--- a/accessible/base/nsAccessibilityService.h
+++ b/accessible/base/nsAccessibilityService.h
@@ -249,17 +249,17 @@ GetAccService()
  * Return true if we're in a content process and not B2G.
  */
 inline bool
 IPCAccessibilityActive()
 {
 #ifdef MOZ_B2G
   return false;
 #else
-  return XRE_GetProcessType() != GeckoProcessType_Default;
+  return XRE_GetProcessType() == GeckoProcessType_Content;
 #endif
 }
 
 /**
  * Map nsIAccessibleEvents constants to strings. Used by
  * nsIAccessibleRetrieval::getStringEventType() method.
  */
 static const char kEventTypeNames[][40] = {

--- a/accessible/windows/msaa/XULListboxAccessibleWrap.cpp
+++ b/accessible/windows/msaa/XULListboxAccessibleWrap.cpp
@@ -10,17 +10,18 @@ using namespace mozilla::a11y;
 ////////////////////////////////////////////////////////////////////////////////
 // XULListboxAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS_INHERITED0(XULListboxAccessibleWrap,
                              XULListboxAccessible)
 
 IMPL_IUNKNOWN_QUERY_HEAD(XULListboxAccessibleWrap)
-IMPL_IUNKNOWN_QUERY_CLASS_COND(ia2AccessibleTable, IsMulticolumn());
+IMPL_IUNKNOWN_QUERY_CLASS_COND(ia2AccessibleTable,
+                               !IsDefunct() && IsMulticolumn());
 IMPL_IUNKNOWN_QUERY_CLASS(AccessibleWrap)
 IMPL_IUNKNOWN_QUERY_TAIL
 
 void
 XULListboxAccessibleWrap::Shutdown()
 {
   ia2AccessibleTable::mTable = nullptr;
   XULListboxAccessible::Shutdown();

--- a/addon-sdk/mach_commands.py
+++ b/addon-sdk/mach_commands.py
@@ -98,17 +98,18 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] != "gonk
                     dir_path = ''
                 else:
                     # Ensure that we don't have things like:
                     #   EXTRA_JS_MODULES.commonjs.sdk.private-browsing
                     # which would be a Python syntax error.
                     path = d.split('/')
                     module_path = ''.join('.' + p if p.find('-') == -1 else "['%s']" % p for p in path)
                     dir_path = d + '/'
-                filelist = ["'source/lib/%s%s'" % (dir_path, f) for f in sorted(files)]
+                filelist = ["'source/lib/%s%s'" % (dir_path, f)
+                            for f in sorted(files, key=lambda x: x.lower())]
                 js_modules.append("EXTRA_JS_MODULES.commonjs%s += [\n    %s,\n]\n"
                                   % (module_path, ',\n    '.join(filelist)))
             stringified = '\n'.join(js_modules)
             # This isn't the same thing as |js_modules|, since |js_modules| had
             # embedded newlines.
             lines = stringified.split('\n')
             # Indent lines while avoiding trailing whitespace.
             lines = [indent + line if line else line for line in lines]

--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -107,25 +107,17 @@ pref("browser.sessionstore.max_tabs_undo
 /* these should help performance */
 pref("mozilla.widget.force-24bpp", true);
 pref("mozilla.widget.use-buffer-pixmap", true);
 pref("mozilla.widget.disable-native-theme", true);
 pref("layout.reflow.synthMouseMove", false);
 pref("layers.enable-tiles", true);
 pref("layers.low-precision-buffer", true);
 pref("layers.low-precision-opacity", "0.5");
-/*
-   Cross Process Mutex is not supported on Mac OS X so progressive
-   paint cannot be enabled for B2G on Mac OS X desktop
-*/
-#ifdef MOZ_WIDGET_COCOA
-pref("layers.progressive-paint", false);
-#else
 pref("layers.progressive-paint", true);
-#endif
 
 /* download manager (don't show the window or alert) */
 pref("browser.download.useDownloadDir", true);
 pref("browser.download.folderList", 1); // Default to ~/Downloads
 pref("browser.download.manager.showAlertOnComplete", false);
 pref("browser.download.manager.showAlertInterval", 2000);
 pref("browser.download.manager.retention", 2);
 pref("browser.download.manager.showWhenStarting", false);

--- a/browser/devtools/debugger/test/browser.ini
+++ b/browser/devtools/debugger/test/browser.ini
@@ -501,47 +501,47 @@ skip-if = e10s || buildapp == 'mulet'
 skip-if = e10s
 [browser_dbg_variables-view-large-array-buffer.js]
 skip-if = e10s
 [browser_dbg_variables-view-override-01.js]
 skip-if = e10s
 [browser_dbg_variables-view-override-02.js]
 skip-if = e10s
 [browser_dbg_variables-view-popup-01.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-02.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-03.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-04.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-05.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-06.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-07.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-08.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-09.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-10.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-11.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-12.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-13.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-14.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-15.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_variables-view-popup-16.js]
-skip-if = e10s
+skip-if = e10s  && debug
 [browser_dbg_variables-view-reexpand-01.js]
 skip-if = e10s
 [browser_dbg_variables-view-reexpand-02.js]
 skip-if = e10s
 [browser_dbg_variables-view-reexpand-03.js]
 skip-if = e10s
 [browser_dbg_variables-view-webidl.js]
 skip-if = e10s

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-01.js
@@ -5,17 +5,17 @@
  * Tests opening the variable inspection popup on a variable which has a
  * simple literal as the value.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     bubble._ignoreLiterals = false;
 
     function verifyContents(textContent, className) {
       is(tooltip.querySelectorAll(".variables-view-container").length, 0,
@@ -24,18 +24,17 @@ function test() {
         "There should be a simple text node added to the tooltip instead.");
 
       is(tooltip.querySelector(".devtools-tooltip-simple-text").textContent, textContent,
         "The inspected property's value is correct.");
       ok(tooltip.querySelector(".devtools-tooltip-simple-text").className.contains(className),
         "The inspected property's value is colorized correctly.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Inspect variables.
     yield openVarPopup(panel, { line: 15, ch: 12 });
     verifyContents("1", "token-number");
 
     yield reopenVarPopup(panel, { line: 16, ch: 21 });
     verifyContents("1", "token-number");

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-02.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-02.js
@@ -5,35 +5,34 @@
  * Tests opening the variable inspection popup on a variable which has a
  * a property accessible via getters and setters.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     function verifyContents(textContent, className) {
       is(tooltip.querySelectorAll(".variables-view-container").length, 0,
         "There should be no variables view containers added to the tooltip.");
       is(tooltip.querySelectorAll(".devtools-tooltip-simple-text").length, 1,
         "There should be a simple text node added to the tooltip instead.");
 
       is(tooltip.querySelector(".devtools-tooltip-simple-text").textContent, textContent,
         "The inspected property's value is correct.");
       ok(tooltip.querySelector(".devtools-tooltip-simple-text").className.contains(className),
         "The inspected property's value is colorized correctly.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Inspect properties.
     yield openVarPopup(panel, { line: 19, ch: 10 });
     verifyContents("42", "token-number");
 
     yield reopenVarPopup(panel, { line: 20, ch: 14 });
     verifyContents("42", "token-number");

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-03.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-03.js
@@ -4,22 +4,21 @@
 /**
  * Tests that the inspected indentifier is highlighted.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Inspect variable.
     yield openVarPopup(panel, { line: 15, ch: 12 });
 
     ok(bubble.contentsShown(),
       "The variable should register as being shown.");
     ok(!bubble._tooltip.isEmpty(),

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-04.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-04.js
@@ -4,22 +4,21 @@
 /**
  * Tests that the variable inspection popup is hidden when the editor scrolls.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Inspect variable.
     yield openVarPopup(panel, { line: 15, ch: 12 });
     yield hideVarPopupByScrollingEditor(panel);
     ok(true, "The variable inspection popup was hidden.");
 
     ok(bubble._tooltip.isEmpty(),

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-05.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-05.js
@@ -5,17 +5,17 @@
  * Tests opening the variable inspection popup on a variable which has a
  * simple object as the value.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     function verifyContents() {
       is(tooltip.querySelectorAll(".variables-view-container").length, 1,
         "There should be one variables view container added to the tooltip.");
 
@@ -33,18 +33,17 @@ function test() {
         "The first property's value is correct.");
 
       is(tooltip.querySelectorAll(".variables-view-property .name")[1].getAttribute("value"), "__proto__",
         "The second property's name is correct.");
       is(tooltip.querySelectorAll(".variables-view-property .value")[1].getAttribute("value"), "Object",
         "The second property's value is correct.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Inspect variable.
     yield openVarPopup(panel, { line: 16, ch: 12 }, true);
     verifyContents();
 
     yield resumeDebuggerThenCloseAndFinish(panel);
   });

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-06.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-06.js
@@ -6,17 +6,17 @@
  * complext object as the value.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   requestLongerTimeout(2);
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     function verifyContents() {
       is(tooltip.querySelectorAll(".variables-view-container").length, 1,
         "There should be one variables view container added to the tooltip.");
 
@@ -59,18 +59,17 @@ function test() {
         "The sixth property's value is correct.");
 
       is(tooltip.querySelectorAll(".variables-view-property .name")[6].getAttribute("value"), "__proto__",
         "The seventh property's name is correct.");
       is(tooltip.querySelectorAll(".variables-view-property .value")[6].getAttribute("value"), "Object",
         "The seventh property's value is correct.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Inspect variable.
     yield openVarPopup(panel, { line: 17, ch: 12 }, true);
     verifyContents();
 
     yield resumeDebuggerThenCloseAndFinish(panel);
   });

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-07.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-07.js
@@ -5,17 +5,17 @@
  * Tests the variable inspection popup behaves correctly when switching
  * between simple and complex objects.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     function verifySimpleContents(textContent, className) {
       is(tooltip.querySelectorAll(".variables-view-container").length, 0,
         "There should be no variables view container added to the tooltip.");
       is(tooltip.querySelectorAll(".devtools-tooltip-simple-text").length, 1,
@@ -37,18 +37,17 @@ function test() {
         "There should be one scope with no header displayed.");
       is(tooltip.querySelectorAll(".variables-view-variable[untitled]").length, 1,
         "There should be one variable with no header displayed.");
 
       ok(tooltip.querySelectorAll(".variables-view-property").length >= propertyCount,
         "There should be some properties displayed.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Inspect variables.
     yield openVarPopup(panel, { line: 15, ch: 12 });
     verifySimpleContents("1", "token-number");
 
     yield reopenVarPopup(panel, { line: 16, ch: 12 }, true);
     verifyComplexContents(2);

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-08.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-08.js
@@ -4,17 +4,17 @@
 /**
  * Tests opening inspecting variables works across scopes.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_scope-variable.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let events = win.EVENTS;
     let editor = win.DebuggerView.editor;
     let frames = win.DebuggerView.StackFrames;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     function verifyContents(textContent, className) {
@@ -35,18 +35,17 @@ function test() {
       is(frames.itemCount, 2,
         "Should have two frames.");
       is(frames.selectedDepth, selectedFrame,
         "The correct frame is selected in the widget.");
       ok(isCaretPos(panel, caretLine),
         "Editor caret location is correct.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.test());
+    callInTab(tab, "test");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 20);
     checkView(0, 20);
 
     // Inspect variable in topmost frame.
     yield openVarPopup(panel, { line: 18, ch: 12 });
     verifyContents("\"second scope\"", "token-string");
     checkView(0, 20);
 

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-09.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-09.js
@@ -4,23 +4,22 @@
 /**
  * Tests opening inspecting variables works across scopes.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_scope-variable-3.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.test());
+    callInTab(tab, "test");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 15);
 
     yield openVarPopup(panel, { line: 12, ch: 10 });
     ok(true, "The variable inspection popup was shown for the real variable.");
 
     once(tooltip, "popupshown").then(() => {
       ok(false, "The variable inspection popup shouldn't have been opened.");
     });

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-10.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-10.js
@@ -6,27 +6,26 @@
  * a variable inspection popup is opened and a watch expression is
  * also evaluated at the same time.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let events = win.EVENTS;
     let editor = win.DebuggerView.editor;
     let editorContainer = win.document.getElementById("editor");
     let bubble = win.DebuggerView.VariableBubble;
     let expressions = win.DebuggerView.WatchExpressions;
     let tooltip = bubble._tooltip.panel;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     let expressionsEvaluated = waitForDebuggerEvents(panel, events.FETCHED_WATCH_EXPRESSIONS);
     expressions.addExpression("this");
     editor.focus();
     yield expressionsEvaluated;
 
     // Scroll to the top of the editor and inspect variables.

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-11.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-11.js
@@ -4,17 +4,17 @@
 /**
  * Tests that the watch expression button is added in variable view popup.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_watch-expression-button.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let events = win.EVENTS;
     let watch = win.DebuggerView.WatchExpressions;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     let label = win.L10N.getStr("addWatchExpressionButton");
     let className = "dbg-expression-button";
@@ -32,18 +32,17 @@ function test() {
       ok(!tooltip.querySelector("button"),
         "There should be no button available in variable view popup.");
       ok(watch.getItemAtIndex(0),
         "The expression at index 0 should be available.");
       is(watch.getItemAtIndex(0).attachment.initialExpression, aExpression,
         "The expression at index 0 is correct.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 19);
 
     // Inspect primitive value variable.
     yield openVarPopup(panel, { line: 15, ch: 12 });
     let popupHiding = once(tooltip, "popuphiding");
     let expressionsEvaluated = waitForDebuggerEvents(panel, events.FETCHED_WATCH_EXPRESSIONS);
     testExpressionButton(label, className, "a");
     yield promise.all([popupHiding, expressionsEvaluated]);

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-12.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-12.js
@@ -5,35 +5,34 @@
  * Tests that the clicking "Watch" button twice, for the same expression, only adds it
  * once.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_watch-expression-button.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let events = win.EVENTS;
     let watch = win.DebuggerView.WatchExpressions;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
     function verifyContent(aExpression, aItemCount) {
 
       ok(watch.getItemAtIndex(0),
         "The expression at index 0 should be available.");
       is(watch.getItemAtIndex(0).attachment.initialExpression, aExpression,
         "The expression at index 0 is correct.");
       is(watch.itemCount, aItemCount,
         "The expression count is correct.");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 19);
 
     // Inspect primitive value variable.
     yield openVarPopup(panel, { line: 15, ch: 12 });
     let popupHiding = once(tooltip, "popuphiding");
     let expressionsEvaluated = waitForDebuggerEvents(panel, events.FETCHED_WATCH_EXPRESSIONS);
     tooltip.querySelector("button").click();
     verifyContent("a", 1);

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-13.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-13.js
@@ -5,17 +5,17 @@
  * Tests that the variable inspection popup has inspector links for DOMNode
  * properties and that the popup closes when the link is clicked
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_domnode-variables.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
     let toolbox = gDevTools.getToolbox(panel.target);
 
     function getDomNodeInTooltip(propertyName) {
       let domNodeProperties = tooltip.querySelectorAll(".token-domnode");
       for (let prop of domNodeProperties) {
@@ -23,18 +23,17 @@ function test() {
         if (propName.getAttribute("value") === propertyName) {
           ok(true, "DOMNode " + propertyName + " was found in the tooltip");
           return prop;
         }
       }
       ok(false, "DOMNode " + propertyName + " wasn't found in the tooltip");
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 19);
 
     // Inspect the div DOM variable.
     yield openVarPopup(panel, { line: 17, ch: 38 }, true);
     let property = getDomNodeInTooltip("firstElementChild");
 
     // Simulate mouseover on the property value
     let highlighted = once(toolbox, "node-highlight");

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-14.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-14.js
@@ -5,22 +5,21 @@
  * Tests that the variable inspection popup is hidden when
  * selecting text in the editor.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function*() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     // Select some text.
     let cursor = win.DebuggerView.editor.getOffset({ line: 15, ch: 12 });
     let [ anchor, head ] = win.DebuggerView.editor.getPosition(
       cursor,
       cursor + 3
     );

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-15.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-15.js
@@ -4,23 +4,22 @@
 /**
  * Tests opening the variable inspection popup directly on literals.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_frame-parameters.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.start());
+    callInTab(tab, "start");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 24);
 
     yield openVarPopup(panel, { line: 15, ch: 12 });
     ok(true, "The variable inspection popup was shown for the real variable.");
 
     once(tooltip, "popupshown").then(() => {
       ok(false, "The variable inspection popup shouldn't have been opened.");
     });

--- a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-16.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-16.js
@@ -5,17 +5,17 @@
  * Tests if opening the variables inspection popup preserves the highlighting
  * associated with the currently debugged line.
  */
 
 const TAB_URL = EXAMPLE_URL + "doc_recursion-stack.html";
 
 function test() {
   Task.spawn(function() {
-    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let [tab,, panel] = yield initDebugger(TAB_URL);
     let win = panel.panelWin;
     let events = win.EVENTS;
     let editor = win.DebuggerView.editor;
     let frames = win.DebuggerView.StackFrames;
     let variables = win.DebuggerView.Variables;
     let bubble = win.DebuggerView.VariableBubble;
     let tooltip = bubble._tooltip.panel;
 
@@ -46,18 +46,17 @@ function test() {
       is(globalScope.expanded, false,
         "The globalScope should not be expanded yet.");
 
       let finished = waitForDebuggerEvents(panel, events.FETCHED_VARIABLES);
       globalScope.expand();
       return finished;
     }
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.recurse());
+    callInTab(tab, "recurse");
     yield waitForSourceAndCaretAndScopes(panel, ".html", 26);
     yield checkView(0, 26);
 
     yield expandGlobalScope();
     yield checkView(0, 26);
 
