--- a/build/clang-plugin/tests/Makefile.in
+++ b/build/clang-plugin/tests/Makefile.in
@@ -3,12 +3,12 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # Build without any warning flags, and with clang verify flag for a
 # syntax-only build (no codegen).
 OS_CXXFLAGS := $(filter-out -W%,$(OS_CXXFLAGS)) -fsyntax-only -Xclang -verify
 
 include $(topsrcdir)/config/rules.mk
 
-target:: $(OBJS)
+export:: $(OBJS)
 
 # We don't actually build anything.
 .PHONY: $(OBJS)

--- a/dom/base/nsHostObjectProtocolHandler.cpp
+++ b/dom/base/nsHostObjectProtocolHandler.cpp
@@ -637,18 +637,23 @@ NS_GetStreamForBlobURI(nsIURI* aURI, nsI
   return blobImpl->GetInternalStream(aStream);
 }
 
 nsresult
 NS_GetStreamForMediaStreamURI(nsIURI* aURI, mozilla::DOMMediaStream** aStream)
 {
   NS_ASSERTION(IsMediaStreamURI(aURI), "Only call this with mediastream URIs");
 
+  nsISupports* dataObject = GetDataObject(aURI);
+  if (!dataObject) {
+    return NS_ERROR_DOM_BAD_URI;
+  }
+
   *aStream = nullptr;
-  return CallQueryInterface(GetDataObject(aURI), aStream);
+  return CallQueryInterface(dataObject, aStream);
 }
 
 NS_IMETHODIMP
 nsFontTableProtocolHandler::NewURI(const nsACString& aSpec,
                                    const char *aCharset,
                                    nsIURI *aBaseURI,
                                    nsIURI **aResult)
 {

--- a/dom/browser-element/BrowserElementChildPreload.js
+++ b/dom/browser-element/BrowserElementChildPreload.js
@@ -1338,17 +1338,16 @@ BrowserElementChild.prototype = {
       else if (state & Ci.nsIWebProgressListener.STATE_IS_INSECURE) {
         stateDesc = 'insecure';
       }
       else {
         debug("Unexpected securitychange state!");
         stateDesc = '???';
       }
 
-      // XXX Until bug 764496 is fixed, this will always return false.
       var isEV = !!(state & Ci.nsIWebProgressListener.STATE_IDENTITY_EV_TOPLEVEL);
 
       sendAsyncMsg('securitychange', { state: stateDesc, extendedValidation: isEV });
     },
 
     onStatusChange: function(webProgress, request, status, message) {},
     onProgressChange: function(webProgress, request, curSelfProgress,
                                maxSelfProgress, curTotalProgress, maxTotalProgress) {},

--- a/dom/media/fmp4/apple/AppleVDADecoder.cpp
+++ b/dom/media/fmp4/apple/AppleVDADecoder.cpp
@@ -5,16 +5,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include <CoreFoundation/CFString.h>
 
 #include "AppleUtils.h"
 #include "AppleVDADecoder.h"
 #include "AppleVDALinker.h"
 #include "mp4_demuxer/DecoderData.h"
+#include "mp4_demuxer/H264.h"
 #include "MP4Decoder.h"
 #include "MediaData.h"
 #include "MacIOSurfaceImage.h"
 #include "mozilla/ArrayUtils.h"
 #include "nsAutoPtr.h"
 #include "nsCocoaFeatures.h"
 #include "nsThreadUtils.h"
 #include "prlog.h"
@@ -38,19 +39,38 @@ AppleVDADecoder::AppleVDADecoder(const m
   , mTaskQueue(aVideoTaskQueue)
   , mCallback(aCallback)
   , mImageContainer(aImageContainer)
   , mDecoder(nullptr)
   , mIs106(!nsCocoaFeatures::OnLionOrLater())
 {
   MOZ_COUNT_CTOR(AppleVDADecoder);
   // TODO: Verify aConfig.mime_type.
+
+  // Retrieve video dimensions from H264 SPS NAL.
+  mPictureWidth = mConfig.image_width;
+  mPictureHeight = mConfig.image_height;
+  mMaxRefFrames = 4;
+  mp4_demuxer::SPSData spsdata;
+  if (mp4_demuxer::H264::DecodeSPSFromExtraData(mConfig.extra_data, spsdata) &&
+      spsdata.pic_width && spsdata.pic_height) {
+    mPictureWidth = spsdata.pic_width;
+    mPictureHeight = spsdata.pic_height;
+    // max_num_ref_frames determines the size of the sliding window
+    // we need to queue that many frames in order to guarantee proper
+    // pts frames ordering. Use a minimum of 4 to ensure proper playback of
+    // non compliant videos.
+    mMaxRefFrames =
+      (spsdata.max_num_ref_frames + 1) > mMaxRefFrames ?
+        spsdata.max_num_ref_frames + 1 : mMaxRefFrames;
+  }
+
   LOG("Creating AppleVDADecoder for %dx%d h.264 video",
-      mConfig.image_width,
-      mConfig.image_height
+      mPictureWidth,
+      mPictureHeight
      );
 }
 
 AppleVDADecoder::~AppleVDADecoder()
 {
   MOZ_COUNT_DTOR(AppleVDADecoder);
 }
 
@@ -265,27 +285,19 @@ AppleVDADecoder::OutputFrame(CVPixelBuff
     mCallback->Error();
     return NS_ERROR_FAILURE;
   }
 
   // Frames come out in DTS order but we need to output them
   // in composition order.
   mReorderQueue.Push(data);
   // Assume a frame with a PTS <= current DTS is ready.
-  while (mReorderQueue.Length() > 0) {
+  while (mReorderQueue.Length() > mMaxRefFrames) {
     nsRefPtr<VideoData> readyData = mReorderQueue.Pop();
-    if (readyData->mTime <= aFrameRef->decode_timestamp) {
-      LOG("returning queued frame with pts %lld", readyData->mTime);
       mCallback->Output(readyData);
-    } else {
-      LOG("requeued frame with pts %lld > %lld",
-          readyData->mTime, aFrameRef->decode_timestamp);
-      mReorderQueue.Push(readyData);
-      break;
-    }
   }
   LOG("%llu decoded frames queued",
       static_cast<unsigned long long>(mReorderQueue.Length()));
 
   return NS_OK;
 }
 
 nsresult
@@ -406,21 +418,21 @@ AppleVDADecoder::CreateDecoderSpecificat
 {
   const uint8_t* extradata = mConfig.extra_data->Elements();
   int extrasize = mConfig.extra_data->Length();
 
   OSType format = 'avc1';
   AutoCFRelease<CFNumberRef> avc_width  =
     CFNumberCreate(kCFAllocatorDefault,
                    kCFNumberSInt32Type,
-                   &mConfig.image_width);
+                   &mPictureWidth);
   AutoCFRelease<CFNumberRef> avc_height =
     CFNumberCreate(kCFAllocatorDefault,
                    kCFNumberSInt32Type,
-                   &mConfig.image_height);
+                   &mPictureHeight);
   AutoCFRelease<CFNumberRef> avc_format =
     CFNumberCreate(kCFAllocatorDefault,
                    kCFNumberSInt32Type,
                    &format);
   AutoCFRelease<CFDataRef> avc_data =
     CFDataCreate(kCFAllocatorDefault,
                  extradata,
                  extrasize);

--- a/dom/media/fmp4/apple/AppleVDADecoder.h
+++ b/dom/media/fmp4/apple/AppleVDADecoder.h
@@ -85,16 +85,19 @@ public:
   void ClearReorderedFrames();
   CFDictionaryRef CreateOutputConfiguration();
 
   const mp4_demuxer::VideoDecoderConfig& mConfig;
   nsRefPtr<MediaTaskQueue> mTaskQueue;
   MediaDataDecoderCallback* mCallback;
   nsRefPtr<layers::ImageContainer> mImageContainer;
   ReorderQueue mReorderQueue;
+  uint32_t mPictureWidth;
+  uint32_t mPictureHeight;
+  uint32_t mMaxRefFrames;
 
 private:
   VDADecoder mDecoder;
   bool mIs106;
 
   // Method to pass a frame to VideoToolbox for decoding.
   nsresult SubmitFrame(mp4_demuxer::MP4Sample* aSample);
   // Method to set up the decompression session.

--- a/dom/media/fmp4/apple/AppleVTDecoder.cpp
+++ b/dom/media/fmp4/apple/AppleVTDecoder.cpp
@@ -6,16 +6,17 @@
 
 #include <CoreFoundation/CFString.h>
 
 #include "AppleCMLinker.h"
 #include "AppleUtils.h"
 #include "AppleVTDecoder.h"
 #include "AppleVTLinker.h"
 #include "mp4_demuxer/DecoderData.h"
+#include "mp4_demuxer/H264.h"
 #include "MediaData.h"
 #include "MacIOSurfaceImage.h"
 #include "mozilla/ArrayUtils.h"
 #include "nsAutoPtr.h"
 #include "nsThreadUtils.h"
 #include "prlog.h"
 #include "VideoUtils.h"
 
@@ -270,18 +271,18 @@ AppleVTDecoder::InitializeSession()
   LOG("AVCDecoderConfig %ld bytes sha1 %s",
       mConfig.extra_data->Length(), avc_digest.get());
 #endif // LOG_MEDIA_SHA1
 
   AutoCFRelease<CFDictionaryRef> extensions = CreateDecoderExtensions();
 
   rv = CMVideoFormatDescriptionCreate(kCFAllocatorDefault,
                                       kCMVideoCodecType_H264,
-                                      mConfig.image_width,
-                                      mConfig.image_height,
+                                      mPictureWidth,
+                                      mPictureHeight,
                                       extensions,
                                       &mFormat);
   if (rv != noErr) {
     NS_ERROR("Couldn't create format description!");
     return NS_ERROR_FAILURE;
   }
 
   // Contruct video decoder selection spec.

--- a/ipc/glue/Shmem.h
+++ b/ipc/glue/Shmem.h
@@ -260,17 +260,17 @@ private:
       reinterpret_cast<char*>(aSegment->memory()) + aSegment->Size();
     return reinterpret_cast<uint32_t*>(endOfSegment - sizeof(uint32_t));
   }
 
 #else
   void AssertInvariants() const;
 #endif
 
-  SharedMemory* mSegment;
+  SharedMemory* MOZ_NON_OWNING_REF mSegment;
   void* mData;
   size_t mSize;
   id_t mId;
 };
 
 
 } // namespace ipc
 } // namespace mozilla

--- a/ipc/ipdl/moz.build
+++ b/ipc/ipdl/moz.build
@@ -8,13 +8,11 @@ if CONFIG['MOZ_IPDL_TESTS']:
     DIRS += ['test']
 
 FAIL_ON_WARNINGS = True
 
 include('/ipc/chromium/chromium-config.mozbuild')
 
 FINAL_LIBRARY = 'xul'
 
-GENERATED_INCLUDES += ['/ipc/ipdl/_ipdlheaders']
-
 # We #include some things in the dom/plugins/ directory that rely on
 # toolkit libraries.
 CXXFLAGS += CONFIG['TK_CFLAGS']

--- a/js/src/builtin/SIMD.cpp
+++ b/js/src/builtin/SIMD.cpp
@@ -8,16 +8,17 @@
  * JS SIMD pseudo-module.
  * Specification matches polyfill:
  * https://github.com/johnmccutchan/ecmascript_simd/blob/master/src/ecmascript_simd.js
  * The objects float32x4 and int32x4 are installed on the SIMD pseudo-module.
  */
 
 #include "builtin/SIMD.h"
 
+#include "mozilla/IntegerTypeTraits.h"
 #include "jsapi.h"
 #include "jsfriendapi.h"
 
 #include "builtin/TypedObject.h"
 #include "js/Value.h"
 
 #include "jsobjinlines.h"
 
@@ -142,22 +143,27 @@ static bool SignMask(JSContext *cx, unsi
     TypeDescr &descr = typedObj.typeDescr();
     if (descr.kind() != type::Simd || descr.as<SimdTypeDescr>().type() != SimdType::type) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,
                              SimdTypeDescr::class_.name, "signMask",
                              InformalValueTypeName(args.thisv()));
         return false;
     }
 
-    Elem *data = reinterpret_cast<Elem *>(typedObj.typedMem());
-    int32_t mx = data[0] < 0.0 ? 1 : 0;
-    int32_t my = data[1] < 0.0 ? 1 : 0;
-    int32_t mz = data[2] < 0.0 ? 1 : 0;
-    int32_t mw = data[3] < 0.0 ? 1 : 0;
-    int32_t result = mx | my << 1 | mz << 2 | mw << 3;
+    // Load the data as integer so that we treat the sign bit consistently,
+    // since -0.0 is not less than zero, but it still has the sign bit set.
+    typedef typename mozilla::SignedStdintTypeForSize<sizeof(Elem)>::Type Int;
+    static_assert(SimdType::lanes * sizeof(Int) <= jit::Simd128DataSize,
+                  "signMask access should respect the bounds of the type");
+    const Elem *elems = reinterpret_cast<const Elem *>(typedObj.typedMem());
+    int32_t result = 0;
+    for (unsigned i = 0; i < SimdType::lanes; ++i) {
+        Int x = mozilla::BitwiseCast<Int>(elems[i]);
+        result |= (x < 0) << i;
+    }
     args.rval().setInt32(result);
     return true;
 }
 
 #define SIGN_MASK(type) \
 static bool type##SignMask(JSContext *cx, unsigned argc, Value *vp) { \
     return SignMask<type>(cx, argc, vp); \
 }
@@ -291,53 +297,46 @@ CreateSimdClass(JSContext *cx, Handle<Gl
 
     return typeDescr;
 }
 
 bool
 SimdTypeDescr::call(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    const unsigned LANES = 4;
 
     Rooted<SimdTypeDescr*> descr(cx, &args.callee().as<SimdTypeDescr>());
     if (args.length() == 1) {
         // SIMD type used as a coercion
         if (!CheckVectorObject(args[0], descr->type())) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_SIMD_NOT_A_VECTOR);
             return false;
         }
 
         args.rval().setObject(args[0].toObject());
         return true;
     }
 
-    if (args.length() < LANES) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_MORE_ARGS_NEEDED,
-                             args.callee().getClass()->name, "3", "s");
-        return false;
-    }
-
     Rooted<TypedObject*> result(cx, TypedObject::createZeroed(cx, descr, 0));
     if (!result)
         return false;
 
     switch (descr->type()) {
       case SimdTypeDescr::TYPE_INT32: {
         int32_t *mem = reinterpret_cast<int32_t*>(result->typedMem());
         for (unsigned i = 0; i < 4; i++) {
-            if (!ToInt32(cx, args[i], &mem[i]))
+            if (!ToInt32(cx, args.get(i), &mem[i]))
                 return false;
         }
         break;
       }
       case SimdTypeDescr::TYPE_FLOAT32: {
         float *mem = reinterpret_cast<float*>(result->typedMem());
         for (unsigned i = 0; i < 4; i++) {
-            if (!RoundFloat32(cx, args[i], &mem[i]))
+            if (!RoundFloat32(cx, args.get(i), &mem[i]))
                 return false;
         }
         break;
       }
     }
     args.rval().setObject(*result);
     return true;
 }

--- a/js/src/jit-test/tests/asm.js/testBug1099216.js
+++ b/js/src/jit-test/tests/asm.js/testBug1099216.js
@@ -1,8 +1,13 @@
+if (typeof SIMD === 'undefined' || !isSimdAvailable()) {
+    print("won't run tests as simd extensions aren't activated yet");
+    quit(0);
+}
+
 (function(global) {
     "use asm";
     var frd = global.Math.fround;
     var fx4 = global.SIMD.float32x4;
     var fsp = fx4.splat;
     function s(){}
     function d(x){x=fx4(x);}
     function e() {

--- a/js/src/jit-test/tests/asm.js/testSIMD.js
+++ b/js/src/jit-test/tests/asm.js/testSIMD.js
@@ -183,17 +183,17 @@ assertAsmTypeFail('glob', USE_ASM + "fun
 assertAsmTypeFail('glob', USE_ASM + "function f() {var x=42.; return x.signMask;} return f");
 assertAsmTypeFail('glob', USE_ASM + FROUND + "function f() {var x=f32(42.); return x.signMask;} return f");
 
 assertEq(asmLink(asmCompile('glob', USE_ASM + I32 + 'function f() { var x=i4(1,2,3,4); return x.signMask | 0 } return f'), this)(), 0b0000);
 assertEq(asmLink(asmCompile('glob', USE_ASM + I32 + 'function f() { var x=i4(0,-1, ' + INT32_MAX + ',' + INT32_MIN  + '); return x.signMask | 0 } return f'), this)(), 0b1010);
 
 assertEq(asmLink(asmCompile('glob', USE_ASM + F32 + FROUND + 'var Infinity = glob.Infinity; function f() { var x=f4(0,0,0,0); x=f4(f32(1), f32(-13.37), f32(42), f32(-Infinity)); return x.signMask | 0 } return f'), this)(), 0b1010);
 assertEq(asmLink(asmCompile('glob', USE_ASM + F32 + FROUND + 'var Infinity = glob.Infinity; function f() { var x=f4(0,0,0,0); x=f4(f32(-1), f32(0), f32(-0.000001), f32(Infinity)); return x.signMask | 0 } return f'), this)(), 0b0101);
-assertEq(asmLink(asmCompile('glob', USE_ASM + F32 + FROUND + 'var NaN = glob.NaN; function f() { var x=f4(0,0,0,0); x=f4(f32(-1), f32(NaN), f32(3.), f32(4.)); return x.signMask | 0 } return f'), this)(), 0b0001);
+assertEq(asmLink(asmCompile('glob', USE_ASM + F32 + FROUND + 'var NaN = glob.NaN; function f() { var x=f4(0,0,0,0); x=f4(f32(-1), f32(NaN), f32(-0), f32(0)); return x.signMask | 0 } return f'), this)(), 0b0101);
 
 // 1.3.3. Variable assignments
 assertAsmTypeFail('glob', USE_ASM + I32 + I32A + "function f() {var x=i4(1,2,3,4); x=i4();} return f");
 assertAsmTypeFail('glob', USE_ASM + I32 + I32A + "function f() {var x=i4(1,2,3,4); x=i4(1);} return f");
 assertAsmTypeFail('glob', USE_ASM + I32 + I32A + "function f() {var x=i4(1,2,3,4); x=i4(1, 2);} return f");
 assertAsmTypeFail('glob', USE_ASM + I32 + I32A + "function f() {var x=i4(1,2,3,4); x=i4(1, 2, 3);} return f");
 assertAsmTypeFail('glob', USE_ASM + I32 + I32A + "function f() {var x=i4(1,2,3,4); x=i4(1.0, 2, 3, 4);} return f");
 assertAsmTypeFail('glob', USE_ASM + I32 + I32A + "function f() {var x=i4(1,2,3,4); x=i4(1, 2.0, 3, 4);} return f");

--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1787,16 +1787,21 @@ CodeGenerator::visitLabel(LLabel *lir)
 }
 
 void
 CodeGenerator::visitNop(LNop *lir)
 {
 }
 
 void
+CodeGenerator::visitMop(LMop *lir)
+{
+}
+
+void
 CodeGenerator::visitOsiPoint(LOsiPoint *lir)
 {
     // Note: markOsiPoint ensures enough space exists between the last
     // LOsiPoint and this one to patch adjacent call instructions.
 
