Merge inbound to m-c.
authorRyan VanderMeulen <ryanvm@gmail.com>
Thu, 05 Dec 2013 17:29:03 -0500
changeset 158967 ee425b3ccc294bcef1c065e28095e25796870343
parent 158910 801fdb5306a1e313915b338dc4f62a0becfa7d59 (current diff)
parent 158966 f23fd773d7d1ffba4091e1caa81c89b8a9cdee74 (diff)
child 158992 7f4ce3bb50d043727cc829a4e0c0df2cd67cc18f
push id25767
push userryanvm@gmail.com
push dateThu, 05 Dec 2013 22:29:08 +0000
treeherdermozilla-central@ee425b3ccc29 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone28.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge inbound to m-c.
CLOBBER
dom/contacts/Makefile.in
other-licenses/snappy/Makefile.in
toolkit/library/winvccorlib/dummyvccorlib.cpp
toolkit/library/winvccorlib/moz.build
--- a/CLOBBER
+++ b/CLOBBER
@@ -13,9 +13,9 @@
 #          |               |
 #          O <-- Clobber   O  <-- Clobber
 #
 # Note: The description below will be part of the error message shown to users.
 #
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
 
-Bug 933136 - Windows webidl changes.
+Bug 585122 - New file added for xpcshell test not always being copied.
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -1001,18 +1001,18 @@ nsAccessibilityService::GetOrCreateAcces
       if (deckFrame && deckFrame->GetSelectedBox() != frame) {
         if (aIsSubtreeHidden)
           *aIsSubtreeHidden = true;
 
         return nullptr;
       }
     }
 
-    // Elements may implement nsIAccessibleProvider via XBL. This allows them to
-    // say what kind of accessible to create.
+    // XBL bindings may use @role attribute to point the accessible type
+    // they belong to.
     newAcc = CreateAccessibleByType(content, document);
 
     // Any XUL box can be used as tabpanel, make sure we create a proper
     // accessible for it.
     if (!newAcc && aContext->IsXULTabpanels() &&
         content->GetParent() == aContext->GetContent()) {
       nsIAtom* frameType = frame->GetType();
       if (frameType == nsGkAtoms::boxFrame ||
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -173,18 +173,17 @@ private:
   bool Init();
 
   /**
    * Shutdowns accessibility service.
    */
   void Shutdown();
 
   /**
-   * Create accessible for the element implementing nsIAccessibleProvider
-   * interface.
+   * Create accessible for the element having XBL bindings.
    */
   already_AddRefed<Accessible>
     CreateAccessibleByType(nsIContent* aContent, DocAccessible* aDoc);
 
   /**
    * Create accessible for HTML node by tag name.
    */
   already_AddRefed<Accessible>
--- a/accessible/src/generic/Accessible.cpp
+++ b/accessible/src/generic/Accessible.cpp
@@ -226,17 +226,17 @@ Accessible::Name(nsString& aName)
       aName.CompressWhitespace();
       return eNameFromTooltip;
     }
   } else if (mContent->IsSVG()) {
     // If user agents need to choose among multiple ‘desc’ or ‘title’ elements
     // for processing, the user agent shall choose the first one.
     for (nsIContent* childElm = mContent->GetFirstChild(); childElm;
          childElm = childElm->GetNextSibling()) {
-      if (childElm->IsSVG(nsGkAtoms::title)) {
+      if (childElm->IsSVG(nsGkAtoms::desc)) {
         nsTextEquivUtils::AppendTextEquivFromContent(this, childElm, &aName);
         return eNameFromTooltip;
       }
     }
   }
 
   if (nameFlag != eNoNameOnPurpose)
     aName.SetIsVoid(true);
@@ -289,17 +289,17 @@ Accessible::Description(nsString& aDescr
       // Keep the Name() method logic.
       if (mContent->IsHTML()) {
         mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::title, aDescription);
       } else if (mContent->IsXUL()) {
         mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::tooltiptext, aDescription);
       } else if (mContent->IsSVG()) {
         for (nsIContent* childElm = mContent->GetFirstChild(); childElm;
              childElm = childElm->GetNextSibling()) {
-          if (childElm->IsSVG(nsGkAtoms::title)) {
+          if (childElm->IsSVG(nsGkAtoms::desc)) {
             nsTextEquivUtils::AppendTextEquivFromContent(this, childElm,
                                                          &aDescription);
             break;
           }
         }
       }
 
       if (!aDescription.IsEmpty()) {
@@ -2484,17 +2484,17 @@ Accessible::NativeName(nsString& aName)
   if (mContent->IsXUL())
     return GetXULName(aName);
 
   if (mContent->IsSVG()) {
     // If user agents need to choose among multiple ‘desc’ or ‘title’ elements
     // for processing, the user agent shall choose the first one.
     for (nsIContent* childElm = mContent->GetFirstChild(); childElm;
          childElm = childElm->GetNextSibling()) {
-      if (childElm->IsSVG(nsGkAtoms::desc)) {
+      if (childElm->IsSVG(nsGkAtoms::title)) {
         nsTextEquivUtils::AppendTextEquivFromContent(this, childElm, &aName);
         return eNameOK;
       }
     }
   }
 
   return eNameOK;
 }
--- a/accessible/src/jsat/AccessFu.jsm
+++ b/accessible/src/jsat/AccessFu.jsm
@@ -739,16 +739,17 @@ var Input = {
         break;
       case 'swipeup1':
         this.contextAction('backward');
         break;
       case 'swipedown1':
         this.contextAction('forward');
         break;
       case 'exploreend1':
+      case 'dwellend1':
         this.activateCurrent(null, true);
         break;
       case 'swiperight2':
         this.sendScrollMessage(-1, true);
         break;
       case 'swipedown2':
         this.sendScrollMessage(-1);
         break;
--- a/accessible/src/jsat/TouchAdapter.jsm
+++ b/accessible/src/jsat/TouchAdapter.jsm
@@ -387,16 +387,18 @@ TouchPoint.prototype = {
     // To be considered a tap/dwell...
     if ((this.distanceTraveled / this.dpi) < TouchAdapter.TAP_MAX_RADIUS) { // Didn't travel
       if (duration < TouchAdapter.DWELL_THRESHOLD) {
         // Mark it as done so we don't use this touch for another gesture.
         this.finish();
         return {type: 'tap', x: this.startX, y: this.startY};
       } else if (!this.done && duration == TouchAdapter.DWELL_THRESHOLD) {
         return {type: 'dwell', x: this.startX, y: this.startY};
+      } else if (this.done && duration > TouchAdapter.DWELL_THRESHOLD) {
+        return {type: 'dwellend', x: this.startX, y: this.startY};
       }
     }
 
     // To be considered a swipe...
     if (duration <= TouchAdapter.SWIPE_MAX_DURATION && // Quick enough
         (directDistance / this.dpi) >= TouchAdapter.SWIPE_MIN_DISTANCE && // Traveled far
         (directDistance * 1.2) >= this.distanceTraveled) { // Direct enough
 
--- a/accessible/src/xul/XULTabAccessible.h
+++ b/accessible/src/xul/XULTabAccessible.h
@@ -70,20 +70,17 @@ public:
     { mType = eXULTabpanelsType; }
 
   // Accessible
   virtual a11y::role NativeRole();
 };
 
 
 /**
- * A tabpanel object, child elements of xul:tabpanels element. Note,the object
- * is created from nsAccessibilityService::GetAccessibleForDeckChildren()
- * method and we do not use nsIAccessibleProvider interface here because
- * all children of xul:tabpanels element acts as xul:tabpanel element.
+ * A tabpanel object, child elements of xul:tabpanels element.
  *
  * XXX: we need to move the class logic into generic class since
  * for example we do not create instance of this class for XUL textbox used as
  * a tabpanel.
  */
 class XULTabpanelAccessible : public AccessibleWrap
 {
 public:
--- a/accessible/tests/mochitest/name/test_svg.html
+++ b/accessible/tests/mochitest/name/test_svg.html
@@ -39,17 +39,17 @@
     Mozilla Bug 459357
   </a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
   </pre>
 
   <svg xmlns="http://www.w3.org/2000/svg" version="1.1" id="svg1">
-    <title>A description</title>
-    <desc>A name</desc>
+    <title>A name</title>
+    <desc>A description</title>
   </svg>
 
   <svg xmlns="http://www.w3.org/2000/svg" version="1.1" id="svg2">
-    <title>A tooltip</title>
+    <desc>A tooltip</desc>
   </svg>
 </body>
 </html>
--- a/accessible/tests/mochitest/tree/test_formctrl.xul
+++ b/accessible/tests/mochitest/tree/test_formctrl.xul
@@ -1,16 +1,24 @@
 <?xml version="1.0"?>
 <?xml-stylesheet href="chrome://global/skin" type="text/css"?>
 <?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
                  type="text/css"?>
 
+<!-- Firefox toolbar -->
+<?xml-stylesheet href="chrome://browser/content/browser.css"
+                 type="text/css"?>
+
 <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         title="Accessible XUL checkbox and radio hierarchy tests">
 
+  <!-- Firefox toolbar -->
+  <script type="application/javascript"
+          src="chrome://browser/content/browser.js"/>
+
   <script type="application/javascript"
           src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
 
   <script type="application/javascript"
           src="../common.js" />
   <script type="application/javascript"
           src="../role.js" />
 
@@ -71,16 +79,19 @@
             name: "hello",
             children: [ ]
           }
         ]
       };
 
       testAccessibleTree("toolbar2", accTree);
 
+      if (!SEAMONKEY)
+        testAccessibleTree("tb_customizable", { TOOLBAR: [] });
+
       SimpleTest.finish()
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   ]]>
   </script>
 
@@ -105,13 +116,15 @@
         <radio label="radio2"/>
       </radiogroup>
       <toolbar id="toolbar" toolbarname="My toolbar">
         <toolbarbutton id="button1" label="hello"/>
       </toolbar>
       <toolbar id="toolbar2" toolbarname="2nd" aria-label="My second toolbar">
         <toolbarbutton id="button2" label="hello"/>
       </toolbar>
+
+      <toolbar id="tb_customizable" customizable="true"/>
     </vbox>
   </hbox>
 
 </window>
 
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1245,45 +1245,42 @@
         <parameter name="aCharset"/>
         <parameter name="aPostData"/>
         <parameter name="aLoadInBackground"/>
         <parameter name="aAllowThirdPartyFixup"/>
         <body>
           <![CDATA[
             var aFromExternal;
             var aRelatedToCurrent;
-            var aIsUTF8;
             var aDisableMCB;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
               let params = arguments[1];
               aReferrerURI          = params.referrerURI;
               aCharset              = params.charset;
               aPostData             = params.postData;
               aLoadInBackground     = params.inBackground;
               aAllowThirdPartyFixup = params.allowThirdPartyFixup;
               aFromExternal         = params.fromExternal;
               aRelatedToCurrent     = params.relatedToCurrent;
-              aIsUTF8               = params.isUTF8;
               aDisableMCB           = params.disableMCB;
             }
 
             var bgLoad = (aLoadInBackground != null) ? aLoadInBackground :
                          Services.prefs.getBoolPref("browser.tabs.loadInBackground");
             var owner = bgLoad ? null : this.selectedTab;
             var tab = this.addTab(aURI, {
                                   referrerURI: aReferrerURI,
                                   charset: aCharset,
                                   postData: aPostData,
                                   ownerTab: owner,
                                   allowThirdPartyFixup: aAllowThirdPartyFixup,
                                   fromExternal: aFromExternal,
                                   relatedToCurrent: aRelatedToCurrent,
-                                  isUTF8: aIsUTF8,
                                   disableMCB: aDisableMCB});
             if (!bgLoad)
               this.selectedTab = tab;
 
             return tab;
          ]]>
         </body>
       </method>
@@ -1422,31 +1419,29 @@
         <parameter name="aOwner"/>
         <parameter name="aAllowThirdPartyFixup"/>
         <body>
           <![CDATA[
             const NS_XUL = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
             var aFromExternal;
             var aRelatedToCurrent;
             var aSkipAnimation;
-            var aIsUTF8;
             var aDisableMCB;
             if (arguments.length == 2 &&
                 typeof arguments[1] == "object" &&
                 !(arguments[1] instanceof Ci.nsIURI)) {
               let params = arguments[1];
               aReferrerURI          = params.referrerURI;
               aCharset              = params.charset;
               aPostData             = params.postData;
               aOwner                = params.ownerTab;
               aAllowThirdPartyFixup = params.allowThirdPartyFixup;
               aFromExternal         = params.fromExternal;
               aRelatedToCurrent     = params.relatedToCurrent;
               aSkipAnimation        = params.skipAnimation;
-              aIsUTF8               = params.isUTF8;
               aDisableMCB           = params.disableMCB;
             }
 
             // if we're adding tabs, we're past interrupt mode, ditch the owner
             if (this.mCurrentTab.owner)
               this.mCurrentTab.owner = null;
 
             var t = document.createElementNS(NS_XUL, "tab");
@@ -1605,18 +1600,16 @@
               if (aURI && gInitialPages.indexOf(aURI) == -1)
                 b.userTypedValue = aURI;
 
               let flags = Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
               if (aAllowThirdPartyFixup)
                 flags |= Ci.nsIWebNavigation.LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP;
               if (aFromExternal)
                 flags |= Ci.nsIWebNavigation.LOAD_FLAGS_FROM_EXTERNAL;
-              if (aIsUTF8)
-                flags |= Ci.nsIWebNavigation.LOAD_FLAGS_URI_IS_UTF8;
               if (aDisableMCB)
                 flags |= Ci.nsIWebNavigation.LOAD_FLAGS_ALLOW_MIXED_CONTENT;
               try {
                 b.loadURIWithFlags(aURI, flags, aReferrerURI, aCharset, aPostData);
               } catch (ex) {
                 Cu.reportError(ex);
               }
             }
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -295,20 +295,16 @@
             function loadCurrent() {
               let flags = Ci.nsIWebNavigation.LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP;
               // Pass LOAD_FLAGS_DISALLOW_INHERIT_OWNER to prevent any loads from
               // inheriting the currently loaded document's principal, unless this
               // URL is marked as safe to inherit (e.g. came from a bookmark
               // keyword).
               if (!mayInheritPrincipal)
                 flags |= Ci.nsIWebNavigation.LOAD_FLAGS_DISALLOW_INHERIT_OWNER;
-              // If the value wasn't typed, we know that we decoded the value as
-              // UTF-8 (see losslessDecodeURI)
-              if (!this.valueIsTyped)
-                flags |= Ci.nsIWebNavigation.LOAD_FLAGS_URI_IS_UTF8;
               gBrowser.loadURIWithFlags(url, flags, null, null, postData);
             }
 
             // Focus the content area before triggering loads, since if the load
             // occurs in a new tab, we want focus to be restored to the content
             // area when the current tab is re-selected.
             gBrowser.selectedBrowser.focus();
 
@@ -336,18 +332,16 @@
                 if (matchLastLocationChange) {
                   loadCurrent();
                 }
               } else {
                 this.handleRevert();
                 let params = { allowThirdPartyFixup: true,
                                postData: postData,
                                initiatingDoc: document };
-                if (!this.valueIsTyped)
-                  params.isUTF8 = true;
                 openUILinkIn(url, where, params);
               }
             } else {
               if (matchLastLocationChange) {
                 loadCurrent();
               }
             }
           }.bind(this));
@@ -489,17 +483,17 @@
             if (remainder != "" && remainder[0] != "/")
               return selectedVal;
           }
 
           let uriFixup = Cc["@mozilla.org/docshell/urifixup;1"].getService(Ci.nsIURIFixup);
 
           let uri;
           try {
-            uri = uriFixup.createFixupURI(inputVal, Ci.nsIURIFixup.FIXUP_FLAG_USE_UTF8);
+            uri = uriFixup.createFixupURI(inputVal, Ci.nsIURIFixup.FIXUP_FLAG_NONE);
           } catch (e) {}
           if (!uri)
             return selectedVal;
 
           // Only copy exposable URIs
           try {
             uri = uriFixup.createExposableURI(uri);
           } catch (ex) {}
--- a/browser/base/content/utilityOverlay.js
+++ b/browser/base/content/utilityOverlay.js
@@ -211,18 +211,16 @@ function openLinkIn(url, where, params) 
   var aAllowThirdPartyFixup = params.allowThirdPartyFixup;
   var aPostData             = params.postData;
   var aCharset              = params.charset;
   var aReferrerURI          = params.referrerURI;
   var aRelatedToCurrent     = params.relatedToCurrent;
   var aDisableMCB           = params.disableMCB;
   var aInBackground         = params.inBackground;
   var aDisallowInheritPrincipal = params.disallowInheritPrincipal;
-  // Currently, this parameter works only for where=="tab" or "current"
-  var aIsUTF8               = params.isUTF8;
   var aInitiatingDoc        = params.initiatingDoc;
   var aIsPrivate            = params.private;
 
   if (where == "save") {
     if (!aInitiatingDoc) {
       Components.utils.reportError("openUILink/openLinkIn was called with " +
         "where == 'save' but without initiatingDoc.  See bug 814264.");
       return;
@@ -301,33 +299,30 @@ function openLinkIn(url, where, params) 
 
   switch (where) {
   case "current":
     let flags = Ci.nsIWebNavigation.LOAD_FLAGS_NONE;
     if (aAllowThirdPartyFixup)
       flags |= Ci.nsIWebNavigation.LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP;
     if (aDisallowInheritPrincipal)
       flags |= Ci.nsIWebNavigation.LOAD_FLAGS_DISALLOW_INHERIT_OWNER;
-    if (aIsUTF8)
-      flags |= Ci.nsIWebNavigation.LOAD_FLAGS_URI_IS_UTF8;
     w.gBrowser.loadURIWithFlags(url, flags, aReferrerURI, null, aPostData);
     break;
   case "tabshifted":
     loadInBackground = !loadInBackground;
     // fall through
   case "tab":
     let browser = w.gBrowser;
     browser.loadOneTab(url, {
                        referrerURI: aReferrerURI,
                        charset: aCharset,
                        postData: aPostData,
                        inBackground: loadInBackground,
                        allowThirdPartyFixup: aAllowThirdPartyFixup,
                        relatedToCurrent: aRelatedToCurrent,
-                       isUTF8: aIsUTF8,
                        disableMCB: aDisableMCB});
     break;
   }
 
   w.gBrowser.selectedBrowser.focus();
 
   if (!loadInBackground && w.isBlankPageURL(url))
     w.focusAndSelectUrlBar();
--- a/browser/components/customizableui/content/toolbar.xml
+++ b/browser/components/customizableui/content/toolbar.xml
@@ -3,29 +3,23 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
 <bindings id="browserToolbarBindings"
           xmlns="http://www.mozilla.org/xbl"
           xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
           xmlns:xbl="http://www.mozilla.org/xbl">
 
-  <binding id="toolbar">
+  <binding id="toolbar" role="xul:toolbar">
     <resources>
       <stylesheet src="chrome://global/skin/toolbar.css"/>
     </resources>
-    <implementation implements="nsIAccessibleProvider">
+    <implementation>
       <field name="overflowedDuringConstruction">null</field>
 
-      <property name="accessibleType" readonly="true">
-        <getter>
-          return Components.interfaces.nsIAccessibleProvider.XULToolbar;
-        </getter>
-      </property>
-
       <constructor><![CDATA[
           let scope = {};
           Cu.import("resource:///modules/CustomizableUI.jsm", scope);
           // Add an early overflow event listener that will mark if the
           // toolbar overflowed during construction.
           if (scope.CustomizableUI.isAreaOverflowable(this.id)) {
             this.addEventListener("overflow", this);
             this.addEventListener("underflow", this);
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -785,17 +785,16 @@ bin/libfreebl_32int64_3.so
 #endif
 
 #ifdef MOZ_METRO
 @BINPATH@/components/MetroUIUtils.js
 @BINPATH@/components/MetroUIUtils.manifest
 [metro]
 ; gre resources
 @BINPATH@/CommandExecuteHandler@BIN_SUFFIX@
-@BINPATH@/dummyvccorlib.dll
 @BINPATH@/resources.pri
 @BINPATH@/VisualElementsManifest.xml
 @BINPATH@/tileresources
 ; app dir resources
 @BINPATH@/metro/chrome.manifest
 @BINPATH@/metro/searchplugins
 @BINPATH@/metro/metroapp.ini
 @BINPATH@/metro/chrome/browser@JAREXT@
--- a/browser/locales/en-US/chrome/browser/charsetMenu.properties
+++ b/browser/locales/en-US/chrome/browser/charsetMenu.properties
@@ -66,22 +66,20 @@ IBM866           = Cyrillic (DOS)
 # Greek
 windows-1253.key = G
 windows-1253     = Greek (Windows)
 ISO-8859-7.key   =          O
 ISO-8859-7       = Greek (ISO)
 
 # Hebrew
 windows-1255.key = H
-windows-1255     = Hebrew (Windows)
-ISO-8859-8-I     = Hebrew (ISO)
+windows-1255     = Hebrew
 # LOCALIZATION NOTE (ISO-8859-8): The value for this item should begin with
-# the same word for Hebrew as the values for windows-1255 and ISO-8859-8-I
-# so that this item sorts right after those two in the collation order for your
-# locale.
+# the same word for Hebrew as the value for windows-1255 so that this item 
+# sorts right after that one in the collation order for your locale.
 ISO-8859-8       = Hebrew, Visual
 
 # Japanese
 Shift_JIS.key    = J
 Shift_JIS        = Japanese (Shift_JIS)
 EUC-JP.key       =   p
 EUC-JP           = Japanese (EUC-JP)
 ISO-2022-JP.key  =     n
--- a/browser/metro/base/content/bindings/urlbar.xml
+++ b/browser/metro/base/content/bindings/urlbar.xml
@@ -168,17 +168,17 @@
               if (remainder != "" && remainder[0] != "/")
                 return selectedVal;
             }
 
             let uriFixup = Cc["@mozilla.org/docshell/urifixup;1"].getService(Ci.nsIURIFixup);
 
             let uri;
             try {
-              uri = uriFixup.createFixupURI(inputVal, Ci.nsIURIFixup.FIXUP_FLAG_USE_UTF8);
+              uri = uriFixup.createFixupURI(inputVal, Ci.nsIURIFixup.FIXUP_FLAG_NONE);
             } catch (e) {}
             if (!uri)
               return selectedVal;
 
             // Only copy exposable URIs
             try {
               uri = uriFixup.createExposableURI(uri);
             } catch (ex) {}
--- a/browser/modules/CharsetMenu.jsm
+++ b/browser/modules/CharsetMenu.jsm
@@ -46,17 +46,16 @@ const kEncodings = new Set([
   "KOI8-U",
   "IBM866", // Not in menu in Chromium. Maybe drop this?
   // "x-mac-cyrillic", // Not in menu in IE11 or Chromium.
   // Greek
   "windows-1253",
   "ISO-8859-7",
   // Hebrew
   "windows-1255",
-  "ISO-8859-8-I",
   "ISO-8859-8",
   // Japanese
   "Shift_JIS",
   "EUC-JP",
   "ISO-2022-JP",
   // Korean
   "EUC-KR",
   // Thai
--- a/content/base/public/nsViewportInfo.h
+++ b/content/base/public/nsViewportInfo.h
@@ -9,17 +9,17 @@
 #include "mozilla/Attributes.h"
 #include "Units.h"
 
 /**
  * Default values for the nsViewportInfo class.
  */
 static const mozilla::LayoutDeviceToScreenScale kViewportMinScale(0.0f);
 static const mozilla::LayoutDeviceToScreenScale kViewportMaxScale(10.0f);
-static const mozilla::CSSIntSize kViewportMinSize(200, 223);
+static const mozilla::CSSIntSize kViewportMinSize(200, 40);
 static const mozilla::CSSIntSize kViewportMaxSize(10000, 10000);
 static const int32_t  kViewportDefaultScreenWidth = 980;
 
 /**
  * Information retrieved from the <meta name="viewport"> tag. See
  * nsContentUtils::GetViewportInfo for more information on this functionality.
  */
 class MOZ_STACK_CLASS nsViewportInfo
--- a/content/base/src/nsDOMBlobBuilder.cpp
+++ b/content/base/src/nsDOMBlobBuilder.cpp
@@ -252,30 +252,35 @@ nsDOMMultipartFile::ParseBlobArrayArgume
         if (subBlobs) {
           blobSet.AppendBlobs(*subBlobs);
         } else {
           blobSet.AppendBlob(blob);
         }
         continue;
       }
       if (JS_IsArrayBufferViewObject(obj)) {
-        blobSet.AppendVoidPtr(JS_GetArrayBufferViewData(obj),
-                              JS_GetArrayBufferViewByteLength(obj));
+        nsresult rv = blobSet.AppendVoidPtr(
+                                          JS_GetArrayBufferViewData(obj),
+                                          JS_GetArrayBufferViewByteLength(obj));
+        NS_ENSURE_SUCCESS(rv, rv);
         continue;
       }
       if (JS_IsArrayBufferObject(obj)) {
-        blobSet.AppendArrayBuffer(obj);
+        nsresult rv = blobSet.AppendArrayBuffer(obj);
+        NS_ENSURE_SUCCESS(rv, rv);
         continue;
       }
     }
 
     // coerce it to a string
     JSString* str = JS::ToString(aCx, element);
     NS_ENSURE_TRUE(str, NS_ERROR_TYPE_ERR);
-    blobSet.AppendString(str, aNativeEOL, aCx);
+
+    nsresult rv = blobSet.AppendString(str, aNativeEOL, aCx);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
 
   mBlobs = blobSet.GetBlobs();
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMMultipartFile::GetMozFullPathInternal(nsAString &aFilename)
--- a/content/base/test/test_meta_viewport3.html
+++ b/content/base/test/test_meta_viewport3.html
@@ -15,40 +15,40 @@
 
     SimpleTest.waitForExplicitFinish();
 
     let tests = [];
 
     tests.push(function test1() {
       SpecialPowers.pushPrefEnv(scaleRatio(1.0),
         function() {
-          let info = getViewportInfo(800, 480);
+          let info = getViewportInfo(800, 80);
           is(info.defaultZoom, 2.5,   "initial zoom fits the displayWidth");
           is(info.width,       320,   "width is set explicitly");
-          is(info.height,      223,   "height is at the absolute minimum");
+          is(info.height,      40,   "height is at the absolute minimum");
           is(info.autoSize,    false, "width=device-width enables autoSize");
           is(info.allowZoom,   true,  "zooming is enabled by default");
 
           info = getViewportInfo(480, 800);
           is(info.defaultZoom, 1.5,   "initial zoom fits the new displayWidth");
           is(info.width,       320,   "explicit width is unchanged");
           is(info.height,      533,   "height changes proportional to displayHeight");
 
           nextTest();
         });
     });
 
     tests.push(function test2() {
       SpecialPowers.pushPrefEnv(scaleRatio(1.5),
         function() {
           // With an explicit width in CSS px, the scaleRatio has no effect.
-          let info = getViewportInfo(800, 480);
+          let info = getViewportInfo(800, 80);
           is(info.defaultZoom, 2.5,   "initial zoom still fits the displayWidth");
           is(info.width,       320,   "width is still set explicitly");
-          is(info.height,      223,   "height is still minimum height");
+          is(info.height,      40,   "height is still minimum height");
 
           nextTest();
         });
     });
 
     function getViewportInfo(aDisplayWidth, aDisplayHeight) {
       let defaultZoom = {}, allowZoom = {}, minZoom = {}, maxZoom = {},
           width = {}, height = {}, autoSize = {};
--- a/content/html/content/test/forms/mochitest.ini
+++ b/content/html/content/test/forms/mochitest.ini
@@ -19,20 +19,21 @@ support-files =
 [test_input_color_picker_initial.html]
 [test_input_color_picker_popup.html]
 [test_input_color_picker_update.html]
 [test_input_email.html]
 [test_input_event.html]
 [test_input_file_picker.html]
 [test_input_list_attribute.html]
 [test_input_number_key_events.html]
-# Spin buttons are hidden on Firefox OS and Firefox for Android:
-#skip-if = toolkit == "gonk" || os == 'android'
-#[test_input_number_mouse_events.html]
-#[test_input_number_rounding.html]
+[test_input_number_mouse_events.html]
+# Not run on Firefox OS and Firefox for Android where the spin buttons are hidden:
+skip-if = os == "android" || appname == "b2g"
+[test_input_number_rounding.html]
+skip-if = os == "android"
 [test_input_range_attr_order.html]
 [test_input_range_key_events.html]
 [test_input_range_mouse_and_touch_events.html]
 [test_input_range_rounding.html]
 [test_input_sanitization.html]
 [test_input_textarea_set_value_no_scroll.html]
 [test_input_typing_sanitization.html]
 [test_input_untrusted_key_events.html]
--- a/content/xul/document/src/XULDocument.cpp
+++ b/content/xul/document/src/XULDocument.cpp
@@ -212,16 +212,19 @@ XULDocument::XULDocument(void)
 XULDocument::~XULDocument()
 {
     NS_ASSERTION(mNextSrcLoadWaiter == nullptr,
         "unreferenced document still waiting for script source to load?");
 
     // In case we failed somewhere early on and the forward observer
     // decls never got resolved.
     mForwardReferences.Clear();
+    // Likewise for any references we have to IDs where we might
+    // look for persisted data:
+    mPersistenceIds.Clear();
 
     // Destroy our broadcaster map.
     if (mBroadcasterMap) {
         PL_DHashTableDestroy(mBroadcasterMap);
     }
 
     if (mLocalStore) {
         nsCOMPtr<nsIRDFRemoteDataSource> remote =
@@ -2175,16 +2178,21 @@ XULDocument::ApplyPersistentAttributes()
     // model.
     if (!mLocalStore)
         return NS_OK;
 
     mApplyingPersistedAttrs = true;
     ApplyPersistentAttributesInternal();
     mApplyingPersistedAttrs = false;
 
+    // After we've applied persistence once, we should only reapply
+    // it to nodes created by overlays
+    mRestrictPersistence = true;
+    mPersistenceIds.Clear();
+
     return NS_OK;
 }
 
 
 nsresult 
 XULDocument::ApplyPersistentAttributesInternal()
 {
     nsCOMArray<nsIContent> elements;
@@ -2219,16 +2227,19 @@ XULDocument::ApplyPersistentAttributesIn
             continue;
 
         nsAutoString id;
         nsXULContentUtils::MakeElementID(this, nsDependentCString(uri), id);
 
         if (id.IsEmpty())
             continue;
 
+        if (mRestrictPersistence && !mPersistenceIds.Contains(id))
+            continue;
+
         // This will clear the array if there are no elements.
         GetElementsForID(id, elements);
 
         if (!elements.Count())
             continue;
 
         ApplyPersistentAttributesToElements(resource, elements);
     }
@@ -2971,16 +2982,25 @@ XULDocument::ResumeWalk()
                                                     getter_AddRefs(child),
                                                     false);
                     if (NS_FAILED(rv)) return rv;
 
                     // ...and append it to the content model.
                     rv = element->AppendChildTo(child, false);
                     if (NS_FAILED(rv)) return rv;
 
+                    // If we're only restoring persisted things on
+                    // some elements, store the ID here to do that.
+                    if (mRestrictPersistence) {
+                        nsIAtom* id = child->GetID();
+                        if (id) {
+                            mPersistenceIds.PutEntry(nsDependentAtomString(id));
+                        }
+                    }
+
                     // do pre-order document-level hookup, but only if
                     // we're in the master document. For an overlay,
                     // this will happen when the overlay is
                     // successfully resolved.
                     if (mState == eState_Master)
                         AddElementToDocumentPre(child);
                 }
                 else {
--- a/content/xul/document/src/XULDocument.h
+++ b/content/xul/document/src/XULDocument.h
@@ -321,16 +321,22 @@ protected:
      * stylesheet finishes loading while the PD walk is still in
      * progress (waiting for an overlay to finish loading).
      * mStillWalking prevents DoneLoading (and StartLayout) from being
      * called in this situation.
      */
     bool                       mStillWalking;
 
     /**
+     * These two values control where persistent attributes get applied.
+     */
+    bool                           mRestrictPersistence;
+    nsTHashtable<nsStringHashKey>  mPersistenceIds;
+
+    /**
      * An array of style sheets, that will be added (preserving order) to the
      * document after all of them are loaded (in DoneWalking).
      */
     nsTArray<nsRefPtr<nsCSSStyleSheet> > mOverlaySheets;
 
     nsCOMPtr<nsIDOMXULCommandDispatcher>     mCommandDispatcher; // [OWNER] of the focus tracker
 
     // Maintains the template builders that have been attached to
--- a/content/xul/document/test/chrome.ini
+++ b/content/xul/document/test/chrome.ini
@@ -13,9 +13,10 @@ support-files =
 [test_bug403868.xul]
 [test_bug414907.xul]
 [test_bug418216.xul]
 [test_bug445177.xul]
 [test_bug449457.xul]
 [test_bug468176.xul]
 [test_bug497875.xul]
 [test_bug583948.xul]
+[test_bug640158_overlay_persist.xul]
 [test_bug757137.xul]
new file mode 100644
--- /dev/null
+++ b/content/xul/document/test/overlay_640158.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<overlay id="overlay1"
+         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <window id="rootwin">
+    <box id="bar" testattr="original"/>
+  </window>
+</overlay>
+
new file mode 100644
--- /dev/null
+++ b/content/xul/document/test/test_bug640158_overlay_persist.xul
@@ -0,0 +1,51 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=640158
+-->
+<window title="Mozilla Bug 640158" id="rootwin"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=640158"
+     target="_blank">Mozilla Bug 640158</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+  SimpleTest.waitForExplicitFinish();
+  window.onload = function onload() {
+    is($("foo").getAttribute("testattr"), "original", "Attribute should be in original state");
+    // Change and persist another value:
+    $("foo").setAttribute("testattr", "changed");
+    document.persist("foo", "testattr");
+    $("foo").setAttribute("testattr", "original");
+
+    // Hacky times: check that items which are overlaid do get persisted into correctly,
+    // by first creating an extra element and persisting the value before loading an
+    // overlay that changes that value - the persisted value should be reinstated.
+    let root = document.documentElement;
+    let bar = document.createElement("box");
+    bar.id = "bar";
+    bar.setAttribute("testattr", "changed"); // The overlay we load has 'original'
+    root.appendChild(bar);
+    document.persist("bar", "testattr");
+    document.loadOverlay(location.href.replace(/[^\\\/]*.xul/, "overlay_bug640158.xul"), function() {
+      is($("foo").getAttribute("testattr"), "original",
+         "Non-overlaid attribute should still be in original state");
+      is($("bar").getAttribute("testattr"), "changed",
+         "Overlaid attribute should have been changed.");
+      SimpleTest.finish();
+    });
+  }
+
+  ]]></script>
+
+  <box id="foo" testattr="original"/>
+
+</window>
+
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -4206,19 +4206,16 @@ nsDocShell::LoadURI(const PRUnichar * aU
         // Call the fixup object.  This will clobber the rv from NS_NewURI
         // above, but that's fine with us.  Note that we need to do this even
         // if NS_NewURI returned a URI, because fixup handles nested URIs, etc
         // (things like view-source:mozilla.org for example).
         uint32_t fixupFlags = 0;
         if (aLoadFlags & LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP) {
           fixupFlags |= nsIURIFixup::FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP;
         }
-        if (aLoadFlags & LOAD_FLAGS_URI_IS_UTF8) {
-          fixupFlags |= nsIURIFixup::FIXUP_FLAG_USE_UTF8;
-        }
         nsCOMPtr<nsIInputStream> fixupStream;
         rv = sURIFixup->CreateFixupURI(uriString, fixupFlags,
                                        getter_AddRefs(fixupStream),
                                        getter_AddRefs(uri));
         if (fixupStream) {
             // CreateFixupURI only returns a post data stream if it succeeded
             // and changed the URI, in which case we should override the
             // passed-in post data.
--- a/docshell/base/nsIURIFixup.idl
+++ b/docshell/base/nsIURIFixup.idl
@@ -27,25 +27,22 @@ interface nsIURIFixup : nsISupports
 
     /**
      * Tell the fixup to make an alternate URI from the input URI, for example
      * to turn foo into www.foo.com.
      */
     const unsigned long FIXUP_FLAGS_MAKE_ALTERNATE_URI = 2;
 
     /**
-     * Use UTF-8 to encode the URI instead of platform charset.
-     */
-    const unsigned long FIXUP_FLAG_USE_UTF8 = 4;
-
-    /**
      * Fix common scheme typos.
      */
     const unsigned long FIXUP_FLAG_FIX_SCHEME_TYPOS = 8;
 
+    /* Note that flag 4 is available. */
+
     /**
      * Converts an internal URI (e.g. a wyciwyg URI) into one which we can
      * expose to the user, for example on the URL bar.
      *
      * @param  aURI       The URI to be converted
      * @return nsIURI     The converted, exposable URI
      * @throws NS_ERROR_MALFORMED_URI when the exposable portion of aURI is malformed
      * @throws NS_ERROR_UNKNOWN_PROTOCOL when we can't get a protocol handler service
--- a/docshell/base/nsIWebNavigation.idl
+++ b/docshell/base/nsIWebNavigation.idl
@@ -180,27 +180,24 @@ interface nsIWebNavigation : nsISupports
   const unsigned long LOAD_FLAGS_FORCE_ALLOW_COOKIES = 0x20000;
 
   /**
    * Prevent the owner principal from being inherited for this load.
    */
   const unsigned long LOAD_FLAGS_DISALLOW_INHERIT_OWNER = 0x40000;
 
   /**
-   * Assume the URI is encoded in UTF-8.
-   */
-  const unsigned long LOAD_FLAGS_URI_IS_UTF8 = 0x80000;
-
-  /**
    * This flag specifies that the URI may be submitted to a third-party
    * server for correction. This should only be applied to non-sensitive
    * URIs entered by users.  This flag must not be passed to Reload.
    */
   const unsigned long LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP = 0x100000;
 
+  /* Note that flag 0x80000 is available. */
+
   /**
    * Loads a given URI.  This will give priority to loading the requested URI
    * in the object implementing	this interface.  If it can't be loaded here
    * however, the URI dispatcher will go through its normal process of content
    * loading.
    *
    * @param aURI
    *        The URI string to load.  For HTTP and FTP URLs and possibly others,
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -3738,17 +3738,17 @@ for (uint32_t i = 0; i < length; ++i) {
     if type.isDictionary():
         # There are no nullable dictionaries
         assert not type.nullable()
         # All optional dictionaries always have default values, so we
         # should be able to assume not isOptional here.
         assert not isOptional
 
         typeName = CGDictionary.makeDictionaryName(type.inner)
-        if not isMember:
+        if not isMember and not isCallbackReturnValue:
             # Since we're not a member and not nullable or optional, no one will
             # see our real type, so we can do the fast version of the dictionary
             # that doesn't pre-initialize members.
             typeName = "dictionary_detail::Fast" + typeName
 
         declType = CGGeneric(typeName)
 
         # We do manual default value handling here, because we
@@ -3778,17 +3778,21 @@ for (uint32_t i = 0; i < length; ++i) {
 
         template += ('if (!${declName}.Init(cx, %s, "%s")) {\n'
                      "%s\n"
                      "}" % (val, firstCap(sourceDescription),
                             exceptionCodeIndented.define()))
 
         # Dictionary arguments that might contain traceable things need to get
         # traced
-        if not isMember and typeNeedsRooting(type):
+        if not isMember and isCallbackReturnValue:
+            # Go ahead and just convert directly into our actual return value
+            declType = CGWrapper(declType, post="&")
+            declArgs = "retval"
+        elif not isMember and typeNeedsRooting(type):
             declType = CGTemplatedType("RootedDictionary", declType);
             declArgs = "cx"
         else:
             declArgs = None
 
         return JSToNativeConversionInfo(template, declType=declType,
                                         declArgs=declArgs)
 
@@ -9703,36 +9707,53 @@ class CGNativeMember(ClassMethod):
                 returnCode = "retval.SwapElements(${declName});"
             return "void", "", returnCode
         if type.isDate():
             result = CGGeneric("Date")
             if type.nullable():
                 result = CGTemplatedType("Nullable", result)
             return (result.define(), "%s()" % result.define(),
                     "return ${declName};")
+        if type.isDictionary():
+            if isMember:
+                # Only the first member of the tuple matters here, but return
+                # bogus values for the others in case someone decides to use
+                # them.
+                return CGDictionary.makeDictionaryName(type.inner), None, None
+            # In this case we convert directly into our outparam to start with
+            return "void", "", ""
+
         raise TypeError("Don't know how to declare return value for %s" %
                         type)
 
     def getArgs(self, returnType, argList):
         args = [self.getArg(arg) for arg in argList]
         # Now the outparams
         if returnType.isDOMString():
             args.append(Argument("nsString&", "retval"))
-        if returnType.isByteString():
+        elif returnType.isByteString():
             args.append(Argument("nsCString&", "retval"))
         elif returnType.isSequence():
             nullable = returnType.nullable()
             if nullable:
                 returnType = returnType.inner
             # And now the actual underlying type
             elementDecl = self.getReturnType(returnType.inner, True)
             type = CGTemplatedType("nsTArray", CGGeneric(elementDecl))
             if nullable:
                 type = CGTemplatedType("Nullable", type)
             args.append(Argument("%s&" % type.define(), "retval"))
+        elif returnType.isDictionary():
+            nullable = returnType.nullable()
+            if nullable:
+                returnType = returnType.inner
+            dictType = CGGeneric(CGDictionary.makeDictionaryName(returnType.inner))
+            if nullable:
+                dictType = CGTemplatedType("Nullable", dictType)
+            args.append(Argument("%s&" % dictType.define(), "retval"))
         # And the ErrorResult
         if not 'infallible' in self.extendedAttrs:
             # Use aRv so it won't conflict with local vars named "rv"
             args.append(Argument("ErrorResult&", "aRv"))
         # The legacycaller thisval
         if self.member.isMethod() and self.member.isLegacycaller():
             # If it has an identifier, we can't deal with it yet
             assert self.member.isIdentifierLess()
--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -2027,17 +2027,17 @@ class IDLWrapperType(IDLType):
     def isSerializable(self):
         if self.isInterface():
             if self.inner.isExternal():
                 return False
             return any(m.isMethod() and m.isJsonifier() for m in self.inner.members)
         elif self.isEnum():
             return True
         elif self.isDictionary():
-            return all(m.isSerializable() for m in self.inner.members)
+            return all(m.type.isSerializable() for m in self.inner.members)
         else:
             raise WebIDLError("IDLWrapperType wraps type %s that we don't know if "
                               "is serializable" % type(self.inner), [self.location])
 
     def resolveType(self, parentScope):
         assert isinstance(parentScope, IDLScope)
         self.inner.resolve(parentScope)
 
--- a/dom/bindings/test/TestBindingHeader.h
+++ b/dom/bindings/test/TestBindingHeader.h
@@ -336,16 +336,17 @@ public:
   void PassOptionalNonNullCallbackInterface(const Optional<OwningNonNull<TestCallbackInterface> >&);
   void PassOptionalCallbackInterfaceWithDefault(TestCallbackInterface*);
 
   already_AddRefed<IndirectlyImplementedInterface> ReceiveConsequentialInterface();
   void PassConsequentialInterface(IndirectlyImplementedInterface&);
 
   // Sequence types
   void GetReadonlySequence(nsTArray<int32_t>&);
+  void GetReadonlySequenceOfDictionaries(JSContext*, nsTArray<Dict>&);
   void ReceiveSequence(nsTArray<int32_t>&);
   void ReceiveNullableSequence(Nullable< nsTArray<int32_t> >&);
   void ReceiveSequenceOfNullableInts(nsTArray< Nullable<int32_t> >&);
   void ReceiveNullableSequenceOfNullableInts(Nullable< nsTArray< Nullable<int32_t> > >&);
   void PassSequence(const Sequence<int32_t> &);
   void PassNullableSequence(const Nullable< Sequence<int32_t> >&);
   void PassSequenceOfNullableInts(const Sequence<Nullable<int32_t> >&);
   void PassOptionalSequenceOfNullableInts(const Optional<Sequence<Nullable<int32_t> > > &);
--- a/dom/bindings/test/TestCodeGen.webidl
+++ b/dom/bindings/test/TestCodeGen.webidl
@@ -292,16 +292,18 @@ interface TestInterface {
 
   // Miscellaneous interface tests
   IndirectlyImplementedInterface receiveConsequentialInterface();
   void passConsequentialInterface(IndirectlyImplementedInterface arg);
 
   // Sequence types
   [Cached, Pure]
   readonly attribute sequence<long> readonlySequence;
+  [Cached, Pure]
+  readonly attribute sequence<Dict> readonlySequenceOfDictionaries;
   sequence<long> receiveSequence();
   sequence<long>? receiveNullableSequence();
   sequence<long?> receiveSequenceOfNullableInts();
   sequence<long?>? receiveNullableSequenceOfNullableInts();
   void passSequence(sequence<long> arg);
   void passNullableSequence(sequence<long>? arg);
   void passSequenceOfNullableInts(sequence<long?> arg);
   void passOptionalSequenceOfNullableInts(optional sequence<long?> arg);
--- a/dom/bindings/test/TestExampleGen.webidl
+++ b/dom/bindings/test/TestExampleGen.webidl
@@ -188,16 +188,18 @@ interface TestExampleInterface {
 
