--- a/.eslintignore
+++ b/.eslintignore
@@ -190,16 +190,17 @@ toolkit/modules/tests/xpcshell/test_task
 
 # Not yet updated
 toolkit/components/osfile/**
 toolkit/components/passwordmgr/**
 toolkit/components/places/**
 
 # Uses preprocessing
 toolkit/content/contentAreaUtils.js
+toolkit/content/widgets/videocontrols.xml
 toolkit/components/jsdownloads/src/DownloadIntegration.jsm
 toolkit/components/search/nsSearchService.js
 toolkit/components/url-classifier/**
 toolkit/components/urlformatter/nsURLFormatter.js
 toolkit/identity/FirefoxAccounts.jsm
 toolkit/modules/AppConstants.jsm
 toolkit/modules/SessionRecorder.jsm
 toolkit/mozapps/downloads/nsHelperAppDlg.js

--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1318,18 +1318,16 @@ sticky_pref("lightweightThemes.selectedT
 #endif
 
 // Whether the character encoding menu is under the main Firefox button. This
 // preference is a string so that localizers can alter it.
 pref("browser.menu.showCharacterEncoding", "chrome://browser/locale/browser.properties");
 
 // Allow using tab-modal prompts when possible.
 pref("prompts.tab_modal.enabled", true);
-// Whether the Panorama should animate going in/out of tabs
-pref("browser.panorama.animate_zoom", true);
 
 // Activates preloading of the new tab url.
 pref("browser.newtab.preload", true);
 
 // Remembers if the about:newtab intro has been shown
 pref("browser.newtabpage.introShown", false);
 
 // Toggles the content of 'about:newtab'. Shows the grid when enabled.

--- a/browser/base/content/browser-menubar.inc
+++ b/browser/base/content/browser-menubar.inc
@@ -499,21 +499,16 @@
                         accesskey="&addons.accesskey;"
                         key="key_openAddons"
                         command="Tools:Addons"/>
               <menuitem id="menu_openApps"
                         label="&webapps.label;"
                         accesskey="&webapps.accesskey;"
                         oncommand="BrowserOpenApps();"/>
 
-              <menuitem id="menu_openLoop"
-                        label="&loopMenuItem.label;"
-                        accesskey = "&loopMenuItem.accesskey;"
-                        oncommand="LoopUI.togglePanel();"/>
-
               <!-- only one of sync-setup, sync-syncnowitem or sync-reauthitem will be showing at once -->
               <menuitem id="sync-setup"
                         label="&syncSignIn.label;"
                         accesskey="&syncSignIn.accesskey;"
                         observes="sync-setup-state"
                         oncommand="gSyncUI.openSetup(null, 'menubar')"/>
               <menuitem id="sync-syncnowitem"
                         label="&syncSyncNowItem.label;"

--- a/browser/base/content/tab-content.js
+++ b/browser/base/content/tab-content.js
@@ -329,17 +329,17 @@ var AboutReaderListener = {
   /**
    * NB: this function will update the state of the reader button asynchronously
    * after the next mozAfterPaint call (assuming reader mode is enabled and
    * this is a suitable document). Calling it on things which won't be
    * painted is not going to work.
    */
   updateReaderButton: function(forceNonArticle) {
     if (!ReaderMode.isEnabledForParseOnLoad || this.isAboutReader ||
-        !(content.document instanceof content.HTMLDocument) ||
+        !content || !(content.document instanceof content.HTMLDocument) ||
         content.document.mozSyntheticDocument) {
       return;
     }
 
     this.scheduleReadabilityCheckPostPaint(forceNonArticle);
   },
 
   cancelPotentialPendingReadabilityCheck: function() {

--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -649,17 +649,19 @@
 
                   // If the browser is loading it must not be crashed anymore
                   this.mTab.removeAttribute("crashed");
                 }
 
                 if (this._shouldShowProgress(aRequest)) {
                   if (!(aStateFlags & nsIWebProgressListener.STATE_RESTORING)) {
                     this.mTab.setAttribute("busy", "true");
-                    if (!(aWebProgress.loadType & Ci.nsIDocShell.LOAD_CMD_RELOAD))
+
+                    if (aWebProgress.isTopLevel &&
+                        !(aWebProgress.loadType & Ci.nsIDocShell.LOAD_CMD_RELOAD))
                       this.mTabBrowser.setTabTitleLoading(this.mTab);
                   }
 
                   if (this.mTab.selected)
                     this.mTabBrowser.mIsBusy = true;
                 }
               }
               else if (aStateFlags & nsIWebProgressListener.STATE_STOP &&

--- a/browser/base/content/test/general/browser_urlbarSearchSuggestions.js
+++ b/browser/base/content/test/general/browser_urlbarSearchSuggestions.js
@@ -17,26 +17,28 @@ add_task(function* prepare() {
 
     // Make sure the popup is closed for the next test.
     gURLBar.blur();
     Assert.ok(!gURLBar.popup.popupOpen, "popup should be closed");
   });
 });
 
 add_task(function* clickSuggestion() {
+  gBrowser.selectedTab = gBrowser.addTab();
   gURLBar.focus();
   yield promiseAutocompleteResultPopup("foo");
   let [idx, suggestion] = yield promiseFirstSuggestion();
   let item = gURLBar.popup.richlistbox.getItemAtIndex(idx);
   let loadPromise = promiseTabLoaded(gBrowser.selectedTab);
   item.click();
   yield loadPromise;
   let uri = Services.search.currentEngine.getSubmission(suggestion).uri;
   Assert.ok(uri.equals(gBrowser.currentURI),
             "The search results page should have loaded");
+  gBrowser.removeTab(gBrowser.selectedTab);
 });
 
 function getFirstSuggestion() {
   let controller = gURLBar.popup.input.controller;
   let matchCount = controller.matchCount;
   let present = false;
   for (let i = 0; i < matchCount; i++) {
     let url = controller.getValueAt(i);

--- a/browser/base/content/test/general/browser_urlbarSearchTelemetry.js
+++ b/browser/base/content/test/general/browser_urlbarSearchTelemetry.js
@@ -22,36 +22,40 @@ add_task(function* prepare() {
     // Make sure the popup is closed for the next test.
     gURLBar.blur();
     Assert.ok(!gURLBar.popup.popupOpen, "popup should be closed");
   });
 });
 
 add_task(function* heuristicResult() {
   yield compareCounts(function* () {
+    gBrowser.selectedTab = gBrowser.addTab();
     yield promiseAutocompleteResultPopup("heuristicResult");
     let action = getActionAtIndex(0);
     Assert.ok(!!action, "there should be an action at index 0");
     Assert.equal(action.type, "searchengine", "type should be searchengine");
     let item = gURLBar.popup.richlistbox.getItemAtIndex(0);
     let loadPromise = promiseTabLoaded(gBrowser.selectedTab);
     item.click();
     yield loadPromise;
+    gBrowser.removeTab(gBrowser.selectedTab);
   });
 });
 
 add_task(function* searchSuggestion() {
   yield compareCounts(function* () {
+    gBrowser.selectedTab = gBrowser.addTab();
     yield promiseAutocompleteResultPopup("searchSuggestion");
     let idx = getFirstSuggestionIndex();
     Assert.ok(idx >= 0, "there should be a first suggestion");
     let item = gURLBar.popup.richlistbox.getItemAtIndex(idx);
     let loadPromise = promiseTabLoaded(gBrowser.selectedTab);
     item.click();
     yield loadPromise;
+    gBrowser.removeTab(gBrowser.selectedTab);
   });
 });
 
 /**
  * This does three things: gets current telemetry/FHR counts, calls
  * clickCallback, gets telemetry/FHR counts again to compare them to the old
  * counts.
  *

--- a/browser/base/content/test/general/searchSuggestionEngine.xml
+++ b/browser/base/content/test/general/searchSuggestionEngine.xml
@@ -1,9 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- Any copyright is dedicated to the Public Domain.
    - http://creativecommons.org/publicdomain/zero/1.0/ -->
 
 <SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
 <ShortName>browser_searchSuggestionEngine searchSuggestionEngine.xml</ShortName>
 <Url type="application/x-suggestions+json" method="GET" template="http://mochi.test:8888/browser/browser/base/content/test/general/searchSuggestionEngine.sjs?{searchTerms}"/>
-<Url type="text/html" method="GET" template="http://mochi.test:8888/browser/browser/base/content/test/general/searchSuggestionEngine.sjs?{searchTerms}" rel="searchform"/>
+<Url type="text/html" method="GET" template="http://mochi.test:8888/" rel="searchform"/>
 </SearchPlugin>

--- a/browser/extensions/loop/bootstrap.js
+++ b/browser/extensions/loop/bootstrap.js
@@ -30,16 +30,17 @@ var WindowListener = {
    *
    * @param {Object} window The window to inject the integration into.
    */
   setupBrowserUI: function(window) {
     let document = window.document;
     let gBrowser = window.gBrowser;
     let xhrClass = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"];
     let FileReader = window.FileReader;
+    let menuItem = null;
 
     // the "exported" symbols
     var LoopUI = {
       /**
        * @var {XULWidgetSingleWrapper} toolbarButton Getter for the Loop toolbarbutton
        *                                             instance for this window. This should
        *                                             not be used in the hidden window.
        */
@@ -65,30 +66,16 @@ var WindowListener = {
         if (browser) {
           delete this.browser;
           this.browser = browser;
         }
         return browser;
       },
 
       /**
-       * @var {String|null} selectedTab Getter for the name of the currently selected
-       *                                tab inside the Loop panel. Will be NULL if
-       *                                the panel hasn't loaded yet.
-       */
-      get selectedTab() {
-        if (!this.browser) {
-          return null;
-        }
-
-        let selectedTab = this.browser.contentDocument.querySelector(".tab-view > .selected");
-        return selectedTab && selectedTab.getAttribute("data-tab-name");
-      },
-
-      /**
        * @return {Promise}
        */
       promiseDocumentVisible(aDocument) {
         if (!aDocument.hidden) {
           return Promise.resolve(aDocument);
         }
 
         return new Promise((resolve) => {
@@ -273,32 +260,63 @@ var WindowListener = {
         this.MozLoopService.initialize().catch(ex => {
           if (!ex.message ||
               (!ex.message.contains("not enabled") &&
                !ex.message.contains("not needed"))) {
             console.error(ex);
           }
         });
 
+        this.addMenuItem();
+
         // Don't do the rest if this is for the hidden window - we don't
         // have a toolbar there.
         if (window == Services.appShell.hiddenDOMWindow) {
           return;
         }
 
         // Cleanup when the window unloads.
         window.addEventListener("unload", () => {
           Services.obs.removeObserver(this, "loop-status-changed");
         });
 
         Services.obs.addObserver(this, "loop-status-changed", false);
 
         this.updateToolbarState();
       },
 
+      /**
+       * Adds a menu item to the browsers' Tools menu that open the Loop panel
+       * when selected.
+       */
+      addMenuItem: function() {
+        let menu = document.getElementById("menu_ToolsPopup");
+        if (!menu || menuItem) {
+          return;
+        }
+
+        menuItem = document.createElementNS(kNSXUL, "menuitem");
+        menuItem.setAttribute("id", "menu_openLoop");
+        menuItem.setAttribute("label", this._getString("loopMenuItem_label"));
+        menuItem.setAttribute("accesskey", this._getString("loopMenuItem_accesskey"));
+
+        menuItem.addEventListener("command", () => this.togglePanel());
+
+        menu.insertBefore(menuItem, document.getElementById("sync-setup"));
+      },
+
+      /**
+       * Removes the menu item from the browsers' Tools menu.
+       */
+      removeMenuItem: function() {
+        if (menuItem) {
+          menuItem.parentNode.removeChild(menuItem);
+        }
+      },
+
       // Implements nsIObserver
       observe: function(subject, topic, data) {
         if (topic != "loop-status-changed") {
           return;
         }
         this.updateToolbarState(data);
       },
 
@@ -669,17 +687,20 @@ var WindowListener = {
     window.LoopUI = LoopUI;
   },
 
   tearDownBrowserUI: function(window) {
     let document = window.document;
 
     // Take any steps to remove UI or anything from the browser window
     // document.getElementById() etc. will work here
-    // XXX Add in tear-down of the panel.
+    if (window.LoopUI) {
+      window.LoopUI.removeMenuItem();
+      // XXX Add in tear-down of the panel.
+    }
   },
 
   // nsIWindowMediatorListener functions.
   onOpenWindow: function(xulWindow) {
     // A new window has opened.
     let domWindow = xulWindow.QueryInterface(Ci.nsIInterfaceRequestor)
                              .getInterface(Ci.nsIDOMWindow);
 

--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -247,18 +247,16 @@ These should match what Safari and other
 <!ENTITY downloads.accesskey          "D">
 <!ENTITY downloads.commandkey         "j">
 <!ENTITY downloadsUnix.commandkey     "y">
 <!ENTITY addons.label                 "Add-ons">
 <!ENTITY addons.accesskey             "A">
 <!ENTITY addons.commandkey            "A">
 <!ENTITY webapps.label                "Apps">
 <!ENTITY webapps.accesskey            "p">
-<!ENTITY loopMenuItem.label           "Start a conversation…">
-<!ENTITY loopMenuItem.accesskey       "t">
 
 <!ENTITY webDeveloperMenu.label       "Web Developer">
 <!ENTITY webDeveloperMenu.accesskey   "W">
 
 <!ENTITY devToolsCmd.keycode          "VK_F12">
 <!ENTITY devToolsCmd.keytext          "F12">
 
 <!ENTITY devtoolsConnect.label        "Connect…">

--- a/browser/locales/en-US/chrome/browser/loop/loop.properties
+++ b/browser/locales/en-US/chrome/browser/loop/loop.properties
@@ -4,16 +4,22 @@
 
 # Panel Strings
 
 ## LOCALIZATION NOTE(clientShortname2): This should not be localized and
 ## should remain "Firefox Hello" for all locales.
 clientShortname2=Firefox Hello
 clientSuperShortname=Hello
 
+## LOCALIZATION_NOTE(loopMenuItem_label): Label of the menu item that is placed
+## inside the browser 'Tools' menu. Use the unicode ellipsis char, \u2026, or
+## use "..." if \u2026 doesn't suit traditions in your locale.
+loopMenuItem_label=Start a conversation…
+loopMenuItem_accesskey=t
+
 ## LOCALIZATION_NOTE(sign_in_again_title_line_one, sign_in_again_title_line_two2):
 ## These are displayed together at the top of the panel when a user is needed to
 ## sign-in again. The emphesis is on the first line to get the user to sign-in again,
 ## and this is displayed in slightly larger font. Please arrange as necessary for
 ## your locale.
 ## {{clientShortname2}} will be replaced by the brand name for either string.
 sign_in_again_title_line_one=Please sign in again
 sign_in_again_title_line_two2=to continue using {{clientShortname2}}

--- a/browser/modules/TabGroupsMigrator.jsm
+++ b/browser/modules/TabGroupsMigrator.jsm
@@ -139,16 +139,19 @@ this.TabGroupsMigrator = {
           if (!groupData) {
             let title = (groupInfo[group] && groupInfo[group].title) || "";
             groupData = {
               tabs: [],
               tabGroupsMigrationTitle: title,
             };
             if (!title) {
               groupData.anonGroupID = ++globalAnonGroupID;
+              groupData.tabGroupsMigrationTitle =
+                gBrowserBundle.formatStringFromName("tabgroups.migration.anonGroup",
+                                                    [groupData.anonGroupID], 1);
             }
             // If this is the active group, set the active group ID and add
             // all the already-known tabs (that didn't list a group ID), if any.
             if (!activeGroupID && !tab.hidden) {
               activeGroupID = group;
               groupData.tabs = tabsWithoutGroup;
               tabsWithoutGroup = null;
             }
@@ -174,42 +177,43 @@ this.TabGroupsMigrator = {
   _createBackup(stateStr) {
     let dest = Services.dirsvc.get("ProfD", Ci.nsIFile);
     dest.append("tabgroups-session-backup.json");
     let promise = OS.File.writeAtomic(dest.path, stateStr, {encoding: "utf-8"});
     AsyncShutdown.webWorkersShutdown.addBlocker("TabGroupsMigrator", promise);
     return promise;
   },
 
+  _groupSorter(a, b) {
+    if (!a.anonGroupID) {
+      return -1;
+    }
+    if (!b.anonGroupID) {
+      return 1;
+    }
+    return a.anonGroupID - b.anonGroupID;
+  },
+
   _bookmarkAllGroupsFromState: Task.async(function*(groupData) {
     // First create a folder in which to put all these bookmarks:
     this.bookmarkedGroupsPromise = PlacesUtils.bookmarks.insert({
       parentGuid: PlacesUtils.bookmarks.menuGuid,
       type: PlacesUtils.bookmarks.TYPE_FOLDER,
       index: 0,
       title: gBrowserBundle.GetStringFromName("tabgroups.migration.tabGroupBookmarkFolderName"),
     }).catch(Cu.reportError);
     let tabgroupsFolder = yield this.bookmarkedGroupsPromise;
 
     for (let [, windowGroupMap] of groupData) {
-      let windowGroups = [... windowGroupMap.values()].sort((a, b) => {
-        if (!a.anonGroupID) {
-          return -1;
-        }
-        if (!b.anonGroupID) {
-          return 1;
-        }
-        return a.anonGroupID - b.anonGroupID;
-      });
+      let windowGroups = [... windowGroupMap.values()].sort(this._groupSorter);
       for (let group of windowGroups) {
         let groupFolder = yield PlacesUtils.bookmarks.insert({
           parentGuid: tabgroupsFolder.guid,
           type: PlacesUtils.bookmarks.TYPE_FOLDER,
-          title: group.tabGroupsMigrationTitle ||
-            gBrowserBundle.formatStringFromName("tabgroups.migration.anonGroup", [group.anonGroupID], 1),
+          title: group.tabGroupsMigrationTitle
         }).catch(Cu.reportError);
 
         for (let tab of group.tabs) {
           let entry = tab.entries[tab.index - 1];
           yield PlacesUtils.bookmarks.insert({
             parentGuid: groupFolder.guid,
             title: tab.title || entry.title,
             url: entry.url,
@@ -248,22 +252,25 @@ this.TabGroupsMigrator = {
           // Make sure we unhide it, or it won't get restored correctly
           tab.hidden = false;
         }
       }
 
       // We then convert any hidden groups into windows for the state object
       // we show in about:tabgroupsdata
       if (groupInfoForWindow) {
+        let windowsToReturn = [];
         for (let groupID of hiddenGroupIDs) {
           let group = groupInfoForWindow.get("" + groupID);
           if (group) {
-            stateToReturn.windows.push(group);
+            windowsToReturn.push(group);
           }
         }
+        windowsToReturn.sort(this._groupSorter);
+        stateToReturn.windows = stateToReturn.windows.concat(windowsToReturn);
       }
 
       // Finally we remove tab groups data from the window:
       if (win.extData) {
         delete win.extData["tabview-group"];
         delete win.extData["tabview-groups"];
         delete win.extData["tabview-ui"];
         delete win.extData["tabview-visibility"];

--- a/browser/modules/test/xpcshell/test_TabGroupsMigrator.js
+++ b/browser/modules/test/xpcshell/test_TabGroupsMigrator.js
@@ -160,27 +160,109 @@ const TEST_STATES = {
           }
         ],
         extData: {
           "tabview-group": "{\"2\":{}}",
         },
       }
     ],
   },
+  SORTING_NAMING_RESTORE_PAGE: {
+    windows: [
+      {
+        tabs: [
+          {
+            entries: [{
+              url: "about:robots",
+              title: "Robots 1",
+            }],
+            index: 1,
+            hidden: false,
+            extData: {
+              "tabview-tab": "{\"groupID\":2,\"active\":true}",
+            },
+          },
+          {
+            entries: [{
+              url: "about:robots",
+              title: "Robots 2",
+            }],
+            index: 1,
+            hidden: false,
+            extData: {
+              "tabview-tab": "{\"groupID\":2}",
+            },
+          },
+          {
+            entries: [{
+              url: "about:robots",
+              title: "Robots 3",
+            }],
+            index: 1,
+            hidden: true,
+            extData: {
+              "tabview-tab": "{\"groupID\":13}",
+            },
+          },
+          {
+            entries: [{
+              url: "about:robots",
+              title: "Robots 4",
+            }],
+            index: 1,
+            hidden: true,
+            extData: {
+              "tabview-tab": "{\"groupID\":15}",
+            },
+          },
+          {
+            entries: [{
+              url: "about:robots",
+              title: "Robots 5",
+            }],
+            index: 1,
+            hidden: true,
+            extData: {
+              "tabview-tab": "{\"groupID\":16}",
+            },
+          },
+          {
+            entries: [{
+              url: "about:robots",
+              title: "Robots 6",
+            }],
+            index: 1,
+            hidden: true,
+            extData: {
+              "tabview-tab": "{\"groupID\":17}",
+            },
+          }
+        ],
+        extData: {
+          "tabview-group": "{\"2\":{},\"13\":{\"title\":\"Foopy\"}, \"15\":{\"title\":\"Barry\"}, \"16\":{}, \"17\":{}}",
+          "tabview-groups": "{\"nextID\":20,\"activeGroupId\":2,\"totalNumber\":5}",
+          "tabview-visibility": "false"
+        },
+      },
+    ]
+  },
 };
 
 add_task(function* gatherGroupDataTest() {
   let groupInfo = TabGroupsMigrator._gatherGroupData(TEST_STATES.TWO_GROUPS);
   Assert.equal(groupInfo.size, 1, "Information about 1 window");
   let singleWinGroups = [... groupInfo.values()][0];
   Assert.equal(singleWinGroups.size, 2, "2 groups");
   let group2 = singleWinGroups.get("2");
   Assert.ok(!!group2, "group 2 should exist");
   Assert.equal(group2.tabs.length, 2, "2 tabs in group 2");
-  Assert.equal(group2.tabGroupsMigrationTitle, "", "We don't assign titles to untitled groups");
+  // Note that this has groupID 2 in the internal representation of tab groups,
+  // but because it was the first group we encountered when migrating, it was
+  // labeled "group 1" for the user
+  Assert.equal(group2.tabGroupsMigrationTitle, "Group 1", "We assign a numeric title to untitled groups");
   Assert.equal(group2.anonGroupID, "1", "We mark an untitled group with an anonymous id");
   let group13 = singleWinGroups.get("13");
   Assert.ok(!!group13, "group 13 should exist");
   Assert.equal(group13.tabs.length, 1, "1 tabs in group 13");
   Assert.equal(group13.tabGroupsMigrationTitle, "Foopy", "Group with title has correct title");
   Assert.ok(!("anonGroupID" in group13), "We don't mark a titled group with an anonymous id");
 });
 