     MOZ_ASSERT(masm.framePushed() == frameSize());
 
     uint32_t osiCallPointOffset = markOsiPoint(lir);

--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -58,16 +58,17 @@ class CodeGenerator : public CodeGenerat
 
   public:
     bool generate();
     bool generateAsmJS(AsmJSFunctionLabels *labels);
     bool link(JSContext *cx, types::CompilerConstraintList *constraints);
 
     void visitLabel(LLabel *lir);
     void visitNop(LNop *lir);
+    void visitMop(LMop *lir);
     void visitOsiPoint(LOsiPoint *lir);
     void visitGoto(LGoto *lir);
     void visitTableSwitch(LTableSwitch *ins);
     void visitTableSwitchV(LTableSwitchV *ins);
     void visitCloneLiteral(LCloneLiteral *lir);
     void visitParameter(LParameter *lir);
     void visitCallee(LCallee *lir);
     void visitIsConstructing(LIsConstructing *lir);

--- a/js/src/jit/EffectiveAddressAnalysis.cpp
+++ b/js/src/jit/EffectiveAddressAnalysis.cpp
@@ -16,20 +16,20 @@ AnalyzeLsh(TempAllocator &alloc, MLsh *l
 {
     if (lsh->specialization() != MIRType_Int32)
         return;
 
     MDefinition *index = lsh->lhs();
     MOZ_ASSERT(index->type() == MIRType_Int32);
 
     MDefinition *shift = lsh->rhs();
-    if (!shift->isConstant())
+    if (!shift->isConstantValue())
         return;
 
-    Value shiftValue = shift->toConstant()->value();
+    Value shiftValue = shift->constantValue();
     if (!shiftValue.isInt32() || !IsShiftInScaleRange(shiftValue.toInt32()))
         return;
 
     Scale scale = ShiftToScale(shiftValue.toInt32());
 
     int32_t displacement = 0;
     MInstruction *last = lsh;
     MDefinition *base = nullptr;
@@ -42,18 +42,18 @@ AnalyzeLsh(TempAllocator &alloc, MLsh *l
             break;
 
         MAdd *add = use->consumer()->toDefinition()->toAdd();
         if (add->specialization() != MIRType_Int32 || !add->isTruncated())
             break;
 
         MDefinition *other = add->getOperand(1 - add->indexOf(*use));
 
-        if (other->isConstant()) {
-            displacement += other->toConstant()->value().toInt32();
+        if (other->isConstantValue()) {
+            displacement += other->constantValue().toInt32();
         } else {
             if (base)
                 break;
             base = other;
         }
 
         last = add;
     }
@@ -67,21 +67,21 @@ AnalyzeLsh(TempAllocator &alloc, MLsh *l
             return;
 
         MUseIterator use = last->usesBegin();
         if (!use->consumer()->isDefinition() || !use->consumer()->toDefinition()->isBitAnd())
             return;
 
         MBitAnd *bitAnd = use->consumer()->toDefinition()->toBitAnd();
         MDefinition *other = bitAnd->getOperand(1 - bitAnd->indexOf(*use));
-        if (!other->isConstant() || !other->toConstant()->value().isInt32())
+        if (!other->isConstantValue() || !other->constantValue().isInt32())
             return;
 
         uint32_t bitsClearedByShift = elemSize - 1;
-        uint32_t bitsClearedByMask = ~uint32_t(other->toConstant()->value().toInt32());
+        uint32_t bitsClearedByMask = ~uint32_t(other->constantValue().toInt32());
         if ((bitsClearedByShift & bitsClearedByMask) != bitsClearedByMask)
             return;
 
         bitAnd->replaceAllUsesWith(last);
         return;
     }
 
     MEffectiveAddress *eaddr = MEffectiveAddress::New(alloc, base, index, scale, displacement);

--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -255,29 +255,29 @@ MaybeFoldConditionBlock(MIRGraph &graph,
 
     // If either trueBranch or falseBranch just computes a constant for the
     // test, determine the block that branch will end up jumping to and eliminate
     // the branch. Otherwise, change the end of the block to a test that jumps
     // directly to successors of testBlock, rather than to testBlock itself.
 
     MBasicBlock *trueTarget = trueBranch;
     if (BlockComputesConstant(trueBranch, trueResult)) {
-        trueTarget = trueResult->toConstant()->valueToBoolean()
+        trueTarget = trueResult->constantToBoolean()
                      ? finalTest->ifTrue()
                      : finalTest->ifFalse();
         testBlock->removePredecessor(trueBranch);
         graph.removeBlock(trueBranch);
     } else {
         UpdateTestSuccessors(graph.alloc(), trueBranch, trueResult,
                              finalTest->ifTrue(), finalTest->ifFalse(), testBlock);
     }
 
     MBasicBlock *falseTarget = falseBranch;
     if (BlockComputesConstant(falseBranch, falseResult)) {
-        falseTarget = falseResult->toConstant()->valueToBoolean()
+        falseTarget = falseResult->constantToBoolean()
                       ? finalTest->ifTrue()
                       : finalTest->ifFalse();
         testBlock->removePredecessor(falseBranch);
         graph.removeBlock(falseBranch);
     } else {
         UpdateTestSuccessors(graph.alloc(), falseBranch, falseResult,
                              finalTest->ifTrue(), finalTest->ifFalse(), testBlock);
     }
@@ -2265,18 +2265,18 @@ SimpleLinearSum
 jit::ExtractLinearSum(MDefinition *ins)
 {
     if (ins->isBeta())
         ins = ins->getOperand(0);
 
     if (ins->type() != MIRType_Int32)
         return SimpleLinearSum(ins, 0);
 
-    if (ins->isConstant()) {
-        const Value &v = ins->toConstant()->value();
+    if (ins->isConstantValue()) {
+        const Value &v = ins->constantValue();
         MOZ_ASSERT(v.isInt32());
         return SimpleLinearSum(nullptr, v.toInt32());
     } else if (ins->isAdd() || ins->isSub()) {
         MDefinition *lhs = ins->getOperand(0);
         MDefinition *rhs = ins->getOperand(1);
         if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
             SimpleLinearSum lsum = ExtractLinearSum(lhs);
             SimpleLinearSum rsum = ExtractLinearSum(rhs);
@@ -2667,18 +2667,18 @@ LinearSum::add(SimpleLinearSum other, in
 bool
 LinearSum::add(MDefinition *term, int32_t scale)
 {
     MOZ_ASSERT(term);
 
     if (scale == 0)
         return true;
 
-    if (term->isConstant()) {
-        int32_t constant = term->toConstant()->value().toInt32();
+    if (term->isConstantValue()) {
+        int32_t constant = term->constantValue().toInt32();
         if (!SafeMul(constant, scale, &constant))
             return false;
         return add(constant);
     }
 
     for (size_t i = 0; i < terms_.length(); i++) {
         if (term == terms_[i].term) {
             if (!SafeAdd(scale, terms_[i].scale, &terms_[i].scale))
@@ -2746,17 +2746,17 @@ LinearSum::dump() const
 
 MDefinition *
 jit::ConvertLinearSum(TempAllocator &alloc, MBasicBlock *block, const LinearSum &sum, bool convertConstant)
 {
     MDefinition *def = nullptr;
 
     for (size_t i = 0; i < sum.numTerms(); i++) {
         LinearTerm term = sum.term(i);
-        MOZ_ASSERT(!term.term->isConstant());
+        MOZ_ASSERT(!term.term->isConstantValue());
         if (term.scale == 1) {
             if (def) {
                 def = MAdd::New(alloc, def, term.term);
                 def->toAdd()->setInt32();
                 block->insertAtEnd(def->toInstruction());
                 def->computeRange(alloc);
             } else {
                 def = term.term;

--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -2256,19 +2256,18 @@ IonBuilder::processDoWhileCondEnd(CFGSta
 
     // Pop the last value, and create the successor block.
     MDefinition *vins = current->pop();
     MBasicBlock *successor = newBlock(current, GetNextPc(pc), loopDepth_ - 1);
     if (!successor)
         return ControlStatus_Error;
 
     // Test for do {} while(false) and don't create a loop in that case.
-    if (vins->isConstant()) {
-        MConstant *cte = vins->toConstant();
-        if (cte->value().isBoolean() && !cte->value().toBoolean()) {
+    if (vins->isConstantValue() && !vins->constantValue().isMagic()) {
+        if (!vins->constantToBoolean()) {
             current->end(MGoto::New(alloc(), successor));
             current = nullptr;
 
             state.loop.successor = successor;
             return processBrokenLoop(state);
         }
     }
 
@@ -4563,17 +4562,17 @@ IonBuilder::makeInliningDecision(JSObjec
                 //
                 //  - Inner function as argument. Inlining a function called
                 //    with an inner function might help scalar replacement at
                 //    removing the scope chain, and thus using registers within
                 //    the loop instead of writting everything back to memory.
                 bool hasOpportunities = false;
                 for (size_t i = 0, e = callInfo.argv().length(); !hasOpportunities && i < e; i++) {
                     MDefinition *arg = callInfo.argv()[i];
-                    hasOpportunities = arg->isLambda() || arg->isConstant();
+                    hasOpportunities = arg->isLambda() || arg->isConstantValue();
                 }
 
                 if (!hasOpportunities)
                     return DontInline(targetScript, "Vetoed: big function that contains a loop");
             }
 
             // Caller must not be excessively large.
             if (script()->length() >= optimizationInfo().inliningMaxCallerBytecodeLength())
@@ -5925,20 +5924,20 @@ IonBuilder::jsop_eval(uint32_t argc)
 
         current->pushSlot(info().thisSlot());
         MDefinition *thisValue = current->pop();
 
         // Try to pattern match 'eval(v + "()")'. In this case v is likely a
         // name on the scope chain and the eval is performing a call on that
         // value. Use a dynamic scope chain lookup rather than a full eval.
         if (string->isConcat() &&
-            string->getOperand(1)->isConstant() &&
-            string->getOperand(1)->toConstant()->value().isString())
+            string->getOperand(1)->isConstantValue() &&
+            string->getOperand(1)->constantValue().isString())
         {
-            JSAtom *atom = &string->getOperand(1)->toConstant()->value().toString()->asAtom();
+            JSAtom *atom = &string->getOperand(1)->constantValue().toString()->asAtom();
 
             if (StringEqualsAscii(atom, "()")) {
                 MDefinition *name = string->getOperand(0);
                 MInstruction *dynamicName = MGetDynamicName::New(alloc(), scopeChain, name);
                 current->add(dynamicName);
 
                 current->push(dynamicName);
                 current->push(thisValue);
@@ -7841,20 +7840,20 @@ IonBuilder::getElemTryArgumentsInlined(b
         return true;
 
     // Emit inlined arguments.
     obj->setImplicitlyUsedUnchecked();
 
     MOZ_ASSERT(!info().argsObjAliasesFormals());
 
     // When the id is constant, we can just return the corresponding inlined argument
-    if (index->isConstant() && index->toConstant()->value().isInt32()) {
+    if (index->isConstantValue() && index->constantValue().isInt32()) {
         MOZ_ASSERT(inliningDepth_ > 0);
 
-        int32_t id = index->toConstant()->value().toInt32();
+        int32_t id = index->constantValue().toInt32();
         index->setImplicitlyUsedUnchecked();
 
         if (id < (int32_t)inlineCallInfo_->argc() && id >= 0)
             current->push(inlineCallInfo_->getArg(id));
         else
             pushConstant(UndefinedValue());
 
         *emitted = true;
@@ -8060,18 +8059,18 @@ void
 IonBuilder::addTypedArrayLengthAndData(MDefinition *obj,
                                        BoundsChecking checking,
                                        MDefinition **index,
                                        MInstruction **length, MInstruction **elements)
 {
     MOZ_ASSERT((index != nullptr) == (elements != nullptr));
     JSObject *tarr = nullptr;
 
-    if (obj->isConstant() && obj->toConstant()->value().isObject())
-        tarr = &obj->toConstant()->value().toObject();
+    if (obj->isConstantValue() && obj->constantValue().isObject())
+        tarr = &obj->constantValue().toObject();
     else if (obj->resultTypeSet())
         tarr = obj->resultTypeSet()->getSingleton();
 
     if (tarr) {
         void *data = AnyTypedArrayViewData(tarr);
         // Bug 979449 - Optimistically embed the elements and use TI to
         //              invalidate if we move them.
         bool isTenured = !tarr->runtimeFromMainThread()->gc.nursery.isInside(data);
@@ -8118,28 +8117,28 @@ IonBuilder::convertShiftToMaskForStaticT
                                                   Scalar::Type viewType)
 {
     // No shifting is necessary if the typed array has single byte elements.
     if (TypedArrayShift(viewType) == 0)
         return id;
 
     // If the index is an already shifted constant, undo the shift to get the
     // absolute offset being accessed.
-    if (id->isConstant() && id->toConstant()->value().isInt32()) {
-        int32_t index = id->toConstant()->value().toInt32();
+    if (id->isConstantValue() && id->constantValue().isInt32()) {
+        int32_t index = id->constantValue().toInt32();
         MConstant *offset = MConstant::New(alloc(), Int32Value(index << TypedArrayShift(viewType)));
         current->add(offset);
         return offset;
     }
 
     if (!id->isRsh() || id->isEffectful())
         return nullptr;
-    if (!id->getOperand(1)->isConstant())
+    if (!id->getOperand(1)->isConstantValue())
         return nullptr;
-    const Value &value = id->getOperand(1)->toConstant()->value();
+    const Value &value = id->getOperand(1)->constantValue();
     if (!value.isInt32() || uint32_t(value.toInt32()) != TypedArrayShift(viewType))
         return nullptr;
 
     // Instead of shifting, mask off the low bits of the index so that
     // a non-scaled access on the typed array can be performed.
     MConstant *mask = MConstant::New(alloc(), Int32Value(~((1 << value.toInt32()) - 1)));
     MBitAnd *ptr = MBitAnd::New(alloc(), id->getOperand(0), mask);
 

--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -38,16 +38,22 @@ class LLabel : public LInstructionHelper
 };
 
 class LNop : public LInstructionHelper<0, 0, 0>
 {
   public:
     LIR_HEADER(Nop)
 };
 
+class LMop : public LInstructionHelper<0, 0, 0>
+{
+  public:
+    LIR_HEADER(Mop)
+};
+
 // An LOsiPoint captures a snapshot after a call and ensures enough space to
 // patch in a call to the invalidation mechanism.
 //
 // Note: LSafepoints are 1:1 with LOsiPoints, so it holds a reference to the
 // corresponding LSafepoint to inform it of the LOsiPoint's masm offset when it
 // gets CG'd.
 class LOsiPoint : public LInstructionHelper<0, 0, 0>
 {

--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -5,16 +5,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef jit_LOpcodes_h
 #define jit_LOpcodes_h
 
 #define LIR_COMMON_OPCODE_LIST(_)   \
     _(Label)                        \
     _(Nop)                          \
+    _(Mop)                          \
     _(OsiPoint)                     \
     _(MoveGroup)                    \
     _(Integer)                      \
     _(Pointer)                      \
     _(Double)                       \
     _(Float32)                      \
     _(SimdSplatX4)                  \
     _(Int32x4)                      \

--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -618,17 +618,17 @@ LIRGenerator::visitCallDirectEval(MCallD
 }
 
 static JSOp
 ReorderComparison(JSOp op, MDefinition **lhsp, MDefinition **rhsp)
 {
     MDefinition *lhs = *lhsp;
     MDefinition *rhs = *rhsp;
 
-    if (lhs->isConstant()) {
+    if (lhs->isConstantValue()) {
         *rhsp = lhs;
         *lhsp = rhs;
         return ReverseCompareOp(op);
     }
     return op;
 }
 
 void
@@ -638,18 +638,18 @@ LIRGenerator::visitTest(MTest *test)
     MBasicBlock *ifTrue = test->ifTrue();
     MBasicBlock *ifFalse = test->ifFalse();
 
     // String is converted to length of string in the type analysis phase (see
     // TestPolicy).
     MOZ_ASSERT(opd->type() != MIRType_String);
 
     // Testing a constant.
-    if (opd->isConstant()) {
-        bool result = opd->toConstant()->valueToBoolean();
+    if (opd->isConstantValue() && !opd->constantValue().isMagic()) {
+        bool result = opd->constantToBoolean();
         add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
         return;
     }
 
     if (opd->type() == MIRType_Value) {
         LDefinition temp0, temp1;
         if (test->operandMightEmulateUndefined()) {
             temp0 = temp();
@@ -1486,35 +1486,35 @@ LIRGenerator::visitMul(MMul *ins)
     MOZ_ASSERT(lhs->type() == rhs->type());
 
     if (ins->specialization() == MIRType_Int32) {
         MOZ_ASSERT(lhs->type() == MIRType_Int32);
         ReorderCommutative(&lhs, &rhs, ins);
 
         // If our RHS is a constant -1 and we don't have to worry about
         // overflow, we can optimize to an LNegI.
-        if (!ins->fallible() && rhs->isConstant() && rhs->toConstant()->value() == Int32Value(-1))
+        if (!ins->fallible() && rhs->isConstantValue() && rhs->constantValue() == Int32Value(-1))
             defineReuseInput(new(alloc()) LNegI(useRegisterAtStart(lhs)), ins, 0);
         else
             lowerMulI(ins, lhs, rhs);
     } else if (ins->specialization() == MIRType_Double) {
         MOZ_ASSERT(lhs->type() == MIRType_Double);
         ReorderCommutative(&lhs, &rhs, ins);
 
         // If our RHS is a constant -1.0, we can optimize to an LNegD.
-        if (rhs->isConstant() && rhs->toConstant()->value() == DoubleValue(-1.0))
+        if (rhs->isConstantValue() && rhs->constantValue() == DoubleValue(-1.0))
             defineReuseInput(new(alloc()) LNegD(useRegisterAtStart(lhs)), ins, 0);
         else
             lowerForFPU(new(alloc()) LMathD(JSOP_MUL), ins, lhs, rhs);
     } else if (ins->specialization() == MIRType_Float32) {
         MOZ_ASSERT(lhs->type() == MIRType_Float32);
         ReorderCommutative(&lhs, &rhs, ins);
 
         // We apply the same optimizations as for doubles
-        if (rhs->isConstant() && rhs->toConstant()->value() == Float32Value(-1.0f))
+        if (rhs->isConstantValue() && rhs->constantValue() == Float32Value(-1.0f))
             defineReuseInput(new(alloc()) LNegF(useRegisterAtStart(lhs)), ins, 0);
         else
             lowerForFPU(new(alloc()) LMathF(JSOP_MUL), ins, lhs, rhs);
     } else {
         lowerBinaryV(JSOP_MUL, ins);
     }
 }
 
@@ -4112,20 +4112,30 @@ LIRGenerator::visitInstruction(MInstruct
 
     if (ins->resumePoint())
         updateResumeState(ins);
 
 #ifdef DEBUG
     ins->setInWorklistUnchecked();
 #endif
 
+    // If we added a Nop for this instruction, we'll also add a Mop, so that
+    // that live-ranges for fixed register defs, which with LSRA extend through
+    // the Nop so that they can extend through the OsiPoint don't, with their
+    // one-extra extension, extend into a position where they use the input
+    // move group for the following instruction.
+    bool needsMop = !current->instructions().empty() && current->rbegin()->isNop();
+
     // If no safepoint was created, there's no need for an OSI point.
     if (LOsiPoint *osiPoint = popOsiPoint())
         add(osiPoint);
 
+    if (needsMop)
+        add(new(alloc()) LMop);
+
     return !gen->errored();
 }
 
 void
 LIRGenerator::definePhis()
 {
     size_t lirIndex = 0;
     MBasicBlock *block = current->mir();

--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -371,30 +371,30 @@ IonBuilder::inlineArray(CallInfo &callIn
         templateObject->clearShouldConvertDoubleElements();
 
     // A single integer argument denotes initial length.
     if (callInfo.argc() == 1) {
         if (callInfo.getArg(0)->type() != MIRType_Int32)
             return InliningStatus_NotInlined;
 
         MDefinition *arg = callInfo.getArg(0);
-        if (!arg->isConstant()) {
+        if (!arg->isConstantValue()) {
             callInfo.setImplicitlyUsedUnchecked();
             ArrayObject *templateArray = &templateObject->as<ArrayObject>();
             MNewArrayDynamicLength *ins =
                 MNewArrayDynamicLength::New(alloc(), constraints(), templateArray,
                                             templateArray->type()->initialHeap(constraints()),
                                             arg);
             current->add(ins);
             current->push(ins);
             return InliningStatus_Inlined;
         }
 