   // Miscellaneous interface tests
   IndirectlyImplementedInterface receiveConsequentialInterface();
   void passConsequentialInterface(IndirectlyImplementedInterface arg);
 
   // Sequence types
   [Cached, Pure]
   readonly attribute sequence<long> readonlySequence;
+  [Cached, Pure]
+  readonly attribute sequence<Dict> readonlySequenceOfDictionaries;
   sequence<long> receiveSequence();
   sequence<long>? receiveNullableSequence();
   sequence<long?> receiveSequenceOfNullableInts();
   sequence<long?>? receiveNullableSequenceOfNullableInts();
   void passSequence(sequence<long> arg);
   void passNullableSequence(sequence<long>? arg);
   void passSequenceOfNullableInts(sequence<long?> arg);
   void passOptionalSequenceOfNullableInts(optional sequence<long?> arg);
@@ -422,29 +424,28 @@ interface TestExampleInterface {
 
   // binaryNames tests
   void methodRenamedFrom();
   void methodRenamedFrom(byte argument);
   readonly attribute byte attributeGetterRenamedFrom;
   attribute byte attributeRenamedFrom;
 
   void passDictionary(optional Dict x);
-  // FIXME: Bug 863949 no dictionary return values in callbacks
-  // Dict receiveDictionary();
-  // Dict? receiveNullableDictionary();
+  Dict receiveDictionary();
+  Dict? receiveNullableDictionary();
   void passOtherDictionary(optional GrandparentDict x);
   void passSequenceOfDictionaries(sequence<Dict> x);
   // No support for nullable dictionaries inside a sequence (nor should there be)
   //  void passSequenceOfNullableDictionaries(sequence<Dict?> x);
   void passDictionaryOrLong(optional Dict x);
   void passDictionaryOrLong(long x);
 
   void passDictContainingDict(optional DictContainingDict arg);
   void passDictContainingSequence(optional DictContainingSequence arg);
-  //UNSUPPORTED DictContainingSequence receiveDictContainingSequence();
+  DictContainingSequence receiveDictContainingSequence();
 
   // EnforceRange/Clamp tests
   void dontEnforceRangeOrClamp(byte arg);
   void doEnforceRange([EnforceRange] byte arg);
   void doClamp([Clamp] byte arg);
   [EnforceRange] attribute byte enforcedByte;
   [Clamp] attribute byte clampedByte;
 
--- a/dom/bindings/test/TestJSImplGen.webidl
+++ b/dom/bindings/test/TestJSImplGen.webidl
@@ -209,16 +209,18 @@ interface TestJSImplInterface {
 
   // Miscellaneous interface tests
   IndirectlyImplementedInterface receiveConsequentialInterface();
   void passConsequentialInterface(IndirectlyImplementedInterface arg);
 
   // Sequence types
   [Cached, Pure]
   readonly attribute sequence<long> readonlySequence;
+  [Cached, Pure]
+  readonly attribute sequence<Dict> readonlySequenceOfDictionaries;
   sequence<long> receiveSequence();
   sequence<long>? receiveNullableSequence();
   sequence<long?> receiveSequenceOfNullableInts();
   sequence<long?>? receiveNullableSequenceOfNullableInts();
   void passSequence(sequence<long> arg);
   void passNullableSequence(sequence<long>? arg);
   void passSequenceOfNullableInts(sequence<long?> arg);
   void passOptionalSequenceOfNullableInts(optional sequence<long?> arg);
@@ -446,30 +448,29 @@ interface TestJSImplInterface {
 
   // binaryNames tests
   void methodRenamedFrom();
   void methodRenamedFrom(byte argument);
   readonly attribute byte attributeGetterRenamedFrom;
   attribute byte attributeRenamedFrom;
 
   void passDictionary(optional Dict x);
-  // FIXME: Bug 863949 no dictionary return values
-  //   Dict receiveDictionary();
-  //   Dict? receiveNullableDictionary();
+  Dict receiveDictionary();
+  // No support for nullable dictionary return values here yet
+  //  Dict? receiveNullableDictionary();
   void passOtherDictionary(optional GrandparentDict x);
   void passSequenceOfDictionaries(sequence<Dict> x);
   // No support for nullable dictionaries inside a sequence (nor should there be)
   //  void passSequenceOfNullableDictionaries(sequence<Dict?> x);
   void passDictionaryOrLong(optional Dict x);
   void passDictionaryOrLong(long x);
 
   void passDictContainingDict(optional DictContainingDict arg);
   void passDictContainingSequence(optional DictContainingSequence arg);
-  // FIXME: Bug 863949 no dictionary return values
-  //   DictContainingSequence receiveDictContainingSequence();
+  DictContainingSequence receiveDictContainingSequence();
 
   // EnforceRange/Clamp tests
   void dontEnforceRangeOrClamp(byte arg);
   void doEnforceRange([EnforceRange] byte arg);
   void doClamp([Clamp] byte arg);
   [EnforceRange] attribute byte enforcedByte;
   [Clamp] attribute byte clampedByte;
 
--- a/dom/bluetooth/Makefile.in
+++ b/dom/bluetooth/Makefile.in
@@ -7,29 +7,22 @@
 #     http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-VPATH += $(srcdir)/ipc
-
 ifneq (,$(MOZ_B2G_BT))
 
 ifeq (gonk,$(MOZ_WIDGET_TOOLKIT))
 ifdef MOZ_B2G_BT_BLUEZ
 LOCAL_INCLUDES += $(MOZ_DBUS_CFLAGS)
 endif #MOZ_B2G_BT_BLUEZ
 else
 ifdef MOZ_ENABLE_DBUS
 LOCAL_INCLUDES += $(MOZ_DBUS_CFLAGS)
 CFLAGS += $(MOZ_DBUS_GLIB_CFLAGS)
 CXXFLAGS += $(MOZ_DBUS_GLIB_CFLAGS) -DHAVE_PTHREADS
 endif #MOZ_ENABLE_DBUS
 endif #MOZ_WIDGET_TOOLKIT
-
-# Add VPATH to LOCAL_INCLUDES so we are going to include the correct backend
-# subdirectory.
-LOCAL_INCLUDES += $(VPATH:%=-I%)
-
 endif #MOZ_B2G_BT
--- a/dom/bluetooth/moz.build
+++ b/dom/bluetooth/moz.build
@@ -67,16 +67,20 @@ if CONFIG['MOZ_B2G_BT']:
         LOCAL_INCLUDES += [
             'bluez',
             'bluez/linux',
         ]
         DEFINES['MOZ_BLUETOOTH_DBUS'] = True
 
     FINAL_LIBRARY = 'gklayout'
 
+    LOCAL_INCLUDES += [
+        'ipc',
+    ]
+
 EXPORTS.mozilla.dom.bluetooth.ipc += [
     'ipc/BluetoothMessageUtils.h',
 ]
 
 EXPORTS.mozilla.dom.bluetooth += [
     'BluetoothCommon.h',
 ]
 
deleted file mode 100644
--- a/dom/contacts/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-VPATH += $(srcdir)/fallback
--- a/dom/contacts/moz.build
+++ b/dom/contacts/moz.build
@@ -9,15 +9,15 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'andr
     TEST_DIRS += ['tests']
 
 EXTRA_COMPONENTS += [
     'ContactManager.js',
     'ContactManager.manifest',
 ]
 
 EXTRA_JS_MODULES += [
-    'ContactDB.jsm',
+    'fallback/ContactDB.jsm',
 ]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'android':
     EXTRA_JS_MODULES += [
-        'ContactService.jsm'
+        'fallback/ContactService.jsm'
     ]
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -1525,17 +1525,18 @@ TabChild::RecvUpdateFrame(const FrameMet
       return ProcessUpdateFrame(aFrameMetrics);
     }
   } else {
     // aFrameMetrics.mIsRoot is false, so we are trying to update a subframe.
     // This requires special handling.
     nsCOMPtr<nsIContent> content = nsLayoutUtils::FindContentFor(
                                       aFrameMetrics.mScrollId);
     if (content) {
-      APZCCallbackHelper::UpdateSubFrame(content, aFrameMetrics);
+      FrameMetrics newSubFrameMetrics(aFrameMetrics);
+      APZCCallbackHelper::UpdateSubFrame(content, newSubFrameMetrics);
       return true;
     }
   }
 
   // We've recieved a message that is out of date and we want to ignore.
   // However we can't reply without painting so we reply by painting the
   // exact same thing as we did before.
   return ProcessUpdateFrame(mLastMetrics);
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@@ -2316,17 +2316,24 @@ nsPluginHost::WritePluginInfo()
     PR_fprintf(fd, "%lld%c%c\n",
       invalidPlugins->mLastModifiedTime,
       PLUGIN_REGISTRY_FIELD_DELIMITER,
       PLUGIN_REGISTRY_END_OF_LINE_MARKER);
 
     invalidPlugins = invalidPlugins->mNext;
   }
 
-  PR_Close(fd);
+  PRStatus prrc;
+  prrc = PR_Close(fd);
+  if (prrc != PR_SUCCESS) {
+    // we should obtain a refined value based on prrc;
+    rv = NS_ERROR_FAILURE;
+    MOZ_ASSERT(false, "PR_Close() failed.");
+    return rv;
+  }
   nsCOMPtr<nsIFile> parent;
   rv = pluginReg->GetParent(getter_AddRefs(parent));
   NS_ENSURE_SUCCESS(rv, rv);
   rv = pluginReg->MoveToNative(parent, kPluginRegistryFilename);
   return rv;
 }
 
 nsresult
@@ -2393,17 +2400,25 @@ nsPluginHost::ReadPluginInfo()
   rv = pluginReg->OpenNSPRFileDesc(PR_RDONLY, 0444, &fd);
   if (NS_FAILED(rv))
     return rv;
 
   // set rv to return an error on goto out
   rv = NS_ERROR_FAILURE;
 
   int32_t bread = PR_Read(fd, registry, flen);
-  PR_Close(fd);
+
+  PRStatus prrc;
+  prrc = PR_Close(fd);
+  if (prrc != PR_SUCCESS) {
+    // Strange error: this is one of those "Should not happen" error.
+    // we may want to report something more refined than  NS_ERROR_FAILURE.
+    MOZ_ASSERT(false, "PR_Close() failed.");
+    return rv;
+  }
 
   if (flen > bread)
     return rv;
 
   if (!ReadSectionHeader(reader, "HEADER"))
     return rv;;
 
   if (!reader.NextLine())
--- a/dom/plugins/test/testplugin/testplugin.mk
+++ b/dom/plugins/test/testplugin/testplugin.mk
@@ -4,18 +4,16 @@
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # Don't use STL wrappers; nptest isn't Gecko code
 STL_FLAGS =
 
 # must link statically with the CRT; nptest isn't Gecko code
 USE_STATIC_LIBS = 1
 
-VPATH += $(topsrcdir)/build
-
 ifeq ($(MOZ_WIDGET_TOOLKIT),qt)
 include $(topsrcdir)/config/config.mk
 CXXFLAGS        += $(MOZ_QT_CFLAGS)
 CFLAGS          += $(MOZ_QT_CFLAGS)
 EXTRA_DSO_LDOPTS = \
                 $(MOZ_QT_LIBS) \
                 $(XLDFLAGS) \
                 $(XLIBS)
--- a/dom/webidl/PeerConnectionObserver.webidl
+++ b/dom/webidl/PeerConnectionObserver.webidl
@@ -44,13 +44,10 @@ interface PeerConnectionObserver
   void onAddStream(MediaStream stream);
   void onRemoveStream();
   void onAddTrack();
   void onRemoveTrack();
 
   /* Helper function to access supported constraints defined in webidl. Needs to
    * be in a separate webidl object we hold, so putting it here was convenient.
    */
-// TODO: Bug 863949
-//  MediaConstraintSet getSupportedConstraints(optional
-  object getSupportedConstraints(optional
-      MediaConstraintSet constraints);
+  MediaConstraintSet getSupportedConstraints(optional MediaConstraintSet constraints);
 };
--- a/gfx/gl/GLBlitHelper.cpp
+++ b/gfx/gl/GLBlitHelper.cpp
@@ -15,19 +15,17 @@ namespace gl {
 GLBlitHelper::GLBlitHelper(GLContext* gl)
     : mGL(gl)
     , mTexBlit_Buffer(0)
     , mTexBlit_VertShader(0)
     , mTex2DBlit_FragShader(0)
     , mTex2DRectBlit_FragShader(0)
     , mTex2DBlit_Program(0)
     , mTex2DRectBlit_Program(0)
-    , mTexBlit_UseDrawNotCopy(false)
 {
-    mTexBlit_UseDrawNotCopy = Preferences::GetBool("gl.blit-draw-not-copy", false);
 }
 
 GLBlitHelper::~GLBlitHelper()
 {
     DeleteTexBlitProgram();
 }
 
 // Allowed to be destructive of state we restore in functions below.
@@ -485,25 +483,16 @@ void
 GLBlitHelper::BlitTextureToTexture(GLuint srcTex, GLuint destTex,
                                 const gfxIntSize& srcSize,
                                 const gfxIntSize& destSize,
                                 GLenum srcTarget, GLenum destTarget)
 {
     MOZ_ASSERT(mGL->fIsTexture(srcTex));
     MOZ_ASSERT(mGL->fIsTexture(destTex));
 
-    if (mTexBlit_UseDrawNotCopy) {
-        // Draw is texture->framebuffer
-        ScopedFramebufferForTexture destWrapper(mGL, destTex, destTarget);
-
-        BlitTextureToFramebuffer(srcTex, destWrapper.FB(),
-                                 srcSize, destSize, srcTarget);
-        return;
-    }
-
     // Generally, just use the CopyTexSubImage path
     ScopedFramebufferForTexture srcWrapper(mGL, srcTex, srcTarget);
 
     BlitFramebufferToTexture(srcWrapper.FB(), destTex,
                              srcSize, destSize, destTarget);
 }
 
 }
--- a/gfx/gl/GLBlitHelper.h
+++ b/gfx/gl/GLBlitHelper.h
@@ -25,18 +25,16 @@ class GLBlitHelper MOZ_FINAL
 
     GLuint mTexBlit_Buffer;
     GLuint mTexBlit_VertShader;
     GLuint mTex2DBlit_FragShader;
     GLuint mTex2DRectBlit_FragShader;
     GLuint mTex2DBlit_Program;
     GLuint mTex2DRectBlit_Program;
 
-    bool mTexBlit_UseDrawNotCopy;
-
     void UseBlitProgram();
     void SetBlitFramebufferForDestTexture(GLuint aTexture);
 
     bool UseTexQuadProgram(GLenum target, const nsIntSize& srcSize);
     bool InitTexQuadProgram(GLenum target = LOCAL_GL_TEXTURE_2D);
     void DeleteTexBlitProgram();
 
 public:
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -325,22 +325,41 @@ public:
 #ifdef DEBUG
   // In debug builds, we check some properties of |aLayer|.
   virtual void Mutated(Layer* aLayer);
 #else
   virtual void Mutated(Layer* aLayer) { }
 #endif
 
   /**
+   * Hints that can be used during Thebes layer creation to influence the type
+   * or properties of the layer created.
+   *
+   * NONE: No hint.
+   * SCROLLABLE: This layer may represent scrollable content.
+   */
+  enum ThebesLayerCreationHint {
+    NONE, SCROLLABLE
+  };
+
+  /**
    * CONSTRUCTION PHASE ONLY
    * Create a ThebesLayer for this manager's layer tree.
    */
   virtual already_AddRefed<ThebesLayer> CreateThebesLayer() = 0;
   /**
    * CONSTRUCTION PHASE ONLY
+   * Create a ThebesLayer for this manager's layer tree, with a creation hint
+   * parameter to help optimise the type of layer created.
+   */
+  virtual already_AddRefed<ThebesLayer> CreateThebesLayerWithHint(ThebesLayerCreationHint) {
+    return CreateThebesLayer();
+  }
+  /**
+   * CONSTRUCTION PHASE ONLY
    * Create a ContainerLayer for this manager's layer tree.
    */
   virtual already_AddRefed<ContainerLayer> CreateContainerLayer() = 0;
   /**
    * CONSTRUCTION PHASE ONLY
    * Create an ImageLayer for this manager's layer tree.
    */
   virtual already_AddRefed<ImageLayer> CreateImageLayer() = 0;
--- a/gfx/layers/client/ClientLayerManager.h
+++ b/gfx/layers/client/ClientLayerManager.h
@@ -61,16 +61,17 @@ public:
   virtual void GetBackendName(nsAString& name);
   virtual const char* Name() const { return "Client"; }
 
   virtual void SetRoot(Layer* aLayer);
 
   virtual void Mutated(Layer* aLayer);
 
   virtual already_AddRefed<ThebesLayer> CreateThebesLayer();
+  virtual already_AddRefed<ThebesLayer> CreateThebesLayerWithHint(ThebesLayerCreationHint aHint);
   virtual already_AddRefed<ContainerLayer> CreateContainerLayer();
   virtual already_AddRefed<ImageLayer> CreateImageLayer();
   virtual already_AddRefed<CanvasLayer> CreateCanvasLayer();
   virtual already_AddRefed<ColorLayer> CreateColorLayer();
   virtual already_AddRefed<RefLayer> CreateRefLayer();
 
   virtual TextureFactoryIdentifier GetTextureFactoryIdentifier() MOZ_OVERRIDE
   {
--- a/gfx/layers/client/ClientThebesLayer.cpp
+++ b/gfx/layers/client/ClientThebesLayer.cpp
@@ -148,18 +148,28 @@ ClientThebesLayer::PaintBuffer(gfxContex
   contentClientRemote->Updated(aRegionToDraw,
                                mVisibleRegion,
                                aDidSelfCopy);
 }
 
 already_AddRefed<ThebesLayer>
 ClientLayerManager::CreateThebesLayer()
 {
+  return CreateThebesLayerWithHint(NONE);
+}
+
+already_AddRefed<ThebesLayer>
+ClientLayerManager::CreateThebesLayerWithHint(ThebesLayerCreationHint aHint)
+{
   NS_ASSERTION(InConstruction(), "Only allowed in construction phase");
-  if (Preferences::GetBool("layers.force-tiles") && AsShadowForwarder()->GetCompositorBackendType() == LAYERS_OPENGL) {
+  if (
+#ifdef MOZ_B2G
+      aHint == SCROLLABLE &&
+#endif
+      Preferences::GetBool("layers.force-tiles") && AsShadowForwarder()->GetCompositorBackendType() == LAYERS_OPENGL) {
     nsRefPtr<ClientTiledThebesLayer> layer =
       new ClientTiledThebesLayer(this);
     CREATE_SHADOW(Thebes);
     return layer.forget();
   } else
   {
     nsRefPtr<ClientThebesLayer> layer =
       new ClientThebesLayer(this);
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -1413,17 +1413,19 @@ void AsyncPanZoomController::UpdateCompo
 
   // If the window had 0 dimensions before, or does now, we don't want to
   // repaint or update the zoom since we'll run into rendering issues and/or
   // divide-by-zero. This manifests itself as the screen flashing. If the page
   // has gone out of view, the buffer will be cleared elsewhere anyways.
   if (aCompositionBounds.width && aCompositionBounds.height &&
       oldCompositionBounds.width && oldCompositionBounds.height) {
     float adjustmentFactor = float(aCompositionBounds.width) / float(oldCompositionBounds.width);
-    mFrameMetrics.mZoom.scale *= adjustmentFactor;
+    mFrameMetrics.mZoom.scale =
+      clamped(mFrameMetrics.mZoom.scale * adjustmentFactor,
+              mMinZoom.scale, mMaxZoom.scale);
 
     // Repaint on a rotation so that our new resolution gets properly updated.
     RequestContentRepaint();
   }
 }
 
 void AsyncPanZoomController::ZoomToRect(CSSRect aRect) {
   SetState(ANIMATING_ZOOM);
--- a/gfx/tests/gtest/moz.build
+++ b/gfx/tests/gtest/moz.build
@@ -3,17 +3,18 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 LIBRARY_NAME = 'gfxtest'
 
 UNIFIED_SOURCES += [
     'gfxSurfaceRefCountTest.cpp',
-    'gfxWordCacheTest.cpp',
+    # Disabled on suspicion of causing bug 904227
+    #'gfxWordCacheTest.cpp',
     'TestAsyncPanZoomController.cpp',
     'TestBufferRotation.cpp',
     'TestColorNames.cpp',
     'TestLayers.cpp',
     'TestRegion.cpp',
     # Hangs on linux in ApplyGdkScreenFontOptions
     #'gfxFontSelectionTest.cpp',
     'TestTextures.cpp',
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -17,79 +17,17 @@ endif
 TOPLEVEL_BUILD := 1
 
 run_for_side_effects := $(shell echo 'MAKE: $(MAKE)')
 STATIC_LIBRARY_NAME = js_static
 LIBS		= $(NSPR_LIBS)
 
 DIST_INSTALL = 1
 
-VPATH		+= \
-		$(srcdir) \
-		$(srcdir)/builtin \
-		$(srcdir)/devtools \
-		$(srcdir)/ds \
-		$(srcdir)/frontend \
-		$(srcdir)/gc \
-		$(srcdir)/vm \
-		$(NULL)
-
-######################################################
-# BEGIN include exported headers from the JS engine
-#
-#       Ultimately, after cleansing EXPORTS,
-#       these will be the ONLY headers exported by
-#       the js engine
-#
-VPATH		+= \
-		$(srcdir)/../public \
-		$(NULL)
-
-###############################################
-# BEGIN enable non-releasable features
-#
-# Ion
-ifdef ENABLE_ION
-VPATH +=	$(srcdir)/jit
-VPATH +=	$(srcdir)/jit/shared
-
-ifeq (86, $(findstring 86,$(TARGET_CPU)))
-ifeq (x86_64, $(TARGET_CPU))
-VPATH +=	$(srcdir)/jit/x64
-else
-VPATH +=	$(srcdir)/jit/x86
-endif
-endif
-ifeq (arm, $(findstring arm, $(TARGET_CPU)))
-VPATH +=	$(srcdir)/jit/arm
-endif
-endif #ENABLE_ION
-
-###############################################
-# BEGIN include sources for the Nitro assembler
-#
-
-VPATH += 	$(srcdir)/assembler \
-		$(srcdir)/assembler/wtf \
-		$(srcdir)/assembler/jit \
-		$(srcdir)/yarr \
-		$(NONE)
-
-ifneq (,$(ENABLE_ION)$(ENABLE_YARR_JIT))
-VPATH += 	$(srcdir)/assembler/assembler \
-		$(NONE)
-endif
-
-#
-# END include sources for the Nitro assembler
-#############################################
-
 ifdef JS_HAS_CTYPES
-VPATH += $(srcdir)/ctypes
-
 ifdef MOZ_NATIVE_FFI
 LOCAL_INCLUDES = $(MOZ_FFI_CFLAGS)
 else
 LOCAL_INCLUDES = -Ictypes/libffi/include
 endif
 
 ifdef MOZ_NATIVE_FFI
 EXTRA_DSO_LDOPTS += $(MOZ_FFI_LIBS)
@@ -102,22 +40,16 @@ else
 SHARED_LIBRARY_LIBS += \
     ctypes/libffi/.libs/libffi.$(LIB_SUFFIX) \
     $(NULL)
 endif
 endif
 
 endif # JS_HAS_CTYPES
 
-# PerfMeasurement is available regardless of low-level support for it;
-# it just doesn't necessarily do anything useful.  There is one
-# implementation source file per supported operating system, plus a stub
-# for unsupported OSes, plus the Javascript wrapper.
-VPATH += $(srcdir)/perf
-
 DASH_R		= -r
 
 ifneq (,$(filter OS2 WINNT,$(OS_ARCH)))
 SDK_LIBRARY = $(IMPORT_LIBRARY)
 else
 SDK_LIBRARY = $(SHARED_LIBRARY)
 endif
 
@@ -356,16 +288,21 @@ DIST_GARBAGE = config.cache config.log c
    backend.RecursiveMakeBackend backend.RecursiveMakeBackend.pp \
    devtools/rootAnalysis/Makefile
 
 distclean::
 	$(RM) $(DIST_GARBAGE)
 
 INCLUDES	+= -I$(srcdir)
 
+ifneq (,$(filter WINNT,$(OS_ARCH)))
+# _CRT_RAND_S must be #defined before #including stdlib.h to get rand_s()
+DEFINES         += -D_CRT_RAND_S
+endif
+
 ifneq ($(findstring -L,$(NSPR_LIBS)),)
 NSPR_STATIC_PATH = $(subst -L,,$(findstring -L,$(NSPR_LIBS)))
 else
 NSPR_STATIC_PATH = $(DIST)/lib
 endif
 
 ifdef MOZ_ETW
 # This will get the ETW provider resources into the library mozjs.dll
--- a/js/src/builtin/Profilers.h
+++ b/js/src/builtin/Profilers.h
@@ -8,17 +8,17 @@
  * Functions for controlling profilers from within JS: Valgrind, Perf,
  * Shark, etc.
  */
 #ifndef builtin_Profilers_h
 #define builtin_Profilers_h
 
 #include "jstypes.h"
 
-#ifdef XP_WIN
+#ifdef _MSC_VER
 typedef int pid_t;
 #else
 #include <unistd.h>
 #endif
 
 /**
  * Start any profilers that are available and have been configured on for this
  * platform. This is NOT thread safe.
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -4757,18 +4757,23 @@ StructType::Create(JSContext* cx, unsign
 
   args.rval().setObject(*result);
   return true;
 }
 
 static void
 PostBarrierCallback(JSTracer *trc, void *k, void *d)
 {
+    typedef HashMap<JSFlatString*,
+                    UnbarrieredFieldInfo,
+                    FieldHashPolicy,
+                    SystemAllocPolicy> UnbarrieredFieldInfoHash;
+
     JSString *prior = static_cast<JSString*>(k);
-    FieldInfoHash *table = static_cast<FieldInfoHash*>(d);
+    UnbarrieredFieldInfoHash *table = reinterpret_cast<UnbarrieredFieldInfoHash*>(d);
     JSString *key = prior;
     JS_CallStringTracer(trc, &key, "CType fieldName");
     table->rekeyIfMoved(JS_ASSERT_STRING_IS_FLAT(prior), JS_ASSERT_STRING_IS_FLAT(key));
 }
 
 bool
 StructType::DefineInternal(JSContext* cx, JSObject* typeObj_, JSObject* fieldsObj_)
 {
--- a/js/src/ctypes/CTypes.h
+++ b/js/src/ctypes/CTypes.h
@@ -214,16 +214,25 @@ enum TypeCode {
 // as the key to the hash entry.
 struct FieldInfo
 {
   JS::Heap<JSObject*> mType;    // CType of the field
   size_t              mIndex;   // index of the field in the struct (first is 0)
   size_t              mOffset;  // offset of the field in the struct, in bytes
 };
 
+struct UnbarrieredFieldInfo
+{
+  JSObject*           mType;    // CType of the field
+  size_t              mIndex;   // index of the field in the struct (first is 0)
+  size_t              mOffset;  // offset of the field in the struct, in bytes
+};
+static_assert(sizeof(UnbarrieredFieldInfo) == sizeof(FieldInfo),
+              "UnbarrieredFieldInfo should be the same as FieldInfo but with unbarriered mType");
+
 // Hash policy for FieldInfos.
 struct FieldHashPolicy : DefaultHasher<JSFlatString*>
 {
   typedef JSFlatString* Key;
   typedef Key Lookup;
 
   static uint32_t hash(const Lookup &l) {
     const jschar* s = l->chars();
--- a/js/src/devtools/rootAnalysis/Makefile.in
+++ b/js/src/devtools/rootAnalysis/Makefile.in
@@ -9,18 +9,16 @@
 # Makefile will use $PATH to subvert compiler invocations to add in the sixgill
 # plugin, and then do a regular build of whatever portion of the tree you are
 # analyzing. The plugins will dump out several xdb database files. Various
 # analysis scripts, written in JS, will run over those database files to
 # produce the final analysis output.
 
 include $(topsrcdir)/config/config.mk
 
-VPATH += $(srcdir)
-
 # Tree to build and analyze, defaulting to the current tree
 TARGET_JSOBJDIR ?= $(MOZ_BUILD_ROOT)
 
 # Path to a JS binary to use to run the analysis. You really want this to be an
 # optimized build.
 JS ?= $(MOZ_BUILD_ROOT)/shell/js
 
 # Path to an xgill checkout containing the GCC plugin, xdb-processing binaries,
--- a/js/src/gdb/Makefile.in
+++ b/js/src/gdb/Makefile.in
@@ -1,16 +1,14 @@
 # -*- Mode: makefile -*-
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-VPATH		= @srcdir@ @srcdir@/tests
-
 LIBS = $(DEPTH)/$(LIB_PREFIX)js_static.$(LIB_SUFFIX) $(NSPR_LIBS) $(MOZ_ZLIB_LIBS)
 
 LOCAL_INCLUDES += -I$(topsrcdir) -I..
 
 ifdef MOZ_NATIVE_ICU
 EXTRA_LIBS += $(MOZ_ICU_LIBS)
 endif
 
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug653438.js
@@ -0,0 +1,2 @@
+assertEq((123456789).toExponential(), "1.23456789e+8");
+assertEq((123456789).toExponential(undefined), "1.23456789e+8");
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug945811.js
@@ -0,0 +1,17 @@
+function toPrinted(value) {}
+function reportCompare (expected, actual, description) {
+    if (expected != actual)
+        + toPrinted(actual)
+}
+test();
+function test() {
+    reportCompare();
+    try {
+        test();
+    } catch (e) {
+	try {
+            new test();
+	} catch(e) {}
+    }
+    reportCompare();
+}
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug946284.js
@@ -0,0 +1,5 @@
+function f(x) {
+    return x.length / 2
+}
+f("")
+assertEq(f(undefined + ""), 4.5);
--- a/js/src/jit-test/tests/ion/divmodself.js
+++ b/js/src/jit-test/tests/ion/divmodself.js
@@ -44,16 +44,28 @@ function bug_g() {
 }
 function bug_h(x) {
     Math.max(x ? ((x / x) | 0) : 0);
 }
 for (var a = 0; a < 2; ++a) {
   bug939893();
 }
 
+// bug 945860
+function bug945860(x) {
+    return (x % x);
+}
+for (var i = 0; i < 2; i++) {
+    try {
+        (function() {
+            assertEq(bug945860(1), 0);
+        })()
+    } catch (e) {}
+}
+
 // Assorted tests.
 
 function sdiv_truncate(y) {
   return (y / y)|0;
 }
 assertEq(sdiv_truncate(5), 1);
 assertEq(sdiv_truncate(1), 1);
 assertEq(sdiv_truncate(-1), 1);
--- a/js/src/jit/IonAllocPolicy.h
+++ b/js/src/jit/IonAllocPolicy.h
@@ -160,30 +160,39 @@ class AutoIonContextAlloc
     ~AutoIonContextAlloc() {
         JS_ASSERT(icx_->temp == &tempAlloc_);
         icx_->temp = prevAlloc_;
     }
 };
 
 struct TempObject
 {
-    inline void *operator new(size_t nbytes) {
-        return GetIonContext()->temp->allocateInfallible(nbytes);
-    }
     inline void *operator new(size_t nbytes, TempAllocator &alloc) {
         return alloc.allocateInfallible(nbytes);
     }
     template <class T>
     inline void *operator new(size_t nbytes, T *pos) {
         static_assert(mozilla::IsConvertible<T*, TempObject*>::value,
                       "Placement new argument type must inherit from TempObject");
         return pos;
     }
 };
 
+// Deprecated, don't use for (new) classes. Will be removed when all classes have
+// been converted to placement new/TempObject (bug 937540).
+struct OldTempObject
+  : public TempObject
+{
+    using TempObject::operator new;
+
+    inline void *operator new(size_t nbytes) {
+        return GetIonContext()->temp->allocateInfallible(nbytes);
+    }
+};
+
 template <typename T>
 class TempObjectPool
 {
     InlineForwardList<T> freed_;
 
   public:
     T *allocate() {
         if (freed_.empty())
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -306,121 +306,100 @@ IonBuilder::getPolyCallTargets(types::Te
 
     // For now, only inline "singleton" lambda calls
     if (*gotLambda && targets.length() > 1)
         targets.clear();
 
     return true;
 }
 
-bool
-IonBuilder::canEnterInlinedFunction(JSFunction *target)
-{
-    if (target->isHeavyweight())
-        return false;
-
-    JSScript *targetScript = target->nonLazyScript();
-
-    if (targetScript->uninlineable)
-        return false;
-
-    if (!targetScript->analyzedArgsUsage())
-        return false;
-
-    if (targetScript->needsArgsObj())
-        return false;
-
-    if (!targetScript->compileAndGo)
-        return false;
-
-    types::TypeObjectKey *targetType = types::TypeObjectKey::get(target);
-    if (targetType->unknownProperties())
-        return false;
-
-    return true;
-}
-
-bool
+IonBuilder::InliningDecision
+IonBuilder::DontInline(JSScript *targetScript, const char *reason)
+{
+    if (targetScript) {
+        IonSpew(IonSpew_Inlining, "Cannot inline %s:%u: %s",
+                targetScript->filename(), targetScript->lineno, reason);
+    } else {
+        IonSpew(IonSpew_Inlining, "Cannot inline: %s", reason);
+    }
+
+    return InliningDecision_DontInline;
+}
+
+IonBuilder::InliningDecision
 IonBuilder::canInlineTarget(JSFunction *target, CallInfo &callInfo)
 {
-    if (!target->isInterpreted()) {
-        IonSpew(IonSpew_Inlining, "Cannot inline due to non-interpreted");
-        return false;
-    }
+    if (!target->isInterpreted())
+        return DontInline(nullptr, "Non-interpreted target");
 
     // Allow constructing lazy scripts when performing the definite properties
     // analysis, as baseline has not been used to warm the caller up yet.
     if (target->isInterpreted() && info().executionMode() == DefinitePropertiesAnalysis) {
         if (!target->getOrCreateScript(analysisContext))
-            return false;
+            return InliningDecision_Error;
 
         RootedScript script(analysisContext, target->nonLazyScript());
         if (!script->hasBaselineScript() && script->canBaselineCompile()) {
             MethodStatus status = BaselineCompile(analysisContext, script);
+            if (status == Method_Error)
+                return InliningDecision_Error;
             if (status != Method_Compiled)
-                return false;
+                return InliningDecision_DontInline;
         }
     }
 
-    if (!target->hasScript()) {
-        IonSpew(IonSpew_Inlining, "Cannot inline due to lack of Non-Lazy script");
-        return false;
-    }
-
-    if (callInfo.constructing() && !target->isInterpretedConstructor()) {
-        IonSpew(IonSpew_Inlining, "Cannot inline because callee is not a constructor");
-        return false;
-    }
+    if (!target->hasScript())
+        return DontInline(nullptr, "Lazy script");
 
     JSScript *inlineScript = target->nonLazyScript();
+    if (callInfo.constructing() && !target->isInterpretedConstructor())
+        return DontInline(inlineScript, "Callee is not a constructor");
+
     ExecutionMode executionMode = info().executionMode();
-    if (!CanIonCompile(inlineScript, executionMode)) {
-        IonSpew(IonSpew_Inlining, "%s:%d Cannot inline due to disable Ion compilation",
-                                  inlineScript->filename(), inlineScript->lineno);
-        return false;
-    }
+    if (!CanIonCompile(inlineScript, executionMode))
+        return DontInline(inlineScript, "Disabled Ion compilation");
 
     // Don't inline functions which don't have baseline scripts.
-    if (!inlineScript->hasBaselineScript()) {
-        IonSpew(IonSpew_Inlining, "%s:%d Cannot inline target with no baseline jitcode",
-                                  inlineScript->filename(), inlineScript->lineno);
-        return false;
-    }
-
-    if (TooManyArguments(target->nargs)) {
-        IonSpew(IonSpew_Inlining, "%s:%d Cannot inline too many args",
-                                  inlineScript->filename(), inlineScript->lineno);
-        return false;
-    }
-
-    if (TooManyArguments(callInfo.argc())) {
-        IonSpew(IonSpew_Inlining, "%s:%d Cannot inline too many args",
-                                  inlineScript->filename(), inlineScript->lineno);
-        return false;
-    }
+    if (!inlineScript->hasBaselineScript())
+        return DontInline(inlineScript, "No baseline jitcode");
+
+    if (TooManyArguments(target->nargs))
+        return DontInline(inlineScript, "Too many args");
+
+    if (TooManyArguments(callInfo.argc()))
+        return DontInline(inlineScript, "Too many args");
 
     // Allow inlining of recursive calls, but only one level deep.
     IonBuilder *builder = callerBuilder_;
     while (builder) {
-        if (builder->script() == inlineScript) {
-            IonSpew(IonSpew_Inlining, "%s:%d Not inlining recursive call",
-                                       inlineScript->filename(), inlineScript->lineno);
-            return false;
-        }
+        if (builder->script() == inlineScript)
+            return DontInline(inlineScript, "Recursive call");
         builder = builder->callerBuilder_;
     }
 
-    if (!canEnterInlinedFunction(target)) {
-        IonSpew(IonSpew_Inlining, "%s:%d Cannot inline due to oracle veto %d",
-                                  inlineScript->filename(), inlineScript->lineno,
-                                  script()->lineno);
-        return false;
-    }
-
-    return true;
+    if (target->isHeavyweight())
+        return DontInline(inlineScript, "Heavyweight function");
+
+    if (inlineScript->uninlineable)
+        return DontInline(inlineScript, "Uninlineable script");
+
+    if (!inlineScript->analyzedArgsUsage())
+        return DontInline(inlineScript, "Script without analyzed args usage");
+
+    if (inlineScript->needsArgsObj())
+        return DontInline(inlineScript, "Script that needs an arguments object");
+
+    if (!inlineScript->compileAndGo)
+        return DontInline(inlineScript, "Non-compileAndGo script");
+
+    types::TypeObjectKey *targetType = types::TypeObjectKey::get(target);
+    if (targetType->unknownProperties())
+        return DontInline(inlineScript, "Target type has unknown properties");
+
+    return InliningDecision_Inline;
 }
 
 void
 IonBuilder::popCfgStack()
 {
     if (cfgStack_.back().isLoop())
         loops_.popBack();
     if (cfgStack_.back().state == CFGState::LABEL)
@@ -661,17 +640,17 @@ IonBuilder::build()
     current->makeStart(MStart::New(alloc(), MStart::StartType_Default));
     if (instrumentedProfiling())
         current->add(MFunctionBoundary::New(alloc(), script(), MFunctionBoundary::Enter));
 
     // Guard against over-recursion. Do this before we start unboxing, since
     // this will create an OSI point that will read the incoming argument
     // values, which is nice to do before their last real use, to minimize
     // register/stack pressure.
-    MCheckOverRecursed *check = new MCheckOverRecursed;
+    MCheckOverRecursed *check = MCheckOverRecursed::New(alloc());
     current->add(check);
     check->setResumePoint(current->entryResumePoint());
 
     // Parameters have been checked to correspond to the typeset, now we unbox
     // what we can in an infallible manner.
     rewriteParameters();
 
     // It's safe to start emitting actual IR, so now build the scope chain.
@@ -2440,27 +2419,27 @@ IonBuilder::processBreak(JSOp op, jssrcn
     jsbytecode *target = pc + GetJumpOffset(pc);
     DebugOnly<bool> found = false;
 
     if (SN_TYPE(sn) == SRC_BREAK2LABEL) {
         for (size_t i = labels_.length() - 1; i < labels_.length(); i--) {
             CFGState &cfg = cfgStack_[labels_[i].cfgEntry];
             JS_ASSERT(cfg.state == CFGState::LABEL);
             if (cfg.stopAt == target) {
-                cfg.label.breaks = new DeferredEdge(current, cfg.label.breaks);
+                cfg.label.breaks = new(alloc()) DeferredEdge(current, cfg.label.breaks);
                 found = true;
                 break;
             }
         }
     } else {
         for (size_t i = loops_.length() - 1; i < loops_.length(); i--) {
             CFGState &cfg = cfgStack_[loops_[i].cfgEntry];
             JS_ASSERT(cfg.isLoop());
             if (cfg.loop.exitpc == target) {
-                cfg.loop.breaks = new DeferredEdge(current, cfg.loop.breaks);
+                cfg.loop.breaks = new(alloc()) DeferredEdge(current, cfg.loop.breaks);
                 found = true;
                 break;
             }
         }
     }
 
     JS_ASSERT(found);
 
@@ -2494,17 +2473,17 @@ IonBuilder::processContinue(JSOp op)
         }
     }
 
     // There must always be a valid target loop structure. If not, there's
     // probably an off-by-something error in which pc we track.
     JS_ASSERT(found);
     CFGState &state = *found;
 
-    state.loop.continues = new DeferredEdge(current, state.loop.continues);
+    state.loop.continues = new(alloc()) DeferredEdge(current, state.loop.continues);
 
     setCurrent(nullptr);
     pc += js_CodeSpec[op].length;
     return processControlEnd();
 }
 
 IonBuilder::ControlStatus
 IonBuilder::processSwitchBreak(JSOp op)
@@ -2533,17 +2512,17 @@ IonBuilder::processSwitchBreak(JSOp op)
         break;
       case CFGState::COND_SWITCH_BODY:
         breaks = &state.condswitch.breaks;
         break;
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected switch state.");
     }
 
-    *breaks = new DeferredEdge(current, *breaks);
+    *breaks = new(alloc()) DeferredEdge(current, *breaks);
 
     setCurrent(nullptr);
     pc += js_CodeSpec[op].length;
     return processControlEnd();
 }
 
 IonBuilder::ControlStatus
 IonBuilder::processSwitchEnd(DeferredEdge *breaks, jsbytecode *exitpc)
@@ -3984,122 +3963,119 @@ IonBuilder::patchInlinedReturns(CallInfo
 }
 
 static bool
 IsSmallFunction(JSScript *script)
 {
     return script->length() <= js_IonOptions.smallFunctionMaxBytecodeLength;
 }
 
-bool
+IonBuilder::InliningDecision
 IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
 {
     // Only inline when inlining is enabled.
     if (!inliningEnabled())
-        return false;
+        return InliningDecision_DontInline;
 
     // When there is no target, inlining is impossible.
     if (target == nullptr)
-        return false;
+        return InliningDecision_DontInline;
 
     // Native functions provide their own detection in inlineNativeCall().
     if (target->isNative())
-        return true;
+        return InliningDecision_Inline;
 
     // Determine whether inlining is possible at callee site
-    if (!canInlineTarget(target, callInfo))
-        return false;
+    InliningDecision decision = canInlineTarget(target, callInfo);
+    if (decision != InliningDecision_Inline)
+        return decision;
 
     // Heuristics!
     JSScript *targetScript = target->nonLazyScript();
 
     // Skip heuristics if we have an explicit hint to inline.
     if (!targetScript->shouldInline) {
         // Cap the inlining depth.
         if (IsSmallFunction(targetScript)) {
-            if (inliningDepth_ >= js_IonOptions.smallFunctionMaxInlineDepth) {
-                IonSpew(IonSpew_Inlining, "%s:%d - Vetoed: exceeding allowed inline depth",
-                        targetScript->filename(), targetScript->lineno);
-                return false;
-            }
+            if (inliningDepth_ >= js_IonOptions.smallFunctionMaxInlineDepth)
+                return DontInline(targetScript, "Vetoed: exceeding allowed inline depth");
         } else {
-            if (inliningDepth_ >= js_IonOptions.maxInlineDepth) {
-                IonSpew(IonSpew_Inlining, "%s:%d - Vetoed: exceeding allowed inline depth",
-                        targetScript->filename(), targetScript->lineno);
-                return false;
-            }
-
-            if (targetScript->hasLoops()) {
-                IonSpew(IonSpew_Inlining, "%s:%d - Vetoed: big function that contains a loop",
-                        targetScript->filename(), targetScript->lineno);
-                return false;
-            }
+            if (inliningDepth_ >= js_IonOptions.maxInlineDepth)
+                return DontInline(targetScript, "Vetoed: exceeding allowed inline depth");
+
+            if (targetScript->hasLoops())
+                return DontInline(targetScript, "Vetoed: big function that contains a loop");
 
             // Caller must not be excessively large.
-            if (script()->length() >= js_IonOptions.inliningMaxCallerBytecodeLength) {
-                IonSpew(IonSpew_Inlining, "%s:%d - Vetoed: caller excessively large.",
-                        targetScript->filename(), targetScript->lineno);
-                return false;
-            }
+            if (script()->length() >= js_IonOptions.inliningMaxCallerBytecodeLength)
+                return DontInline(targetScript, "Vetoed: caller excessively large");
         }
 
         // Callee must not be excessively large.
         // This heuristic also applies to the callsite as a whole.
-        if (targetScript->length() > js_IonOptions.inlineMaxTotalBytecodeLength) {
-            IonSpew(IonSpew_Inlining, "%s:%d - Vetoed: callee excessively large.",
-                    targetScript->filename(), targetScript->lineno);
-            return false;
-        }
+        if (targetScript->length() > js_IonOptions.inlineMaxTotalBytecodeLength)
+            return DontInline(targetScript, "Vetoed: callee excessively large");
 