     // Inspect variable in topmost frame.
     yield openVarPopup(panel, { line: 26, ch: 11 });

--- a/dom/base/DOMException.cpp
+++ b/dom/base/DOMException.cpp
@@ -153,16 +153,18 @@ NS_GetNameAndMessageForDOMNSResult(nsres
 namespace mozilla {
 namespace dom {
 
 bool Exception::sEverMadeOneFromFactory = false;
 
 NS_IMPL_CLASSINFO(Exception, nullptr, nsIClassInfo::DOM_OBJECT,
                   NS_XPCEXCEPTION_CID)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(Exception)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(Exception)
   NS_INTERFACE_MAP_ENTRY(nsIException)
   NS_INTERFACE_MAP_ENTRY(nsIXPCException)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIException)
   NS_IMPL_QUERY_CLASSINFO(Exception)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(Exception)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(Exception)

--- a/dom/media/MediaPermissionGonk.cpp
+++ b/dom/media/MediaPermissionGonk.cpp
@@ -391,20 +391,19 @@ private:
 };
 
 NS_IMPL_ISUPPORTS(MediaDeviceErrorCallback, nsIDOMGetUserMediaErrorCallback)
 
 // nsIDOMGetUserMediaErrorCallback method
 NS_IMETHODIMP
 MediaDeviceErrorCallback::OnError(nsISupports* aError)
 {
-  MediaStreamError *error = nullptr;
-  nsresult rv = CallQueryInterface(aError, &error);
-  if (NS_FAILED(rv)) {
-    return rv;
+  nsRefPtr<MediaStreamError> error = do_QueryObject(aError);
+  if (!error) {
+    return NS_ERROR_NO_INTERFACE;
   }
 
   nsString name;
   error->GetName(name);
   return NotifyPermissionDeny(mCallID, name);
 }
 
 } // namespace anonymous

--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@@ -830,23 +830,28 @@ RTCPeerConnection.prototype = {
       this.logWarning(
           "addIceCandidate called without success/failure callbacks. This is deprecated, and will be an error in the future.",
           null, 0);
     }
     if (!cand.candidate && !cand.sdpMLineIndex) {
       throw new this._win.DOMError("",
           "Invalid candidate passed to addIceCandidate!");
     }
+
+    this._queueOrRun({
+      func: this._addIceCandidate,
+      args: [cand, onSuccess, onError],
+      wait: false
+    });
+  },
+
+  _addIceCandidate: function(cand, onSuccess, onError) {
     this._onAddIceCandidateSuccess = onSuccess || null;
     this._onAddIceCandidateError = onError || null;
 
-    this._queueOrRun({ func: this._addIceCandidate, args: [cand], wait: false });
-  },
-
-  _addIceCandidate: function(cand) {
     this._impl.addIceCandidate(cand.candidate, cand.sdpMid || "",
                                (cand.sdpMLineIndex === null) ? 0 :
                                  cand.sdpMLineIndex + 1);
   },
 
   addStream: function(stream) {
     stream.getTracks().forEach(track => this.addTrack(track, stream));
   },

--- a/dom/webidl/WorkerGlobalScope.webidl
+++ b/dom/webidl/WorkerGlobalScope.webidl
@@ -45,10 +45,11 @@ WorkerGlobalScope implements GlobalFetch
 
 // Mozilla extensions
 partial interface WorkerGlobalScope {
   attribute EventHandler onclose;
 
   void dump(optional DOMString str);
 
   // XXXbz no spec for this yet, because the webperf WG is a bit dysfunctional
+  [Constant, Cached]
   readonly attribute Performance performance;
 };

--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -3043,31 +3043,31 @@ ScrollableLayerGuid AsyncPanZoomControll
 
 void AsyncPanZoomController::UpdateSharedCompositorFrameMetrics()
 {
   mMonitor.AssertCurrentThreadIn();
 
   FrameMetrics* frame = mSharedFrameMetricsBuffer ?
       static_cast<FrameMetrics*>(mSharedFrameMetricsBuffer->memory()) : nullptr;
 
-  if (frame && mSharedLock && gfxPrefs::UseProgressiveTilePainting()) {
+  if (frame && mSharedLock && gfxPlatform::GetPlatform()->UseProgressivePaint()) {
     mSharedLock->Lock();
     *frame = mFrameMetrics.MakePODObject();
     mSharedLock->Unlock();
   }
 }
 
 void AsyncPanZoomController::ShareCompositorFrameMetrics() {
 
   PCompositorParent* compositor = GetSharedFrameMetricsCompositor();
 
   // Only create the shared memory buffer if it hasn't already been created,
   // we are using progressive tile painting, and we have a
   // compositor to pass the shared memory back to the content process/thread.
-  if (!mSharedFrameMetricsBuffer && compositor && gfxPrefs::UseProgressiveTilePainting()) {
+  if (!mSharedFrameMetricsBuffer && compositor && gfxPlatform::GetPlatform()->UseProgressivePaint()) {
 
     // Create shared memory and initialize it with the current FrameMetrics value
     mSharedFrameMetricsBuffer = new ipc::SharedMemoryBasic;
     FrameMetrics* frame = nullptr;
     mSharedFrameMetricsBuffer->Create(sizeof(FrameMetrics));
     mSharedFrameMetricsBuffer->Map(sizeof(FrameMetrics));
     frame = static_cast<FrameMetrics*>(mSharedFrameMetricsBuffer->memory());
 

--- a/gfx/layers/client/ClientTiledPaintedLayer.cpp
+++ b/gfx/layers/client/ClientTiledPaintedLayer.cpp
@@ -188,17 +188,17 @@ ClientTiledPaintedLayer::UseFastPath()
 {
   LayerMetricsWrapper scrollAncestor;
   GetAncestorLayers(&scrollAncestor, nullptr);
   if (!scrollAncestor) {
     return true;
   }
   const FrameMetrics& parentMetrics = scrollAncestor.Metrics();
 
-  bool multipleTransactionsNeeded = gfxPrefs::UseProgressiveTilePainting()
+  bool multipleTransactionsNeeded = gfxPlatform::GetPlatform()->UseProgressivePaint()
                                  || gfxPrefs::UseLowPrecisionBuffer()
                                  || !parentMetrics.mCriticalDisplayPort.IsEmpty();
   bool isFixed = GetIsFixedPosition() || GetParent()->GetIsFixedPosition();
   return !multipleTransactionsNeeded || isFixed || parentMetrics.mDisplayPort.IsEmpty();
 }
 
 bool
 ClientTiledPaintedLayer::RenderHighPrecision(nsIntRegion& aInvalidRegion,
@@ -209,17 +209,17 @@ ClientTiledPaintedLayer::RenderHighPreci
   // If we have no high-precision stuff to draw, or we have started drawing low-precision
   // already, then we shouldn't do anything there.
   if (aInvalidRegion.IsEmpty() || mPaintData.mLowPrecisionPaintCount != 0) {
     return false;
   }
 
   // Only draw progressively when the resolution is unchanged, and we're not
   // in a reftest scenario (that's what the HasShadowManager() check is for).
-  if (gfxPrefs::UseProgressiveTilePainting() &&
+  if (gfxPlatform::GetPlatform()->UseProgressivePaint() &&
       !ClientManager()->HasShadowTarget() &&
       mContentClient->mTiledBuffer.GetFrameResolution() == mPaintData.mResolution) {
     // Store the old valid region, then clear it before painting.
     // We clip the old valid region to the visible region, as it only gets
     // used to decide stale content (currently valid and previously visible)
     nsIntRegion oldValidRegion = mContentClient->mTiledBuffer.GetValidRegion();
     oldValidRegion.And(oldValidRegion, aVisibleRegion);
     if (!mPaintData.mCriticalDisplayPort.IsEmpty()) {

--- a/gfx/layers/composite/LayerManagerComposite.cpp
+++ b/gfx/layers/composite/LayerManagerComposite.cpp
@@ -871,17 +871,17 @@ GetDisplayportCoverage(const CSSRect& aD
 }
 #endif // MOZ_WIDGET_ANDROID
 
 float
 LayerManagerComposite::ComputeRenderIntegrity()
 {
   // We only ever have incomplete rendering when progressive tiles are enabled.
   Layer* root = GetRoot();
-  if (!gfxPrefs::UseProgressiveTilePainting() || !root) {
+  if (!gfxPlatform::GetPlatform()->UseProgressivePaint() || !root) {
     return 1.f;
   }
 
   FrameMetrics rootMetrics = LayerMetricsWrapper::TopmostScrollableMetrics(root);
   if (!rootMetrics.IsScrollable()) {
     // The root may not have any scrollable metrics, in which case rootMetrics
     // will just be an empty FrameMetrics. Instead use the actual metrics from
     // the root layer.

--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -258,19 +258,20 @@ public:
 
     bool SupportsAzureContentForType(mozilla::gfx::BackendType aType) {
       return BackendTypeBit(aType) & mContentBackendBitmask;
     }
 
     virtual bool UseAcceleratedSkiaCanvas();
     virtual void InitializeSkiaCacheLimits();
 
-    /// This should be used instead of directly accessing the preference,
+    /// These should be used instead of directly accessing the preference,
     /// as different platforms may override the behaviour.
     virtual bool UseTiling() { return gfxPrefs::LayersTilesEnabledDoNotUseDirectly(); }
+    virtual bool UseProgressivePaint() { return gfxPrefs::ProgressivePaintDoNotUseDirectly(); }
 
     void GetAzureBackendInfo(mozilla::widget::InfoObject &aObj) {
       aObj.DefineProperty("AzureCanvasBackend", GetBackendName(mPreferredCanvasBackend));
       aObj.DefineProperty("AzureSkiaAccelerated", UseAcceleratedSkiaCanvas());
       aObj.DefineProperty("AzureFallbackCanvasBackend", GetBackendName(mFallbackCanvasBackend));
       aObj.DefineProperty("AzureContentBackend", GetBackendName(mContentBackend));
     }
 

--- a/gfx/thebes/gfxPlatformMac.cpp
+++ b/gfx/thebes/gfxPlatformMac.cpp
@@ -406,16 +406,24 @@ gfxPlatformMac::UseTiling()
 {
   if (gfxPrefs::LayersTilesForceEnabled()) {
     return true;
   }
   // Tiling seems to be slow on 10.6 so disable it until we figure it out
   return nsCocoaFeatures::OnLionOrLater() && gfxPlatform::UseTiling();
 }
 
+bool
+gfxPlatformMac::UseProgressivePaint()
+{
+  // Progressive painting requires cross-process mutexes, which don't work so
+  // well on OS X 10.6 so we disable there.
+  return nsCocoaFeatures::OnLionOrLater() && gfxPlatform::UseProgressivePaint();
+}
+
 void
 gfxPlatformMac::GetPlatformCMSOutputProfile(void* &mem, size_t &size)
 {
     mem = nullptr;
     size = 0;
 
     CGColorSpaceRef cspace = ::CGDisplayCopyColorSpace(::CGMainDisplayID());
     if (!cspace) {

--- a/gfx/thebes/gfxPlatformMac.h
+++ b/gfx/thebes/gfxPlatformMac.h
@@ -66,16 +66,17 @@ public:
 
     virtual bool CanRenderContentToDataSurface() const MOZ_OVERRIDE {
       return true;
     }
 
     bool UseAcceleratedCanvas();
 
     virtual bool UseTiling() MOZ_OVERRIDE;
+    virtual bool UseProgressivePaint() MOZ_OVERRIDE;
 
     // lower threshold on font anti-aliasing
     uint32_t GetAntiAliasingThreshold() { return mFontAntiAliasingThreshold; }
 
 private:
     virtual void GetPlatformCMSOutputProfile(void* &mem, size_t &size);
 
     // read in the pref value for the lower threshold on font anti-aliasing

--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -288,17 +288,17 @@ private:
   DECL_GFX_PREF(Once, "layers.offmainthreadcomposition.enabled", LayersOffMainThreadCompositionEnabled, bool, false);
   DECL_GFX_PREF(Live, "layers.offmainthreadcomposition.frame-rate", LayersCompositionFrameRate, int32_t,-1);
   DECL_GFX_PREF(Once, "layers.offmainthreadcomposition.force-enabled", LayersOffMainThreadCompositionForceEnabled, bool, false);
   DECL_GFX_PREF(Once, "layers.offmainthreadcomposition.testing.enabled", LayersOffMainThreadCompositionTestingEnabled, bool, false);
   DECL_GFX_PREF(Once, "layers.use-image-offscreen-surfaces",   UseImageOffscreenSurfaces, bool, false);
   DECL_GFX_PREF(Live, "layers.orientation.sync.timeout",       OrientationSyncMillis, uint32_t, (uint32_t)0);
   DECL_GFX_PREF(Once, "layers.prefer-d3d9",                    LayersPreferD3D9, bool, false);
   DECL_GFX_PREF(Once, "layers.prefer-opengl",                  LayersPreferOpenGL, bool, false);
-  DECL_GFX_PREF(Once, "layers.progressive-paint",              UseProgressiveTilePainting, bool, false);
+  DECL_GFX_PREF(Once, "layers.progressive-paint",              ProgressivePaintDoNotUseDirectly, bool, false);
   DECL_GFX_PREF(Once, "layers.uniformity-info",                UniformityInfo, bool, false);
   DECL_GFX_PREF(Once, "layers.gralloc.disable",                DisableGralloc, bool, false);
 
   DECL_GFX_PREF(Live, "layout.css.scroll-behavior.damping-ratio", ScrollBehaviorDampingRatio, float, 1.0f);
   DECL_GFX_PREF(Live, "layout.css.scroll-behavior.enabled",    ScrollBehaviorEnabled, bool, false);
   DECL_GFX_PREF(Live, "layout.css.scroll-behavior.spring-constant", ScrollBehaviorSpringConstant, float, 250.0f);
   DECL_GFX_PREF(Once, "layout.css.touch_action.enabled",       TouchActionEnabled, bool, false);
   DECL_GFX_PREF(Once, "layout.frame_rate",                     LayoutFrameRate, int32_t, -1);

--- a/ipc/glue/CrossProcessMutex.h
+++ b/ipc/glue/CrossProcessMutex.h
@@ -4,17 +4,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_CrossProcessMutex_h
 #define mozilla_CrossProcessMutex_h
 
 #include "base/process.h"
 #include "mozilla/Mutex.h"
 
-#if defined(OS_LINUX)
+#if defined(OS_POSIX)
 #include <pthread.h>
 #include "SharedMemoryBasic.h"
 #include "mozilla/Atomics.h"
 #include "nsAutoPtr.h"
 #endif
 
 namespace IPC {
 template<typename T>
@@ -27,19 +27,19 @@ struct ParamTraits;
 //  - CrossProcessMutex, a non-recursive mutex that can be shared across processes
 //  - CrossProcessMutexAutoLock, an RAII class for ensuring that Mutexes are
 //    properly locked and unlocked
 //
 // Using CrossProcessMutexAutoLock/CrossProcessMutexAutoUnlock is MUCH
 // preferred to making bare calls to CrossProcessMutex.Lock and Unlock.
 //
 namespace mozilla {
-#ifdef XP_WIN
+#if defined(OS_WIN)
 typedef HANDLE CrossProcessMutexHandle;
-#elif defined(OS_LINUX)
+#elif defined(OS_POSIX)
 typedef mozilla::ipc::SharedMemoryBasic::Handle CrossProcessMutexHandle;
 #else
 // Stub for other platforms. We can't use uintptr_t here since different
 // processes could disagree on its size.
 typedef uintptr_t CrossProcessMutexHandle;
 #endif
 
 class CrossProcessMutex
@@ -93,19 +93,19 @@ public:
 
 private:
   friend struct IPC::ParamTraits<CrossProcessMutex>;
 
   CrossProcessMutex();
   CrossProcessMutex(const CrossProcessMutex&);
   CrossProcessMutex &operator=(const CrossProcessMutex&);
 
-#ifdef XP_WIN
+#if defined(OS_WIN)
   HANDLE mMutex;
-#elif defined(OS_LINUX)
+#elif defined(OS_POSIX)
   nsRefPtr<mozilla::ipc::SharedMemoryBasic> mSharedBuffer;
   pthread_mutex_t* mMutex;
   mozilla::Atomic<int32_t>* mCount;
 #endif
 };
 
 typedef BaseAutoLock<CrossProcessMutex> CrossProcessMutexAutoLock;
 typedef BaseAutoUnlock<CrossProcessMutex> CrossProcessMutexAutoUnlock;

--- a/ipc/glue/CrossProcessMutex_posix.cpp
+++ b/ipc/glue/CrossProcessMutex_posix.cpp
@@ -3,16 +3,20 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "CrossProcessMutex.h"
 #include "mozilla/unused.h"
 #include "nsDebug.h"
 #include "nsISupportsImpl.h"
 
+#ifdef OS_MACOSX
+#include "nsCocoaFeatures.h"
+#endif
+
 namespace {
 
 struct MutexData {
   pthread_mutex_t mMutex;
   mozilla::Atomic<int32_t> mCount;
 };
 
 }
@@ -36,16 +40,25 @@ InitMutex(pthread_mutex_t* mMutex)
     MOZ_CRASH();
   }
 }
 