@@ -303,8 +385,22 @@ add_task(function* dealWithNoGroupInfo()
   Assert.equal(groupInfo.size, 1, "Should have 1 window");
   let windowGroups = [...groupInfo][0][1];
   Assert.equal(windowGroups.size, 1, "Window should have 1 group");
   let fallbackActiveGroup = windowGroups.get("active group");
   Assert.ok(fallbackActiveGroup, "Fallback group should exist");
   Assert.equal(fallbackActiveGroup.tabs.length, 3, "There should be 3 tabs in the fallback group");
 });
 
+add_task(function* groupSortingInRemovedDataUsedForRestorePage() {
+  let stateClone = JSON.parse(JSON.stringify(TEST_STATES.SORTING_NAMING_RESTORE_PAGE));
+  let groupInfo = TabGroupsMigrator._gatherGroupData(stateClone);
+  let removedGroups = TabGroupsMigrator._removeHiddenTabGroupsFromState(stateClone, groupInfo);
+  Assert.equal(stateClone.windows.length, 1, "Should still only have 1 window");
+  Assert.equal(stateClone.windows[0].tabs.length, 2, "Should now have 2 tabs");
+
+  let restoredWindowTitles = removedGroups.windows.map(win => win.tabGroupsMigrationTitle);
+  // Note that group 1 is the active group and as such it won't appear in the list of
+  // things the user can restore:
+  Assert.deepEqual(restoredWindowTitles,
+    ["Barry", "Foopy", "Group 2", "Group 3"]);
+});
+

--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -90,16 +90,17 @@ browser.jar:
   skin/classic/browser/customizableui/customizeMode-gridTexture.png  (customizableui/customizeMode-gridTexture.png)
   skin/classic/browser/customizableui/customizeMode-separatorHorizontal.png  (customizableui/customizeMode-separatorHorizontal.png)
   skin/classic/browser/customizableui/customizeMode-separatorVertical.png  (customizableui/customizeMode-separatorVertical.png)
   skin/classic/browser/customizableui/menu-arrow.svg           (customizableui/menu-arrow.svg)
 * skin/classic/browser/customizableui/panelUIOverlay.css       (customizableui/panelUIOverlay.css)
   skin/classic/browser/downloads/allDownloadsViewOverlay.css   (downloads/allDownloadsViewOverlay.css)
   skin/classic/browser/downloads/buttons.png                   (downloads/buttons.png)
   skin/classic/browser/downloads/buttons-XP.png                (downloads/buttons-XP.png)
+  skin/classic/browser/downloads/download-glow-menuPanel.png   (downloads/download-glow-menuPanel.png)
   skin/classic/browser/downloads/download-glow-menuPanel-XPVista7.png   (downloads/download-glow-menuPanel-XPVista7.png)
   skin/classic/browser/downloads/download-notification-finish.png (downloads/download-notification-finish.png)
   skin/classic/browser/downloads/download-notification-start.png (downloads/download-notification-start.png)
   skin/classic/browser/downloads/download-summary.png          (downloads/download-summary.png)
   skin/classic/browser/downloads/downloads.css                 (downloads/downloads.css)
   skin/classic/browser/feeds/feedIcon.png                      (feeds/feedIcon.png)
   skin/classic/browser/feeds/feedIcon16.png                    (feeds/feedIcon16.png)
   skin/classic/browser/feeds/feedIcon-XP.png                   (feeds/feedIcon-XP.png)

--- a/devtools/client/canvasdebugger/test/browser.ini
+++ b/devtools/client/canvasdebugger/test/browser.ini
@@ -7,16 +7,18 @@ support-files =
   doc_no-canvas.html
   doc_raf-no-canvas.html
   doc_simple-canvas.html
   doc_simple-canvas-bitmasks.html
   doc_simple-canvas-deep-stack.html
   doc_simple-canvas-transparent.html
   doc_webgl-bindings.html
   doc_webgl-enum.html
+  doc_webgl-drawArrays.html
+  doc_webgl-drawElements.html
   head.js
 
 [browser_canvas-actor-test-01.js]
 [browser_canvas-actor-test-02.js]
 [browser_canvas-actor-test-03.js]
 [browser_canvas-actor-test-04.js]
 [browser_canvas-actor-test-05.js]
 [browser_canvas-actor-test-06.js]

--- a/devtools/client/canvasdebugger/test/browser_profiling-webgl.js
+++ b/devtools/client/canvasdebugger/test/browser_profiling-webgl.js
@@ -3,17 +3,18 @@
 
 /**
  * Tests if functions inside a single animation frame are recorded and stored
  * for a canvas context profiling.
  */
 
 function* ifTestingSupported() {
   let currentTime = window.performance.now();
-  let { target, front } = yield initCanvasDebuggerBackend(WEBGL_ENUM_URL);
+  info("Start to estimate WebGL drawArrays function.");
+  var { target, front } = yield initCanvasDebuggerBackend(WEBGL_DRAW_ARRAYS);
 
   let navigated = once(target, "navigate");
 
   yield front.setup({ reload: true });
   ok(true, "The front was setup up successfully.");
 
   yield navigated;
   ok(true, "Target automatically navigated when the front was set up.");
@@ -24,18 +25,63 @@ function* ifTestingSupported() {
 
   let animationOverview = yield snapshotActor.getOverview();
   ok(animationOverview,
     "An animation overview could be retrieved after recording.");
 
   let functionCalls = animationOverview.calls;
   ok(functionCalls,
     "An array of function call actors was sent after recording.");
-  is(functionCalls.length, 3,
-    "The number of function call actors is correct.");
+
+  testFunctionCallTimestamp(functionCalls, currentTime);
+
+  info("Check triangle and vertex counts in drawArrays()");
+  is(animationOverview.primitive.tris, 5, "The count of triangles is correct.");
+  is(animationOverview.primitive.vertices, 26, "The count of vertices is correct.");
+  is(animationOverview.primitive.points, 4, "The count of points is correct.");
+  is(animationOverview.primitive.lines, 8, "The count of lines is correct.");
+
+  yield removeTab(target.tab);
+
+  info("Start to estimate WebGL drawElements function.");
+  var { target, front } = yield initCanvasDebuggerBackend(WEBGL_DRAW_ELEMENTS);
+
+  navigated = once(target, "navigate");
+
+  yield front.setup({ reload: true });
+  ok(true, "The front was setup up successfully.");
+
+  yield navigated;
+  ok(true, "Target automatically navigated when the front was set up.");
+
+  snapshotActor = yield front.recordAnimationFrame();
+  ok(snapshotActor,
+    "A snapshot actor was sent after recording.");
+  
+  animationOverview = yield snapshotActor.getOverview();
+  ok(animationOverview,
+    "An animation overview could be retrieved after recording.");
+  
+  functionCalls = animationOverview.calls;
+  ok(functionCalls,
+    "An array of function call actors was sent after recording.");
+  
+  testFunctionCallTimestamp(functionCalls, currentTime);
+  
+  info("Check triangle and vertex counts in drawElements()");
+  is(animationOverview.primitive.tris, 5, "The count of triangles is correct.");
+  is(animationOverview.primitive.vertices, 26, "The count of vertices is correct.");
+  is(animationOverview.primitive.points, 4, "The count of points is correct.");
+  is(animationOverview.primitive.lines, 8, "The count of lines is correct.");
+  
+  yield removeTab(target.tab);
+  finish();
+}
+
+function testFunctionCallTimestamp(functionCalls, currentTime) {
 
   info("Check the timestamps of function calls");
 
   for ( let i = 0; i < functionCalls.length-1; i += 2 ) {
     ok( functionCalls[i].timestamp > 0, "The timestamp of the called function is larger than 0." );
     ok( functionCalls[i].timestamp < currentTime, "The timestamp has been minus the frame start time." );
     ok( functionCalls[i+1].timestamp > functionCalls[i].timestamp, "The timestamp of the called function is correct." );
   }

new file mode 100644
--- /dev/null
+++ b/devtools/client/canvasdebugger/test/doc_webgl-drawArrays.html
@@ -0,0 +1,187 @@
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!doctype html>
+
+<html>
+  <head>
+    <meta charset="utf-8"/>
+    <title>WebGL editor test page</title>
+  </head>
+
+  <body>
+    <canvas id="canvas" width="128" height="128"></canvas>
+    <script id="shader-fs" type="x-shader/x-fragment">
+      precision mediump float;
+      uniform vec4 mtrColor;
+
+      void main(void) {
+        gl_FragColor = vec4(1.0, 1.0, 1.0, 1.0) * mtrColor;
+      }
+    </script>
+    <script id="shader-vs" type="x-shader/x-vertex">
+      attribute vec3 aVertexPosition;
+
+      void main(void) {
+        gl_PointSize = 5.0;
+        gl_Position = vec4(aVertexPosition, 1.0);
+      }
+    </script>
+    <script type="text/javascript;version=1.8">
+      "use strict";
+
+      let canvas, gl, shaderProgram;
+      let triangleVertexPositionBuffer, squareVertexPositionBuffer;
+     
+      window.onload = function() {
+        canvas = document.querySelector("canvas");
+        gl = canvas.getContext("webgl", { preserveDrawingBuffer: true });
+        gl.viewportWidth = canvas.width;
+        gl.viewportHeight = canvas.height;
+       
+        initShaders();
+        initBuffers();
+
+        gl.viewport(0, 0, gl.viewportWidth, gl.viewportHeight);
+        gl.clearColor(0.0, 0.0, 0.0, 1.0);
+        gl.disable(gl.DEPTH_TEST);
+        drawScene();
+      }
+
+      function getShader(gl, id) {
+        var shaderScript = document.getElementById(id);
+        if (!shaderScript) {
+            return null;
+        }
+
+        var str = "";
+        var k = shaderScript.firstChild;
+        while (k) {
+            if (k.nodeType == 3) {
+                str += k.textContent;
+            }
+            k = k.nextSibling;
+        }
+
+        var shader;
+        if (shaderScript.type == "x-shader/x-fragment") {
+            shader = gl.createShader(gl.FRAGMENT_SHADER);
+        } else if (shaderScript.type == "x-shader/x-vertex") {
+            shader = gl.createShader(gl.VERTEX_SHADER);
+        } else {
+            return null;
+        }
+
+        gl.shaderSource(shader, str);
+        gl.compileShader(shader);
+
+        if (!gl.getShaderParameter(shader, gl.COMPILE_STATUS)) {
+            alert(gl.getShaderInfoLog(shader));
+            return null;
+        }
+
+        return shader;
+      }
+      
+      function initShaders() {
+        var fragmentShader = getShader(gl, "shader-fs");
+        var vertexShader = getShader(gl, "shader-vs");
+
+        shaderProgram = gl.createProgram();
+        gl.attachShader(shaderProgram, vertexShader);
+        gl.attachShader(shaderProgram, fragmentShader);
+        gl.linkProgram(shaderProgram);
+
+        if (!gl.getProgramParameter(shaderProgram, gl.LINK_STATUS)) {
+            alert("Could not initialise shaders");
+        }
+
+        gl.useProgram(shaderProgram);
+
+        shaderProgram.vertexPositionAttribute = gl.getAttribLocation(shaderProgram, "aVertexPosition");
+        shaderProgram.pMaterialColor = gl.getUniformLocation(shaderProgram, "mtrColor");
+        gl.enableVertexAttribArray(shaderProgram.vertexPositionAttribute);
+      }
+
+      function initBuffers() {
+          // Create triangle vertex/index buffer
+          triangleVertexPositionBuffer = gl.createBuffer();
+          gl.bindBuffer(gl.ARRAY_BUFFER, triangleVertexPositionBuffer);
+          var vertices = [
+               0.0,  0.5,  0.0,
+              -0.5, -0.5,  0.0,
+               0.5, -0.5,  0.0
+          ];
+          gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+          triangleVertexPositionBuffer.itemSize = 3;
+          triangleVertexPositionBuffer.numItems = 3;
+
+          // Create square vertex/index buffer
+          squareVertexPositionBuffer = gl.createBuffer();
+          gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+          vertices = [
+               0.8,  0.8,  0.0,
+              -0.8,  0.8,  0.0,
+               0.8, -0.8,  0.0,
+              -0.8, -0.8,  0.0
+          ];
+          gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+          squareVertexPositionBuffer.itemSize = 3;
+          squareVertexPositionBuffer.numItems = 4;
+      }
+
+      function drawScene() {        
+        gl.clear(gl.COLOR_BUFFER_BIT | gl.DEPTH_BUFFER_BIT | gl.STENCIL_BUFFER_BIT);
+
+        // DrawArrays
+        // --------------
+        // draw square - triangle strip
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 1, 1, 1, 1);
+        gl.drawArrays(gl.TRIANGLE_STRIP, 0, squareVertexPositionBuffer.numItems);
+
+        // draw square - triangle fan
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0, 1, 0, 1);
+        gl.drawArrays(gl.TRIANGLE_FAN, 0, squareVertexPositionBuffer.numItems);
+
+        // draw triangle
+        gl.bindBuffer(gl.ARRAY_BUFFER, triangleVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, triangleVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 1, 0, 0, 1);
+        gl.drawArrays(gl.TRIANGLES, 0, triangleVertexPositionBuffer.numItems);
+
+        // draw points
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 1, 0, 1, 1);
+        gl.drawArrays(gl.POINTS, 0, squareVertexPositionBuffer.numItems);
+
+        // draw lines
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0, 0, 1, 1);
+        gl.lineWidth(8.0);
+        gl.drawArrays(gl.LINES, 0, squareVertexPositionBuffer.numItems);
+
+        // draw line strip
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0.9, 0.6, 0, 1);
+        gl.lineWidth(3.0);
+        gl.drawArrays(gl.LINE_STRIP, 0, squareVertexPositionBuffer.numItems);
+
+        // draw line loop
+        gl.bindBuffer(gl.ARRAY_BUFFER, triangleVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, triangleVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0, 1, 1, 1);
+        gl.lineWidth(3.0);
+        gl.drawArrays(gl.LINE_LOOP, 0, triangleVertexPositionBuffer.numItems);
+
+        window.requestAnimationFrame(drawScene);
+      }
+    </script>
+  </body>
+
+</html>
\ No newline at end of file

new file mode 100644
--- /dev/null
+++ b/devtools/client/canvasdebugger/test/doc_webgl-drawElements.html
@@ -0,0 +1,225 @@
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!doctype html>
+
+<html>
+  <head>
+    <meta charset="utf-8"/>
+    <title>WebGL editor test page</title>
+  </head>
+
+  <body>
+    <canvas id="canvas" width="128" height="128"></canvas>
+    <script id="shader-fs" type="x-shader/x-fragment">
+      precision mediump float;
+      uniform vec4 mtrColor;
+
+      void main(void) {
+        gl_FragColor = vec4(1.0, 1.0, 1.0, 1.0) * mtrColor;
+      }
+    </script>
+    <script id="shader-vs" type="x-shader/x-vertex">
+      attribute vec3 aVertexPosition;
+
+      void main(void) {
+        gl_PointSize = 5.0;
+        gl_Position = vec4(aVertexPosition, 1.0);
+      }
+    </script>
+    <script type="text/javascript;version=1.8">
+      "use strict";
+
+      let canvas, gl, shaderProgram;
+      let triangleVertexPositionBuffer, squareVertexPositionBuffer;
+      let triangleIndexBuffer;
+      let squareIndexBuffer, squareStripIndexBuffer, squareFanIndexBuffer
+     
+      window.onload = function() {
+        canvas = document.querySelector("canvas");
+        gl = canvas.getContext("webgl", { preserveDrawingBuffer: true });
+        gl.viewportWidth = canvas.width;
+        gl.viewportHeight = canvas.height;
+       
+        initShaders();
+        initBuffers();
+
+        gl.viewport(0, 0, gl.viewportWidth, gl.viewportHeight);
+        gl.clearColor(0.0, 0.0, 0.0, 1.0);
+        gl.disable(gl.DEPTH_TEST);
+        drawScene();
+      }
+
+      function getShader(gl, id) {
+        var shaderScript = document.getElementById(id);
+        if (!shaderScript) {
+            return null;
+        }
+
+        var str = "";
+        var k = shaderScript.firstChild;
+        while (k) {
+            if (k.nodeType == 3) {
+                str += k.textContent;
+            }
+            k = k.nextSibling;
+        }
+
+        var shader;
+        if (shaderScript.type == "x-shader/x-fragment") {
+            shader = gl.createShader(gl.FRAGMENT_SHADER);
+        } else if (shaderScript.type == "x-shader/x-vertex") {
+            shader = gl.createShader(gl.VERTEX_SHADER);
+        } else {
+            return null;
+        }
+
+        gl.shaderSource(shader, str);
+        gl.compileShader(shader);
+
+        if (!gl.getShaderParameter(shader, gl.COMPILE_STATUS)) {
+            alert(gl.getShaderInfoLog(shader));
+            return null;
+        }
+
+        return shader;
+      }
+      
+      function initShaders() {
+        var fragmentShader = getShader(gl, "shader-fs");
+        var vertexShader = getShader(gl, "shader-vs");
+
+        shaderProgram = gl.createProgram();
+        gl.attachShader(shaderProgram, vertexShader);
+        gl.attachShader(shaderProgram, fragmentShader);
+        gl.linkProgram(shaderProgram);
+
+        if (!gl.getProgramParameter(shaderProgram, gl.LINK_STATUS)) {
+            alert("Could not initialise shaders");
+        }
+
+        gl.useProgram(shaderProgram);
+
+        shaderProgram.vertexPositionAttribute = gl.getAttribLocation(shaderProgram, "aVertexPosition");
+        shaderProgram.pMaterialColor = gl.getUniformLocation(shaderProgram, "mtrColor");
+        gl.enableVertexAttribArray(shaderProgram.vertexPositionAttribute);
+      }
+
+      function initBuffers() {
+          // Create triangle vertex/index buffer
+          triangleVertexPositionBuffer = gl.createBuffer();
+          gl.bindBuffer(gl.ARRAY_BUFFER, triangleVertexPositionBuffer);
+          var vertices = [
+             0.0,  0.5,  0.0,
+            -0.5, -0.5,  0.0,
+             0.5, -0.5,  0.0
+          ];
+          gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+          triangleVertexPositionBuffer.itemSize = 3;
+          triangleVertexPositionBuffer.numItems = 3;
+
+          triangleIndexBuffer = gl.createBuffer();
+          gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, triangleIndexBuffer);
+          var indices = [
+              0, 1, 2
+          ];
+          gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint16Array(indices), gl.STATIC_DRAW);
+          triangleIndexBuffer.itemSize = 1;
+          triangleIndexBuffer.numItems = 3;
+
+          // Create square vertex/index buffer
+          squareVertexPositionBuffer = gl.createBuffer();
+          gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+          vertices = [
+             0.8,  0.8,  0.0,
+            -0.8,  0.8,  0.0,
+             0.8, -0.8,  0.0,
+            -0.8, -0.8,  0.0
+          ];
+          gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(vertices), gl.STATIC_DRAW);
+          squareVertexPositionBuffer.itemSize = 3;
+          squareVertexPositionBuffer.numItems = 4;
+
+          squareIndexBuffer = gl.createBuffer();
+          gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, squareIndexBuffer);
+          indices = [ 
+            0, 1, 2,
+            1, 3, 2
+          ];
+          gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint16Array(indices), gl.STATIC_DRAW);
+          squareIndexBuffer.itemSize = 1;
+          squareIndexBuffer.numItems = 6;
+
+          squareStripIndexBuffer = gl.createBuffer();
+          gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, squareStripIndexBuffer);
+          indices = [ 
+            0, 1, 2, 3
+          ];
+          gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, new Uint16Array(indices), gl.STATIC_DRAW);
+          squareStripIndexBuffer.itemSize = 1;
+          squareStripIndexBuffer.numItems = 4;
+
+      }
+
+      function drawScene() {
+        gl.clear(gl.COLOR_BUFFER_BIT | gl.DEPTH_BUFFER_BIT | gl.STENCIL_BUFFER_BIT);
+
+        // DrawElements
+        // --------------
+        // draw triangle
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 1, 1, 1, 1);
+        gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, squareIndexBuffer);
+        gl.drawElements(gl.TRIANGLES, squareIndexBuffer.numItems, gl.UNSIGNED_SHORT, 0);
+
+        // draw square - triangle strip
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0, 1, 0, 1);
+        gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, squareStripIndexBuffer);
+        gl.drawElements(gl.TRIANGLE_FAN, squareStripIndexBuffer.numItems, gl.UNSIGNED_SHORT, 0);
+
+        // draw square - triangle fan
+        gl.bindBuffer(gl.ARRAY_BUFFER, triangleVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, triangleVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 1, 0, 0, 1);
+        gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, triangleIndexBuffer);
+        gl.drawElements(gl.TRIANGLE_FAN, triangleIndexBuffer.numItems, gl.UNSIGNED_SHORT, 0);
+
+        // draw points
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 1, 0, 1, 1);
+        gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, squareStripIndexBuffer);
+        gl.drawElements(gl.POINTS, squareStripIndexBuffer.numItems, gl.UNSIGNED_SHORT, 0);
+
+        // draw lines
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0, 0, 1, 1);
+        gl.lineWidth(8.0);
+        gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, squareStripIndexBuffer);
+        gl.drawElements(gl.LINES, squareStripIndexBuffer.numItems, gl.UNSIGNED_SHORT, 0);
+
+        // draw line strip
+        gl.bindBuffer(gl.ARRAY_BUFFER, squareVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, squareVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0.9, 0.6, 0, 1);
+        gl.lineWidth(3.0);
+        gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, squareStripIndexBuffer);
+        gl.drawElements(gl.LINE_STRIP, squareStripIndexBuffer.numItems, gl.UNSIGNED_SHORT, 0);
+
+        // draw line loop
+        gl.bindBuffer(gl.ARRAY_BUFFER, triangleVertexPositionBuffer);
+        gl.vertexAttribPointer(shaderProgram.vertexPositionAttribute, triangleVertexPositionBuffer.itemSize, gl.FLOAT, false, 0, 0);
+        gl.uniform4f(shaderProgram.pMaterialColor, 0, 1, 1, 1);
+        gl.lineWidth(3.0);
+        gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, triangleIndexBuffer);
+        gl.drawElements(gl.LINE_LOOP, triangleIndexBuffer.numItems, gl.UNSIGNED_SHORT, 0);
+
+        window.requestAnimationFrame(drawScene);
+      }
+    </script>
+  </body>
+
+</html>
\ No newline at end of file

