Bug 1580733 - Fix AppConstants module getter, r=evilpie,mconley Differential Revision: https://phabricator.services.mozilla.com/D47899

Bug 1572147 - Part 3: Remove includes to builtin/String.h. r=evilpie Multiple files were including builtin/String.h, but not actually using any function definitions from builtin/String.h. Depends on D41040 Differential Revision: https://phabricator.services.mozilla.com/D41041

Bug 1572147 - Part 2: Remove unused includes from builtin/String.h. r=evilpie Depends on D41039 Differential Revision: https://phabricator.services.mozilla.com/D41040

Bug 1572147 - Part 1: Remove no longer used String functions from self-hosting global. r=evilpie These functions were only exposed for the String generics. Differential Revision: https://phabricator.services.mozilla.com/D41039

Bug 1544834 - Replace deprecated generics in test code r=evilpie - `Array.map` becomes `Array.from` - Array copying via `Array.slice` becomes `Array.from`. - `Array.forEach` that did not rely on closures becomes `for`-`of` loops. - Anything else: `Array.X` becomes `Array.prototype.X`. Complex cases: dom/bindings/test/TestInterfaceJS.js and dom/bindings/test/test_exception_options_from_jsimplemented.html use `Array.indexOf` to generate an error with a specific error message. Switched to `Array.prototype.forEach` to generate the same error. js/src/jit-test/tests/basic/exception-column-number.js In this test `Array.indexOf()` is used to generate an error. Since the exact message doesn't matter, I switched to `Array.from()`. Intentionally not changed: editor/libeditor/tests/browserscope/lib/richtext/richtext/js/range.js Did not modify because this is 3rd-party code and the code uses feature detection as a fall back when Array generics are not used. testing/talos/talos/tests/dromaeo/lib/mootools.js Did not modify because mootools adds the `Array.slice` method to the `Array` object. Not changed because they check the implementation of Array generics: js/src/jit-test/tests/basic/arrayNatives.js js/src/jit-test/tests/basic/bug563243.js js/src/jit-test/tests/basic/bug618853.js js/src/jit-test/tests/basic/bug830967.js js/src/jit-test/tests/jaeger/recompile/bug656753.js js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js js/src/tests/non262/Array/generics.js js/src/tests/non262/Array/regress-415540.js js/src/tests/non262/extensions/regress-355497.js js/src/tests/non262/extensions/typedarray-set-neutering.js Depends on D27802 Differential Revision: https://phabricator.services.mozilla.com/D27803

Bug 1544834 - Replace non-test uses of deprecated Array generics r=evilpie,dao - `Array.forEach` becomes for-of loop or `array.forEach`. - `Array.slice(a)` or `Array.slice(a, 0)` becomes `Array.from(a)`. - `Array.map` becomes `Array.from` - `Array` copy + concatenation becomes Array literal + spread syntax. - All other `Array.X(a, ...)` become `Array.prototype.X.call` or `Array.from(a).X(...)` Differential Revision: https://phabricator.services.mozilla.com/D27802

Bug 1527592 - Preserve callable/constructor flags when returning a dead object proxy from Compartment::wrap. r=evilpie,jorendorff Differential Revision: https://phabricator.services.mozilla.com/D19945

Bug 1525674 part 4 - Move Ion's Iterator{More,Close} code to the MacroAssembler and use it in Baseline instead of ICs. r=evilpie Differential Revision: https://phabricator.services.mozilla.com/D18929

Bug 1525674 part 3 - Rename JSObject::ITER_CLASS_NFIXED_SLOTS to PropertyIteratorObject::NUM_FIXED_SLOTS. r=evilpie Differential Revision: https://phabricator.services.mozilla.com/D18928

Bug 1525674 part 2 - Make js::IteratorMore (and the JIT-inlined equivalent) infallible. r=evilpie This also removes some dead BaselineInspector code. Differential Revision: https://phabricator.services.mozilla.com/D18927

Bug 1525674 part 1 - Change the enumerate proxy trap to return the jsid vector instead of an iterator. r=bzbarsky,evilpie In vm/Iteration.cpp this inlines some functions because there's a single caller now. Follow-up patches will do additional cleanup/optimization. Differential Revision: https://phabricator.services.mozilla.com/D18926

Bug 1521677. Change defineProperties to handle non-configurable properties on WindowProxy like defineProperty does. r=evilpie We want to indicate "we didn't actually manage to define your properties as non-configurable" but we don't want to throw exceptions when people try to Object.defineProperties with a non-configurable property in the list on a WindowProxy. Though maybe we should just silently ignore the "can't define non-configurable on WindowProxy" bits in defineProperties and just return the object anyway? The reason we do the "return null" bit in defineProperty is so that Caja and the like can detect it, but if they're not using defineProperties to start with they may not need to detect this "failure". On the other hand, Mark Miller thinks the detection will be needed... Differential Revision: https://phabricator.services.mozilla.com/D17516

Bug 1522068 - Baseline-compile JSOP_SETINTRINSIC. r=evilpie Differential Revision: https://phabricator.services.mozilla.com/D17497

Bug 1517690 - Fix BaselineInspector to match new CacheIR ops for WindowProxy unwrapping. r=evilpie Differential Revision: https://phabricator.services.mozilla.com/D15729

Bug 1509768 - Handle the case that String#replace is called with a empty string pattern on a rope. r=evilpie