 CrossProcessMutex::CrossProcessMutex(const char*)
     : mMutex(nullptr)
     , mCount(nullptr)
 {
+#ifdef OS_MACOSX
+  if (!nsCocoaFeatures::OnLionOrLater()) {
+    // Don't allow using the cross-process mutex before OS X 10.7 because it
+    // probably doesn't work very well. See discussion in bug 1072093 for more
+    // details.
+    MOZ_CRASH();
+  }
+#endif
+
   mSharedBuffer = new ipc::SharedMemoryBasic;
   if (!mSharedBuffer->Create(sizeof(MutexData))) {
     MOZ_CRASH();
   }
 
   if (!mSharedBuffer->Map(sizeof(MutexData))) {
     MOZ_CRASH();
   }

--- a/ipc/glue/moz.build
+++ b/ipc/glue/moz.build
@@ -54,17 +54,17 @@ else:
         'SharedMemory_posix.cpp',
         'Transport_posix.cpp',
     ]
 
 if CONFIG['OS_ARCH'] == 'WINNT':
     SOURCES += [
         'CrossProcessMutex_windows.cpp',
     ]
-elif CONFIG['OS_ARCH'] == 'Linux':
+elif CONFIG['OS_ARCH'] in ('Linux', 'Darwin'):
     UNIFIED_SOURCES += [
         'CrossProcessMutex_posix.cpp',
     ]
 else:
     UNIFIED_SOURCES += [
         'CrossProcessMutex_unimplemented.cpp',
     ]
 

--- a/js/src/asmjs/AsmJSValidate.cpp
+++ b/js/src/asmjs/AsmJSValidate.cpp
@@ -8387,16 +8387,17 @@ GenerateAsyncInterruptExit(ModuleCompile
     // This will restore stack to the address before the call.
     masm.movePtr(s0, StackPointer);
     masm.PopRegsInMask(AllRegsExceptSP);
 
     // Pop resumePC into PC. Clobber HeapReg to make the jump and restore it
     // during jump delay slot.
     masm.pop(HeapReg);
     masm.as_jr(HeapReg);
+    masm.loadAsmJSHeapRegisterFromGlobalData();
 #elif defined(JS_CODEGEN_ARM)
     masm.setFramePushed(0);         // set to zero so we can use masm.framePushed() below
     masm.PushRegsInMask(RegisterSet(GeneralRegisterSet(Registers::AllMask & ~(1<<Registers::sp)), FloatRegisterSet(uint32_t(0))));   // save all GP registers,excep sp
 
     // Save both the APSR and FPSCR in non-volatile registers.
     masm.as_mrs(r4);
     masm.as_vmrs(r5);
     // Save the stack pointer in a non-volatile register.

--- a/js/src/builtin/Eval.cpp
+++ b/js/src/builtin/Eval.cpp
@@ -7,16 +7,17 @@
 #include "builtin/Eval.h"
 
 #include "mozilla/HashFunctions.h"
 #include "mozilla/Range.h"
 
 #include "jscntxt.h"
 
 #include "frontend/BytecodeCompiler.h"
+#include "vm/Debugger.h"
 #include "vm/GlobalObject.h"
 #include "vm/JSONParser.h"
 
 #include "vm/Interpreter-inl.h"
 
 using namespace js;
 
 using mozilla::AddToHash;
@@ -475,16 +476,19 @@ js::ExecuteInGlobalAndReturnScope(JSCont
     assertSameCompartment(cx, global);
     MOZ_ASSERT(global->is<GlobalObject>());
 
     RootedScript script(cx, scriptArg);
     if (script->compartment() != cx->compartment()) {
         script = CloneScript(cx, NullPtr(), NullPtr(), script);
         if (!script)
             return false;
+
+        Rooted<GlobalObject *> global(cx, script->compileAndGo() ? &script->global() : nullptr);
+        Debugger::onNewScript(cx, script, global);
     }
 
     RootedObject scope(cx, JS_NewObject(cx, nullptr, JS::NullPtr(), JS::NullPtr()));
     if (!scope)
         return false;
 
     if (!scope->setQualifiedVarObj(cx))
         return false;

--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -2012,17 +2012,18 @@ FindPath(JSContext *cx, unsigned argc, j
 }
 
 static bool
 EvalReturningScope(JSContext *cx, unsigned argc, jsval *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
     RootedString str(cx);
-    if (!JS_ConvertArguments(cx, args, "S", str.address()))
+    RootedObject global(cx);
+    if (!JS_ConvertArguments(cx, args, "S/o", str.address(), global.address()))
         return false;
 
     AutoStableStringChars strChars(cx);
     if (!strChars.initTwoByte(cx, str))
         return false;
 
     mozilla::Range<const char16_t> chars = strChars.twoByteRange();
     size_t srclen = chars.length();
@@ -2038,26 +2039,102 @@ EvalReturningScope(JSContext *cx, unsign
     options.setNoScriptRval(true);
     options.setCompileAndGo(false);
 
     JS::SourceBufferHolder srcBuf(src, srclen, JS::SourceBufferHolder::NoOwnership);
     RootedScript script(cx);
     if (!JS::Compile(cx, JS::NullPtr(), options, srcBuf, &script))
         return false;
 
-    RootedObject global(cx, JS::CurrentGlobalOrNull(cx));
+    if (global) {
+        global = CheckedUnwrap(global);
+        if (!global) {
+            JS_ReportError(cx, "Permission denied to access global");
+            return false;
+        }
+        if (!global->is<GlobalObject>()) {
+            JS_ReportError(cx, "Argument must be a global object");
+            return false;
+        }
+    } else {
+        global = JS::CurrentGlobalOrNull(cx);
+    }
+
     RootedObject scope(cx);
-    if (!js::ExecuteInGlobalAndReturnScope(cx, global, script, &scope))
+
+    {
+        // If we're switching globals here, ExecuteInGlobalAndReturnScope will
+        // take care of cloning the script into that compartment before
+        // executing it.
+        AutoCompartment ac(cx, global);
+
+        if (!js::ExecuteInGlobalAndReturnScope(cx, global, script, &scope))
+            return false;
+    }
+
+    if (!cx->compartment()->wrap(cx, &scope))
         return false;
 
     args.rval().setObject(*scope);
     return true;
 }
 
 static bool
+ShellCloneAndExecuteScript(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    RootedString str(cx);
+    RootedObject global(cx);
+    if (!JS_ConvertArguments(cx, args, "So", str.address(), global.address()))
+        return false;
+
+    AutoStableStringChars strChars(cx);
+    if (!strChars.initTwoByte(cx, str))
+        return false;
+
+    mozilla::Range<const char16_t> chars = strChars.twoByteRange();
+    size_t srclen = chars.length();
+    const char16_t *src = chars.start().get();
+
+    JS::AutoFilename filename;
+    unsigned lineno;
+
+    DescribeScriptedCaller(cx, &filename, &lineno);
+
+    JS::CompileOptions options(cx);
+    options.setFileAndLine(filename.get(), lineno);
+    options.setNoScriptRval(true);
+    options.setCompileAndGo(false);
+
+    JS::SourceBufferHolder srcBuf(src, srclen, JS::SourceBufferHolder::NoOwnership);
+    RootedScript script(cx);
+    if (!JS::Compile(cx, JS::NullPtr(), options, srcBuf, &script))
+        return false;
+
+    global = CheckedUnwrap(global);
+    if (!global) {
+        JS_ReportError(cx, "Permission denied to access global");
+        return false;
+    }
+    if (!global->is<GlobalObject>()) {
+        JS_ReportError(cx, "Argument must be a global object");
+        return false;
+    }
+
+    AutoCompartment ac(cx, global);
+
+    if (!JS::CloneAndExecuteScript(cx, global, script))
+        return false;
+
+    args.rval().setUndefined();
+    return true;
+}
+
+static bool
 IsSimdAvailable(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 #ifdef JS_CODEGEN_NONE
     bool available = false;
 #else
     bool available = cx->jitSupportsSimd();
 #endif
@@ -2394,18 +2471,24 @@ gc::ZealModeHelpText),
 #ifdef NIGHTLY_BUILD
     JS_FN_HELP("objectAddress", ObjectAddress, 1, 0,
 "objectAddress(obj)",
 "  Return the current address of the object. For debugging only--this\n"
 "  address may change during a moving GC."),
 #endif
 
     JS_FN_HELP("evalReturningScope", EvalReturningScope, 1, 0,
-"evalReturningScope(scriptStr)",
-"  Evaluate the script in a new scope and return the scope."),
+"evalReturningScope(scriptStr, [global])",
+"  Evaluate the script in a new scope and return the scope.\n"
+"  If |global| is present, clone the script to |global| before executing."),
+
+    JS_FN_HELP("cloneAndExecuteScript", ShellCloneAndExecuteScript, 2, 0,
+"cloneAndExecuteScript(source, global)",
+"  Compile |source| in the current compartment, clone it into |global|'s\n"
+"  compartment, and run it there."),
 
     JS_FN_HELP("backtrace", DumpBacktrace, 1, 0,
 "backtrace()",
 "  Dump out a brief backtrace."),
 
     JS_FN_HELP("getBacktrace", GetBacktrace, 1, 0,
 "getBacktrace([options])",
 "  Return the current stack as a string. Takes an optional options object,\n"

--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -500,57 +500,39 @@ CreatePrototypeObjectForComplexTypeInsta
                                             TenuredObject);
     if (!result)
         return nullptr;
 
     result->initTypeDescrSlot(*descr);
     return result;
 }
 
-const Class UnsizedArrayTypeDescr::class_ = {
+const Class ArrayTypeDescr::class_ = {
     "ArrayType",
     JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS),
     JS_PropertyStub,
     JS_DeletePropertyStub,
     JS_PropertyStub,
     JS_StrictPropertyStub,
     JS_EnumerateStub,
     JS_ResolveStub,
     JS_ConvertStub,
     nullptr,
     nullptr,
     nullptr,
-    OutlineTypedObject::constructUnsized,
-    nullptr
-};
-
-const Class SizedArrayTypeDescr::class_ = {
-    "ArrayType",
-    JSCLASS_HAS_RESERVED_SLOTS(JS_DESCR_SLOTS),
-    JS_PropertyStub,
-    JS_DeletePropertyStub,
-    JS_PropertyStub,
-    JS_StrictPropertyStub,
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub,
-    nullptr,
-    nullptr,
-    nullptr,
-    TypedObject::constructSized,
+    TypedObject::construct,
     nullptr
 };
 
 const JSPropertySpec ArrayMetaTypeDescr::typeObjectProperties[] = {
     JS_PS_END
 };
 
 const JSFunctionSpec ArrayMetaTypeDescr::typeObjectMethods[] = {
     {"array", {nullptr, nullptr}, 1, 0, "ArrayShorthand"},
-    JS_FN("dimension", UnsizedArrayTypeDescr::dimension, 1, 0),
     JS_SELF_HOSTED_FN("toSource", "DescrToSource", 0, 0),
     {"equivalent", {nullptr, nullptr}, 1, 0, "TypeDescrEquivalent"},
     JS_SELF_HOSTED_FN("build",    "TypedObjectArrayTypeBuild", 3, 0),
     JS_SELF_HOSTED_FN("buildPar", "TypedObjectArrayTypeBuildPar", 3, 0),
     JS_SELF_HOSTED_FN("from",     "TypedObjectArrayTypeFrom", 3, 0),
     JS_SELF_HOSTED_FN("fromPar",  "TypedObjectArrayTypeFromPar", 3, 0),
     JS_FS_END
 };
@@ -572,31 +554,29 @@ const JSFunctionSpec ArrayMetaTypeDescr:
     JS_SELF_HOSTED_FN("filterPar",  "TypedArrayFilterPar",  1, 0),
     JS_FS_END
 };
 
 bool
 js::CreateUserSizeAndAlignmentProperties(JSContext *cx, HandleTypeDescr descr)
 {
     // If data is transparent, also store the public slots.
-    if (descr->transparent() && descr->is<SizedTypeDescr>()) {
-        Rooted<SizedTypeDescr*> sizedDescr(cx, &descr->as<SizedTypeDescr>());
-
+    if (descr->transparent()) {
         // byteLength
-        RootedValue typeByteLength(cx, Int32Value(sizedDescr->size()));
+        RootedValue typeByteLength(cx, Int32Value(descr->size()));
         if (!JSObject::defineProperty(cx, descr, cx->names().byteLength,
                                       typeByteLength,
                                       nullptr, nullptr,
                                       JSPROP_READONLY | JSPROP_PERMANENT))
         {
             return false;
         }
 
         // byteAlignment
-        RootedValue typeByteAlignment(cx, Int32Value(sizedDescr->alignment()));
+        RootedValue typeByteAlignment(cx, Int32Value(descr->alignment()));
         if (!JSObject::defineProperty(cx, descr, cx->names().byteAlignment,
                                       typeByteAlignment,
                                       nullptr, nullptr,
                                       JSPROP_READONLY | JSPROP_PERMANENT))
         {
             return false;
         }
     } else {
@@ -614,55 +594,52 @@ js::CreateUserSizeAndAlignmentProperties
                                       UndefinedHandleValue,
                                       nullptr, nullptr,
                                       JSPROP_READONLY | JSPROP_PERMANENT))
         {
             return false;
         }
     }
 
-    // variable -- true for unsized arrays
-    RootedValue variable(cx, BooleanValue(!descr->is<SizedTypeDescr>()));
-    if (!JSObject::defineProperty(cx, descr, cx->names().variable,
-                                  variable,
-                                  nullptr, nullptr,
-                                  JSPROP_READONLY | JSPROP_PERMANENT))
-    {
-        return false;
-    }
-
     return true;
 }
 
-template<class T>
-T *
+ArrayTypeDescr *
 ArrayMetaTypeDescr::create(JSContext *cx,
                            HandleObject arrayTypePrototype,
-                           HandleSizedTypeDescr elementType,
+                           HandleTypeDescr elementType,
                            HandleAtom stringRepr,
-                           int32_t size)
+                           int32_t size,
+                           int32_t length)
 {
-    Rooted<T*> obj(cx);
-    obj = NewObjectWithProto<T>(cx, arrayTypePrototype, nullptr, SingletonObject);
+    Rooted<ArrayTypeDescr*> obj(cx);
+    obj = NewObjectWithProto<ArrayTypeDescr>(cx, arrayTypePrototype, nullptr, SingletonObject);
     if (!obj)
         return nullptr;
 
-    obj->initReservedSlot(JS_DESCR_SLOT_KIND, Int32Value(T::Kind));
+    obj->initReservedSlot(JS_DESCR_SLOT_KIND, Int32Value(ArrayTypeDescr::Kind));
     obj->initReservedSlot(JS_DESCR_SLOT_STRING_REPR, StringValue(stringRepr));
     obj->initReservedSlot(JS_DESCR_SLOT_ALIGNMENT, Int32Value(elementType->alignment()));
     obj->initReservedSlot(JS_DESCR_SLOT_SIZE, Int32Value(size));
     obj->initReservedSlot(JS_DESCR_SLOT_OPAQUE, BooleanValue(elementType->opaque()));
     obj->initReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE, ObjectValue(*elementType));
+    obj->initReservedSlot(JS_DESCR_SLOT_ARRAY_LENGTH, Int32Value(length));
 
     RootedValue elementTypeVal(cx, ObjectValue(*elementType));
     if (!JSObject::defineProperty(cx, obj, cx->names().elementType,
                                   elementTypeVal, nullptr, nullptr,
                                   JSPROP_READONLY | JSPROP_PERMANENT))
         return nullptr;
 
+    RootedValue lengthValue(cx, NumberValue(length));
+    if (!JSObject::defineProperty(cx, obj, cx->names().length,
+                                  lengthValue, nullptr, nullptr,
+                                  JSPROP_READONLY | JSPROP_PERMANENT))
+        return nullptr;
+
     if (!CreateUserSizeAndAlignmentProperties(cx, obj))
         return nullptr;
 
     Rooted<TypedProto*> prototypeObj(cx);
     prototypeObj = CreatePrototypeObjectForComplexTypeInstance(cx, obj, arrayTypePrototype);
     if (!prototypeObj)
         return nullptr;
 
@@ -682,142 +659,79 @@ ArrayMetaTypeDescr::construct(JSContext 
     if (!args.isConstructing()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
                              JSMSG_NOT_FUNCTION, "ArrayType");
         return false;
     }
 
     RootedObject arrayTypeGlobal(cx, &args.callee());
 
-    // Expect one argument which is a sized type object
-    if (args.length() < 1) {
+    // Expect two arguments. The first is a type object, the second is a length.
+    if (args.length() < 2) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_MORE_ARGS_NEEDED,
-                             "ArrayType", "0", "");
+                             "ArrayType", "1", "");
         return false;
     }
 
-    if (!args[0].isObject() || !args[0].toObject().is<SizedTypeDescr>()) {
+    if (!args[0].isObject() || !args[0].toObject().is<TypeDescr>()) {
         ReportCannotConvertTo(cx, args[0], "ArrayType element specifier");
         return false;
     }
 