--- a/devtools/client/canvasdebugger/test/head.js
+++ b/devtools/client/canvasdebugger/test/head.js
@@ -34,16 +34,18 @@ const SET_TIMEOUT_URL = EXAMPLE_URL + "d
 const NO_CANVAS_URL = EXAMPLE_URL + "doc_no-canvas.html";
 const RAF_NO_CANVAS_URL = EXAMPLE_URL + "doc_raf-no-canvas.html";
 const SIMPLE_CANVAS_URL = EXAMPLE_URL + "doc_simple-canvas.html";
 const SIMPLE_BITMASKS_URL = EXAMPLE_URL + "doc_simple-canvas-bitmasks.html";
 const SIMPLE_CANVAS_TRANSPARENT_URL = EXAMPLE_URL + "doc_simple-canvas-transparent.html";
 const SIMPLE_CANVAS_DEEP_STACK_URL = EXAMPLE_URL + "doc_simple-canvas-deep-stack.html";
 const WEBGL_ENUM_URL = EXAMPLE_URL + "doc_webgl-enum.html";
 const WEBGL_BINDINGS_URL = EXAMPLE_URL + "doc_webgl-bindings.html";
+const WEBGL_DRAW_ARRAYS = EXAMPLE_URL + "doc_webgl-drawArrays.html";
+const WEBGL_DRAW_ELEMENTS = EXAMPLE_URL + "doc_webgl-drawElements.html";
 const RAF_BEGIN_URL = EXAMPLE_URL + "doc_raf-begin.html";
 
 // All tests are asynchronous.
 waitForExplicitFinish();
 
 var gToolEnabled = Services.prefs.getBoolPref("devtools.canvasdebugger.enabled");
 
 DevToolsUtils.testing = true;

--- a/devtools/client/memory/initializer.js
+++ b/devtools/client/memory/initializer.js
@@ -10,43 +10,47 @@ Cu.import("resource://devtools/client/sh
 const { require } = BrowserLoaderModule.BrowserLoader("resource://devtools/client/memory/", this);
 const { Task } = require("resource://gre/modules/Task.jsm");
 const { createFactory, createElement } = require("devtools/client/shared/vendor/react");
 const ReactDOM = require("devtools/client/shared/vendor/react-dom");
 const { Provider } = require("devtools/client/shared/vendor/react-redux");
 const App = createFactory(require("devtools/client/memory/app"));
 const Store = require("devtools/client/memory/store");
 const { assert } = require("devtools/shared/DevToolsUtils");
+const Telemetry = require("devtools/client/shared/telemetry");
 
 /**
  * The current target, toolbox, MemoryFront, and HeapAnalysesClient, set by this tool's host.
  */
 var gToolbox, gTarget, gFront, gHeapAnalysesClient;
 
 /**
  * Variables set by `initialize()`
  */
-var gStore, gRoot, gApp, gProvider, unsubscribe, isHighlighted;
+var gStore, gRoot, gApp, gProvider, unsubscribe, isHighlighted, telemetry;
 
 var initialize = Task.async(function*() {
+  telemetry = new Telemetry();
+  telemetry.toolOpened("memory");
   gRoot = document.querySelector("#app");
   gStore = Store();
   gApp = createElement(App, { toolbox: gToolbox, front: gFront, heapWorker: gHeapAnalysesClient });
   gProvider = createElement(Provider, { store: gStore }, gApp);
   ReactDOM.render(gProvider, gRoot);
   unsubscribe = gStore.subscribe(onStateChange);
 });
 
 var destroy = Task.async(function*() {
   const ok = ReactDOM.unmountComponentAtNode(gRoot);
   assert(ok, "Should successfully unmount the memory tool's top level React component");
 
+  telemetry.toolClosed("memory");
   unsubscribe();
 
-  gStore, gRoot, gApp, gProvider, unsubscribe, isHighlighted = null;
+  gStore, gRoot, gApp, gProvider, unsubscribe, isHighlighted, telemetry = null;
 });
 
 /**
  * Fired on any state change, currently only handles toggling
  * the highlighting of the tool when recording allocations.
  */
 function onStateChange () {
   let isRecording = gStore.getState().allocations.recording;

--- a/devtools/client/shared/telemetry.js
+++ b/devtools/client/shared/telemetry.js
@@ -140,16 +140,21 @@ Telemetry.prototype = {
       userHistogram: "DEVTOOLS_CANVASDEBUGGER_OPENED_PER_USER_FLAG",
       timerHistogram: "DEVTOOLS_CANVASDEBUGGER_TIME_ACTIVE_SECONDS"
     },
     performance: {
       histogram: "DEVTOOLS_JSPROFILER_OPENED_BOOLEAN",
       userHistogram: "DEVTOOLS_JSPROFILER_OPENED_PER_USER_FLAG",
       timerHistogram: "DEVTOOLS_JSPROFILER_TIME_ACTIVE_SECONDS"
     },
+    memory: {
+      histogram: "DEVTOOLS_MEMORY_OPENED_BOOLEAN",
+      userHistogram: "DEVTOOLS_MEMORY_OPENED_PER_USER_FLAG",
+      timerHistogram: "DEVTOOLS_MEMORY_TIME_ACTIVE_SECONDS"
+    },
     netmonitor: {
       histogram: "DEVTOOLS_NETMONITOR_OPENED_BOOLEAN",
       userHistogram: "DEVTOOLS_NETMONITOR_OPENED_PER_USER_FLAG",
       timerHistogram: "DEVTOOLS_NETMONITOR_TIME_ACTIVE_SECONDS"
     },
     storage: {
       histogram: "DEVTOOLS_STORAGE_OPENED_BOOLEAN",
       userHistogram: "DEVTOOLS_STORAGE_OPENED_PER_USER_FLAG",

--- a/devtools/client/shared/widgets/TableWidget.js
+++ b/devtools/client/shared/widgets/TableWidget.js
@@ -470,17 +470,17 @@ function Column(table, id, header) {
   this.tbody.appendChild(this.splitter);
 
   this.column = this.document.createElementNS(HTML_NS, "div");
   this.column.id = id;
   this.column.className = "table-widget-column";
   this.wrapper.appendChild(this.column);
 
   this.header = this.document.createElementNS(XUL_NS, "label");
-  this.header.className = "plain devtools-toolbar table-widget-column-header";
+  this.header.className = "devtools-toolbar table-widget-column-header";
   this.header.setAttribute("value", header);
   this.column.appendChild(this.header);
   if (table.headersContextMenu) {
     this.header.setAttribute("context", table.headersContextMenu);
   }
   this.toggleColumn = this.toggleColumn.bind(this);
   this.table.on(EVENTS.HEADER_CONTEXT_MENU, this.toggleColumn);
 

--- a/devtools/client/sourceeditor/tern/README
+++ b/devtools/client/sourceeditor/tern/README
@@ -2,9 +2,12 @@ This is the Tern code-analysis engine pa
 
 Tern is a stand-alone code-analysis engine for JavaScript. It is intended to be used with a code editor plugin to enhance the editor's support for intelligent JavaScript editing
 
 
 # Upgrade
 
 Currently used version is 0.6.2.  To upgrade, download the latest release from http://ternjs.net/, and copy the files from lib/ into this directory.
 
-You may also need to update the CodeMirror plugin found in devtools/client/sourceeditor/codemirror/tern, but it will most likely work without updating.
+You may also need to update the CodeMirror plugin found in devtools/client/sourceeditor/codemirror/addon/tern, but it will most likely work without updating.
+
+Replace instances of `require("acorn")` with `require("acorn/acorn")`
+Replace instances of `acorn/dist/` with `acorn/`
\ No newline at end of file

old mode 100644
new mode 100755

old mode 100644
new mode 100755
--- a/devtools/client/sourceeditor/tern/condense.js
+++ b/devtools/client/sourceeditor/tern/condense.js
@@ -2,57 +2,57 @@
 
 // This code can be used to, after a library has been analyzed,
 // extract the types defined in that library and dump them as a JSON
 // structure (as parsed by def.js).
 
 // The idea being that big libraries can be analyzed once, dumped, and
 // then cheaply included in later analysis.
 
-(function(mod) {
+(function(root, mod) {
   if (typeof exports == "object" && typeof module == "object") // CommonJS
     return mod(exports, require("./infer"));
   if (typeof define == "function" && define.amd) // AMD
     return define(["exports", "./infer"], mod);
-  mod(self.tern || (self.tern = {}), tern); // Plain browser env
-})(function(exports, infer) {
+  mod(root.tern || (root.tern = {}), tern); // Plain browser env
+})(this, function(exports, infer) {
   "use strict";
 
   exports.condense = function(origins, name, options) {
     if (typeof origins == "string") origins = [origins];
     var state = new State(origins, name || origins[0], options || {});
 
-    runPass(state.passes.preCondenseReach, state);
+    state.server.signal("preCondenseReach", state)
 
     state.cx.topScope.path = "<top>";
     state.cx.topScope.reached("", state);
     for (var path in state.roots)
       reach(state.roots[path], null, path, state);
     for (var i = 0; i < state.patchUp.length; ++i)
       patchUpSimpleInstance(state.patchUp[i], state);
 
-    runPass(state.passes.postCondenseReach, state);
+    state.server.signal("postCondenseReach", state)
 
     for (var path in state.types)
       store(createPath(path.split("."), state), state.types[path], state);
     for (var path in state.altPaths)
       storeAlt(path, state.altPaths[path], state);
     var hasDef = false;
     for (var _def in state.output["!define"]) { hasDef = true; break; }
     if (!hasDef) delete state.output["!define"];
 
-    runPass(state.passes.postCondense, state);
+    state.server.signal("postCondense", state)
 
     return simplify(state.output, state.options.sortOutput);
   };
 
   function State(origins, name, options) {
     this.origins = origins;
     this.cx = infer.cx();
-    this.passes = options.passes || this.cx.parent && this.cx.parent.passes || {};
+    this.server = options.server || this.cx.parent || {signal: function() {}}
     this.maxOrigin = -Infinity;
     for (var i = 0; i < origins.length; ++i)
       this.maxOrigin = Math.max(this.maxOrigin, this.cx.origins.indexOf(origins[i]));
     this.output = {"!name": name, "!define": {}};
     this.options = options;
     this.types = Object.create(null);
     this.altPaths = Object.create(null);
     this.patchUp = [];
@@ -108,34 +108,40 @@
       if (!(actual instanceof infer.Prim)) actual.path = newPath;
       if (actual.reached(newPath, state, !relevant) && relevant) {
         var data = state.types[oldPath];
         if (data) {
           delete state.types[oldPath];
           state.altPaths[oldPath] = actual;
         } else data = {type: actual};
         data.span = state.getSpan(type) || (actual != type && state.isTarget(actual.origin) && state.getSpan(actual)) || data.span;
-        data.doc = type.doc || (actual != type && state.isTarget(actual.origin) && type.doc) || data.doc;
+        data.doc = type.doc || (actual != type && state.isTarget(actual.origin) && actual.doc) || data.doc;
         data.data = actual.metaData;
         data.byName = data.byName == null ? !!byName : data.byName && byName;
         state.types[newPath] = data;
       }
     } else {
       if (relevant) state.altPaths[newPath] = actual;
     }
   }
   function reachByName(aval, path, id, state) {
     var type = aval.getType();
     if (type) reach(type, path, id, state, true);
   }
 
   infer.Prim.prototype.reached = function() {return true;};
 
   infer.Arr.prototype.reached = function(path, state, concrete) {
-    if (!concrete) reachByName(this.getProp("<i>"), path, "<i>", state);
+    if (concrete) return true
+    if (this.tuple) {
+      for (var i = 0; i < this.tuple; i++)
+        reachByName(this.getProp(String(i)), path, String(i), state)
+    } else {
+      reachByName(this.getProp("<i>"), path, "<i>", state)
+    }
     return true;
   };
 
   infer.Fn.prototype.reached = function(path, state, concrete) {
     infer.Obj.prototype.reached.call(this, path, state, concrete);
     if (!concrete) {
       for (var i = 0; i < this.args.length; ++i)
         reachByName(this.args[i], path, "!" + i, state);
@@ -172,22 +178,20 @@
     }
     for (var prop in obj.props)
       reach(obj.props[prop], path, prop, state);
   }
 
   function createPath(parts, state) {
     var base = state.output, defs = state.output["!define"];
     for (var i = 0, path; i < parts.length; ++i) {
-      var part = parts[i], known = path && state.types[path];
+      var part = parts[i];
       path = path ? path + "." + part : part;
       var me = state.types[path];
-      if (part.charAt(0) == "!" ||
-          known && known.type.constructor != infer.Obj ||
-          me && me.byName) {
+      if (part.charAt(0) == "!" || me && me.byName) {
         if (hop(defs, path)) base = defs[path];
         else defs[path] = base = {};
       } else {
         if (hop(base, parts[i])) base = base[part];
         else base = base[part] = {};
       }
     }
     return base;
@@ -211,47 +215,65 @@
     if (last[0] == "!") return;
     var known = state.types[parts.join(".")];
     var base = createPath(parts, state);
     if (known && known.type.constructor != infer.Obj) return;
     if (!hop(base, last)) base[last] = type.nameOverride || type.path;
   }
 
   var typeNameStack = [];
-  function typeName(type) {
-    var actual = type.getType(false);
-    if (!actual || typeNameStack.indexOf(actual) > -1)
-      return actual && actual.path || "?";
-    typeNameStack.push(actual);
-    var name = actual.typeName();
-    typeNameStack.pop();
+  function typeName(value) {
+    var isType = value instanceof infer.Type;
+    if (isType) {
+      if (typeNameStack.indexOf(value) > -1)
+        return value.path || "?";
+      typeNameStack.push(value);
+    }
+    var name = value.typeName();
+    if (isType) typeNameStack.pop();
     return name;
   }
 
+  infer.AVal.prototype.typeName = function() {
+    if (this.types.length == 0) return "?";
+    if (this.types.length == 1) return typeName(this.types[0]);
+    var simplified = infer.simplifyTypes(this.types);
+    if (simplified.length > 2) return "?";
+    for (var strs = [], i = 0; i < simplified.length; i++)
+      strs.push(typeName(simplified[i]));
+    return strs.join("|");
+  };
+
+  infer.ANull.typeName = function() { return "?"; };
+
   infer.Prim.prototype.typeName = function() { return this.name; };
 
+  infer.Sym.prototype.typeName = function() { return this.asPropName }
+
   infer.Arr.prototype.typeName = function() {
-    return "[" + typeName(this.getProp("<i>")) + "]";
+    if (!this.tuple) return "[" + typeName(this.getProp("<i>")) + "]"
+    var content = []
+    for (var i = 0; i < this.tuple; i++)
+      content.push(typeName(this.getProp(String(i))))
+    return "[" + content.join(", ") + "]"
   };
 
   infer.Fn.prototype.typeName = function() {
-    var out = "fn(";
+    var out = this.generator ? "fn*(" : "fn(";
     for (var i = 0; i < this.args.length; ++i) {
       if (i) out += ", ";
       var name = this.argNames[i];
       if (name && name != "?") out += name + ": ";
       out += typeName(this.args[i]);
     }
     out += ")";
-    if (this.computeRetSource) {
+    if (this.computeRetSource)
       out += " -> " + this.computeRetSource;
-    } else if (!this.retval.isEmpty()) {
-      var rettype = this.retval.getType(false);
-      if (rettype) out += " -> " + typeName(rettype);
-    }
+    else if (!this.retval.isEmpty())
+      out += " -> " + typeName(this.retval);
     return out;
   };
 
   infer.Obj.prototype.typeName = function() {
     if (this.nameOverride) return this.nameOverride;
     if (!this.path) return "?";
     return this.path;
   };
@@ -274,14 +296,9 @@
     for (var prop in obj) props.push(prop);
     props.sort();
     for (var i = 0; i < props.length; ++i) {
       var prop = props[i];
       out[prop] = obj[prop];
     }
     return out;
   }
-
-  function runPass(functions) {
-    if (functions) for (var i = 0; i < functions.length; ++i)
-      functions[i].apply(null, Array.prototype.slice.call(arguments, 1));
-  }
 });

old mode 100644
new mode 100755
--- a/devtools/client/sourceeditor/tern/def.js
+++ b/devtools/client/sourceeditor/tern/def.js
@@ -22,149 +22,229 @@
   }
 
