Merge fx-team to m-c.
authorRyan VanderMeulen <ryanvm@gmail.com>
Wed, 05 Jun 2013 16:28:59 -0400
changeset 134140 ec4504144bcfd34a4c4458bda80e92464db4ada7
parent 134138 89a5a4c14185ebbd8d79bb72d732ba722f228c9d (diff)
parent 134139 0f23a2e50620f0932469697df5f8fbe1596b34fa (current diff)
child 134141 204de5b7e0a6dd2d79c2b0378d1104ecac01b1f3
push id29067
push userryanvm@gmail.com
push dateWed, 05 Jun 2013 20:37:20 +0000
treeherdermozilla-inbound@72fbfb2f8e51 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone24.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge fx-team to m-c.
--- a/browser/components/search/content/search.xml
+++ b/browser/components/search/content/search.xml
@@ -451,35 +451,37 @@
             where = whereToOpenLink(aEvent, false, true);
           }
           else {
             var newTabPref = textBox._prefBranch.getBoolPref("browser.search.openintab");
             if ((aEvent && aEvent.altKey) ^ newTabPref)
               where = "tab";
           }
 
-          // Save the current value in the form history
-          if (textValue && !PrivateBrowsingUtils.isWindowPrivate(window)) {
-            this.FormHistory.update(
-              { op : "bump",
-                fieldname : textBox.getAttribute("autocompletesearchparam"),
-                value : textValue },
-              { handleError : function(aError) {
-                  Components.utils.reportError("Saving search to form history failed: " + aError.message);
-              }});
-          }
-
           this.doSearch(textValue, where);
         ]]></body>
       </method>
 
       <method name="doSearch">
         <parameter name="aData"/>
         <parameter name="aWhere"/>
         <body><![CDATA[
+          var textBox = this._textbox;
+        
+          // Save the current value in the form history
+          if (aData && !PrivateBrowsingUtils.isWindowPrivate(window)) {
+            this.FormHistory.update(
+              { op : "bump",
+                fieldname : textBox.getAttribute("autocompletesearchparam"),
+                value : aData },
+              { handleError : function(aError) {
+                  Components.utils.reportError("Saving search to form history failed: " + aError.message);
+              }});
+          }
+          
           // null parameter below specifies HTML response for search
           var submission = this.currentEngine.getSubmission(aData);
           BrowserSearch.recordSearchInHealthReport(this.currentEngine.name, "searchbar");
           openUILinkIn(submission.uri.spec, aWhere, null, submission.postData);
         ]]></body>
       </method>
     </implementation>
 
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -493,16 +493,18 @@
 @BINPATH@/components/servicesComponents.manifest
 @BINPATH@/components/cryptoComponents.manifest
 @BINPATH@/components/TelemetryPing.js
 @BINPATH@/components/TelemetryPing.manifest
 @BINPATH@/components/messageWakeupService.js
 @BINPATH@/components/messageWakeupService.manifest
 @BINPATH@/components/SettingsManager.js
 @BINPATH@/components/SettingsManager.manifest
+@BINPATH@/components/SettingsService.js
+@BINPATH@/components/SettingsService.manifest
 @BINPATH@/components/Webapps.js
 @BINPATH@/components/Webapps.manifest
 @BINPATH@/components/AppsService.js
 @BINPATH@/components/AppsService.manifest
 @BINPATH@/components/nsDOMIdentity.js
 @BINPATH@/components/nsIDService.js
 @BINPATH@/components/Identity.manifest
 @BINPATH@/components/recording-cmdline.js
--- a/browser/metro/base/content/browser-ui.js
+++ b/browser/metro/base/content/browser-ui.js
@@ -1404,16 +1404,17 @@ var StartUI = {
     "RemoteTabsStartView"
   ],
 
   init: function init() {
     Elements.startUI.addEventListener("autocompletestart", this, false);
     Elements.startUI.addEventListener("autocompleteend", this, false);
     Elements.startUI.addEventListener("contextmenu", this, false);
     Elements.startUI.addEventListener("click", this, false);
+    Elements.startUI.addEventListener("MozMousePixelScroll", this, false);
 
     this.sections.forEach(function (sectionName) {
       let section = window[sectionName];
       if (section.init)
         section.init();
     });
   },
 
@@ -1507,16 +1508,26 @@ var StartUI = {
       case "contextmenu":
         let event = document.createEvent("Events");
         event.initEvent("MozEdgeUICompleted", true, false);
         window.dispatchEvent(event);
         break;
       case "click":
         this.onClick(aEvent);
         break;
+
+      case "MozMousePixelScroll":
+        let startBox = document.getElementById("start-scrollbox");
+        let [, scrollInterface] = ScrollUtils.getScrollboxFromElement(startBox);
+
+        scrollInterface.scrollBy(aEvent.detail, 0);
+
+        aEvent.preventDefault();
+        aEvent.stopPropagation();
+        break;
     }
   }
 };
 
 var SyncPanelUI = {
   init: function() {
     // Run some setup code the first time the panel is shown.
     Elements.syncFlyout.addEventListener("PopupChanged", function onShow(aEvent) {
--- a/browser/metro/base/content/browser.xul
+++ b/browser/metro/base/content/browser.xul
@@ -191,36 +191,36 @@
             <toolbarbutton id="newtab-button" command="cmd_newTab" label="&newtab.label;"/>
           </vbox>
         </hbox>
 
         <!-- Start UI -->
         <hbox id="start-container" flex="1" observes="bcast_windowState" class="meta content-height content-width">
           <!-- portrait/landscape/filled view -->
           <hbox id="start" class="start-page" flex="1" observes="bcast_windowState">
-            <scrollbox id="start-scrollbox" orient="horizontal" flex="1">
-            <vbox id="start-topsites" class="meta-section">
-              <label class="meta-section-title" value="&startTopSitesHeader.label;"/>
-              <richgrid id="start-topsites-grid" rows="3" columns="3" seltype="multiple" flex="1"/>
-            </vbox>
-            <vbox id="start-bookmarks" class="meta-section">
-              <label class="meta-section-title" value="&startBookmarksHeader.label;"
-                onclick="PanelUI.show('bookmarks-container');"/>
-              <richgrid id="start-bookmarks-grid" seltype="multiple" flex="1"/>
-            </vbox>
-            <vbox id="start-history" class="meta-section">
-              <label class="meta-section-title" value="&startHistoryHeader.label;"
-                onclick="PanelUI.show('history-container');"/>
-              <richgrid id="start-history-grid" seltype="multiple" flex="1"/>
-            </vbox>
-            <vbox id="start-remotetabs" class="meta-section">
-              <label class="meta-section-title" value="&startRemoteTabsHeader.label;"
-                onclick="PanelUI.show('remotetabs-container');"/>
-              <richgrid id="start-remotetabs-grid" seltype="multiple" flex="1"/>
-            </vbox>
+            <scrollbox id="start-scrollbox" orient="horizontal" observes="bcast_preciseInput" flex="1">
+              <vbox id="start-topsites" class="meta-section">
+                <label class="meta-section-title" value="&startTopSitesHeader.label;"/>
+                <richgrid id="start-topsites-grid" rows="3" columns="3" seltype="multiple" flex="1"/>
+              </vbox>
+              <vbox id="start-bookmarks" class="meta-section">
+                <label class="meta-section-title" value="&startBookmarksHeader.label;"
+                  onclick="PanelUI.show('bookmarks-container');"/>
+                <richgrid id="start-bookmarks-grid" seltype="multiple" flex="1"/>
+              </vbox>
+              <vbox id="start-history" class="meta-section">
+                <label class="meta-section-title" value="&startHistoryHeader.label;"
+                  onclick="PanelUI.show('history-container');"/>
+                <richgrid id="start-history-grid" seltype="multiple" flex="1"/>
+              </vbox>
+              <vbox id="start-remotetabs" class="meta-section">
+                <label class="meta-section-title" value="&startRemoteTabsHeader.label;"
+                  onclick="PanelUI.show('remotetabs-container');"/>
+                <richgrid id="start-remotetabs-grid" seltype="multiple" flex="1"/>
+              </vbox>
             </scrollbox>
           </hbox>
           <!-- snapped view -->
           <vbox id="snapped-start" class="start-page" observes="bcast_windowState">
             <scrollbox id="snapped-scrollbox" orient="vertical" flex="1">
               <vbox id="snapped-topsites">
                 <label class="meta-section-title" value="&startTopSitesHeader.label;"/>
                 <richgrid id="snapped-topsites-grid" class="canSnapTiles" rows="8" columns="1" flex="1"/>
@@ -235,17 +235,17 @@
           </vbox>
           <!-- Autocompletion interface -->
           <box id="start-autocomplete" observes="bcast_windowState"/>
         </hbox>
       </vbox> <!-- end tray -->
 
       <!-- Content viewport -->
       <stack id="content-viewport">
-        <deck id="browsers" flex="1"/>
+        <deck id="browsers" flex="1" observes="bcast_preciseInput"/>
         <box id="vertical-scroller" class="scroller" orient="vertical" end="0" top="0"/>
         <box id="horizontal-scroller" class="scroller" orient="horizontal" left="0" bottom="0"/>
       </stack>
     </vbox>
 
     <!-- popup for content navigator helper -->
     <vbox id="content-navigator">
       <textbox id="find-helper-textbox" class="search-bar content-navigator-item" oncommand="FindHelperUI.search(this.value)" oninput="FindHelperUI.updateCommands(this.value);" type="search"/>
--- a/browser/metro/base/content/cursor.css
+++ b/browser/metro/base/content/cursor.css
@@ -12,8 +12,13 @@ xul|*:-moz-system-metric(touch-enabled) 
 html|*:-moz-system-metric(touch-enabled) {
   cursor: none !important;
 }
 
 /* For touch input, *all* select boxes use the SelectHelper popup. */
 select option, select optgroup {
   pointer-events: none;
 }
+
+/* Style the scrollbars */
+html xul|scrollbar {
+  display: none;
+}
--- a/browser/metro/base/content/helperui/FindHelperUI.js
+++ b/browser/metro/base/content/helperui/FindHelperUI.js
@@ -110,18 +110,20 @@ var FindHelperUI = {
 
     // See bindings.xml
     this._container.show(this);
 
     this.search(this._textbox.value);
     this._textbox.select();
     this._textbox.focus();
     this._open = true;
-    Elements.browsers.setAttribute("findbar", true);
-    setTimeout(() => this._container.setAttribute("showing", true), 0);
+    setTimeout(() => {
+      Elements.browsers.setAttribute("findbar", true);
+      this._container.setAttribute("showing", true)
+    }, 0);
 
     // Prevent the view to scroll automatically while searching
     Browser.selectedBrowser.scrollSync = false;
   },
 
   hide: function findHelperHide() {
     if (!this._open)
       return;
--- a/browser/metro/theme/browser.css
+++ b/browser/metro/theme/browser.css
@@ -657,18 +657,20 @@ setting[type="radio"] > vbox {
   display: none;
 }
 
 #start-container[startpage],
 #start-container[filtering] {
   display: -moz-box;
 }
 
-#start-scrollbox {
-  overflow: hidden;
+#start-scrollbox[input="precise"] {
+  overflow-x: scroll;
+  /* Move scrollbar above toolbar, discount padding added by .meta in #start-container */
+  margin-bottom: calc(@toolbar_height@ - @metro_spacing_normal@);
 }
 
 /* if autocomplete is set, hide both start pages,
  *  else hide the autocomplete screen */
 #start-container[filtering] > .start-page,
 #start-container:not([filtering]) > #start-autocomplete {
   visibility: collapse;
 }
@@ -984,16 +986,20 @@ setting[type="radio"] > vbox {
 }
 
 .scroller[orient="horizontal"] {
   min-height: @scroller_thickness@;
   height: @scroller_thickness@;
   min-width: @scroller_minimum@;
 }
 
+#browsers[input="imprecise"] browser {
+  overflow: hidden;
+}
+
 /* Text selection handles */
 
 #selectionhandle-mark1,
 #selectionhandle-mark2,
 #selectionhandle-mark3 {
   list-style-image: url("chrome://browser/skin/images/selection-monocle.png");
   border: 0px solid gray;
   padding: 0px;
--- a/browser/metro/theme/content.css
+++ b/browser/metro/theme/content.css
@@ -7,93 +7,16 @@
 
 @namespace url("http://www.w3.org/1999/xhtml");
 @namespace xul url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
 
 *:-moz-any-link:focus {
   outline-offset: -2px;
 }
 
-/* Style the scrollbars */
-html xul|scrollbar {
-  display: none;
-}
-
-xul|window xul|scrollbar {
-  display: block;
-}
-
-xul|window xul|scrollbar[orient="vertical"] {
-  -moz-appearance: none !important;
-  opacity: 0;
-  position: relative;
-  margin-left: -8px;
-  min-width: 8px;
-  background-color: transparent !important;
-  background-image: none !important;
-  border: 0px solid transparent !important;
-}
-
-xul|window xul|scrollbar[orient="vertical"]:-moz-locale-dir(rtl) {
-  margin-left: 2px;
-  margin-right: -10px;
-}
-
-xul|window xul|scrollbar[orient="vertical"] xul|thumb {
-  max-width: 6px !important;
-  min-width: 6px !important;
-}
-
-xul|window xul|scrollbar[orient="horizontal"] {
-  -moz-appearance: none !important;
-  opacity: 0;
-  position: relative;
-  min-height: 8px;
-  margin-top: -8px;
-  background-color: transparent !important;
-  background-image: none !important;
-  border: 0px solid transparent !important;
-}
-
-xul|window xul|scrollbar[orient="horizontal"] xul|thumb {
-  max-height: 6px !important;
-  min-height: 6px !important;
-}
-
-xul|window xul|*[panning] xul|scrollbar {
-  opacity: 1;
-}
-
-xul|window xul|scrollbox {
-  overflow-y: scroll;
-  overflow-x: scroll;
-}
-
-xul|window xul|scrollbarbutton {
-  min-height: 8px !important;
-  min-width: 8px !important;
-  -moz-appearance: none !important;
-  visibility: hidden;
-}
-
-xul|window xul|scrollbarbutton[sbattr="scrollbar-up-top"],
-xul|window xul|scrollbarbutton[sbattr="scrollbar-bottom-top"] {
-  display: none;
-}
-
-xul|window xul|scrollbar xul|thumb {
-  background-color: rgba(0, 0, 0, 0.4) !important;
-  -moz-border-top-colors: none !important;
-  -moz-border-bottom-colors: none !important;
-  -moz-border-right-colors: none !important;
-  -moz-border-left-colors: none !important;
-  border: 1px solid rgba(255, 255, 255, 0.4) !important;
-  border-radius: 3px;
-}
-
 select:not([size]):not([multiple]) > xul|scrollbar,
 select[size="1"] > xul|scrollbar,
 select:not([size]):not([multiple]) xul|scrollbarbutton,
 select[size="1"] xul|scrollbarbutton {
   display: block;
   margin-left: 0;
   min-width: 16px;
 }
--- a/browser/metro/theme/forms.css
+++ b/browser/metro/theme/forms.css
@@ -14,19 +14,19 @@
   padding: 0;
   bottom: 0;
   transform: translateY(100%);
   transition: transform @metro_animation_duration@ @metro_animation_easing@,
               bottom @metro_animation_duration@ @metro_animation_easing@;
   background-color: @metro_orange@;
 }
 
-#content-navigator[type] {
+#content-navigator[showing] {
   transform: none;
- }
+}
 
 #content-navigator > .previous-button,
 #content-navigator > .next-button,
 #content-navigator > .close-button {
   min-width: @touch_button_small@ !important; /* button size */
   min-height: @touch_button_small@ !important; /* button size */
   border: none !important;
   background-image: none !important;
--- a/caps/include/nsScriptSecurityManager.h
+++ b/caps/include/nsScriptSecurityManager.h
@@ -22,17 +22,16 @@
 #include "nsIScriptExternalNameSet.h"
 
 #include "mozilla/StandardInteger.h"
 
 class nsIDocShell;
 class nsString;
 class nsIClassInfo;
 class nsIIOService;
-class nsIXPConnect;
 class nsIStringBundle;
 class nsSystemPrincipal;
 struct ClassPolicy;
 class ClassInfoData;
 class DomainPolicy;
 
 /////////////////////
 // PrincipalKey //
@@ -518,17 +517,16 @@ private:
     nsCOMPtr<nsIPrincipal> mSystemPrincipal;
     bool mPrefInitialized;
     bool mIsJavaScriptEnabled;
     bool mPolicyPrefsChanged;
 
     static bool sStrictFileOriginPolicy;
 
     static nsIIOService    *sIOService;
-    static nsIXPConnect    *sXPConnect;
     static nsIStringBundle *sStrBundle;
     static JSRuntime       *sRuntime;
 };
 
 #define NS_SECURITYNAMESET_CID \
  { 0x7c02eadc, 0x76, 0x4d03, \
  { 0x99, 0x8d, 0x80, 0xd7, 0x79, 0xc4, 0x85, 0x89 } }
 #define NS_SECURITYNAMESET_CONTRACTID "@mozilla.org/security/script/nameset;1"
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -67,17 +67,16 @@
 #define WEBAPPS_PERM_NAME "webapps-manage"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 static NS_DEFINE_CID(kZipReaderCID, NS_ZIPREADER_CID);
 
 nsIIOService    *nsScriptSecurityManager::sIOService = nullptr;
-nsIXPConnect    *nsScriptSecurityManager::sXPConnect = nullptr;
 nsIStringBundle *nsScriptSecurityManager::sStrBundle = nullptr;
 JSRuntime       *nsScriptSecurityManager::sRuntime   = 0;
 bool nsScriptSecurityManager::sStrictFileOriginPolicy = true;
 
 bool
 nsScriptSecurityManager::SubjectIsPrivileged()
 {
     JSContext *cx = GetCurrentJSContext();
@@ -256,24 +255,24 @@ private:
     bool mDidGetFlags;
     bool mMustFreeName;
 };
 
 JSContext *
 nsScriptSecurityManager::GetCurrentJSContext()
 {
     // Get JSContext from stack.
-    return sXPConnect->GetCurrentJSContext();
+    return nsXPConnect::XPConnect()->GetCurrentJSContext();
 }
 
 JSContext *
 nsScriptSecurityManager::GetSafeJSContext()
 {
     // Get JSContext from stack.
-    return sXPConnect->GetSafeJSContext();
+    return nsXPConnect::XPConnect()->GetSafeJSContext();
 }
 
 /* static */
 bool
 nsScriptSecurityManager::SecurityCompareURIs(nsIURI* aSourceURI,
                                              nsIURI* aTargetURI)
 {
     return NS_SecurityCompareURIs(aSourceURI, aTargetURI, sStrictFileOriginPolicy);
@@ -2052,17 +2051,17 @@ nsScriptSecurityManager::doGetObjectPrin
 // static
 nsIPrincipal*
 nsScriptSecurityManager::old_doGetObjectPrincipal(JS::Handle<JSObject*> aObj,
                                                   bool aAllowShortCircuit)
 {
     NS_ASSERTION(aObj, "Bad call to doGetObjectPrincipal()!");
     nsIPrincipal* result = nullptr;
 
-    JSContext* cx = sXPConnect->GetCurrentJSContext();
+    JSContext* cx = nsXPConnect::XPConnect()->GetCurrentJSContext();
     JS::RootedObject obj(cx, aObj);
     JS::RootedObject origObj(cx, obj);
     js::Class *jsClass = js::GetObjectClass(obj);
 
     // A common case seen in this code is that we enter this function
     // with obj being a Function object, whose parent is a Call
     // object. Neither of those have object principals, so we can skip
     // those objects here before we enter the below loop. That way we
@@ -2087,18 +2086,18 @@ nsScriptSecurityManager::old_doGetObject
         }
     }
 
     do {
         // Note: jsClass is set before this loop, and also at the
         // *end* of this loop.
         
         if (IS_WRAPPER_CLASS(jsClass)) {
-            result = sXPConnect->GetPrincipal(obj,
-                                              aAllowShortCircuit);
+            result = nsXPConnect::XPConnect()->GetPrincipal(obj,
+                                                            aAllowShortCircuit);
             if (result) {
                 break;
             }
         } else {
             nsISupports *priv;
             if (!(~jsClass->flags & (JSCLASS_HAS_PRIVATE |
                                      JSCLASS_PRIVATE_IS_NSISUPPORTS))) {
                 priv = (nsISupports *) js::GetObjectPrivate(obj);
@@ -2417,18 +2416,16 @@ nsScriptSecurityManager::nsScriptSecurit
 {
     MOZ_STATIC_ASSERT(sizeof(intptr_t) == sizeof(void*),
                       "intptr_t and void* have different lengths on this platform. "
                       "This may cause a security failure with the SecurityLevel union.");
 }
 
 nsresult nsScriptSecurityManager::Init()
 {
-    NS_ADDREF(sXPConnect = nsXPConnect::XPConnect());
-
     JSContext* cx = GetSafeJSContext();
     if (!cx) return NS_ERROR_FAILURE;   // this can happen of xpt loading fails
     
     ::JS_BeginRequest(cx);
     if (sEnabledID == JSID_VOID)
         sEnabledID = INTERNED_STRING_TO_JSID(cx, ::JS_InternString(cx, "enabled"));
     ::JS_EndRequest(cx);
 
@@ -2448,21 +2445,17 @@ nsresult nsScriptSecurityManager::Init()
     // Create our system principal singleton
     nsRefPtr<nsSystemPrincipal> system = new nsSystemPrincipal();
     NS_ENSURE_TRUE(system, NS_ERROR_OUT_OF_MEMORY);
 
     mSystemPrincipal = system;
 
     //-- Register security check callback in the JS engine
     //   Currently this is used to control access to function.caller
-    nsCOMPtr<nsIJSRuntimeService> runtimeService =
-        do_QueryInterface(sXPConnect, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = runtimeService->GetRuntime(&sRuntime);
+    rv = nsXPConnect::XPConnect()->GetRuntime(&sRuntime);
     NS_ENSURE_SUCCESS(rv, rv);
 
     static const JSSecurityCallbacks securityCallbacks = {
         CheckObjectAccess,
         ContentSecurityPolicyPermitsJSAction
     };
 
     MOZ_ASSERT(!JS_GetSecurityCallbacks(sRuntime));
@@ -2493,17 +2486,16 @@ nsScriptSecurityManager::Shutdown()
     if (sRuntime) {
         JS_SetSecurityCallbacks(sRuntime, nullptr);
         JS_SetTrustedPrincipals(sRuntime, nullptr);
         sRuntime = nullptr;
     }
     sEnabledID = JSID_VOID;
 
     NS_IF_RELEASE(sIOService);
-    NS_IF_RELEASE(sXPConnect);
     NS_IF_RELEASE(sStrBundle);
 }
 
 nsScriptSecurityManager *
 nsScriptSecurityManager::GetScriptSecurityManager()
 {
     if (!gScriptSecMan)
     {
@@ -2511,18 +2503,19 @@ nsScriptSecurityManager::GetScriptSecuri
 
         nsresult rv;
         rv = ssManager->Init();
         NS_ASSERTION(NS_SUCCEEDED(rv), "Failed to initialize nsScriptSecurityManager");
         if (NS_FAILED(rv)) {
             return nullptr;
         }
  
-        rv = sXPConnect->SetDefaultSecurityManager(ssManager,
-                                                   nsIXPCSecurityManager::HOOK_ALL);
+        rv = nsXPConnect::XPConnect()->
+            SetDefaultSecurityManager(ssManager,
+                                      nsIXPCSecurityManager::HOOK_ALL);
         if (NS_FAILED(rv)) {
             NS_WARNING("Failed to install xpconnect security manager!");
             return nullptr;
         }
 
         ClearOnShutdown(&gScriptSecMan);
         gScriptSecMan = ssManager;
     }
@@ -2540,18 +2533,18 @@ nsScriptSecurityManager::SystemPrincipal
         NS_ADDREF(sysprin = gScriptSecMan->mSystemPrincipal);
     return static_cast<nsSystemPrincipal*>(sysprin);
 }
 
 nsresult
 nsScriptSecurityManager::InitPolicies()
 {
     // Clear any policies cached on XPConnect wrappers
-    NS_ENSURE_STATE(sXPConnect);
-    nsresult rv = sXPConnect->ClearAllWrappedNativeSecurityPolicies();
+    nsresult rv =
+        nsXPConnect::XPConnect()->ClearAllWrappedNativeSecurityPolicies();
     if (NS_FAILED(rv)) return rv;
 
     //-- Clear mOriginToPolicyMap: delete mapped DomainEntry items,
     //-- whose dtor decrements refcount of stored DomainPolicy object
     delete mOriginToPolicyMap;
     
     //-- Marks all the survivor DomainPolicy objects (those cached
     //-- by nsPrincipal objects) as invalid: they will be released
--- a/caps/tests/mochitest/test_bug470804.html
+++ b/caps/tests/mochitest/test_bug470804.html
@@ -18,19 +18,19 @@ https://bugzilla.mozilla.org/show_bug.cg
 <script type="application/javascript">
 
 /** Test for Bug 470804
     Passing a null targetURL to checkLoadURIWithPrincipal shouldn't crash
  **/
 
 netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
 const nsIScriptSecurityManager = Components.interfaces.nsIScriptSecurityManager;
-var secMan = Components.classes["@mozilla.org/scriptsecuritymanager;1"]
+var secMan = SpecialPowers.Cc["@mozilla.org/scriptsecuritymanager;1"]
                        .getService(nsIScriptSecurityManager);
-var principal = SpecialPowers.getNodePrincipal(document);
+var principal = SpecialPowers.wrap(document).nodePrincipal;
 isnot(principal, undefined, "Should have a principal");
 isnot(principal, null, "Should have a non-null principal");
 is(secMan.isSystemPrincipal(principal), false,
    "Shouldn't have system principal here");
 try {
   secMan.checkLoadURIWithPrincipal(principal, null,
                                    nsIScriptSecurityManager.STANDARD);
 } catch (e) {
--- a/content/base/test/test_bug166235.html
+++ b/content/base/test/test_bug166235.html
@@ -58,19 +58,19 @@ https://bugzilla.mozilla.org/show_bug.cg
     is(clipboard.hasDataMatchingFlavors(["text/html"], 1,1), true);
   }
   function getClipboardData(mime) {
     var transferable = Cc['@mozilla.org/widget/transferable;1']
                          .createInstance(SpecialPowers.Ci.nsITransferable);
     transferable.init(getLoadContext());
     transferable.addDataFlavor(mime);
     clipboard.getData(transferable, 1);
-    var data = SpecialPowers.wrap({});
+    var data = SpecialPowers.createBlankObject();
     transferable.getTransferData(mime, data, {}) ;
-    return data;
+    return SpecialPowers.wrap(data);
   }
   function testClipboardValue(mime, expected, test) {
     var data = getClipboardData(mime);
     is (data.value == null ? data.value :
         data.value.QueryInterface(SpecialPowers.Ci.nsISupportsString).data,
       expected,
       mime + " value in the clipboard");
     return data.value;
--- a/content/base/test/test_bug353334.html
+++ b/content/base/test/test_bug353334.html
@@ -24,33 +24,31 @@ https://bugzilla.mozilla.org/show_bug.cg
 </div>
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
 /** Test for Bug 353334 **/
 SimpleTest.waitForExplicitFinish();
 
 function doPrincipalTest(id) {
-  var doc = $(id).contentDocument;
+  var doc = SpecialPowers.wrap($(id).contentDocument);
 
-  isnot(SpecialPowers.getNodePrincipal(doc), undefined, "Should have a principal");
-  isnot(SpecialPowers.getNodePrincipal(doc), null, "Should have a non-null principal");
-  is(SpecialPowers.getNodePrincipal(doc),
-     SpecialPowers.getNodePrincipal(document),
+  isnot(doc.nodePrincipal, undefined, "Should have a principal");
+  isnot(doc.nodePrincipal, null, "Should have a non-null principal");
+  is(doc.nodePrincipal.origin, SpecialPowers.wrap(document).nodePrincipal.origin,
      "Wrong principal for document in node with id='" + id + "'");
 }
 
 function doContentTest(id) {
   is($(id).contentDocument.documentElement.textContent, "PASS",
      "Script executed in wrong context in node with id='" + id + "'");
 }
 
 function checkPrincipal() {
-  is(SpecialPowers.getNodePrincipal(document) instanceof SpecialPowers.Ci.nsIPrincipal,
-     true,
+  ok(SpecialPowers.call_Instanceof(SpecialPowers.wrap(document).nodePrincipal, SpecialPowers.Ci.nsIPrincipal),
      "Should be a principal");
 }
 
 addLoadEvent(function() {
   checkPrincipal();
 
   for (var i of [ "one", "two", "three", "four" ]) {
     doPrincipalTest(i);
--- a/content/base/test/test_bug375314.html
+++ b/content/base/test/test_bug375314.html
@@ -57,16 +57,17 @@ var policy = {
     return Ci.nsIContentPolicy.ACCEPT;
   },
 
   shouldProcess: function(contentType, contentLocation, requestOrigin, context, mimeTypeGuess, extra) {
 
     return Ci.nsIContentPolicy.ACCEPT;
   }
 }
+policy = SpecialPowers.wrapCallbackObject(policy);
 
 // Register content policy
 var componentManager = SpecialPowers.wrap(SpecialPowers.Components).manager
                                                      .QueryInterface(Ci.nsIComponentRegistrar);
 
 componentManager.registerFactory(policyID, "Test content policy", policyName, policy);
 
 var categoryManager = Cc["@mozilla.org/categorymanager;1"].getService(Ci.nsICategoryManager);
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -597,17 +597,17 @@ WebGLContext::Render(gfxContext *ctx, gf
     if (!gl)
         return NS_OK;
 
     nsRefPtr<gfxImageSurface> surf = new gfxImageSurface(gfxIntSize(mWidth, mHeight),
                                                          gfxASurface::ImageFormatARGB32);
     if (surf->CairoStatus() != 0)
         return NS_ERROR_FAILURE;
 
-    gl->ReadPixelsIntoImageSurface(surf);
+    gl->ReadScreenIntoImageSurface(surf);
 
     bool srcPremultAlpha = mOptions.premultipliedAlpha;
     bool dstPremultAlpha = aFlags & RenderFlagPremultAlpha;
 
     if (!srcPremultAlpha && dstPremultAlpha) {
         gfxUtils::PremultiplyImageSurface(surf);
     } else if (srcPremultAlpha && !dstPremultAlpha) {
         gfxUtils::UnpremultiplyImageSurface(surf);
--- a/content/canvas/src/WebGLContextValidate.cpp
+++ b/content/canvas/src/WebGLContextValidate.cpp
@@ -60,16 +60,28 @@ WebGLProgram::UpdateInfo()
                 mAttribsInUse[loc] = true;
             } else {
                 mContext->GenerateWarning("program exceeds MAX_VERTEX_ATTRIBS");
                 return false;
             }
         }
     }
 
+    if (!mUniformInfoMap) {
+        mUniformInfoMap = new CStringToUniformInfoMap;
+        mUniformInfoMap->Init();
+        for (size_t i = 0; i < mAttachedShaders.Length(); i++) {
+            for (size_t j = 0; j < mAttachedShaders[i]->mUniforms.Length(); j++) {
+	        const WebGLMappedIdentifier& uniform = mAttachedShaders[i]->mUniforms[j];
+	        const WebGLUniformInfo& info = mAttachedShaders[i]->mUniformInfos[j];
+	        mUniformInfoMap->Put(uniform.mapped, info);
+            }
+        }
+    }
+
     return true;
 }
 
 /*
  * Verify that state is consistent for drawing, and compute max number of elements (maxAllowedCount)
  * that will be legal to be read from bound VBOs.
  */
 
--- a/content/canvas/src/WebGLProgram.cpp
+++ b/content/canvas/src/WebGLProgram.cpp
@@ -219,29 +219,16 @@ WebGLProgram::ReverseMapIdentifier(const
     // not found? return name unchanged. This case happens e.g. on bad user input, or when
     // we're not using identifier mapping, or if we didn't store an identifier in the map because
     // e.g. its mapping is trivial (as happens for short identifiers)
     reverseMappedName->Assign(name);
 }
 
 WebGLUniformInfo
 WebGLProgram::GetUniformInfoForMappedIdentifier(const nsACString& name) {
-    if (!mUniformInfoMap) {
-        // if the identifier-to-array-size map doesn't exist yet, build it now
-        mUniformInfoMap = new CStringToUniformInfoMap;
-        mUniformInfoMap->Init();
-        for (size_t i = 0; i < mAttachedShaders.Length(); i++) {
-            for (size_t j = 0; j < mAttachedShaders[i]->mUniforms.Length(); j++) {
-                const WebGLMappedIdentifier& uniform = mAttachedShaders[i]->mUniforms[j];
-                const WebGLUniformInfo& info = mAttachedShaders[i]->mUniformInfos[j];
-                mUniformInfoMap->Put(uniform.mapped, info);
-            }
-        }
-    }
-
     nsCString mutableName(name);
     nsCString bracketPart;
     bool hadBracketPart = SplitLastSquareBracket(mutableName, bracketPart);
     // if there is a bracket, we're either an array or an entry in an array.
     if (hadBracketPart)
         mutableName.AppendLiteral("[0]");
 
     WebGLUniformInfo info;
--- a/content/events/test/test_bug448602.html
+++ b/content/events/test/test_bug448602.html
@@ -110,29 +110,29 @@ function runTests() {
   is(infos[0].allowsUntrusted, true, "Should allow untrusted events (3)");
   is(SpecialPowers.unwrap(infos[0].listenerObject), l,
      "Should have the right listener object (4)");
 
   // Event target chain tests
   l2 = document.getElementById("testlevel2");
   l3 = document.getElementById("testlevel3");
   var textnode = l3.firstChild;
-  var chain = SpecialPowers.unwrap(els.getEventTargetChainFor(textnode, {}));
+  var chain = els.getEventTargetChainFor(textnode, {});
   ok(chain.length > 3, "Too short event target chain.");
-  is(chain[0], textnode, "Wrong chain item (1)");
-  is(chain[1], l3, "Wrong chain item (2)");
-  is(chain[2], l2, "Wrong chain item (3)");
-  is(chain[3], root, "Wrong chain item (4)");
+  ok(SpecialPowers.compare(chain[0], textnode), "Wrong chain item (1)");
+  ok(SpecialPowers.compare(chain[1], l3), "Wrong chain item (2)");
+  ok(SpecialPowers.compare(chain[2], l2), "Wrong chain item (3)");
+  ok(SpecialPowers.compare(chain[3], root), "Wrong chain item (4)");
 
   var hasDocumentInChain = false;
   var hasWindowInChain = false;
   for (var i = 0; i < chain.length; ++i) {
-    if (chain[i] == document) {
+    if (SpecialPowers.compare(chain[i], document)) {
       hasDocumentInChain = true;
-    } else if (chain[i] == window) {
+    } else if (SpecialPowers.compare(chain[i], window)) {
       hasWindowInChain = true;
     }
   }
 
   ok(hasDocumentInChain, "Should have document in event target chain!");
   ok(hasWindowInChain, "Should have window in event target chain!");
 /*
   if (!jsdOn) {
--- a/content/media/MediaCache.cpp
+++ b/content/media/MediaCache.cpp
@@ -31,21 +31,27 @@ PRLogModuleInfo* gMediaCacheLog;
 #endif
 
 // Readahead blocks for non-seekable streams will be limited to this
 // fraction of the cache space. We don't normally evict such blocks
 // because replacing them requires a seek, but we need to make sure
 // they don't monopolize the cache.
 static const double NONSEEKABLE_READAHEAD_MAX = 0.5;
 
-// Assume that any replaying or backward seeking will happen
-// this far in the future (in seconds). This is a random guess/estimate
-// penalty to account for the possibility that we might not replay at
-// all.
-static const uint32_t REPLAY_DELAY = 30;
+// Data N seconds before the current playback position is given the same priority
+// as data REPLAY_PENALTY_FACTOR*N seconds ahead of the current playback
+// position. REPLAY_PENALTY_FACTOR is greater than 1 to reflect that
+// data in the past is less likely to be played again than data in the future.
+// We want to give data just behind the current playback position reasonably
+// high priority in case codecs need to retrieve that data (e.g. because
+// tracks haven't been muxed well or are being decoded at uneven rates).
+// 1/REPLAY_PENALTY_FACTOR as much data will be kept behind the
+// current playback position as will be kept ahead of the current playback
+// position.
+static const uint32_t REPLAY_PENALTY_FACTOR = 3;
 
 // When looking for a reusable block, scan forward this many blocks
 // from the desired "best" block location to look for free blocks,
 // before we resort to scanning the whole cache. The idea is to try to
 // store runs of stream blocks close-to-consecutively in the cache if we
 // can.
 static const uint32_t FREE_BLOCK_SCAN_LIMIT = 16;
 
@@ -927,25 +933,30 @@ MediaCache::PredictNextUse(TimeStamp aNo
     BlockOwner* bo = &block->mOwners[i];
     TimeDuration prediction;
     switch (bo->mClass) {
     case METADATA_BLOCK:
       // This block should be managed in LRU mode. For metadata we predict
       // that the time until the next use is the time since the last use.
       prediction = aNow - bo->mLastUseTime;
       break;
-    case PLAYED_BLOCK:
+    case PLAYED_BLOCK: {
       // This block should be managed in LRU mode, and we should impose
       // a "replay delay" to reflect the likelihood of replay happening
       NS_ASSERTION(static_cast<int64_t>(bo->mStreamBlock)*BLOCK_SIZE <
                    bo->mStream->mStreamOffset,
                    "Played block after the current stream position?");
-      prediction = aNow - bo->mLastUseTime +
-        TimeDuration::FromSeconds(REPLAY_DELAY);
+      int64_t bytesBehind =
+        bo->mStream->mStreamOffset - static_cast<int64_t>(bo->mStreamBlock)*BLOCK_SIZE;
+      int64_t millisecondsBehind =
+        bytesBehind*1000/bo->mStream->mPlaybackBytesPerSecond;
+      prediction = TimeDuration::FromMilliseconds(
+          std::min<int64_t>(millisecondsBehind*REPLAY_PENALTY_FACTOR, INT32_MAX));
       break;
+    }
     case READAHEAD_BLOCK: {
       int64_t bytesAhead =
         static_cast<int64_t>(bo->mStreamBlock)*BLOCK_SIZE - bo->mStream->mStreamOffset;
       NS_ASSERTION(bytesAhead >= 0,
                    "Readahead block before the current stream position?");
       int64_t millisecondsAhead =
         bytesAhead*1000/bo->mStream->mPlaybackBytesPerSecond;
       prediction = TimeDuration::FromMilliseconds(
--- a/content/media/webspeech/synth/test/common.js
+++ b/content/media/webspeech/synth/test/common.js
@@ -31,44 +31,44 @@ SpeechTaskCallback.prototype = {
   },
 
   onCancel: function onCancel() {
     if (this.oncancel)
       this.oncancel();
   }
 };
 
-var TestSpeechServiceWithAudio = {
+var TestSpeechServiceWithAudio = SpecialPowers.wrapCallbackObject({
   CHANNELS: 1,
   SAMPLE_RATE: 16000,
 
   serviceType: SpecialPowers.Ci.nsISpeechService.SERVICETYPE_DIRECT_AUDIO,
 
   speak: function speak(aText, aUri, aRate, aPitch, aTask) {
     var task = SpecialPowers.wrap(aTask);
 
     window.setTimeout(
       function () {
-        task.setup(new SpeechTaskCallback(), this.CHANNELS, this.SAMPLE_RATE);
+        task.setup(SpecialPowers.wrapCallbackObject(new SpeechTaskCallback()), this.CHANNELS, this.SAMPLE_RATE);
         // 0.025 seconds per character.
         task.sendAudio(new Int16Array((this.SAMPLE_RATE/40)*aText.length), []);
         task.sendAudio(new Int16Array(0), []);
       }.bind(this), 0);
   },
 
   QueryInterface: function(iid) {
     return this;
   },
 
   getInterfaces: function(c) {},
 
   getHelperForLanguage: function() {}
-};
+});
 
-var TestSpeechServiceNoAudio = {
+var TestSpeechServiceNoAudio = SpecialPowers.wrapCallbackObject({
   serviceType: SpecialPowers.Ci.nsISpeechService.SERVICETYPE_INDIRECT_AUDIO,
 
   speak: function speak(aText, aUri, aRate, aPitch, aTask) {
     var pair = this.expectedSpeaks.shift();
     if (pair) {
       // XXX: These tests do not happen in OOP
       var utterance = pair[0];
       var expected = pair[1];
@@ -79,17 +79,17 @@ var TestSpeechServiceNoAudio = {
 
       for (var attr in args) {
         if (expected[attr] != undefined)
           is(args[attr], expected[attr], "expected service arg " + attr);
       }
     }
 
     var task = SpecialPowers.wrap(aTask);
-    task.setup(new SpeechTaskCallback());
+    task.setup(SpecialPowers.wrapCallbackObject(new SpeechTaskCallback()));
     setTimeout(function () {
                  task.dispatchStart();
                  setTimeout(function () {
                               task.dispatchEnd(aText.length / 2.0, aText.length);
                             }, 0);
 
                }, 0);
   },
@@ -98,17 +98,17 @@ var TestSpeechServiceNoAudio = {
     return this;
   },
 
   getInterfaces: function(c) {},
 
   getHelperForLanguage: function() {},
 
   expectedSpeaks: []
-};
+});
 
 function synthAddVoice(aServiceName, aName, aLang, aIsLocal) {
   if (SpecialPowers.isMainProcess()) {
     var voicesBefore = speechSynthesis.getVoices().length;
     var uri = "urn:moz-tts:mylittleservice:" + encodeURI(aName + '?' + aLang);
     gSpeechRegistry.addVoice(window[aServiceName], uri, aName, aLang, aIsLocal);
 
     gAddedVoices.push([window[aServiceName], uri]);
deleted file mode 100644
--- a/content/xul/content/crashtests/236853.xul
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0"?>
-<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
-<window
-	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
-	xmlns:svg="http://www.w3.org/2000/svg">
-	<vbox flex="1">
-		<svg:svg datasources="236853.rdf" ref="urn:root"> 
-			<template>
-				<rule>
-					<conditions>
-						<content uri="?root"/>
-						<triple	subject="?root"
-								predicate="http://www.ex.org/ex-rdf#nodes"
-								object="?nodes"/>
-						<member container="?nodes" child="?node"/>
-					</conditions>
-					<action>
-						<!-- The line below causes Mozilla to crash -->
-						<svg:text uri="?node" x="64" y="64">Text</svg:text>
-					</action>
-				</rule>
-			</template>
-			<!--<svg:text x="64" y="64">Text</svg:text>-->
-		</svg:svg>
-	</vbox>
-</window>
--- a/content/xul/content/crashtests/crashtests.list
+++ b/content/xul/content/crashtests/crashtests.list
@@ -1,10 +1,9 @@
 load 107518-1.xml
-load 236853.xul
 load 252448-1.xul
 load 253479-1.xul
 load 253479-2.xul
 load 326644-1.html
 load 326644-2.html
 load 326864-1.xul
 load 326875-1.xul
 load 326881-1.xul
--- a/content/xul/content/test/Makefile.in
+++ b/content/xul/content/test/Makefile.in
@@ -13,14 +13,16 @@ include $(DEPTH)/config/autoconf.mk
 
 MOCHITEST_FILES = 	\
 		test_bug486990.xul \
 		test_bug749367.xul \
 		$(NULL)
 
 MOCHITEST_CHROME_FILES = \
 		test_bug233643.xul \
+		test_bug236853.xul \
+		file_bug236853.rdf \
 		test_bug398289.html \
 		398289-resource.xul \
 		test_bug775972.xul \
 		$(NULL)
 
 include $(topsrcdir)/config/rules.mk
rename from content/xul/content/crashtests/236853.rdf
rename to content/xul/content/test/file_bug236853.rdf
new file mode 100644
--- /dev/null
+++ b/content/xul/content/test/test_bug236853.xul
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<window
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:svg="http://www.w3.org/2000/svg">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript">
+  <![CDATA[
+    SimpleTest.waitForExplicitFinish();
+    window.onload = function() {
+      ok(true, "Didn't crash");
+      SimpleTest.finish();
+    }
+  ]]>
+  </script>
+  <vbox flex="1">
+    <svg:svg datasources="file_bug236853.rdf" ref="urn:root">
+      <template>
+        <rule>
+          <conditions>
+            <content uri="?root"/>
+            <triple subject="?root"
+                predicate="http://www.ex.org/ex-rdf#nodes"
+                object="?nodes"/>
+            <member container="?nodes" child="?node"/>
+          </conditions>
+          <action>
+            <!-- The line below causes Mozilla to crash -->
+            <svg:text uri="?node" x="64" y="64">Text</svg:text>
+          </action>
+        </rule>
+      </template>
+      <!--<svg:text x="64" y="64">Text</svg:text>-->
+    </svg:svg>
+  </vbox>
+</window>
deleted file mode 100644
--- a/content/xul/templates/src/crashtests/397148-1.xul
+++ /dev/null
@@ -1,5 +0,0 @@
-<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
-
-<html:span datasources="0" />
-
-</window>
--- a/content/xul/templates/src/crashtests/crashtests.list
+++ b/content/xul/templates/src/crashtests/crashtests.list
@@ -1,10 +1,7 @@
 load 257752-1-recursion.xul
-load 329335-1.xul
 load 329884-1.xul
-skip-if(winWidget||browserIsRemote) HTTP load 330010-1.xul # bugs 742455 and 823470
 skip-if(winWidget) load 330012-1.xul # bug 742455
-skip-if(winWidget) load 397148-1.xul # bug 742455
 load 404346-1.xul
 load 415019-1.xul
 load 417840-1.xul
 load 424418-1.xul
--- a/content/xul/templates/tests/chrome/Makefile.in
+++ b/content/xul/templates/tests/chrome/Makefile.in
@@ -222,14 +222,25 @@ MOCHITEST_CHROME_FILES = \
 		test_tmpl_xmlquerywithmultiplequeries.xul \
 		test_tmpl_xmlquerywithothertypes.xul \
 		test_tmpl_xmlquerywithinlinedata.xul \
 		test_tmpl_xmlquerywithinlinedatawithmultiplequeries.xul \
 		test_tmpl_invalidqp.xul \
 		test_tmpl_errors.xul \
 		test_tmpl_regenerate.xul \
 		test_bug441785.xul \
+		test_bug329335.xul \
 		bug441785-1.rdf \
 		bug441785-2.rdf \
 		test_sortservice.xul \
 		$(NULL)
 
+# bugs 742455 and 823470
+ifneq ($(OS_ARCH),WINNT)
+MOCHITEST_CHROME_FILES += \
+		test_bug330010.xul \
+		file_bug330010.rdf \
+		$(NULL)
+endif
+
+# test_bug397148.xul is disabled because it leaks. See bug 879531.
+
 include $(topsrcdir)/config/rules.mk
rename from content/xul/templates/src/crashtests/330010-1.rdf
rename to content/xul/templates/tests/chrome/file_bug330010.rdf
rename from content/xul/templates/src/crashtests/329335-1.xul
rename to content/xul/templates/tests/chrome/test_bug329335.xul
--- a/content/xul/templates/src/crashtests/329335-1.xul
+++ b/content/xul/templates/tests/chrome/test_bug329335.xul
@@ -1,19 +1,25 @@
 <?xml version="1.0"?>
 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         xmlns:svg="http://www.w3.org/2000/svg">
 
-
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
   <script>
 
+  SimpleTest.waitForExplicitFinish();
+
   function init()
-  { 
+  {
     document.documentElement.appendChild(document.getElementById("svg"));
+    ok(true, "Didn't crash");
+    SimpleTest.finish();
   }
 
   window.addEventListener("load", init, false);
 
   </script>
 
 
   <svg:svg datasources="" id="svg"/>
rename from content/xul/templates/src/crashtests/330010-1.xul
rename to content/xul/templates/tests/chrome/test_bug330010.xul
--- a/content/xul/templates/src/crashtests/330010-1.xul
+++ b/content/xul/templates/tests/chrome/test_bug330010.xul
@@ -1,28 +1,32 @@
 <?xml version="1.0"?>
 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         xmlns:svg="http://www.w3.org/2000/svg"
         xmlns:html="http://www.w3.org/1999/xhtml"
         onload="boom();">
-        
+<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
 <script type="text/javascript">
 
+SimpleTest.waitForExplicitFinish();
 function boom()
 {
   var x = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox");
   generatedShape = document.getElementById("s").childNodes[3];
   generatedShape.appendChild(x);
   document.documentElement.removeChild(document.getElementById("s"));
+  ok(true, "Didn't crash");
+  SimpleTest.finish();
 }
 
 </script>
 
-  <html:div datasources="330010-1.rdf" ref="urn:root" flex="1" id="s">
+  <html:div datasources="file_bug330010.rdf" ref="urn:root" flex="1" id="s">
     <template>
       <rule>
         <conditions>
           <content uri="?root"/>
           <triple subject="?root"
                   predicate="urn:croczilla:xulsvg1:shapes"
                   object="?shapes"/>
           <member container="?shapes" child="?shape" id="m"/>
new file mode 100644
--- /dev/null
+++ b/content/xul/templates/tests/chrome/test_bug397148.xul
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" onload="boom();">
+<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+<script type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+
+function boom() {
+  ok(true, "Didn't crash");
+  SimpleTest.finish();
+}
+</script>
+
+
+<html:span datasources="0" />
+
+</window>
--- a/dom/apps/src/Webapps.js
+++ b/dom/apps/src/Webapps.js
@@ -560,16 +560,17 @@ WebappsApplication.prototype = {
           return;
 
         if ("installState" in msg) {
           this.installState = msg.installState;
           this.progress = msg.progress;
           if (this.installState == "installed") {
             this._downloadError = null;
             this.downloading = false;
+            this.downloadAvailable = false;
             this._fireEvent("downloadsuccess", this._ondownloadsuccess);
             this._fireEvent("downloadapplied", this._ondownloadapplied);
           } else {
             this.downloading = true;
             this._fireEvent("downloadprogress", this._onprogress);
           }
         } else if (msg.error) {
           this._downloadError = msg.error;
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -579,18 +579,17 @@ bool
 NativeInterface2JSObjectAndThrowIfFailed(JSContext* aCx,
                                          JS::Handle<JSObject*> aScope,
                                          JS::Value* aRetval,
                                          xpcObjectHelper& aHelper,
                                          const nsIID* aIID,
                                          bool aAllowNativeWrapper)
 {
   nsresult rv;
-  XPCLazyCallContext lccx(JS_CALLER, aCx, aScope);
-  if (!XPCConvert::NativeInterface2JSObject(lccx, aRetval, NULL, aHelper, aIID,
+  if (!XPCConvert::NativeInterface2JSObject(aRetval, NULL, aHelper, aIID,
                                             NULL, aAllowNativeWrapper, &rv)) {
     // I can't tell if NativeInterface2JSObject throws JS exceptions
     // or not.  This is a sloppy stab at the right semantics; the
     // method really ought to be fixed to behave consistently.
     if (!JS_IsExceptionPending(aCx)) {
       Throw<true>(aCx, NS_FAILED(rv) ? rv : NS_ERROR_UNEXPECTED);
     }
     return false;
@@ -650,18 +649,17 @@ XPCOMObjectToJsval(JSContext* cx, JS::Ha
   return true;
 }
 
 bool
 VariantToJsval(JSContext* aCx, JS::Handle<JSObject*> aScope,
                nsIVariant* aVariant, JS::Value* aRetval)
 {
   nsresult rv;
-  XPCLazyCallContext lccx(JS_CALLER, aCx, aScope);
-  if (!XPCVariant::VariantDataToJS(lccx, aVariant, &rv, aRetval)) {
+  if (!XPCVariant::VariantDataToJS(aVariant, &rv, aRetval)) {
     // Does it throw?  Who knows
     if (!JS_IsExceptionPending(aCx)) {
       Throw<true>(aCx, NS_FAILED(rv) ? rv : NS_ERROR_UNEXPECTED);
     }
     return false;
   }
 
   return true;
--- a/dom/bindings/CallbackObject.cpp
+++ b/dom/bindings/CallbackObject.cpp
@@ -186,24 +186,19 @@ CallbackObjectHolderBase::ToXPCOMCallbac
     return nullptr;
   }
 