         // Negative lengths generate a RangeError, unhandled by the inline path.
-        initLength = arg->toConstant()->value().toInt32();
+        initLength = arg->constantValue().toInt32();
         if (initLength >= NativeObject::NELEMENTS_LIMIT)
             return InliningStatus_NotInlined;
 
         // Make sure initLength matches the template object's length. This is
         // not guaranteed to be the case, for instance if we're inlining the
         // MConstant may come from an outer script.
         if (initLength != templateObject->as<ArrayObject>().length())
             return InliningStatus_NotInlined;
@@ -1031,20 +1031,20 @@ IonBuilder::inlineMathPow(CallInfo &call
 
     callInfo.setImplicitlyUsedUnchecked();
 
     MDefinition *base = callInfo.getArg(0);
     MDefinition *power = callInfo.getArg(1);
     MDefinition *output = nullptr;
 
     // Optimize some constant powers.
-    if (callInfo.getArg(1)->isConstant() &&
-        callInfo.getArg(1)->toConstant()->value().isNumber())
+    if (callInfo.getArg(1)->isConstantValue() &&
+        callInfo.getArg(1)->constantValue().isNumber())
     {
-        double pow = callInfo.getArg(1)->toConstant()->value().toNumber();
+        double pow = callInfo.getArg(1)->constantValue().toNumber();
 
         // Math.pow(x, 0.5) is a sqrt with edge-case detection.
         if (pow == 0.5) {
             MPowHalf *half = MPowHalf::New(alloc(), base);
             current->add(half);
             output = half;
         }
 
@@ -1209,18 +1209,18 @@ IonBuilder::inlineMathMinMax(CallInfo &c
           case MIRType_Int32:
             if (!int32_cases.append(arg))
                 return InliningStatus_Error;
             break;
           case MIRType_Double:
           case MIRType_Float32:
             // Don't force a double MMinMax for arguments that would be a NOP
             // when doing an integer MMinMax.
-            if (arg->isConstant()) {
-                double cte = arg->toConstant()->value().toDouble();
+            if (arg->isConstantValue()) {
+                double cte = arg->constantValue().toDouble();
                 // min(int32, cte >= INT32_MAX) = int32
                 if (cte >= INT32_MAX && !max)
                     break;
                 // max(int32, cte <= INT32_MIN) = int32
                 if (cte <= INT32_MIN && max)
                     break;
             }
 
@@ -1361,24 +1361,24 @@ IonBuilder::inlineStrCharCodeAt(CallInfo
     current->add(charCode);
     current->push(charCode);
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
 IonBuilder::inlineConstantCharCodeAt(CallInfo &callInfo)
 {
-    if (!callInfo.thisArg()->isConstant())
+    if (!callInfo.thisArg()->isConstantValue())
         return InliningStatus_NotInlined;
 
-    if (!callInfo.getArg(0)->isConstant())
+    if (!callInfo.getArg(0)->isConstantValue())
         return InliningStatus_NotInlined;
 
-    const js::Value *strval = callInfo.thisArg()->toConstant()->vp();
-    const js::Value *idxval  = callInfo.getArg(0)->toConstant()->vp();
+    const js::Value *strval = callInfo.thisArg()->constantVp();
+    const js::Value *idxval  = callInfo.getArg(0)->constantVp();
 
     if (!strval->isString() || !idxval->isInt32())
         return InliningStatus_NotInlined;
 
     JSString *str = strval->toString();
     if (!str->isLinear())
         return InliningStatus_NotInlined;
 
@@ -2026,19 +2026,19 @@ IonBuilder::inlineUnsafeSetReservedSlot(
         return InliningStatus_NotInlined;
     if (callInfo.getArg(0)->type() != MIRType_Object)
         return InliningStatus_NotInlined;
     if (callInfo.getArg(1)->type() != MIRType_Int32)
         return InliningStatus_NotInlined;
 
     // Don't inline if we don't have a constant slot.
     MDefinition *arg = callInfo.getArg(1);
-    if (!arg->isConstant())
+    if (!arg->isConstantValue())
         return InliningStatus_NotInlined;
-    uint32_t slot = arg->toConstant()->value().toPrivateUint32();
+    uint32_t slot = arg->constantValue().toPrivateUint32();
 
     callInfo.setImplicitlyUsedUnchecked();
 
     MStoreFixedSlot *store = MStoreFixedSlot::New(alloc(), callInfo.getArg(0), slot, callInfo.getArg(2));
     current->add(store);
     current->push(store);
 
     if (NeedsPostBarrier(info(), callInfo.getArg(2)))
@@ -2054,19 +2054,19 @@ IonBuilder::inlineUnsafeGetReservedSlot(
         return InliningStatus_NotInlined;
     if (callInfo.getArg(0)->type() != MIRType_Object)
         return InliningStatus_NotInlined;
     if (callInfo.getArg(1)->type() != MIRType_Int32)
         return InliningStatus_NotInlined;
 
     // Don't inline if we don't have a constant slot.
     MDefinition *arg = callInfo.getArg(1);
-    if (!arg->isConstant())
+    if (!arg->isConstantValue())
         return InliningStatus_NotInlined;
-    uint32_t slot = arg->toConstant()->value().toPrivateUint32();
+    uint32_t slot = arg->constantValue().toPrivateUint32();
 
     callInfo.setImplicitlyUsedUnchecked();
 
     MLoadFixedSlot *load = MLoadFixedSlot::New(alloc(), callInfo.getArg(0), slot);
     current->add(load);
     current->push(load);
 
     // We don't track reserved slot types, so always emit a barrier.
@@ -2222,19 +2222,19 @@ IonBuilder::inlineBailout(CallInfo &call
 IonBuilder::InliningStatus
 IonBuilder::inlineAssertFloat32(CallInfo &callInfo)
 {
     callInfo.setImplicitlyUsedUnchecked();
 
     MDefinition *secondArg = callInfo.getArg(1);
 
     MOZ_ASSERT(secondArg->type() == MIRType_Boolean);
-    MOZ_ASSERT(secondArg->isConstant());
-
-    bool mustBeFloat32 = secondArg->toConstant()->value().toBoolean();
+    MOZ_ASSERT(secondArg->isConstantValue());
+
+    bool mustBeFloat32 = secondArg->constantValue().toBoolean();
     current->add(MAssertFloat32::New(alloc(), callInfo.getArg(0), mustBeFloat32));
 
     MConstant *undefined = MConstant::New(alloc(), UndefinedValue());
     current->add(undefined);
     current->push(undefined);
     return InliningStatus_Inlined;
 }
 

--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -66,27 +66,55 @@ MDefinition::PrintOpcodeName(FILE *fp, M
 #undef NAME
     };
     const char *name = names[op];
     size_t len = strlen(name);
     for (size_t i = 0; i < len; i++)
         fprintf(fp, "%c", tolower(name[i]));
 }
 
+const Value &
+MDefinition::constantValue()
+{
+    MOZ_ASSERT(isConstantValue());
+
+    if (isBox())
+        return getOperand(0)->constantValue();
+    return toConstant()->value();
+}
+
+const Value *
+MDefinition::constantVp()
+{
+    MOZ_ASSERT(isConstantValue());
+    if (isBox())
+        return getOperand(0)->constantVp();
+    return toConstant()->vp();
+}
+
+bool
+MDefinition::constantToBoolean()
+{
+    MOZ_ASSERT(isConstantValue());
+    if (isBox())
+        return getOperand(0)->constantToBoolean();
+    return toConstant()->valueToBoolean();
+}
+
 static MConstant *
 EvaluateConstantOperands(TempAllocator &alloc, MBinaryInstruction *ins, bool *ptypeChange = nullptr)
 {
     MDefinition *left = ins->getOperand(0);
     MDefinition *right = ins->getOperand(1);
 
-    if (!left->isConstant() || !right->isConstant())
+    if (!left->isConstantValue() || !right->isConstantValue())
         return nullptr;
 
-    Value lhs = left->toConstant()->value();
-    Value rhs = right->toConstant()->value();
+    Value lhs = left->constantValue();
+    Value rhs = right->constantValue();
     Value ret = UndefinedValue();
 
     switch (ins->op()) {
       case MDefinition::Op_BitAnd:
         ret = Int32Value(lhs.toInt32() & rhs.toInt32());
         break;
       case MDefinition::Op_BitOr:
         ret = Int32Value(lhs.toInt32() | rhs.toInt32());
@@ -141,20 +169,20 @@ EvaluateExactReciprocal(TempAllocator &a
 {
     // we should fold only when it is a floating point operation
     if (!IsFloatingPointType(ins->type()))
         return nullptr;
 
     MDefinition *left = ins->getOperand(0);
     MDefinition *right = ins->getOperand(1);
 
-    if (!right->isConstant())
+    if (!right->isConstantValue())
         return nullptr;
 
-    Value rhs = right->toConstant()->value();
+    Value rhs = right->constantValue();
 
     int32_t num;
     if (!mozilla::NumberIsInt32(rhs.toNumber(), &num))
         return nullptr;
 
     // check if rhs is a power of two
     if (mozilla::Abs(num) & (mozilla::Abs(num) - 1))
         return nullptr;
@@ -350,18 +378,18 @@ MTest::foldsTo(TempAllocator &alloc)
     if (op->isNot()) {
         // If the operand of the Not is itself a Not, they cancel out.
         MDefinition *opop = op->getOperand(0);
         if (opop->isNot())
             return MTest::New(alloc, opop->toNot()->input(), ifTrue(), ifFalse());
         return MTest::New(alloc, op->toNot()->input(), ifFalse(), ifTrue());
     }
 
-    if (op->isConstant())
-        return MGoto::New(alloc, op->toConstant()->valueToBoolean() ? ifTrue() : ifFalse());
+    if (op->isConstantValue() && !op->constantValue().isMagic())
+        return MGoto::New(alloc, op->constantToBoolean() ? ifTrue() : ifFalse());
 
     switch (op->type()) {
       case MIRType_Undefined:
       case MIRType_Null:
         return MGoto::New(alloc, ifFalse());
       case MIRType_Symbol:
         return MGoto::New(alloc, ifTrue());
       case MIRType_Object:
@@ -763,39 +791,39 @@ MSimdValueX4::foldsTo(TempAllocator &all
 {
     DebugOnly<MIRType> scalarType = SimdTypeToScalarType(type());
     bool allConstants = true;
     bool allSame = true;
 
     for (size_t i = 0; i < 4; ++i) {
         MDefinition *op = getOperand(i);
         MOZ_ASSERT(op->type() == scalarType);
-        if (!op->isConstant())
+        if (!op->isConstantValue())
             allConstants = false;
         if (i > 0 && op != getOperand(i - 1))
             allSame = false;
     }
 
     if (!allConstants && !allSame)
         return this;
 
     if (allConstants) {
         SimdConstant cst;
         switch (type()) {
           case MIRType_Int32x4: {
             int32_t a[4];
             for (size_t i = 0; i < 4; ++i)
-                a[i] = getOperand(i)->toConstant()->value().toInt32();
+                a[i] = getOperand(i)->constantValue().toInt32();
             cst = SimdConstant::CreateX4(a);
             break;
           }
           case MIRType_Float32x4: {
             float a[4];
             for (size_t i = 0; i < 4; ++i)
-                a[i] = getOperand(i)->toConstant()->value().toNumber();
+                a[i] = getOperand(i)->constantValue().toNumber();
             cst = SimdConstant::CreateX4(a);
             break;
           }
           default: MOZ_CRASH("unexpected type in MSimdValueX4::foldsTo");
         }
 
         return MSimdConstant::New(alloc, cst, type());
     }
@@ -804,33 +832,33 @@ MSimdValueX4::foldsTo(TempAllocator &all
     return MSimdSplatX4::New(alloc, type(), getOperand(0));
 }
 
 MDefinition*
 MSimdSplatX4::foldsTo(TempAllocator &alloc)
 {
     DebugOnly<MIRType> scalarType = SimdTypeToScalarType(type());
     MDefinition *op = getOperand(0);
-    if (!op->isConstant())
+    if (!op->isConstantValue())
         return this;
     MOZ_ASSERT(op->type() == scalarType);
 
     SimdConstant cst;
     switch (type()) {
       case MIRType_Int32x4: {
         int32_t a[4];
-        int32_t v = getOperand(0)->toConstant()->value().toInt32();
+        int32_t v = getOperand(0)->constantValue().toInt32();
         for (size_t i = 0; i < 4; ++i)
             a[i] = v;
         cst = SimdConstant::CreateX4(a);
         break;
       }
       case MIRType_Float32x4: {
         float a[4];
-        float v = getOperand(0)->toConstant()->value().toNumber();
+        float v = getOperand(0)->constantValue().toNumber();
         for (size_t i = 0; i < 4; ++i)
             a[i] = v;
         cst = SimdConstant::CreateX4(a);
         break;
       }
       default: MOZ_CRASH("unexpected type in MSimdSplatX4::foldsTo");
     }
 
@@ -1091,18 +1119,18 @@ MApplyArgs::New(TempAllocator &alloc, JS
                 MDefinition *self)
 {
     return new(alloc) MApplyArgs(target, fun, argc, self);
 }
 
 MDefinition*
 MStringLength::foldsTo(TempAllocator &alloc)
 {
-    if ((type() == MIRType_Int32) && (string()->isConstant())) {
-        Value value = string()->toConstant()->value();
+    if ((type() == MIRType_Int32) && (string()->isConstantValue())) {
+        Value value = string()->constantValue();
         JSAtom *atom = &value.toString()->asAtom();
         return MConstant::New(alloc, Int32Value(atom->length()));
     }
 
     return this;
 }
 
 static bool
@@ -1879,22 +1907,20 @@ MMinMax::trySpecializeFloat32(TempAlloca
 }
 
 MDefinition *
 MMinMax::foldsTo(TempAllocator &alloc)
 {
     if (!lhs()->isConstant() && !rhs()->isConstant())
         return this;
 
-    MDefinition *operand = lhs()->isConstant() ? rhs() : lhs();
-    MConstant *constant = lhs()->isConstant() ? lhs()->toConstant() : rhs()->toConstant();
+    MDefinition *operand = lhs()->isConstantValue() ? rhs() : lhs();
+    const js::Value &val = lhs()->isConstantValue() ? lhs()->constantValue() : rhs()->constantValue();
 
     if (operand->isToDouble() && operand->getOperand(0)->type() == MIRType_Int32) {
-        const js::Value &val = constant->value();
-
         // min(int32, cte >= INT32_MAX) = int32
         if (val.isDouble() && val.toDouble() >= INT32_MAX && !isMax()) {
             MLimitedTruncate *limit =
                 MLimitedTruncate::New(alloc, operand->getOperand(0), MDefinition::NoTruncate);
             block()->insertBefore(this, limit);
             MToDouble *toDouble = MToDouble::New(alloc, limit);
             block()->insertBefore(this, toDouble);
             return toDouble;
@@ -1954,35 +1980,35 @@ MDiv::foldsTo(TempAllocator &alloc)
 void
 MDiv::analyzeEdgeCasesForward()
 {
     // This is only meaningful when doing integer division.
     if (specialization_ != MIRType_Int32)
         return;
 
     // Try removing divide by zero check
-    if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(0))
+    if (rhs()->isConstantValue() && !rhs()->constantValue().isInt32(0))
         canBeDivideByZero_ = false;
 
     // If lhs is a constant int != INT32_MIN, then
     // negative overflow check can be skipped.
-    if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(INT32_MIN))
+    if (lhs()->isConstantValue() && !lhs()->constantValue().isInt32(INT32_MIN))
         canBeNegativeOverflow_ = false;
 
     // If rhs is a constant int != -1, likewise.
-    if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(-1))
+    if (rhs()->isConstantValue() && !rhs()->constantValue().isInt32(-1))
         canBeNegativeOverflow_ = false;
 
     // If lhs is != 0, then negative zero check can be skipped.
-    if (lhs()->isConstant() && !lhs()->toConstant()->value().isInt32(0))
+    if (lhs()->isConstantValue() && !lhs()->constantValue().isInt32(0))
         setCanBeNegativeZero(false);
 
     // If rhs is >= 0, likewise.
-    if (rhs()->isConstant()) {
-        const js::Value &val = rhs()->toConstant()->value();
+    if (rhs()->isConstantValue()) {
+        const js::Value &val = rhs()->constantValue();
         if (val.isInt32() && val.toInt32() >= 0)
             setCanBeNegativeZero(false);
     }
 }
 
 void
 MDiv::analyzeEdgeCasesBackward()
 {
@@ -2010,21 +2036,21 @@ MMod::foldsTo(TempAllocator &alloc)
 
 void
 MMod::analyzeEdgeCasesForward()
 {
     // These optimizations make sense only for integer division
     if (specialization_ != MIRType_Int32)
         return;
 
-    if (rhs()->isConstant() && !rhs()->toConstant()->value().isInt32(0))
+    if (rhs()->isConstantValue() && !rhs()->constantValue().isInt32(0))
         canBeDivideByZero_ = false;
 
-    if (rhs()->isConstant()) {
-        int32_t n = rhs()->toConstant()->value().toInt32();
+    if (rhs()->isConstantValue()) {
+        int32_t n = rhs()->constantValue().toInt32();
         if (n > 0 && !IsPowerOfTwo(n))
             canBePowerOfTwoDivisor_ = false;
     }
 }
 
 bool
 MMod::fallible() const
 {
@@ -2088,25 +2114,25 @@ void
 MMul::analyzeEdgeCasesForward()
 {
     // Try to remove the check for negative zero
     // This only makes sense when using the integer multiplication
     if (specialization() != MIRType_Int32)
         return;
 
     // If lhs is > 0, no need for negative zero check.
-    if (lhs()->isConstant()) {
-        const js::Value &val = lhs()->toConstant()->value();
+    if (lhs()->isConstantValue()) {
+        const js::Value &val = lhs()->constantValue();
         if (val.isInt32() && val.toInt32() > 0)
             setCanBeNegativeZero(false);
     }
 
     // If rhs is > 0, likewise.
-    if (rhs()->isConstant()) {
-        const js::Value &val = rhs()->toConstant()->value();
+    if (rhs()->isConstantValue()) {
+        const js::Value &val = rhs()->constantValue();
         if (val.isInt32() && val.toInt32() > 0)
             setCanBeNegativeZero(false);
     }
 }
 
 void
 MMul::analyzeEdgeCasesBackward()
 {
@@ -2365,25 +2391,25 @@ MCompare::inputType()
 
 static inline bool
 MustBeUInt32(MDefinition *def, MDefinition **pwrapped)
 {
     if (def->isUrsh()) {
         *pwrapped = def->toUrsh()->getOperand(0);
         MDefinition *rhs = def->toUrsh()->getOperand(1);
         return !def->toUrsh()->bailoutsDisabled()
-            && rhs->isConstant()
-            && rhs->toConstant()->value().isInt32()
-            && rhs->toConstant()->value().toInt32() == 0;
+            && rhs->isConstantValue()
+            && rhs->constantValue().isInt32()
+            && rhs->constantValue().toInt32() == 0;
     }
 
-    if (def->isConstant()) {
+    if (def->isConstantValue()) {
         *pwrapped = def;
-        return def->toConstant()->value().isInt32()
-            && def->toConstant()->value().toInt32() >= 0;
+        return def->constantValue().isInt32()
+            && def->constantValue().toInt32() >= 0;
     }
 
     return false;
 }
 
 bool
 MBinaryInstruction::tryUseUnsignedOperands()
 {
@@ -2548,17 +2574,17 @@ MDefinition *
 MBitNot::foldsTo(TempAllocator &alloc)
 {
     if (specialization_ != MIRType_Int32)
         return this;
 
     MDefinition *input = getOperand(0);
 
     if (input->isConstant()) {
-        js::Value v = Int32Value(~(input->toConstant()->value().toInt32()));
+        js::Value v = Int32Value(~(input->constantValue().toInt32()));
         return MConstant::New(alloc, v);
     }
 
     if (input->isBitNot() && input->toBitNot()->specialization_ == MIRType_Int32) {
         MOZ_ASSERT(input->toBitNot()->getOperand(0)->type() == MIRType_Int32);
         return input->toBitNot()->getOperand(0); // ~~x => x
     }
 