   var TypeParser = exports.TypeParser = function(spec, start, base, forceNew) {
     this.pos = start || 0;
     this.spec = spec;
     this.base = base;
     this.forceNew = forceNew;
   };
+
+  function unwrapType(type, self, args) {
+    return type.call ? type(self, args) : type;
+  }
+
+  function extractProp(type, prop) {
+    if (prop == "!ret") {
+      if (type.retval) return type.retval;
+      var rv = new infer.AVal;
+      type.propagate(new infer.IsCallee(infer.ANull, [], null, rv));
+      return rv;
+    } else {
+      return type.getProp(prop);
+    }
+  }
+
+  function computedFunc(name, args, retType, generator) {
+    return function(self, cArgs) {
+      var realArgs = [];
+      for (var i = 0; i < args.length; i++) realArgs.push(unwrapType(args[i], self, cArgs));
+      return new infer.Fn(name, infer.ANull, realArgs, unwrapType(retType, self, cArgs), generator);
+    };
+  }
+  function computedUnion(types) {
+    return function(self, args) {
+      var union = new infer.AVal;
+      for (var i = 0; i < types.length; i++) unwrapType(types[i], self, args).propagate(union);
+      union.maxWeight = 1e5;
+      return union;
+    };
+  }
+  function computedArray(inner) {
+    return function(self, args) {
+      return new infer.Arr(inner(self, args));
+    };
+  }
+  function computedTuple(types) {
+    return function(self, args) {
+      return new infer.Arr(types.map(function(tp) { return unwrapType(tp, self, args) }))
+    }
+  }
+
   TypeParser.prototype = {
     eat: function(str) {
       if (str.length == 1 ? this.spec.charAt(this.pos) == str : this.spec.indexOf(str, this.pos) == this.pos) {
         this.pos += str.length;
         return true;
       }
     },
     word: function(re) {
       var word = "", ch, re = re || /[\w$]/;
       while ((ch = this.spec.charAt(this.pos)) && re.test(ch)) { word += ch; ++this.pos; }
       return word;
     },
     error: function() {
       throw new Error("Unrecognized type spec: " + this.spec + " (at " + this.pos + ")");
     },
-    parseFnType: function(name, top) {
-      var args = [], names = [];
+    parseFnType: function(comp, name, top, generator) {
+      var args = [], names = [], computed = false;
       if (!this.eat(")")) for (var i = 0; ; ++i) {
         var colon = this.spec.indexOf(": ", this.pos), argname;
         if (colon != -1) {
           argname = this.spec.slice(this.pos, colon);
           if (/^[$\w?]+$/.test(argname))
             this.pos = colon + 2;
           else
             argname = null;
         }
         names.push(argname);
-        args.push(this.parseType());
+        var argType = this.parseType(comp);
+        if (argType.call) computed = true;
+        args.push(argType);
         if (!this.eat(", ")) {
           this.eat(")") || this.error();
           break;
         }
       }
       var retType, computeRet, computeRetStart, fn;
       if (this.eat(" -> ")) {
-        if (top && this.spec.indexOf("!", this.pos) > -1) {
+        var retStart = this.pos;
+        retType = this.parseType(true);
+        if (retType.call && !computed) {
+          computeRet = retType;
           retType = infer.ANull;
-          computeRetStart = this.pos;
-          computeRet = this.parseRetType();
-        } else retType = this.parseType();
-      } else retType = infer.ANull;
+          computeRetStart = retStart;
+        }
+      } else {
+        retType = infer.ANull;
+      }
+      if (computed) return computedFunc(name, args, retType, generator);
+
       if (top && (fn = this.base))
-        infer.Fn.call(this.base, name, infer.ANull, args, names, retType);
+        infer.Fn.call(this.base, name, infer.ANull, args, names, retType, generator);
       else
-        fn = new infer.Fn(name, infer.ANull, args, names, retType);
+        fn = new infer.Fn(name, infer.ANull, args, names, retType, generator);
       if (computeRet) fn.computeRet = computeRet;
       if (computeRetStart != null) fn.computeRetSource = this.spec.slice(computeRetStart, this.pos);
       return fn;
     },
-    parseType: function(name, top) {
-      if (this.eat("fn(")) {
-        return this.parseFnType(name, top);
+    parseType: function(comp, name, top) {
+      var main = this.parseTypeMaybeProp(comp, name, top);
+      if (!this.eat("|")) return main;
+      var types = [main], computed = main.call;
+      for (;;) {
+        var next = this.parseTypeMaybeProp(comp, name, top);
+        types.push(next);
+        if (next.call) computed = true;
+        if (!this.eat("|")) break;
+      }
+      if (computed) return computedUnion(types);
+      var union = new infer.AVal;
+      for (var i = 0; i < types.length; i++) types[i].propagate(union);
+      union.maxWeight = 1e5;
+      return union;
+    },
+    parseTypeMaybeProp: function(comp, name, top) {
+      var result = this.parseTypeInner(comp, name, top);
+      while (comp && this.eat(".")) result = this.extendWithProp(result);
+      return result;
+    },
+    extendWithProp: function(base) {
+      var propName = this.word(/[\w<>$!:]/) || this.error();
+      if (base.apply) return function(self, args) {
+        return extractProp(base(self, args), propName);
+      };
+      return extractProp(base, propName);
+    },
+    parseTypeInner: function(comp, name, top) {
+      var gen
+      if (this.eat("fn(") || (gen = this.eat("fn*("))) {
+        return this.parseFnType(comp, name, top, gen);
       } else if (this.eat("[")) {
-        var inner = this.parseType();
-        if (inner == infer.ANull && this.spec == "[b.<i>]") {
-          var b = parsePath("b");
-          console.log(b.props["<i>"].types.length);
+        var inner = this.parseType(comp), types, computed = inner.call
+        while (this.eat(", ")) {
+          if (!types) types = [inner]
+          var next = this.parseType(comp)
+          types.push(next)
+          computed = computed || next.call
         }
-        this.eat("]") || this.error();
+        this.eat("]") || this.error()
+        if (computed) return types ? computedTuple(types) : computedArray(inner)
         if (top && this.base) {
-          infer.Arr.call(this.base, inner);
-          return this.base;
+          infer.Arr.call(this.base, types || inner)
+          return this.base
         }
-        return new infer.Arr(inner);
+        return new infer.Arr(types || inner)
       } else if (this.eat("+")) {
-        var path = this.word(/[\w$<>\.!]/);
-        var base = parsePath(path + ".prototype");
-        if (!(base instanceof infer.Obj)) base = parsePath(path);
-        if (!(base instanceof infer.Obj)) return base;
+        var path = this.word(/[\w$<>\.:!]/)
+        var base = infer.cx().localDefs[path + ".prototype"]
+        if (!base) {
+          var base = parsePath(path);
+          if (!(base instanceof infer.Obj)) return base;
+          var proto = descendProps(base, ["prototype"])
+          if (proto && (proto = proto.getObjType()))
+            base = proto
+        }
+        if (comp && this.eat("[")) return this.parsePoly(base);
         if (top && this.forceNew) return new infer.Obj(base);
         return infer.getInstance(base);
+      } else if (this.eat(":")) {
+        var name = this.word(/[\w$\.]/)
+        return infer.getSymbol(name)
+      } else if (comp && this.eat("!")) {
+        var arg = this.word(/\d/);
+        if (arg) {
+          arg = Number(arg);
+          return function(_self, args) {return args[arg] || infer.ANull;};
+        } else if (this.eat("this")) {
+          return function(self) {return self;};
+        } else if (this.eat("custom:")) {
+          var fname = this.word(/[\w$]/);
+          return customFunctions[fname] || function() { return infer.ANull; };
+        } else {
+          return this.fromWord("!" + this.word(/[\w$<>\.!:]/));
+        }
       } else if (this.eat("?")) {
         return infer.ANull;
       } else {
-        return this.fromWord(this.word(/[\w$<>\.!`]/));
+        return this.fromWord(this.word(/[\w$<>\.!:`]/));
       }
     },
     fromWord: function(spec) {
       var cx = infer.cx();
       switch (spec) {
       case "number": return cx.num;
       case "string": return cx.str;
       case "bool": return cx.bool;
       case "<top>": return cx.topScope;
       }
       if (cx.localDefs && spec in cx.localDefs) return cx.localDefs[spec];
       return parsePath(spec);
     },
-    parseBaseRetType: function() {
-      if (this.eat("[")) {
-        var inner = this.parseRetType();
-        this.eat("]") || this.error();
-        return function(self, args) { return new infer.Arr(inner(self, args)); };
-      } else if (this.eat("+")) {
-        var base = this.parseRetType();
-        return function(self, args) { return infer.getInstance(base(self, args)); };
-      } else if (this.eat("!")) {
-        var arg = this.word(/\d/);
-        if (arg) {
-          arg = Number(arg);
-          return function(_self, args) {return args[arg] || infer.ANull;};
-        } else if (this.eat("this")) {
-          return function(self) {return self;};
-        } else if (this.eat("custom:")) {
-          var fname = this.word(/[\w$]/);
-          return customFunctions[fname] || function() { return infer.ANull; };
-        } else {
-          return this.fromWord("!" + arg + this.word(/[\w$<>\.!]/));
-        }
+    parsePoly: function(base) {
+      var propName = "<i>", match;
+      if (match = this.spec.slice(this.pos).match(/^\s*([\w$:]+)\s*=\s*/)) {
+        propName = match[1];
+        this.pos += match[0].length;
       }
-      var t = this.parseType();
-      return function(){return t;};
-    },
-    extendRetType: function(base) {
-      var propName = this.word(/[\w<>$!]/) || this.error();
-      if (propName == "!ret") return function(self, args) {
-        var lhs = base(self, args);
-        if (lhs.retval) return lhs.retval;
-        var rv = new infer.AVal;
-        lhs.propagate(new infer.IsCallee(infer.ANull, [], null, rv));
-        return rv;
+      var value = this.parseType(true);
+      if (!this.eat("]")) this.error();
+      if (value.call) return function(self, args) {
+        var instance = new infer.Obj(base);
+        value(self, args).propagate(instance.defProp(propName));
+        return instance;
       };
-      return function(self, args) {return base(self, args).getProp(propName);};
-    },
-    parseRetType: function() {
-      var tp = this.parseBaseRetType();
-      while (this.eat(".")) tp = this.extendRetType(tp);
-      return tp;
+      var instance = new infer.Obj(base);
+      value.propagate(instance.defProp(propName));
+      return instance;
     }
   };
 
   function parseType(spec, name, base, forceNew) {
-    var type = new TypeParser(spec, null, base, forceNew).parseType(name, true);
+    var type = new TypeParser(spec, null, base, forceNew).parseType(false, name, true);
     if (/^fn\(/.test(spec)) for (var i = 0; i < type.args.length; ++i) (function(i) {
       var arg = type.args[i];
       if (arg instanceof infer.Fn && arg.args && arg.args.length) addEffect(type, function(_self, fArgs) {
         var fArg = fArgs[i];
         if (fArg) fArg.propagate(new infer.IsCallee(infer.cx().topScope, arg.args, null, infer.ANull));
       });
     })(i);
     return type;
@@ -178,77 +258,84 @@
       return replaceRet ? handled : old;
     };
   }
 
   var parseEffect = exports.parseEffect = function(effect, fn) {
     var m;
     if (effect.indexOf("propagate ") == 0) {
       var p = new TypeParser(effect, 10);
-      var getOrigin = p.parseRetType();
+      var origin = p.parseType(true);
       if (!p.eat(" ")) p.error();
-      var getTarget = p.parseRetType();
+      var target = p.parseType(true);
       addEffect(fn, function(self, args) {
-        getOrigin(self, args).propagate(getTarget(self, args));
+        unwrapType(origin, self, args).propagate(unwrapType(target, self, args));
       });
     } else if (effect.indexOf("call ") == 0) {
       var andRet = effect.indexOf("and return ", 5) == 5;
       var p = new TypeParser(effect, andRet ? 16 : 5);
-      var getCallee = p.parseRetType(), getSelf = null, getArgs = [];
-      if (p.eat(" this=")) getSelf = p.parseRetType();
-      while (p.eat(" ")) getArgs.push(p.parseRetType());
+      var getCallee = p.parseType(true), getSelf = null, getArgs = [];
+      if (p.eat(" this=")) getSelf = p.parseType(true);
+      while (p.eat(" ")) getArgs.push(p.parseType(true));
       addEffect(fn, function(self, args) {
-        var callee = getCallee(self, args);
-        var slf = getSelf ? getSelf(self, args) : infer.ANull, as = [];
-        for (var i = 0; i < getArgs.length; ++i) as.push(getArgs[i](self, args));
+        var callee = unwrapType(getCallee, self, args);
+        var slf = getSelf ? unwrapType(getSelf, self, args) : infer.ANull, as = [];
+        for (var i = 0; i < getArgs.length; ++i) as.push(unwrapType(getArgs[i], self, args));
         var result = andRet ? new infer.AVal : infer.ANull;
         callee.propagate(new infer.IsCallee(slf, as, null, result));
         return result;
       }, andRet);
     } else if (m = effect.match(/^custom (\S+)\s*(.*)/)) {
       var customFunc = customFunctions[m[1]];
       if (customFunc) addEffect(fn, m[2] ? customFunc(m[2]) : customFunc);
     } else if (effect.indexOf("copy ") == 0) {
       var p = new TypeParser(effect, 5);
-      var getFrom = p.parseRetType();
+      var getFrom = p.parseType(true);
       p.eat(" ");
-      var getTo = p.parseRetType();
+      var getTo = p.parseType(true);
       addEffect(fn, function(self, args) {
-        var from = getFrom(self, args), to = getTo(self, args);
+        var from = unwrapType(getFrom, self, args), to = unwrapType(getTo, self, args);
         from.forAllProps(function(prop, val, local) {
           if (local && prop != "<i>")
-            to.propagate(new infer.PropHasSubset(prop, val));
+            to.propagate(new infer.DefProp(prop, val));
         });
       });
     } else {
       throw new Error("Unknown effect type: " + effect);
     }
   };
 
   var currentTopScope;
 
-  var parsePath = exports.parsePath = function(path) {
+  var parsePath = exports.parsePath = function(path, scope) {
     var cx = infer.cx(), cached = cx.paths[path], origPath = path;
     if (cached != null) return cached;
     cx.paths[path] = infer.ANull;
 
-    var base = currentTopScope || cx.topScope;
+    var base = scope || currentTopScope || cx.topScope;
 
     if (cx.localDefs) for (var name in cx.localDefs) {
       if (path.indexOf(name) == 0) {
         if (path == name) return cx.paths[path] = cx.localDefs[path];
         if (path.charAt(name.length) == ".") {
           base = cx.localDefs[name];
           path = path.slice(name.length + 1);
           break;
         }
       }
     }
 
-    var parts = path.split(".");
+    var result = descendProps(base, path.split("."))
+    // Uncomment this to get feedback on your poorly written .json files
+    // if (result == infer.ANull) console.error("bad path: " + origPath + " (" + cx.curOrigin + ")")
+    cx.paths[origPath] = result == infer.ANull ? null : result
+    return result
+  }
+
+  function descendProps(base, parts) {
     for (var i = 0; i < parts.length && base != infer.ANull; ++i) {
       var prop = parts[i];
       if (prop.charAt(0) == "!") {
         if (prop == "!proto") {
           base = (base instanceof infer.Obj && base.proto) || infer.ANull;
         } else {
           var fn = base.getFunctionType();
           if (!fn) {
@@ -263,21 +350,18 @@
       } else if (base instanceof infer.Obj) {
         var propVal = (prop == "prototype" && base instanceof infer.Fn) ? base.getProp(prop) : base.props[prop];
         if (!propVal || propVal.isEmpty())
           base = infer.ANull;
         else
           base = propVal.types[0];
       }
     }
-    // Uncomment this to get feedback on your poorly written .json files
-    // if (base == infer.ANull) console.error("bad path: " + origPath + " (" + cx.curOrigin + ")");
-    cx.paths[origPath] = base == infer.ANull ? null : base;
     return base;
-  };
+  }
 
   function emptyObj(ctor) {
     var empty = Object.create(ctor.prototype);
     empty.props = Object.create(null);
     empty.isShell = true;
     return empty;
   }
 
@@ -303,17 +387,17 @@
       }
       base.name = path;
     }
 
     for (var name in spec) if (hop(spec, name) && name.charCodeAt(0) != 33) {
       var inner = spec[name];
       if (typeof inner == "string" || isSimpleAnnotation(inner)) continue;
       var prop = base.defProp(name);
-      passOne(prop.getType(false), inner, path ? path + "." + name : name).propagate(prop);
+      passOne(prop.getObjType(), inner, path ? path + "." + name : name).propagate(prop);
     }
     return base;
   }
 
   function passTwo(base, spec, path) {
     if (base.isShell) {
       delete base.isShell;
       var tp = spec["!type"];
@@ -327,54 +411,47 @@
 
     var effects = spec["!effects"];
     if (effects && base instanceof infer.Fn) for (var i = 0; i < effects.length; ++i)
       parseEffect(effects[i], base);
     copyInfo(spec, base);
 
     for (var name in spec) if (hop(spec, name) && name.charCodeAt(0) != 33) {
       var inner = spec[name], known = base.defProp(name), innerPath = path ? path + "." + name : name;
-      var type = known.getType(false);
       if (typeof inner == "string") {
-        if (type) continue;
-        parseType(inner, innerPath).propagate(known);
+        if (known.isEmpty()) parseType(inner, innerPath).propagate(known);
       } else {
-        if (!isSimpleAnnotation(inner)) {
-          passTwo(type, inner, innerPath);
-        } else if (!type) {
+        if (!isSimpleAnnotation(inner))
+          passTwo(known.getObjType(), inner, innerPath);
+        else if (known.isEmpty())
           parseType(inner["!type"], innerPath, null, true).propagate(known);
-          type = known.getType(false);
-          if (type instanceof infer.Obj) copyInfo(inner, type);
-        } else continue;
+        else
+          continue;
         if (inner["!doc"]) known.doc = inner["!doc"];
         if (inner["!url"]) known.url = inner["!url"];
         if (inner["!span"]) known.span = inner["!span"];
       }
     }
+    return base;
   }
 
   function copyInfo(spec, type) {
     if (spec["!doc"]) type.doc = spec["!doc"];
     if (spec["!url"]) type.url = spec["!url"];
     if (spec["!span"]) type.span = spec["!span"];
     if (spec["!data"]) type.metaData = spec["!data"];
   }
 
-  function runPasses(type, arg) {
-    var parent = infer.cx().parent, pass = parent && parent.passes && parent.passes[type];
-    if (pass) for (var i = 0; i < pass.length; i++) pass[i](arg);
-  }
-
   function doLoadEnvironment(data, scope) {
-    var cx = infer.cx();
+    var cx = infer.cx(), server = cx.parent
 
     infer.addOrigin(cx.curOrigin = data["!name"] || "env#" + cx.origins.length);
     cx.localDefs = cx.definitions[cx.curOrigin] = Object.create(null);
 
-    runPasses("preLoadDef", data);
+    if (server) server.signal("preLoadDef", data)
 
     passOne(scope, data);
 
     var def = data["!define"];
     if (def) {
       for (var name in def) {
         var spec = def[name];
         cx.localDefs[name] = typeof spec == "string" ? parsePath(spec) : passOne(null, spec, name);
@@ -382,42 +459,64 @@
       for (var name in def) {
         var spec = def[name];
         if (typeof spec != "string") passTwo(cx.localDefs[name], def[name], name);
       }
     }
 
     passTwo(scope, data);
 
-    runPasses("postLoadDef", data);
+    if (server) server.signal("postLoadDef", data)
 
     cx.curOrigin = cx.localDefs = null;
   }
 
   exports.load = function(data, scope) {
     if (!scope) scope = infer.cx().topScope;
     var oldScope = currentTopScope;
     currentTopScope = scope;
     try {
       doLoadEnvironment(data, scope);
     } finally {
       currentTopScope = oldScope;
     }
   };
 
+  exports.parse = function(data, origin, path) {
+    var cx = infer.cx();
+    if (origin) {
+      cx.origin = origin;
+      cx.localDefs = cx.definitions[origin];
+    }
+
+    try {
+      if (typeof data == "string")
+        return parseType(data, path);
+      else
+        return passTwo(passOne(null, data, path), data, path);
+    } finally {
+      if (origin) cx.origin = cx.localDefs = null;
+    }
+  };
+
   // Used to register custom logic for more involved effect or type
   // computation.
   var customFunctions = Object.create(null);
   infer.registerFunction = function(name, f) { customFunctions[name] = f; };
 
-  var IsCreated = infer.constraint("created, target, spec", {
+  var IsCreated = infer.constraint({
+    construct: function(created, target, spec) {
+      this.created = created;
+      this.target = target;
+      this.spec = spec;
+    },
     addType: function(tp) {
       if (tp instanceof infer.Obj && this.created++ < 5) {
         var derived = new infer.Obj(tp), spec = this.spec;
-        if (spec instanceof infer.AVal) spec = spec.getType(false);
+        if (spec instanceof infer.AVal) spec = spec.getObjType(false);
         if (spec instanceof infer.Obj) for (var prop in spec.props) {
           var cur = spec.props[prop].types[0];
           var p = derived.defProp(prop);
           if (cur && cur instanceof infer.Obj && cur.props.value) {
             var vtp = cur.props.value.getType(false);
             if (vtp) p.addType(vtp);
           }
         }
@@ -430,21 +529,58 @@
     if (argNodes && argNodes.length && argNodes[0].type == "Literal" && argNodes[0].value == null)
       return new infer.Obj();
 
     var result = new infer.AVal;
     if (args[0]) args[0].propagate(new IsCreated(0, result, args[1]));
     return result;
   });
 
-  var IsBound = infer.constraint("self, args, target", {
+  var PropSpec = infer.constraint({
+    construct: function(target) { this.target = target; },
+    addType: function(tp) {
+      if (!(tp instanceof infer.Obj)) return;
+      if (tp.hasProp("value"))
+        tp.getProp("value").propagate(this.target);
+      else if (tp.hasProp("get"))
+        tp.getProp("get").propagate(new infer.IsCallee(infer.ANull, [], null, this.target));
+    }
+  });
+
+  infer.registerFunction("Object_defineProperty", function(_self, args, argNodes) {
+    if (argNodes && argNodes.length >= 3 && argNodes[1].type == "Literal" &&
+        typeof argNodes[1].value == "string") {
+      var obj = args[0], connect = new infer.AVal;
+      obj.propagate(new infer.DefProp(argNodes[1].value, connect, argNodes[1]));
+      args[2].propagate(new PropSpec(connect));
+    }
+    return infer.ANull;
+  });
+
+  infer.registerFunction("Object_defineProperties", function(_self, args, argNodes) {
+    if (args.length >= 2) {
+      var obj = args[0];
+      args[1].forAllProps(function(prop, val, local) {
+        if (!local) return;
+        var connect = new infer.AVal;
+        obj.propagate(new infer.DefProp(prop, connect, argNodes && argNodes[1]));
+        val.propagate(new PropSpec(connect));
+      });
+    }
+    return infer.ANull;
+  });
+
+  var IsBound = infer.constraint({
+    construct: function(self, args, target) {
+      this.self = self; this.args = args; this.target = target;
+    },
     addType: function(tp) {
       if (!(tp instanceof infer.Fn)) return;
-      this.target.addType(new infer.Fn(tp.name, tp.self, tp.args.slice(this.args.length),
-                                       tp.argNames.slice(this.args.length), tp.retval));
+      this.target.addType(new infer.Fn(tp.name, infer.ANull, tp.args.slice(this.args.length),
+                                       tp.argNames.slice(this.args.length), tp.retval, tp.generator));
       this.self.propagate(tp.self);
       for (var i = 0; i < Math.min(tp.args.length, this.args.length); ++i)
         this.args[i].propagate(tp.args[i]);
     }
   });
 
   infer.registerFunction("Function_bind", function(self, args) {
     if (!args.length) return infer.ANull;
@@ -457,10 +593,64 @@
     var arr = new infer.Arr;
     if (args.length != 1 || !args[0].hasType(infer.cx().num)) {
       var content = arr.getProp("<i>");
       for (var i = 0; i < args.length; ++i) args[i].propagate(content);
     }
     return arr;
   });
 
+  infer.registerFunction("Promise_ctor", function(_self, args, argNodes) {
+    var defs6 = infer.cx().definitions.ecma6
+    if (!defs6 || args.length < 1) return infer.ANull;
+    var self = new infer.Obj(defs6["Promise.prototype"]);
+    var valProp = self.defProp(":t", argNodes && argNodes[0]);
+    var valArg = new infer.AVal;
+    valArg.propagate(valProp);
+    var exec = new infer.Fn("execute", infer.ANull, [valArg], ["value"], infer.ANull);
+    var reject = defs6.Promise_reject;
+    args[0].propagate(new infer.IsCallee(infer.ANull, [exec, reject], null, infer.ANull));
+    return self;
+  });
+
+  var PromiseResolvesTo = infer.constraint({
+    construct: function(output) { this.output = output; },
+    addType: function(tp) {
+      if (tp.constructor == infer.Obj && tp.name == "Promise" && tp.hasProp(":t"))
+        tp.getProp(":t").propagate(this.output);
+      else
+        tp.propagate(this.output);
+    }
+  });
+
+  var WG_PROMISE_KEEP_VALUE = 50;
+
+  infer.registerFunction("Promise_then", function(self, args, argNodes) {
+    var fn = args.length && args[0].getFunctionType();
+    var defs6 = infer.cx().definitions.ecma6
+    if (!fn || !defs6) return self;
+
+    var result = new infer.Obj(defs6["Promise.prototype"]);
+    var value = result.defProp(":t", argNodes && argNodes[0]), ty;
+    if (fn.retval.isEmpty() && (ty = self.getType()) instanceof infer.Obj && ty.hasProp(":t"))
+      ty.getProp(":t").propagate(value, WG_PROMISE_KEEP_VALUE);
+    fn.retval.propagate(new PromiseResolvesTo(value));
+    return result;
+  });
+
+  infer.registerFunction("getOwnPropertySymbols", function(_self, args) {
+    if (!args.length) return infer.ANull
+    var result = new infer.AVal
+    args[0].forAllProps(function(prop, _val, local) {
+      if (local && prop.charAt(0) == ":") result.addType(infer.getSymbol(prop.slice(1)))
+    })
+    return result
+  })
+
+  infer.registerFunction("getSymbol", function(_self, _args, argNodes) {
+    if (argNodes.length && argNodes[0].type == "Literal" && typeof argNodes[0].value == "string")
+      return infer.getSymbol(argNodes[0].value)
+    else
+      return infer.ANull
+  })
+
   return exports;
 });

old mode 100644
new mode 100755
--- a/devtools/client/sourceeditor/tern/infer.js
+++ b/devtools/client/sourceeditor/tern/infer.js
@@ -1,65 +1,71 @@
 // Main type inference engine
 
-// Walks an AST, building up a graph of abstract values and contraints
+// Walks an AST, building up a graph of abstract values and constraints
 // that cause types to flow from one node to another. Also defines a
 // number of utilities for accessing ASTs and scopes.
 