         // Callee must have been called a few times to have somewhat stable
         // type information, except for definite properties analysis,
         // as the caller has not run yet.
         if (targetScript->getUseCount() < js_IonOptions.usesBeforeInlining() &&
             info().executionMode() != DefinitePropertiesAnalysis)
         {
-            IonSpew(IonSpew_Inlining, "%s:%d - Vetoed: callee is insufficiently hot.",
-                    targetScript->filename(), targetScript->lineno);
-            return false;
+            return DontInline(targetScript, "Vetoed: callee is insufficiently hot.");
         }
     }
 
     // TI calls ObjectStateChange to trigger invalidation of the caller.
     types::TypeObjectKey *targetType = types::TypeObjectKey::get(target);
     targetType->watchStateChangeForInlinedCall(constraints());
 
-    return true;
-}
-
-uint32_t
-IonBuilder::selectInliningTargets(ObjectVector &targets, CallInfo &callInfo, BoolVector &choiceSet)
-{
+    return InliningDecision_Inline;
+}
+
+bool
+IonBuilder::selectInliningTargets(ObjectVector &targets, CallInfo &callInfo, BoolVector &choiceSet,
+                                  uint32_t *numInlineable)
+{
+    *numInlineable = 0;
     uint32_t totalSize = 0;
-    uint32_t numInlineable = 0;
 
     // For each target, ask whether it may be inlined.
     if (!choiceSet.reserve(targets.length()))
         return false;
+
     for (size_t i = 0; i < targets.length(); i++) {
         JSFunction *target = &targets[i]->as<JSFunction>();
-        bool inlineable = makeInliningDecision(target, callInfo);
+        bool inlineable;
+        InliningDecision decision = makeInliningDecision(target, callInfo);
+        switch (decision) {
+          case InliningDecision_Error:
+            return false;
+          case InliningDecision_DontInline:
+            inlineable = false;
+            break;
+          case InliningDecision_Inline:
+            inlineable = true;
+            break;
+        }
 
         // Enforce a maximum inlined bytecode limit at the callsite.
         if (inlineable && target->isInterpreted()) {
             totalSize += target->nonLazyScript()->length();
             if (totalSize > js_IonOptions.inlineMaxTotalBytecodeLength)
                 inlineable = false;
         }
 
         choiceSet.append(inlineable);
         if (inlineable)
-            numInlineable++;
+            *numInlineable += 1;
     }
 
     JS_ASSERT(choiceSet.length() == targets.length());
-    return numInlineable;
+    return true;
 }
 
 static bool
 CanInlineGetPropertyCache(MGetPropertyCache *cache, MDefinition *thisDef)
 {
     JS_ASSERT(cache->object()->type() == MIRType_Object);
     if (cache->object() != thisDef)
         return false;
@@ -4188,18 +4164,25 @@ IonBuilder::inlineCallsite(ObjectVector 
     // If so, the cache may be movable to a fallback path, with a dispatch
     // instruction guarding on the incoming TypeObject.
     MGetPropertyCache *propCache = getInlineableGetPropertyCache(callInfo);
 
     // Inline single targets -- unless they derive from a cache, in which case
     // avoiding the cache and guarding is still faster.
     if (!propCache && targets.length() == 1) {
         JSFunction *target = &targets[0]->as<JSFunction>();
-        if (!makeInliningDecision(target, callInfo))
+        InliningDecision decision = makeInliningDecision(target, callInfo);
+        switch (decision) {
+          case InliningDecision_Error:
+            return InliningStatus_Error;
+          case InliningDecision_DontInline:
             return InliningStatus_NotInlined;
+          case InliningDecision_Inline:
+            break;
+        }
 
         // Inlining will elminate uses of the original callee, but it needs to
         // be preserved in phis if we bail out.  Mark the old callee definition as
         // folded to ensure this happens.
         callInfo.fun()->setFoldedUnchecked();
 
         // If the callee is not going to be a lambda (which may vary across
         // different invocations), then the callee definition can be replaced by a
@@ -4211,17 +4194,19 @@ IonBuilder::inlineCallsite(ObjectVector 
             callInfo.setFun(constFun);
         }
 
         return inlineSingleCall(callInfo, target);
     }
 
     // Choose a subset of the targets for polymorphic inlining.
     BoolVector choiceSet(alloc());
-    uint32_t numInlined = selectInliningTargets(targets, callInfo, choiceSet);
+    uint32_t numInlined;
+    if (!selectInliningTargets(targets, callInfo, choiceSet, &numInlined))
+        return InliningStatus_Error;
     if (numInlined == 0)
         return InliningStatus_NotInlined;
 
     // Perform a polymorphic dispatch.
     if (!inlineCalls(callInfo, targets, originals, choiceSet, propCache))
         return InliningStatus_Error;
 
     return InliningStatus_Inlined;
@@ -4819,19 +4804,30 @@ IonBuilder::jsop_funcall(uint32_t argc)
         // |this| becomes implicit in the call.
         argc -= 1;
     }
 
     CallInfo callInfo(alloc(), false);
     if (!callInfo.init(current, argc))
         return false;
 
-    // Try inlining call
-    if (argc > 0 && makeInliningDecision(target, callInfo) && target->isInterpreted())
-        return inlineScriptedCall(callInfo, target);
+    // Try to inline the call.
+    if (argc > 0) {
+        InliningDecision decision = makeInliningDecision(target, callInfo);
+        switch (decision) {
+          case InliningDecision_Error:
+            return false;
+          case InliningDecision_DontInline:
+            break;
+          case InliningDecision_Inline:
+            if (target->isInterpreted())
+                return inlineScriptedCall(callInfo, target);
+            break;
+        }
+    }
 
     // Call without inlining.
     return makeCall(target, callInfo, false);
 }
 
 bool
 IonBuilder::jsop_funapply(uint32_t argc)
 {
@@ -4965,19 +4961,27 @@ IonBuilder::jsop_funapplyarguments(uint3
     passFunc->replaceAllUsesWith(argFunc);
     passFunc->block()->discard(passFunc);
 
     callInfo.setFun(argFunc);
 
     // Pop apply function.
     current->pop();
 
-    // Try inlining call
-    if (makeInliningDecision(target, callInfo) && target->isInterpreted())
-        return inlineScriptedCall(callInfo, target);
+    // Try to inline the call.
+    InliningDecision decision = makeInliningDecision(target, callInfo);
+    switch (decision) {
+      case InliningDecision_Error:
+        return false;
+      case InliningDecision_DontInline:
+        break;
+      case InliningDecision_Inline:
+        if (target->isInterpreted())
+            return inlineScriptedCall(callInfo, target);
+    }
 
     callInfo.wrapArgs(alloc(), current);
     return makeCall(target, callInfo, false);
 }
 
 bool
 IonBuilder::jsop_call(uint32_t argc, bool constructing)
 {
@@ -5205,17 +5209,17 @@ IonBuilder::makeCallHelper(JSFunction *t
         JS_ASSERT(callInfo.getArg(i)->isPassArg());
         call->addArg(i + 1, callInfo.getArg(i)->toPassArg());
     }
 
     // Place an MPrepareCall before the first passed argument, before we
     // potentially perform rearrangement.
     JS_ASSERT(callInfo.thisArg()->isPassArg());
     MPassArg *thisArg = callInfo.thisArg()->toPassArg();
-    MPrepareCall *start = new MPrepareCall;
+    MPrepareCall *start = MPrepareCall::New(alloc());
     thisArg->block()->insertBefore(thisArg, start);
     call->initPrepareCall(start);
 
     // Inline the constructor on the caller-side.
     if (callInfo.constructing()) {
         MDefinition *create = createThis(target, callInfo.fun());
         if (!create) {
             abort("Failure inlining constructor for call.");
@@ -6721,20 +6725,21 @@ IonBuilder::getElemTryComplexElemOfTyped
                                         MMul::Integer);
     current->add(indexAsByteOffset);
 
     // Find location within the owner object.
     MDefinition *owner, *ownerOffset;
     loadTypedObjectData(obj, indexAsByteOffset, &owner, &ownerOffset);
 
     // Create the derived type object.
-    MInstruction *derived = new MNewDerivedTypedObject(elemTypeReprs,
-                                                       elemType,
-                                                       owner,
-                                                       ownerOffset);
+    MInstruction *derived = MNewDerivedTypedObject::New(alloc(),
+                                                        elemTypeReprs,
+                                                        elemType,
+                                                        owner,
+                                                        ownerOffset);
 
     types::TemporaryTypeSet *resultTypes = bytecodeTypes(pc);
     derived->setResultTypeSet(resultTypes);
     current->add(derived);
     current->push(derived);
 
     return true;
 }
@@ -7696,17 +7701,17 @@ IonBuilder::jsop_length_fastPath()
             objTypes->getKnownClass() == &ArrayObject::class_ &&
             !objTypes->hasObjectFlags(constraints(), types::OBJECT_FLAG_LENGTH_OVERFLOW))
         {
             current->pop();
             MElements *elements = MElements::New(alloc(), obj);
             current->add(elements);
 
             // Read length.
-            MArrayLength *length = new MArrayLength(elements);
+            MArrayLength *length = MArrayLength::New(alloc(), elements);
             current->add(length);
             current->push(length);
             return true;
         }
 
         if (objTypes && objTypes->getTypedArrayType() != ScalarTypeRepresentation::TYPE_MAX) {
             current->pop();
             MInstruction *length = getTypedArrayLength(obj);
@@ -7844,17 +7849,17 @@ IonBuilder::jsop_runonce()
     return resumeAfter(ins);
 }
 
 bool
 IonBuilder::jsop_not()
 {
     MDefinition *value = current->pop();
 
-    MNot *ins = new MNot(value);
+    MNot *ins = MNot::New(alloc(), value);
     current->add(ins);
     current->push(ins);
     ins->infer();
     return true;
 }
 
 bool
 IonBuilder::objectsHaveCommonPrototype(types::TemporaryTypeSet *types, PropertyName *name,
@@ -8357,20 +8362,21 @@ IonBuilder::getPropTryComplexPropOfTyped
     MDefinition *fieldType = typeObjectForFieldFromStructType(type, fieldIndex);
 
     // Find location within the owner object.
     MDefinition *owner, *ownerOffset;
     loadTypedObjectData(typedObj, constantInt(fieldOffset),
                         &owner, &ownerOffset);
 
     // Create the derived type object.
-    MInstruction *derived = new MNewDerivedTypedObject(fieldTypeReprs,
-                                                       fieldType,
-                                                       owner,
-                                                       ownerOffset);
+    MInstruction *derived = MNewDerivedTypedObject::New(alloc(),
+                                                        fieldTypeReprs,
+                                                        fieldType,
+                                                        owner,
+                                                        ownerOffset);
     derived->setResultTypeSet(resultTypes);
     current->add(derived);
     current->push(derived);
     *emitted = true;
     return true;
 }
 
 bool
@@ -8463,17 +8469,31 @@ IonBuilder::getPropTryCommonGetter(bool 
     current->add(wrapper);
     current->push(wrapper);
 
     CallInfo callInfo(alloc(), false);
     if (!callInfo.init(current, 0))
         return false;
 
     // Inline if we can, otherwise, forget it and just generate a call.
-    if (makeInliningDecision(commonGetter, callInfo) && commonGetter->isInterpreted()) {
+    bool inlineable = false;
+    if (commonGetter->isInterpreted()) {
+        InliningDecision decision = makeInliningDecision(commonGetter, callInfo);
+        switch (decision) {
+          case InliningDecision_Error:
+            return false;
+          case InliningDecision_DontInline:
+            break;
+          case InliningDecision_Inline:
+            inlineable = true;
+            break;
+        }
+    }
+
+    if (inlineable) {
         if (!inlineScriptedCall(callInfo, commonGetter))
             return false;
     } else {
         if (!makeCall(commonGetter, callInfo, false))
             return false;
     }
 
     *emitted = true;
@@ -8753,22 +8773,29 @@ IonBuilder::setPropTryCommonSetter(bool 
     CallInfo callInfo(alloc(), false);
     if (!callInfo.init(current, 1))
         return false;
 
     // Ensure that we know we are calling a setter in case we inline it.
     callInfo.markAsSetter();
 
     // Inline the setter if we can.
-    if (makeInliningDecision(commonSetter, callInfo) && commonSetter->isInterpreted()) {
-        if (!inlineScriptedCall(callInfo, commonSetter))
+    if (commonSetter->isInterpreted()) {
+        InliningDecision decision = makeInliningDecision(commonSetter, callInfo);
+        switch (decision) {
+          case InliningDecision_Error:
             return false;
-
-        *emitted = true;
-        return true;
+          case InliningDecision_DontInline:
+            break;
+          case InliningDecision_Inline:
+            if (!inlineScriptedCall(callInfo, commonSetter))
+                return false;
+            *emitted = true;
+            return true;
+        }
     }
 
     MCall *call = makeCallHelper(commonSetter, callInfo, false);
     if (!call)
         return false;
 
     current->push(value);
     if (!resumeAfter(call))
@@ -9490,17 +9517,17 @@ IonBuilder::jsop_in()
     if (ElementAccessIsDenseNative(obj, id) &&
         !ElementAccessHasExtraIndexedProperty(constraints(), obj))
     {
         return jsop_in_dense();
     }
 
     current->pop();
     current->pop();
-    MIn *ins = new MIn(id, obj);
+    MIn *ins = MIn::New(alloc(), id, obj);
 
     current->add(ins);
     current->push(ins);
 
     return resumeAfter(ins);
 }
 
 bool
@@ -9553,25 +9580,25 @@ IonBuilder::jsop_instanceof()
         types::HeapTypeSetKey protoProperty =
             rhsType->property(NameToId(names().prototype));
         JSObject *protoObject = protoProperty.singleton(constraints());
         if (!protoObject)
             break;
 
         rhs->setFoldedUnchecked();
 
-        MInstanceOf *ins = new MInstanceOf(obj, protoObject);
+        MInstanceOf *ins = MInstanceOf::New(alloc(), obj, protoObject);
 
         current->add(ins);
         current->push(ins);
 
         return resumeAfter(ins);
     } while (false);
 
-    MCallInstanceOf *ins = new MCallInstanceOf(obj, rhs);
+    MCallInstanceOf *ins = MCallInstanceOf::New(alloc(), obj, rhs);
 
     current->add(ins);
     current->push(ins);
 
     return resumeAfter(ins);
 }
 
 MInstruction *
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -232,17 +232,16 @@ class IonBuilder : public MIRGenerator
 
     static bool inliningEnabled() {
         return js_IonOptions.inlining;
     }
 
     JSFunction *getSingleCallTarget(types::TemporaryTypeSet *calleeTypes);
     bool getPolyCallTargets(types::TemporaryTypeSet *calleeTypes, bool constructing,
                             ObjectVector &targets, uint32_t maxTargets, bool *gotLambda);
-    bool canInlineTarget(JSFunction *target, CallInfo &callInfo);
 
     void popCfgStack();
     DeferredEdge *filterDeadDeferredEdges(DeferredEdge *edge);
     bool processDeferredContinues(CFGState &state);
     ControlStatus processControlEnd();
     ControlStatus processCfgStack();
     ControlStatus processCfgEntry(CFGState &state);
     ControlStatus processIfEnd(CFGState &state);
@@ -571,21 +570,30 @@ class IonBuilder : public MIRGenerator
 
     enum InliningStatus
     {
         InliningStatus_Error,
         InliningStatus_NotInlined,
         InliningStatus_Inlined
     };
 
+    enum InliningDecision
+    {
+        InliningDecision_Error,
+        InliningDecision_Inline,
+        InliningDecision_DontInline
+    };
+
+    static InliningDecision DontInline(JSScript *targetScript, const char *reason);
+
     // Oracles.
-    bool canEnterInlinedFunction(JSFunction *target);
-    bool makeInliningDecision(JSFunction *target, CallInfo &callInfo);
-    uint32_t selectInliningTargets(ObjectVector &targets, CallInfo &callInfo,
-                                   BoolVector &choiceSet);
+    InliningDecision canInlineTarget(JSFunction *target, CallInfo &callInfo);
+    InliningDecision makeInliningDecision(JSFunction *target, CallInfo &callInfo);
+    bool selectInliningTargets(ObjectVector &targets, CallInfo &callInfo,
+                               BoolVector &choiceSet, uint32_t *numInlineable);
 
     // Native inlining helpers.
     types::TemporaryTypeSet *getInlineReturnTypeSet();
     MIRType getInlineReturnType();
 
     // Array natives.
     InliningStatus inlineArray(CallInfo &callInfo);
     InliningStatus inlineArrayPopShift(CallInfo &callInfo, MArrayPopShift::Mode mode);
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -124,17 +124,17 @@ LSnapshot::init(MIRGenerator *gen)
 {
     slots_ = gen->allocate<LAllocation>(numSlots_);
     return !!slots_;
 }
 
 LSnapshot *
 LSnapshot::New(MIRGenerator *gen, MResumePoint *mir, BailoutKind kind)
 {
-    LSnapshot *snapshot = new LSnapshot(mir, kind);
+    LSnapshot *snapshot = new(gen->alloc()) LSnapshot(mir, kind);
     if (!snapshot->init(gen))
         return nullptr;
 
     IonSpew(IonSpew_Snapshots, "Generating LIR snapshot %p from MIR (%p)",
             (void *)snapshot, (void *)mir);
 
     return snapshot;
 }
@@ -352,17 +352,17 @@ LInstruction::dump()
 {
     return dump(stderr);
 }
 
 void
 LInstruction::initSafepoint(TempAllocator &alloc)
 {
     JS_ASSERT(!safepoint_);
-    safepoint_ = new LSafepoint(alloc);
+    safepoint_ = new(alloc) LSafepoint(alloc);
     JS_ASSERT(safepoint_);
 }
 
 bool
 LMoveGroup::add(LAllocation *from, LAllocation *to)
 {
 #ifdef DEBUG
     JS_ASSERT(*from != *to);
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -106,22 +106,22 @@ class LAllocation : public TempObject
     explicit LAllocation(Kind kind) {
         setKindAndData(kind, 0);
     }
 
   public:
     LAllocation() : bits_(0)
     { }
 
-    static LAllocation *New() {
-        return new LAllocation();
+    static LAllocation *New(TempAllocator &alloc) {
+        return new(alloc) LAllocation();
     }
     template <typename T>
-    static LAllocation *New(const T &other) {
-        return new LAllocation(other);
+    static LAllocation *New(TempAllocator &alloc, const T &other) {
+        return new(alloc) LAllocation(other);
     }
 
     // The value pointer must be rooted in MIR and have its low bit cleared.
     explicit LAllocation(const Value *vp) {
         bits_ = uintptr_t(vp);
         JS_ASSERT(!isTagged());
         bits_ |= TAG_MASK;
     }
@@ -564,17 +564,17 @@ class LDefinition
     LIR_OPCODE_LIST(LIROP)
 #undef LIROP
 
 class LSnapshot;
 class LSafepoint;
 class LInstructionVisitor;
 
 class LInstruction
-  : public TempObject,
+  : public OldTempObject,
     public InlineListNode<LInstruction>
 {
     uint32_t id_;
 
     // This snapshot could be set after a ResumePoint.  It is used to restart
     // from the resume point pc.
     LSnapshot *snapshot_;
 
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -376,23 +376,23 @@ LinearScanAllocator::reifyAllocations()
                 // it should use the fixed register instead.
                 SetOsiPointUses(interval, defEnd, LAllocation(fixedReg));
 
                 if (!moveAfter(defEnd, from, interval))
                     return false;
                 spillFrom = from->getAllocation();
             } else {
                 if (def->policy() == LDefinition::MUST_REUSE_INPUT) {
-                    LAllocation *alloc = reg->ins()->getOperand(def->getReusedInput());
-                    LAllocation *origAlloc = LAllocation::New(*alloc);
+                    LAllocation *inputAlloc = reg->ins()->getOperand(def->getReusedInput());
+                    LAllocation *origAlloc = LAllocation::New(alloc(), *inputAlloc);
 
-                    JS_ASSERT(!alloc->isUse());
+                    JS_ASSERT(!inputAlloc->isUse());
 
-                    *alloc = *interval->getAllocation();
-                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, alloc))
+                    *inputAlloc = *interval->getAllocation();
+                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc))
                         return false;
                 }
 
                 JS_ASSERT(DefinitionCompatibleWith(reg->ins(), def, *interval->getAllocation()));
                 def->setOutput(*interval->getAllocation());
 
                 spillFrom = interval->getAllocation();
             }
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -568,17 +568,17 @@ IonBuilder::inlineMathFloor(CallInfo &ca
     if (argType == MIRType_Int32 && returnType == MIRType_Int32) {
         callInfo.unwrapArgs();
         current->push(callInfo.getArg(0));
         return InliningStatus_Inlined;
     }
 
     if (IsFloatingPointType(argType) && returnType == MIRType_Int32) {
         callInfo.unwrapArgs();
-        MFloor *ins = new MFloor(callInfo.getArg(0));
+        MFloor *ins = MFloor::New(alloc(), callInfo.getArg(0));
         current->add(ins);
         current->push(ins);
         return InliningStatus_Inlined;
     }
 
     if (IsFloatingPointType(argType) && returnType == MIRType_Double) {
         callInfo.unwrapArgs();
         MMathFunction *ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Floor, nullptr);
@@ -606,17 +606,17 @@ IonBuilder::inlineMathRound(CallInfo &ca
     if (argType == MIRType_Int32 && returnType == MIRType_Int32) {
         callInfo.unwrapArgs();
         current->push(callInfo.getArg(0));
         return InliningStatus_Inlined;
     }
 
     if (argType == MIRType_Double && returnType == MIRType_Int32) {
         callInfo.unwrapArgs();
-        MRound *ins = new MRound(callInfo.getArg(0));
+        MRound *ins = MRound::New(alloc(), callInfo.getArg(0));
         current->add(ins);
         current->push(ins);
         return InliningStatus_Inlined;
     }
 
     if (argType == MIRType_Double && returnType == MIRType_Double) {
         callInfo.unwrapArgs();
         MMathFunction *ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Round, nullptr);
@@ -1362,17 +1362,17 @@ IonBuilder::inlineParallelArrayTail(Call
         MDefinition *arg = callInfo.getArg(i + discards);
         MPassArg *passArg = MPassArg::New(alloc(), arg);
         current->add(passArg);
         call->addArg(i + 1, passArg);
     }
 
     // Place an MPrepareCall before the first passed argument, before we
     // potentially perform rearrangement.
-    MPrepareCall *start = new MPrepareCall;
+    MPrepareCall *start = MPrepareCall::New(alloc());
     oldThis->block()->insertBefore(oldThis, start);
     call->initPrepareCall(start);
 
     // Create the MIR to allocate the new parallel array.  Take the type
     // object is taken from the prediction set.
     MNewParallelArray *newObject = MNewParallelArray::New(alloc(), templateObject);
     current->add(newObject);
     MPassArg *newThis = MPassArg::New(alloc(), newObject);
@@ -1434,19 +1434,20 @@ IonBuilder::inlineNewDenseArrayForParall
     types::TypeObject *typeObject = returnTypes->getTypeObject(0);
 
     JSObject *templateObject = inspector->getTemplateObjectForNative(pc, intrinsic_NewDenseArray);
     if (!templateObject || templateObject->type() != typeObject)
         return InliningStatus_NotInlined;
 
     callInfo.unwrapArgs();
 
-    MNewDenseArrayPar *newObject = new MNewDenseArrayPar(graph().forkJoinSlice(),
-                                                         callInfo.getArg(0),
-                                                         templateObject);
+    MNewDenseArrayPar *newObject = MNewDenseArrayPar::New(alloc(),
+                                                          graph().forkJoinSlice(),
+                                                          callInfo.getArg(0),
+                                                          templateObject);
     current->add(newObject);
     current->push(newObject);
 
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
 IonBuilder::inlineUnsafeSetReservedSlot(CallInfo &callInfo)
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3159,18 +3159,17 @@ TryAddTypeBarrierForWrite(TempAllocator 
         return true;
       }
       default:;
     }
 
     if ((*pvalue)->type() != MIRType_Value)
         return false;
 
-    types::TemporaryTypeSet *types =
-        aggregateProperty.ref().maybeTypes()->clone(GetIonContext()->temp->lifoAlloc());
+    types::TemporaryTypeSet *types = aggregateProperty.ref().maybeTypes()->clone(alloc.lifoAlloc());
     if (!types)
         return false;
 
     MInstruction *ins = MMonitorTypes::New(alloc, *pvalue, types);
     current->add(ins);
     return true;
 }
 
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -384,17 +384,17 @@ class MDefinition : public MNode
     virtual void analyzeEdgeCasesBackward();
 
     virtual bool truncate();
     virtual bool isOperandTruncated(size_t index) const;
 
     bool earlyAbortCheck();
 
     // Compute an absolute or symbolic range for the value of this node.
-    virtual void computeRange() {
+    virtual void computeRange(TempAllocator &alloc) {
     }
 
     // Collect information from the pre-truncated ranges.
     virtual void collectRangeInfoPreTrunc() {
     }
 
     MNode::Kind kind() const {
         return MNode::Definition;
@@ -986,17 +986,17 @@ class MConstant : public MNullaryInstruc
         // value by a double value.
         if (type() == MIRType_Float32)
             return c->type() == MIRType_Float32;
         if (type() == MIRType_Double)
             return c->type() != MIRType_Float32;
         return true;
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool truncate();
 
     bool canProduceFloat32() const;
 };
 
 class MParameter : public MNullaryInstruction
 {
     int32_t index_;
@@ -1507,26 +1507,30 @@ class MNewObject : public MNullaryInstru
     }
 };
 
 // Could be allocating either a new array or a new object.
 class MNewPar : public MUnaryInstruction
 {
     CompilerRootObject templateObject_;
 
-  public:
-    INSTRUCTION_HEADER(NewPar);
-
     MNewPar(MDefinition *slice, JSObject *templateObject)
       : MUnaryInstruction(slice),
         templateObject_(templateObject)
     {
         setResultType(MIRType_Object);
     }
 
+  public:
+    INSTRUCTION_HEADER(NewPar);
+
+    static MNewPar *New(TempAllocator &alloc, MDefinition *slice, JSObject *templateObject) {
+        return new(alloc) MNewPar(slice, templateObject);
+    }
+
     MDefinition *forkJoinSlice() const {
         return getOperand(0);
     }
 
     JSObject *templateObject() const {
         return templateObject_;
     }
 };
@@ -1547,30 +1551,36 @@ class MNewDerivedTypedObject
   : public MTernaryInstruction,
     public Mix3Policy<ObjectPolicy<0>,
                       ObjectPolicy<1>,
                       IntPolicy<2> >
 {
   private:
     TypeRepresentationSet set_;
 
-  public:
-    INSTRUCTION_HEADER(NewDerivedTypedObject);
-
     MNewDerivedTypedObject(TypeRepresentationSet set,
                            MDefinition *type,
                            MDefinition *owner,
                            MDefinition *offset)
       : MTernaryInstruction(type, owner, offset),
         set_(set)
     {
         setMovable();
         setResultType(MIRType_Object);
     }
 
+  public:
+    INSTRUCTION_HEADER(NewDerivedTypedObject);
+
+    static MNewDerivedTypedObject *New(TempAllocator &alloc, TypeRepresentationSet set,
+                                       MDefinition *type, MDefinition *owner, MDefinition *offset)
+    {
+        return new(alloc) MNewDerivedTypedObject(set, type, owner, offset);
+    }
+
     TypeRepresentationSet set() const {
         return set_;
     }
 
     MDefinition *type() const {
         return getOperand(0);
     }
 
@@ -1759,18 +1769,19 @@ class MInitElemGetterSetter
 // Designates the start of call frame construction.
 // Generates code to adjust the stack pointer for the argument vector.
 // Argc is inferred by checking the use chain during lowering.
 class MPrepareCall : public MNullaryInstruction
 {
   public:
     INSTRUCTION_HEADER(PrepareCall)
 
-    MPrepareCall()
-    { }
+    static MPrepareCall *New(TempAllocator &alloc) {
+        return new(alloc) MPrepareCall();
+    }
 
     // Get the vector size for the upcoming call by looking at the call.
     uint32_t argc() const;
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
 };
@@ -2894,17 +2905,17 @@ class MToDouble
         if (!ins->isToDouble() || ins->toToDouble()->conversion() != conversion())
             return false;
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool truncate();
     bool isOperandTruncated(size_t index) const;
 
 #ifdef DEBUG
     bool isConsistentFloat32Use() const { return true; }
 #endif
 };
 
@@ -2956,17 +2967,17 @@ class MToFloat32
         if (!ins->isToFloat32() || ins->toToFloat32()->conversion() != conversion())
             return false;
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 
     bool canConsumeFloat32() const { return true; }
     bool canProduceFloat32() const { return true; }
 };
 
 // Converts a uint32 to a double (coming from asm.js).
 class MAsmJSUnsignedToDouble
   : public MUnaryInstruction
@@ -3063,17 +3074,17 @@ class MToInt32
 
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 
 #ifdef DEBUG
     bool isConsistentFloat32Use() const { return true; }
 #endif
 };
 
 // Converts a value or typed input to a truncated int32, for use with bitwise
 // operations. This is an infallible ValueToECMAInt32.
@@ -3099,17 +3110,17 @@ class MTruncateToInt32 : public MUnaryIn
 
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool isOperandTruncated(size_t index) const;
 # ifdef DEBUG
     bool isConsistentFloat32Use() const {
         return true;
     }
 #endif
 };
 
@@ -3168,17 +3179,17 @@ class MBitNot
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         if (specialization_ == MIRType_None)
             return AliasSet::Store(AliasSet::Any);
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MTypeOf
   : public MUnaryInstruction,
     public BoxInputsPolicy
 {
     MIRType inputType_;
     bool inputMaybeCallableOrEmulatesUndefined_;
@@ -3295,17 +3306,17 @@ class MBitAnd : public MBinaryBitwiseIns
         return getOperand(operand); // 0 & x => 0;
     }
     MDefinition *foldIfNegOne(size_t operand) {
         return getOperand(1 - operand); // x & -1 => x
     }
     MDefinition *foldIfEqual() {
         return getOperand(0); // x & x => x;
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MBitOr : public MBinaryBitwiseInstruction
 {
     MBitOr(MDefinition *left, MDefinition *right)
       : MBinaryBitwiseInstruction(left, right)
     { }
 
@@ -3318,17 +3329,17 @@ class MBitOr : public MBinaryBitwiseInst
         return getOperand(1 - operand); // 0 | x => x, so if ith is 0, return (1-i)th
     }
     MDefinition *foldIfNegOne(size_t operand) {
         return getOperand(operand); // x | -1 => -1
     }
     MDefinition *foldIfEqual() {
         return getOperand(0); // x | x => x
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MBitXor : public MBinaryBitwiseInstruction
 {
     MBitXor(MDefinition *left, MDefinition *right)
       : MBinaryBitwiseInstruction(left, right)
     { }
 
@@ -3341,17 +3352,17 @@ class MBitXor : public MBinaryBitwiseIns
         return getOperand(1 - operand); // 0 ^ x => x
     }
     MDefinition *foldIfNegOne(size_t operand) {
         return this;
     }
     MDefinition *foldIfEqual() {
         return this;
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MShiftInstruction
   : public MBinaryBitwiseInstruction
 {
   protected:
     MShiftInstruction(MDefinition *left, MDefinition *right)
       : MBinaryBitwiseInstruction(left, right)
@@ -3379,17 +3390,17 @@ class MLsh : public MShiftInstruction
     static MLsh *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
 
     MDefinition *foldIfZero(size_t operand) {
         // 0 << x => 0
         // x << 0 => x
         return getOperand(0);
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MRsh : public MShiftInstruction
 {
     MRsh(MDefinition *left, MDefinition *right)
       : MShiftInstruction(left, right)
     { }
 
@@ -3398,17 +3409,17 @@ class MRsh : public MShiftInstruction
     static MRsh *New(TempAllocator &alloc, MDefinition *left, MDefinition *right);
     static MRsh *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
 
     MDefinition *foldIfZero(size_t operand) {
         // 0 >> x => 0
         // x >> 0 => x
         return getOperand(0);
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MUrsh : public MShiftInstruction
 {
     bool bailoutsDisabled_;
 
     MUrsh(MDefinition *left, MDefinition *right)
       : MShiftInstruction(left, right),
@@ -3431,17 +3442,17 @@ class MUrsh : public MShiftInstruction
     void infer(BaselineInspector *inspector, jsbytecode *pc);
 
     bool bailoutsDisabled() const {
         return bailoutsDisabled_;
     }
 
     bool fallible() const;
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     void collectRangeInfoPreTrunc();
 };
 
 class MBinaryArithInstruction
   : public MBinaryInstruction,
     public ArithPolicy
 {
     // Implicit truncate flag is set by the truncate backward range analysis
@@ -3541,17 +3552,17 @@ class MMinMax
         if (isMax() != ins->toMinMax()->isMax())
             return false;
         return congruentIfOperandsEqual(ins);
     }
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MAbs
   : public MUnaryInstruction,
     public ArithPolicy
 {
     bool implicitTruncate_;
 
@@ -3585,17 +3596,17 @@ class MAbs
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     bool fallible() const;
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool isFloat32Commutative() const { return true; }
     void trySpecializeFloat32(TempAllocator &alloc);
 };
 
 // Inline implementation of Math.sqrt().
 class MSqrt
   : public MUnaryInstruction,
     public FloatingPointPolicy<0>
@@ -3625,17 +3636,17 @@ class MSqrt
     }
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 
     bool isFloat32Commutative() const { return true; }
     void trySpecializeFloat32(TempAllocator &alloc);
 };
 
 // Inline implementation of atan2 (arctangent of y/x).
 class MAtan2
   : public MBinaryInstruction,
@@ -3825,17 +3836,17 @@ class MRandom : public MNullaryInstructi
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
 
     bool possiblyCalls() const {
         return true;
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MMathFunction
   : public MUnaryInstruction,
     public FloatingPointPolicy<0>
 {
   public:
     enum Function {
@@ -3915,17 +3926,17 @@ class MMathFunction
     static const char *FunctionName(Function function);
 
     bool isFloat32Commutative() const {
         return function_ == Log || function_ == Sin || function_ == Cos
                || function_ == Exp || function_ == Tan || function_ == ATan
                || function_ == ASin || function_ == ACos || function_ == Floor;
     }
     void trySpecializeFloat32(TempAllocator &alloc);
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MAdd : public MBinaryArithInstruction
 {
     // Is this instruction really an int at heart?
     MAdd(MDefinition *left, MDefinition *right)
       : MBinaryArithInstruction(left, right)
     {
@@ -3953,17 +3964,17 @@ class MAdd : public MBinaryArithInstruct
 
     bool isFloat32Commutative() const { return true; }
 
     double getIdentity() {
         return 0;
     }
 
     bool fallible() const;
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool truncate();
     bool isOperandTruncated(size_t index) const;
 };
 
 class MSub : public MBinaryArithInstruction
 {
     MSub(MDefinition *left, MDefinition *right)
       : MBinaryArithInstruction(left, right)
@@ -3989,17 +4000,17 @@ class MSub : public MBinaryArithInstruct
 
     double getIdentity() {
         return 0;
     }
 
     bool isFloat32Commutative() const { return true; }
 
     bool fallible() const;
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool truncate();
     bool isOperandTruncated(size_t index) const;
 };
 
 class MMul : public MBinaryArithInstruction
 {
   public:
     enum Mode {
@@ -4078,17 +4089,17 @@ class MMul : public MBinaryArithInstruct
     bool updateForReplacement(MDefinition *ins);
 
     bool fallible() const {
         return canBeNegativeZero_ || canOverflow();
     }
 
     bool isFloat32Commutative() const { return true; }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool truncate();
     bool isOperandTruncated(size_t index) const;
 
     Mode mode() { return mode_; }
 };
 
 class MDiv : public MBinaryArithInstruction
 {
@@ -4157,17 +4168,17 @@ class MDiv : public MBinaryArithInstruct
     }
 
     bool isUnsigned() const {
         return unsigned_;
     }
 
     bool isFloat32Commutative() const { return true; }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool fallible() const;
     bool truncate();
     void collectRangeInfoPreTrunc();
 };
 
 class MMod : public MBinaryArithInstruction
 {
     bool unsigned_;
@@ -4212,17 +4223,17 @@ class MMod : public MBinaryArithInstruct
     bool canBePowerOfTwoDivisor() const;
 
     bool isUnsigned() const {
         return unsigned_;
     }
 
     bool fallible() const;
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool truncate();
     void collectRangeInfoPreTrunc();
 };
 
 class MConcat
   : public MBinaryInstruction,
     public BinaryStringPolicy
 {
@@ -4311,17 +4322,17 @@ class MCharCodeAt
         return this;
     }
 
     virtual AliasSet getAliasSet() const {
         // Strings are immutable, so there is no implicit dependency.
         return AliasSet::None();
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MFromCharCode
   : public MUnaryInstruction,
     public IntPolicy<0>
 {
     MFromCharCode(MDefinition *code)
       : MUnaryInstruction(code)
@@ -4522,17 +4533,17 @@ class MPhi MOZ_FINAL : public MDefinitio
     }
     void setIterator() {
         isIterator_ = true;
     }
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 
     MDefinition *operandIfRedundant() {
         // If this phi is redundant (e.g., phi(a,a) or b=phi(a,this)),
         // returns the operand that it will always be equal to (a, in
         // those two cases).
         MDefinition *first = getOperand(0);
         for (size_t i = 1, e = numOperands(); i < e; i++) {
             if (getOperand(i) != first && getOperand(i) != this)
@@ -4584,17 +4595,17 @@ class MBeta : public MUnaryInstruction
     {
         return new(alloc) MBeta(val, comp);
     }
 
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // MIR representation of a Value on the OSR StackFrame.
 // The Value is indexed off of OsrFrameReg.
 class MOsrValue : public MUnaryInstruction
 {
   private:
     ptrdiff_t frameOffset_;
@@ -4691,52 +4702,64 @@ class MOsrReturnValue : public MUnaryIns
     }
 };
 
 // Check the current frame for over-recursion past the global stack limit.
 class MCheckOverRecursed : public MNullaryInstruction
 {
   public:
     INSTRUCTION_HEADER(CheckOverRecursed)
+
+    static MCheckOverRecursed *New(TempAllocator &alloc) {
+        return new(alloc) MCheckOverRecursed();
+    }
 };
 
 // Check the current frame for over-recursion past the global stack limit.
 // Uses the per-thread recursion limit.
 class MCheckOverRecursedPar : public MUnaryInstruction
 {
-  public:
-    INSTRUCTION_HEADER(CheckOverRecursedPar);
-
     MCheckOverRecursedPar(MDefinition *slice)
       : MUnaryInstruction(slice)
     {
         setResultType(MIRType_None);
         setGuard();
         setMovable();
     }
 
+  public:
+    INSTRUCTION_HEADER(CheckOverRecursedPar);
+
+    static MCheckOverRecursedPar *New(TempAllocator &alloc, MDefinition *slice) {
+        return new(alloc) MCheckOverRecursedPar(slice);
+    }
+
     MDefinition *forkJoinSlice() const {
         return getOperand(0);
     }
 };
 
 // Check for an interrupt (or rendezvous) in parallel mode.
 class MCheckInterruptPar : public MUnaryInstruction
 {
-  public:
-    INSTRUCTION_HEADER(CheckInterruptPar);
-
     MCheckInterruptPar(MDefinition *slice)
       : MUnaryInstruction(slice)
     {
         setResultType(MIRType_None);
         setGuard();
         setMovable();
     }
 
+  public:
+    INSTRUCTION_HEADER(CheckInterruptPar);
+
+    static MCheckInterruptPar *New(TempAllocator &alloc, MDefinition *slice) {
+        return new(alloc) MCheckInterruptPar(slice);
+    }
+
     MDefinition *forkJoinSlice() const {
         return getOperand(0);
     }
 };
 
 // Check whether we need to fire the interrupt handler.
 class MInterruptCheck : public MNullaryInstruction
 {
@@ -5229,17 +5252,17 @@ class MInitializedLength
     }
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // Store to the initialized length in an elements header. Note the input is an
 // *index*, one less than the desired length.
 class MSetInitializedLength
   : public MAryInstruction<2>
 {
     MSetInitializedLength(MDefinition *elements, MDefinition *index) {
@@ -5264,37 +5287,41 @@ class MSetInitializedLength
         return AliasSet::Store(AliasSet::ObjectFields);
     }
 };
 
 // Load the array length from an elements header.
 class MArrayLength
   : public MUnaryInstruction
 {
-  public:
     MArrayLength(MDefinition *elements)
       : MUnaryInstruction(elements)
     {
         setResultType(MIRType_Int32);
         setMovable();
     }
 
+  public:
     INSTRUCTION_HEADER(ArrayLength)
 
+    static MArrayLength *New(TempAllocator &alloc, MDefinition *elements) {
+        return new(alloc) MArrayLength(elements);
+    }
+
     MDefinition *elements() const {
         return getOperand(0);
     }
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         return AliasSet::Load(AliasSet::ObjectFields);
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // Store to the length in an elements header. Note the input is an *index*, one
 // less than the desired length.
 class MSetArrayLength
   : public MAryInstruction<2>
 {
     MSetArrayLength(MDefinition *elements, MDefinition *index) {
@@ -5349,17 +5376,17 @@ class MTypedArrayLength
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         // The typed array |length| property is immutable, so there is no
         // implicit dependency.
         return AliasSet::None();
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // Load a typed array's elements vector.
 class MTypedArrayElements
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
     MTypedArrayElements(MDefinition *object)
@@ -5541,17 +5568,17 @@ class MBoundsCheck
         MBoundsCheck *other = ins->toBoundsCheck();
         if (minimum() != other->minimum() || maximum() != other->maximum())
             return false;
         return congruentIfOperandsEqual(other);
     }
     virtual AliasSet getAliasSet() const {
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // Bailout if index < minimum.
 class MBoundsCheckLower
   : public MUnaryInstruction
 {
     int32_t minimum_;
     bool fallible_;
@@ -5900,17 +5927,17 @@ class MArrayPush
         return getOperand(1);
     }
     TypePolicy *typePolicy() {
         return this;
     }
     AliasSet getAliasSet() const {
         return AliasSet::Store(AliasSet::Element | AliasSet::ObjectFields);
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // Array.prototype.concat on two dense arrays.
 class MArrayConcat
   : public MBinaryInstruction,
     public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >
 {
     CompilerRootObject templateObj_;
@@ -5992,17 +6019,17 @@ class MLoadTypedArrayElement
         return getOperand(1);
     }
     AliasSet getAliasSet() const {
         return AliasSet::Load(AliasSet::TypedArrayElement);
     }
 
     void printOpcode(FILE *fp) const;
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 
     bool canProduceFloat32() const { return arrayType_ == ScalarTypeRepresentation::TYPE_FLOAT32; }
 };
 
 // Load a value from a typed array. Out-of-bounds accesses are handled using
 // a VM call.
 class MLoadTypedArrayElementHole
   : public MBinaryInstruction,
@@ -6100,17 +6127,17 @@ class MLoadTypedArrayElementStatic
     void setInfallible() {
         fallible_ = false;
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
     bool truncate();
     bool canProduceFloat32() const { return typedArray_->type() == ScalarTypeRepresentation::TYPE_FLOAT32; }
 };
 
 class MStoreTypedArrayElement
   : public MTernaryInstruction,
     public StoreTypedArrayPolicy
 {
@@ -6350,17 +6377,17 @@ class MClampToUint8
         return this;
     }
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 class MLoadFixedSlot
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
     size_t slot_;
 
@@ -8010,35 +8037,39 @@ class MStringLength
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         // The string |length| property is immutable, so there is no
         // implicit dependency.
         return AliasSet::None();
     }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // Inlined version of Math.floor().
 class MFloor
   : public MUnaryInstruction,
     public FloatingPointPolicy<0>
 {
-  public:
     MFloor(MDefinition *num)
       : MUnaryInstruction(num)
     {
         setResultType(MIRType_Int32);
         setPolicyType(MIRType_Double);
         setMovable();
     }
 
+  public:
     INSTRUCTION_HEADER(Floor)
 
+    static MFloor *New(TempAllocator &alloc, MDefinition *num) {
+        return new(alloc) MFloor(num);
+    }
+
     MDefinition *num() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
     TypePolicy *typePolicy() {
         return this;
@@ -8054,26 +8085,30 @@ class MFloor
 #endif
 };
 
 // Inlined version of Math.round().
 class MRound
   : public MUnaryInstruction,
     public DoublePolicy<0>
 {
-  public:
     MRound(MDefinition *num)
       : MUnaryInstruction(num)
     {
         setResultType(MIRType_Int32);
         setMovable();
     }
 
+  public:
     INSTRUCTION_HEADER(Round)
 
