--- a/browser/base/content/test/static/browser_all_files_referenced.js
+++ b/browser/base/content/test/static/browser_all_files_referenced.js
@@ -46,17 +46,16 @@ var whitelist = [
   // browser/extensions/pdfjs/content/PdfStreamConverter.jsm
   {file: "chrome://pdf.js/locale/chrome.properties"},
   {file: "chrome://pdf.js/locale/viewer.properties"},
 
   // security/manager/pki/resources/content/device_manager.js
   {file: "chrome://pippki/content/load_device.xul"},
 
   // Add-on compat
-  {file: "chrome://global/content/XPCNativeWrapper.js"},
   {file: "chrome://global/locale/brand.dtd"},
 
   // The l10n build system can't package string files only for some platforms.
   // See bug 1339424 for why this is hard to fix.
   {file: "chrome://global/locale/fallbackMenubar.properties",
    platforms: ["linux", "win"]},
   {file: "chrome://global/locale/printPageSetup.dtd", platforms: ["macosx"]},
   {file: "chrome://global/locale/printPreviewProgress.dtd",

--- a/devtools/client/debugger/new/README.mozilla
+++ b/devtools/client/debugger/new/README.mozilla
@@ -1,13 +1,13 @@
 This is the debugger.html project output.
 See https://github.com/devtools-html/debugger.html
 
-Version 28.0
+Version 29.0
 
-Comparison: https://github.com/devtools-html/debugger.html/compare/release-28...release-27
+Comparison: https://github.com/devtools-html/debugger.html/compare/release-28...release-29
 
 Packages:
 - babel-plugin-transform-es2015-modules-commonjs @6.26.0
 - babel-preset-react @6.24.1
 - react @16.2.0
 - react-dom @16.2.0
 - webpack @3.11.0

--- a/devtools/client/debugger/new/debugger.css
+++ b/devtools/client/debugger/new/debugger.css
@@ -1213,16 +1213,17 @@ html[dir="rtl"] .tree-node img.arrow {
   flex: 1;
   overflow-x: auto;
   overflow-y: auto;
 }
 
 .sources-list {
   flex: 1;
   display: flex;
+  overflow: hidden;
 }
 
 .sources-list .tree:focus {
   outline: none;
 }
 
 .sources-list .managed-tree {
   flex: 1;
@@ -3977,16 +3978,20 @@ html .welcomebox .toggle-button-end.coll
 }
 
 .result-list.big li {
   padding: 10px;
   flex-direction: row;
   border-bottom: 1px solid var(--theme-splitter-color);
 }
 
+.result-list.small li {
+  justify-content: space-between;
+}
+
 .result-list li:hover {
   background: var(--theme-tab-toolbar-background);
 }
 
 .result-list li.selected {
   background: var(--accordion-header-background);
 }
 

--- a/devtools/client/debugger/new/debugger.js
+++ b/devtools/client/debugger/new/debugger.js
@@ -5400,25 +5400,27 @@ var _extends = Object.assign || function
 /* eslint complexity: ["error", 30]*/
 
 /**
  * Pause reducer
  * @module reducers/pause
  */
 
 exports.getPauseReason = getPauseReason;
+exports.getPauseCommand = getPauseCommand;
 exports.isStepping = isStepping;
 exports.isPaused = isPaused;
 exports.getPreviousPauseFrameLocation = getPreviousPauseFrameLocation;
 exports.isEvaluatingExpression = isEvaluatingExpression;
 exports.getPopupObjectProperties = getPopupObjectProperties;
 exports.getIsWaitingOnBreak = getIsWaitingOnBreak;
 exports.getShouldPauseOnExceptions = getShouldPauseOnExceptions;
 exports.getShouldIgnoreCaughtExceptions = getShouldIgnoreCaughtExceptions;
 exports.getCanRewind = getCanRewind;
+exports.getExtra = getExtra;
 exports.getFrames = getFrames;
 exports.getGeneratedFrameScope = getGeneratedFrameScope;
 exports.getOriginalFrameScope = getOriginalFrameScope;
 exports.getFrameScopes = getFrameScopes;
 exports.getFrameScope = getFrameScope;
 exports.getSelectedScope = getSelectedScope;
 exports.getSelectedScopeMappings = getSelectedScopeMappings;
 exports.getSelectedFrameId = getSelectedFrameId;
@@ -5430,31 +5432,32 @@ var _reselect = __webpack_require__(993)
 
 var _devtoolsSourceMap = __webpack_require__(1360);
 
 var _prefs = __webpack_require__(226);
 
 var _sources = __webpack_require__(1369);
 
 const createPauseState = exports.createPauseState = () => ({
+  extra: {},
   why: null,
   isWaitingOnBreak: false,
   frames: undefined,
   selectedFrameId: undefined,
   frameScopes: {
     generated: {},
     original: {},
     mappings: {}
   },
   loadedObjects: {},
   shouldPauseOnExceptions: _prefs.prefs.pauseOnExceptions,
   shouldIgnoreCaughtExceptions: _prefs.prefs.ignoreCaughtExceptions,
   canRewind: false,
   debuggeeUrl: "",
-  command: "",
+  command: null,
   previousLocation: null
 });
 
 const emptyPauseState = {
   pause: null,
   frames: null,
   frameScopes: {
     generated: {},
@@ -5490,26 +5493,27 @@ function update(state = createPauseState
 
     case "MAP_FRAMES":
       {
         return _extends({}, state, { frames: action.frames });
       }
 
     case "ADD_SCOPES":
       {
-        const { frame, status, value } = action;
+        const { frame, extra, status, value } = action;
         const selectedFrameId = frame.id;
 
         const generated = _extends({}, state.frameScopes.generated, {
           [selectedFrameId]: {
             pending: status !== "done",
             scope: value
           }
         });
         return _extends({}, state, {
+          extra: extra,
           frameScopes: _extends({}, state.frameScopes, {
             generated
           })
         });
       }
 
     case "TRAVEL_TO":
       return _extends({}, state, action.data.paused);
@@ -5573,27 +5577,27 @@ function update(state = createPauseState
         shouldIgnoreCaughtExceptions
       });
 
     case "COMMAND":
       {
         return action.status === "start" ? _extends({}, state, emptyPauseState, {
           command: action.command,
           previousLocation: buildPreviousLocation(state, action)
-        }) : _extends({}, state, { command: "" });
+        }) : _extends({}, state, { command: null });
       }
 
     case "RESUME":
       // We clear why on resume because we need it to decide if
       // we shoul re-evaluate watch expressions.
       return _extends({}, state, { why: null });
 
     case "EVALUATE_EXPRESSION":
       return _extends({}, state, {
-        command: action.status === "start" ? "expression" : ""
+        command: action.status === "start" ? "expression" : null
       });
 
     case "NAVIGATE":
       return _extends({}, state, emptyPauseState, { debuggeeUrl: action.url });
   }
 
   return state;
 }
@@ -5630,18 +5634,22 @@ function buildPreviousLocation(state, ac
 const getPauseState = state => state.pause;
 
 const getAllPopupObjectProperties = exports.getAllPopupObjectProperties = (0, _reselect.createSelector)(getPauseState, pauseWrapper => pauseWrapper.loadedObjects);
 
 function getPauseReason(state) {
   return state.pause.why;
 }
 
+function getPauseCommand(state) {
+  return state.pause && state.pause.command;
+}
+
 function isStepping(state) {
-  return ["stepIn", "stepOver", "stepOut"].includes(state.pause.command);
+  return ["stepIn", "stepOver", "stepOut"].includes(getPauseCommand(state));
 }
 
 function isPaused(state) {
   return !!getFrames(state);
 }
 
 function getPreviousPauseFrameLocation(state) {
   return state.pause.previousLocation;
@@ -5666,16 +5674,20 @@ function getShouldPauseOnExceptions(stat
 function getShouldIgnoreCaughtExceptions(state) {
   return state.pause.shouldIgnoreCaughtExceptions;
 }
 
 function getCanRewind(state) {
   return state.pause.canRewind;
 }
 
+function getExtra(state) {
+  return state.pause.extra;
+}
+
 function getFrames(state) {
   return state.pause.frames;
 }
 
 function getGeneratedFrameScope(state, frameId) {
   if (!frameId) {
     return null;
   }
@@ -6383,57 +6395,61 @@ Object.defineProperty(exports, "__esModu
 });
 exports.setSourceMetaData = setSourceMetaData;
 exports.setSymbols = setSymbols;
 exports.setOutOfScopeLocations = setOutOfScopeLocations;
 exports.setPausePoints = setPausePoints;
 
 var _selectors = __webpack_require__(3590);
 
+var _pause = __webpack_require__(1639);
+
 var _setInScopeLines = __webpack_require__(1781);
 
 var _parser = __webpack_require__(1365);
 
 var _promise = __webpack_require__(1653);
 
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
-
 function setSourceMetaData(sourceId) {
   return async ({ dispatch, getState }) => {
     const source = (0, _selectors.getSource)(getState(), sourceId);
     if (!source || !source.text || source.isWasm) {
       return;
     }
 
     const framework = await (0, _parser.getFramework)(source.id);
     dispatch({
       type: "SET_SOURCE_METADATA",
       sourceId: source.id,
       sourceMetaData: {
         framework
       }
     });
   };
-}
+} /* This Source Code Form is subject to the terms of the Mozilla Public
+   * License, v. 2.0. If a copy of the MPL was not distributed with this
+   * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
 function setSymbols(sourceId) {
   return async ({ dispatch, getState }) => {
     const source = (0, _selectors.getSource)(getState(), sourceId);
     if (!source || !source.text || source.isWasm || (0, _selectors.hasSymbols)(getState(), source)) {
       return;
     }
 
     await dispatch({
       type: "SET_SYMBOLS",
       source: source.toJS(),
       [_promise.PROMISE]: (0, _parser.getSymbols)(source.id)
     });
 
+    if ((0, _selectors.isPaused)(getState())) {
+      await dispatch((0, _pause.mapFrames)());
+    }
+
     await dispatch(setPausePoints(sourceId));
     await dispatch(setSourceMetaData(sourceId));
   };
 }
 
 function setOutOfScopeLocations() {
   return async ({ dispatch, getState }) => {
     const location = (0, _selectors.getSelectedLocation)(getState());
@@ -7707,64 +7723,35 @@ module.exports = {
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.containsPosition = containsPosition;
-exports.findClosestScope = findClosestScope;
 exports.getASTLocation = getASTLocation;
 exports.findScopeByName = findScopeByName;
 
 var _parser = __webpack_require__(1365);
 
-function containsPosition(a, b) {
-  const startsBefore = a.start.line < b.line || a.start.line === b.line && a.start.column <= b.column;
-  const endsAfter = a.end.line > b.line || a.end.line === b.line && a.end.column >= b.column;
-
-  return startsBefore && endsAfter;
-} /* This Source Code Form is subject to the terms of the Mozilla Public
-   * License, v. 2.0. If a copy of the MPL was not distributed with this
-   * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
-
-function findClosestScope(functions, location) {
-  return functions.reduce((found, currNode) => {
-    if (currNode.name === "anonymous" || !containsPosition(currNode.location, {
-      line: location.line,
-      column: location.column || 0
-    })) {
-      return found;
-    }
-
-    if (!found) {
-      return currNode;
-    }
-
-    if (found.location.start.line > currNode.location.start.line) {
-      return found;
-    }
-    if (found.location.start.line === currNode.location.start.line && found.location.start.column > currNode.location.start.column) {
-      return found;
-    }
-
-    return currNode;
-  }, null);
-}
+var _ast = __webpack_require__(1638);
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
 function getASTLocation(source, symbols, location) {
   if (source.isWasm || !symbols || symbols.loading) {
     return { name: undefined, offset: location };
   }
 
   const functions = [...symbols.functions];
 
-  const scope = findClosestScope(functions, location);
+  const scope = (0, _ast.findClosestFunction)(functions, location);
   if (scope) {
     // we only record the line, but at some point we may
     // also do column offsets
     const line = location.line - scope.location.start.line;
     return {
       name: scope.name,
       offset: { line, column: undefined }
     };
@@ -21925,17 +21912,17 @@ var _reactRedux = __webpack_require__(35
 var _devtoolsContextmenu = __webpack_require__(1413);
 
 var _devtoolsSourceMap = __webpack_require__(1360);
 
 var _clipboard = __webpack_require__(1388);
 
 var _function = __webpack_require__(1597);
 
-var _astBreakpointLocation = __webpack_require__(1416);
+var _ast = __webpack_require__(1638);
 
 var _editor = __webpack_require__(1358);
 
 var _source = __webpack_require__(1356);
 
 var _selectors = __webpack_require__(3590);
 
 var _actions = __webpack_require__(1354);
@@ -22133,18 +22120,18 @@ const {
 
 exports.default = (0, _reactRedux.connect)(state => {
   const selectedSource = (0, _selectors.getSelectedSource)(state);
   return {
     selectedLocation: (0, _selectors.getSelectedLocation)(state),
     selectedSource,
     hasPrettyPrint: !!(0, _selectors.getPrettySource)(state, selectedSource.get("id")),
     contextMenu: (0, _selectors.getContextMenu)(state),
-    getFunctionText: line => (0, _function.findFunctionText)(line, selectedSource.toJS(), (0, _selectors.getSymbols)(state, selectedSource.toJS())),
-    getFunctionLocation: line => (0, _astBreakpointLocation.findClosestScope)((0, _selectors.getSymbols)(state, selectedSource.toJS()).functions, {
+    getFunctionText: line => (0, _function.findFunctionText)(line, selectedSource.toJS(), (0, _selectors.getSymbols)(state, selectedSource)),
+    getFunctionLocation: line => (0, _ast.findClosestFunction)((0, _selectors.getSymbols)(state, selectedSource).functions, {
       line,
       column: Infinity
     })
   };
 }, {
   addExpression,
   evaluateInConsole,
   flashLineRange,
@@ -22162,26 +22149,29 @@ exports.default = (0, _reactRedux.connec
 "use strict";
 
 
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.findFunctionText = findFunctionText;
 
-var _astBreakpointLocation = __webpack_require__(1416);
+var _ast = __webpack_require__(1638);
 
 var _indentation = __webpack_require__(1438);
 
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
 function findFunctionText(line, source, symbols) {
-  const func = (0, _astBreakpointLocation.findClosestScope)(symbols.functions, { line, column: Infinity });
+  const func = (0, _ast.findClosestFunction)(symbols.functions, {
+    line,
+    column: Infinity
+  });
   if (!func) {
     return null;
   }
 
   const { location: { start, end } } = func;
   const lines = source.text.split("\n");
   const firstLine = lines[start.line - 1].slice(start.column);
   const lastLine = lines[end.line - 1].slice(0, end.column);
@@ -22466,33 +22456,35 @@ var _CommandBar2 = _interopRequireDefaul
 var _UtilsBar = __webpack_require__(1609);
 
 var _UtilsBar2 = _interopRequireDefault(_UtilsBar);
 
 var _BreakpointsDropdown = __webpack_require__(1790);
 
 var _BreakpointsDropdown2 = _interopRequireDefault(_BreakpointsDropdown);
 
+var _FrameworkComponent = __webpack_require__(3623);
+
+var _FrameworkComponent2 = _interopRequireDefault(_FrameworkComponent);
+
 var _ChromeScopes = __webpack_require__(1610);
 
 var _ChromeScopes2 = _interopRequireDefault(_ChromeScopes);
 
 var _Scopes2 = __webpack_require__(1611);
 
 var _Scopes3 = _interopRequireDefault(_Scopes2);
 