   AutoSafeJSContext cx;
 
   JS::Rooted<JSObject*> callback(cx, aCallback->Callback());
 
   JSAutoCompartment ac(cx, callback);
-  XPCCallContext ccx(NATIVE_CALLER, cx);
-  if (!ccx.IsValid()) {
-    return nullptr;
-  }
-
   nsRefPtr<nsXPCWrappedJS> wrappedJS;
   nsresult rv =
-    nsXPCWrappedJS::GetNewOrUsed(ccx, callback, aIID,
+    nsXPCWrappedJS::GetNewOrUsed(callback, aIID,
                                  nullptr, getter_AddRefs(wrappedJS));
   if (NS_FAILED(rv) || !wrappedJS) {
     return nullptr;
   }
 
   nsCOMPtr<nsISupports> retval;
   rv = wrappedJS->QueryInterface(aIID, getter_AddRefs(retval));
   if (NS_FAILED(rv)) {
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -2385,35 +2385,28 @@ class CallbackObjectUnwrapper:
             "!IsConvertibleToCallbackInterface(cx, %(source)s)" %
             self.substitution).define() + "\n\n"
         if self.descriptor.workers:
             return checkObjectType + string.Template(
                 "${target} = ${source};"
                 ).substitute(self.substitution)
 
         return checkObjectType + string.Template(
-            """nsresult rv;
-XPCCallContext ccx(JS_CALLER, cx);
-if (!ccx.IsValid()) {
-  rv = NS_ERROR_XPC_BAD_CONVERT_JS;
-${codeOnFailure}
-}
-
-nsISupports* supp = nullptr;
+            """nsISupports* supp = nullptr;
 if (XPCConvert::GetISupportsFromJSObject(${source}, &supp)) {
   nsCOMPtr<nsIXPConnectWrappedNative> xpcwn = do_QueryInterface(supp);
   if (xpcwn) {
     supp = xpcwn->Native();
   }
 }
 
 const nsIID& iid = NS_GET_IID(${nativeType});
 nsRefPtr<nsXPCWrappedJS> wrappedJS;
-rv = nsXPCWrappedJS::GetNewOrUsed(ccx, ${source}, iid,
-                                  supp, getter_AddRefs(wrappedJS));
+nsresult rv = nsXPCWrappedJS::GetNewOrUsed(${source}, iid,
+                                           supp, getter_AddRefs(wrappedJS));
 if (NS_FAILED(rv) || !wrappedJS) {
 ${codeOnFailure}
 }
 
 // Use a temp nsCOMPtr for the null-check, because ${target} might be
 // OwningNonNull, not an nsCOMPtr.
 nsCOMPtr<${nativeType}> tmp = do_QueryObject(wrappedJS.get());
 if (!tmp) {
--- a/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
+++ b/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
@@ -12,17 +12,17 @@
 
 SimpleTest.waitForExplicitFinish();
 browserElementTestHelpers.setEnabledPref(true);
 browserElementTestHelpers.addPermission();
 
 var iframe;
 
 function runTest() {
-  var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+  var principal = SpecialPowers.wrap(document).nodePrincipal;
   SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
                                                  appId: principal.appId,
                                                  isInBrowserElement: true });
 
   iframe = document.createElement('iframe');
   SpecialPowers.wrap(iframe).mozbrowser = true;
 
   // Our test involves three <iframe mozbrowser>'s, parent, child1, and child2.
@@ -69,17 +69,17 @@ function getVisibleTest2() {
 function finish() {
   // We need to remove this listener because when this test finishes and the
   // iframe containing this document is navigated, we'll fire a
   // visibilitychange(false) event on all child iframes.  That's OK and
   // expected, but if we don't remove our listener, then we'll end up causing
   // the /next/ test to fail!
   iframe.removeEventListener('mozbrowsershowmodalprompt', checkMessage);
 
-  var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+  var principal = SpecialPowers.wrap(document).nodePrincipal;
   SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
                                               appId: principal.appId,
                                               isInBrowserElement: true });
 
   SimpleTest.finish();
 }
 
 var expectedMsg = null;
--- a/dom/browser-element/mochitest/browserElement_SetVisibleFrames2.js
+++ b/dom/browser-element/mochitest/browserElement_SetVisibleFrames2.js
@@ -6,17 +6,17 @@
 
 "use strict";
 
 SimpleTest.waitForExplicitFinish();
 browserElementTestHelpers.setEnabledPref(true);
 browserElementTestHelpers.addPermission();
 
 function runTest() {
-  var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+  var principal = SpecialPowers.wrap(document).nodePrincipal;
   SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
                                                  appId: principal.appId,
                                                  isInBrowserElement: true });
 
   var iframe = document.createElement('iframe');
   SpecialPowers.wrap(iframe).mozbrowser = true;
 
   // We need remote = false here until bug 761935 is fixed; see
@@ -50,17 +50,17 @@ function runTest() {
       ok(false, "Got unexpected message: " + e.detail.message);
     }
   });
 
   document.body.appendChild(iframe);
 }
 
 function finish() {
-  var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+  var principal = SpecialPowers.wrap(document).nodePrincipal;
   SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
                                               appId: principal.appId,
                                               isInBrowserElement: true });
 
   SimpleTest.finish();
 }
 
 addEventListener('testready', runTest);
--- a/dom/browser-element/mochitest/priority/test_ExpectingSystemMessage2.html
+++ b/dom/browser-element/mochitest/priority/test_ExpectingSystemMessage2.html
@@ -16,23 +16,23 @@ message gets priority BACKGROUND_PERCEIV
 
 SimpleTest.waitForExplicitFinish();
 browserElementTestHelpers.setEnabledPref(true);
 browserElementTestHelpers.addPermission();
 browserElementTestHelpers.enableProcessPriorityManager();
 SpecialPowers.addPermission("embed-apps", true, document);
 
 // Give our origin permission to open browsers, and remove it when the test is complete.
-var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+var principal = SpecialPowers.wrap(document).nodePrincipal;
 SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
                                                appId: principal.appId,
                                                isInBrowserElement: true });
 
 addEventListener('unload', function() {
-  var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+  var principal = SpecialPowers.wrap(document).nodePrincipal;
   SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
                                               appId: principal.appId,
                                               isInBrowserElement: true });
 });
 
 function runTest() {
   var iframe = document.createElement('iframe');
   iframe.setAttribute('mozbrowser', true);
--- a/dom/browser-element/mochitest/priority/test_NestedFrames.html
+++ b/dom/browser-element/mochitest/priority/test_NestedFrames.html
@@ -15,23 +15,23 @@ Test changing the visibility of an <ifra
 "use strict";
 
 SimpleTest.waitForExplicitFinish();
 browserElementTestHelpers.setEnabledPref(true);
 browserElementTestHelpers.addPermission();
 browserElementTestHelpers.enableProcessPriorityManager();
 
 // Give our origin permission to open browsers, and remove it when the test is complete.
-var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+var principal = SpecialPowers.wrap(document).nodePrincipal;
 SpecialPowers.addPermission("browser", true, { url: SpecialPowers.wrap(principal.URI).spec,
                                                appId: principal.appId,
                                                isInBrowserElement: true });
 
 addEventListener('unload', function() {
-  var principal = SpecialPowers.wrap(SpecialPowers.getNodePrincipal(document));
+  var principal = SpecialPowers.wrap(document).nodePrincipal;
   SpecialPowers.removePermission("browser", { url: SpecialPowers.wrap(principal.URI).spec,
                                               appId: principal.appId,
                                               isInBrowserElement: true });
 });
 
 function runTest() {
   // Set up the following hierarchy of frames:
   //
--- a/dom/contacts/fallback/ContactDB.jsm
+++ b/dom/contacts/fallback/ContactDB.jsm
@@ -21,17 +21,17 @@ Cu.import("resource://gre/modules/devtoo
 const DB_NAME = "contacts";
 const DB_VERSION = 11;
 const STORE_NAME = "contacts";
 const SAVED_GETALL_STORE_NAME = "getallcache";
 const CHUNK_SIZE = 20;
 const REVISION_STORE = "revision";
 const REVISION_KEY = "revision";
 
-function ContactDispatcher(aContacts, aFullContacts, aCallback, aNewTxn, aClearDispatcher) {
+function ContactDispatcher(aContacts, aFullContacts, aCallback, aNewTxn, aClearDispatcher, aFailureCb) {
   let nextIndex = 0;
 
   let sendChunk;
   let count = 0;
   if (aFullContacts) {
     sendChunk = function() {
       try {
         let chunk = aContacts.splice(0, CHUNK_SIZE);
@@ -62,16 +62,18 @@ function ContactDispatcher(aContacts, aF
                 aCallback(null);
                 aClearDispatcher();
               } else if (chunk.length === CHUNK_SIZE) {
                 aCallback(chunk);
                 chunk.length = 0;
               }
             }
           }
+        }, null, function(errorMsg) {
+          aFailureCb(errorMsg);
         });
       } catch (e) {
         aClearDispatcher();
       }
     }
   }
 
   return {
@@ -543,17 +545,17 @@ ContactDB.prototype = {
       Cu.reportError("Contact without ID");
     }
     if (!record.published) {
       record.published = new Date();
     }
     record.updated = new Date();
   },
 
-  removeObjectFromCache: function CDB_removeObjectFromCache(aObjectId, aCallback) {
+  removeObjectFromCache: function CDB_removeObjectFromCache(aObjectId, aCallback, aFailureCb) {
     if (DEBUG) debug("removeObjectFromCache: " + aObjectId);
     if (!aObjectId) {
       if (DEBUG) debug("No object ID passed");
       return;
     }
     this.newTxn("readwrite", SAVED_GETALL_STORE_NAME, function(txn, store) {
       store.openCursor().onsuccess = function(e) {
         let cursor = e.target.result;
@@ -566,26 +568,29 @@ ContactDB.prototype = {
               break;
             }
           }
           cursor.continue();
         } else {
           aCallback();
         }
       }.bind(this);
-    }.bind(this));
+    }.bind(this), null,
+    function(errorMsg) {
+      aFailureCb(errorMsg);
+    });
   },
 
   // Invalidate the entire cache. It will be incrementally regenerated on demand
   // See getCacheForQuery
-  invalidateCache: function CDB_invalidateCache() {
+  invalidateCache: function CDB_invalidateCache(aErrorCb) {
     if (DEBUG) debug("invalidate cache");
     this.newTxn("readwrite", SAVED_GETALL_STORE_NAME, function (txn, store) {
       store.clear();
-    });
+    }, aErrorCb);
   },
 
   incrementRevision: function CDB_incrementRevision(txn) {
     let revStore = txn.objectStore(REVISION_STORE);
     revStore.get(REVISION_KEY).onsuccess = function(e) {
       revStore.put(parseInt(e.target.result, 10) + 1, REVISION_KEY);
     };
   },
@@ -611,33 +616,33 @@ ContactDB.prototype = {
             return;
           } else {
             if (DEBUG) debug("rev check OK");
             contact.published = event.target.result.published;
             contact.updated = new Date();
             store.put(contact);
           }
         }
-        this.invalidateCache();
+        this.invalidateCache(errorCb);
       }.bind(this);
 
       this.incrementRevision(txn);
     }.bind(this), successCb, errorCb);
   },
 
   removeContact: function removeContact(aId, aSuccessCb, aErrorCb) {
     if (DEBUG) debug("removeContact: " + aId);
     this.removeObjectFromCache(aId, function() {
       this.newTxn("readwrite", STORE_NAME, function(txn, store) {
         store.delete(aId).onsuccess = function() {
           aSuccessCb();
         };
         this.incrementRevision(txn);
       }.bind(this), null, aErrorCb);
-    }.bind(this));
+    }.bind(this), aErrorCb);
   },
 
   clear: function clear(aSuccessCb, aErrorCb) {
     this.newTxn("readwrite", STORE_NAME, function (txn, store) {
       if (DEBUG) debug("Going to clear all!");
       store.clear();
       this.incrementRevision(txn);
     }.bind(this), aSuccessCb, aErrorCb);
@@ -649,48 +654,48 @@ ContactDB.prototype = {
         let contactsArray = [];
         for (let i in aContacts) {
           contactsArray.push(aContacts[i]);
         }
 
         // save contact ids in cache
         this.newTxn("readwrite", SAVED_GETALL_STORE_NAME, function(txn, store) {
           store.put(contactsArray.map(function(el) el.id), aQuery);
-        });
+        }, null, aFailureCb);
 
         // send full contacts
         aSuccessCb(contactsArray, true);
       } else {
         aSuccessCb([], true);
       }
     }.bind(this),
     function (aErrorMsg) { aFailureCb(aErrorMsg); },
     JSON.parse(aQuery));
   },
 
-  getCacheForQuery: function CDB_getCacheForQuery(aQuery, aSuccessCb) {
+  getCacheForQuery: function CDB_getCacheForQuery(aQuery, aSuccessCb, aFailureCb) {
     if (DEBUG) debug("getCacheForQuery");
     // Here we try to get the cached results for query `aQuery'. If they don't
     // exist, it means the cache was invalidated and needs to be recreated, so
     // we do that. Otherwise, we just return the existing cache.
     this.newTxn("readonly", SAVED_GETALL_STORE_NAME, function(txn, store) {
       let req = store.get(aQuery);
       req.onsuccess = function(e) {
         if (e.target.result) {
           if (DEBUG) debug("cache exists");
           aSuccessCb(e.target.result, false);
         } else {
           if (DEBUG) debug("creating cache for query " + aQuery);
           this.createCacheForQuery(aQuery, aSuccessCb);
         }
       }.bind(this);
-      req.onerror = function() {
-
+      req.onerror = function(e) {
+        aFailureCb(e.target.errorMessage);
       };
-    }.bind(this));
+    }.bind(this), null, aFailureCb);
   },
 
   sendNow: function CDB_sendNow(aCursorId) {
     if (aCursorId in this._dispatcher) {
       this._dispatcher[aCursorId].sendNow();
     }
   },
 
@@ -708,23 +713,24 @@ ContactDB.prototype = {
       // aFullContacts is true if the cache didn't exist and had to be created.
       // In that case, we receive the full contacts since we already have them
       // in memory to create the cache. This allows us to avoid accessing the
       // object store again.
       if (aCachedResults && aCachedResults.length > 0) {
         let newTxnFn = this.newTxn.bind(this);
         let clearDispatcherFn = this.clearDispatcher.bind(this, aCursorId);
         this._dispatcher[aCursorId] = new ContactDispatcher(aCachedResults, aFullContacts,
-                                                            aSuccessCb, newTxnFn, clearDispatcherFn);
+                                                            aSuccessCb, newTxnFn,
+                                                            clearDispatcherFn, aFailureCb);
         this._dispatcher[aCursorId].sendNow();
       } else { // no contacts
         if (DEBUG) debug("query returned no contacts");
         aSuccessCb(null);
       }
-    }.bind(this));
+    }.bind(this), aFailureCb);
   },
 
   getRevision: function CDB_getRevision(aSuccessCb) {
     if (DEBUG) debug("getRevision");
     this.newTxn("readonly", REVISION_STORE, function (txn, store) {
       store.get(REVISION_KEY).onsuccess = function (e) {
         aSuccessCb(e.target.result);
       };
--- a/dom/contacts/fallback/ContactService.jsm
+++ b/dom/contacts/fallback/ContactService.jsm
@@ -115,17 +115,17 @@ let ContactService = {
                 let index = this._cursors[mm].indexOf(msg.cursorId);
                 this._cursors[mm].splice(index, 1);
               }
             } catch (e) {
               if (DEBUG) debug("Child is dead, DB should stop sending contacts");
               throw e;
             }
           }.bind(this),
-          function(aErrorMsg) { mm.sendAsyncMessage("Contacts:Find:Return:KO", { errorMsg: aErrorMsg }); },
+          function(aErrorMsg) { mm.sendAsyncMessage("Contacts:Find:Return:KO", { requestID: msg.cursorId, errorMsg: aErrorMsg }); },
           msg.findOptions, msg.cursorId);
         break;
       case "Contacts:GetAll:SendNow":
         // sendNow is a no op if there isn't an existing cursor in the DB, so we
         // don't need to assert the permission again.
         this._db.sendNow(msg.cursorId);
         break;
       case "Contact:Save":
--- a/dom/indexedDB/test/file.js
+++ b/dom/indexedDB/test/file.js
@@ -171,24 +171,28 @@ function grabFileUsageAndContinueHandler
 }
 
 function getUsage(usageHandler)
 {
   let comp = SpecialPowers.wrap(Components);
   let quotaManager = comp.classes["@mozilla.org/dom/quota/manager;1"]
                          .getService(comp.interfaces.nsIQuotaManager);
 
-  let uri = SpecialPowers.getDocumentURIObject(window.document);
-  let callback = {
-    onUsageResult: function(uri, usage, fileUsage) {
-      usageHandler(usage, fileUsage);
-    }
-  };
+  // We need to pass a JS callback to getUsageForURI. However, that callback
+  // takes an XPCOM URI object, which will cause us to throw when we wrap it
+  // for the content compartment. So we need to define the function in a
+  // privileged scope, which we do using a sandbox.
+  var sysPrin = SpecialPowers.Services.scriptSecurityManager.getSystemPrincipal();
+  var sb = new SpecialPowers.Cu.Sandbox(sysPrin);
+  sb.usageHandler = usageHandler;
+  var cb = SpecialPowers.Cu.evalInSandbox((function(uri, usage, fileUsage) {
+                                           usageHandler(usage, fileUsage); }).toSource(), sb);
 
-  quotaManager.getUsageForURI(uri, callback);
+  let uri = SpecialPowers.wrap(window).document.documentURIObject;
+  quotaManager.getUsageForURI(uri, cb);
 }
 
 function scheduleGC()
 {
   SpecialPowers.exactGC(window, continueToNextStep);
 }
 
 function getFileId(file)
--- a/dom/indexedDB/test/helpers.js
+++ b/dom/indexedDB/test/helpers.js
@@ -44,27 +44,37 @@ function clearAllDatabases(callback) {
   }
 
   let comp = SpecialPowers.wrap(Components);
 
   let quotaManager =
     comp.classes["@mozilla.org/dom/quota/manager;1"]
         .getService(comp.interfaces.nsIQuotaManager);
 
-  let uri = SpecialPowers.getDocumentURIObject(document);
+  let uri = SpecialPowers.wrap(document).documentURIObject;
 
-  quotaManager.clearStoragesForURI(uri);
-  quotaManager.getUsageForURI(uri, function(uri, usage, fileUsage) {
+  // We need to pass a JS callback to getUsageForURI. However, that callback
+  // takes an XPCOM URI object, which will cause us to throw when we wrap it
+  // for the content compartment. So we need to define the function in a
+  // privileged scope, which we do using a sandbox.
+  var sysPrin = SpecialPowers.Services.scriptSecurityManager.getSystemPrincipal();
+  var sb = new SpecialPowers.Cu.Sandbox(sysPrin);
+  sb.ok = ok;
+  sb.runCallback = runCallback;
+  var cb = SpecialPowers.Cu.evalInSandbox((function(uri, usage, fileUsage) {
     if (usage) {
       ok(false,
          "getUsageForURI returned non-zero usage after clearing all " +
          "storages!");
     }
     runCallback();
-  });
+  }).toSource(), sb);
+
+  quotaManager.clearStoragesForURI(uri);
+  quotaManager.getUsageForURI(uri, cb);
 }
 
 if (!window.runTest) {
   window.runTest = function(limitedQuota)
   {
     SimpleTest.waitForExplicitFinish();
 
     if (limitedQuota) {
--- a/dom/mobilemessage/tests/marionette/test_strict_7bit_encoding.js
+++ b/dom/mobilemessage/tests/marionette/test_strict_7bit_encoding.js
@@ -111,36 +111,61 @@ const GSM_SMS_STRICT_7BIT_CHARMAP = {
 const SELF = "5554";
 
 SpecialPowers.setBoolPref("dom.sms.enabled", true);
 SpecialPowers.addPermission("sms", true, document);
 
 let sms = window.navigator.mozSms;
 ok(sms instanceof MozSmsManager);
 
-function repeat(func, array, oncomplete) {
-  (function do_call(index) {
-    let next = index < (array.length - 1) ? do_call.bind(null, index + 1) : oncomplete;
-    array[index].push(next);
-    func.apply(null, array[index]);
-  })(0);
-}
+let tasks = {
+  // List of test fuctions. Each of them should call |tasks.next()| when
+  // completed or |tasks.finish()| to jump to the last one.
+  _tasks: [],
+  _nextTaskIndex: 0,
+
+  push: function push(func) {
+    this._tasks.push(func);
+  },
 
-function testStrict7BitEncodingHelper(sent, received, next) {
+  next: function next() {
+    let index = this._nextTaskIndex++;
+    let task = this._tasks[index];
+    try {
+      task();
+    } catch (ex) {
+      ok(false, "test task[" + index + "] throws: " + ex);
+      // Run last task as clean up if possible.
+      if (index != this._tasks.length - 1) {
+        this.finish();
+      }
+    }
+  },
+
+  finish: function finish() {
+    this._tasks[this._tasks.length - 1]();
+  },
+
+  run: function run() {
+    this.next();
+  }
+};
+
+function testStrict7BitEncodingHelper(sent, received) {
   // The log message contains unicode and Marionette seems unable to process
   // it and throws: |UnicodeEncodeError: 'ascii' codec can't encode character
   // u'\xa5' in position 14: ordinal not in range(128)|.
   //
   //log("Testing '" + sent + "' => '" + received + "'");
 
   let count = 0;
   function done(step) {
     count += step;
     if (count >= 2) {
-      window.setTimeout(next, 0);
+      window.setTimeout(tasks.next.bind(tasks), 0);
     }
   }
 
   sms.addEventListener("received", function onReceived(event) {
     event.target.removeEventListener("received", onReceived);
 
     let message = event.message;
     is(message.body, received, "received message.body");
@@ -156,58 +181,80 @@ function testStrict7BitEncodingHelper(se
     done(1);
   });
   request.addEventListener("error", function onRequestError(event) {
     ok(false, "Can't send message out!!!");
     done(2);
   });
 }
 
-function test_enabled() {
+// Bug 877141 - If you send several spaces together in a sms, the other
+//              dipositive receives a "*" for each space.
+//
+// This function is called twice, with strict 7bit encoding enabled or
+// disabled.  Expect the same result in both sent and received text and with
+// either strict 7bit encoding enabled or disabled.
+function testBug877141() {
+  log("Testing bug 877141");
+  let sent = "1 2     3";
+  testStrict7BitEncodingHelper(sent, sent);
+}
+
+tasks.push(function () {
   log("Testing with dom.sms.strict7BitEncoding enabled");
-
   SpecialPowers.setBoolPref("dom.sms.strict7BitEncoding", true);
+  tasks.next();
+});
 
-  let cases = [];
 
-  // Test for combined string.
+// Test for combined string.
+tasks.push(function () {
   let sent = "", received = "";
   for (let c in GSM_SMS_STRICT_7BIT_CHARMAP) {
     sent += c;
     received += GSM_SMS_STRICT_7BIT_CHARMAP[c];
   }
-  cases.push([sent, received]);
+  testStrict7BitEncodingHelper(sent, received);
+});
 
-  // When strict7BitEncoding is enabled, we should replace characters that
-  // can't be encoded with GSM 7-Bit alphabets with '*'.
-  cases.push(["\u65b0\u5e74\u5feb\u6a02", "****"]); // "Happy New Year" in Chinese.
-
-  repeat(testStrict7BitEncodingHelper, cases, test_disabled);
-}
+// When strict7BitEncoding is enabled, we should replace characters that
+// can't be encoded with GSM 7-Bit alphabets with '*'.
+tasks.push(function () {
+  // "Happy New Year" in Chinese.
+  let sent = "\u65b0\u5e74\u5feb\u6a02", received = "****";
+  testStrict7BitEncodingHelper(sent, received);
+});
 
-function test_disabled() {
+tasks.push(testBug877141);
+
+tasks.push(function () {
   log("Testing with dom.sms.strict7BitEncoding disabled");
-
   SpecialPowers.setBoolPref("dom.sms.strict7BitEncoding", false);
+  tasks.next();
+});
 
-  let cases = [];
-
-  // Test for combined string.
+// Test for combined string.
+tasks.push(function () {
   let sent = "";
   for (let c in GSM_SMS_STRICT_7BIT_CHARMAP) {
     sent += c;
   }
-  cases.push([sent, sent]);
-
-  cases.push(["\u65b0\u5e74\u5feb\u6a02", "\u65b0\u5e74\u5feb\u6a02"]);
+  testStrict7BitEncodingHelper(sent, sent);
+});
 
-  repeat(testStrict7BitEncodingHelper, cases, cleanUp);
-}
+tasks.push(function () {
+  // "Happy New Year" in Chinese.
+  let sent = "\u65b0\u5e74\u5feb\u6a02";
+  testStrict7BitEncodingHelper(sent, sent);
+});
 
-function cleanUp() {
+tasks.push(testBug877141);
+
+// WARNING: All tasks should be pushed before this!!!
+tasks.push(function cleanUp() {
   SpecialPowers.removePermission("sms", document);
   SpecialPowers.clearUserPref("dom.sms.enabled");
   SpecialPowers.clearUserPref("dom.sms.strict7BitEncoding");
 
   finish();
-}
+});
 
-test_enabled();
+tasks.run();
--- a/dom/settings/SettingsService.js
+++ b/dom/settings/SettingsService.js
@@ -213,11 +213,17 @@ SettingsService.prototype = {
       function() { dump("SettingsService failed to open DB!\n"); },
       myGlobal );
     this.nextTick(function() { this._open = false; }, lock);
     return lock;
   },
 
   classID : SETTINGSSERVICE_CID,
   QueryInterface : XPCOMUtils.generateQI([Ci.nsISettingsService]),
+  classInfo: XPCOMUtils.generateCI({
+    classID: SETTINGSSERVICE_CID,
+    contractID: "@mozilla.org/settingsService;1",
+    interfaces: [Ci.nsISettingsService],
+    flags: nsIClassInfo.DOM_OBJECT
+  })
 }
 
 this.NSGetFactory = XPCOMUtils.generateNSGetFactory([SettingsService, SettingsServiceLock])
--- a/dom/settings/tests/Makefile.in
+++ b/dom/settings/tests/Makefile.in
@@ -6,20 +6,21 @@ DEPTH            = @DEPTH@
 topsrcdir        = @top_srcdir@
 srcdir           = @srcdir@
 VPATH            = @srcdir@
 
 relativesrcdir   = @relativesrcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
-
 MOCHITEST_FILES = \
   test_settings_basics.html \
   test_settings_events.html \
   test_settings_onsettingchange.html \
   test_settings_blobs.html \
   $(NULL)
 
-_CHROMEMOCHITEST_FILES = \
+MOCHITEST_CHROME_FILES = \
+  test_settings_service.xul \
+  test_settings_service.js \
   $(NULL)
 
 include $(topsrcdir)/config/rules.mk
new file mode 100644
--- /dev/null
+++ b/dom/settings/tests/test_settings_service.js
@@ -0,0 +1,143 @@
+"use strict";
+
+const Cu = Components.utils;
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+SimpleTest.waitForExplicitFinish();
+
+XPCOMUtils.defineLazyServiceGetter(this, "SettingsService",
+                                   "@mozilla.org/settingsService;1",
+                                   "nsISettingsService");
+
+let tests = [
+  /* Callback tests */
+  function() {
+    let callbackCount = 10;
+
+    let callback = {
+      handle: function(name, result) {
+        switch (callbackCount) {
+        case 10:
+        case 9:
+          is(result, true, "result is true");
+          break;
+        case 8:
+        case 7:
+          is(result, false, "result is false");
+          break;
+        case 6:
+        case 5:
+          is(result, 9, "result is 9");
+          break;
+        case 4:
+        case 3:
+          is(result, 9.4, "result is 9.4");
+          break;
+        case 2:
+          is(result, false, "result is false");
+          break;
+        case 1:
+          is(result, null, "result is null");
+          break;
+        default:
+          ok(false, "Unexpected call: " + callbackCount);
+        }
+
+        --callbackCount;
+        if (callbackCount === 0) {
+          next();
+        }
+      },
+
+      handleError: function(name) {
+        ok(false, "error: " + name);
+      }
+    };
+
+    let lock = SettingsService.createLock();
+    let lock1 = SettingsService.createLock();
+
+    lock.set("asdf", true, callback, null);
+    lock1.get("asdf", callback);
+    lock.get("asdf", callback);
+    lock.set("asdf", false, callback, null);
+    lock.get("asdf", callback);
+    lock.set("int", 9, callback, null);
+    lock.get("int", callback);
+    lock.set("doub", 9.4, callback, null);
+    lock.get("doub", callback);
+    lock1.get("asdfxxx", callback);
+  },
+
+  /* Observer tests */
+  function() {
+    const XPCOM_SHUTDOWN        = "xpcom-shutdown";
+    const MOZSETTINGS_CHANGED   = "mozsettings-changed";
+
+    const TEST_OBSERVER_KEY     = "test.observer.key";
+    const TEST_OBSERVER_VALUE   = true;
+    const TEST_OBSERVER_MESSAGE = "test.observer.message";
+
+    let observerCount = 2;
+
+    function observer(subject, topic, data) {
+      if (topic === XPCOM_SHUTDOWN) {
+        Services.obs.removeObserver(this, XPCOM_SHUTDOWN);
+        Services.obs.removeObserver(this, MOZSETTINGS_CHANGED);
+        return;
+      }
+
+      if (topic !== MOZSETTINGS_CHANGED) {
+        ok(false, "Event is not mozsettings-changed.");
+        return;
+      }
+
+      data = JSON.parse(data);
+
+      function checkProp(name, type, value) {
+        ok(name in data, "data." + name + " is present");
+        is(typeof data[name], type, "data." + name + " is " + type);
+        is(data[name], value, "data." + name + " is " + value);
+      }
+
+      checkProp("key", "string", TEST_OBSERVER_KEY);
+      checkProp("value", "boolean", TEST_OBSERVER_VALUE);
+      if (observerCount === 2) {
+        checkProp("message", "object", null);
+      } else {
+        checkProp("message", "string", TEST_OBSERVER_MESSAGE);
+      }
+      --observerCount;
+
+      if (observerCount === 0) {
+        next();
+      }
+    }
+
+    Services.obs.addObserver(observer, XPCOM_SHUTDOWN, false);
+    Services.obs.addObserver(observer, MOZSETTINGS_CHANGED, false);
+
+    let lock = SettingsService.createLock();
+    lock.set(TEST_OBSERVER_KEY, TEST_OBSERVER_VALUE, null, null);
+    lock.set(TEST_OBSERVER_KEY, TEST_OBSERVER_VALUE, null, TEST_OBSERVER_MESSAGE);
+  }
+];
+
+function next() {
+  let step = tests.shift();
+  if (step) {
+    try {
+      step();
+    } catch(e) {
+      ok(false, "Test threw: " + e);
+    }
+  } else {
+    SimpleTest.finish();
+  }
+}
+
+next();
new file mode 100644
--- /dev/null
+++ b/dom/settings/tests/test_settings_service.xul
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=678695
+-->
+<window title="Mozilla Bug 678695"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=678695"
+     target="_blank">Mozilla Bug 678695</a>
+  </body>
+
+  <script type="application/javascript;version=1.7" src="test_settings_service.js" />
+</window>
--- a/dom/system/gonk/NetworkManager.js
+++ b/dom/system/gonk/NetworkManager.js
@@ -125,16 +125,23 @@ function isError(code) {
   return (type != NETD_COMMAND_PROCEEDING && type != NETD_COMMAND_OKAY);
 }
 
 function isComplete(code) {
   let type = netdResponseType(code);
   return (type != NETD_COMMAND_PROCEEDING);
 }
 
+function defineLazyRegExp(obj, name, pattern) {
+  obj.__defineGetter__(name, function() {
+    delete obj[name];
+    return obj[name] = new RegExp(pattern);
+  });
+}
+
 /**
  * This component watches for network interfaces changing state and then
  * adjusts routes etc. accordingly.
  */
 function NetworkManager() {
   this.networkInterfaces = {};
   Services.obs.addObserver(this, TOPIC_INTERFACE_STATE_CHANGED, true);
   Services.obs.addObserver(this, TOPIC_INTERFACE_REGISTERED, true);
@@ -211,16 +218,20 @@ function NetworkManager() {
     },
 
     handleError: function (aErrorMessage) {
       debug("Error reading the 'tethering.wifi.enabled' setting: " + aErrorMessage);
     }
   });
 
   ppmm.addMessageListener('NetworkInterfaceList:ListInterface', this);
+
+  // Used in resolveHostname().
+  defineLazyRegExp(this, "REGEXP_IPV4", "^\\d{1,3}(?:\\.\\d{1,3}){3}$");
+  defineLazyRegExp(this, "REGEXP_IPV6", "^[\\da-fA-F]{4}(?::[\\da-fA-F]{4}){7}$");
 }
 NetworkManager.prototype = {
   classID:   NETWORKMANAGER_CID,
   classInfo: XPCOMUtils.generateCI({classID: NETWORKMANAGER_CID,
                                     contractID: NETWORKMANAGER_CONTRACTID,
                                     classDescription: "Network Manager",
                                     interfaces: [Ci.nsINetworkManager]}),
   QueryInterface: XPCOMUtils.generateQI([Ci.nsINetworkManager,
@@ -606,27 +617,35 @@ NetworkManager.prototype = {
       hostnames: [network.dns1, network.dns2, network.httpProxyHost]
     };
     this.worker.postMessage(options);
   },
 
   resolveHostname: function resolveHostname(hosts) {
     let retval = [];
 
-    for(var i = 0; i < hosts.length; i++) {
-      let hostname = hosts[i].split('/')[2];
-      if (!hostname) {
+    for (let hostname of hosts) {
+      try {
+        let uri = Services.io.newURI(hostname, null, null);
+        hostname = uri.host;
+      } catch (e) {}
+
+      if (hostname.match(this.REGEXP_IPV4) ||
+          hostname.match(this.REGEXP_IPV6)) {
+        retval.push(hostname);
         continue;
       }
 
-      let hostnameIps = gDNSService.resolve(hostname, 0);
-      while (hostnameIps.hasMore()) {
-        retval.push(hostnameIps.getNextAddrAsString());
-        debug("Found IP at: " + JSON.stringify(retval));
-      }
+      try {
+        let hostnameIps = gDNSService.resolve(hostname, 0);
+        while (hostnameIps.hasMore()) {
+          retval.push(hostnameIps.getNextAddrAsString());
+          debug("Found IP at: " + JSON.stringify(retval));
+        }
+      } catch (e) {}
     }
 
     return retval;
   },
 
   addHostRouteWithResolve: function addHostRouteWithResolve(network, hosts) {
     debug("Going to add host route after dns resolution on " + network.name);
     let options = {
--- a/dom/system/gonk/ril_consts.js
+++ b/dom/system/gonk/ril_consts.js
@@ -425,16 +425,17 @@ this.ICC_EF_PLMNsel = 0x6f30; // PLMN fo
 this.ICC_EF_SST    = 0x6f38;
 this.ICC_EF_UST    = 0x6f38; // For USIM
 this.ICC_EF_ADN    = 0x6f3a;
 this.ICC_EF_FDN    = 0x6f3b;
 this.ICC_EF_SMS    = 0x6f3c;
 this.ICC_EF_MSISDN = 0x6f40;
 this.ICC_EF_CBMI   = 0x6f45;
 this.ICC_EF_SPN    = 0x6f46;
+this.ICC_EF_CBMID  = 0x6f48;
 this.ICC_EF_SDN    = 0x6f49;
 this.ICC_EF_EXT1   = 0x6f4a;
 this.ICC_EF_EXT2   = 0x6f4b;
 this.ICC_EF_EXT3   = 0x6f4c;
 this.ICC_EF_CBMIR  = 0x6f50;
 this.ICC_EF_AD     = 0x6fad;
 this.ICC_EF_PHASE  = 0x6fae;
 this.ICC_EF_PNN    = 0x6fc5;
@@ -1068,31 +1069,33 @@ this.STK_SUPPORTED_TERMINAL_PROFILE = [
 this.GECKO_ICC_SERVICES = {
   sim: {
     ADN: 2,
     FDN: 3,
     PLMNSEL: 7,
     CBMI: 14,
     SPN: 17,
     SDN: 18,
+    DATA_DOWNLOAD_SMS_CB: 25,
     DATA_DOWNLOAD_SMS_PP: 26,
     CBMIR: 30,
     BDN: 31,
     PNN: 51,
     OPL: 52,
     SPDI: 56
   },
   usim: {
     FDN: 2,
     SDN: 4,
     BDN: 6,
     CBMI: 15,
     CBMIR: 16,
     SPN: 19,
     DATA_DOWNLOAD_SMS_PP: 28,
+    DATA_DOWNLOAD_SMS_CB: 29,
     PNN: 45,
     OPL: 46,
     SPDI: 51
   },
   ruim: {
     SPN: 17
   }
 };
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -38,16 +38,18 @@
 
 "use strict";
 
 importScripts("ril_consts.js", "systemlibs.js");
 
 // set to true in ril_consts.js to see debug messages
 let DEBUG = DEBUG_WORKER;
 
+let GLOBAL = this;
+
 const INT32_MAX   = 2147483647;
 const UINT8_SIZE  = 1;
 const UINT16_SIZE = 2;
 const UINT32_SIZE = 4;
 const PARCEL_SIZE_SIZE = UINT32_SIZE;
 
 const PDU_HEX_OCTET_SIZE = 4;
 
@@ -4142,16 +4144,17 @@ let RIL = {
     return list;
   },
 
   /**
    * Merge all members of cellBroadcastConfigs into mergedCellBroadcastConfig.
    */
   _mergeAllCellBroadcastConfigs: function _mergeAllCellBroadcastConfigs() {
     if (!("CBMI" in this.cellBroadcastConfigs)
+        || !("CBMID" in this.cellBroadcastConfigs)
         || !("CBMIR" in this.cellBroadcastConfigs)
         || !("MMI" in this.cellBroadcastConfigs)) {
       if (DEBUG) {
         debug("cell broadcast configs not ready, waiting ...");
       }
       return;
     }
     if (DEBUG) {
@@ -9736,16 +9739,17 @@ let ICCFileHelper = {
       case ICC_EF_AD:
       case ICC_EF_MBDN:
       case ICC_EF_PLMNsel:
       case ICC_EF_SPN:
       case ICC_EF_SPDI:
       case ICC_EF_SST:
       case ICC_EF_PHASE:
       case ICC_EF_CBMI:
+      case ICC_EF_CBMID:
       case ICC_EF_CBMIR:
       case ICC_EF_OPL:
       case ICC_EF_PNN:
         return EF_PATH_MF_SIM + EF_PATH_DF_GSM;
       default:
         return null
     }
   },
@@ -9758,16 +9762,17 @@ let ICCFileHelper = {
       case ICC_EF_AD:
       case ICC_EF_FDN:
       case ICC_EF_MBDN:
       case ICC_EF_UST:
       case ICC_EF_MSISDN:
       case ICC_EF_SPN:
       case ICC_EF_SPDI:
       case ICC_EF_CBMI:
+      case ICC_EF_CBMID:
       case ICC_EF_CBMIR:
       case ICC_EF_OPL:
       case ICC_EF_PNN:
         return EF_PATH_MF_SIM + EF_PATH_ADF_USIM;
       default:
         // The file ids in USIM phone book entries are decided by the
         // card manufacturer. So if we don't match any of the cases
         // above and if its a USIM return the phone book path.
@@ -10258,16 +10263,21 @@ let ICCRecordHelper = {
         if (DEBUG) debug("OPL: OPL is not available");
       }
 
       if (ICCUtilsHelper.isICCServiceAvailable("CBMI")) {
         this.readCBMI();
       } else {
         RIL.cellBroadcastConfigs.CBMI = null;
       }
+      if (ICCUtilsHelper.isICCServiceAvailable("DATA_DOWNLOAD_SMS_CB")) {
+        this.readCBMID();
+      } else {
+        RIL.cellBroadcastConfigs.CBMID = null;
+      }
       if (ICCUtilsHelper.isICCServiceAvailable("CBMIR")) {
         this.readCBMIR();
       } else {
         RIL.cellBroadcastConfigs.CBMIR = null;
       }
       RIL._mergeAllCellBroadcastConfigs();
     }
 
@@ -10730,22 +10740,17 @@ let ICCRecordHelper = {
       }
     }
 
     // PLMN List is Servive 51 in USIM, EF_SPDI
     ICCIOHelper.loadTransparentEF({fileId: ICC_EF_SPDI,
                                    callback: callback.bind(this)});
   },
 
-  /**
-   * Read EFcbmi (Cell Broadcast Message Identifier selection)
-   *
-   * @see 3GPP TS 31.102 v110.02.0 section 4.2.14 EFcbmi
-   */
-  readCBMI: function readCBMI() {
+  _readCbmiHelper: function _readCbmiHelper(which) {
     function callback() {
       let strLength = Buf.readUint32();
 
       // Each Message Identifier takes two octets and each octet is encoded
       // into two chars.
       let numIds = strLength / 4, list = null;
       if (numIds) {
         list = [];
@@ -10754,39 +10759,61 @@ let ICCRecordHelper = {
           // `Unused entries shall be set to 'FF FF'.`
           if (id != 0xFFFF) {
             list.push(id);
             list.push(id + 1);
           }
         }
       }
       if (DEBUG) {
-        debug("CBMI: " + JSON.stringify(list));
+        debug(which + ": " + JSON.stringify(list));
       }
 
       Buf.readStringDelimiter(strLength);
 
-      RIL.cellBroadcastConfigs.CBMI = list;
+      RIL.cellBroadcastConfigs[which] = list;
       RIL._mergeAllCellBroadcastConfigs();
     }
 
     function onerror() {
-      RIL.cellBroadcastConfigs.CBMI = null;
+      RIL.cellBroadcastConfigs[which] = null;
       RIL._mergeAllCellBroadcastConfigs();
     }
 
-    ICCIOHelper.loadTransparentEF({fileId: ICC_EF_CBMI,
+    let fileId = GLOBAL["ICC_EF_" + which];
+    ICCIOHelper.loadTransparentEF({fileId: fileId,
                                    callback: callback.bind(this),
                                    onerror: onerror.bind(this)});
   },
 
   /**
+   * Read EFcbmi (Cell Broadcast Message Identifier selection)
+   *
+   * @see 3GPP TS 31.102 v110.02.0 section 4.2.14 EFcbmi
+   * @see 3GPP TS 51.011 v5.0.0 section 10.3.13 EFcbmi
+   */
+  readCBMI: function readCBMI() {
+    this._readCbmiHelper("CBMI");
+  },
+
+  /**
+   * Read EFcbmid (Cell Broadcast Message Identifier for Data Download)
+   *
+   * @see 3GPP TS 31.102 v110.02.0 section 4.2.20 EFcbmid
+   * @see 3GPP TS 51.011 v5.0.0 section 10.3.26 EFcbmid
+   */
+  readCBMID: function readCBMID() {
+    this._readCbmiHelper("CBMID");
+  },
+
+  /**
    * Read EFcbmir (Cell Broadcast Message Identifier Range selection)
    *
    * @see 3GPP TS 31.102 v110.02.0 section 4.2.22 EFcbmir
+   * @see 3GPP TS 51.011 v5.0.0 section 10.3.28 EFcbmir
    */
   readCBMIR: function readCBMIR() {
     function callback() {
       let strLength = Buf.readUint32();
 
       // Each Message Identifier range takes four octets and each octet is
       // encoded into two chars.
       let numIds = strLength / 8, list = null;
--- a/dom/tests/mochitest/bugs/test_bug534149.html
+++ b/dom/tests/mochitest/bugs/test_bug534149.html
@@ -38,43 +38,43 @@ var [i2outer, i2inner] = getIDs(i2);
   
 is(i1inner, i1outer + 1, "For frame 1, inner should come right after outer");
 is(i2inner, i2outer + 1, "For frame 2, inner should come right after outer");
 is(i2outer, i1inner + 1, "Frame 2 comes right after frame 1");
 
 var innerWindowDestroyID;
 var outerWindowDestroyID;
 
-function outerObserver(id) {
-  outerWindowDestroyID =
-    SpecialPowers.wrap(id).QueryInterface(SpecialPowers.Ci.nsISupportsPRUint64).data;
-}
-function innerObserver(id) {
+var outerObserver = {
+  observe: function(id) {
+    outerWindowDestroyID =
+      SpecialPowers.wrap(id).QueryInterface(SpecialPowers.Ci.nsISupportsPRUint64).data;
+  }
+};
+var innerObserver = {
+  observe: function(id) {
   innerWindowDestroyID =
    SpecialPowers.wrap(id).QueryInterface(SpecialPowers.Ci.nsISupportsPRUint64).data;
-}
+  }
+};
 
 function removeFrame(iframe) {
-  var obsSvc = SpecialPowers.Cc["@mozilla.org/observer-service;1"]
-                         .getService(SpecialPowers.Ci.nsIObserverService);
-  obsSvc.addObserver(outerObserver, "outer-window-destroyed", false);
-  obsSvc.addObserver(innerObserver, "inner-window-destroyed", false);
+  SpecialPowers.addObserver(outerObserver, "outer-window-destroyed", false);
+  SpecialPowers.addObserver(innerObserver, "inner-window-destroyed", false);
 
   iframe.parentNode.removeChild(iframe);
 }
 
 removeFrame(i1);
 SimpleTest.waitForExplicitFinish();
 SimpleTest.executeSoon(function() {
   is(innerWindowDestroyID, i1inner, "inner window of frame 1 should be destroyed");
   is(outerWindowDestroyID, i1outer, "outer window of frame 1 should be destroyed");
-  var obsSvc = SpecialPowers.Cc["@mozilla.org/observer-service;1"]
-                         .getService(SpecialPowers.Ci.nsIObserverService);
-  obsSvc.removeObserver(outerObserver, "outer-window-destroyed");
-  obsSvc.removeObserver(innerObserver, "inner-window-destroyed");
+  SpecialPowers.removeObserver(outerObserver, "outer-window-destroyed");
+  SpecialPowers.removeObserver(innerObserver, "inner-window-destroyed");
   SimpleTest.finish();
 });
   
 
 </script>
 </pre>
 </body>
 </html>
--- a/dom/tests/mochitest/notification/notification_common.js
+++ b/dom/tests/mochitest/notification/notification_common.js
@@ -36,16 +36,17 @@ var mockAlertsService = {
 
   createInstance: function(aOuter, aIID) {
     if (aOuter != null) {
       throw SpecialPowers.Components.results.NS_ERROR_NO_AGGREGATION;
     }
     return this.QueryInterface(aIID);
   }
 };
+mockAlertsService = SpecialPowers.wrapCallbackObject(mockAlertsService);
 
 function setup_notifications(allowPrompt, forceClick, callback) {
   SpecialPowers.pushPrefEnv({'set': [["notification.prompt.testing", true],
                                      ["notification.prompt.testing.allow", allowPrompt],
                                      ["notification.prompt.testing.click_on_notification", forceClick]]},
                             callback);
 
   registrar.registerFactory(MOCK_SYSTEM_ALERTS_CID, "system alerts service",
--- a/dom/tests/mochitest/notification/test_notification_tag.html
+++ b/dom/tests/mochitest/notification/test_notification_tag.html
@@ -41,16 +41,17 @@ https://bugzilla.mozilla.org/show_bug.cg
 
     createInstance: function(aOuter, aIID) {
       if (aOuter != null) {
         throw SpecialPowers.Components.results.NS_ERROR_NO_AGGREGATION;
       }
       return this.QueryInterface(aIID);
     }
   };
+  mockAlertsService = SpecialPowers.wrapCallbackObject(mockAlertsService);
 
   var notificationsCreated = [];
   function checkNotifications() {
     // notifications created by the test1 origin
     var test1notifications = [];
     // notifications created by the test2 origin
     var test2notifications = [];
     for (var i = 0; i < notificationsCreated.length; i++) {
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -402,16 +402,23 @@ GLContext::InitWithPrefix(const char *pr
                 printf_stderr("OpenGL vendor ('%s') unrecognized\n", glVendorString);
             }
         }
         firstRun = false;
 #endif
 
         InitExtensions();
 
+        // Disable extensions with partial or incorrect support.
+        if (WorkAroundDriverBugs()) {
+            if (Renderer() == RendererAdrenoTM320) {
+                MarkExtensionUnsupported(OES_standard_derivatives);
+            }
+        }
+
         NS_ASSERTION(!IsExtensionSupported(GLContext::ARB_pixel_buffer_object) ||
                      (mSymbols.fMapBuffer && mSymbols.fUnmapBuffer),
                      "ARB_pixel_buffer_object supported without glMapBuffer/UnmapBuffer being available!");
 
         if (SupportsRobustness()) {
             if (IsExtensionSupported(ARB_robustness)) {
                 SymLoadStruct robustnessSymbols[] = {
                     { (PRFuncPtr*) &mSymbols.fGetGraphicsResetStatus, { "GetGraphicsResetStatusARB", nullptr } },
--- a/gfx/gl/SharedSurfaceGL.cpp
+++ b/gfx/gl/SharedSurfaceGL.cpp
@@ -334,19 +334,20 @@ SharedSurface_GLTexture::~SharedSurface_
     if (mSync) {
         mGL->fDeleteSync(mSync);
     }
 }
 
 void
 SharedSurface_GLTexture::Fence()
 {
+    MutexAutoLock lock(mMutex);
     mGL->MakeCurrent();
 
-    if (mGL->IsExtensionSupported(GLContext::ARB_sync)) {
+    if (mConsGL && mGL->IsExtensionSupported(GLContext::ARB_sync)) {
         if (mSync) {
             mGL->fDeleteSync(mSync);
             mSync = 0;
         }
 
         mSync = mGL->fFenceSync(LOCAL_GL_SYNC_GPU_COMMANDS_COMPLETE, 0);
         if (mSync) {
             mGL->fFlush();
@@ -356,26 +357,37 @@ SharedSurface_GLTexture::Fence()
     MOZ_ASSERT(!mSync);
 
     mGL->fFinish();
 }
 
 bool
 SharedSurface_GLTexture::WaitSync()
 {
+    MutexAutoLock lock(mMutex);
     if (!mSync) {
         // We must have used glFinish instead of glFenceSync.
         return true;
     }
+
+    MOZ_ASSERT(mConsGL, "Did you forget to call a deferred `SetConsumerGL()`?");
     mConsGL->MakeCurrent();
     MOZ_ASSERT(mConsGL->IsExtensionSupported(GLContext::ARB_sync));
 
     mConsGL->fWaitSync(mSync,
                        0,
                        LOCAL_GL_TIMEOUT_IGNORED);
     mConsGL->fDeleteSync(mSync);
     mSync = 0;
 
     return true;
 }
 
+void
+SharedSurface_GLTexture::SetConsumerGL(GLContext* consGL)
+{
+    MutexAutoLock lock(mMutex);
+    MOZ_ASSERT(consGL);
+    mConsGL = consGL;
+}
+
 } /* namespace gfx */
 } /* namespace mozilla */
--- a/gfx/gl/SharedSurfaceGL.h
+++ b/gfx/gl/SharedSurfaceGL.h
@@ -7,16 +7,17 @@
 #define SHARED_SURFACE_GL_H_
 
 #include "SharedSurface.h"
 #include "SurfaceFactory.h"
 #include "SurfaceTypes.h"
 #include "GLContextTypes.h"
 #include "nsAutoPtr.h"
 #include "gfxASurface.h"
+#include "mozilla/Mutex.h"
 
 #include <queue>
 
 // Forwards:
 class gfxImageSurface;
 namespace mozilla {
     namespace gl {
         class GLContext;
@@ -187,33 +188,35 @@ public:
 
     static SharedSurface_GLTexture* Cast(SharedSurface* surf) {
         MOZ_ASSERT(surf->Type() == SharedSurfaceType::GLTextureShare);
 
         return (SharedSurface_GLTexture*)surf;
     }
 
 protected:
-    GLContext* const mConsGL;
+    GLContext* mConsGL;
     const GLuint mTex;
     GLsync mSync;
+    mutable Mutex mMutex;
 