+    static MRound *New(TempAllocator &alloc, MDefinition *num) {
+        return new(alloc) MRound(num);
+    }
+
     MDefinition *num() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
     }
     TypePolicy *typePolicy() {
         return this;
@@ -8183,25 +8218,29 @@ class MIteratorEnd
     }
 };
 
 // Implementation for 'in' operator.
 class MIn
   : public MBinaryInstruction,
     public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >
 {
-  public:
     MIn(MDefinition *key, MDefinition *obj)
       : MBinaryInstruction(key, obj)
     {
         setResultType(MIRType_Boolean);
     }
 
+  public:
     INSTRUCTION_HEADER(In)
 
+    static MIn *New(TempAllocator &alloc, MDefinition *key, MDefinition *obj) {
+        return new(alloc) MIn(key, obj);
+    }
+
     TypePolicy *typePolicy() {
         return this;
     }
     bool possiblyCalls() const {
         return true;
     }
 };
 
@@ -8268,49 +8307,57 @@ class MInArray
 
 // Implementation for instanceof operator with specific rhs.
 class MInstanceOf
   : public MUnaryInstruction,
     public InstanceOfPolicy
 {
     CompilerRootObject protoObj_;
 
-  public:
     MInstanceOf(MDefinition *obj, JSObject *proto)
       : MUnaryInstruction(obj),
         protoObj_(proto)
     {
         setResultType(MIRType_Boolean);
     }
 
+  public:
     INSTRUCTION_HEADER(InstanceOf)
 
+    static MInstanceOf *New(TempAllocator &alloc, MDefinition *obj, JSObject *proto) {
+        return new(alloc) MInstanceOf(obj, proto);
+    }
+
     TypePolicy *typePolicy() {
         return this;
     }
 
     JSObject *prototypeObject() {
         return protoObj_;
     }
 };
 
 // Implementation for instanceof operator with unknown rhs.
 class MCallInstanceOf
   : public MBinaryInstruction,
     public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >
 {
-  public:
     MCallInstanceOf(MDefinition *obj, MDefinition *proto)
       : MBinaryInstruction(obj, proto)
     {
         setResultType(MIRType_Boolean);
     }
 
+  public:
     INSTRUCTION_HEADER(CallInstanceOf)
 
+    static MCallInstanceOf *New(TempAllocator &alloc, MDefinition *obj, MDefinition *proto) {
+        return new(alloc) MCallInstanceOf(obj, proto);
+    }
+
     TypePolicy *typePolicy() {
         return this;
     }
 };
 
 class MArgumentsLength : public MNullaryInstruction
 {
     MArgumentsLength()
@@ -8329,17 +8376,17 @@ class MArgumentsLength : public MNullary
     bool congruentTo(MDefinition *ins) const {
         return congruentIfOperandsEqual(ins);
     }
     AliasSet getAliasSet() const {
         // Arguments |length| cannot be mutated by Ion Code.
         return AliasSet::None();
    }
 
-    void computeRange();
+    void computeRange(TempAllocator &alloc);
 };
 
 // This MIR instruction is used to get an argument from the actual arguments.
 class MGetFrameArgument
   : public MUnaryInstruction,
     public IntPolicy<0>
 {
     bool scriptHasSetArg_;
@@ -8910,26 +8957,32 @@ class MEnclosingScope : public MLoadFixe
 
 // Creates a dense array of the given length.
 //
 // Note: the template object should be an *empty* dense array!
 class MNewDenseArrayPar : public MBinaryInstruction
 {
     CompilerRootObject templateObject_;
 
-  public:
-    INSTRUCTION_HEADER(NewDenseArrayPar);
-
     MNewDenseArrayPar(MDefinition *slice, MDefinition *length, JSObject *templateObject)
       : MBinaryInstruction(slice, length),
         templateObject_(templateObject)
     {
         setResultType(MIRType_Object);
     }
 
+  public:
+    INSTRUCTION_HEADER(NewDenseArrayPar);
+
+    static MNewDenseArrayPar *New(TempAllocator &alloc, MDefinition *slice, MDefinition *length,
+                                  JSObject *templateObject)
+    {
+        return new(alloc) MNewDenseArrayPar(slice, length, templateObject);
+    }
+
     MDefinition *forkJoinSlice() const {
         return getOperand(0);
     }
 
     MDefinition *length() const {
         return getOperand(1);
     }
 
@@ -8940,17 +8993,17 @@ class MNewDenseArrayPar : public MBinary
     bool possiblyCalls() const {
         return true;
     }
 };
 
 // A resume point contains the information needed to reconstruct the interpreter
 // state from a position in the JIT. See the big comment near resumeAfter() in
 // IonBuilder.cpp.
-class MResumePoint : public MNode, public InlineForwardListNode<MResumePoint>
+class MResumePoint MOZ_FINAL : public MNode, public InlineForwardListNode<MResumePoint>
 {
   public:
     enum Mode {
         ResumeAt,    // Resume until before the current instruction
         ResumeAfter, // Resume after the current instruction
         Outer        // State before inlining.
     };
 
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -152,17 +152,17 @@ class MoveResolver
         Kind kind() const {
             return kind_;
         }
     };
 
   private:
     struct PendingMove
       : public Move,
-        public TempObject,
+        public OldTempObject,
         public InlineListNode<PendingMove>
     {
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
           : Move(from, to, kind, false)
         { }
         
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -591,17 +591,17 @@ ParallelSafetyVisitor::visitToString(MTo
         return markUnsafe();
     return true;
 }
 
 bool
 ParallelSafetyVisitor::replaceWithNewPar(MInstruction *newInstruction,
                                          JSObject *templateObject)
 {
-    replace(newInstruction, new MNewPar(forkJoinSlice(), templateObject));
+    replace(newInstruction, MNewPar::New(alloc(), forkJoinSlice(), templateObject));
     return true;
 }
 
 bool
 ParallelSafetyVisitor::replace(MInstruction *oldInstruction,
                                MInstruction *replacementInstruction)
 {
     MBasicBlock *block = oldInstruction->block();
@@ -734,23 +734,23 @@ ParallelSafetyVisitor::visitCall(MCall *
 // In sequential Ion code, the stack limit is stored in the JSRuntime.
 // We store it in the thread context.  We therefore need a separate
 // instruction to access it, one parameterized by the thread context.
 // Similar considerations apply to checking for interrupts.
 
 bool
 ParallelSafetyVisitor::visitCheckOverRecursed(MCheckOverRecursed *ins)
 {
-    return replace(ins, new MCheckOverRecursedPar(forkJoinSlice()));
+    return replace(ins, MCheckOverRecursedPar::New(alloc(), forkJoinSlice()));
 }
 
 bool
 ParallelSafetyVisitor::visitInterruptCheck(MInterruptCheck *ins)
 {
-    return replace(ins, new MCheckInterruptPar(forkJoinSlice()));
+    return replace(ins, MCheckInterruptPar::New(alloc(), forkJoinSlice()));
 }
 
 /////////////////////////////////////////////////////////////////////////////
 // Specialized ops
 //
 // Some ops, like +, can be specialized to ints/doubles.  Anything
 // else is terrifying.
 //
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -186,21 +186,23 @@ RangeAnalysis::addBetaNodes()
                 smaller = left;
                 greater = right;
             } else if (jsop == JSOP_GT) {
                 smaller = right;
                 greater = left;
             }
             if (smaller && greater) {
                 MBeta *beta;
-                beta = MBeta::New(alloc(), smaller, Range::NewInt32Range(JSVAL_INT_MIN, JSVAL_INT_MAX-1));
+                beta = MBeta::New(alloc(), smaller,
+                                  Range::NewInt32Range(alloc(), JSVAL_INT_MIN, JSVAL_INT_MAX-1));
                 block->insertBefore(*block->begin(), beta);
                 replaceDominatedUsesWith(smaller, beta, block);
                 IonSpew(IonSpew_Range, "Adding beta node for smaller %d", smaller->id());
-                beta = MBeta::New(alloc(), greater, Range::NewInt32Range(JSVAL_INT_MIN+1, JSVAL_INT_MAX));
+                beta = MBeta::New(alloc(), greater,
+                                  Range::NewInt32Range(alloc(), JSVAL_INT_MIN+1, JSVAL_INT_MAX));
                 block->insertBefore(*block->begin(), beta);
                 replaceDominatedUsesWith(greater, beta, block);
                 IonSpew(IonSpew_Range, "Adding beta node for greater %d", greater->id());
             }
             continue;
         } else {
             continue;
         }
@@ -244,17 +246,17 @@ RangeAnalysis::addBetaNodes()
         }
 
         if (IonSpewEnabled(IonSpew_Range)) {
             IonSpewHeader(IonSpew_Range);
             fprintf(IonSpewFile, "Adding beta node for %d with range ", val->id());
             comp.dump(IonSpewFile);
         }
 
-        MBeta *beta = MBeta::New(alloc(), val, new Range(comp));
+        MBeta *beta = MBeta::New(alloc(), val, new(alloc()) Range(comp));
         block->insertBefore(*block->begin(), beta);
         replaceDominatedUsesWith(val, beta, block);
     }
 
     return true;
 }
 
 bool
@@ -376,27 +378,27 @@ Range::dump(FILE *fp) const
 
 void
 Range::dump() const
 {
     dump(stderr);
 }
 
 Range *
-Range::intersect(const Range *lhs, const Range *rhs, bool *emptyRange)
+Range::intersect(TempAllocator &alloc, const Range *lhs, const Range *rhs, bool *emptyRange)
 {
     *emptyRange = false;
 
     if (!lhs && !rhs)
         return nullptr;
 
     if (!lhs)
-        return new Range(*rhs);
+        return new(alloc) Range(*rhs);
     if (!rhs)
-        return new Range(*lhs);
+        return new(alloc) Range(*lhs);
 
     int32_t newLower = Max(lhs->lower_, rhs->lower_);
     int32_t newUpper = Min(lhs->upper_, rhs->upper_);
 
     // :TODO: This information could be used better. If upper < lower, then we
     // have conflicting constraints. Consider:
     //
     // if (x < 0) {
@@ -456,18 +458,18 @@ Range::intersect(const Range *lhs, const
         // push the bounds past each other, since the actual intersection is
         // the empty set.
         if (newLower > newUpper) {
             *emptyRange = true;
             return nullptr;
         }
     }
 
-    return new Range(newLower, newHasInt32LowerBound, newUpper, newHasInt32UpperBound,
-                     newFractional, newExponent);
+    return new(alloc) Range(newLower, newHasInt32LowerBound, newUpper, newHasInt32UpperBound,
+                            newFractional, newExponent);
 }
 
 void
 Range::unionWith(const Range *other)
 {
     int32_t newLower = Min(lower_, other->lower_);
     int32_t newUpper = Max(upper_, other->upper_);
 
@@ -585,17 +587,17 @@ Range::setDouble(double l, double h)
 static inline bool
 MissingAnyInt32Bounds(const Range *lhs, const Range *rhs)
 {
     return !lhs->hasInt32LowerBound() || !lhs->hasInt32UpperBound() ||
            !rhs->hasInt32LowerBound() || !rhs->hasInt32UpperBound();
 }
 
 Range *
-Range::add(const Range *lhs, const Range *rhs)
+Range::add(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     int64_t l = (int64_t) lhs->lower_ + (int64_t) rhs->lower_;
     if (!lhs->hasInt32LowerBound() || !rhs->hasInt32LowerBound())
         l = NoInt32LowerBound;
 
     int64_t h = (int64_t) lhs->upper_ + (int64_t) rhs->upper_;
     if (!lhs->hasInt32UpperBound() || !rhs->hasInt32UpperBound())
         h = NoInt32UpperBound;
@@ -605,21 +607,21 @@ Range::add(const Range *lhs, const Range
     uint16_t e = Max(lhs->max_exponent_, rhs->max_exponent_);
     if (e <= Range::MaxFiniteExponent)
         ++e;
 
     // Infinity + -Infinity is NaN.
     if (lhs->canBeInfiniteOrNaN() && rhs->canBeInfiniteOrNaN())
         e = Range::IncludesInfinityAndNaN;
 
-    return new Range(l, h, lhs->canHaveFractionalPart() || rhs->canHaveFractionalPart(), e);
+    return new(alloc) Range(l, h, lhs->canHaveFractionalPart() || rhs->canHaveFractionalPart(), e);
 }
 
 Range *
-Range::sub(const Range *lhs, const Range *rhs)
+Range::sub(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     int64_t l = (int64_t) lhs->lower_ - (int64_t) rhs->upper_;
     if (!lhs->hasInt32LowerBound() || !rhs->hasInt32UpperBound())
         l = NoInt32LowerBound;
 
     int64_t h = (int64_t) lhs->upper_ - (int64_t) rhs->lower_;
     if (!lhs->hasInt32UpperBound() || !rhs->hasInt32LowerBound())
         h = NoInt32UpperBound;
@@ -629,66 +631,66 @@ Range::sub(const Range *lhs, const Range
     uint16_t e = Max(lhs->max_exponent_, rhs->max_exponent_);
     if (e <= Range::MaxFiniteExponent)
         ++e;
 
     // Infinity - Infinity is NaN.
     if (lhs->canBeInfiniteOrNaN() && rhs->canBeInfiniteOrNaN())
         e = Range::IncludesInfinityAndNaN;
 
-    return new Range(l, h, lhs->canHaveFractionalPart() || rhs->canHaveFractionalPart(), e);
+    return new(alloc) Range(l, h, lhs->canHaveFractionalPart() || rhs->canHaveFractionalPart(), e);
 }
 
 Range *
-Range::and_(const Range *lhs, const Range *rhs)
+Range::and_(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     JS_ASSERT(lhs->isInt32());
     JS_ASSERT(rhs->isInt32());
 
     // If both numbers can be negative, result can be negative in the whole range
     if (lhs->lower() < 0 && rhs->lower() < 0)
-        return Range::NewInt32Range(INT32_MIN, Max(lhs->upper(), rhs->upper()));
+        return Range::NewInt32Range(alloc, INT32_MIN, Max(lhs->upper(), rhs->upper()));
 
     // Only one of both numbers can be negative.
     // - result can't be negative
     // - Upper bound is minimum of both upper range,
     int32_t lower = 0;
     int32_t upper = Min(lhs->upper(), rhs->upper());
 
     // EXCEPT when upper bound of non negative number is max value,
     // because negative value can return the whole max value.
     // -1 & 5 = 5
     if (lhs->lower() < 0)
        upper = rhs->upper();
     if (rhs->lower() < 0)
         upper = lhs->upper();
 
-    return Range::NewInt32Range(lower, upper);
+    return Range::NewInt32Range(alloc, lower, upper);
 }
 
 Range *
-Range::or_(const Range *lhs, const Range *rhs)
+Range::or_(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     JS_ASSERT(lhs->isInt32());
     JS_ASSERT(rhs->isInt32());
     // When one operand is always 0 or always -1, it's a special case where we
     // can compute a fully precise result. Handling these up front also
     // protects the code below from calling CountLeadingZeroes32 with a zero
     // operand or from shifting an int32_t by 32.
     if (lhs->lower() == lhs->upper()) {
         if (lhs->lower() == 0)
-            return new Range(*rhs);
+            return new(alloc) Range(*rhs);
         if (lhs->lower() == -1)
-            return new Range(*lhs);;
+            return new(alloc) Range(*lhs);;
     }
     if (rhs->lower() == rhs->upper()) {
         if (rhs->lower() == 0)
-            return new Range(*lhs);
+            return new(alloc) Range(*lhs);
         if (rhs->lower() == -1)
-            return new Range(*rhs);;
+            return new(alloc) Range(*rhs);;
     }
 
     // The code below uses CountLeadingZeroes32, which has undefined behavior
     // if its operand is 0. We rely on the code above to protect it.
     JS_ASSERT_IF(lhs->lower() >= 0, lhs->upper() != 0);
     JS_ASSERT_IF(rhs->lower() >= 0, rhs->upper() != 0);
     JS_ASSERT_IF(lhs->upper() < 0, lhs->lower() != -1);
     JS_ASSERT_IF(rhs->upper() < 0, rhs->lower() != -1);
@@ -713,21 +715,21 @@ Range::or_(const Range *lhs, const Range
         }
         if (rhs->upper() < 0) {
             unsigned leadingOnes = CountLeadingZeroes32(~rhs->lower());
             lower = Max(lower, ~int32_t(UINT32_MAX >> leadingOnes));
             upper = -1;
         }
     }
 
-    return Range::NewInt32Range(lower, upper);
+    return Range::NewInt32Range(alloc, lower, upper);
 }
 
 Range *
-Range::xor_(const Range *lhs, const Range *rhs)
+Range::xor_(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     JS_ASSERT(lhs->isInt32());
     JS_ASSERT(rhs->isInt32());
     int32_t lhsLower = lhs->lower();
     int32_t lhsUpper = lhs->upper();
     int32_t rhsLower = rhs->lower();
     int32_t rhsUpper = rhs->upper();
     bool invertAfter = false;
@@ -777,28 +779,28 @@ Range::xor_(const Range *lhs, const Rang
     // If we bitwise-negated one (but not both) of the operands above, apply the
     // bitwise-negate to the result, completing ~((~x)^y) == x^y.
     if (invertAfter) {
         lower = ~lower;
         upper = ~upper;
         Swap(lower, upper);
     }
 
-    return Range::NewInt32Range(lower, upper);
+    return Range::NewInt32Range(alloc, lower, upper);
 }
 
 Range *
-Range::not_(const Range *op)
+Range::not_(TempAllocator &alloc, const Range *op)
 {
     JS_ASSERT(op->isInt32());
-    return Range::NewInt32Range(~op->upper(), ~op->lower());
+    return Range::NewInt32Range(alloc, ~op->upper(), ~op->lower());
 }
 
 Range *
-Range::mul(const Range *lhs, const Range *rhs)
+Range::mul(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     bool fractional = lhs->canHaveFractionalPart() || rhs->canHaveFractionalPart();
 
     uint16_t exponent;
     if (!lhs->canBeInfiniteOrNaN() && !rhs->canBeInfiniteOrNaN()) {
         // Two finite values.
         exponent = lhs->numBits() + rhs->numBits() - 1;
         if (exponent > Range::MaxFiniteExponent)
@@ -811,147 +813,147 @@ Range::mul(const Range *lhs, const Range
         // Two values that multiplied together won't produce a NaN.
         exponent = Range::IncludesInfinity;
     } else {
         // Could be anything.
         exponent = Range::IncludesInfinityAndNaN;
     }
 
     if (MissingAnyInt32Bounds(lhs, rhs))
-        return new Range(NoInt32LowerBound, NoInt32UpperBound, fractional, exponent);
+        return new(alloc) Range(NoInt32LowerBound, NoInt32UpperBound, fractional, exponent);
     int64_t a = (int64_t)lhs->lower() * (int64_t)rhs->lower();
     int64_t b = (int64_t)lhs->lower() * (int64_t)rhs->upper();
     int64_t c = (int64_t)lhs->upper() * (int64_t)rhs->lower();
     int64_t d = (int64_t)lhs->upper() * (int64_t)rhs->upper();
-    return new Range(
+    return new(alloc) Range(
         Min( Min(a, b), Min(c, d) ),
         Max( Max(a, b), Max(c, d) ),
         fractional, exponent);
 }
 
 Range *
-Range::lsh(const Range *lhs, int32_t c)
+Range::lsh(TempAllocator &alloc, const Range *lhs, int32_t c)
 {
     JS_ASSERT(lhs->isInt32());
     int32_t shift = c & 0x1f;
 
     // If the shift doesn't loose bits or shift bits into the sign bit, we
     // can simply compute the correct range by shifting.
     if ((int32_t)((uint32_t)lhs->lower() << shift << 1 >> shift >> 1) == lhs->lower() &&
         (int32_t)((uint32_t)lhs->upper() << shift << 1 >> shift >> 1) == lhs->upper())
     {
-        return Range::NewInt32Range(
+        return Range::NewInt32Range(alloc,
             uint32_t(lhs->lower()) << shift,
             uint32_t(lhs->upper()) << shift);
     }
 
-    return Range::NewInt32Range(INT32_MIN, INT32_MAX);
+    return Range::NewInt32Range(alloc, INT32_MIN, INT32_MAX);
 }
 
 Range *
-Range::rsh(const Range *lhs, int32_t c)
+Range::rsh(TempAllocator &alloc, const Range *lhs, int32_t c)
 {
     JS_ASSERT(lhs->isInt32());
     int32_t shift = c & 0x1f;
-    return Range::NewInt32Range(
+    return Range::NewInt32Range(alloc,
         lhs->lower() >> shift,
         lhs->upper() >> shift);
 }
 
 Range *
-Range::ursh(const Range *lhs, int32_t c)
+Range::ursh(TempAllocator &alloc, const Range *lhs, int32_t c)
 {
     // ursh's left operand is uint32, not int32, but for range analysis we
     // currently approximate it as int32. We assume here that the range has
     // already been adjusted accordingly by our callers.
     JS_ASSERT(lhs->isInt32());
 
     int32_t shift = c & 0x1f;
 
     // If the value is always non-negative or always negative, we can simply
     // compute the correct range by shifting.
     if (lhs->isFiniteNonNegative() || lhs->isFiniteNegative()) {
-        return Range::NewUInt32Range(
+        return Range::NewUInt32Range(alloc,
             uint32_t(lhs->lower()) >> shift,
             uint32_t(lhs->upper()) >> shift);
     }
 
     // Otherwise return the most general range after the shift.
-    return Range::NewUInt32Range(0, UINT32_MAX >> shift);
+    return Range::NewUInt32Range(alloc, 0, UINT32_MAX >> shift);
 }
 
 Range *
-Range::lsh(const Range *lhs, const Range *rhs)
+Range::lsh(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     JS_ASSERT(lhs->isInt32());
     JS_ASSERT(rhs->isInt32());
-    return Range::NewInt32Range(INT32_MIN, INT32_MAX);
+    return Range::NewInt32Range(alloc, INT32_MIN, INT32_MAX);
 }
 
 Range *
-Range::rsh(const Range *lhs, const Range *rhs)
+Range::rsh(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     JS_ASSERT(lhs->isInt32());
     JS_ASSERT(rhs->isInt32());
-    return Range::NewInt32Range(Min(lhs->lower(), 0), Max(lhs->upper(), 0));
+    return Range::NewInt32Range(alloc, Min(lhs->lower(), 0), Max(lhs->upper(), 0));
 }
 
 Range *
-Range::ursh(const Range *lhs, const Range *rhs)
+Range::ursh(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     // ursh's left operand is uint32, not int32, but for range analysis we
     // currently approximate it as int32. We assume here that the range has
     // already been adjusted accordingly by our callers.
     JS_ASSERT(lhs->isInt32());
     JS_ASSERT(rhs->isInt32());
-    return Range::NewUInt32Range(0, lhs->isFiniteNonNegative() ? lhs->upper() : UINT32_MAX);
+    return Range::NewUInt32Range(alloc, 0, lhs->isFiniteNonNegative() ? lhs->upper() : UINT32_MAX);
 }
 
 Range *
-Range::abs(const Range *op)
+Range::abs(TempAllocator &alloc, const Range *op)
 {
     int32_t l = op->lower_;
     int32_t u = op->upper_;
 
-    return new Range(Max(Max(int32_t(0), l), u == INT32_MIN ? INT32_MAX : -u),
-                     true,
-                     Max(Max(int32_t(0), u), l == INT32_MIN ? INT32_MAX : -l),
-                     op->hasInt32LowerBound_ && op->hasInt32UpperBound_ && l != INT32_MIN,
-                     op->canHaveFractionalPart_,
-                     op->max_exponent_);
+    return new(alloc) Range(Max(Max(int32_t(0), l), u == INT32_MIN ? INT32_MAX : -u),
+                            true,
+                            Max(Max(int32_t(0), u), l == INT32_MIN ? INT32_MAX : -l),
+                            op->hasInt32LowerBound_ && op->hasInt32UpperBound_ && l != INT32_MIN,
+                            op->canHaveFractionalPart_,
+                            op->max_exponent_);
 }
 
 Range *
-Range::min(const Range *lhs, const Range *rhs)
+Range::min(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     // If either operand is NaN, the result is NaN.
     if (lhs->canBeNaN() || rhs->canBeNaN())
         return nullptr;
 
-    return new Range(Min(lhs->lower_, rhs->lower_),
-                     lhs->hasInt32LowerBound_ && rhs->hasInt32LowerBound_,
-                     Min(lhs->upper_, rhs->upper_),
-                     lhs->hasInt32UpperBound_ || rhs->hasInt32UpperBound_,
-                     lhs->canHaveFractionalPart_ || rhs->canHaveFractionalPart_,
-                     Max(lhs->max_exponent_, rhs->max_exponent_));
+    return new(alloc) Range(Min(lhs->lower_, rhs->lower_),
+                            lhs->hasInt32LowerBound_ && rhs->hasInt32LowerBound_,
+                            Min(lhs->upper_, rhs->upper_),
+                            lhs->hasInt32UpperBound_ || rhs->hasInt32UpperBound_,
+                            lhs->canHaveFractionalPart_ || rhs->canHaveFractionalPart_,
+                            Max(lhs->max_exponent_, rhs->max_exponent_));
 }
 
 Range *
-Range::max(const Range *lhs, const Range *rhs)
+Range::max(TempAllocator &alloc, const Range *lhs, const Range *rhs)
 {
     // If either operand is NaN, the result is NaN.
     if (lhs->canBeNaN() || rhs->canBeNaN())
         return nullptr;
 
-    return new Range(Max(lhs->lower_, rhs->lower_),
-                     lhs->hasInt32LowerBound_ || rhs->hasInt32LowerBound_,
-                     Max(lhs->upper_, rhs->upper_),
-                     lhs->hasInt32UpperBound_ && rhs->hasInt32UpperBound_,
-                     lhs->canHaveFractionalPart_ || rhs->canHaveFractionalPart_,
-                     Max(lhs->max_exponent_, rhs->max_exponent_));
+    return new(alloc) Range(Max(lhs->lower_, rhs->lower_),
+                            lhs->hasInt32LowerBound_ || rhs->hasInt32LowerBound_,
+                            Max(lhs->upper_, rhs->upper_),
+                            lhs->hasInt32UpperBound_ && rhs->hasInt32UpperBound_,
+                            lhs->canHaveFractionalPart_ || rhs->canHaveFractionalPart_,
+                            Max(lhs->max_exponent_, rhs->max_exponent_));
 }
 
 bool
 Range::negativeZeroMul(const Range *lhs, const Range *rhs)
 {
     // The result can only be negative zero if both sides are finite and they
     // have differing signs.
     return (lhs->canBeFiniteNegative() && rhs->canBeFiniteNonNegative()) ||
@@ -981,17 +983,17 @@ Range::update(const Range *other)
     return changed;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 // Range Computation for MIR Nodes
 ///////////////////////////////////////////////////////////////////////////////
 
 void
-MPhi::computeRange()
+MPhi::computeRange(TempAllocator &alloc)
 {
     if (type() != MIRType_Int32 && type() != MIRType_Double)
         return;
 
     Range *range = nullptr;
     JS_ASSERT(getOperand(0)->op() != MDefinition::Op_OsrValue);
     for (size_t i = 0, e = numOperands(); i < e; i++) {
         if (getOperand(i)->block()->earlyAbort()) {
@@ -1007,233 +1009,233 @@ MPhi::computeRange()
         if (!getOperand(i)->range())
             return;
 
         Range input(getOperand(i));
 
         if (range)
             range->unionWith(&input);
         else
-            range = new Range(input);
+            range = new(alloc) Range(input);
     }
 
     setRange(range);
 }
 
 void
-MBeta::computeRange()
+MBeta::computeRange(TempAllocator &alloc)
 {
     bool emptyRange = false;
 
     Range opRange(getOperand(0));
-    Range *range = Range::intersect(&opRange, comparison_, &emptyRange);
+    Range *range = Range::intersect(alloc, &opRange, comparison_, &emptyRange);
     if (emptyRange) {
         IonSpew(IonSpew_Range, "Marking block for inst %d unexitable", id());
         block()->setEarlyAbort();
     } else {
         setRange(range);
     }
 }
 
 void
-MConstant::computeRange()
+MConstant::computeRange(TempAllocator &alloc)
 {
     if (value().isNumber()) {
         double d = value().toNumber();
-        setRange(Range::NewDoubleRange(d, d));
+        setRange(Range::NewDoubleRange(alloc, d, d));
     } else if (value().isBoolean()) {
         bool b = value().toBoolean();
-        setRange(Range::NewInt32Range(b, b));
+        setRange(Range::NewInt32Range(alloc, b, b));
     }
 }
 
 void
-MCharCodeAt::computeRange()
+MCharCodeAt::computeRange(TempAllocator &alloc)
 {
     // ECMA 262 says that the integer will be non-negative and at most 65535.
-    setRange(Range::NewInt32Range(0, 65535));
+    setRange(Range::NewInt32Range(alloc, 0, 65535));
 }
 
 void
-MClampToUint8::computeRange()
+MClampToUint8::computeRange(TempAllocator &alloc)
 {
-    setRange(Range::NewUInt32Range(0, 255));
+    setRange(Range::NewUInt32Range(alloc, 0, 255));
 }
 
 void
-MBitAnd::computeRange()
+MBitAnd::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
     left.wrapAroundToInt32();
     right.wrapAroundToInt32();
 
-    setRange(Range::and_(&left, &right));
+    setRange(Range::and_(alloc, &left, &right));
 }
 
 void
-MBitOr::computeRange()
+MBitOr::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
     left.wrapAroundToInt32();
     right.wrapAroundToInt32();
 
-    setRange(Range::or_(&left, &right));
+    setRange(Range::or_(alloc, &left, &right));
 }
 
 void
-MBitXor::computeRange()
+MBitXor::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
     left.wrapAroundToInt32();
     right.wrapAroundToInt32();
 
-    setRange(Range::xor_(&left, &right));
+    setRange(Range::xor_(alloc, &left, &right));
 }
 
 void
-MBitNot::computeRange()
+MBitNot::computeRange(TempAllocator &alloc)
 {
     Range op(getOperand(0));
     op.wrapAroundToInt32();
 
-    setRange(Range::not_(&op));
+    setRange(Range::not_(alloc, &op));
 }
 
 void
-MLsh::computeRange()
+MLsh::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
     left.wrapAroundToInt32();
 
     MDefinition *rhs = getOperand(1);
     if (!rhs->isConstant()) {
         right.wrapAroundToShiftCount();
-        setRange(Range::lsh(&left, &right));
+        setRange(Range::lsh(alloc, &left, &right));
         return;
     }
 
     int32_t c = rhs->toConstant()->value().toInt32();
-    setRange(Range::lsh(&left, c));
+    setRange(Range::lsh(alloc, &left, c));
 }
 
 void
-MRsh::computeRange()
+MRsh::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
     left.wrapAroundToInt32();
 
     MDefinition *rhs = getOperand(1);
     if (!rhs->isConstant()) {
         right.wrapAroundToShiftCount();
-        setRange(Range::rsh(&left, &right));
+        setRange(Range::rsh(alloc, &left, &right));
         return;
     }
 
     int32_t c = rhs->toConstant()->value().toInt32();
-    setRange(Range::rsh(&left, c));
+    setRange(Range::rsh(alloc, &left, c));
 }
 
 void
-MUrsh::computeRange()
+MUrsh::computeRange(TempAllocator &alloc)
 {
     Range left(getOperand(0));
     Range right(getOperand(1));
 
     // ursh can be thought of as converting its left operand to uint32, or it
     // can be thought of as converting its left operand to int32, and then
     // reinterpreting the int32 bits as a uint32 value. Both approaches yield
     // the same result. Since we lack support for full uint32 ranges, we use
     // the second interpretation, though it does cause us to be conservative.
     left.wrapAroundToInt32();
     right.wrapAroundToShiftCount();
 
     MDefinition *rhs = getOperand(1);
     if (!rhs->isConstant()) {
-        setRange(Range::ursh(&left, &right));
+        setRange(Range::ursh(alloc, &left, &right));
     } else {
         int32_t c = rhs->toConstant()->value().toInt32();
-        setRange(Range::ursh(&left, c));
+        setRange(Range::ursh(alloc, &left, c));
     }
 
     JS_ASSERT(range()->lower() >= 0);
 }
 
 void
-MAbs::computeRange()
+MAbs::computeRange(TempAllocator &alloc)
 {
     if (specialization_ != MIRType_Int32 && specialization_ != MIRType_Double)
         return;
 
     Range other(getOperand(0));
-    Range *next = Range::abs(&other);
+    Range *next = Range::abs(alloc, &other);
     if (implicitTruncate_)
         next->wrapAroundToInt32();
     setRange(next);
 }
 
 void
-MMinMax::computeRange()
+MMinMax::computeRange(TempAllocator &alloc)
 {
     if (specialization_ != MIRType_Int32 && specialization_ != MIRType_Double)
         return;
 
     Range left(getOperand(0));
     Range right(getOperand(1));
-    setRange(isMax() ? Range::max(&left, &right) : Range::min(&left, &right));
+    setRange(isMax() ? Range::max(alloc, &left, &right) : Range::min(alloc, &left, &right));
 }
 
 void
-MAdd::computeRange()
+MAdd::computeRange(TempAllocator &alloc)
 {
     if (specialization() != MIRType_Int32 && specialization() != MIRType_Double)
         return;
     Range left(getOperand(0));
     Range right(getOperand(1));
-    Range *next = Range::add(&left, &right);
+    Range *next = Range::add(alloc, &left, &right);
     if (isTruncated())
         next->wrapAroundToInt32();
     setRange(next);
 }
 
 void
-MSub::computeRange()
+MSub::computeRange(TempAllocator &alloc)
 {
     if (specialization() != MIRType_Int32 && specialization() != MIRType_Double)
         return;
     Range left(getOperand(0));
     Range right(getOperand(1));
-    Range *next = Range::sub(&left, &right);
+    Range *next = Range::sub(alloc, &left, &right);
     if (isTruncated())
         next->wrapAroundToInt32();
     setRange(next);
 }
 
 void
-MMul::computeRange()
+MMul::computeRange(TempAllocator &alloc)
 {
     if (specialization() != MIRType_Int32 && specialization() != MIRType_Double)
         return;
     Range left(getOperand(0));
     Range right(getOperand(1));
     if (canBeNegativeZero())
         canBeNegativeZero_ = Range::negativeZeroMul(&left, &right);
-    Range *next = Range::mul(&left, &right);
+    Range *next = Range::mul(alloc, &left, &right);
     // Truncated multiplications could overflow in both directions
     if (isTruncated())
         next->wrapAroundToInt32();
     setRange(next);
 }
 
 void
-MMod::computeRange()
+MMod::computeRange(TempAllocator &alloc)
 {
     if (specialization() != MIRType_Int32 && specialization() != MIRType_Double)
         return;
     Range lhs(getOperand(0));
     Range rhs(getOperand(1));
 
     // If either operand is a NaN, the result is NaN. This also conservatively
     // handles Infinity cases.
@@ -1270,17 +1272,17 @@ MMod::computeRange()
             rhsBound = UINT32_MAX;
 
         // The result will never be equal to the rhs, and we shouldn't have
         // any rounding to worry about.
         JS_ASSERT(!lhs.canHaveFractionalPart() && !rhs.canHaveFractionalPart());
         --rhsBound;
 
         // This gives us two upper bounds, so we can take the best one.
-        setRange(Range::NewUInt32Range(0, Min(lhsBound, rhsBound)));
+        setRange(Range::NewUInt32Range(alloc, 0, Min(lhsBound, rhsBound)));
         return;
     }
 
     // Math.abs(lhs % rhs) == Math.abs(lhs) % Math.abs(rhs).
     // First, the absolute value of the result will always be less than the
     // absolute value of rhs. (And if rhs is zero, the result is NaN).
     int64_t a = Abs<int64_t>(rhs.lower());
     int64_t b = Abs<int64_t>(rhs.upper());
@@ -1302,230 +1304,223 @@ MMod::computeRange()
     int64_t absBound = Min(lhsAbsBound, rhsAbsBound);
 
     // Now consider the sign of the result.
     // If lhs is non-negative, the result will be non-negative.
     // If lhs is non-positive, the result will be non-positive.
     int64_t lower = lhs.lower() >= 0 ? 0 : -absBound;
     int64_t upper = lhs.upper() <= 0 ? 0 : absBound;
 
-    setRange(new Range(lower, upper, lhs.canHaveFractionalPart() || rhs.canHaveFractionalPart(),
-                       Min(lhs.exponent(), rhs.exponent())));
+    setRange(new(alloc) Range(lower, upper, lhs.canHaveFractionalPart() || rhs.canHaveFractionalPart(),
+                              Min(lhs.exponent(), rhs.exponent())));
 }
 
 void
-MDiv::computeRange()
+MDiv::computeRange(TempAllocator &alloc)
 {
     if (specialization() != MIRType_Int32 && specialization() != MIRType_Double)
         return;
     Range lhs(getOperand(0));
     Range rhs(getOperand(1));
 
     // If either operand is a NaN, the result is NaN. This also conservatively
     // handles Infinity cases.
     if (!lhs.hasInt32Bounds() || !rhs.hasInt32Bounds())
         return;
 
     // Something simple for now: When dividing by a positive rhs, the result
     // won't be further from zero than lhs.
     if (lhs.lower() >= 0 && rhs.lower() >= 1) {
-        setRange(new Range(0, lhs.upper(), true, lhs.exponent()));
-
-        // Also, we can optimize by converting this to an unsigned div.
-        if (specialization() == MIRType_Int32 &&
-            !lhs.canHaveFractionalPart() && !rhs.canHaveFractionalPart())
-        {
-            unsigned_ = true;
-        }
+        setRange(new(alloc) Range(0, lhs.upper(), true, lhs.exponent()));
     } else if (unsigned_ && rhs.lower() >= 1) {
         // We shouldn't set the unsigned flag if the inputs can have
         // fractional parts.
         JS_ASSERT(!lhs.canHaveFractionalPart() && !rhs.canHaveFractionalPart());
         // Unsigned division by a non-zero rhs will return a uint32 value.
-        setRange(Range::NewUInt32Range(0, UINT32_MAX));
+        setRange(Range::NewUInt32Range(alloc, 0, UINT32_MAX));
     }
 }
 
 void
-MSqrt::computeRange()
+MSqrt::computeRange(TempAllocator &alloc)
 {
     Range input(getOperand(0));
 
     // If either operand is a NaN, the result is NaN. This also conservatively
     // handles Infinity cases.
     if (!input.hasInt32Bounds())
         return;
 
     // Sqrt of a negative non-zero value is NaN.
     if (input.lower() < 0)
         return;
 
     // Something simple for now: When taking the sqrt of a positive value, the
     // result won't be further from zero than the input.
-    setRange(new Range(0, input.upper(), true, input.exponent()));
+    setRange(new(alloc) Range(0, input.upper(), true, input.exponent()));
 }
 
 void
-MToDouble::computeRange()
+MToDouble::computeRange(TempAllocator &alloc)
 {
-    setRange(new Range(getOperand(0)));
+    setRange(new(alloc) Range(getOperand(0)));
 }
 
 void
-MToFloat32::computeRange()
+MToFloat32::computeRange(TempAllocator &alloc)
 {
-    setRange(new Range(getOperand(0)));
+    setRange(new(alloc) Range(getOperand(0)));
 }
 
 void
-MTruncateToInt32::computeRange()
+MTruncateToInt32::computeRange(TempAllocator &alloc)
 {
-    Range *output = new Range(getOperand(0));
+    Range *output = new(alloc) Range(getOperand(0));
     output->wrapAroundToInt32();
     setRange(output);
 }
 
 void
-MToInt32::computeRange()
+MToInt32::computeRange(TempAllocator &alloc)
 {
-    Range *output = new Range(getOperand(0));
+    Range *output = new(alloc) Range(getOperand(0));
     output->clampToInt32();
     setRange(output);
 }
 
-static Range *GetTypedArrayRange(int type)
+static Range *GetTypedArrayRange(TempAllocator &alloc, int type)
 {
     switch (type) {
       case ScalarTypeRepresentation::TYPE_UINT8_CLAMPED:
       case ScalarTypeRepresentation::TYPE_UINT8:
-        return Range::NewUInt32Range(0, UINT8_MAX);
+        return Range::NewUInt32Range(alloc, 0, UINT8_MAX);
       case ScalarTypeRepresentation::TYPE_UINT16:
-        return Range::NewUInt32Range(0, UINT16_MAX);
+        return Range::NewUInt32Range(alloc, 0, UINT16_MAX);
       case ScalarTypeRepresentation::TYPE_UINT32:
-        return Range::NewUInt32Range(0, UINT32_MAX);
+        return Range::NewUInt32Range(alloc, 0, UINT32_MAX);
 
       case ScalarTypeRepresentation::TYPE_INT8:
-        return Range::NewInt32Range(INT8_MIN, INT8_MAX);
+        return Range::NewInt32Range(alloc, INT8_MIN, INT8_MAX);
       case ScalarTypeRepresentation::TYPE_INT16:
-        return Range::NewInt32Range(INT16_MIN, INT16_MAX);
+        return Range::NewInt32Range(alloc, INT16_MIN, INT16_MAX);
       case ScalarTypeRepresentation::TYPE_INT32:
-        return Range::NewInt32Range(INT32_MIN, INT32_MAX);
+        return Range::NewInt32Range(alloc, INT32_MIN, INT32_MAX);
 
       case ScalarTypeRepresentation::TYPE_FLOAT32:
       case ScalarTypeRepresentation::TYPE_FLOAT64:
         break;
     }
 
   return nullptr;
 }
 
 void
-MLoadTypedArrayElement::computeRange()
+MLoadTypedArrayElement::computeRange(TempAllocator &alloc)
 {
     // We have an Int32 type and if this is a UInt32 load it may produce a value
     // outside of our range, but we have a bailout to handle those cases.
-    setRange(GetTypedArrayRange(arrayType()));
+    setRange(GetTypedArrayRange(alloc, arrayType()));
 }
 
 void
-MLoadTypedArrayElementStatic::computeRange()
+MLoadTypedArrayElementStatic::computeRange(TempAllocator &alloc)
 {
     // We don't currently use MLoadTypedArrayElementStatic for uint32, so we
     // don't have to worry about it returning a value outside our type.
     JS_ASSERT(typedArray_->type() != ScalarTypeRepresentation::TYPE_UINT32);
 
-    setRange(GetTypedArrayRange(typedArray_->type()));
+    setRange(GetTypedArrayRange(alloc, typedArray_->type()));
 }
 
 void
-MArrayLength::computeRange()
+MArrayLength::computeRange(TempAllocator &alloc)
 {
     // Array lengths can go up to UINT32_MAX, but we only create MArrayLength
     // nodes when the value is known to be int32 (see the
     // OBJECT_FLAG_LENGTH_OVERFLOW flag).
-    setRange(Range::NewUInt32Range(0, INT32_MAX));
+    setRange(Range::NewUInt32Range(alloc, 0, INT32_MAX));
 }
 
 void
-MInitializedLength::computeRange()
+MInitializedLength::computeRange(TempAllocator &alloc)
 {
-    setRange(Range::NewUInt32Range(0, JSObject::NELEMENTS_LIMIT));
+    setRange(Range::NewUInt32Range(alloc, 0, JSObject::NELEMENTS_LIMIT));
 }
 
 void
-MTypedArrayLength::computeRange()
+MTypedArrayLength::computeRange(TempAllocator &alloc)
 {
-    setRange(Range::NewUInt32Range(0, INT32_MAX));
+    setRange(Range::NewUInt32Range(alloc, 0, INT32_MAX));
 }
 
 void
-MStringLength::computeRange()
+MStringLength::computeRange(TempAllocator &alloc)
 {
     static_assert(JSString::MAX_LENGTH <= UINT32_MAX,
                   "NewUInt32Range requires a uint32 value");
-    setRange(Range::NewUInt32Range(0, JSString::MAX_LENGTH));
+    setRange(Range::NewUInt32Range(alloc, 0, JSString::MAX_LENGTH));
 }
 
 void
-MArgumentsLength::computeRange()
+MArgumentsLength::computeRange(TempAllocator &alloc)
 {
     // This is is a conservative upper bound on what |TooManyArguments| checks.
     // If exceeded, Ion will not be entered in the first place.
     static_assert(SNAPSHOT_MAX_NARGS <= UINT32_MAX,
                   "NewUInt32Range requires a uint32 value");
-    setRange(Range::NewUInt32Range(0, SNAPSHOT_MAX_NARGS));
+    setRange(Range::NewUInt32Range(alloc, 0, SNAPSHOT_MAX_NARGS));
 }
 
 void
-MBoundsCheck::computeRange()
+MBoundsCheck::computeRange(TempAllocator &alloc)
 {
     // Just transfer the incoming index range to the output. The length() is
     // also interesting, but it is handled as a bailout check, and we're
     // computing a pre-bailout range here.
-    setRange(new Range(index()));
+    setRange(new(alloc) Range(index()));
 }
 
 void
-MArrayPush::computeRange()
+MArrayPush::computeRange(TempAllocator &alloc)
 {
     // MArrayPush returns the new array length.
-    setRange(Range::NewUInt32Range(0, UINT32_MAX));
+    setRange(Range::NewUInt32Range(alloc, 0, UINT32_MAX));
 }
 
 void
-MMathFunction::computeRange()
+MMathFunction::computeRange(TempAllocator &alloc)
 {
     Range opRange(getOperand(0));
     switch (function()) {
       case Sin:
       case Cos:
         if (!opRange.canBeInfiniteOrNaN())
-            setRange(Range::NewDoubleRange(-1.0, 1.0));
+            setRange(Range::NewDoubleRange(alloc, -1.0, 1.0));
         break;
       case Sign:
         if (!opRange.canBeNaN()) {
             // Note that Math.sign(-0) is -0, and we treat -0 as equal to 0.
             int32_t lower = -1;
             int32_t upper = 1;
             if (opRange.hasInt32LowerBound() && opRange.lower() >= 0)
                 lower = 0;
             if (opRange.hasInt32UpperBound() && opRange.upper() <= 0)
                 upper = 0;
-            setRange(Range::NewInt32Range(lower, upper));
+            setRange(Range::NewInt32Range(alloc, lower, upper));
         }
         break;
     default:
         break;
     }
 }
 
 void
-MRandom::computeRange()
+MRandom::computeRange(TempAllocator &alloc)
 {
-    setRange(Range::NewDoubleRange(0.0, 1.0));
+    setRange(Range::NewDoubleRange(alloc, 0.0, 1.0));
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 // Range Analysis
 ///////////////////////////////////////////////////////////////////////////////
 
 bool
 RangeAnalysis::markBlocksInLoopBody(MBasicBlock *header, MBasicBlock *backedge)
@@ -1762,17 +1757,17 @@ RangeAnalysis::analyzeLoopIterationCount
                 return nullptr;
         }
         if (!bound.add(lhs.constant))
             return nullptr;
     } else {
         return nullptr;
     }
 