@@ -2873,82 +2899,95 @@ MToInt32::analyzeEdgeCasesBackward()
     if (!NeedNegativeZeroCheck(this))
         setCanBeNegativeZero(false);
 }
 
 MDefinition *
 MTruncateToInt32::foldsTo(TempAllocator &alloc)
 {
     MDefinition *input = getOperand(0);
+    if (input->isBox())
+        input = input->getOperand(0);
+
     if (input->type() == MIRType_Int32)
         return input;
 
     if (input->type() == MIRType_Double && input->isConstant()) {
-        const Value &v = input->toConstant()->value();
+        const Value &v = input->constantValue();
         int32_t ret = ToInt32(v.toDouble());
         return MConstant::New(alloc, Int32Value(ret));
     }
 
     return this;
 }
 
 MDefinition *
 MToDouble::foldsTo(TempAllocator &alloc)
 {
-    MDefinition *in = input();
-    if (in->type() == MIRType_Double)
-        return in;
-
-    if (in->isConstant()) {
-        const Value &v = in->toConstant()->value();
+    MDefinition *input = getOperand(0);
+    if (input->isBox())
+        input = input->getOperand(0);
+
+    if (input->type() == MIRType_Double)
+        return input;
+
+    if (input->isConstant()) {
+        const Value &v = input->toConstant()->value();
         if (v.isNumber()) {
             double out = v.toNumber();
             return MConstant::New(alloc, DoubleValue(out));
         }
     }
 
     return this;
 }
 
 MDefinition *
 MToFloat32::foldsTo(TempAllocator &alloc)
 {
-    if (input()->type() == MIRType_Float32)
-        return input();
+    MDefinition *input = getOperand(0);
+    if (input->isBox())
+        input = input->getOperand(0);
+
+    if (input->type() == MIRType_Float32)
+        return input;
 
     // If x is a Float32, Float32(Double(x)) == x
-    if (input()->isToDouble() && input()->toToDouble()->input()->type() == MIRType_Float32)
-        return input()->toToDouble()->input();
-
-    if (input()->isConstant()) {
-        const Value &v = input()->toConstant()->value();
+    if (input->isToDouble() && input->toToDouble()->input()->type() == MIRType_Float32)
+        return input->toToDouble()->input();
+
+    if (input->isConstant()) {
+        const Value &v = input->toConstant()->value();
         if (v.isNumber()) {
             float out = v.toNumber();
             MConstant *c = MConstant::New(alloc, DoubleValue(out));
             c->setResultType(MIRType_Float32);
             return c;
         }
     }
     return this;
 }
 
 MDefinition *
 MToString::foldsTo(TempAllocator &alloc)
 {
     MDefinition *in = input();
+    if (in->isBox())
+        in = in->getOperand(0);
+
     if (in->type() == MIRType_String)
         return in;
     return this;
 }
 
 MDefinition *
 MClampToUint8::foldsTo(TempAllocator &alloc)
 {
-    if (input()->isConstant()) {
-        const Value &v = input()->toConstant()->value();
+    if (input()->isConstantValue()) {
+        const Value &v = input()->constantValue();
         if (v.isDouble()) {
             int32_t clamped = ClampDoubleToUint8(v.toDouble());
             return MConstant::New(alloc, Int32Value(clamped));
         }
         if (v.isInt32()) {
             int32_t clamped = ClampIntForUint8Array(v.toInt32());
             return MConstant::New(alloc, Int32Value(clamped));
         }
@@ -3353,18 +3392,18 @@ MNot::cacheOperandMightEmulateUndefined(
     if (!MaybeEmulatesUndefined(getOperand(0)))
         markOperandCantEmulateUndefined();
 }
 
 MDefinition *
 MNot::foldsTo(TempAllocator &alloc)
 {
     // Fold if the input is constant
-    if (input()->isConstant()) {
-        bool result = input()->toConstant()->valueToBoolean();
+    if (input()->isConstantValue() && !input()->constantValue().isMagic()) {
+        bool result = input()->constantToBoolean();
         if (type() == MIRType_Int32)
             return MConstant::New(alloc, Int32Value(!result));
 
         // ToBoolean can't cause side effects, so this is safe.
         return MConstant::New(alloc, BooleanValue(!result));
     }
 
     // If the operand of the Not is itself a Not, they cancel out. But we can't
@@ -3920,30 +3959,30 @@ MGetPropertyCache::updateForReplacement(
     MGetPropertyCache *other = ins->toGetPropertyCache();
     location_.append(&other->location_);
     return true;
 }
 
 MDefinition *
 MAsmJSUnsignedToDouble::foldsTo(TempAllocator &alloc)
 {
-    if (input()->isConstant()) {
-        const Value &v = input()->toConstant()->value();
+    if (input()->isConstantValue()) {
+        const Value &v = input()->constantValue();
         if (v.isInt32())
             return MConstant::New(alloc, DoubleValue(uint32_t(v.toInt32())));
     }
 
     return this;
 }
 
 MDefinition *
 MAsmJSUnsignedToFloat32::foldsTo(TempAllocator &alloc)
 {
-    if (input()->isConstant()) {
-        const Value &v = input()->toConstant()->value();
+    if (input()->isConstantValue()) {
+        const Value &v = input()->constantValue();
         if (v.isInt32()) {
             double dval = double(uint32_t(v.toInt32()));
             if (IsFloat32Representable(dval))
                 return MConstant::NewAsmJS(alloc, JS::Float32Value(float(dval)), MIRType_Float32);
         }
     }
 
     return this;
@@ -3982,32 +4021,32 @@ MSqrt::trySpecializeFloat32(TempAllocato
 
     setResultType(MIRType_Float32);
     setPolicyType(MIRType_Float32);
 }
 
 MDefinition *
 MClz::foldsTo(TempAllocator &alloc)
 {
-    if (num()->isConstant()) {
-        int32_t n = num()->toConstant()->value().toInt32();
+    if (num()->isConstantValue()) {
+        int32_t n = num()->constantValue().toInt32();
         if (n == 0)
             return MConstant::New(alloc, Int32Value(32));
         return MConstant::New(alloc, Int32Value(mozilla::CountLeadingZeroes32(n)));
     }
 
     return this;
 }
 
 MDefinition *
 MBoundsCheck::foldsTo(TempAllocator &alloc)
 {
-    if (index()->isConstant() && length()->isConstant()) {
-       uint32_t len = length()->toConstant()->value().toInt32();
-       uint32_t idx = index()->toConstant()->value().toInt32();
+    if (index()->isConstantValue() && length()->isConstantValue()) {
+       uint32_t len = length()->constantValue().toInt32();
+       uint32_t idx = index()->constantValue().toInt32();
        if (idx + uint32_t(minimum()) < len && idx + uint32_t(maximum()) < len)
            return index();
     }
 
     return this;
 }
 
 MDefinition *

--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -747,16 +747,23 @@ class MDefinition : public MNode
         return this->to<M##opcode>();     \
     }                                     \
     const M##opcode *to##opcode() const { \
         return this->to<M##opcode>();     \
     }
     MIR_OPCODE_LIST(OPCODE_CASTS)
 #   undef OPCODE_CASTS
 
+    bool isConstantValue() {
+        return isConstant() || (isBox() && getOperand(0)->isConstant());
+    }
+    const Value &constantValue();
+    const Value *constantVp();
+    bool constantToBoolean();
+
     inline MInstruction *toInstruction();
     inline const MInstruction *toInstruction() const;
     bool isInstruction() const {
         return !isPhi();
     }
 
     virtual bool isControlInstruction() const {
         return false;

--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -150,16 +150,19 @@ RangeAnalysis::addBetaNodes()
         BranchDirection branch_dir;
         MTest *test = block->immediateDominatorBranch(&branch_dir);
 
         if (!test || !test->getOperand(0)->isCompare())
             continue;
 
         MCompare *compare = test->getOperand(0)->toCompare();
 
+        if (compare->compareType() == MCompare::Compare_Unknown)
+            continue;
+
         // TODO: support unsigned comparisons
         if (compare->compareType() == MCompare::Compare_UInt32)
             continue;
 
         MDefinition *left = compare->getOperand(0);
         MDefinition *right = compare->getOperand(1);
         double bound;
         double conservativeLower = NegativeInfinity<double>();
@@ -169,22 +172,22 @@ RangeAnalysis::addBetaNodes()
         JSOp jsop = compare->jsop();
 
         if (branch_dir == FALSE_BRANCH) {
             jsop = NegateCompareOp(jsop);
             conservativeLower = GenericNaN();
             conservativeUpper = GenericNaN();
         }
 
-        if (left->isConstant() && left->toConstant()->value().isNumber()) {
-            bound = left->toConstant()->value().toNumber();
+        if (left->isConstantValue() && left->constantValue().isNumber()) {
+            bound = left->constantValue().toNumber();
             val = right;
             jsop = ReverseCompareOp(jsop);
-        } else if (right->isConstant() && right->toConstant()->value().isNumber()) {
-            bound = right->toConstant()->value().toNumber();
+        } else if (right->isConstantValue() && right->constantValue().isNumber()) {
+            bound = right->constantValue().toNumber();
             val = left;
         } else if (left->type() == MIRType_Int32 && right->type() == MIRType_Int32) {
             MDefinition *smaller = nullptr;
             MDefinition *greater = nullptr;
             if (jsop == JSOP_LT) {
                 smaller = left;
                 greater = right;
             } else if (jsop == JSOP_GT) {
@@ -1305,42 +1308,42 @@ MBitNot::computeRange(TempAllocator &all
 void
 MLsh::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
     left.wrapAroundToInt32();
 
     MDefinition *rhs = getOperand(1);
-    if (!rhs->isConstant()) {
-        right.wrapAroundToShiftCount();
-        setRange(Range::lsh(alloc, &left, &right));
+    if (rhs->isConstantValue() && rhs->constantValue().isInt32()) {
+        int32_t c = rhs->constantValue().toInt32();
+        setRange(Range::lsh(alloc, &left, c));
         return;
     }
 
-    int32_t c = rhs->toConstant()->value().toInt32();
-    setRange(Range::lsh(alloc, &left, c));
+    right.wrapAroundToShiftCount();
+    setRange(Range::lsh(alloc, &left, &right));
 }
 
 void
 MRsh::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
     left.wrapAroundToInt32();
 
     MDefinition *rhs = getOperand(1);
-    if (!rhs->isConstant()) {
-        right.wrapAroundToShiftCount();
-        setRange(Range::rsh(alloc, &left, &right));
+    if (rhs->isConstantValue() && rhs->constantValue().isInt32()) {
+        int32_t c = rhs->constantValue().toInt32();
+        setRange(Range::rsh(alloc, &left, c));
         return;
     }
 
-    int32_t c = rhs->toConstant()->value().toInt32();
-    setRange(Range::rsh(alloc, &left, c));
+    right.wrapAroundToShiftCount();
+    setRange(Range::rsh(alloc, &left, &right));
 }
 
 void
 MUrsh::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
 
@@ -1348,21 +1351,21 @@ MUrsh::computeRange(TempAllocator &alloc
     // can be thought of as converting its left operand to int32, and then
     // reinterpreting the int32 bits as a uint32 value. Both approaches yield
     // the same result. Since we lack support for full uint32 ranges, we use
     // the second interpretation, though it does cause us to be conservative.
     left.wrapAroundToInt32();
     right.wrapAroundToShiftCount();
 
     MDefinition *rhs = getOperand(1);
-    if (!rhs->isConstant()) {
-        setRange(Range::ursh(alloc, &left, &right));
+    if (rhs->isConstantValue() && rhs->constantValue().isInt32()) {
+        int32_t c = rhs->constantValue().toInt32();
+        setRange(Range::ursh(alloc, &left, c));
     } else {
-        int32_t c = rhs->toConstant()->value().toInt32();
-        setRange(Range::ursh(alloc, &left, c));
+        setRange(Range::ursh(alloc, &left, &right));
     }
 
     MOZ_ASSERT(range()->lower() >= 0);
 }
 
 void
 MAbs::computeRange(TempAllocator &alloc)
 {
@@ -2729,17 +2732,17 @@ CloneForDeadBranches(TempAllocator &allo
     clone->setRange(nullptr);
 
     // Set UseRemoved flag on the cloned instruction in order to chain recover
     // instruction for the bailout path.
     clone->setUseRemovedUnchecked();
 
     candidate->block()->insertBefore(candidate, clone);
 
-    if (!candidate->isConstant()) {
+    if (!candidate->isConstantValue()) {
         MOZ_ASSERT(clone->canRecoverOnBailout());
         clone->setRecoveredOnBailout();
     }
 
     // Replace the candidate by its recovered on bailout clone within recovered
     // instructions and resume points operands.
     for (MUseIterator i(candidate->usesBegin()); i != candidate->usesEnd(); ) {
         MUse *use = *i++;

--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -528,20 +528,20 @@ static bool
 IndexOf(MDefinition *ins, int32_t *res)
 {
     MOZ_ASSERT(ins->isLoadElement() || ins->isStoreElement());
     MDefinition *indexDef = ins->getOperand(1); // ins->index();
     if (indexDef->isBoundsCheck())
         indexDef = indexDef->toBoundsCheck()->index();
     if (indexDef->isToInt32())
         indexDef = indexDef->toToInt32()->getOperand(0);
-    if (!indexDef->isConstant())
+    if (!indexDef->isConstantValue())
         return false;
 
-    Value index = indexDef->toConstant()->value();
+    Value index = indexDef->constantValue();
     if (!index.isInt32())
         return false;
     *res = index.toInt32();
     return true;
 }
 
 // Returns False if the array is not escaped and if it is optimizable by
 // ScalarReplacementOfArray.
@@ -961,17 +961,17 @@ ArrayMemoryView::visitSetInitializedLeng
     if (!isArrayStateElements(elements))
         return;
 
     // Replace by the new initialized length.  Note that the argument of
     // MSetInitalizedLength is the last index and not the initialized length.
     // To obtain the length, we need to add 1 to it, and thus we need to create
     // a new constant that we register in the ArrayState.
     state_ = BlockState::Copy(alloc_, state_);
-    int32_t initLengthValue = ins->index()->toConstant()->value().toInt32() + 1;
+    int32_t initLengthValue = ins->index()->constantValue().toInt32() + 1;
     MConstant *initLength = MConstant::New(alloc_, Int32Value(initLengthValue));
     ins->block()->insertBefore(ins, initLength);
     ins->block()->insertBefore(ins, state_);
     state_->setInitializedLength(initLength);
 
     // Remove original instruction.
     discardInstruction(ins, elements);
 }

--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -487,37 +487,37 @@ LIRGeneratorARM::visitAsmJSUnsignedToFlo
 void
 LIRGeneratorARM::visitAsmJSLoadHeap(MAsmJSLoadHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     MOZ_ASSERT(ptr->type() == MIRType_Int32);
     LAllocation ptrAlloc;
 
     // For the ARM it is best to keep the 'ptr' in a register if a bounds check is needed.
-    if (ptr->isConstant() && !ins->needsBoundsCheck()) {
+    if (ptr->isConstantValue() && !ins->needsBoundsCheck()) {
         // A bounds check is only skipped for a positive index.
-        MOZ_ASSERT(ptr->toConstant()->value().toInt32() >= 0);
-        ptrAlloc = LAllocation(ptr->toConstant()->vp());
+        MOZ_ASSERT(ptr->constantValue().toInt32() >= 0);
+        ptrAlloc = LAllocation(ptr->constantVp());
     } else {
         ptrAlloc = useRegisterAtStart(ptr);
     }
 
     define(new(alloc()) LAsmJSLoadHeap(ptrAlloc), ins);
 }
 
 void
 LIRGeneratorARM::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     MOZ_ASSERT(ptr->type() == MIRType_Int32);
     LAllocation ptrAlloc;
 
-    if (ptr->isConstant() && !ins->needsBoundsCheck()) {
-        MOZ_ASSERT(ptr->toConstant()->value().toInt32() >= 0);
-        ptrAlloc = LAllocation(ptr->toConstant()->vp());
+    if (ptr->isConstantValue() && !ins->needsBoundsCheck()) {
+        MOZ_ASSERT(ptr->constantValue().toInt32() >= 0);
+        ptrAlloc = LAllocation(ptr->constantVp());
     } else {
         ptrAlloc = useRegisterAtStart(ptr);
     }
 
     add(new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value())), ins);
 }
 
 void

--- a/js/src/jit/mips/Lowering-mips.cpp
+++ b/js/src/jit/mips/Lowering-mips.cpp
@@ -465,37 +465,37 @@ void
 LIRGeneratorMIPS::visitAsmJSLoadHeap(MAsmJSLoadHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     MOZ_ASSERT(ptr->type() == MIRType_Int32);
     LAllocation ptrAlloc;
 
     // For MIPS it is best to keep the 'ptr' in a register if a bounds check
     // is needed.
-    if (ptr->isConstant() && !ins->needsBoundsCheck()) {
-        int32_t ptrValue = ptr->toConstant()->value().toInt32();
+    if (ptr->isConstantValue() && !ins->needsBoundsCheck()) {
+        int32_t ptrValue = ptr->constantValue().toInt32();
         // A bounds check is only skipped for a positive index.
         MOZ_ASSERT(ptrValue >= 0);
-        ptrAlloc = LAllocation(ptr->toConstant()->vp());
+        ptrAlloc = LAllocation(ptr->constantVp());
     } else
         ptrAlloc = useRegisterAtStart(ptr);
 
     define(new(alloc()) LAsmJSLoadHeap(ptrAlloc), ins);
 }
 
 void
 LIRGeneratorMIPS::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
 {
     MDefinition *ptr = ins->ptr();
     MOZ_ASSERT(ptr->type() == MIRType_Int32);
     LAllocation ptrAlloc;
 
-    if (ptr->isConstant() && !ins->needsBoundsCheck()) {
-        MOZ_ASSERT(ptr->toConstant()->value().toInt32() >= 0);
-        ptrAlloc = LAllocation(ptr->toConstant()->vp());
+    if (ptr->isConstantValue() && !ins->needsBoundsCheck()) {
+        MOZ_ASSERT(ptr->constantValue().toInt32() >= 0);
+        ptrAlloc = LAllocation(ptr->constantVp());
     } else
         ptrAlloc = useRegisterAtStart(ptr);
 
     add(new(alloc()) LAsmJSStoreHeap(ptrAlloc, useRegisterAtStart(ins->value())), ins);
 }
 
 void
 LIRGeneratorMIPS::visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins)

--- a/js/src/jsapi-tests/testJitRangeAnalysis.cpp
+++ b/js/src/jsapi-tests/testJitRangeAnalysis.cpp
@@ -122,16 +122,17 @@ BEGIN_TEST(testJitRangeAnalysis_MathSign
     // if (p < 0)
     MParameter *p = func.createParameter();
     entry->add(p);
     MConstant *c0 = MConstant::New(func.alloc, DoubleValue(0.0));
     entry->add(c0);
     MConstant *cm0 = MConstant::New(func.alloc, DoubleValue(-0.0));
     entry->add(cm0);
     MCompare *cmp = MCompare::New(func.alloc, p, c0, JSOP_LT);
+    cmp->setCompareType(MCompare::Compare_Double);
     entry->add(cmp);
     entry->end(MTest::New(func.alloc, cmp, thenBlock, elseBlock));
 
     // {
     //   return Math.sign(p + -0);
     // }
     MAdd *thenAdd = MAdd::NewAsmJS(func.alloc, p, cm0, MIRType_Double);
     thenBlock->add(thenAdd);
@@ -139,16 +140,17 @@ BEGIN_TEST(testJitRangeAnalysis_MathSign
     thenBlock->add(thenSign);
     MReturn *thenRet = MReturn::New(func.alloc, thenSign);
     thenBlock->end(thenRet);
 