 __webpack_require__(1342);
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
-
-const Scopes = _prefs.features.chromeScopes ? _ChromeScopes2.default : _Scopes3.default;
+const Scopes = _prefs.features.chromeScopes ? _ChromeScopes2.default : _Scopes3.default; /* This Source Code Form is subject to the terms of the Mozilla Public
+                                                                                          * License, v. 2.0. If a copy of the MPL was not distributed with this
+                                                                                          * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
 function debugBtn(onClick, type, className, tooltip) {
   return _react2.default.createElement(
     "button",
     {
       onClick: onClick,
       className: `${type} ${className}`,
       key: type,
@@ -22553,16 +22545,30 @@ class SecondaryPanes extends _react.Comp
       component: _react2.default.createElement(Scopes, null),
       opened: _prefs.prefs.scopesVisible,
       onToggle: opened => {
         _prefs.prefs.scopesVisible = opened;
       }
     };
   }
 
+  getComponentItem() {
+    const { extra: { react } } = this.props;
+
+    return {
+      header: react.displayName,
+      className: "component-pane",
+      component: _react2.default.createElement(_FrameworkComponent2.default, null),
+      opened: _prefs.prefs.componentVisible,
+      onToggle: opened => {
+        _prefs.prefs.componentVisible = opened;
+      }
+    };
+  }
+
   getWatchItem() {
     return {
       header: L10N.getStr("watchExpressions.header"),
       className: "watch-expressions-pane",
       buttons: this.watchExpressionHeaderButtons(),
       component: _react2.default.createElement(_Expressions2.default, null),
       opened: _prefs.prefs.expressionsVisible,
       onToggle: opened => {
@@ -22620,32 +22626,37 @@ class SecondaryPanes extends _react.Comp
       shouldIgnoreCaughtExceptions,
       isWaitingOnBreak
     } = this.props;
 
     return (0, _BreakpointsDropdown2.default)(breakOnNext, pauseOnExceptions, shouldPauseOnExceptions, shouldIgnoreCaughtExceptions, isWaitingOnBreak);
   }
 
   getStartItems() {
-    const { workers } = this.props;
+    const { extra, workers } = this.props;
 
     const items = [];
     if (this.props.horizontal) {
       if (_prefs.features.workers && workers.size > 0) {
         items.push(this.getWorkersItem());
       }
 
       items.push(this.getWatchItem());
     }
 
     items.push(this.getBreakpointsItem());
 
     if (this.props.hasFrames) {
       items.push(this.getCallStackItem());
+
       if (this.props.horizontal) {
+        if (extra && extra.react) {
+          items.push(this.getComponentItem());
+        }
+
         items.push(this.getScopeItem());
       }
     }
 
     if (_prefs.features.eventListeners) {
       items.push({
         header: L10N.getStr("eventListenersHeader"),
         className: "event-listeners-pane",
@@ -22656,30 +22667,34 @@ class SecondaryPanes extends _react.Comp
     return items.filter(item => item);
   }
 
   renderHorizontalLayout() {
     return _react2.default.createElement(_Accordion2.default, { items: this.getItems() });
   }
 
   getEndItems() {
-    const { workers } = this.props;
+    const { extra, workers } = this.props;
 
     let items = [];
 
     if (this.props.horizontal) {
       return [];
     }
 
     if (_prefs.features.workers && workers.size > 0) {
       items.push(this.getWorkersItem());
     }
 
     items.push(this.getWatchItem());
 
+    if (extra && extra.react) {
+      items.push(this.getComponentItem());
+    }
+
     if (this.props.hasFrames) {
       items = [...items, this.getScopeItem()];
     }
 
     return items;
   }
 
   getItems() {
@@ -22723,16 +22738,17 @@ class SecondaryPanes extends _react.Comp
   }
 }
 
 SecondaryPanes.contextTypes = {
   shortcuts: _propTypes2.default.object
 };
 
 exports.default = (0, _reactRedux.connect)(state => ({
+  extra: (0, _selectors.getExtra)(state),
   hasFrames: !!(0, _selectors.getTopFrame)(state),
   breakpoints: (0, _selectors.getBreakpoints)(state),
   breakpointsDisabled: (0, _selectors.getBreakpointsDisabled)(state),
   breakpointsLoading: (0, _selectors.getBreakpointsLoading)(state),
   isWaitingOnBreak: (0, _selectors.getIsWaitingOnBreak)(state),
   shouldPauseOnExceptions: (0, _selectors.getShouldPauseOnExceptions)(state),
   shouldIgnoreCaughtExceptions: (0, _selectors.getShouldIgnoreCaughtExceptions)(state),
   workers: (0, _selectors.getWorkers)(state)
@@ -26370,16 +26386,18 @@ function astCommand(stepType) {
 "use strict";
 
 
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.findBestMatchExpression = findBestMatchExpression;
 exports.findEmptyLines = findEmptyLines;
+exports.containsPosition = containsPosition;
+exports.findClosestFunction = findClosestFunction;
 
 var _lodash = __webpack_require__(2);
 
 function findBestMatchExpression(symbols, tokenPos) {
   const { memberExpressions, identifiers } = symbols;
   const { line, column } = tokenPos;
   return identifiers.concat(memberExpressions).reduce((found, expression) => {
     const overlaps = expression.location.start.line == line && expression.location.start.column <= column && expression.location.end.column >= column && !expression.computed;
@@ -26405,16 +26423,47 @@ function findEmptyLines(selectedSource, 
   if (!selectedSource.text) {
     return [];
   }
   const lineCount = selectedSource.text.split("\n").length;
   const sourceLines = (0, _lodash.range)(1, lineCount + 1);
   return (0, _lodash.without)(sourceLines, ...breakpointLines);
 }
 
+function containsPosition(a, b) {
+  const startsBefore = a.start.line < b.line || a.start.line === b.line && a.start.column <= b.column;
+  const endsAfter = a.end.line > b.line || a.end.line === b.line && a.end.column >= b.column;
+
+  return startsBefore && endsAfter;
+}
+
+function findClosestFunction(functions, location) {
+  return functions.reduce((found, currNode) => {
+    if (currNode.name === "anonymous" || !containsPosition(currNode.location, {
+      line: location.line,
+      column: location.column || 0
+    })) {
+      return found;
+    }
+
+    if (!found) {
+      return currNode;
+    }
+
+    if (found.location.start.line > currNode.location.start.line) {
+      return found;
+    }
+    if (found.location.start.line === currNode.location.start.line && found.location.start.column > currNode.location.start.column) {
+      return found;
+    }
+
+    return currNode;
+  }, null);
+}
+
 /***/ }),
 
 /***/ 1639:
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
@@ -27174,17 +27223,20 @@ class QuickOpenModal extends _react.Comp
     };
 
     this.searchSymbols = query => {
       const { symbols: { functions, variables } } = this.props;
 
       let results = functions;
       if (this.isVariableQuery()) {
         results = variables;
-      }
+      } else {
+        results = results.filter(result => result.title !== "anonymous");
+      }
+
       if (query === "@" || query === "#") {
         return this.setState({ results });
       }
 
       this.setState({ results: filter(results, query.slice(1)) });
     };
 
     this.searchShortcuts = query => {
@@ -27590,36 +27642,43 @@ Object.defineProperty(exports, "__esModu
   value: true
 });
 exports.fetchScopes = fetchScopes;
 
 var _selectors = __webpack_require__(3590);
 
 var _mapScopes = __webpack_require__(1634);
 
+var _preview = __webpack_require__(1786);
+
 var _promise = __webpack_require__(1653);
 
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
+
 function fetchScopes() {
   return async function ({ dispatch, getState, client, sourceMaps }) {
     const frame = (0, _selectors.getSelectedFrame)(getState());
     if (!frame || (0, _selectors.getGeneratedFrameScope)(getState(), frame.id)) {
       return;
     }
 
+    const extra = await dispatch((0, _preview.getExtra)("this;", frame.this, frame));
+
     const scopes = dispatch({
       type: "ADD_SCOPES",
       frame,
+      extra,
       [_promise.PROMISE]: client.getFrameScopes(frame)
     });
 
     await dispatch((0, _mapScopes.mapScopes)(scopes, frame));
   };
-} /* This Source Code Form is subject to the terms of the Mozilla Public
-   * License, v. 2.0. If a copy of the MPL was not distributed with this
-   * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
+}
 
 /***/ }),
 
 /***/ 1657:
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
@@ -30163,16 +30222,17 @@ function createLocation({
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
 
 var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; /* This Source Code Form is subject to the terms of the Mozilla Public
                                                                                                                                                                                                                                                                    * License, v. 2.0. If a copy of the MPL was not distributed with this
                                                                                                                                                                                                                                                                    * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
 
+exports.getExtra = getExtra;
 exports.updatePreview = updatePreview;
 exports.setPreview = setPreview;
 exports.clearPreview = clearPreview;
 
 var _ast = __webpack_require__(1638);
 
 var _editor = __webpack_require__(1358);
 
@@ -30237,16 +30297,24 @@ function isInvalidTarget(target) {
   const invalidToken = tokenText === "" || tokenText.match(/[(){}\|&%,.;=<>\+-/\*\s]/);
 
   // exclude codemirror elements that are not tokens
   const invalidTarget = target.parentElement && !target.parentElement.closest(".CodeMirror-line") || cursorPos.top == 0;
 
   return invalidTarget || invalidToken || invaildType;
 }
 
+function getExtra(expression, result, selectedFrame) {
+  return async ({ dispatch, getState, client, sourceMaps }) => {
+    const extra = await getExtraProps(expression, result, expr => client.evaluateInFrame(selectedFrame.id, expr));
+
+    return extra;
+  };
+}
+
 function updatePreview(target, editor) {
   return ({ dispatch, getState, client, sourceMaps }) => {
     const tokenPos = (0, _editor.getTokenLocation)(editor.codeMirror, target);
     const cursorPos = target.getBoundingClientRect();
     const preview = (0, _selectors.getPreview)(getState());
 
     if ((0, _selectors.getCanRewind)(getState())) {
       return;
@@ -30317,17 +30385,17 @@ function setPreview(expression, location
         }
 
         const { result } = await client.evaluateInFrame(selectedFrame.id, expression);
 
         if (result === undefined) {
           return;
         }
 
-        const extra = await getExtraProps(expression, result, expr => client.evaluateInFrame(selectedFrame.id, expr));
+        const extra = await dispatch(getExtra(expression, result, selectedFrame));
 
         return {
           expression,
           result,
           location,
           tokenPos,
           cursorPos,
           extra
@@ -30745,37 +30813,71 @@ function isDebugLine(selectedFrame, sele
 
   return selectedFrame.location.sourceId == selectedLocation.sourceId && selectedFrame.location.line == selectedLocation.line;
 }
 
 function isDocumentReady(selectedSource, selectedLocation) {
   return selectedLocation && (0, _source.isLoaded)(selectedSource) && (0, _sourceDocuments.hasDocument)(selectedLocation.sourceId);
 }
 
-class HighlightLine extends _react.PureComponent {
+class HighlightLine extends _react.Component {
+  constructor(...args) {
+    var _temp;
+
+    return _temp = super(...args), this.isStepping = false, this.previousEditorLine = null, _temp;
+  }
+
+  shouldComponentUpdate(nextProps) {
+    const { selectedLocation, selectedSource } = nextProps;
+    return this.shouldSetHighlightLine(selectedLocation, selectedSource);
+  }
+
+  shouldSetHighlightLine(selectedLocation, selectedSource) {
+    const { sourceId, line } = selectedLocation;
+    const editorLine = (0, _editor.toEditorLine)(sourceId, line);
+
+    if (!isDocumentReady(selectedSource, selectedLocation)) {
+      return false;
+    }
+
+    if (this.isStepping && editorLine === this.previousEditorLine) {
+      return false;
+    }
+
+    return true;
+  }
+
   componentDidUpdate(prevProps) {
-    const { selectedLocation, selectedFrame, selectedSource } = this.props;
+    const {
+      pauseCommand,
+      selectedLocation,
+      selectedFrame,
+      selectedSource
+    } = this.props;
+    if (pauseCommand) {
+      this.isStepping = true;
+    }
 
     this.clearHighlightLine(prevProps.selectedLocation, prevProps.selectedSource);
-
     this.setHighlightLine(selectedLocation, selectedFrame, selectedSource);
   }
 
   setHighlightLine(selectedLocation, selectedFrame, selectedSource) {
-    if (!isDocumentReady(selectedSource, selectedLocation)) {
-      return;
-    }
-
     const { sourceId, line } = selectedLocation;
+    if (!this.shouldSetHighlightLine(selectedLocation, selectedSource)) {
+      return;
+    }
+    this.isStepping = false;
+    const editorLine = (0, _editor.toEditorLine)(sourceId, line);
+    this.previousEditorLine = editorLine;
 
     if (!line || isDebugLine(selectedFrame, selectedLocation)) {
       return;
     }
 
-    const editorLine = (0, _editor.toEditorLine)(sourceId, line);
     const doc = (0, _sourceDocuments.getDocument)(sourceId);
     doc.addLineClass(editorLine, "line", "highlight-line");
   }
 
   clearHighlightLine(selectedLocation, selectedSource) {
     if (!isDocumentReady(selectedSource, selectedLocation)) {
       return;
     }
@@ -30788,16 +30890,17 @@ class HighlightLine extends _react.PureC
 
   render() {
     return null;
   }
 }
 
 exports.HighlightLine = HighlightLine;
 exports.default = (0, _reactRedux.connect)(state => ({
+  pauseCommand: (0, _selectors.getPauseCommand)(state),
   selectedFrame: (0, _selectors.getVisibleSelectedFrame)(state),
   selectedLocation: (0, _selectors.getSelectedLocation)(state),
   selectedSource: (0, _selectors.getSelectedSource)(state)
 }))(HighlightLine);
 
 /***/ }),
 
 /***/ 1797:
@@ -31576,52 +31679,76 @@ function jumpToMappedSelectedLocation() 
 
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
 
 var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; };
 
 exports.updateFrameLocation = updateFrameLocation;
+exports.mapDisplayNames = mapDisplayNames;
 exports.mapFrames = mapFrames;
 
 var _selectors = __webpack_require__(3590);
 
+var _ast = __webpack_require__(1638);
+
 function updateFrameLocation(frame, sourceMaps) {
   return sourceMaps.getOriginalLocation(frame.location).then(loc => _extends({}, frame, {
     location: loc,
     generatedLocation: frame.generatedLocation || frame.location
   }));
 }
 
 function updateFrameLocations(frames, sourceMaps) {
   if (!frames || frames.length == 0) {
     return Promise.resolve(frames);
   }
 
   return Promise.all(frames.map(frame => updateFrameLocation(frame, sourceMaps)));
 }
 
-/**
- * Map call stack frame locations to original locations.
+function mapDisplayNames(frames, getState) {
+  return frames.map(frame => {
+    const source = (0, _selectors.getSource)(getState(), frame.location.sourceId);
+    const symbols = (0, _selectors.getSymbols)(getState(), source);
+
+    if (!symbols || !symbols.functions) {
+      return frame;
+    }
+
+    const originalFunction = (0, _ast.findClosestFunction)(symbols.functions, frame.location);
+
+    if (!originalFunction) {
+      return frame;
+    }
+
+    const originalDisplayName = originalFunction.name;
+    return _extends({}, frame, { originalDisplayName });
+  });
+}
+
+/**
+ * Map call stack frame locations and display names to originals.
  * e.g.
  * 1. When the debuggee pauses
  * 2. When a source is pretty printed
- *
+ * 3. When symbols are loaded
  * @memberof actions/pause
  * @static
  */
 function mapFrames() {
   return async function ({ dispatch, getState, sourceMaps }) {
     const frames = (0, _selectors.getFrames)(getState());
     if (!frames) {
       return;
     }
 