 // Analysis is done in a context, which is tracked by the dynamically
 // bound cx variable. Use withContext to set the current context.
 
 // For memory-saving reasons, individual types export an interface
 // similar to abstract values (which can hold multiple types), and can
 // thus be used in place abstract values that only ever contain a
 // single type.
 
-(function(mod) {
+(function(root, mod) {
   if (typeof exports == "object" && typeof module == "object") // CommonJS
-    return mod(exports, require("acorn/acorn"), require("acorn/acorn_loose"), require("acorn/util/walk"),
+    return mod(exports, require("acorn/acorn"), require("acorn/acorn_loose"), require("acorn/walk"),
                require("./def"), require("./signal"));
   if (typeof define == "function" && define.amd) // AMD
-    return define(["exports", "acorn/acorn", "acorn/acorn_loose", "acorn/util/walk", "./def", "./signal"], mod);
-  mod(self.tern || (self.tern = {}), acorn, acorn, acorn.walk, tern.def, tern.signal); // Plain browser env
-})(function(exports, acorn, acorn_loose, walk, def, signal) {
+    return define(["exports", "acorn/acorn", "acorn/acorn_loose", "acorn/walk", "./def", "./signal"], mod);
+  mod(root.tern || (root.tern = {}), acorn, acorn, acorn.walk, tern.def, tern.signal); // Plain browser env
+})(this, function(exports, acorn, acorn_loose, walk, def, signal) {
   "use strict";
 
   var toString = exports.toString = function(type, maxDepth, parent) {
-    return !type || type == parent ? "?": type.toString(maxDepth);
+    if (!type || type == parent || maxDepth && maxDepth < -3) return "?";
+    return type.toString(maxDepth, parent);
   };
 
   // A variant of AVal used for unknown, dead-end values. Also serves
   // as prototype for AVals, Types, and Constraints because it
   // implements 'empty' versions of all the methods that the code
   // expects.
   var ANull = exports.ANull = signal.mixin({
     addType: function() {},
     propagate: function() {},
     getProp: function() { return ANull; },
     forAllProps: function() {},
     hasType: function() { return false; },
     isEmpty: function() { return true; },
     getFunctionType: function() {},
+    getObjType: function() {},
+    getSymbolType: function() {},
     getType: function() {},
     gatherProperties: function() {},
     propagatesTo: function() {},
     typeHint: function() {},
-    propHint: function() {}
+    propHint: function() {},
+    toString: function() { return "?"; }
   });
 
   function extend(proto, props) {
     var obj = Object.create(proto);
     if (props) for (var prop in props) obj[prop] = props[prop];
     return obj;
   }
 
   // ABSTRACT VALUES
 
-  var WG_DEFAULT = 100, WG_NEW_INSTANCE = 90, WG_MADEUP_PROTO = 10, WG_MULTI_MEMBER = 5,
-      WG_CATCH_ERROR = 5, WG_GLOBAL_THIS = 90, WG_SPECULATIVE_THIS = 2;
+  var WG_DEFAULT = 100, WG_NEW_INSTANCE = 90, WG_MADEUP_PROTO = 10,
+      WG_MULTI_MEMBER = 6, WG_CATCH_ERROR = 6,
+      WG_PHANTOM_OBJ = 1,
+      WG_GLOBAL_THIS = 90, WG_SPECULATIVE_THIS = 2, WG_SPECULATIVE_PROTO_THIS = 4;
 
   var AVal = exports.AVal = function() {
     this.types = [];
     this.forward = null;
     this.maxWeight = 0;
   };
   AVal.prototype = extend(ANull, {
     addType: function(type, weight) {
@@ -76,63 +82,99 @@
       this.types.push(type);
       var forward = this.forward;
       if (forward) withWorklist(function(add) {
         for (var i = 0; i < forward.length; ++i) add(type, forward[i], weight);
       });
     },
 
     propagate: function(target, weight) {
-      if (target == ANull || (target instanceof Type)) return;
-      if (weight && weight < WG_DEFAULT) target = new Muffle(target, weight);
+      if (target == ANull || (target instanceof Type && this.forward && this.forward.length > 2)) return;
+      if (weight && weight != WG_DEFAULT) target = new Muffle(target, weight);
       (this.forward || (this.forward = [])).push(target);
       var types = this.types;
       if (types.length) withWorklist(function(add) {
         for (var i = 0; i < types.length; ++i) add(types[i], target, weight);
       });
     },
 
     getProp: function(prop) {
       if (prop == "__proto__" || prop == "✖") return ANull;
       var found = (this.props || (this.props = Object.create(null)))[prop];
       if (!found) {
         found = this.props[prop] = new AVal;
-        this.propagate(new PropIsSubset(prop, found));
+        this.propagate(new GetProp(prop, found));
       }
       return found;
     },
 
     forAllProps: function(c) {
       this.propagate(new ForAllProps(c));
     },
 
     hasType: function(type) {
       return this.types.indexOf(type) > -1;
     },
-    isEmpty: function() { return this.types.length == 0; },
+    isEmpty: function() { return this.types.length === 0; },
     getFunctionType: function() {
       for (var i = this.types.length - 1; i >= 0; --i)
         if (this.types[i] instanceof Fn) return this.types[i];
     },
+    getObjType: function() {
+      var seen = null;
+      for (var i = this.types.length - 1; i >= 0; --i) {
+        var type = this.types[i];
+        if (!(type instanceof Obj)) continue;
+        if (type.name) return type;
+        if (!seen) seen = type;
+      }
+      return seen;
+    },
+
+    getSymbolType: function() {
+      for (var i = this.types.length - 1; i >= 0; --i)
+        if (this.types[i] instanceof Sym) return this.types[i]
+    },
 
     getType: function(guess) {
-      if (this.types.length == 0 && guess !== false) return this.makeupType();
-      if (this.types.length == 1) return this.types[0];
+      if (this.types.length === 0 && guess !== false) return this.makeupType();
+      if (this.types.length === 1) return this.types[0];
       return canonicalType(this.types);
     },
 
-    computedPropType: function() {
-      if (!this.propertyOf || !this.propertyOf.hasProp("<i>")) return null;
-      var computedProp = this.propertyOf.getProp("<i>");
-      if (computedProp == this) return null;
-      return computedProp.getType();
+    toString: function(maxDepth, parent) {
+      if (this.types.length == 0) return toString(this.makeupType(), maxDepth, parent);
+      if (this.types.length == 1) return toString(this.types[0], maxDepth, parent);
+      var simplified = simplifyTypes(this.types);
+      if (simplified.length > 2) return "?";
+      return simplified.map(function(tp) { return toString(tp, maxDepth, parent); }).join("|");
+    },
+
+    makeupPropType: function(obj) {
+      var propName = this.propertyName;
+
+      var protoProp = obj.proto && obj.proto.hasProp(propName);
+      if (protoProp) {
+        var fromProto = protoProp.getType();
+        if (fromProto) return fromProto;
+      }
+
+      if (propName != "<i>") {
+        var computedProp = obj.hasProp("<i>");
+        if (computedProp) return computedProp.getType();
+      } else if (obj.props["<i>"] != this) {
+        for (var prop in obj.props) {
+          var val = obj.props[prop];
+          if (!val.isEmpty()) return val.getType();
+        }
+      }
     },
 
     makeupType: function() {
-      var computed = this.computedPropType();
+      var computed = this.propertyOf && this.makeupPropType(this.propertyOf);
       if (computed) return computed;
 
       if (!this.forward) return null;
       for (var i = this.forward.length - 1; i >= 0; --i) {
         var hint = this.forward[i].typeHint();
         if (hint && !hint.isEmpty()) {guessing = true; return hint;}
       }
 
@@ -173,16 +215,69 @@
         var prop = this.forward[i].propHint();
         if (prop) f(prop, null, 0);
       }
       var guessed = this.makeupType();
       if (guessed) guessed.gatherProperties(f);
     }
   });
 
+  function similarAVal(a, b, depth) {
+    var typeA = a.getType(false), typeB = b.getType(false);
+    if (!typeA || !typeB) return true;
+    return similarType(typeA, typeB, depth);
+  }
+
+  function similarType(a, b, depth) {
+    if (!a || depth >= 5) return b;
+    if (!a || a == b) return a;
+    if (!b) return a;
+    if (a.constructor != b.constructor) return false;
+    if (a.constructor == Arr) {
+      var innerA = a.getProp("<i>").getType(false);
+      if (!innerA) return b;
+      var innerB = b.getProp("<i>").getType(false);
+      if (!innerB || similarType(innerA, innerB, depth + 1)) return b;
+    } else if (a.constructor == Obj) {
+      var propsA = 0, propsB = 0, same = 0;
+      for (var prop in a.props) {
+        propsA++;
+        if (prop in b.props && similarAVal(a.props[prop], b.props[prop], depth + 1))
+          same++;
+      }
+      for (var prop in b.props) propsB++;
+      if (propsA && propsB && same < Math.max(propsA, propsB) / 2) return false;
+      return propsA > propsB ? a : b;
+    } else if (a.constructor == Fn) {
+      if (a.args.length != b.args.length ||
+          !a.args.every(function(tp, i) { return similarAVal(tp, b.args[i], depth + 1); }) ||
+          !similarAVal(a.retval, b.retval, depth + 1) || !similarAVal(a.self, b.self, depth + 1))
+        return false;
+      return a;
+    } else {
+      return false;
+    }
+  }
+
+  var simplifyTypes = exports.simplifyTypes = function(types) {
+    var found = [];
+    outer: for (var i = 0; i < types.length; ++i) {
+      var tp = types[i];
+      for (var j = 0; j < found.length; j++) {
+        var similar = similarType(tp, found[j], 0);
+        if (similar) {
+          found[j] = similar;
+          continue outer;
+        }
+      }
+      found.push(tp);
+    }
+    return found;
+  };
+
   function canonicalType(types) {
     var arrays = 0, fns = 0, objs = 0, prim = null;
     for (var i = 0; i < types.length; ++i) {
       var tp = types[i];
       if (tp instanceof Arr) ++arrays;
       else if (tp instanceof Fn) ++fns;
       else if (tp instanceof Obj) ++objs;
       else if (tp instanceof Prim) {
@@ -208,115 +303,121 @@
       }
       if (score >= maxScore) { maxScore = score; maxTp = tp; }
     }
     return maxTp;
   }
 
   // PROPAGATION STRATEGIES
 
-  function Constraint() {}
-  Constraint.prototype = extend(ANull, {
-    init: function() { this.origin = cx.curOrigin; }
-  });
-
-  var constraint = exports.constraint = function(props, methods) {
-    var body = "this.init();";
-    props = props ? props.split(", ") : [];
-    for (var i = 0; i < props.length; ++i)
-      body += "this." + props[i] + " = " + props[i] + ";";
-    var ctor = Function.apply(null, props.concat([body]));
-    ctor.prototype = Object.create(Constraint.prototype);
+  var constraint = exports.constraint = function(methods) {
+    var ctor = function() {
+      this.origin = cx.curOrigin;
+      this.construct.apply(this, arguments);
+    };
+    ctor.prototype = Object.create(ANull);
     for (var m in methods) if (methods.hasOwnProperty(m)) ctor.prototype[m] = methods[m];
     return ctor;
   };
 
-  var PropIsSubset = constraint("prop, target", {
+  var GetProp = constraint({
+    construct: function(prop, target) {
+      this.prop = prop; this.target = target;
+    },
     addType: function(type, weight) {
       if (type.getProp)
         type.getProp(this.prop).propagate(this.target, weight);
     },
     propHint: function() { return this.prop; },
     propagatesTo: function() {
       if (this.prop == "<i>" || !/[^\w_]/.test(this.prop))
         return {target: this.target, pathExt: "." + this.prop};
     }
   });
 
-  var PropHasSubset = exports.PropHasSubset = constraint("prop, type, originNode", {
+  var DefProp = exports.PropHasSubset = exports.DefProp = constraint({
+    construct: function(prop, type, originNode) {
+      this.prop = prop; this.type = type; this.originNode = originNode;
+    },
     addType: function(type, weight) {
       if (!(type instanceof Obj)) return;
       var prop = type.defProp(this.prop, this.originNode);
-      prop.origin = this.origin;
+      if (!prop.origin) prop.origin = this.origin;
       this.type.propagate(prop, weight);
     },
     propHint: function() { return this.prop; }
   });
 
-  var ForAllProps = constraint("c", {
+  var ForAllProps = constraint({
+    construct: function(c) { this.c = c; },
     addType: function(type) {
       if (!(type instanceof Obj)) return;
       type.forAllProps(this.c);
     }
   });
 
   function withDisabledComputing(fn, body) {
     cx.disabledComputing = {fn: fn, prev: cx.disabledComputing};
-    try {
-      return body();
-    } finally {
-      cx.disabledComputing = cx.disabledComputing.prev;
-    }
+    var result = body();
+    cx.disabledComputing = cx.disabledComputing.prev;
+    return result;
   }
-  var IsCallee = exports.IsCallee = constraint("self, args, argNodes, retval", {
-    init: function() {
-      Constraint.prototype.init();
+  var IsCallee = exports.IsCallee = constraint({
+    construct: function(self, args, argNodes, retval) {
+      this.self = self; this.args = args; this.argNodes = argNodes; this.retval = retval;
       this.disabled = cx.disabledComputing;
     },
     addType: function(fn, weight) {
       if (!(fn instanceof Fn)) return;
       for (var i = 0; i < this.args.length; ++i) {
         if (i < fn.args.length) this.args[i].propagate(fn.args[i], weight);
         if (fn.arguments) this.args[i].propagate(fn.arguments, weight);
       }
       this.self.propagate(fn.self, this.self == cx.topScope ? WG_GLOBAL_THIS : weight);
-      var compute = fn.computeRet;
+      var compute = fn.computeRet, result = fn.retval
       if (compute) for (var d = this.disabled; d; d = d.prev)
-        if (d.fn == fn || fn.name && d.fn.name == fn.name) compute = null;
-      if (compute)
-        compute(this.self, this.args, this.argNodes).propagate(this.retval, weight);
-      else
-        fn.retval.propagate(this.retval, weight);
+        if (d.fn == fn || fn.originNode && d.fn.originNode == fn.originNode) compute = null;
+      if (compute) {
+        var old = cx.disabledComputing;
+        cx.disabledComputing = this.disabled;
+        result = compute(this.self, this.args, this.argNodes)
+        cx.disabledComputing = old;
+      }
+      maybeIterator(fn, result).propagate(this.retval, weight)
     },
     typeHint: function() {
       var names = [];
       for (var i = 0; i < this.args.length; ++i) names.push("?");
       return new Fn(null, this.self, this.args, names, ANull);
     },
     propagatesTo: function() {
       return {target: this.retval, pathExt: ".!ret"};
     }
   });
 
-  var HasMethodCall = constraint("propName, args, argNodes, retval", {
-    init: function() {
-      Constraint.prototype.init();
+  var HasMethodCall = constraint({
+    construct: function(propName, args, argNodes, retval) {
+      this.propName = propName; this.args = args; this.argNodes = argNodes; this.retval = retval;
       this.disabled = cx.disabledComputing;
     },
     addType: function(obj, weight) {
       var callee = new IsCallee(obj, this.args, this.argNodes, this.retval);
       callee.disabled = this.disabled;
       obj.getProp(this.propName).propagate(callee, weight);
     },
     propHint: function() { return this.propName; }
   });
 
-  var IsCtor = exports.IsCtor = constraint("target, noReuse", {
+  var IsCtor = exports.IsCtor = constraint({
+    construct: function(target, noReuse) {
+      this.target = target; this.noReuse = noReuse;
+    },
     addType: function(f, weight) {
       if (!(f instanceof Fn)) return;
+      if (cx.parent && !cx.parent.options.reuseInstances) this.noReuse = true;
       f.getProp("prototype").propagate(new IsProto(this.noReuse ? false : f, this.target), weight);
     }
   });
 
   var getInstance = exports.getInstance = function(obj, ctor) {
     if (ctor === false) return new Obj(obj);
 
     if (!ctor) ctor = obj.hasCtor;
@@ -326,65 +427,85 @@
       if (cur.ctor == ctor) return cur.instance;
     }
     var instance = new Obj(obj, ctor && ctor.name);
     instance.origin = obj.origin;
     obj.instances.push({ctor: ctor, instance: instance});
     return instance;
   };
 
-  var IsProto = exports.IsProto = constraint("ctor, target", {
+  var IsProto = exports.IsProto = constraint({
+    construct: function(ctor, target) {
+      this.ctor = ctor; this.target = target;
+    },
     addType: function(o, _weight) {
       if (!(o instanceof Obj)) return;
       if ((this.count = (this.count || 0) + 1) > 8) return;
       if (o == cx.protos.Array)
         this.target.addType(new Arr);
       else
         this.target.addType(getInstance(o, this.ctor));
     }
   });
 
-  var FnPrototype = constraint("fn", {
+  var FnPrototype = constraint({
+    construct: function(fn) { this.fn = fn; },
     addType: function(o, _weight) {
       if (o instanceof Obj && !o.hasCtor) {
         o.hasCtor = this.fn;
         var adder = new SpeculativeThis(o, this.fn);
         adder.addType(this.fn);
         o.forAllProps(function(_prop, val, local) {
           if (local) val.propagate(adder);
         });
       }
     }
   });
 
-  var IsAdded = constraint("other, target", {
+  var IsAdded = constraint({
+    construct: function(other, target) {
+      this.other = other; this.target = target;
+    },
     addType: function(type, weight) {
       if (type == cx.str)
         this.target.addType(cx.str, weight);
       else if (type == cx.num && this.other.hasType(cx.num))
         this.target.addType(cx.num, weight);
     },
     typeHint: function() { return this.other; }
   });
 
-  var IfObj = exports.IfObj = constraint("target", {
+  var IfObj = exports.IfObj = constraint({
+    construct: function(target) { this.target = target; },
     addType: function(t, weight) {
       if (t instanceof Obj) this.target.addType(t, weight);
     },
     propagatesTo: function() { return this.target; }
   });
 
-  var SpeculativeThis = constraint("obj, ctor", {
+  var SpeculativeThis = constraint({
+    construct: function(obj, ctor) { this.obj = obj; this.ctor = ctor; },
     addType: function(tp) {
-      if (tp instanceof Fn && tp.self && tp.self.isEmpty())
-        tp.self.addType(getInstance(this.obj, this.ctor), WG_SPECULATIVE_THIS);
+      if (tp instanceof Fn && tp.self)
+        tp.self.addType(getInstance(this.obj, this.ctor), WG_SPECULATIVE_PROTO_THIS);
     }
   });
 
-  var Muffle = constraint("inner, weight", {
+  var HasProto = constraint({
+    construct: function(obj) { this.obj = obj },
+    addType: function(tp) {
+      if (tp instanceof Obj && this.obj.proto == cx.protos.Object)
+        this.obj.replaceProto(tp)
+    }
+  });
+
+  var Muffle = constraint({
+    construct: function(inner, weight) {
+      this.inner = inner; this.weight = weight;
+    },
     addType: function(tp, weight) {
       this.inner.addType(tp, Math.min(weight, this.weight));
     },
     propagatesTo: function() { return this.inner.propagatesTo(); },
     typeHint: function() { return this.inner.typeHint(); },
     propHint: function() { return this.inner.propHint(); }
   });
 
@@ -405,81 +526,93 @@
     constructor: Prim,
     toString: function() { return this.name; },
     getProp: function(prop) {return this.proto.hasProp(prop) || ANull;},
     gatherProperties: function(f, depth) {
       if (this.proto) this.proto.gatherProperties(f, depth);
     }
   });
 