-    return new LoopIterationBound(header, test, bound);
+    return new(alloc()) LoopIterationBound(header, test, bound);
 }
 
 void
 RangeAnalysis::analyzeLoopPhi(MBasicBlock *header, LoopIterationBound *loopBound, MPhi *phi)
 {
     // Given a bound on the number of backedges taken, compute an upper and
     // lower bound for a phi node that may change by a constant amount each
     // iteration. Unlike for the case when computing the iteration bound
@@ -1793,17 +1788,17 @@ RangeAnalysis::analyzeLoopPhi(MBasicBloc
         return;
 
     SimpleLinearSum modified = ExtractLinearSum(phi->getOperand(backedge->positionInPhiSuccessor()));
 
     if (modified.term != phi || modified.constant == 0)
         return;
 
     if (!phi->range())
-        phi->setRange(new Range());
+        phi->setRange(new(alloc()) Range());
 
     LinearSum initialSum(alloc());
     if (!initialSum.add(initial, 1))
         return;
 
     // The phi may change by N each iteration, and is either nondecreasing or
     // nonincreasing. initial(phi) is either a lower or upper bound for the
     // phi, and initial(phi) + loopBound * N is either an upper or lower bound,
@@ -1827,23 +1822,23 @@ RangeAnalysis::analyzeLoopPhi(MBasicBloc
     int32_t negativeConstant;
     if (!SafeSub(0, modified.constant, &negativeConstant) || !limitSum.add(negativeConstant))
         return;
 
     Range *initRange = initial->range();
     if (modified.constant > 0) {
         if (initRange && initRange->hasInt32LowerBound())
             phi->range()->refineLower(initRange->lower());
-        phi->range()->setSymbolicLower(new SymbolicBound(nullptr, initialSum));
-        phi->range()->setSymbolicUpper(new SymbolicBound(loopBound, limitSum));
+        phi->range()->setSymbolicLower(SymbolicBound::New(alloc(), nullptr, initialSum));
+        phi->range()->setSymbolicUpper(SymbolicBound::New(alloc(), loopBound, limitSum));
     } else {
         if (initRange && initRange->hasInt32UpperBound())
             phi->range()->refineUpper(initRange->upper());
-        phi->range()->setSymbolicUpper(new SymbolicBound(nullptr, initialSum));
-        phi->range()->setSymbolicLower(new SymbolicBound(loopBound, limitSum));
+        phi->range()->setSymbolicUpper(SymbolicBound::New(alloc(), nullptr, initialSum));
+        phi->range()->setSymbolicLower(SymbolicBound::New(alloc(), loopBound, limitSum));
     }
 
     IonSpew(IonSpew_Range, "added symbolic range on %d", phi->id());
     SpewRange(phi);
 }
 
 // Whether bound is valid at the specified bounds check instruction in a loop,
 // and may be used to hoist ins.
@@ -1870,53 +1865,53 @@ ConvertLinearSum(TempAllocator &alloc, M
     for (size_t i = 0; i < sum.numTerms(); i++) {
         LinearTerm term = sum.term(i);
         JS_ASSERT(!term.term->isConstant());
         if (term.scale == 1) {
             if (def) {
                 def = MAdd::New(alloc, def, term.term);
                 def->toAdd()->setInt32();
                 block->insertBefore(block->lastIns(), def->toInstruction());
-                def->computeRange();
+                def->computeRange(alloc);
             } else {
                 def = term.term;
             }
         } else if (term.scale == -1) {
             if (!def) {
                 def = MConstant::New(alloc, Int32Value(0));
                 block->insertBefore(block->lastIns(), def->toInstruction());
-                def->computeRange();
+                def->computeRange(alloc);
             }
             def = MSub::New(alloc, def, term.term);
             def->toSub()->setInt32();
             block->insertBefore(block->lastIns(), def->toInstruction());
-            def->computeRange();
+            def->computeRange(alloc);
         } else {
             JS_ASSERT(term.scale != 0);
             MConstant *factor = MConstant::New(alloc, Int32Value(term.scale));
             block->insertBefore(block->lastIns(), factor);
             MMul *mul = MMul::New(alloc, term.term, factor);
             mul->setInt32();
             block->insertBefore(block->lastIns(), mul);
-            mul->computeRange();
+            mul->computeRange(alloc);
             if (def) {
                 def = MAdd::New(alloc, def, mul);
                 def->toAdd()->setInt32();
                 block->insertBefore(block->lastIns(), def->toInstruction());
-                def->computeRange();
+                def->computeRange(alloc);
             } else {
                 def = mul;
             }
         }
     }
 
     if (!def) {
         def = MConstant::New(alloc, Int32Value(0));
         block->insertBefore(block->lastIns(), def->toInstruction());
-        def->computeRange();
+        def->computeRange(alloc);
     }
 
     return def;
 }
 
 bool
 RangeAnalysis::tryHoistBoundsCheck(MBasicBlock *header, MBoundsCheck *ins)
 {
@@ -1994,17 +1989,17 @@ RangeAnalysis::analyze()
     IonSpew(IonSpew_Range, "Doing range propagation");
 
     for (ReversePostorderIterator iter(graph_.rpoBegin()); iter != graph_.rpoEnd(); iter++) {
         MBasicBlock *block = *iter;
 
         for (MDefinitionIterator iter(block); iter; iter++) {
             MDefinition *def = *iter;
 
-            def->computeRange();
+            def->computeRange(alloc());
             IonSpew(IonSpew_Range, "computing range on %d", def->id());
             SpewRange(def);
         }
 
         if (block->isLoopHeader()) {
             if (!analyzeLoop(block))
                 return false;
         }
@@ -2069,17 +2064,17 @@ RangeAnalysis::addRangeAssertions()
             // Don't insert assertions if there's nothing interesting to assert.
             if (r.isUnknown() || (ins->type() == MIRType_Int32 && r.isUnknownInt32()))
                 continue;
 
             // Range-checking PassArgs breaks stuff.
             if (ins->isPassArg())
                 continue;
 
-            MAssertRange *guard = MAssertRange::New(alloc(), ins, new Range(r));
+            MAssertRange *guard = MAssertRange::New(alloc(), ins, new(alloc()) Range(r));
 
             // The code that removes beta nodes assumes that it can find them
             // in a contiguous run at the top of each block. Don't insert
             // range assertions in between beta nodes.
             MInstructionIterator insertIter = iter;
             while (insertIter->isBeta())
                 insertIter++;
 
--- a/js/src/jit/RangeAnalysis.h
+++ b/js/src/jit/RangeAnalysis.h
@@ -41,32 +41,38 @@ struct LoopIterationBound : public TempO
       : header(header), test(test), sum(sum)
     {
     }
 };
 
 // A symbolic upper or lower bound computed for a term.
 struct SymbolicBound : public TempObject
 {
+  private:
+    SymbolicBound(LoopIterationBound *loop, LinearSum sum)
+      : loop(loop), sum(sum)
+    {
+    }
+
+  public:
     // Any loop iteration bound from which this was derived.
     //
     // If non-nullptr, then 'sum' is only valid within the loop body, at
     // points dominated by the loop bound's test (see LoopIterationBound).
     //
     // If nullptr, then 'sum' is always valid.
     LoopIterationBound *loop;
 
+    static SymbolicBound *New(TempAllocator &alloc, LoopIterationBound *loop, LinearSum sum) {
+        return new(alloc) SymbolicBound(loop, sum);
+    }
+
     // Computed symbolic bound, see above.
     LinearSum sum;
 
-    SymbolicBound(LoopIterationBound *loop, LinearSum sum)
-      : loop(loop), sum(sum)
-    {
-    }
-
     void print(Sprinter &sp) const;
     void dump() const;
 };
 
 class RangeAnalysis
 {
   protected:
     bool blockDominates(MBasicBlock *b, MBasicBlock *b2);
@@ -347,62 +353,63 @@ class Range : public TempObject {
         assertInvariants();
     }
 
     // Construct a range from the given MDefinition. This differs from the
     // MDefinition's range() method in that it describes the range of values
     // *after* any bailout checks.
     Range(const MDefinition *def);
 
-    static Range *NewInt32Range(int32_t l, int32_t h) {
-        return new Range(l, h, false, MaxInt32Exponent);
+    static Range *NewInt32Range(TempAllocator &alloc, int32_t l, int32_t h) {
+        return new(alloc) Range(l, h, false, MaxInt32Exponent);
     }
 
-    static Range *NewUInt32Range(uint32_t l, uint32_t h) {
+    static Range *NewUInt32Range(TempAllocator &alloc, uint32_t l, uint32_t h) {
         // For now, just pass them to the constructor as int64_t values.
         // They'll become unbounded if they're not in the int32_t range.
-        return new Range(l, h, false, MaxUInt32Exponent);
+        return new(alloc) Range(l, h, false, MaxUInt32Exponent);
     }
 
-    static Range *NewDoubleRange(double l, double h) {
+    static Range *NewDoubleRange(TempAllocator &alloc, double l, double h) {
         if (mozilla::IsNaN(l) && mozilla::IsNaN(h))
             return nullptr;
 
-        Range *r = new Range();
+        Range *r = new(alloc) Range();
         r->setDouble(l, h);
         return r;
     }
 
     void print(Sprinter &sp) const;
     void dump(FILE *fp) const;
     void dump() const;
     bool update(const Range *other);
 
     // Unlike the other operations, unionWith is an in-place
     // modification. This is to avoid a bunch of useless extra
     // copying when chaining together unions when handling Phi
     // nodes.
     void unionWith(const Range *other);
-    static Range * intersect(const Range *lhs, const Range *rhs, bool *emptyRange);
-    static Range * add(const Range *lhs, const Range *rhs);
-    static Range * sub(const Range *lhs, const Range *rhs);
-    static Range * mul(const Range *lhs, const Range *rhs);
-    static Range * and_(const Range *lhs, const Range *rhs);
-    static Range * or_(const Range *lhs, const Range *rhs);
-    static Range * xor_(const Range *lhs, const Range *rhs);
-    static Range * not_(const Range *op);
-    static Range * lsh(const Range *lhs, int32_t c);
-    static Range * rsh(const Range *lhs, int32_t c);
-    static Range * ursh(const Range *lhs, int32_t c);
-    static Range * lsh(const Range *lhs, const Range *rhs);
-    static Range * rsh(const Range *lhs, const Range *rhs);
-    static Range * ursh(const Range *lhs, const Range *rhs);
-    static Range * abs(const Range *op);
-    static Range * min(const Range *lhs, const Range *rhs);
-    static Range * max(const Range *lhs, const Range *rhs);
+    static Range *intersect(TempAllocator &alloc, const Range *lhs, const Range *rhs,
+                             bool *emptyRange);
+    static Range *add(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *sub(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *mul(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *and_(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *or_(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *xor_(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *not_(TempAllocator &alloc, const Range *op);
+    static Range *lsh(TempAllocator &alloc, const Range *lhs, int32_t c);
+    static Range *rsh(TempAllocator &alloc, const Range *lhs, int32_t c);
+    static Range *ursh(TempAllocator &alloc, const Range *lhs, int32_t c);
+    static Range *lsh(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *rsh(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *ursh(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *abs(TempAllocator &alloc, const Range *op);
+    static Range *min(TempAllocator &alloc, const Range *lhs, const Range *rhs);
+    static Range *max(TempAllocator &alloc, const Range *lhs, const Range *rhs);
 
     static bool negativeZeroMul(const Range *lhs, const Range *rhs);
 
     bool isUnknownInt32() const {
         return isInt32() && lower() == INT32_MIN && upper() == INT32_MAX;
     }
 
     bool isUnknown() const {
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -23,17 +23,17 @@ DefaultStackSlot(uint32_t vreg)
 
 LAllocation *
 StupidAllocator::stackLocation(uint32_t vreg)
 {
     LDefinition *def = virtualRegisters[vreg];
     if (def->policy() == LDefinition::PRESET && def->output()->isArgument())
         return def->output();
 
-    return new LStackSlot(DefaultStackSlot(vreg), def->type() == LDefinition::DOUBLE);
+    return new(alloc()) LStackSlot(DefaultStackSlot(vreg), def->type() == LDefinition::DOUBLE);
 }
 
 StupidAllocator::RegisterIndex
 StupidAllocator::registerIndex(AnyRegister reg)
 {
     for (size_t i = 0; i < registerCount; i++) {
         if (reg == registers[i].reg)
             return i;
@@ -181,17 +181,17 @@ StupidAllocator::allocateRegister(LInstr
     return best;
 }
 
 void
 StupidAllocator::syncRegister(LInstruction *ins, RegisterIndex index)
 {
     if (registers[index].dirty) {
         LMoveGroup *input = getInputMoveGroup(ins->id());
-        LAllocation *source = new LAllocation(registers[index].reg);
+        LAllocation *source = new(alloc()) LAllocation(registers[index].reg);
 
         uint32_t existing = registers[index].vreg;
         LAllocation *dest = stackLocation(existing);
         input->addAfter(source, dest);
 
         registers[index].dirty = false;
     }
 }
@@ -204,17 +204,17 @@ StupidAllocator::evictRegister(LInstruct
 }
 
 void
 StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index)
 {
     // Load a vreg from its stack location to a register.
     LMoveGroup *input = getInputMoveGroup(ins->id());
     LAllocation *source = stackLocation(vreg);
-    LAllocation *dest = new LAllocation(registers[index].reg);
+    LAllocation *dest = new(alloc()) LAllocation(registers[index].reg);
     input->addAfter(source, dest);
     registers[index].set(vreg, ins);
 }
 
 StupidAllocator::RegisterIndex
 StupidAllocator::findExistingRegister(uint32_t vreg)
 {
     for (size_t i = 0; i < registerCount; i++) {
--- a/js/src/jit/shared/CodeGenerator-shared.h
+++ b/js/src/jit/shared/CodeGenerator-shared.h
@@ -435,17 +435,17 @@ class CodeGeneratorShared : public LInst
                                    jsbytecode *bytecode);
     OutOfLineAbortPar *oolAbortPar(ParallelBailoutCause cause, LInstruction *lir);
     OutOfLinePropagateAbortPar *oolPropagateAbortPar(LInstruction *lir);
     virtual bool visitOutOfLineAbortPar(OutOfLineAbortPar *ool) = 0;
     virtual bool visitOutOfLinePropagateAbortPar(OutOfLinePropagateAbortPar *ool) = 0;
 };
 
 // An out-of-line path is generated at the end of the function.
-class OutOfLineCode : public TempObject
+class OutOfLineCode : public OldTempObject
 {
     Label entry_;
     Label rejoin_;
     uint32_t framePushed_;
     jsbytecode *pc_;
     JSScript *script_;
 
   public:
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -1031,36 +1031,41 @@ CodeGeneratorX86Shared::visitModSelfI(LM
 }
 
 bool
 CodeGeneratorX86Shared::visitModPowTwoI(LModPowTwoI *ins)
 {
     Register lhs = ToRegister(ins->getOperand(0));
     int32_t shift = ins->shift();
 
-    Label negative, done;
-    // Switch based on sign of the lhs.
-    // Positive numbers are just a bitmask
-    masm.branchTest32(Assembler::Signed, lhs, lhs, &negative);
-    {
-        masm.andl(Imm32((1 << shift) - 1), lhs);
+    Label negative;
+
+    if (ins->mir()->canBeNegativeDividend()) {
+        // Switch based on sign of the lhs.
+        // Positive numbers are just a bitmask
+        masm.branchTest32(Assembler::Signed, lhs, lhs, &negative);
+    }
+
+    masm.andl(Imm32((1 << shift) - 1), lhs);
+
+    if (ins->mir()->canBeNegativeDividend()) {
+        Label done;
         masm.jump(&done);
-    }
-    // Negative numbers need a negate, bitmask, negate
-    {
+
+        // Negative numbers need a negate, bitmask, negate
         masm.bind(&negative);
         // visitModI has an overflow check here to catch INT_MIN % -1, but
         // here the rhs is a power of 2, and cannot be -1, so the check is not generated.
         masm.negl(lhs);
         masm.andl(Imm32((1 << shift) - 1), lhs);
         masm.negl(lhs);
         if (!ins->mir()->isTruncated() && !bailoutIf(Assembler::Zero, ins->snapshot()))
             return false;
+        masm.bind(&done);
     }
-    masm.bind(&done);
     return true;
 
 }
 
 class ModOverflowCheck : public OutOfLineCodeBase<CodeGeneratorX86Shared>
 {
     Label done_;
     LModI *ins_;
--- a/js/src/jit/shared/LIR-x86-shared.h
+++ b/js/src/jit/shared/LIR-x86-shared.h
@@ -53,22 +53,16 @@ class LDivPowTwoI : public LBinaryMath<0
 
     LDivPowTwoI(const LAllocation &lhs, const LAllocation &lhsCopy, int32_t shift)
       : shift_(shift)
     {
         setOperand(0, lhs);
         setOperand(1, lhsCopy);
     }
 
-    LDivPowTwoI(const LAllocation &lhs, int32_t shift)
-      : shift_(shift)
-    {
-        setOperand(0, lhs);
-    }
-
     const LAllocation *numerator() {
         return getOperand(0);
     }
     const LAllocation *numeratorCopy() {
         return getOperand(1);
     }
     int32_t shift() const {
         return shift_;
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -143,17 +143,17 @@ LIRGeneratorX86Shared::lowerDivI(MDiv *d
         // similar manner as positive powers of two, and division by other
         // constants can be optimized by a reciprocal multiplication technique.
         int32_t shift = FloorLog2(rhs);
         if (rhs > 0 && 1 << shift == rhs) {
             LAllocation lhs = useRegisterAtStart(div->lhs());
             LDivPowTwoI *lir;
             if (!div->canBeNegativeDividend()) {
                 // Numerator is unsigned, so does not need adjusting.
-                lir = new LDivPowTwoI(lhs, shift);
+                lir = new LDivPowTwoI(lhs, lhs, shift);
             } else {
                 // Numerator is signed, and needs adjusting, and an extra
                 // lhs copy register is needed.
                 lir = new LDivPowTwoI(lhs, useRegister(div->lhs()), shift);
             }
             if (div->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
             return defineReuseInput(lir, div, 0);
@@ -253,17 +253,17 @@ LIRGeneratorX86Shared::lowerUDiv(MDiv *d
     return defineFixed(lir, div, LAllocation(AnyRegister(eax)));
 }
 
 bool
 LIRGeneratorX86Shared::lowerUMod(MMod *mod)
 {
     // Optimize x%x. The comments in lowerModI apply here as well.
     if (mod->lhs() == mod->rhs()) {
-        if (mod->isTruncated())
+        if (mod->isTruncated() || (mod->isUnsigned() && !mod->canBeDivideByZero()))
             return define(new LInteger(0), mod);
 
         LModSelfI *lir = new LModSelfI(useRegisterAtStart(mod->lhs()));
         if (mod->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         return define(lir, mod);
     }
 
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -538,40 +538,32 @@ TypeSet::unionSets(TypeSet *a, TypeSet *
 // contents, along with the assumption made about those contents.
 //
 // At the end of compilation, when linking the result on the main thread, the
 // list of compiler constraints are read and converted to type constraints and
 // attached to the type sets. If the property type sets have changed so that the
 // assumptions no longer hold then the compilation is aborted and its result
 // discarded.
 
-static LifoAlloc *IonAlloc() {
-#ifdef JS_ION
-    return jit::GetIonContext()->temp->lifoAlloc();
-#else
-    MOZ_CRASH();
-#endif
-}
-
 // Superclass of all constraints generated during Ion compilation. These may
 // be allocated off the main thread, using the current Ion context's allocator.
 class CompilerConstraint
 {
   public:
     // Property being queried by the compiler.
     HeapTypeSetKey property;
 
     // Contents of the property at the point when the query was performed. This
     // may differ from the actual property types later in compilation as the
     // main thread performs side effects.
     TemporaryTypeSet *expected;
 
-    CompilerConstraint(const HeapTypeSetKey &property)
+    CompilerConstraint(LifoAlloc *alloc, const HeapTypeSetKey &property)
       : property(property),
-        expected(property.maybeTypes() ? property.maybeTypes()->clone(IonAlloc()) : nullptr)
+        expected(property.maybeTypes() ? property.maybeTypes()->clone(alloc) : nullptr)
     {}
 
     // Generate the type constraint recording the assumption made by this
     // compilation. Returns true if the assumption originally made still holds.
     virtual bool generateTypeConstraint(JSContext *cx, RecompileInfo recompileInfo) = 0;
 };
 
 class types::CompilerConstraintList
@@ -585,27 +577,31 @@ class types::CompilerConstraintList
         TemporaryTypeSet *bytecodeTypes;
     };
 
   private:
 
     // OOM during generation of some constraint.
     bool failed_;
 
+    // Allocator used for constraints.
+    LifoAlloc *alloc_;
+
 #ifdef JS_ION
     // Constraints generated on heap properties.
     Vector<CompilerConstraint *, 0, jit::IonAllocPolicy> constraints;
 
     // Scripts whose stack type sets were frozen for the compilation.
     Vector<FrozenScript, 1, jit::IonAllocPolicy> frozenScripts;
 #endif
 
   public:
     CompilerConstraintList(jit::TempAllocator &alloc)
       : failed_(false)
+      , alloc_(alloc.lifoAlloc())
 #ifdef JS_ION
       , constraints(alloc)
       , frozenScripts(alloc)
 #endif
     {}
 
     void add(CompilerConstraint *constraint) {
 #ifdef JS_ION
@@ -667,31 +663,34 @@ class types::CompilerConstraintList
     }
 
     bool failed() {
         return failed_;
     }
     void setFailed() {
         failed_ = true;
     }
+    LifoAlloc *alloc() const {
+        return alloc_;
+    }
 };
 
 CompilerConstraintList *
 types::NewCompilerConstraintList(jit::TempAllocator &alloc)
 {
-    return IonAlloc()->new_<CompilerConstraintList>(alloc);
+    return alloc.lifoAlloc()->new_<CompilerConstraintList>(alloc);
 }
 
 /* static */ bool
 TypeScript::FreezeTypeSets(CompilerConstraintList *constraints, JSScript *script,
                            TemporaryTypeSet **pThisTypes,
                            TemporaryTypeSet **pArgTypes,
                            TemporaryTypeSet **pBytecodeTypes)
 {
-    LifoAlloc *alloc = IonAlloc();
+    LifoAlloc *alloc = constraints->alloc();
     StackTypeSet *existing = script->types->typeArray();
 
     size_t count = NumTypeSets(script);
     TemporaryTypeSet *types = alloc->newArrayUninitialized<TemporaryTypeSet>(count);
     if (!types)
         return false;
     PodZero(types, count);
 
@@ -713,18 +712,18 @@ TypeScript::FreezeTypeSets(CompilerConst
 namespace {
 
 template <typename T>
 class CompilerConstraintInstance : public CompilerConstraint
 {
     T data;
 
   public:
-    CompilerConstraintInstance<T>(const HeapTypeSetKey &property, const T &data)
-      : CompilerConstraint(property), data(data)
+    CompilerConstraintInstance<T>(LifoAlloc *alloc, const HeapTypeSetKey &property, const T &data)
+      : CompilerConstraint(alloc, property), data(data)
     {}
 
     bool generateTypeConstraint(JSContext *cx, RecompileInfo recompileInfo);
 };
 
 // Constraint generated from a CompilerConstraint when linking the compilation.
 template <typename T>
 class TypeCompilerConstraint : public TypeConstraint
@@ -1012,17 +1011,20 @@ class ConstraintDataFreeze
     }
 };
 
 } /* anonymous namespace */
 
 void
 HeapTypeSetKey::freeze(CompilerConstraintList *constraints)
 {
-    constraints->add(IonAlloc()->new_<CompilerConstraintInstance<ConstraintDataFreeze> >(*this, ConstraintDataFreeze()));
+    LifoAlloc *alloc = constraints->alloc();
+
+    typedef CompilerConstraintInstance<ConstraintDataFreeze> T;
+    constraints->add(alloc->new_<T>(alloc, *this, ConstraintDataFreeze()));
 }
 
 static inline JSValueType
 GetValueTypeFromTypeFlags(TypeFlags flags)
 {
     switch (flags) {
       case TYPE_FLAG_UNDEFINED:
         return JSVAL_TYPE_UNDEFINED;
@@ -1203,17 +1205,20 @@ TypeObjectKey::hasFlags(CompilerConstrai
     JS_ASSERT(flags);
 
     if (TypeObject *type = maybeType()) {
         if (type->hasAnyFlags(flags))
             return true;
     }
 
     HeapTypeSetKey objectProperty = property(JSID_EMPTY);
-    constraints->add(IonAlloc()->new_<CompilerConstraintInstance<ConstraintDataFreezeObjectFlags> >(objectProperty, ConstraintDataFreezeObjectFlags(flags)));
+    LifoAlloc *alloc = constraints->alloc();
+
+    typedef CompilerConstraintInstance<ConstraintDataFreezeObjectFlags> T;
+    constraints->add(alloc->new_<T>(alloc, objectProperty, ConstraintDataFreezeObjectFlags(flags)));
     return false;
 }
 
 bool
 TemporaryTypeSet::hasObjectFlags(CompilerConstraintList *constraints, TypeObjectFlags flags)
 {
     if (unknownObject())
         return true;
@@ -1244,17 +1249,20 @@ TypeObject::initialHeap(CompilerConstrai
 
     if (shouldPreTenure())
         return gc::TenuredHeap;
 
     if (!canPreTenure())
         return gc::DefaultHeap;
 
     HeapTypeSetKey objectProperty = TypeObjectKey::get(this)->property(JSID_EMPTY);
-    constraints->add(IonAlloc()->new_<CompilerConstraintInstance<ConstraintDataFreezeObjectFlags> >(objectProperty, ConstraintDataFreezeObjectFlags(OBJECT_FLAG_PRE_TENURE)));
+    LifoAlloc *alloc = constraints->alloc();
+
+    typedef CompilerConstraintInstance<ConstraintDataFreezeObjectFlags> T;
+    constraints->add(alloc->new_<T>(alloc, objectProperty, ConstraintDataFreezeObjectFlags(OBJECT_FLAG_PRE_TENURE)));
 
     return gc::DefaultHeap;
 }
 
 namespace {
 
 // Constraint which triggers recompilation on any type change in an inlined
 // script. The freeze constraints added to stack type sets will only directly
@@ -1336,33 +1344,44 @@ class ConstraintDataFreezeObjectForTyped
 };
 
 } /* anonymous namespace */
 
 void
 TypeObjectKey::watchStateChangeForInlinedCall(CompilerConstraintList *constraints)
 {
     HeapTypeSetKey objectProperty = property(JSID_EMPTY);
-    constraints->add(IonAlloc()->new_<CompilerConstraintInstance<ConstraintDataFreezeObjectForInlinedCall> >(objectProperty, ConstraintDataFreezeObjectForInlinedCall()));
+    LifoAlloc *alloc = constraints->alloc();
+
+    typedef CompilerConstraintInstance<ConstraintDataFreezeObjectForInlinedCall> T;
+    constraints->add(alloc->new_<T>(alloc, objectProperty, ConstraintDataFreezeObjectForInlinedCall()));
 }
 
 void
 TypeObjectKey::watchStateChangeForNewScriptTemplate(CompilerConstraintList *constraints)
 {
     JSObject *templateObject = asTypeObject()->newScript()->templateObject;
     HeapTypeSetKey objectProperty = property(JSID_EMPTY);
-    constraints->add(IonAlloc()->new_<CompilerConstraintInstance<ConstraintDataFreezeObjectForNewScriptTemplate> >(objectProperty, ConstraintDataFreezeObjectForNewScriptTemplate(templateObject)));
+    LifoAlloc *alloc = constraints->alloc();
+
+    typedef CompilerConstraintInstance<ConstraintDataFreezeObjectForNewScriptTemplate> T;
+    constraints->add(alloc->new_<T>(alloc, objectProperty,
+                                    ConstraintDataFreezeObjectForNewScriptTemplate(templateObject)));
 }
 
 void
 TypeObjectKey::watchStateChangeForTypedArrayBuffer(CompilerConstraintList *constraints)
 {
     void *viewData = asSingleObject()->as<TypedArrayObject>().viewData();
     HeapTypeSetKey objectProperty = property(JSID_EMPTY);
-    constraints->add(IonAlloc()->new_<CompilerConstraintInstance<ConstraintDataFreezeObjectForTypedArrayBuffer> >(objectProperty, ConstraintDataFreezeObjectForTypedArrayBuffer(viewData)));
+    LifoAlloc *alloc = constraints->alloc();
+
+    typedef CompilerConstraintInstance<ConstraintDataFreezeObjectForTypedArrayBuffer> T;
+    constraints->add(alloc->new_<T>(alloc, objectProperty,
+                                    ConstraintDataFreezeObjectForTypedArrayBuffer(viewData)));
 }
 
 static void
 ObjectStateChange(ExclusiveContext *cxArg, TypeObject *object, bool markingUnknown)
 {
     if (object->unknownProperties())
         return;
 
@@ -1436,17 +1455,21 @@ class ConstraintDataFreezeConfiguredProp
 } /* anonymous namespace */
 
 bool
 HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *type)
 {
     if (maybeTypes() && maybeTypes()->configuredProperty())
         return true;
 
-    constraints->add(IonAlloc()->new_<CompilerConstraintInstance<ConstraintDataFreezeConfiguredProperty> >(*this, ConstraintDataFreezeConfiguredProperty(type)));
+    LifoAlloc *alloc = constraints->alloc();
+
+    typedef CompilerConstraintInstance<ConstraintDataFreezeConfiguredProperty> T;
+    constraints->add(alloc->new_<T>(alloc, *this,
+                                    ConstraintDataFreezeConfiguredProperty(type)));
     return false;
 }
 
 bool
 TemporaryTypeSet::filtersType(const TemporaryTypeSet *other, Type filteredType) const
 {
     if (other->unknown())
         return unknown();
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -3,21 +3,16 @@
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * JS math package.
  */
 
-#if defined(XP_WIN)
-/* _CRT_RAND_S must be #defined before #including stdlib.h to get rand_s(). */
-#define _CRT_RAND_S
-#endif
-
 #include "jsmath.h"
 
 #include "mozilla/Constants.h"
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/MathAlgorithms.h"
 #include "mozilla/MemoryReporting.h"
 
 #include <algorithm>  // for std::max
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -934,17 +934,17 @@ num_toFixed(JSContext *cx, unsigned argc
 
 JS_ALWAYS_INLINE bool
 num_toExponential_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsNumber(args.thisv()));
 
     JSDToStrMode mode;
     int precision;
-    if (args.length() == 0) {
+    if (!args.hasDefined(0)) {
         mode = DTOSTR_STANDARD_EXPONENTIAL;
         precision = 0;
     } else {
         mode = DTOSTR_EXPONENTIAL;
         if (!ComputePrecisionInRange(cx, 0, MAX_PRECISION, args[0], &precision))
             return false;
     }
 
@@ -970,28 +970,21 @@ num_toPrecision_impl(JSContext *cx, Call
         if (!str) {
             JS_ReportOutOfMemory(cx);
             return false;
         }
         args.rval().setString(str);
         return true;
     }
 
-    JSDToStrMode mode;
     int precision;
-    if (args.length() == 0) {
-        mode = DTOSTR_STANDARD;
-        precision = 0;
-    } else {
-        mode = DTOSTR_PRECISION;
-        if (!ComputePrecisionInRange(cx, 1, MAX_PRECISION, args[0], &precision))
-            return false;
-    }
+    if (!ComputePrecisionInRange(cx, 1, MAX_PRECISION, args[0], &precision))
+        return false;
 
-    return DToStrResult(cx, d, mode, precision, args);
+    return DToStrResult(cx, d, DTOSTR_PRECISION, precision, args);
 }
 
 static bool
 num_toPrecision(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsNumber, num_toPrecision_impl>(cx, args);
 }
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -122,17 +122,17 @@ Dump(JSContext *cx, unsigned argc, Value
         return false;
 
     NS_ConvertUTF16toUTF8 utf8str(reinterpret_cast<const PRUnichar*>(chars));
 #ifdef ANDROID
     __android_log_print(ANDROID_LOG_INFO, "Gecko", "%s", utf8str.get());
 #endif
 #ifdef XP_WIN
     if (IsDebuggerPresent()) {
-      OutputDebugStringW(reinterpret_cast<const PRUnichar*>(chars));
+      OutputDebugStringW(reinterpret_cast<const wchar_t*>(chars));
     }
 #endif
     fputs(utf8str.get(), stdout);
     fflush(stdout);
     return true;
 }
 
 static bool
--- a/js/xpconnect/loader/mozJSSubScriptLoader.cpp
+++ b/js/xpconnect/loader/mozJSSubScriptLoader.cpp
@@ -150,22 +150,22 @@ mozJSSubScriptLoader::ReadScript(nsIURI 
                                             charset, nullptr, script);
 
         if (NS_FAILED(rv)) {
             return ReportError(cx, LOAD_ERROR_BADCHARSET);
         }
 
         if (!reuseGlobal) {
             *scriptp = JS::Compile(cx, target_obj, options,
-                                   reinterpret_cast<const jschar*>(script.get()),
+                                   script.get(),
                                    script.Length());
         } else {
             *functionp = JS::CompileFunction(cx, target_obj, options,
                                              nullptr, 0, nullptr,
-                                             reinterpret_cast<const jschar*>(script.get()),
+                                             script.get(),
                                              script.Length());
         }
     } else {
         // We only use LAZY_SOURCE when no special encoding is specified because
         // the lazy source loader doesn't know the encoding.
         if (!reuseGlobal) {
             options.setSourcePolicy(JS::CompileOptions::LAZY_SOURCE);
             *scriptp = JS::Compile(cx, target_obj, options, buf.get(), len);
--- a/js/xpconnect/src/XPCLocale.cpp
+++ b/js/xpconnect/src/XPCLocale.cpp
@@ -105,17 +105,17 @@ private:
     if (!depStr.init(cx, src)) {
       return false;
     }
 
     nsAutoString result;
     changeCaseFnc(depStr, result);
 
     JSString *ucstr =
-      JS_NewUCStringCopyN(cx, (jschar*)result.get(), result.Length());
+      JS_NewUCStringCopyN(cx, result.get(), result.Length());
     if (!ucstr) {
       return false;
     }
 
     rval.set(STRING_TO_JSVAL(ucstr));
     return true;
   }
 
--- a/js/xpconnect/src/XPCMaps.h
+++ b/js/xpconnect/src/XPCMaps.h
@@ -690,19 +690,28 @@ public:
 private:
     JSObject2JSObjectMap() {}
 
     /*
      * This function is called during minor GCs for each key in the HashMap that
      * has been moved.
      */
     static void KeyMarkCallback(JSTracer *trc, void *k, void *d) {
+        /*
+         * To stop the barriers on the values of mTable firing while we are
+         * marking the store buffer, we cast the table to one that is
+         * binary-equivatlent but without the barriers, and update that.
+         */
+        typedef js::HashMap<JSObject *, JSObject *, js::PointerHasher<JSObject *, 3>,
+                            js::SystemAllocPolicy> UnbarrieredMap;
+        JSObject2JSObjectMap *self = static_cast<JSObject2JSObjectMap *>(d);
+        UnbarrieredMap &table = reinterpret_cast<UnbarrieredMap &>(self->mTable);
+
         JSObject *key = static_cast<JSObject*>(k);
-        JSObject2JSObjectMap *self = static_cast<JSObject2JSObjectMap *>(d);
         JSObject *prior = key;
         JS_CallObjectTracer(trc, &key, "XPCWrappedNativeScope::mWaiverWrapperMap key");
-        self->mTable.rekeyIfMoved(prior, key);
+        table.rekeyIfMoved(prior, key);
     }
 
     Map mTable;
 };
 
 #endif /* xpcmaps_h___ */
--- a/js/xpconnect/tests/components/native/xpctest_params.cpp
+++ b/js/xpconnect/tests/components/native/xpctest_params.cpp
@@ -162,17 +162,17 @@ NS_IMETHODIMP nsXPCTestParams::TestWstri
 {
     nsDependentString aprime(a);
     nsDependentString bprime(*b);
     *_retval = ToNewUnicode(bprime);
     *b = ToNewUnicode(aprime);
 
     // XPCOM ownership rules dictate that overwritten inout params must be callee-freed.
     // See https://developer.mozilla.org/en/XPIDL
-    NS_Free(const_cast<PRUnichar*>(bprime.get()));
+    NS_Free((void*)bprime.get());
 
     return NS_OK;
 }
 
 /* DOMString testDOMString (in DOMString a, inout DOMString b); */
 NS_IMETHODIMP nsXPCTestParams::TestDOMString(const nsAString & a, nsAString & b, nsAString & _retval)
 {
     STRING_METHOD_IMPL;
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -1292,18 +1292,17 @@ XrayToString(JSContext *cx, unsigned arg
         JS_ReportOutOfMemory(cx);
         return false;
     }
     result.AppendASCII(wrapperStr);
     JS_smprintf_free(wrapperStr);
 
     result.AppendASCII(end);
 
-    JSString *str = JS_NewUCStringCopyN(cx, reinterpret_cast<const jschar *>(result.get()),
-                                        result.Length());
+    JSString *str = JS_NewUCStringCopyN(cx, result.get(), result.Length());
     if (!str)
         return false;
 
     args.rval().setString(str);
     return true;
 }
 
 #ifdef DEBUG
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -1415,18 +1415,27 @@ ContainerState::CreateOrRecycleThebesLay
 #endif
       data->mRegionToInvalidate.SetEmpty();
     }
 
     // We do not need to Invalidate these areas in the widget because we
     // assume the caller of InvalidateThebesLayerContents has ensured
     // the area is invalidated in the widget.
   } else {
+    // Check whether the layer will be scrollable. This is used as a hint to
+    // influence whether tiled layers are used or not.
+    bool canScroll = false;
+    nsIFrame* animatedGeometryRootParent = aAnimatedGeometryRoot->GetParent();
+    if (animatedGeometryRootParent &&
+        animatedGeometryRootParent->GetType() == nsGkAtoms::scrollFrame) {
+      canScroll = true;
+    }
     // Create a new thebes layer
-    layer = mManager->CreateThebesLayer();
+    layer = mManager->CreateThebesLayerWithHint(canScroll ? LayerManager::SCROLLABLE :
+                                                            LayerManager::NONE);
     if (!layer)
       return nullptr;
     // Mark this layer as being used for Thebes-painting display items
     data = new ThebesDisplayItemLayerUserData();
     layer->SetUserData(&gThebesDisplayItemLayerUserData, data);
     ResetScrollPositionForLayerPixelAlignment(aAnimatedGeometryRoot);
 #ifndef MOZ_ANDROID_OMTC
     didResetScrollPositionForLayerPixelAlignment = true;
--- a/media/libopus/README_MOZILLA
+++ b/media/libopus/README_MOZILLA
@@ -3,9 +3,9 @@ IETF Opus audio codec reference implemen
 The source in this directory was copied from an opus
 repository checkout by running the ./update.sh script.
 Any changes made to this version of the source should
 be reflected in that script, e.g. by applying patch
 files after the copy step.
 