     SharedSurface_GLTexture(GLContext* prodGL,
                             GLContext* consGL,
                             const gfxIntSize& size,
                             bool hasAlpha,
                             GLuint tex)
         : SharedSurface_GL(SharedSurfaceType::GLTextureShare,
                            AttachmentType::GLTexture,
                            prodGL,
                            size,
                            hasAlpha)
         , mConsGL(consGL)
         , mTex(tex)
         , mSync(0)
+        , mMutex("SharedSurface_GLTexture mutex")
     {
     }
 
 public:
     virtual ~SharedSurface_GLTexture();
 
     virtual void LockProdImpl() {}
     virtual void UnlockProdImpl() {}
@@ -221,31 +224,39 @@ public:
 
     virtual void Fence();
     virtual bool WaitSync();
 
 
     virtual GLuint Texture() const {
         return mTex;
     }
+
+    // Custom:
+    void SetConsumerGL(GLContext* consGL);
 };
 
 class SurfaceFactory_GLTexture
     : public SurfaceFactory_GL
 {
 protected:
     GLContext* const mConsGL;
 
 public:
+    // If we don't know `consGL` at construction time, use `nullptr`, and call
+    // `SetConsumerGL()` on each `SharedSurface_GLTexture` before calling its
+    // `WaitSync()`.
     SurfaceFactory_GLTexture(GLContext* prodGL,
                              GLContext* consGL,
                              const SurfaceCaps& caps)
         : SurfaceFactory_GL(prodGL, SharedSurfaceType::GLTextureShare, caps)
         , mConsGL(consGL)
-    {}
+    {
+        MOZ_ASSERT(consGL != prodGL);
+    }
 
     virtual SharedSurface* CreateShared(const gfxIntSize& size) {
         bool hasAlpha = mReadCaps.alpha;
         return SharedSurface_GLTexture::Create(mGL, mConsGL, mFormats, size, hasAlpha);
     }
 };
 
 } /* namespace gfx */
--- a/gfx/layers/client/ClientCanvasLayer.cpp
+++ b/gfx/layers/client/ClientCanvasLayer.cpp
@@ -37,17 +37,17 @@ ClientCanvasLayer::Initialize(const Data
             factory = SurfaceFactory_EGLImage::Create(mGLContext, screen->Caps());
           } else {
             // [Basic/OGL Layers, OOPC] WebGL layer init. (Out Of Process Compositing)
             // Fall back to readback.
           }
         } else {
           // [Basic Layers, OMTC] WebGL layer init.
           // Well, this *should* work...
-          factory = new SurfaceFactory_GLTexture(mGLContext, mGLContext, screen->Caps());
+          factory = new SurfaceFactory_GLTexture(mGLContext, nullptr, screen->Caps());
         }
       }
     }
 
     if (factory) {
       screen->Morph(factory, streamType);
     }
   }
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -534,16 +534,19 @@ CompositorParent::ShadowLayersUpdated(La
   // race condition.
   mLayerManager->UpdateRenderBounds(aTargetConfig.clientBounds());
 
   mCompositionManager->Updated(isFirstPaint, aTargetConfig);
   Layer* root = aLayerTree->GetRoot();
   mLayerManager->SetRoot(root);
   if (root) {
     SetShadowProperties(root);
+    if (mIsTesting) {
+      mCompositionManager->TransformShadowTree(mTestTime);
+    }
   }
   ScheduleComposition();
   LayerManagerComposite *layerComposite = mLayerManager->AsLayerManagerComposite();
   if (layerComposite) {
     layerComposite->NotifyShadowTreeTransaction();
   }
 }
 
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -402,17 +402,19 @@ SurfaceStreamHostOGL::Lock()
 
   mGL->MakeCurrent();
 
   mSize = IntSize(sharedSurf->Size().width, sharedSurf->Size().height);
 
   gfxImageSurface* toUpload = nullptr;
   switch (sharedSurf->Type()) {
     case SharedSurfaceType::GLTextureShare: {
-      mTextureHandle = SharedSurface_GLTexture::Cast(sharedSurf)->Texture();
+      SharedSurface_GLTexture* glTexSurf = SharedSurface_GLTexture::Cast(sharedSurf);
+      glTexSurf->SetConsumerGL(mGL);
+      mTextureHandle = glTexSurf->Texture();
       MOZ_ASSERT(mTextureHandle);
       mShaderProgram = sharedSurf->HasAlpha() ? RGBALayerProgramType
                                               : RGBXLayerProgramType;
       break;
     }
     case SharedSurfaceType::EGLImageShare: {
       SharedSurface_EGLImage* eglImageSurf =
           SharedSurface_EGLImage::Cast(sharedSurf);
--- a/gfx/tests/reftest/reftest.list
+++ b/gfx/tests/reftest/reftest.list
@@ -1,4 +1,4 @@
 # 468496-1 will also detect bugs in video drivers.
 == 468496-1.html 468496-1-ref.html
-random-if(bug685516) == 611498-1.html 611498-ref.html
+== 611498-1.html 611498-ref.html
 skip-if(B2G) == 709477-1.html 709477-1-ref.html # bug 773482
--- a/hal/gonk/GonkHal.cpp
+++ b/hal/gonk/GonkHal.cpp
@@ -1161,17 +1161,17 @@ SetNiceForPid(int aPid, int aNice)
     if (errno) {
       LOG("Unable to get nice for tid=%d (pid=%d); error %d.  This isn't "
           "necessarily a problem; it could be a benign race condition.",
           tid, aPid, errno);
       continue;
     }
 
     int newtaskpriority =
-      std::max(origtaskpriority + aNice - origProcPriority, origProcPriority);
+      std::max(origtaskpriority - origProcPriority + aNice, aNice);
     rv = setpriority(PRIO_PROCESS, tid, newtaskpriority);
 
     if (rv) {
       LOG("Unable to set nice for tid=%d (pid=%d); error %d.  This isn't "
           "necessarily a problem; it could be a benign race condition.",
           tid, aPid, errno);
       continue;
     }
--- a/image/test/crashtests/ownerdiscard.html
+++ b/image/test/crashtests/ownerdiscard.html
@@ -21,16 +21,17 @@
     }
     var img = document.getElementById('victim');
     var observer = new ImageDecoderObserverStub();
     observer.discard = function() {
       SpecialPowers.clearUserPref('min_discard_timeout_ms');
       imgLoadingContent.removeObserver(gObserver);
       setTimeout("document.documentElement.className = '';", 0);
     }
+    observer = SpecialPowers.wrapCallbackObject(observer);
     var gObserver = Cc["@mozilla.org/image/tools;1"].getService(Ci.imgITools)
                                                     .createScriptedObserver(observer);
     var imgLoadingContent =
       SpecialPowers.wrap(img).QueryInterface(Ci.nsIImageLoadingContent);
     imgLoadingContent.addObserver(gObserver);
 
     SpecialPowers.setBoolPref('min_discard_timeout_ms', 1);
 
--- a/image/test/reftest/color-management/reftest.list
+++ b/image/test/reftest/color-management/reftest.list
@@ -1,7 +1,7 @@
 # Colormangement
 
 # test for bug 489133, test for bug 460520
-random-if(bug685516) == invalid-chrm.png invalid-chrm-ref.png
-random-if(bug685516) == invalid-whitepoint.png invalid-chrm-ref.png
+== invalid-chrm.png invalid-chrm-ref.png
+== invalid-whitepoint.png invalid-chrm-ref.png
 # test for bug 488955
-random-if(bug685516) == trc-type.html trc-type-ref.html
+== trc-type.html trc-type-ref.html
--- a/image/test/reftest/gif/reftest.list
+++ b/image/test/reftest/gif/reftest.list
@@ -1,21 +1,21 @@
 # GIF tests 
 
 # tests for bug 519589
-random-if(bug685516) == 1bit-255-trans.gif 1bit-255-trans.png
-random-if(bug685516) == in-colormap-trans.gif in-colormap-trans.png
-random-if(bug685516) == out-of-colormap-trans.gif out-of-colormap-trans.png
+== 1bit-255-trans.gif 1bit-255-trans.png
+== in-colormap-trans.gif in-colormap-trans.png
+== out-of-colormap-trans.gif out-of-colormap-trans.png
 
 # a GIF file that uses the comment extension
-random-if(bug685516) == comment.gif comment.png
+== comment.gif comment.png
 
 # a GIF file with a background smaller than the size of the canvas
-random-if(bug685516) == small-background-size.gif small-background-size-ref.gif
-random-if(bug685516) == small-background-size-2.gif small-background-size-2-ref.gif
+== small-background-size.gif small-background-size-ref.gif
+== small-background-size-2.gif small-background-size-2-ref.gif
 
 # a transparent gif that disposes previous frames with clear; we must properly
 # clear each frame to pass.
 random == delaytest.html?transparent-animation.gif transparent-animation-finalframe.gif # incorrect timing dependence (bug 558678)
 
 # test for bug 641198
 skip-if(B2G) random-if(Android) == test_bug641198.html animation2a-finalframe.gif # bug 773482
 
@@ -36,9 +36,9 @@ skip-if(B2G) random-if(Android) == test_
 # \r\n
 # <contents of blue.gif> (no newline)
 # --BOUNDARYOMG--\r\n
 # 
 # (The boundary is arbitrary, and just has to be defined as something that
 # won't be in the text of the contents themselves. --$(boundary)\r\n means
 # "Here is the beginning of a boundary," and --$(boundary)-- means "All done
 # sending you parts.")
-skip-if(B2G) random-if(bug685516) HTTP == webcam.html blue.gif # bug 773482
+skip-if(B2G) HTTP == webcam.html blue.gif # bug 773482
--- a/image/test/reftest/jpeg/reftest.list
+++ b/image/test/reftest/jpeg/reftest.list
@@ -1,34 +1,34 @@
 # JPEG tests 
 
 # Images of various sizes.
-random-if(bug685516) == jpg-size-1x1.jpg   jpg-size-1x1.png
-random-if(bug685516) == jpg-size-2x2.jpg   jpg-size-2x2.png
-random-if(bug685516) == jpg-size-3x3.jpg   jpg-size-3x3.png
-random-if(bug685516) == jpg-size-4x4.jpg   jpg-size-4x4.png
-random-if(bug685516) == jpg-size-5x5.jpg   jpg-size-5x5.png
-random-if(bug685516) == jpg-size-6x6.jpg   jpg-size-6x6.png
-random-if(bug685516) == jpg-size-7x7.jpg   jpg-size-7x7.png
-random-if(bug685516) == jpg-size-8x8.jpg   jpg-size-8x8.png
-random-if(bug685516) == jpg-size-9x9.jpg   jpg-size-9x9.png
-random-if(bug685516) == jpg-size-15x15.jpg jpg-size-15x15.png
-random-if(bug685516) == jpg-size-16x16.jpg jpg-size-16x16.png
-random-if(bug685516) == jpg-size-17x17.jpg jpg-size-17x17.png
-random-if(bug685516) == jpg-size-31x31.jpg jpg-size-31x31.png
-random-if(bug685516) == jpg-size-32x32.jpg jpg-size-32x32.png
-random-if(bug685516) == jpg-size-33x33.jpg jpg-size-33x33.png
+== jpg-size-1x1.jpg   jpg-size-1x1.png
+== jpg-size-2x2.jpg   jpg-size-2x2.png
+== jpg-size-3x3.jpg   jpg-size-3x3.png
+== jpg-size-4x4.jpg   jpg-size-4x4.png
+== jpg-size-5x5.jpg   jpg-size-5x5.png
+== jpg-size-6x6.jpg   jpg-size-6x6.png
+== jpg-size-7x7.jpg   jpg-size-7x7.png
+== jpg-size-8x8.jpg   jpg-size-8x8.png
+== jpg-size-9x9.jpg   jpg-size-9x9.png
+== jpg-size-15x15.jpg jpg-size-15x15.png
+== jpg-size-16x16.jpg jpg-size-16x16.png
+== jpg-size-17x17.jpg jpg-size-17x17.png
+== jpg-size-31x31.jpg jpg-size-31x31.png
+== jpg-size-32x32.jpg jpg-size-32x32.png
+== jpg-size-33x33.jpg jpg-size-33x33.png
 # Progressive encoding
-random-if(bug685516) == jpg-progressive.jpg jpg-progressive.png
+== jpg-progressive.jpg jpg-progressive.png
 # Grayscale colorspace
-random-if(bug685516) == jpg-gray.jpg jpg-gray.png
+== jpg-gray.jpg jpg-gray.png
 # CMYK colorspace
-random-if(bug685516) == jpg-cmyk-1.jpg jpg-cmyk-1.png
-random-if(bug685516) == jpg-cmyk-2.jpg jpg-cmyk-2.png
-random-if(bug685516) == jpg-srgb-icc.jpg jpg-srgb-icc.png
+== jpg-cmyk-1.jpg jpg-cmyk-1.png
+== jpg-cmyk-2.jpg jpg-cmyk-2.png
+== jpg-srgb-icc.jpg jpg-srgb-icc.png
 
 # webcam-simulacrum.mjpg is a hand-edited file containing red.jpg and blue.jpg,
 # concatenated together with the relevant headers for
 # multipart/x-mixed-replace. Specifically, with the headers in
 # webcam-simulacrum.mjpg^headers^, the web browser will get the following:
 #
 # HTTP 200 OK
 # Content-Type: multipart/x-mixed-replace;boundary=BOUNDARYOMG
@@ -42,9 +42,9 @@ random-if(bug685516) == jpg-srgb-icc.jpg
 # \r\n
 # <contents of blue.jpg> (no newline)
 # --BOUNDARYOMG--\r\n
 # 
 # (The boundary is arbitrary, and just has to be defined as something that
 # won't be in the text of the contents themselves. --$(boundary)\r\n means
 # "Here is the beginning of a boundary," and --$(boundary)-- means "All done
 # sending you parts.")
-random-if(bug685516) HTTP == webcam-simulacrum.mjpg blue.jpg
+HTTP == webcam-simulacrum.mjpg blue.jpg
--- a/image/test/reftest/pngsuite-basic-n/reftest.list
+++ b/image/test/reftest/pngsuite-basic-n/reftest.list
@@ -1,29 +1,29 @@
 # PngSuite - Basic formats (non-interlaced)
 
 
 # basn0g01 - black & white
-random-if(bug685516) == basn0g01.png basn0g01.html
+== basn0g01.png basn0g01.html
 # basn0g02 - 2 bit (4 level) grayscale
 fails-if(Android) == basn0g02.png basn0g02.html
 # basn0g04 - 4 bit (16 level) grayscale
 fails-if(Android) == basn0g04.png basn0g04.html
 # basn0g08 - 8 bit (256 level) grayscale
 fails-if(Android) == basn0g08.png basn0g08.html
 # basn0g16 - 16 bit (64k level) grayscale
 fails-if(Android) == basn0g16.png basn0g16.html
 # basn2c08 - 3x8 bits rgb color
 fails-if(Android) == basn2c08.png basn2c08.html
 # basn2c16 - 3x16 bits rgb color
 fails-if(Android) == basn2c16.png basn2c16.html
 # basn3p01 - 1 bit (2 color) paletted
 fails-if(Android) == basn3p01.png basn3p01.html
 # basn3p02 - 2 bit (4 color) paletted
-random-if(bug685516) == basn3p02.png basn3p02.html
+== basn3p02.png basn3p02.html
 # basn3p04 - 4 bit (16 color) paletted
 fails-if(Android) == basn3p04.png basn3p04.html
 # basn3p08 - 8 bit (256 color) paletted
 fails-if(Android) == basn3p08.png basn3p08.html
 # basn4a08 - 8 bit grayscale + 8 bit alpha-channel
 #== basn4a08.png basn4a08.html
 # basn4a16 - 16 bit grayscale + 16 bit alpha-channel
 #== basn4a16.png basn4a16.html
--- a/image/test/reftest/pngsuite-filtering/reftest.list
+++ b/image/test/reftest/pngsuite-filtering/reftest.list
@@ -1,22 +1,22 @@
 # PngSuite - Image filtering
 
 # f00n0g08 - grayscale, no interlacing, filter-type 0
-random-if(bug685516) == f00n0g08.png f00n0g08.html
+== f00n0g08.png f00n0g08.html
 # f00n2c08 - color, no interlacing, filter-type 0
-random-if(bug685516) == f00n2c08.png f00n2c08.html
+== f00n2c08.png f00n2c08.html
 # f01n0g08 - grayscale, no interlacing, filter-type 1
-random-if(bug685516) == f01n0g08.png f01n0g08.html
+== f01n0g08.png f01n0g08.html
 # f01n2c08 - color, no interlacing, filter-type 1
-random-if(bug685516) == f01n2c08.png f01n2c08.html
+== f01n2c08.png f01n2c08.html
 # f02n0g08 - grayscale, no interlacing, filter-type 2
-random-if(bug685516) == f02n0g08.png f02n0g08.html
+== f02n0g08.png f02n0g08.html
 # f02n2c08 - color, no interlacing, filter-type 2
-random-if(bug685516) == f02n2c08.png f02n2c08.html
+== f02n2c08.png f02n2c08.html
 # f03n0g08 - grayscale, no interlacing, filter-type 3
-random-if(bug685516) == f03n0g08.png f03n0g08.html
+== f03n0g08.png f03n0g08.html
 # f03n2c08 - color, no interlacing, filter-type 3
-random-if(bug685516) == f03n2c08.png f03n2c08.html
+== f03n2c08.png f03n2c08.html
 # f04n0g08 - grayscale, no interlacing, filter-type 4
-random-if(bug685516) == f04n0g08.png f04n0g08.html
+== f04n0g08.png f04n0g08.html
 # f04n2c08 - color, no interlacing, filter-type 4 
-random-if(bug685516) == f04n2c08.png f04n2c08.html
+== f04n2c08.png f04n2c08.html
--- a/image/test/reftest/pngsuite-oddsizes/reftest.list
+++ b/image/test/reftest/pngsuite-oddsizes/reftest.list
@@ -1,21 +1,21 @@
 # PngSuite - Odd sizes
 #
 # Note: For each size, there are 2 PNGs (one interlaced, one not). Both
 # versions look identical, so they share a common HTML reference file.
 
 # s01i3p01 - 1x1 paletted file, interlaced
-random-if(bug685516) == s01i3p01.png s01_3p01.html
+== s01i3p01.png s01_3p01.html
 # s01n3p01 - 1x1 paletted file, no interlacing
-random-if(bug685516) == s01n3p01.png s01_3p01.html
+== s01n3p01.png s01_3p01.html
 # s02i3p01 - 2x2 paletted file, interlaced
-random-if(bug685516) == s02i3p01.png s02_3p01.html
+== s02i3p01.png s02_3p01.html
 # s02n3p01 - 2x2 paletted file, no interlacing
-random-if(bug685516) == s02n3p01.png s02_3p01.html
+== s02n3p01.png s02_3p01.html
 # s03i3p01 - 3x3 paletted file, interlaced
 fails-if(Android) == s03i3p01.png s03_3p01.html
 # s03n3p01 - 3x3 paletted file, no interlacing
 fails-if(Android) == s03n3p01.png s03_3p01.html
 # s04i3p01 - 4x4 paletted file, interlaced
 fails-if(Android) == s04i3p01.png s04_3p01.html
 # s04n3p01 - 4x4 paletted file, no interlacing
 fails-if(Android) == s04n3p01.png s04_3p01.html
--- a/image/test/reftest/pngsuite-zlib/reftest.list
+++ b/image/test/reftest/pngsuite-zlib/reftest.list
@@ -1,8 +1,8 @@
 # z00n2c08 - color, no interlacing, compression level 0 (none)
-random-if(bug685516) == z00n2c08.png z00n2c08.html
+== z00n2c08.png z00n2c08.html
 # z03n2c08 - color, no interlacing, compression level 3
-random-if(bug685516) == z03n2c08.png z03n2c08.html
+== z03n2c08.png z03n2c08.html
 # z06n2c08 - color, no interlacing, compression level 6 (default)
-random-if(bug685516) == z06n2c08.png z06n2c08.html
+== z06n2c08.png z06n2c08.html
 # z09n2c08 - color, no interlacing, compression level 9 (maximum) 
-random-if(bug685516) == z09n2c08.png z09n2c08.html
+== z09n2c08.png z09n2c08.html
--- a/ipc/testshell/XPCShellEnvironment.cpp
+++ b/ipc/testshell/XPCShellEnvironment.cpp
@@ -51,34 +51,16 @@
 using mozilla::ipc::XPCShellEnvironment;
 using mozilla::ipc::TestShellChild;
 using mozilla::ipc::TestShellParent;
 
 namespace {
 
 static const char kDefaultRuntimeScriptFilename[] = "xpcshell.js";
 
-class FullTrustSecMan : public nsIScriptSecurityManager
-{
-public:
-    NS_DECL_ISUPPORTS
-    NS_DECL_NSIXPCSECURITYMANAGER
-    NS_DECL_NSISCRIPTSECURITYMANAGER
-
-    FullTrustSecMan() { }
-    virtual ~FullTrustSecMan() { }
-
-    void SetSystemPrincipal(nsIPrincipal *aPrincipal) {
-        mSystemPrincipal = aPrincipal;
-    }
-
-private:
-    nsCOMPtr<nsIPrincipal> mSystemPrincipal;
-};
-
 class XPCShellDirProvider : public nsIDirectoryServiceProvider
 {
 public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIDIRECTORYSERVICEPROVIDER
 
     XPCShellDirProvider() { }
     ~XPCShellDirProvider() { }
@@ -633,226 +615,16 @@ ProcessFile(JSContext *cx,
         }
     } while (!hitEOF && !env->IsQuitting());
 
     fprintf(stdout, "\n");
 }
 
 } /* anonymous namespace */
 
-NS_INTERFACE_MAP_BEGIN(FullTrustSecMan)
-    NS_INTERFACE_MAP_ENTRY(nsIXPCSecurityManager)
-    NS_INTERFACE_MAP_ENTRY(nsIScriptSecurityManager)
-    NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIXPCSecurityManager)
-NS_INTERFACE_MAP_END
-
-NS_IMPL_ADDREF(FullTrustSecMan)
-NS_IMPL_RELEASE(FullTrustSecMan)
-
-NS_IMETHODIMP
-FullTrustSecMan::CanCreateWrapper(JSContext * aJSContext,
-                                  const nsIID & aIID,
-                                  nsISupports *aObj,
-                                  nsIClassInfo *aClassInfo,
-                                  void * *aPolicy)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CanCreateInstance(JSContext * aJSContext,
-                                   const nsCID & aCID)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CanGetService(JSContext * aJSContext,
-                               const nsCID & aCID)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CanAccess(uint32_t aAction,
-                           nsAXPCNativeCallContext *aCallContext,
-                           JSContext * aJSContext,
-                           JSObject * aJSObject,
-                           nsISupports *aObj,
-                           nsIClassInfo *aClassInfo,
-                           jsid aName,
-                           void * *aPolicy)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CheckPropertyAccess(JSContext * aJSContext,
-                                     JSObject * aJSObject,
-                                     const char *aClassName,
-                                     jsid aProperty,
-                                     uint32_t aAction)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CheckLoadURIFromScript(JSContext * cx,
-                                        nsIURI *uri)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CheckLoadURIWithPrincipal(nsIPrincipal *aPrincipal,
-                                           nsIURI *uri,
-                                           uint32_t flags)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CheckLoadURIStrWithPrincipal(nsIPrincipal *aPrincipal,
-                                              const nsACString & uri,
-                                              uint32_t flags)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CheckFunctionAccess(JSContext * cx,
-                                     void * funObj,
-                                     void * targetObj)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CanExecuteScripts(JSContext * cx,
-                                   nsIPrincipal *principal,
-                                   bool *_retval)
-{
-    *_retval = true;
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetSubjectPrincipal(nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetSystemPrincipal(nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetSimpleCodebasePrincipal(nsIURI *aURI,
-                                            nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetNoAppCodebasePrincipal(nsIURI *aURI,
-                                           nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetCodebasePrincipal(nsIURI *aURI, nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetAppCodebasePrincipal(nsIURI *aURI,
-                                         uint32_t aAppId,
-                                         bool aInMozBrowser,
-                                         nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetDocShellCodebasePrincipal(nsIURI *aURI,
-                                              nsIDocShell* aDocShell,
-                                              nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetObjectPrincipal(JSContext * cx,
-                                    JSObject * obj,
-                                    nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::SubjectPrincipalIsSystem(bool *_retval)
-{
-    *_retval = true;
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CheckSameOrigin(JSContext * aJSContext,
-                                 nsIURI *aTargetURI)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CheckSameOriginURI(nsIURI *aSourceURI,
-                                    nsIURI *aTargetURI,
-                                    bool reportError)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetChannelPrincipal(nsIChannel *aChannel,
-                                     nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::IsSystemPrincipal(nsIPrincipal *aPrincipal,
-                                   bool *_retval)
-{
-    *_retval = aPrincipal == mSystemPrincipal;
-    return NS_OK;
-}
-
-NS_IMETHODIMP_(nsIPrincipal *)
-FullTrustSecMan::GetCxSubjectPrincipal(JSContext *cx)
-{
-    return mSystemPrincipal;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetExtendedOrigin(nsIURI* aURI, uint32_t aAppId,
-                                   bool aInMozBrowser,
-                                   nsACString& aExtendedOrigin)
-{
-  aExtendedOrigin.Truncate();
-  return NS_OK;
-}
-
 NS_IMETHODIMP_(nsrefcnt)
 XPCShellDirProvider::AddRef()
 {
     return 2;
 }
 
 NS_IMETHODIMP_(nsrefcnt)
 XPCShellDirProvider::Release()
@@ -980,32 +752,27 @@ XPCShellEnvironment::Init()
 
     nsCOMPtr<nsIXPConnect> xpc =
       do_GetService(nsIXPConnect::GetCID());
     if (!xpc) {
         NS_ERROR("failed to get nsXPConnect service!");
         return false;
     }
 
-    nsRefPtr<FullTrustSecMan> secman(new FullTrustSecMan());
-    xpc->SetSecurityManagerForJSContext(cx, secman, 0xFFFF);
-
     nsCOMPtr<nsIPrincipal> principal;
-
     nsCOMPtr<nsIScriptSecurityManager> securityManager =
         do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv) && securityManager) {
         rv = securityManager->GetSystemPrincipal(getter_AddRefs(principal));
         if (NS_FAILED(rv)) {
             fprintf(stderr, "+++ Failed to obtain SystemPrincipal from ScriptSecurityManager service.\n");
         } else {
             // fetch the JS principals and stick in a global
             mJSPrincipals = nsJSPrincipals::get(principal);
             JS_HoldPrincipals(mJSPrincipals);
-            secman->SetSystemPrincipal(principal);
         }
     } else {
         fprintf(stderr, "+++ Failed to get ScriptSecurityManager service, running without principals");
     }
 
     nsCxPusher pusher;
     pusher.Push(mCx);
 
--- a/js/jsd/jsd_xpc.cpp
+++ b/js/jsd/jsd_xpc.cpp
@@ -2503,17 +2503,17 @@ jsdService::ActivateDebugger (JSRuntime 
     if (gPrevGCSliceCallback == jsds_GCSliceCallbackProc)
         /* condition indicates that the callback proc has not been set yet */
         gPrevGCSliceCallback = JS::SetGCSliceCallback (rt, jsds_GCSliceCallbackProc);
 
     mCx = JSD_DebuggerOnForUser (rt, NULL, NULL);
     if (!mCx)
         return NS_ERROR_FAILURE;
 
-    JSContext *cx   = JSD_GetDefaultJSContext (mCx);
+    mozilla::AutoPushJSContext cx(JSD_GetDefaultJSContext (mCx));
     JS::RootedObject glob(cx, JSD_GetDefaultGlobal (mCx));
 
     /* init xpconnect on the debugger's context in case xpconnect tries to
      * use it for stuff. */
     nsresult rv;
     nsCOMPtr<nsIXPConnect> xpc = do_GetService(nsIXPConnect::GetCID(), &rv);
     if (NS_FAILED(rv))
         return rv;
--- a/js/src/builtin/Module.cpp
+++ b/js/src/builtin/Module.cpp
@@ -16,18 +16,30 @@ Class js::ModuleClass = {
     JS_DeletePropertyStub,  /* delProperty */
     JS_PropertyStub,        /* getProperty */
     JS_StrictPropertyStub,  /* setProperty */
     JS_EnumerateStub,
     JS_ResolveStub,
     JS_ConvertStub
 };
 
+inline void
+Module::setAtom(JSAtom *atom)
+{
+    setReservedSlot(ATOM_SLOT, StringValue(atom));
+}
+
+inline void
+Module::setScript(JSScript *script)
+{
+    setReservedSlot(SCRIPT_SLOT, PrivateValue(script));
+}
+
 Module *
-js_NewModule(JSContext *cx, HandleAtom atom)
+Module::create(JSContext *cx, HandleAtom atom)
 {
     RootedObject object(cx, NewBuiltinClassInstance(cx, &ModuleClass));
     if (!object)
         return NULL;
     RootedModule module(cx, &object->asModule());
     module->setAtom(atom);
     module->setScript(NULL);
     return module;
--- a/js/src/builtin/Module.h
+++ b/js/src/builtin/Module.h
@@ -8,42 +8,36 @@
 #define Module_h___
 
 #include "jsobj.h"
 
 namespace js {
 
 class Module : public JSObject {
   public:
+    static Module *create(JSContext *cx, js::HandleAtom atom);
+
     JSAtom *atom() {
         return &getReservedSlot(ATOM_SLOT).toString()->asAtom();
     };
 
-    void setAtom(JSAtom *atom) {
-        setReservedSlot(ATOM_SLOT, StringValue(atom));
-    };
-
     JSScript *script() {
         return (JSScript *) getReservedSlot(SCRIPT_SLOT).toPrivate();
     }
 
-    void setScript(JSScript *script) {
-        setReservedSlot(SCRIPT_SLOT, PrivateValue(script));
-    }
+  private:
+    inline void setAtom(JSAtom *atom);
+    inline void setScript(JSScript *script);
 
-  private:
     static const uint32_t ATOM_SLOT = 0;
     static const uint32_t SCRIPT_SLOT = 1;
 };
 
 } // namespace js
 
-js::Module *
-js_NewModule(JSContext *cx, js::HandleAtom atom);
-
 inline js::Module &
 JSObject::asModule()
 {
     JS_ASSERT(isModule());
     return *static_cast<js::Module *>(this);
 }
 
 #endif // Module_h___
--- a/js/src/ds/InlineMap.h
+++ b/js/src/ds/InlineMap.h
@@ -17,17 +17,17 @@ namespace js {
  */
 template <typename T> struct ZeroIsReserved         { static const bool result = false; };
 template <typename T> struct ZeroIsReserved<T *>    { static const bool result = true; };
 
 template <typename K, typename V, size_t InlineElems>
 class InlineMap
 {
   public:
-    typedef HashMap<K, V, DefaultHasher<K>, TempAllocPolicy> WordMap;
+    typedef HashMap<K, V, DefaultHasher<K>, SystemAllocPolicy> WordMap;
 
     struct InlineElem
     {
         K key;
         V value;
     };
 
   private:
@@ -74,18 +74,18 @@ class InlineMap
     bool switchAndAdd(const K &key, const V &value) {
         if (!switchToMap())
             return false;
 
         return map.putNew(key, value);
     }
 
   public:
-    explicit InlineMap(JSContext *cx)
-      : inlNext(0), inlCount(0), map(cx) {
+    explicit InlineMap()
+      : inlNext(0), inlCount(0) {
         checkStaticInvariants(); /* Force the template to instantiate the static invariants. */
     }
 
     class Entry
     {
         friend class InlineMap;
         const K &key_;
         V &value_;
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -2,16 +2,17 @@
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "frontend/BytecodeCompiler.h"
 
 #include "jsprobes.h"
+#include "jsscript.h"
 
 #include "frontend/BytecodeEmitter.h"
 #include "frontend/FoldConstants.h"
 #include "frontend/NameFunctions.h"
 #include "ion/AsmJS.h"
 #include "vm/GlobalObject.h"
 
 #include "jsinferinlines.h"
@@ -125,18 +126,16 @@ frontend::CompileScript(JSContext *cx, H
     if (options.canLazilyParse) {
         syntaxParser.construct(cx, options, chars, length, /* foldConstants = */ false,
                                (Parser<SyntaxParseHandler> *) NULL,
                                (LazyScript *) NULL);
     }
 
     Parser<FullParseHandler> parser(cx, options, chars, length, /* foldConstants = */ true,
                                     options.canLazilyParse ? &syntaxParser.ref() : NULL, NULL);
-    if (!parser.init())
-        return NULL;
     parser.sct = sct;
 
     GlobalSharedContext globalsc(cx, scopeChain, StrictModeFromContext(cx));
 
     // Syntax parsing may cause us to restart processing of top level
     // statements in the script. Use Maybe<> so that the parse context can be
     // reset when this occurs.
     Maybe<ParseContext<FullParseHandler> > pc;
@@ -323,18 +322,16 @@ frontend::CompileLazyFunction(JSContext 
            .setFileAndLine(lazy->parent()->filename(), lazy->lineno())
            .setColumn(lazy->column())
            .setCompileAndGo(lazy->parent()->compileAndGo)
            .setNoScriptRval(false)
            .setSelfHostingMode(false);
 
     Parser<FullParseHandler> parser(cx, options, chars, length,
                                     /* foldConstants = */ true, NULL, lazy);
-    if (!parser.init())
-        return false;
 
     RootedObject enclosingScope(cx, lazy->parent()->function());
 
     ParseNode *pn = parser.standaloneLazyFunction(fun, lazy->parent()->staticLevel + 1,
                                                   lazy->strict());
     if (!pn)
         return false;
 
@@ -396,18 +393,16 @@ frontend::CompileFunctionBody(JSContext 
                                (Parser<SyntaxParseHandler> *) NULL,
                                (LazyScript *) NULL);
     }
 
     JS_ASSERT(!options.forEval);
 
     Parser<FullParseHandler> parser(cx, options, chars, length, /* foldConstants = */ true,
                                     options.canLazilyParse ? &syntaxParser.ref() : NULL, NULL);
-    if (!parser.init())
-        return false;
     parser.sct = &sct;
 
     JS_ASSERT(fun);
 
     fun->setArgCount(formals.length());
 
     /* FIXME: make Function format the source for a function definition. */
     ParseNode *fn = CodeNode::create(PNK_FUNCTION, &parser.handler);
--- a/js/src/frontend/BytecodeCompiler.h
+++ b/js/src/frontend/BytecodeCompiler.h
@@ -2,17 +2,18 @@
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef BytecodeCompiler_h__
 #define BytecodeCompiler_h__
 
-#include "frontend/Parser.h"
+#include "jsapi.h"
+#include "jsprvtd.h"
 
 namespace js {
 namespace frontend {
 
 JSScript *
 CompileScript(JSContext *cx, HandleObject scopeChain, HandleScript evalCaller,
               const CompileOptions &options, const jschar *chars, size_t length,
               JSString *source_ = NULL, unsigned staticLevel = 0,
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -5,27 +5,26 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef BytecodeEmitter_h__
 #define BytecodeEmitter_h__
 
 /*
  * JS bytecode generation.
  */
-#include "jstypes.h"
 #include "jsatom.h"
 #include "jsopcode.h"
 #include "jsscript.h"
-#include "jsprvtd.h"
 #include "jspubtd.h"
 
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/Parser.h"
 #include "frontend/ParseMaps.h"
 #include "frontend/SharedContext.h"
+#include "frontend/SourceNotes.h"
 
 #include "vm/ScopeObject.h"
 
 namespace js {
 namespace frontend {
 
 struct CGTryNoteList {
     Vector<JSTryNote> list;
@@ -237,152 +236,16 @@ bool
 EmitTree(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn);
 
 /*
  * Emit function code using bce for the tree rooted at body.
  */
 bool
 EmitFunctionScript(JSContext *cx, BytecodeEmitter *bce, ParseNode *body);
 
-} /* namespace frontend */
-
-/*
- * Source notes generated along with bytecode for decompiling and debugging.
- * A source note is a uint8_t with 5 bits of type and 3 of offset from the pc
- * of the previous note. If 3 bits of offset aren't enough, extended delta
- * notes (SRC_XDELTA) consisting of 2 set high order bits followed by 6 offset
- * bits are emitted before the next note. Some notes have operand offsets
- * encoded immediately after them, in note bytes or byte-triples.
- *
- *                 Source Note               Extended Delta
- *              +7-6-5-4-3+2-1-0+           +7-6-5+4-3-2-1-0+
- *              |note-type|delta|           |1 1| ext-delta |
- *              +---------+-----+           +---+-----------+
- *
- * At most one "gettable" note (i.e., a note of type other than SRC_NEWLINE,
- * SRC_COLSPAN, SRC_SETLINE, and SRC_XDELTA) applies to a given bytecode.
- *
- * NB: the js_SrcNoteSpec array in BytecodeEmitter.cpp is indexed by this
- * enum, so its initializers need to match the order here.
- *
- * Don't forget to update XDR_BYTECODE_VERSION in vm/Xdr.h for all such
- * incompatible source note or other bytecode changes.
- */
-enum SrcNoteType {
-    SRC_NULL        = 0,        /* terminates a note vector */
-
-    SRC_IF          = 1,        /* JSOP_IFEQ bytecode is from an if-then */
-    SRC_IF_ELSE     = 2,        /* JSOP_IFEQ bytecode is from an if-then-else */
-    SRC_COND        = 3,        /* JSOP_IFEQ is from conditional ?: operator */
-
-    SRC_FOR         = 4,        /* JSOP_NOP or JSOP_POP in for(;;) loop head */
-
-    SRC_WHILE       = 5,        /* JSOP_GOTO to for or while loop condition
-                                   from before loop, else JSOP_NOP at top of
-                                   do-while loop */
-    SRC_FOR_IN      = 6,        /* JSOP_GOTO to for-in loop condition from
-                                   before loop */
-    SRC_CONTINUE    = 7,        /* JSOP_GOTO is a continue */
-    SRC_BREAK       = 8,        /* JSOP_GOTO is a break */
-    SRC_BREAK2LABEL = 9,        /* JSOP_GOTO for 'break label' */
-    SRC_SWITCHBREAK = 10,       /* JSOP_GOTO is a break in a switch */
-
-    SRC_TABLESWITCH = 11,       /* JSOP_TABLESWITCH, offset points to end of
-                                   switch */
-    SRC_CONDSWITCH  = 12,       /* JSOP_CONDSWITCH, 1st offset points to end of
-                                   switch, 2nd points to first JSOP_CASE */
-
-    SRC_NEXTCASE    = 13,       /* distance forward from one CASE in a
-                                   CONDSWITCH to the next */
-
-    SRC_ASSIGNOP    = 14,       /* += or another assign-op follows */
-
-    SRC_HIDDEN      = 15,       /* opcode shouldn't be decompiled */
-
-    SRC_CATCH       = 16,       /* catch block has guard */
-
-    /* All notes below here are "gettable".  See SN_IS_GETTABLE below. */
-    SRC_LAST_GETTABLE = SRC_CATCH,
-
-    SRC_COLSPAN     = 17,       /* number of columns this opcode spans */
-    SRC_NEWLINE     = 18,       /* bytecode follows a source newline */
-    SRC_SETLINE     = 19,       /* a file-absolute source line number note */
-
-    SRC_UNUSED20    = 20,
-    SRC_UNUSED21    = 21,
-    SRC_UNUSED22    = 22,
-    SRC_UNUSED23    = 23,
-
-    SRC_XDELTA      = 24        /* 24-31 are for extended delta notes */
-};
-
-#define SN_TYPE_BITS            5
-#define SN_DELTA_BITS           3
-#define SN_XDELTA_BITS          6
-#define SN_TYPE_MASK            (JS_BITMASK(SN_TYPE_BITS) << SN_DELTA_BITS)
-#define SN_DELTA_MASK           ((ptrdiff_t)JS_BITMASK(SN_DELTA_BITS))
-#define SN_XDELTA_MASK          ((ptrdiff_t)JS_BITMASK(SN_XDELTA_BITS))
-
-#define SN_MAKE_NOTE(sn,t,d)    (*(sn) = (jssrcnote)                          \
-                                          (((t) << SN_DELTA_BITS)             \
-                                           | ((d) & SN_DELTA_MASK)))
-#define SN_MAKE_XDELTA(sn,d)    (*(sn) = (jssrcnote)                          \
-                                          ((SRC_XDELTA << SN_DELTA_BITS)      \
-                                           | ((d) & SN_XDELTA_MASK)))
-
-#define SN_IS_XDELTA(sn)        ((*(sn) >> SN_DELTA_BITS) >= SRC_XDELTA)
-#define SN_TYPE(sn)             ((js::SrcNoteType)(SN_IS_XDELTA(sn)           \
-                                                   ? SRC_XDELTA               \
-                                                   : *(sn) >> SN_DELTA_BITS))
-#define SN_SET_TYPE(sn,type)    SN_MAKE_NOTE(sn, type, SN_DELTA(sn))
-#define SN_IS_GETTABLE(sn)      (SN_TYPE(sn) <= SRC_LAST_GETTABLE)
-
-#define SN_DELTA(sn)            ((ptrdiff_t)(SN_IS_XDELTA(sn)                 \
-                                             ? *(sn) & SN_XDELTA_MASK         \
-                                             : *(sn) & SN_DELTA_MASK))
-#define SN_SET_DELTA(sn,delta)  (SN_IS_XDELTA(sn)                             \
-                                 ? SN_MAKE_XDELTA(sn, delta)                  \
-                                 : SN_MAKE_NOTE(sn, SN_TYPE(sn), delta))
-
-#define SN_DELTA_LIMIT          ((ptrdiff_t)JS_BIT(SN_DELTA_BITS))
-#define SN_XDELTA_LIMIT         ((ptrdiff_t)JS_BIT(SN_XDELTA_BITS))
-
-/*
- * Offset fields follow certain notes and are frequency-encoded: an offset in
- * [0,0x7f] consumes one byte, an offset in [0x80,0x7fffff] takes three, and
- * the high bit of the first byte is set.
- */
-#define SN_3BYTE_OFFSET_FLAG    0x80
-#define SN_3BYTE_OFFSET_MASK    0x7f
-
-/*
- * Negative SRC_COLSPAN offsets are rare, but can arise with for(;;) loops and
- * other constructs that generate code in non-source order. They can also arise
- * due to failure to update pn->pn_pos.end to be the last child's end -- such
- * failures are bugs to fix.
- *
- * Source note offsets in general must be non-negative and less than 0x800000,
- * per the above SN_3BYTE_* definitions. To encode negative colspans, we bias
- * them by the offset domain size and restrict non-negative colspans to less
- * than half this domain.
- */
-#define SN_COLSPAN_DOMAIN       ptrdiff_t(SN_3BYTE_OFFSET_FLAG << 16)
-
-#define SN_MAX_OFFSET ((size_t)((ptrdiff_t)SN_3BYTE_OFFSET_FLAG << 16) - 1)
-
-#define SN_LENGTH(sn)           ((js_SrcNoteSpec[SN_TYPE(sn)].arity == 0) ? 1 \
-                                 : js_SrcNoteLength(sn))
-#define SN_NEXT(sn)             ((sn) + SN_LENGTH(sn))
-
-/* A source note array is terminated by an all-zero element. */
-#define SN_MAKE_TERMINATOR(sn)  (*(sn) = SRC_NULL)
-#define SN_IS_TERMINATOR(sn)    (*(sn) == SRC_NULL)
-
-namespace frontend {
-
 /*
  * Append a new source note of the given type (and therefore size) to bce's
  * notes dynamic array, updating bce->noteCount. Return the new note's index
  * within the array pointed at by bce->current->notes. Return -1 if out of
  * memory.
  */
 int
 NewSrcNote(JSContext *cx, BytecodeEmitter *bce, SrcNoteType type);
@@ -431,23 +294,9 @@ BytecodeEmitter::countFinalSourceNotes()
             cnt += JS_HOWMANY(diff, SN_XDELTA_MASK);
     }
     return cnt;
 }
 
 } /* namespace frontend */
 } /* namespace js */
 
-struct JSSrcNoteSpec {
-    const char      *name;      /* name for disassembly/debugging output */
-    int8_t          arity;      /* number of offset operands */
-};
-
-extern JS_FRIEND_DATA(JSSrcNoteSpec)  js_SrcNoteSpec[];
-extern JS_FRIEND_API(unsigned)         js_SrcNoteLength(jssrcnote *sn);
-
-/*
- * Get and set the offset operand identified by which (0 for the first, etc.).
- */
-extern JS_FRIEND_API(ptrdiff_t)
-js_GetSrcNoteOffset(jssrcnote *sn, unsigned which);
-
 #endif /* BytecodeEmitter_h__ */
--- a/js/src/frontend/ParseMaps-inl.h
+++ b/js/src/frontend/ParseMaps-inl.h
@@ -82,42 +82,42 @@ AtomDecls<ParseHandler>::addUnique(JSAto
 }
 
 template <class Map>
 inline bool
 AtomThingMapPtr<Map>::ensureMap(JSContext *cx)
 {
     if (map_)
         return true;
-    map_ = cx->parseMapPool().acquire<Map>();
+    map_ = cx->runtime->parseMapPool.acquire<Map>();
     return !!map_;
 }
 
 template <class Map>
 inline void
 AtomThingMapPtr<Map>::releaseMap(JSContext *cx)
 {
     if (!map_)
         return;
-    cx->parseMapPool().release(map_);
+    cx->runtime->parseMapPool.release(map_);
     map_ = NULL;
 }
 
 template <typename ParseHandler>
 inline bool
 AtomDecls<ParseHandler>::init()
 {
-    map = cx->parseMapPool().acquire<AtomDefnListMap>();
+    map = cx->runtime->parseMapPool.acquire<AtomDefnListMap>();
     return map;
 }
 
 template <typename ParseHandler>
 inline
 AtomDecls<ParseHandler>::~AtomDecls()
 {
     if (map)
-        cx->parseMapPool().release(map);
+        cx->runtime->parseMapPool.release(map);
 }
 
 } /* namespace frontend */
 } /* namespace js */
 
 #endif
--- a/js/src/frontend/ParseMaps.cpp
+++ b/js/src/frontend/ParseMaps.cpp
@@ -45,17 +45,17 @@ ParseMapPool::purgeAll()
 
 void *
 ParseMapPool::allocateFresh()
 {
     size_t newAllLength = all.length() + 1;
     if (!all.reserve(newAllLength) || !recyclable.reserve(newAllLength))
         return NULL;
 
-    AtomMapT *map = cx->new_<AtomMapT>(cx);
+    AtomMapT *map = js_new<AtomMapT>();
     if (!map)
         return NULL;
 
     all.infallibleAppend(map);
     return (void *) map;
 }
 
 DefinitionList::Node *
--- a/js/src/frontend/ParseMaps.h
+++ b/js/src/frontend/ParseMaps.h
@@ -40,17 +40,16 @@ InitAtomMap(JSContext *cx, AtomIndexMap 
  * relinquishing all resources when |purgeAll| is triggered.
  */
 class ParseMapPool
 {
     typedef Vector<void *, 32, SystemAllocPolicy> RecyclableMaps;
 
     RecyclableMaps      all;
     RecyclableMaps      recyclable;
-    JSContext           *cx;
 
     void checkInvariants();
 
     void recycle(void *map) {
         JS_ASSERT(map);
 #ifdef DEBUG
         bool ok = false;
         /* Make sure the map is in |all| but not already in |recyclable|. */
@@ -74,18 +73,16 @@ class ParseMapPool
     /* Arbitrary atom map type, that has keys and values of the same kind. */
     typedef AtomIndexMap AtomMapT;
 
     static AtomMapT *asAtomMap(void *ptr) {
         return reinterpret_cast<AtomMapT *>(ptr);
     }
 
   public:
-    explicit ParseMapPool(JSContext *cx) : cx(cx) {}
-
     ~ParseMapPool() {
         purgeAll();
     }
 
     void purgeAll();
 
     bool empty() const {
         return all.empty();
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -16,16 +16,17 @@
  *
  * This parser attempts no error recovery.
  */
 
 #include "frontend/Parser.h"
 
 #include <stdlib.h>
 #include <string.h>
+
 #include "jstypes.h"
 #include "jsutil.h"
 #include "jsapi.h"
 #include "jsarray.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsversion.h"
 #include "jsfun.h"
@@ -51,16 +52,17 @@
 
 #include "frontend/ParseMaps-inl.h"
 #include "frontend/ParseNode-inl.h"
 #include "frontend/Parser-inl.h"
 #include "frontend/SharedContext-inl.h"
 
 #include "vm/NumericConversions.h"
 #include "vm/RegExpObject-inl.h"
+#include "vm/RegExpStatics-inl.h"
 
 using namespace js;
 using namespace js::gc;
 using mozilla::Maybe;
 
 namespace js {
 namespace frontend {
 
@@ -415,42 +417,33 @@ Parser<ParseHandler>::Parser(JSContext *
     compileAndGo(options.compileAndGo),
     selfHostingMode(options.selfHostingMode),
     abortedSyntaxParse(false),
     handler(cx, tokenStream, foldConstants, syntaxParser, lazyOuterFunction)
 {
     // XXX bug 678037 always disable syntax parsing for now.
     handler.disableSyntaxParser();
 
-    cx->activeCompilations++;
+    cx->runtime->activeCompilations++;
 
     // The Mozilla specific 'strict' option adds extra warnings which are not
     // generated if functions are parsed lazily. Note that the standard
     // "use strict" does not inhibit lazy parsing.
     if (context->hasStrictOption())
         handler.disableSyntaxParser();
-}
-
-template <typename ParseHandler>
-bool
-Parser<ParseHandler>::init()
-{
-    if (!context->ensureParseMapPool())
-        return false;
-
-    tempPoolMark = context->tempLifoAlloc().mark();
-    return true;
+
+    tempPoolMark = cx->tempLifoAlloc().mark();
 }
 
 template <typename ParseHandler>
 Parser<ParseHandler>::~Parser()
 {
     JSContext *cx = context;
     cx->tempLifoAlloc().release(tempPoolMark);
-    cx->activeCompilations--;
+    cx->runtime->activeCompilations--;
 
     /*
      * The parser can allocate enormous amounts of memory for large functions.
      * Eagerly free the memory now (which otherwise won't be freed until the
      * next GC) to avoid unnecessary OOMs.
      */
     cx->tempLifoAlloc().freeAllIfHugeAndUnused();
 }
@@ -2334,17 +2327,17 @@ Parser<FullParseHandler>::moduleDecl()
         return NULL;
     }
 
     ParseNode *pn = CodeNode::create(PNK_MODULE, &handler);
     if (!pn)
         return NULL;
     JS_ALWAYS_TRUE(tokenStream.matchToken(TOK_STRING));
     RootedAtom atom(context, tokenStream.currentToken().atom());
-    Module *module = js_NewModule(context, atom);
+    Module *module = Module::create(context, atom);
     if (!module)
         return NULL;
     ModuleBox *modulebox = newModuleBox(module, pc);
     if (!modulebox)
         return NULL;
     pn->pn_modulebox = modulebox;
 
     ParseContext<FullParseHandler> modulepc(this, pc, modulebox, pc->staticLevel + 1, pc->blockidGen);
@@ -2760,16 +2753,61 @@ PopStatementPC(JSContext *cx, ParseConte
 
     if (blockObj) {
         JS_ASSERT(!blockObj->inDictionaryMode());
         ForEachLetDef(cx, pc, blockObj, PopLetDecl<ParseHandler>());
         blockObj->resetPrevBlockChainFromParser();
     }
 }
 