+  function isInteger(str) {
+    var c0 = str.charCodeAt(0)
+    if (c0 >= 48 && c0 <= 57) return !/\D/.test(str)
+    else return false
+  }
+
   var Obj = exports.Obj = function(proto, name) {
     if (!this.props) this.props = Object.create(null);
     this.proto = proto === true ? cx.protos.Object : proto;
     if (proto && !name && proto.name && !(this instanceof Fn)) {
       var match = /^(.*)\.prototype$/.exec(this.proto.name);
       if (match) name = match[1];
     }
     this.name = name;
     this.maybeProps = null;
     this.origin = cx.curOrigin;
   };
   Obj.prototype = extend(Type.prototype, {
     constructor: Obj,
     toString: function(maxDepth) {
-      if (!maxDepth && this.name) return this.name;
+      if (maxDepth == null) maxDepth = 0;
+      if (maxDepth <= 0 && this.name) return this.name;
       var props = [], etc = false;
       for (var prop in this.props) if (prop != "<i>") {
         if (props.length > 5) { etc = true; break; }
         if (maxDepth)
-          props.push(prop + ": " + toString(this.props[prop].getType(), maxDepth - 1));
+          props.push(prop + ": " + toString(this.props[prop], maxDepth - 1, this));
         else
           props.push(prop);
       }
       props.sort();
       if (etc) props.push("...");
       return "{" + props.join(", ") + "}";
     },
     hasProp: function(prop, searchProto) {
+      if (isInteger(prop)) prop = this.normalizeIntegerProp(prop)
       var found = this.props[prop];
       if (searchProto !== false)
         for (var p = this.proto; p && !found; p = p.proto) found = p.props[prop];
       return found;
     },
     defProp: function(prop, originNode) {
       var found = this.hasProp(prop, false);
       if (found) {
-        if (found.maybePurge) found.maybePurge = false;
         if (originNode && !found.originNode) found.originNode = originNode;
         return found;
       }
       if (prop == "__proto__" || prop == "✖") return ANull;
+      if (isInteger(prop)) prop = this.normalizeIntegerProp(prop)
 
       var av = this.maybeProps && this.maybeProps[prop];
       if (av) {
         delete this.maybeProps[prop];
         this.maybeUnregProtoPropHandler();
       } else {
         av = new AVal;
         av.propertyOf = this;
+        av.propertyName = prop;
       }
 
       this.props[prop] = av;
       av.originNode = originNode;
       av.origin = cx.curOrigin;
       this.broadcastProp(prop, av, true);
       return av;
     },
     getProp: function(prop) {
       var found = this.hasProp(prop, true) || (this.maybeProps && this.maybeProps[prop]);
       if (found) return found;
       if (prop == "__proto__" || prop == "✖") return ANull;
+      if (isInteger(prop)) prop = this.normalizeIntegerProp(prop)
       var av = this.ensureMaybeProps()[prop] = new AVal;
       av.propertyOf = this;
+      av.propertyName = prop;
       return av;
     },
+    normalizeIntegerProp: function(_) { return "<i>" },
     broadcastProp: function(prop, val, local) {
       if (local) {
         this.signal("addProp", prop, val);
         // If this is a scope, it shouldn't be registered
         if (!(this instanceof Scope)) registerProp(prop, this);
       }
 
       if (this.onNewProp) for (var i = 0; i < this.onNewProp.length; ++i) {
@@ -491,27 +624,35 @@
       var maybe = this.maybeProps && this.maybeProps[prop];
       if (maybe) {
         delete this.maybeProps[prop];
         this.maybeUnregProtoPropHandler();
         this.proto.getProp(prop).propagate(maybe);
       }
       this.broadcastProp(prop, val, false);
     },
+    replaceProto: function(proto) {
+      if (this.proto && this.maybeProps)
+        this.proto.unregPropHandler(this)
+      this.proto = proto
+      if (this.maybeProps)
+        this.proto.forAllProps(this)
+    },
     ensureMaybeProps: function() {
       if (!this.maybeProps) {
         if (this.proto) this.proto.forAllProps(this);
         this.maybeProps = Object.create(null);
       }
       return this.maybeProps;
     },
     removeProp: function(prop) {
       var av = this.props[prop];
       delete this.props[prop];
       this.ensureMaybeProps()[prop] = av;
+      av.types.length = 0;
     },
     forAllProps: function(c) {
       if (!this.onNewProp) {
         this.onNewProp = [];
         if (this.proto) this.proto.forAllProps(this);
       }
       this.onNewProp.push(c);
       for (var o = this; o; o = o.proto) for (var prop in o.props) {
@@ -530,43 +671,45 @@
       this.proto.unregPropHandler(this);
     },
     unregPropHandler: function(handler) {
       for (var i = 0; i < this.onNewProp.length; ++i)
         if (this.onNewProp[i] == handler) { this.onNewProp.splice(i, 1); break; }
       this.maybeUnregProtoPropHandler();
     },
     gatherProperties: function(f, depth) {
-      for (var prop in this.props) if (prop != "<i>")
+      for (var prop in this.props) if (prop != "<i>" && prop.charAt(0) != ":")
         f(prop, this, depth);
       if (this.proto) this.proto.gatherProperties(f, depth + 1);
-    }
+    },
+    getObjType: function() { return this; }
   });
 
-  var Fn = exports.Fn = function(name, self, args, argNames, retval) {
+  var Fn = exports.Fn = function(name, self, args, argNames, retval, generator) {
     Obj.call(this, cx.protos.Function, name);
     this.self = self;
     this.args = args;
     this.argNames = argNames;
     this.retval = retval;
+    this.generator = generator
   };
   Fn.prototype = extend(Obj.prototype, {
     constructor: Fn,
     toString: function(maxDepth) {
-      if (maxDepth) maxDepth--;
-      var str = "fn(";
+      if (maxDepth == null) maxDepth = 0;
+      var str = this.generator ? "fn*(" : "fn(";
       for (var i = 0; i < this.args.length; ++i) {
         if (i) str += ", ";
         var name = this.argNames[i];
         if (name && name != "?") str += name + ": ";
-        str += toString(this.args[i].getType(), maxDepth, this);
+        str += maxDepth > -3 ? toString(this.args[i], maxDepth - 1, this) : "?";
       }
       str += ")";
       if (!this.retval.isEmpty())
-        str += " -> " + toString(this.retval.getType(), maxDepth, this);
+        str += " -> " + (maxDepth > -3 ? toString(this.retval, maxDepth - 1, this) : "?");
       return str;
     },
     getProp: function(prop) {
       if (prop == "prototype") {
         var known = this.hasProp(prop, false);
         if (!known) {
           known = this.defProp(prop);
           var proto = new Obj(true, this.name && this.name + ".prototype");
@@ -587,27 +730,81 @@
         return found;
       }
       return Obj.prototype.defProp.call(this, prop, originNode);
     },
     getFunctionType: function() { return this; }
   });
 
   var Arr = exports.Arr = function(contentType) {
-    Obj.call(this, cx.protos.Array);
-    var content = this.defProp("<i>");
-    if (contentType) contentType.propagate(content);
+    Obj.call(this, cx.protos.Array)
+    var content = this.defProp("<i>")
+    if (Array.isArray(contentType)) {
+      this.tuple = contentType.length
+      for (var i = 0; i < contentType.length; i++) {
+        var prop = this.defProp(String(i))
+        contentType[i].propagate(prop)
+        prop.propagate(content)
+      }
+    } else if (contentType) {
+      this.tuple = 0
+      contentType.propagate(content)
+    }
   };
   Arr.prototype = extend(Obj.prototype, {
     constructor: Arr,
     toString: function(maxDepth) {
-      return "[" + toString(this.getProp("<i>").getType(), maxDepth, this) + "]";
+      if (maxDepth == null) maxDepth = 0
+      if (maxDepth <= -3) return "[?]"
+      var content = ""
+      if (this.tuple) {
+        var similar
+        for (var i = 0; i in this.props; i++) {
+          var type = toString(this.getProp(String(i)), maxDepth - 1, this)
+          if (similar == null)
+            similar = type
+          else if (similar != type)
+            similar = false
+          else
+            similar = type
+          content += (content ? ", " : "") + type
+        }
+        if (similar) content = similar
+      } else {
+        content = toString(this.getProp("<i>"), maxDepth - 1, this)
+      }
+      return "[" + content + "]"
+    },
+    normalizeIntegerProp: function(prop) {
+      if (+prop < this.tuple) return prop
+      else return "<i>"
     }
   });
 
+  var Sym = exports.Sym = function(name, originNode) {
+    Prim.call(this, cx.protos.Symbol, "Symbol")
+    this.symName = name
+    this.originNode = originNode
+  }
+  Sym.prototype = extend(Prim.prototype, {
+    constructor: Sym,
+    asPropName: function() { return ":" + this.symName },
+    getSymbolType: function() { return this }
+  })
+
+  exports.getSymbol = function(name, originNode) {
+    var cleanName = name.replace(/[^\w$\.]/g, "_")
+    var known = cx.symbols[cleanName]
+    if (known) {
+      if (originNode && !known.originNode) known.originNode = originNode
+      return known
+    }
+    return cx.symbols[cleanName] = new Sym(cleanName, originNode)
+  }
+
   // THE PROPERTY REGISTRY
 
   function registerProp(prop, obj) {
     var data = cx.props[prop] || (cx.props[prop] = []);
     data.push(obj);
   }
 
   function objsWithProp(prop) {
@@ -622,51 +819,59 @@
     this.protos = Object.create(null);
     this.origins = [];
     this.curOrigin = "ecma5";
     this.paths = Object.create(null);
     this.definitions = Object.create(null);
     this.purgeGen = 0;
     this.workList = null;
     this.disabledComputing = null;
+    this.curSuperCtor = this.curSuper = null;
+    this.symbols = Object.create(null)
 
     exports.withContext(this, function() {
       cx.protos.Object = new Obj(null, "Object.prototype");
       cx.topScope = new Scope();
       cx.topScope.name = "<top>";
       cx.protos.Array = new Obj(true, "Array.prototype");
-      cx.protos.Function = new Obj(true, "Function.prototype");
+      cx.protos.Function = new Fn("Function.prototype", ANull, [], [], ANull);
+      cx.protos.Function.proto = cx.protos.Object;
       cx.protos.RegExp = new Obj(true, "RegExp.prototype");
       cx.protos.String = new Obj(true, "String.prototype");
       cx.protos.Number = new Obj(true, "Number.prototype");
       cx.protos.Boolean = new Obj(true, "Boolean.prototype");
+      cx.protos.Symbol = new Obj(true, "Symbol.prototype");
       cx.str = new Prim(cx.protos.String, "string");
       cx.bool = new Prim(cx.protos.Boolean, "bool");
       cx.num = new Prim(cx.protos.Number, "number");
       cx.curOrigin = null;
 
       if (defs) for (var i = 0; i < defs.length; ++i)
         def.load(defs[i]);
     });
   };
 
+  exports.Context.prototype.startAnalysis = function() {
+    this.disabledComputing = this.workList = this.curSuperCtor = this.curSuper = null;
+  };
+
   var cx = null;
   exports.cx = function() { return cx; };
 
   exports.withContext = function(context, f) {
     var old = cx;
     cx = context;
     try { return f(); }
     finally { cx = old; }
   };
 
   exports.TimedOut = function() {
     this.message = "Timed out";
     this.stack = (new Error()).stack;
-  }
+  };
   exports.TimedOut.prototype = Object.create(Error.prototype);
   exports.TimedOut.prototype.name = "infer.TimedOut";
 
   var timeout;
   exports.withTimeout = function(ms, f) {
     var end = +new Date + ms;
     var oldEnd = timeout;
     if (oldEnd && oldEnd < end) return f();
@@ -674,121 +879,134 @@
     try { return f(); }
     finally { timeout = oldEnd; }
   };
 
   exports.addOrigin = function(origin) {
     if (cx.origins.indexOf(origin) < 0) cx.origins.push(origin);
   };
 
-  var baseMaxWorkDepth = 20, reduceMaxWorkDepth = .0001;
+  var baseMaxWorkDepth = 20, reduceMaxWorkDepth = 0.0001;
   function withWorklist(f) {
     if (cx.workList) return f(cx.workList);
 
     var list = [], depth = 0;
     var add = cx.workList = function(type, target, weight) {
       if (depth < baseMaxWorkDepth - reduceMaxWorkDepth * list.length)
         list.push(type, target, weight, depth);
     };
-    try {
-      var ret = f(add);
-      for (var i = 0; i < list.length; i += 4) {
-        if (timeout && +new Date >= timeout)
-          throw new exports.TimedOut();
-        depth = list[i + 3] + 1;
-        list[i + 1].addType(list[i], list[i + 2]);
-      }
-      return ret;
-    } finally {
-      cx.workList = null;
+    var ret = f(add);
+    for (var i = 0; i < list.length; i += 4) {
+      if (timeout && +new Date >= timeout)
+        throw new exports.TimedOut();
+      depth = list[i + 3] + 1;
+      list[i + 1].addType(list[i], list[i + 2]);
     }
+    cx.workList = null;
+    return ret;
+  }
+
+  function withSuper(ctor, obj, f) {
+    var oldCtor = cx.curSuperCtor, oldObj = cx.curSuper
+    cx.curSuperCtor = ctor; cx.curSuper = obj
+    var result = f()
+    cx.curSuperCtor = oldCtor; cx.curSuper = oldObj
+    return result
   }
 
   // SCOPES
 
-  var Scope = exports.Scope = function(prev) {
+  var Scope = exports.Scope = function(prev, originNode, isBlock) {
     Obj.call(this, prev || true);
     this.prev = prev;
+    this.originNode = originNode
+    this.isBlock = !!isBlock
   };
   Scope.prototype = extend(Obj.prototype, {
     constructor: Scope,
     defVar: function(name, originNode) {
       for (var s = this; ; s = s.proto) {
         var found = s.props[name];
         if (found) return found;
         if (!s.prev) return s.defProp(name, originNode);
       }
     }
   });
 
+  function functionScope(scope) {
+    while (scope.isBlock) scope = scope.prev
+    return scope
+  }
+
+
   // RETVAL COMPUTATION HEURISTICS
 
   function maybeInstantiate(scope, score) {
-    if (scope.fnType)
-      scope.fnType.instantiateScore = (scope.fnType.instantiateScore || 0) + score;
+    var fn = functionScope(scope).fnType
+    if (fn) fn.instantiateScore = (fn.instantiateScore || 0) + score;
   }
 
   var NotSmaller = {};
   function nodeSmallerThan(node, n) {
     try {
       walk.simple(node, {Expression: function() { if (--n <= 0) throw NotSmaller; }});
       return true;
     } catch(e) {
       if (e == NotSmaller) return false;
       throw e;
     }
   }
 
-  function maybeTagAsInstantiated(node, scope) {
-    var score = scope.fnType.instantiateScore;
-    if (!cx.disabledComputing && score && scope.fnType.args.length && nodeSmallerThan(node, score * 5)) {
-      maybeInstantiate(scope.prev, score / 2);
-      setFunctionInstantiated(node, scope);
+  function maybeTagAsInstantiated(node, fn) {
+    var score = fn.instantiateScore;
+    if (!cx.disabledComputing && score && fn.args.length && nodeSmallerThan(node, score * 5)) {
+      maybeInstantiate(functionScope(fn.originNode.scope.prev), score / 2);
+      setFunctionInstantiated(node, fn);
       return true;
     } else {
-      scope.fnType.instantiateScore = null;
+      fn.instantiateScore = null;
     }
   }
 
-  function setFunctionInstantiated(node, scope) {
-    var fn = scope.fnType;
+  function setFunctionInstantiated(node, fn) {
     // Disconnect the arg avals, so that we can add info to them without side effects
     for (var i = 0; i < fn.args.length; ++i) fn.args[i] = new AVal;
     fn.self = new AVal;
     fn.computeRet = function(self, args) {
       // Prevent recursion
       return withDisabledComputing(fn, function() {
         var oldOrigin = cx.curOrigin;
         cx.curOrigin = fn.origin;
-        var scopeCopy = new Scope(scope.prev);
-        scopeCopy.originNode = scope.originNode;
+        var scope = node.scope
+        var scopeCopy = new Scope(scope.prev, scope.originNode);
         for (var v in scope.props) {
           var local = scopeCopy.defProp(v, scope.props[v].originNode);
           for (var i = 0; i < args.length; ++i) if (fn.argNames[i] == v && i < args.length)
             args[i].propagate(local);
         }
         var argNames = fn.argNames.length != args.length ? fn.argNames.slice(0, args.length) : fn.argNames;
         while (argNames.length < args.length) argNames.push("?");
-        scopeCopy.fnType = new Fn(fn.name, self, args, argNames, ANull);
+        scopeCopy.fnType = new Fn(fn.name, self, args, argNames, ANull, fn.generator);
+        scopeCopy.fnType.originNode = fn.originNode;
         if (fn.arguments) {
           var argset = scopeCopy.fnType.arguments = new AVal;
           scopeCopy.defProp("arguments").addType(new Arr(argset));
           for (var i = 0; i < args.length; ++i) args[i].propagate(argset);
         }
-        node.body.scope = scopeCopy;
+        node.scope = scopeCopy;
         walk.recursive(node.body, scopeCopy, null, scopeGatherer);
         walk.recursive(node.body, scopeCopy, null, inferWrapper);
         cx.curOrigin = oldOrigin;
         return scopeCopy.fnType.retval;
       });
     };
   }
 
-  function maybeTagAsGeneric(scope) {
-    var fn = scope.fnType, target = fn.retval;
+  function maybeTagAsGeneric(fn) {
+    var target = fn.retval;
     if (target == ANull) return;
     var targetInner, asArray;
     if (!target.isEmpty() && (targetInner = target.getType()) instanceof Arr)
       target = asArray = targetInner.getProp("<i>");
 
     function explore(aval, path, depth) {
       if (depth > 3 || !aval.forward) return;
       for (var i = 0; i < aval.forward.length; ++i) {
@@ -809,383 +1027,701 @@
 
     var foundPath = explore(fn.self, "!this", 0);
     for (var i = 0; !foundPath && i < fn.args.length; ++i)
       foundPath = explore(fn.args[i], "!" + i, 0);
 
     if (foundPath) {
       if (asArray) foundPath = "[" + foundPath + "]";
       var p = new def.TypeParser(foundPath);
-      fn.computeRet = p.parseRetType();
+      var parsed = p.parseType(true);
+      fn.computeRet = parsed.apply ? parsed : function() { return parsed; };
       fn.computeRetSource = foundPath;
       return true;
     }
   }
 
   // SCOPE GATHERING PASS
 
   function addVar(scope, nameNode) {
     return scope.defProp(nameNode.name, nameNode);
   }
+  function patternName(node) {
+    if (node.type == "Identifier") return node.name
+    if (node.type == "AssignmentPattern") return patternName(node.left)
+    if (node.type == "ObjectPattern") return "{" + node.properties.map(function(e) { return patternName(e.value) }).join(", ") + "}"
+    if (node.type == "ArrayPattern") return "[" + node.elements.map(patternName).join(", ") + "]"
+    if (node.type == "RestElement") return "..." + patternName(node.argument)
+    return "_"
+  }
 
-  var scopeGatherer = walk.make({
+  function isBlockScopedDecl(node) {
+    return node.type == "VariableDeclaration" && node.kind != "var" ||
+      node.type == "FunctionDeclaration" ||
+      node.type == "ClassDeclaration";
+  }
+
+  function patternScopes(inner, outer) {
+    return {inner: inner, outer: outer || inner}
+  }
+
+  var scopeGatherer = exports.scopeGatherer = walk.make({
+    VariablePattern: function(node, scopes) {
+      if (scopes.inner) addVar(scopes.inner, node)
+    },
+    AssignmentPattern: function(node, scopes, c) {
+      c(node.left, scopes, "Pattern")
+      c(node.right, scopes.outer, "Expression")
+    },
+    AssignmentExpression: function(node, scope, c) {
+      if (node.left.type == "MemberExpression")
+        c(node.left, scope, "Expression")
+      else
+        c(node.left, patternScopes(false, scope), "Pattern")
+      c(node.right, scope, "Expression")
+    },
     Function: function(node, scope, c) {
-      var inner = node.body.scope = new Scope(scope);
-      inner.originNode = node;
-      var argVals = [], argNames = [];
+      var inner = node.scope = new Scope(scope, node)
+      var argVals = [], argNames = []
       for (var i = 0; i < node.params.length; ++i) {
-        var param = node.params[i];
-        argNames.push(param.name);
-        argVals.push(addVar(inner, param));
+        var param = node.params[i]
+        argNames.push(patternName(param))
+        if (param.type == "Identifier") {
+          argVals.push(addVar(inner, param))
+        } else {
+          var arg = new AVal
+          argVals.push(arg)
+          arg.originNode = param
+          c(param, patternScopes(inner), "Pattern")
+        }
       }
-      inner.fnType = new Fn(node.id && node.id.name, new AVal, argVals, argNames, ANull);
+      inner.fnType = new Fn(node.id && node.id.name, new AVal, argVals, argNames, ANull, node.generator)
       inner.fnType.originNode = node;
       if (node.id) {
         var decl = node.type == "FunctionDeclaration";
         addVar(decl ? scope : inner, node.id);
       }
-      c(node.body, inner, "ScopeBody");
+      c(node.body, inner, node.expression ? "Expression" : "Statement");
+    },
+    BlockStatement: function(node, scope, c) {
+      if (!node.scope && node.body.some(isBlockScopedDecl))
+        scope = node.scope = new Scope(scope, node, true)
+      walk.base.BlockStatement(node, scope, c)
     },
     TryStatement: function(node, scope, c) {
       c(node.block, scope, "Statement");
       if (node.handler) {
-        var v = addVar(scope, node.handler.param);
-        c(node.handler.body, scope, "ScopeBody");
-        var e5 = cx.definitions.ecma5;
-        if (e5 && v.isEmpty()) getInstance(e5["Error.prototype"]).propagate(v, WG_CATCH_ERROR);
+        if (node.handler.param.type == "Identifier") {
+          var v = addVar(scope, node.handler.param);
+          c(node.handler.body, scope, "Statement");
+          var e5 = cx.definitions.ecma5;
+          if (e5 && v.isEmpty()) getInstance(e5["Error.prototype"]).propagate(v, WG_CATCH_ERROR);
+        } else {
+          c(node.handler.param, patternScopes(scope), "Pattern")
+        }
       }
       if (node.finalizer) c(node.finalizer, scope, "Statement");
     },
     VariableDeclaration: function(node, scope, c) {
+      var targetScope = node.kind == "var" ? functionScope(scope) : scope
       for (var i = 0; i < node.declarations.length; ++i) {
         var decl = node.declarations[i];
-        addVar(scope, decl.id);
+        c(decl.id, patternScopes(targetScope, scope), "Pattern")
         if (decl.init) c(decl.init, scope, "Expression");
       }
+    },
+    ClassDeclaration: function(node, scope, c) {
+      addVar(scope, node.id)
+      if (node.superClass) c(node.superClass, scope, "Expression")
+      for (var i = 0; i < node.body.body.length; i++)
+        c(node.body.body[i], scope)
+    },
+    ForInStatement: function(node, scope, c) {
+      if (!node.scope && isBlockScopedDecl(node.left))
+        scope = node.scope = new Scope(scope, node, true)
+      walk.base.ForInStatement(node, scope, c)
+    },
+    ForStatement: function(node, scope, c) {
+      if (!node.scope && node.init && isBlockScopedDecl(node.init))
+        scope = node.scope = new Scope(scope, node, true)
+      walk.base.ForStatement(node, scope, c)
+    },
+    ImportDeclaration: function(node, scope) {
+      for (var i = 0; i < node.specifiers.length; i++)
+        addVar(scope, node.specifiers[i].local)
     }
   });
+  scopeGatherer.ForOfStatement = scopeGatherer.ForInStatement
 