-    const mappedFrames = await updateFrameLocations(frames, sourceMaps);
+    let mappedFrames = await updateFrameLocations(frames, sourceMaps);
+    mappedFrames = mapDisplayNames(mappedFrames, getState);
 
     dispatch({
       type: "MAP_FRAMES",
       frames: mappedFrames
     });
   };
 }
 
@@ -33921,16 +34048,17 @@ const pref = Services.pref;
 if (isDevelopment()) {
   pref("devtools.debugger.alphabetize-outline", false);
   pref("devtools.debugger.auto-pretty-print", true);
   pref("devtools.source-map.client-service.enabled", true);
   pref("devtools.debugger.pause-on-exceptions", false);
   pref("devtools.debugger.ignore-caught-exceptions", false);
   pref("devtools.debugger.call-stack-visible", true);
   pref("devtools.debugger.scopes-visible", true);
+  pref("devtools.debugger.component-visible", true);
   pref("devtools.debugger.workers-visible", true);
   pref("devtools.debugger.expressions-visible", true);
   pref("devtools.debugger.breakpoints-visible", true);
   pref("devtools.debugger.start-panel-collapsed", false);
   pref("devtools.debugger.end-panel-collapsed", false);
   pref("devtools.debugger.tabs", "[]");
   pref("devtools.debugger.tabsBlackBoxed", "[]");
   pref("devtools.debugger.ui.framework-grouping-on", true);
@@ -33963,16 +34091,17 @@ if (isDevelopment()) {
 const prefs = new PrefsHelper("devtools", {
   alphabetizeOutline: ["Bool", "debugger.alphabetize-outline"],
   autoPrettyPrint: ["Bool", "debugger.auto-pretty-print"],
   clientSourceMapsEnabled: ["Bool", "source-map.client-service.enabled"],
   pauseOnExceptions: ["Bool", "debugger.pause-on-exceptions"],
   ignoreCaughtExceptions: ["Bool", "debugger.ignore-caught-exceptions"],
   callStackVisible: ["Bool", "debugger.call-stack-visible"],
   scopesVisible: ["Bool", "debugger.scopes-visible"],
+  componentVisible: ["Bool", "debugger.component-visible"],
   workersVisible: ["Bool", "debugger.workers-visible"],
   breakpointsVisible: ["Bool", "debugger.breakpoints-visible"],
   expressionsVisible: ["Bool", "debugger.expressions-visible"],
   startPanelCollapsed: ["Bool", "debugger.start-panel-collapsed"],
   endPanelCollapsed: ["Bool", "debugger.end-panel-collapsed"],
   frameworkGroupingOn: ["Bool", "debugger.ui.framework-grouping-on"],
   tabs: ["Json", "debugger.tabs", []],
   tabsBlackBoxed: ["Json", "debugger.tabsBlackBoxed", []],
@@ -37216,34 +37345,43 @@ function annotateBabelAsyncFrames(frames
   const isBabelFrame = frameIndex => babelFrameIndexes.includes(frameIndex);
 
   return frames.map((frame, frameIndex) => isBabelFrame(frameIndex) ? _extends({}, frame, { library: "Babel" }) : frame);
 }
 
 // Receives an array of frames and looks for babel async
 // call stack groups.
 function getBabelFrameIndexes(frames) {
-  const startIndexes = getFrameIndices(frames, (displayName, url) => url.match(/regenerator-runtime/i) && displayName === "tryCatch");
-
-  const endIndexes = getFrameIndices(frames, (displayName, url) => displayName === "_asyncToGenerator/<" || url.match(/_microtask/i) && displayName === "flush");
+  const startIndexes = frames.reduce((accumulator, frame, index) => {
+    if ((0, _getFrameUrl.getFrameUrl)(frame).match(/regenerator-runtime/i) && frame.displayName === "tryCatch") {
+      return [...accumulator, index];
+    }
+    return accumulator;
+  }, []);
+
+  const endIndexes = frames.reduce((accumulator, frame, index) => {
+    if ((0, _getFrameUrl.getFrameUrl)(frame).match(/_microtask/i) && frame.displayName === "flush") {
+      return [...accumulator, index];
+    }
+    if (frame.displayName === "_asyncToGenerator/<") {
+      return [...accumulator, index + 1];
+    }
+    return accumulator;
+  }, []);
 
   if (startIndexes.length != endIndexes.length || startIndexes.length === 0) {
     return frames;
   }
 
   // Receives an array of start and end index tuples and returns
   // an array of async call stack index ranges.
   // e.g. [[1,3], [5,7]] => [[1,2,3], [5,6,7]]
   return (0, _lodash.flatMap)((0, _lodash.zip)(startIndexes, endIndexes), ([startIndex, endIndex]) => (0, _lodash.range)(startIndex, endIndex + 1));
 }
 
-function getFrameIndices(frames, predicate) {
-  return frames.reduce((accumulator, frame, index) => predicate(frame.displayName, (0, _getFrameUrl.getFrameUrl)(frame)) ? [...accumulator, index] : accumulator, []);
-}
-
 /***/ }),
 
 /***/ 3609:
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
@@ -37397,17 +37535,18 @@ const displayNameMap = {
 };
 
 function mapDisplayNames(frame, library) {
   const { displayName } = frame;
   return displayNameMap[library] && displayNameMap[library][displayName] || displayName;
 }
 
 function formatDisplayName(frame, { shouldMapDisplayName = true } = {}) {
-  let { displayName, library } = frame;
+  let { displayName, originalDisplayName, library } = frame;
+  displayName = originalDisplayName || displayName;
   if (library && shouldMapDisplayName) {
     displayName = mapDisplayNames(frame, library);
   }
 
   displayName = simplifyDisplayName(displayName);
   return (0, _utils.endTruncateStr)(displayName, 25);
 }
 
@@ -38301,16 +38440,121 @@ function formatPausePoints(text, nodes) 
     lines[line - 1] = insertStrtAt(lines[line - 1], column, `/*${types} ${num}*/`);
   });
 
   return lines.join("\n");
 }
 
 /***/ }),
 
+/***/ 3623:
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+
+var _react = __webpack_require__(0);
+
+var _react2 = _interopRequireDefault(_react);
+
+var _redux = __webpack_require__(3593);
+
+var _reactRedux = __webpack_require__(3592);
+
+var _actions = __webpack_require__(1354);
+
+var _actions2 = _interopRequireDefault(_actions);
+
+var _firefox = __webpack_require__(1500);
+
+var _selectors = __webpack_require__(3590);
+
+var _devtoolsReps = __webpack_require__(1408);
+
+var _preview = __webpack_require__(1807);
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at <http://mozilla.org/MPL/2.0/>. */
+
+const { createNode, getChildren } = _devtoolsReps.ObjectInspectorUtils.node;
+const { loadItemProperties } = _devtoolsReps.ObjectInspectorUtils.loadProperties;
+
+class FrameworkComponent extends _react.PureComponent {
+  async componentWillMount() {
+    const expression = "this;";
+    const { selectedFrame, setPopupObjectProperties } = this.props;
+    const value = selectedFrame.this;
+
+    const root = createNode(null, expression, expression, { value });
+    const properties = await loadItemProperties(root, _firefox.createObjectClient);
+    if (properties) {
+      setPopupObjectProperties(value, properties);
+    }
+  }
+
+  renderReactComponent() {
+    const { selectedFrame, popupObjectProperties } = this.props;
+    const expression = "this;";
+    const value = selectedFrame.this;
+    const root = {
+      name: expression,
+      path: expression,
+      contents: { value }
+    };
+
+    const loadedRootProperties = popupObjectProperties[value.actor];
+
+    let roots = getChildren({
+      item: root,
+      loadedProperties: new Map([[root.path, loadedRootProperties]])
+    });
+
+    roots = roots.filter(r => ["state", "props"].includes(r.name));
+
+    return _react2.default.createElement(
+      "div",
+      { className: "pane framework-component" },
+      _react2.default.createElement(_devtoolsReps.ObjectInspector, {
+        roots: roots,
+        autoExpandAll: false,
+        autoExpandDepth: 0,
+        disableWrap: true,
+        disabledFocus: true,
+        dimTopLevelWindow: true,
+        createObjectClient: grip => (0, _firefox.createObjectClient)(grip)
+      })
+    );
+  }
+
+  render() {
+    const { selectedFrame } = this.props;
+    if ((0, _preview.isReactComponent)(selectedFrame.this)) {
+      return this.renderReactComponent();
+    }
+
+    return null;
+  }
+}
+
+exports.default = (0, _reactRedux.connect)(state => {
+  return {
+    selectedFrame: (0, _selectors.getSelectedFrame)(state),
+    popupObjectProperties: (0, _selectors.getAllPopupObjectProperties)(state)
+  };
+}, dispatch => (0, _redux.bindActionCreators)(_actions2.default, dispatch))(FrameworkComponent);
+
+/***/ }),
+
 /***/ 363:
 /***/ (function(module, exports) {
 
 module.exports = "<!-- This Source Code Form is subject to the terms of the Mozilla Public - License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. --><svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:svg=\"http://www.w3.org/2000/svg\"><path fill=\"black\" id=\"svg_1\" fill-rule=\"evenodd\" d=\"m4.55195,12.97461l7.4,-5l-7.4,-5l0,10zm-0.925,0l0,-10c0,-0.785 0.8,-1.264 1.415,-0.848l7.4,5c0.58,0.392 0.58,1.304 0,1.696l-7.4,5c-0.615,0.416 -1.415,-0.063 -1.415,-0.848z\"></path></svg>"
 
 /***/ }),
 
 /***/ 364:

--- a/devtools/client/debugger/new/parser-worker.js
+++ b/devtools/client/debugger/new/parser-worker.js
@@ -992,20 +992,17 @@ let ASTs = new Map();
 function _parse(code, opts) {
   return babylon.parse(code, _extends({}, opts, {
     tokens: true
   }));
 }
 
 const sourceOptions = {
   generated: {
-    tokens: true,
-    plugins: [
-      "objectRestSpread"
-    ]
+    tokens: true
   },
   original: {
     sourceType: "unambiguous",
     tokens: true,
     plugins: ["jsx", "flow", "doExpressions", "objectRestSpread", "classProperties", "exportDefaultFrom", "exportNamespaceFrom", "asyncGenerators", "functionBind", "functionSent", "dynamicImport"]
   }
 };
 
@@ -40560,9 +40557,9 @@ function listCacheHas(key) {
 }
 
 module.exports = listCacheHas;
 
 
 /***/ })
 
 /******/ });
-});
+});
\ No newline at end of file

--- a/devtools/client/preferences/debugger.js
+++ b/devtools/client/preferences/debugger.js
@@ -24,16 +24,17 @@ pref("devtools.debugger.ui.panes-workers
 pref("devtools.debugger.ui.panes-instruments-width", 300);
 pref("devtools.debugger.ui.panes-visible-on-startup", false);
 pref("devtools.debugger.ui.variables-sorting-enabled", true);
 pref("devtools.debugger.ui.variables-only-enum-visible", false);
 pref("devtools.debugger.ui.variables-searchbox-visible", false);
 pref("devtools.debugger.ui.framework-grouping-on", true);
 pref("devtools.debugger.call-stack-visible", true);
 pref("devtools.debugger.scopes-visible", true);
+pref("devtools.debugger.component-visible", true);
 pref("devtools.debugger.workers-visible", true);
 pref("devtools.debugger.breakpoints-visible", true);
 pref("devtools.debugger.expressions-visible", true);
 pref("devtools.debugger.start-panel-collapsed", false);
 pref("devtools.debugger.end-panel-collapsed", false);
 pref("devtools.debugger.tabs", "[]");
 pref("devtools.debugger.tabsBlackBoxed", "[]");
 pref("devtools.debugger.pending-selected-location", "{}");

--- a/dom/base/StructuredCloneHolder.cpp
+++ b/dom/base/StructuredCloneHolder.cpp
@@ -118,32 +118,44 @@ StructuredCloneCallbacksFreeTransfer(uin
 {
   StructuredCloneHolderBase* holder =
     static_cast<StructuredCloneHolderBase*>(aClosure);
   MOZ_ASSERT(holder);
   return holder->CustomFreeTransferHandler(aTag, aOwnership, aContent,
                                            aExtraData);
 }
 
+bool
+StructuredCloneCallbacksCanTransfer(JSContext* aCx,
+                                    JS::Handle<JSObject*> aObject,
+                                    void* aClosure)
+{
+  StructuredCloneHolderBase* holder =
+    static_cast<StructuredCloneHolderBase*>(aClosure);
+  MOZ_ASSERT(holder);
+  return holder->CustomCanTransferHandler(aCx, aObject);
+}
+
 void
 StructuredCloneCallbacksError(JSContext* aCx,
                               uint32_t aErrorId)
 {
   NS_WARNING("Failed to clone data.");
 }
 
 } // anonymous namespace
 
 const JSStructuredCloneCallbacks StructuredCloneHolder::sCallbacks = {
   StructuredCloneCallbacksRead,
   StructuredCloneCallbacksWrite,
   StructuredCloneCallbacksError,
   StructuredCloneCallbacksReadTransfer,
   StructuredCloneCallbacksWriteTransfer,
-  StructuredCloneCallbacksFreeTransfer
+  StructuredCloneCallbacksFreeTransfer,
+  StructuredCloneCallbacksCanTransfer,
 };
 
 // StructuredCloneHolderBase class
 
 StructuredCloneHolderBase::StructuredCloneHolderBase(StructuredCloneScope aScope)
   : mStructuredCloneScope(aScope)
 #ifdef DEBUG
   , mClearCalled(false)
@@ -235,16 +247,23 @@ void
 StructuredCloneHolderBase::CustomFreeTransferHandler(uint32_t aTag,
                                                      JS::TransferableOwnership aOwnership,
                                                      void* aContent,
                                                      uint64_t aExtraData)
 {
   MOZ_CRASH("Nothing to free.");
 }
 
+bool
+StructuredCloneHolderBase::CustomCanTransferHandler(JSContext* aCx,
+                                                    JS::Handle<JSObject*> aObj)
+{
+  return false;
+}
+
 // StructuredCloneHolder class
 
 StructuredCloneHolder::StructuredCloneHolder(CloningSupport aSupportsCloning,
                                              TransferringSupport aSupportsTransferring,
                                              StructuredCloneScope aScope)
   : StructuredCloneHolderBase(aScope)
   , mSupportsCloning(aSupportsCloning == CloningSupported)
   , mSupportsTransferring(aSupportsTransferring == TransferringSupported)
@@ -1216,32 +1235,40 @@ StructuredCloneHolder::CustomWriteTransf
   {
     MessagePort* port = nullptr;
     nsresult rv = UNWRAP_OBJECT(MessagePort, &obj, port);
     if (NS_SUCCEEDED(rv)) {
       // We use aExtraData to store the index of this new port identifier.
       *aExtraData = mPortIdentifiers.Length();
       MessagePortIdentifier* identifier = mPortIdentifiers.AppendElement();
 
+      if (!port->CanBeCloned()) {
+        return false;
+      }
+
       port->CloneAndDisentangle(*identifier);
 
       *aTag = SCTAG_DOM_MAP_MESSAGEPORT;
       *aOwnership = JS::SCTAG_TMO_CUSTOM;
       *aContent = nullptr;
 
       return true;
     }
 
     if (mStructuredCloneScope == StructuredCloneScope::SameProcessSameThread ||
         mStructuredCloneScope == StructuredCloneScope::SameProcessDifferentThread) {
       OffscreenCanvas* canvas = nullptr;
       rv = UNWRAP_OBJECT(OffscreenCanvas, &obj, canvas);
       if (NS_SUCCEEDED(rv)) {
         MOZ_ASSERT(canvas);
 