+/*
+ * The function LexicalLookup searches a static binding for the given name in
+ * the stack of statements enclosing the statement currently being parsed. Each
+ * statement that introduces a new scope has a corresponding scope object, on
+ * which the bindings for that scope are stored. LexicalLookup either returns
+ * the innermost statement which has a scope object containing a binding with
+ * the given name, or NULL.
+ */
+template <class ContextT>
+typename ContextT::StmtInfo *
+LexicalLookup(ContextT *ct, HandleAtom atom, int *slotp, typename ContextT::StmtInfo *stmt)
+{
+    RootedId id(ct->sc->context, AtomToId(atom));
+
+    if (!stmt)
+        stmt = ct->topScopeStmt;
+    for (; stmt; stmt = stmt->downScope) {
+        /*
+         * With-statements introduce dynamic bindings. Since dynamic bindings
+         * can potentially override any static bindings introduced by statements
+         * further up the stack, we have to abort the search.
+         */
+        if (stmt->type == STMT_WITH)
+            break;
+
+        // Skip statements that do not introduce a new scope
+        if (!stmt->isBlockScope)
+            continue;
+
+        StaticBlockObject &blockObj = *stmt->blockObj;
+        Shape *shape = blockObj.nativeLookup(ct->sc->context, id);
+        if (shape) {
+            JS_ASSERT(shape->hasShortID());
+
+            if (slotp)
+                *slotp = blockObj.stackDepth() + shape->shortid();
+            return stmt;
+        }
+    }
+
+    if (slotp)
+        *slotp = -1;
+    return stmt;
+}
+
 template <typename ParseHandler>
 static inline bool
 OuterLet(ParseContext<ParseHandler> *pc, StmtInfoPC *stmt, HandleAtom atom)
 {
     while (stmt->downScope) {
         stmt = LexicalLookup(pc, atom, NULL, stmt->downScope);
         if (!stmt)
             return false;
@@ -6668,17 +6706,17 @@ Parser<ParseHandler>::primaryExpr(TokenK
       case TOK_LC:
       {
         Node pnval;
 
         /*
          * A map from property names we've seen thus far to a mask of property
          * assignment types, stored and retrieved with ALE_SET_INDEX/ALE_INDEX.
          */
-        AtomIndexMap seen(context);
+        AtomIndexMap seen;
 
         enum AssignmentType {
             GET     = 0x1,
             SET     = 0x2,
             VALUE   = 0x4 | GET | SET
         };
 
         pn = handler.newList(PNK_OBJECT, null(), JSOP_NEWINIT);
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -326,24 +326,16 @@ struct Parser : private AutoGCRooter, pu
     Parser(JSContext *cx, const CompileOptions &options,
            const jschar *chars, size_t length, bool foldConstants,
            Parser<SyntaxParseHandler> *syntaxParser,
            LazyScript *lazyOuterFunction);
     ~Parser();
 
     friend void AutoGCRooter::trace(JSTracer *trc);
 
-    /*
-     * Initialize a parser. The compiler owns the arena pool "tops-of-stack"
-     * space above the current JSContext.tempLifoAlloc mark. This means you
-     * cannot allocate from tempLifoAlloc and save the pointer beyond the next
-     * Parser destructor invocation.
-     */
-    bool init();
-
     const char *getFilename() const { return tokenStream.getFilename(); }
     JSVersion versionNumber() const { return tokenStream.versionNumber(); }
 
     /*
      * Parse a top-level JS script.
      */
     Node parse(JSObject *chain);
 
--- a/js/src/frontend/SharedContext-inl.h
+++ b/js/src/frontend/SharedContext-inl.h
@@ -88,56 +88,11 @@ frontend::FinishPopStatement(ContextT *c
     ct->topStmt = stmt->down;
     if (stmt->linksScope()) {
         ct->topScopeStmt = stmt->downScope;
         if (stmt->isBlockScope)
             ct->blockChain = stmt->blockObj->enclosingBlock();
     }
 }
 
-/*
- * The function LexicalLookup searches a static binding for the given name in
- * the stack of statements enclosing the statement currently being parsed. Each
- * statement that introduces a new scope has a corresponding scope object, on
- * which the bindings for that scope are stored. LexicalLookup either returns
- * the innermost statement which has a scope object containing a binding with
- * the given name, or NULL.
- */
-template <class ContextT>
-typename ContextT::StmtInfo *
-frontend::LexicalLookup(ContextT *ct, HandleAtom atom, int *slotp, typename ContextT::StmtInfo *stmt)
-{
-    RootedId id(ct->sc->context, AtomToId(atom));
-
-    if (!stmt)
-        stmt = ct->topScopeStmt;
-    for (; stmt; stmt = stmt->downScope) {
-        /*
-         * With-statements introduce dynamic bindings. Since dynamic bindings
-         * can potentially override any static bindings introduced by statements
-         * further up the stack, we have to abort the search.
-         */
-        if (stmt->type == STMT_WITH)
-            break;
-
-        // Skip statements that do not introduce a new scope
-        if (!stmt->isBlockScope)
-            continue;
-
-        StaticBlockObject &blockObj = *stmt->blockObj;
-        Shape *shape = blockObj.nativeLookup(ct->sc->context, id);
-        if (shape) {
-            JS_ASSERT(shape->hasShortID());
-
-            if (slotp)
-                *slotp = blockObj.stackDepth() + shape->shortid();
-            return stmt;
-        }
-    }
-
-    if (slotp)
-        *slotp = -1;
-    return stmt;
-}
-
 } // namespace js
 
 #endif // SharedContext_inl_h__
new file mode 100644
--- /dev/null
+++ b/js/src/frontend/SourceNotes.h
@@ -0,0 +1,162 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef SourceNotes_h__
+#define SourceNotes_h__
+
+#include "jsprvtd.h"
+
+namespace js {
+
+/*
+ * Source notes generated along with bytecode for decompiling and debugging.
+ * A source note is a uint8_t with 5 bits of type and 3 of offset from the pc
+ * of the previous note. If 3 bits of offset aren't enough, extended delta
+ * notes (SRC_XDELTA) consisting of 2 set high order bits followed by 6 offset
+ * bits are emitted before the next note. Some notes have operand offsets
+ * encoded immediately after them, in note bytes or byte-triples.
+ *
+ *                 Source Note               Extended Delta
+ *              +7-6-5-4-3+2-1-0+           +7-6-5+4-3-2-1-0+
+ *              |note-type|delta|           |1 1| ext-delta |
+ *              +---------+-----+           +---+-----------+
+ *
+ * At most one "gettable" note (i.e., a note of type other than SRC_NEWLINE,
+ * SRC_COLSPAN, SRC_SETLINE, and SRC_XDELTA) applies to a given bytecode.
+ *
+ * NB: the js_SrcNoteSpec array in BytecodeEmitter.cpp is indexed by this
+ * enum, so its initializers need to match the order here.
+ *
+ * Don't forget to update XDR_BYTECODE_VERSION in vm/Xdr.h for all such
+ * incompatible source note or other bytecode changes.
+ */
+enum SrcNoteType {
+    SRC_NULL        = 0,        /* terminates a note vector */
+
+    SRC_IF          = 1,        /* JSOP_IFEQ bytecode is from an if-then */
+    SRC_IF_ELSE     = 2,        /* JSOP_IFEQ bytecode is from an if-then-else */
+    SRC_COND        = 3,        /* JSOP_IFEQ is from conditional ?: operator */
+
+    SRC_FOR         = 4,        /* JSOP_NOP or JSOP_POP in for(;;) loop head */
+
+    SRC_WHILE       = 5,        /* JSOP_GOTO to for or while loop condition
+                                   from before loop, else JSOP_NOP at top of
+                                   do-while loop */
+    SRC_FOR_IN      = 6,        /* JSOP_GOTO to for-in loop condition from
+                                   before loop */
+    SRC_CONTINUE    = 7,        /* JSOP_GOTO is a continue */
+    SRC_BREAK       = 8,        /* JSOP_GOTO is a break */
+    SRC_BREAK2LABEL = 9,        /* JSOP_GOTO for 'break label' */
+    SRC_SWITCHBREAK = 10,       /* JSOP_GOTO is a break in a switch */
+
+    SRC_TABLESWITCH = 11,       /* JSOP_TABLESWITCH, offset points to end of
+                                   switch */
+    SRC_CONDSWITCH  = 12,       /* JSOP_CONDSWITCH, 1st offset points to end of
+                                   switch, 2nd points to first JSOP_CASE */
+
+    SRC_NEXTCASE    = 13,       /* distance forward from one CASE in a
+                                   CONDSWITCH to the next */
+
+    SRC_ASSIGNOP    = 14,       /* += or another assign-op follows */
+
+    SRC_HIDDEN      = 15,       /* opcode shouldn't be decompiled */
+
+    SRC_CATCH       = 16,       /* catch block has guard */
+
+    /* All notes below here are "gettable".  See SN_IS_GETTABLE below. */
+    SRC_LAST_GETTABLE = SRC_CATCH,
+
+    SRC_COLSPAN     = 17,       /* number of columns this opcode spans */
+    SRC_NEWLINE     = 18,       /* bytecode follows a source newline */
+    SRC_SETLINE     = 19,       /* a file-absolute source line number note */
+
+    SRC_UNUSED20    = 20,
+    SRC_UNUSED21    = 21,
+    SRC_UNUSED22    = 22,
+    SRC_UNUSED23    = 23,
+
+    SRC_XDELTA      = 24        /* 24-31 are for extended delta notes */
+};
+
+}  // namespace js
+
+#define SN_TYPE_BITS            5
+#define SN_DELTA_BITS           3
+#define SN_XDELTA_BITS          6
+#define SN_TYPE_MASK            (JS_BITMASK(SN_TYPE_BITS) << SN_DELTA_BITS)
+#define SN_DELTA_MASK           ((ptrdiff_t)JS_BITMASK(SN_DELTA_BITS))
+#define SN_XDELTA_MASK          ((ptrdiff_t)JS_BITMASK(SN_XDELTA_BITS))
+
+#define SN_MAKE_NOTE(sn,t,d)    (*(sn) = (jssrcnote)                          \
+                                          (((t) << SN_DELTA_BITS)             \
+                                           | ((d) & SN_DELTA_MASK)))
+#define SN_MAKE_XDELTA(sn,d)    (*(sn) = (jssrcnote)                          \
+                                          ((SRC_XDELTA << SN_DELTA_BITS)      \
+                                           | ((d) & SN_XDELTA_MASK)))
+
+#define SN_IS_XDELTA(sn)        ((*(sn) >> SN_DELTA_BITS) >= SRC_XDELTA)
+#define SN_TYPE(sn)             ((js::SrcNoteType)(SN_IS_XDELTA(sn)           \
+                                                   ? SRC_XDELTA               \
+                                                   : *(sn) >> SN_DELTA_BITS))
+#define SN_SET_TYPE(sn,type)    SN_MAKE_NOTE(sn, type, SN_DELTA(sn))
+#define SN_IS_GETTABLE(sn)      (SN_TYPE(sn) <= SRC_LAST_GETTABLE)
+
+#define SN_DELTA(sn)            ((ptrdiff_t)(SN_IS_XDELTA(sn)                 \
+                                             ? *(sn) & SN_XDELTA_MASK         \
+                                             : *(sn) & SN_DELTA_MASK))
+#define SN_SET_DELTA(sn,delta)  (SN_IS_XDELTA(sn)                             \
+                                 ? SN_MAKE_XDELTA(sn, delta)                  \
+                                 : SN_MAKE_NOTE(sn, SN_TYPE(sn), delta))
+
+#define SN_DELTA_LIMIT          ((ptrdiff_t)JS_BIT(SN_DELTA_BITS))
+#define SN_XDELTA_LIMIT         ((ptrdiff_t)JS_BIT(SN_XDELTA_BITS))
+
+/*
+ * Offset fields follow certain notes and are frequency-encoded: an offset in
+ * [0,0x7f] consumes one byte, an offset in [0x80,0x7fffff] takes three, and
+ * the high bit of the first byte is set.
+ */
+#define SN_3BYTE_OFFSET_FLAG    0x80
+#define SN_3BYTE_OFFSET_MASK    0x7f
+
+/*
+ * Negative SRC_COLSPAN offsets are rare, but can arise with for(;;) loops and
+ * other constructs that generate code in non-source order. They can also arise
+ * due to failure to update pn->pn_pos.end to be the last child's end -- such
+ * failures are bugs to fix.
+ *
+ * Source note offsets in general must be non-negative and less than 0x800000,
+ * per the above SN_3BYTE_* definitions. To encode negative colspans, we bias
+ * them by the offset domain size and restrict non-negative colspans to less
+ * than half this domain.
+ */
+#define SN_COLSPAN_DOMAIN       ptrdiff_t(SN_3BYTE_OFFSET_FLAG << 16)
+
+#define SN_MAX_OFFSET ((size_t)((ptrdiff_t)SN_3BYTE_OFFSET_FLAG << 16) - 1)
+
+#define SN_LENGTH(sn)           ((js_SrcNoteSpec[SN_TYPE(sn)].arity == 0) ? 1 \
+                                 : js_SrcNoteLength(sn))
+#define SN_NEXT(sn)             ((sn) + SN_LENGTH(sn))
+
+/* A source note array is terminated by an all-zero element. */
+#define SN_MAKE_TERMINATOR(sn)  (*(sn) = SRC_NULL)
+#define SN_IS_TERMINATOR(sn)    (*(sn) == SRC_NULL)
+
+struct JSSrcNoteSpec {
+    const char      *name;      /* name for disassembly/debugging output */
+    int8_t          arity;      /* number of offset operands */
+};
+
+extern JS_FRIEND_DATA(JSSrcNoteSpec)  js_SrcNoteSpec[];
+extern JS_FRIEND_API(unsigned)         js_SrcNoteLength(jssrcnote *sn);
+
+/*
+ * Get and set the offset operand identified by which (0 for the first, etc.).
+ */
+extern JS_FRIEND_API(ptrdiff_t)
+js_GetSrcNoteOffset(jssrcnote *sn, unsigned which);
+
+#endif  // SourceNotes_h__
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -18,20 +18,19 @@
 #include "gc/Barrier-inl.h"
 #include "gc/Nursery-inl.h"
 
 using namespace js;
 using namespace gc;
 using namespace mozilla;
 
 bool
-js::Nursery::enable()
+js::Nursery::init()
 {
-    if (isEnabled())
-        return true;
+    JS_ASSERT(start() == 0);
 
     if (!hugeSlots.init())
         return false;
 
     fallbackBitmap.clear(false);
 
     void *heap = MapAlignedPages(NurserySize, Alignment);
     if (!heap)
@@ -45,32 +44,38 @@ js::Nursery::enable()
     JS_POISON(heap, FreshNursery, NurserySize);
     for (int i = 0; i < NumNurseryChunks; ++i)
         chunk(i).runtime = rt;
 
     JS_ASSERT(isEnabled());
     return true;
 }
 
+js::Nursery::~Nursery()
+{
+    if (start())
+        UnmapPages((void *)start(), NurserySize);
+}
+
+void
+js::Nursery::enable()
+{
+    if (isEnabled())
+        return;
+    JS_ASSERT(position_ == start());
+    numActiveChunks_ = 1;
+}
+
 void
 js::Nursery::disable()
 {
     if (!isEnabled())
         return;
-
-    hugeSlots.finish();
-    JS_ASSERT(start());
-    UnmapPages((void *)start(), NurserySize);
-    runtime()->gcNurseryStart_ = runtime()->gcNurseryEnd_ = position_ = currentEnd_ = 0;
-    currentChunk_ = numActiveChunks_ = 0;
-}
-
-js::Nursery::~Nursery()
-{
-    disable();
+    JS_ASSERT(position_ == start());
+    numActiveChunks_ = 0;
 }
 
 void *
 js::Nursery::allocate(size_t size)
 {
     JS_ASSERT(size % ThingAlignment == 0);
     JS_ASSERT(position() % ThingAlignment == 0);
     JS_ASSERT(!runtime()->isHeapBusy());
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -43,19 +43,21 @@ class Nursery
       : runtime_(rt),
         position_(0),
         currentEnd_(0),
         currentChunk_(0),
         numActiveChunks_(0)
     {}
     ~Nursery();
 
-    bool enable();
+    bool init();
+
+    void enable();
     void disable();
-    bool isEnabled() const { return bool(start()); }
+    bool isEnabled() const { return numActiveChunks_ != 0; }
 
     template <typename T>
     JS_ALWAYS_INLINE bool isInside(const T *p) const {
         return uintptr_t(p) >= start() && uintptr_t(p) < heapEnd();
     }
 
     /*
      * Allocate and return a pointer to a new GC thing. Returns NULL if the
--- a/js/src/ion/AsmJS.cpp
+++ b/js/src/ion/AsmJS.cpp
@@ -6,16 +6,17 @@
 
 #include "jsmath.h"
 #include "jsworkers.h"
 
 #include "frontend/ParseNode.h"
 #include "ion/AsmJS.h"
 #include "ion/AsmJSModule.h"
 
+#include "jsobjinlines.h"
 #include "frontend/ParseNode-inl.h"
 
 using namespace js;
 using namespace js::frontend;
 using namespace mozilla;
 
 #include "ion/PerfSpewer.h"
 #include "ion/CodeGenerator.h"
--- a/js/src/ion/BaselineIC.cpp
+++ b/js/src/ion/BaselineIC.cpp
@@ -1,25 +1,26 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineJIT.h"
-#include "BaselineCompiler.h"
-#include "BaselineHelpers.h"
-#include "BaselineIC.h"
-#include "IonLinker.h"
-#include "IonSpewer.h"
-#include "VMFunctions.h"
-#include "IonFrames-inl.h"
+#include "ion/BaselineJIT.h"
 
 #include "builtin/Eval.h"
-
+#include "ion/BaselineCompiler.h"
+#include "ion/BaselineHelpers.h"
+#include "ion/BaselineIC.h"
+#include "ion/IonLinker.h"
+#include "ion/IonSpewer.h"
+#include "ion/VMFunctions.h"
+
+#include "builtin/Iterator-inl.h"
+#include "ion/IonFrames-inl.h"
 #include "vm/Interpreter-inl.h"
 
 namespace js {
 namespace ion {
 
 #ifdef DEBUG
 void
 FallbackICSpew(JSContext *cx, ICFallbackStub *stub, const char *fmt, ...)
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -14,16 +14,17 @@
 #include "IonAnalysis.h"
 #include "IonSpewer.h"
 #include "BaselineInspector.h"
 #include "builtin/Eval.h"
 #include "frontend/BytecodeEmitter.h"
 
 #include "CompileInfo-inl.h"
 #include "ExecutionModeInlines.h"
+#include "jsanalyzeinlines.h"
 #include "jsscriptinlines.h"
 #include "jstypedarrayinlines.h"
 
 #ifdef JS_THREADSAFE
 # include "prthread.h"
 #endif
 
 using namespace js;
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -793,20 +793,36 @@ IonActivationIterator::ionStackRange(uin
     IonFrameIterator frames(top());
 
     if (frames.isFakeExitFrame()) {
         min = reinterpret_cast<uintptr_t *>(frames.fp());
     } else {
         IonExitFrameLayout *exitFrame = frames.exitFrame();
         IonExitFooterFrame *footer = exitFrame->footer();
         const VMFunction *f = footer->function();
-        if (exitFrame->isWrapperExit() && f->outParam == Type_Handle)
-            min = reinterpret_cast<uintptr_t *>(footer->outVp());
-        else
+        if (exitFrame->isWrapperExit() && f->outParam == Type_Handle) {
+            switch (f->outParamRootType) {
+              case VMFunction::RootNone:
+                JS_NOT_REACHED("Handle outparam must have root type");
+                break;
+              case VMFunction::RootObject:
+              case VMFunction::RootString:
+              case VMFunction::RootPropertyName:
+              case VMFunction::RootFunction:
+              case VMFunction::RootCell:
+                // These are all handles to GCThing pointers.
+                min = reinterpret_cast<uintptr_t *>(footer->outParam<void *>());
+                break;
+              case VMFunction::RootValue:
+                min = reinterpret_cast<uintptr_t *>(footer->outParam<Value>());
+                break;
+            }
+        } else {
             min = reinterpret_cast<uintptr_t *>(footer);
+        }
     }
 
     while (!frames.done())
         ++frames;
 
     end = reinterpret_cast<uintptr_t *>(frames.prevFp());
 }
 
@@ -920,18 +936,39 @@ MarkIonExitFrame(JSTracer *trc, const Io
             break;
           case VMFunction::DoubleByValue:
           case VMFunction::DoubleByRef:
             argBase += 2 * sizeof(void *);
             break;
         }
     }
 
-    if (f->outParam == Type_Handle)
-        gc::MarkValueRoot(trc, footer->outVp(), "ion-vm-outvp");
+    if (f->outParam == Type_Handle) {
+        switch (f->outParamRootType) {
+          case VMFunction::RootNone:
+            JS_NOT_REACHED("Handle outparam must have root type");
+            break;
+          case VMFunction::RootObject:
+            gc::MarkObjectRoot(trc, footer->outParam<JSObject *>(), "ion-vm-out");
+            break;
+          case VMFunction::RootString:
+          case VMFunction::RootPropertyName:
+            gc::MarkStringRoot(trc, footer->outParam<JSString *>(), "ion-vm-out");
+            break;
+          case VMFunction::RootFunction:
+            gc::MarkObjectRoot(trc, footer->outParam<JSFunction *>(), "ion-vm-out");
+            break;
+          case VMFunction::RootValue:
+            gc::MarkValueRoot(trc, footer->outParam<Value>(), "ion-vm-outvp");
+            break;
+          case VMFunction::RootCell:
+            gc::MarkGCThingRoot(trc, footer->outParam<void *>(), "ion-vm-out");
+            break;
+        }
+    }
 }
 
 static void
 MarkIonActivation(JSTracer *trc, const IonActivationIterator &activations)
 {
     for (IonFrameIterator frames(activations); !frames.done(); ++frames) {
         switch (frames.type()) {
           case IonFrame_Exit:
--- a/js/src/ion/IonMacroAssembler.cpp
+++ b/js/src/ion/IonMacroAssembler.cpp
@@ -1087,16 +1087,59 @@ void
 MacroAssembler::convertInt32ValueToDouble(const Address &address, Register scratch, Label *done)
 {
     branchTestInt32(Assembler::NotEqual, address, done);
     unboxInt32(address, scratch);
     convertInt32ToDouble(scratch, ScratchFloatReg);
     storeDouble(ScratchFloatReg, address);
 }
 
+void
+MacroAssembler::PushEmptyRooted(VMFunction::RootType rootType)
+{
+    switch (rootType) {
+      case VMFunction::RootNone:
+        JS_NOT_REACHED("Handle must have root type");
+        break;
+      case VMFunction::RootObject:
+      case VMFunction::RootString:
+      case VMFunction::RootPropertyName:
+      case VMFunction::RootFunction:
+      case VMFunction::RootCell:
+        Push(ImmWord((void *)NULL));
+        break;
+      case VMFunction::RootValue:
+        Push(UndefinedValue());
+        break;
+    }
+}
+
+void
+MacroAssembler::popRooted(VMFunction::RootType rootType, Register cellReg,
+                          const ValueOperand &valueReg)
+{
+    switch (rootType) {
+      case VMFunction::RootNone:
+        JS_NOT_REACHED("Handle must have root type");
+        break;
+      case VMFunction::RootObject:
+      case VMFunction::RootString:
+      case VMFunction::RootPropertyName:
+      case VMFunction::RootFunction:
+      case VMFunction::RootCell:
+        loadPtr(Address(StackPointer, 0), cellReg);
+        freeStack(sizeof(void *));
+        break;
+      case VMFunction::RootValue:
+        loadValue(Address(StackPointer, 0), valueReg);
+        freeStack(sizeof(Value));
+        break;
+    }
+}
+
 #ifdef JS_ASMJS
 ABIArgIter::ABIArgIter(const MIRTypeVector &types)
   : gen_(),
     types_(types),
     i_(0)
 {
     if (!done())
         gen_.next(types_[i_]);
--- a/js/src/ion/IonMacroAssembler.h
+++ b/js/src/ion/IonMacroAssembler.h
@@ -12,16 +12,17 @@
 #elif defined(JS_CPU_X64)
 # include "ion/x64/MacroAssembler-x64.h"
 #elif defined(JS_CPU_ARM)
 # include "ion/arm/MacroAssembler-arm.h"
 #endif
 #include "ion/IonCompartment.h"
 #include "ion/IonInstrumentation.h"
 #include "ion/ParallelFunctions.h"
+#include "ion/VMFunctions.h"
 
 #include "vm/ForkJoin.h"
 
 #include "jstypedarray.h"
 #include "jscompartment.h"
 
 #include "vm/Shape.h"
 
@@ -409,16 +410,19 @@ class MacroAssembler : public MacroAssem
     }
 
     void PushValue(const Address &addr) {
         JS_ASSERT(addr.base != StackPointer);
         pushValue(addr);
         framePushed_ += sizeof(Value);
     }
 
+    void PushEmptyRooted(VMFunction::RootType rootType);
+    void popRooted(VMFunction::RootType rootType, Register cellReg, const ValueOperand &valueReg);
+
     void adjustStack(int amount) {
         if (amount > 0)
             freeStack(amount);
         else if (amount < 0)
             reserveStack(-amount);
     }
 
     void bumpKey(Int32Key *key, int diff) {
--- a/js/src/ion/MoveResolver.h
+++ b/js/src/ion/MoveResolver.h
@@ -20,27 +20,29 @@ class MoveResolver
     // This is similar to Operand, but carries more information. We're also not
     // guaranteed that Operand looks like this on all ISAs.
     class MoveOperand
     {
         enum Kind {
             REG,
             FLOAT_REG,
             ADDRESS,
+            FLOAT_ADDRESS,
             EFFECTIVE_ADDRESS
         };
 
         Kind kind_;
         uint32_t code_;
         int32_t disp_;
 
       public:
         enum AddressKind {
             MEMORY = ADDRESS,
-            EFFECTIVE = EFFECTIVE_ADDRESS
+            EFFECTIVE = EFFECTIVE_ADDRESS,
+            FLOAT = FLOAT_ADDRESS
         };
 
         MoveOperand()
         { }
         explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
         { }
         explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
         { }
@@ -56,34 +58,37 @@ class MoveResolver
         { }
         bool isFloatReg() const {
             return kind_ == FLOAT_REG;
         }
         bool isGeneralReg() const {
             return kind_ == REG;
         }
         bool isDouble() const {
-            return kind_ == FLOAT_REG;
+            return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
         }
         bool isMemory() const {
             return kind_ == ADDRESS;
         }
+        bool isFloatAddress() const {
+            return kind_ == FLOAT_ADDRESS;
+        }
         bool isEffectiveAddress() const {
             return kind_ == EFFECTIVE_ADDRESS;
         }
         Register reg() const {
             JS_ASSERT(isGeneralReg());
             return Register::FromCode(code_);
         }
         FloatRegister floatReg() const {
             JS_ASSERT(isFloatReg());
             return FloatRegister::FromCode(code_);
         }
         Register base() const {
-            JS_ASSERT(isMemory() || isEffectiveAddress());
+            JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
             return Register::FromCode(code_);
         }
         int32_t disp() const {
             return disp_;
         }
 
         bool operator ==(const MoveOperand &other) const {
             if (kind_ != other.kind_)
--- a/js/src/ion/ParallelFunctions.cpp
+++ b/js/src/ion/ParallelFunctions.cpp
@@ -1,21 +1,21 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "ParallelFunctions.h"
-#include "IonSpewer.h"
+#include "ion/ParallelFunctions.h"
 
+#include "ion/IonSpewer.h"
 #include "vm/Interpreter.h"
 
 #include "jscompartmentinlines.h"
-
+#include "jsstrinlines.h"
 #include "vm/Interpreter-inl.h"
 
 using namespace js;
 using namespace ion;
 
 using parallel::Spew;
 using parallel::SpewOps;
 using parallel::SpewBailouts;
--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@@ -66,16 +66,20 @@ struct VMFunction
         Word = 0,
         Double = 1,
         ByRef = 2
     };
 
     // Contains properties about the first 16 arguments.
     uint32_t argumentProperties;
 
+    // Which arguments should be passed in float register on platforms that
+    // have them.
+    uint32_t argumentPassedInFloatRegs;
+
     // The outparam may be any Type_*, and must be the final argument to the
     // function, if not Void. outParam != Void implies that the return type
     // has a boolean failure mode.
     DataType outParam;
 
     // Type returned by the C function and used by the VMFunction wrapper to
     // check for failures of the C function.  Valid failure/return types are
     // boolean and object pointers which are asserted inside the VMFunction
@@ -95,16 +99,19 @@ struct VMFunction
         RootValue,
         RootCell
     };
 
     // Contains an combination of enumerated types used by the gc for marking
     // arguments of the VM wrapper.
     uint64_t argumentRootTypes;
 
+    // The root type of the out param if outParam == Type_Handle.
+    RootType outParamRootType;
+
     // Does this function take a ForkJoinSlice * or a JSContext *?
     ExecutionMode executionMode;
 
     // Number of Values the VM wrapper should pop from the stack when it returns.
     // Used by baseline IC stubs so that they can use tail calls to call the VM
     // wrapper.
     uint32_t extraValuesToPop;
 
@@ -120,16 +127,20 @@ struct VMFunction
     ArgProperties argProperties(uint32_t explicitArg) const {
         return ArgProperties((argumentProperties >> (2 * explicitArg)) & 3);
     }
 
     RootType argRootType(uint32_t explicitArg) const {
         return RootType((argumentRootTypes >> (3 * explicitArg)) & 7);
     }
 
+    bool argPassedInFloatReg(uint32_t explicitArg) const {
+        return ((argumentPassedInFloatRegs >> explicitArg) & 1) == 1;
+    }
+
     // Return the stack size consumed by explicit arguments.
     size_t explicitStackSlots() const {
         size_t stackSlots = explicitArgs;
 
         // Fetch all double-word flags of explicit arguments.
         uint32_t n =
             ((1 << (explicitArgs * 2)) - 1) // = Explicit argument mask.
             & 0x55555555                    // = Mask double-size args.
@@ -169,33 +180,38 @@ struct VMFunction
         }
         return stackSlots;
     }
 
     VMFunction()
       : wrapped(NULL),
         explicitArgs(0),
         argumentProperties(0),
+        argumentPassedInFloatRegs(0),
         outParam(Type_Void),
         returnType(Type_Void),
+        outParamRootType(RootNone),
         executionMode(SequentialExecution),
         extraValuesToPop(0)
     {
     }
 
 
     VMFunction(void *wrapped, uint32_t explicitArgs, uint32_t argumentProperties,
-               uint64_t argRootTypes, DataType outParam, DataType returnType,
+               uint32_t argumentPassedInFloatRegs, uint64_t argRootTypes,
+               DataType outParam, RootType outParamRootType, DataType returnType,
                ExecutionMode executionMode, uint32_t extraValuesToPop = 0)
       : wrapped(wrapped),
         explicitArgs(explicitArgs),
         argumentProperties(argumentProperties),
+        argumentPassedInFloatRegs(argumentPassedInFloatRegs),
         outParam(outParam),
         returnType(returnType),
         argumentRootTypes(argRootTypes),
+        outParamRootType(outParamRootType),
         executionMode(executionMode),
         extraValuesToPop(extraValuesToPop)
     {
         // Check for valid failure/return type.
         JS_ASSERT_IF(outParam != Type_Void && executionMode == SequentialExecution,
                      returnType == Type_Bool);
         JS_ASSERT_IF(executionMode == ParallelExecution, returnType == Type_ParallelResult);
         JS_ASSERT(returnType == Type_Bool ||
@@ -264,16 +280,25 @@ template <> struct TypeToArgProperties<M
 };
 template <> struct TypeToArgProperties<HandleShape> {
     static const uint32_t result = TypeToArgProperties<Shape *>::result | VMFunction::ByRef;
 };
 template <> struct TypeToArgProperties<HandleTypeObject> {
     static const uint32_t result = TypeToArgProperties<types::TypeObject *>::result | VMFunction::ByRef;
 };
 
+// Convert argument type to whether or not it should be passed in a float
+// register on platforms that have them, like x64.
+template <class T> struct TypeToPassInFloatReg {
+    static const uint32_t result = 0;
+};
+template <> struct TypeToPassInFloatReg<double> {
+    static const uint32_t result = 1;
+};
+
 // Convert argument types to root types used by the gc, see MarkIonExitFrame.
 template <class T> struct TypeToRootType {
     static const uint32_t result = VMFunction::RootNone;
 };
 template <> struct TypeToRootType<HandleObject> {
     static const uint32_t result = VMFunction::RootObject;
 };
 template <> struct TypeToRootType<HandleString> {
@@ -300,16 +325,29 @@ template <> struct TypeToRootType<Handle
 
 template <class> struct OutParamToDataType { static const DataType result = Type_Void; };
 template <> struct OutParamToDataType<Value *> { static const DataType result = Type_Value; };
 template <> struct OutParamToDataType<int *> { static const DataType result = Type_Int32; };
 template <> struct OutParamToDataType<uint32_t *> { static const DataType result = Type_Int32; };
 template <> struct OutParamToDataType<MutableHandleValue> { static const DataType result = Type_Handle; };
 template <> struct OutParamToDataType<MutableHandleObject> { static const DataType result = Type_Handle; };
 
+template <class> struct OutParamToRootType {
+    static const VMFunction::RootType result = VMFunction::RootNone;
+};
+template <> struct OutParamToRootType<MutableHandleValue> {
+    static const VMFunction::RootType result = VMFunction::RootValue;
+};
+template <> struct OutParamToRootType<MutableHandleObject> {
+    static const VMFunction::RootType result = VMFunction::RootObject;
+};
+template <> struct OutParamToRootType<MutableHandleString> {
+    static const VMFunction::RootType result = VMFunction::RootString;
+};
+
 template <class> struct MatchContext { };
 template <> struct MatchContext<JSContext *> {
     static const ExecutionMode execMode = SequentialExecution;
 };
 template <> struct MatchContext<ForkJoinSlice *> {
     static const ExecutionMode execMode = ParallelExecution;
 };
 
@@ -317,47 +355,56 @@ template <> struct MatchContext<ForkJoin
 #define FOR_EACH_ARGS_2(Macro, Sep, Last) FOR_EACH_ARGS_1(Macro, Sep, Sep) Macro(2) Last(2)
 #define FOR_EACH_ARGS_3(Macro, Sep, Last) FOR_EACH_ARGS_2(Macro, Sep, Sep) Macro(3) Last(3)
 #define FOR_EACH_ARGS_4(Macro, Sep, Last) FOR_EACH_ARGS_3(Macro, Sep, Sep) Macro(4) Last(4)
 #define FOR_EACH_ARGS_5(Macro, Sep, Last) FOR_EACH_ARGS_4(Macro, Sep, Sep) Macro(5) Last(5)
 #define FOR_EACH_ARGS_6(Macro, Sep, Last) FOR_EACH_ARGS_5(Macro, Sep, Sep) Macro(6) Last(6)
 
 #define COMPUTE_INDEX(NbArg) NbArg
 #define COMPUTE_OUTPARAM_RESULT(NbArg) OutParamToDataType<A ## NbArg>::result
+#define COMPUTE_OUTPARAM_ROOT(NbArg) OutParamToRootType<A ## NbArg>::result
 #define COMPUTE_ARG_PROP(NbArg) (TypeToArgProperties<A ## NbArg>::result << (2 * (NbArg - 1)))
 #define COMPUTE_ARG_ROOT(NbArg) (uint64_t(TypeToRootType<A ## NbArg>::result) << (3 * (NbArg - 1)))
+#define COMPUTE_ARG_FLOAT(NbArg) (TypeToPassInFloatReg<A ## NbArg>::result) << (NbArg - 1)
 #define SEP_OR(_) |
 #define NOTHING(_)
 
 #define FUNCTION_INFO_STRUCT_BODY(ForEachNb)                                            \
     static inline ExecutionMode executionMode() {                                       \
         return MatchContext<Context>::execMode;                                         \
     }                                                                                   \
     static inline DataType returnType() {                                               \
         return TypeToDataType<R>::result;                                               \
     }                                                                                   \
     static inline DataType outParam() {                                                 \
         return ForEachNb(NOTHING, NOTHING, COMPUTE_OUTPARAM_RESULT);                    \
     }                                                                                   \
+    static inline RootType outParamRootType() {                                         \
+        return ForEachNb(NOTHING, NOTHING, COMPUTE_OUTPARAM_ROOT);                      \
+    }                                                                                   \
     static inline size_t NbArgs() {                                                     \
         return ForEachNb(NOTHING, NOTHING, COMPUTE_INDEX);                              \
     }                                                                                   \
     static inline size_t explicitArgs() {                                               \
         return NbArgs() - (outParam() != Type_Void ? 1 : 0);                            \
     }                                                                                   \
     static inline uint32_t argumentProperties() {                                       \
         return ForEachNb(COMPUTE_ARG_PROP, SEP_OR, NOTHING);                            \
     }                                                                                   \
+    static inline uint32_t argumentPassedInFloatRegs() {                                \
+        return ForEachNb(COMPUTE_ARG_FLOAT, SEP_OR, NOTHING);                           \
+    }                                                                                   \
     static inline uint64_t argumentRootTypes() {                                        \
         return ForEachNb(COMPUTE_ARG_ROOT, SEP_OR, NOTHING);                            \
     }                                                                                   \
     FunctionInfo(pf fun, PopValues extraValuesToPop = PopValues(0))                     \
         : VMFunction(JS_FUNC_TO_DATA_PTR(void *, fun), explicitArgs(),                  \
-                     argumentProperties(),argumentRootTypes(),                          \
-                     outParam(), returnType(), executionMode(),                         \
+                     argumentProperties(), argumentPassedInFloatRegs(),                 \
+                     argumentRootTypes(), outParam(), outParamRootType(),               \
+                     returnType(), executionMode(),                                     \
                      extraValuesToPop.numValues)                                        \
     { }
 
 template <typename Fun>
 struct FunctionInfo {
 };
 
 // VMFunction wrapper with no explicit arguments.
@@ -369,29 +416,36 @@ struct FunctionInfo<R (*)(Context)> : pu
         return MatchContext<Context>::execMode;
     }
     static inline DataType returnType() {
         return TypeToDataType<R>::result;
     }
     static inline DataType outParam() {
         return Type_Void;
     }
+    static inline RootType outParamRootType() {
+        return RootNone;
+    }
     static inline size_t explicitArgs() {
         return 0;
     }
     static inline uint32_t argumentProperties() {
         return 0;
     }
+    static inline uint32_t argumentPassedInFloatRegs() {
+        return 0;
+    }
     static inline uint64_t argumentRootTypes() {
         return 0;
     }
     FunctionInfo(pf fun)
       : VMFunction(JS_FUNC_TO_DATA_PTR(void *, fun), explicitArgs(),
-                   argumentProperties(), argumentRootTypes(),
-                   outParam(), returnType(), executionMode())
+                   argumentProperties(), argumentPassedInFloatRegs(),
+                   argumentRootTypes(), outParam(), outParamRootType(),
+                   returnType(), executionMode())
     { }
 };
 
 // Specialize the class for each number of argument used by VMFunction.
 // Keep it verbose unless you find a readable macro for it.
 template <class R, class Context, class A1>
 struct FunctionInfo<R (*)(Context, A1)> : public VMFunction {
     typedef R (*pf)(Context, A1);
@@ -434,17 +488,19 @@ template <class R, class Context, class 
 #undef FOR_EACH_ARGS_5
 #undef FOR_EACH_ARGS_4
 #undef FOR_EACH_ARGS_3
 #undef FOR_EACH_ARGS_2
 #undef FOR_EACH_ARGS_1
 
 #undef COMPUTE_INDEX
 #undef COMPUTE_OUTPARAM_RESULT
+#undef COMPUTE_OUTPARAM_ROOT
 #undef COMPUTE_ARG_PROP
+#undef COMPUTE_ARG_FLOAT
 #undef SEP_OR
 #undef NOTHING
 
 class AutoDetectInvalidation
 {
     JSContext *cx_;
     IonScript *ionScript_;
     Value *rval_;
--- a/js/src/ion/arm/IonFrames-arm.h
+++ b/js/src/ion/arm/IonFrames-arm.h
@@ -149,18 +149,19 @@ class IonExitFooterFrame
     inline IonCode **addressOfIonCode() {
         return &ionCode_;
     }
     inline const VMFunction *function() const {
         return function_;
     }
 
     // This should only be called for function()->outParam == Type_Handle
-    Value *outVp() {
-        return reinterpret_cast<Value *>(reinterpret_cast<char *>(this) - sizeof(Value));
+    template <typename T>
+    T *outParam() {
+        return reinterpret_cast<T *>(reinterpret_cast<char *>(this) - sizeof(T));
     }
 };
 
 class IonOsrFrameLayout : public IonJSFrameLayout
 {
   public:
     static inline size_t Size() {
         return sizeof(IonOsrFrameLayout);
--- a/js/src/ion/arm/Trampoline-arm.cpp
+++ b/js/src/ion/arm/Trampoline-arm.cpp
@@ -624,17 +624,17 @@ IonRuntime::generateVMWrapper(JSContext 
         regs.take(outReg);
         masm.reserveStack(sizeof(Value));
         masm.ma_mov(sp, outReg);
         break;
 
       case Type_Handle:
         outReg = r4;
         regs.take(outReg);
-        masm.Push(UndefinedValue());
+        masm.PushEmptyRooted(f.outParamRootType);
         masm.ma_mov(sp, outReg);
         break;
 
       case Type_Int32:
         outReg = r4;
         regs.take(outReg);
         masm.reserveStack(sizeof(int32_t));
         masm.ma_mov(sp, outReg);
@@ -654,21 +654,21 @@ IonRuntime::generateVMWrapper(JSContext 
     for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
         MoveOperand from;
         switch (f.argProperties(explicitArg)) {
           case VMFunction::WordByValue:
             masm.passABIArg(MoveOperand(argsBase, argDisp));
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByValue:
-            JS_NOT_REACHED("VMCalls with double-size value arguments is not supported.");
-            masm.passABIArg(MoveOperand(argsBase, argDisp));
-            argDisp += sizeof(void *);
-            masm.passABIArg(MoveOperand(argsBase, argDisp));
-            argDisp += sizeof(void *);
+            // Values should be passed by reference, not by value, so we
+            // assert that the argument is a double-precision float.
+            JS_ASSERT(f.argPassedInFloatReg(explicitArg));
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
+            argDisp += sizeof(double);
             break;
           case VMFunction::WordByRef:
             masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByRef:
             masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
             argDisp += 2 * sizeof(void *);
@@ -696,16 +696,19 @@ IonRuntime::generateVMWrapper(JSContext 
       default:
         JS_NOT_REACHED("unknown failure kind");
         break;
     }
 
     // Load the outparam and free any allocated stack.
     switch (f.outParam) {
       case Type_Handle:
+        masm.popRooted(f.outParamRootType, ReturnReg, JSReturnOperand);
+        break;
+
       case Type_Value:
         masm.loadValue(Address(sp, 0), JSReturnOperand);
         masm.freeStack(sizeof(Value));
         break;
 
       case Type_Int32:
         masm.load32(Address(sp, 0), ReturnReg);
         masm.freeStack(sizeof(int32_t));
--- a/js/src/ion/shared/IonFrames-x86-shared.h
+++ b/js/src/ion/shared/IonFrames-x86-shared.h
@@ -142,18 +142,19 @@ class IonExitFooterFrame
     inline IonCode **addressOfIonCode() {
         return &ionCode_;
     }
     inline const VMFunction *function() const {
         return function_;
     }
 
     // This should only be called for function()->outParam == Type_Handle
-    Value *outVp() {
-        return reinterpret_cast<Value *>(reinterpret_cast<char *>(this) - sizeof(Value));
+    template <typename T>
+    T *outParam() {
+        return reinterpret_cast<T *>(reinterpret_cast<char *>(this) - sizeof(T));
     }
 };
 
 class IonNativeExitFrameLayout;
 class IonOOLNativeGetterExitFrameLayout;
 class IonOOLPropertyOpExitFrameLayout;
 class IonOOLProxyGetExitFrameLayout;
 class IonDOMExitFrameLayout;
--- a/js/src/ion/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/ion/shared/MoveEmitter-x86-shared.cpp
@@ -49,17 +49,17 @@ Operand
 MoveEmitterX86::spillSlot() const
 {
     return Operand(StackPointer, masm.framePushed() - pushedAtSpill_);
 }
 
 Operand
 MoveEmitterX86::toOperand(const MoveOperand &operand) const
 {
-    if (operand.isMemory() || operand.isEffectiveAddress()) {
+    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress()) {
         if (operand.base() != StackPointer)
             return Operand(operand.base(), operand.disp());
 
         JS_ASSERT(operand.disp() >= 0);
 
         // Otherwise, the stack offset may need to be adjusted.
         return Operand(StackPointer, operand.disp() + (masm.framePushed() - pushedAtStart_));
     }
--- a/js/src/ion/x64/MacroAssembler-x64.h
+++ b/js/src/ion/x64/MacroAssembler-x64.h
@@ -382,18 +382,22 @@ class MacroAssemblerX64 : public MacroAs
         movq(rhs, ScratchReg);
         cmpq(lhs, ScratchReg);
     }
     void cmpPtr(const Operand &lhs, const ImmGCPtr rhs) {
         movq(rhs, ScratchReg);
         cmpq(lhs, ScratchReg);
     }
     void cmpPtr(const Operand &lhs, const ImmWord rhs) {
-        mov(rhs, ScratchReg);
-        cmpq(lhs, ScratchReg);
+        if ((intptr_t)rhs.value <= INT32_MAX && (intptr_t)rhs.value >= INT32_MIN) {
+            cmpq(lhs, Imm32((int32_t)rhs.value));
+        } else {
+            mov(rhs, ScratchReg);
+            cmpq(lhs, ScratchReg);
+        }
     }
     void cmpPtr(const Address &lhs, const ImmGCPtr rhs) {
         cmpPtr(Operand(lhs), rhs);
     }
     void cmpPtr(const Address &lhs, const ImmWord rhs) {
         cmpPtr(Operand(lhs), rhs);
     }
     void cmpPtr(const Operand &lhs, const Register &rhs) {
@@ -438,18 +442,22 @@ class MacroAssemblerX64 : public MacroAs
     void addPtr(Imm32 imm, const Register &dest) {
         addq(imm, dest);
     }
     void addPtr(Imm32 imm, const Address &dest) {
         addq(imm, Operand(dest));
     }
     void addPtr(ImmWord imm, const Register &dest) {
         JS_ASSERT(dest != ScratchReg);
-        mov(imm, ScratchReg);
-        addq(ScratchReg, dest);
+        if ((intptr_t)imm.value <= INT32_MAX && (intptr_t)imm.value >= INT32_MIN) {
+            addq(Imm32((int32_t)imm.value), dest);
+        } else {
+            mov(imm, ScratchReg);
+            addq(ScratchReg, dest);
+        }
     }
     void addPtr(const Address &src, const Register &dest) {
         addq(Operand(src), dest);
     }
     void subPtr(Imm32 imm, const Register &dest) {
         subq(imm, dest);
     }
     void subPtr(const Register &src, const Register &dest) {
@@ -549,18 +557,22 @@ class MacroAssemblerX64 : public MacroAs
     void loadPtr(const BaseIndex &src, Register dest) {
         movq(Operand(src), dest);
     }
     void loadPrivate(const Address &src, Register dest) {
         loadPtr(src, dest);
         shlq(Imm32(1), dest);
     }
     void storePtr(ImmWord imm, const Address &address) {
-        mov(imm, ScratchReg);
-        movq(ScratchReg, Operand(address));
+        if ((intptr_t)imm.value <= INT32_MAX && (intptr_t)imm.value >= INT32_MIN) {
+            mov(Imm32((int32_t)imm.value), Operand(address));
+        } else {
+            mov(imm, ScratchReg);
+            movq(ScratchReg, Operand(address));
+        }
     }
     void storePtr(ImmGCPtr imm, const Address &address) {
         movq(imm, ScratchReg);
         movq(ScratchReg, Operand(address));
     }
     void storePtr(Register src, const Address &address) {
         movq(src, Operand(address));
     }
--- a/js/src/ion/x64/Trampoline-x64.cpp
+++ b/js/src/ion/x64/Trampoline-x64.cpp
@@ -523,17 +523,17 @@ IonRuntime::generateVMWrapper(JSContext 
       case Type_Value:
         outReg = regs.takeAny();
         masm.reserveStack(sizeof(Value));
         masm.movq(esp, outReg);
         break;
 
       case Type_Handle:
         outReg = regs.takeAny();
-        masm.Push(UndefinedValue());
+        masm.PushEmptyRooted(f.outParamRootType);
         masm.movq(esp, outReg);
         break;
 
       case Type_Int32:
         outReg = regs.takeAny();
         masm.reserveStack(sizeof(int32_t));
         masm.movq(esp, outReg);
         break;
@@ -549,17 +549,20 @@ IonRuntime::generateVMWrapper(JSContext 
     size_t argDisp = 0;
 
     // Copy arguments.
     if (f.explicitArgs) {
         for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
             MoveOperand from;
             switch (f.argProperties(explicitArg)) {
               case VMFunction::WordByValue:
-                masm.passABIArg(MoveOperand(argsBase, argDisp));
+                if (f.argPassedInFloatReg(explicitArg))
+                    masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
+                else
+                    masm.passABIArg(MoveOperand(argsBase, argDisp));
                 argDisp += sizeof(void *);
                 break;
               case VMFunction::WordByRef:
                 masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
                 argDisp += sizeof(void *);
                 break;
               case VMFunction::DoubleByValue:
               case VMFunction::DoubleByRef:
@@ -591,16 +594,19 @@ IonRuntime::generateVMWrapper(JSContext 
       default:
         JS_NOT_REACHED("unknown failure kind");
         break;
     }
 
     // Load the outparam and free any allocated stack.
     switch (f.outParam) {
       case Type_Handle:
+        masm.popRooted(f.outParamRootType, ReturnReg, JSReturnOperand);
+        break;
+
       case Type_Value:
         masm.loadValue(Address(esp, 0), JSReturnOperand);
         masm.freeStack(sizeof(Value));
         break;
 
       case Type_Int32:
         masm.load32(Address(esp, 0), ReturnReg);
         masm.freeStack(sizeof(int32_t));
--- a/js/src/ion/x86/Trampoline-x86.cpp
+++ b/js/src/ion/x86/Trampoline-x86.cpp
@@ -540,17 +540,17 @@ IonRuntime::generateVMWrapper(JSContext 
       case Type_Value:
         outReg = regs.takeAny();
         masm.reserveStack(sizeof(Value));
         masm.movl(esp, outReg);
         break;
 
       case Type_Handle:
         outReg = regs.takeAny();
-        masm.Push(UndefinedValue());
+        masm.PushEmptyRooted(f.outParamRootType);
         masm.movl(esp, outReg);
         break;
 
       case Type_Int32:
         outReg = regs.takeAny();
         masm.reserveStack(sizeof(int32_t));
         masm.movl(esp, outReg);
         break;
@@ -570,16 +570,18 @@ IonRuntime::generateVMWrapper(JSContext 
         for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
             MoveOperand from;
             switch (f.argProperties(explicitArg)) {
               case VMFunction::WordByValue:
                 masm.passABIArg(MoveOperand(argsBase, argDisp));
                 argDisp += sizeof(void *);
                 break;
               case VMFunction::DoubleByValue:
+                // We don't pass doubles in float registers on x86, so no need
+                // to check for argPassedInFloatReg.
                 masm.passABIArg(MoveOperand(argsBase, argDisp));
                 argDisp += sizeof(void *);
                 masm.passABIArg(MoveOperand(argsBase, argDisp));
                 argDisp += sizeof(void *);
                 break;
               case VMFunction::WordByRef:
                 masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
                 argDisp += sizeof(void *);
@@ -614,16 +616,19 @@ IonRuntime::generateVMWrapper(JSContext 
       default:
         JS_NOT_REACHED("unknown failure kind");
         break;
     }
 
     // Load the outparam and free any allocated stack.
     switch (f.outParam) {
       case Type_Handle:
+        masm.popRooted(f.outParamRootType, ReturnReg, JSReturnOperand);
+        break;
+
       case Type_Value:
         masm.loadValue(Address(esp, 0), JSReturnOperand);
         masm.freeStack(sizeof(Value));
         break;
 
       case Type_Int32:
         masm.load32(Address(esp, 0), ReturnReg);
         masm.freeStack(sizeof(JSBool));
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -8,17 +8,19 @@
 