 The upstream repository is https://git.xiph.org/opus.git
 
-The git tag/revision used was v1.1-rc2-1-g35a44c6.
+The git tag/revision used was v1.1.
--- a/media/libopus/celt/celt_decoder.c
+++ b/media/libopus/celt/celt_decoder.c
@@ -208,31 +208,31 @@ void deemphasis(celt_sig *in[], opus_val
       y = pcm+c;
 #ifdef CUSTOM_MODES
       if (coef[1] != 0)
       {
          opus_val16 coef1 = coef[1];
          opus_val16 coef3 = coef[3];
          for (j=0;j<N;j++)
          {
-            celt_sig tmp = x[j] + m;
+            celt_sig tmp = x[j] + m + VERY_SMALL;
             m = MULT16_32_Q15(coef0, tmp)
                           - MULT16_32_Q15(coef1, x[j]);
             tmp = SHL32(MULT16_32_Q15(coef3, tmp), 2);
             scratch[j] = tmp;
          }
          apply_downsampling=1;
       } else
 #endif
       if (downsample>1)
       {
          /* Shortcut for the standard (non-custom modes) case */
          for (j=0;j<N;j++)
          {
-            celt_sig tmp = x[j] + m;
+            celt_sig tmp = x[j] + m + VERY_SMALL;
             m = MULT16_32_Q15(coef0, tmp);
             scratch[j] = tmp;
          }
          apply_downsampling=1;
       } else {
          /* Shortcut for the standard (non-custom modes) case */
          for (j=0;j<N;j++)
          {
--- a/media/libopus/celt/celt_encoder.c
+++ b/media/libopus/celt/celt_encoder.c
@@ -503,17 +503,17 @@ void celt_preemphasis(const opus_val16 *
    m = *mem;
 #ifdef CUSTOM_MODES
    if (coef[1] != 0)
    {
       opus_val16 coef1 = coef[1];
       opus_val16 coef2 = coef[2];
       for (i=0;i<N;i++)
       {
-         opus_val16 x, tmp;
+         celt_sig x, tmp;
          x = inp[i];
          /* Apply pre-emphasis */
          tmp = MULT16_16(coef2, x);
          inp[i] = tmp + m;
          m = MULT16_32_Q15(coef1, inp[i]) - MULT16_32_Q15(coef0, tmp);
       }
    } else
 #endif
@@ -1811,17 +1811,17 @@ int celt_encode_with_ec(CELTEncoder * OP
         {  1, 2, 3, 4, 5, 6, 7, 8,16,24,36,44,50,56,62,67,72,79,88,106,134};
       static const opus_val16 intensity_histeresis[21]=
         {  1, 1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 2, 2, 2, 3, 3, 4, 5, 6,  8, 8};
 
       /* Always use MS for 2.5 ms frames until we can do a better analysis */
       if (LM!=0)
          dual_stereo = stereo_analysis(mode, X, LM, N);
 
-      st->intensity = hysteresis_decision((opus_val16)equiv_rate/1000,
+      st->intensity = hysteresis_decision((opus_val16)(equiv_rate/1000),
             intensity_thresholds, intensity_histeresis, 21, st->intensity);
       st->intensity = IMIN(st->end,IMAX(st->start, st->intensity));
    }
 
    alloc_trim = 5;
    if (tell+(6<<BITRES) <= total_bits - total_boost)
    {
       if (st->lfe)
--- a/media/libopus/moz.build
+++ b/media/libopus/moz.build
@@ -11,17 +11,17 @@ EXPORTS.opus += [
     'include/opus_types.h',
 ]
 
 MSVC_ENABLE_PGO = True
 
 FINAL_LIBRARY = 'gkmedias'
 
 DEFINES['OPUS_BUILD'] = True
-DEFINES['OPUS_VERSION'] = '"v1.1-rc2-1-g35a44c6-mozilla"'
+DEFINES['OPUS_VERSION'] = '"v1.1-mozilla"'
 DEFINES['USE_ALLOCA'] = True
 
 if CONFIG['OS_ARCH'] in ('Linux', 'Darwin', 'DragonFly', 'FreeBSD',
                          'NetBSD', 'OpenBSD'):
     DEFINES['HAVE_LRINTF'] = True
 
 if CONFIG['OS_ARCH'] == 'WINNT':
     DEFINES['inline'] = '__inline'
--- a/media/libopus/update.sh
+++ b/media/libopus/update.sh
@@ -46,17 +46,17 @@ done
 for file in ${STATIC_FILES} ${MK_FILES} ${SRC_FILES} ${HDR_FILES}; do
   cmd="cp $1/${file} ${TARGET}/${file}"
   echo ${cmd}
   ${cmd}
 done
 
 # query git for the revision we're copying from
 if test -d $1/.git; then
-  version=$(cd $1 && git describe --tags)
+  version=$(cd $1 && git describe --tags --match 'v*' --dirty)
 else
   version="UNKNOWN"
 fi
 echo "copied from revision ${version}"
 # update README revision
 sed -e "s/^The git tag\/revision used was .*/The git tag\/revision used was ${version}./" \
     ${TARGET}/README_MOZILLA > ${TARGET}/README_MOZILLA+ && \
     mv ${TARGET}/README_MOZILLA+ ${TARGET}/README_MOZILLA
--- a/media/mtransport/build/moz.build
+++ b/media/mtransport/build/moz.build
@@ -27,17 +27,17 @@ EXPORTS.mtransport += [
 
 include('../objs.mozbuild')
 
 # These files cannot be built in unified mode because they force NSPR logging.
 SOURCES += mtransport_cppsrcs
 
 LIBRARY_NAME = 'mtransport'
 
-FAIL_ON_WARNINGS = not CONFIG['_MSC_VER']
+FAIL_ON_WARNINGS = True
 
 LOCAL_INCLUDES = [
     '/media/webrtc/trunk/third_party/libjingle/source/',
 ]
 LOCAL_INCLUDES += [
     '/media/mtransport/',
     '/media/mtransport/third_party/',
     '/media/mtransport/third_party/nICEr/src/crypto',
--- a/media/mtransport/third_party/nrappkit/src/port/win32/include/csi_platform.h
+++ b/media/mtransport/third_party/nrappkit/src/port/win32/include/csi_platform.h
@@ -46,16 +46,17 @@
 #endif
 
 #define UINT8 UBLAH_IGNORE_ME_PLEASE
 #define INT8 BLAH_IGNORE_ME_PLEASE
 #include <winsock2.h>
 #undef UINT8
 #undef INT8
 #include <r_types.h>
+#include <errno.h>
 
 #define strcasecmp _stricmp
 #define strncasecmp _strnicmp
 
 #define strcasestr stristr
 
 /* Hack version of strlcpy (in util/util.c) */
 size_t strlcat(char *dst, const char *src, size_t siz);
@@ -73,17 +74,19 @@ int gettimeofday(struct timeval *tv, voi
 typedef void* NR_SOCKET;
 #else
 typedef SOCKET NR_SOCKET;
 #define NR_SOCKET_READ(sock,buf,count)   recv((sock),(buf),(count),0)
 #define NR_SOCKET_WRITE(sock,buf,count)  send((sock),(buf),(count),0)
 #define NR_SOCKET_CLOSE(sock)            closesocket(sock)
 #endif
 
+#ifndef EHOSTUNREACH
 #define EHOSTUNREACH    WSAEHOSTUNREACH
+#endif
 
 #define LOG_EMERG       0
 #define LOG_ALERT       1
 #define LOG_CRIT        2
 #define LOG_ERR         3
 #define LOG_WARNING     4
 #define LOG_NOTICE      5
 #define LOG_INFO        6
--- a/media/mtransport/third_party/nrappkit/upstream.diff
+++ b/media/mtransport/third_party/nrappkit/upstream.diff
@@ -1,11 +1,11 @@
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/event/async_wait.h src/event/async_wait.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/event/async_wait.h	2007-06-26 15:37:44.000000000 -0700
-+++ src/event/async_wait.h	2012-10-03 22:15:41.000000000 -0700
+diff --git a/media/mtransport/third_party/nrappkit/src/event/async_wait.h b/media/mtransport/third_party/nrappkit/src/event/async_wait.h
+--- a/media/mtransport/third_party/nrappkit/src/event/async_wait.h
++++ b/media/mtransport/third_party/nrappkit/src/event/async_wait.h
 @@ -38,21 +38,21 @@
  
  
  #ifndef _async_wait_h
  #define _async_wait_h
  
  #ifdef HAVE_SYS_TIME_H
  #include <sys/time.h>
@@ -19,38 +19,39 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  #define NR_ASYNC_WAIT_WRITE 1
  
  
  int NR_async_wait_init(void);
  int NR_async_wait(NR_SOCKET sock, int how, NR_async_cb cb,void *cb_arg,
                              char *function,int line);
  int NR_async_cancel(NR_SOCKET sock,int how);
  int NR_async_schedule(NR_async_cb cb,void *arg,char *function,int line);
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/log/r_log.c src/log/r_log.c
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/log/r_log.c	2008-11-25 14:25:18.000000000 -0800
-+++ src/log/r_log.c	2012-10-03 22:15:41.000000000 -0700
-@@ -33,28 +33,40 @@
+diff --git a/media/mtransport/third_party/nrappkit/src/log/r_log.c b/media/mtransport/third_party/nrappkit/src/log/r_log.c
+--- a/media/mtransport/third_party/nrappkit/src/log/r_log.c
++++ b/media/mtransport/third_party/nrappkit/src/log/r_log.c
+@@ -33,28 +33,41 @@
     POSSIBILITY OF SUCH DAMAGE.
-    
+ 
  
     ekr@rtfm.com  Mon Dec  3 15:24:38 2001
   */
  
  
  static char *RCSSTRING __UNUSED__ ="$Id: r_log.c,v 1.10 2008/11/25 22:25:18 adamcain Exp $";
  
  
 +#ifdef LINUX
 +#define _BSD_SOURCE
 +#endif
 +
  #include "r_log.h"
  #include "hex.h"
 +
  #include <string.h>
++#include <errno.h>
 +#ifndef _MSC_VER
 +#include <strings.h>
 +#include <syslog.h>
 +#endif
  #include <registry.h>
  #include <time.h>
 +
 +
@@ -63,19 +64,19 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  int NR_LOG_LOGGING = 0;
  
  static char *log_level_strings[]={
       "EMERG",
       "ALERT",
       "CRIT",
       "ERR",
       "WARNING",
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/darwin/include/csi_platform.h src/port/darwin/include/csi_platform.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/darwin/include/csi_platform.h	2007-06-26 15:37:48.000000000 -0700
-+++ src/port/darwin/include/csi_platform.h	2012-10-03 22:15:41.000000000 -0700
+diff --git a/media/mtransport/third_party/nrappkit/src/port/darwin/include/csi_platform.h b/media/mtransport/third_party/nrappkit/src/port/darwin/include/csi_platform.h
+--- a/media/mtransport/third_party/nrappkit/src/port/darwin/include/csi_platform.h
++++ b/media/mtransport/third_party/nrappkit/src/port/darwin/include/csi_platform.h
 @@ -37,17 +37,21 @@
   */
  
  
  #ifndef _platform_h
  #define _platform_h
  
  #include <unistd.h>
@@ -88,19 +89,19 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  typedef int NR_SOCKET;
  #define NR_SOCKET_READ(sock,buf,count)   read((sock),(buf),(count))
  #define NR_SOCKET_WRITE(sock,buf,count)  write((sock),(buf),(count))
  #define NR_SOCKET_CLOSE(sock)            close(sock)
 +#endif
  
  #endif
  
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/linux/include/csi_platform.h src/port/linux/include/csi_platform.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/linux/include/csi_platform.h	2007-06-26 15:37:49.000000000 -0700
-+++ src/port/linux/include/csi_platform.h	2012-10-03 22:15:41.000000000 -0700
+diff --git a/media/mtransport/third_party/nrappkit/src/port/linux/include/csi_platform.h b/media/mtransport/third_party/nrappkit/src/port/linux/include/csi_platform.h
+--- a/media/mtransport/third_party/nrappkit/src/port/linux/include/csi_platform.h
++++ b/media/mtransport/third_party/nrappkit/src/port/linux/include/csi_platform.h
 @@ -35,17 +35,21 @@
  
     ekr@rtfm.com  Mon Dec 13 17:26:51 2004
   */
  
  
  #ifndef _platform_h
  #define _platform_h
@@ -113,63 +114,38 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  typedef int NR_SOCKET;
  #define NR_SOCKET_READ(sock,buf,count)   read((sock),(buf),(count))
  #define NR_SOCKET_WRITE(sock,buf,count)  write((sock),(buf),(count))
  #define NR_SOCKET_CLOSE(sock)            close(sock)
 +#endif
  
  #endif
  
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/linux/include/sys/queue.h src/port/linux/include/sys/queue.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/linux/include/sys/queue.h	2012-10-03 18:04:13.000000000 -0700
-+++ src/port/linux/include/sys/queue.h	2012-10-03 17:49:05.000000000 -0700
-@@ -26,21 +26,21 @@
-  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-  * SUCH DAMAGE.
-  *
-  *	@(#)queue.h	8.5 (Berkeley) 8/20/94
-  * $FreeBSD: src/sys/sys/queue.h,v 1.58 2004/04/07 04:19:49 imp Exp $
-  */
- 
- #ifndef _SYS_QUEUE_H_
- #define	_SYS_QUEUE_H_
- 
--#include <stddef.h>
-+#include <linux/stddef.h>
- #define __offsetof offsetof
- 
- #include <sys/cdefs.h>
- 
- #define STAILQ_FOREACH_SAFE(var, head, field, tvar)                     \
-          for ((var) = STAILQ_FIRST((head));                              \
-              (var) && ((tvar) = STAILQ_NEXT((var), field), 1);           \
-              (var) = (tvar))
- 
- 
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/win32/include/csi_platform.h src/port/win32/include/csi_platform.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/port/win32/include/csi_platform.h	2008-04-29 20:19:10.000000000 -0700
-+++ src/port/win32/include/csi_platform.h	2012-10-03 22:15:41.000000000 -0700
-@@ -47,43 +47,46 @@
+diff --git a/media/mtransport/third_party/nrappkit/src/port/win32/include/csi_platform.h b/media/mtransport/third_party/nrappkit/src/port/win32/include/csi_platform.h
+--- a/media/mtransport/third_party/nrappkit/src/port/win32/include/csi_platform.h
++++ b/media/mtransport/third_party/nrappkit/src/port/win32/include/csi_platform.h
+@@ -44,45 +44,51 @@
+ #define _WIN32_WINNT 0x0400  // This prevents weird "'TryEnterCriticalSection': identifier not found"
+                              // compiler errors when poco/win32_mutex.h is included
+ #endif
  
  #define UINT8 UBLAH_IGNORE_ME_PLEASE
  #define INT8 BLAH_IGNORE_ME_PLEASE
  #include <winsock2.h>
  #undef UINT8
  #undef INT8
  #include <r_types.h>
++#include <errno.h>
  
  #define strcasecmp _stricmp
  #define strncasecmp _strnicmp
 -#define snprintf _snprintf
  
  #define strcasestr stristr
  
- /* Hack version of addr2ascii (in util/util.c) */
- char *addr2ascii(int af, const void *addrp, int len,char *buf);
- 
  /* Hack version of strlcpy (in util/util.c) */
  size_t strlcat(char *dst, const char *src, size_t siz);
  
  /* Hack version of getopt() (in util/getopt.c) */
  int getopt(int argc, char *argv[], char *opstring);
  extern char *optarg;
  extern int optind;
  extern int opterr;
@@ -181,34 +157,38 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
 +typedef void* NR_SOCKET;
 +#else
  typedef SOCKET NR_SOCKET;
  #define NR_SOCKET_READ(sock,buf,count)   recv((sock),(buf),(count),0)
  #define NR_SOCKET_WRITE(sock,buf,count)  send((sock),(buf),(count),0)
  #define NR_SOCKET_CLOSE(sock)            closesocket(sock)
 +#endif
  
++#ifndef EHOSTUNREACH
  #define EHOSTUNREACH    WSAEHOSTUNREACH
++#endif
  
  #define LOG_EMERG       0
  #define LOG_ALERT       1
  #define LOG_CRIT        2
  #define LOG_ERR         3
  #define LOG_WARNING     4
  #define LOG_NOTICE      5
  #define LOG_INFO        6
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/registry/registry.c src/registry/registry.c
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/registry/registry.c	2007-11-20 16:09:12.000000000 -0800
-+++ src/registry/registry.c	2012-10-03 22:15:41.000000000 -0700
+ #define LOG_DEBUG       7
+ 
+diff --git a/media/mtransport/third_party/nrappkit/src/registry/registry.c b/media/mtransport/third_party/nrappkit/src/registry/registry.c
+--- a/media/mtransport/third_party/nrappkit/src/registry/registry.c
++++ b/media/mtransport/third_party/nrappkit/src/registry/registry.c
 @@ -37,21 +37,22 @@
-  *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
+  *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   *    POSSIBILITY OF SUCH DAMAGE.
-  *    
+  *
   *
   */
  
  #include <assert.h>
  #include <string.h>
 -#ifndef WIN32
 +#ifndef _MSC_VER
 +#include <strings.h>
@@ -217,19 +197,19 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  #endif
  #ifdef OPENSSL
  #include <openssl/ssl.h>
  #endif
  #include <ctype.h>
  #include "registry.h"
  #include "registry_int.h"
  #include "registry_vtbl.h"
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/libekr/r_crc32.c src/util/libekr/r_crc32.c
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/libekr/r_crc32.c	2008-11-25 19:22:02.000000000 -0800
-+++ src/util/libekr/r_crc32.c	2012-10-03 22:15:41.000000000 -0700
+diff --git a/media/mtransport/third_party/nrappkit/src/util/libekr/r_crc32.c b/media/mtransport/third_party/nrappkit/src/util/libekr/r_crc32.c
+--- a/media/mtransport/third_party/nrappkit/src/util/libekr/r_crc32.c
++++ b/media/mtransport/third_party/nrappkit/src/util/libekr/r_crc32.c
 @@ -58,20 +58,21 @@
   * the crc computation is finished.  The crc should be complemented
   * before transmission.
   * The variable corresponding to the macro argument "crc" should
   * be an unsigned long and should be preset to all ones for Ethernet
   * use.  An error-free packet will leave 0xDEBB20E3 in the crc.
   *			Spencer Garrett <srg@quick.com>
   */
@@ -242,19 +222,19 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  
  #ifdef WIN32
  #define u_int32_t  UINT4
  #endif
  
  #define CRC(crc, ch)	 (crc = (crc >> 8) ^ crctab[(crc ^ (ch)) & 0xff])
  
  /* generated using the AUTODIN II polynomial
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/libekr/r_macros.h src/util/libekr/r_macros.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/libekr/r_macros.h	2007-06-26 15:37:57.000000000 -0700
-+++ src/util/libekr/r_macros.h	2012-10-03 22:15:41.000000000 -0700
+diff --git a/media/mtransport/third_party/nrappkit/src/util/libekr/r_macros.h b/media/mtransport/third_party/nrappkit/src/util/libekr/r_macros.h
+--- a/media/mtransport/third_party/nrappkit/src/util/libekr/r_macros.h
++++ b/media/mtransport/third_party/nrappkit/src/util/libekr/r_macros.h
 @@ -118,20 +118,20 @@
  #ifndef MIN
  #define MIN(a,b) ((a)>(b))?(b):(a)
  #endif
  
  #ifndef MAX
  #define MAX(a,b) ((b)>(a))?(b):(a)
  #endif
@@ -266,20 +246,20 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  #else
  #define DBG(a)
  #endif
  
  #define UNIMPLEMENTED do { fprintf(stderr,"%s:%d Function %s unimplemented\n",__FILE__,__LINE__,__FUNCTION__); abort(); } while(0)
  
  #include "r_memory.h"
  
- #endif 
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/libekr/r_time.h src/util/libekr/r_time.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/libekr/r_time.h	2007-06-26 15:37:57.000000000 -0700
-+++ src/util/libekr/r_time.h	2012-10-03 22:15:46.000000000 -0700
+ #endif
+diff --git a/media/mtransport/third_party/nrappkit/src/util/libekr/r_time.h b/media/mtransport/third_party/nrappkit/src/util/libekr/r_time.h
+--- a/media/mtransport/third_party/nrappkit/src/util/libekr/r_time.h
++++ b/media/mtransport/third_party/nrappkit/src/util/libekr/r_time.h
 @@ -77,35 +77,25 @@
     $Id: r_time.h,v 1.4 2007/06/26 22:37:57 adamcain Exp $
  
  
     ekr@rtfm.com  Thu Mar  4 08:45:41 1999
   */
  
  
@@ -310,21 +290,21 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  int r_timeval_diff(struct timeval *t1,struct timeval *t0, struct timeval *diff);
  int r_timeval_add(struct timeval *t1,struct timeval *t2, struct timeval *sum);
  int r_timeval_cmp(struct timeval *t1,struct timeval *t2);
  
  UINT8 r_timeval2int(struct timeval *tv);
  int r_int2timeval(UINT8 t,struct timeval *tv);
  UINT8 r_gettimeint(void);
  
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/util.c src/util/util.c
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/util.c	2007-11-20 16:09:13.000000000 -0800
-+++ src/util/util.c	2012-10-03 22:15:41.000000000 -0700
-@@ -291,20 +291,22 @@
-     
+diff --git a/media/mtransport/third_party/nrappkit/src/util/util.c b/media/mtransport/third_party/nrappkit/src/util/util.c
+--- a/media/mtransport/third_party/nrappkit/src/util/util.c
++++ b/media/mtransport/third_party/nrappkit/src/util/util.c
+@@ -292,20 +292,22 @@ int nr_sha1_file(char *filename,UCHAR *o
+ 
      return(_status);
    }
  
  #endif
  
  #ifdef WIN32
    // TODO
  #else
@@ -335,40 +315,40 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
  
  int nr_rm_tree(char *path)
    {
      FTS *fts=0;
      FTSENT *p;
      int failed=0;
      int _status;
      char *argv[2];
-     
-@@ -336,20 +338,21 @@
+ 
+@@ -337,20 +339,21 @@ int nr_rm_tree(char *path)
      }
  
      if(failed)
        ABORT(R_FAILED);
-     
+ 
      _status=0;
    abort:
      if(fts) fts_close(fts);
      return(_status);
    }
 +#endif
  
  int nr_write_pid_file(char *pid_filename)
    {
      FILE *fp;
      int _status;
  
      if(!pid_filename)
        ABORT(R_BAD_ARGS);
  
      unlink(pid_filename);
-@@ -541,12 +544,24 @@
+@@ -739,12 +742,24 @@ int gettimeofday(struct timeval *tv, voi
       * since the Epoch */
      SystemTimeToFileTime(&st, &ft);
      u.HighPart = ft.dwHighDateTime;
      u.LowPart = ft.dwLowDateTime;
  
      tv->tv_sec = (long) (u.QuadPart / 10000000L);
      tv->tv_usec = (long) (st.wMilliseconds * 1000);;
  
@@ -381,30 +361,31 @@ diff -r -U10 /Users/ekr/dev/mtransport-i
 +  int ret;
 +  va_start(argp, format);
 +  ret = _vscprintf(format, argp);
 +  vsnprintf_s(buffer, n, _TRUNCATE, format, argp);
 +  va_end(argp);
 +  return ret;
 +}
 +
- #endif 
+ #endif
  
-diff -r -U10 /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/util.h src/util/util.h
---- /Users/ekr/dev/mtransport-import-references/nrappkit/src/util/util.h	2006-08-16 12:39:17.000000000 -0700
-+++ src/util/util.h	2012-10-03 22:15:41.000000000 -0700
-@@ -57,12 +57,16 @@
+diff --git a/media/mtransport/third_party/nrappkit/src/util/util.h b/media/mtransport/third_party/nrappkit/src/util/util.h
+--- a/media/mtransport/third_party/nrappkit/src/util/util.h
++++ b/media/mtransport/third_party/nrappkit/src/util/util.h
+@@ -57,12 +57,17 @@ int nr_drop_privileges(char *username);
  int nr_hex_ascii_dump(Data *data);
  int nr_fwrite_all(FILE *fp,UCHAR *buf,int len);
  int nr_sha1_file(char *filename,UCHAR *out);
  int nr_bin2hex(UCHAR *in,int len,UCHAR *out);
  int nr_rm_tree(char *path);
  int nr_write_pid_file(char *pid_filename);
  
  int nr_reg_uint4_fetch_and_check(NR_registry key, UINT4 min, UINT4 max, int log_fac, int die, UINT4 *val);
  int nr_reg_uint8_fetch_and_check(NR_registry key, UINT8 min, UINT8 max, int log_fac, int die, UINT8 *val);
  
 +#ifdef WIN32
 +int snprintf(char *buffer, size_t n, const char *format, ...);
++const char *inet_ntop(int af, const void *src, char *dst, size_t size);
+ #endif
+ 
 +#endif
 +
- #endif
- 
--- a/memory/jemalloc/Makefile.in
+++ b/memory/jemalloc/Makefile.in
@@ -1,14 +1,12 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-VPATH		= $(srcdir) $(srcdir)/src/src
-
 ifdef MOZ_GLUE_PROGRAM_LDFLAGS
 SDK_LIBRARY = $(REAL_LIBRARY)
 DIST_INSTALL = 1
 endif
 
 include $(topsrcdir)/config/rules.mk
 
 LOCAL_INCLUDES += \
--- a/memory/replace/jemalloc/Makefile.in
+++ b/memory/replace/jemalloc/Makefile.in
@@ -3,12 +3,10 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 SHARED_LIBRARY_LIBS = $(call EXPAND_LIBNAME_PATH,jemalloc,$(DEPTH)/memory/jemalloc)
 LOCAL_INCLUDES += -I../../jemalloc/src/include
 ifdef _MSC_VER
 LOCAL_INCLUDES += -I$(topsrcdir)/memory/jemalloc/src/include/msvc_compat
 endif
 
-VPATH += $(topsrcdir)/memory/build
-
 MOZ_GLUE_LDFLAGS = # Don't link against mozglue
 WRAP_LDFLAGS = # Never wrap malloc function calls with -Wl,--wrap
--- a/mfbt/Compression.h
+++ b/mfbt/Compression.h
@@ -96,17 +96,17 @@ public:
     Provides the maximum size that LZ4 may output in a "worst case"
     scenario (input data not compressible) primarily useful for memory
     allocation of output buffer.
     note : this function is limited by "int" range (2^31-1)
 
     @param inputSize is the input size. Max supported value is ~1.9GB
     @return maximum output size in a "worst case" scenario
   */
-  static MFBT_API size_t maxCompressedSize(size_t inputSize)
+  static inline size_t maxCompressedSize(size_t inputSize)
   {
       size_t max = ((inputSize) + ((inputSize)/255) + 16);
       MOZ_ASSERT(max > inputSize);
       return max;
   }
 
 };
 
--- a/netwerk/base/src/nsSocketTransportService2.cpp
+++ b/netwerk/base/src/nsSocketTransportService2.cpp
@@ -537,16 +537,18 @@ nsSocketTransportService::SetOffline(boo
     if (!mOffline && offline) {
         // signal the socket thread to go offline, so it will detach sockets
         mGoingOffline = true;
         mOffline = true;
     }
     else if (mOffline && !offline) {
         mOffline = false;
     }
+    if (mThreadEvent)
+        PR_SetPollableEvent(mThreadEvent);
 
     return NS_OK;
 }
 
 NS_IMETHODIMP
 nsSocketTransportService::CreateTransport(const char **types,
                                           uint32_t typeCount,
                                           const nsACString &host,
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@@ -1519,16 +1519,24 @@ HttpBaseChannel::GetLoadUnblocked(bool *
 
 NS_IMETHODIMP
 HttpBaseChannel::SetLoadUnblocked(bool aLoadUnblocked)
 {
   mLoadUnblocked = aLoadUnblocked;
   return NS_OK;
 }
 
+NS_IMETHODIMP
+HttpBaseChannel::GetApiRedirectToURI(nsIURI ** aResult)
+{
+  NS_ENSURE_ARG_POINTER(aResult);
+  NS_IF_ADDREF(*aResult = mAPIRedirectToURI);
+  return NS_OK;
+}
+
 //-----------------------------------------------------------------------------
 // HttpBaseChannel::nsISupportsPriority
 //-----------------------------------------------------------------------------
 
 NS_IMETHODIMP
 HttpBaseChannel::GetPriority(int32_t *value)
 {
   *value = mPriority;
--- a/netwerk/protocol/http/HttpBaseChannel.h
+++ b/netwerk/protocol/http/HttpBaseChannel.h
@@ -148,16 +148,17 @@ public:
   NS_IMETHOD GetRemoteAddress(nsACString& addr);
   NS_IMETHOD GetRemotePort(int32_t* port);
   NS_IMETHOD GetAllowSpdy(bool *aAllowSpdy);
   NS_IMETHOD SetAllowSpdy(bool aAllowSpdy);
   NS_IMETHOD GetLoadAsBlocking(bool *aLoadAsBlocking);
   NS_IMETHOD SetLoadAsBlocking(bool aLoadAsBlocking);
   NS_IMETHOD GetLoadUnblocked(bool *aLoadUnblocked);
   NS_IMETHOD SetLoadUnblocked(bool aLoadUnblocked);
+  NS_IMETHOD GetApiRedirectToURI(nsIURI * *aApiRedirectToURI);
   NS_IMETHOD AddSecurityMessage(const nsAString &aMessageTag, const nsAString &aMessageCategory);
   NS_IMETHOD TakeAllSecurityMessages(nsCOMArray<nsISecurityConsoleMessage> &aMessages);
 
   inline void CleanRedirectCacheChainIfNecessary()
   {
       mRedirectedCachekeys = nullptr;
   }
   NS_IMETHOD HTTPUpgrade(const nsACString & aProtocolName,
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -880,34 +880,40 @@ HttpChannelChild::OnRedirectVerifyCallba
 
   nsCOMPtr<nsIHttpChannelChild> newHttpChannelChild =
       do_QueryInterface(mRedirectChannelChild);
   if (newHttpChannelChild && NS_SUCCEEDED(result)) {
     newHttpChannelChild->AddCookiesToRequest();
     newHttpChannelChild->GetClientSetRequestHeaders(&headerTuples);
   }
 
+  /* If the redirect was canceled, bypass OMR and send an empty API
+   * redirect URI */
+  SerializeURI(nullptr, redirectURI);
+
   if (NS_SUCCEEDED(result)) {
-    // we know this is an HttpChannelChild
-    HttpChannelChild* base =
-      static_cast<HttpChannelChild*>(mRedirectChannelChild.get());
     // Note: this is where we would notify "http-on-modify-response" observers.
     // We have deliberately disabled this for child processes (see bug 806753)
     //
     // After we verify redirect, nsHttpChannel may hit the network: must give
     // "http-on-modify-request" observers the chance to cancel before that.
     //base->CallOnModifyRequestObservers();
 
-    /* If there was an API redirect of this redirect, we need to send it
-     * down here, since it can't get sent via SendAsyncOpen. */
-    SerializeURI(base->mAPIRedirectToURI, redirectURI);
-  } else {
-    /* If the redirect was canceled, bypass OMR and send an empty API
-     * redirect URI */
-    SerializeURI(nullptr, redirectURI);
+    nsCOMPtr<nsIHttpChannelInternal> newHttpChannelInternal =
+      do_QueryInterface(mRedirectChannelChild);
+    if (newHttpChannelInternal) {
+      nsCOMPtr<nsIURI> apiRedirectURI;
+      nsresult rv = newHttpChannelInternal->GetApiRedirectToURI(
+        getter_AddRefs(apiRedirectURI));
+      if (NS_SUCCEEDED(rv) && apiRedirectURI) {
+        /* If there was an API redirect of this channel, we need to send it
+         * up here, since it can't be sent via SendAsyncOpen. */
+        SerializeURI(apiRedirectURI, redirectURI);
+      }
+    }
   }
 
   if (mIPCOpen)
     SendRedirect2Verify(result, *headerTuples, redirectURI);
 
   return NS_OK;
 }
 
--- a/netwerk/protocol/http/nsIHttpChannelInternal.idl
+++ b/netwerk/protocol/http/nsIHttpChannelInternal.idl
@@ -32,17 +32,17 @@ interface nsIHttpUpgradeListener : nsISu
                               in nsIAsyncOutputStream aSocketOut);
 };
 
 /**
  * Dumping ground for http.  This interface will never be frozen.  If you are
  * using any feature exposed by this interface, be aware that this interface
  * will change and you will be broken.  You have been warned.
  */
-[scriptable, uuid(5b4b2632-cee4-11e2-8e84-c7506188709b)]
+[scriptable, uuid(b733194f-6751-4876-a444-bca4ba3f2fcb)]
 interface nsIHttpChannelInternal : nsISupports
 {
     /**
      * An http channel can own a reference to the document URI
      */
     attribute nsIURI documentURI;
 
     /**
@@ -176,9 +176,14 @@ interface nsIHttpChannelInternal : nsISu
 
     /**
      * If set, this channel will load in parallel with the rest of the load
      * group even if a blocking subset of the group would normally be given
      * exclusivity. Default false.
      */
     attribute boolean loadUnblocked;
 
+    /**
+     * Get value of the URI passed to nsIHttpChannel.redirectTo() if any.
+     * May return null when redirectTo() has not been called.
+     */
+    readonly attribute nsIURI apiRedirectToURI;
 };
--- a/netwerk/sctp/src/Makefile.in
+++ b/netwerk/sctp/src/Makefile.in
@@ -1,19 +1,13 @@
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-VPATH     = \
-  @srcdir@ \
-  @srcdir@/netinet \
-  @srcdir@/netinet6 \
-  $(NULL)
-
 NO_PROFILE_GUIDED_OPTIMIZE = 1 # Don't PGO
 
 ifeq ($(OS_TARGET),Darwin)
 DEFINES += \
   -U__APPLE__ \
   $(NULL)
 else
 ifeq ($(OS_TARGET),FreeBSD)
--- a/netwerk/srtp/src/Makefile.in
+++ b/netwerk/srtp/src/Makefile.in
@@ -1,22 +1,10 @@
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-VPATH = \
-  @srcdir@ \
-  @srcdir@/srtp \
-  @srcdir@/crypto \
-  @srcdir@/crypto/cipher \
-  @srcdir@/crypto/hash \
-  @srcdir@/crypto/kernel \
-  @srcdir@/crypto/math \
-  @srcdir@/crypto/replay \
-  @srcdir@/crypto/rng \
-  $(NULL)
-
 include $(topsrcdir)/config/rules.mk
 
 ifdef GNU_CC
 CFLAGS += -std=gnu99
 endif
deleted file mode 100644
--- a/other-licenses/snappy/Makefile.in
+++ /dev/null
@@ -1,9 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-VPATH = \
-  @srcdir@ \
-  $(topsrcdir)/other-licenses/snappy/src
-  $(NULL)
-
--- a/security/manager/ssl/src/CertVerifier.cpp
+++ b/security/manager/ssl/src/CertVerifier.cpp
@@ -222,32 +222,33 @@ CertVerifier::VerifyCert(CERTCertificate
   cvin[2].value.scalar.time = time;
   i = 3;
   const size_t evParamLocation = i;
 
   if (evPolicy != SEC_OID_UNKNOWN) {
     // EV setup!
     // XXX 859872 The current flags are not quite correct. (use
     // of ocsp flags for crl preferences).
-    uint64_t revMethodFlags =
+    uint64_t ocspRevMethodFlags =
       CERT_REV_M_TEST_USING_THIS_METHOD
       | ((mOCSPDownloadEnabled && !localOnly) ?
           CERT_REV_M_ALLOW_NETWORK_FETCHING : CERT_REV_M_FORBID_NETWORK_FETCHING)
       | CERT_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE
       | CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE
       | CERT_REV_M_IGNORE_MISSING_FRESH_INFO
-      | CERT_REV_M_STOP_TESTING_ON_FRESH_INFO;
- 
+      | CERT_REV_M_STOP_TESTING_ON_FRESH_INFO
+      | (mOCSPGETEnabled ? 0 : CERT_REV_M_FORCE_POST_METHOD_FOR_OCSP);
+
     rev.leafTests.cert_rev_flags_per_method[cert_revocation_method_crl] =
-    rev.chainTests.cert_rev_flags_per_method[cert_revocation_method_crl] = revMethodFlags;
+    rev.chainTests.cert_rev_flags_per_method[cert_revocation_method_crl]
+      = CERT_REV_M_DO_NOT_TEST_USING_THIS_METHOD;
 
     rev.leafTests.cert_rev_flags_per_method[cert_revocation_method_ocsp] =
     rev.chainTests.cert_rev_flags_per_method[cert_revocation_method_ocsp]
-      = revMethodFlags
-      | (mOCSPGETEnabled ? 0 : CERT_REV_M_FORCE_POST_METHOD_FOR_OCSP);
+      = ocspRevMethodFlags;
 
     rev.leafTests.cert_rev_method_independent_flags =
     rev.chainTests.cert_rev_method_independent_flags =
       // avoiding the network is good, let's try local first
       CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST
       // is overall revocation requirement strict or relaxed?
       |  CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE
       ;
--- a/security/manager/ssl/tests/unit/test_ev_certs.js
+++ b/security/manager/ssl/tests/unit/test_ev_certs.js
@@ -13,36 +13,38 @@ const evrootnick = "XPCShell EV Testing 
                    "EV debug test CA";
 
 // This is the list of certificates needed for the test
 // The certificates prefixed by 'int-' are intermediates
 let certList = [
   // Test for successful EV validation
   'int-ev-valid',
   'ev-valid',
+  'no-ocsp-url-cert', // a cert signed by the EV auth that has no OCSP url
+                      // but that contains a valid CRLDP.
 
   // Testing a root that looks like EV but is not EV enabled
   'int-non-ev-root',
   'non-ev-root',
 ]
 
 function load_ca(ca_name) {
   var ca_filename = ca_name + ".der";
   addCertFromFile(certdb, "test_ev_certs/" + ca_filename, 'CTu,CTu,CTu');
 }
 
 var gHttpServer;
 var gOCSPResponseCounter = 0;
 
 function start_ocsp_responder() {
   const SERVER_PORT = 8888;
-
   gHttpServer = new HttpServer();
   gHttpServer.registerPrefixHandler("/",
       function handleServerCallback(aRequest, aResponse) {
+        do_check_neq(aRequest.host, "crl.example.com"); // No CRL checks
         let cert_nick = aRequest.path.slice(1, aRequest.path.length - 1);
         do_print("Generating ocsp response for '" + cert_nick + "'");
         aResponse.setStatusLine(aRequest.httpVersion, 200, "OK");
         aResponse.setHeader("Content-Type", "application/ocsp-response");
         // now we generate the response
         let ocsp_request_desc = new Array();
         ocsp_request_desc.push("good");
         ocsp_request_desc.push(cert_nick);
@@ -50,16 +52,17 @@ function start_ocsp_responder() {
         let arg_array = new Array();
         arg_array.push(ocsp_request_desc);
         let retArray = generateOCSPResponses(arg_array, "test_ev_certs");
         let responseBody = retArray[0];
         aResponse.bodyOutputStream.write(responseBody, responseBody.length);
         gOCSPResponseCounter++;
       });
   gHttpServer.identity.setPrimary("http", "www.example.com", SERVER_PORT);
+  gHttpServer.identity.add("http", "crl.example.com", SERVER_PORT);
   gHttpServer.start(SERVER_PORT);
 }
 
 function check_cert_err(cert_name, expected_error) {
   let cert = certdb.findCertByNickname(null, cert_name);
   let hasEVPolicy = {};
   let verifiedChain = {};
   let error = certdb.verifyCertNow(cert, certificateUsageSSLServer,
@@ -86,33 +89,40 @@ function run_test() {
   for (let i = 0 ; i < certList.length; i++) {
     let cert_filename = certList[i] + ".der";
     addCertFromFile(certdb, "test_ev_certs/" + cert_filename, ',,');
   }
   load_ca("evroot");
   load_ca("non-evroot-ca");
 
   // setup and start ocsp responder
-  Services.prefs.setCharPref("network.dns.localDomains", 'www.example.com');
+  Services.prefs.setCharPref("network.dns.localDomains",
+                             'www.example.com, crl.example.com');
+
   start_ocsp_responder();
 
   run_next_test();
 }
 
 
 add_test(function() {
   check_ee_for_ev("ev-valid", true);
   run_next_test();
 });
 
 add_test(function() {
   check_ee_for_ev("non-ev-root", false);
   run_next_test();
 });
 