+        if (canvas->IsNeutered()) {
+          return false;
+        }
+
         *aExtraData = 0;
         *aTag = SCTAG_DOM_CANVAS;
         *aOwnership = JS::SCTAG_TMO_CUSTOM;
         *aContent = canvas->ToCloneData();
         MOZ_ASSERT(*aContent);
         canvas->SetNeutered();
 
         return true;
@@ -1310,16 +1337,52 @@ StructuredCloneHolder::CustomFreeTransfe
     ImageBitmapCloneData* data =
       static_cast<ImageBitmapCloneData*>(aContent);
     delete data;
     return;
   }
 }
 
 bool
+StructuredCloneHolder::CustomCanTransferHandler(JSContext* aCx,
+                                                JS::Handle<JSObject*> aObj)
+{
+  if (!mSupportsTransferring) {
+    return false;
+  }
+
+  JS::Rooted<JSObject*> obj(aCx, aObj);
+
+  {
+    MessagePort* port = nullptr;
+    nsresult rv = UNWRAP_OBJECT(MessagePort, &obj, port);
+    if (NS_SUCCEEDED(rv)) {
+      return true;
+    }
+
+    if (mStructuredCloneScope == StructuredCloneScope::SameProcessSameThread ||
+        mStructuredCloneScope == StructuredCloneScope::SameProcessDifferentThread) {
+      OffscreenCanvas* canvas = nullptr;
+      rv = UNWRAP_OBJECT(OffscreenCanvas, &obj, canvas);
+      if (NS_SUCCEEDED(rv)) {
+        return true;
+      }
+
+      ImageBitmap* bitmap = nullptr;
+      rv = UNWRAP_OBJECT(ImageBitmap, &obj, bitmap);
+      if (NS_SUCCEEDED(rv)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+bool
 StructuredCloneHolder::TakeTransferredPortsAsSequence(Sequence<OwningNonNull<mozilla::dom::MessagePort>>& aPorts)
 {
   nsTArray<RefPtr<MessagePort>> ports = TakeTransferredPorts();
 
   aPorts.Clear();
   for (uint32_t i = 0, len = ports.Length(); i < len; ++i) {
     if (!aPorts.AppendElement(ports[i].forget(), fallible)) {
       return false;

--- a/dom/base/StructuredCloneHolder.h
+++ b/dom/base/StructuredCloneHolder.h
@@ -83,16 +83,20 @@ public:
                              uint64_t* aExtraData);
 
   virtual void
   CustomFreeTransferHandler(uint32_t aTag,
                             JS::TransferableOwnership aOwnership,
                             void* aContent,
                             uint64_t aExtraData);
 
+  virtual bool
+  CustomCanTransferHandler(JSContext* aCx,
+                           JS::Handle<JSObject*> aObj);
+
   // These methods are what you should use to read/write data.
 
   // Execute the serialization of aValue using the Structured Clone Algorithm.
   // The data can read back using Read().
   bool Write(JSContext* aCx,
              JS::Handle<JS::Value> aValue);
 
   // Like Write() but it supports the transferring of objects and handling
@@ -278,16 +282,19 @@ public:
                                           void** aContent,
                                           uint64_t* aExtraData) override;
 
   virtual void CustomFreeTransferHandler(uint32_t aTag,
                                          JS::TransferableOwnership aOwnership,
                                          void* aContent,
                                          uint64_t aExtraData) override;
 
+  virtual bool CustomCanTransferHandler(JSContext* aCx,
+                                        JS::Handle<JSObject*> aObj) override;
+
   // These 2 static methods are useful to read/write fully serializable objects.
   // They can be used by custom StructuredCloneHolderBase classes to
   // serialize objects such as ImageData, CryptoKey, RTCCertificate, etc.
 
   static JSObject* ReadFullySerializableObjects(JSContext* aCx,
                                                 JSStructuredCloneReader* aReader,
                                                 uint32_t aTag);
 

--- a/dom/base/nsINode.h
+++ b/dom/base/nsINode.h
@@ -608,19 +608,21 @@ public:
    */
 
   nsIDocument* GetUncomposedDoc() const
   {
     return IsInUncomposedDoc() ? OwnerDoc() : nullptr;
   }
 
   /**
-   * This method returns the owner doc if the node is in the
-   * composed document (as defined in the Shadow DOM spec), otherwise
-   * it returns null.
+   * This method returns the owner document if the node is connected to it
+   * (as defined in the DOM spec), otherwise it returns null.
+   * In other words, returns non-null even in the case the node is in
+   * Shadow DOM, if there is a possibly shadow boundary crossing path from
+   * the node to its owner document.
    */
   nsIDocument* GetComposedDoc() const
   {
     return IsInShadowTree() ?
       GetComposedDocInternal() : GetUncomposedDoc();
   }
 
   /**

--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -695,17 +695,18 @@ nsresult
 GetAddInfoCallback(JSContext* aCx, void* aClosure)
 {
   static const JSStructuredCloneCallbacks kStructuredCloneCallbacks = {
     nullptr /* read */,
     StructuredCloneWriteCallback /* write */,
     nullptr /* reportError */,
     nullptr /* readTransfer */,
     nullptr /* writeTransfer */,
-    nullptr /* freeTransfer */
+    nullptr /* freeTransfer */,
+    nullptr /* canTransfer */
   };
 
   MOZ_ASSERT(aCx);
 
   auto* data = static_cast<GetAddInfoClosure*>(aClosure);
   MOZ_ASSERT(data);
 
   data->mCloneWriteInfo.mOffsetToKeyProp = 0;
@@ -1318,16 +1319,17 @@ IDBObjectStore::DeserializeValue(JSConte
   JSAutoRequest ar(aCx);
 
   static const JSStructuredCloneCallbacks callbacks = {
     CommonStructuredCloneReadCallback,
     nullptr,
     nullptr,
     nullptr,
     nullptr,
+    nullptr,
     nullptr
   };
 
   // FIXME: Consider to use StructuredCloneHolder here and in other
   //        deserializing methods.
   if (!JS_ReadStructuredClone(aCx, aCloneReadInfo.mData, JS_STRUCTURED_CLONE_VERSION,
                               JS::StructuredCloneScope::SameProcessSameThread,
                               aValue, &callbacks, &aCloneReadInfo)) {
@@ -1491,16 +1493,17 @@ private:
   DeserializeIndexValue(JSContext* aCx, JS::MutableHandle<JS::Value> aValue)
   {
     static const JSStructuredCloneCallbacks callbacks = {
       CommonStructuredCloneReadCallback,
       nullptr,
       nullptr,
       nullptr,
       nullptr,
+      nullptr,
       nullptr
     };
 
     if (!JS_ReadStructuredClone(aCx, mCloneReadInfo.mData,
                                 JS_STRUCTURED_CLONE_VERSION,
                                 JS::StructuredCloneScope::SameProcessSameThread,
                                 aValue, &callbacks, &mCloneReadInfo)) {
       return NS_ERROR_DOM_DATA_CLONE_ERR;
@@ -1604,16 +1607,17 @@ private:
   DeserializeUpgradeValue(JSContext* aCx, JS::MutableHandle<JS::Value> aValue)
   {
     static const JSStructuredCloneCallbacks callbacks = {
       CommonStructuredCloneReadCallback,
       nullptr,
       nullptr,
       nullptr,
       nullptr,
+      nullptr,
       nullptr
     };
 
     if (!JS_ReadStructuredClone(aCx, mCloneReadInfo.mData,
                                 JS_STRUCTURED_CLONE_VERSION,
                                 JS::StructuredCloneScope::SameProcessSameThread,
                                 aValue, &callbacks, &mCloneReadInfo)) {
       return NS_ERROR_DOM_DATA_CLONE_ERR;

--- a/dom/messagechannel/MessagePort.cpp
+++ b/dom/messagechannel/MessagePort.cpp
@@ -199,16 +199,17 @@ NS_INTERFACE_MAP_END_INHERITING(DOMEvent
 NS_IMPL_ADDREF_INHERITED(MessagePort, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(MessagePort, DOMEventTargetHelper)
 
 MessagePort::MessagePort(nsIGlobalObject* aGlobal)
   : DOMEventTargetHelper(aGlobal)
   , mInnerID(0)
   , mMessageQueueEnabled(false)
   , mIsKeptAlive(false)
+  , mHasBeenTransferredOrClosed(false)
 {
   MOZ_ASSERT(aGlobal);
 
   mIdentifier = new MessagePortIdentifier();
   mIdentifier->neutered() = true;
   mIdentifier->sequenceId() = 0;
 }
 
@@ -496,16 +497,17 @@ MessagePort::Dispatch()
   }
 
   MOZ_ALWAYS_SUCCEEDS(NS_DispatchToCurrentThread(mPostMessageRunnable));
 }
 
 void
 MessagePort::Close()
 {
+  mHasBeenTransferredOrClosed = true;
   CloseInternal(true /* aSoftly */);
 }
 
 void
 MessagePort::CloseForced()
 {
   CloseInternal(false /* aSoftly */);
 }
@@ -720,16 +722,19 @@ MessagePort::Disentangle()
 
   UpdateMustKeepAlive();
 }
 
 void
 MessagePort::CloneAndDisentangle(MessagePortIdentifier& aIdentifier)
 {
   MOZ_ASSERT(mIdentifier);
+  MOZ_ASSERT(!mHasBeenTransferredOrClosed);
+
+  mHasBeenTransferredOrClosed = true;
 
   // We can clone a port that has already been transfered. In this case, on the
   // otherside will have a neutered port. Here we set neutered to true so that
   // we are safe in case a early return.
   aIdentifier.neutered() = true;
 
   if (mState > eStateEntangled) {
     return;

--- a/dom/messagechannel/MessagePort.h
+++ b/dom/messagechannel/MessagePort.h
@@ -69,16 +69,21 @@ public:
   void SetOnmessage(EventHandlerNonNull* aCallback);
 
   IMPL_EVENT_HANDLER(messageerror)
 
   // Non WebIDL methods
 
   void UnshippedEntangle(MessagePort* aEntangledPort);
 
+  bool CanBeCloned() const
+  {
+    return !mHasBeenTransferredOrClosed;
+  }
+
   void CloneAndDisentangle(MessagePortIdentifier& aIdentifier);
 
   void CloseForced();
 
   // These methods are useful for MessagePortChild
 
   void Entangled(nsTArray<ClonedMessageData>& aMessages);
   void MessagesReceived(nsTArray<ClonedMessageData>& aMessages);
@@ -177,14 +182,20 @@ private:
 
   uint64_t mInnerID;
 
   State mState;
 
   bool mMessageQueueEnabled;
 
   bool mIsKeptAlive;
+
+  // mHasBeenTransferredOrClosed is used to know if this port has been manually
+  // closed or transferred via postMessage. Note that if the entangled port is
+  // closed, this port is closed as well (see mState) but, just because close()
+  // has not been called directly, by spec, this port can still be transferred.
+  bool mHasBeenTransferredOrClosed;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_MessagePort_h

--- a/gfx/2d/DrawCommands.h
+++ b/gfx/2d/DrawCommands.h
@@ -235,16 +235,23 @@ public:
     CLONE_INTO(DrawFilterCommand)(mFilter, mSourceRect, mDestPoint, mOptions);
   }
 
   virtual void ExecuteOnDT(DrawTarget* aDT, const Matrix*) const override
   {
     RefPtr<FilterNode> filter = mFilter;
     if (mFilter->GetBackendType() == FilterBackend::FILTER_BACKEND_CAPTURE) {
       filter = static_cast<FilterNodeCapture*>(filter.get())->Validate(aDT);
+
+      // This can happen if the FilterNodeCapture is unable to create a
+      // backing FilterNode on the target backend. Normally this would be
+      // handled by the painting code, but here there's not much we can do.
+      if (!filter) {
+        return;
+      }
     }
     aDT->DrawFilter(filter, mSourceRect, mDestPoint, mOptions);
   }
 
   void Log(TreeLog& aStream) const override
   {
     aStream << "[DrawFilter surf=" << mFilter;
     aStream << " src=" << mSourceRect;

--- a/gfx/2d/FilterNodeD2D1.cpp
+++ b/gfx/2d/FilterNodeD2D1.cpp
@@ -197,32 +197,36 @@ uint32_t ConvertValue(FilterType aType, 
       aValue = D2DTurbulenceNoise(aValue);
     }
     break;
   case FilterType::COMPOSITE:
     if (aAttribute == ATT_COMPOSITE_OPERATOR) {
       aValue = D2DFilterCompositionMode(aValue);
     }
     break;
+  default:
+    break;
   }
 
   return aValue;
 }
 
 void ConvertValue(FilterType aType, uint32_t aAttribute, IntSize &aValue)
 {
   switch (aType) {
   case FilterType::MORPHOLOGY:
     if (aAttribute == ATT_MORPHOLOGY_RADII) {
       aValue.width *= 2;
       aValue.width += 1;
       aValue.height *= 2;
       aValue.height += 1;
     }
     break;
+  default:
+    break;
   }
 }
 
 UINT32
 GetD2D1InputForInput(FilterType aType, uint32_t aIndex)
 {
   return aIndex;
 }
@@ -436,32 +440,36 @@ GetD2D1PropForAttribute(FilterType aType
       CONVERT_PROP(DISTANT_SPECULAR_KERNEL_UNIT_LENGTH, DISTANTSPECULAR_PROP_KERNEL_UNIT_LENGTH);
     }
     break;
   case FilterType::CROP:
     switch (aIndex) {
       CONVERT_PROP(CROP_RECT, CROP_PROP_RECT);
     }
     break;
+  default:
+    break;
   }
 
   return UINT32_MAX;
 }
 
 bool
 GetD2D1PropsForIntSize(FilterType aType, uint32_t aIndex, UINT32 *aPropWidth, UINT32 *aPropHeight)
 {
   switch (aType) {
   case FilterType::MORPHOLOGY:
     if (aIndex == ATT_MORPHOLOGY_RADII) {
       *aPropWidth = D2D1_MORPHOLOGY_PROP_WIDTH;
       *aPropHeight = D2D1_MORPHOLOGY_PROP_HEIGHT;
       return true;
     }
     break;
+  default:
+    break;
   }
   return false;
 }
 
 static inline REFCLSID GetCLDIDForFilterType(FilterType aType)
 {
   switch (aType) {
   case FilterType::COLOR_MATRIX:
@@ -509,16 +517,18 @@ static inline REFCLSID GetCLDIDForFilter
   case FilterType::DISTANT_SPECULAR:
     return CLSID_D2D1DistantSpecular;
   case FilterType::CROP:
     return CLSID_D2D1Crop;
   case FilterType::PREMULTIPLY:
     return CLSID_D2D1Premultiply;
   case FilterType::UNPREMULTIPLY:
     return CLSID_D2D1UnPremultiply;
+  default:
+    break;
   }
   return GUID_NULL;
 }
 
 static bool
 IsTransferFilterType(FilterType aType)
 {
   switch (aType) {

--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -860,17 +860,17 @@ SourceSurfaceImage::GetTextureClient(Kno
   }
   if (textureClient) {
     textureClient->SyncWithObject(aForwarder->GetSyncObject());
     entry.OrInsert([&textureClient](){ return textureClient; });
     return textureClient;
   }
 
   // Remove the speculatively added entry.
-  mTextureClients.Remove(aForwarder->GetSerial());
+  entry.OrRemove();
   return nullptr;
 }
 
 ImageContainer::ProducerID
 ImageContainer::AllocateProducerID()
 {
   // Callable on all threads.
   static Atomic<ImageContainer::ProducerID> sProducerID(0u);