     // else
     // {
     //   if (p >= 0)
     MCompare *elseCmp = MCompare::New(func.alloc, p, c0, JSOP_GE);
+    elseCmp->setCompareType(MCompare::Compare_Double);
     elseBlock->add(elseCmp);
     elseBlock->end(MTest::New(func.alloc, elseCmp, elseThenBlock, elseElseBlock));
 
     //   {
     //     return Math.sign(p + -0);
     //   }
     MAdd *elseThenAdd = MAdd::NewAsmJS(func.alloc, p, cm0, MIRType_Double);
     elseThenBlock->add(elseThenAdd);

deleted file mode 100644
--- a/js/src/tests/ecma_7/SIMD/coercions.js
+++ /dev/null
@@ -1,66 +0,0 @@
-// |reftest| skip-if(!this.hasOwnProperty("SIMD"))
-var BUGNUMBER = 1061229;
-var float32x4 = SIMD.float32x4;
-var int32x4 = SIMD.int32x4;
-var {StructType, int32} = TypedObject;
-var summary = 'constructors used as coercions';
-
-/*
- * Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/licenses/publicdomain/
- */
-
-function assertCaught(f) {
-    var caught = false;
-    var args = Array.slice(arguments, 1);
-    try {
-        f.apply(null, args);
-    } catch (e) {
-        caught = true;
-        print(e)
-    }
-    assertEq(caught, true);
-}
-
-function test() {
-    var x = int32x4(1, 2, 3, 4);
-    var y = int32x4(x);
-
-    assertEq(x, y);
-
-    assertEq(y.x, x.x);
-    assertEq(y.x, 1);
-    assertEq(y.y, x.y);
-    assertEq(y.y, 2);
-    assertEq(y.z, x.z);
-    assertEq(y.z, 3);
-    assertEq(y.w, x.w);
-    assertEq(y.w, 4);
-
-    assertCaught(int32x4, 3);
-    assertCaught(int32x4, float32x4(1, 2, 3, 4));
-    assertCaught(int32x4, 'pony x 4');
-
-    var x = float32x4(NaN, 13.37, -Infinity, 4);
-    var y = float32x4(x);
-
-    assertEq(x, y);
-
-    assertEq(y.x, x.x);
-    assertEq(y.x, Math.fround(NaN));
-    assertEq(y.y, x.y);
-    assertEq(y.y, Math.fround(13.37));
-    assertEq(y.z, x.z);
-    assertEq(y.z, Math.fround(-Infinity));
-    assertEq(y.w, x.w);
-    assertEq(y.w, Math.fround(4));
-
-    assertCaught(float32x4, 3);
-    assertCaught(float32x4, int32x4(1, 2, 3, 4));
-    assertCaught(float32x4, 'pony x 4');
-
-    if (typeof reportCompare === "function")
-        reportCompare(true, true);
-}
-
-test();

new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_7/SIMD/constructors.js
@@ -0,0 +1,66 @@
+// |reftest| skip-if(!this.hasOwnProperty("SIMD"))
+
+var float32x4 = SIMD.float32x4;
+var int32x4 = SIMD.int32x4;
+
+function test() {
+
+    // Constructors.
+    assertEqX4(int32x4(1, 2, 3, 4),         [1,2,3,4]);
+    assertEqX4(int32x4(1, 2, 3),            [1,2,3,0]);
+    assertEqX4(int32x4(1, 2),               [1,2,0,0]);
+    // The 1-argument form is reserved for coercions.
+    assertEqX4(int32x4(),                   [0,0,0,0]);
+    assertEqX4(int32x4(1, 2, 3, 4, 5),      [1,2,3,4]);
+    assertEqX4(int32x4(1, 2, 3, 4, 5, 6),   [1,2,3,4]);
+
+    assertEqX4(float32x4(1, 2, 3, 4),       [1,2,3,4]);
+    assertEqX4(float32x4(1, 2, 3),          [1,2,3,NaN]);
+    assertEqX4(float32x4(1, 2),             [1,2,NaN,NaN]);
+    // The 1-argument form is reserved for coercions.
+    assertEqX4(float32x4(),                 [NaN,NaN,NaN,NaN]);
+    assertEqX4(float32x4(1, 2, 3, 4, 5),    [1,2,3,4]);
+    assertEqX4(float32x4(1, 2, 3, 4, 5, 6), [1,2,3,4]);
+
+    // Constructors used as coercion.
+    var x = int32x4(1, 2, 3, 4);
+    var y = int32x4(x);
+
+    assertEq(x, y);
+
+    assertEq(y.x, x.x);
+    assertEq(y.x, 1);
+    assertEq(y.y, x.y);
+    assertEq(y.y, 2);
+    assertEq(y.z, x.z);
+    assertEq(y.z, 3);
+    assertEq(y.w, x.w);
+    assertEq(y.w, 4);
+
+    assertThrowsInstanceOf(() => int32x4(3), TypeError);
+    assertThrowsInstanceOf(() => int32x4(float32x4(1,2,3,4)), TypeError);
+    assertThrowsInstanceOf(() => int32x4('pony x 4'), TypeError);
+
+    var x = float32x4(NaN, 13.37, -Infinity, 4);
+    var y = float32x4(x);
+
+    assertEq(x, y);
+
+    assertEq(y.x, x.x);
+    assertEq(y.x, Math.fround(NaN));
+    assertEq(y.y, x.y);
+    assertEq(y.y, Math.fround(13.37));
+    assertEq(y.z, x.z);
+    assertEq(y.z, Math.fround(-Infinity));
+    assertEq(y.w, x.w);
+    assertEq(y.w, Math.fround(4));
+
+    assertThrowsInstanceOf(() => float32x4(3), TypeError);
+    assertThrowsInstanceOf(() => float32x4(int32x4(1,2,3,4)), TypeError);
+    assertThrowsInstanceOf(() => float32x4('pony x 4'), TypeError);
+
+    if (typeof reportCompare === "function")
+        reportCompare(true, true);
+}
+
+test();

new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_7/SIMD/signmask.js
@@ -0,0 +1,33 @@
+// |reftest| skip-if(!this.hasOwnProperty("SIMD"))
+
+var float32x4 = SIMD.float32x4;
+var int32x4 = SIMD.int32x4;
+
+function test_float32x4() {
+  var v, w;
+  for ([v, w] of [[float32x4(-1, 20, 30, 4), 0b0001],
+                  [float32x4(9.999, 2.1234, 30.4443, -4), 0b1000],
+                  [float32x4(0, -Infinity, +Infinity, -0), 0b1010]])
+  {
+      assertEq(v.signMask, w);
+  }
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+}
+
+function test_int32x4() {
+  var v, w;
+  for ([v, w] of [[int32x4(-1, 20, 30, 4), 0b0001],
+                  [int32x4(10, 2, 30.2, -4), 0b1000],
+                  [int32x4(0, 0x80000000, 0x7fffffff, -0), 0b0010]])
+  {
+      assertEq(v.signMask, w);
+  }
+
+  if (typeof reportCompare === "function")
+    reportCompare(true, true);
+}
+
+test_float32x4();
+test_int32x4();

new file mode 100644
--- /dev/null
+++ b/layout/generic/RubyUtils.cpp
@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "RubyUtils.h"
+#include "nsIFrame.h"
+
+using namespace mozilla;
+
+NS_DECLARE_FRAME_PROPERTY(ReservedISize, nullptr);
+
+union NSCoordValue
+{
+  nscoord mCoord;
+  void* mPointer;
+  static_assert(sizeof(nscoord) <= sizeof(void*),
+                "Cannot store nscoord in pointer");
+};
+
+/* static */ void
+RubyUtils::SetReservedISize(nsIFrame* aFrame, nscoord aISize)
+{
+  MOZ_ASSERT(IsExpandableRubyBox(aFrame));
+  NSCoordValue value = { aISize };
+  aFrame->Properties().Set(ReservedISize(), value.mPointer);
+}
+
+/* static */ void
+RubyUtils::ClearReservedISize(nsIFrame* aFrame)
+{
+  MOZ_ASSERT(IsExpandableRubyBox(aFrame));
+  aFrame->Properties().Remove(ReservedISize());
+}
+
+/* static */ nscoord
+RubyUtils::GetReservedISize(nsIFrame* aFrame)
+{
+  MOZ_ASSERT(IsExpandableRubyBox(aFrame));
+  NSCoordValue value;
+  value.mPointer = aFrame->Properties().Get(ReservedISize());
+  return value.mCoord;
+}

new file mode 100644
--- /dev/null
+++ b/layout/generic/RubyUtils.h
@@ -0,0 +1,63 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_RubyUtils_h_
+#define mozilla_RubyUtils_h_
+
+#include "nsGkAtoms.h"
+#include "nsIFrame.h"
+
+namespace mozilla {
+
+/**
+ * Reserved ISize
+ *
+ * With some exceptions, each ruby internal box has two isizes, which
+ * are the reflowed isize and the final isize. The reflowed isize is
+ * what a box itself needs. It is determined when the box gets reflowed.
+ *
+ * The final isize is what a box should be as the final result. For a
+ * ruby base/text box, the final isize is the size of its ruby column.
+ * For a ruby base/text container, the final isize is the size of its
+ * ruby segment. The final isize is never smaller than the reflowed
+ * isize. It is initially determined when a ruby column/segment gets
+ * fully reflowed, and may be advanced when a box is expanded, e.g.
+ * for justification.
+ *
+ * The difference between the reflowed isize and the final isize is
+ * reserved in the line layout after reflowing a box, hence it is called
+ * "Reserved ISize" here. It is used to expand the ruby boxes from their
+ * reflowed isize to the final isize during alignment of the line.
+ *
+ * There are three exceptions for the final isize:
+ * 1. A ruby text container has a larger final isize only if it is for
+ *    a span or collapsed annotations.
+ * 2. A ruby base container has a larger final isize only if at least
+ *    one of its ruby text containers does.
+ * 3. If a ruby text container has a larger final isize, its children
+ *    must not have.
+ */
+
+class RubyUtils
+{
+public:
+  static inline bool IsExpandableRubyBox(nsIFrame* aFrame)
+  {
+    nsIAtom* type = aFrame->GetType();
+    return type == nsGkAtoms::rubyBaseFrame ||
+           type == nsGkAtoms::rubyTextFrame ||
+           type == nsGkAtoms::rubyBaseContainerFrame ||
+           type == nsGkAtoms::rubyTextContainerFrame;
+  }
+
+  static void SetReservedISize(nsIFrame* aFrame, nscoord aISize);
+  static void ClearReservedISize(nsIFrame* aFrame);
+  static nscoord GetReservedISize(nsIFrame* aFrame);
+};
+
+}
+
+#endif /* !defined(mozilla_RubyUtils_h_) */

--- a/layout/generic/moz.build
+++ b/layout/generic/moz.build
@@ -89,16 +89,17 @@ UNIFIED_SOURCES += [
     'nsSimplePageSequenceFrame.cpp',
     'nsSplittableFrame.cpp',
     'nsSubDocumentFrame.cpp',
     'nsTextFrame.cpp',
     'nsTextFrameUtils.cpp',
     'nsTextRunTransformations.cpp',
     'nsVideoFrame.cpp',
     'nsViewportFrame.cpp',
+    'RubyUtils.cpp',
     'ScrollbarActivity.cpp',
     'StickyScrollContainer.cpp',
     'TextOverflow.cpp',
 ]
 
 # nsLineLayout.cpp needs to be built separately because it uses plarena.h.
 # nsPluginFrame.cpp needs to be built separately because of name clashes in the OS X headers.
 SOURCES += [

--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -757,18 +757,22 @@ public:
   /**
    * Return frame's position without relative positioning
    */
   nsPoint GetNormalPosition() const;
   mozilla::LogicalPoint
   GetLogicalNormalPosition(mozilla::WritingMode aWritingMode,
                            nscoord aContainerWidth) const
   {
+    // Subtract the width of this frame from the container width to get
+    // the correct position in rtl frames where the origin is on the
+    // right instead of the left
     return mozilla::LogicalPoint(aWritingMode,
-                                 GetNormalPosition(), aContainerWidth);
+                                 GetNormalPosition(),
+                                 aContainerWidth - mRect.width);
   }
 
   virtual nsPoint GetPositionOfChildIgnoringScrolling(nsIFrame* aChild)
   { return aChild->GetPosition(); }
   
   nsPoint GetPositionIgnoringScrolling();
 
   static void DestroyRegion(void* aPropertyValue);

--- a/layout/generic/nsLineLayout.cpp
+++ b/layout/generic/nsLineLayout.cpp
@@ -19,16 +19,17 @@
 #include "nsStyleContext.h"
 #include "nsPresContext.h"
 #include "nsGkAtoms.h"
 #include "nsIContent.h"
 #include "nsLayoutUtils.h"
 #include "nsTextFrame.h"
 #include "nsStyleStructInlines.h"
 #include "nsBidiPresUtils.h"
+#include "RubyUtils.h"
 #include <algorithm>
 
 #ifdef DEBUG
 #undef  NOISY_INLINEDIR_ALIGN
 #undef  NOISY_BLOCKDIR_ALIGN
 #undef  REALLY_NOISY_BLOCKDIR_ALIGN
 #undef  NOISY_REFLOW
 #undef  REALLY_NOISY_REFLOW
@@ -72,17 +73,18 @@ nsLineLayout::nsLineLayout(nsPresContext
     mLineIsEmpty(false),
     mLineEndsInBR(false),
     mNeedBackup(false),
     mInFirstLine(false),
     mGotLineBox(false),
     mInFirstLetter(false),
     mHasBullet(false),
     mDirtyNextLine(false),
-    mLineAtStart(false)
+    mLineAtStart(false),
+    mHasRuby(false)
 {
   MOZ_ASSERT(aOuterReflowState, "aOuterReflowState must not be null");
   NS_ASSERTION(aFloatManager || aOuterReflowState->frame->GetType() ==
                                   nsGkAtoms::letterFrame,
                "float manager should be present");
   MOZ_COUNT_CTOR(nsLineLayout);
 
   // Stash away some style data that we need
@@ -91,16 +93,19 @@ nsLineLayout::nsLineLayout(nsPresContext
     mStyleText = blockFrame->StyleTextForLineLayout();
   else
     mStyleText = aOuterReflowState->frame->StyleText();
 
   mLineNumber = 0;
   mTotalPlacedFrames = 0;
   mBStartEdge = 0;
   mTrimmableISize = 0;
+#ifdef DEBUG
+  mFinalLineBSize = nscoord_MIN;
+#endif
 
   mInflationMinFontSize =
     nsLayoutUtils::InflationMinFontSizeFor(aOuterReflowState->frame);
 
   // Instead of always pre-initializing the free-lists for frames and
   // spans, we do it on demand so that situations that only use a few
   // frames and spans won't waste a lot of time in unneeded
   // initialization.
@@ -188,21 +193,16 @@ nsLineLayout::BeginLineReflow(nscoord aI
   PerSpanData* psd = NewPerSpanData();
   mCurrentSpan = mRootSpan = psd;
   psd->mReflowState = mBlockReflowState;
   psd->mIStart = aICoord;
   psd->mICoord = aICoord;
   psd->mIEnd = aICoord + aISize;
   mContainerWidth = aContainerWidth;
 
-  PerFrameData* pfd = NewPerFrameData(mBlockReflowState->frame);
-  pfd->mAscent = 0;
-  pfd->mSpan = psd;
-  psd->mFrame = pfd;
-
   // If we're in a constrained height frame, then we don't allow a
   // max line box width to take effect.
   if (!(LineContainerFrame()->GetStateBits() &
         NS_FRAME_IN_CONSTRAINED_HEIGHT)) {
 
     // If the available size is greater than the maximum line box width (if
     // specified), then we need to adjust the line box width to be at the max
     // possible width.
@@ -236,16 +236,21 @@ nsLineLayout::BeginLineReflow(nscoord aI
       }
     }
     nscoord indent = nsRuleNode::ComputeCoordPercentCalc(textIndent, pctBasis);
 
     mTextIndent = indent;
 
     psd->mICoord += indent;
   }
+
+  PerFrameData* pfd = NewPerFrameData(mBlockReflowState->frame);
+  pfd->mAscent = 0;
+  pfd->mSpan = psd;
+  psd->mFrame = pfd;
 }
 
 void
 nsLineLayout::EndLineReflow()
 {
 #ifdef NOISY_REFLOW
   nsFrame::ListTag(stdout, mBlockReflowState->frame);
   printf(": EndLineReflow: width=%d\n", mRootSpan->mICoord - mRootSpan->mIStart);
@@ -461,22 +466,22 @@ nsLineLayout::EndSpan(nsIFrame* aFrame)
 void
 nsLineLayout::AttachFrameToBaseLineLayout(PerFrameData* aFrame)
 {
   NS_PRECONDITION(this != mBaseLineLayout,
                   "This method must not be called in a base line layout.");
 
   PerFrameData* baseFrame = mBaseLineLayout->LastFrame();
   MOZ_ASSERT(aFrame && baseFrame);
-  MOZ_ASSERT(!aFrame->GetFlag(PFD_ISLINKEDTOBASE),
+  MOZ_ASSERT(!aFrame->mIsLinkedToBase,
              "The frame must not have been linked with the base");
 
   aFrame->mNextAnnotation = baseFrame->mNextAnnotation;
   baseFrame->mNextAnnotation = aFrame;
-  aFrame->SetFlag(PFD_ISLINKEDTOBASE, true);
+  aFrame->mIsLinkedToBase = true;
 }
 
 int32_t
 nsLineLayout::GetCurrentSpanCount() const
 {
   NS_ASSERTION(mCurrentSpan == mRootSpan, "bad linelayout user");
   int32_t count = 0;
   PerFrameData* pfd = mRootSpan->mFirstFrame;
@@ -554,17 +559,17 @@ nsLineLayout::PushFrame(nsIFrame* aFrame
 #endif
 }
 
 void
 nsLineLayout::UnlinkFrame(PerFrameData* pfd)
 {
   while (nullptr != pfd) {
     PerFrameData* next = pfd->mNext;
-    if (pfd->GetFlag(PFD_ISLINKEDTOBASE)) {
+    if (pfd->mIsLinkedToBase) {
       // This frame is linked to a ruby base, and should not be freed
       // now. Just unlink it from the span. It will be freed when its
       // base frame gets unlinked.
       pfd->mNext = pfd->mPrev = nullptr;
       pfd = next;
       continue;
     }
 
@@ -641,19 +646,30 @@ nsLineLayout::NewPerFrameData(nsIFrame* 
   }
   else {
     mBaseLineLayout->mFrameFreeList = pfd->mNext;
   }
   pfd->mSpan = nullptr;
   pfd->mNext = nullptr;
   pfd->mPrev = nullptr;
   pfd->mNextAnnotation = nullptr;
-  pfd->mFlags = 0;  // all flags default to false
   pfd->mFrame = aFrame;
 
+  // all flags default to false
+  pfd->mRelativePos = false;
+  pfd->mIsTextFrame = false;
+  pfd->mIsNonEmptyTextFrame = false;
+  pfd->mIsNonWhitespaceTextFrame = false;
+  pfd->mIsLetterFrame = false;
+  pfd->mRecomputeOverflow = false;
+  pfd->mIsBullet = false;
+  pfd->mSkipWhenTrimmingWhitespace = false;
+  pfd->mIsEmpty = false;
+  pfd->mIsLinkedToBase = false;
+
   WritingMode frameWM = aFrame->GetWritingMode();
   WritingMode lineWM = mRootSpan->mWritingMode;
   pfd->mBounds = LogicalRect(lineWM);
   pfd->mMargin = LogicalMargin(lineWM);
   pfd->mBorderPadding = LogicalMargin(lineWM);
   pfd->mOffsets = LogicalMargin(frameWM);
 
   pfd->mJustificationInfo = JustificationInfo();
@@ -851,19 +867,19 @@ nsLineLayout::ReflowFrame(nsIFrame* aFra
     if (reflowState.ComputedISize() == NS_UNCONSTRAINEDSIZE) {
       reflowState.AvailableISize() = availableSpaceOnLine;
     }
     WritingMode stateWM = reflowState.GetWritingMode();
     pfd->mMargin =
       reflowState.ComputedLogicalMargin().ConvertTo(lineWM, stateWM);
     pfd->mBorderPadding =
       reflowState.ComputedLogicalBorderPadding().ConvertTo(lineWM, stateWM);
-    pfd->SetFlag(PFD_RELATIVEPOS,
-                 reflowState.mStyleDisplay->IsRelativelyPositionedStyle());
-    if (pfd->GetFlag(PFD_RELATIVEPOS)) {
+    pfd->mRelativePos =
+      reflowState.mStyleDisplay->IsRelativelyPositionedStyle();
+    if (pfd->mRelativePos) {
       pfd->mOffsets =
         reflowState.ComputedLogicalOffsets().ConvertTo(frameWM, stateWM);
     }
 