+add_test(function() {
+  check_ee_for_ev("no-ocsp-url-cert", false);
+  run_next_test();
+});
+
 // Test for bug 917380
 add_test(function () {
   const nsIX509Cert = Ci.nsIX509Cert;
   let evRootCA = certdb.findCertByNickname(null, evrootnick);
   certdb.setCertTrust(evRootCA, nsIX509Cert.CA_CERT, 0);
   check_cert_err("ev-valid", SEC_ERROR_UNTRUSTED_ISSUER);
   certdb.setCertTrust(evRootCA, nsIX509Cert.CA_CERT,
                       Ci.nsIX509CertDB.TRUSTED_SSL |
index 8e1c66104fb7ca78b38e55e4184aba4d2965ac63..4ed96b98208c24ff037126b20d510eb1d4993d65
GIT binary patch
literal 65536
zc%1Fs2{e@J{{ZlJ7F+gx-<Pc89mZPrEv*z%p)8Yi&=^}3hLD6(p|V6ulrANN5M`<C
zDqJm=(nTdLmgGN^+^cTscYf#oe!qX`JfAspX6Aj~_kEsum+yBvr|$!z<#vQ12nj*x
z4hYhxyoFdG2mviTA^I<GkY8R=pI<*WK|Iv=$G!IrLJN>zp8s|9i2p^e0000000000
z000000000000000000000000000000000000000000000008jM5raPHz11_;6I{i-
z>Xml4HnX;a)>+(1TsY1Hr-75kp>V^h1*)f2_o+ImDyj;q&ZzXOWUEA|#9~4)4j2;*
z6Xv!O6J{O&0000000000000000000000000000000000000000_%EVIQUACb69jqt
zcq`!pl!!h)B<lYVhY(dOM_~ahAIw9GvPPqrSlzuzN=sHk!8}+lm}8-laY+L`5`y@C
z)QDW#4Lt&)|NKBbftX-2>UWrotj|Ir5lAHZbN9@&4D!)yqCYSr5R5d?a-)Goc$u-P
zSQS`RMMX^$R@=_YtU~>W{qpfg<AKQtiKX2jXdo0B!3t59uRxL!2q@?3X<tpxvW(T`
z{6&!a#>z)YDHgR!Pgd$&F)4f=)+_(MOuqlV$1KW|%V{>KmbJxBVILo#V+<3158t!h
z={O<%UK^}I^nJNL`&p^y@@73!+obMaZzN{CVLc}0WBdVwTCa6$Ww%8or_Xc|KiYg`
z-zAk{gE+778N3aXg-c)--Ie*?wQtm-Htu|5ayOGjFfa0c<oYeIPWGG+@x++gzTwa;
za5!=6o{%5(UP&mx>|6;(ucq<_YX1E}McK9C_O#<#DIRI!d~t+~{f-HPYg}GDD26&V
zRWRXkrPFMOKelFJY_Q=PY$->pT-jQ3_y(^ZxN=nj^ZcBI-@JXKx=}6?g@6z_WP~E+
zh{(bWlp`q2iAKT@%t(F9ibhjT*C$wv`av3jm`C%#T(tBGv<Mm+Iuzp1cSu;2x`rg0
zastD-LeIB5U8pj#b2lkdxmisT{}fWB1sgA}j6k3@VRaa{_!&k-%es+BzS_#lfq{V-
ze2^o-*9(tv_919%QYbGuo64{TwHr}13}ax$Ecq<iXqhjYIupJAz9}BBL|smK!t1FU
zilI$lBiMkJgVHk^F=~E5fcij0k{A%M0xY*UA|!%G_{(ky!6dvN$;F4@=<bd2@^N<b
zQg-(B`{u$$Q7@#F;%si$M=9wp?ZO8&HKgCYY7-5+cxa#0+XL>Q6AxE0u1l2c&bm_|
zpsOx^>2Zd-*tMY=LmJ;qCecew&g>~pd)z;i=CDmE@Qu=uAI{!kwBKb<zF)_hlbOqT
zJF!b7V|6ii@`ras9MP=(ihtNmI_rtvXHOK1>AAZ+W;|tG#0jB_2y+Si0IE2ya^2=O
zg>17>W~1xzf&#xwMjsE7;2%<L3{ARc@j+qR$VcQ=3sn<#*Qj|7<@a<A?#xf=1c<FJ
zAKF_QS=BD;D;Q@^kG$KQ6=!#XyKNx(b!EpCYrRA_#C!Bcu{PTTq03>6ktj?X#qq#t
z#_|18%=kg1gUs#0r8hp}XTfD5DzQP(H_IVNgwl{-a~I~rQm?en8#6DgKy6oYc0?_^
zUrKBeT5bj8w;e8wgk>>4e(3~)1SyM`8^jNrs6!C=aWnGkeipiCr*^O8<Lu|F<WKZc
za>f%WM?wgK^r~LLyjX6Sb74<R)WK5*9^mNZ?t+2^vHURaLJQlsn^Q+2yzCmtzxB8<
z76u4f?1Hij%97I|qst6}6Uz>>F0{}uE~R$P{oNMipSz~!27T%Sodq$&Wb|oDeu!Gk
z4W2H?zs(I1=dp~R!xNg86KTC=@dG^*(#T-(Sko~vZ}9Q=CQ<HHF&lS$AXX9<r!HT?
zB(T9}ue+C*qnMJIiH(>G-pSupjCx~>Q8uO=ChAIzOk7*=&i+JqQm~kbx2wB19#3@l
zcEu{gN()~?#@51UiyPj{i@FOd%EpvdF<DA?M1Mb0pbwGc7A!~E-#3{G_jRViZU5o1
z{AsGXe6bocJYW>E*=gib=F5{CI1V)PB(uwq+4tmn7x}kU`TbU0C+Kvn(5TuWUV`2%
zMe{zyJE_N5G&^#vUuKgRWEK8?eDsLhP4f@CJMxp7crQ(~Jj0bFY^ssjVHY1HXySKL
zCMV%Vd+L>F*A-;EOcGu|@g=IOLB^Ee&ZB42*c^E4x#uU|M|V`liX)}tb0Y)y9f#6|
zrO(IJ#&nIblq5a9-944Fd$pmn;&W4^)NjV!e;i}BRX;kSnb)6qs>1SNu9(DyJ#T71
zvaZ}3waJpNBuj#;U?#9Udg9KL1Lyfj>{rf??w#mt@7j>Q)%%%Dhl2fUD^!aJp23vQ
ze4j=7i_XPVWluRG+df}f!kpBUL<6HJFJC7t`9Bku7%cL=g!Sh;hObiBZEkvFP1XUG
z7~XXl6|YCFHrm{IurPH67Bml<D>eILfmD9J&KlWsdkrG57+tPOc7jcoWHv2W16Es-
z+2oeXY)j9+GOW3f+ORO?ipx^Sl8ausTx$CqK=1+oo!k~$nz+t=)$uwemDJT%p`C6o
zb5CDRFT<d@4IOH*ESuG@ibg#P&Qy4{>(dEN4TrgQbynZ#q0p{@tb@lHBttx7o=<F7
zt0_uMxT%efOUW@ev<y5{po@-e4jJQaCiKa~wwcsw(X4DyHXSW!y($PbcgE-`#<_jm
zrPmOON5v=N$f1a&BjNL@_Vz<|W4Bvw`U%prm5Oy@OC18FP6_Zxwlti{F=g&fR!BX!
z<<o;(rGIpIM3!T06xxI|nDuinTJz46FBs~LARQj*;*)j~b}I~pDI{2H@K$O@-E}vy
zMV*}s+AP>FXf>p%BY*t-$n33#yF(*d#*$qMCEm`5pB-F!qA1CY8lHZcc(f4JnHN&+
zUy;3#vh<hw9;hD%PHMX0|6wcgtM5(yv(mQI2bvqAqof^n%0Ee_7t#(5@^R_C-d{cM
zP|^%mmGbjiWg+iS6VJlOU+A0sED@HNAGAw{*bcLwna+&4FxZ~kXFoGG5!<`9+J)0C
zQE`Z<IM0@(SxZ7TY0I1GRLOdb>;2y8+`3(kD-cojkne%xj%hW|?#@P4kNkLsJ?e3^
zb@z-N%XKXcH}V=+VDh^>3N%~z-Na9b#_U<k<Ls`-5Fqq;gXbCPKUx}YtYp?q49fI+
z98`!k9+$0m2$s`yKA$bWCUu4SSr%e<a8tST<Ee&Zb>%s?l=HRz>m5>>T<iYm7buL&
zzT1L}L%5f*$Ywua5;(!+qq<Wm>(nV1z3tW4%}4StM7-EFurFo}W50F(G2R(Ii_8k^
z^{o+Swe}y%<A}pmy$QnC9vt@DR4hlckO&Q7{l6zcmd{C$x`3JoqnD(v?`F2|#CoFr
z`3>VweR^C%_)UjaZ6VG<9s0@rmSH1izPkHSuVvAUf-2`<X|ru>lyU!*8}x_=C!OPP
zF2>EB<orTLfDBvp>{u&xgKWH~H(s70Qvx;aBP4z&_I`R$S(}zPu5&~JbLjQ9wjGvi
z#gYMa6-r{vHMJNgZbiY>bvf?*Eg!^ZWwyz87_eX8l{e1jTo9DK>fyCP<1<f1^Sqxa
z_pfOh4Y-(c?dZV*c5a<YmN^gOH*2*%l(olq=1#|zZ&0@w6~)je+Fk2T)0s;S@yKnh
zQEW1AezDdWF}`lnVD6lw*NVIsM!CnVbfwqDM3E};22$cvE|qpi=f6?Y&)l!^I?;RK
zw>gAZhz7sRO+ybskPV*b=kDVTF+o#$=6V^reL7V-ZCY2fZm4Ce#j6lhlriiWWz7G2
zb^-tZ000000000000000000000000000000000000002s-}F~0rZ~g~lhML38AY>L
zib<`-{iY=5hqbLgEz)1E!2f4OA9b=890J9BB6CWQC5!at>kYYXPDP!z*_v#WKU8@}
z=ExJx!BW$JV3&OoXEmmHK54bzYpU^I8BoTwm+>O$MnU2Ht5?GQr_`pOJh1aqUl(cD
z{cdB>uE>NP9tuYxjZcJgounOep|u|GAO=r|)6yRGMLvRR@m<V@?C~Bg5)mD_f<BdI
zLz{Ky#9yYy<t5e`bL>j&o-fUK?(~=gx}eq1Uwz@ZwEXeB;~@s9$u0C^XV}D|8dB2p
ztuOJ)3|<h`!OFM1uFtQpv5(p_<solqXE36wvLeT7Y)Wo#*w)5dQsvVZTr`|-u|XlM
z+1TQcYuhyTBBiG4HWQ6)H`YdFx2P^wKYCJ*i0eOC{V2as{U`~GpAkB{OyM%+9KdUq
zR64GPwPDRAm5z!(t91OTj{n~;cKoZN<-5}i{Ksn{Rh;zvgqzG2y*}E^ghkP5$Mm1D
z8J${Do~~D>Bf@3w$!ky+J#<te+QCpCnO!8MneFtlpfct0!^xckWjTU<voB}U$2jI)
zk?O3$k4VMGEWLtVAKpqvoh&)-n9I2@oMnPv;^i#D?!{%xs9p!(Nk0tt^^^A7#;jgS
zsT|c>C$q8pN*PzN=;hNH8fP9H(Y5EXC@Q@dw%=)+)KJ>T;|lIat`3D{Ae?l9V$Vsw
z;o+H{R+AwJ`Iist#l0RL*t;o^cIcj(>7C!qSa41Bl7V?uTH4~q58v>^jq6SHyhQFW
zBTtcZtUc0Vj_{wWBa$&=nD!%P)|0e8rW-|4e#@wLbo#b{9<hA6{+|VR$XSR5CL=#k
zF5kxs!G&@`{hN{H??u%=-tuR0CD)?9%Q&eoq5fVwPM<@U1{T4G75*_;p0cO)ywEj=
zLk|_sjD%v|iDd1x3e1{GZhB_flOH3r2ac3b$rgTBIM!;E=BU|oa@T!0Jh{qkZq7F)
zfLocTjUdu9Q8e=Dp=ybV814zX`0t%F+j+BseLdbC<?eMPcsyZ}(cC#9L_Z?k<yq0(
zWoaAjsMSLfN;_H6={7OzsvyDUvXwRcY?lP;ars3Po(g3t!Nf??UCAq{>0T0Atz(S0
z(BbEMGUQ87D<C(Uj1@PG8icOrWIuM*2tTPMX`ok|q?M%Q=QBZ$RM>*o=)1grT99Dt
zQ+2JkhR_geAfnn;)}@8W68hM`5Led2YyXv)@-N1T@7y+POL=3TMxLv%W8E<*vg1&I
zKOJ4$CGo@8${2iVqTgDLx_e)vcittJzIV8mqk1f)Kfxm|{jsQ)&9NdstNFb=Mbo>O
z2So}R56;N@80fW$y6x9RVz$K(_0?WzXX!V~F0w4)xM|yvlp1vr|0&)vygQBf_MAa$
z>-|c6?$}%J)UfGl(ijU*_Nvx&*U-r)FC$K%^|>C-bCqoxet5Gx%dNQi^*ocgHd(MT
zu0Z0LQeT*u0$wAlVV$fuE7LPw6L%%f=hA`*xsWx&cwNGyC#^Sjd-5bq*q+$0XDyZ%
zo_534Zd6S;*MB#$d^=C$pz@xec*5EM+?!Q(l74S_3|=+g|9aX7#4>YB{55ON1BjiH
ziaRNHO~t|;gQ89d@y$K+!|4QmcFQa`ImA!znjQ(I;kq>_p-|DrmeNBdZtpL@>lrH$
zLS@J1HB7D`8)bP1;TYPdJ60Jd4IwU?urlimHPhEbykmp;qFjY`98kgdoUBMaB0PCp
zF265w?v^~HYkv1Z2{u3)v0|!)Sje+oETt{jJ3w<+nr_tr-JUVm-kJKs;W)El543rU
z`SXsFx9U$1?{s1vw^S<EX2<eCyM%{o=rTi8$Li=s*!S`Cd%NDNY!@tEXN{hdXH`4E
zx1l>sT{Oonh$C4u<Na-HQiEkn{F@a6#}sJh)p1fBYF2RO{Z0n1wJvkJg|zH!8@D*v
zvX;dP&+)Ffn4?D|JP;om5ANc&I%mbT^3cI;i`iI$azsS_p=oozJGp@Nl9Y>q6)Csj
zV#-BEi+n%jDmy!3+(-nk|HqT%XfP66vYvQ-=$6jj+Na+;n0miJu*Y7iL}%lszOh${
zo8B1{J-Zs;-eYbvvcCk|7M<VyUe@eWMBS*oRBxe}@|v@JrutlW$UILbju|>t?l`2S
z&W$yWbThczm{iztRzP;G1;n#bW?NqGa}m4!L+q)CjIC#}R@|pdcAIc*_29q6HWkf$
zEdY^E^S(M>j_V~u+3B!BU6GpJo)mvlnNe8g?wz-@HwmYgMsdG%8DLr!cjSq${J`zz
zfU9@dxpY^nvl&_4Wj57bS?`)D#bg|7cfwC7{NvrmRb!Hv&;;&ek+Cw3sQm{_uTMh1
z5qcx`bd7(6@2XixzOK$B5cIYZnjida?iIvxQ@t#W2n=6G1oY?WS^lYz@VzNpei{n;
zAAGoJQ*EW3sxmbE{Qim6WDaw)(@j!qMD#b!gmkBNM!blVJ!>F!d#aNl17#m+F@0RG
zlw4m}A&Ax1aoO8u)*2r!zP)|pe)b3qjvPB8WxHO!z1rsh-Fr<z?}8g$v^Z}9=l1#L
ztIm?|h^|AuGEHoc@rQ!sy=^3ib(ODsA)jWokkdxHgEyNsRr(EyR=wLMwIg4wix+pu
z<TY!!9<uS%^;I7x3LkAqzVW`m>g;X)eIt9Slp1f%^|~4ct$arA%U!+ZRqTdShe!Fa
zO@pt~CRaSY#(0=Tyo%Vhku!Yr&AlNp+c$P8XKdG~)KO|uN)9@b>W#=M!J3|<7nlt)
zL@b5^Im!`{{!fMigC(Ir4OWG*OMZPzFZb*FuQ^8k|3(D%nfNQ2!2`-;e(*|MdCN_2
zttrypsGHYO9qxL~{ss>taU0_35CYRtq?(zXn_Z$Uf`9*bQpDdwC<|*hnNl)KGZOLu
zV}xISDh<n4la1oC*Eza(|HOEL{^oo6*$f65$SBnaQo^vk$?olCGh}Z^0!K-q@|CK!
z7A3d?G}?D=d(GokF`kC5Ht1VM{c#|oHg496@7eqnecFx^PW`ED7^7}J>HqS`*iC_T
z>3<~nK36}2*x;4tS&!}#I-SaVe4=l5+;PfRl{v4oQ>|qEzUqpJ18F>=MOLwyv>u)8
z<pBwD29Hk7w+rK|B?i1AT(vn{Zs{k?#5IM4&hED>$-1y)dXeQOTw0jTgN`~!)53gN
zmm%mEt5iq*Izy$-ERz503>W$3qL}+%PdW(z000000000000000000000000000000
c00000000000000000000000000KokJ0W&{{z5oCK
index dee326cf10c5ef690ac3542ee46020ceb78f93a3..02d7aa80b10114ead2f9478c2607574e3943200a
GIT binary patch
literal 983
zc$_n6V!mw9#I$<>GZP~d6AR;<>emLmY@Awc9&O)w85y}*84Sb?MGb`6m_u2Zd3ZAO
zN_11pbjuQRGE)rX#CZ*k4UG(pjf_k!3{0ZLd5u6^Lnzlk*ig`bAEJ>1uBnMp3E2Wh
zRtDxKMt%mMI2ThBBO}Az>)#KB?GMqPVf5tb^J~*=nuI*v=bTjWkaO_=Reg2F<;Is?
z8cQ5ij{UfttH!Ws;yJhbM|3A2S+`r-(8@NY>Vo_Eo(9FJi+**2jd~_c9WPWOe6%j^
z&u?Y_W+9!odfyc`le}EvsQ;(7BrAU{N`G=o?WDl{)b0wcyfEdbcKW+=m>w=T*EI9>
z)yg3ElY5Gv$nX6csS>?P;flCPx9bP~279Ix|8`k_|G4g+@8o^oR);J(CRzKUaIfx(
zqknIuJ5{JZYr4JE#^Zg5@9f^!5{4%qf0+51>)|%;UOvUWMOXZU8-fm1Rkug^UD2Nx
zWxmH&_oVLRiitDw7#D0cbX&$D^}E7}k%^g+fpKvYqb4v!R1G+R!6z%s!eqc;zzt&Z
zv#<ao>YsrEh@;BL_@710K!lA$n~jl`m7SRp&SEl<2dPkIkuVTz5Sg*)&uW!bt86_q
zmQ^`6Z+2dPU~-ayBTO+PBa5klv4J6sZ@}25no&|xV5P5LUS6)3T9KGrkdvyHoS$oD
z0R;N6sMI$w2iYOdVql<WptC@0fkvAeR9|vY4i<f>x*%~NHt+#yRA6y6a0WU<2xu(}
z<7>}WDG+3AF5zS}&^FM7Ifsc+OcrWvZe>YoaY;&kZenJhUQT{;Vvc@tK`~l-Wd@}p
z!CyU_=T|<`e^YFrZnE>-p*+hUB~>klb}?Vdv_Dnqc%#|Gw~L)o>Ss&IfnV`KDQy9j
zcmB+hE6tKwU>Ngx`qtm9FRHKWIj8!}o@pp>U=g!OtnH+#x{q)B9D>fSTEyu%kEzAD
zv83;5tZQ1-j$ciAiMc{s*XeKG>lLuoq?Og`^s$`(Cf3|@7`7aD2yA)P+IX<*cZkHZ
z|C=4yE^QTd__4@9&&>04>AQ(<4oP{>ebra++-xGFZ_bMBBP>^B=FH%o`tkPfw~0Rr
zjCogFzHGYHr*{ADkF7JsYBq*+%xBBGEV#3*Pt)<<?Ee>KQ}-)9%4tlu5<Yj-q3>7M
O$?BTlbun8PtONis<ZM>}
--- a/security/manager/ssl/tests/unit/test_ev_certs/generate.py
+++ b/security/manager/ssl/tests/unit/test_ev_certs/generate.py
@@ -26,19 +26,19 @@ CA_eku = ("extendedKeyUsage = critical, 
 Server_eku = "extendedKeyUsage = critical, serverAuth, clientAuth\n"
 
 authority_key_ident = "authorityKeyIdentifier = keyid, issuer\n"
 subject_key_ident = "subjectKeyIdentifier = hash\n"
 
 aia_prefix = "authorityInfoAccess = OCSP;URI:http://www.example.com:8888/"
 aia_suffix ="/\n"
 intermediate_crl = ("crlDistributionPoints = " +
-                    "URI:http://crl.example.com/root-ev.crl\n")
+                    "URI:http://crl.example.com:8888/root-ev.crl\n")
 endentity_crl = ("crlDistributionPoints = " +
-                 "URI:http://crl.example.com/ee-crl.crl\n")
+                 "URI:http://crl.example.com:8888/ee-crl.crl\n")
 
 mozilla_testing_ev_policy = ("certificatePolicies = @v3_ca_ev_cp\n\n" +
                              "[ v3_ca_ev_cp ]\n" +
                              "policyIdentifier = " +
                                "1.3.6.1.4.1.13769.666.666.666.1.500.9.1\n\n" +
                              "CPS.1 = \"http://mytestdomain.local/cps\"")
 
 def import_untrusted_cert(certfile, nickname):
@@ -88,16 +88,32 @@ def generate_certs():
                                              prefix,
                                              int_ext_text,
                                              ee_ext_text,
                                              key_type)
     pk12file = CertUtils.generate_pkcs12(db, srcdir, int_cert, int_key,
                                          "int-" + prefix)
     import_cert_and_pkcs12(int_cert, pk12file, "int-" + prefix, ",,")
     import_untrusted_cert(ee_cert, prefix)
+
+    # now we generate an end entity cert with an AIA with no OCSP URL
+    no_ocsp_url_ext_aia = ("authorityInfoAccess =" +
+                           "caIssuers;URI:http://www.example.com/ca.html\n");
+    [no_ocsp_key, no_ocsp_cert] =  CertUtils.generate_cert_generic(db,
+                                      srcdir,
+                                      random.randint(100, 40000000),
+                                      key_type,
+                                      'no-ocsp-url-cert',
+                                      EE_basic_constraints + EE_full_ku +
+                                      Server_eku + authority_key_ident +
+                                      no_ocsp_url_ext_aia + endentity_crl +
+                                      mozilla_testing_ev_policy,
+                                      int_key, int_cert);
+    import_untrusted_cert(no_ocsp_cert, 'no-ocsp-url-cert');
+
     [bad_ca_key, bad_ca_cert] = CertUtils.generate_cert_generic( db,
                                       srcdir,
                                       1,
                                       'rsa',
                                       'non-evroot-ca',
                                       CA_basic_constraints + EE_full_ku +
                                         authority_key_ident)
     pk12file =  CertUtils.generate_pkcs12(db, srcdir, bad_ca_cert, bad_ca_key,
index 9c0326f80cf72bbacb4fa5576db7e95969f1a6f7..b2bd73d86a946f941c46606b23b7634c1dfcb525
GIT binary patch
literal 1184
zc$_n6Vwq#m#N4ugnTe5!iG?vcWvT%$8>d#AN85K^Mn-N{27|`shTI06Y|No7Y{E>T
z!7vU750kT_p_qXPh{Mjq>ziMiSCW{Srx2EzT5hOppa>G@;*s*rugc8HNmS5Pa1B#P
zNlhwES13s>E>Qq#mNk$DDdOf42~JHeEy^sZRB+8p&&*3rEy~PGH`F)K1xYjWs6_-g
z2WO<_<baF_0cr-yDrf+$D=IB6DbFt|$*9x>nr9#<&TD9FXk=h)WMpb#U=k(HYXssN
zLb(RwhN1?-5F>dq^GbA6%XG^Ub23v5ni!Rkea*<qz}&>h&j1wXVrpV!WLUpuzuwbF
z&ecIlFV@a~H_KP3^_19TLA55q!lii|OE2s#-mvMgbkdY{&imtflsMd{TU=uh|7_2_
z@%M`<ch&rJ7(yDpy?s3~<B;d~v`ecdoD^UC@!T_$t$qFn)S_d0Dx_VDXQ?gjdwFrj
z=C*XMrc|{FsZu)cn6DgHbIZ*Xvv)mls{H8l?0@3-P8+@1)U4XGw7I-?D#Kh^)#Y6W
z+poOg+dARlv8z88r`b3q>pXX3QrX~g_0<&K2(w8qELPm@pS?Tq#!>~Pm4%-U{^3^-
zZ}AV5*t$STWc9D|ooydaKWJSpQ6ji`$?K|*moHxNog1F_Ozo0(?1vEMb8@MiZW5lg
z0drqoW@2V!U|ih97z+%MNCSRg5XuTOGX7^_HDCr(2HYS4eijyB8v19T1>&fJWEBkL
z*f_M=7+G1_nHk|MCOC`JKpv!4nMJ}ttU=_MD2Iy$|0APzac@1NoO|cPtVCBB$buB`
zv52vV%vkhiwaThhwjLVGsvMg)JFh=5Imy5kW)>qOi=~0Nfhmk{z}TjlQBqQ1rLSLJ
zUapr~k(gVMld6}TpKE0S1p3IauWw)hvPGW7&;Xd?7HBWfY*UBoO)kp8)LWFF57Mj$
zlr-=G=~Q5GHE=d?WD^3~&BFNFvsDTN8JkNu84a`zG+}OHVic2wnwwh*$^t3*xxoCQ
zmy@5In4_OuP>h!Gm_aG8W_!PPruEdrJVrBYLTWB&yjwbF{oEaTETT?v2Mqaw%(lq4
zJgc0q{XXH}G-30&zZcE;3)-I4TzRyhb1J8Db$0vnk5Q%vHum=&vSR6)zSz?#u)KS<
z9ZScl>NldNa&N13TyQ;T$*O)%-|hA4^IN1DPF-%d*XhdmlVE?mCY8CT-=wLAal*ug
z|1)A^pTxX5cJ5HIG>5=;h0BK9<H}TKONl9;JHBwS8}HT0+B22~|GR#4`>RV?%{%qN
zv@gh*^ExbD6Dt0{X{D3>3#PbxcBvEMbJMh+)NA*Jnv3tTXgQPV8o|8eZ$*&wUFnb~
d7PeYbm%sRZ^!S-4FDzY@uV`=0OYVKv2>?xNoJ;@!
index 85b53836e0aa02c321f20689793e38aad7f08a61..b7ed643442f3edfa2f549282d5b6e5ffc785b209
GIT binary patch
literal 2789
zc$`(#cQ_P|9|!QmIXPR0x-09f%Q_@N_Ku8fN;Z))GS51kv$7&N;S@P!uam7fTUK;B
z5~<6`j?k~3=eNFpe4fwqdB2~}zb_;j{E3!^4v7Z81TkL1=wl98Xc%aU(BNDk8vOWA
zoQ_1(>;10+6`|=B|3sH*X#jtg<o`V(FMz=RKA34hNLJvP>t!rlmO&qQX=%>@qS5pK
zyn_VT9CO$~aPBC7S|Ct#ul*LiVopS<`vFl?UToh3{X?`Ow|Hx}8`g=3VF`17C0%eS
znbig5O}!sqaar>`Matyy?szwrDpHUL|6G%H^Jj7sU6(?cUucPXP>?q-RQ-L->Xxy_
zMT@Stx=z=z8JD~z28p?sf3tq&a{Vw$ezpq|UC8uL&BBNarH^h$H=byp7J_DQv4BJ|
zA;Z$nwMS=PgLSMJW!;)2$8JlaW469{LGFaP6-gLqA63$JE$@Iy3{oTA6^*{iA2V>p
zt*!)bcCp1QjJ~r$*UMR_0ppt2J9W<ECzH}Zs+HqY<6u6I7Ppv$J92v+4`yQ@_vhJ~
z&#I?1xp{n6DP(ikn>j;txF=3O2&X(-cUL4J;j3=zEaf44ag;EB-)lqhg%YVzYXd4M
zi3WIdb|vkm;+uNn7z<v`J)e3jzk}#%G~Fw{WXwKbdM$*TdhSKWp#uL??;MOsLZay$
zSLxa2oBYZ$REtK?#Yg@E1{ZColn?c(>x>M}pJcHI9O<(|cU+dRE^V`m_eaI5IIU(z
zBMCez(P{Dp;Nffef$WbIh1=nP@;6wV0H?Hp{)4Z=OFrkC?MdHYg7%Q=;@0q1&G3lB
zjoBlFM%Rz(@6(MCK8u|vZJ$xj+@`AS+mqEFm7>%%R(r0B=b19W>eD#1VuB^Qajevp
z=2!D0O_y4HG7I`g9?I=4Hwd~NKT8Y>6|XB8HM_u4a9%@f&x=I|y=y`l(@T(IHU1tS
z5t7`~=)jU`3_$O*LJ?zGWWFY8U5!04nA_JPjyczjs>IH_4vp3!I^T4A2*RpM)&W%R
z&)k!H9JnW09qV{wp>stFI<^XiS9i;g^bUr}>}5UrGB{Om)6PbM;m2&rY2odTCKW`r
z>rT;kyw4+V@c^Z-FrhnIHk>WTNdl{wrdt2#u}<H#(R0`~UenUTCqD`gj@p@YWQp=H
z{^!f_lY{cz^0OjTnn9+CsbC`yVg(&n9Ve{sb>jn&q0(9n&qv7Z*@Zw8yEjr~v-9-$
zJ(BLRmCeSdsTG_^`1`zQthPwoOmp{Cn6TM^5#~dV5VZ{I@MfxNABBU-iA|@MYHZhJ
z*bYT%zRA_RsL~hP<K7$*I$Q{v<1_MTmzY!$b&amK;?xjUR*DNEc>2`@RG{=D>c5-A
z+@iL2fb7EaTJ3~ugM6YX-|bJG4pD057v@}B6%4Ew#ih$^WP=v{ppq{n{Wzde=LdNg
zTy+}yNvSt&;bQ91H7Xt`8a0sm+)>$lJuBSt0aG(vDA1i(fRTa9`fK!Ma+JD;xvv1{
z1~KxLK`}8O6?m#)(bhu%2<TeKA?1cT#rkJ%{^snr8PRm9drbZbH_dyjS^<9I>HVue
zx%?xmld!(!xQ~U-dFD`|USz<l-euWOqb*~mP(BFXb5V{xap~2PX|iG)uk__DhqiM=
zMV>=hJiWABLtPWo{xh|5%+f0%2ETXknhne-19>~dy8(927+3C@5AJbQ>55{SF<Vf3
z?y;W$9!|NjxGAS?#&ys_XQRKZ3RHIZ@q;a(Mk6y_u$K3|R5HG9YBSrKpZWTp6!LNk
z16(4wD#Z4_w}0u1&D-^s{b6(b3MRqXbAh>gsQ>g_45_cm8~uWgQjWrf0Ipa{sq%P*
z`-T8s%5xRHEkvd_3!3SXz0o#)^jU(#Pn;~rm;ZpN@egI`Wr1jVsXy_hKO+KS`VXIA
z8rmW>a07`3QvabU-CtGhihJ`LUWiKnRTYQ^l17CzB)*YPW?<@C*^Bo9{ZkjUnr>A!
zra;}wyg<rIBc75w)*+rnX(=LIFsAVv9o7LnIc#hqHF4u@41pR0R{}z;jP3&#*XFe+
zlbZ7#hh<`Bwl{c#9ruaIjFT>M{0RwnL0c1`tc;DunvQ{#Ogalr;q|D+;p-JXF4NPA
zK?-pNiBF9rC<w)Me-5&qcDVEwXGq??@ifB0KCIK9sWNtmREo`X*!_~gNq(<J6#H5o
z@5L4t8iSMiF0%o0oYr%_%lLfiq(OeLZZRQ35qV(G@WU_?rq-AIGqR<-P%zITKK<?S
zL2V{#5lVECP=6*yr{X^EQCT*alg#Nouushj4%=ZJjHrNTdt^0PPt-cZBwJcOt&MC%
zgkPImC6=@gzKOp3BSMCvcm>IG3sSS}Rm8izgkZ~5h2OuCj5K?=oDsDcEH9+od%?2?
z5w!%KFvKD=hPIPs1eJ5@n2NBgojcF%YCC&5O}vy8jh%@!hR)`$+EeLwm#h06Q>oL4
z2CYLve00f=gVqaXk}i{Mu@)a3Q{&HlnQ0rey|q{&<q2sF3?voa*Ggl0buA~&_+574
zhCDxUqOO2L7_8-;{Y42|$MzPgq)HGL2<9NEy-l$=!U@K8Di%@|0t}`aNj8U-1-$`0
z8I7Dq#XT<)$7`$J-D%2o6v6oWx<!dq$B$Spr_xc>cVd0}W{4ICq{P*xL$g*%lg?jo
zAJ!|<C0D1NUyqgO-^;q`{uH4XTFmC=b(@9qTxp&eR*gCoagnU!|NJEBZc_N=8$EOf
zlOvnL0IdM7_|HLk>;BFWN0~{o5NMv4sbtso_>~3i{L@%=88wInC!Kzw*vM35R0XSn
zu{+-@bDOQ{8ozg%iWG$m{*E<z_08hlDcQhDZG2j(Wt@@WnL&)2`y;d>K6j1YU0*pm
zgW|xB$zAeqSvCJcyH}g^O~b;;Y@5#s*T6XPxJ#mIlP@a$>yfPFrfq4NX~Jgx@rfbV
zwXFE;1&9)waq+eHgn!ksj&u%Qm)dqOk7uT-)KS_^lp!lAHDv{n;Pa)WC8k?<K64~|
z73lHvbCSt`p5XbbXMb@KFoM8$Q92dR@?duQV+qkb0io!N_0Twu(L7@-+IH}Ux$Gn8
zt5}mR!`WXSL{EPSn^oP`eS$-2YbjWJgm1DSrP$nqx#Ifi?BsQBxz&igelbo7E$Mq{
zaKGT!Fa_82afvsQ?E#A&n3DN(H0A(TRp#DXZ-@z-ygj^E{v|PVJog!};Q0K=?l-VU
zRoaW+7X@VJ8U4oS?Mw7W<7%8Ew#Xv|dKS+f5-@%0cnGT$)3?H7Sg+g+9@_JqSu$vr
zud{XkQ<R7dusdY>PIK7GDa6vQgdZ>~b+$6>DkW=j%q)*&Xi*?f5EAL%6z$DoIuoLV
zMV*$8^f_342*7@tZ)U6%%0f(NF}avU9tHeHOr)Esj3f;`Y^{9VqUs1a30}|7d++l+
zXgSvG27G1-9D_ko)++4dlDuVwf3Dx<M+i!Dd&q!y0!~_0TQ10L^O=KI?AKlz(vjqo
zos}@33?2G#{nRV#k5uwe^`<Ry*H@z>&Mxq>q44mGaaNnIz{{rJO?r997<b>&$kPEH
z)3mt2WQ39M|LVxdCBqGbM8TRR59mH3cv6OaGs=21+14o{NExI6k`Y8N&PqoMr3U~Z
lqaYjpso>q8b=ttyWR<J$S0y%yz%vP*;K|TZRn%W4{{_!GD`Wrw
index 701965d58ab0614190899da3e0a82b88ef66a45e..d03e2a56b86b5540ffc86495fc3775b0953f42d1
GIT binary patch
literal 1057
zc$_n6Vv#jyVrE^y%*4pV#KO4hz!?KxHcqWJkGAi;jEvl@3<eU0Vg@2?%%LpIJiK}N
zdAg}(Mfv$9y2*(Ka^k#(#)d`)#zsb_76ztK;=D#6t|63bAY~|FAO_LNpP5&p3(>6$
z(r(bisDx}0BP#=Q6C*zZP@IdYiII`vuttE8)FuhJzq<F8H`@O{;v{nDN6VbB@X5}r
zp6pquHt~VQ<Lz!`l_|AKOU!?W{j<Dy_T+(5^|Bp2RorVz_N`v`|NVQ}(%GgzA6$<q
zHuG+dx%$<wBB8l2I!k*JgZaPQWtU5$|JEGL`pUqW9XCfc>&V7@Y15u7yiS5WS?81*
zFD;eM-{bxy$nLM=yBS?8`VYGZCG=nYzkS~Gr29e)D=qIz?qB&_Rcq>ssnw3mpMyCR
z778e|9G^aSRp?rAwZ|*vZ4I@~eK@k}$bs0F!XH^$PBD%zjE%S!hrIcrSydl?;;72b
zpDR<$laC58RP!$~+*G|S(!7dE<;UTmB9{oigDs2B88b06GB7S~V$24HNV)+(Fcf8l
z85#exuo^G}DFbeh06z;0FxvhZXn{DYAXx<iIW`V$Hbz!fc4kI6iwVx+gs4?!Q8rLq
zD6>QgcjN-&z`z5hkCBnZ#=y$J0>(FBY}3goDJihh*Do(G*GsKP%q_@C)l1ILwXy&L
zeYD8d2kHdcD$inQpl_hNKzo5^n>ti`a#0SZcCZst%k+Sf2C^WXd@N!tA~nk|Cav7-
z8k6a|!|2fd62*Vj8!ZidK+*~<t_IEqj%-3e*Re3Z_H2~`LB{41PDTT515KE#nHa@n
zq1NVBmZTP!q~zx&X6EVT<R>TQ=qDExqosUiP&zb9vM-iB>8X?RC+t^!3%gbO-DzR3
ze{k)bYrn%*PQ)`?+;K<SlSxW#aZV0Qi#DoQEJ}K}de8LxH$KNd+Ob&r_V0JU=e`m8
zpUz~)UwN-&)0DuR%JdsYCo|95IyG^raBTzMM@gl3zZqj*t`BUv6<6@NSWk4<tk}pm
zA@5X-CRuu``CZ+-Lu8Zu`Z@E=7ha!e7b_O9ar@c&x}->zCo}&{)y|x_<w^BC#w6Q{
zj%CW9#KeC7G*!!$Dc$+hzU#x&M^*miY){Ubx}DzO&S!FxL%Dp#UP~)Qmm8lX4NmyD
s+ULlf=4F~)VjG$@vwfoEvcpA9dT;bDPIM3b%$D!wCpUe=yd#N80BR(3lmGw#
index cfe09d2fc837d4777d4a57aa0de7594ae760e03a..801d2841ae7c932f64e504d2760e871bca4297ca
GIT binary patch
literal 2661
zc$`(#cQ_P|9|v%E&e<y?WQWK)`v@W9?7c!}gv`h;&P+nGb0OJu_6(gfPFBv!-r2q!
zp}6z&eV*U?{_%M}&*%MqKL5TTa0*8tfEWU&xC17?8wZO!qXv)y3g8qhAUFl%bxa3=
zgZlqhfeYZEmg}ei2q3y%)&KVdVFy$E`=A1VAv7Q|yBap~{*n#~AdrkG5)O)tXrLpn
z1bye2qB_u2lDviZ1XWfXTfkJK25{X;8C&m69p%N-t@CYa&(dpib2r-(Su3}@@(RwU
zHwDPJDQ$lk0#V3~ri(-E5@+^@4Sp7;Jh!GqN!4d&M|h-DcO|&i-XZ%9r7a1`l1*c4
z(}2}cGfVJtqUM{0hiAcV5(2J$oHy-Y!y$36H`=FIFVk{w`GLaPrhOja7d!)cIcu%i
zll3zT{T<dO`x#Ajm4D?}1^7@+fG9jkd(vsbVlSlLf-HoUO1=2o9jqjU=TG}5cE3Cr
zClx{N@tsrW{bGxdQh)N<X~KIWVd+H@A0b17>C>IfVc@{>Xj0-dk36fqW7lDtip<Cl
zM3gi%ypX!w0FopCd_Vx3vKd^hEftB3ii**S1>JYeHc~|n7COK<LV__rHRj0>iiu9%
zDjR2&W~7=q;tb)``Zl3xNAe2jvbVbb{jRWH73Yc7+<WDs@y68$P4VoVC&Yp`v<k-G
zC>wX(Z`By7s<GC-TG-)khp4lp-otjT4%qyttx3!0E)i(<{8F2|_2%{afTy2XY{vL$
zbX3F3wu#N(7CU9hLx%GM`!Lfhv$JWG#-euz+(=VT7GqwSCk$i(BK{<XM#zeO|4`1B
z|K&7)Uty}TLF3UAyv6Yn!`=x>eOfM?;b4AwUzO<ju5El(&!S#-O3W4qpA_9h>{hp$
zt|O%+G)>jmHht@67Z#0H-tUNvI$cFl_y{7E${=jeuQP!!`wVrrXd}0VZF)uUeJ&@<
zP^qxNEUG25?IVDK*Enh+WzLp3B8ed-+C?^AJ@Pv_X?yzelBqBHLo^KbdaO&wSwWwp
z;*byI;!4)$n*Sr*Y4|a-y6Vh_dCPCnOac6JwKDL18ao~)QWE%pM|G-<Np~>nQ&n$I
zY||PEtnjS((l5>~XtvmwyfjS?Z}bKfbY}(CPv(T}2j4Vgn&k}erWRy?4Veg47LFV}
zH7{0K;D@^lo5e}xkIFwp_GpTuMy7A!E5;D-`#&Q$o+E3Gd|`U@^_!~QfrOrIxZYFr
zs~c89x(hs1S>aAP676xTMaUv;vr7Gn_JHJdN+Mbd$@ez7Z;|?_zAy)fV(|cnerBUb
zV6}Z<fq=otilMLlJ)n6O-*nCcIwe}{{L@XRZ*-5eXGDG3dQ@bOjJ*T3BtlE|(G$mO
zGR_5;KwhDKmzQwj=Ccwr(lA3$T;N~e3&(88IE%GLHrRl0;B8fz@Ivqj`(DZ{M;~u?
zaQJb&wu(^kg#1qDm1><YWZO1QwPw;;7@%|<6qYxf9fwT}AmvX^IkB2#I9ztZl<kP^
z=p0@_D1F{%A6`KX{<v;W7Dm_Bl(mxK_4M-F@LUcE&sd54(L9%pRNoa(v6Dy>wmF8p
z9&@ve<O4@?NGHkaEB=fqZ2UpDJe$Rxk1Y|MiRFIvio`{?rqzUOYIaMD6U+kYh<`pB
zj6KLUCE6u)?T-ij>3Kcnrh704Ne@&wIuj8aTO3ByMYq%utlUEC3FgcFv6OccHs5r*
zXU0L`B&z>Vjzkg!ClR}j?_Q4pnDRe-Q2>C~&K+C>xAPCxi2qhCVd%8kTed>yZ`D9>
z5XSKROB)PI%7@<Uq-~Yfx7^e|AyPA;6kBASz?Y&OAGC?__%+i`l=}S$2$jZ#x~v%<
zX*eLpRs7?5NIhgg1PC3U@pC;3M9dyXL#G7>W0xnHTzOyE-`#TZ$;p*}W7@MNR!<Ra
zS&t*EmeyVceYAF=2JugSH<NiQF?LZd0QA*XfqMuHmBX0krM7$G)i6wPzZ)R+E^vlU
z#!^f8HF_Rs+(F&j5FIwUga7j_xs5C^e)ZD{SY@-mZ>B=|Xn#If9QynlHYcY(cG81D
zbK&=TR0S0TZ>i<YnI3hE*V7o}@!;eYB|NocB^Kd*GT*dWzEUIS>FVq&e{wNgGg4aX
z(Z}`p-0gT^2+^pxSSW*U6qe@NTl0d79;y6cV(vugQueUs7F1XHOD6RPR}^mk))YEi
zcWcr6Y81JHV`|Sg|E&Jo*8V1E%6{>onsCB8?%U(8QYl;_4Zb55<eL7to|@ZTMZb9g
z1=~1H4JZL>HEh`VB@2?u1)-14ZGDBw8Xh{?D&nLc9lW6q$^I&fRC2(ilEglbYKr5a
zyjcRzO>;PRmNws_nu|s8HfyZxank4B9!$95Y*>>{z0YUT7=@m%ebnTOd8@BUD<acK
zztfr#{F&yw%SsLOf*;JS4-G#7BR<&ED<Y<ThqlT`MLgsheyB1chREI+qVXpx<JKKL
z-kA~ddP^tnNG1|3p5JpRha4_188!9o8O7-$P@EcUKcv+w))BY}aJS8s-{`ZwWl?l6
zUQomP%(YasNc6Xg5R&B}`Uxd8!p~>ymH;Q#FHuD8(@@e7w7PB(Csg@i_GvcNBASQS
z5BG5!)_ydY4mN#O$AZT=%WYGi=S(%V=YB|BKg|Q(CgkCqu$#x*-quboH%WLeJRZN3
zgfy-eo6z_054{aBDfFu99E^<;F~Zy*<bRWuw_XPe9C$C@EH=@sw4k@%Yhcikp&!rm
zyA|W{u3h*PsnFFg%Z&CS-NaiZ;?A8cDkCj=b)2#3p?+9m;+ad{8xcpXyJE$Pe!X=q
zmqIlTM3|NM$p}cv&unf&$;UW=Xh}-Z%L&d?6Ug2jK#flns@Wnda&d4$Der`C7*y(}
z){opy)#$}ZJwpn49*f8LY})6e>lE(su1`ayKH^YPPB<%0VKuM0g<zcJ64mxlNbuc`
zt|k5X(x&6%KYsyfzphn%|HE6Yx;OVz$Ng|6!wIR4xNSMJ{haQBNF@|Bco>_xEtX~&
zl*-LY?>w@Gbhw;knyXY}<gIkM%*<fHN(p6710(Z&NOPJ57{v5i>>AqM0smTj#YFwU
z(n4ntYM|qt>_R10m)VekXPLfRz*{uSi5ZvFTF8=2wv9T>Y>66vU^Kc4+zFoL_bJ<4
z=eFA_J7JGwCJ;0OVnQhkIC99=Z)+Wz##fCNdvq(wD|ORhyKeLcS=N5>ka7L8TKc%4
zAnyE7u9kVnTdC>jnSj1q{262E_{$&1L<=!o$JWX)lyW*Gm#*ZZKxZRDL6_tUwVR=6
z`>#%h{41IF#6!$F7io1}*}pdGguVw_M7i|k?6(S=c7%SzGZ;w=>cFx-`JJNK+#Gy9
z8C>)PMjE}C$t%rpfi?NBtloj^uN}CTsMM89@I!9@S4VOt31$!@Q{O9WPfW-mpo9Kx
zeeWgzY~U3PA_3unkb_BtX^4SrBt#%aZTraB#DnC>5SamshR-b&#)x$p5ZNi2vO<P)
JjMCpq{tH7l5NH4Z
index 260c0c35dced29c6a9777bb41b8452820fbda063..48e7fc98d47a3f07e098d35115ad1ec71e56939b
GIT binary patch
literal 16384
zc%1FoRZJY*wg>QmK?X`0+}(;xfda+7P~4%E;#S-#u2bCIp%f`ai!(@p;y$>$I}|Ac
z_sDmX`*QBvxhFT7U$U}SvLE*2e`Rd|8ledQ06+!+P$mHYoWHdIEC2ur@XrE({%Vl_
zI)VQ<|8WIC|9hX};I|3*C*;5C{~QSEKk+I80s;a80s;a80s;a8!v7zbfIILl_yF7h
z{svA1r(q{yB!MD;j=%`u69NLl{}mwMxs8JxhlK}+hl!nyIe<GD<u^Ao+B4ShH{mzW
zk+4vafZU`g1efxHteQUp`~Gyxh6e7FcVj!fMMXwJLJ3CcziqlD<d$Nm?$7q*RVg3~
zvgcfVm6^LbCJ>gR?9FrTirg=p;0aBq(oaf|Vj2WxLaS)W8(D-!95&qc<xptU$Hv|Z
zH`hx0;3CcR)+Q|zJMCO#4g(olp=HD|ukp{~Ajz?zBJUO=JZ{|2==-2Mo3kuU%eoY*
zC)So49Td{T{yUQb7>t~(NMj2}n2Fk}Nu%^RLrkivsNSDx98A2q(5u(oNd0fC%4RDj
z*cgKprYYR$UaW&(p;sYE6?C#s7*<1{(!)-A$AXqXm!rSJKhp13CC}rjKEw^5lvFXr
z$kRneQ5R&~tBK9Hi|ynwl_iL)2Dad;K#n9-dIy*bUtZMZyI#$vbB+>Tn5FirO*Tt<
z%C>x&4g*rwZ(4~Mq$p)dYOJNEO7Pljfhf(upbsz<j1Z02zMt-^Ki2UuF-w~hnKV7E
zEBj}CSreg{{4E*7Lqo*2E869pd#v2jq}_C0<OSY-t(O`2%{+U!o>be){D>X5%r56x
z;>W}==7M#<U<bp@#@ui=vhP&-x@V>fOGKR5QPC@+kQdX{hPKb0a4XD6l=ZQp??m4g
zD(mbg!eVDX8jnx?=r#tnnBE_8krjy_Ri3dijCP`Js*CUT&Tw~PMd#nF2sBW-vOhcZ
zHw#$GeJjXXoSk3sVFH?9ot4EKuk1+I%}j+}|5__19-i}NwJV0J*y`HgCMy4vi`|4v
zi|cyjGMCQ<Zf&Xm1P!f`j}APaJN71IUtNy2hB+;3;-1oRm!Oy5TjMiB3g;+rnOeY0
zfXn9(9#}3)N7;t?fK0e#+|&WPqjm6Ht)yZ^lzEQ(!(HXiz9BD7)S~Xd^<Jo02m~eP
zx{D$pXPRe(OS`Y=QU-f<qyLa)jS`JYqy79-RM-4qFe?<J_gn7Tjs7-&Yhr-ocCm)U
zBynuYQXS^L=|z@J)Es4hu<^$i>2FHFG4?Q`2}o)be5cO$5?4_Kv+RzCRtd{OP%mKX
z@>fZ#2bKlvs->tr91BEm46i3rcX_Z?Z8OclH6pX8+{F>D&N%f-<m3B_bk(Ky?U}@I
zCDW^F{(v6KKkpNg2Hknfl&oI<YM}lWBt~TAq+>FYZnkf5*tj2dXr_hRYyUW}U&uzq
zJ1$Qd&@%vfq^18Xm|BN^vRaU%>ujm$-L?K0Wyq1?_r^cL0yWwD7C+fWmb^^@Iw0L}
zyjp<l;b0dVR5x=l?N5GZy2%l#oVV^Cg_$I&O?;q}2J?m{(ka)@T;Z#6rzLdeZGUPu
zEAS7Ij2RgRebr<_S!faZC<6nMRy*v9=5>oDNwJWZ_1}KLbU_V}J1Zj+$*cNI|3nWi
z5QG^4UnsrvTEILb*phpX_xTv)MV}6t_tW2qssYkF`oxGuu3Lx*Fz=Ec`AC*b(YJ73
z4FNnR@D&oynI8pf*~oQa4vpxwx>#MCNzS;wMdvH-)oeUq^3{QcI`xH^W@!PrJ3_u_
z;l8Td#vs&jwuVTtvdn`BM!w{szKYSqE`Hy)E(8J+DIB8NfP1vNq%7#sos;>*Pen83
z8!&BPd3!jqRii{Nj+WB>16zc$$VTu*l{4Kh+0*%NUyQCsOZ=#iEgN)UlZ`)Xq6@th
zEIHYN*sp$c#?*}SGGA3ybZ~BONc(7*?tRZY$yCM*8zf4?WeUc1E_SGKABVbD*LIVe
zCRa*#7)8^8<kJLa0K}K#&uaecB`-6n+5xlze;*$vSpQVGv79WAA0YmIKDxtKAFJBQ
z^v*Eai(J+<lc^|ne<Hmu+zK<;f+^mDjQs=%>tm9$w;>Xj?H}~)-TnATyfXCis5XQ#
zx;VtsF9nc8$ygHE1%Vx5*T=8_n!YWv6p=Dx-<3mVsFs;NNPe#ODsfM+bU7}oRei3Q
zhOW%{qU!<tLN`=ZouodWj^Nw9XLI=Z&{|jti5qU+m%~rzQxh=d99@SUrb)K<XIj8f
zDhmub5(PiCoc$>v0NujF#nI92Uu6Iu)W2q5&8vtb_8}4t-)nSPQ?=l)48Xmnf36i^
ztAT!I`1581IxRU#ad>{08Yuggt&STXE6*rvvAY;wo-Y@akYzcloZMuWB+a=?Ox3Tu
zXJ#~zq{oaW=isG&8H498mOvK(J+U&yv0EC7t;fjmiewMGzAMMqcT|;ga;++cd#qZt
z{DCr;iic>JpJs#!4=!1Kj<xXkp)#m$PyUtm36$m<Ha`#L469yu#z{5}2#>9eUz<&#
zNGbY0IpHT@gmv2{q0ArVhzwD0X>SzD7#BqUgC@ng=s?89!upOVG$`LHx49$UK&la9
z92v6jaYNX`PfZonQmgG}se89^08|3AW<PsOeA-w{rSi`l`NhP<)%8m(O&3dz%W`|X
z*IzdGvg4fI*QU%Z>=5;&o%LE*SuDT1`IUntzfe#~<mR-p7ILRxPUiGW=-gY`inGG`
z*PIGZnPqQ@q3y{xZ}+H0yHYet=?oW<7rUZ#A5JFOA+8r|K9bGCRuxjD*cFTKK?AG~
zVoz&%X32~{`<M@$)E4z@CYf+-LZ8m%K&_Xp#Ab&ev7(wg^&_H{r)o(Xlh<!1R_LvT
zLRW`Y1156xJXk*m3<Brfd9<61D>#=Do_kMX9|};+tnHKsbANP4Z*->2c(I0)s{4Bu
z9qIiSSgZVuP^Up$3mZx5pYJPQO9<)Z9bxmEZA_dm*_z_>)co%fV^Pb?fs&?+Dn4DW
zu<86l3?y@Pvh-le-7oXtJ|VHW$$r}Tzb6c283#)VZpP)v-d6nP;O(_`lJG?ZZd+g1
zts5p;@#iU6tVi;<Ds;ZY&O-KU<;BNQKW4bycl9jgiRXk47O#o#U_v{p65=j>0Ea8t
z2R8W)@>lL?5aHl;&OGQlev|{G2X7=&we3P3eSuAHjxm+_&q}`9Z%jLXu6zoYkA>6g
zD}M<-Yb=v~&Un$I$+sN`t^k$?X$KB4(kd!Q@uZN?1?D%rU<9cV+<pjCTk^anofHj7
z(R#ph$I%$IvUA!j5+f`Dw$L^2__S1}uAXT3b)|*pY<HxX)Z~L`D`R2+!26+vo$%ZC
zQf;s^ndg?&^Otb=!t?6&`0wgJU#l%EPI+nHlaIP5e=hJiIMxaGGj#7Uw39b2_@rm&
z*m##|=U5a|%{r|UQD6BP-5r1V*t5T~;Ni!d>Kk?Z%c*4whxiM#L^7v#<il<;c>5@|
zDFAl1T}~5`f>m`}1C~DhgyL~j(qpzNII%$yx+1_D_W{C2W;%6;r+b;z2Z_NW=Gye}
zXQp^$9E7}+{-$87l$E7qTfIo0Z$OayfHR9~&<b+_4*^Y~7WXWLSg%q?p|LF9DS}A}
zj^8ohc?`p01bvr=a6P(3owuU1@3459cF<i?u@y)P{12Mq#!pnpe1Cgxr!SoC5i`#`
zC;D~&I`QOQWdto~4sD&~clGI9t?f~-`4WFII~a-NqNhhPae-%#Gs{Zm){V60<T$Z>
z<)o$&Pvnq}1XLXz)@@)I)G7J=B%CngrbmmKEIuVXc3<t}i5<^{e#uKJVY;u`GyGLL
zuQVF-%jQl~ht!Q3xMOdSl5gWcDj_R&GLlq&-HQygKr!JAkJy=jjY8+cWo^%l{Hd|f
zI?i9@9UnMOONRtC2<?!C0K5CwYoFtQ^$HP&IRKm(+=9D2NZIB@@#6dYqw~)Tx*g{D
z)^Y4xF6>V@@q%4$$OErg<wc>)w#VX2Q)XiZECilN&^eM>lXrLgAE&4Kd2P$1F`QpT
zqIHkRm^6#2OQ{gcv~rfiY`+PPl3LTIQbU{-iOg)oF+3<%l|L3R9*p+2zj!Vf=apx-
z>Q%`jbIjah<jo>zR#M3NCLQzD7i^bl?}28<)!V+LS6p!Gw304&C8M+ftL}qkvdYN9
z;ZeRwB%3B|=E7MlvQ#Wb-VYr4Sy|@d1|2O5d*x+8`^Fo7kT=hkwU?8L?@841TD6tN
zg1!j(N0s75@<A`WEV?4LT~%vYQ2F@@mFxX3a<GKMS+k?`2P(7(?5yk@O-<}LTutoU
zfCNY@6+T7G7o^Q;Siq{G-HkE1izFMs|4a&b%i`(RI0gQutbQGtI-{{pCa$iYjxOdL
zX4V#FAAvd+F0M9?4k!Qs_!{FHv<F-O?g9VP+Xw^%gntJh0O#-P1qVlmzpohnx9O5w
zZmQCds+$apip4<c^l>(H9nSvObUEloWv-MiI%2ysdq=!VUE{b6!qQXhdcUP}cy|<N
z3uZgQXs{Y_m3xhb!_eR3yQz$Z-upf8hqCpgmc>ykgUQ9W(}ZQo6LNjrVDdrD7D;Z>
z5Gq`&M{Il9^4rumnVVr4g(8G#=dmqm?n7ePidUXGA`I53ptP<sM?>~|4}4B=tWs#H
z|L=2!0*Fzq>!!q{VyVD+et0snEFP`q3F@zYuHMDgb|L(|t|<~QR<`sl5cT~rSJOGV
z)^#rf67094h=9G1y^YTj>vb1Sy9qx?o}?`m|G{*>zm2BZNbK7LGoxWv(eHx^0?0CS
zy@rm)l`W#R6lVay!4hiiwIt5XVXC`pHr3|zvB^^BzMUoD!^@Iut$q949h7+4mA92c
zXxFdc6jR12*1qhw7^b$m*0b(}Vt(Ni;gexAZ+S&e1M56zV@q7bqDN3FApO;%Zw7tm
z?&K9`c?qu7SBEfEmkucOpA1IzvojViETigvLSN$|1(|DdkzV_b>$_n))qQnSZ<sSI
z`i(W9RY8{HfYuDG=B7KZtCRWih;JAI84-94!#TldUO)%ge=7Rg%zeUZIZ`i64R8}V
z;4d71A9z=q^<vH?@flfI)fI65it(jVPJBxBACBbrCD;wft?<bAuZgP<BAK$zQKHI)
z{`ma*J`|vmB<sXT{$joa==9y1B{)XKXNDUqk&@_4^x@`ZiVY=s#uqbTmnE^8E<Vag
z`Q4}5GH+D&5#!@A@}S_mtRK!E@0edmBAIf;z?p^J^$gcMYdKc4ZqGrZ=r_69m0D(x
zDb-ynyt)V88H)7B*8ADtRP>l0<5y)^`2rI;?fiG;*QKPkSM)~`+7EtvEmE(TB9Cwk
zYiGZ_mlEw4{7#bgfxI>;k{yR_tj5_SDc<p&L>>D`&@owM9&9Q^12d~uR8gk*OWKfb
zVWr9oO5-X&RPXJQNbQ*_Ba~kaGyw{be2pqg6iwe9h|7s$14_i{{I9xmQHHUZlX;s`
z<$bKuc&1~Ri+bfs8|EWKTHrP7b+<8b7Q8g~-e~5=Q(E%kq@$B87=Jc!OS!Z)r@1Hm
z%da42jQX<xi^Gip!Z;|(1hT0}h_J#th1fr^pRJrRn>E+eumahBn?O0#fgyVcR!1YU
zwK#nQ3nNmflLk$kSX;VHvg9zO>TGG%@YArqHI~K?eGS)BfFg6og9AD6HzgT=xt2yj
z2bzMR${6Yz9rS2ip2zdpp}~<S;@4eXbLza@GTg2CTPygX*7&T^nfE7I6<GD!F0E|I
zdzN_XCvtpz6<f)Ezq*}sN~%f7jCl6RSVQeolsA>Z<+Wn~D;J%5yQ8ybi-y0Hc)qhG
zsP2@N^_xZB=Zlrc%7ng73f^^X0#aD7IGg-3i?u`y8@F`-p`VqCqKg?Ucq}?1=rGH$
z{^`@crN@v8>IJ|R$0iFjI%gP&7neHu0!XnEayVP`E?6z+k9|_xA(}GE_h%P@nQlix
z3Iudl;bEyCPi5z?2Jg>!JZGr9g>XQ0-8kZ6iiB!!&63q|w1{>>rkVBeXt>gt<c6n+
zgmW70)Vfs|cVbwVE#<~RMn%rCCm%Wu%5qiVgQF1ni&b8l!?jx;@IrMT2i&zDctwfs
z+0CqmM^;Nh1?O0$uMvOhks|nc8=9@7n<QPn)mFfiuqL?KDCgmA?nn1U;Fjo7Xkuib
z)BS}<6V|6^6>ja{DxXeIDc!U9@787wU0=NoF`T|u@iGpHeP_#-2oQL*|2pON4({7!
zdkw(&Xq3%p+f(C6&L0hXE`=LyJ4zQcSxoNOCcmX22B$qqk1UPrmccWQn|^A{-8Egs
z1C$9ZlXjHtGP0(Wruaw#FEv3l1voUJeQ7!6+TV$pHp{3*d00o!ddhn`--kNi+OkR+
zO78K##4OS}x@GwkpxfWe(0o^BE@0M+1MmSC^3?h?=nH&8X1MLvaFNkd=?X0z<plz;
z{}}{-&jAiIlYbQjQPR2d-IhKjm$g#e!w_4_`$_G||BiyG(=A9JBj&6enhjXkN$CUZ
zGhVww8Ud+1y$>0m$H7;%a0O=V6_h+^o0nYCG^f%V>U|_gZr(-#mq{s~Bzs?)R4x_)
z=tB@EF1-E96#XYg5ebBd0~K)eLToxxrX!YKHGDzH&70OJVylw{uVCwU_AP%_v%bNY
z+-^?WULRPvRb{*(E$!iCwmm+1Z!ENhY2U#!$)SGN93QL-f9i`~R{uyx#rw)R$XjS<
z)uPrCD)i^TF^OidW8!ftx^;a8(~nJ1g+rHFh>}&>LZEA@cDmL0m5@G*p7aqOiIyfl
zfelVA@=0DNMJ{g+OgcITDa$L-FWJf&Ud^sCf7?bjpCd?&fBvAoJQA$3-NsFA<|BIf
zTV~!~ZBZt!gJJ#+Z5jK$*1mP>6^oXcM)^HR`T?Lg7obkbTzJ<K8=>RrXC!%%TKmx7
zl<~PKup<A5%0bI%&XzPcl1pb0Rpfv&>Prc)6n&PuOl!MdWX!r(ftm-Yi7uobQtpb!
zJH^<+t_+smza66&D<sn^aL*p+^;RbUH~mCBsr=zVZ&<Lp8PcC0W87zk`rc+HK{cMp
zO$^fmjN4mMUMeq|1s2LW)gy1p4h<VjtjiF;m#=h={~GQ-8j;{PFErfpW(sC=gW|-S
zN0ZtxER-n|nr@)YVJqyv{OpPDu=uLBNa~81b~7E?mbR0V`6(l-nfu7NZbpbuSXtu%
zvySmvFxApqW7pp1z}%IFx++&nvk}#4>w!Okryx|YfALpPUj>Ue7e<=Bg-1TAI+qT<
z+w`~lgF*kX1X<G3x_hNU+lRXXGhJa~v1=inB7&Q|)N=^WEKODh@?(z%?J1bbnWhZj
zm9O>1oVUA`*>|)aGH^s9HH@zNrF0$(|7%2ZN4{iNl<ac5!+T$Pg64D@aIf?DQP+M)
zg60&YRZaPsct<cE+}4S4BvVTOF0Tgoo}QqYFNF4Vm9|KTv=~$|FUK-z<ZY>=JGD{a
z{{hK=i{HR~Shy^@?1bANnZxlE3$s9D%t(O<ms{IIa`ypaG;B~y%0;lrzMDX7%tW=v
ziMf=AS8GJ_!qkm&Zu=}+gcGogyUDn%1^Ku-#{d;(3sa^Xg14FOpd#^!CA-;mi%4Pk
zg((>>_Wk(=)%3dA_+WsdN$&$VHFj8|3iO=~#Ie}S1fVjh!cPFefi7IlW@C-mHWC_z
zq-|?}IFdt$x3_Pa^RS5Nsg$H;bO1w2<|o*jW+UC8pQ(pWnh!h{Dg_t{xWZ=>bk`|G
zC7zuFG7OIFS*;<DrA!Q3G(ro82Zo)`a5c`CyOdP|gw?2Zn*KH{SUyk9@Cg#aTd9u?
zzUm+@KnZ^|&j0L6yB>;LZl_dUqIXKb%Mf#RPdUYgog=X_aliBMLq&kk%8J}ta;*YK
zgq)m;Im2(kzP+CCo_ZydohjMg#@UfmcMDRIZD_f?2#U|W(T<HsRrOo);nTbFxA{pd
zeJqk2AxGeJ1x_=?6>2?O#*60KBl<&#`Dw5zN2hj=7d7jbb{u_3IFuxPTg`S9h0|<C
z%}a;}{p3nm@OvHd*S$XxjI29DO*Lh{@rpmTx($nOQQT}^hf;C<?ECQ|v5dM(Xck8^
z!j6^7S3>YP`@?x%v04vICVnxtXJmp;0#6K;o5~`f@?f($&3UYZqQNL?j;&zNm-Ct`
z|AUri{(aKGj{1B#gu<CSgzjY_<#pxJm~@7T;C!a>40m7>)EW+VO7kG(A{w`+nm@1E
zdz|B~m!;ub!=+uCx;G%s_ja<qP9$6~vA12rViNptP666ugneusgsJO=n+VOjQDkJc
zPFbJ-v0|gcG1mp>e1XvcSDPzjiCVcB$m2rXhUx3lbL{AZ#*Uu#q6C)A=dw0tvmtB9
z9@X|8O8P3{<0k)*wzw3cmlW@c7m62hbvzFaVbin_SgcaIBe&Ocgf=X6+V_2yq~e7&
i!Gw_VDIS*L|LK2E1Ox;G1Ox;G1Ox;G1O$YCyZ-`FyK^xB
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..e0a507cff5a6519794d6e05c1ea1c1800ab9393b
GIT binary patch
literal 983
zc$_n6V!mw9#I$<>GZP~d6SMu^_XfOdoLX%jZQpqr8M#>*48#pZ4TRa4Ls^)4crx=!
zbW_W8%Mx=kQw-$9c@2#XjSP&9j7%*IOrpejjX+#ODAz#RP|`pgqER3(UpGIwxInkG
zC`UIrwW!3PiBSpJB1TpQ<|amd2B0_>QxhX2!%ZdKr-wb5WoqP4oZH^LHRId*uQ%VU
zmSJAhvEuk=t|sRNc@-v{7k^%|cA4;mag8fKukDjl90wY|3K&SVq{~FN8tLWF+C5{U
z?B`>et8O>{J*vfE=XvJ(R>Lw?My?;{iq?rmDNMgmnOA0!Fw<^ttKH2v>9>9zS@*Qd
z{b?49=Q+>km$rT}d)OPF#Q!!>cc+!0p%_Dg?2`lR^Q(>D9OjS{td*3^OFz5kqVy*3
zP?o=1{HCoEzE|tb<QHdD2u-$__wAVBgyVtddOmSInxf76-^@fs$TY-Y{<X`TB3>zf
z(_}1TB2EOyMey(Fko_ypwPvw>QSNocCvPjSh=wc+5mE2%jAUYFWMEtj3Z*7SIRj2$
zFv<$EFc~lyaD$lqEG)qI`e&d3;;1q*{$~+05MkrcW@BV!WoKrDvzQFzK`NA4Bn-qF
zL}o1dvsz`<Dq9bYWmS&No1NDmn4Dx_1yjt($f9SUW1t1&8!)xWWt5Z@Sn2DRmzV3M
zRwU*Y<fQ5)=jZAtC+cOC<mMQdgAA8vF)#pXT%ff;qfHH}A-O0AS%Z}Y5a_3->Vm|9
z*uV#*QGvzPz}di&O$cZo3*&3gRw)o<Y%bwsG|)ECgt>!>QA`$UY;I*qYH>+Qer{rB
zo?cFVa$=5tazQa#f@KCJA9L=aa|<5ie7~x?DEzj=t;aL2t(LwStFqPB&;RzD_x=7~
zU5c`=ocMB<_kwfmT7!s<%hSGTxc_TB{8~%p);a}!k0lar4kD+U#2$Q{;*_)}y4%uB
z)X=3l!*TtI3F|H`k<#!AU=UMRi(GN*xm--$6TunXE}_2-Lquo0rn!oQXGyLV_|e9@
zt&DLM>$m+qnj-Hwcg(4OY$tc%*3IdqB|Dt!=cmOVTjVc0cYBNIyOc*f)?E`H6lgs<
zcB*X4X+aS?8#4jtkTbk)R_aI6=d19zbi_<6mTCBN=7jYdWxbj{(aCaec9^%+wYu&4
e%&;N%R%79nw|@-In1(ig*grov*FHS=)O7%c3S8L$
index 7710ddede79a7939a322aa5b60af4361c68408c7..c0680882c567c5565e82ee05c3f21e8f56b41e1d
GIT binary patch
literal 992
zc$_n6V!mV0#B^i<GZP~d6AR;B_16ZxY@Awc9&O)w85y}*84RQhB@D#am_u2ZdH6H)
zN_6w`^K?_obc^!yOAO@1c@2#XjSP&9j7%*IOrykkjX+#ODAz#DP{cq8qL&+4UlXGe
zvNepX49rc8{0u;GE~X|%Mux>(<`h_D@0e$^Q*t9irr(}>6Q&0oobW*1cC+ic=k>R=
zzU|PudoAlXbGAs*?}~%`=VG*LB_tBtc~T1{o~6w-k#V>cX6V><P4jl_Z<Xg-?l)B;
zRj%ziQ8e!p{}h#cm+yMaK9)z-uLkT9&i}bllEw2y?OLO!j$Jtozf!|^0#eEsuy6i<
z%j=VAi(mXF*E93^q*pXwYxW6#KkMf5>TEr?h)+TmtK+5}Ju6ep@J&~y%zfEbJ^KTD
z_A&qe)~Tc6)ey_})^d8*Oht*V+<A40eUCj-US8kCaLIo+PpZlGp8~yq&M(jlGi)#y
zm_BK5y1==`5|4MaZr-A#_k5XB@&DLnGv}pD%!~|-i<=mAfFYt`zzGaNSz#6?0|o<b
z5R;#U1sGlb3=}{dRYu1DEMf*CY#iEbjI6Be%#3grlYu-)g)$2;0vkkXmS0R-xz{x&
z({+c@q5UO_|Ef1y8o0m|GcvMR7?>HD!1xA?Z5kORB?VUc`sL;2dZ`tOxdl0?ddc~@
zRu({@j})8w2Ie4Z<XH?1^bB+sXf4oaQ-f+vF3Q2wnwqK$5(i=fACN``7FPpj14lL?
zpv^3duRU9(K#;Mygp<)g+dvcMA|^&LS*WqOl_jagB`Nv2iJ5tNIr+(nIr_;3#b^na
z8I+KwZ(1apesB8Rl#8;R7Urs7-(QfgU(;Qy@})Ji=Hm@(Zts5Os|!xAma;QbTzh|>
znZmXw2b@?7=JUv}<w+Kto>Z9mefwg8AKDVH*_&?sKFuAQ5ZiR^F#qEDONEd1Uy++<
zvq^OF_pe1JMeY|jm)0L*5B+%S*#n(T9HLjUer0Q<DCXAaFnTJbK4RX~wZ}W?g7zZ!
z8eZpJJ<?Kll-s6OC`mpsK2bB_Y`}Nz$QOT@wgecv3Z}RGH`o8hems-+A-h!3`IPS$
z&z;~mUE`qbGXLj`uR#mCVy1~+cr^LLo=ZRYk0@Pb5TCSfla;{7+$(W!xQk@jT7<4A
R{Yv~cN$+hZQ=Hnd#{j|QWi|i+
index 7ece52a952d20f54aaa40d0115c0f70c402e6738..b6d7b3147b133b02f92fc4926a16a56ad8432609
GIT binary patch
literal 763
zc$_n6V)|~-#CU%JGZP~d6C<MmFB_*;n@8JsUPeZ4Rt5tJLoovpHs(+kW**+W{5;*%
zvZDO_65ZrP137VCLt{fD17jm2Qwsx=C~;mR5Z4gO#iO%{Q3=@^Mpg#qCPsb+pg0#(
z6C)$T(tsmZTqfM^J974-iGz?GtASi<{km6=cTO)nzg%WpT=xy_g)eIKzRE3#4=G>p
zYx2owfj3vR%M=<kD;X`4{krbWdFPpl7B^=lTr+5xyf@?T--797qWWSNa^-G*-1y?(
z4dbn@3MLN(74KaB6(zo)vLNg0B+*-mxmgc*)GXpZ%5c0;y^_8A)Rn-9wnWRDB{DN-
z?Y^Ax@prnml0Zs0|J)^4l$h`DT;nRXTVF-Gzq#a$^5z+HbCfL4zu`X0(y;vIJgx0>
zw3&ij-)uVm+Oft*Sa8Y~=hV-Z%8vF2Cs<CfEYAPf)T|wxYJPjY&rj*xi2S|VZXL)y
z-r*=`d}YTKOU4B<f9^6dGcqtP_A&4>;0K1EtS}?ve->5)W*}w24HDpIVFAY0KLafg
zN0~+0KyjhW5-HpP-h>gY%%EWQ+AiMluzA_;82;$Ta?#yorR?k%)++XH+rgQCpzTY@
z>&(1u9LWiqbE}>n6x#o$`fguV*WCN^mSIyi7Ki+=65IGQf%mc8>Jy#6wDKM8FUV)q
z*)i!w_B^?LaOFk5yY7oN25uEP6mfjQjFvU2|9TP|uFfp_vdr=P`D=Spm%jOuH>3XN
z{*pI*VvDTL&rPrS{NP>VG!_Su8~;Ui_&>dI=<0%uO{YHm=kc^^lHSv`T4{>z?Ro|6
zRPzPLy*2Xqd7jz1X6gz*SCwYetoD#iwadNt;QYR{Y_YzN5!34ILltH=%-okA^V(E)
hX=z%~&M2`HkM#>HdUCzWOg>p3RxbV`=J@{9H2|?zGkE|2
index a88d8e725a31b40aca0282cf49347adaa8c7e87f..70f46e346b4f013fc4475955152a27e7c7abade6
GIT binary patch
literal 2365
zc$`&~c{~%0AIEJr7Ul@KJ(N+-A;rdn<a%70D~!f0vE~RNxt78sYnaEa{9L6&k9%d0
z!W>KdrkEpi3}Z-g8-DeA{jTSa@9X>ezCW+;pYIQxc*Fz<;D-|-hXO}5@7Uehf&v5q
z4~URe5D~KU19RX+{`>!n1RfCi$v@CtAb{`3y8VAoa76*3e;*<M0k|j#(&nY~x`g^%
z5(tFwr4acqKHTjd*ZMW--1cprb~xK*`JG4go9$C8f4!9JUX)axIOFyLlEf0q8bY|P
z6_Ujolv0$jycoCm6(!7KtVLLt)y0<s=SGxf&+Aj!1x!d(Gv$wX>TUxUWAl{}E1wdn
z@7{-8zclB2R*|R+@3#J=%GRm!D)D9X^mms>O0|aPOO`n{wK4+g6RK4T&ezWm4<P%^
z8a^r(2K_S!!dec@<;>D=7LBAO$c%Uk_K#q3=nwM}^t7A|y<4%<yuhO4QvgTlkw7;s
zoro8Gz~R(;w|Zaqmu_kaJF|SBSCr8_#gG64#hU4=8ddYI6B3NQ<i5W~r`C@ez0W7V
zU)`<`AT^h0^oVv-ccO)9Mc2OSMLm)ga~Z58NQyq5%#b}viOs3X2rw^D@z1p;%2ZGn
zdpmVY{6E$u5H_&}u#J#0*^7#nzMxHTm@M7uL86n4I(*h!B$9*7O||8+8Bs-PK;~pp
zWm6H_=wVX}T0!)FEvAZ7W_rMCp9yFXI`D;3GITwji0rF-Tkjc$Hv-N~L<t8!V?>>U
zVh;IjnelGznU1ph_PdQ7@hp?C*ON&^Hwd^c(GKeWzWD~A=GB$bnoz;MYft-TRHa6Q
zk#ib5CgvUVQ(P6o9=pPaPvppxrysvt2+rNw#nb}X3W`)_xleT5QrW_9Q!Y`LH}YB&
zRa4%Py(z8}HXzw;jaZ2nfbu=#509p+`8_0V$@{j>I=H48kI&1G%Zg6~;T^t;J<pg)
z=X!luC+(ycmp|N-dt8fjhw86HNXz4DhZt|;NK^jVpWF965Uo#{0kE8e%mD<<<{Y=R
zg>snp4IFr0(<`3A#u|z_xbV_zj6`Pahx@*v6dZ5Vk>4qrmEs(>G`MH!%%#(3+PKwh
z2&-Azy+a72dd)4&vt6##r&oE9LTZ9mo$ymj)RarZX@5Hw9HwgX#r<h2H;u>{rQe{P
zR`3b^ZiO8)e=Nxf_|l@Zt}TyB2&xFlYSbJURvrjG3~VW`3bM@RccoB%cbLGVXkzQh
zBpDn3Jfm)U(Cy5A%H6M!Xvz5D&UYyMJb{=!D#}=}UAR_h{kiaD;8=*jac5$&A&Ow>
zJL#(*ue*43*0MZ0q09o6q9K1%Ee4UJ{AY7IoCvo3o4sHI5D~2V18e>mbphf3Xek5$
zJ|Kct;6%{k-)!aoX{)G`t_rVf@#RljK}1krMv}4lK}v>D9V#TbvIeADrtMEDGVJFa
z-Na{gs2vkipYf6qTKCyn^!c5YCW=nY=IbhX*7=;_ozn)sW!SsJ$PWrz>a;L@LtFE>
zXg)TBGjRI$R2u!f`9k&fcP#zXOYL9s2}^ZcM8!($a^P%l$<#F__U5G1Yh<TvY)>{H
zON)J>9@F2}V?Umm9aJ2<a^ywo*<U{ZsxZsqw%x<MU7yNJm>{Rx%n8!VQI$uf*3pca
z75`U${wZ=6if4wd58g0XcUHx$ojlQqJ9Uh^0l89b8ySR%IKX@P>&i6ih%!PB;E93O
zp4V}29J{i@y%i}1_Qi3JBHj@RlTmc?hFN)w0ZjB+rE|l)GS=iKu=5NedNP3p?`Tb?
z8CNQQqF?$bP7QN6{Db6^*l1~WDcderaACatjb=quRQ?;-3Z`MR94SCLn)?`1ifVXn
z&nZ?@M@H*}nqAt>upBm*7OvVGFIk8<B!vXt6%`AQbv|B);wG9;*%3})KBR30n$BV)
z4$IQc1w}4gSAU}Z7=pIrNx8YZjZe5ccD79Adi&NQJ(D)lMCykM`8=;~m??Q>i(HWO
zp3CN=*v>uJO?T1YeI6SHnvOt~D5H$;e-3{WuJ_?CLe46*L^e>pU~?Gfq|3J^br60^
z4IOsqRN2cxy<=HH8x>K<_Bt%?Yl4HP&^w$S)V)emU9rtix{Uz`$k7*T19|ZloI(ld
z)-AE%{pG^yji(<BJq-(Ci3e@y(q+}5U%YYG1!tv`02KzTW4~ry_|ynbhNNze@f3Y=
z`zL!c2zsDO>zLI2O_<e3f+LM7by4O*UKBXm`;C60@~R;pP@36K8Jyj>s~g<*`76wc
zhiFgS&KR+fK5KlN>_lwr3%_^}3YbKx4-F}(zdddUnvSI?-D9Sw5UZh&s6fL&lMbuf
z_T^*mx61IsUxKX!n(a5I5MDbveseLrx-oJ<x_04sIWJm6qdU}%tgSG_GR~C_mr=iY
zBXJ2C^J*GnS&*LzC4ZVn%eFaFY3D8d9BJ-}sY<PRE;Y_cB+Tip(SnB08O}0Rb82gg
zOEJYr)I)+K^VC)JIPF<alLN{(=gOaK*yX;uZY*!wPqKPg(SZ8Jef6<+6Ld=CXdB-p
z6<qb^s||#jKiyhcpj&YDFs>__)3VDx7<h<e3XS6nL#<f>&O5k&=u90}eK%)f4dfcq
z%lMoUOu_3|+Y$Toq&Y5uGygW6dR0h3C36@yzeagm)>I=tVtLn9z%?pQp#$NZM!+W_
zUdPFcH`e*ZT!8(;y1HNtE!NvLHQjTqHW5!lxDMH0shPwhkntg{6A4be%3fs_^Hyz<
z*+vdcgSurj6Fqu<Sdnh<o%-An*5Xv(7ZH5vZ<ANh$35wxK|DI`rS(Lk8Yw@Rx&V$K
z=65!pp61?zdHQtaz9`RH*6TWuI87Q@z|WSl3E%SQo8%p>L0k;SsT|*kN8Hom%(O#8
zB4aV>{jWQWdTcyole0aH_IK7&Kbryh1*L@D#EWJ*HpL0nccs?0R>^UXhSgVDf=VY4
zXe!xQcgt&)d~iT{A}r*1`?D6(tjM{wq`6jY3yg~MH|t%fFusrDySvrGHt_R^)rY}P
z{I?yCNb4U1NmXCEd9`GR1idr*yWZ<vrW|{_0|?iLtHO^6fVD*Vf%0HJkksl)u^6l@
f&Dc+~b8Fe$#d~yQG7|(z%9Jk9v~HvRY{`EC$lq+i
--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1,1 +1,1 @@
-NSS_3_15_4_BETA7
+NSS_3_15_4_BETA8
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -5,8 +5,9 @@
 