--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@@ -862,17 +862,18 @@ APZCTreeManager::PrepareNodeForLayer(con
   // that is supposed to scroll together is split into multiple layers because of
   // e.g. non-scrolling content interleaved in z-index order.
   ScrollableLayerGuid guid(aLayersId, aMetrics);
   auto insertResult = aState.mApzcMap.insert(std::make_pair(guid, static_cast<AsyncPanZoomController*>(nullptr)));
   if (!insertResult.second) {
     apzc = insertResult.first->second;
     PrintAPZCInfo(aLayer, apzc);
   }
-  APZCTM_LOG("Found APZC %p for layer %p with identifiers %" PRId64 " %" PRId64 "\n", apzc, aLayer.GetLayer(), guid.mLayersId, guid.mScrollId);
+  APZCTM_LOG("Found APZC %p for layer %p with identifiers %" PRIx64 " %" PRId64 "\n",
+      apzc, aLayer.GetLayer(), uint64_t(guid.mLayersId), guid.mScrollId);
 
   // If we haven't encountered a layer already with the same metrics, then we need to
   // do the full reuse-or-make-an-APZC algorithm, which is contained inside the block
   // below.
   if (apzc == nullptr) {
     apzc = aLayer.GetApzc();
 
     // If the content represented by the scrollable layer has changed (which may
@@ -933,17 +934,18 @@ APZCTreeManager::PrepareNodeForLayer(con
       // be in the tree. These pointers will get reset properly as we continue
       // building the tree. Also remove it from the set of nodes that are going
       // to be destroyed, because it's going to remain active.
       aState.mNodesToDestroy.RemoveElement(node);
       node->SetPrevSibling(nullptr);
       node->SetLastChild(nullptr);
     }
 
-    APZCTM_LOG("Using APZC %p for layer %p with identifiers %" PRId64 " %" PRId64 "\n", apzc, aLayer.GetLayer(), aLayersId, aMetrics.GetScrollId());
+    APZCTM_LOG("Using APZC %p for layer %p with identifiers %" PRIx64 " %" PRId64 "\n",
+        apzc, aLayer.GetLayer(), uint64_t(aLayersId), aMetrics.GetScrollId());
 
     apzc->NotifyLayersUpdated(aLayer.Metadata(), aState.mIsFirstPaint,
         aLayersId == aState.mOriginatingLayersId);
 
     // Since this is the first time we are encountering an APZC with this guid,
     // the node holding it must be the primary holder. It may be newly-created
     // or not, depending on whether it went through the newApzc branch above.
     MOZ_ASSERT(node->IsPrimaryHolder() && node->GetApzc() && node->GetApzc()->Matches(guid));
@@ -1082,17 +1084,17 @@ WillHandleInput(const PanGestureOrScroll
 }
 
 void
 APZCTreeManager::FlushApzRepaints(LayersId aLayersId)
 {
   // Previously, paints were throttled and therefore this method was used to
   // ensure any pending paints were flushed. Now, paints are flushed
   // immediately, so it is safe to simply send a notification now.
-  APZCTM_LOG("Flushing repaints for layers id 0x%" PRIx64 "\n", aLayersId);
+  APZCTM_LOG("Flushing repaints for layers id 0x%" PRIx64 "\n", uint64_t(aLayersId));
   RefPtr<GeckoContentController> controller = GetContentController(aLayersId);
   MOZ_ASSERT(controller);
   controller->DispatchToRepaintThread(
     NewRunnableMethod("layers::GeckoContentController::NotifyFlushComplete",
                       controller,
                       &GeckoContentController::NotifyFlushComplete));
 }
 

--- a/gfx/layers/apz/util/APZCCallbackHelper.cpp
+++ b/gfx/layers/apz/util/APZCCallbackHelper.cpp
@@ -670,25 +670,19 @@ PrepareForSetTargetAPZCNotification(nsIW
     dpElement, &(guid.mPresShellId), &(guid.mScrollId));
   aTargets->AppendElement(guid);
 
   if (!guidIsValid || nsLayoutUtils::HasDisplayPort(dpElement)) {
     return false;
   }
 
   if (!scrollAncestor) {
-    MOZ_ASSERT(false);  // If you hit this, please file a bug with STR.
-
-    // Attempt some sort of graceful handling based on a theory as to why we
-    // reach this point...
-    // If we get here, the document element is non-null, valid, but doesn't have
-    // a displayport. It's possible that the init code in ChromeProcessController
-    // failed for some reason, or the document element got swapped out at some
-    // later time. In this case let's try to set a displayport on the document
-    // element again and bail out on this operation.
+    // This can happen if the document element gets swapped out after ChromeProcessController
+    // runs InitializeRootDisplayport. In this case let's try to set a displayport again and
+    // bail out on this operation.
     APZCCH_LOG("Widget %p's document element %p didn't have a displayport\n",
         aWidget, dpElement.get());
     APZCCallbackHelper::InitializeRootDisplayport(aRootFrame->PresShell());
     return false;
   }
 
   APZCCH_LOG("%p didn't have a displayport, so setting one...\n", dpElement.get());
   bool activated = nsLayoutUtils::CalculateAndSetDisplayPortMargins(

--- a/gfx/layers/wr/WebRenderLayerManager.cpp
+++ b/gfx/layers/wr/WebRenderLayerManager.cpp
@@ -103,17 +103,16 @@ WebRenderLayerManager::DoDestroy(bool aI
   if (IsDestroyed()) {
     return;
   }
 
   LayerManager::Destroy();
 
   if (WrBridge()) {
     // Just clear ImageKeys, they are deleted during WebRenderAPI destruction.
-    mImageKeysToDeleteLater.Clear();
     mImageKeysToDelete.Clear();
     // CompositorAnimations are cleared by WebRenderBridgeParent.
     mDiscardedCompositorAnimationsIds.Clear();
     WrBridge()->Destroy(aIsSync);
   }
 
   // Clear this before calling RemoveUnusedAndResetWebRenderUserData(),
   // otherwise that function might destroy some WebRenderAnimationData instances
@@ -293,17 +292,16 @@ WebRenderLayerManager::EndTransactionWit
 
   mLatestTransactionId = mTransactionIdAllocator->GetTransactionId(/*aThrottle*/ true);
   TimeStamp transactionStart = mTransactionIdAllocator->GetTransactionStart();
 
   for (const auto& key : mImageKeysToDelete) {
     resourceUpdates.DeleteImage(key);
   }
   mImageKeysToDelete.Clear();
-  mImageKeysToDelete.SwapElements(mImageKeysToDeleteLater);
 
   WrBridge()->RemoveExpiredFontKeys(resourceUpdates);
 
   // Skip the synchronization for buffer since we also skip the painting during
   // device-reset status.
   if (!gfxPlatform::GetPlatform()->DidRenderingDeviceReset()) {
     if (WrBridge()->GetSyncObject() &&
         WrBridge()->GetSyncObject()->IsSyncObjectValid()) {
@@ -401,30 +399,26 @@ WebRenderLayerManager::MakeSnapshotIfReq
   dt->FillRect(dst, pattern);
 
   mTarget = nullptr;
 }
 
 void
 WebRenderLayerManager::AddImageKeyForDiscard(wr::ImageKey key)
 {
-  mImageKeysToDeleteLater.AppendElement(key);
+  mImageKeysToDelete.AppendElement(key);
 }
 
 void
 WebRenderLayerManager::DiscardImages()
 {
   wr::IpcResourceUpdateQueue resources(WrBridge());
-  for (const auto& key : mImageKeysToDeleteLater) {
-    resources.DeleteImage(key);
-  }
   for (const auto& key : mImageKeysToDelete) {
     resources.DeleteImage(key);
   }
-  mImageKeysToDeleteLater.Clear();
   mImageKeysToDelete.Clear();
   WrBridge()->UpdateResources(resources);
 }
 
 void
 WebRenderLayerManager::AddActiveCompositorAnimationId(uint64_t aId)
 {
   // In layers-free mode we track the active compositor animation ids on the
@@ -457,17 +451,16 @@ WebRenderLayerManager::DiscardCompositor
 }
 
 void
 WebRenderLayerManager::DiscardLocalImages()
 {
   // Removes images but doesn't tell the parent side about them
   // This is useful in empty / failed transactions where we created
   // image keys but didn't tell the parent about them yet.
-  mImageKeysToDeleteLater.Clear();
   mImageKeysToDelete.Clear();
 }
 
 void
 WebRenderLayerManager::SetLayerObserverEpoch(uint64_t aLayerObserverEpoch)
 {
   if (WrBridge()->IPCOpen()) {
     WrBridge()->SendSetLayerObserverEpoch(aLayerObserverEpoch);

--- a/gfx/layers/wr/WebRenderLayerManager.h
+++ b/gfx/layers/wr/WebRenderLayerManager.h
@@ -170,21 +170,16 @@ private:
    * Take a snapshot of the parent context, and copy
    * it into mTarget.
    */
   void MakeSnapshotIfRequired(LayoutDeviceIntSize aSize);
 
 private:
   nsIWidget* MOZ_NON_OWNING_REF mWidget;
   nsTArray<wr::ImageKey> mImageKeysToDelete;
-  // TODO - This is needed because we have some code that creates image keys
-  // and enqueues them for deletion right away which is bad not only because
-  // of poor texture cache usage, but also because images end up deleted before
-  // they are used. This should hopfully be temporary.
-  nsTArray<wr::ImageKey> mImageKeysToDeleteLater;
 
   // Set of compositor animation ids for which there are active animations (as
   // of the last transaction) on the compositor side.
   std::unordered_set<uint64_t> mActiveCompositorAnimationIds;
   // Compositor animation ids for animations that are done now and that we want
   // the compositor to discard information for.
   nsTArray<uint64_t> mDiscardedCompositorAnimationsIds;
 

--- a/intl/hyphenation/glue/hnjalloc.h
+++ b/intl/hyphenation/glue/hnjalloc.h
@@ -26,26 +26,32 @@
 #include <stdio.h> /* ensure stdio.h is loaded before our macros */
 
 #undef FILE
 #define FILE hnjFile
 
 #define fopen(path,mode)      hnjFopen(path,mode)
 #define fclose(file)          hnjFclose(file)
 #define fgets(buf,count,file) hnjFgets(buf,count,file)
+#define feof(file)            hnjFeof(file)
+#define fgetc(file)           hnjFgetc(file)
 
 typedef struct hnjFile_ hnjFile;
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 hnjFile* hnjFopen(const char* aURISpec, const char* aMode);
 
 int hnjFclose(hnjFile* f);
 
 char* hnjFgets(char* s, int n, hnjFile* f);
 
+int hnjFeof(hnjFile* f);
+
+int hnjFgetc(hnjFile* f);
+
 #ifdef __cplusplus
 }
 #endif
 
 

--- a/intl/hyphenation/glue/hnjstdio.cpp
+++ b/intl/hyphenation/glue/hnjstdio.cpp
@@ -17,16 +17,17 @@
 
 #define BUFSIZE 1024
 
 struct hnjFile_ {
     nsCOMPtr<nsIInputStream> mStream;
     char                     mBuffer[BUFSIZE];
     uint32_t                 mCurPos;
     uint32_t                 mLimit;
+    bool                     mEOF;
 };
 
 // replacement for fopen()
 // (not a full substitute: only supports read access)
 hnjFile*
 hnjFopen(const char* aURISpec, const char* aMode)
 {
     // this override only needs to support "r"
@@ -53,16 +54,17 @@ hnjFopen(const char* aURISpec, const cha
     if (NS_FAILED(rv)) {
         return nullptr;
     }
 
     hnjFile *f = new hnjFile;
     f->mStream = instream;
     f->mCurPos = 0;
     f->mLimit = 0;
+    f->mEOF = false;
 
     return f;
 }
 
 // replacement for fclose()
 int
 hnjFclose(hnjFile* f)
 {
@@ -74,46 +76,64 @@ hnjFclose(hnjFile* f)
         result = EOF;
     }
     f->mStream = nullptr;
 
     delete f;
     return result;
 }
 
+// replacement for fgetc()
+int
+hnjFgetc(hnjFile* f)
+{
+    if (f->mCurPos >= f->mLimit) {
+        f->mCurPos = 0;
+
+        nsresult rv = f->mStream->Read(f->mBuffer, BUFSIZE, &f->mLimit);
+        if (NS_FAILED(rv)) {
+            f->mLimit = 0;
+        }
+
+        if (f->mLimit == 0) {
+            f->mEOF = true;
+            return EOF;
+        }
+    }
+
+    return f->mBuffer[f->mCurPos++];
+}
+
 // replacement for fgets()
 // (not a full reimplementation, but sufficient for libhyphen's needs)
 char*
 hnjFgets(char* s, int n, hnjFile* f)
 {
     NS_ASSERTION(s && f, "bad argument to hnjFgets");
 
     int i = 0;
     while (i < n - 1) {
-        if (f->mCurPos < f->mLimit) {
-            char c = f->mBuffer[f->mCurPos++];
-            s[i++] = c;
-            if (c == '\n' || c == '\r') {
-                break;
-            }
-            continue;
+        int c = hnjFgetc(f);
+
+        if (c == EOF) {
+            break;
         }
 
-        f->mCurPos = 0;
+        s[i++] = c;
 
-        nsresult rv = f->mStream->Read(f->mBuffer, BUFSIZE, &f->mLimit);
-        if (NS_FAILED(rv)) {
-            f->mLimit = 0;
-            return nullptr;
-        }
-
-        if (f->mLimit == 0) {
+        if (c == '\n' || c == '\r') {
             break;
         }
     }
 
     if (i == 0) {
         return nullptr; // end of file
     }
 
     s[i] = '\0'; // null-terminate the returned string
     return s;
 }
+
+int
+hnjFeof(hnjFile* f)
+{
+    return f->mEOF ? EOF : 0;
+}

--- a/intl/hyphenation/hyphen/hyphen.c
+++ b/intl/hyphenation/hyphen/hyphen.c
@@ -433,21 +433,35 @@ for (k = 0; k < 2; k++) {
     dict[k]->utf8 = (strcmp(dict[k]->cset, "UTF-8") == 0);
   } else {
     strncpy(dict[k]->cset, dict[0]->cset, sizeof(dict[k]->cset)-1);
     dict[k]->cset[sizeof(dict[k]->cset)-1] = '\0';
     dict[k]->utf8 = dict[0]->utf8;
   }
 
   if (k == 0 || nextlevel) {
-    while (fgets (buf, sizeof(buf), f) != NULL) {
+    while (fgets(buf, sizeof(buf), f) != NULL) {
+      
+      /* discard lines that don't fit in buffer */
+      if (!feof(f) && strchr(buf, '\n') == NULL) {
+        int c;
+        while ((c = fgetc(f)) != '\n' && c != EOF);
+        /* issue warning if not a comment */
+        if (buf[0] != '%') {
+          fprintf(stderr, "Warning: skipping too long pattern (more than %lu chars)\n", sizeof(buf));
+        }
+        continue;
+      }
+      
       if (strncmp(buf, "NEXTLEVEL", 9) == 0) {
-	nextlevel = 1;
-	break;
-      } else if (buf[0] != '%') hnj_hyphen_load_line(buf, dict[k], hashtab);
+        nextlevel = 1;
+        break;
+      } else if (buf[0] != '%') {
+        hnj_hyphen_load_line(buf, dict[k], hashtab);
+      }
     }
   } else if (k == 1) {
     /* default first level: hyphen and ASCII apostrophe */
     if (!dict[0]->utf8) hnj_hyphen_load_line("NOHYPHEN ',-\n", dict[k], hashtab);
     else hnj_hyphen_load_line("NOHYPHEN ',\xe2\x80\x93,\xe2\x80\x99,-\n", dict[k], hashtab);
     strncpy(buf, "1-1\n", MAX_CHARS-1); /* buf rewritten by hnj_hyphen_load here */
     buf[MAX_CHARS-1] = '\0';
     hnj_hyphen_load_line(buf, dict[k], hashtab); /* remove hyphen */