     // Calculate whether the the frame should have a start margin and
     // subtract the margin from the available width if necessary.
     // The margin will be applied to the starting inline coordinates of
     // the frame in CanPlaceFrame() after reflowing the frame.
@@ -907,28 +923,29 @@ nsLineLayout::ReflowFrame(nsIFrame* aFra
     aFrame->Reflow(mPresContext, metrics, *reflowStateHolder, aReflowStatus);
   } else {
     static_cast<nsTextFrame*>(aFrame)->
       ReflowText(*this, availableSpaceOnLine, psd->mReflowState->rendContext,
                  metrics, aReflowStatus);
   }
 
   pfd->mJustificationInfo = mJustificationInfo;
+  mJustificationInfo = JustificationInfo();
 
   // See if the frame is a placeholderFrame and if it is process
   // the float. At the same time, check if the frame has any non-collapsed-away
   // content.
   bool placedFloat = false;
   bool isEmpty;
   if (!frameType) {
     isEmpty = pfd->mFrame->IsEmpty();
   } else {
     if (nsGkAtoms::placeholderFrame == frameType) {
       isEmpty = true;
-      pfd->SetFlag(PFD_SKIPWHENTRIMMINGWHITESPACE, true);
+      pfd->mSkipWhenTrimmingWhitespace = true;
       nsIFrame* outOfFlowFrame = nsLayoutUtils::GetFloatFromPlaceholder(aFrame);
       if (outOfFlowFrame) {
         // Add mTrimmableISize to the available width since if the line ends
         // here, the width of the inline content will be reduced by
         // mTrimmableISize.
         nscoord availableISize = psd->mIEnd - (psd->mICoord - mTrimmableISize);
         if (psd->mNoWrap) {
           // If we place floats after inline content where there's
@@ -945,45 +962,44 @@ nsLineLayout::ReflowFrame(nsIFrame* aFra
         placedFloat = mBaseLineLayout->AddFloat(outOfFlowFrame, availableISize);
         NS_ASSERTION(!(outOfFlowFrame->GetType() == nsGkAtoms::letterFrame &&
                        GetFirstLetterStyleOK()),
                     "FirstLetterStyle set on line with floating first letter");
       }
     }
     else if (isText) {
       // Note non-empty text-frames for inline frame compatibility hackery
-      pfd->SetFlag(PFD_ISTEXTFRAME, true);
+      pfd->mIsTextFrame = true;
       nsTextFrame* textFrame = static_cast<nsTextFrame*>(pfd->mFrame);
       isEmpty = !textFrame->HasNoncollapsedCharacters();
       if (!isEmpty) {
-        pfd->SetFlag(PFD_ISNONEMPTYTEXTFRAME, true);
+        pfd->mIsNonEmptyTextFrame = true;
         nsIContent* content = textFrame->GetContent();
 
         const nsTextFragment* frag = content->GetText();
         if (frag) {
-          pfd->SetFlag(PFD_ISNONWHITESPACETEXTFRAME,
-                       !content->TextIsOnlyWhitespace());
+          pfd->mIsNonWhitespaceTextFrame = !content->TextIsOnlyWhitespace();
         }
       }
     }
     else if (nsGkAtoms::brFrame == frameType) {
-      pfd->SetFlag(PFD_SKIPWHENTRIMMINGWHITESPACE, true);
+      pfd->mSkipWhenTrimmingWhitespace = true;
       isEmpty = false;
     } else {
       if (nsGkAtoms::letterFrame==frameType) {
-        pfd->SetFlag(PFD_ISLETTERFRAME, true);
+        pfd->mIsLetterFrame = true;
       }
       if (pfd->mSpan) {
         isEmpty = !pfd->mSpan->mHasNonemptyContent && pfd->mFrame->IsSelfEmpty();
       } else {
         isEmpty = pfd->mFrame->IsEmpty();
       }
     }
   }
-  pfd->SetFlag(PFD_ISEMPTY, isEmpty);
+  pfd->mIsEmpty = isEmpty;
 
   mFloatManager->Untranslate(oldWM, tPt);
 
   NS_ASSERTION(metrics.ISize(lineWM) >= 0, "bad inline size");
   NS_ASSERTION(metrics.BSize(lineWM) >= 0,"bad block size");
   if (metrics.ISize(lineWM) < 0) {
     metrics.ISize(lineWM) = 0;
   }
@@ -1048,17 +1064,17 @@ nsLineLayout::ReflowFrame(nsIFrame* aFra
       }
     }
 
     // Check whether this frame breaks up text runs. All frames break up text
     // runs (hence return false here) except for text frames and inline containers.
     bool continuingTextRun = aFrame->CanContinueTextRun();
     
     // Clear any residual mTrimmableISize if this isn't a text frame
-    if (!continuingTextRun && !pfd->GetFlag(PFD_SKIPWHENTRIMMINGWHITESPACE)) {
+    if (!continuingTextRun && !pfd->mSkipWhenTrimmingWhitespace) {
       mTrimmableISize = 0;
     }
 
     // See if we can place the frame. If we can't fit it, then we
     // return now.
     bool optionalBreakAfterFits;
     NS_ASSERTION(isText ||
                  !reflowStateHolder->IsFloating(),
@@ -1069,16 +1085,19 @@ nsLineLayout::ReflowFrame(nsIFrame* aFra
                       aReflowStatus, &optionalBreakAfterFits)) {
       if (!isEmpty) {
         psd->mHasNonemptyContent = true;
         mLineIsEmpty = false;
         if (!pfd->mSpan) {
           // nonempty leaf content has been placed
           mLineAtStart = false;
         }
+        if (nsGkAtoms::rubyFrame == frameType) {
+          mHasRuby = true;
+        }
       }
 
       // Place the frame, updating aBounds with the final size and
       // location.  Then apply the bottom+right margins (as
       // appropriate) to the frame.
       PlaceFrame(pfd, metrics);
       PerSpanData* span = pfd->mSpan;
       if (span) {
@@ -1215,17 +1234,17 @@ nsLineLayout::CanPlaceFrame(PerFrameData
    * However, none of that applies if this is a letter frame (XXXbz why?)
    *
    * For box-decoration-break:clone we apply the end margin on all
    * continuations (that are not letter frames).
    */
   if ((NS_FRAME_IS_NOT_COMPLETE(aStatus) ||
        pfd->mFrame->LastInFlow()->GetNextContinuation() ||
        pfd->mFrame->FrameIsNonLastInIBSplit()) &&
-      !pfd->GetFlag(PFD_ISLETTERFRAME) &&
+      !pfd->mIsLetterFrame &&
       pfd->mFrame->StyleBorder()->mBoxDecorationBreak ==
         NS_STYLE_BOX_DECORATION_BREAK_SLICE) {
     pfd->mMargin.IEnd(lineWM) = 0;
   }
 
   // Apply the start margin to the frame bounds.
   nscoord startMargin = pfd->mMargin.IStart(lineWM);
   nscoord endMargin = pfd->mMargin.IEnd(lineWM);
@@ -1390,17 +1409,17 @@ nsLineLayout::AddBulletFrame(nsIFrame* a
   if (!static_cast<nsBlockFrame*>(blockFrame)->BulletIsEmpty()) {
     mHasBullet = true;
     mLineBox->SetHasBullet();
   }
 
   WritingMode lineWM = mRootSpan->mWritingMode;
   PerFrameData* pfd = NewPerFrameData(aFrame);
   mRootSpan->AppendFrame(pfd);
-  pfd->SetFlag(PFD_ISBULLET, true);
+  pfd->mIsBullet = true;
   if (aMetrics.BlockStartAscent() == nsHTMLReflowMetrics::ASK_FOR_BASELINE) {
     pfd->mAscent = aFrame->GetLogicalBaseline(lineWM);
   } else {
     pfd->mAscent = aMetrics.BlockStartAscent();
   }
 
   // Note: block-coord value will be updated during block-direction alignment
   pfd->mBounds = LogicalRect(lineWM, aFrame->GetRect(), mContainerWidth);
@@ -1508,31 +1527,33 @@ nsLineLayout::VerticalAlignLine()
   for (PerFrameData* pfd = psd->mFirstFrame; pfd; pfd = pfd->mNext) {
     if (pfd->mBlockDirAlign == VALIGN_OTHER) {
       pfd->mBounds.BStart(lineWM) += baselineBCoord;
       pfd->mFrame->SetRect(lineWM, pfd->mBounds, mContainerWidth);
     }
   }
   PlaceTopBottomFrames(psd, -mBStartEdge, lineBSize);
 
-  // Fill in returned line-box and max-element-width data
-  mLineBox->SetBounds(lineWM,
-                      psd->mIStart, mBStartEdge,
-                      psd->mICoord - psd->mIStart, lineBSize,
-                      mContainerWidth);
+  mFinalLineBSize = lineBSize;
+  if (mGotLineBox) {
+    // Fill in returned line-box and max-element-width data
+    mLineBox->SetBounds(lineWM,
+                        psd->mIStart, mBStartEdge,
+                        psd->mICoord - psd->mIStart, lineBSize,
+                        mContainerWidth);
 
-  mFinalLineBSize = lineBSize;
-  mLineBox->SetLogicalAscent(baselineBCoord - mBStartEdge);
+    mLineBox->SetLogicalAscent(baselineBCoord - mBStartEdge);
 #ifdef NOISY_BLOCKDIR_ALIGN
-  printf(
-    "  [line]==> bounds{x,y,w,h}={%d,%d,%d,%d} lh=%d a=%d\n",
-    mLineBox->GetBounds().IStart(lineWM), mLineBox->GetBounds().BStart(lineWM),
-    mLineBox->GetBounds().ISize(lineWM), mLineBox->GetBounds().BSize(lineWM),
-    mFinalLineBSize, mLineBox->GetLogicalAscent());
+    printf(
+      "  [line]==> bounds{x,y,w,h}={%d,%d,%d,%d} lh=%d a=%d\n",
+      mLineBox->GetBounds().IStart(lineWM), mLineBox->GetBounds().BStart(lineWM),
+      mLineBox->GetBounds().ISize(lineWM), mLineBox->GetBounds().BSize(lineWM),
+      mFinalLineBSize, mLineBox->GetLogicalAscent());
 #endif
+  }
 }
 
 // Place frames with CSS property vertical-align: top or bottom.
 void
 nsLineLayout::PlaceTopBottomFrames(PerSpanData* psd,
                                    nscoord aDistanceFromStart,
                                    nscoord aLineBSize)
 {
@@ -1709,18 +1730,18 @@ nsLineLayout::VerticalAlignFrames(PerSpa
 
     // We shouldn't include any whitespace that collapses, unless we're
     // preformatted (in which case it shouldn't, but the width=0 test is
     // perhaps incorrect).  This includes whitespace at the beginning of
     // a line and whitespace preceded (?) by other whitespace.
     // See bug 134580 and bug 155333.
     zeroEffectiveSpanBox = true;
     for (PerFrameData* pfd = psd->mFirstFrame; pfd; pfd = pfd->mNext) {
-      if (pfd->GetFlag(PFD_ISTEXTFRAME) &&
-          (pfd->GetFlag(PFD_ISNONWHITESPACETEXTFRAME) || preMode ||
+      if (pfd->mIsTextFrame &&
+          (pfd->mIsNonWhitespaceTextFrame || preMode ||
            pfd->mBounds.ISize(mRootSpan->mWritingMode) != 0)) {
         zeroEffectiveSpanBox = false;
         break;
       }
     }
   }
   psd->mZeroEffectiveSpanBox = zeroEffectiveSpanBox;
 
@@ -1754,17 +1775,17 @@ nsLineLayout::VerticalAlignFrames(PerSpa
       CalcLineHeight(spanFrame->GetContent(), spanFrame->StyleContext(),
                      mBlockReflowState->ComputedHeight(),
                      inflation);
     nscoord contentBSize = spanFramePFD->mBounds.BSize(lineWM) -
       spanFramePFD->mBorderPadding.BStartEnd(lineWM);
 
     // Special-case for a ::first-letter frame, set the line height to
     // the frame block size if the user has left line-height == normal
-    if (spanFramePFD->GetFlag(PFD_ISLETTERFRAME) &&
+    if (spanFramePFD->mIsLetterFrame &&
         !spanFrame->GetPrevInFlow() &&
         spanFrame->StyleText()->mLineHeight.GetUnit() == eStyleUnit_Normal) {
       logicalBSize = spanFramePFD->mBounds.BSize(lineWM);
     }
 
     nscoord leading = logicalBSize - contentBSize;
     psd->mBStartLeading = leading / 2;
     psd->mBEndLeading = leading - psd->mBStartLeading;
@@ -2064,21 +2085,21 @@ nsLineLayout::VerticalAlignFrames(PerSpa
       //        -- Note #1: With this code enabled and with the fact that we are not
       //           using Em[Ascent|Descent] as nsDimensions for text metrics in
       //           GFX mean that the discussion in bug 13072 cannot hold.
       //        -- Note #2: We still don't want empty-text frames to interfere.
       //           For example in quirks mode, avoiding empty text frames prevents
       //           "tall" lines around elements like <hr> since the rules of <hr>
       //           in quirks.css have pseudo text contents with LF in them.
 #if 0
-      if (!pfd->GetFlag(PFD_ISTEXTFRAME)) {
+      if (!pfd->mIsTextFrame) {
 #else
       // Only consider non empty text frames when line-height=normal
-      bool canUpdate = !pfd->GetFlag(PFD_ISTEXTFRAME);
-      if (!canUpdate && pfd->GetFlag(PFD_ISNONWHITESPACETEXTFRAME)) {
+      bool canUpdate = !pfd->mIsTextFrame;
+      if (!canUpdate && pfd->mIsNonWhitespaceTextFrame) {
         canUpdate =
           frame->StyleText()->mLineHeight.GetUnit() == eStyleUnit_Normal;
       }
       if (canUpdate) {
 #endif
         nscoord blockStart, blockEnd;
         if (frameSpan) {
           // For spans that were are now placing, use their position
@@ -2133,17 +2154,18 @@ nsLineLayout::VerticalAlignFrames(PerSpa
     //      is handled by mZeroEffectiveSpanBox
     //  (2) if this line has a bullet
     //  (3) if this is the last line of an LI, DT, or DD element
     //      (The last line before a block also counts, but not before a
     //      BR) (NN4/IE5 quirk)
 
     // (1) and (2) above
     bool applyMinLH = !psd->mZeroEffectiveSpanBox || mHasBullet;
-    bool isLastLine = (!mLineBox->IsLineWrapped() && !mLineEndsInBR);
+    bool isLastLine = !mGotLineBox ||
+      (!mLineBox->IsLineWrapped() && !mLineEndsInBR);
     if (!applyMinLH && isLastLine) {
       nsIContent* blockContent = mRootSpan->mFrame->mFrame->GetContent();
       if (blockContent) {
         nsIAtom *blockTagAtom = blockContent->Tag();
         // (3) above, if the last line of LI, DT, or DD
         if (blockTagAtom == nsGkAtoms::li ||
             blockTagAtom == nsGkAtoms::dt ||
             blockTagAtom == nsGkAtoms::dd) {
@@ -2383,38 +2405,37 @@ nsLineLayout::TrimTrailingWhiteSpaceIn(P
               // will be run after this method.
               SlideSpanFrameRect(pfd->mFrame, deltaISize);
             }
           }
         }
         return true;
       }
     }
-    else if (!pfd->GetFlag(PFD_ISTEXTFRAME) &&
-             !pfd->GetFlag(PFD_SKIPWHENTRIMMINGWHITESPACE)) {
+    else if (!pfd->mIsTextFrame && !pfd->mSkipWhenTrimmingWhitespace) {
       // If we hit a frame on the end that's not text and not a placeholder,
       // then there is no trailing whitespace to trim. Stop the search.
       *aDeltaISize = 0;
       return true;
     }
-    else if (pfd->GetFlag(PFD_ISTEXTFRAME)) {
+    else if (pfd->mIsTextFrame) {
       // Call TrimTrailingWhiteSpace even on empty textframes because they
       // might have a soft hyphen which should now appear, changing the frame's
       // width
       nsTextFrame::TrimOutput trimOutput = static_cast<nsTextFrame*>(pfd->mFrame)->
           TrimTrailingWhiteSpace(mBlockReflowState->rendContext);
 #ifdef NOISY_TRIM
       nsFrame::ListTag(stdout, psd->mFrame->mFrame);
       printf(": trim of ");
       nsFrame::ListTag(stdout, pfd->mFrame);
       printf(" returned %d\n", trimOutput.mDeltaWidth);
 #endif
 
       if (trimOutput.mChanged) {
-        pfd->SetFlag(PFD_RECOMPUTEOVERFLOW, true);
+        pfd->mRecomputeOverflow = true;
       }
 
       // Delta width not being zero means that
       // there is trimmed space in the frame.
       if (trimOutput.mDeltaWidth) {
         pfd->mBounds.ISize(lineWM) -= trimOutput.mDeltaWidth;
 
         // If any trailing space is trimmed, the justification opportunity
@@ -2446,17 +2467,17 @@ nsLineLayout::TrimTrailingWhiteSpaceIn(P
             // that are direct children of the block will be updated
             // later, however, because the VerticalAlignFrames method
             // will be run after this method.
             SlideSpanFrameRect(pfd->mFrame, trimOutput.mDeltaWidth);
           }
         }
       }
 
-      if (pfd->GetFlag(PFD_ISNONEMPTYTEXTFRAME) || trimOutput.mChanged) {
+      if (pfd->mIsNonEmptyTextFrame || trimOutput.mChanged) {
         // Pass up to caller so they can shrink their span
         *aDeltaISize = trimOutput.mDeltaWidth;
         return true;
       }
     }
     pfd = pfd->mPrev;
   }
 
@@ -2470,92 +2491,154 @@ nsLineLayout::TrimTrailingWhiteSpace()
   PerSpanData* psd = mRootSpan;
   nscoord deltaISize;
   TrimTrailingWhiteSpaceIn(psd, &deltaISize);
   return 0 != deltaISize;
 }
 
 struct nsLineLayout::JustificationComputationState
 {
+  PerFrameData* mFirstParticipant;
   PerFrameData* mLastParticipant;
+  // Whether we are going across a boundary of ruby base, i.e.
+  // entering one, leaving one, or both.
+  bool mCrossingRubyBaseBoundary;
+
+  JustificationComputationState()
+    : mFirstParticipant(nullptr)
+    , mLastParticipant(nullptr)
+    , mCrossingRubyBaseBoundary(false) { }
 };
 
 /**
- * This function returns the total number of
- * expansion opportunities in the given span.
+ * Compute the justification info of the given span, and store the
+ * number of inner opportunities into the frame's justification info.
+ * It returns the number of non-inner opportunities it detects.
  */
 int32_t
 nsLineLayout::ComputeFrameJustification(PerSpanData* aPSD,
                                         JustificationComputationState& aState)
 {
   NS_ASSERTION(aPSD, "null arg");
   NS_ASSERTION(!aState.mLastParticipant || !aState.mLastParticipant->mSpan,
                "Last participant shall always be a leaf frame");
-  int32_t result = 0;
+  bool firstChild = true;
+  int32_t& innerOpportunities =
+    aPSD->mFrame->mJustificationInfo.mInnerOpportunities;
+  MOZ_ASSERT(innerOpportunities == 0,
+             "Justification info should not have been set yet.");
+  int32_t outerOpportunities = 0;
 
   for (PerFrameData* pfd = aPSD->mFirstFrame; pfd; pfd = pfd->mNext) {
     if (!pfd->ParticipatesInJustification()) {
       continue;
     }
 