-    Rooted<SizedTypeDescr*> elementType(cx);
-    elementType = &args[0].toObject().as<SizedTypeDescr>();
-
-    // Construct a canonical string `new ArrayType(<elementType>)`:
+    if (!args[1].isInt32() || args[1].toInt32() < 0) {
+        ReportCannotConvertTo(cx, args[1], "ArrayType length specifier");
+        return false;
+    }
+
+    Rooted<TypeDescr*> elementType(cx, &args[0].toObject().as<TypeDescr>());
+
+    int32_t length = args[1].toInt32();
+
+    // Compute the byte size.
+    CheckedInt32 size = CheckedInt32(elementType->size()) * length;
+    if (!size.isValid()) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                             JSMSG_TYPEDOBJECT_TOO_BIG);
+        return false;
+    }
+
+    // Construct a canonical string `new ArrayType(<elementType>, N)`:
     StringBuffer contents(cx);
     contents.append("new ArrayType(");
     contents.append(&elementType->stringRepr());
+    contents.append(", ");
+    if (!NumberValueToStringBuffer(cx, NumberValue(length), contents))
+        return false;
     contents.append(")");
     RootedAtom stringRepr(cx, contents.finishAtom());
     if (!stringRepr)
         return false;
 
     // Extract ArrayType.prototype
     RootedObject arrayTypePrototype(cx, GetPrototype(cx, arrayTypeGlobal));
     if (!arrayTypePrototype)
         return false;
 
     // Create the instance of ArrayType
-    Rooted<UnsizedArrayTypeDescr *> obj(cx);
-    obj = create<UnsizedArrayTypeDescr>(cx, arrayTypePrototype, elementType,
-                                        stringRepr, 0);
+    Rooted<ArrayTypeDescr *> obj(cx);
+    obj = create(cx, arrayTypePrototype, elementType, stringRepr, size.value(), length);
     if (!obj)
         return false;
 
-    // Add `length` property, which is undefined for an unsized array.
-    if (!JSObject::defineProperty(cx, obj, cx->names().length,
-                                  UndefinedHandleValue, nullptr, nullptr,
-                                  JSPROP_READONLY | JSPROP_PERMANENT))
-        return false;
-
-    args.rval().setObject(*obj);
-    return true;
-}
-
-/*static*/ bool
-UnsizedArrayTypeDescr::dimension(JSContext *cx, unsigned int argc, jsval *vp)
-{
-    // Expect that the `this` pointer is an unsized array type
-    // and the first argument is an integer size.
-    CallArgs args = CallArgsFromVp(argc, vp);
-    if (args.length() != 1 ||
-        !args.thisv().isObject() ||
-        !args.thisv().toObject().is<UnsizedArrayTypeDescr>() ||
-        !args[0].isInt32() ||
-        args[0].toInt32() < 0)
-    {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
-                             JSMSG_TYPEDOBJECT_ARRAYTYPE_BAD_ARGS);
-        return false;
-    }
-
-    // Extract arguments.
-    Rooted<UnsizedArrayTypeDescr*> unsizedTypeDescr(cx);
-    unsizedTypeDescr = &args.thisv().toObject().as<UnsizedArrayTypeDescr>();
-    int32_t length = args[0].toInt32();
-    Rooted<SizedTypeDescr*> elementType(cx, &unsizedTypeDescr->elementType());
-
-    // Compute the size.
-    CheckedInt32 size = CheckedInt32(elementType->size()) * length;
-    if (!size.isValid()) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
-                             JSMSG_TYPEDOBJECT_TOO_BIG);
-        return false;
-    }
-
-    // Construct a canonical string `new ArrayType(<elementType>).dimension(N)`:
-    StringBuffer contents(cx);
-    contents.append("new ArrayType(");
-    contents.append(&elementType->stringRepr());
-    contents.append(").dimension(");
-    if (!NumberValueToStringBuffer(cx, NumberValue(length), contents))
-        return false;
-    contents.append(")");
-    RootedAtom stringRepr(cx, contents.finishAtom());
-    if (!stringRepr)
-        return false;
-
-    // Create the sized type object.
-    Rooted<SizedArrayTypeDescr*> obj(cx);
-    obj = ArrayMetaTypeDescr::create<SizedArrayTypeDescr>(cx, unsizedTypeDescr,
-                                                          elementType,
-                                                          stringRepr, size.value());
-    if (!obj)
-        return false;
-
-    obj->initReservedSlot(JS_DESCR_SLOT_SIZED_ARRAY_LENGTH,
-                          Int32Value(length));
-
-    // Add `length` property.
-    RootedValue lengthVal(cx, Int32Value(length));
-    if (!JSObject::defineProperty(cx, obj, cx->names().length,
-                                  lengthVal, nullptr, nullptr,
-                                  JSPROP_READONLY | JSPROP_PERMANENT))
-        return false;
-
-    // Add `unsized` property, which is a link from the sized
-    // array to the unsized array.
-    RootedValue unsizedTypeDescrValue(cx, ObjectValue(*unsizedTypeDescr));
-    if (!JSObject::defineProperty(cx, obj, cx->names().unsized,
-                                  unsizedTypeDescrValue, nullptr, nullptr,
-                                  JSPROP_READONLY | JSPROP_PERMANENT))
-        return false;
-
     args.rval().setObject(*obj);
     return true;
 }
 
 bool
 js::IsTypedObjectArray(JSObject &obj)
 {
     if (!obj.is<TypedObject>())
         return false;
     TypeDescr& d = obj.as<TypedObject>().typeDescr();
-    return d.is<SizedArrayTypeDescr>() || d.is<UnsizedArrayTypeDescr>();
+    return d.is<ArrayTypeDescr>();
 }
 
 /*********************************
  * StructType class
  */
 
 const Class StructTypeDescr::class_ = {
     "StructType",
@@ -827,17 +741,17 @@ const Class StructTypeDescr::class_ = {
     JS_PropertyStub,
     JS_StrictPropertyStub,
     JS_EnumerateStub,
     JS_ResolveStub,
     JS_ConvertStub,
     nullptr, /* finalize */
     nullptr, /* call */
     nullptr, /* hasInstance */
-    TypedObject::constructSized,
+    TypedObject::construct,
     nullptr  /* trace */
 };
 
 const JSPropertySpec StructMetaTypeDescr::typeObjectProperties[] = {
     JS_PS_END
 };
 
 const JSFunctionSpec StructMetaTypeDescr::typeObjectMethods[] = {
@@ -888,33 +802,33 @@ StructMetaTypeDescr::create(JSContext *c
 
     if (!stringBuffer.append("new StructType({")) {
         js_ReportOutOfMemory(cx);
         return nullptr;
     }
 
     RootedValue fieldTypeVal(cx);
     RootedId id(cx);
-    Rooted<SizedTypeDescr*> fieldType(cx);
+    Rooted<TypeDescr*> fieldType(cx);
     for (unsigned int i = 0; i < ids.length(); i++) {
         id = ids[i];
 
         // Check that all the property names are non-numeric strings.
         uint32_t unused;
         if (!JSID_IS_ATOM(id) || JSID_TO_ATOM(id)->isIndex(&unused)) {
             RootedValue idValue(cx, IdToValue(id));
             ReportCannotConvertTo(cx, idValue, "StructType field name");
             return nullptr;
         }
 
         // Load the value for the current field from the `fields` object.
         // The value should be a type descriptor.
         if (!JSObject::getGeneric(cx, fields, fields, id, &fieldTypeVal))
             return nullptr;
-        fieldType = ToObjectIf<SizedTypeDescr>(fieldTypeVal);
+        fieldType = ToObjectIf<TypeDescr>(fieldTypeVal);
         if (!fieldType) {
             ReportCannotConvertTo(cx, fieldTypeVal, "StructType field specifier");
             return nullptr;
         }
 
         // Collect field name and type object
         RootedValue fieldName(cx, IdToValue(id));
         if (!fieldNames.append(fieldName)) {
@@ -1163,32 +1077,32 @@ StructTypeDescr::fieldOffset(size_t inde
 size_t
 StructTypeDescr::maybeForwardedFieldOffset(size_t index) const
 {
     NativeObject &fieldOffsets = maybeForwardedFieldInfoObject(JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS);
     MOZ_ASSERT(index < fieldOffsets.getDenseInitializedLength());
     return AssertedCast<size_t>(fieldOffsets.getDenseElement(index).toInt32());
 }
 
-SizedTypeDescr&
+TypeDescr&
 StructTypeDescr::fieldDescr(size_t index) const
 {
     NativeObject &fieldDescrs = fieldInfoObject(JS_DESCR_SLOT_STRUCT_FIELD_TYPES);
     MOZ_ASSERT(index < fieldDescrs.getDenseInitializedLength());
-    return fieldDescrs.getDenseElement(index).toObject().as<SizedTypeDescr>();
+    return fieldDescrs.getDenseElement(index).toObject().as<TypeDescr>();
 }
 
-SizedTypeDescr&
+TypeDescr&
 StructTypeDescr::maybeForwardedFieldDescr(size_t index) const
 {
     NativeObject &fieldDescrs = maybeForwardedFieldInfoObject(JS_DESCR_SLOT_STRUCT_FIELD_TYPES);
     MOZ_ASSERT(index < fieldDescrs.getDenseInitializedLength());
     JSObject &descr =
         *MaybeForwarded(&fieldDescrs.getDenseElement(index).toObject());
-    return descr.as<SizedTypeDescr>();
+    return descr.as<TypeDescr>();
 }
 
 /******************************************************************************
  * Creating the TypedObject "module"
  *
  * We create one global, `TypedObject`, which contains the following
  * members:
  *
@@ -1463,19 +1377,17 @@ TypedObject::offset() const
     if (is<InlineTypedObject>())
         return 0;
     return typedMem() - typedMemBase();
 }
 
 int32_t
 TypedObject::length() const
 {
-    if (typeDescr().is<SizedArrayTypeDescr>())
-        return typeDescr().as<SizedArrayTypeDescr>().length();
-    return as<OutlineTypedObject>().unsizedLength();
+    return typeDescr().as<ArrayTypeDescr>().length();
 }
 
 uint8_t *
 TypedObject::typedMem() const
 {
     MOZ_ASSERT(isAttached());
 
     if (is<InlineTypedObject>())
@@ -1612,28 +1524,24 @@ OutlineTypedObject::createUnattachedWith
 {
     MOZ_ASSERT(clasp == &OutlineTransparentTypedObject::class_ ||
                clasp == &OutlineOpaqueTypedObject::class_);
 
     RootedObject proto(cx, PrototypeForTypeDescr(cx, type));
     if (!proto)
         return nullptr;
 
-    gc::AllocKind allocKind = allocKindForTypeDescriptor(type);
     NewObjectKind newKind = (heap == gc::TenuredHeap) ? MaybeSingletonObject : GenericObject;
-    JSObject *obj = NewObjectWithClassProto(cx, clasp, proto, nullptr, allocKind, newKind);
+    JSObject *obj = NewObjectWithClassProto(cx, clasp, proto, nullptr, gc::FINALIZE_OBJECT0, newKind);
     if (!obj)
         return nullptr;
 
     OutlineTypedObject *typedObj = &obj->as<OutlineTypedObject>();
 
     typedObj->setOwnerAndData(nullptr, nullptr);
-    if (type->kind() == type::UnsizedArray)
-        typedObj->setUnsizedLength(length);
-
     return typedObj;
 }
 
 void
 OutlineTypedObject::attach(JSContext *cx, ArrayBufferObject &buffer, int32_t offset)
 {
     MOZ_ASSERT(!isAttached());
     MOZ_ASSERT(offset >= 0);
@@ -1663,38 +1571,35 @@ OutlineTypedObject::attach(JSContext *cx
         attach(cx, owner->as<ArrayBufferObject>(), offset);
     } else {
         MOZ_ASSERT(owner->is<InlineTypedObject>());
         setOwnerAndData(owner, owner->as<InlineTypedObject>().inlineTypedMem() + offset);
     }
 }
 
 // Returns a suitable JS_TYPEDOBJ_SLOT_LENGTH value for an instance of
-// the type `type`. `type` must not be an unsized array.
+// the type `type`.
 static int32_t
 TypedObjLengthFromType(TypeDescr &descr)
 {
     switch (descr.kind()) {
       case type::Scalar:
       case type::Reference:
       case type::Struct:
       case type::Simd:
         return 0;
 
-      case type::SizedArray:
-        return descr.as<SizedArrayTypeDescr>().length();
-
-      case type::UnsizedArray:
-        MOZ_CRASH("TypedObjLengthFromType() invoked on unsized type");
+      case type::Array:
+        return descr.as<ArrayTypeDescr>().length();
     }
     MOZ_CRASH("Invalid kind");
 }
 
 /*static*/ OutlineTypedObject *
-OutlineTypedObject::createDerived(JSContext *cx, HandleSizedTypeDescr type,
+OutlineTypedObject::createDerived(JSContext *cx, HandleTypeDescr type,
                                   HandleTypedObject typedObj, int32_t offset)
 {
     MOZ_ASSERT(offset <= typedObj->size());
     MOZ_ASSERT(offset + type->size() <= typedObj->size());
 
     int32_t length = TypedObjLengthFromType(*type);
 
     const js::Class *clasp = typedObj->opaque()
@@ -1708,73 +1613,36 @@ OutlineTypedObject::createDerived(JSCont
     obj->attach(cx, *typedObj, offset);
     return obj;
 }
 
 /*static*/ TypedObject *
 TypedObject::createZeroed(JSContext *cx, HandleTypeDescr descr, int32_t length, gc::InitialHeap heap)
 {
     // If possible, create an object with inline data.
-    if (descr->is<SizedTypeDescr>() &&
-        (size_t) descr->as<SizedTypeDescr>().size() <= InlineTypedObject::MaximumSize)
-    {
+    if ((size_t) descr->size() <= InlineTypedObject::MaximumSize) {
         InlineTypedObject *obj = InlineTypedObject::create(cx, descr, heap);
-        descr->as<SizedTypeDescr>().initInstances(cx->runtime(), obj->inlineTypedMem(), 1);
+        descr->initInstances(cx->runtime(), obj->inlineTypedMem(), 1);
         return obj;
     }
 
     // Create unattached wrapper object.
     Rooted<OutlineTypedObject*> obj(cx, OutlineTypedObject::createUnattached(cx, descr, length, heap));
     if (!obj)
         return nullptr;
 
     // Allocate and initialize the memory for this instance.
-    // Also initialize the JS_TYPEDOBJ_SLOT_LENGTH slot.
-    switch (descr->kind()) {
-      case type::Scalar:
-      case type::Reference:
-      case type::Struct:
-      case type::Simd:
-      case type::SizedArray:
-      {
-        size_t totalSize = descr->as<SizedTypeDescr>().size();
-        Rooted<ArrayBufferObject*> buffer(cx);
-        buffer = ArrayBufferObject::create(cx, totalSize);
-        if (!buffer)
-            return nullptr;
-        descr->as<SizedTypeDescr>().initInstances(cx->runtime(), buffer->dataPointer(), 1);
-        obj->attach(cx, *buffer, 0);
-        return obj;
-      }
-
-      case type::UnsizedArray:
-      {
-        Rooted<SizedTypeDescr*> elementTypeRepr(cx);
-        elementTypeRepr = &descr->as<UnsizedArrayTypeDescr>().elementType();
-
-        CheckedInt32 totalSize = CheckedInt32(elementTypeRepr->size()) * length;
-        if (!totalSize.isValid()) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
-                                 JSMSG_TYPEDOBJECT_TOO_BIG);
-            return nullptr;
-        }
-
-        Rooted<ArrayBufferObject*> buffer(cx);
-        buffer = ArrayBufferObject::create(cx, totalSize.value());
-        if (!buffer)
-            return nullptr;
-
-        if (length)
-            elementTypeRepr->initInstances(cx->runtime(), buffer->dataPointer(), length);
-        obj->attach(cx, *buffer, 0);
-        return obj;
-      }
-    }
-
-    MOZ_CRASH("Bad TypeRepresentation Kind");
+    size_t totalSize = descr->size();
+    Rooted<ArrayBufferObject*> buffer(cx);
+    buffer = ArrayBufferObject::create(cx, totalSize);
+    if (!buffer)
+        return nullptr;
+    descr->initInstances(cx->runtime(), buffer->dataPointer(), 1);
+    obj->attach(cx, *buffer, 0);
+    return obj;
 }
 
 static bool
 ReportTypedObjTypeError(JSContext *cx,
                         const unsigned errorNumber,
                         HandleTypedObject obj)
 {
     // Serialize type string of obj
@@ -1818,49 +1686,33 @@ OutlineTypedObject::obj_trace(JSTracer *
     {
         mem += reinterpret_cast<uint8_t *>(owner) - reinterpret_cast<uint8_t *>(oldOwner);
         typedObj.setData(mem);
     }
 
     if (!descr.opaque() || !typedObj.maybeForwardedIsAttached())
         return;
 
-    switch (descr.kind()) {
-      case type::Scalar:
-      case type::Reference:
-      case type::Struct:
-      case type::SizedArray:
-      case type::Simd:
-        descr.as<SizedTypeDescr>().traceInstances(trc, mem, 1);
-        break;
-
-      case type::UnsizedArray:
-      {
-        SizedTypeDescr &elemType = descr.as<UnsizedArrayTypeDescr>().maybeForwardedElementType();
-        elemType.traceInstances(trc, mem, typedObj.unsizedLength());
-        break;
-      }
-    }
+    descr.traceInstances(trc, mem, 1);
 }
 
 bool
 TypedObject::obj_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id,
                               MutableHandleObject objp, MutableHandleShape propp)
 {
     MOZ_ASSERT(obj->is<TypedObject>());
 