--- a/js/public/StructuredClone.h
+++ b/js/public/StructuredClone.h
@@ -290,23 +290,32 @@ typedef bool (*TransferStructuredCloneOp
 /**
  * Called when freeing an unknown transferable object. Note that it
  * should never trigger a garbage collection (and will assert in a
  * debug build if it does.)
  */
 typedef void (*FreeTransferStructuredCloneOp)(uint32_t tag, JS::TransferableOwnership ownership,
                                               void* content, uint64_t extraData, void* closure);
 
+/**
+ * Called when the transferring objects are checked. If this function returns false, the
+ * serialization ends throwing a DataCloneError exception.
+ */
+typedef bool (*CanTransferStructuredCloneOp)(JSContext* cx,
+                                             JS::Handle<JSObject*> obj,
+                                             void* closure);
+
 struct JSStructuredCloneCallbacks {
     ReadStructuredCloneOp read;
     WriteStructuredCloneOp write;
     StructuredCloneErrorOp reportError;
     ReadTransferStructuredCloneOp readTransfer;
     TransferStructuredCloneOp writeTransfer;
     FreeTransferStructuredCloneOp freeTransfer;
+    CanTransferStructuredCloneOp canTransfer;
 };
 
 enum OwnTransferablePolicy {
     OwnsTransferablesIfAny,
     IgnoreTransferablesIfAny,
     NoTransferables
 };
 

--- a/js/public/TrackedOptimizationInfo.h
+++ b/js/public/TrackedOptimizationInfo.h
@@ -33,26 +33,24 @@ namespace JS {
     _(SetProp_TypedObject)                              \
     _(SetProp_DefiniteSlot)                             \
     _(SetProp_Unboxed)                                  \
     _(SetProp_InlineAccess)                             \
     _(SetProp_InlineCache)                              \
                                                         \
     _(GetElem_TypedObject)                              \
     _(GetElem_Dense)                                    \
-    _(GetElem_TypedStatic)                              \
     _(GetElem_TypedArray)                               \
     _(GetElem_String)                                   \
     _(GetElem_Arguments)                                \
     _(GetElem_ArgumentsInlinedConstant)                 \
     _(GetElem_ArgumentsInlinedSwitch)                   \
     _(GetElem_InlineCache)                              \
                                                         \
     _(SetElem_TypedObject)                              \
-    _(SetElem_TypedStatic)                              \
     _(SetElem_TypedArray)                               \
     _(SetElem_Dense)                                    \
     _(SetElem_Arguments)                                \
     _(SetElem_InlineCache)                              \
                                                         \
     _(BinaryArith_Concat)                               \
     _(BinaryArith_SpecializedTypes)                     \
     _(BinaryArith_SpecializedOnBaselineTypes)           \
@@ -118,18 +116,16 @@ namespace JS {
     _(AccessNotTypedObject)                                             \
     _(AccessNotTypedArray)                                              \
     _(AccessNotString)                                                  \
     _(OperandNotString)                                                 \
     _(OperandNotNumber)                                                 \
     _(OperandNotStringOrNumber)                                         \
     _(OperandNotSimpleArith)                                            \
     _(OperandNotEasilyCoercibleToString)                                \
-    _(StaticTypedArrayUint32)                                           \
-    _(StaticTypedArrayCantComputeMask)                                  \
     _(OutOfBounds)                                                      \
     _(GetElemStringNotCached)                                           \
     _(NonNativeReceiver)                                                \
     _(IndexType)                                                        \
     _(SetElemNonDenseNonTANotCached)                                    \
     _(NoSimdJitSupport)                                                 \
     _(SimdTypeNotOptimized)                                             \
     _(UnknownSimdProperty)                                              \

--- a/js/src/builtin/Module.js
+++ b/js/src/builtin/Module.js
@@ -183,19 +183,23 @@ function IsResolvedBinding(resolution)
 }
 
 // 15.2.1.18 GetModuleNamespace(module)
 function GetModuleNamespace(module)
 {
     // Step 1
     assert(IsModule(module), "GetModuleNamespace called with non-module");
 
+    // Until issue https://github.com/tc39/ecma262/issues/1155 is resolved,
+    // violate the spec here and throw if called on an errored module.
+    if (module.status === MODULE_STATUS_EVALUATED_ERROR)
+        throw GetModuleEvaluationError(module);
+
     // Steps 2-3
-    assert(module.status !== MODULE_STATUS_UNINSTANTIATED &&
-           module.status !== MODULE_STATUS_EVALUATED_ERROR,
+    assert(module.status !== MODULE_STATUS_UNINSTANTIATED,
            "Bad module state in GetModuleNamespace");
 
     // Step 4
     let namespace = module.namespace;
 
     // Step 3
     if (typeof namespace === "undefined") {
         let exportedNames = callFunction(module.getExportedNames, module);

--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -1750,42 +1750,16 @@ obj_getOwnPropertySymbols(JSContext* cx,
     if (!obj)
         return false;
 
     return GetOwnPropertyKeys(cx, obj,
                               JSITER_OWNONLY | JSITER_HIDDEN | JSITER_SYMBOLS | JSITER_SYMBOLSONLY,
                               args.rval());
 }
 
-/* ES6 draft rev 32 (2015 Feb 2) 19.1.2.4: Object.defineProperty(O, P, Attributes) */
-bool
-js::obj_defineProperty(JSContext* cx, unsigned argc, Value* vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    // Steps 1-3.
-    RootedObject obj(cx);
-    if (!GetFirstArgumentAsObject(cx, args, "Object.defineProperty", &obj))
-        return false;
-    RootedId id(cx);
-    if (!ToPropertyKey(cx, args.get(1), &id))
-        return false;
-
-    // Steps 4-5.
-    Rooted<PropertyDescriptor> desc(cx);
-    if (!ToPropertyDescriptor(cx, args.get(2), true, &desc))
-        return false;
-
-    // Steps 6-8.
-    if (!DefineProperty(cx, obj, id, desc))
-        return false;
-    args.rval().setObject(*obj);
-    return true;
-}
-
 /* ES5 15.2.3.7: Object.defineProperties(O, Properties) */
 static bool
 obj_defineProperties(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
     /* Steps 1 and 7. */
     RootedObject obj(cx);

--- a/js/src/builtin/Object.h
+++ b/js/src/builtin/Object.h
@@ -17,50 +17,39 @@ class Value;
 } // namespace JS
 
 namespace js {
 
 // Object constructor native. Exposed only so the JIT can know its address.
 MOZ_MUST_USE bool
 obj_construct(JSContext* cx, unsigned argc, JS::Value* vp);
 
-MOZ_MUST_USE bool
-obj_propertyIsEnumerable(JSContext* cx, unsigned argc, Value* vp);
-
 PlainObject*
 ObjectCreateImpl(JSContext* cx, HandleObject proto, NewObjectKind newKind = GenericObject,
                  HandleObjectGroup group = nullptr);
 
 PlainObject*
 ObjectCreateWithTemplate(JSContext* cx, HandlePlainObject templateObj);
 
 // Object methods exposed so they can be installed in the self-hosting global.
 MOZ_MUST_USE bool
-obj_create(JSContext* cx, unsigned argc, JS::Value* vp);
+obj_propertyIsEnumerable(JSContext* cx, unsigned argc, Value* vp);
 
 MOZ_MUST_USE bool
-obj_defineProperty(JSContext* cx, unsigned argc, JS::Value* vp);
+obj_create(JSContext* cx, unsigned argc, JS::Value* vp);
 
 MOZ_MUST_USE bool
 obj_getOwnPropertyNames(JSContext* cx, unsigned argc, JS::Value* vp);
 
 MOZ_MUST_USE bool
-obj_getPrototypeOf(JSContext* cx, unsigned argc, JS::Value* vp);
-
-
-MOZ_MUST_USE bool
-obj_isExtensible(JSContext* cx, unsigned argc, JS::Value* vp);
-
-MOZ_MUST_USE bool
 obj_toString(JSContext* cx, unsigned argc, JS::Value* vp);
 
 JSString*
 ObjectClassToString(JSContext* cx, HandleObject obj);
 
-// Exposed so SelfHosting.cpp can use it in the OwnPropertyKeys intrinsic
 MOZ_MUST_USE bool
 GetOwnPropertyKeys(JSContext* cx, HandleObject obj, unsigned flags, JS::MutableHandleValue rval);
 
 // Exposed for SelfHosting.cpp
 MOZ_MUST_USE bool
 GetOwnPropertyDescriptorToArray(JSContext* cx, unsigned argc, JS::Value* vp);
 
 /*

--- a/js/src/builtin/Object.js
+++ b/js/src/builtin/Object.js
@@ -3,17 +3,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // ES stage 4 proposal
 function ObjectGetOwnPropertyDescriptors(O) {
     // Step 1.
     var obj = ToObject(O);
 
     // Step 2.
-    var keys = OwnPropertyKeys(obj);
+    var keys = std_Reflect_ownKeys(obj);
 
     // Step 3.
     var descriptors = {};
 
     // Step 4.
     for (var index = 0, len = keys.length; index < len; index++) {
         var key = keys[index];
 

--- a/js/src/builtin/Reflect.cpp
+++ b/js/src/builtin/Reflect.cpp
@@ -82,18 +82,18 @@ js::Reflect_isExtensible(JSContext* cx, 
     if (!IsExtensible(cx, target, &extensible))
         return false;
     args.rval().setBoolean(extensible);
     return true;
 }
 
 // ES2018 draft rev c164be80f7ea91de5526b33d54e5c9321ed03d3f
 // 26.1.10 Reflect.ownKeys ( target )
-static bool
-Reflect_ownKeys(JSContext* cx, unsigned argc, Value* vp)
+bool
+js::Reflect_ownKeys(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
     // Step 1.
     RootedObject target(cx, NonNullObjectArg(cx, "`target`", "Reflect.ownKeys", args.get(0)));
     if (!target)
         return false;
 

--- a/js/src/builtin/Reflect.h
+++ b/js/src/builtin/Reflect.h
@@ -19,11 +19,14 @@ InitReflect(JSContext* cx, js::HandleObj
 namespace js {
 
 extern MOZ_MUST_USE bool
 Reflect_getPrototypeOf(JSContext* cx, unsigned argc, Value* vp);
 
 extern MOZ_MUST_USE bool
 Reflect_isExtensible(JSContext* cx, unsigned argc, Value* vp);
 
+extern MOZ_MUST_USE bool
+Reflect_ownKeys(JSContext* cx, unsigned argc, Value* vp);
+
 }
 
 #endif /* builtin_Reflect_h */

--- a/js/src/builtin/Utilities.js
+++ b/js/src/builtin/Utilities.js
@@ -214,77 +214,88 @@ function GetInternalError(msg) {
         return e;
     }
     assert(false, "the catch block should've returned from this function.");
 }
 
 // To be used when a function is required but calling it shouldn't do anything.
 function NullFunction() {}
 
-// Object Rest/Spread Properties proposal
-// Abstract operation: CopyDataProperties (target, source, excluded)
-function CopyDataProperties(target, source, excluded) {
+// ES2019 draft rev 4c2df13f4194057f09b920ee88712e5a70b1a556
+// 7.3.23 CopyDataProperties (target, source, excludedItems)
+function CopyDataProperties(target, source, excludedItems) {
     // Step 1.
     assert(IsObject(target), "target is an object");
 
     // Step 2.
-    assert(IsObject(excluded), "excluded is an object");
+    assert(IsObject(excludedItems), "excludedItems is an object");
 
-    // Steps 3, 6.
+    // Steps 3 and 7.
     if (source === undefined || source === null)
         return;
 
-    // Step 4.a.
-    source = ToObject(source);
-
-    // Step 4.b.
-    var keys = OwnPropertyKeys(source);
+    // Step 4.
+    var from = ToObject(source);
 
     // Step 5.
+    var keys = CopyDataPropertiesOrGetOwnKeys(target, from, excludedItems);
+
+    // Return if we copied all properties in native code.
+    if (keys === null)
+        return;
+
+    // Step 6.
     for (var index = 0; index < keys.length; index++) {
         var key = keys[index];
 
         // We abbreviate this by calling propertyIsEnumerable which is faster
         // and returns false for not defined properties.
-        if (!hasOwn(key, excluded) && callFunction(std_Object_propertyIsEnumerable, source, key))
-            _DefineDataProperty(target, key, source[key]);
+        if (!hasOwn(key, excludedItems) &&
+            callFunction(std_Object_propertyIsEnumerable, from, key))
+        {
+            _DefineDataProperty(target, key, from[key]);
+        }
     }
 
-    // Step 6 (Return).
+    // Step 7 (Return).
 }
 
-// Object Rest/Spread Properties proposal
-// Abstract operation: CopyDataProperties (target, source, excluded)
+// ES2019 draft rev 4c2df13f4194057f09b920ee88712e5a70b1a556
+// 7.3.23 CopyDataProperties (target, source, excludedItems)
 function CopyDataPropertiesUnfiltered(target, source) {
     // Step 1.
     assert(IsObject(target), "target is an object");
 
     // Step 2 (Not applicable).
 
-    // Steps 3, 6.
+    // Steps 3 and 7.
     if (source === undefined || source === null)
         return;
 
-    // Step 4.a.
-    source = ToObject(source);
-
-    // Step 4.b.
-    var keys = OwnPropertyKeys(source);
+    // Step 4.
+    var from = ToObject(source);
 
     // Step 5.
+    var keys = CopyDataPropertiesOrGetOwnKeys(target, from, null);
+
+    // Return if we copied all properties in native code.
+    if (keys === null)
+        return;
+
+    // Step 6.
     for (var index = 0; index < keys.length; index++) {
         var key = keys[index];
 
         // We abbreviate this by calling propertyIsEnumerable which is faster
         // and returns false for not defined properties.
-        if (callFunction(std_Object_propertyIsEnumerable, source, key))
-            _DefineDataProperty(target, key, source[key]);
+        if (callFunction(std_Object_propertyIsEnumerable, from, key))
+            _DefineDataProperty(target, key, from[key]);
     }
 
-    // Step 6 (Return).
+    // Step 7 (Return).
 }
 
 /*************************************** Testing functions ***************************************/
 function outer() {
     return function inner() {
         return "foo";
     };
 }

--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -5484,30 +5484,17 @@ BytecodeEmitter::setOrEmitSetFunName(Par
                                      FunctionPrefixKind prefixKind)
 {
     MOZ_ASSERT(maybeFun->isDirectRHSAnonFunction());
 
     if (maybeFun->isKind(ParseNodeKind::Function)) {
         // Function doesn't have 'name' property at this point.
         // Set function's name at compile time.
         JSFunction* fun = maybeFun->pn_funbox->function();
-
-        // Single node can be emitted multiple times if it appears in
-        // array destructuring default.  If function already has a name,
-        // just return.
-        if (fun->hasInferredName()) {
-#ifdef DEBUG
-            RootedFunction rootedFun(cx, fun);
-            JSAtom* funName = NameToFunctionName(cx, name, prefixKind);
-            if (!funName)
-                return false;
-            MOZ_ASSERT(funName == rootedFun->inferredName());
-#endif
-            return true;
-        }
+        MOZ_ASSERT(!fun->hasInferredName());
 
         fun->setInferredName(name);
         return true;
     }
 
     MOZ_ASSERT(maybeFun->isKind(ParseNodeKind::Class));
 
     uint32_t nameIndex;