   // CONSTRAINT GATHERING PASS
 
-  function propName(node, scope, c) {
-    var prop = node.property;
-    if (!node.computed) return prop.name;
-    if (prop.type == "Literal" && typeof prop.value == "string") return prop.value;
-    if (c) infer(prop, scope, c, ANull);
+  var propName = exports.propName = function(node, inferInScope) {
+    var key = node.property || node.key;
+    if (!node.computed && key.type == "Identifier") return key.name;
+    if (key.type == "Literal") {
+      if (typeof key.value == "string") return key.value
+      if (typeof key.value == "number") return String(key.value)
+    }
+    if (inferInScope) {
+      var symName = symbolName(infer(key, inferInScope))
+      if (symName) return node.propName = symName
+    } else if (node.propName) {
+      return node.propName
+    }
     return "<i>";
   }
+  function symbolName(val) {
+    var sym = val.getSymbolType()
+    if (sym) return sym.asPropName()
+  }
 
   function unopResultType(op) {
     switch (op) {
     case "+": case "-": case "~": return cx.num;
     case "!": return cx.bool;
     case "typeof": return cx.str;
     case "void": case "delete": return ANull;
     }
   }
   function binopIsBoolean(op) {
     switch (op) {
     case "==": case "!=": case "===": case "!==": case "<": case ">": case ">=": case "<=":
     case "in": case "instanceof": return true;
     }
   }
-  function literalType(val) {
-    switch (typeof val) {
+  function literalType(node) {
+    if (node.regex) return getInstance(cx.protos.RegExp);
+    switch (typeof node.value) {
     case "boolean": return cx.bool;
     case "number": return cx.num;
     case "string": return cx.str;
     case "object":
     case "function":
-      if (!val) return ANull;
+      if (!node.value) return ANull;
       return getInstance(cx.protos.RegExp);
     }
   }
 
+  function join(a, b) {
+    if (a == b || b == ANull) return a
+    if (a == ANull) return b
+    var joined = new AVal
+    a.propagate(joined)
+    b.propagate(joined)
+    return joined
+  }
+
+  function connectParams(node, scope) {
+    for (var i = 0; i < node.params.length; i++) {
+      var param = node.params[i]
+      if (param.type == "Identifier") continue
+      connectPattern(param, scope, node.scope.fnType.args[i])
+    }
+  }
+
+  function ensureVar(node, scope) {
+    return scope.hasProp(node.name) || cx.topScope.defProp(node.name, node)
+  }
+
+  var inferPatternVisitor = exports.inferPatternVisitor = {
+    Identifier: function(node, scope, source) {
+      source.propagate(ensureVar(node, scope))
+    },
+    MemberExpression: function(node, scope, source) {
+      var obj = infer(node.object, scope)
+      var pName = propName(node, scope)
+      obj.propagate(new DefProp(pName, source, node.property))
+    },
+    RestElement: function(node, scope, source) {
+      connectPattern(node.argument, scope, new Arr(source))
+    },
+    ObjectPattern: function(node, scope, source) {
+      for (var i = 0; i < node.properties.length; ++i) {
+        var prop = node.properties[i]
+        connectPattern(prop.value, scope, source.getProp(prop.key.name))
+      }
+    },
+    ArrayPattern: function(node, scope, source) {
+      for (var i = 0; i < node.elements.length; i++)
+        if (node.elements[i])
+          connectPattern(node.elements[i], scope, source.getProp(String(i)))
+    },
+    AssignmentPattern: function(node, scope, source) {
+      connectPattern(node.left, scope, join(source, infer(node.right, scope)))
+    }
+  }
+
+  function connectPattern(node, scope, source) {
+    var connecter = inferPatternVisitor[node.type]
+    if (connecter) connecter(node, scope, source)
+  }
+
+  function getThis(scope) {
+    var fnScope = functionScope(scope)
+    return fnScope.fnType ? fnScope.fnType.self : fnScope
+  }
+
+  function maybeAddPhantomObj(obj) {
+    if (!obj.isEmpty() || !obj.propertyOf) return
+    obj.propertyOf.getProp(obj.propertyName).addType(new Obj, WG_PHANTOM_OBJ)
+    maybeAddPhantomObj(obj.propertyOf)
+  }
+
+  function inferClass(node, scope, name) {
+    if (!name && node.id) name = node.id.name
+
+    var sup = cx.protos.Object, supCtor, delayed
+    if (node.superClass) {
+      if (node.superClass.type == "Literal" && node.superClass.value == null) {
+        sup = null
+      } else {
+        var supVal = infer(node.superClass, scope), supProto
+        supCtor = supVal.getFunctionType()
+        if (supCtor && (supProto = supCtor.getProp("prototype").getObjType())) {
+          sup = supProto
+        } else {
+          supCtor = supVal
+          delayed = supVal.getProp("prototype")
+        }
+      }
+    }
+    var proto = new Obj(sup, name && name + ".prototype")
+    if (delayed) delayed.propagate(new HasProto(proto))
+
+    return withSuper(supCtor, delayed || sup, function() {
+      var ctor, body = node.body.body
+      for (var i = 0; i < body.length; i++)
+        if (body[i].kind == "constructor") ctor = body[i].value
+      var fn = node.objType = ctor ? infer(ctor, scope) : new Fn(name, ANull, [], null, ANull)
+      fn.originNode = node.id || ctor || node
+
+      var inst = getInstance(proto, fn)
+      fn.self.addType(inst)
+      fn.defProp("prototype", node).addType(proto)
+      for (var i = 0; i < body.length; i++) {
+        var method = body[i], target
+        if (method.kind == "constructor") continue
+        var pName = propName(method, scope)
+        if (pName == "<i>" || method.kind == "set") {
+          target = ANull
+        } else {
+          target = (method.static ? fn : proto).defProp(pName, method.key)
+          target.initializer = true
+          if (method.kind == "get") target = new IsCallee(inst, [], null, target)
+        }
+        infer(method.value, scope, target)
+        var methodFn = target.getFunctionType()
+        if (methodFn) methodFn.self.addType(inst)
+      }
+      return fn
+    })
+  }
+
+  function arrayLiteralType(elements, scope, inner) {
+    var tuple = elements.length > 1 && elements.length < 6
+    if (tuple) {
+      var homogenous = true, litType
+      for (var i = 0; i < elements.length; i++) {
+        var elt = elements[i]
+        if (!elt)
+          tuple = false
+        else if (elt.type != "Literal" || (litType && litType != typeof elt.value))
+          homogenous = false
+        else
+          litType = typeof elt.value
+      }
+      if (homogenous) tuple = false
+    }
+
+    if (tuple) {
+      var types = []
+      for (var i = 0; i < elements.length; ++i)
+        types.push(inner(elements[i], scope))
+      return new Arr(types)
+    } else if (elements.length < 2) {
+      return new Arr(elements[0] && inner(elements[0], scope))
+    } else {
+      var eltVal = new AVal
+      for (var i = 0; i < elements.length; i++)
+        if (elements[i]) inner(elements[i], scope).propagate(eltVal)
+      return new Arr(eltVal)
+    }
+  }
+
   function ret(f) {
-    return function(node, scope, c, out, name) {
-      var r = f(node, scope, c, name);
+    return function(node, scope, out, name) {
+      var r = f(node, scope, name);
       if (out) r.propagate(out);
       return r;
     };
   }
   function fill(f) {
-    return function(node, scope, c, out, name) {
+    return function(node, scope, out, name) {
       if (!out) out = new AVal;
-      f(node, scope, c, out, name);
+      f(node, scope, out, name);
       return out;
     };
   }
 
-  var inferExprVisitor = {
-    ArrayExpression: ret(function(node, scope, c) {
-      var eltval = new AVal;
-      for (var i = 0; i < node.elements.length; ++i) {
-        var elt = node.elements[i];
-        if (elt) infer(elt, scope, c, eltval);
+  var inferExprVisitor = exports.inferExprVisitor = {
+    ArrayExpression: ret(function(node, scope) {
+      return arrayLiteralType(node.elements, scope, infer)
+    }),
+    ObjectExpression: ret(function(node, scope, name) {
+      var proto = true, waitForProto
+      for (var i = 0; i < node.properties.length; ++i) {
+        var prop = node.properties[i]
+        if (prop.key.name == "__proto__") {
+          if (prop.value.type == "Literal" && prop.value.value == null) {
+            proto = null
+          } else {
+            var protoVal = infer(prop.value, scope), known = protoVal.getObjType()
+            if (known) proto = known
+            else waitForProto = protoVal
+          }
+        }
       }
-      return new Arr(eltval);
-    }),
-    ObjectExpression: ret(function(node, scope, c, name) {
-      var obj = node.objType = new Obj(true, name);
+
+      var obj = node.objType = new Obj(proto, name);
+      if (waitForProto) waitForProto.propagate(new HasProto(obj))
       obj.originNode = node;
 
-      for (var i = 0; i < node.properties.length; ++i) {
-        var prop = node.properties[i], key = prop.key, name;
-        if (key.type == "Identifier") {
-          name = key.name;
-        } else if (typeof key.value == "string") {
-          name = key.value;
-        } else {
-          infer(prop.value, scope, c, ANull);
-          continue;
+      withSuper(null, waitForProto || proto, function() {
+        for (var i = 0; i < node.properties.length; ++i) {
+          var prop = node.properties[i], key = prop.key;
+          if (prop.value.name == "✖" || prop.key.name == "__proto__") continue;
+
+          var name = propName(prop, scope), target
+          if (name == "<i>" || prop.kind == "set") {
+            target = ANull;
+          } else {
+            var val = target = obj.defProp(name, key);
+            val.initializer = true;
+            if (prop.kind == "get")
+              target = new IsCallee(obj, [], null, val);
+          }
+          infer(prop.value, scope, target, name);
+          if (prop.value.type == "FunctionExpression")
+            prop.value.scope.fnType.self.addType(obj, WG_SPECULATIVE_THIS);
         }
-        var val = obj.defProp(name, key);
-        val.initializer = true;
-        infer(prop.value, scope, c, val, name);
-      }
+      })
       return obj;
     }),
-    FunctionExpression: ret(function(node, scope, c, name) {
-      var inner = node.body.scope, fn = inner.fnType;
+    FunctionExpression: ret(function(node, scope, name) {
+      var inner = node.scope, fn = inner.fnType;
       if (name && !fn.name) fn.name = name;
-      c(node.body, scope, "ScopeBody");
-      maybeTagAsInstantiated(node, inner) || maybeTagAsGeneric(inner);
+      connectParams(node, inner)
+      if (node.expression)
+        infer(node.body, inner, inner.fnType.retval = new AVal)
+      else
+        walk.recursive(node.body, inner, null, inferWrapper, "Statement")
+      if (node.type == "ArrowFunctionExpression") {
+        getThis(scope).propagate(fn.self)
+        fn.self = ANull
+      }
+      maybeTagAsInstantiated(node, fn) || maybeTagAsGeneric(fn);
       if (node.id) inner.getProp(node.id.name).addType(fn);
       return fn;
     }),
-    SequenceExpression: ret(function(node, scope, c) {
+    ClassExpression: ret(inferClass),
+    SequenceExpression: ret(function(node, scope) {
       for (var i = 0, l = node.expressions.length - 1; i < l; ++i)
-        infer(node.expressions[i], scope, c, ANull);
-      return infer(node.expressions[l], scope, c);
+        infer(node.expressions[i], scope, ANull);
+      return infer(node.expressions[l], scope);
     }),
-    UnaryExpression: ret(function(node, scope, c) {
-      infer(node.argument, scope, c, ANull);
+    UnaryExpression: ret(function(node, scope) {
+      infer(node.argument, scope, ANull);
       return unopResultType(node.operator);
     }),
-    UpdateExpression: ret(function(node, scope, c) {
-      infer(node.argument, scope, c, ANull);
+    UpdateExpression: ret(function(node, scope) {
+      infer(node.argument, scope, ANull);
       return cx.num;
     }),
-    BinaryExpression: ret(function(node, scope, c) {
+    BinaryExpression: ret(function(node, scope) {
       if (node.operator == "+") {
-        var lhs = infer(node.left, scope, c);
-        var rhs = infer(node.right, scope, c);
+        var lhs = infer(node.left, scope);
+        var rhs = infer(node.right, scope);
         if (lhs.hasType(cx.str) || rhs.hasType(cx.str)) return cx.str;
         if (lhs.hasType(cx.num) && rhs.hasType(cx.num)) return cx.num;
         var result = new AVal;
         lhs.propagate(new IsAdded(rhs, result));
         rhs.propagate(new IsAdded(lhs, result));
         return result;
       } else {
-        infer(node.left, scope, c, ANull);
-        infer(node.right, scope, c, ANull);
+        infer(node.left, scope, ANull);
+        infer(node.right, scope, ANull);
         return binopIsBoolean(node.operator) ? cx.bool : cx.num;
       }
     }),
-    AssignmentExpression: ret(function(node, scope, c) {
-      var rhs, name, pName;
+    AssignmentExpression: ret(function(node, scope, name) {
+      var rhs, pName;
       if (node.left.type == "MemberExpression") {
-        pName = propName(node.left, scope, c);
-        if (node.left.object.type == "Identifier")
-          name = node.left.object.name + "." + pName;
-      } else {
-        name = node.left.name;
+        pName = propName(node.left, scope)
+        if (!name)
+          name = node.left.object.type == "Identifier" ? node.left.object.name + "." + pName : pName
+      } else if (!name && node.left.type == "Identifier") {
+        name = node.left.name
       }
 
-      if (node.operator != "=" && node.operator != "+=") {
-        infer(node.right, scope, c, ANull);
+      if (node.operator && node.operator != "=" && node.operator != "+=") {
+        infer(node.right, scope, ANull);
         rhs = cx.num;
       } else {
-        rhs = infer(node.right, scope, c, null, name);
+        rhs = infer(node.right, scope, null, name);
       }
 
       if (node.left.type == "MemberExpression") {
-        var obj = infer(node.left.object, scope, c);
+        var obj = infer(node.left.object, scope);
         if (pName == "prototype") maybeInstantiate(scope, 20);
         if (pName == "<i>") {
           // This is a hack to recognize for/in loops that copy
           // properties, and do the copying ourselves, insofar as we
           // manage, because such loops tend to be relevant for type
           // information.
           var v = node.left.property.name, local = scope.props[v], over = local && local.iteratesOver;
           if (over) {
             maybeInstantiate(scope, 20);
             var fromRight = node.right.type == "MemberExpression" && node.right.computed && node.right.property.name == v;
             over.forAllProps(function(prop, val, local) {
               if (local && prop != "prototype" && prop != "<i>")
-                obj.propagate(new PropHasSubset(prop, fromRight ? val : ANull));
+                obj.propagate(new DefProp(prop, fromRight ? val : ANull));
             });
             return rhs;
           }
         }
-        obj.propagate(new PropHasSubset(pName, rhs, node.left.property));
-      } else { // Identifier
-        var v = scope.defVar(node.left.name, node.left);
-        if (v.maybePurge) v.maybePurge = false;
-        rhs.propagate(v);
+
+        obj.propagate(new DefProp(pName, rhs, node.left.property));
+        maybeAddPhantomObj(obj)
+        if (node.right.type == "FunctionExpression")
+          obj.propagate(node.right.scope.fnType.self, WG_SPECULATIVE_THIS);
+      } else {
+        connectPattern(node.left, scope, rhs)
       }
       return rhs;
     }),
-    LogicalExpression: fill(function(node, scope, c, out) {
-      infer(node.left, scope, c, out);
-      infer(node.right, scope, c, out);
+    LogicalExpression: fill(function(node, scope, out) {
+      infer(node.left, scope, out);
+      infer(node.right, scope, out);
     }),
-    ConditionalExpression: fill(function(node, scope, c, out) {
-      infer(node.test, scope, c, ANull);
-      infer(node.consequent, scope, c, out);
-      infer(node.alternate, scope, c, out);
+    ConditionalExpression: fill(function(node, scope, out) {
+      infer(node.test, scope, ANull);
+      infer(node.consequent, scope, out);
+      infer(node.alternate, scope, out);
     }),
-    NewExpression: fill(function(node, scope, c, out, name) {
+    NewExpression: fill(function(node, scope, out, name) {
       if (node.callee.type == "Identifier" && node.callee.name in scope.props)
         maybeInstantiate(scope, 20);
 
       for (var i = 0, args = []; i < node.arguments.length; ++i)
-        args.push(infer(node.arguments[i], scope, c));
-      var callee = infer(node.callee, scope, c);
+        args.push(infer(node.arguments[i], scope));
+      var callee = infer(node.callee, scope);
       var self = new AVal;
       callee.propagate(new IsCtor(self, name && /\.prototype$/.test(name)));
       self.propagate(out, WG_NEW_INSTANCE);
       callee.propagate(new IsCallee(self, args, node.arguments, new IfObj(out)));
     }),
-    CallExpression: fill(function(node, scope, c, out) {
+    CallExpression: fill(function(node, scope, out) {
       for (var i = 0, args = []; i < node.arguments.length; ++i)
-        args.push(infer(node.arguments[i], scope, c));
+        args.push(infer(node.arguments[i], scope));
+      var outerFn = functionScope(scope).fnType
       if (node.callee.type == "MemberExpression") {
-        var self = infer(node.callee.object, scope, c);
-        var pName = propName(node.callee, scope, c);
-        if ((pName == "call" || pName == "apply") &&
-            scope.fnType && scope.fnType.args.indexOf(self) > -1)
+        var self = infer(node.callee.object, scope);
+        var pName = propName(node.callee, scope)
+        if (outerFn && (pName == "call" || pName == "apply") &&
+            outerFn.args.indexOf(self) > -1)
           maybeInstantiate(scope, 30);
         self.propagate(new HasMethodCall(pName, args, node.arguments, out));
+      } else if (node.callee.type == "Super" && cx.curSuperCtor) {
+        cx.curSuperCtor.propagate(new IsCallee(getThis(scope), args, node.arguments, out))
       } else {
-        var callee = infer(node.callee, scope, c);
-        if (scope.fnType && scope.fnType.args.indexOf(callee) > -1)
+        var callee = infer(node.callee, scope);
+        if (outerFn && outerFn.args.indexOf(callee) > -1)
           maybeInstantiate(scope, 30);
         var knownFn = callee.getFunctionType();
-        if (knownFn && knownFn.instantiateScore && scope.fnType)
+        if (knownFn && knownFn.instantiateScore && outerFn)
           maybeInstantiate(scope, knownFn.instantiateScore / 5);
         callee.propagate(new IsCallee(cx.topScope, args, node.arguments, out));
       }
     }),
-    MemberExpression: fill(function(node, scope, c, out) {
-      var name = propName(node, scope);
-      var obj = infer(node.object, scope, c);
-      var prop = obj.getProp(name);
+    MemberExpression: fill(function(node, scope, out) {
+      var name = propName(node), wg;
       if (name == "<i>") {
-        var propType = infer(node.property, scope, c);
-        if (!propType.hasType(cx.num))
-          return prop.propagate(out, WG_MULTI_MEMBER);
+        var propType = infer(node.property, scope)
+        var symName = symbolName(propType)
+        if (symName)
+          name = node.propName = symName
+        else if (!propType.hasType(cx.num))
+          wg = WG_MULTI_MEMBER
       }
-      prop.propagate(out);
+      infer(node.object, scope).getProp(name).propagate(out, wg)
     }),
     Identifier: ret(function(node, scope) {
-      if (node.name == "arguments" && scope.fnType && !(node.name in scope.props))
-        scope.defProp(node.name, scope.fnType.originNode)
-          .addType(new Arr(scope.fnType.arguments = new AVal));
+      if (node.name == "arguments") {
+        var fnScope = functionScope(scope)
+        if (fnScope.fnType && !(node.name in fnScope.props))
+          scope.defProp(node.name, fnScope.fnType.originNode)
+            .addType(new Arr(fnScope.fnType.arguments = new AVal));
+      }
       return scope.getProp(node.name);
     }),
     ThisExpression: ret(function(_node, scope) {
-      return scope.fnType ? scope.fnType.self : cx.topScope;
+      return getThis(scope)
+    }),
+    Super: ret(function(node) {
+      return node.superType = cx.curSuper || ANull
     }),
     Literal: ret(function(node) {
-      return literalType(node.value);
+      return literalType(node);
+    }),
+    TemplateLiteral: ret(function(node, scope) {
+      for (var i = 0; i < node.expressions.length; ++i)
+        infer(node.expressions[i], scope, ANull)
+      return cx.str
+    }),
+    TaggedTemplateExpression: fill(function(node, scope, out) {
+      var args = [new Arr(cx.str)]
+      for (var i = 0; i < node.quasi.expressions.length; ++i)
+        args.push(infer(node.quasi.expressions[i], scope))
+      infer(node.tag, scope, new IsCallee(cx.topScope, args, node.quasi.expressions, out))
+    }),
+    YieldExpression: ret(function(node, scope) {
+      var output = ANull, fn = functionScope(scope).fnType
+      if (fn) {
+        if (fn.retval == ANull) fn.retval = new AVal
+        if (!fn.yieldval) fn.yieldval = new AVal
+        output = fn.retval
+      }
+      if (node.argument) {
+        if (node.delegate) {
+          infer(node.argument, scope, new HasMethodCall("next", [], null,
+                                                        new GetProp("value", output)))
+        } else {
+          infer(node.argument, scope, output)
+        }
+      }
+      return fn ? fn.yieldval : ANull
     })
   };
+  inferExprVisitor.ArrowFunctionExpression = inferExprVisitor.FunctionExpression
 