+    bool isRubyBase = pfd->mFrame->GetType() == nsGkAtoms::rubyBaseFrame;
+    if (isRubyBase) {
+      aState.mCrossingRubyBaseBoundary = true;
+    }
+
+    int extraOpportunities = 0;
     if (pfd->mSpan) {
       PerSpanData* span = pfd->mSpan;
-      result += ComputeFrameJustification(span, aState);
+      extraOpportunities = ComputeFrameJustification(span, aState);
+      innerOpportunities += pfd->mJustificationInfo.mInnerOpportunities;
     } else {
       const auto& info = pfd->mJustificationInfo;
-      if (pfd->GetFlag(PFD_ISTEXTFRAME)) {
-        result += info.mInnerOpportunities;
+      if (pfd->mIsTextFrame) {
+        innerOpportunities += info.mInnerOpportunities;
       }
 
       PerFrameData* prev = aState.mLastParticipant;
-      if (prev) {
+      if (!prev) {
+        aState.mFirstParticipant = pfd;
+      } else {
         auto& assign = pfd->mJustificationAssignment;
         auto& prevAssign = prev->mJustificationAssignment;
         const auto& prevInfo = prev->mJustificationInfo;
 
-        if (info.mIsStartJustifiable || prevInfo.mIsEndJustifiable) {
-          result++;
-          if (!info.mIsStartJustifiable) {
+        if (info.mIsStartJustifiable ||
+            prevInfo.mIsEndJustifiable ||
+            aState.mCrossingRubyBaseBoundary) {
+          extraOpportunities = 1;
+          if (aState.mCrossingRubyBaseBoundary) {
+            // For ruby alignment with value space-around, there is
+            // always an expansion opportunity at the boundary of a ruby
+            // base, and it always generates one gap at each side. If we
+            // don't do it here, the interaction between text align and
+            // and ruby align could be strange.
+            prevAssign.mGapsAtEnd = 1;
+            assign.mGapsAtStart = 1;
+          } else if (!info.mIsStartJustifiable) {
             prevAssign.mGapsAtEnd = 2;
             assign.mGapsAtStart = 0;
           } else if (!prevInfo.mIsEndJustifiable) {
             prevAssign.mGapsAtEnd = 0;
             assign.mGapsAtStart = 2;
           } else {
             prevAssign.mGapsAtEnd = 1;
             assign.mGapsAtStart = 1;
           }
         }
       }
 
       aState.mLastParticipant = pfd;
+      aState.mCrossingRubyBaseBoundary = isRubyBase;
+    }
+
+    if (firstChild) {
+      outerOpportunities = extraOpportunities;
+      firstChild = false;
+    } else {
+      innerOpportunities += extraOpportunities;
     }
   }
 
-  return result;
+  return outerOpportunities;
 }
 
 void
 nsLineLayout::AdvanceAnnotationInlineBounds(PerFrameData* aPFD,
                                             nscoord aContainerWidth,
                                             nscoord aDeltaICoord,
                                             nscoord aDeltaISize)
 {
-  MOZ_ASSERT(aPFD->mFrame->GetType() == nsGkAtoms::rubyTextFrame ||
-             aPFD->mFrame->GetType() == nsGkAtoms::rubyTextContainerFrame);
+  nsIFrame* frame = aPFD->mFrame;
+  nsIAtom* frameType = frame->GetType();
+  MOZ_ASSERT(frameType == nsGkAtoms::rubyTextFrame ||
+             frameType == nsGkAtoms::rubyTextContainerFrame);
   MOZ_ASSERT(aPFD->mSpan, "rt and rtc should have span.");
 
+  PerSpanData* psd = aPFD->mSpan;
   WritingMode lineWM = mRootSpan->mWritingMode;
-  WritingMode frameWM = aPFD->mSpan->mWritingMode;
-  LogicalRect bounds = aPFD->mFrame->GetLogicalRect(aContainerWidth);
-  bounds = bounds.ConvertTo(lineWM, frameWM, aContainerWidth);
+  LogicalRect bounds(lineWM, frame->GetRect(), aContainerWidth);
   bounds.IStart(lineWM) += aDeltaICoord;
-  bounds.ISize(lineWM) += aDeltaISize;
-  aPFD->mBounds = bounds.ConvertTo(frameWM, lineWM, aContainerWidth);
-  aPFD->mFrame->SetRect(frameWM, aPFD->mBounds, aContainerWidth);
+
+  // Check whether this expansion should be counted into the reserved
+  // isize or not. When it is a ruby text container, and it has some
+  // children linked to the base, it must not have reserved isize,
+  // or its children won't align with their bases.  Otherwise, this
+  // expansion should be reserved.  There are two cases a ruby text
+  // container does not have children linked to the base:
+  // 1. it is a container for span; 2. its children are collapsed.
+  // See bug 1055674 for the second case.
+  if (frameType == nsGkAtoms::rubyTextFrame ||
+      // This ruby text container is a span.
+      (psd->mFirstFrame == psd->mLastFrame && psd->mFirstFrame &&
+       !psd->mFirstFrame->mIsLinkedToBase)) {
+    nscoord reservedISize = RubyUtils::GetReservedISize(frame);
+    RubyUtils::SetReservedISize(frame, reservedISize + aDeltaISize);
+  } else {
+    // It is a normal ruby text container. Its children will expand
+    // themselves properly. We only need to expand its own size here.
+    bounds.ISize(lineWM) += aDeltaISize;
+  }
+  aPFD->mBounds = bounds;
+  aPFD->mFrame->SetRect(lineWM, bounds, aContainerWidth);
 }
 
 /**
  * This function applies the changes of icoord and isize caused by
  * justification to annotations of the given frame.
  * aPFD must be one of the frames in aContainingSpan.
  */
 void
@@ -2573,17 +2656,17 @@ nsLineLayout::ApplyLineJustificationToAn
     // There are two cases where an annotation frame has siblings which
     // do not attached to a ruby base-level frame:
     // 1. there's an intra-annotation whitespace which has no intra-base
     //    white-space to pair with;
     // 2. there are not enough ruby bases to be paired with annotations.
     // In these cases, their size should not be affected, but we still
     // need to move them so that they won't overlap other frames.
     PerFrameData* sibling = pfd->mNext;
-    while (sibling && !sibling->GetFlag(PFD_ISLINKEDTOBASE)) {
+    while (sibling && !sibling->mIsLinkedToBase) {
       AdvanceAnnotationInlineBounds(sibling, containerWidth,
                                     aDeltaICoord + aDeltaISize, 0);
       sibling = sibling->mNext;
     }
 
     pfd = pfd->mNextAnnotation;
   }
 }
@@ -2592,53 +2675,131 @@ nscoord
 nsLineLayout::ApplyFrameJustification(PerSpanData* aPSD,
                                       JustificationApplicationState& aState)
 {
   NS_ASSERTION(aPSD, "null arg");
 
   nscoord deltaICoord = 0;
   for (PerFrameData* pfd = aPSD->mFirstFrame; pfd != nullptr; pfd = pfd->mNext) {
     // Don't reposition bullets (and other frames that occur out of X-order?)
-    if (!pfd->GetFlag(PFD_ISBULLET)) {
+    if (!pfd->mIsBullet) {
       nscoord dw = 0;
       WritingMode lineWM = mRootSpan->mWritingMode;
+      const auto& assign = pfd->mJustificationAssignment;
 
-      pfd->mBounds.IStart(lineWM) += deltaICoord;
-
-      if (true == pfd->GetFlag(PFD_ISTEXTFRAME)) {
+      if (true == pfd->mIsTextFrame) {
         if (aState.IsJustifiable()) {
           // Set corresponding justification gaps here, so that the
           // text frame knows how it should add gaps at its sides.
           const auto& info = pfd->mJustificationInfo;
-          const auto& assign = pfd->mJustificationAssignment;
           auto textFrame = static_cast<nsTextFrame*>(pfd->mFrame);
           textFrame->AssignJustificationGaps(assign);
           dw = aState.Consume(JustificationUtils::CountGaps(info, assign));
         }
 
         if (dw) {
-          pfd->SetFlag(PFD_RECOMPUTEOVERFLOW, true);
+          pfd->mRecomputeOverflow = true;
         }
       }
       else {
         if (nullptr != pfd->mSpan) {
           dw = ApplyFrameJustification(pfd->mSpan, aState);
         }
       }
 
       pfd->mBounds.ISize(lineWM) += dw;
+      if (!pfd->mIsTextFrame && assign.TotalGaps()) {
+        // It is possible that we assign gaps to non-text frame.
+        // Apply the gaps as margin around the frame.
+        deltaICoord += aState.Consume(assign.mGapsAtStart);
+        dw += aState.Consume(assign.mGapsAtEnd);
+      }
+      pfd->mBounds.IStart(lineWM) += deltaICoord;
 
       ApplyLineJustificationToAnnotations(pfd, aPSD, deltaICoord, dw);
       deltaICoord += dw;
       pfd->mFrame->SetRect(lineWM, pfd->mBounds, ContainerWidthForSpan(aPSD));
     }
   }
   return deltaICoord;
 }
 
+/**
+ * This method expands the given frame by the given reserved isize.
+ */
+void
+nsLineLayout::ExpandRubyBox(PerFrameData* aFrame, nscoord aReservedISize,
+                            nscoord aContainerWidth)
+{
+  int32_t opportunities = aFrame->mJustificationInfo.mInnerOpportunities;
+  // Each expandable ruby box has an gap at each of its sides. For
+  // rb/rbc, see comment in ComputeFrameJustification; for rt/rtc,
+  // see comment in this method below.
+  int32_t gaps = opportunities * 2 + 2;
+  JustificationApplicationState state(gaps, aReservedISize);
+  ApplyFrameJustification(aFrame->mSpan, state);
+
+  WritingMode lineWM = mRootSpan->mWritingMode;
+  aFrame->mBounds.ISize(lineWM) += aReservedISize;
+  aFrame->mFrame->SetRect(lineWM, aFrame->mBounds, aContainerWidth);
+}
+
+/**
+ * This method expands the given frame by the reserved inline size.
+ * It also expands its annotations if they are expandable and have
+ * reserved isize larger than zero.
+ */
+void
+nsLineLayout::ExpandRubyBoxWithAnnotations(PerFrameData* aFrame,
+                                           nscoord aContainerWidth)
+{
+  nscoord reservedISize = RubyUtils::GetReservedISize(aFrame->mFrame);
+  if (reservedISize) {
+    ExpandRubyBox(aFrame, reservedISize, aContainerWidth);
+  }
+
+  for (PerFrameData* annotation = aFrame->mNextAnnotation;
+       annotation; annotation = annotation->mNextAnnotation) {
+    nscoord reservedISize = RubyUtils::GetReservedISize(annotation->mFrame);
+    if (!reservedISize) {
+      continue;
+    }
+
+    MOZ_ASSERT(annotation->mSpan);
+    JustificationComputationState computeState;
+    ComputeFrameJustification(annotation->mSpan, computeState);
+    if (!computeState.mFirstParticipant) {
+      continue;
+    }
+    // Add one gap at each side of this annotation.
+    computeState.mFirstParticipant->mJustificationAssignment.mGapsAtStart = 1;
+    computeState.mLastParticipant->mJustificationAssignment.mGapsAtEnd = 1;
+    ExpandRubyBox(annotation, reservedISize, aContainerWidth);
+    ExpandInlineRubyBoxes(annotation->mSpan);
+  }
+}
+
+/**
+ * This method looks for all expandable ruby box in the given span, and
+ * calls ExpandRubyBox to expand them in depth-first preorder.
+ */
+void
+nsLineLayout::ExpandInlineRubyBoxes(PerSpanData* aSpan)
+{
+  nscoord containerWidth = ContainerWidthForSpan(aSpan);
+  for (PerFrameData* pfd = aSpan->mFirstFrame; pfd; pfd = pfd->mNext) {
+    if (RubyUtils::IsExpandableRubyBox(pfd->mFrame)) {
+      ExpandRubyBoxWithAnnotations(pfd, containerWidth);
+    }
+    if (pfd->mSpan) {
+      ExpandInlineRubyBoxes(pfd->mSpan);
+    }
+  }
+}
+
 // Align inline frames within the line according to the CSS text-align
 // property.
 void
 nsLineLayout::TextAlignLine(nsLineBox* aLine,
                             bool aIsLastLine)
 {
   /**
    * NOTE: aIsLastLine ain't necessarily so: it is correctly set by caller
@@ -2673,28 +2834,48 @@ nsLineLayout::TextAlignLine(nsLineBox* a
       if (textAlign == NS_STYLE_TEXT_ALIGN_JUSTIFY) {
         textAlign = NS_STYLE_TEXT_ALIGN_DEFAULT;
       }
     } else {
       textAlign = mStyleText->mTextAlignLast;
     }
   }
 
-  if ((remainingISize > 0 || textAlignTrue) &&
-      !(mBlockReflowState->frame->IsSVGText())) {
+  bool isSVG = mBlockReflowState->frame->IsSVGText();
+  bool doTextAlign = remainingISize > 0 || textAlignTrue;
 
+  int32_t additionalGaps = 0;
+  if (!isSVG && (mHasRuby || (doTextAlign &&
+                              textAlign == NS_STYLE_TEXT_ALIGN_JUSTIFY))) {
+    JustificationComputationState computeState;
+    ComputeFrameJustification(psd, computeState);
+    if (mHasRuby && computeState.mFirstParticipant) {
+      PerFrameData* firstFrame = computeState.mFirstParticipant;
+      if (firstFrame->mFrame->StyleContext()->IsDirectlyInsideRuby()) {
+        MOZ_ASSERT(!firstFrame->mJustificationAssignment.mGapsAtStart);
+        firstFrame->mJustificationAssignment.mGapsAtStart = 1;
+        additionalGaps++;
+      }
+      PerFrameData* lastFrame = computeState.mLastParticipant;
+      if (lastFrame->mFrame->StyleContext()->IsDirectlyInsideRuby()) {
+        MOZ_ASSERT(!lastFrame->mJustificationAssignment.mGapsAtEnd);
+        lastFrame->mJustificationAssignment.mGapsAtEnd = 1;
+        additionalGaps++;
+      }
+    }
+  }
+
+  if (!isSVG && doTextAlign) {
     switch (textAlign) {
       case NS_STYLE_TEXT_ALIGN_JUSTIFY: {
-        JustificationComputationState computeState = {
-          nullptr // mLastParticipant
-        };
-        int32_t opportunities = ComputeFrameJustification(psd, computeState);
+        int32_t opportunities =
+          psd->mFrame->mJustificationInfo.mInnerOpportunities;
         if (opportunities > 0) {
-          JustificationApplicationState applyState(
-              opportunities * 2, remainingISize);
+          int32_t gaps = opportunities * 2 + additionalGaps;
+          JustificationApplicationState applyState(gaps, remainingISize);
 
           // Apply the justification, and make sure to update our linebox
           // width to account for it.
           aLine->ExpandBy(ApplyFrameJustification(psd, applyState),
                           ContainerWidthForSpan(psd));
 
           MOZ_ASSERT(applyState.mGaps.mHandled == applyState.mGaps.mCount,
                      "Unprocessed justification gaps");
@@ -2730,16 +2911,20 @@ nsLineLayout::TextAlignLine(nsLineBox* a
 
       case NS_STYLE_TEXT_ALIGN_CENTER:
       case NS_STYLE_TEXT_ALIGN_MOZ_CENTER:
         dx = remainingISize / 2;
         break;
     }
   }
 
+  if (mHasRuby) {
+    ExpandInlineRubyBoxes(mRootSpan);
+  }
+
   if (mPresContext->BidiEnabled() &&
       (!mPresContext->IsVisualMode() || !lineWM.IsBidiLTR())) {
     nsBidiPresUtils::ReorderFrames(psd->mFirstFrame->mFrame,
                                    aLine->GetChildCount(),
                                    lineWM, mContainerWidth,
                                    psd->mIStart + mTextIndent + dx);
     if (dx) {
       aLine->IndentBy(dx, mContainerWidth);
@@ -2793,17 +2978,17 @@ nsLineLayout::RelativePositionFrames(Per
     overflowAreas.ScrollableOverflow() = overflowAreas.VisualOverflow();
   }
 
   for (PerFrameData* pfd = psd->mFirstFrame; pfd; pfd = pfd->mNext) {
     nsIFrame* frame = pfd->mFrame;
     nsPoint origin = frame->GetPosition();
 
     // Adjust the origin of the frame
-    if (pfd->GetFlag(PFD_RELATIVEPOS)) {
+    if (pfd->mRelativePos) {
       //XXX temporary until ApplyRelativePositioning can handle logical offsets
       nsMargin physicalOffsets =
         pfd->mOffsets.GetPhysicalMargin(pfd->mFrame->GetWritingMode());
       // right and bottom are handled by
       // nsHTMLReflowState::ComputeRelativeOffsets
       nsHTMLReflowState::ApplyRelativePositioning(pfd->mFrame,
                                                   physicalOffsets,
                                                   &origin);
@@ -2824,22 +3009,22 @@ nsLineLayout::RelativePositionFrames(Per
     // <b>x</b> and <b>y</b> which were computed above.
     nsOverflowAreas r;
     if (pfd->mSpan) {
       // Compute a new combined area for the child span before
       // aggregating it into our combined area.
       RelativePositionFrames(pfd->mSpan, r);
     } else {
       r = pfd->mOverflowAreas;
-      if (pfd->GetFlag(PFD_ISTEXTFRAME)) {
+      if (pfd->mIsTextFrame) {
         // We need to recompute overflow areas in two cases:
         // (1) When PFD_RECOMPUTEOVERFLOW is set due to trimming
         // (2) When there are text decorations, since we can't recompute the
         //     overflow area until Reflow and VerticalAlignLine have finished
-        if (pfd->GetFlag(PFD_RECOMPUTEOVERFLOW) ||
+        if (pfd->mRecomputeOverflow ||
             frame->StyleContext()->HasTextDecorationLines()) {
           nsTextFrame* f = static_cast<nsTextFrame*>(frame);
           r = f->RecomputeOverflow(*mBlockReflowState);
         }
         frame->FinishAndStoreOverflow(r, frame->GetSize());
       }
 
       // If we have something that's not an inline but with a complex frame

--- a/layout/generic/nsLineLayout.h
+++ b/layout/generic/nsLineLayout.h
@@ -111,16 +111,25 @@ public:
     PushFrame(aFrame);
   }
 
   /**
    * Place frames in the block direction (CSS property vertical-align)
    */
   void VerticalAlignLine();
 
+  // Get the final size of the line, in the block direction.
+  // Do not call this until after we've called VerticalAlignLine.
+  nscoord GetFinalLineBSize() const
+  {
+    NS_ASSERTION(mFinalLineBSize != nscoord_MIN,
+                 "VerticalAlignLine should have been called before");
+    return mFinalLineBSize;
+  }
+
   bool TrimTrailingWhiteSpace();
 
   /**
    * Place frames in the inline direction (CSS property text-align).
    */
   void TextAlignLine(nsLineBox* aLine, bool aIsLastLine);
 
   /**
@@ -432,57 +441,37 @@ protected:
     nsOverflowAreas mOverflowAreas;
 
     // From reflow-state
     mozilla::LogicalMargin mMargin;        // in *line* writing mode
     mozilla::LogicalMargin mBorderPadding; // in *line* writing mode
     mozilla::LogicalMargin mOffsets;       // in *frame* writing mode
 
     // state for text justification
+    // Note that, although all frames would have correct inner
+    // opportunities computed after ComputeFrameJustification, start
+    // and end justifiable info are not reliable for non-text frames.
     mozilla::JustificationInfo mJustificationInfo;
     mozilla::JustificationAssignment mJustificationAssignment;
     