--- a/js/src/frontend/FoldConstants.cpp
+++ b/js/src/frontend/FoldConstants.cpp
@@ -1285,19 +1285,21 @@ FoldElement(JSContext* cx, ParseNode** n
             name = atom->asPropertyName();
         }
     } else if (key->isKind(ParseNodeKind::Number)) {
         double number = key->pn_dval;
         if (number != ToUint32(number)) {
             // Optimization 2: We have something like expr[3.14]. The number
             // isn't an array index, so it converts to a string ("3.14"),
             // enabling optimization 3 below.
-            JSAtom* atom = ToAtom<NoGC>(cx, DoubleValue(number));
-            if (!atom)
+            JSAtom* atom = NumberToAtom(cx, number);
+            if (!atom) {
+                cx->recoverFromOutOfMemory();
                 return false;
+            }
             name = atom->asPropertyName();
         }
     }
 
     // If we don't have a name, we can't optimize to getprop.
     if (!name)
         return true;
 

--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -9304,24 +9304,16 @@ GeneralParser<ParseHandler, CharT>::arra
                                          reportMissingClosing(JSMSG_BRACKET_AFTER_LIST,
                                                               JSMSG_BRACKET_OPENED, begin));
     }
 
     handler.setEndPosition(literal, pos().end);
     return literal;
 }
 
-static JSAtom*
-DoubleToAtom(JSContext* cx, double value)
-{
-    // This is safe because doubles can not be moved.
-    Value tmp = DoubleValue(value);
-    return ToAtom<CanGC>(cx, HandleValue::fromMarkedLocation(&tmp));
-}
-
 template <class ParseHandler, typename CharT>
 typename ParseHandler::Node
 GeneralParser<ParseHandler, CharT>::propertyName(YieldHandling yieldHandling,
                                                  const Maybe<DeclarationKind>& maybeDecl,
                                                  Node propList,
                                                  PropertyType* propType,
                                                  MutableHandleAtom propAtom)
 {
@@ -9369,17 +9361,17 @@ GeneralParser<ParseHandler, CharT>::prop
         if (!tokenStream.getToken(&ltok))
             return null();
     }
 
     propAtom.set(nullptr);
     Node propName;
     switch (ltok) {
       case TokenKind::Number:
-        propAtom.set(DoubleToAtom(context, anyChars.currentToken().number()));
+        propAtom.set(NumberToAtom(context, anyChars.currentToken().number()));
         if (!propAtom.get())
             return null();
         propName = newNumber(anyChars.currentToken());
         if (!propName)
             return null();
         break;
 
       case TokenKind::String: {
@@ -9433,27 +9425,27 @@ GeneralParser<ParseHandler, CharT>::prop
         }
         if (tt == TokenKind::String) {
             tokenStream.consumeKnownToken(TokenKind::String);
 
             propAtom.set(anyChars.currentToken().atom());
 
             uint32_t index;
             if (propAtom->isIndex(&index)) {
-                propAtom.set(DoubleToAtom(context, index));
+                propAtom.set(NumberToAtom(context, index));
                 if (!propAtom.get())
                     return null();
                 return handler.newNumber(index, NoDecimal, pos());
             }
             return stringLiteral();
         }
         if (tt == TokenKind::Number) {
             tokenStream.consumeKnownToken(TokenKind::Number);
 
-            propAtom.set(DoubleToAtom(context, anyChars.currentToken().number()));
+            propAtom.set(NumberToAtom(context, anyChars.currentToken().number()));
             if (!propAtom.get())
                 return null();
             return newNumber(anyChars.currentToken());
         }
         if (tt == TokenKind::Lb) {
             tokenStream.consumeKnownToken(TokenKind::Lb);
 
             return computedPropertyName(yieldHandling, maybeDecl, propList);

--- a/js/src/fuzz-tests/moz.build
+++ b/js/src/fuzz-tests/moz.build
@@ -4,16 +4,17 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 GeckoProgram('fuzz-tests', linkage=None)
 
 UNIFIED_SOURCES += [
     'testExample.cpp',
     'tests.cpp',
+    'testStructuredCloneReader.cpp',
 ]
 
 if CONFIG['JS_BUILD_BINAST']:
     UNIFIED_SOURCES += [
         'testBinASTReader.cpp',
     ]
 
 DEFINES['EXPORT_JS_API'] = True

new file mode 100644
--- /dev/null
+++ b/js/src/fuzz-tests/testStructuredCloneReader.cpp
@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+
+#include "mozilla/ScopeExit.h"
+
+#include "jsapi.h"
+
+#include "fuzz-tests/tests.h"
+#include "vm/Interpreter.h"
+
+#include "vm/JSContext-inl.h"
+
+using namespace js;
+
+// These are defined and pre-initialized by the harness (in tests.cpp).
+extern JS::PersistentRootedObject gGlobal;
+extern JSContext* gCx;
+
+static int
+testStructuredCloneReaderInit(int *argc, char ***argv) {
+  return 0;
+}
+
+static int
+testStructuredCloneReaderFuzz(const uint8_t* buf, size_t size) {
+    auto gcGuard = mozilla::MakeScopeExit([&] {
+        JS::PrepareForFullGC(gCx);
+        JS::GCForReason(gCx, GC_NORMAL, JS::gcreason::API);
+    });
+
+    if (!size) return 0;
+
+    // Make sure to pad the buffer to a multiple of kSegmentAlignment
+    const size_t kSegmentAlignment = 8;
+    size_t buf_size = JS_ROUNDUP(size, kSegmentAlignment);
+
+    auto clonebuf = MakeUnique<JSStructuredCloneData>(0, 0, buf_size);
+    if (!clonebuf || !clonebuf->Init(buf_size, buf_size)) {
+        ReportOutOfMemory(gCx);
+        return 0;
+    }
+
+    // Initialize with zeros, including padding, then copy buffer
+    memset(clonebuf->Start(), '\0', buf_size);
+    js_memcpy(clonebuf->Start(), buf, size);
+
+    JS::StructuredCloneScope scope = JS::StructuredCloneScope::DifferentProcess;
+
+    RootedValue deserialized(gCx);
+    if (!JS_ReadStructuredClone(gCx, *clonebuf,
+    			JS_STRUCTURED_CLONE_VERSION,
+    			scope,
+    			&deserialized, nullptr, nullptr))
+    {
+        return 0;
+    }
+
+    /* If we succeeded in deserializing, we should try to reserialize the data.
+       This has two main advantages:
+
+       1) It tests parts of the serializer as well.
+       2) The deserialized data is actually used, making it more likely to detect
+          further memory-related problems.
+
+       Tests show that this also doesn't cause a serious performance penalty.
+    */
+    mozilla::Maybe<JSAutoStructuredCloneBuffer> clonebufOut;
+    JS::CloneDataPolicy policy;
+
+    clonebufOut.emplace(scope, nullptr, nullptr);
+    if (!clonebufOut->write(gCx, deserialized, UndefinedHandleValue, policy))
+        return 0;
+
+    return 0;
+}
+
+MOZ_FUZZING_INTERFACE_RAW(
+    testStructuredCloneReaderInit,
+    testStructuredCloneReaderFuzz,
+    StructuredCloneReader
+);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1448582-1.js
@@ -0,0 +1,21 @@
+// Overview:
+// - The outer function is an IIFE which gets marked as a singleton.
+// - The |o[index]| inner function is then also marked as a singleton.
+// - The |o[index]| inner function has a dynamic name from a computed property name.
+// - The |self| inner function uses |Function.prototype.caller| to reinvoke the outer function.
+//
+// When we reinvoke outer, we end up cloning a previously reused, i.e. non-cloned,
+// function which triggered an assertion in js::SetFunctionNameIfNoOwnName().
+
+(function(index) {
+    var o = {
+        [index]: function() {}
+    };
+
+    // Reinvoke the IIFE through |Function.prototype.caller|.
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1448582-2.js
@@ -0,0 +1,25 @@
+// Overview:
+// - The outer function is an IIFE which gets marked as a singleton.
+// - The |o[index]| inner function is then also marked as a singleton.
+// - The |o[index]| inner function has a dynamic name from a computed property name.
+// - The |self| inner function uses |Function.prototype.caller| to reinvoke the outer function.
+//
+// When we reinvoke outer, we end up cloning a previously reused, i.e. non-cloned,
+// function which triggered an assertion in js::SetFunctionNameIfNoOwnName().
+
+(function(index) {
+    var o = {
+        [index]: function() {}
+    };
+
+    // Accessing |.name| sets the resolved-name flag, which triggered yet
+    // another assertion when compared to bug1448582-1.js
+    assertEq(o[index].name, String(index));
+
+    // Reinvoke the IIFE through |Function.prototype.caller|.
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1448582-3.js
@@ -0,0 +1,22 @@
+// Overview:
+// - The outer function is an IIFE which gets marked as a singleton.
+// - The |fn| inner function is then also marked as a singleton.
+// - The |self| inner function uses |Function.prototype.caller| to reinvoke the outer function.
+//
+// When we reinvoke outer, we end up cloning a previously reused, i.e. non-cloned,
+// function.
+
+(function(index) {
+    var fn = function() {};
+
+    // Accessing |.name| sets the resolved-name flag, which should not be
+    // copied over to the function clone.
+    assertEq(fn.name, "fn");
+
+    // Reinvoke the IIFE through |Function.prototype.caller|.
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1448582-4.js
@@ -0,0 +1,22 @@
+// Overview:
+// - The outer function is an IIFE which gets marked as a singleton.
+// - The |fn| inner function is then also marked as a singleton.
+// - The |self| inner function uses |Function.prototype.caller| to reinvoke the outer function.
+//
+// When we reinvoke outer, we end up cloning a previously reused, i.e. non-cloned,
+// function.
+
+(function(index) {
+    var fn = function(a) {};
+
+    // Accessing |.length| sets the resolved-length flag, which should not be
+    // copied over to the function clone.
+    assertEq(fn.length, 1);
+
+    // Reinvoke the IIFE through |Function.prototype.caller|.
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1448582-5.js
@@ -0,0 +1,133 @@
+// Repeat 1448582-{1,3,4}.js for classes.
+
+(function(index) {
+    // Does not assert.
+    var c = class { constructor(){} };
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+(function(index) {
+    var c = class { constructor(){} };
+
+    // Accessing |.name| sets the resolved-name flag, which should not be
+    // copied over to the function clone.
+    assertEq(c.name, "c");
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+(function(index) {
+    var c = class { constructor(a){} };
+
+    // Accessing |.length| sets the resolved-length flag, which should not be
+    // copied over to the function clone.
+    assertEq(c.length, 1);
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+
+// Repeat 1448582-{3,4}.js for generator functions.
+
+(function(index) {
+    function* f() {}
+
+    // Accessing |.name| sets the resolved-name flag, which should not be
+    // copied over to the function clone.
+    assertEq(f.name, "f");
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+(function(index) {
+    function* f(a) {}
+
+    // Accessing |.length| sets the resolved-length flag, which should not be
+    // copied over to the function clone.
+    assertEq(f.length, 1);
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+
+// Repeat 1448582-{3,4}.js for async functions.
+
+(function(index) {
+    async function f() {}
+
+    // Accessing |.name| sets the resolved-name flag, which should not be
+    // copied over to the function clone.
+    assertEq(f.name, "f");
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+(function(index) {
+    async function f(a) {}
+
+    // Accessing |.length| sets the resolved-length flag, which should not be
+    // copied over to the function clone.
+    assertEq(f.length, 1);
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+
+// Repeat 1448582-{3,4}.js for async generator functions.
+
+(function(index) {
+    async function* f() {}
+
+    // Accessing |.name| sets the resolved-name flag, which should not be
+    // copied over to the function clone.
+    assertEq(f.name, "f");
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);
+
+(function(index) {
+    async function* f(a) {}
+
+    // Accessing |.length| sets the resolved-length flag, which should not be
+    // copied over to the function clone.
+    assertEq(f.length, 1);
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1448582-6.js
@@ -0,0 +1,27 @@
+// Overview:
+// - The outer function is an IIFE which gets marked as a singleton.
+// - The |o[index]| inner function is then also marked as a singleton.
+// - The |o[index]| inner function has a dynamic name from a computed property name.
+// - The |self| inner function uses |Function.prototype.caller| to reinvoke the outer function.
+
+(function(index) {
+    var o = {
+        [index]: class {
+            constructor() {}
+
+            // Prevent adding an inferred name at index = 1 by creating a
+            // static method named "name".
+            static [(index === 0 ? "not-name" : "name")]() {}
+        }
+    }
+
+    // At index = 0 the class will get the inferred name "0".
+    // At index = 1 the class should have no inferred name.
+    assertEq(displayName(o[index]), index === 0 ? "0" : "");
+
+    if (index === 0) {
+        (function self() {
+            self.caller(1);
+        })();
+    }
+})(0);

--- a/js/src/jit-test/tests/basic/object-assign-unboxed.js
+++ b/js/src/jit-test/tests/basic/object-assign-unboxed.js
@@ -5,17 +5,18 @@ function Unboxed() {
     this.b = true;
 }
 
 function tryCreateUnboxedObject() {
     var obj;
     for (var i = 0; i < 1000; ++i) {
         obj = new Unboxed();
     }
-
+    if (unboxedObjectsEnabled())
+        assertEq(isUnboxedObject(obj), true);
     return obj;
 }
 
 function basic() {
     var unboxed = tryCreateUnboxedObject();
 
     var target = {};
     Object.assign(target, unboxed);

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/object-rest-unboxed.js
@@ -0,0 +1,44 @@
+load(libdir + "asserts.js");
+
+function Unboxed() {
+    this.a = 0;
+    this.b = true;
+}
+
+function tryCreateUnboxedObject() {
+    var obj;
+    for (var i = 0; i < 1000; ++i) {
+        obj = new Unboxed();
+    }
+    if (unboxedObjectsEnabled())
+        assertEq(isUnboxedObject(obj), true);
+    return obj;
+}
+
+function basic() {
+    var unboxed = tryCreateUnboxedObject();
+
+    var {...target} = unboxed;
+    assertDeepEq(target, {a: 0, b: true});
+
+    var {a, c, ...target} = unboxed;
+    assertDeepEq(a, 0);
+    assertDeepEq(c, undefined);
+    assertDeepEq(target, {b: true});
+}
+
+function expando() {
+    var unboxed = tryCreateUnboxedObject();
+    unboxed.c = 3.5;
+
+    var {...target} = unboxed;
+    assertDeepEq(target, {a: 0, b: true, c: 3.5});
+
+    var {a, d, ...target} = unboxed;
+    assertDeepEq(a, 0);
+    assertDeepEq(d, undefined);
+    assertDeepEq(target, {b: true, c: 3.5});
+}
+
+basic();
+expando();