     Rooted<TypeDescr*> descr(cx, &obj->as<TypedObject>().typeDescr());
     switch (descr->kind()) {
       case type::Scalar:
       case type::Reference:
       case type::Simd:
         break;
 
-      case type::SizedArray:
-      case type::UnsizedArray:
+      case type::Array:
       {
         uint32_t index;
         if (js_IdIsIndex(id, &index))
             return obj_lookupElement(cx, obj, index, objp, propp);
 
         if (JSID_IS_ATOM(id, cx->names().length)) {
             MarkNonNativePropertyFound(propp);
             objp.set(obj);
@@ -1977,18 +1829,17 @@ TypedObject::obj_getGeneric(JSContext *c
     switch (typedObj->typeDescr().kind()) {
       case type::Scalar:
       case type::Reference:
         break;
 
       case type::Simd:
         break;
 
-      case type::SizedArray:
-      case type::UnsizedArray:
+      case type::Array:
         if (JSID_IS_ATOM(id, cx->names().length)) {
             if (!typedObj->isAttached()) {
                 JS_ReportErrorNumber(
                     cx, js_GetErrorMessage,
                     nullptr, JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
                 return false;
             }
 
@@ -2000,17 +1851,17 @@ TypedObject::obj_getGeneric(JSContext *c
       case type::Struct: {
         Rooted<StructTypeDescr*> descr(cx, &typedObj->typeDescr().as<StructTypeDescr>());
 
         size_t fieldIndex;
         if (!descr->fieldIndex(id, &fieldIndex))
             break;
 
         size_t offset = descr->fieldOffset(fieldIndex);
-        Rooted<SizedTypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex));
+        Rooted<TypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex));
         return Reify(cx, fieldType, typedObj, offset, vp);
       }
     }
 
     RootedObject proto(cx, obj->getProto());
     if (!proto) {
         vp.setUndefined();
         return true;
@@ -2037,50 +1888,42 @@ TypedObject::obj_getElement(JSContext *c
 
     switch (descr->kind()) {
       case type::Scalar:
       case type::Reference:
       case type::Simd:
       case type::Struct:
         break;
 
-      case type::SizedArray:
-        return obj_getArrayElement<SizedArrayTypeDescr>(cx, typedObj, descr,
-                                                        index, vp);
-
-      case type::UnsizedArray:
-        return obj_getArrayElement<UnsizedArrayTypeDescr>(cx, typedObj, descr,
-                                                          index, vp);
+      case type::Array:
+        return obj_getArrayElement(cx, typedObj, descr, index, vp);
     }
 
     RootedObject proto(cx, obj->getProto());
     if (!proto) {
         vp.setUndefined();
         return true;
     }
 
     return JSObject::getElement(cx, proto, receiver, index, vp);
 }
 
-template<class T>
 /*static*/ bool
 TypedObject::obj_getArrayElement(JSContext *cx,
                                 Handle<TypedObject*> typedObj,
                                 Handle<TypeDescr*> typeDescr,
                                 uint32_t index,
                                 MutableHandleValue vp)
 {
-    MOZ_ASSERT(typeDescr->is<T>());
-
     if (index >= (size_t) typedObj->length()) {
         vp.setUndefined();
         return true;
     }
 
-    Rooted<SizedTypeDescr*> elementType(cx, &typeDescr->as<T>().elementType());
+    Rooted<TypeDescr*> elementType(cx, &typeDescr->as<ArrayTypeDescr>().elementType());
     size_t offset = elementType->size() * index;
     return Reify(cx, elementType, typedObj, offset, vp);
 }
 
 bool
 TypedObject::obj_setGeneric(JSContext *cx, HandleObject obj, HandleId id,
                            MutableHandleValue vp, bool strict)
 {
@@ -2094,34 +1937,33 @@ TypedObject::obj_setGeneric(JSContext *c
     switch (typedObj->typeDescr().kind()) {
       case type::Scalar:
       case type::Reference:
         break;
 
       case type::Simd:
         break;
 
-      case type::SizedArray:
-      case type::UnsizedArray:
+      case type::Array:
         if (JSID_IS_ATOM(id, cx->names().length)) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage,
                                  nullptr, JSMSG_CANT_REDEFINE_ARRAY_LENGTH);
             return false;
         }
         break;
 
       case type::Struct: {
         Rooted<StructTypeDescr*> descr(cx, &typedObj->typeDescr().as<StructTypeDescr>());
 
         size_t fieldIndex;
         if (!descr->fieldIndex(id, &fieldIndex))
             break;
 
         size_t offset = descr->fieldOffset(fieldIndex);
-        Rooted<SizedTypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex));
+        Rooted<TypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex));
         return ConvertAndCopyTo(cx, fieldType, typedObj, offset, vp);
       }
     }
 
     return ReportTypedObjTypeError(cx, JSMSG_OBJECT_NOT_EXTENSIBLE, typedObj);
 }
 
 bool
@@ -2143,44 +1985,38 @@ TypedObject::obj_setElement(JSContext *c
 
     switch (descr->kind()) {
       case type::Scalar:
       case type::Reference:
       case type::Simd:
       case type::Struct:
         break;
 
-      case type::SizedArray:
-        return obj_setArrayElement<SizedArrayTypeDescr>(cx, typedObj, descr, index, vp);
-
-      case type::UnsizedArray:
-        return obj_setArrayElement<UnsizedArrayTypeDescr>(cx, typedObj, descr, index, vp);
+      case type::Array:
+        return obj_setArrayElement(cx, typedObj, descr, index, vp);
     }
 
     return ReportTypedObjTypeError(cx, JSMSG_OBJECT_NOT_EXTENSIBLE, typedObj);
 }
 
-template<class T>
 /*static*/ bool
 TypedObject::obj_setArrayElement(JSContext *cx,
                                 Handle<TypedObject*> typedObj,
                                 Handle<TypeDescr*> descr,
                                 uint32_t index,
                                 MutableHandleValue vp)
 {
-    MOZ_ASSERT(descr->is<T>());
-
     if (index >= (size_t) typedObj->length()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage,
                              nullptr, JSMSG_TYPEDOBJECT_BINARYARRAY_BAD_INDEX);
         return false;
     }
 
-    Rooted<SizedTypeDescr*> elementType(cx);
-    elementType = &descr->as<T>().elementType();
+    Rooted<TypeDescr*> elementType(cx);
+    elementType = &descr->as<ArrayTypeDescr>().elementType();
     size_t offset = elementType->size() * index;
     return ConvertAndCopyTo(cx, elementType, typedObj, offset, vp);
 }
 
 bool
 TypedObject::obj_getGenericAttributes(JSContext *cx, HandleObject obj,
                                      HandleId id, unsigned *attrsp)
 {
@@ -2189,18 +2025,17 @@ TypedObject::obj_getGenericAttributes(JS
     switch (typedObj->typeDescr().kind()) {
       case type::Scalar:
       case type::Reference:
         break;
 
       case type::Simd:
         break;
 
-      case type::SizedArray:
-      case type::UnsizedArray:
+      case type::Array:
         if (js_IdIsIndex(id, &index)) {
             *attrsp = JSPROP_ENUMERATE | JSPROP_PERMANENT;
             return true;
         }
         if (JSID_IS_ATOM(id, cx->names().length)) {
             *attrsp = JSPROP_READONLY | JSPROP_PERMANENT;
             return true;
         }
@@ -2230,18 +2065,17 @@ IsOwnId(JSContext *cx, HandleObject obj,
     uint32_t index;
     Rooted<TypedObject *> typedObj(cx, &obj->as<TypedObject>());
     switch (typedObj->typeDescr().kind()) {
       case type::Scalar:
       case type::Reference:
       case type::Simd:
         return false;
 
-      case type::SizedArray:
-      case type::UnsizedArray:
+      case type::Array:
         return js_IdIsIndex(id, &index) || JSID_IS_ATOM(id, cx->names().length);
 
       case type::Struct:
         size_t index;
         if (typedObj->typeDescr().as<StructTypeDescr>().fieldIndex(id, &index))
             return true;
     }
 
@@ -2300,18 +2134,17 @@ TypedObject::obj_enumerate(JSContext *cx
 
           case JSENUMERATE_NEXT:
           case JSENUMERATE_DESTROY:
             statep.setNull();
             break;
         }
         break;
 
-      case type::SizedArray:
-      case type::UnsizedArray:
+      case type::Array:
         switch (enum_op) {
           case JSENUMERATE_INIT_ALL:
           case JSENUMERATE_INIT:
             statep.setInt32(0);
             idp.set(INT_TO_JSID(typedObj->length()));
             break;
 
           case JSENUMERATE_NEXT:
@@ -2361,18 +2194,16 @@ TypedObject::obj_enumerate(JSContext *cx
     }
 
     return true;
 }
 
 void
 OutlineTypedObject::neuter(void *newData)
 {
-    if (typeDescr().kind() == type::UnsizedArray)
-        setUnsizedLength(0);
     setData(reinterpret_cast<uint8_t *>(newData));
 }
 
 /******************************************************************************
  * Inline typed objects
  */
 
 /* static */ InlineTypedObject *
@@ -2413,17 +2244,17 @@ InlineTypedObject::createCopy(JSContext 
 InlineTypedObject::obj_trace(JSTracer *trc, JSObject *object)
 {
     InlineTypedObject &typedObj = object->as<InlineTypedObject>();
 
     // When this is called for compacting GC, the related objects we touch here
     // may not have had their slots updated yet.
     TypeDescr &descr = typedObj.maybeForwardedTypeDescr();
 
-    descr.as<SizedTypeDescr>().traceInstances(trc, typedObj.inlineTypedMem(), 1);
+    descr.traceInstances(trc, typedObj.inlineTypedMem(), 1);
 }
 
 ArrayBufferObject *
 InlineTransparentTypedObject::getOrCreateBuffer(JSContext *cx)
 {
     LazyArrayBufferTable *&table = cx->compartment()->lazyArrayBuffers;
     if (!table) {
         table = cx->new_<LazyArrayBufferTable>(cx);
@@ -2432,17 +2263,17 @@ InlineTransparentTypedObject::getOrCreat
     }
 
     ArrayBufferObject *buffer = table->maybeBuffer(this);
     if (buffer)
         return buffer;
 
     ArrayBufferObject::BufferContents contents =
         ArrayBufferObject::BufferContents::createPlain(inlineTypedMem());
-    size_t nbytes = typeDescr().as<SizedTypeDescr>().size();
+    size_t nbytes = typeDescr().size();
 
     // Prevent GC under ArrayBufferObject::create, which might move this object
     // and its contents.
     gc::AutoSuppressGC suppress(cx);
 
     buffer = ArrayBufferObject::create(cx, nbytes, contents, ArrayBufferObject::DoesntOwnData);
     if (!buffer)
         return nullptr;
@@ -2589,21 +2420,18 @@ LengthForType(TypeDescr &descr)
 {
     switch (descr.kind()) {
       case type::Scalar:
       case type::Reference:
       case type::Struct:
       case type::Simd:
         return 0;
 
-      case type::SizedArray:
-        return descr.as<SizedArrayTypeDescr>().length();
-
-      case type::UnsizedArray:
-        return 0;
+      case type::Array:
+        return descr.as<ArrayTypeDescr>().length();
     }
 
     MOZ_CRASH("Invalid kind");
 }
 
 static bool
 CheckOffset(int32_t offset,
             int32_t size,
@@ -2628,25 +2456,25 @@ CheckOffset(int32_t offset,
     // Offset must be aligned.
     if ((offset % alignment) != 0)
         return false;
 
     return true;
 }
 
 /*static*/ bool
-TypedObject::constructSized(JSContext *cx, unsigned int argc, Value *vp)
+TypedObject::construct(JSContext *cx, unsigned int argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    MOZ_ASSERT(args.callee().is<SizedTypeDescr>());
-    Rooted<SizedTypeDescr*> callee(cx, &args.callee().as<SizedTypeDescr>());
-
-    // Typed object constructors for sized types are overloaded in
-    // three ways, in order of precedence:
+    MOZ_ASSERT(args.callee().is<TypeDescr>());
+    Rooted<TypeDescr*> callee(cx, &args.callee().as<TypeDescr>());
+
+    // Typed object constructors are overloaded in three ways, in order of
+    // precedence:
     //
     //   new TypeObj()
     //   new TypeObj(buffer, [offset])
     //   new TypeObj(data)
 
     // Zero argument constructor:
     if (args.length() == 0) {
         int32_t length = LengthForType(*callee);
@@ -2721,203 +2549,47 @@ TypedObject::constructSized(JSContext *c
     }
 
     // Something bogus.
     JS_ReportErrorNumber(cx, js_GetErrorMessage,
                          nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
     return false;
 }
 
-/*static*/ bool
-TypedObject::constructUnsized(JSContext *cx, unsigned int argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    MOZ_ASSERT(args.callee().is<TypeDescr>());
-    Rooted<UnsizedArrayTypeDescr*> callee(cx);
-    callee = &args.callee().as<UnsizedArrayTypeDescr>();
-
-    // Typed object constructors for unsized arrays are overloaded in
-    // four ways, in order of precedence:
-    //
-    //   new TypeObj(buffer, [offset, [length]]) // [1]
-    //   new TypeObj(length)                     // [1]
-    //   new TypeObj(data)
-    //   new TypeObj()
-    //
-    // [1] Explicit lengths only available for unsized arrays.
-
-    // Zero argument constructor:
-    if (args.length() == 0) {
-        Rooted<TypedObject*> obj(cx, createZeroed(cx, callee, 0));
-        if (!obj)
-            return false;
-        args.rval().setObject(*obj);
-        return true;
-    }
-
-    // Length constructor.
-    if (args[0].isInt32()) {
-        int32_t length = args[0].toInt32();
-        if (length < 0) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                 nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-            return false;
-        }
-        Rooted<TypedObject*> obj(cx, createZeroed(cx, callee, length));
-        if (!obj)
-            return false;
-        args.rval().setObject(*obj);
-        return true;
-    }
-
-    // Buffer constructor.
-    if (args[0].isObject() && args[0].toObject().is<ArrayBufferObject>()) {
-        Rooted<ArrayBufferObject*> buffer(cx);
-        buffer = &args[0].toObject().as<ArrayBufferObject>();
-
-        if (callee->opaque()) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                 nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-            return false;
-        }
-
-        int32_t offset;
-        if (args.length() >= 2 && !args[1].isUndefined()) {
-            if (!args[1].isInt32()) {
-                JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                     nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-                return false;
-            }
-
-            offset = args[1].toInt32();
-        } else {
-            offset = 0;
-        }
-
-        if (!CheckOffset(offset, 0, callee->alignment(), buffer->byteLength())) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                 nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-            return false;
-        }
-
-        int32_t elemSize = callee->elementType().size();
-        int32_t bytesRemaining = buffer->byteLength() - offset;
-        int32_t maximumLength = bytesRemaining / elemSize;
-
-        int32_t length;
-        if (args.length() >= 3 && !args[2].isUndefined()) {
-            if (!args[2].isInt32()) {
-                JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                     nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-                return false;
-            }
-            length = args[2].toInt32();
-
-            if (length < 0 || length > maximumLength) {
-                JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                     nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-                return false;
-            }
-        } else {
-            if ((bytesRemaining % elemSize) != 0) {
-                JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                     nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-                return false;
-            }
-
-            length = maximumLength;
-        }
-
-        if (buffer->isNeutered()) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                 nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-            return false;
-        }
-
-        Rooted<OutlineTypedObject*> obj(cx);
-        obj = OutlineTypedObject::createUnattached(cx, callee, length);
-        if (!obj)
-            return false;
-
-        obj->attach(cx, args[0].toObject().as<ArrayBufferObject>(), offset);
-    }
-
-    // Data constructor for unsized values
-    if (args[0].isObject()) {
-        // Read length out of the object.
-        RootedObject arg(cx, &args[0].toObject());
-        RootedValue lengthVal(cx);
-        if (!JSObject::getProperty(cx, arg, arg, cx->names().length, &lengthVal))
-            return false;
-        if (!lengthVal.isInt32()) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                 nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-            return false;
-        }
-        int32_t length = lengthVal.toInt32();
-
-        // Check that length * elementSize does not overflow.
-        int32_t elementSize = callee->elementType().size();
-        int32_t byteLength;
-        if (!SafeMul(elementSize, length, &byteLength)) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                                 nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-            return false;
-        }
-
-        // Create the unsized array.
-        Rooted<TypedObject*> obj(cx, createZeroed(cx, callee, length));
-        if (!obj)
-            return false;
-
-        // Initialize from `arg`
-        if (!ConvertAndCopyTo(cx, obj, args[0]))
-            return false;
-        args.rval().setObject(*obj);
-        return true;
-    }
-
-    // Something bogus.
-    JS_ReportErrorNumber(cx, js_GetErrorMessage,
-                         nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
-    return false;
-}
-
 /******************************************************************************
  * Intrinsics
  */
 
 bool
 js::NewOpaqueTypedObject(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     MOZ_ASSERT(args.length() == 1);
-    MOZ_ASSERT(args[0].isObject() && args[0].toObject().is<SizedTypeDescr>());
-
-    Rooted<SizedTypeDescr*> descr(cx, &args[0].toObject().as<SizedTypeDescr>());
+    MOZ_ASSERT(args[0].isObject() && args[0].toObject().is<TypeDescr>());
+
+    Rooted<TypeDescr*> descr(cx, &args[0].toObject().as<TypeDescr>());
     int32_t length = TypedObjLengthFromType(*descr);
     Rooted<OutlineTypedObject*> obj(cx);
     obj = OutlineTypedObject::createUnattachedWithClass(cx, &OutlineOpaqueTypedObject::class_, descr, length);
     if (!obj)
         return false;
     args.rval().setObject(*obj);
     return true;
 }
 
 bool
 js::NewDerivedTypedObject(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     MOZ_ASSERT(args.length() == 3);
-    MOZ_ASSERT(args[0].isObject() && args[0].toObject().is<SizedTypeDescr>());
+    MOZ_ASSERT(args[0].isObject() && args[0].toObject().is<TypeDescr>());
     MOZ_ASSERT(args[1].isObject() && args[1].toObject().is<TypedObject>());
     MOZ_ASSERT(args[2].isInt32());
 