Bug 1505511 - Part 2: Use ClassSpec in WeakSetObject. r=evilpie

Bug 1505511 - Part 1: Use ClassSpec in WeakMapObject. r=evilpie

Bug 1499335 - Support module specifiers containing inline data in the shell r=evilpie

Bug 1500267 - Record op in SetPropIRGenerator CacheIR logs r=evilpie Depends on D9167 Differential Revision: https://phabricator.services.mozilla.com/D9168

Bug 1500052 - Fix iterator cache to check getDenseInitializedLength() == 0 instead of hasEmptyElements(). r=evilpie hasEmptyElements() is too pessimistic: arrays often have no elements but aren't using the empty elements singleton. Differential Revision: https://phabricator.services.mozilla.com/D9083

Bug 1494647: Add flags section to CacheIR spew, and report dictionary mode r=evilpie Differential Revision: https://phabricator.services.mozilla.com/D8761

Bug 1496863 - Remove an obsolete comment. r=evilpie

Bug 1496863 - Use precise capture-lists for the various lambdas in CharacterEncoding.cpp, rather than using [&] and capturing everything willy-nilly by reference. r=evilpie

Bug 1496863 - Add a constexpr char16_t unicode::REPLACEMENT_CHARACTER, and change the two (!) separate const char16_t variables of the same value in CharacterEncoding.cpp with it. r=evilpie

Bug 1490348 - Improve CacheIR Spew for arrays r=evilpie Differential Revision: https://phabricator.services.mozilla.com/D6048

Bug 1490632 - Always use braces for if/for/while statements in js/ipc. r=evilpie Differential Revision: https://phabricator.services.mozilla.com/D5661

Bug 1488698 - Always use braces for if/for/while statements in js/src/jit, part 6. r=evilpie

Bug 1488698 - Always use braces for if/for/while statements in js/src/proxy. r=evilpie

Bug 1488698 - Always use braces for if/for/while statements in js/src/builtin, part 3. r=evilpie

Bug 1469019 - Object.fromEntries. r=evilpie, r=peterv

Bug 1483806 - Guard CACHEIR_SPEW only member variable in NewObjectIRGenerator. r=evilpie

Bug 1482364: Allow bitwise value comparison for strict-equals even when object emulates undefined. r=evilpie

Bug 1481229 part 2 - Always use the unwrapped object in Logging::formatObject. r=evilpie

Bug 1481229 part 1 - Remove unnecessary realm entering in JavaScriptShared::findObjectById. r=evilpie ToWindowProxyIfWindow does not rely on the current realm in any way.

Bug 1477375 Ensure we actually disable all CacheIR Stubs when requested with --cache-ir-stubs=off. r=evilpie

Bug 1475177 - Change sendCommand xpcshell function to only accept plain JSFunction callbacks. r=evilpie

Bug 1473255 - Restore caller realm in the interpreter after calling a JITted function. r=evilpie

Bug 1471788: Apply ToNumber conversion even when the typed array write is out-of-bounds. r=evilpie

Bug 1470890 - handle deserialization failure gracefully in JS IPC; r=evilpie Summary: This primarily affects the efficiency of fuzzing. Reviewers: evilpie Reviewed By: evilpie Bug #: 1470890 Differential Revision: https://phabricator.services.mozilla.com/D1797

Bug 1468816 - Add result to UnaryArith CacheIR spew. r=evilpie

Bug 1470181 - handle deserialization failure gracefully in JS IPC; r=evilpie This primarily effects the efficiency of fuzzing. Differential Revision: https://phabricator.services.mozilla.com/D1751

Bug 859782 - Firefox cannot start without /proc (chroot). r=sfink,evilpie,jld Firefox uses the current stack frame address and the stack size as a sort of heuristic for various things in the javascript engine. The js::GetNativeStackBaseImpl() function is used to get the base stack address (ie the address from which the stack grows, so this can be either the first or last memory address of the stack memory space depending on the CPU architecture). On Linux, this function is implemented using the pthreads APIs. For non-main threads, the queried thread info is stored in memory. The main thread does not have this information on hand, so it gets the stack memory range via the /proc/self/maps file ( see glibc's pthread_get_attr_np.c ). Fortunately (per discussions with the firefox devs in #jsapi) the base address only needs to be approximation. In reality, environment variables, args, and other things are stored in space between the end/beginning of the mapped stack memory and the 'top' of the stack space used by stack frames. We can get the top of this usable stack from __libc_stack_end, which is a void* set by glibc during program initialization. Non-main threads still get their stack-base through the usual pthreads APIs.

Bug 1468406 part 3 - Add some obj->as<Foo>() casts to eliminate some JSObject::realm() calls. r=evilpie

Bug 1468252 part 6 - Use isSelfHostingZone instead of isSelfHostingGlobal in getNonWrapperObjectForCurrentCompartment. r=evilpie

Bug 1468252 part 2 - Rename GetOriginalEval to GetRealmOriginalEval, remove scope argument. r=evilpie

Bug 1468137 - Remove JS_Get*Prototype APIs; use JS::GetRealm*Prototype instead. r=evilpie

Bug 1465860 - Don't crash in JS IPC on invalid object id. r=evilpie Instead, return an error up to the caller, who can return an IPC error, which will kill the child. This is significantly friendlier to fuzzing. MozReview-Commit-ID: C67xSqUeN1i

Bug 1464134 part 4 - Rename CompileCompartment to CompileRealm. r=evilpie

Bug 1461938 part 40 - Use private inheritance. r=evilpie

Bug 1461938 part 29 - Move validAccessPtr to JS::Realm. r=evilpie