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/object-rest.js
@@ -0,0 +1,90 @@
+function test() {
+    var from, to;
+
+    // From values.
+    from = {x: 1, y: 2};
+    ({...to} = from);
+    assertEq(to.y, 2);
+
+    var z;
+    from = {x: 1, y: 2};
+    ({x: z, ...to} = from);
+    assertEq(z, 1);
+    assertEq(to.y, 2);
+
+    // From getter.
+    var c = 7;
+    from = {x: 1, get y() { return ++c; }};
+    ({...to} = from);
+    assertEq(c, 8);
+    assertEq(to.y, 8);
+
+    from = {x: 1, get y() { return ++c; }};
+    ({y: z, ...to} = from);
+    assertEq(c, 9);
+    assertEq(z, 9);
+    assertEq(to.y, undefined);
+
+    // Array with dense elements.
+    from = [1, 2, 3];
+    ({...to} = from);
+    assertEq(to[2], 3);
+    assertEq("length" in to, false);
+
+    from = [1, 2, 3];
+    ({2: z, ...to} = from);
+    assertEq(z, 3);
+    assertEq(to[2], undefined);
+    assertEq(to[0], 1);
+    assertEq("length" in to, false);
+
+    // Object with sparse elements and symbols.
+    from = {x: 1, 1234567: 2, 1234560: 3, [Symbol.iterator]: 5, z: 3};
+    ({...to} = from);
+    assertEq(to[1234567], 2);
+    assertEq(Object.keys(to).toString(), "1234560,1234567,x,z");
+    assertEq(to[Symbol.iterator], 5);
+
+    from = {x: 1, 1234567: 2, 1234560: 3, [Symbol.iterator]: 5, z: 3};
+    ({[Symbol.iterator]: z, ...to} = from);
+    assertEq(to[1234567], 2);
+    assertEq(Object.keys(to).toString(), "1234560,1234567,x,z");
+    assertEq(to[Symbol.iterator], undefined);
+    assertEq(z, 5);
+
+    // Typed array.
+    from = new Int32Array([1, 2, 3]);
+    ({...to} = from);
+    assertEq(to[1], 2);
+
+    from = new Int32Array([1, 2, 3]);
+    ({1: z, ...to} = from);
+    assertEq(z, 2);
+    assertEq(to[1], undefined);
+    assertEq(to[2], 3);
+
+    // Primitive string.
+    from = "foo";
+    ({...to} = from);
+    assertEq(to[0], "f");
+
+    from = "foo";
+    ({0: z, ...to} = from);
+    assertEq(z, "f");
+    assertEq(to[0], undefined);
+    assertEq(to[1], "o");
+
+    // String object.
+    from = new String("bar");
+    ({...to} = from);
+    assertEq(to[2], "r");
+
+    from = new String("bar");
+    ({1: z, ...to} = from);
+    assertEq(z, "a");
+    assertEq(to[1], undefined);
+    assertEq(to[2], "r");
+}
+test();
+test();
+test();

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/object-spread-unboxed.js
@@ -0,0 +1,40 @@
+load(libdir + "asserts.js");
+
+function Unboxed() {
+    this.a = 0;
+    this.b = true;
+}
+
+function tryCreateUnboxedObject() {
+    var obj;
+    for (var i = 0; i < 1000; ++i) {
+        obj = new Unboxed();
+    }
+    if (unboxedObjectsEnabled())
+        assertEq(isUnboxedObject(obj), true);
+    return obj;
+}
+
+function basic() {
+    var unboxed = tryCreateUnboxedObject();
+
+    var target = {...unboxed};
+    assertDeepEq(target, {a: 0, b: true});
+
+    target = {a: 1, c: 3, ...unboxed};
+    assertDeepEq(target, {a: 0, c: 3, b: true});
+}
+
+function expando() {
+    var unboxed = tryCreateUnboxedObject();
+    unboxed.c = 3.5;
+
+    var target = {...unboxed};
+    assertDeepEq(target, {a: 0, b: true, c: 3.5});
+
+    target = {a: 1, d: 3, ...unboxed};
+    assertDeepEq(target, {a: 0, d: 3, b: true, c: 3.5});
+}
+
+basic();
+expando();

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/object-spread.js
@@ -0,0 +1,49 @@
+function test() {
+    var from, to;
+
+    // From values.
+    from = {x: 1, y: 2};
+    to = {...from};
+    assertEq(to.y, 2);
+    to = {...from, ...from};
+    assertEq(to.y, 2);
+
+    // From getter.
+    var c = 7;
+    from = {x: 1, get y() { return ++c; }};
+    to = {...from};
+    assertEq(to.y, 8);
+    to = {...from, ...from};
+    assertEq(to.y, 10);
+
+    // Array with dense elements.
+    from = [1, 2, 3];
+    to = {...from};
+    assertEq(to[2], 3);
+    assertEq("length" in to, false);
+
+    // Object with sparse elements and symbols.
+    from = {x: 1, 1234567: 2, 1234560: 3, [Symbol.iterator]: 5, z: 3};
+    to = {...from};
+    assertEq(to[1234567], 2);
+    assertEq(Object.keys(to).toString(), "1234560,1234567,x,z");
+    assertEq(to[Symbol.iterator], 5);
+
+    // Typed array.
+    from = new Int32Array([1, 2, 3]);
+    to = {...from};
+    assertEq(to[1], 2);
+
+    // Primitive string.
+    from = "foo";
+    to = {...from};
+    assertEq(to[0], "f");
+
+    // String object.
+    from = new String("bar");
+    to = {...from};
+    assertEq(to[2], "r");
+}
+test();
+test();
+test();

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/modules/bug1449153.js
@@ -0,0 +1,35 @@
+// Test performing GetModuleNamespace on an errored module.
+
+class MyError {}
+
+function assertThrowsMyError(f)
+{
+    let caught = false;
+    try {
+        f();
+    } catch (e) {
+        caught = true;
+        assertEq(e.constructor, MyError);
+    }
+    assertEq(caught, true);
+}
+
+let moduleRepo = {};
+setModuleResolveHook(function(module, specifier) {
+    return moduleRepo[specifier];
+});
+
+moduleRepo["a"] = parseModule(`
+    throw new MyError();
+`);
+
+let c = moduleRepo["c"] = parseModule(`
+    import "a";
+`);
+c.declarationInstantiation();
+assertThrowsMyError(() => c.evaluation());
+
+let b = moduleRepo['b'] = parseModule(`
+    import * as ns0 from 'a'
+`);
+assertThrowsMyError(() => b.declarationInstantiation());

--- a/js/src/jit-test/tests/wasm/regress/baseline-getglobal-scratch.js
+++ b/js/src/jit-test/tests/wasm/regress/baseline-getglobal-scratch.js
@@ -27,9 +27,32 @@ new WebAssembly.Module(wasmTextToBinary(
         get_global $g
         get_global $g
         get_global $g
         get_global $g
         get_global $g
         unreachable
     )
 )
-`))
+`));
+
+new WebAssembly.Module(wasmTextToBinary(`
+(module
+    (global $g (mut i32) (i32.const 42))
+    (func (param $i i32)
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_global $g
+        get_local $i
+        set_global $g
+        unreachable
+    )
+)
+`));

--- a/js/src/jit/AliasAnalysisShared.cpp
+++ b/js/src/jit/AliasAnalysisShared.cpp
@@ -118,18 +118,16 @@ GetObject(const MDefinition* ins)
       case MDefinition::Opcode::LoadElementHole:
       case MDefinition::Opcode::TypedArrayElements:
       case MDefinition::Opcode::TypedObjectElements:
       case MDefinition::Opcode::CopyLexicalEnvironmentObject:
       case MDefinition::Opcode::IsPackedArray:
         object = ins->getOperand(0);
         break;
       case MDefinition::Opcode::GetPropertyCache:
-      case MDefinition::Opcode::LoadTypedArrayElementStatic:
-      case MDefinition::Opcode::StoreTypedArrayElementStatic:
       case MDefinition::Opcode::GetDOMProperty:
       case MDefinition::Opcode::GetDOMMember:
       case MDefinition::Opcode::Call:
       case MDefinition::Opcode::Compare:
       case MDefinition::Opcode::GetArgumentsObjectArg:
       case MDefinition::Opcode::SetArgumentsObjectArg:
       case MDefinition::Opcode::GetFrameArgument:
       case MDefinition::Opcode::SetFrameArgument:

--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -1375,19 +1375,21 @@ BaselineCacheIRCompiler::emitStoreDenseE
 
     FailurePath* failure;
     if (!addFailurePath(&failure))
         return false;
 
     // Load obj->elements in scratch.
     masm.loadPtr(Address(obj, NativeObject::offsetOfElements()), scratch);
 
-    // Bounds check.
+    // Bounds check. Unfortunately we don't have more registers available on
+    // x86, so use InvalidReg and emit slightly slower code on x86.
+    Register spectreTemp = InvalidReg;
     Address initLength(scratch, ObjectElements::offsetOfInitializedLength());
-    masm.branch32(Assembler::BelowOrEqual, initLength, index, failure->label());
+    masm.spectreBoundsCheck32(index, initLength, spectreTemp, failure->label());
 
     // Hole check.
     BaseObjectElementIndex element(scratch, index);
     masm.branchTestMagic(Assembler::Equal, element, failure->label());
 
     // Perform a single test to see if we either need to convert double
     // elements, clone the copy on write elements in the object or fail
     // due to a frozen element.
@@ -1466,28 +1468,40 @@ BaselineCacheIRCompiler::emitStoreDenseE
     Address elementsFlags(scratch, ObjectElements::offsetOfFlags());
 
     // Check for copy-on-write or frozen elements.
     masm.branchTest32(Assembler::NonZero, elementsFlags,
                       Imm32(ObjectElements::COPY_ON_WRITE |
                             ObjectElements::FROZEN),
                       failure->label());
 
+    // We don't have enough registers on x86 so use InvalidReg. This will emit
+    // slightly less efficient code on x86.
+    Register spectreTemp = InvalidReg;
+
     if (handleAdd) {
-        // Fail if index > initLength.
-        masm.branch32(Assembler::Below, initLength, index, failure->label());
+        // Bounds check.
+        Label capacityOk, outOfBounds;
+        masm.spectreBoundsCheck32(index, initLength, spectreTemp, &outOfBounds);
+        masm.jump(&capacityOk);
+
+        // If we're out-of-bounds, only handle the index == initLength case.
+        masm.bind(&outOfBounds);
+        masm.branch32(Assembler::NotEqual, initLength, index, failure->label());
 
         // If index < capacity, we can add a dense element inline. If not we
         // need to allocate more elements.
-        Label capacityOk;
+        Label allocElement;
         Address capacity(scratch, ObjectElements::offsetOfCapacity());
-        masm.branch32(Assembler::Above, capacity, index, &capacityOk);
+        masm.spectreBoundsCheck32(index, capacity, spectreTemp, &allocElement);
+        masm.jump(&capacityOk);
 
         // Check for non-writable array length. We only have to do this if
         // index >= capacity.
+        masm.bind(&allocElement);
         masm.branchTest32(Assembler::NonZero, elementsFlags,
                           Imm32(ObjectElements::NONWRITABLE_ARRAY_LENGTH),
                           failure->label());
 
         LiveRegisterSet save(GeneralRegisterSet::Volatile(), liveVolatileFloatRegs());
         save.takeUnchecked(scratch);
         masm.PushRegsInMask(save);
 
@@ -1505,17 +1519,17 @@ BaselineCacheIRCompiler::emitStoreDenseE
         masm.loadPtr(Address(obj, NativeObject::offsetOfElements()), scratch);
 
         masm.bind(&capacityOk);
 
         // We increment initLength after the callTypeUpdateIC call, to ensure
         // the type update code doesn't read uninitialized memory.
     } else {
         // Fail if index >= initLength.
-        masm.branch32(Assembler::BelowOrEqual, initLength, index, failure->label());
+        masm.spectreBoundsCheck32(index, initLength, spectreTemp, failure->label());
     }
 
     // Check if we have to convert a double element.
     Label noConversion;
     masm.branchTest32(Assembler::Zero, elementsFlags,
                       Imm32(ObjectElements::CONVERT_DOUBLE_ELEMENTS),
                       &noConversion);
 
@@ -1590,39 +1604,41 @@ BaselineCacheIRCompiler::emitArrayPush()
     AutoScratchRegister scratchLength(allocator, masm);
 
     FailurePath* failure;
     if (!addFailurePath(&failure))
         return false;
 
     // Load obj->elements in scratch.
     masm.loadPtr(Address(obj, NativeObject::offsetOfElements()), scratch);
-    masm.load32(Address(scratch, ObjectElements::offsetOfLength()), scratchLength);
-
-    BaseObjectElementIndex element(scratch, scratchLength);
-    Address initLength(scratch, ObjectElements::offsetOfInitializedLength());
+
+    Address elementsInitLength(scratch, ObjectElements::offsetOfInitializedLength());
+    Address elementsLength(scratch, ObjectElements::offsetOfLength());
     Address elementsFlags(scratch, ObjectElements::offsetOfFlags());
 
     // Check for copy-on-write or frozen elements.
     masm.branchTest32(Assembler::NonZero, elementsFlags,
                       Imm32(ObjectElements::COPY_ON_WRITE |
                             ObjectElements::FROZEN),
                       failure->label());
 
     // Fail if length != initLength.
-    masm.branch32(Assembler::NotEqual, initLength, scratchLength, failure->label());
+    masm.load32(elementsInitLength, scratchLength);
+    masm.branch32(Assembler::NotEqual, elementsLength, scratchLength, failure->label());
 
     // If scratchLength < capacity, we can add a dense element inline. If not we
     // need to allocate more elements.
-    Label capacityOk;
+    Label capacityOk, allocElement;
     Address capacity(scratch, ObjectElements::offsetOfCapacity());
-    masm.branch32(Assembler::Above, capacity, scratchLength, &capacityOk);
+    masm.spectreBoundsCheck32(scratchLength, capacity, InvalidReg, &allocElement);
+    masm.jump(&capacityOk);
 
     // Check for non-writable array length. We only have to do this if
     // index >= capacity.
+    masm.bind(&allocElement);
     masm.branchTest32(Assembler::NonZero, elementsFlags,
                       Imm32(ObjectElements::NONWRITABLE_ARRAY_LENGTH),
                       failure->label());
 
     LiveRegisterSet save(GeneralRegisterSet::Volatile(), liveVolatileFloatRegs());
     save.takeUnchecked(scratch);
     masm.PushRegsInMask(save);
 
@@ -1667,22 +1683,22 @@ BaselineCacheIRCompiler::emitArrayPush()
     saveRegs.add(val);
     if (!callTypeUpdateIC(obj, val, scratch, saveRegs))
         return false;
 
     // Reload obj->elements as callTypeUpdateIC used the scratch register.
     masm.loadPtr(Address(obj, NativeObject::offsetOfElements()), scratch);
 
     // Increment initLength and length.
-    Address length(scratch, ObjectElements::offsetOfLength());
-    masm.add32(Imm32(1), initLength);
-    masm.load32(length, scratchLength);
-    masm.add32(Imm32(1), length);
+    masm.add32(Imm32(1), elementsInitLength);
+    masm.load32(elementsLength, scratchLength);
+    masm.add32(Imm32(1), elementsLength);
 
     // Store the value.
+    BaseObjectElementIndex element(scratch, scratchLength);
     masm.storeValue(val, element);
     emitPostBarrierElement(obj, val, scratch, scratchLength);
 
     // Return value is new length.
     masm.add32(Imm32(1), scratchLength);
     masm.tagValue(JSVAL_TYPE_INT32, scratchLength, val);
 
     return true;
@@ -1703,17 +1719,21 @@ BaselineCacheIRCompiler::emitStoreTypedE
 
     FailurePath* failure;
     if (!addFailurePath(&failure))
         return false;
 
     // Bounds check.
     Label done;
     LoadTypedThingLength(masm, layout, obj, scratch1);
-    masm.branch32(Assembler::BelowOrEqual, scratch1, index, handleOOB ? &done : failure->label());
+
+    // Unfortunately we don't have more registers available on x86, so use
+    // InvalidReg and emit slightly slower code on x86.
+    Register spectreTemp = InvalidReg;
+    masm.spectreBoundsCheck32(index, scratch1, spectreTemp, handleOOB ? &done : failure->label());
 
     // Load the elements vector.
     LoadTypedThingData(masm, layout, obj, scratch1);
 
     BaseIndex dest(scratch1, index, ScaleFromElemWidth(Scalar::byteSize(type)));
 
     // Use ICStubReg as second scratch register. TODO: consider doing the RHS
     // type check/conversion as a separate IR instruction so we can simplify