-    Rooted<SizedTypeDescr*> descr(cx, &args[0].toObject().as<SizedTypeDescr>());
+    Rooted<TypeDescr*> descr(cx, &args[0].toObject().as<TypeDescr>());
     Rooted<TypedObject*> typedObj(cx, &args[1].toObject().as<TypedObject>());
     int32_t offset = args[2].toInt32();
 
     Rooted<TypedObject*> obj(cx);
     obj = OutlineTypedObject::createDerived(cx, descr, typedObj, offset);
     if (!obj)
         return false;
 
@@ -3052,56 +2724,25 @@ JS_JITINFO_NATIVE_PARALLEL_THREADSAFE(js
 bool
 js::TypeDescrIsArrayType(ThreadSafeContext *, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     MOZ_ASSERT(args.length() == 1);
     MOZ_ASSERT(args[0].isObject());
     MOZ_ASSERT(args[0].toObject().is<js::TypeDescr>());
     JSObject& obj = args[0].toObject();
-    args.rval().setBoolean(obj.is<js::SizedArrayTypeDescr>() ||
-                           obj.is<js::UnsizedArrayTypeDescr>());
+    args.rval().setBoolean(obj.is<js::ArrayTypeDescr>());
     return true;
 }
 
 JS_JITINFO_NATIVE_PARALLEL_THREADSAFE(js::TypeDescrIsArrayTypeJitInfo,
                                       TypeDescrIsArrayTypeJitInfo,
                                       js::TypeDescrIsArrayType);
 
 bool
-js::TypeDescrIsSizedArrayType(ThreadSafeContext *, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    MOZ_ASSERT(args.length() == 1);
-    MOZ_ASSERT(args[0].isObject());
-    MOZ_ASSERT(args[0].toObject().is<js::TypeDescr>());
-    args.rval().setBoolean(args[0].toObject().is<js::SizedArrayTypeDescr>());
-    return true;
-}
-
-JS_JITINFO_NATIVE_PARALLEL_THREADSAFE(js::TypeDescrIsSizedArrayTypeJitInfo,
-                                      TypeDescrIsSizedArrayTypeJitInfo,
-                                      js::TypeDescrIsSizedArrayType);
-
-bool
-js::TypeDescrIsUnsizedArrayType(ThreadSafeContext *, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    MOZ_ASSERT(args.length() == 1);
-    MOZ_ASSERT(args[0].isObject());
-    MOZ_ASSERT(args[0].toObject().is<js::TypeDescr>());
-    args.rval().setBoolean(args[0].toObject().is<js::UnsizedArrayTypeDescr>());
-    return true;
-}
-
-JS_JITINFO_NATIVE_PARALLEL_THREADSAFE(js::TypeDescrIsUnsizedArrayTypeJitInfo,
-                                      TypeDescrIsUnsizedArrayTypeJitInfo,
-                                      js::TypeDescrIsUnsizedArrayType);
-
-bool
 js::TypedObjectIsAttached(ThreadSafeContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     TypedObject &typedObj = args[0].toObject().as<TypedObject>();
     args.rval().setBoolean(typedObj.isAttached());
     return true;
 }
 
@@ -3306,53 +2947,48 @@ JS_FOR_EACH_UNIQUE_SCALAR_TYPE_REPR_CTYP
 JS_FOR_EACH_REFERENCE_TYPE_REPR(JS_STORE_REFERENCE_CLASS_IMPL)
 JS_FOR_EACH_REFERENCE_TYPE_REPR(JS_LOAD_REFERENCE_CLASS_IMPL)
 
 ///////////////////////////////////////////////////////////////////////////
 // Walking memory
 
 template<typename V>
 static void
-visitReferences(SizedTypeDescr &descr,
+visitReferences(TypeDescr &descr,
                 uint8_t *mem,
                 V& visitor)
 {
     if (descr.transparent())
         return;
 
     switch (descr.kind()) {
       case type::Scalar:
       case type::Simd:
         return;
 
       case type::Reference:
         visitor.visitReference(descr.as<ReferenceTypeDescr>(), mem);
         return;
 
-      case type::SizedArray:
+      case type::Array:
       {
-        SizedArrayTypeDescr &arrayDescr = descr.as<SizedArrayTypeDescr>();
-        SizedTypeDescr &elementDescr = arrayDescr.maybeForwardedElementType();
+        ArrayTypeDescr &arrayDescr = descr.as<ArrayTypeDescr>();
+        TypeDescr &elementDescr = arrayDescr.maybeForwardedElementType();
         for (int32_t i = 0; i < arrayDescr.length(); i++) {
             visitReferences(elementDescr, mem, visitor);
             mem += elementDescr.size();
         }
         return;
       }
 
-      case type::UnsizedArray:
-      {
-        MOZ_CRASH("Only Sized Type representations");
-      }
-
       case type::Struct:
       {
         StructTypeDescr &structDescr = descr.as<StructTypeDescr>();
         for (size_t i = 0; i < structDescr.maybeForwardedFieldCount(); i++) {
-            SizedTypeDescr &descr = structDescr.maybeForwardedFieldDescr(i);
+            TypeDescr &descr = structDescr.maybeForwardedFieldDescr(i);
             size_t offset = structDescr.maybeForwardedFieldOffset(i);
             visitReferences(descr, mem + offset, visitor);
         }
         return;
       }
     }
 
     MOZ_CRASH("Invalid type repr kind");
@@ -3401,17 +3037,17 @@ js::MemoryInitVisitor::visitReference(Re
         return;
       }
     }
 
     MOZ_CRASH("Invalid kind");
 }
 
 void
-SizedTypeDescr::initInstances(const JSRuntime *rt, uint8_t *mem, size_t length)
+TypeDescr::initInstances(const JSRuntime *rt, uint8_t *mem, size_t length)
 {
     MOZ_ASSERT(length >= 1);
 
     MemoryInitVisitor visitor(rt);
 
     // Initialize the 0th instance
     memset(mem, 0, size());
     if (opaque())
@@ -3471,17 +3107,17 @@ js::MemoryTracingVisitor::visitReference
         return;
       }
     }
 
     MOZ_CRASH("Invalid kind");
 }
 
 void
-SizedTypeDescr::traceInstances(JSTracer *trace, uint8_t *mem, size_t length)
+TypeDescr::traceInstances(JSTracer *trace, uint8_t *mem, size_t length)
 {
     MemoryTracingVisitor visitor(trace);
 
     for (size_t i = 0; i < length; i++) {
         visitReferences(*this, mem, visitor);
         mem += size();
     }
 }

--- a/js/src/builtin/TypedObject.h
+++ b/js/src/builtin/TypedObject.h
@@ -114,35 +114,29 @@ static T ConvertScalar(double d)
 
 namespace type {
 
 enum Kind {
     Scalar = JS_TYPEREPR_SCALAR_KIND,
     Reference = JS_TYPEREPR_REFERENCE_KIND,
     Simd = JS_TYPEREPR_SIMD_KIND,
     Struct = JS_TYPEREPR_STRUCT_KIND,
-    SizedArray = JS_TYPEREPR_SIZED_ARRAY_KIND,
-    UnsizedArray = JS_TYPEREPR_UNSIZED_ARRAY_KIND,
+    Array = JS_TYPEREPR_ARRAY_KIND
 };
 
-static inline bool isSized(type::Kind kind) {
-    return kind > JS_TYPEREPR_MAX_UNSIZED_KIND;
-}
-
 }
 
 ///////////////////////////////////////////////////////////////////////////
 // Typed Prototypes
 
-class SizedTypeDescr;
 class SimpleTypeDescr;
 class ComplexTypeDescr;
 class SimdTypeDescr;
 class StructTypeDescr;
-class SizedTypedProto;
+class TypedProto;
 
 /*
  * The prototype for a typed object. Currently, carries a link to the
  * type descriptor. Eventually will carry most of the type information
  * we want.
  */
 class TypedProto : public NativeObject
 {
@@ -169,20 +163,16 @@ class TypeDescr : public NativeObject
     // errors if a is<FooTypeDescr>() etc goes wrong. Otherwise, the
     // default implementation resolves this to a reference to
     // FooTypeDescr::class_ which resolves to
     // JSObject::class_. Debugging the resulting errors leads to much
     // fun and rejoicing.
     static const Class class_;
 
   public:
-    static bool isSized(type::Kind kind) {
-        return kind > JS_TYPEREPR_MAX_UNSIZED_KIND;
-    }
-
     TypedProto &typedProto() const {
         return getReservedSlot(JS_DESCR_SLOT_TYPROTO).toObject().as<TypedProto>();
     }
 
     JSAtom &stringRepr() const {
         return getReservedSlot(JS_DESCR_SLOT_STRING_REPR).toString()->asAtom();
     }
 
@@ -196,34 +186,28 @@ class TypeDescr : public NativeObject
 
     bool transparent() const {
         return !opaque();
     }
 
     int32_t alignment() const {
         return getReservedSlot(JS_DESCR_SLOT_ALIGNMENT).toInt32();
     }
-};
 
-typedef Handle<TypeDescr*> HandleTypeDescr;
-
-class SizedTypeDescr : public TypeDescr
-{
-  public:
     int32_t size() const {
         return getReservedSlot(JS_DESCR_SLOT_SIZE).toInt32();
     }
 
     void initInstances(const JSRuntime *rt, uint8_t *mem, size_t length);
     void traceInstances(JSTracer *trace, uint8_t *mem, size_t length);
 };
 
-typedef Handle<SizedTypeDescr*> HandleSizedTypeDescr;
+typedef Handle<TypeDescr*> HandleTypeDescr;
 
-class SimpleTypeDescr : public SizedTypeDescr
+class SimpleTypeDescr : public TypeDescr
 {
 };
 
 // Type for scalar type constructors like `uint8`. All such type
 // constructors share a common js::Class and JSFunctionSpec. Scalar
 // types are non-opaque (their storage is visible unless combined with
 // an opaque reference type.)
 class ScalarTypeDescr : public SimpleTypeDescr
@@ -323,17 +307,17 @@ class ReferenceTypeDescr : public Simple
 
 #define JS_FOR_EACH_REFERENCE_TYPE_REPR(macro_)                    \
     macro_(ReferenceTypeDescr::TYPE_ANY,    HeapValue, Any)        \
     macro_(ReferenceTypeDescr::TYPE_OBJECT, HeapPtrObject, Object) \
     macro_(ReferenceTypeDescr::TYPE_STRING, HeapPtrString, string)
 
 // Type descriptors whose instances are objects and hence which have
 // an associated `prototype` property.
-class ComplexTypeDescr : public SizedTypeDescr
+class ComplexTypeDescr : public TypeDescr
 {
   public:
     // Returns the prototype that instances of this type descriptor
     // will have.
     TypedProto &instancePrototype() const {
         return getReservedSlot(JS_DESCR_SLOT_TYPROTO).toObject().as<TypedProto>();
     }
 };
@@ -367,43 +351,38 @@ class SimdTypeDescr : public ComplexType
     macro_(SimdTypeDescr::TYPE_INT32, int32_t, int32)                  \
     macro_(SimdTypeDescr::TYPE_FLOAT32, float, float32)
 
 bool IsTypedObjectClass(const Class *clasp); // Defined below
 bool IsTypedObjectArray(JSObject& obj);
 
 bool CreateUserSizeAndAlignmentProperties(JSContext *cx, HandleTypeDescr obj);
 
+class ArrayTypeDescr;
+
 /*
  * Properties and methods of the `ArrayType` meta type object. There
  * is no `class_` field because `ArrayType` is just a native
  * constructor function.
  */
 class ArrayMetaTypeDescr : public JSObject
 {
   private:
-    friend class UnsizedArrayTypeDescr;
-
-    // Helper for creating a new ArrayType object, either sized or unsized.
-    // The template parameter `T` should be either `UnsizedArrayTypeDescr`
-    // or `SizedArrayTypeDescr`.
+    // Helper for creating a new ArrayType object.
     //
-    // - `arrayTypePrototype` - prototype for the new object to be created,
-    //                          either ArrayType.prototype or
-    //                          unsizedArrayType.__proto__ depending on
-    //                          whether this is a sized or unsized array
+    // - `arrayTypePrototype` - prototype for the new object to be created
     // - `elementType` - type object for the elements in the array
     // - `stringRepr` - canonical string representation for the array
-    // - `size` - length of the array (0 if unsized)
-    template<class T>
-    static T *create(JSContext *cx,
-                     HandleObject arrayTypePrototype,
-                     HandleSizedTypeDescr elementType,
-                     HandleAtom stringRepr,
-                     int32_t size);
+    // - `size` - length of the array
+    static ArrayTypeDescr *create(JSContext *cx,
+                                  HandleObject arrayTypePrototype,
+                                  HandleTypeDescr elementType,
+                                  HandleAtom stringRepr,
+                                  int32_t size,
+                                  int32_t length);
 
   public:
     // Properties and methods to be installed on ArrayType.prototype,
     // and hence inherited by all array type objects:
     static const JSPropertySpec typeObjectProperties[];
     static const JSFunctionSpec typeObjectMethods[];
 
     // Properties and methods to be installed on ArrayType.prototype.prototype,
@@ -412,64 +391,35 @@ class ArrayMetaTypeDescr : public JSObje
     static const JSFunctionSpec typedObjectMethods[];
 
     // This is the function that gets called when the user
     // does `new ArrayType(elem)`. It produces an array type object.
     static bool construct(JSContext *cx, unsigned argc, Value *vp);
 };
 
 /*
- * Type descriptor created by `new ArrayType(typeObj)`
- *
- * These have a prototype, and hence *could* be a subclass of
- * `ComplexTypeDescr`, but it would require some reshuffling of the
- * hierarchy, and it's not worth the trouble since they will be going
- * away as part of bug 973238.
+ * Type descriptor created by `new ArrayType(type, n)`
  */
-class UnsizedArrayTypeDescr : public TypeDescr
+class ArrayTypeDescr : public ComplexTypeDescr
 {
   public:
     static const Class class_;
-    static const type::Kind Kind = type::UnsizedArray;
+    static const type::Kind Kind = type::Array;
 
-    // This is the sized method on unsized array type objects.  It
-    // produces a sized variant.
-    static bool dimension(JSContext *cx, unsigned int argc, jsval *vp);
-
-    SizedTypeDescr &elementType() const {
-        return getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject().as<SizedTypeDescr>();
+    TypeDescr &elementType() const {
+        return getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject().as<TypeDescr>();
     }
 
-    SizedTypeDescr &maybeForwardedElementType() const {
-        JSObject *elemType =
-            MaybeForwarded(&getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject());
-        return elemType->as<SizedTypeDescr>();
-    }
-};
-
-/*
- * Type descriptor created by `unsizedArrayTypeObj.dimension()`
- */
-class SizedArrayTypeDescr : public ComplexTypeDescr
-{
-  public:
-    static const Class class_;
-    static const type::Kind Kind = type::SizedArray;
-
-    SizedTypeDescr &elementType() const {
-        return getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject().as<SizedTypeDescr>();
-    }
-
-    SizedTypeDescr &maybeForwardedElementType() const {
+    TypeDescr &maybeForwardedElementType() const {
         JSObject *elemType = &getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject();
-        return MaybeForwarded(elemType)->as<SizedTypeDescr>();
+        return MaybeForwarded(elemType)->as<TypeDescr>();
     }
 
     int32_t length() const {
-        return getReservedSlot(JS_DESCR_SLOT_SIZED_ARRAY_LENGTH).toInt32();
+        return getReservedSlot(JS_DESCR_SLOT_ARRAY_LENGTH).toInt32();
     }
 };
 
 /*
  * Properties and methods of the `StructType` meta type object. There
  * is no `class_` field because `StructType` is just a native
  * constructor function.
  */
@@ -507,18 +457,18 @@ class StructTypeDescr : public ComplexTy
     // Set `*out` to the index of the field named `id` and returns true,
     // or return false if no such field exists.
     bool fieldIndex(jsid id, size_t *out) const;
 
     // Return the name of the field at index `index`.
     JSAtom &fieldName(size_t index) const;
 
     // Return the type descr of the field at index `index`.
-    SizedTypeDescr &fieldDescr(size_t index) const;
-    SizedTypeDescr &maybeForwardedFieldDescr(size_t index) const;
+    TypeDescr &fieldDescr(size_t index) const;
+    TypeDescr &maybeForwardedFieldDescr(size_t index) const;
 