 #include "mozilla/DebugOnly.h"
 #include "mozilla/PodOperations.h"
 
 #include "jsautooplen.h"
 #include "jscompartment.h"
 #include "jscntxt.h"
 
+#include "jsanalyzeinlines.h"
 #include "jsinferinlines.h"
+#include "jsopcodeinlines.h"
 
 using namespace js;
 using namespace js::analyze;
 
 using mozilla::DebugOnly;
 using mozilla::PodCopy;
 using mozilla::PodZero;
 
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -12,17 +12,16 @@
 #include "mozilla/PodOperations.h"
 #include "mozilla/TypeTraits.h"
 
 #include "jsautooplen.h"
 #include "jscompartment.h"
 #include "jscntxt.h"
 #include "jsinfer.h"
 #include "jsscript.h"
-#include "jsopcodeinlines.h"
 
 #include "ds/LifoAlloc.h"
 #include "js/TemplateLib.h"
 #include "vm/ScopeObject.h"
 
 class JSScript;
 
 namespace js {
@@ -821,43 +820,28 @@ class ScriptAnalysis
     }
     bool jumpTarget(const jsbytecode *pc) { return jumpTarget(pc - script_->code); }
 
     bool popGuaranteed(jsbytecode *pc) {
         jsbytecode *next = pc + GetBytecodeLength(pc);
         return JSOp(*next) == JSOP_POP && !jumpTarget(next);
     }
 
-    const SSAValue &poppedValue(uint32_t offset, uint32_t which) {
-        JS_ASSERT(offset < script_->length);
-        JS_ASSERT(which < GetUseCount(script_, offset) +
-                  (ExtendedUse(script_->code + offset) ? 1 : 0));
-        return getCode(offset).poppedValues[which];
-    }
-    const SSAValue &poppedValue(const jsbytecode *pc, uint32_t which) {
-        return poppedValue(pc - script_->code, which);
-    }
+    inline const SSAValue &poppedValue(uint32_t offset, uint32_t which);
+
+    inline const SSAValue &poppedValue(const jsbytecode *pc, uint32_t which);
 
     const SlotValue *newValues(uint32_t offset) {
         JS_ASSERT(offset < script_->length);
         return getCode(offset).newValues;
     }
     const SlotValue *newValues(const jsbytecode *pc) { return newValues(pc - script_->code); }
 
-    types::StackTypeSet *pushedTypes(uint32_t offset, uint32_t which = 0) {
-        JS_ASSERT(offset < script_->length);
-        JS_ASSERT(which < GetDefCount(script_, offset) +
-                  (ExtendedDef(script_->code + offset) ? 1 : 0));
-        types::StackTypeSet *array = getCode(offset).pushedTypes;
-        JS_ASSERT(array);
-        return array + which;
-    }
-    types::StackTypeSet *pushedTypes(const jsbytecode *pc, uint32_t which) {
-        return pushedTypes(pc - script_->code, which);
-    }
+    inline types::StackTypeSet *pushedTypes(uint32_t offset, uint32_t which = 0);
+    inline types::StackTypeSet *pushedTypes(const jsbytecode *pc, uint32_t which);
 
     bool hasPushedTypes(const jsbytecode *pc) { return getCode(pc).pushedTypes != NULL; }
 
     types::TypeBarrier *typeBarriers(JSContext *cx, uint32_t offset) {
         if (getCode(offset).typeBarriers)
             pruneTypeBarriers(cx, offset);
         return getCode(offset).typeBarriers;
     }
@@ -880,87 +864,45 @@ class ScriptAnalysis
      */
     void breakTypeBarriers(JSContext *cx, uint32_t offset, bool all);
 
     /* Break all type barriers used in computing v. */
     void breakTypeBarriersSSA(JSContext *cx, const SSAValue &v);
 
     inline void addPushedType(JSContext *cx, uint32_t offset, uint32_t which, types::Type type);
 
-    types::StackTypeSet *getValueTypes(const SSAValue &v) {
-        switch (v.kind()) {
-          case SSAValue::PUSHED:
-            return pushedTypes(v.pushedOffset(), v.pushedIndex());
-          case SSAValue::VAR:
-            JS_ASSERT(!slotEscapes(v.varSlot()));
-            if (v.varInitial()) {
-                if (v.varSlot() < LocalSlot(script_, 0))
-                    return types::TypeScript::SlotTypes(script_, v.varSlot());
-                return undefinedTypeSet;
-            } else {
-                /*
-                 * Results of intermediate assignments have the same type as
-                 * the first type pushed by the assignment op. Note that this
-                 * may not be the exact same value as was pushed, due to
-                 * post-inc/dec ops.
-                 */
-                return pushedTypes(v.varOffset(), 0);
-            }
-          case SSAValue::PHI:
-            return &v.phiNode()->types;
-          default:
-            /* Cannot compute types for empty SSA values. */
-            JS_NOT_REACHED("Bad SSA value");
-            return NULL;
-        }
-    }
+    inline types::StackTypeSet *getValueTypes(const SSAValue &v);
 
-    types::StackTypeSet *poppedTypes(uint32_t offset, uint32_t which) {
-        return getValueTypes(poppedValue(offset, which));
-    }
-    types::StackTypeSet *poppedTypes(const jsbytecode *pc, uint32_t which) {
-        return getValueTypes(poppedValue(pc, which));
-    }
+    inline types::StackTypeSet *poppedTypes(uint32_t offset, uint32_t which);
+    inline types::StackTypeSet *poppedTypes(const jsbytecode *pc, uint32_t which);
 
     /* Whether an arithmetic operation is operating on integers, with an integer result. */
     bool integerOperation(jsbytecode *pc);
 
     bool trackUseChain(const SSAValue &v) {
         JS_ASSERT_IF(v.kind() == SSAValue::VAR, trackSlot(v.varSlot()));
         return v.kind() != SSAValue::EMPTY &&
                (v.kind() != SSAValue::VAR || !v.varInitial());
     }
 
     /*
      * Get the use chain for an SSA value. May be invalid for some opcodes in
      * scripts where localsAliasStack(). You have been warned!
      */
-    SSAUseChain *& useChain(const SSAValue &v) {
-        JS_ASSERT(trackUseChain(v));
-        if (v.kind() == SSAValue::PUSHED)
-            return getCode(v.pushedOffset()).pushedUses[v.pushedIndex()];
-        if (v.kind() == SSAValue::VAR)
-            return getCode(v.varOffset()).pushedUses[GetDefCount(script_, v.varOffset())];
-        return v.phiNode()->uses;
-    }
+    inline SSAUseChain *& useChain(const SSAValue &v);
 
     LoopAnalysis *getLoop(uint32_t offset) {
         JS_ASSERT(offset < script_->length);
         return getCode(offset).loop;
     }
     LoopAnalysis *getLoop(const jsbytecode *pc) { return getLoop(pc - script_->code); }
 
+
     /* For a JSOP_CALL* op, get the pc of the corresponding JSOP_CALL/NEW/etc. */
-    jsbytecode *getCallPC(jsbytecode *pc)
-    {
-        SSAUseChain *uses = useChain(SSAValue::PushedValue(pc - script_->code, 0));
-        JS_ASSERT(uses && uses->popped);
-        JS_ASSERT(js_CodeSpec[script_->code[uses->offset]].format & JOF_INVOKE);
-        return script_->code + uses->offset;
-    }
+    inline jsbytecode *getCallPC(jsbytecode *pc);
 
     /* Accessors for local variable information. */
 
     /*
      * Escaping slots include all slots that can be accessed in ways other than
      * through the corresponding LOCAL/ARG opcode. This includes all closed
      * slots in the script, all slots in scripts which use eval or are in debug
      * mode, and slots which are aliased by NAME or similar opcodes in the
@@ -1123,19 +1065,17 @@ class CrossScriptSSA
         if (index == OUTER_FRAME)
             return 0;
         size_t res = outerFrame.script->length;
         for (unsigned i = 0; i < index; i++)
             res += inlineFrames[i].script->length;
         return res;
     }
 
-    types::StackTypeSet *getValueTypes(const CrossSSAValue &cv) {
-        return getFrame(cv.frame).script->analysis()->getValueTypes(cv.v);
-    }
+    inline types::StackTypeSet *getValueTypes(const CrossSSAValue &cv);
 
     bool addInlineFrame(JSScript *script, uint32_t depth, uint32_t parent,
                         jsbytecode *parentpc)
     {
         uint32_t index = inlineFrames.length();
         return inlineFrames.append(Frame(index, script, depth, parent, parentpc));
     }
 
new file mode 100644
--- /dev/null
+++ b/js/src/jsanalyzeinlines.h
@@ -0,0 +1,120 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef jsanalyzeinlines_h___
+#define jsanalyzeinlines_h___
+
+#include "jsanalyze.h"
+
+#include "jsopcodeinlines.h"
+
+namespace js {
+namespace analyze {
+
+inline const SSAValue &
+ScriptAnalysis::poppedValue(uint32_t offset, uint32_t which)
+{
+    JS_ASSERT(offset < script_->length);
+    JS_ASSERT(which < GetUseCount(script_, offset) +
+              (ExtendedUse(script_->code + offset) ? 1 : 0));
+    return getCode(offset).poppedValues[which];
+}
+
+inline const SSAValue &
+ScriptAnalysis::poppedValue(const jsbytecode *pc, uint32_t which)
+{
+    return poppedValue(pc - script_->code, which);
+}
+
+inline types::StackTypeSet *
+ScriptAnalysis::pushedTypes(uint32_t offset, uint32_t which)
+{
+    JS_ASSERT(offset < script_->length);
+    JS_ASSERT(which < GetDefCount(script_, offset) +
+              (ExtendedDef(script_->code + offset) ? 1 : 0));
+    types::StackTypeSet *array = getCode(offset).pushedTypes;
+    JS_ASSERT(array);
+    return array + which;
+}
+
+inline types::StackTypeSet *
+ScriptAnalysis::pushedTypes(const jsbytecode *pc, uint32_t which)
+{
+    return pushedTypes(pc - script_->code, which);
+}
+
+inline types::StackTypeSet *
+ScriptAnalysis::getValueTypes(const SSAValue &v)
+{
+    switch (v.kind()) {
+      case SSAValue::PUSHED:
+        return pushedTypes(v.pushedOffset(), v.pushedIndex());
+      case SSAValue::VAR:
+        JS_ASSERT(!slotEscapes(v.varSlot()));
+        if (v.varInitial()) {
+            if (v.varSlot() < LocalSlot(script_, 0))
+                return types::TypeScript::SlotTypes(script_, v.varSlot());
+            return undefinedTypeSet;
+        } else {
+            /*
+             * Results of intermediate assignments have the same type as
+             * the first type pushed by the assignment op. Note that this
+             * may not be the exact same value as was pushed, due to
+             * post-inc/dec ops.
+             */
+            return pushedTypes(v.varOffset(), 0);
+        }
+      case SSAValue::PHI:
+        return &v.phiNode()->types;
+      default:
+        /* Cannot compute types for empty SSA values. */
+        JS_NOT_REACHED("Bad SSA value");
+        return NULL;
+    }
+}
+
+inline types::StackTypeSet *
+ScriptAnalysis::poppedTypes(uint32_t offset, uint32_t which)
+{
+    return getValueTypes(poppedValue(offset, which));
+}
+
+inline types::StackTypeSet *
+ScriptAnalysis::poppedTypes(const jsbytecode *pc, uint32_t which)
+{
+    return getValueTypes(poppedValue(pc, which));
+}
+
+inline SSAUseChain *&
+ScriptAnalysis::useChain(const SSAValue &v)
+{
+    JS_ASSERT(trackUseChain(v));
+    if (v.kind() == SSAValue::PUSHED)
+        return getCode(v.pushedOffset()).pushedUses[v.pushedIndex()];
+    if (v.kind() == SSAValue::VAR)
+        return getCode(v.varOffset()).pushedUses[GetDefCount(script_, v.varOffset())];
+    return v.phiNode()->uses;
+}
+
+inline jsbytecode *
+ScriptAnalysis::getCallPC(jsbytecode *pc)
+{
+    SSAUseChain *uses = useChain(SSAValue::PushedValue(pc - script_->code, 0));
+    JS_ASSERT(uses && uses->popped);
+    JS_ASSERT(js_CodeSpec[script_->code[uses->offset]].format & JOF_INVOKE);
+    return script_->code + uses->offset;
+}
+
+inline types::StackTypeSet *
+CrossScriptSSA::getValueTypes(const CrossSSAValue &cv)
+{
+    return getFrame(cv.frame).script->analysis()->getValueTypes(cv.v);
+}
+
+} /* namespace analyze */
+} /* namespace js */
+
+#endif // jsanalyzeinlines_h___
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -56,16 +56,18 @@
 #endif
 
 #include "builtin/Eval.h"
 #include "builtin/Intl.h"
 #include "builtin/MapObject.h"
 #include "builtin/RegExp.h"
 #include "builtin/ParallelArray.h"
 #include "frontend/BytecodeCompiler.h"
+#include "frontend/FullParseHandler.h"  // for JS_BufferIsCompileableUnit
+#include "frontend/Parser.h" // for JS_BufferIsCompileableUnit
 #include "gc/Marking.h"
 #include "gc/Memory.h"
 #include "ion/AsmJS.h"
 #include "js/CharacterEncoding.h"
 #include "vm/Debugger.h"
 #include "vm/Interpreter.h"
 #include "vm/NumericConversions.h"
 #include "vm/Shape.h"
@@ -872,16 +874,17 @@ JSRuntime::JSRuntime(JSUseHelperThreads 
     propertyRemovals(0),
 #if !ENABLE_INTL_API
     thousandsSeparator(0),
     decimalSeparator(0),
     numGrouping(0),
 #endif
     mathCache_(NULL),
     dtoaState(NULL),
+    activeCompilations(0),
     trustedPrincipals_(NULL),
     wrapObjectCallback(TransparentObjectWrapper),
     sameCompartmentWrapObjectCallback(NULL),
     preWrapObjectCallback(NULL),
     preserveWrapperCallback(NULL),
 #ifdef DEBUG
     noGCOrAllocationCheck(0),
 #endif
@@ -5432,29 +5435,26 @@ JS_BufferIsCompilableUnit(JSContext *cx,
      */
     result = JS_TRUE;
     exnState = JS_SaveExceptionState(cx);
     {
         CompileOptions options(cx);
         options.setCompileAndGo(false);
         Parser<frontend::FullParseHandler> parser(cx, options, chars, length,
                                                   /* foldConstants = */ true, NULL, NULL);
-        if (parser.init()) {
-            older = JS_SetErrorReporter(cx, NULL);
-            if (!parser.parse(obj) &&
-                parser.tokenStream.isUnexpectedEOF()) {
-                /*
-                 * We ran into an error. If it was because we ran out of
-                 * source, we return false so our caller knows to try to
-                 * collect more buffered source.
-                 */
-                result = JS_FALSE;
-            }
-            JS_SetErrorReporter(cx, older);
+        older = JS_SetErrorReporter(cx, NULL);
+        if (!parser.parse(obj) && parser.tokenStream.isUnexpectedEOF()) {
+            /*
+             * We ran into an error. If it was because we ran out of
+             * source, we return false so our caller knows to try to
+             * collect more buffered source.
+             */
+            result = JS_FALSE;
         }
+        JS_SetErrorReporter(cx, older);
     }
     js_free(chars);
     JS_RestoreExceptionState(cx, exnState);
     return result;
 }
 
 JS_PUBLIC_API(JSObject *)
 JS_GetGlobalFromScript(JSScript *script)
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -1127,54 +1127,50 @@ JSContext::JSContext(JSRuntime *rt)
     options_(0),
     reportGranularity(JS_DEFAULT_JITREPORT_GRANULARITY),
     resolvingList(NULL),
     generatingError(false),
     enterCompartmentDepth_(0),
     savedFrameChains_(),
     defaultCompartmentObject_(NULL),
     stack(thisDuringConstruction()),
-    parseMapPool_(NULL),
     cycleDetectorSet(thisDuringConstruction()),
     errorReporter(NULL),
     operationCallback(NULL),
     data(NULL),
     data2(NULL),
 #ifdef JS_THREADSAFE
     outstandingRequests(0),
 #endif
     resolveFlags(0),
     iterValue(MagicValue(JS_NO_ITER_VALUE)),
     jitIsBroken(false),
 #ifdef MOZ_TRACE_JSCALLS
     functionCallback(NULL),
 #endif
-    innermostGenerator_(NULL),
+    innermostGenerator_(NULL)
+{
 #ifdef DEBUG
-    stackIterAssertionEnabled(true),
+    stackIterAssertionEnabled = true;
 #endif
-    activeCompilations(0)
-{
+
     JS_ASSERT(static_cast<ContextFriendFields*>(this) ==
               ContextFriendFields::get(this));
 
 #if defined(JSGC_ROOT_ANALYSIS) || defined(JSGC_USE_EXACT_ROOTING)
     PodArrayZero(thingGCRooters);
 #endif
 #if defined(DEBUG) && defined(JS_GC_ZEAL) && defined(JSGC_ROOT_ANALYSIS) && !defined(JS_THREADSAFE)
     skipGCRooters = NULL;
 #endif
 }
 
 JSContext::~JSContext()
 {
     /* Free the stuff hanging off of cx. */
-    if (parseMapPool_)
-        js_delete(parseMapPool_);
-
     JS_ASSERT(!resolvingList);
 }
 
 bool
 JSRuntime::setDefaultLocale(const char *locale)
 {
     if (!locale)
         return false;
@@ -1353,25 +1349,16 @@ JSRuntime::onOutOfMemory(void *p, size_t
       p = js_realloc(p, nbytes);
     if (p)
         return p;
     if (cx)
         js_ReportOutOfMemory(cx);
     return NULL;
 }
 
-void
-JSContext::purge()
-{
-    if (!activeCompilations) {
-        js_delete(parseMapPool_);
-        parseMapPool_ = NULL;
-    }
-}
-
 static bool
 ComputeIsJITBroken()
 {
 #if !defined(ANDROID) || defined(GONK)
     return false;
 #else  // ANDROID
     if (getenv("JS_IGNORE_JIT_BROKENNESS")) {
         return false;
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -24,16 +24,17 @@
 #include "jsgc.h"
 #include "jspropertycache.h"
 #include "jspropertytree.h"
 #include "jsprototypes.h"
 #include "jsutil.h"
 #include "prmjtime.h"
 
 #include "ds/LifoAlloc.h"
+#include "frontend/ParseMaps.h"
 #include "gc/Nursery.h"
 #include "gc/Statistics.h"
 #include "gc/StoreBuffer.h"
 #include "js/HashTable.h"
 #include "js/Vector.h"
 #include "ion/AsmJS.h"
 #include "vm/DateTime.h"
 #include "vm/SPSProfiler.h"
@@ -606,18 +607,16 @@ struct MallocProvider
 
     JS_DECLARE_NEW_METHODS(new_, malloc_, JS_ALWAYS_INLINE)
 };
 
 namespace gc {
 class MarkingValidator;
 } // namespace gc
 
-class JS_FRIEND_API(AutoEnterPolicy);
-
 typedef Vector<JS::Zone *, 1, SystemAllocPolicy> ZoneVector;
 
 } // namespace js
 
 struct JSRuntime : public JS::shadow::Runtime,
                    public js::MallocProvider<JSRuntime>
 {
     /*
@@ -1254,16 +1253,26 @@ struct JSRuntime : public JS::shadow::Ru
 
     /* State used by jsdtoa.cpp. */
     DtoaState           *dtoaState;
 
     js::DateTimeInfo    dateTimeInfo;
 
     js::ConservativeGCData conservativeGC;
 
+    /* Pool of maps used during parse/emit. */
+    js::frontend::ParseMapPool parseMapPool;
+
+    /*
+     * Count of currently active compilations.
+     * When there are compilations active for the context, the GC must not
+     * purge the ParseMapPool.
+     */
+    unsigned activeCompilations;
+
   private:
     JSPrincipals        *trustedPrincipals_;
   public:
     void setTrustedPrincipals(JSPrincipals *p) { trustedPrincipals_ = p; }
     JSPrincipals *trustedPrincipals() const { return trustedPrincipals_; }
 
     /* Set of all currently-living atoms. */
     js::AtomSet         atoms;
@@ -1598,44 +1607,32 @@ struct JSContext : js::ContextFriendFiel
     inline js::StackFrame* fp() const       { return stack.fp(); }
     inline js::StackFrame* maybefp() const  { return stack.maybefp(); }
     inline js::FrameRegs& regs() const      { return stack.regs(); }
     inline js::FrameRegs* maybeRegs() const { return stack.maybeRegs(); }
 
     /* Wrap cx->exception for the current compartment. */
     void wrapPendingException();
 
-  private:
-    /* Lazily initialized pool of maps used during parse/emit. */
-    js::frontend::ParseMapPool *parseMapPool_;
-
-  public:
     /* State for object and array toSource conversion. */
     js::ObjectSet       cycleDetectorSet;
 
     /* Per-context optional error reporter. */
     JSErrorReporter     errorReporter;
 
     /* Branch callback. */
     JSOperationCallback operationCallback;
 
     /* Client opaque pointers. */
     void                *data;
     void                *data2;
 
     inline js::RegExpStatics *regExpStatics();
 
   public:
-    js::frontend::ParseMapPool &parseMapPool() {
-        JS_ASSERT(parseMapPool_);
-        return *parseMapPool_;
-    }
-
-    inline bool ensureParseMapPool();
-
     /*
      * The default script compilation version can be set iff there is no code running.
      * This typically occurs via the JSAPI right after a context is constructed.
      */
     inline bool canSetDefaultVersion() const;
 
     /* Force a version for future script compilation. */
     inline void overrideVersion(JSVersion newVersion);
@@ -1747,18 +1744,16 @@ struct JSContext : js::ContextFriendFiel
     void *onOutOfMemory(void *p, size_t nbytes) {
         return runtime->onOutOfMemory(p, nbytes, this);
     }
     void updateMallocCounter(size_t nbytes);
     void reportAllocationOverflow() {
         js_ReportAllocationOverflow(this);
     }
 
-    void purge();
-
     bool isExceptionPending() {
         return throwing;
     }
 
     js::Value getPendingException() {
         JS_ASSERT(throwing);
         return exception;
     }
@@ -1776,23 +1771,16 @@ struct JSContext : js::ContextFriendFiel
     /*
      * Controls whether a quadratic-complexity assertion is performed during
      * stack iteration; defaults to true.
      */
     bool stackIterAssertionEnabled;
 #endif
 
     /*
-     * Count of currently active compilations.
-     * When there are compilations active for the context, the GC must not
-     * purge the ParseMapPool.
-     */
-    unsigned activeCompilations;
-
-    /*
      * See JS_SetTrustedPrincipals in jsapi.h.
      * Note: !cx->compartment is treated as trusted.
      */
     bool runningWithTrustedPrincipals() const;
 
     JS_FRIEND_API(size_t) sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf) const;
 
     void mark(JSTracer *trc);
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -515,25 +515,16 @@ JSContext::typeLifoAlloc()
 inline void
 JSContext::setPendingException(js::Value v) {
     JS_ASSERT(!IsPoisonedValue(v));
     this->throwing = true;
     this->exception = v;
     js::assertSameCompartment(this, v);
 }
 
-inline bool
-JSContext::ensureParseMapPool()
-{
-    if (parseMapPool_)
-        return true;
-    parseMapPool_ = js_new<js::frontend::ParseMapPool>(this);
-    return parseMapPool_;
-}
-
 inline js::PropertyTree&
 JSContext::propertyTree()
 {
     return compartment->propertyTree;
 }
 
 inline void
 JSContext::setDefaultCompartmentObject(JSObject *obj)
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -19,17 +19,17 @@
 #include "jsgc.h"
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jsscript.h"
 #include "jsstr.h"
 #include "jswatchpoint.h"
 #include "jswrapper.h"
 
-#include "frontend/BytecodeEmitter.h"
+#include "frontend/SourceNotes.h"
 #include "vm/Debugger.h"
 #include "vm/Interpreter.h"
 #include "vm/Shape.h"
 
 #ifdef JS_ASMJS
 #include "ion/AsmJSModule.h"
 #endif
 
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -939,17 +939,17 @@ js_InitGC(JSRuntime *rt, uint32_t maxbyt
     rt->gcMaxBytes = maxbytes;
     rt->setGCMaxMallocBytes(maxbytes);
 
 #ifndef JS_MORE_DETERMINISTIC
     rt->gcJitReleaseTime = PRMJ_Now() + JIT_SCRIPT_RELEASE_TYPES_INTERVAL;
 #endif
 
 #ifdef JSGC_GENERATIONAL
-    if (!rt->gcNursery.enable())
+    if (!rt->gcNursery.init())
         return false;
 
     if (!rt->gcStoreBuffer.enable())
         return false;
 #endif
 
 #ifdef JS_GC_ZEAL
     if (!InitGCZeal(rt))
@@ -2572,18 +2572,18 @@ PurgeRuntime(JSRuntime *rt)
 
     rt->gsnCache.purge();
     rt->propertyCache.purge(rt);
     rt->newObjectCache.purge();
     rt->nativeIterCache.purge();
     rt->sourceDataCache.purge();
     rt->evalCache.clear();
 
-    for (ContextIter acx(rt); !acx.done(); acx.next())
-        acx->purge();
+    if (!rt->activeCompilations)
+        rt->parseMapPool.purgeAll();
 }
 
 static bool
 ShouldPreserveJITCode(JSCompartment *comp, int64_t currentTime)
 {
     if (comp->rt->gcShouldCleanUpEverything || !comp->zone()->types.inferenceEnabled)
         return false;
 
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -23,20 +23,22 @@
 #include "ion/BaselineJIT.h"
 #include "ion/Ion.h"
 #include "ion/IonCompartment.h"
 #endif
 #include "gc/Marking.h"
 #include "js/MemoryMetrics.h"
 #include "vm/Shape.h"
 
+#include "jsanalyzeinlines.h"
 #include "jsatominlines.h"
 #include "jsgcinlines.h"
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
+#include "jsopcodeinlines.h"
 #include "jsscriptinlines.h"
 
 #include "vm/Stack-inl.h"
 
 #ifdef __SUNPRO_CC
 #include <alloca.h>
 #endif
 
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -18,16 +18,17 @@
 
 #include "builtin/ParallelArray.h"
 #ifdef JS_ION
 #include "ion/IonFrames.h"
 #endif
 #include "js/RootingAPI.h"
 #include "vm/GlobalObject.h"
 
+#include "jsanalyzeinlines.h"
 #include "vm/Stack-inl.h"
 
 #ifndef jsinferinlines_h___
 #define jsinferinlines_h___
 
 inline bool
 js::TaggedProto::isObject() const
 {
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -32,24 +32,23 @@
 #include "jsutil.h"
 #include "jsapi.h"
 #include "jsatom.h"
 #include "jscntxt.h"
 #include "jsversion.h"
 #include "jsdtoa.h"
 #include "jsobj.h"
 #include "jsstr.h"
-
 #include "vm/GlobalObject.h"
 #include "vm/NumericConversions.h"
 #include "vm/StringBuffer.h"
 
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
-
+#include "jsstrinlines.h"
 #include "vm/NumberObject-inl.h"
 #include "vm/String-inl.h"
 
 using namespace js;
 using namespace js::types;
 
 using mozilla::PodCopy;
 using mozilla::RangedPtr;
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -45,18 +45,20 @@
 #include "jsatominlines.h"
 #include "jsboolinlines.h"
 #include "jscntxtinlines.h"
 #include "jscompartmentinlines.h"
 #include "jsobjinlines.h"
 #include "jsscriptinlines.h"
 #include "jstypedarrayinlines.h"
 
+#include "builtin/Iterator-inl.h"
 #include "vm/BooleanObject-inl.h"
 #include "vm/NumberObject-inl.h"
+#include "vm/RegExpStatics-inl.h"
 #include "vm/Shape-inl.h"
 #include "vm/StringObject-inl.h"
 
 using namespace js;
 using namespace js::gc;
 using namespace js::types;
 
 using js::frontend::IsIdentifier;
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -256,16 +256,18 @@ class SetIteratorObject;
 class StaticBlockObject;
 class StrictArgumentsObject;
 class StringObject;
 class RegExpObject;
 class WithObject;
 
 }  /* namespace js */
 
+#define JSSLOT_FREE(clasp)  JSCLASS_RESERVED_SLOTS(clasp)
+
 /*
  * The public interface for an object.
  *
  * Implementation of the underlying structure occurs in ObjectImpl, from which
  * this struct inherits.  This inheritance is currently public, but it will
  * eventually be made protected.  For full details, see vm/ObjectImpl.{h,cpp}.
  *
  * The JSFunction struct is an extension of this struct allocated from a larger
@@ -417,18 +419,26 @@ class JSObject : public js::ObjectImpl
     inline void prepareElementRangeForOverwrite(size_t start, size_t end);
 
     void rollbackProperties(JSContext *cx, uint32_t slotSpan);
 
     inline void nativeSetSlot(uint32_t slot, const js::Value &value);
     static inline void nativeSetSlotWithType(JSContext *cx, js::HandleObject, js::Shape *shape,
                                              const js::Value &value);
 
-    inline const js::Value &getReservedSlot(uint32_t index) const;
-    inline js::HeapSlot &getReservedSlotRef(uint32_t index);
+    inline const js::Value &getReservedSlot(uint32_t index) const {
+        JS_ASSERT(index < JSSLOT_FREE(getClass()));
+        return getSlot(index);
+    }
+
+    inline js::HeapSlot &getReservedSlotRef(uint32_t index) {
+        JS_ASSERT(index < JSSLOT_FREE(getClass()));
+        return getSlotRef(index);
+    }
+
     inline void initReservedSlot(uint32_t index, const js::Value &v);
     inline void setReservedSlot(uint32_t index, const js::Value &v);
 
     /*
      * Marks this object as having a singleton type, and leave the type lazy.
      * Constructs a new, unique shape for the object.
      */
     static inline bool setSingletonType(JSContext *cx, js::HandleObject obj);
@@ -1078,18 +1088,16 @@ operator!=(const JSObject &lhs, const JS
 }
 
 struct JSObject_Slots2 : JSObject { js::Value fslots[2]; };
 struct JSObject_Slots4 : JSObject { js::Value fslots[4]; };
 struct JSObject_Slots8 : JSObject { js::Value fslots[8]; };
 struct JSObject_Slots12 : JSObject { js::Value fslots[12]; };
 struct JSObject_Slots16 : JSObject { js::Value fslots[16]; };
 
-#define JSSLOT_FREE(clasp)  JSCLASS_RESERVED_SLOTS(clasp)
-
 class JSValueArray {
   public:
     jsval *array;
     size_t length;
 
     JSValueArray(jsval *v, size_t c) : array(v), length(c) {}
 };
 
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -18,17 +18,16 @@
 #include "jsobj.h"
 #include "jsprobes.h"
 #include "jspropertytree.h"
 #include "jsproxy.h"
 #include "jsstr.h"
 #include "jstypedarray.h"
 #include "jswrapper.h"
 
-#include "builtin/Iterator-inl.h"
 #include "gc/Barrier.h"
 #include "gc/Marking.h"
 #include "js/MemoryMetrics.h"
 #include "js/RootingAPI.h"
 #include "js/TemplateLib.h"
 #include "vm/BooleanObject.h"
 #include "vm/GlobalObject.h"
 #include "vm/Shape.h"
@@ -42,17 +41,16 @@
 #include "jsgcinlines.h"
 #include "jsinferinlines.h"
 #include "jsscriptinlines.h"
 
 #include "gc/Barrier-inl.h"
 
 #include "vm/ObjectImpl-inl.h"
 #include "vm/Shape-inl.h"
-#include "vm/RegExpStatics-inl.h"
 #include "vm/String-inl.h"
 
 /* static */ inline bool
 JSObject::enumerate(JSContext *cx, JS::HandleObject obj, JSIterateOp iterop,
                     JS::MutableHandleValue statep, JS::MutableHandleId idp)
 {
     JSNewEnumerateOp op = obj->getOps()->enumerate;
     return (op ? op : JS_EnumerateState)(cx, obj, iterop, statep, idp);
@@ -320,30 +318,16 @@ JSObject::canRemoveLastProperty()
 
 inline const js::HeapSlot *
 JSObject::getRawSlots()
 {
     JS_ASSERT(isGlobal());
     return slots;
 }
 
-inline const js::Value &
-JSObject::getReservedSlot(uint32_t index) const
-{
-    JS_ASSERT(index < JSSLOT_FREE(getClass()));
-    return getSlot(index);
-}
-
-inline js::HeapSlot &
-JSObject::getReservedSlotRef(uint32_t index)
-{
-    JS_ASSERT(index < JSSLOT_FREE(getClass()));
-    return getSlotRef(index);
-}
-
 inline void
 JSObject::setReservedSlot(uint32_t index, const js::Value &v)
 {
     JS_ASSERT(index < JSSLOT_FREE(getClass()));
     setSlot(index, v);
 }
 
 inline void
--- a/js/src/jsopcodeinlines.h
+++ b/js/src/jsopcodeinlines.h
@@ -4,17 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef jsopcodeinlines_h__
 #define jsopcodeinlines_h__
 
 #include "jsautooplen.h"
 
-#include "frontend/BytecodeEmitter.h"
+#include "frontend/SourceNotes.h"
 
 namespace js {
 
 static inline unsigned
 GetDefCount(JSScript *script, unsigned offset)
 {
     JS_ASSERT(offset < script->length);
     jsbytecode *pc = script->code + offset;
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -51,36 +51,31 @@ typedef struct JSTryNote            JSTr
 /* Friend "Advanced API" typedefs. */
 typedef struct JSAtomState          JSAtomState;
 typedef struct JSCodeSpec           JSCodeSpec;
 typedef struct JSPrinter            JSPrinter;
 typedef struct JSStackHeader        JSStackHeader;
 typedef struct JSSubString          JSSubString;
 typedef struct JSSpecializedNative  JSSpecializedNative;
 
-/*
- * Template declarations.
- *
- * jsprvtd.h can be included in both C and C++ translation units. For C++, it
- * may possibly be wrapped in an extern "C" block which does not agree with
- * templates.
- */
+/* String typedefs. */
 class JSDependentString;
 class JSExtensibleString;
 class JSExternalString;
 class JSLinearString;
 class JSRope;
 class JSAtom;
 class JSWrapper;
 
 namespace js {
 
 struct ArgumentsData;
 struct Class;
 
+class AutoNameVector;
 class RegExpGuard;
 class RegExpObject;
 class RegExpObjectBuilder;
 class RegExpShared;
 class RegExpStatics;
 class MatchPairs;
 class PropertyName;
 class LazyScript;
@@ -104,16 +99,17 @@ class StringBuffer;
 class FrameRegs;
 class StackFrame;
 class StackSegment;
 class StackSpace;
 class ContextStack;
 class ScriptFrameIter;
 
 class Proxy;
+class JS_FRIEND_API(AutoEnterPolicy);
 class JS_FRIEND_API(BaseProxyHandler);
 class JS_FRIEND_API(Wrapper);
 class JS_FRIEND_API(CrossCompartmentWrapper);
 
 class TempAllocPolicy;
 class RuntimeAllocPolicy;
 
 class GlobalObject;
@@ -140,16 +136,18 @@ class WatchpointMap;
  */
 typedef JSObject Env;
 
 typedef JSNative             Native;
 typedef JSPropertyOp         PropertyOp;
 typedef JSStrictPropertyOp   StrictPropertyOp;
 typedef JSPropertyDescriptor PropertyDescriptor;
 
+struct SourceCompressionToken;
+
 namespace frontend {
 
 struct BytecodeEmitter;
 struct Definition;
 class FunctionBox;
 class ObjectBox;
 struct Token;
 struct TokenPos;
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -3067,18 +3067,16 @@ reflect_parse(JSContext *cx, uint32_t ar
 
     const StableCharPtr chars = stable->chars();
     size_t length = stable->length();
     CompileOptions options(cx);
     options.setFileAndLine(filename, lineno);
     options.setCanLazilyParse(false);
     Parser<FullParseHandler> parser(cx, options, chars.get(), length,
                                     /* foldConstants = */ false, NULL, NULL);
-    if (!parser.init())
-        return JS_FALSE;
 
     serialize.setParser(&parser);
 
     ParseNode *pn = parser.parse(NULL);
     if (!pn)
         return JS_FALSE;
 
     RootedValue val(cx);
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -891,16 +891,26 @@ JSScript::destroyScriptCounts(FreeOp *fo
 {
     if (hasScriptCounts) {
         ScriptCounts scriptCounts = releaseScriptCounts();
         scriptCounts.destroy(fop);
     }
 }
 
 void
+ScriptSourceObject::setSource(ScriptSource *source)
+{
+    if (source)
+        source->incref();
+    if (this->source())
+        this->source()->decref();
+    setReservedSlot(SOURCE_SLOT, PrivateValue(source));
+}
+
+void
 ScriptSourceObject::finalize(FreeOp *fop, JSObject *obj)
 {
     // ScriptSource::setSource automatically takes care of the refcount
     obj->asScriptSource().setSource(NULL);
 }
 
 Class js::ScriptSourceClass = {
     "ScriptSource",
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -1097,23 +1097,17 @@ class ScriptSourceObject : public JSObje
   public:
     static void finalize(FreeOp *fop, JSObject *obj);
     static ScriptSourceObject *create(JSContext *cx, ScriptSource *source);
 
     ScriptSource *source() {
         return static_cast<ScriptSource *>(getReservedSlot(SOURCE_SLOT).toPrivate());
     }
 
-    void setSource(ScriptSource *source) {
-        if (source)
-            source->incref();
-        if (this->source())
-            this->source()->decref();
-        setReservedSlot(SOURCE_SLOT, PrivateValue(source));
-    }
+    void setSource(ScriptSource *source);
 
   private:
     static const uint32_t SOURCE_SLOT = 0;
 };
 
 // Information about a script which may be (or has been) lazily compiled to
 // bytecode from its source.
 class LazyScript : public js::gc::Cell
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3173,18 +3173,16 @@ Parse(JSContext *cx, unsigned argc, jsva
     JSString *scriptContents = args[0].toString();
     CompileOptions options(cx);
     options.setFileAndLine("<string>", 1)
            .setCompileAndGo(false);
     Parser<FullParseHandler> parser(cx, options,
                                     JS_GetStringCharsZ(cx, scriptContents),
                                     JS_GetStringLength(scriptContents),
                                     /* foldConstants = */ true, NULL, NULL);
-    if (!parser.init())
-        return false;
 
     ParseNode *pn = parser.parse(NULL);
     if (!pn)
         return false;
 #ifdef DEBUG
     DumpParseTree(pn);
     fputc('\n', stderr);
 #endif
@@ -3213,18 +3211,16 @@ SyntaxParse(JSContext *cx, unsigned argc
     JSString *scriptContents = args[0].toString();
     CompileOptions options(cx);
     options.setFileAndLine("<string>", 1)
            .setCompileAndGo(false);
 
     const jschar *chars = JS_GetStringCharsZ(cx, scriptContents);
     size_t length = JS_GetStringLength(scriptContents);
     Parser<frontend::SyntaxParseHandler> parser(cx, options, chars, length, false, NULL, NULL);
-    if (!parser.init())
-        return false;
 
     bool succeeded = parser.parse(NULL);
     if (cx->isExceptionPending())
         return false;
 