-  function infer(node, scope, c, out, name) {
-    return inferExprVisitor[node.type](node, scope, c, out, name);
+  function infer(node, scope, out, name) {
+    var handler = inferExprVisitor[node.type];
+    return handler ? handler(node, scope, out, name) : ANull;
   }
 
-  var inferWrapper = walk.make({
-    Expression: function(node, scope, c) {
-      infer(node, scope, c, ANull);
+  function loopPattern(init) {
+    return init.type == "VariableDeclaration" ? init.declarations[0].id : init
+  }
+
+  var inferWrapper = exports.inferWrapper = walk.make({
+    Expression: function(node, scope) {
+      infer(node, node.scope || scope, ANull);
     },
 
     FunctionDeclaration: function(node, scope, c) {
-      var inner = node.body.scope, fn = inner.fnType;
-      c(node.body, scope, "ScopeBody");
-      maybeTagAsInstantiated(node, inner) || maybeTagAsGeneric(inner);
-      var prop = scope.getProp(node.id.name);
-      prop.addType(fn);
+      var inner = node.scope, fn = inner.fnType;
+      connectParams(node, inner)
+      c(node.body, inner, "Statement");
+      maybeTagAsInstantiated(node, fn) || maybeTagAsGeneric(fn);
+      scope.getProp(node.id.name).addType(fn)
+    },
+
+    Statement: function(node, scope, c) {
+      c(node, node.scope || scope)
     },
 
-    VariableDeclaration: function(node, scope, c) {
+    VariableDeclaration: function(node, scope) {
       for (var i = 0; i < node.declarations.length; ++i) {
-        var decl = node.declarations[i], prop = scope.getProp(decl.id.name);
-        if (decl.init)
-          infer(decl.init, scope, c, prop, decl.id.name);
+        var decl = node.declarations[i];
+        if (decl.id.type == "Identifier") {
+          var prop = scope.getProp(decl.id.name);
+          if (decl.init)
+            infer(decl.init, scope, prop, decl.id.name);
+        } else if (decl.init) {
+          connectPattern(decl.id, scope, infer(decl.init, scope))
+        }
       }
     },
 
-    ReturnStatement: function(node, scope, c) {
+    ClassDeclaration: function(node, scope) {
+      scope.getProp(node.id.name).addType(inferClass(node, scope, node.id.name))
+    },
+
+    ReturnStatement: function(node, scope) {
       if (!node.argument) return;
-      var output = ANull;
-      if (scope.fnType) {
-        if (scope.fnType.retval == ANull) scope.fnType.retval = new AVal;
-        output = scope.fnType.retval;
+      var output = ANull, fn = functionScope(scope).fnType
+      if (fn) {
+        if (fn.retval == ANull) fn.retval = new AVal;
+        output = fn.retval;
       }
-      infer(node.argument, scope, c, output);
+      infer(node.argument, scope, output);
     },
 
     ForInStatement: function(node, scope, c) {
-      var source = infer(node.right, scope, c);
+      var source = infer(node.right, scope);
       if ((node.right.type == "Identifier" && node.right.name in scope.props) ||
           (node.right.type == "MemberExpression" && node.right.property.name == "prototype")) {
         maybeInstantiate(scope, 5);
-        var varName;
-        if (node.left.type == "Identifier") {
-          varName = node.left.name;
-        } else if (node.left.type == "VariableDeclaration") {
-          varName = node.left.declarations[0].id.name;
+        var pattern = loopPattern(node.left)
+        if (pattern.type == "Identifier") {
+          if (pattern.name in scope.props)
+            scope.getProp(pattern.name).iteratesOver = source
+          source.getProp("<i>").propagate(ensureVar(pattern, scope))
+        } else {
+          connectPattern(pattern, scope, source.getProp("<i>"))
         }
-        if (varName && varName in scope.props)
-          scope.getProp(varName).iteratesOver = source;
       }
       c(node.body, scope, "Statement");
     },
 
-    ScopeBody: function(node, scope, c) { c(node, node.scope || scope); }
+    ForOfStatement: function(node, scope, c) {
+      var pattern = loopPattern(node.left), target
+      if (pattern.type == "Identifier")
+        target = ensureVar(pattern, scope)
+      else
+        connectPattern(pattern, scope, target = new AVal)
+      infer(node.right, scope, new HasMethodCall(":Symbol.iterator", [], null,
+                                                 new HasMethodCall("next", [], null,
+                                                                   new GetProp("value", target))))
+      c(node.body, scope, "Statement")
+    }
   });
 
   // PARSING
 
-  function runPasses(passes, pass) {
-    var arr = passes && passes[pass];
-    var args = Array.prototype.slice.call(arguments, 2);
-    if (arr) for (var i = 0; i < arr.length; ++i) arr[i].apply(null, args);
-  }
-
-  var parse = exports.parse = function(text, passes, options) {
+  var parse = exports.parse = function(text, options, thirdArg) {
+    if (!options || Array.isArray(options)) options = thirdArg
     var ast;
     try { ast = acorn.parse(text, options); }
     catch(e) { ast = acorn_loose.parse_dammit(text, options); }
-    runPasses(passes, "postParse", ast, text);
     return ast;
   };
 
   // ANALYSIS INTERFACE
 
-  exports.analyze = function(ast, name, scope, passes) {
+  exports.analyze = function(ast, name, scope) {
     if (typeof ast == "string") ast = parse(ast);
 
     if (!name) name = "file#" + cx.origins.length;
     exports.addOrigin(cx.curOrigin = name);
 
     if (!scope) scope = cx.topScope;
+    cx.startAnalysis();
+
     walk.recursive(ast, scope, null, scopeGatherer);
-    runPasses(passes, "preInfer", ast, scope);
+    if (cx.parent) cx.parent.signal("preInfer", ast, scope)
     walk.recursive(ast, scope, null, inferWrapper);
-    runPasses(passes, "postInfer", ast, scope);
+    if (cx.parent) cx.parent.signal("postInfer", ast, scope)
 
     cx.curOrigin = null;
   };
 
   // PURGING
 
-  exports.purgeTypes = function(origins, start, end) {
+  exports.purge = function(origins, start, end) {
     var test = makePredicate(origins, start, end);
     ++cx.purgeGen;
     cx.topScope.purge(test);
     for (var prop in cx.props) {
       var list = cx.props[prop];
       for (var i = 0; i < list.length; ++i) {
         var obj = list[i], av = obj.props[prop];
         if (!av || test(av, av.originNode)) list.splice(i--, 1);
@@ -1211,87 +1747,107 @@
     this.purgeGen = cx.purgeGen;
     for (var i = 0; i < this.types.length; ++i) {
       var type = this.types[i];
       if (test(type, type.originNode))
         this.types.splice(i--, 1);
       else
         type.purge(test);
     }
+    if (!this.types.length) this.maxWeight = 0;
+
     if (this.forward) for (var i = 0; i < this.forward.length; ++i) {
       var f = this.forward[i];
       if (test(f)) {
         this.forward.splice(i--, 1);
         if (this.props) this.props = null;
       } else if (f.purge) {
         f.purge(test);
       }
     }
   };
   ANull.purge = function() {};
   Obj.prototype.purge = function(test) {
     if (this.purgeGen == cx.purgeGen) return true;
     this.purgeGen = cx.purgeGen;
-    var props = [];
     for (var p in this.props) {
       var av = this.props[p];
       if (test(av, av.originNode))
         this.removeProp(p);
       av.purge(test);
     }
   };
   Fn.prototype.purge = function(test) {
     if (Obj.prototype.purge.call(this, test)) return;
     this.self.purge(test);
     this.retval.purge(test);
     for (var i = 0; i < this.args.length; ++i) this.args[i].purge(test);
   };
 
-  exports.markVariablesDefinedBy = function(scope, origins, start, end) {
-    var test = makePredicate(origins, start, end);
-    for (var s = scope; s; s = s.prev) for (var p in s.props) {
-      var prop = s.props[p];
-      if (test(prop, prop.originNode)) {
-        prop.maybePurge = true;
-        if (start == null && prop.originNode) prop.originNode = null;
-      }
-    }
-  };
-
-  exports.purgeMarkedVariables = function(scope) {
-    for (var s = scope; s; s = s.prev) for (var p in s.props)
-      if (s.props[p].maybePurge) delete s.props[p];
-  };
-
   // EXPRESSION TYPE DETERMINATION
 
   function findByPropertyName(name) {
     guessing = true;
     var found = objsWithProp(name);
     if (found) for (var i = 0; i < found.length; ++i) {
       var val = found[i].getProp(name);
       if (!val.isEmpty()) return val;
     }
     return ANull;
   }
 
-  var typeFinder = {
+  function generatorResult(input, output) {
+    var retObj = new Obj(true)
+    retObj.defProp("done").addType(cx.bool)
+    output.propagate(retObj.defProp("value"))
+    var method = new Fn(null, ANull, input ? [input] : [], input ? ["?"] : [], retObj)
+    var result = new Obj(cx.definitions.ecma6 && cx.definitions.ecma6.generator_prototype || true)
+    result.defProp("next").addType(method)
+    return result
+  }
+
+  function maybeIterator(fn, output) {
+    if (!fn.generator) return output
+    if (!fn.computeRet) { // Reuse iterator objects for non-computed return types
+      if (fn.generator === true) fn.generator = generatorResult(fn.yieldval, output)
+      return fn.generator
+    }
+    return generatorResult(fn.yieldval, output)
+  }
+
+  function computeReturnType(funcNode, argNodes, scope) {
+    var fn = findType(funcNode, scope).getFunctionType()
+    if (!fn) return ANull
+    var result = fn.retval
+    if (fn.computeRet) {
+      for (var i = 0, args = []; i < argNodes.length; ++i)
+        args.push(findType(argNodes[i], scope))
+      var self = ANull
+      if (funcNode.type == "MemberExpression")
+        self = findType(funcNode.object, scope)
+      result = fn.computeRet(self, args, argNodes);
+    }
+    return maybeIterator(fn, result)
+  }
+
+  var typeFinder = exports.typeFinder = {
     ArrayExpression: function(node, scope) {
-      var eltval = new AVal;
-      for (var i = 0; i < node.elements.length; ++i) {
-        var elt = node.elements[i];
-        if (elt) findType(elt, scope).propagate(eltval);
-      }
-      return new Arr(eltval);
+      return arrayLiteralType(node.elements, scope, findType)
     },
     ObjectExpression: function(node) {
       return node.objType;
     },
+    ClassExpression: function(node) {
+      return node.objType;
+    },
     FunctionExpression: function(node) {
-      return node.body.scope.fnType;
+      return node.scope.fnType;
+    },
+    ArrowFunctionExpression: function(node) {
+      return node.scope.fnType;
     },
     SequenceExpression: function(node, scope) {
       return findType(node.expressions[node.expressions.length-1], scope);
     },
     UnaryExpression: function(node) {
       return unopResultType(node.operator);
     },
     UpdateExpression: function() {
@@ -1314,133 +1870,222 @@
       return lhs.isEmpty() ? findType(node.right, scope) : lhs;
     },
     ConditionalExpression: function(node, scope) {
       var lhs = findType(node.consequent, scope);
       return lhs.isEmpty() ? findType(node.alternate, scope) : lhs;
     },
     NewExpression: function(node, scope) {
       var f = findType(node.callee, scope).getFunctionType();
-      var proto = f && f.getProp("prototype").getType();
+      var proto = f && f.getProp("prototype").getObjType();
       if (!proto) return ANull;
       return getInstance(proto, f);
     },
     CallExpression: function(node, scope) {
-      var f = findType(node.callee, scope).getFunctionType();
-      if (!f) return ANull;
-      if (f.computeRet) {
-        for (var i = 0, args = []; i < node.arguments.length; ++i)
-          args.push(findType(node.arguments[i], scope));
-        var self = ANull;
-        if (node.callee.type == "MemberExpression")
-          self = findType(node.callee.object, scope);
-        return f.computeRet(self, args, node.arguments);
-      } else {
-        return f.retval;
-      }
+      return computeReturnType(node.callee, node.arguments, scope)
     },
     MemberExpression: function(node, scope) {
-      var propN = propName(node, scope), obj = findType(node.object, scope).getType();
+      var propN = propName(node), obj = findType(node.object, scope).getType();
       if (obj) return obj.getProp(propN);
       if (propN == "<i>") return ANull;
       return findByPropertyName(propN);
     },
     Identifier: function(node, scope) {
       return scope.hasProp(node.name) || ANull;
     },
     ThisExpression: function(_node, scope) {
-      return scope.fnType ? scope.fnType.self : cx.topScope;
+      return getThis(scope)
     },
     Literal: function(node) {
-      return literalType(node.value);
+      return literalType(node);
+    },
+    Super: ret(function(node) {
+      return node.superType
+    }),
+    TemplateLiteral: function() {
+      return cx.str
+    },
+    TaggedTemplateExpression: function(node, scope) {
+      return computeReturnType(node.tag, node.quasi.expressions, scope)
+    },
+    YieldExpression: function(_node, scope) {
+      var fn = functionScope(scope).fnType
+      return fn ? fn.yieldval : ANull
     }
   };
 
   function findType(node, scope) {
-    var found = typeFinder[node.type](node, scope);
-    return found;
+    var finder = typeFinder[node.type];
+    return finder ? finder(node, scope) : ANull;
   }
 
   var searchVisitor = exports.searchVisitor = walk.make({
     Function: function(node, _st, c) {
-      var scope = node.body.scope;
-      if (node.id) c(node.id, scope);
-      for (var i = 0; i < node.params.length; ++i)
-        c(node.params[i], scope);
-      c(node.body, scope, "ScopeBody");
+      walk.base.Function(node, node.scope, c)
+    },
+    Property: function(node, st, c) {
+      if (node.computed) c(node.key, st, "Expression");
+      if (node.key != node.value) c(node.value, st, "Expression");
+    },
+    Statement: function(node, st, c) {
+      c(node, node.scope || st)
     },
-    TryStatement: function(node, st, c) {
-      if (node.handler)
-        c(node.handler.param, st);
-      walk.base.TryStatement(node, st, c);
+    ImportSpecifier: function(node, st, c) {
+      c(node.local, st)
     },
-    VariableDeclaration: function(node, st, c) {
-      for (var i = 0; i < node.declarations.length; ++i) {
-        var decl = node.declarations[i];
-        c(decl.id, st);
-        if (decl.init) c(decl.init, st, "Expression");
-      }
+    ImportDefaultSpecifier: function(node, st, c) {
+      c(node.local, st)
+    },
+    ImportNamespaceSpecifier: function(node, st, c) {
+      c(node.local, st)
     }
   });
   exports.fullVisitor = walk.make({
     MemberExpression: function(node, st, c) {
       c(node.object, st, "Expression");
       c(node.property, st, node.computed ? "Expression" : null);
     },
     ObjectExpression: function(node, st, c) {
       for (var i = 0; i < node.properties.length; ++i) {
         c(node.properties[i].value, st, "Expression");
         c(node.properties[i].key, st);
       }
     }
   }, searchVisitor);
 
   exports.findExpressionAt = function(ast, start, end, defaultScope, filter) {
-    var test = filter || function(_t, node) {return typeFinder.hasOwnProperty(node.type);};
+    var test = filter || function(_t, node) {
+      if (node.type == "Identifier" && node.name == "✖") return false;
+      return typeFinder.hasOwnProperty(node.type);
+    };
     return walk.findNodeAt(ast, start, end, test, searchVisitor, defaultScope || cx.topScope);
   };
 
   exports.findExpressionAround = function(ast, start, end, defaultScope, filter) {
     var test = filter || function(_t, node) {
       if (start != null && node.start > start) return false;
+      if (node.type == "Identifier" && node.name == "✖") return false;
       return typeFinder.hasOwnProperty(node.type);
     };
     return walk.findNodeAround(ast, end, test, searchVisitor, defaultScope || cx.topScope);
   };
 
   exports.expressionType = function(found) {
     return findType(found.node, found.state);
   };
 
+  // Finding the expected type of something, from context
+
+  exports.parentNode = function(child, ast) {
+    var stack = [];
+    function c(node, st, override) {
+      if (node.start <= child.start && node.end >= child.end) {
+        var top = stack[stack.length - 1];
+        if (node == child) throw {found: top};
+        if (top != node) stack.push(node);
+        walk.base[override || node.type](node, st, c);
+        if (top != node) stack.pop();
+      }
+    }
+    try {
+      c(ast, null);
+    } catch (e) {
+      if (e.found) return e.found;
+      throw e;
+    }
+  };
+
+  var findTypeFromContext = exports.findTypeFromContext = {
+    ArrayExpression: function(parent, _, get) { return get(parent, true).getProp("<i>"); },
+    ObjectExpression: function(parent, node, get) {
+      for (var i = 0; i < parent.properties.length; ++i) {
+        var prop = node.properties[i];
+        if (prop.value == node)
+          return get(parent, true).getProp(prop.key.name);
+      }
+    },
+    UnaryExpression: function(parent) { return unopResultType(parent.operator); },
+    UpdateExpression: function() { return cx.num; },
+    BinaryExpression: function(parent) { return binopIsBoolean(parent.operator) ? cx.bool : cx.num; },
+    AssignmentExpression: function(parent, _, get) { return get(parent.left); },
+    LogicalExpression: function(parent, _, get) { return get(parent, true); },
+    ConditionalExpression: function(parent, node, get) {
+      if (parent.consequent == node || parent.alternate == node) return get(parent, true);
+    },
+    CallExpression: function(parent, node, get) {
+      for (var i = 0; i < parent.arguments.length; i++) {
+        var arg = parent.arguments[i];
+        if (arg == node) {
+          var calleeType = get(parent.callee).getFunctionType();
+          if (calleeType instanceof Fn)
+            return calleeType.args[i];
+          break;
+        }
+      }
+    },
+    ReturnStatement: function(_parent, node, get) {
+      var fnNode = walk.findNodeAround(node.sourceFile.ast, node.start, "Function");
+      if (fnNode) {
+        var fnType = fnNode.node.type != "FunctionDeclaration"
+          ? get(fnNode.node, true).getFunctionType()
+          : fnNode.node.scope.fnType;
+        if (fnType) return fnType.retval.getType();
+      }
+    },
+    VariableDeclarator: function(parent, node, get) {
+      if (parent.init == node) return get(parent.id)
+    }
+  };
+  findTypeFromContext.NewExpression = findTypeFromContext.CallExpression
+
+  exports.typeFromContext = function(ast, found) {
+    var parent = exports.parentNode(found.node, ast);
+    var type = null;
+    if (findTypeFromContext.hasOwnProperty(parent.type)) {
+      var finder = findTypeFromContext[parent.type];
+      type = finder && finder(parent, found.node, function(node, fromContext) {
+        var obj = {node: node, state: found.state};
+        var tp = fromContext ? exports.typeFromContext(ast, obj) : exports.expressionType(obj);
+        return tp || ANull;
+      });
+    }
+    return type || exports.expressionType(found);
+  };
+
   // Flag used to indicate that some wild guessing was used to produce
   // a type or set of completions.
   var guessing = false;
 
   exports.resetGuessing = function(val) { guessing = val; };
   exports.didGuess = function() { return guessing; };
 
   exports.forAllPropertiesOf = function(type, f) {
     type.gatherProperties(f, 0);
   };
 
   var refFindWalker = walk.make({}, searchVisitor);
 
   exports.findRefs = function(ast, baseScope, name, refScope, f) {
-    refFindWalker.Identifier = function(node, scope) {
+    refFindWalker.Identifier = refFindWalker.VariablePattern = function(node, scope) {
       if (node.name != name) return;
       for (var s = scope; s; s = s.prev) {
         if (s == refScope) f(node, scope);
         if (name in s.props) return;
       }
     };
     walk.recursive(ast, baseScope, null, refFindWalker);
   };
 
   var simpleWalker = walk.make({
-    Function: function(node, _st, c) { c(node.body, node.body.scope, "ScopeBody"); }
+    Function: function(node, _scope, c) {
+      c(node.body, node.scope, node.expression ? "Expression" : "Statement")
+    },
+    Statement: function(node, scope, c) {
+      c(node, node.scope || scope)
+    }
   });
 
   exports.findPropRefs = function(ast, scope, objType, propName, f) {
     walk.simple(ast, {
       MemberExpression: function(node, scope) {
         if (node.computed || node.property.name != propName) return;
         if (findType(node.object, scope).getType() == objType) f(node.property);
       },
@@ -1450,18 +2095,18 @@
           if (node.properties[i].key.name == propName) f(node.properties[i].key);
       }
     }, simpleWalker, scope);
   };
 
   // LOCAL-VARIABLE QUERIES
 
   var scopeAt = exports.scopeAt = function(ast, pos, defaultScope) {
-    var found = walk.findNodeAround(ast, pos, function(tp, node) {
-      return tp == "ScopeBody" && node.scope;
+    var found = walk.findNodeAround(ast, pos, function(_, node) {
+      return node.scope;
     });
     if (found) return found.node.scope;
     else return defaultScope || cx.topScope;
   };
 
   exports.forAllLocalsAt = function(ast, pos, defaultScope, f) {
     var scope = scopeAt(ast, pos, defaultScope);
     scope.gatherProperties(f, 0);