     // Return the offset of the field at index `index`.
     size_t fieldOffset(size_t index) const;
     size_t maybeForwardedFieldOffset(size_t index) const;
 
   private:
     NativeObject &fieldInfoObject(size_t slot) const {
         return getReservedSlot(slot).toObject().as<NativeObject>();
@@ -548,24 +498,22 @@ class TypedObjectModuleObject : public N
 };
 
 /* Base type for transparent and opaque typed objects. */
 class TypedObject : public JSObject
 {
   private:
     static const bool IsTypedObjectClass = true;
 
-    template<class T>
     static bool obj_getArrayElement(JSContext *cx,
                                     Handle<TypedObject*> typedObj,
                                     Handle<TypeDescr*> typeDescr,
                                     uint32_t index,
                                     MutableHandleValue vp);
 
-    template<class T>
     static bool obj_setArrayElement(JSContext *cx,
                                     Handle<TypedObject*> typedObj,
                                     Handle<TypeDescr*> typeDescr,
                                     uint32_t index,
                                     MutableHandleValue vp);
 
   protected:
     static bool obj_lookupGeneric(JSContext *cx, HandleObject obj,
@@ -595,19 +543,16 @@ class TypedObject : public JSObject
                                HandleId id, MutableHandleValue vp);
 
     static bool obj_getProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
                                 HandlePropertyName name, MutableHandleValue vp);
 
     static bool obj_getElement(JSContext *cx, HandleObject obj, HandleObject receiver,
                                uint32_t index, MutableHandleValue vp);
 
-    static bool obj_getUnsizedArrayElement(JSContext *cx, HandleObject obj, HandleObject receiver,
-                                         uint32_t index, MutableHandleValue vp);
-
     static bool obj_setGeneric(JSContext *cx, HandleObject obj, HandleId id,
                                MutableHandleValue vp, bool strict);
     static bool obj_setProperty(JSContext *cx, HandleObject obj, HandlePropertyName name,
                                 MutableHandleValue vp, bool strict);
     static bool obj_setElement(JSContext *cx, HandleObject obj, uint32_t index,
                                MutableHandleValue vp, bool strict);
 
     static bool obj_getGenericAttributes(JSContext *cx, HandleObject obj,
@@ -640,30 +585,17 @@ class TypedObject : public JSObject
     int32_t offset() const;
     int32_t length() const;
     uint8_t *typedMem() const;
     uint8_t *typedMemBase() const;
     bool isAttached() const;
     bool maybeForwardedIsAttached() const;
 
     int32_t size() const {
-        switch (typeDescr().kind()) {
-          case type::Scalar:
-          case type::Simd:
-          case type::Reference:
-          case type::Struct:
-          case type::SizedArray:
-            return typeDescr().as<SizedTypeDescr>().size();
-
-          case type::UnsizedArray: {
-            SizedTypeDescr &elementType = typeDescr().as<UnsizedArrayTypeDescr>().elementType();
-            return elementType.size() * length();
-          }
-        }
-        MOZ_CRASH("unhandled typerepresentation kind");
+        return typeDescr().size();
     }
 
     uint8_t *typedMem(size_t offset) const {
         // It seems a bit surprising that one might request an offset
         // == size(), but it can happen when taking the "address of" a
         // 0-sized value. (In other words, we maintain the invariant
         // that `offset + size <= size()` -- this is always checked in
         // the caller's side.)
@@ -674,22 +606,19 @@ class TypedObject : public JSObject
     inline bool opaque() const;
 
     // Creates a new typed object whose memory is freshly allocated and
     // initialized with zeroes (or, in the case of references, an appropriate
     // default value).
     static TypedObject *createZeroed(JSContext *cx, HandleTypeDescr typeObj, int32_t length,
                                      gc::InitialHeap heap = gc::DefaultHeap);
 
-    // User-accessible constructor (`new TypeDescriptor(...)`) used for sized
-    // types. Note that the callee here is the type descriptor.
-    static bool constructSized(JSContext *cx, unsigned argc, Value *vp);
-
-    // As `constructSized`, but for unsized array types.
-    static bool constructUnsized(JSContext *cx, unsigned argc, Value *vp);
+    // User-accessible constructor (`new TypeDescriptor(...)`). Note that the
+    // callee here is the type descriptor.
+    static bool construct(JSContext *cx, unsigned argc, Value *vp);
 
     /* Accessors for self hosted code. */
     static bool GetBuffer(JSContext *cx, unsigned argc, Value *vp);
     static bool GetByteOffset(JSContext *cx, unsigned argc, Value *vp);
 };
 
 typedef Handle<TypedObject*> HandleTypedObject;
 
@@ -698,59 +627,36 @@ class OutlineTypedObject : public TypedO
     // The object which owns the data this object points to. Because this
     // pointer is managed in tandem with |data|, this is not a HeapPtr and
     // barriers are managed directly.
     JSObject *owner_;
 
     // Data pointer to some offset in the owner's contents.
     uint8_t *data_;
 
-    // The length for unsized array objects. For other outline objects the
-    // space for this field is not allocated and cannot be accessed.
-    uint32_t unsizedLength_;
-
     void setOwnerAndData(JSObject *owner, uint8_t *data);
 
-    void setUnsizedLength(uint32_t length) {
-        MOZ_ASSERT(typeDescr().is<UnsizedArrayTypeDescr>());
-        unsizedLength_ = length;
-    }
-
   public:
-    static gc::AllocKind allocKindForTypeDescriptor(TypeDescr *descr) {
-        // Use a larger allocation kind for unsized arrays, to accommodate the
-        // unsized length.
-        if (descr->is<UnsizedArrayTypeDescr>())
-            return gc::FINALIZE_OBJECT2;
-        return gc::FINALIZE_OBJECT0;
-    }
-
     // JIT accessors.
     static size_t offsetOfData() { return offsetof(OutlineTypedObject, data_); }
     static size_t offsetOfOwner() { return offsetof(OutlineTypedObject, owner_); }
-    static size_t offsetOfUnsizedLength() { return offsetof(OutlineTypedObject, unsizedLength_); }
 
     JSObject &owner() const {
         MOZ_ASSERT(owner_);
         return *owner_;
     }
 
     JSObject *maybeOwner() const {
         return owner_;
     }
 
     uint8_t *outOfLineTypedMem() const {
         return data_;
     }
 
-    int32_t unsizedLength() const {
-        MOZ_ASSERT(typeDescr().is<UnsizedArrayTypeDescr>());
-        return unsizedLength_;
-    }
-
     void setData(uint8_t *data) {
         data_ = data;
     }
 
     // Helper for createUnattached()
     static OutlineTypedObject *createUnattachedWithClass(JSContext *cx,
                                                          const Class *clasp,
                                                          HandleTypeDescr type,
@@ -767,17 +673,17 @@ class OutlineTypedObject : public TypedO
     // - length: 0 unless this is an array, otherwise the length
     static OutlineTypedObject *createUnattached(JSContext *cx, HandleTypeDescr type,
                                                 int32_t length, gc::InitialHeap heap = gc::DefaultHeap);
 
     // Creates a typedObj that aliases the memory pointed at by `owner`
     // at the given offset. The typedObj will be a handle iff type is a
     // handle and a typed object otherwise.
     static OutlineTypedObject *createDerived(JSContext *cx,
-                                             HandleSizedTypeDescr type,
+                                             HandleTypeDescr type,
                                              Handle<TypedObject*> typedContents,
                                              int32_t offset);
 
     // Use this method when `buffer` is the owner of the memory.
     void attach(JSContext *cx, ArrayBufferObject &buffer, int32_t offset);
 
     // Otherwise, use this to attach to memory referenced by another typedObj.
     void attach(JSContext *cx, TypedObject &typedObj, int32_t offset);
@@ -811,17 +717,17 @@ class InlineTypedObject : public TypedOb
     // Start of the inline data, which immediately follows the shape and type.
     uint8_t data_[1];
 
   public:
     static const size_t MaximumSize =
         sizeof(NativeObject) - sizeof(TypedObject) + NativeObject::MAX_FIXED_SLOTS * sizeof(Value);
 
     static gc::AllocKind allocKindForTypeDescriptor(TypeDescr *descr) {
-        size_t nbytes = descr->as<SizedTypeDescr>().size();
+        size_t nbytes = descr->size();
         MOZ_ASSERT(nbytes <= MaximumSize);
 
         size_t dataSlots = AlignBytes(nbytes, sizeof(Value) / sizeof(Value));
         MOZ_ASSERT(nbytes <= dataSlots * sizeof(Value));
         return gc::GetGCObjectKind(dataSlots);
     }
 
     uint8_t *inlineTypedMem() const {
@@ -927,22 +833,16 @@ extern const JSJitInfo ObjectIsTranspare
 /* Predicates on type descriptor objects.  In all cases, 'obj' must be a type descriptor. */
 
 bool TypeDescrIsSimpleType(ThreadSafeContext *, unsigned argc, Value *vp);
 extern const JSJitInfo TypeDescrIsSimpleTypeJitInfo;
 
 bool TypeDescrIsArrayType(ThreadSafeContext *, unsigned argc, Value *vp);
 extern const JSJitInfo TypeDescrIsArrayTypeJitInfo;
 
-bool TypeDescrIsSizedArrayType(ThreadSafeContext *, unsigned argc, Value *vp);
-extern const JSJitInfo TypeDescrIsSizedArrayTypeJitInfo;
-
-bool TypeDescrIsUnsizedArrayType(ThreadSafeContext *, unsigned argc, Value *vp);
-extern const JSJitInfo TypeDescrIsUnsizedArrayTypeJitInfo;
-
 /*
  * Usage: TypedObjectIsAttached(obj)
  *
  * Given a TypedObject `obj`, returns true if `obj` is
  * "attached" (i.e., its data pointer is nullptr).
  */
 bool TypedObjectIsAttached(ThreadSafeContext *cx, unsigned argc, Value *vp);
 extern const JSJitInfo TypedObjectIsAttachedJitInfo;
@@ -1096,32 +996,25 @@ IsSimpleTypeDescrClass(const Class* clas
     return clasp == &ScalarTypeDescr::class_ ||
            clasp == &ReferenceTypeDescr::class_;
 }
 
 inline bool
 IsComplexTypeDescrClass(const Class* clasp)
 {
     return clasp == &StructTypeDescr::class_ ||
-           clasp == &SizedArrayTypeDescr::class_ ||
+           clasp == &ArrayTypeDescr::class_ ||
            clasp == &SimdTypeDescr::class_;
 }
 
 inline bool
-IsSizedTypeDescrClass(const Class* clasp)
-{
-    return IsSimpleTypeDescrClass(clasp) ||
-           IsComplexTypeDescrClass(clasp);
-}
-
-inline bool
 IsTypeDescrClass(const Class* clasp)
 {
-    return IsSizedTypeDescrClass(clasp) ||
-           clasp == &UnsizedArrayTypeDescr::class_;
+    return IsSimpleTypeDescrClass(clasp) ||
+           IsComplexTypeDescrClass(clasp);
 }
 
 inline bool
 TypedObject::opaque() const
 {
     return IsOpaqueTypedObjectClass(getClass());
 }
 
@@ -1158,23 +1051,16 @@ template <>
 inline bool
 JSObject::is<js::SimpleTypeDescr>() const
 {
     return IsSimpleTypeDescrClass(getClass());
 }
 
 template <>
 inline bool
-JSObject::is<js::SizedTypeDescr>() const
-{
-    return IsSizedTypeDescrClass(getClass());
-}
-
-template <>
-inline bool
 JSObject::is<js::ComplexTypeDescr>() const
 {
     return IsComplexTypeDescrClass(getClass());
 }
 
 template <>
 inline bool
 JSObject::is<js::TypeDescr>() const

--- a/js/src/builtin/TypedObject.js
+++ b/js/src/builtin/TypedObject.js
@@ -14,18 +14,18 @@
 #define DESCR_SIZE(obj) \
     UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_SIZE)
 #define DESCR_OPAQUE(obj) \
     UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_OPAQUE)
 #define DESCR_TYPE(obj)   \
     UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_TYPE)
 #define DESCR_ARRAY_ELEMENT_TYPE(obj) \
     UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_ARRAY_ELEM_TYPE)
-#define DESCR_SIZED_ARRAY_LENGTH(obj) \
-    TO_INT32(UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_SIZED_ARRAY_LENGTH))
+#define DESCR_ARRAY_LENGTH(obj) \
+    TO_INT32(UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_ARRAY_LENGTH))
 #define DESCR_STRUCT_FIELD_NAMES(obj) \
     UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_STRUCT_FIELD_NAMES)
 #define DESCR_STRUCT_FIELD_TYPES(obj) \
     UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_STRUCT_FIELD_TYPES)
 #define DESCR_STRUCT_FIELD_OFFSETS(obj) \
     UnsafeGetReservedSlot(obj, JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS)
 
 // Typed prototype slots
@@ -65,22 +65,19 @@ function TypedObjectGet(descr, typedObj,
     return TypedObjectGetScalar(descr, typedObj, offset);
 
   case JS_TYPEREPR_REFERENCE_KIND:
     return TypedObjectGetReference(descr, typedObj, offset);
 
   case JS_TYPEREPR_SIMD_KIND:
     return TypedObjectGetSimd(descr, typedObj, offset);
 
-  case JS_TYPEREPR_SIZED_ARRAY_KIND:
+  case JS_TYPEREPR_ARRAY_KIND:
   case JS_TYPEREPR_STRUCT_KIND:
     return TypedObjectGetDerived(descr, typedObj, offset);
-
-  case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    assert(false, "Unhandled repr kind: " + DESCR_KIND(descr));
   }
 
   assert(false, "Unhandled kind: " + DESCR_KIND(descr));
   return undefined;
 }
 
 function TypedObjectGetDerived(descr, typedObj, offset) {
   assert(!TypeDescrIsSimpleType(descr),
@@ -196,24 +193,18 @@ function TypedObjectSet(descr, typedObj,
   case JS_TYPEREPR_REFERENCE_KIND:
     TypedObjectSetReference(descr, typedObj, offset, fromValue);
     return;
 
   case JS_TYPEREPR_SIMD_KIND:
     TypedObjectSetSimd(descr, typedObj, offset, fromValue);
     return;
 
-  case JS_TYPEREPR_SIZED_ARRAY_KIND:
-    var length = DESCR_SIZED_ARRAY_LENGTH(descr);
-    if (TypedObjectSetArray(descr, length, typedObj, offset, fromValue))
-      return;
-    break;
-
-  case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    var length = typedObj.length;
+  case JS_TYPEREPR_ARRAY_KIND:
+    var length = DESCR_ARRAY_LENGTH(descr);
     if (TypedObjectSetArray(descr, length, typedObj, offset, fromValue))
       return;
     break;
 
   case JS_TYPEREPR_STRUCT_KIND:
     if (!IsObject(fromValue))
       break;
 
@@ -422,41 +413,32 @@ function TypedArrayRedimension(newArrayT
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
   if (!IsObject(newArrayType) || !ObjectIsTypeDescr(newArrayType))
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
   // Peel away the outermost array layers from the type of `this` to find
   // the core element type. In the process, count the number of elements.
   var oldArrayType = TypedObjectTypeDescr(this);
-  var oldArrayReprKind = DESCR_KIND(oldArrayType);
   var oldElementType = oldArrayType;
   var oldElementCount = 1;
-  switch (oldArrayReprKind) {
-  case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    oldElementCount *= this.length;
-    oldElementType = oldElementType.elementType;
-    break;
 
-  case JS_TYPEREPR_SIZED_ARRAY_KIND:
-    break;
+  if (DESCR_KIND(oldArrayType) != JS_TYPEREPR_ARRAY_KIND)
+    ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
-  default:
-    ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
-  }
-  while (DESCR_KIND(oldElementType) === JS_TYPEREPR_SIZED_ARRAY_KIND) {
+  while (DESCR_KIND(oldElementType) === JS_TYPEREPR_ARRAY_KIND) {
     oldElementCount *= oldElementType.length;
     oldElementType = oldElementType.elementType;
   }
 
   // Peel away the outermost array layers from `newArrayType`. In the
   // process, count the number of elements.
   var newElementType = newArrayType;
   var newElementCount = 1;
-  while (DESCR_KIND(newElementType) == JS_TYPEREPR_SIZED_ARRAY_KIND) {
+  while (DESCR_KIND(newElementType) == JS_TYPEREPR_ARRAY_KIND) {
     newElementCount *= newElementType.length;
     newElementType = newElementType.elementType;
   }
 
   // Check that the total number of elements does not change.
   if (oldElementCount !== newElementCount) {
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
   }
@@ -531,21 +513,21 @@ function DescrToSource() {
 // Warning: user exposed!
 function ArrayShorthand(...dims) {
   if (!IsObject(this) || !ObjectIsTypeDescr(this))
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
   var T = GetTypedObjectModule();
 
   if (dims.length == 0)
-    return new T.ArrayType(this);
+    ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
   var accum = this;
   for (var i = dims.length - 1; i >= 0; i--)
-    accum = new T.ArrayType(accum).dimension(dims[i]);
+    accum = new T.ArrayType(accum, dims[i]);
   return accum;
 }
 
 // This is the `storage()` function defined in the spec.  When
 // provided with a *transparent* typed object, it returns an object
 // containing buffer, byteOffset, byteLength. When given an opaque
 // typed object, it returns null. Otherwise it throws.
 //
@@ -555,21 +537,17 @@ function StorageOfTypedObject(obj) {
     if (ObjectIsOpaqueTypedObject(obj))
       return null;
 
     if (ObjectIsTransparentTypedObject(obj)) {
       if (!TypedObjectIsAttached(obj))
           ThrowError(JSMSG_TYPEDOBJECT_HANDLE_UNATTACHED);
 
       var descr = TypedObjectTypeDescr(obj);
-      var byteLength;
-      if (DESCR_KIND(descr) == JS_TYPEREPR_UNSIZED_ARRAY_KIND)
-        byteLength = DESCR_SIZE(descr.elementType) * obj.length;
-      else
-        byteLength = DESCR_SIZE(descr);
+      var byteLength = DESCR_SIZE(descr);
 
       return { buffer: TypedObjectBuffer(obj),
                byteLength: byteLength,
                byteOffset: TypedObjectByteOffset(obj) };
     }
   }
 
   ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
@@ -600,42 +578,31 @@ function TypeOfTypedObject(obj) {
   }
 }
 
 ///////////////////////////////////////////////////////////////////////////
 // TypedObject surface API methods (sequential implementations).
 