     if (!succeeded && !parser.hadAbortedSyntaxParse()) {
         // If no exception is posted, either there was an OOM or a language
         // feature unhandled by the syntax parser was encountered.
deleted file mode 100644
--- a/js/src/tests/most.tests
+++ /dev/null
@@ -1,892 +0,0 @@
-# Created Wed Nov 17 00:42:42 GMT-0500 (EST) 1999
-# ecma: 591/592 (99%) selected
-# ecma_2: 173/173 (100%) selected
-# js1_1: 2/2 (100%) selected
-# js1_2: 83/83 (100%) selected
-# js1_3: 27/27 (100%) selected
-# js1_4: 11/11 (100%) selected
-# TOTAL: 887/1133 (78%) selected
-ecma/Array/15.4-1.js
-ecma/Array/15.4-2.js
-ecma/Array/15.4.1.1.js
-ecma/Array/15.4.1.2.js
-ecma/Array/15.4.1.3.js
-ecma/Array/15.4.1.js
-ecma/Array/15.4.2.1-1.js
-ecma/Array/15.4.2.2-1.js
-ecma/Array/15.4.2.2-2.js
-ecma/Array/15.4.2.3.js
-ecma/Array/15.4.3.1-2.js
-ecma/Array/15.4.3.2.js
-ecma/extensions/15.4.3.js
-ecma/Array/15.4.4.1.js
-ecma/Array/15.4.4.2.js
-ecma/Array/15.4.4.3-1.js
-ecma/Array/15.4.4.4-1.js
-ecma/Array/15.4.4.4-2.js
-ecma/Array/15.4.4.5-1.js
-ecma/Array/15.4.4.5-2.js
-ecma/Array/15.4.4.5-3.js
-ecma/Array/15.4.4.js
-ecma/Array/15.4.5.1-1.js
-ecma/Array/15.4.5.1-2.js
-ecma/Array/15.4.5.2-1.js
-ecma/Array/15.4.5.2-2.js
-ecma/Boolean/15.6.1.js
-ecma/Boolean/15.6.2.js
-ecma/Boolean/15.6.3.1-1.js
-ecma/Boolean/15.6.3.1-2.js
-ecma/Boolean/15.6.3.1-3.js
-ecma/Boolean/15.6.3.1-4.js
-ecma/extensions/15.6.3.1-5.js
-ecma/Boolean/15.6.3.1.js
-ecma/extensions/15.6.3.js
-ecma/Boolean/15.6.4-1.js
-ecma/Boolean/15.6.4-2.js
-ecma/Boolean/15.6.4.1.js
-ecma/Boolean/15.6.4.2-1.js
-ecma/Boolean/15.6.4.2-2.js
-ecma/Boolean/15.6.4.2-3.js
-ecma/Boolean/15.6.4.2-4-n.js
-ecma/Boolean/15.6.4.3-1.js
-ecma/Boolean/15.6.4.3-2.js
-ecma/Boolean/15.6.4.3-3.js
-ecma/Boolean/15.6.4.3-4-n.js
-ecma/Boolean/15.6.4.3.js
-ecma/Boolean/15.6.4.js
-ecma/Date/15.9.1.1-1.js
-ecma/Date/15.9.1.1-2.js
-ecma/Date/15.9.2.1.js
-ecma/Date/15.9.2.2-1.js
-ecma/Date/15.9.2.2-2.js
-ecma/Date/15.9.2.2-3.js
-ecma/Date/15.9.2.2-4.js
-ecma/Date/15.9.2.2-5.js
-ecma/Date/15.9.2.2-6.js
-ecma/Date/15.9.3.1-1.js
-ecma/Date/15.9.3.1-2.js
-ecma/Date/15.9.3.1-3.js
-ecma/Date/15.9.3.1-4.js
-ecma/Date/15.9.3.1-5.js
-ecma/Date/15.9.3.2-1.js
-ecma/Date/15.9.3.2-2.js
-ecma/Date/15.9.3.2-3.js
-ecma/Date/15.9.3.2-4.js
-ecma/Date/15.9.3.2-5.js
-ecma/Date/15.9.3.8-1.js
-ecma/Date/15.9.3.8-2.js
-ecma/Date/15.9.3.8-3.js
-ecma/Date/15.9.3.8-4.js
-ecma/Date/15.9.3.8-5.js
-ecma/Date/15.9.4.2-1.js
-ecma/Date/15.9.4.2.js
-ecma/Date/15.9.4.3.js
-ecma/Date/15.9.5.1.js
-ecma/Date/15.9.5.10-1.js
-ecma/Date/15.9.5.10-10.js
-ecma/Date/15.9.5.10-11.js
-ecma/Date/15.9.5.10-12.js
-ecma/Date/15.9.5.10-13.js
-ecma/Date/15.9.5.10-3.js
-ecma/Date/15.9.5.10-4.js
-ecma/Date/15.9.5.10-5.js
-ecma/Date/15.9.5.10-6.js
-ecma/Date/15.9.5.10-7.js
-ecma/Date/15.9.5.10-8.js
-ecma/Date/15.9.5.10-9.js
-ecma/Date/15.9.5.11-1.js
-ecma/Date/15.9.5.11-2.js
-ecma/Date/15.9.5.11-3.js
-ecma/Date/15.9.5.11-4.js
-ecma/Date/15.9.5.11-5.js
-ecma/Date/15.9.5.11-6.js
-ecma/Date/15.9.5.11-7.js
-ecma/Date/15.9.5.12-1.js
-ecma/Date/15.9.5.12-2.js
-ecma/Date/15.9.5.12-3.js
-ecma/Date/15.9.5.12-4.js
-ecma/Date/15.9.5.12-5.js
-ecma/Date/15.9.5.12-6.js
-ecma/Date/15.9.5.12-7.js
-ecma/Date/15.9.5.12-8.js
-ecma/Date/15.9.5.13-1.js
-ecma/Date/15.9.5.13-2.js
-ecma/Date/15.9.5.13-3.js
-ecma/Date/15.9.5.13-4.js
-ecma/Date/15.9.5.13-5.js
-ecma/Date/15.9.5.13-6.js
-ecma/Date/15.9.5.13-7.js
-ecma/Date/15.9.5.13-8.js
-ecma/Date/15.9.5.14.js
-ecma/Date/15.9.5.15.js
-ecma/Date/15.9.5.16.js
-ecma/Date/15.9.5.17.js
-ecma/Date/15.9.5.18.js
-ecma/Date/15.9.5.19.js
-ecma/Date/15.9.5.2-1.js
-ecma/Date/15.9.5.2-2-n.js
-ecma/Date/15.9.5.2.js
-ecma/Date/15.9.5.20.js
-ecma/Date/15.9.5.21-1.js
-ecma/Date/15.9.5.21-2.js
-ecma/Date/15.9.5.21-3.js
-ecma/Date/15.9.5.21-4.js
-ecma/Date/15.9.5.21-5.js
-ecma/Date/15.9.5.21-6.js
-ecma/Date/15.9.5.21-7.js
-ecma/Date/15.9.5.21-8.js
-ecma/Date/15.9.5.22-1.js
-ecma/Date/15.9.5.22-2.js
-ecma/Date/15.9.5.22-3.js
-ecma/Date/15.9.5.22-4.js
-ecma/Date/15.9.5.22-5.js
-ecma/Date/15.9.5.22-6.js
-ecma/Date/15.9.5.22-7.js
-ecma/Date/15.9.5.22-8.js
-ecma/Date/15.9.5.23-1.js
-ecma/Date/15.9.5.23-10.js
-ecma/Date/15.9.5.23-11.js
-ecma/Date/15.9.5.23-12.js
-ecma/Date/15.9.5.23-13.js
-ecma/Date/15.9.5.23-14.js
-ecma/Date/15.9.5.23-15.js
-ecma/Date/15.9.5.23-16.js
-ecma/Date/15.9.5.23-17.js
-ecma/Date/15.9.5.23-18.js
-ecma/Date/15.9.5.23-2.js
-ecma/Date/15.9.5.23-3-n.js
-ecma/Date/15.9.5.23-4.js
-ecma/Date/15.9.5.23-5.js
-ecma/Date/15.9.5.23-6.js
-ecma/Date/15.9.5.23-7.js
-ecma/Date/15.9.5.23-8.js
-ecma/Date/15.9.5.23-9.js
-ecma/Date/15.9.5.24-1.js
-ecma/Date/15.9.5.24-2.js
-ecma/Date/15.9.5.24-3.js
-ecma/Date/15.9.5.24-4.js
-ecma/Date/15.9.5.24-5.js
-ecma/Date/15.9.5.24-6.js
-ecma/Date/15.9.5.24-7.js
-ecma/Date/15.9.5.24-8.js
-ecma/Date/15.9.5.25-1.js
-ecma/Date/15.9.5.26-1.js
-ecma/Date/15.9.5.27-1.js
-ecma/Date/15.9.5.28-1.js
-ecma/Date/15.9.5.29-1.js
-ecma/Date/15.9.5.3-1-n.js
-ecma/Date/15.9.5.3-2.js
-ecma/Date/15.9.5.30-1.js
-ecma/Date/15.9.5.31-1.js
-ecma/Date/15.9.5.32-1.js
-ecma/Date/15.9.5.33-1.js
-ecma/Date/15.9.5.34-1.js
-ecma/Date/15.9.5.35-1.js
-ecma/Date/15.9.5.36-1.js
-ecma/Date/15.9.5.36-2.js
-ecma/Date/15.9.5.36-3.js
-ecma/Date/15.9.5.36-4.js
-ecma/Date/15.9.5.36-5.js
-ecma/Date/15.9.5.36-6.js
-ecma/Date/15.9.5.36-7.js
-ecma/Date/15.9.5.37-1.js
-ecma/Date/15.9.5.37-2.js
-ecma/Date/15.9.5.37-3.js
-ecma/Date/15.9.5.37-4.js
-ecma/Date/15.9.5.37-5.js
-ecma/Date/15.9.5.4-1.js
-ecma/Date/15.9.5.4-2-n.js
-ecma/Date/15.9.5.5.js
-ecma/Date/15.9.5.6.js
-ecma/Date/15.9.5.7.js
-ecma/Date/15.9.5.8.js
-ecma/Date/15.9.5.9.js
-ecma/Date/15.9.5.js
-ecma/ExecutionContexts/10.1.3-1.js
-ecma/ExecutionContexts/10.1.3.js
-ecma/ExecutionContexts/10.1.4-1.js
-ecma/ExecutionContexts/10.1.4-10.js
-ecma/ExecutionContexts/10.1.4-2.js
-ecma/ExecutionContexts/10.1.4-3.js
-ecma/ExecutionContexts/10.1.4-4.js
-ecma/ExecutionContexts/10.1.4-5.js
-ecma/ExecutionContexts/10.1.4-6.js
-ecma/ExecutionContexts/10.1.4-7.js
-ecma/ExecutionContexts/10.1.4-8.js
-ecma/extensions/10.1.4-9.js
-ecma/ExecutionContexts/10.1.5-1.js
-ecma/ExecutionContexts/10.1.5-2.js
-ecma/ExecutionContexts/10.1.5-3.js
-ecma/ExecutionContexts/10.1.5-4.js
-ecma/extensions/10.1.6.js
-ecma/extensions/10.1.8-1.js
-ecma/ExecutionContexts/10.1.8-2.js
-ecma/ExecutionContexts/10.2.1.js
-ecma/ExecutionContexts/10.2.2-1.js
-ecma/ExecutionContexts/10.2.2-2.js
-ecma/ExecutionContexts/10.2.3-1.js
-ecma/ExecutionContexts/10.2.3-2.js
-ecma/Expressions/11.1.1.js
-ecma/Expressions/11.10-1.js
-ecma/Expressions/11.10-2.js
-ecma/Expressions/11.10-3.js
-ecma/Expressions/11.12-1.js
-ecma/Expressions/11.12-2-n.js
-ecma/Expressions/11.12-3.js
-ecma/Expressions/11.12-4.js
-ecma/Expressions/11.13.1.js
-ecma/Expressions/11.13.2-1.js
-ecma/Expressions/11.13.2-2.js
-ecma/Expressions/11.13.2-3.js
-ecma/Expressions/11.13.2-4.js
-ecma/Expressions/11.13.2-5.js
-ecma/Expressions/11.13.js
-ecma/Expressions/11.14-1.js
-ecma/Expressions/11.2.1-1.js
-ecma/Expressions/11.2.1-2.js
-ecma/Expressions/11.2.1-3-n.js
-ecma/Expressions/11.2.1-4-n.js
-ecma/Expressions/11.2.1-5.js
-ecma/Expressions/11.2.2-1-n.js
-ecma/Expressions/11.2.2-1.js
-ecma/Expressions/11.2.2-10-n.js
-ecma/Expressions/11.2.2-11.js
-ecma/Expressions/11.2.2-2-n.js
-ecma/Expressions/11.2.2-3-n.js
-ecma/Expressions/11.2.2-4-n.js
-ecma/Expressions/11.2.2-5-n.js
-ecma/Expressions/11.2.2-6-n.js
-ecma/Expressions/11.2.2-7-n.js
-ecma/Expressions/11.2.2-8-n.js
-ecma/Expressions/11.2.2-9-n.js
-ecma/Expressions/11.2.3-1.js
-ecma/Expressions/11.2.3-2-n.js
-ecma/Expressions/11.2.3-3-n.js
-ecma/Expressions/11.2.3-4-n.js
-ecma/Expressions/11.2.3-5.js
-ecma/Expressions/11.3.1.js
-ecma/Expressions/11.3.2.js
-ecma/Expressions/11.4.1-n.js
-ecma/Expressions/11.4.1.js
-ecma/Expressions/11.4.2.js
-ecma/Expressions/11.4.3.js
-ecma/Expressions/11.4.4.js
-ecma/Expressions/11.4.5.js
-ecma/Expressions/11.4.6.js
-ecma/Expressions/11.4.8.js
-ecma/Expressions/11.4.9.js
-ecma/Expressions/11.5.1.js
-ecma/Expressions/11.5.2.js
-ecma/Expressions/11.5.3.js
-ecma/Expressions/11.6.1-1.js
-ecma/Expressions/11.6.1-2.js
-ecma/Expressions/11.6.1-3.js
-ecma/Expressions/11.6.2-1.js
-ecma/Expressions/11.6.3.js
-ecma/Expressions/11.7.1.js
-ecma/Expressions/11.7.2.js
-ecma/Expressions/11.7.3.js
-ecma/Expressions/11.8.1.js
-ecma/Expressions/11.8.2.js
-ecma/Expressions/11.8.3.js
-ecma/Expressions/11.8.4.js
-ecma/Expressions/11.9.1.js
-ecma/Expressions/11.9.2.js
-ecma/Expressions/11.9.3.js
-ecma/FunctionObjects/15.3.1.1-1.js
-ecma/FunctionObjects/15.3.1.1-2.js
-ecma/FunctionObjects/15.3.1.1-3.js
-ecma/FunctionObjects/15.3.2.1-1.js
-ecma/FunctionObjects/15.3.2.1-2.js
-ecma/FunctionObjects/15.3.2.1-3.js
-ecma/FunctionObjects/15.3.3.1-1.js
-ecma/FunctionObjects/15.3.3.1-2.js
-ecma/FunctionObjects/15.3.3.1-3.js
-ecma/FunctionObjects/15.3.3.1-4.js
-ecma/FunctionObjects/15.3.3.2.js
-ecma/FunctionObjects/15.3.4-1.js
-ecma/FunctionObjects/15.3.4.1.js
-ecma/FunctionObjects/15.3.4.js
-ecma/FunctionObjects/15.3.5-1.js
-ecma/FunctionObjects/15.3.5-2.js
-ecma/FunctionObjects/15.3.5.1.js
-ecma/FunctionObjects/15.3.5.3.js
-ecma/GlobalObject/15.1-1-n.js
-ecma/GlobalObject/15.1-2-n.js
-ecma/GlobalObject/15.1.1.1.js
-ecma/GlobalObject/15.1.1.2.js
-ecma/extensions/15.1.2.1-1.js
-ecma/GlobalObject/15.1.2.1-2.js
-ecma/GlobalObject/15.1.2.2-1.js
-ecma/GlobalObject/15.1.2.2-2.js
-ecma/GlobalObject/15.1.2.3-1.js
-ecma/GlobalObject/15.1.2.3-2.js
-ecma/GlobalObject/15.1.2.4.js
-ecma/GlobalObject/15.1.2.5-1.js
-ecma/GlobalObject/15.1.2.5-2.js
-ecma/GlobalObject/15.1.2.5-3.js
-ecma/GlobalObject/15.1.2.6.js
-ecma/GlobalObject/15.1.2.7.js
-ecma/LexicalConventions/7.1-1.js
-ecma/LexicalConventions/7.1-2.js
-ecma/LexicalConventions/7.1-3.js
-ecma/LexicalConventions/7.2-1.js
-ecma/LexicalConventions/7.2-2-n.js
-ecma/LexicalConventions/7.2-3-n.js
-ecma/LexicalConventions/7.2-4-n.js
-ecma/LexicalConventions/7.2-5-n.js
-ecma/LexicalConventions/7.2-6.js
-ecma/LexicalConventions/7.3-1.js
-ecma/LexicalConventions/7.3-10.js
-ecma/LexicalConventions/7.3-11.js
-ecma/LexicalConventions/7.3-12.js
-ecma/LexicalConventions/7.3-13-n.js
-ecma/LexicalConventions/7.3-2.js
-ecma/LexicalConventions/7.3-3.js
-ecma/LexicalConventions/7.3-4.js
-ecma/LexicalConventions/7.3-5.js
-ecma/LexicalConventions/7.3-6.js
-ecma/LexicalConventions/7.3-7.js
-ecma/LexicalConventions/7.3-8.js
-ecma/LexicalConventions/7.3-9.js
-ecma/LexicalConventions/7.4.1-1-n.js
-ecma/LexicalConventions/7.4.1-2-n.js
-ecma/LexicalConventions/7.4.1-3-n.js
-ecma/LexicalConventions/7.4.2-1-n.js
-ecma/LexicalConventions/7.4.2-10-n.js
-ecma/LexicalConventions/7.4.2-11-n.js
-ecma/LexicalConventions/7.4.2-12-n.js
-ecma/LexicalConventions/7.4.2-13-n.js
-ecma/LexicalConventions/7.4.2-14-n.js
-ecma/LexicalConventions/7.4.2-15-n.js
-ecma/LexicalConventions/7.4.2-16-n.js
-ecma/LexicalConventions/7.4.2-2-n.js
-ecma/LexicalConventions/7.4.2-3-n.js
-ecma/LexicalConventions/7.4.2-4-n.js
-ecma/LexicalConventions/7.4.2-5-n.js
-ecma/LexicalConventions/7.4.2-6-n.js
-ecma/LexicalConventions/7.4.2-7-n.js
-ecma/LexicalConventions/7.4.2-8-n.js
-ecma/LexicalConventions/7.4.2-9-n.js
-ecma/LexicalConventions/7.4.3-1-n.js
-ecma/LexicalConventions/7.4.3-10-n.js
-ecma/LexicalConventions/7.4.3-11-n.js
-ecma/LexicalConventions/7.4.3-12-n.js
-ecma/LexicalConventions/7.4.3-13-n.js
-ecma/LexicalConventions/7.4.3-14-n.js
-ecma/LexicalConventions/7.4.3-15-n.js
-ecma/LexicalConventions/7.4.3-16-n.js
-ecma/LexicalConventions/7.4.3-2-n.js
-ecma/LexicalConventions/7.4.3-3-n.js
-ecma/LexicalConventions/7.4.3-4-n.js
-ecma/LexicalConventions/7.4.3-5-n.js
-ecma/LexicalConventions/7.4.3-6-n.js
-ecma/LexicalConventions/7.4.3-7-n.js
-ecma/LexicalConventions/7.4.3-8-n.js
-ecma/LexicalConventions/7.4.3-9-n.js
-ecma/LexicalConventions/7.5-1.js
-ecma/LexicalConventions/7.5-10-n.js
-ecma/LexicalConventions/7.5-2-n.js
-ecma/LexicalConventions/7.5-3-n.js
-ecma/LexicalConventions/7.5-4-n.js
-ecma/LexicalConventions/7.5-5-n.js
-ecma/LexicalConventions/7.5-6.js
-ecma/LexicalConventions/7.5-7.js
-ecma/LexicalConventions/7.5-8-n.js
-ecma/LexicalConventions/7.5-9-n.js
-ecma/LexicalConventions/7.6.js
-ecma/LexicalConventions/7.7.1.js
-ecma/LexicalConventions/7.7.2.js
-ecma/LexicalConventions/7.7.3-1.js
-ecma/LexicalConventions/7.7.3-2.js
-ecma/LexicalConventions/7.7.3-3-n.js
-ecma/LexicalConventions/7.7.3-4-n.js
-ecma/LexicalConventions/7.7.3.js
-ecma/LexicalConventions/7.7.4.js
-ecma/LexicalConventions/7.8.2-n.js
-ecma/extensions/15.8-1.js
-ecma/Math/15.8-2-n.js
-ecma/Math/15.8-3-n.js
-ecma/Math/15.8.1.1-1.js
-ecma/Math/15.8.1.1-2.js
-ecma/Math/15.8.1.2-1.js
-ecma/Math/15.8.1.2-2.js
-ecma/Math/15.8.1.3-1.js
-ecma/Math/15.8.1.3-2.js
-ecma/Math/15.8.1.4-1.js
-ecma/Math/15.8.1.4-2.js
-ecma/Math/15.8.1.5-1.js
-ecma/Math/15.8.1.5-2.js
-ecma/Math/15.8.1.6-1.js
-ecma/Math/15.8.1.6-2.js
-ecma/Math/15.8.1.7-1.js
-ecma/Math/15.8.1.7-2.js
-ecma/Math/15.8.1.8-1.js
-ecma/Math/15.8.1.8-2.js
-ecma/Math/15.8.1.8-3.js
-ecma/Math/15.8.1.js
-ecma/Math/15.8.2.1.js
-ecma/Math/15.8.2.10.js
-ecma/Math/15.8.2.11.js
-ecma/Math/15.8.2.12.js
-ecma/Math/15.8.2.13.js
-ecma/Math/15.8.2.14.js
-ecma/Math/15.8.2.15.js
-ecma/Math/15.8.2.16.js
-ecma/Math/15.8.2.17.js
-ecma/Math/15.8.2.18.js
-ecma/Math/15.8.2.2.js
-ecma/Math/15.8.2.3.js
-ecma/Math/15.8.2.4.js
-ecma/Math/15.8.2.5.js
-ecma/Math/15.8.2.6.js
-ecma/Math/15.8.2.7.js
-ecma/Math/15.8.2.8.js
-ecma/Math/15.8.2.9.js
-ecma/extensions/15-1.js
-ecma/extensions/15-2.js
-ecma/Number/15.7.1.js
-ecma/Number/15.7.2.js
-ecma/Number/15.7.3.1-1.js
-ecma/Number/15.7.3.1-2.js
-ecma/Number/15.7.3.1-3.js
-ecma/Number/15.7.3.2-1.js
-ecma/Number/15.7.3.2-2.js
-ecma/Number/15.7.3.2-3.js
-ecma/Number/15.7.3.2-4.js
-ecma/Number/15.7.3.3-1.js
-ecma/Number/15.7.3.3-2.js
-ecma/Number/15.7.3.3-3.js
-ecma/Number/15.7.3.3-4.js
-ecma/Number/15.7.3.4-1.js
-ecma/Number/15.7.3.4-2.js
-ecma/Number/15.7.3.4-3.js
-ecma/Number/15.7.3.4-4.js
-ecma/Number/15.7.3.5-1.js
-ecma/Number/15.7.3.5-2.js
-ecma/Number/15.7.3.5-3.js
-ecma/Number/15.7.3.5-4.js
-ecma/Number/15.7.3.6-1.js
-ecma/Number/15.7.3.6-2.js
-ecma/Number/15.7.3.6-3.js
-ecma/Number/15.7.3.6-4.js
-ecma/Number/15.7.3.js
-ecma/Number/15.7.4-1.js
-ecma/Number/15.7.4.1.js
-ecma/Number/15.7.4.2-1.js
-ecma/Number/15.7.4.2-2-n.js
-ecma/Number/15.7.4.2-3-n.js
-ecma/Number/15.7.4.2-4.js
-ecma/Number/15.7.4.3-1.js
-ecma/Number/15.7.4.3-2.js
-ecma/Number/15.7.4.3-3-n.js
-ecma/extensions/15.7.4.js
-ecma/ObjectObjects/15.2.1.1.js
-ecma/ObjectObjects/15.2.1.2.js
-ecma/ObjectObjects/15.2.2.1.js
-ecma/ObjectObjects/15.2.2.2.js
-ecma/ObjectObjects/15.2.3-1.js
-ecma/ObjectObjects/15.2.3.1-1.js
-ecma/ObjectObjects/15.2.3.1-2.js
-ecma/ObjectObjects/15.2.3.1-3.js
-ecma/ObjectObjects/15.2.3.1-4.js
-ecma/ObjectObjects/15.2.3.js
-ecma/ObjectObjects/15.2.4.1.js
-ecma/ObjectObjects/15.2.4.2.js
-ecma/ObjectObjects/15.2.4.3.js
-ecma/extensions/15.2.4.js
-ecma/SourceText/6-1.js
-ecma/SourceText/6-2.js
-ecma/Statements/12.10-1.js
-ecma/Statements/12.10.js
-ecma/Statements/12.2-1.js
-ecma/Statements/12.5-1.js
-ecma/Statements/12.5-2.js
-ecma/Statements/12.6.1-1.js
-ecma/Statements/12.6.2-1.js
-ecma/Statements/12.6.2-2.js
-ecma/Statements/12.6.2-3.js
-ecma/Statements/12.6.2-4.js
-ecma/Statements/12.6.2-5.js
-ecma/Statements/12.6.2-6.js
-ecma/Statements/12.6.2-7.js
-ecma/Statements/12.6.2-8.js
-ecma/Statements/12.6.2-9-n.js
-ecma/Statements/12.6.3-1.js
-ecma/Statements/12.6.3-10.js
-ecma/Statements/12.6.3-11.js
-ecma/Statements/12.6.3-12.js
-ecma/Statements/12.6.3-19.js
-ecma/Statements/12.6.3-2.js
-ecma/Statements/12.6.3-3.js
-ecma/Statements/12.6.3-4.js
-ecma/Statements/12.6.3-5-n.js
-ecma/Statements/12.6.3-6-n.js
-ecma/Statements/12.6.3-7-n.js
-ecma/Statements/12.6.3-8-n.js
-ecma/Statements/12.6.3-9-n.js
-ecma/Statements/12.7-1-n.js
-ecma/Statements/12.8-1-n.js
-ecma/Statements/12.9-1-n.js
-ecma/String/15.5.1.js
-ecma/String/15.5.2.js
-ecma/String/15.5.3.1-1.js
-ecma/String/15.5.3.1-2.js
-ecma/String/15.5.3.1-3.js
-ecma/String/15.5.3.1-4.js
-ecma/String/15.5.3.2-1.js
-ecma/String/15.5.3.2-2.js
-ecma/String/15.5.3.2-3.js
-ecma/String/15.5.3.js
-ecma/String/15.5.4.1.js
-ecma/String/15.5.4.10-1.js
-ecma/String/15.5.4.11-1.js
-ecma/String/15.5.4.11-2.js
-ecma/String/15.5.4.11-3.js
-ecma/String/15.5.4.11-4.js
-ecma/String/15.5.4.11-5.js
-ecma/String/15.5.4.11-6.js
-ecma/String/15.5.4.12-1.js
-ecma/String/15.5.4.12-2.js
-ecma/String/15.5.4.12-3.js
-ecma/String/15.5.4.12-4.js
-ecma/String/15.5.4.12-5.js
-ecma/String/15.5.4.2-1.js
-ecma/String/15.5.4.2-2-n.js
-ecma/String/15.5.4.2-3.js
-ecma/String/15.5.4.2.js
-ecma/String/15.5.4.3-1.js
-ecma/String/15.5.4.3-2.js
-ecma/String/15.5.4.3-3-n.js
-ecma/String/15.5.4.4-1.js
-ecma/String/15.5.4.4-2.js
-ecma/String/15.5.4.4-3.js
-ecma/String/15.5.4.4-4.js
-ecma/String/15.5.4.5-1.js
-ecma/String/15.5.4.5-2.js
-ecma/String/15.5.4.5-3.js
-ecma/String/15.5.4.5-4.js
-ecma/String/15.5.4.5-5.js
-ecma/extensions/15.5.4.5-6.js
-ecma/String/15.5.4.6-1.js
-ecma/String/15.5.4.6-2.js
-ecma/String/15.5.4.7-1.js
-ecma/String/15.5.4.7-2.js
-ecma/extensions/15.5.4.7-3.js
-ecma/String/15.5.4.8-1.js
-ecma/String/15.5.4.8-2.js
-ecma/String/15.5.4.8-3.js
-ecma/String/15.5.4.9-1.js
-ecma/String/15.5.4.js
-ecma/String/15.5.5.1.js
-ecma/TypeConversion/9.2.js
-ecma/TypeConversion/9.3-1.js
-ecma/TypeConversion/9.3.1-1.js
-ecma/TypeConversion/9.3.1-2.js
-ecma/TypeConversion/9.3.1-3.js
-ecma/TypeConversion/9.3.js
-ecma/TypeConversion/9.4-1.js
-ecma/TypeConversion/9.4-2.js
-ecma/TypeConversion/9.5-2.js
-ecma/TypeConversion/9.6.js
-ecma/TypeConversion/9.7.js
-ecma/TypeConversion/9.8.1.js
-ecma/TypeConversion/9.9-1.js
-ecma/Types/8.1.js
-ecma/Types/8.4.js
-ecma/Types/8.6.2.1-1.js
-ecma_2/Exceptions/boolean-001.js
-ecma_2/Exceptions/boolean-002.js
-ecma_2/Exceptions/date-001.js
-ecma_2/Exceptions/date-002.js
-ecma_2/Exceptions/date-003.js
-ecma_2/Exceptions/date-004.js
-ecma_2/Exceptions/exception-001.js
-ecma_2/Exceptions/exception-002.js
-ecma_2/Exceptions/exception-003.js
-ecma_2/Exceptions/exception-004.js
-ecma_2/Exceptions/exception-005.js
-ecma_2/Exceptions/exception-006.js
-ecma_2/Exceptions/exception-007.js
-ecma_2/Exceptions/exception-008.js
-ecma_2/Exceptions/exception-009.js
-ecma_2/Exceptions/expression-001.js
-ecma_2/Exceptions/expression-002.js
-ecma_2/Exceptions/expression-003.js
-ecma_2/Exceptions/expression-004.js
-ecma_2/Exceptions/expression-005.js
-ecma_2/Exceptions/expression-006.js
-ecma_2/Exceptions/expression-007.js
-ecma_2/Exceptions/expression-008.js
-ecma_2/Exceptions/expression-009.js
-ecma_2/Exceptions/expression-010.js
-ecma_2/Exceptions/expression-011.js
-ecma_2/Exceptions/expression-012.js
-ecma_2/Exceptions/expression-013.js
-ecma_2/Exceptions/expression-014.js
-ecma_2/Exceptions/expression-015.js
-ecma_2/Exceptions/expression-016.js
-ecma_2/Exceptions/expression-017.js
-ecma_2/Exceptions/expression-019.js
-ecma_2/Exceptions/expression-020.js
-ecma_2/Exceptions/function-001.js
-ecma_2/Exceptions/global-001.js
-ecma_2/Exceptions/global-002.js
-ecma_2/Exceptions/lexical-001.js
-ecma_2/Exceptions/lexical-002.js
-ecma_2/Exceptions/lexical-003.js
-ecma_2/Exceptions/lexical-004.js
-ecma_2/Exceptions/lexical-005.js
-ecma_2/Exceptions/lexical-006.js
-ecma_2/Exceptions/lexical-007.js
-ecma_2/Exceptions/lexical-008.js
-ecma_2/Exceptions/lexical-009.js
-ecma_2/Exceptions/lexical-010.js
-ecma_2/Exceptions/lexical-011.js
-ecma_2/Exceptions/lexical-012.js
-ecma_2/Exceptions/lexical-013.js
-ecma_2/Exceptions/lexical-014.js
-ecma_2/Exceptions/lexical-015.js
-ecma_2/Exceptions/lexical-016.js
-ecma_2/Exceptions/lexical-017.js
-ecma_2/Exceptions/lexical-018.js
-ecma_2/Exceptions/lexical-019.js
-ecma_2/Exceptions/lexical-020.js
-ecma_2/Exceptions/lexical-021.js
-ecma_2/Exceptions/lexical-022.js
-ecma_2/Exceptions/lexical-023.js
-ecma_2/Exceptions/lexical-024.js
-ecma_2/Exceptions/lexical-025.js
-ecma_2/Exceptions/lexical-026.js
-ecma_2/Exceptions/lexical-027.js
-ecma_2/Exceptions/lexical-028.js
-ecma_2/Exceptions/lexical-029.js
-ecma_2/Exceptions/lexical-030.js
-ecma_2/Exceptions/lexical-031.js
-ecma_2/Exceptions/lexical-032.js
-ecma_2/Exceptions/lexical-033.js
-ecma_2/Exceptions/lexical-034.js
-ecma_2/Exceptions/lexical-035.js
-ecma_2/Exceptions/lexical-036.js
-ecma_2/Exceptions/lexical-037.js
-ecma_2/Exceptions/lexical-038.js
-ecma_2/Exceptions/lexical-039.js
-ecma_2/Exceptions/lexical-040.js
-ecma_2/Exceptions/lexical-041.js
-ecma_2/Exceptions/lexical-042.js
-ecma_2/Exceptions/lexical-043.js
-ecma_2/Exceptions/lexical-044.js
-ecma_2/Exceptions/lexical-045.js
-ecma_2/Exceptions/lexical-046.js
-ecma_2/Exceptions/lexical-047.js
-ecma_2/Exceptions/lexical-048.js
-ecma_2/Exceptions/lexical-049.js
-ecma_2/Exceptions/lexical-050.js
-ecma_2/Exceptions/lexical-051.js
-ecma_2/Exceptions/lexical-052.js
-ecma_2/Exceptions/lexical-053.js
-ecma_2/Exceptions/lexical-054.js
-ecma_2/Exceptions/number-001.js
-ecma_2/Exceptions/number-002.js
-ecma_2/Exceptions/number-003.js
-ecma_2/Exceptions/statement-001.js
-ecma_2/Exceptions/statement-002.js
-ecma_2/Exceptions/statement-003.js
-ecma_2/Exceptions/statement-004.js
-ecma_2/Exceptions/statement-005.js
-ecma_2/Exceptions/statement-006.js
-ecma_2/Exceptions/statement-007.js
-ecma_2/Exceptions/statement-008.js
-ecma_2/Exceptions/statement-009.js
-ecma_2/Exceptions/string-001.js
-ecma_2/Exceptions/string-002.js
-ecma_2/Expressions/StrictEquality-001.js
-ecma_2/extensions/instanceof-001.js
-ecma_2/extensions/instanceof-002.js
-ecma_2/extensions/instanceof-003-n.js
-ecma_2/extensions/instanceof-004-n.js
-ecma_2/extensions/instanceof-005-n.js
-ecma_2/extensions/instanceof-006.js
-ecma_2/FunctionObjects/call-1.js
-ecma_2/LexicalConventions/keywords-001.js
-ecma_2/LexicalConventions/regexp-literals-001.js
-ecma_2/LexicalConventions/regexp-literals-002.js
-ecma_2/RegExp/constructor-001.js
-ecma_2/RegExp/exec-001.js
-ecma_2/RegExp/exec-002.js
-ecma_2/RegExp/function-001.js
-ecma_2/RegExp/hex-001.js
-ecma_2/RegExp/multiline-001.js
-ecma_2/RegExp/octal-001.js
-ecma_2/RegExp/octal-002.js
-ecma_2/RegExp/octal-003.js
-ecma_2/RegExp/properties-001.js
-ecma_2/RegExp/properties-002.js
-ecma_2/RegExp/regexp-enumerate-001.js
-ecma_2/RegExp/regress-001.js
-ecma_2/RegExp/unicode-001.js
-ecma_2/Statements/dowhile-001.js
-ecma_2/Statements/dowhile-002.js
-ecma_2/Statements/dowhile-003.js
-ecma_2/Statements/dowhile-004.js
-ecma_2/Statements/dowhile-005.js
-ecma_2/Statements/dowhile-006.js
-ecma_2/Statements/dowhile-007.js
-ecma_2/Statements/forin-001.js
-ecma_2/Statements/forin-002.js
-ecma_2/Statements/if-001.js
-ecma_2/Statements/label-001.js
-ecma_2/Statements/label-002.js
-ecma_2/Statements/switch-001.js
-ecma_2/Statements/switch-002.js
-ecma_2/Statements/switch-003.js
-ecma_2/Statements/switch-004.js
-ecma_2/Statements/try-001.js
-ecma_2/Statements/try-003.js
-ecma_2/Statements/try-004.js
-ecma_2/Statements/try-005.js
-ecma_2/Statements/try-006.js
-ecma_2/Statements/try-007.js
-ecma_2/Statements/try-008.js
-ecma_2/Statements/try-009.js
-ecma_2/Statements/try-010.js
-ecma_2/Statements/try-012.js
-ecma_2/Statements/while-001.js
-ecma_2/Statements/while-002.js
-ecma_2/Statements/while-003.js
-ecma_2/Statements/while-004.js
-ecma_2/String/match-001.js
-ecma_2/String/match-002.js
-ecma_2/String/match-003.js
-ecma_2/String/match-004.js
-ecma_2/String/replace-001.js
-ecma_2/String/split-001.js
-ecma_2/String/split-002.js
-ecma_2/String/split-003.js
-ecma_2/instanceof/instanceof-001.js
-ecma_2/instanceof/instanceof-002.js
-ecma_2/instanceof/instanceof-003.js
-ecma_2/instanceof/regress-7635.js
-js1_1/Boolean/boolean-001.js
-js1_1/regress/function-001.js
-js1_2/Array/array_split_1.js
-js1_2/Array/general1.js
-js1_2/Array/general2.js
-js1_2/Array/slice.js
-js1_2/Array/splice1.js
-js1_2/Array/splice2.js
-js1_2/Array/tostring_1.js
-js1_2/Array/tostring_2.js
-js1_2/Objects/toString-001.js
-js1_2/String/charCodeAt.js
-js1_2/String/concat.js
-js1_2/String/match.js
-js1_2/String/slice.js
-js1_2/function/Function_object.js
-js1_2/function/Number.js
-js1_2/function/String.js
-js1_2/function/definition-1.js
-js1_2/function/function-001-n.js
-js1_2/function/length.js
-js1_2/function/nesting-1.js
-js1_2/function/nesting.js
-js1_2/function/regexparg-1.js
-js1_2/function/regexparg-2-n.js
-js1_2/function/tostring-1.js
-js1_2/function/tostring-2.js
-js1_2/operator/equality.js
-js1_2/operator/strictEquality.js
-js1_2/regexp/RegExp_dollar_number.js
-js1_2/regexp/RegExp_input.js
-js1_2/regexp/RegExp_input_as_array.js
-js1_2/regexp/RegExp_lastIndex.js
-js1_2/regexp/RegExp_lastMatch.js
-js1_2/regexp/RegExp_lastMatch_as_array.js
-js1_2/regexp/RegExp_lastParen.js
-js1_2/regexp/RegExp_lastParen_as_array.js
-js1_2/regexp/RegExp_leftContext.js
-js1_2/regexp/RegExp_leftContext_as_array.js
-js1_2/regexp/RegExp_multiline.js
-js1_2/regexp/RegExp_multiline_as_array.js
-js1_2/regexp/RegExp_object.js
-js1_2/regexp/RegExp_rightContext.js
-js1_2/regexp/RegExp_rightContext_as_array.js
-js1_2/regexp/alphanumeric.js
-js1_2/regexp/asterisk.js
-js1_2/regexp/backslash.js
-js1_2/regexp/backspace.js
-js1_2/regexp/beginLine.js
-js1_2/regexp/character_class.js
-js1_2/regexp/compile.js
-js1_2/regexp/control_characters.js
-js1_2/regexp/digit.js
-js1_2/regexp/dot.js
-js1_2/regexp/endLine.js
-js1_2/regexp/everything.js
-js1_2/regexp/exec.js
-js1_2/regexp/flags.js
-js1_2/regexp/global.js
-js1_2/regexp/hexadecimal.js
-js1_2/regexp/ignoreCase.js
-js1_2/regexp/interval.js
-js1_2/regexp/octal.js
-js1_2/regexp/parentheses.js
-js1_2/regexp/plus.js
-js1_2/regexp/question_mark.js
-js1_2/regexp/regress-6359.js
-js1_2/regexp/regress-9141.js
-js1_2/regexp/simple_form.js
-js1_2/regexp/source.js
-js1_2/regexp/special_characters.js
-js1_2/regexp/string_replace.js
-js1_2/regexp/string_search.js
-js1_2/regexp/string_split.js
-js1_2/regexp/test.js
-js1_2/regexp/toString.js
-js1_2/regexp/vertical_bar.js
-js1_2/regexp/whitespace.js
-js1_2/regexp/word_boundary.js
-js1_2/regress/regress-7703.js
-js1_2/statements/break.js
-js1_2/statements/continue.js
-js1_2/statements/do_while.js
-js1_2/statements/switch.js
-js1_2/statements/switch2.js
-js1_3/Boolean/boolean-001.js
-js1_3/Script/delete-001.js
-js1_3/Script/function-001-n.js
-js1_3/Script/function-002.js
-js1_3/Script/in-001.js
-js1_3/Script/new-001.js
-js1_3/extensions/script-001.js
-js1_3/Script/switch-001.js
-js1_3/inherit/proto_1.js
-js1_3/inherit/proto_10.js
-js1_3/inherit/proto_11.js
-js1_3/inherit/proto_12.js
-js1_3/extensions/proto_2.js
-js1_3/inherit/proto_3.js
-js1_3/inherit/proto_4.js
-js1_3/extensions/proto_5.js
-js1_3/inherit/proto_6.js
-js1_3/inherit/proto_7.js
-js1_3/inherit/proto_8.js
-js1_3/inherit/proto_9.js
-js1_3/misc/eval-001-n.js
-js1_3/regress/delete-001.js
-js1_3/regress/function-001-n.js
-js1_3/regress/function-002.js
-js1_3/regress/in-001.js
-js1_3/regress/new-001.js
-js1_3/regress/switch-001.js
-js1_4/Eval/eval-001.js
-js1_4/Eval/eval-002.js
-js1_4/Eval/eval-003.js
-js1_4/Functions/function-001.js
-js1_4/Regress/date-001-n.js
-js1_4/Regress/function-001.js
-js1_4/Regress/function-002.js
-js1_4/Regress/function-003.js
-js1_4/Regress/function-004-n.js
-js1_4/Regress/regress-7224.js
-js1_4/Regress/toString-001-n.js
deleted file mode 100644
--- a/js/src/tests/narcissus-failures.txt
+++ /dev/null
@@ -1,1137 +0,0 @@
-ecma/Array/15.4.4.3-1.js
-ecma/Boolean/15.6.4.1.js
-ecma/Boolean/15.6.4.2-4-n.js
-ecma/Boolean/15.6.4.3-4-n.js
-ecma/Date/15.9.5.1.js
-ecma/Date/15.9.5.10-2.js
-ecma/Date/15.9.5.11-2.js
-ecma/Date/15.9.5.12-2.js
-ecma/Date/15.9.5.2-2-n.js
-ecma/Date/15.9.5.23-3-n.js
-ecma/Date/15.9.5.3-1-n.js
-ecma/Date/15.9.5.4-2-n.js
-ecma/Date/15.9.5.8.js
-ecma/ExecutionContexts/10.2.2-1.js
-ecma/ExecutionContexts/10.2.2-2.js
-ecma/Expressions/11.12-2-n.js
-ecma/Expressions/11.2.1-1.js
-ecma/Expressions/11.2.1-3-n.js
-ecma/Expressions/11.2.1-4-n.js
-ecma/Expressions/11.2.2-1-n.js
-ecma/Expressions/11.2.2-10-n.js
-ecma/Expressions/11.2.2-2-n.js
-ecma/Expressions/11.2.2-3-n.js
-ecma/Expressions/11.2.2-4-n.js
-ecma/Expressions/11.2.2-5-n.js
-ecma/Expressions/11.2.2-6-n.js
-ecma/Expressions/11.2.2-7-n.js
-ecma/Expressions/11.2.2-8-n.js
-ecma/Expressions/11.2.2-9-n.js
-ecma/Expressions/11.2.3-2-n.js
-ecma/Expressions/11.2.3-3-n.js
-ecma/Expressions/11.2.3-4-n.js
-ecma/Expressions/11.3.1.js
-ecma/Expressions/11.3.2.js
-ecma/Expressions/11.4.4.js
-ecma/Expressions/11.4.5.js
-ecma/Expressions/11.4.6.js
-ecma/Expressions/11.4.7-01.js
-ecma/Expressions/11.4.7-02.js
-ecma/FunctionObjects/15.3.1.1-1.js
-ecma/FunctionObjects/15.3.1.1-2.js
-ecma/FunctionObjects/15.3.1.1-3.js
-ecma/FunctionObjects/15.3.2.1-1.js
-ecma/FunctionObjects/15.3.2.1-2.js
-ecma/FunctionObjects/15.3.2.1-3.js
-ecma/FunctionObjects/15.3.3.1-4.js
-ecma/FunctionObjects/15.3.4-1.js
-ecma/FunctionObjects/15.3.4.js
-ecma/FunctionObjects/15.3.5-1.js
-ecma/FunctionObjects/15.3.5-2.js
-ecma/FunctionObjects/15.3.5.3.js
-ecma/GlobalObject/15.1-1-n.js
-ecma/GlobalObject/15.1-2-n.js
-ecma/GlobalObject/15.1.2.3-1.js
-ecma/GlobalObject/15.1.2.3-2.js
-ecma/LexicalConventions/7.1-1.js
-ecma/LexicalConventions/7.1-2.js
-ecma/LexicalConventions/7.1-3.js
-ecma/LexicalConventions/7.2-1.js
-ecma/LexicalConventions/7.2-2-n.js
-ecma/LexicalConventions/7.2-3-n.js
-ecma/LexicalConventions/7.2-4-n.js
-ecma/LexicalConventions/7.2-5-n.js
-ecma/LexicalConventions/7.3-13-n.js
-ecma/LexicalConventions/7.4.1-1-n.js
-ecma/LexicalConventions/7.4.1-2-n.js
-ecma/LexicalConventions/7.4.1-3-n.js
-ecma/LexicalConventions/7.4.2-1-n.js
-ecma/LexicalConventions/7.4.2-10-n.js
-ecma/LexicalConventions/7.4.2-11-n.js
-ecma/LexicalConventions/7.4.2-12-n.js
-ecma/LexicalConventions/7.4.2-13-n.js
-ecma/LexicalConventions/7.4.2-14-n.js
-ecma/LexicalConventions/7.4.2-15-n.js
-ecma/LexicalConventions/7.4.2-16-n.js
-ecma/LexicalConventions/7.4.2-2-n.js
-ecma/LexicalConventions/7.4.2-3-n.js
-ecma/LexicalConventions/7.4.2-4-n.js
-ecma/LexicalConventions/7.4.2-5-n.js
-ecma/LexicalConventions/7.4.2-6-n.js
-ecma/LexicalConventions/7.4.2-7-n.js
-ecma/LexicalConventions/7.4.2-8-n.js
-ecma/LexicalConventions/7.4.2-9-n.js
-ecma/LexicalConventions/7.4.3-1-n.js
-ecma/LexicalConventions/7.4.3-10-n.js
-ecma/LexicalConventions/7.4.3-11-n.js
-ecma/LexicalConventions/7.4.3-12-n.js
-ecma/LexicalConventions/7.4.3-13-n.js
-ecma/LexicalConventions/7.4.3-14-n.js
-ecma/LexicalConventions/7.4.3-15-n.js
-ecma/LexicalConventions/7.4.3-16-n.js
-ecma/LexicalConventions/7.4.3-2-n.js
-ecma/LexicalConventions/7.4.3-4-n.js
-ecma/LexicalConventions/7.4.3-5-n.js
-ecma/LexicalConventions/7.4.3-6-n.js
-ecma/LexicalConventions/7.4.3-7-n.js
-ecma/LexicalConventions/7.4.3-8-n.js
-ecma/LexicalConventions/7.4.3-9-n.js
-ecma/LexicalConventions/7.5-10-n.js
-ecma/LexicalConventions/7.5-2-n.js
-ecma/LexicalConventions/7.5-3-n.js
-ecma/LexicalConventions/7.5-4-n.js
-ecma/LexicalConventions/7.5-5-n.js
-ecma/LexicalConventions/7.5-8-n.js
-ecma/LexicalConventions/7.5-9-n.js
-ecma/LexicalConventions/7.7.3-2.js
-ecma/LexicalConventions/7.7.3.js
-ecma/LexicalConventions/7.8.2-n.js
-ecma/Math/15.8-2-n.js
-ecma/Math/15.8-3-n.js
-ecma/Math/15.8.1.3-1.js
-ecma/Math/15.8.1.3-2.js
-ecma/Math/15.8.1.5-1.js
-ecma/Math/15.8.1.5-2.js
-ecma/Math/15.8.1.7-1.js
-ecma/Math/15.8.1.7-2.js
-ecma/Math/15.8.1.js
-ecma/Math/15.8.2.1.js
-ecma/Math/15.8.2.11.js
-ecma/Math/15.8.2.13.js
-ecma/Math/15.8.2.15.js
-ecma/Math/15.8.2.16.js
-ecma/Math/15.8.2.17.js
-ecma/Math/15.8.2.2.js
-ecma/Math/15.8.2.6.js
-ecma/Math/15.8.2.7.js
-ecma/Math/15.8.2.9.js
-ecma/Number/0x-without-following-hexdigits.js
-ecma/Number/15.7.4-1.js
-ecma/Number/15.7.4.1.js
-ecma/Number/15.7.4.2-2-n.js
-ecma/Number/15.7.4.2-3-n.js
-ecma/Number/15.7.4.3-3-n.js
-ecma/ObjectObjects/15.2.4.1.js
-ecma/ObjectObjects/15.2.4.2.js
-ecma/Statements/12.6.2-9-n.js
-ecma/Statements/12.6.3-5-n.js
-ecma/Statements/12.6.3-6-n.js
-ecma/Statements/12.6.3-7-n.js
-ecma/Statements/12.6.3-8-n.js
-ecma/Statements/12.6.3-9-n.js
-ecma/Statements/12.7-1-n.js
-ecma/Statements/12.8-1-n.js
-ecma/Statements/12.9-1-n.js
-ecma/String/15.5.1.js
-ecma/String/15.5.2.js
-ecma/String/15.5.4.1.js
-ecma/String/15.5.4.2-1.js
-ecma/String/15.5.4.2-2-n.js
-ecma/String/15.5.4.2.js
-ecma/String/15.5.4.3-1.js
-ecma/String/15.5.4.3-3-n.js
-ecma/String/15.5.4.8-1.js
-ecma/String/15.5.4.js
-ecma/String/15.5.5.1.js
-ecma/TypeConversion/9.3.1-1.js
-ecma/TypeConversion/9.3.1-3.js
-ecma/TypeConversion/9.4-1.js
-ecma/TypeConversion/9.4-2.js
-ecma/TypeConversion/9.5-2.js
-ecma/TypeConversion/9.6.js
-ecma/TypeConversion/9.8.1.js
-ecma/extensions/15-1.js
-ecma/extensions/15-2.js
-ecma/extensions/15.2.3-1.js
-ecma/extensions/15.3.1.1-2.js
-ecma/extensions/15.3.2.1-2.js
-ecma/extensions/15.3.3.1-1.js
-ecma/extensions/15.4.3.js
-ecma/extensions/15.5.3.js
-ecma/extensions/15.5.4.2.js
-ecma/extensions/15.6.3.1-5.js
-ecma/extensions/15.6.3.js
-ecma/extensions/15.7.3.js
-ecma/extensions/9.9-1.js
-ecma/extensions/trapflatclosure.js
-ecma_2/Exceptions/boolean-001.js
-ecma_2/Exceptions/boolean-002.js
-ecma_2/Exceptions/date-001.js
-ecma_2/Exceptions/date-002.js
-ecma_2/Exceptions/date-003.js
-ecma_2/Exceptions/date-004.js
-ecma_2/Exceptions/exception-001.js
-ecma_2/Exceptions/exception-002.js
-ecma_2/Exceptions/exception-003.js
-ecma_2/Exceptions/exception-004.js
-ecma_2/Exceptions/exception-005.js
-ecma_2/Exceptions/exception-006.js
-ecma_2/Exceptions/exception-007.js
-ecma_2/Exceptions/exception-010-n.js
-ecma_2/Exceptions/exception-011-n.js
-ecma_2/Exceptions/expression-002.js
-ecma_2/Exceptions/expression-003.js
-ecma_2/Exceptions/expression-004.js
-ecma_2/Exceptions/expression-005.js
-ecma_2/Exceptions/expression-006.js
-ecma_2/Exceptions/expression-007.js
-ecma_2/Exceptions/expression-008.js
-ecma_2/Exceptions/expression-009.js
-ecma_2/Exceptions/expression-010.js
-ecma_2/Exceptions/expression-011.js
-ecma_2/Exceptions/expression-012.js
-ecma_2/Exceptions/expression-013.js
-ecma_2/Exceptions/expression-014.js
-ecma_2/Exceptions/expression-016.js
-ecma_2/Exceptions/expression-017.js
-ecma_2/Exceptions/expression-019.js
-ecma_2/Exceptions/global-001.js
-ecma_2/Exceptions/global-002.js
-ecma_2/Exceptions/lexical-001.js
-ecma_2/Exceptions/lexical-002.js
-ecma_2/Exceptions/lexical-011.js
-ecma_2/Exceptions/lexical-014.js
-ecma_2/Exceptions/lexical-015.js
-ecma_2/Exceptions/lexical-016.js
-ecma_2/Exceptions/lexical-021.js
-ecma_2/Exceptions/lexical-023.js
-ecma_2/Exceptions/lexical-033.js
-ecma_2/Exceptions/lexical-047.js
-ecma_2/Exceptions/lexical-048.js
-ecma_2/Exceptions/lexical-049.js
-ecma_2/Exceptions/lexical-051.js
-ecma_2/Exceptions/number-001.js
-ecma_2/Exceptions/number-002.js
-ecma_2/Exceptions/number-003.js
-ecma_2/Exceptions/statement-001.js
-ecma_2/Exceptions/statement-003.js
-ecma_2/Exceptions/statement-004.js
-ecma_2/Exceptions/statement-005.js
-ecma_2/Exceptions/statement-006.js
-ecma_2/Exceptions/string-001.js
-ecma_2/Exceptions/string-002.js
-ecma_2/FunctionObjects/apply-001-n.js
-ecma_2/LexicalConventions/keywords-001.js
-ecma_2/LexicalConventions/regexp-literals-002.js
-ecma_2/Statements/forin-002.js
-ecma_2/String/split-001.js
-ecma_2/String/split-003.js
-ecma_2/extensions/instanceof-001.js
-ecma_2/extensions/instanceof-002.js
-ecma_2/extensions/instanceof-003-n.js
-ecma_2/extensions/instanceof-004-n.js
-ecma_2/extensions/instanceof-005-n.js
-ecma_2/extensions/instanceof-006.js
-ecma_2/instanceof/instanceof-001.js
-ecma_2/instanceof/instanceof-002.js
-ecma_2/instanceof/instanceof-003.js
-ecma_3/Array/15.4.5.1-01.js
-ecma_3/Array/15.5.4.8-01.js
-ecma_3/Array/regress-322135-01.js
-ecma_3/Array/regress-387501.js
-ecma_3/Array/regress-421325.js
-ecma_3/Array/regress-430717.js
-ecma_3/Date/15.9.5.4.js
-ecma_3/Date/regress-452786.js
-ecma_3/Exceptions/binding-001.js
-ecma_3/Exceptions/regress-181914.js
-ecma_3/Exceptions/regress-95101.js
-ecma_3/ExecutionContexts/10.1.3-1.js
-ecma_3/ExecutionContexts/10.1.3-2.js
-ecma_3/FunExpr/fe-001-n.js
-ecma_3/Function/arguments-001.js
-ecma_3/Function/regress-131964.js
-ecma_3/Function/regress-313570.js
-ecma_3/Function/regress-58274.js
-ecma_3/Function/regress-85880.js
-ecma_3/Function/regress-94506.js
-ecma_3/Function/scope-001.js
-ecma_3/Function/scope-002.js
-ecma_3/LexicalConventions/7.4-01.js
-ecma_3/LexicalConventions/7.8.3-01.js
-ecma_3/LexicalConventions/7.9.1.js
-ecma_3/Number/15.7.4.5-1.js
-ecma_3/Number/15.7.4.5-2.js
-ecma_3/Object/8.6.1-01.js
-ecma_3/Object/8.6.2.6-001.js
-ecma_3/Object/class-001.js
-ecma_3/Object/class-003.js
-ecma_3/Object/class-005.js
-ecma_3/Object/regress-385393-07.js
-ecma_3/Operators/11.13.1-001.js
-ecma_3/RegExp/15.10.4.1-5-n.js
-ecma_3/RegExp/15.10.4.1-6.js
-ecma_3/RegExp/regress-188206.js
-ecma_3/RegExp/regress-223273.js
-ecma_3/RegExp/regress-375715-01-n.js
-ecma_3/RegExp/regress-375715-04.js
-ecma_3/RegExp/regress-57631.js
-ecma_3/Regress/regress-385393-04.js
-ecma_3/Regress/regress-580544.js
-ecma_3/Statements/regress-157509.js
-ecma_3/Statements/regress-302439.js
-ecma_3/String/regress-304376.js
-ecma_3/String/regress-313567.js
-ecma_3/Unicode/regress-352044-01.js
-ecma_3/Unicode/regress-352044-02-n.js
-ecma_3/Unicode/uc-001-n.js
-ecma_3/Unicode/uc-002-n.js
-ecma_3/Unicode/uc-002.js
-ecma_3/Unicode/uc-003.js
-ecma_3/Unicode/uc-005.js
-ecma_3/extensions/10.1.3-2.js
-ecma_3/extensions/7.9.1.js
-ecma_3/extensions/regress-188206-01.js
-ecma_3/extensions/regress-274152.js
-ecma_3/extensions/regress-368516.js
-ecma_3/extensions/regress-385393-03.js
-ecma_3/extensions/regress-429248.js
-ecma_3_1/Object/regress-444787.js
-ecma_5/Array/toString-01.js
-ecma_5/Date/toJSON-01.js
-ecma_5/Expressions/11.1.5-01.js
-ecma_5/Expressions/named-accessor-function.js
-ecma_5/Expressions/object-literal-accessor-arguments.js
-ecma_5/Function/15.3.4.3-01.js
-ecma_5/Function/arguments-caller-callee.js
-ecma_5/Function/arguments-property-attributes.js
-ecma_5/Function/function-bind.js
-ecma_5/Function/function-caller.js
-ecma_5/Function/strict-arguments.js
-ecma_5/JSON/cyclic-stringify.js
-ecma_5/JSON/small-codepoints.js
-ecma_5/Object/15.2.3.3-01.js
-ecma_5/Object/15.2.3.4-03.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-1-of-8.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-2-of-8.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-3-of-8.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-4-of-8.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-5-of-8.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-6-of-8.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-7-of-8.js
-ecma_5/Object/15.2.3.6-dictionary-redefinition-8-of-8.js
-ecma_5/Object/15.2.3.6-function-length.js
-ecma_5/Object/15.2.3.6-middle-redefinition-1-of-8.js
-ecma_5/Object/15.2.3.6-middle-redefinition-2-of-8.js
-ecma_5/Object/15.2.3.6-middle-redefinition-3-of-8.js
-ecma_5/Object/15.2.3.6-middle-redefinition-4-of-8.js
-ecma_5/Object/15.2.3.6-middle-redefinition-5-of-8.js
-ecma_5/Object/15.2.3.6-middle-redefinition-6-of-8.js
-ecma_5/Object/15.2.3.6-middle-redefinition-7-of-8.js
-ecma_5/Object/15.2.3.6-middle-redefinition-8-of-8.js
-ecma_5/Object/15.2.3.6-new-definition.js
-ecma_5/Object/15.2.3.6-redefinition-1-of-4.js
-ecma_5/Object/15.2.3.6-redefinition-2-of-4.js
-ecma_5/Object/15.2.3.6-redefinition-3-of-4.js
-ecma_5/Object/15.2.3.6-redefinition-4-of-4.js
-ecma_5/Object/15.2.3.7-01.js
-ecma_5/Object/extensibility-01.js
-ecma_5/Object/vacuous-accessor-unqualified-name.js
-ecma_5/RegExp/15.10.7.5-01.js
-ecma_5/Types/8.12.5-01.js
-ecma_5/extensions/8.12.5-01.js
-ecma_5/extensions/string-literal-getter-setter-decompilation.js
-ecma_5/extensions/15.4.4.11.js
-ecma_5/misc/enumerate-undefined.js
-ecma_5/misc/global-numeric-properties.js
-ecma_5/strict/10.4.2.js
-ecma_5/strict/11.1.5.js
-ecma_5/strict/11.13.1.js
-ecma_5/strict/11.13.2.js
-ecma_5/strict/11.3.1.js
-ecma_5/strict/11.3.2.js
-ecma_5/strict/11.4.1.js
-ecma_5/strict/11.4.4.js
-ecma_5/strict/11.4.5.js
-ecma_5/strict/12.10.1.js
-ecma_5/strict/12.14.1.js
-ecma_5/strict/12.2.1.js
-ecma_5/strict/13.1.js
-ecma_5/strict/8.7.2.js
-ecma_5/strict/B.1.1.js
-ecma_5/strict/B.1.2.js
-ecma_5/strict/regress-532254.js
-ecma_5/strict/8.12.5.js
-ecma_5/strict/8.12.7.js
-ecma_5/strict/10.6.js
-ecma_5/strict/15.3.5.1.js
-ecma_5/strict/15.3.5.2.js
-ecma_5/strict/15.4.4.9.js
-ecma_5/strict/15.4.4.6.js
-ecma_5/strict/15.4.4.8.js
-ecma_5/strict/15.4.4.12.js
-ecma_5/strict/15.4.5.1.js
-ecma_5/strict/15.4.4.13.js
-ecma_5/strict/15.5.5.1.js
-ecma_5/strict/15.5.5.2.js
-ecma_5/strict/15.10.7.js
-ecma_5/strict/function-name-arity.js
-js1_2/regexp/RegExp_multiline.js
-js1_2/regexp/RegExp_multiline_as_array.js
-js1_2/regexp/alphanumeric.js
-js1_2/regexp/digit.js
-js1_2/regexp/whitespace.js
-js1_2/regexp/word_boundary.js
-js1_2/regress/regress-144834.js
-js1_3/inherit/proto_10.js
-js1_3/inherit/proto_12.js
-js1_3/inherit/proto_9.js
-js1_4/Functions/function-001.js
-js1_4/Regress/date-001-n.js
-js1_4/Regress/function-004-n.js
-js1_4/Regress/toString-001-n.js
-js1_5/Array/array-001.js
-js1_5/Array/regress-154338.js
-js1_5/Array/regress-157652.js
-js1_5/Array/regress-178722.js
-js1_5/Array/regress-313153.js
-js1_5/Array/regress-330812.js
-js1_5/Array/regress-350256-02.js
-js1_5/Array/regress-350256-03.js
-js1_5/Array/regress-451483.js
-js1_5/Array/regress-465980-01.js
-js1_5/Array/regress-474529.js
-js1_5/Error/regress-354246.js
-js1_5/Error/regress-465377.js
-js1_5/Exceptions/catchguard-002-n.js
-js1_5/Exceptions/catchguard-003-n.js
-js1_5/Exceptions/errstack-001.js
-js1_5/Exceptions/regress-121658.js
-js1_5/Exceptions/regress-232182.js
-js1_5/Exceptions/regress-257751.js
-js1_5/Exceptions/regress-273931.js
-js1_5/Exceptions/regress-315147.js
-js1_5/Exceptions/regress-332472.js
-js1_5/Exceptions/regress-333728.js
-js1_5/Exceptions/regress-342359.js
-js1_5/Exceptions/regress-347674.js
-js1_5/Exceptions/regress-350650-n.js
-js1_5/Exceptions/regress-350837.js
-js1_5/Expressions/regress-394673.js
-js1_5/Function/10.1.6-01.js
-js1_5/Function/10.1.6.js
-js1_5/Function/regress-222029-001.js
-js1_5/Function/regress-222029-002.js
-js1_5/Function/regress-338001.js
-js1_5/Function/regress-338121-01.js
-js1_5/Function/regress-338121-02.js
-js1_5/Function/regress-338121-03.js
-js1_5/GC/regress-203278-2.js
-js1_5/GC/regress-348532.js
-js1_5/LexicalConventions/lexical-001.js
-js1_5/LexicalConventions/regress-343675.js
-js1_5/Regress/regress-103602.js
-js1_5/Regress/regress-104077.js
-js1_5/Regress/regress-114493.js
-js1_5/Regress/regress-116228.js
-js1_5/Regress/regress-118849.js
-js1_5/Regress/regress-127557.js
-js1_5/Regress/regress-131510-001.js
-js1_5/Regress/regress-139316.js
-js1_5/Regress/regress-167328.js
-js1_5/Regress/regress-172699.js
-js1_5/Regress/regress-179524.js
-js1_5/Regress/regress-214761.js
-js1_5/Regress/regress-224956.js
-js1_5/Regress/regress-234389.js
-js1_5/Regress/regress-243389-n.js
-js1_5/Regress/regress-244470.js
-js1_5/Regress/regress-245113.js
-js1_5/Regress/regress-252892.js
-js1_5/Regress/regress-253150.js
-js1_5/Regress/regress-256617.js
-js1_5/Regress/regress-281606.js
-js1_5/Regress/regress-290575.js
-js1_5/Regress/regress-294302.js
-js1_5/Regress/regress-303213.js
-js1_5/Regress/regress-306633.js
-js1_5/Regress/regress-306794.js
-js1_5/Regress/regress-308566.js
-js1_5/Regress/regress-309242.js
-js1_5/Regress/regress-310993.js
-js1_5/Regress/regress-311071.js
-js1_5/Regress/regress-312260.js
-js1_5/Regress/regress-31255.js
-js1_5/Regress/regress-312588.js
-js1_5/Regress/regress-315990.js
-js1_5/Regress/regress-317533.js
-js1_5/Regress/regress-319391.js
-js1_5/Regress/regress-321757.js
-js1_5/Regress/regress-323314-1.js
-js1_5/Regress/regress-328664.js
-js1_5/Regress/regress-329383.js
-js1_5/Regress/regress-329530.js
-js1_5/Regress/regress-334807-01.js
-js1_5/Regress/regress-334807-02.js
-js1_5/Regress/regress-334807-03.js
-js1_5/Regress/regress-334807-04.js
-js1_5/Regress/regress-334807-05.js
-js1_5/Regress/regress-334807-06.js
-js1_5/Regress/regress-336100.js
-js1_5/Regress/regress-344711-n.js
-js1_5/Regress/regress-349648.js
-js1_5/Regress/regress-350253.js
-js1_5/Regress/regress-350268.js
-js1_5/Regress/regress-350415.js
-js1_5/Regress/regress-350529.js
-js1_5/Regress/regress-351515.js
-js1_5/Regress/regress-352009.js
-js1_5/Regress/regress-352197.js
-js1_5/Regress/regress-352208.js
-js1_5/Regress/regress-355556.js
-js1_5/Regress/regress-356693.js
-js1_5/Regress/regress-360969-01.js
-js1_5/Regress/regress-360969-02.js
-js1_5/Regress/regress-360969-03.js
-js1_5/Regress/regress-360969-04.js
-js1_5/Regress/regress-360969-05.js
-js1_5/Regress/regress-360969-06.js
-js1_5/Regress/regress-372364.js
-js1_5/Regress/regress-383682.js
-js1_5/Regress/regress-410852.js
-js1_5/Regress/regress-419018.js
-js1_5/Regress/regress-420919.js
-js1_5/Regress/regress-422348.js
-js1_5/Regress/regress-426827.js
-js1_5/Regress/regress-438415-02.js
-js1_5/Regress/regress-450833.js
-js1_5/Regress/regress-451884.js
-js1_5/Regress/regress-452495.js
-js1_5/Regress/regress-455775.js
-js1_5/Regress/regress-459990.js
-js1_5/Regress/regress-461307.js
-js1_5/Regress/regress-462292.js
-js1_5/Regress/regress-462879.js
-js1_5/Regress/regress-463259.js
-js1_5/Regress/regress-477733.js
-js1_5/Regress/regress-503860.js
-js1_5/Regress/regress-511859.js
-js1_5/Regress/regress-68498-003.js
-js1_5/Regress/regress-68498-004.js
-js1_5/Regress/regress-89474.js
-js1_5/Regress/regress-96128-n.js
-js1_5/Regress/regress-98901.js
-js1_5/Scope/regress-184107.js
-js1_5/Scope/regress-185485.js
-js1_5/Scope/regress-446026-01.js
-js1_5/decompilation/regress-344120.js
-js1_5/decompilation/regress-346892.js
-js1_5/decompilation/regress-346902.js
-js1_5/decompilation/regress-346915.js
-js1_5/decompilation/regress-349491.js
-js1_5/decompilation/regress-349596.js
-js1_5/decompilation/regress-349650.js
-js1_5/decompilation/regress-350242.js
-js1_5/decompilation/regress-350263.js
-js1_5/decompilation/regress-350271.js
-js1_5/decompilation/regress-350666.js
-js1_5/decompilation/regress-351104.js
-js1_5/decompilation/regress-351219.js
-js1_5/decompilation/regress-351597.js
-js1_5/decompilation/regress-351693.js
-js1_5/decompilation/regress-351705.js
-js1_5/decompilation/regress-351793.js
-js1_5/decompilation/regress-352013.js
-js1_5/decompilation/regress-352022.js
-js1_5/decompilation/regress-352073.js
-js1_5/decompilation/regress-352202.js
-js1_5/decompilation/regress-352312.js
-js1_5/decompilation/regress-352360.js
-js1_5/decompilation/regress-352375.js
-js1_5/decompilation/regress-352453.js
-js1_5/decompilation/regress-352649.js
-js1_5/decompilation/regress-353000.js
-js1_5/decompilation/regress-353120.js
-js1_5/decompilation/regress-353146.js
-js1_5/decompilation/regress-354910.js
-js1_5/decompilation/regress-356083.js
-js1_5/decompilation/regress-375882.js
-js1_5/decompilation/regress-376564.js
-js1_5/decompilation/regress-383721.js
-js1_5/decompilation/regress-406555.js
-js1_5/decompilation/regress-456964-01.js
-js1_5/decompilation/regress-457824.js
-js1_5/decompilation/regress-460116-01.js
-js1_5/decompilation/regress-460116-02.js
-js1_5/decompilation/regress-460116-03.js
-js1_5/decompilation/regress-460501.js
-js1_5/decompilation/regress-460870.js
-js1_5/decompilation/regress-461110.js
-js1_5/extensions/catchguard-001-n.js
-js1_5/extensions/no-such-method.js
-js1_5/extensions/regress-164697.js
-js1_5/extensions/regress-178722.js
-js1_5/extensions/regress-192465.js
-js1_5/extensions/regress-226078.js
-js1_5/extensions/regress-245795.js
-js1_5/extensions/regress-255245.js
-js1_5/extensions/regress-300079.js
-js1_5/extensions/regress-306738.js
-js1_5/extensions/regress-311161.js
-js1_5/extensions/regress-313500.js
-js1_5/extensions/regress-313803.js
-js1_5/extensions/regress-314874.js
-js1_5/extensions/regress-319683.js
-js1_5/extensions/regress-325269.js
-js1_5/extensions/regress-328443.js
-js1_5/extensions/regress-333541.js
-js1_5/extensions/regress-336409-1.js
-js1_5/extensions/regress-336409-2.js
-js1_5/extensions/regress-336410-1.js
-js1_5/extensions/regress-336410-2.js
-js1_5/extensions/regress-342960.js
-js1_5/extensions/regress-346494.js
-js1_5/extensions/regress-348986.js
-js1_5/extensions/regress-350312-01.js
-js1_5/extensions/regress-350312-02.js
-js1_5/extensions/regress-351102-02.js
-js1_5/extensions/regress-351102-06.js
-js1_5/extensions/regress-352261.js
-js1_5/extensions/regress-352372.js
-js1_5/extensions/regress-353214.js
-js1_5/extensions/regress-355497.js
-js1_5/extensions/regress-355736.js
-js1_5/extensions/regress-365527.js
-js1_5/extensions/regress-365692.js
-js1_5/extensions/regress-365869.js
-js1_5/extensions/regress-367501-03.js
-js1_5/extensions/regress-367630.js
-js1_5/extensions/regress-367923.js
-js1_5/extensions/regress-368859.js
-js1_5/extensions/regress-369696-02.js
-js1_5/extensions/regress-375183.js
-js1_5/extensions/regress-376052.js
-js1_5/extensions/regress-379523.js
-js1_5/extensions/regress-380581.js
-js1_5/extensions/regress-381211.js
-js1_5/extensions/regress-381304.js
-js1_5/extensions/regress-382509.js
-js1_5/extensions/regress-384680.js
-js1_5/extensions/regress-390597.js
-js1_5/extensions/regress-390598.js
-js1_5/extensions/regress-394967.js
-js1_5/extensions/regress-420869-01.js
-js1_5/extensions/regress-422137.js
-js1_5/extensions/regress-424683-01.js
-js1_5/extensions/regress-427196-01.js
-js1_5/extensions/regress-429264.js
-js1_5/extensions/regress-429739.js
-js1_5/extensions/regress-431428.js
-js1_5/extensions/regress-434837-01.js
-js1_5/extensions/regress-446386.js
-js1_5/extensions/regress-454040.js
-js1_5/extensions/regress-459606.js
-js1_5/extensions/regress-462734-02.js
-js1_5/extensions/regress-462734-04.js
-js1_5/extensions/regress-469625.js
-js1_5/extensions/regress-472599.js
-js1_5/extensions/regress-476447.js
-js1_5/extensions/regress-50447-1.js
-js1_5/extensions/regress-543839.js
-js1_5/extensions/regress-96284-001.js
-js1_5/extensions/regress-96284-002.js
-js1_5/extensions/scope-001.js
-js1_6/Array/regress-352742-01.js
-js1_6/Array/regress-415540.js
-js1_6/Regress/regress-314887.js
-js1_6/Regress/regress-350417.js
-js1_6/Regress/regress-351795.js
-js1_6/Regress/regress-352271.js
-js1_6/Regress/regress-355002.js
-js1_6/Regress/regress-378492.js
-js1_6/Regress/regress-382509.js
-js1_6/Regress/regress-476655.js
-js1_6/String/regress-306591.js
-js1_6/decompilation/regress-352084.js
-js1_6/decompilation/regress-352613-01.js
-js1_6/decompilation/regress-352613-02.js
-js1_6/extensions/regress-312385-01.js
-js1_6/extensions/regress-352392.js
-js1_6/extensions/regress-385393-08.js
-js1_6/extensions/regress-456826.js
-js1_6/extensions/regress-465443.js
-js1_6/extensions/regress-470310.js
-js1_6/extensions/regress-475144.js
-js1_6/extensions/regress-565521.js
-js1_7/GC/regress-341675.js
-js1_7/block/order-of-operation.js
-js1_7/block/regress-341939.js
-js1_7/block/regress-343765.js
-js1_7/block/regress-344139.js
-js1_7/block/regress-344262.js
-js1_7/block/regress-344370.js
-js1_7/block/regress-344601.js
-js1_7/block/regress-345542.js
-js1_7/block/regress-347559.js
-js1_7/block/regress-348685.js
-js1_7/block/regress-349283.js
-js1_7/block/regress-349507.js
-js1_7/block/regress-349653.js
-js1_7/block/regress-350793-01.js
-js1_7/block/regress-351497.js
-js1_7/block/regress-351794.js
-js1_7/block/regress-352092.js
-js1_7/block/regress-352185.js
-js1_7/block/regress-352212.js
-js1_7/block/regress-352267.js
-js1_7/block/regress-352422.js
-js1_7/block/regress-352616.js
-js1_7/block/regress-352624.js
-js1_7/block/regress-352786.js
-js1_7/block/regress-352907.js
-js1_7/block/regress-376410.js
-js1_7/block/regress-396900.js
-js1_7/block/regress-411279.js
-js1_7/decompilation/regress-349493.js
-js1_7/decompilation/regress-349499.js
-js1_7/decompilation/regress-349633.js
-js1_7/decompilation/regress-350704.js
-js1_7/decompilation/regress-350793-02.js
-js1_7/decompilation/regress-350810.js
-js1_7/decompilation/regress-351070-03.js
-js1_7/decompilation/regress-351496.js
-js1_7/decompilation/regress-352015.js
-js1_7/decompilation/regress-352068.js
-js1_7/decompilation/regress-352079.js
-js1_7/decompilation/regress-352217.js
-js1_7/decompilation/regress-352269.js
-js1_7/decompilation/regress-352272.js
-js1_7/decompilation/regress-352283.js
-js1_7/decompilation/regress-352415.js
-js1_7/decompilation/regress-352441.js
-js1_7/decompilation/regress-352732.js
-js1_7/decompilation/regress-355049-01.js
-js1_7/decompilation/regress-355049-02.js
-js1_7/decompilation/regress-355635.js
-js1_7/decompilation/regress-356247.js
-js1_7/decompilation/regress-379925.js
-js1_7/decompilation/regress-380506.js
-js1_7/decompilation/regress-410571.js
-js1_7/decompilation/regress-429252.js
-js1_7/expressions/destructuring-scope.js
-js1_7/expressions/regress-346203.js
-js1_7/expressions/regress-346645-01.js
-js1_7/expressions/regress-346645-02.js
-js1_7/expressions/regress-346645-03.js
-js1_7/expressions/regress-349624.js
-js1_7/expressions/regress-349818.js
-js1_7/expressions/regress-418051.js
-js1_7/expressions/regress-421806.js
-js1_7/extensions/basic-Iterator.js
-js1_7/extensions/basic-for-each.js
-js1_7/extensions/basic-for-in.js
-js1_7/extensions/destructuring-order.js
-js1_7/extensions/regress-346021.js
-js1_7/extensions/regress-346642-02.js
-js1_7/extensions/regress-349619.js
-js1_7/extensions/regress-350312.js
-js1_7/extensions/regress-351102-03.js
-js1_7/extensions/regress-351102-04.js
-js1_7/extensions/regress-351102-05.js
-js1_7/extensions/regress-351102-07.js
-js1_7/extensions/regress-352885-01.js
-js1_7/extensions/regress-352885-02.js
-js1_7/extensions/regress-353454.js
-js1_7/extensions/regress-354945-01.js
-js1_7/extensions/regress-354945-02.js
-js1_7/extensions/regress-355052-01.js
-js1_7/extensions/regress-355052-02.js
-js1_7/extensions/regress-355052-03.js
-js1_7/extensions/regress-355145.js
-js1_7/extensions/regress-355410.js
-js1_7/extensions/regress-355512.js
-js1_7/extensions/regress-363040-01.js
-js1_7/extensions/regress-363040-02.js
-js1_7/extensions/regress-366668-02.js
-js1_7/extensions/regress-367629.js
-js1_7/extensions/regress-368213.js
-js1_7/extensions/regress-368224.js
-js1_7/extensions/regress-372364.js
-js1_7/extensions/regress-379566.js
-js1_7/extensions/regress-380933.js
-js1_7/extensions/regress-381301.js
-js1_7/extensions/regress-381303.js
-js1_7/extensions/regress-392308.js
-js1_7/extensions/regress-429266.js
-js1_7/extensions/regress-455982-01.js
-js1_7/extensions/regress-455982-02.js
-js1_7/extensions/regress-458679.js
-js1_7/extensions/regress-469405-02.js
-js1_7/extensions/regress-470176.js
-js1_7/extensions/regress-470300-01.js
-js1_7/extensions/regress-470300-02.js
-js1_7/extensions/regress-474771-01.js
-js1_7/extensions/regress-476257.js
-js1_7/extensions/regress-477048.js
-js1_7/extensions/regress-590813.js
-js1_7/geniter/326466-01.js
-js1_7/geniter/builtin-Iterator-function.js
-js1_7/geniter/evens.js
-js1_7/geniter/fibonacci-matrix-generator.js
-js1_7/geniter/message-value-passing.js
-js1_7/geniter/multiple-close.js
-js1_7/geniter/nested-yield.js
-js1_7/geniter/pi-generator.js
-js1_7/geniter/regress-345736.js
-js1_7/geniter/regress-345855.js
-js1_7/geniter/regress-345879-01.js
-js1_7/geniter/regress-345879-02.js
-js1_7/geniter/regress-347593.js
-js1_7/geniter/regress-349012-02.js
-js1_7/geniter/regress-349012-03.js
-js1_7/geniter/regress-349012-04.js
-js1_7/geniter/regress-349012-05.js
-js1_7/geniter/regress-349023-01.js
-js1_7/geniter/regress-349023-02.js
-js1_7/geniter/regress-349023-03.js
-js1_7/geniter/regress-349362.js
-js1_7/geniter/regress-350621.js
-js1_7/geniter/regress-351120.js
-js1_7/geniter/regress-351514.js
-js1_7/geniter/regress-352197.js
-js1_7/geniter/regress-352605.js
-js1_7/geniter/regress-352876.js
-js1_7/geniter/regress-355834.js
-js1_7/geniter/regress-359062.js
-js1_7/geniter/regress-366941.js
-js1_7/geniter/regress-382335.js
-js1_7/geniter/regress-387871.js
-js1_7/geniter/regress-390918.js
-js1_7/geniter/regress-392310.js
-js1_7/geniter/regress-466206.js
-js1_7/geniter/send-no-rhs.js
-js1_7/geniter/sequential-yields.js
-js1_7/geniter/simple-fib.js
-js1_7/geniter/throw-after-close.js
-js1_7/geniter/throw-forever.js
-js1_7/geniter/unreachable-yield.js
-js1_7/geniter/yield-undefined.js
-js1_7/iterable/regress-341499.js
-js1_7/iterable/regress-341510.js
-js1_7/iterable/regress-355075-02.js
-js1_7/iterable/regress-412467.js
-js1_7/iterable/regress-415922.js
-js1_7/iterable/regress-568056.js
-js1_7/lexical/regress-336376-01.js
-js1_7/lexical/regress-351515.js
-js1_7/regress/regress-351503-01.js
-js1_7/regress/regress-351503-02.js
-js1_7/regress/regress-352797-02.js
-js1_7/regress/regress-352870-01.js
-js1_7/regress/regress-352870-02.js
-js1_7/regress/regress-352870-03.js
-js1_7/regress/regress-353079.js
-js1_7/regress/regress-355023.js
-js1_7/regress/regress-355832-01.js
-js1_7/regress/regress-355832-02.js
-js1_7/regress/regress-361566.js
-js1_7/regress/regress-363040-01.js
-js1_7/regress/regress-363040-02.js
-js1_7/regress/regress-372331.js
-js1_7/regress/regress-373827-01.js
-js1_7/regress/regress-373827-02.js
-js1_7/regress/regress-373828.js
-js1_7/regress/regress-385133-01.js
-js1_7/regress/regress-385133-02.js
-js1_7/regress/regress-385393-05.js
-js1_7/regress/regress-387951.js
-js1_7/regress/regress-406477.js
-js1_7/regress/regress-407727-02.js
-js1_7/regress/regress-414553.js
-js1_7/regress/regress-416601.js
-js1_7/regress/regress-416705.js
-js1_7/regress/regress-418641.js
-js1_7/regress/regress-419803.js
-js1_7/regress/regress-428706.js
-js1_7/regress/regress-428708.js
-js1_7/regress/regress-452703.js
-js1_7/regress/regress-452960.js
-js1_7/regress/regress-453049.js
-js1_7/regress/regress-453051.js
-js1_7/regress/regress-453411.js
-js1_7/regress/regress-461945.js
-js1_7/regress/regress-462071.js
-js1_7/regress/regress-462282.js
-js1_7/regress/regress-462388.js
-js1_7/regress/regress-462407.js
-js1_7/regress/regress-465236.js
-js1_7/regress/regress-465424.js
-js1_7/regress/regress-465484.js
-js1_7/regress/regress-465686.js
-js1_7/regress/regress-469239-01.js
-js1_7/regress/regress-469239-02.js
-js1_7/regress/regress-470223.js
-js1_7/regress/regress-470388-01.js
-js1_7/regress/regress-470388-02.js
-js1_7/regress/regress-470388-03.js
-js1_7/regress/regress-474771.js
-js1_8/decompilation/regress-346749.js
-js1_8/decompilation/regress-381963-01.js
-js1_8/decompilation/regress-381963-02.js
-js1_8/decompilation/regress-382981.js
-js1_8/extensions/expclo.js
-js1_8/extensions/expclo2.js
-js1_8/extensions/regress-353116.js
-js1_8/extensions/regress-385393-01.js
-js1_8/extensions/regress-385393-10.js
-js1_8/extensions/regress-385393-11.js
-js1_8/extensions/regress-385729.js
-js1_8/extensions/regress-394709.js
-js1_8/extensions/regress-422269.js
-js1_8/extensions/regress-452476.js
-js1_8/extensions/regress-452913.js
-js1_8/extensions/regress-455973.js
-js1_8/extensions/regress-465337.js
-js1_8/extensions/regress-465453.js
-js1_8/extensions/regress-469625.js
-js1_8/extensions/regress-472450-03.js
-js1_8/extensions/regress-472450-04.js
-js1_8/extensions/regress-473040.js
-js1_8/extensions/regress-476414-01.js
-js1_8/extensions/regress-476414-02.js
-js1_8/extensions/regress-476427.js
-js1_8/extensions/regress-476653.js
-js1_8/extensions/regress-476869.js
-js1_8/extensions/regress-476871-01.js
-js1_8/extensions/regress-476871-02.js
-js1_8/extensions/regress-481989.js
-js1_8/extensions/regress-482263.js
-js1_8/genexps/regress-347739.js
-js1_8/genexps/regress-349012-01.js
-js1_8/genexps/regress-349326.js
-js1_8/genexps/regress-349331.js
-js1_8/genexps/regress-380237-01.js
-js1_8/genexps/regress-380237-03.js
-js1_8/regress/regress-366941.js
-js1_8/regress/regress-384412.js
-js1_8/regress/regress-384758.js
-js1_8/regress/regress-404734.js
-js1_8/regress/regress-427798.js
-js1_8/regress/regress-433279-01.js
-js1_8/regress/regress-433279-02.js
-js1_8/regress/regress-433279-03.js
-js1_8/regress/regress-453492.js
-js1_8/regress/regress-455981-01.js
-js1_8/regress/regress-455981-02.js
-js1_8/regress/regress-457065-01.js
-js1_8/regress/regress-457065-02.js
-js1_8/regress/regress-458076.js
-js1_8/regress/regress-459185.js
-js1_8/regress/regress-459186.js
-js1_8/regress/regress-459389.js
-js1_8/regress/regress-461930.js
-js1_8/regress/regress-461932.js
-js1_8/regress/regress-463334-01.js
-js1_8/regress/regress-463334-02.js
-js1_8/regress/regress-463783.js
-js1_8/regress/regress-464092-01.js
-js1_8/regress/regress-464092-02.js
-js1_8/regress/regress-464096.js
-js1_8/regress/regress-464418.js
-js1_8/regress/regress-464978.js
-js1_8/regress/regress-465220.js
-js1_8/regress/regress-465234.js
-js1_8/regress/regress-465239.js
-js1_8/regress/regress-465241.js
-js1_8/regress/regress-465249.js
-js1_8/regress/regress-465261.js
-js1_8/regress/regress-465308.js
-js1_8/regress/regress-465454.js
-js1_8/regress/regress-465460-01.js
-js1_8/regress/regress-465460-02.js
-js1_8/regress/regress-465460-03.js
-js1_8/regress/regress-465460-06.js
-js1_8/regress/regress-465460-07.js
-js1_8/regress/regress-465460-08.js
-js1_8/regress/regress-465460-09.js
-js1_8/regress/regress-465460-10.js
-js1_8/regress/regress-465460-11.js
-js1_8/regress/regress-465483.js
-js1_8/regress/regress-465567-01.js
-js1_8/regress/regress-465688.js
-js1_8/regress/regress-466128.js
-js1_8/regress/regress-466787.js
-js1_8/regress/regress-467495-03.js
-js1_8/regress/regress-467495-05.js
-js1_8/regress/regress-468711.js
-js1_8/regress/regress-469547.js
-js1_8/regress/regress-469625-02.js
-js1_8/regress/regress-469625-03.js
-js1_8/regress/regress-471373.js
-js1_8/regress/regress-471660.js
-js1_8/regress/regress-472450-01.js
-js1_8/regress/regress-472450-02.js
-js1_8/regress/regress-472528-01.js
-js1_8/regress/regress-472528-02.js
-js1_8/regress/regress-472703.js
-js1_8/regress/regress-474769.js
-js1_8/regress/regress-474771.js
-js1_8/regress/regress-474935.js
-js1_8/regress/regress-476655.js
-js1_8/regress/regress-477234.js
-js1_8/regress/regress-477581.js
-js1_8/regress/regress-478205.js
-js1_8/regress/regress-479353.js
-js1_8/regress/regress-481800.js
-js1_8/regress/regress-483749.js
-js1_8/regress/regress-499524.js
-js1_8/regress/regress-532491.js
-js1_8_1/decompilation/regress-346642-01.js
-js1_8_1/decompilation/regress-349605.js
-js1_8_1/decompilation/regress-349634.js
-js1_8_1/decompilation/regress-350991.js
-js1_8_1/decompilation/regress-351070-01.js
-js1_8_1/decompilation/regress-351336.js
-js1_8_1/decompilation/regress-351626.js
-js1_8_1/decompilation/regress-352011.js
-js1_8_1/decompilation/regress-352022.js
-js1_8_1/decompilation/regress-352026.js
-js1_8_1/decompilation/regress-352609.js
-js1_8_1/decompilation/regress-353249.js
-js1_8_1/decompilation/regress-354878.js
-js1_8_1/decompilation/regress-371802.js
-js1_8_1/decompilation/regress-373678-01.js
-js1_8_1/decompilation/regress-380237-03.js
-js1_8_1/decompilation/regress-443074.js
-js1_8_1/extensions/regress-352281.js
-js1_8_1/extensions/regress-353214-02.js
-js1_8_1/extensions/regress-437288-01.js
-js1_8_1/extensions/regress-452498-193.js
-js1_8_1/extensions/regress-452498-196.js
-js1_8_1/extensions/regress-452498-224.js
-js1_8_1/extensions/regress-477158.js
-js1_8_1/extensions/regress-477187.js
-js1_8_1/extensions/regress-520572.js
-js1_8_1/extensions/strict-warning.js
-js1_8_1/regress/regress-420399.js
-js1_8_1/regress/regress-452498-027.js
-js1_8_1/regress/regress-452498-038.js
-js1_8_1/regress/regress-452498-050.js
-js1_8_1/regress/regress-452498-051.js
-js1_8_1/regress/regress-452498-052-a.js
-js1_8_1/regress/regress-452498-052.js
-js1_8_1/regress/regress-452498-053.js
-js1_8_1/regress/regress-452498-054.js
-js1_8_1/regress/regress-452498-068.js
-js1_8_1/regress/regress-452498-074.js
-js1_8_1/regress/regress-452498-076.js
-js1_8_1/regress/regress-452498-077.js
-js1_8_1/regress/regress-452498-082.js
-js1_8_1/regress/regress-452498-091.js
-js1_8_1/regress/regress-452498-092.js
-js1_8_1/regress/regress-452498-098.js
-js1_8_1/regress/regress-452498-099-a.js
-js1_8_1/regress/regress-452498-099.js
-js1_8_1/regress/regress-452498-101.js
-js1_8_1/regress/regress-452498-102.js
-js1_8_1/regress/regress-452498-103.js
-js1_8_1/regress/regress-452498-107.js
-js1_8_1/regress/regress-452498-108.js
-js1_8_1/regress/regress-452498-110.js
-js1_8_1/regress/regress-452498-112.js
-js1_8_1/regress/regress-452498-114.js
-js1_8_1/regress/regress-452498-117.js
-js1_8_1/regress/regress-452498-119.js
-js1_8_1/regress/regress-452498-123.js
-js1_8_1/regress/regress-452498-129.js
-js1_8_1/regress/regress-452498-130.js
-js1_8_1/regress/regress-452498-131.js
-js1_8_1/regress/regress-452498-135-a.js
-js1_8_1/regress/regress-452498-135.js
-js1_8_1/regress/regress-452498-138.js
-js1_8_1/regress/regress-452498-139.js
-js1_8_1/regress/regress-452498-155.js
-js1_8_1/regress/regress-452498-160.js
-js1_8_1/regress/regress-452498-178.js
-js1_8_1/regress/regress-452498-185.js
-js1_8_1/regress/regress-452498-187.js
-js1_8_1/regress/regress-452498-191.js
-js1_8_1/regress/regress-466905-01.js
-js1_8_1/regress/regress-479430-01.js
-js1_8_1/regress/regress-479430-02.js
-js1_8_1/regress/regress-479430-03.js
-js1_8_1/regress/regress-479430-04.js
-js1_8_1/regress/regress-479430-05.js
-js1_8_1/regress/regress-495907.js
-js1_8_1/regress/regress-496922.js
-js1_8_1/regress/regress-507424.js
-js1_8_1/regress/regress-509354.js
-js1_8_1/regress/regress-515885.js
-js1_8_1/regress/regress-522123.js
-js1_8_1/regress/regress-524264.js
-js1_8_1/regress/regress-530879.js
-js1_8_1/strict/12.2.1.js
-js1_8_1/strict/generator-eval-arguments.js
-js1_8_1/strict/let-block-eval-arguments.js
-js1_8_1/jit/math-jit-tests.js
-js1_8_1/jit/testDeepBailFromNonNative.js
-js1_8_1/jit/jit-test.js
-js1_8_5/extensions/censor-strict-caller.js
-js1_8_5/extensions/destructure-accessor.js
-js1_8_5/extensions/reflect-parse.js
-js1_8_5/extensions/scripted-proxies.js
-js1_8_5/extensions/typedarray.js
-js1_8_5/extensions/clone-object.js
-js1_8_5/extensions/clone-errors.js
-js1_8_5/extensions/clone-typed-array.js
-js1_8_5/regress/regress-500528.js
-js1_8_5/regress/regress-533876.js
-js1_8_5/regress/regress-541255-0.js
-js1_8_5/regress/regress-541255-1.js
-js1_8_5/regress/regress-541255-2.js
-js1_8_5/regress/regress-541255-3.js
-js1_8_5/regress/regress-541255-4.js
-js1_8_5/regress/regress-546615.js
-js1_8_5/regress/regress-555246-0.js
-js1_8_5/regress/regress-560101.js
-js1_8_5/regress/regress-560998-1.js
-js1_8_5/regress/regress-566549.js
-js1_8_5/regress/regress-566914.js
-js1_8_5/regress/regress-569306.js
-js1_8_5/regress/regress-571014.js
-js1_8_5/regress/regress-577648-1.js
-js1_8_5/regress/regress-577648-2.js
-js1_8_5/regress/regress-584355.js
-js1_8_5/regress/regress-588339.js
-js1_8_5/regress/regress-592217.js
-js1_8_5/regress/regress-596805-2.js
-js1_8_5/regress/regress-597870.js
-js1_8_5/regress/regress-597945-1.js
-narcissus/../ecma/Date/15.9.5.10-2.js
-narcissus/../ecma/Date/15.9.5.11-2.js
-narcissus/../ecma/Date/15.9.5.12-2.js
-narcissus/../ecma/Date/15.9.5.2-2-n.js
-narcissus/../ecma/Date/15.9.5.23-3-n.js
-narcissus/../ecma/Date/15.9.5.3-1-n.js
-narcissus/../ecma/Date/15.9.5.4-2-n.js
-narcissus/../ecma/Date/15.9.5.8.js
-narcissus/../ecma/Date/dst-offset-caching-1-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-2-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-3-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-4-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-5-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-6-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-7-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-8-of-8.js
-narcissus/../ecma_3/Date/15.9.5.4.js
-narcissus/../ecma_3/Date/regress-452786.js
deleted file mode 100644
--- a/js/src/tests/narcissus.README
+++ /dev/null
@@ -1,12 +0,0 @@
-To run narcissus with jstests.py, change to the js/src/tests/ directory and run
-the following command (which excludes tests that are particularly slow):
-
-  python jstests.py -d -j 4 $OBJDIR/njs -x slow-narcissus.txt
-
-
-Currently, Narcissus is failing a number of tests.  narcissus-failures.txt can
-be used to ignore those tests.  Note that narcissus-failures.txt also includes
-all of the tests from slow-narcissus.txt.
-
-  python jstests.py -d -j 4 $OBJDIR/njs -x narcissus-failures.txt
-
deleted file mode 100644
--- a/js/src/tests/narcissus.list
+++ /dev/null
@@ -1,1 +0,0 @@
-include narcissus/jstests.list
deleted file mode 100644
--- a/js/src/tests/performance.tests
+++ /dev/null
@@ -1,3 +0,0 @@
-js1_5/GC/regress-383269-01.js
-js1_5/GC/regress-383269-02.js
-js1_5/extensions/regress-363258.js
deleted file mode 100644
--- a/js/src/tests/slow-n.tests
+++ /dev/null
@@ -1,28 +0,0 @@
-ecma/Date/15.9.5.10-2.js
-ecma_3/Array/regress-322135-03.js
-ecma_3/Array/regress-322135-04.js
-ecma_3/RegExp/regress-307456.js
-ecma_3/RegExp/regress-330684.js
-js1_5/Array/regress-350256-03.js
-js1_5/Array/regress-465980-02.js
-js1_5/GC/regress-338653.js
-js1_5/GC/regress-346794.js
-js1_5/GC/regress-348532.js
-js1_5/Regress/regress-271716-n.js
-js1_5/Regress/regress-303213.js
-js1_5/Regress/regress-451322.js
-js1_5/Regress/regress-484693.js
-js1_5/extensions/regress-342960.js
-js1_5/extensions/regress-345967.js
-js1_5/extensions/regress-350531.js
-js1_6/extensions/regress-455464-04.js
-js1_7/extensions/regress-458679.js
-js1_8/extensions/regress-452913.js
-js1_8_1/regress/regress-452498-168-2.js
-js1_8/extensions/regress-476414-01.js
-js1_8/extensions/regress-476414-02.js
-js1_8/extensions/regress-476427.js
-js1_8/regress/regress-464096.js
-js1_8/regress/regress-477234.js
-js1_8_1/regress/regress-452498-168-2.js
-js1_8_1/jit/regress-451673.js
deleted file mode 100644
--- a/js/src/tests/slow-narcissus.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-narcissus/../ecma/Date/15.9.5.2-2-n.js
-narcissus/../ecma/Date/15.9.5.23-3-n.js
-narcissus/../ecma/Date/15.9.5.3-1-n.js
-narcissus/../ecma/Date/15.9.5.4-2-n.js
-narcissus/../ecma/Date/15.9.5.8.js
-narcissus/../ecma/Date/dst-offset-caching-1-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-2-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-3-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-4-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-5-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-6-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-7-of-8.js
-narcissus/../ecma/Date/dst-offset-caching-8-of-8.js
-narcissus/../ecma/Date/15.9.5.11-2.js
-narcissus/../ecma/Date/15.9.5.12-2.js
-narcissus/../ecma_3/Date/15.9.5.4.js
-narcissus/../ecma_3/Date/regress-452786.js
-narcissus/../ecma/Date/15.9.5.10-2.js
deleted file mode 100644
--- a/js/src/tests/spidermonkey-gc.tests
+++ /dev/null
@@ -1,20 +0,0 @@
-js1_5/GC/regress-104584.js
-js1_5/GC/regress-203278-2.js
-js1_5/GC/regress-203278-3.js
-js1_5/GC/regress-278725.js
-js1_5/GC/regress-306788.js
-js1_5/GC/regress-311497.js
-js1_5/GC/regress-313276.js
-js1_5/GC/regress-313479.js
-js1_5/GC/regress-316885-01.js
-js1_5/GC/regress-316885-02.js
-js1_5/GC/regress-316885-03.js
-js1_5/GC/regress-324278.js
-js1_5/extensions/regress-311792-01.js
-js1_5/extensions/regress-311792-02.js
-js1_5/extensions/regress-312278.js
-js1_5/extensions/regress-313500.js
-js1_5/extensions/regress-313630.js
-js1_5/extensions/regress-313763.js
-js1_5/extensions/regress-313938.js
-js1_5/extensions/regress-325269.js
deleted file mode 100755
--- a/js/src/tests/spidermonkey-n.tests
+++ /dev/null
@@ -1,67 +0,0 @@
-# Obsolete SpiderMonkey tests
-#
-# invalidated by bug 10278
-#
-js1_2/function/function-001-n.js
-js1_3/Script/function-001-n.js
-js1_3/regress/function-001-n.js
-#
-# WONTFIX bug 119719
-#
-js1_5/Regress/regress-119719.js
-#
-# Spidermonkey now defaults lineNumber and fileName
-# to the location and file where the exception occurred.
-# exclude original test which assumes the defaults are
-# 0 and ''
-#
-js1_5/extensions/regress-50447.js
-#
-# behavior changed to match MSIE/Opera/etc
-# see bug 309840
-#
-js1_5/Regress/regress-173067.js
-#
-# per comment in bug, this test is obsolete
-# for spidermonkey and rhino.
-#
-ecma_3/Statements/regress-121744.js
-#
-# remove version dependent tests
-# see bug 325921
-#
-js1_2/Array/array_split_1.js
-js1_2/Array/tostring_1.js
-js1_2/Array/tostring_2.js
-js1_2/Objects/toString-001.js
-js1_2/String/concat.js
-js1_2/function/Function_object.js
-js1_2/function/Number.js
-js1_2/function/String.js
-js1_2/function/function-001-n.js
-js1_2/function/length.js
-js1_2/function/regexparg-2-n.js
-js1_2/function/tostring-1.js
-js1_2/function/tostring-2.js
-js1_2/operator/equality.js
-js1_2/regexp/RegExp_lastIndex.js
-js1_2/regexp/string_split.js
-js1_2/version120/boolean-001.js
-js1_2/version120/regress-99663.js
-js1_3/Script/delete-001.js
-js1_3/Script/function-001-n.js
-js1_3/regress/delete-001.js
-js1_3/regress/function-001-n.js
-#
-# tests not yet implemented
-#
-ecma_2/RegExp/exec-001.js
-ecma_2/String/replace-001.js
-#
-# pre ecma warnings are doa
-#
-js1_5/Regress/regress-106244.js
-#
-# do not ignore unicode formatting chars/trunk - bug 274152
-#
-ecma_3/Unicode/uc-001.js
--- a/js/src/tests/update-test262.sh
+++ b/js/src/tests/update-test262.sh
@@ -4,36 +4,60 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # Abort when an error occurs.
 set -e
 