-// PerFrameData flags
-#define PFD_RELATIVEPOS                 0x00000001
-#define PFD_ISTEXTFRAME                 0x00000002
-#define PFD_ISNONEMPTYTEXTFRAME         0x00000004
-#define PFD_ISNONWHITESPACETEXTFRAME    0x00000008
-#define PFD_ISLETTERFRAME               0x00000010
-#define PFD_RECOMPUTEOVERFLOW           0x00000020
-#define PFD_ISBULLET                    0x00000040
-#define PFD_SKIPWHENTRIMMINGWHITESPACE  0x00000080
-#define PFD_ISEMPTY                     0x00000100
-#define PFD_ISLINKEDTOBASE              0x00000200
-#define PFD_LASTFLAG                    PFD_ISLINKEDTOBASE
+    // PerFrameData flags
+    bool mRelativePos : 1;
+    bool mIsTextFrame : 1;
+    bool mIsNonEmptyTextFrame : 1;
+    bool mIsNonWhitespaceTextFrame : 1;
+    bool mIsLetterFrame : 1;
+    bool mRecomputeOverflow : 1;
+    bool mIsBullet : 1;
+    bool mSkipWhenTrimmingWhitespace : 1;
+    bool mIsEmpty : 1;
+    bool mIsLinkedToBase : 1;
 
     // Other state we use
-    uint16_t mFlags;
     uint8_t mBlockDirAlign;
 
-    static_assert(PFD_LASTFLAG <= UINT16_MAX,
-                  "Flag value exceeds the length of flags variable.");
-
-    void SetFlag(uint32_t aFlag, bool aValue)
-    {
-      NS_ASSERTION(aFlag<=PFD_LASTFLAG, "bad flag");
-      if (aValue) { // set flag
-        mFlags |= aFlag;
-      }
-      else {        // unset flag
-        mFlags &= ~aFlag;
-      }
-    }
-
-    bool GetFlag(uint32_t aFlag) const
-    {
-      NS_ASSERTION(aFlag<=PFD_LASTFLAG, "bad flag");
-      return !!(mFlags & aFlag);
-    }
-
-
     PerFrameData* Last() {
       PerFrameData* pfd = this;
       while (pfd->mNext) {
         pfd = pfd->mNext;
       }
       return pfd;
     }
 
@@ -494,17 +483,17 @@ protected:
     bool IsEndJustifiable() const
     {
       return mJustificationInfo.mIsEndJustifiable;
     }
 
     bool ParticipatesInJustification() const
     {
       // Skip bullets and empty frames
-      return !GetFlag(PFD_ISBULLET) && !GetFlag(PFD_ISEMPTY);
+      return !mIsBullet && !mIsEmpty;
     }
   };
   PerFrameData* mFrameFreeList;
 
   struct PerSpanData {
     union {
       PerSpanData* mParent;
       PerSpanData* mNextFreeSpan;
@@ -596,16 +585,17 @@ protected:
   bool mLineEndsInBR            : 1;
   bool mNeedBackup              : 1;
   bool mInFirstLine             : 1;
   bool mGotLineBox              : 1;
   bool mInFirstLetter           : 1;
   bool mHasBullet               : 1;
   bool mDirtyNextLine           : 1;
   bool mLineAtStart             : 1;
+  bool mHasRuby                 : 1;
 
   int32_t mSpanDepth;
 #ifdef DEBUG
   int32_t mSpansAllocated, mSpansFreed;
   int32_t mFramesAllocated, mFramesFreed;
 #endif
   PLArenaPool mArena; // Per span and per frame data, 4 byte aligned
 
@@ -680,16 +670,24 @@ protected:
                                            nscoord aDeltaICoord,
                                            nscoord aDeltaISize);
 
   // Apply justification.  The return value is the amount by which the width of
   // the span corresponding to aPSD got increased due to justification.
   nscoord ApplyFrameJustification(
       PerSpanData* aPSD, mozilla::JustificationApplicationState& aState);
 
+  void ExpandRubyBox(PerFrameData* aFrame, nscoord aReservedISize,
+                     nscoord aContainerWidth);
+
+  void ExpandRubyBoxWithAnnotations(PerFrameData* aFrame,
+                                    nscoord aContainerWidth);
+
+  void ExpandInlineRubyBoxes(PerSpanData* aSpan);
+
   void AttachFrameToBaseLineLayout(PerFrameData* aFrame);
 
 #ifdef DEBUG
   void DumpPerSpanData(PerSpanData* psd, int32_t aIndent);
 #endif
 };
 
 #endif /* nsLineLayout_h___ */

--- a/layout/generic/nsRubyBaseContainerFrame.cpp
+++ b/layout/generic/nsRubyBaseContainerFrame.cpp
@@ -8,16 +8,17 @@
 
 #include "nsRubyBaseContainerFrame.h"
 #include "nsContentUtils.h"
 #include "nsLineLayout.h"
 #include "nsPresContext.h"
 #include "nsStyleContext.h"
 #include "nsStyleStructInlines.h"
 #include "WritingModes.h"
+#include "RubyUtils.h"
 
 using namespace mozilla;
 
 //----------------------------------------------------------------------
 
 // Frame class boilerplate
 // =======================
 
@@ -371,49 +372,66 @@ nsRubyBaseContainerFrame::Reflow(nsPresC
   // reflowed, or be not reflowed at all.
   MOZ_ASSERT(NS_INLINE_IS_BREAK_BEFORE(aStatus) ||
              NS_FRAME_IS_COMPLETE(aStatus) || mSpanContainers.IsEmpty());
   if (!NS_INLINE_IS_BREAK_BEFORE(aStatus) &&
       NS_FRAME_IS_COMPLETE(aStatus) && !mSpanContainers.IsEmpty()) {
     // Reflow spans
     nscoord spanISize = ReflowSpans(aPresContext, aReflowState,
                                     spanReflowStates);
-    if (isize < spanISize) {
-      nscoord delta = spanISize - isize;
-      if (allowLineBreak && ShouldBreakBefore(aReflowState, delta)) {
-        aStatus = NS_INLINE_LINE_BREAK_BEFORE();
-      } else {
-        aReflowState.mLineLayout->AdvanceICoord(delta);
-        isize = spanISize;
-      }
+    nscoord deltaISize = spanISize - isize;
+    if (deltaISize <= 0) {
+      RubyUtils::ClearReservedISize(this);
+    } else if (allowLineBreak && ShouldBreakBefore(aReflowState, deltaISize)) {
+      aStatus = NS_INLINE_LINE_BREAK_BEFORE();
+    } else {
+      RubyUtils::SetReservedISize(this, deltaISize);
+      aReflowState.mLineLayout->AdvanceICoord(deltaISize);
+      isize = spanISize;
     }
+  }
     // When there are spans, ReflowPairs and ReflowOnePair won't
     // record any optional break position. We have to record one
     // at the end of this segment.
     if (!NS_INLINE_IS_BREAK(aStatus) && allowLineBreak &&
         aReflowState.mLineLayout->NotifyOptionalBreakPosition(
           this, INT32_MAX, startEdge + isize <= aReflowState.AvailableISize(),
           gfxBreakPriority::eNormalBreak)) {
       aStatus = NS_INLINE_LINE_BREAK_AFTER(aStatus);
     }
-  }
 
   DebugOnly<nscoord> lineSpanSize = aReflowState.mLineLayout->EndSpan(this);
   // When there are no frames inside the ruby base container, EndSpan
   // will return 0. However, in this case, the actual width of the
   // container could be non-zero because of non-empty ruby annotations.
   MOZ_ASSERT(NS_INLINE_IS_BREAK_BEFORE(aStatus) ||
              isize == lineSpanSize || mFrames.IsEmpty());
   for (uint32_t i = 0; i < totalCount; i++) {
     // It happens before the ruby text container is reflowed, and that
     // when it is reflowed, it will just use this size.
     nsRubyTextContainerFrame* textContainer = i < rtcCount ?
       mTextContainers[i] : mSpanContainers[i - rtcCount];
-    textContainer->SetISize(isize);
-    lineLayouts[i]->EndLineReflow();
+    nsLineLayout* lineLayout = lineLayouts[i].get();
+
+    RubyUtils::ClearReservedISize(textContainer);
+    nscoord rtcISize = lineLayout->GetCurrentICoord();
+    // Only span containers and containers with collapsed annotations
+    // need reserving isize. For normal ruby text containers, their
+    // children will be expanded properly. We only need to expand their
+    // own size.
+    if (i < rtcCount) {
+      rtcISize = isize;
+    } else if (isize > rtcISize) {
+      RubyUtils::SetReservedISize(textContainer, isize - rtcISize);
+    }
+
+    lineLayout->VerticalAlignLine();
+    LogicalSize lineSize(lineWM, isize, lineLayout->GetFinalLineBSize());
+    textContainer->SetLineSize(lineSize);
+    lineLayout->EndLineReflow();
   }
 
   aDesiredSize.ISize(lineWM) = isize;
   nsLayoutUtils::SetBSizeFromFontMetrics(this, aDesiredSize, aReflowState,
                                          borderPadding, lineWM, frameWM);
 }
 
 /**
@@ -563,16 +581,17 @@ nsRubyBaseContainerFrame::ReflowOnePair(
       if (annotationText.Equals(baseText)) {
         textFrame->AddStateBits(NS_RUBY_TEXT_FRAME_AUTOHIDE);
       } else {
         textFrame->RemoveStateBits(NS_RUBY_TEXT_FRAME_AUTOHIDE);
       }
 
       nsReflowStatus reflowStatus;
       nsHTMLReflowMetrics metrics(*aReflowStates[i]);
+      RubyUtils::ClearReservedISize(textFrame);
 
       bool pushedFrame;
       aReflowStates[i]->mLineLayout->ReflowFrame(textFrame, reflowStatus,
                                                  &metrics, pushedFrame);
       MOZ_ASSERT(!NS_INLINE_IS_BREAK(reflowStatus) && !pushedFrame,
                  "Any line break inside ruby box should has been suppressed");
       pairISize = std::max(pairISize, metrics.ISize(lineWM));
     }
@@ -585,33 +604,46 @@ nsRubyBaseContainerFrame::ReflowOnePair(
     return 0;
   }
 
   // Reflow the base frame
   if (aBaseFrame) {
     MOZ_ASSERT(aBaseFrame->GetType() == nsGkAtoms::rubyBaseFrame);
     nsReflowStatus reflowStatus;
     nsHTMLReflowMetrics metrics(aReflowState);
+    RubyUtils::ClearReservedISize(aBaseFrame);
 
     bool pushedFrame;
     aReflowState.mLineLayout->ReflowFrame(aBaseFrame, reflowStatus,
                                           &metrics, pushedFrame);
     MOZ_ASSERT(!NS_INLINE_IS_BREAK(reflowStatus) && !pushedFrame,
                "Any line break inside ruby box should has been suppressed");
     pairISize = std::max(pairISize, metrics.ISize(lineWM));
   }
 
   // Align all the line layout to the new coordinate.
   nscoord icoord = istart + pairISize;
-  aReflowState.mLineLayout->AdvanceICoord(
-    icoord - aReflowState.mLineLayout->GetCurrentICoord());
+  nscoord deltaISize = icoord - aReflowState.mLineLayout->GetCurrentICoord();
+  if (deltaISize > 0) {
+    aReflowState.mLineLayout->AdvanceICoord(deltaISize);
+    if (aBaseFrame) {
+      RubyUtils::SetReservedISize(aBaseFrame, deltaISize);
+    }
+  }
   for (uint32_t i = 0; i < rtcCount; i++) {
     nsLineLayout* lineLayout = aReflowStates[i]->mLineLayout;
-    lineLayout->AdvanceICoord(icoord - lineLayout->GetCurrentICoord());
-    if (aBaseFrame && aTextFrames[i]) {
+    nsIFrame* textFrame = aTextFrames[i];
+    nscoord deltaISize = icoord - lineLayout->GetCurrentICoord();
+    if (deltaISize > 0) {
+      lineLayout->AdvanceICoord(deltaISize);
+      if (textFrame) {
+        RubyUtils::SetReservedISize(textFrame, deltaISize);
+      }
+    }
+    if (aBaseFrame && textFrame) {
       lineLayout->AttachLastFrameToBaseLineLayout();
     }
   }
 
   mPairCount++;
   if (aAllowLineBreak &&
       aReflowState.mLineLayout->NotifyOptionalBreakPosition(
         this, mPairCount, icoord <= aReflowState.AvailableISize(),

--- a/layout/generic/nsRubyFrame.cpp
+++ b/layout/generic/nsRubyFrame.cpp
@@ -266,16 +266,33 @@ nsRubyFrame::Reflow(nsPresContext* aPres
   // We never handle overflow in ruby.
   MOZ_ASSERT(!NS_FRAME_OVERFLOW_IS_INCOMPLETE(aStatus));
 
   aDesiredSize.ISize(lineWM) = aReflowState.mLineLayout->EndSpan(this);
   nsLayoutUtils::SetBSizeFromFontMetrics(this, aDesiredSize, aReflowState,
                                          borderPadding, lineWM, frameWM);
 }
 
+#ifdef DEBUG
+static void
+SanityCheckRubyPosition(int8_t aRubyPosition)
+{
+  uint8_t horizontalPosition = aRubyPosition &
+    (NS_STYLE_RUBY_POSITION_LEFT | NS_STYLE_RUBY_POSITION_RIGHT);
+  MOZ_ASSERT(horizontalPosition == NS_STYLE_RUBY_POSITION_LEFT ||
+             horizontalPosition == NS_STYLE_RUBY_POSITION_RIGHT);
+  uint8_t verticalPosition = aRubyPosition &
+    (NS_STYLE_RUBY_POSITION_OVER | NS_STYLE_RUBY_POSITION_UNDER |
+     NS_STYLE_RUBY_POSITION_INTER_CHARACTER);
+  MOZ_ASSERT(verticalPosition == NS_STYLE_RUBY_POSITION_OVER ||
+             verticalPosition == NS_STYLE_RUBY_POSITION_UNDER ||
+             verticalPosition == NS_STYLE_RUBY_POSITION_INTER_CHARACTER);
+}
+#endif
+
 void
 nsRubyFrame::ReflowSegment(nsPresContext* aPresContext,
                            const nsHTMLReflowState& aReflowState,
                            nsRubyBaseContainerFrame* aBaseContainer,
                            nsReflowStatus& aStatus)
 {
   AutoSetTextContainers holder(aBaseContainer);
   WritingMode lineWM = aReflowState.mLineLayout->GetWritingMode();
@@ -351,16 +368,26 @@ nsRubyFrame::ReflowSegment(nsPresContext
       nsIFrame* nextRTC = textContainers[i]->GetNextInFlow();
       if (nextRTC) {
         nextRTC->GetParent()->DeleteNextInFlowChild(nextRTC, true);
       }
     }
   }
 
   nsRect baseRect = aBaseContainer->GetRect();
+  // We need to position our rtc frames on one side or the other of the
+  // base container's rect, using a coordinate space that's relative to
+  // the ruby frame. Right now, the base container's rect's block-axis
+  // position is relative to the block container frame containing the
+  // lines, so we use 0 instead. (i.e. we assume that the base container
+  // is adjacent to the ruby frame's block-start edge.)
+  // XXX We may need to add border/padding here. See bug 1055667.
+  (lineWM.IsVertical() ? baseRect.x : baseRect.y) = 0;
+  // The rect for offsets of text containers.
+  nsRect offsetRect = baseRect;
   for (uint32_t i = 0; i < rtcCount; i++) {
     nsRubyTextContainerFrame* textContainer = textContainers[i];
     nsReflowStatus textReflowStatus;
     nsHTMLReflowMetrics textMetrics(aReflowState);
     nsHTMLReflowState textReflowState(aPresContext, aReflowState,
                                       textContainer, availSize);
     // FIXME We probably shouldn't be using the same nsLineLayout for
     //       the text containers. But it should be fine now as we are
@@ -371,24 +398,47 @@ nsRubyFrame::ReflowSegment(nsPresContext
                           textReflowState, textReflowStatus);
     // Ruby text containers always return NS_FRAME_COMPLETE even when
     // they have continuations, because the breaking has already been
     // handled when reflowing the base containers.
     NS_ASSERTION(textReflowStatus == NS_FRAME_COMPLETE,
                  "Ruby text container must not break itself inside");
     textContainer->SetSize(LogicalSize(lineWM, textMetrics.ISize(lineWM),
                                        textMetrics.BSize(lineWM)));
+
     nscoord x, y;
     nscoord bsize = textMetrics.BSize(lineWM);
+    uint8_t rubyPosition = textContainer->StyleText()->mRubyPosition;
+#ifdef DEBUG
+    SanityCheckRubyPosition(rubyPosition);
+#endif
     if (lineWM.IsVertical()) {
-      x = lineWM.IsVerticalLR() ? -bsize : baseRect.XMost();
-      y = baseRect.Y();
+      // writing-mode is vertical, so bsize is the annotation's *width*
+      if (rubyPosition & NS_STYLE_RUBY_POSITION_LEFT) {
+        x = offsetRect.X() - bsize;
+        offsetRect.SetLeftEdge(x);
+      } else {
+        x = offsetRect.XMost();
+        offsetRect.SetRightEdge(x + bsize);
+      }
+      y = offsetRect.Y();
     } else {
-      x = baseRect.X();
-      y = -bsize;
+      // writing-mode is horizontal, so bsize is the annotation's *height*
+      x = offsetRect.X();
+      if (rubyPosition & NS_STYLE_RUBY_POSITION_OVER) {
+        y = offsetRect.Y() - bsize;
+        offsetRect.SetTopEdge(y);
+      } else if (rubyPosition & NS_STYLE_RUBY_POSITION_UNDER) {
+        y = offsetRect.YMost();
+        offsetRect.SetBottomEdge(y + bsize);
+      } else {
+        // XXX inter-character support in bug 1055672
+        MOZ_ASSERT_UNREACHABLE("Unsupported ruby-position");
+        y = offsetRect.Y();
+      }
     }
     FinishReflowChild(textContainer, aPresContext, textMetrics,
                       &textReflowState, x, y, 0);
   }
 }
 
 nsRubyBaseContainerFrame*
 nsRubyFrame::PullOneSegment(ContinuationTraversingState& aState)

--- a/layout/generic/nsRubyTextContainerFrame.cpp
+++ b/layout/generic/nsRubyTextContainerFrame.cpp
@@ -66,25 +66,19 @@ nsRubyTextContainerFrame::Reflow(nsPresC
                                  nsHTMLReflowMetrics& aDesiredSize,
                                  const nsHTMLReflowState& aReflowState,
                                  nsReflowStatus& aStatus)
 {
   DO_GLOBAL_REFLOW_COUNT("nsRubyTextContainerFrame");
   DISPLAY_REFLOW(aPresContext, this, aReflowState, aDesiredSize, aStatus);
 
   // All rt children have already been reflowed. All we need to do is
-  // to report complete and return the desired size.
+  // to report complete and return the desired size provided by the
+  // ruby base container.
 
   // Although a ruby text container may have continuations, returning
   // NS_FRAME_COMPLETE here is still safe, since its parent, ruby frame,
   // ignores the status, and continuations of the ruby base container
   // will take care of our continuations.
   aStatus = NS_FRAME_COMPLETE;
   WritingMode lineWM = aReflowState.mLineLayout->GetWritingMode();
-  WritingMode frameWM = aReflowState.GetWritingMode();
-  LogicalMargin borderPadding = aReflowState.ComputedLogicalBorderPadding();
-
-  // ISize is provided by the ruby base container
-  // during reflow of that container.
-  aDesiredSize.ISize(lineWM) = mISize;
-  nsLayoutUtils::SetBSizeFromFontMetrics(this, aDesiredSize, aReflowState,
-                                         borderPadding, lineWM, frameWM);
+  aDesiredSize.SetSize(lineWM, mLineSize);
 }