 // Warning: user exposed!
 function TypedObjectArrayTypeBuild(a,b,c) {
-  // Arguments (this sized) : [depth], func
-  // Arguments (this unsized) : length, [depth], func
+  // Arguments : [depth], func
 
   if (!IsObject(this) || !ObjectIsTypeDescr(this))
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
   var kind = DESCR_KIND(this);
   switch (kind) {
-  case JS_TYPEREPR_SIZED_ARRAY_KIND:
+  case JS_TYPEREPR_ARRAY_KIND:
     if (typeof a === "function") // XXX here and elsewhere: these type dispatches are fragile at best.
       return BuildTypedSeqImpl(this, this.length, 1, a);
     else if (typeof a === "number" && typeof b === "function")
       return BuildTypedSeqImpl(this, this.length, a, b);
     else if (typeof a === "number")
       ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
     else
       ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
-  case JS_TYPEREPR_UNSIZED_ARRAY_KIND:
-    var len = a;
-    if (typeof b === "function")
-      return BuildTypedSeqImpl(this, len, 1, b);
-    else if (typeof b === "number" && typeof c === "function")
-      return BuildTypedSeqImpl(this, len, b, c);
-    else if (typeof b === "number")
-      ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
-    else
-      ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
   default:
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
   }
 }
 
 // Warning: user exposed!
 function TypedObjectArrayTypeFrom(a, b, c) {
   // Arguments: arrayLike, [depth], func
@@ -726,17 +693,17 @@ function TypedArrayReduce(a, b) {
 function TypedArrayScatter(a, b, c, d) {
   // Arguments: outputArrayType, indices, defaultValue, conflictFunction
   if (!IsObject(this) || !ObjectIsTypedObject(this))
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
   var thisType = TypedObjectTypeDescr(this);
   if (!TypeDescrIsArrayType(thisType))
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
-  if (!IsObject(a) || !ObjectIsTypeDescr(a) || !TypeDescrIsSizedArrayType(a))
+  if (!IsObject(a) || !ObjectIsTypeDescr(a) || !TypeDescrIsArrayType(a))
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
   if (d !== undefined && typeof d !== "function")
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
 
   return ScatterTypedSeqImpl(this, a, b, c, d);
 }
 
@@ -823,17 +790,17 @@ function BuildTypedSeqImpl(arrayType, le
   //    ArrayType(ArrayType(T, 4), 5)
   // and a depth of 2, we get
   //    grainType = T
   //    iterationSpace = [5, 4]
   var [iterationSpace, grainType, totalLength] =
     ComputeIterationSpace(arrayType, depth, len);
 
   // Create a zeroed instance with no data
-  var result = arrayType.variable ? new arrayType(len) : new arrayType();
+  var result = new arrayType();
 
   var indices = NewDenseArray(depth);
   for (var i = 0; i < depth; i++) {
     indices[i] = 0;
   }
 
   var grainTypeIsComplex = !TypeDescrIsSimpleType(grainType);
   var size = DESCR_SIZE(grainType);
@@ -916,21 +883,21 @@ function MapUntypedSeqImpl(inArray, outp
 
   if (!IsCallable(maybeFunc))
     ThrowError(JSMSG_NOT_FUNCTION, DecompileArg(0, maybeFunc));
   var func = maybeFunc;
 
   // Skip check for compatible iteration spaces; any normal JS array
   // is trivially compatible with any iteration space of depth 1.
 
-  var outLength = outputType.variable ? inArray.length : outputType.length;
+  var outLength = outputType.length;
   var outGrainType = outputType.elementType;
 
   // Create a zeroed instance with no data
-  var result = outputType.variable ? new outputType(inArray.length) : new outputType();
+  var result = new outputType();
 
   var outUnitSize = DESCR_SIZE(outGrainType);
   var outGrainTypeIsComplex = !TypeDescrIsSimpleType(outGrainType);
   var outOffset = 0;
 
   // Core of map computation starts here (comparable to
   // DoMapTypedSeqDepth1 and DoMapTypedSeqDepthN below).
 
@@ -970,24 +937,24 @@ function MapTypedSeqImpl(inArray, depth,
 
   // Compute iteration space for input and output and check for compatibility.
   var inputType = TypeOfTypedObject(inArray);
   var [inIterationSpace, inGrainType, _] =
     ComputeIterationSpace(inputType, depth, inArray.length);
   if (!IsObject(inGrainType) || !ObjectIsTypeDescr(inGrainType))
     ThrowError(JSMSG_TYPEDOBJECT_BAD_ARGS);
   var [iterationSpace, outGrainType, totalLength] =
-    ComputeIterationSpace(outputType, depth, outputType.variable ? inArray.length : outputType.length);
+    ComputeIterationSpace(outputType, depth, outputType.length);
   for (var i = 0; i < depth; i++)
     if (inIterationSpace[i] !== iterationSpace[i])
       // TypeError("Incompatible iteration space in input and output type");
       ThrowError(JSMSG_TYPEDOBJECT_ARRAYTYPE_BAD_ARGS);
 
   // Create a zeroed instance with no data
-  var result = outputType.variable ? new outputType(inArray.length) : new outputType();
+  var result = new outputType();
 
   var inGrainTypeIsComplex = !TypeDescrIsSimpleType(inGrainType);
   var outGrainTypeIsComplex = !TypeDescrIsSimpleType(outGrainType);
 
   var inOffset = 0;
   var outOffset = 0;
 
   var isDepth1Simple = depth == 1 && !(inGrainTypeIsComplex || outGrainTypeIsComplex);
@@ -1078,17 +1045,17 @@ function MapTypedParImpl(inArray, depth,
          "Map/From called on something not callable");
 
   var inArrayType = TypeOfTypedObject(inArray);
 
   if (ShouldForceSequential() ||
       depth <= 0 ||
       TO_INT32(depth) !== depth ||
       !TypeDescrIsArrayType(inArrayType) ||
-      !TypeDescrIsUnsizedArrayType(outputType))
+      !TypeDescrIsArrayType(outputType))
   {
     // defer error cases to seq implementation:
     return MapTypedSeqImpl(inArray, depth, outputType, func);
   }
 
   switch (depth) {
   case 1:
     return MapTypedParImplDepth1(inArray, inArrayType, outputType, func);
@@ -1156,17 +1123,17 @@ function MapTypedParImplDepth1(inArray, 
   const inGrainTypeSize = DESCR_SIZE(inGrainType);
   const outGrainTypeSize = DESCR_SIZE(outGrainType);
   const inGrainTypeIsComplex = !TypeDescrIsSimpleType(inGrainType);
   const outGrainTypeIsComplex = !TypeDescrIsSimpleType(outGrainType);
 
   const length = inArray.length;
   const mode = undefined;
 
-  const outArray = new outArrayType(length);
+  const outArray = new outArrayType();
   if (length === 0)
     return outArray;
 
   const outGrainTypeIsTransparent = ObjectIsTransparentTypedObject(outArray);
 
   // Construct the slices and initial pointers for each worker:
   const slicesInfo = ComputeSlicesInfo(length);
   const numWorkers = ForkJoinNumWorkers();
@@ -1302,17 +1269,17 @@ function ReduceTypedSeqImpl(array, outpu
   }
 
   return value;
 }
 
 function ScatterTypedSeqImpl(array, outputType, indices, defaultValue, conflictFunc) {
   assert(IsObject(array) && ObjectIsTypedObject(array), "Scatter called on non-object or untyped input array.");
   assert(IsObject(outputType) && ObjectIsTypeDescr(outputType), "Scatter called on non-type-object outputType");
-  assert(TypeDescrIsSizedArrayType(outputType), "Scatter called on non-sized array type");
+  assert(TypeDescrIsArrayType(outputType), "Scatter called on non-array type");
   assert(conflictFunc === undefined || typeof conflictFunc === "function", "Scatter called with invalid conflictFunc");
 
   var result = new outputType();
   var bitvec = new Uint8Array(result.length);
   var elemType = outputType.elementType;
   var i, j;
   if (defaultValue !== elemType(undefined)) {
     for (i = 0; i < result.length; i++) {
@@ -1351,16 +1318,18 @@ function FilterTypedSeqImpl(array, func)
     var v = TypedObjectGet(elementType, array, inOffset);
     if (func(v, i, array)) {
       SET_BIT(flags, i);
       count++;
     }
     inOffset += size;
   }
 
-  var resultType = (arrayType.variable ? arrayType : arrayType.unsized);
-  var result = new resultType(count);
+  var T = GetTypedObjectModule();
+
+  var resultType = new T.ArrayType(elementType, count);
+  var result = new resultType();
   for (var i = 0, j = 0; i < array.length; i++) {
     if (GET_BIT(flags, i))
       result[j++] = array[i];
   }
   return result;
 }

--- a/js/src/builtin/TypedObjectConstants.h
+++ b/js/src/builtin/TypedObjectConstants.h
@@ -22,46 +22,44 @@
 // particular kinds of type objects. For simplicity we use the same
 // number of slots no matter what kind of type descriptor we are
 // working with, even though this is mildly wasteful.
 
 // Slots on all type objects
 #define JS_DESCR_SLOT_KIND               0  // Atomized string representation
 #define JS_DESCR_SLOT_STRING_REPR        1  // Atomized string representation
 #define JS_DESCR_SLOT_ALIGNMENT          2  // Alignment in bytes
-#define JS_DESCR_SLOT_SIZE               3  // Size in bytes, if sized, else 0
+#define JS_DESCR_SLOT_SIZE               3  // Size in bytes, else 0
 #define JS_DESCR_SLOT_OPAQUE             4  // Atomized string representation
 #define JS_DESCR_SLOT_TYPROTO            5  // Prototype for instances, if any
 
 // Slots on scalars, references, and x4s
 #define JS_DESCR_SLOT_TYPE               6  // Type code
 
 // Slots on all array descriptors
 #define JS_DESCR_SLOT_ARRAY_ELEM_TYPE    6
 
-// Slots on sized array descriptors
-#define JS_DESCR_SLOT_SIZED_ARRAY_LENGTH 7
+// Slots on array descriptors
+#define JS_DESCR_SLOT_ARRAY_LENGTH 7
 
 // Slots on struct type objects
 #define JS_DESCR_SLOT_STRUCT_FIELD_NAMES 6
 #define JS_DESCR_SLOT_STRUCT_FIELD_TYPES 7
 #define JS_DESCR_SLOT_STRUCT_FIELD_OFFSETS 8
 
 // Maximum number of slots for any descriptor
 #define JS_DESCR_SLOTS                   9
 
 // These constants are for use exclusively in JS code. In C++ code,
 // prefer TypeRepresentation::Scalar etc, which allows you to
 // write a switch which will receive a warning if you omit a case.
-#define JS_TYPEREPR_UNSIZED_ARRAY_KIND  0
-#define JS_TYPEREPR_MAX_UNSIZED_KIND    0    // Unsized kinds go above here
 #define JS_TYPEREPR_SCALAR_KIND         1
 #define JS_TYPEREPR_REFERENCE_KIND      2
 #define JS_TYPEREPR_STRUCT_KIND         3
-#define JS_TYPEREPR_SIZED_ARRAY_KIND    4
+#define JS_TYPEREPR_ARRAY_KIND          4
 #define JS_TYPEREPR_SIMD_KIND           5
 
 // These constants are for use exclusively in JS code. In C++ code,
 // prefer Scalar::Int8 etc, which allows you to write a switch which will
 // receive a warning if you omit a case.
 #define JS_SCALARTYPEREPR_INT8          0
 #define JS_SCALARTYPEREPR_UINT8         1
 #define JS_SCALARTYPEREPR_INT16         2

--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -270,18 +270,17 @@ frontend::CompileScript(ExclusiveContext
                                     /* foldConstants = */ true,
                                     canLazilyParse ? syntaxParser.ptr() : nullptr, nullptr);
     parser.sct = sct;
     parser.ss = ss;
 
     Directives directives(options.strictOption);
     GlobalSharedContext globalsc(cx, scopeChain, directives, options.extraWarningsOption);
 
-    bool savedCallerFun = options.compileAndGo &&
-                          evalCaller && evalCaller->functionOrCallerFunction();
+    bool savedCallerFun = evalCaller && evalCaller->functionOrCallerFunction();
     Rooted<JSScript*> script(cx, JSScript::Create(cx, NullPtr(), savedCallerFun,
                                                   options, staticLevel, sourceObject, 0,
                                                   srcBuf.length()));
     if (!script)
         return nullptr;
 
     // We can specialize a bit for the given scope chain if that scope chain is the global object.
     JSObject *globalScope =
@@ -307,17 +306,17 @@ frontend::CompileScript(ExclusiveContext
                /* blockScopeDepth = */ 0);
     if (!pc->init(parser.tokenStream))
         return nullptr;
 
     /* If this is a direct call to eval, inherit the caller's strictness.  */
     if (evalCaller && evalCaller->strict())
         globalsc.strict = true;
 
-    if (options.compileAndGo && evalCaller && evalCaller->functionOrCallerFunction()) {
+    if (savedCallerFun) {
         /*
          * An eval script in a caller frame needs to have its enclosing
          * function captured in case it refers to an upvar, and someone
          * wishes to decompile it while it's running.
          */
         JSFunction *fun = evalCaller->functionOrCallerFunction();
         Directives directives(/* strict = */ fun->strict());
         ObjectBox *funbox = parser.newFunctionBox(/* fn = */ nullptr, fun, pc.ptr(),

--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -399,21 +399,19 @@ GetObjectAllocKindForCopy(const Nursery 
         // Figure out the size of this object, from the prototype's TypeDescr.
         // The objects we are traversing here are all tenured, so we don't need
         // to check forwarding pointers.
         TypeDescr *descr = &obj->as<InlineTypedObject>().typeDescr();
         MOZ_ASSERT(!IsInsideNursery(descr));
         return InlineTypedObject::allocKindForTypeDescriptor(descr);
     }
 
-    // Outline typed objects have special requirements for their allocation kind.
-    if (obj->is<OutlineTypedObject>()) {
-        TypeDescr *descr = &obj->as<OutlineTypedObject>().typeDescr();
-        return OutlineTypedObject::allocKindForTypeDescriptor(descr);
-    }
+    // Outline typed objects use the minimum allocation kind.
+    if (obj->is<OutlineTypedObject>())
+        return FINALIZE_OBJECT0;
 
     // The only non-native objects in existence are proxies and typed objects.
     MOZ_ASSERT(obj->isNative());
 
     AllocKind kind = GetGCObjectFixedSlotsKind(obj->as<NativeObject>().numFixedSlots());
     MOZ_ASSERT(!IsBackgroundFinalized(kind));
     MOZ_ASSERT(CanBeFinalizedInBackground(kind, obj->getClass()));
     return GetBackgroundAllocKind(kind);

--- a/js/src/jit-test/tests/TypedObject/Bug981650.js
+++ b/js/src/jit-test/tests/TypedObject/Bug981650.js
@@ -1,10 +1,9 @@
-// Fuzz bug 981650: Test creating an unsized array type based on an instance of
+// Fuzz bug 981650: Test creating an array type based on an instance of
 // that same type.
 
 if (typeof TypedObject === "undefined")
   quit();
 
 var T = TypedObject;
-var AT = new T.ArrayType(T.int32);
-var v = new AT(10);
-new AT(v);
+var v = new T.ArrayType(T.int32, 10);
+new v(v);

--- a/js/src/jit-test/tests/TypedObject/atopneuteredbuffer.js
+++ b/js/src/jit-test/tests/TypedObject/atopneuteredbuffer.js
@@ -4,21 +4,21 @@
 if (typeof TypedObject === "undefined")
   quit();
 
 load(libdir + "asserts.js")
 
 var {StructType, uint32, Object, Any, storage, objectType} = TypedObject;
 
 function main(variant) { // once a C programmer, always a C programmer.
-  var Uints = uint32.array();
+  var Uints = uint32.array(0);
   var Unit = new StructType({});   // Empty struct type
   var buffer = new ArrayBuffer(0); // Empty buffer
   var p = new Unit(buffer);        // OK
   neuter(buffer, variant);
   assertThrowsInstanceOf(() => new Unit(buffer), TypeError,
                          "Able to instantiate atop neutered buffer");
-  assertThrowsInstanceOf(() => new Uints(buffer, 0), TypeError,
+  assertThrowsInstanceOf(() => new Uints(buffer), TypeError,
                          "Able to instantiate atop neutered buffer");
 }
 
 main("same-data");
 main("change-data");