 # Updates the jstests copy of the test cases of Test262, the conformance test
 # suite for ECMA-262 and ECMA-402, ECMAScript and its Internationalization API.
 
-if [ $# -lt 1 ]; then
-  echo "Usage: update-test262.sh <URL of test262 hg, e.g. http://hg.ecmascript.org/tests/test262/ or a local clone>"
+function usage()
+{
+  echo "Usage: update-test262.sh <URL of test262 hg> [clone | copy]"
+  echo ""
+  echo "The URL will most commonly be http://hg.ecmascript.org/tests/test262/ "
+  echo "but may also be a local clone.  Don't use a local clone when generating"
+  echo "the final import patch"\!"  test262/HG-INFO will record the wrong URL"
+  echo "if you do so.  Local cloning is only useful when editing this script to"
+  echo "import a larger test262 subset."
+  echo ""
+  echo "If a local clone is specified, the optional clone/copy argument will"
+  echo "either clone into a temporary directory, or directly copy from the"
+  echo "clone's checkout.  'clone' semantics are the default."
   exit 1
-fi
+}
 
-# Mercurial doesn't have a way to download just a part of a repository, or to
-# just get the working copy - we have to clone the entire thing. We use a
-# temporary test262 directory for that.
-unique_dir=`mktemp -d /tmp/test262.XXXX` || exit 1
-tmp_dir=${unique_dir}/test262
+if [ $# -lt 1 ]; then
+  usage
+elif [ $# -eq 1 -o "$2" == "clone" ]; then
+  # Beware!  'copy' support requires that the clone performed here *never* be
+  # altered.  If it were altered, those changes wouldn't appear in the final
+  # set of changes as determined by the 'copy' path below.
+
+  # Mercurial doesn't have a way to download just a part of a repository, or to
+  # just get the working copy - we have to clone the entire thing. We use a
+  # temporary test262 directory for that.
+  unique_dir=`mktemp -d /tmp/test262.XXXX` || exit 1
+  tmp_dir=${unique_dir}/test262
 
-# Remove the temporary test262 directory on exit.
-function cleanupTempFiles()
-{
-  rm -rf ${unique_dir}
-}
-trap cleanupTempFiles EXIT
+  # Remove the temporary test262 directory on exit.
+  function cleanupTempFiles()
+  {
+    rm -rf ${unique_dir}
+  }
+  trap cleanupTempFiles EXIT
 
-echo "Feel free to get some coffee - this could take a few minutes..."
-hg clone $1 ${tmp_dir}
+  echo "Feel free to get some coffee - this could take a few minutes..."
+  hg clone $1 ${tmp_dir}
+elif [ "$2" == "copy" ]; then
+  echo "Copying directly from $1; be sure this repository is updated to tip"\!
+  tmp_dir="$1"
+else
+  usage
+fi
 
 # Now to the actual test262 directory.
 js_src_tests_dir=`dirname $0`
 test262_dir=${js_src_tests_dir}/test262
 rm -rf ${test262_dir}
 mkdir ${test262_dir}
 
 # Copy over the test262 license.
deleted file mode 100644
--- a/js/src/tests/update-test402.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/bin/sh
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# Updates the jstests copy of the test cases of Test402, the conformance test
-# suite for standard ECMA-402, ECMAScript Internationalization API
-# Specification.
-
-# Usage: update-test402.sh <URL of test262 hg>
-# E.g.: update-test402.sh http://hg.ecmascript.org/tests/test262/
-# Note that test402 is part of the test262 repository.
-
-# Abort when an error occurs.
-set -e
-
-if [ $# -lt 1 ]; then
-  echo "Usage: update-test402.sh <URL of test262 hg>"
-  exit 1
-fi
-
-# Test402 in its original form uses the harness of Test262, the conformance
-# test suite for standard ECMA-262, ECMAScript Language Specification, and its
-# test cases are part of the test262 repository.
-# Mercurial doesn't have a way to download just a part of a repository, or to
-# just get the working copy - we have to clone the entire thing. We use a
-# temporary test262 directory for that.
-tmp_dir=`mktemp -d /tmp/test402.XXXX`/test262 || exit 1
-echo "Feel free to get some coffee - this could take a few minutes..."
-hg clone $1 ${tmp_dir}
-
-# Now to the actual test402 directory.
-test402_dir=`dirname $0`/test402
-rm -rf ${test402_dir}
-mkdir ${test402_dir}
-mkdir ${test402_dir}/lib
-
-# Copy over the test402 tests, the supporting JavaScript library files, and
-# the license.
-cp -r ${tmp_dir}/test/suite/intl402/ch* ${test402_dir}
-cp ${tmp_dir}/test/harness/testBuiltInObject.js ${test402_dir}/lib
-cp ${tmp_dir}/test/harness/testIntl.js ${test402_dir}/lib
-cp ${tmp_dir}/LICENSE ${test402_dir}
-
-# Create empty browser.js and shell.js in each test directory to keep
-# jstests happy.
-for dir in `find test402/ch* -type d -print` ; do
-    touch $dir/browser.js
-    touch $dir/shell.js
-done
-
-# Restore our own jstests adapter files.
-cp supporting/test402-browser.js test402/browser.js
-cp supporting/test402-shell.js test402/shell.js
-
-# Keep a record of what we imported.
-echo "URL:         $1" > ${test402_dir}/HG-INFO
-hg -R ${tmp_dir} log -r. >> ${test402_dir}/HG-INFO
-
-# Update for the patch.
-hg addremove ${test402_dir}
-
-# Get rid of the Test262 clone.
-rm -rf ${tmp_dir}
-
-# The alert reader may now be wondering: what about test402 tests we don't
-# currently pass?  We disable such tests in js/src/tests/jstests.list, one by
-# one.  This has the moderate benefit that if a bug is fixed, only that one file
-# must be updated, and we don't have to rerun this script.
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -1,33 +1,34 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "vm/Debugger.h"
+
 #include <limits.h>
 
-#include "vm/Debugger.h"
 #include "jsapi.h"
 #include "jscntxt.h"
+#include "jscompartment.h"
 #include "jsnum.h"
 #include "jsobj.h"
 #include "jswrapper.h"
-#include "jsgcinlines.h"
-#include "jsobjinlines.h"
-#include "jsopcodeinlines.h"
-#include "jscompartment.h"
 
 #include "frontend/BytecodeCompiler.h"
 #include "frontend/BytecodeEmitter.h"
 #include "gc/Marking.h"
 #include "ion/BaselineJIT.h"
 #include "js/Vector.h"
 
+#include "jsgcinlines.h"
+#include "jsobjinlines.h"
+#include "jsopcodeinlines.h"
 #include "gc/FindSCCs-inl.h"
 #include "vm/Interpreter-inl.h"
 #include "vm/Stack-inl.h"
 
 using namespace js;
 
 using js::frontend::IsIdentifier;
 using mozilla::ArrayLength;
--- a/js/src/vm/RegExpObject-inl.h
+++ b/js/src/vm/RegExpObject-inl.h
@@ -5,22 +5,20 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef RegExpObject_inl_h___
 #define RegExpObject_inl_h___
 
 #include "mozilla/Util.h"
 
 #include "RegExpObject.h"
-#include "RegExpStatics.h"
 
 #include "jsobjinlines.h"
 #include "jsstrinlines.h"
 
-#include "RegExpStatics-inl.h"
 #include "String-inl.h"
 
 inline js::RegExpObject &
 JSObject::asRegExp()
 {
     JS_ASSERT(isRegExp());
     return *static_cast<js::RegExpObject *>(this);
 }
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -616,21 +616,25 @@ RegExpShared::executeMatchOnly(JSContext
         return RegExpRunStatus_Error;
 
     unsigned result =
         JSC::Yarr::interpret(cx, bytecode, chars, length, start, matches.rawBuf());
 
     if (result == JSC::Yarr::offsetNoMatch)
         return RegExpRunStatus_Success_NotFound;
 
+    match = MatchPair(result, matches[0].limit);
+    match.displace(displacement);
+
+#ifdef DEBUG
     matches.displace(displacement);
     matches.checkAgainst(origLength);
+#endif
 
-    *lastIndex = matches[0].limit;
-    match = MatchPair(result, matches[0].limit);
+    *lastIndex = match.limit;
     return RegExpRunStatus_Success;
 }
 
 /* RegExpCompartment */
 
 RegExpCompartment::RegExpCompartment(JSRuntime *rt)
   : map_(rt), inUse_(rt)
 {}
--- a/js/src/vm/RegExpStatics-inl.h
+++ b/js/src/vm/RegExpStatics-inl.h
@@ -5,17 +5,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef RegExpStatics_inl_h__
 #define RegExpStatics_inl_h__
 
 #include "RegExpStatics.h"
 
 #include "gc/Marking.h"
-#include "vm/RegExpObject-inl.h"
 #include "vm/String-inl.h"
 
 namespace js {
 
 class RegExpStatics
 {
     /* The latest RegExp output, set after execution. */
     VectorMatchPairs        matches;
--- a/js/src/vm/ScopeObject-inl.h
+++ b/js/src/vm/ScopeObject-inl.h
@@ -5,16 +5,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef ScopeObject_inl_h___
 #define ScopeObject_inl_h___
 
 #include "ScopeObject.h"
 
 #include "jsinferinlines.h"
+#include "jsobjinlines.h"
 #include "jsscriptinlines.h"
 
 namespace js {
 
 inline
 ScopeCoordinate::ScopeCoordinate(jsbytecode *pc)
   : hops(GET_UINT16(pc)), slot(GET_UINT16(pc + 2))
 {
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -217,17 +217,18 @@ CallObject::createTemplateObject(JSConte
  * Construct a call object for the given bindings.  If this is a call object
  * for a function invocation, callee should be the function being called.
  * Otherwise it must be a call object for eval of strict mode code, and callee
  * must be null.
  */
 CallObject *
 CallObject::create(JSContext *cx, HandleScript script, HandleObject enclosing, HandleFunction callee)
 {
-    CallObject *callobj = CallObject::createTemplateObject(cx, script, gc::DefaultHeap);
+    gc::InitialHeap heap = script->treatAsRunOnce ? gc::TenuredHeap : gc::DefaultHeap;
+    CallObject *callobj = CallObject::createTemplateObject(cx, script, heap);
     if (!callobj)
         return NULL;
 
     callobj->asScope().setEnclosingScope(enclosing);
     callobj->initFixedSlot(CALLEE_SLOT, ObjectOrNullValue(callee));
 
     if (script->treatAsRunOnce) {
         Rooted<CallObject*> ncallobj(cx, callobj);
--- a/js/xpconnect/idl/nsIXPConnect.idl
+++ b/js/xpconnect/idl/nsIXPConnect.idl
@@ -286,17 +286,17 @@ interface nsIXPCFunctionThisTranslator :
 %{ C++
 // For use with the service manager
 // {CB6593E0-F9B2-11d2-BDD6-000064657374}
 #define NS_XPCONNECT_CID \
 { 0xcb6593e0, 0xf9b2, 0x11d2, \
     { 0xbd, 0xd6, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74 } }
 %}
 
-[uuid(4d292c29-9d18-403b-b98e-2056e550a3b4)]
+[uuid(8c85f21e-c28b-4a78-89cf-f5682d0c357a)]
 interface nsIXPConnect : nsISupports
 {
 %{ C++
   NS_DEFINE_STATIC_CID_ACCESSOR(NS_XPCONNECT_CID)
 %}
 
     /**
      * Initializes classes on a global object that has already been created.
@@ -435,34 +435,23 @@ interface nsIXPConnect : nsISupports
     nsIXPConnectWrappedNative
     getWrappedNativeOfJSObject(in JSContextPtr aJSContext,
                                in JSObjectPtr  aJSObj);
 
     [noscript, notxpcom] nsISupports
     getNativeOfWrapper(in JSContextPtr aJSContext,
                        in JSObjectPtr  aJSObj);
 
-    void setSecurityManagerForJSContext(in JSContextPtr aJSContext,
-                                        in nsIXPCSecurityManager aManager,
-                                        in uint16_t flags);
-
-    void getSecurityManagerForJSContext(in JSContextPtr aJSContext,
-                                        out nsIXPCSecurityManager aManager,
-                                        out uint16_t flags);
-
     /**
     * The security manager to use when the current JSContext has no security
     * manager.
     */
     void setDefaultSecurityManager(in nsIXPCSecurityManager aManager,
                                    in uint16_t flags);
 
-    void getDefaultSecurityManager(out nsIXPCSecurityManager aManager,
-                                   out uint16_t flags);
-
     nsIStackFrame
     createStackFrameLocation(in uint32_t       aLanguage,
                              in string         aFilename,
                              in string         aFunctionName,
                              in int32_t        aLineNumber,
                              in nsIStackFrame  aCaller);
 
 
--- a/js/xpconnect/shell/xpcshell.cpp
+++ b/js/xpconnect/shell/xpcshell.cpp
@@ -1308,252 +1308,16 @@ ProcessArgs(JSContext *cx, JS::Handle<JS
 
     if (filename || isInteractive)
         Process(cx, obj, filename, forceTTY);
     return gExitCode;
 }
 
 /***************************************************************************/
 
-class FullTrustSecMan
-  : public nsIScriptSecurityManager
-{
-public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIXPCSECURITYMANAGER
-  NS_DECL_NSISCRIPTSECURITYMANAGER
-
-  FullTrustSecMan();
-  virtual ~FullTrustSecMan();
-
-  void SetSystemPrincipal(nsIPrincipal *aPrincipal) {
-    mSystemPrincipal = aPrincipal;
-  }
-
-private:
-  nsCOMPtr<nsIPrincipal> mSystemPrincipal;
-};
-
-NS_INTERFACE_MAP_BEGIN(FullTrustSecMan)
-  NS_INTERFACE_MAP_ENTRY(nsIXPCSecurityManager)
-  NS_INTERFACE_MAP_ENTRY(nsIScriptSecurityManager)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIXPCSecurityManager)
-NS_INTERFACE_MAP_END
-
-NS_IMPL_ADDREF(FullTrustSecMan)
-NS_IMPL_RELEASE(FullTrustSecMan)
-
-FullTrustSecMan::FullTrustSecMan()
-{
-  mSystemPrincipal = nullptr;
-}
-
-FullTrustSecMan::~FullTrustSecMan()
-{
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CanCreateWrapper(JSContext * aJSContext, const nsIID & aIID,
-                                  nsISupports *aObj, nsIClassInfo *aClassInfo,
-                                  void * *aPolicy)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CanCreateInstance(JSContext * aJSContext, const nsCID & aCID)
-{
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::CanGetService(JSContext * aJSContext, const nsCID & aCID)
-{
-    return NS_OK;
-}
-
-/* void CanAccess (in uint32_t aAction, in nsIXPCNativeCallContext aCallContext, in JSContextPtr aJSContext, in JSObjectPtr aJSObject, in nsISupports aObj, in nsIClassInfo aClassInfo, in jsval aName, inout voidPtr aPolicy); */
-NS_IMETHODIMP
-FullTrustSecMan::CanAccess(uint32_t aAction,
-                           nsAXPCNativeCallContext *aCallContext,
-                           JSContext * aJSContext, JSObject * aJSObject,
-                           nsISupports *aObj, nsIClassInfo *aClassInfo,
-                           jsid aName, void * *aPolicy)
-{
-    return NS_OK;
-}
-
-/* [noscript] void checkPropertyAccess (in JSContextPtr aJSContext, in JSObjectPtr aJSObject, in string aClassName, in jsid aProperty, in uint32_t aAction); */
-NS_IMETHODIMP
-FullTrustSecMan::CheckPropertyAccess(JSContext * aJSContext,
-                                     JSObject * aJSObject,
-                                     const char *aClassName,
-                                     jsid aProperty, uint32_t aAction)
-{
-    return NS_OK;
-}
-
-/* [noscript] void checkLoadURIFromScript (in JSContextPtr cx, in nsIURI uri); */
-NS_IMETHODIMP
-FullTrustSecMan::CheckLoadURIFromScript(JSContext * cx, nsIURI *uri)
-{
-    return NS_OK;
-}
-
-/* void checkLoadURIWithPrincipal (in nsIPrincipal aPrincipal, in nsIURI uri, in unsigned long flags); */
-NS_IMETHODIMP
-FullTrustSecMan::CheckLoadURIWithPrincipal(nsIPrincipal *aPrincipal,
-                                           nsIURI *uri, uint32_t flags)
-{
-    return NS_OK;
-}
-
-/* void checkLoadURIStrWithPrincipal (in nsIPrincipal aPrincipal, in AUTF8String uri, in unsigned long flags); */
-NS_IMETHODIMP
-FullTrustSecMan::CheckLoadURIStrWithPrincipal(nsIPrincipal *aPrincipal,
-                                              const nsACString & uri,
-                                              uint32_t flags)
-{
-    return NS_OK;
-}
-
-/* [noscript] void checkFunctionAccess (in JSContextPtr cx, in voidPtr funObj, in voidPtr targetObj); */
-NS_IMETHODIMP
-FullTrustSecMan::CheckFunctionAccess(JSContext * cx, void * funObj,
-                                     void * targetObj)
-{
-    return NS_OK;
-}
-
-/* [noscript] boolean canExecuteScripts (in JSContextPtr cx, in nsIPrincipal principal); */
-NS_IMETHODIMP
-FullTrustSecMan::CanExecuteScripts(JSContext * cx, nsIPrincipal *principal,
-                                   bool *_retval)
-{
-    *_retval = true;
-    return NS_OK;
-}
-
-/* [noscript] nsIPrincipal getSubjectPrincipal (); */
-NS_IMETHODIMP
-FullTrustSecMan::GetSubjectPrincipal(nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-/* [noscript] nsIPrincipal getSystemPrincipal (); */
-NS_IMETHODIMP
-FullTrustSecMan::GetSystemPrincipal(nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-/* [noscript] nsIPrincipal getSimpleCodebasePrincipal (in nsIURI aURI); */
-NS_IMETHODIMP
-FullTrustSecMan::GetSimpleCodebasePrincipal(nsIURI *aURI, nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-/* [noscript] nsIPrincipal getNoAppCodebasePrincipal (in nsIURI aURI); */
-NS_IMETHODIMP
-FullTrustSecMan::GetNoAppCodebasePrincipal(nsIURI *aURI, nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-/* [noscript] nsIPrincipal getCodebasePrincipal (in nsIURI aURI); */
-NS_IMETHODIMP
-FullTrustSecMan::GetCodebasePrincipal(nsIURI *aURI, nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-/* [noscript] nsIPrincipal getAppCodebasePrincipal (in nsIURI aURI, unsigned long appid, bool inMozBrowser); */
-NS_IMETHODIMP
-FullTrustSecMan::GetAppCodebasePrincipal(nsIURI *aURI, uint32_t aAppId, bool aInMozBrowser, nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-/* [noscript] nsIPrincipal getDocShellCodebasePrincipal (in nsIURI aURI, nsIDocShell docShell); */
-NS_IMETHODIMP
-FullTrustSecMan::GetDocShellCodebasePrincipal(nsIURI *aURI, nsIDocShell* aDocShell, nsIPrincipal **_retval)
-{
-    return GetSimpleCodebasePrincipal(aURI, _retval);
-}
-
-/* [noscript] nsIPrincipal getObjectPrincipal (in JSContextPtr cx, in JSObjectPtr obj); */
-NS_IMETHODIMP
-FullTrustSecMan::GetObjectPrincipal(JSContext * cx, JSObject * obj,
-                                    nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-/* [noscript] boolean subjectPrincipalIsSystem (); */
-NS_IMETHODIMP
-FullTrustSecMan::SubjectPrincipalIsSystem(bool *_retval)
-{
-    *_retval = true;
-    return NS_OK;
-}
-
-/* [noscript] void checkSameOrigin (in JSContextPtr aJSContext, in nsIURI aTargetURI); */
-NS_IMETHODIMP
-FullTrustSecMan::CheckSameOrigin(JSContext * aJSContext, nsIURI *aTargetURI)
-{
-    return NS_OK;
-}
-
-/* void checkSameOriginURI (in nsIURI aSourceURI, in nsIURI aTargetURI); */
-NS_IMETHODIMP
-FullTrustSecMan::CheckSameOriginURI(nsIURI *aSourceURI, nsIURI *aTargetURI,
-                                    bool reportError)
-{
-    return NS_OK;
-}
-
-/* [noscript] nsIPrincipal getChannelPrincipal (in nsIChannel aChannel); */
-NS_IMETHODIMP
-FullTrustSecMan::GetChannelPrincipal(nsIChannel *aChannel, nsIPrincipal **_retval)
-{
-    NS_IF_ADDREF(*_retval = mSystemPrincipal);
-    return *_retval ? NS_OK : NS_ERROR_FAILURE;
-}
-
-/* boolean isSystemPrincipal (in nsIPrincipal aPrincipal); */
-NS_IMETHODIMP
-FullTrustSecMan::IsSystemPrincipal(nsIPrincipal *aPrincipal, bool *_retval)
-{
-    *_retval = aPrincipal == mSystemPrincipal;
-    return NS_OK;
-}
-
-NS_IMETHODIMP_(nsIPrincipal *)
-FullTrustSecMan::GetCxSubjectPrincipal(JSContext *cx)
-{
-    return mSystemPrincipal;
-}
-
-NS_IMETHODIMP
-FullTrustSecMan::GetExtendedOrigin(nsIURI* aURI, uint32_t aAppId,
-                                   bool aInMozBrowser,
-                                   nsACString& aExtendedOrigin)
-{
-  aExtendedOrigin.Truncate();
-  return NS_OK;
-}
-
-/***************************************************************************/
-
 // #define TEST_InitClassesWithNewWrappedGlobal
 
 #ifdef TEST_InitClassesWithNewWrappedGlobal
 // XXX hacky test code...
 #include "xpctest.h"
 
 class TestGlobal : public nsIXPCTestNoisy, public nsIXPCScriptable
 {
@@ -1824,39 +1588,32 @@ main(int argc, char **argv, char **envp)
         ProcessArgsForCompartment(cx, argv, argc);
 
         nsCOMPtr<nsIXPConnect> xpc = do_GetService(nsIXPConnect::GetCID());
         if (!xpc) {
             printf("failed to get nsXPConnect service!\n");
             return 1;
         }
 
-        // Since the caps security system might set a default security manager
-        // we will be sure that the secman on this context gives full trust.
-        nsRefPtr<FullTrustSecMan> secman = new FullTrustSecMan();
-        xpc->SetSecurityManagerForJSContext(cx, secman, 0xFFFF);
-
         nsCOMPtr<nsIPrincipal> systemprincipal;
-
         // Fetch the system principal and store it away in a global, to use for
         // script compilation in Load() and ProcessFile() (including interactive
         // eval loop)
         {
 
             nsCOMPtr<nsIScriptSecurityManager> securityManager =
                 do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
             if (NS_SUCCEEDED(rv) && securityManager) {
                 rv = securityManager->GetSystemPrincipal(getter_AddRefs(systemprincipal));
                 if (NS_FAILED(rv)) {
                     fprintf(gErrFile, "+++ Failed to obtain SystemPrincipal from ScriptSecurityManager service.\n");
                 } else {
                     // fetch the JS principals and stick in a global
                     gJSPrincipals = nsJSPrincipals::get(systemprincipal);
                     JS_HoldPrincipals(gJSPrincipals);
-                    secman->SetSystemPrincipal(systemprincipal);
                 }
             } else {
                 fprintf(gErrFile, "+++ Failed to get ScriptSecurityManager service, running without principals");
             }
         }
 
         const JSSecurityCallbacks *scb = JS_GetSecurityCallbacks(rt);
         NS_ASSERTION(scb, "We are assuming that nsScriptSecurityManager::Init() has been run");
--- a/js/xpconnect/src/XPCCallContext.cpp
+++ b/js/xpconnect/src/XPCCallContext.cpp
@@ -1,25 +1,28 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* Call context. */
 
 #include "mozilla/Util.h"
 #include "AccessCheck.h"
 
 #include "xpcprivate.h"
 
 using namespace mozilla;
 using namespace xpc;
 using namespace JS;
 
+#define IS_TEAROFF_CLASS(clazz) ((clazz) == &XPC_WN_Tearoff_JSClass)
+
 XPCCallContext::XPCCallContext(XPCContext::LangType callerLanguage,
                                JSContext* cx       /* = GetDefaultJSContext() */,
                                HandleObject obj    /* = nullptr               */,
                                HandleObject funobj /* = nullptr               */,
                                HandleId name       /* = JSID_VOID             */,
                                unsigned argc       /* = NO_ARGS               */,
                                jsval *argv         /* = nullptr               */,
                                jsval *rval         /* = nullptr               */)
@@ -31,79 +34,19 @@ XPCCallContext::XPCCallContext(XPCContex
         mDestroyJSContextInDestructor(false),
         mCallerLanguage(callerLanguage),
         mFlattenedJSObject(cx),
         mWrapper(nullptr),
         mTearOff(nullptr),
         mName(cx)
 {
     MOZ_ASSERT(cx);
-    Init(callerLanguage, callerLanguage == NATIVE_CALLER, obj, funobj,
-         INIT_SHOULD_LOOKUP_WRAPPER, name, argc, argv, rval);
-}
-
-XPCCallContext::XPCCallContext(XPCContext::LangType callerLanguage,
-                               JSContext* cx,
-                               JSBool callBeginRequest,
-                               HandleObject obj,
-                               HandleObject flattenedJSObject,
-                               XPCWrappedNative* wrapper,
-                               XPCWrappedNativeTearOff* tearOff)
-    :   mState(INIT_FAILED),
-        mXPC(nsXPConnect::XPConnect()),
-        mXPCContext(nullptr),
-        mJSContext(cx),
-        mContextPopRequired(false),
-        mDestroyJSContextInDestructor(false),
-        mCallerLanguage(callerLanguage),
-        mFlattenedJSObject(cx, flattenedJSObject),
-        mWrapper(wrapper),
-        mTearOff(tearOff),
-        mName(cx)
-{
-    MOZ_ASSERT(cx);
-    Init(callerLanguage, callBeginRequest, obj, NullPtr(),
-         WRAPPER_PASSED_TO_CONSTRUCTOR, JSID_VOIDHANDLE, NO_ARGS,
-         nullptr, nullptr);
-}
-
-#define IS_TEAROFF_CLASS(clazz) ((clazz) == &XPC_WN_Tearoff_JSClass)
-
+    bool callBeginRequest = callerLanguage == NATIVE_CALLER;
 
-// static
-JSContext *
-XPCCallContext::GetDefaultJSContext()
-{
-    // This is slightly questionable. If called without an explicit
-    // JSContext (generally a call to a wrappedJS) we will use the JSContext
-    // on the top of the JSContext stack - if there is one - *before*
-    // falling back on the safe JSContext.
-    // This is good AND bad because it makes calls from JS -> native -> JS
-    // have JS stack 'continuity' for purposes of stack traces etc.
-    // Note: this *is* what the pre-XPCCallContext xpconnect did too.
-
-    XPCJSContextStack* stack = XPCJSRuntime::Get()->GetJSContextStack();
-    JSContext *topJSContext = stack->Peek();
-
-    return topJSContext ? topJSContext : stack->GetSafeJSContext();
-}
-
-void
-XPCCallContext::Init(XPCContext::LangType callerLanguage,
-                     JSBool callBeginRequest,
-                     HandleObject obj,
-                     HandleObject funobj,
-                     WrapperInitOptions wrapperInitOptions,
-                     HandleId name,
-                     unsigned argc,
-                     jsval *argv,
-                     jsval *rval)
-{
     NS_ASSERTION(mJSContext, "No JSContext supplied to XPCCallContext");
-
     if (!mXPC)
         return;
 
     XPCJSContextStack* stack = XPCJSRuntime::Get()->GetJSContextStack();
     JSContext *topJSContext = stack->Peek();
 
     if (topJSContext != mJSContext) {
         if (!stack->Push(mJSContext)) {
@@ -137,61 +80,78 @@ XPCCallContext::Init(XPCContext::LangTyp
     if (!obj)
         return;
 
     mMethodIndex = 0xDEAD;
 
     mState = HAVE_OBJECT;
 
     mTearOff = nullptr;
-    if (wrapperInitOptions == INIT_SHOULD_LOOKUP_WRAPPER) {
-        // If the object is a security wrapper, GetWrappedNativeOfJSObject can't
-        // handle it. Do special handling here to make cross-origin Xrays work.
-        JSObject *unwrapped = js::CheckedUnwrap(obj, /* stopAtOuter = */ false);
-        if (!unwrapped) {
-            mWrapper = UnwrapThisIfAllowed(obj, funobj, argc);
-            if (!mWrapper) {
-                JS_ReportError(mJSContext, "Permission denied to call method on |this|");
-                mState = INIT_FAILED;
-                return;
-            }
-        } else {
-            js::Class *clasp = js::GetObjectClass(unwrapped);
-            if (IS_WRAPPER_CLASS(clasp)) {
-                if (IS_SLIM_WRAPPER_OBJECT(unwrapped))
-                    mFlattenedJSObject = unwrapped;
-                else
-                    mWrapper = XPCWrappedNative::Get(unwrapped);
-            } else if (IS_TEAROFF_CLASS(clasp)) {
-                mTearOff = (XPCWrappedNativeTearOff*)js::GetObjectPrivate(unwrapped);
-                mWrapper = XPCWrappedNative::Get(js::GetObjectParent(unwrapped));
-            }
+
+    // If the object is a security wrapper, GetWrappedNativeOfJSObject can't
+    // handle it. Do special handling here to make cross-origin Xrays work.
+    JSObject *unwrapped = js::CheckedUnwrap(obj, /* stopAtOuter = */ false);
+    if (!unwrapped) {
+        mWrapper = UnwrapThisIfAllowed(obj, funobj, argc);
+        if (!mWrapper) {
+            JS_ReportError(mJSContext, "Permission denied to call method on |this|");
+            mState = INIT_FAILED;
+            return;
         }
-        if (mWrapper) {
-            mFlattenedJSObject = mWrapper->GetFlatJSObject();
-
-            if (mTearOff)
-                mScriptableInfo = nullptr;
+    } else {
+        js::Class *clasp = js::GetObjectClass(unwrapped);
+        if (IS_WRAPPER_CLASS(clasp)) {
+            if (IS_SLIM_WRAPPER_OBJECT(unwrapped))
+                mFlattenedJSObject = unwrapped;
             else
-                mScriptableInfo = mWrapper->GetScriptableInfo();
-        } else {
-            NS_ABORT_IF_FALSE(!mFlattenedJSObject || IS_SLIM_WRAPPER(mFlattenedJSObject),
-                              "should have a slim wrapper");
+                mWrapper = XPCWrappedNative::Get(unwrapped);
+        } else if (IS_TEAROFF_CLASS(clasp)) {
+            mTearOff = (XPCWrappedNativeTearOff*)js::GetObjectPrivate(unwrapped);
+            mWrapper = XPCWrappedNative::Get(js::GetObjectParent(unwrapped));
         }
     }
+    if (mWrapper) {
+        mFlattenedJSObject = mWrapper->GetFlatJSObject();
+
+        if (mTearOff)
+            mScriptableInfo = nullptr;
+        else
+            mScriptableInfo = mWrapper->GetScriptableInfo();
+    } else {
+        NS_ABORT_IF_FALSE(!mFlattenedJSObject || IS_SLIM_WRAPPER(mFlattenedJSObject),
+                          "should have a slim wrapper");
+    }
 
     if (!JSID_IS_VOID(name))
         SetName(name);
 
     if (argc != NO_ARGS)
         SetArgsAndResultPtr(argc, argv, rval);
 
     CHECK_STATE(HAVE_OBJECT);
 }
 
+// static
+JSContext *
+XPCCallContext::GetDefaultJSContext()
+{
+    // This is slightly questionable. If called without an explicit
+    // JSContext (generally a call to a wrappedJS) we will use the JSContext
+    // on the top of the JSContext stack - if there is one - *before*
+    // falling back on the safe JSContext.
+    // This is good AND bad because it makes calls from JS -> native -> JS
+    // have JS stack 'continuity' for purposes of stack traces etc.
+    // Note: this *is* what the pre-XPCCallContext xpconnect did too.
+
+    XPCJSContextStack* stack = XPCJSRuntime::Get()->GetJSContextStack();
+    JSContext *topJSContext = stack->Peek();
+
+    return topJSContext ? topJSContext : stack->GetSafeJSContext();
+}
+
 void
 XPCCallContext::SetName(jsid name)
 {
     CHECK_STATE(HAVE_OBJECT);
 
     mName = name;
 
     if (mTearOff) {
@@ -272,17 +232,17 @@ XPCCallContext::CanCallNow()
     nsresult rv;
 
     if (!HasInterfaceAndMember())
         return NS_ERROR_UNEXPECTED;
     if (mState < HAVE_ARGS)
         return NS_ERROR_UNEXPECTED;
 
     if (!mTearOff) {
-        mTearOff = mWrapper->FindTearOff(*this, mInterface, false, &rv);
+        mTearOff = mWrapper->FindTearOff(mInterface, false, &rv);
         if (!mTearOff || mTearOff->GetInterface() != mInterface) {
             mTearOff = nullptr;
             return NS_FAILED(rv) ? rv : NS_ERROR_UNEXPECTED;
         }
     }
 
     // Refresh in case FindTearOff extended the set
     mSet = mWrapper->GetSet();
@@ -433,28 +393,16 @@ XPCCallContext::GetPreviousCallContext(n
 NS_IMETHODIMP
 XPCCallContext::GetLanguage(uint16_t *aResult)
 {
   NS_ENSURE_ARG_POINTER(aResult);
   *aResult = GetCallerLanguage();
   return NS_OK;
 }
 
-#ifdef DEBUG
-// static
-void
-XPCLazyCallContext::AssertContextIsTopOfStack(JSContext* cx)
-{
-    XPCJSContextStack* stack = XPCJSRuntime::Get()->GetJSContextStack();
-
-    JSContext *topJSContext = stack->Peek();
-    NS_ASSERTION(cx == topJSContext, "wrong context on XPCJSContextStack!");
-}
-#endif
-
 XPCWrappedNative*
 XPCCallContext::UnwrapThisIfAllowed(HandleObject obj, HandleObject fun, unsigned argc)
 {
     // We should only get here for objects that aren't safe to unwrap.
     MOZ_ASSERT(!js::CheckedUnwrap(obj));
     MOZ_ASSERT(js::IsObjectInContextCompartment(obj, mJSContext));
 
     // We can't do anything here without a function.
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -1569,26 +1569,19 @@ nsXPCComponents_ID::CallOrConstruct(nsIX
                                     JSContext *cx, HandleObject obj,
                                     const CallArgs &args, bool *_retval)
 {
     // make sure we have at least one arg
 
     if (args.length() < 1)
         return ThrowAndFail(NS_ERROR_XPC_NOT_ENOUGH_ARGS, cx, _retval);
 
-    XPCCallContext ccx(JS_CALLER, cx);
-    if (!ccx.IsValid())
-        return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
-
-    XPCContext* xpcc = ccx.GetXPCContext();
-
     // Do the security check if necessary
 
-    nsIXPCSecurityManager* sm =
-            xpcc->GetAppropriateSecurityManager(nsIXPCSecurityManager::HOOK_CREATE_INSTANCE);
+    nsIXPCSecurityManager* sm = nsXPConnect::XPConnect()->GetDefaultSecurityManager();
     if (sm && NS_FAILED(sm->CanCreateInstance(cx, nsJSID::GetCID()))) {
         // the security manager vetoed. It should have set an exception.
         *_retval = false;
         return NS_OK;
     }
 
     // convert the first argument into a string and see if it looks like an id
 
@@ -1939,27 +1932,21 @@ struct MOZ_STACK_CLASS ExceptionArgParse
 };
 
 // static
 nsresult
 nsXPCComponents_Exception::CallOrConstruct(nsIXPConnectWrappedNative *wrapper,
                                            JSContext *cx, HandleObject obj,
                                            const CallArgs &args, bool *_retval)
 {
-    XPCCallContext ccx(JS_CALLER, cx);
-    if (!ccx.IsValid())
-        return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
-
     nsXPConnect* xpc = nsXPConnect::XPConnect();
-    XPCContext* xpcc = ccx.GetXPCContext();
 
     // Do the security check if necessary
 
-    nsIXPCSecurityManager* sm =
-            xpcc->GetAppropriateSecurityManager(nsIXPCSecurityManager::HOOK_CREATE_INSTANCE);
+    nsIXPCSecurityManager* sm = xpc->GetDefaultSecurityManager();
     if (sm && NS_FAILED(sm->CanCreateInstance(cx, nsXPCException::GetCID()))) {
         // the security manager vetoed. It should have set an exception.
         *_retval = false;
         return NS_OK;
     }
 
     // Parse the arguments to the Exception constructor.
     ExceptionArgParser parser(cx, xpc);
@@ -2214,20 +2201,16 @@ nsXPCConstructor::Construct(nsIXPConnect
     return CallOrConstruct(wrapper, cx, obj, args, _retval);
 }
 
 // static
 nsresult
 nsXPCConstructor::CallOrConstruct(nsIXPConnectWrappedNative *wrapper,JSContext *cx,
                                   HandleObject obj, const CallArgs &args, bool *_retval)
 {
-    XPCCallContext ccx(JS_CALLER, cx);
-    if (!ccx.IsValid())
-        return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
-
     nsXPConnect* xpc = nsXPConnect::XPConnect();
 
     // security check not required because we are going to call through the
     // code which is reflected into JS which will do that for us later.
 
     nsCOMPtr<nsIXPConnectJSObjectHolder> cidHolder;
     nsCOMPtr<nsIXPConnectJSObjectHolder> iidHolder;
     RootedObject cidObj(cx);
@@ -2448,32 +2431,26 @@ nsXPCComponents_Constructor::CallOrConst
 {
     // make sure we have at least one arg
 
     if (args.length() < 1)
         return ThrowAndFail(NS_ERROR_XPC_NOT_ENOUGH_ARGS, cx, _retval);
 
     // get the various other object pointers we need
 
-    XPCCallContext ccx(JS_CALLER, cx);
-    if (!ccx.IsValid())
-        return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
-
     nsXPConnect* xpc = nsXPConnect::XPConnect();
-    XPCContext* xpcc = ccx.GetXPCContext();
     XPCWrappedNativeScope* scope = GetObjectScope(obj);
     nsXPCComponents* comp;
 
-    if (!xpc || !xpcc || !scope || !(comp = scope->GetComponents()))
+    if (!xpc || !scope || !(comp = scope->GetComponents()))
         return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
 
     // Do the security check if necessary
 
-    nsIXPCSecurityManager* sm =
-            xpcc->GetAppropriateSecurityManager(nsIXPCSecurityManager::HOOK_CREATE_INSTANCE);
+    nsIXPCSecurityManager* sm = xpc->GetDefaultSecurityManager();
     if (sm && NS_FAILED(sm->CanCreateInstance(cx, nsXPCConstructor::GetCID()))) {
         // the security manager vetoed. It should have set an exception.
         *_retval = false;
         return NS_OK;
     }
 
     // initialization params for the Constructor object we will create
     nsCOMPtr<nsIJSCID> cClassID;
@@ -3356,27 +3333,23 @@ xpc_CreateSandboxObject(JSContext *cx, j
         }
 
         nsCOMPtr<nsIScriptObjectPrincipal> sbp =
             new SandboxPrivate(principal, sandbox);
 
         // Pass on ownership of sbp to |sandbox|.
         JS_SetPrivate(sandbox, sbp.forget().get());
 
-        XPCCallContext ccx(NATIVE_CALLER, cx);
-        if (!ccx.IsValid())
-            return NS_ERROR_XPC_UNEXPECTED;
-
         {
-          JSAutoCompartment ac(ccx, sandbox);
+          JSAutoCompartment ac(cx, sandbox);
           if (options.wantComponents &&
-              !nsXPCComponents::AttachComponentsObject(ccx, GetObjectScope(sandbox)))
+              !nsXPCComponents::AttachComponentsObject(cx, GetObjectScope(sandbox)))
               return NS_ERROR_XPC_UNEXPECTED;
 
-          if (!XPCNativeWrapper::AttachNewConstructorObject(ccx, sandbox))
+          if (!XPCNativeWrapper::AttachNewConstructorObject(cx, sandbox))
               return NS_ERROR_XPC_UNEXPECTED;
         }
 
         if (!JS_DefineFunctions(cx, sandbox, SandboxFunctions))
             return NS_ERROR_XPC_UNEXPECTED;
 
         if (options.wantXHRConstructor &&
             !JS_DefineFunction(cx, sandbox, "XMLHttpRequest", CreateXMLHttpRequest, 0, JSFUN_CONSTRUCTOR))
@@ -4368,18 +4341,17 @@ nsXPCComponents_Utils::SetWantXrays(cons
 NS_IMETHODIMP
 nsXPCComponents_Utils::GetComponentsForScope(const jsval &vscope, JSContext *cx,
                                              jsval *rval)
 {
     if (!vscope.isObject())
         return NS_ERROR_INVALID_ARG;
     JSObject *scopeObj = js::UncheckedUnwrap(&vscope.toObject());
     XPCWrappedNativeScope *scope = GetObjectScope(scopeObj);
-    XPCCallContext ccx(NATIVE_CALLER, cx);
-    JSObject *components = scope->GetComponentsJSObject(ccx);
+    JSObject *components = scope->GetComponentsJSObject();
     if (!components)
         return NS_ERROR_FAILURE;
     *rval = ObjectValue(*components);
     if (!JS_WrapValue(cx, rval))
         return NS_ERROR_FAILURE;
     return NS_OK;
 }
 
@@ -4884,30 +4856,30 @@ ContentComponentsGetterOp(JSContext *cx,
             doc->WarnOnceAbout(nsIDocument::eComponents, /* asError = */ true);
     }
 
     return true;
 }
 
 // static
 JSBool
-nsXPCComponents::AttachComponentsObject(XPCCallContext& ccx,
+nsXPCComponents::AttachComponentsObject(JSContext* aCx,
                                         XPCWrappedNativeScope* aScope)
 {
-    RootedObject components(ccx, aScope->GetComponentsJSObject(ccx));
+    RootedObject components(aCx, aScope->GetComponentsJSObject());
     if (!components)
         return false;
 
-    RootedObject global(ccx, aScope->GetGlobalJSObject());
-    MOZ_ASSERT(js::IsObjectInContextCompartment(global, ccx));
-
-    RootedId id(ccx, ccx.GetRuntime()->GetStringID(XPCJSRuntime::IDX_COMPONENTS));
+    RootedObject global(aCx, aScope->GetGlobalJSObject());
+    MOZ_ASSERT(js::IsObjectInContextCompartment(global, aCx));
+
+    RootedId id(aCx, XPCJSRuntime::Get()->GetStringID(XPCJSRuntime::IDX_COMPONENTS));
     JSPropertyOp getter = AccessCheck::isChrome(global) ? nullptr
                                                         : &ContentComponentsGetterOp;
-    return JS_DefinePropertyById(ccx, global, id, js::ObjectValue(*components),
+    return JS_DefinePropertyById(aCx, global, id, js::ObjectValue(*components),
                                  getter, nullptr, JSPROP_PERMANENT | JSPROP_READONLY);
 }
 
 /* void lookupMethod (); */
 NS_IMETHODIMP
 nsXPCComponents::LookupMethod(const JS::Value& object,
                               const JS::Value& name,
                               JSContext *cx,
--- a/js/xpconnect/src/XPCContext.cpp
+++ b/js/xpconnect/src/XPCContext.cpp
@@ -13,36 +13,33 @@
 /***************************************************************************/
 
 XPCContext::XPCContext(XPCJSRuntime* aRuntime,
                        JSContext* aJSContext)
     :   mRuntime(aRuntime),
         mJSContext(aJSContext),
         mLastResult(NS_OK),
         mPendingResult(NS_OK),
-        mSecurityManager(nullptr),
         mException(nullptr),
-        mCallingLangType(LANG_UNKNOWN),
-        mSecurityManagerFlags(0)
+        mCallingLangType(LANG_UNKNOWN)
 {
     MOZ_COUNT_CTOR(XPCContext);
 
     PR_INIT_CLIST(&mScopes);
 
     NS_ASSERTION(!JS_GetSecondContextPrivate(mJSContext), "Must be null");
     JS_SetSecondContextPrivate(mJSContext, this);
 }
 
 XPCContext::~XPCContext()
 {
     MOZ_COUNT_DTOR(XPCContext);
     NS_ASSERTION(JS_GetSecondContextPrivate(mJSContext) == this, "Must match this");
     JS_SetSecondContextPrivate(mJSContext, nullptr);
     NS_IF_RELEASE(mException);
-    NS_IF_RELEASE(mSecurityManager);
 
     // Iterate over our scopes and tell them that we have been destroyed
     for (PRCList *scopeptr = PR_NEXT_LINK(&mScopes);
          scopeptr != &mScopes;
          scopeptr = PR_NEXT_LINK(scopeptr)) {
         XPCWrappedNativeScope *scope =
             static_cast<XPCWrappedNativeScope*>(scopeptr);
         scope->ClearContext();
@@ -55,19 +52,16 @@ XPCContext::DebugDump(int16_t depth)
 #ifdef DEBUG
     depth--;
     XPC_LOG_ALWAYS(("XPCContext @ %x", this));
         XPC_LOG_INDENT();
         XPC_LOG_ALWAYS(("mRuntime @ %x", mRuntime));
         XPC_LOG_ALWAYS(("mJSContext @ %x", mJSContext));
         XPC_LOG_ALWAYS(("mLastResult of %x", mLastResult));
         XPC_LOG_ALWAYS(("mPendingResult of %x", mPendingResult));
-        XPC_LOG_ALWAYS(("mSecurityManager @ %x", mSecurityManager));
-        XPC_LOG_ALWAYS(("mSecurityManagerFlags of %x", mSecurityManagerFlags));
-
         XPC_LOG_ALWAYS(("mException @ %x", mException));
         if (depth && mException) {
             // XXX show the exception here...
         }
 
         XPC_LOG_ALWAYS(("mCallingLangType of %s",
                         mCallingLangType == LANG_UNKNOWN ? "LANG_UNKNOWN" :
                         mCallingLangType == LANG_JS      ? "LANG_JS" :
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -79,23 +79,23 @@ XPCConvert::GetISupportsFromJSObject(JSO
     *iface = UnwrapDOMObjectToISupports(obj);
     return !!*iface;
 }
 
 /***************************************************************************/
 
 // static
 JSBool
-XPCConvert::NativeData2JS(XPCLazyCallContext& lccx, jsval* d, const void* s,
+XPCConvert::NativeData2JS(jsval* d, const void* s,
                           const nsXPTType& type, const nsID* iid, nsresult* pErr)
 {
     NS_PRECONDITION(s, "bad param");
     NS_PRECONDITION(d, "bad param");
 
-   JSContext* cx = lccx.GetJSContext();
+    AutoJSContext cx;
     if (pErr)
         *pErr = NS_ERROR_XPC_BAD_CONVERT_NATIVE;
 
     switch (type.TagPart()) {
     case nsXPTType::T_I8    : *d = INT_TO_JSVAL(int32_t(*((int8_t*)s)));             break;
     case nsXPTType::T_I16   : *d = INT_TO_JSVAL(int32_t(*((int16_t*)s)));            break;
     case nsXPTType::T_I32   : *d = INT_TO_JSVAL(*((int32_t*)s));                     break;
     case nsXPTType::T_I64   : *d = DOUBLE_TO_JSVAL(double(*((int64_t*)s)));          break;
@@ -306,22 +306,22 @@ XPCConvert::NativeData2JS(XPCLazyCallCon
             {
                 nsISupports* iface = *((nsISupports**)s);
                 if (iface) {
                     if (iid->Equals(NS_GET_IID(nsIVariant))) {
                         nsCOMPtr<nsIVariant> variant = do_QueryInterface(iface);
                         if (!variant)
                             return false;
 
-                        return XPCVariant::VariantDataToJS(lccx, variant,
+                        return XPCVariant::VariantDataToJS(variant,
                                                            pErr, d);
                     }
                     // else...
                     xpcObjectHelper helper(iface);
-                    if (!NativeInterface2JSObject(lccx, d, nullptr, helper, iid,
+                    if (!NativeInterface2JSObject(d, nullptr, helper, iid,
                                                   nullptr, true, pErr))
                         return false;
 
 #ifdef DEBUG
                     JSObject* jsobj = JSVAL_TO_OBJECT(*d);
                     if (jsobj && !js::GetObjectParent(jsobj))
                         NS_ASSERTION(js::GetObjectClass(jsobj)->flags & JSCLASS_IS_GLOBAL,
                                      "Why did we recreate this wrapper?");
@@ -360,25 +360,26 @@ CheckJSCharInCharRange(jschar c)
 template<typename T>
 bool ConvertToPrimitive(JSContext *cx, HandleValue v, T *retval)
 {
     return ValueToPrimitive<T, eDefault>(cx, v, retval);
 }
 
 // static
 JSBool
-XPCConvert::JSData2Native(JSContext* cx, void* d, HandleValue s,
+XPCConvert::JSData2Native(void* d, HandleValue s,
                           const nsXPTType& type,
                           JSBool useAllocator, const nsID* iid,
                           nsresult* pErr)
 {
     NS_PRECONDITION(d, "bad param");
 
     JSBool isDOMString = true;
 
+    AutoJSContext cx;
     if (pErr)
         *pErr = NS_ERROR_XPC_BAD_CONVERT_JS;
 
     switch (type.TagPart()) {
     case nsXPTType::T_I8     :
         return ConvertToPrimitive(cx, s, static_cast<int8_t*>(d));
     case nsXPTType::T_I16    :
         return ConvertToPrimitive(cx, s, static_cast<int16_t*>(d));
@@ -744,47 +745,46 @@ XPCConvert::JSData2Native(JSContext* cx,
         // only wrap JSObjects
         if (!s.isObject()) {
             if (pErr && s.isInt32() && 0 == s.toInt32())
                 *pErr = NS_ERROR_XPC_BAD_CONVERT_JS_ZERO_ISNOT_NULL;
             return false;
         }
 
         RootedObject src(cx, &s.toObject());
-        return JSObject2NativeInterface(cx, (void**)d, src, iid, nullptr, pErr);
+        return JSObject2NativeInterface((void**)d, src, iid, nullptr, pErr);
     }
     default:
         NS_ERROR("bad type");
         return false;
     }
     return true;
 }
 
 inline JSBool
-CreateHolderIfNeeded(XPCCallContext& ccx, HandleObject obj, jsval* d,
+CreateHolderIfNeeded(HandleObject obj, jsval* d,
                      nsIXPConnectJSObjectHolder** dest)
 {
     if (dest) {
-        XPCJSObjectHolder* objHolder = XPCJSObjectHolder::newHolder(ccx, obj);
+        XPCJSObjectHolder* objHolder = XPCJSObjectHolder::newHolder(obj);
         if (!objHolder)
             return false;
 
         NS_ADDREF(*dest = objHolder);
     }
 
     *d = OBJECT_TO_JSVAL(obj);
 
     return true;
 }
 
 /***************************************************************************/
 // static
 JSBool
-XPCConvert::NativeInterface2JSObject(XPCLazyCallContext& lccx,
-                                     jsval* d,
+XPCConvert::NativeInterface2JSObject(jsval* d,
                                      nsIXPConnectJSObjectHolder** dest,
                                      xpcObjectHelper& aHelper,
                                      const nsID* iid,
                                      XPCNativeInterface** Interface,
                                      bool allowNativeWrapper,
                                      nsresult* pErr)
 {
     NS_ASSERTION(!Interface || iid,
@@ -801,17 +801,17 @@ XPCConvert::NativeInterface2JSObject(XPC
 
     // We used to have code here that unwrapped and simply exposed the
     // underlying JSObject. That caused anomolies when JSComponents were
     // accessed from other JS code - they didn't act like other xpconnect
     // wrapped components. So, instead, we create "double wrapped" objects
     // (that means an XPCWrappedNative around an nsXPCWrappedJS). This isn't
     // optimal -- we could detect this and roll the functionality into a
     // single wrapper, but the current solution is good enough for now.
-    JSContext* cx = lccx.GetJSContext();
+    AutoJSContext cx;
     XPCWrappedNativeScope* xpcscope = GetObjectScope(JS_GetGlobalForScopeChain(cx));
     if (!xpcscope)
         return false;
 
     // First, see if this object supports the wrapper cache.
     // Note: If |cache->IsProxy()| is true, then it means that the object
     // implementing it doesn't want a wrapped native as its JS Object, but
     // instead it provides its own proxy object. In that case, the object
@@ -819,32 +819,29 @@ XPCConvert::NativeInterface2JSObject(XPC
     // object will create (and fill the cache) from its WrapObject call.
     nsWrapperCache *cache = aHelper.GetWrapperCache();
 
     bool tryConstructSlimWrapper = false;
     RootedObject flat(cx);
     if (cache) {
         flat = cache->GetWrapper();
         if (cache->IsDOMBinding()) {
-            XPCCallContext &ccx = lccx.GetXPCCallContext();
-            if (!ccx.IsValid())
-                return false;
 
             if (!flat) {
                 JS::Rooted<JSObject*> global(cx, xpcscope->GetGlobalJSObject());
                 flat = cache->WrapObject(cx, global);
                 if (!flat)
                     return false;
             }
 
             if (flat) {
-                if (allowNativeWrapper && !JS_WrapObject(ccx, flat.address()))
+                if (allowNativeWrapper && !JS_WrapObject(cx, flat.address()))
                     return false;
 
-                return CreateHolderIfNeeded(ccx, flat, d, dest);
+                return CreateHolderIfNeeded(flat, d, dest);
             }
         }
 
         if (!dest) {
             if (!flat) {
                 tryConstructSlimWrapper = true;
             } else if (IS_SLIM_WRAPPER_OBJECT(flat)) {
                 if (js::IsObjectInContextCompartment(flat, cx)) {
@@ -855,95 +852,84 @@ XPCConvert::NativeInterface2JSObject(XPC
         }
     } else {
         flat = nullptr;
     }
 
     // If we're not handing this wrapper to an nsIXPConnectJSObjectHolder, and
     // the object supports slim wrappers, try to create one here.
     if (tryConstructSlimWrapper) {
-        XPCCallContext &ccx = lccx.GetXPCCallContext();
-        if (!ccx.IsValid())
-            return false;
-
         RootedValue slim(cx);
-        if (ConstructSlimWrapper(ccx, aHelper, xpcscope, &slim)) {
+        if (ConstructSlimWrapper(aHelper, xpcscope, &slim)) {
             *d = slim;
             return true;
         }
 
         if (JS_IsExceptionPending(cx))
             return false;
 
         // Even if ConstructSlimWrapper returns false it might have created a
         // wrapper (while calling the PreCreate hook). In that case we need to
         // fall through because we either have a slim wrapper that needs to be
         // morphed or an XPCWrappedNative.
         flat = cache->GetWrapper();
     }
 
-    XPCCallContext &ccx = lccx.GetXPCCallContext();
-    if (!ccx.IsValid())
-        return false;
-
     // We can't simply construct a slim wrapper. Go ahead and create an
     // XPCWrappedNative for this object. At this point, |flat| could be
     // non-null, meaning that either we already have a wrapped native from
     // the cache (which might need to be QI'd to the new interface) or that
     // we found a slim wrapper that we'll have to morph.
-    AutoMarkingNativeInterfacePtr iface(ccx);
+    AutoMarkingNativeInterfacePtr iface(cx);
     if (iid) {
         if (Interface)
             iface = *Interface;
 
         if (!iface) {
-            iface = XPCNativeInterface::GetNewOrUsed(ccx, iid);
+            iface = XPCNativeInterface::GetNewOrUsed(iid);
             if (!iface)
                 return false;
 
             if (Interface)
                 *Interface = iface;
         }
     }
 
     NS_ASSERTION(!flat || IS_WRAPPER_CLASS(js::GetObjectClass(flat)),
                  "What kind of wrapper is this?");
 
     nsresult rv;
     XPCWrappedNative* wrapper;
     nsRefPtr<XPCWrappedNative> strongWrapper;
     if (!flat) {
-        rv = XPCWrappedNative::GetNewOrUsed(ccx, aHelper, xpcscope, iface,
+        rv = XPCWrappedNative::GetNewOrUsed(aHelper, xpcscope, iface,
                                             getter_AddRefs(strongWrapper));
 
         wrapper = strongWrapper;
     } else if (IS_WN_WRAPPER_OBJECT(flat)) {
         wrapper = static_cast<XPCWrappedNative*>(xpc_GetJSPrivate(flat));
 
         // If asked to return the wrapper we'll return a strong reference,
         // otherwise we'll just return its JSObject in d (which should be
         // rooted in that case).
         if (dest)
             strongWrapper = wrapper;
-        // If iface is not null we know lccx.GetXPCCallContext() returns
-        // a valid XPCCallContext because we checked when calling Init on
-        // iface.
         if (iface)
-            wrapper->FindTearOff(ccx, iface, false, &rv);
+            wrapper->FindTearOff(iface, false, &rv);
         else
             rv = NS_OK;
     } else {
         NS_ASSERTION(IS_SLIM_WRAPPER(flat),
                      "What kind of wrapper is this?");
 
         SLIM_LOG(("***** morphing from XPCConvert::NativeInterface2JSObject"
                   "(%p)\n",
                   static_cast<nsISupports*>(xpc_GetJSPrivate(flat))));
 
-        rv = XPCWrappedNative::Morph(ccx, flat, iface, cache,
+        rv = XPCWrappedNative::Morph(flat, iface, cache,
                                      getter_AddRefs(strongWrapper));
         wrapper = strongWrapper;
     }
 
     if (NS_FAILED(rv) && pErr)
         *pErr = rv;
 
     // If creating the wrapped native failed, then return early.
@@ -961,28 +947,28 @@ XPCConvert::NativeInterface2JSObject(XPC
         if (pErr)
             *pErr = NS_OK;
         return true;
     }
 
     // The call to wrap here handles both cross-compartment and same-compartment
     // security wrappers.
     RootedObject original(cx, flat);
-    if (!JS_WrapObject(ccx, flat.address()))
+    if (!JS_WrapObject(cx, flat.address()))
         return false;
 
     *d = OBJECT_TO_JSVAL(flat);
 
     if (dest) {
         // The strongWrapper still holds the original flat object.
         if (flat == original) {
             *dest = strongWrapper.forget().get();
         } else {
             nsRefPtr<XPCJSObjectHolder> objHolder =
-                XPCJSObjectHolder::newHolder(ccx, flat);
+                XPCJSObjectHolder::newHolder(flat);
             if (!objHolder)
                 return false;
 
             *dest = objHolder.forget().get();
         }
     }
 
     if (pErr)
@@ -990,26 +976,26 @@ XPCConvert::NativeInterface2JSObject(XPC
 
     return true;
 }
 
 /***************************************************************************/
 
 // static
 JSBool
-XPCConvert::JSObject2NativeInterface(JSContext* cx,
-                                     void** dest, HandleObject src,
+XPCConvert::JSObject2NativeInterface(void** dest, HandleObject src,
                                      const nsID* iid,
                                      nsISupports* aOuter,
                                      nsresult* pErr)
 {
     NS_ASSERTION(dest, "bad param");
     NS_ASSERTION(src, "bad param");
     NS_ASSERTION(iid, "bad param");
 
+    AutoJSContext cx;
     JSAutoCompartment ac(cx, src);
 
     *dest = nullptr;
      if (pErr)
         *pErr = NS_ERROR_XPC_BAD_CONVERT_JS;
 
     nsISupports* iface;
 
@@ -1054,17 +1040,17 @@ XPCConvert::JSObject2NativeInterface(JSC
 
             return false;
         }
     }
 
     // else...
 
     nsXPCWrappedJS* wrapper;
-    nsresult rv = nsXPCWrappedJS::GetNewOrUsed(cx, src, *iid, aOuter, &wrapper);
+    nsresult rv = nsXPCWrappedJS::GetNewOrUsed(src, *iid, aOuter, &wrapper);
     if (pErr)
         *pErr = rv;
     if (NS_SUCCEEDED(rv) && wrapper) {
         // We need to go through the QueryInterface logic to make this return
         // the right thing for the various 'special' interfaces; e.g.
         // nsIPropertyBag. We must use AggregatedQueryInterface in cases where
         // there is an outer to avoid nasty recursion.
         rv = aOuter ? wrapper->AggregatedQueryInterface(*iid, dest) :
@@ -1143,23 +1129,22 @@ public:
 
 private:
     JSContext * const mContext;
     RootedValue tvr;
 };
 
 // static
 nsresult
-XPCConvert::JSValToXPCException(XPCCallContext& ccx,
-                                jsval sArg,
+XPCConvert::JSValToXPCException(jsval sArg,
                                 const char* ifaceName,
                                 const char* methodName,
                                 nsIException** exceptn)
 {
-    JSContext* cx = ccx.GetJSContext();
+    AutoJSContext cx;
     RootedValue s(cx, sArg);
     AutoExceptionRestorer aer(cx, s);
 
     if (!JSVAL_IS_PRIMITIVE(s)) {
         // we have a JSObject
         RootedObject obj(cx, JSVAL_TO_OBJECT(s));
 
         if (!obj) {
@@ -1194,17 +1179,17 @@ XPCConvert::JSValToXPCException(XPCCallC
             // If it is an engine Error with an error report then let's
             // extract the report and build an xpcexception from that
             const JSErrorReport* report;
             if (nullptr != (report = JS_ErrorFromException(cx, s))) {
                 JSAutoByteString message;
                 JSString* str;
                 if (nullptr != (str = JS_ValueToString(cx, s)))
                     message.encodeLatin1(cx, str);
-                return JSErrorToXPCException(ccx, message.ptr(), ifaceName,
+                return JSErrorToXPCException(message.ptr(), ifaceName,
                                              methodName, report, exceptn);
             }
 
 
             unsigned ignored;
             JSBool found;
 
             // heuristic to see if it might be usable as an xpcexception
@@ -1213,18 +1198,17 @@ XPCConvert::JSValToXPCException(XPCCallC
 
             if (found && !JS_GetPropertyAttributes(cx, obj, "result", &ignored, &found))
                 return NS_ERROR_FAILURE;
 
             if (found) {
                 // lets try to build a wrapper around the JSObject
                 nsXPCWrappedJS* jswrapper;
                 nsresult rv =
-                    nsXPCWrappedJS::GetNewOrUsed(ccx, obj,
-                                                 NS_GET_IID(nsIException),
+                    nsXPCWrappedJS::GetNewOrUsed(obj, NS_GET_IID(nsIException),
                                                  nullptr, &jswrapper);
                 if (NS_FAILED(rv))
                     return rv;
 
                 *exceptn = static_cast<nsIException *>(jswrapper->GetXPTCStub());
                 return NS_OK;
             }
 
@@ -1318,23 +1302,23 @@ XPCConvert::JSValToXPCException(XPCCallC
     }
     return NS_ERROR_FAILURE;
 }
 
 /********************************/
 
 // static
 nsresult
-XPCConvert::JSErrorToXPCException(XPCCallContext& ccx,
-                                  const char* message,
+XPCConvert::JSErrorToXPCException(const char* message,
                                   const char* ifaceName,
                                   const char* methodName,
                                   const JSErrorReport* report,
                                   nsIException** exceptn)
 {
+    AutoJSContext cx;
     nsresult rv = NS_ERROR_FAILURE;
     nsRefPtr<nsScriptError> data;
     if (report) {
         nsAutoString bestMessage;
         if (report && report->ucmessage) {
             bestMessage = static_cast<const PRUnichar*>(report->ucmessage);
         } else if (message) {
             CopyASCIItoUTF16(message, bestMessage);
@@ -1348,17 +1332,17 @@ XPCConvert::JSErrorToXPCException(XPCCal
         data = new nsScriptError();
         data->InitWithWindowID(
             bestMessage,
             NS_ConvertASCIItoUTF16(report->filename),
             uclinebuf ? nsDependentString(uclinebuf) : EmptyString(),
             report->lineno,
             report->uctokenptr - report->uclinebuf, report->flags,
             "XPConnect JavaScript",
-            nsJSUtils::GetCurrentlyRunningCodeInnerWindowID(ccx.GetJSContext()));
+            nsJSUtils::GetCurrentlyRunningCodeInnerWindowID(cx));
     }
 
     if (data) {
         nsAutoCString formattedMsg;
         data->ToString(formattedMsg);
 
         rv = ConstructException(NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS,
                                 formattedMsg.get(), ifaceName, methodName,
@@ -1377,29 +1361,24 @@ XPCConvert::JSErrorToXPCException(XPCCal
 // array fun...
 
 #ifdef POPULATE
 #undef POPULATE
 #endif
 
 // static
 JSBool
-XPCConvert::NativeArray2JS(XPCLazyCallContext& lccx,
-                           jsval* d, const void** s,
+XPCConvert::NativeArray2JS(jsval* d, const void** s,
                            const nsXPTType& type, const nsID* iid,
                            uint32_t count, nsresult* pErr)
 {
     NS_PRECONDITION(s, "bad param");
     NS_PRECONDITION(d, "bad param");
 
-    XPCCallContext& ccx = lccx.GetXPCCallContext();
-    if (!ccx.IsValid())
-        return false;
-
-