 /*
  * A dummy header file that is a dependency for all the object files.
  * Used to force a full recompilation of NSS in Mozilla's Tinderbox
  * depend builds.  See comments in rules.mk.
  */
 
 #error "Do not include this header file."
+
--- a/security/nss/lib/ckfw/builtins/nssckbi.h
+++ b/security/nss/lib/ckfw/builtins/nssckbi.h
@@ -40,18 +40,18 @@
  *     ...
  *   - NSS 3.29 branch: 250-255
  *
  * NSS_BUILTINS_LIBRARY_VERSION_MINOR is a CK_BYTE.  It's not clear
  * whether we may use its full range (0-255) or only 0-99 because
  * of the comment in the CK_VERSION type definition.
  */
 #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 1
-#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 95
-#define NSS_BUILTINS_LIBRARY_VERSION "1.95"
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 96
+#define NSS_BUILTINS_LIBRARY_VERSION "1.96"
 
 /* These version numbers detail the semantic changes to the ckfw engine. */
 #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1
 #define NSS_BUILTINS_HARDWARE_VERSION_MINOR 0
 
 /* These version numbers detail the semantic changes to ckbi itself 
  * (new PKCS #11 objects), etc. */
 #define NSS_BUILTINS_FIRMWARE_VERSION_MAJOR 1
--- a/testing/gtest/Makefile.in
+++ b/testing/gtest/Makefile.in
@@ -1,22 +1,15 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # Avoid recursive make to avoid having to add files to the gtest/ subdirectory
 # (which is third-party code), and to make the build faster.
 
-VPATH = \
-  $(srcdir) \
-  $(srcdir)/gtest/src \
-  $(srcdir)/mozilla \
-  $(srcdir)/gmock/src \
-  $(NULL)
-
 LOCAL_INCLUDES += \
   -I$(srcdir)/gtest \
   -I$(srcdir)/gtest/include \
   -I$(srcdir)/gmock \
   -I$(srcdir)/gmock/include \
   $(NULL)
 
 include $(topsrcdir)/config/rules.mk
--- a/testing/mochitest/mach_commands.py
+++ b/testing/mochitest/mach_commands.py
@@ -134,17 +134,17 @@ class MochitestRunner(MozbuildObject):
         options = parser.parse_args([])[0]
 
         if test_path:
             test_root_file = mozpack.path.join(self.mochitest_dir, 'tests', test_path)
             if not os.path.exists(test_root_file):
                 print('Specified test path does not exist: %s' % test_root_file)
                 return 1
             options.testPath = test_path
-        elif conditions.is_b2g_desktop:
+        elif conditions.is_b2g_desktop(self):
             options.testManifest = 'b2g-desktop.json'
         else:
             options.testManifest = 'b2g.json'
 
         for k, v in kwargs.iteritems():
             setattr(options, k, v)
         options.noWindow = no_window
         options.totalChunks = total_chunks
--- a/toolkit/components/protobuf/Makefile.in
+++ b/toolkit/components/protobuf/Makefile.in
@@ -1,19 +1,8 @@
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-VPATH = \
-  @srcdir@ \
-  @srcdir@/google/protobuf \
-  @srcdir@/google/protobuf/io \
-  @srcdir@/google/protobuf/stubs \
-  $(NULL)
-
-LOCAL_INCLUDES = \
-  -I$(srcdir) \
-  $(NULL)
-
 include $(topsrcdir)/config/rules.mk
 
 CXXFLAGS += $(TK_CFLAGS) -DGOOGLE_PROTOBUF_NO_RTTI
--- a/toolkit/crashreporter/nsExceptionHandler.cpp
+++ b/toolkit/crashreporter/nsExceptionHandler.cpp
@@ -101,17 +101,16 @@ using namespace mozilla;
 using mozilla::dom::CrashReporterChild;
 using mozilla::dom::PCrashReporterChild;
 
 namespace CrashReporter {
 
 #ifdef XP_WIN32
 typedef wchar_t XP_CHAR;
 typedef std::wstring xpstring;
-#define CONVERT_UTF16_TO_XP_CHAR(x) x
 #define CONVERT_XP_CHAR_TO_UTF16(x) x
 #define XP_STRLEN(x) wcslen(x)
 #define my_strlen strlen
 #define CRASH_REPORTER_FILENAME "crashreporter.exe"
 #define PATH_SEPARATOR "\\"
 #define XP_PATH_SEPARATOR L"\\"
 // sort of arbitrary, but MAX_PATH is kinda small
 #define XP_PATH_MAX 4096
@@ -121,17 +120,16 @@ typedef std::wstring xpstring;
 #define XP_TTOA(time, buffer, base) ltoa(time, buffer, base)
 #else
 #define XP_TTOA(time, buffer, base) _i64toa(time, buffer, base)
 #endif
 #define XP_STOA(size, buffer, base) _ui64toa(size, buffer, base)
 #else
 typedef char XP_CHAR;
 typedef std::string xpstring;
-#define CONVERT_UTF16_TO_XP_CHAR(x) NS_ConvertUTF16toUTF8(x)
 #define CONVERT_XP_CHAR_TO_UTF16(x) NS_ConvertUTF8toUTF16(x)
 #define CRASH_REPORTER_FILENAME "crashreporter"
 #define PATH_SEPARATOR "/"
 #define XP_PATH_SEPARATOR "/"
 #define XP_PATH_MAX PATH_MAX
 #ifdef XP_LINUX
 #define XP_STRLEN(x) my_strlen(x)
 #define XP_TTOA(time, buffer, base) my_inttostring(time, buffer, sizeof(buffer))
@@ -866,17 +864,17 @@ nsresult SetExceptionHandler(nsIFile* aX
 #endif
 
     exePath->AppendNative(NS_LITERAL_CSTRING(CRASH_REPORTER_FILENAME));
 
 #ifdef XP_WIN32
     nsString crashReporterPath_temp;
 
     exePath->GetPath(crashReporterPath_temp);
-    crashReporterPath = ToNewUnicode(crashReporterPath_temp);
+    crashReporterPath = reinterpret_cast<wchar_t*>(ToNewUnicode(crashReporterPath_temp));
 #elif !defined(__ANDROID__)
     nsCString crashReporterPath_temp;
 
     exePath->GetNativePath(crashReporterPath_temp);
     crashReporterPath = ToNewCString(crashReporterPath_temp);
 #else
     // On Android, we launch using the application package name
     // instead of a filename, so use ANDROID_PACKAGE_NAME to do that here.
@@ -1091,22 +1089,23 @@ bool GetMinidumpPath(nsAString& aPath)
   return true;
 }
 
 nsresult SetMinidumpPath(const nsAString& aPath)
 {
   if (!gExceptionHandler)
     return NS_ERROR_NOT_INITIALIZED;
 
-#ifndef XP_LINUX
-  gExceptionHandler->set_dump_path(
-      CONVERT_UTF16_TO_XP_CHAR(aPath).BeginReading());
+#ifdef XP_WIN32
+  gExceptionHandler->set_dump_path(char16ptr_t(aPath.BeginReading()));
+#elif defined(XP_LINUX)
+  gExceptionHandler->set_minidump_descriptor(
+      MinidumpDescriptor(NS_ConvertUTF16toUTF8(aPath).BeginReading()));
 #else
-  gExceptionHandler->set_minidump_descriptor(
-      MinidumpDescriptor(CONVERT_UTF16_TO_XP_CHAR(aPath).BeginReading()));
+  gExceptionHandler->set_dump_path(NS_ConvertUTF16toUTF8(aPath).BeginReading());
 #endif
   return NS_OK;
 }
 
 static nsresult
 WriteDataToFile(nsIFile* aFile, const nsACString& data)
 {
   PRFileDesc* fd;
@@ -1917,17 +1916,17 @@ FindPendingDir()
   }
   else {
     pendingDir->Append(NS_LITERAL_STRING("Crash Reports"));
     pendingDir->Append(NS_LITERAL_STRING("pending"));
 
 #ifdef XP_WIN
     nsString path;
     pendingDir->GetPath(path);
-    pendingDirectory = ToNewUnicode(path);
+    pendingDirectory = reinterpret_cast<wchar_t*>(ToNewUnicode(path));
 #else
     nsCString path;
     pendingDir->GetNativePath(path);
     pendingDirectory = ToNewCString(path);
 #endif
   }
 }
 
@@ -2498,17 +2497,17 @@ SetRemoteExceptionHandler(const nsACStri
 
   gExceptionHandler = new google_breakpad::
     ExceptionHandler(L"",
                      FPEFilter,
                      nullptr,    // no minidump callback
                      nullptr,    // no callback context
                      google_breakpad::ExceptionHandler::HANDLER_ALL,
                      MiniDumpNormal,
-                     NS_ConvertASCIItoUTF16(crashPipe).BeginReading(),
+                     NS_ConvertASCIItoUTF16(crashPipe).get(),
                      nullptr);
 #ifdef XP_WIN
   gExceptionHandler->set_handle_debug_exceptions(true);
 #endif
 
   // we either do remote or nothing, no fallback to regular crash reporting
   return gExceptionHandler->IsOutOfProcess();
 }
--- a/toolkit/library/Makefile.in
+++ b/toolkit/library/Makefile.in
@@ -9,18 +9,16 @@ ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
 # "libxul.dylib"
 SHARED_LIBRARY_NAME=XUL
 # Setting MAKE_FRAMEWORK makes DLL_PREFIX and DLL_SUFFIX be ignored when
 # setting SHARED_LIBRARY; we need to leave DLL_PREFIX and DLL_SUFFIX
 # as-is so that dependencies of the form -ltracemalloc still work.
 MAKE_FRAMEWORK=1
 endif
 
-VPATH += $(topsrcdir)/build/
-
 ifdef MOZ_CONTENT_SANDBOX
 ifeq ($(OS_ARCH),WINNT)
   LOCAL_INCLUDES += -I$(srcdir)/../sandboxbroker
   SHARED_LIBRARY_LIBS += ../../security/sandbox/win/src/sandboxbroker/$(LIB_PREFIX)sandboxbroker.$(LIB_SUFFIX)
 endif
 endif
 
 # COMPONENT_LIBS is mosly useless since bug 935881, but is kept for
@@ -430,13 +428,14 @@ gtestxul: $(GTEST_LIB)
 endif
 
 ifdef LINK_GTEST
 
 COMPONENT_LIBS += \
   gtest \
   gfxtest \
   ssltest \
+  xpcom_glue_gtest \
   $(NULL)
 endif
 
 $(FINAL_TARGET)/dependentlibs.list: dependentlibs.py $(SHARED_LIBRARY) $(wildcard $(if $(wildcard $(FINAL_TARGET)/dependentlibs.list),$(addprefix $(FINAL_TARGET)/,$(shell cat $(FINAL_TARGET)/dependentlibs.list))))
 	$(PYTHON) $< $(SHARED_LIBRARY) -L $(FINAL_TARGET) $(if $(TOOLCHAIN_PREFIX),$(addprefix -p ,$(TOOLCHAIN_PREFIX))) > $@
--- a/toolkit/library/moz.build
+++ b/toolkit/library/moz.build
@@ -1,17 +1,14 @@
 # -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-if CONFIG['MOZ_METRO'] and CONFIG['OS_ARCH'] == 'WINNT':
-    DIRS += ['winvccorlib']
-
 LIBRARY_NAME = 'xul'
 
 SOURCES += [
     'nsStaticXULComponents.cpp',
 ]
 
 if CONFIG['OS_ARCH'] == 'WINNT':
     SOURCES += [
--- a/toolkit/library/nsDllMain.cpp
+++ b/toolkit/library/nsDllMain.cpp
@@ -1,26 +1,18 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  
 #include <windows.h>
-#if defined(_WIN32_WINNT_WIN8) && defined(_MSC_VER) && _MSC_VER < 1700
-// The Windows 8 SDK defines FACILITY_VISUALCPP in winerror.h, and MSVC
-// defines it in delayimp.h previous to VS2012.
-#undef FACILITY_VISUALCPP
-#endif
-#include <delayimp.h>
 #include "nsToolkit.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/WindowsVersion.h"
 
-using mozilla::IsWin8OrLater;
-
 #if defined(__GNUC__)
 // If DllMain gets name mangled, it won't be seen.
 extern "C" {
 #endif
 
 BOOL APIENTRY DllMain(  
                       HINSTANCE hModule, 
                       DWORD reason, 
@@ -41,88 +33,11 @@ BOOL APIENTRY DllMain(
             nsToolkit::Shutdown();
             break;
 
     }
 
     return TRUE;
 }
 
-#if defined(MOZ_METRO)
-/*
- * DelayDllLoadHook - the crt calls here anytime a delay load dll is about to
- * load. There are a number of events, we listen for dliNotePreLoadLibrary.
- * 
- * On Win8, we enable Windows Runtime Component Extension support. When enabled
- * the compiler bakes auto-generated code into our binary, including a c init-
- * ializer which inits the winrt library through a call into the winrt standard
- * lib 'vccorlib'. Vccorlib in turn has system dll dependencies which are only
- * available on Win8 (currently API-MS-WIN-CORE-WINRT and
- * API-MS-WIN-CORE-WINRT-STRING), which prevent xul.dll from loading on os <=
- * Win7. To get around this we generate a dummy vccore lib with the three entry
- * points the initializer needs and load it in place of the real vccorlib. We
- * also have to add vccorlib and the system dlls to the delay load list.
- *
- * In addition to setting up dummyvccorlib, we also have additional checks for
- * for unexpected behavior, specifically:
- * - trap attempts to load entry points in dummyvccorlib. This is not expected
- *   to happen in release code. It can happen during development if winrt apis
- *   are accessed when running on the desktop, or when winrt objects are
- *   accidentially placed in the global scope.
- * - trap and handle calls to vccorlib's __abi_FailFast in a breakpad compatible
- *   way. __abi_FailFast is called by exception handling code generated by the
- *   compiler for delegate events.
- */
-
-const char* kvccorlib = "vccorlib";
-const char* kwinrtprelim = "api-ms-win-core-winrt";
-const char* kfailfast = "?__abi_FailFast";
-
-static bool IsWinRTDLLNotPresent(PDelayLoadInfo pdli, const char* aLibToken)
-{
-  return (!IsWin8OrLater() && pdli->szDll &&
-          !strnicmp(pdli->szDll, aLibToken, strlen(aLibToken)));
-}
-
-static bool IsWinRTDLLPresent(PDelayLoadInfo pdli, const char* aLibToken)
-{
-  return (IsWin8OrLater() && pdli->szDll &&
-          !strnicmp(pdli->szDll, aLibToken, strlen(aLibToken)));
-}
-
-void __stdcall __abi_MozFailFast()
-{
-  MOZ_CRASH();
-}
-
-FARPROC WINAPI DelayDllLoadHook(unsigned dliNotify, PDelayLoadInfo pdli)
-{
-  if (dliNotify == dliNotePreLoadLibrary) {
-    if (IsWinRTDLLNotPresent(pdli, kvccorlib)) {
-      return (FARPROC)LoadLibraryA("dummyvccorlib.dll");
-    }
-    NS_ASSERTION(!IsWinRTDLLNotPresent(pdli, kwinrtprelim),
-      "Attempting to load winrt libs in non-metro environment. "
-      "(Winrt variable type placed in global scope?)");
-  }
-  if (dliNotify == dliFailGetProc && IsWinRTDLLNotPresent(pdli, kvccorlib)) {
-    NS_WARNING("Attempting to access winrt vccorlib entry point in non-metro environment.");
-    NS_WARNING(pdli->szDll);
-    NS_WARNING(pdli->dlp.szProcName);
-    NS_ABORT();
-  }
-  if (dliNotify == dliNotePreGetProcAddress &&
-      IsWinRTDLLPresent(pdli, kvccorlib) &&
-      pdli->dlp.szProcName &&
-      !strnicmp(pdli->dlp.szProcName, kfailfast, strlen(kfailfast))) {
-    return (FARPROC)__abi_MozFailFast;
-  }
-  return nullptr;
-}
-
-ExternC PfnDliHook __pfnDliNotifyHook2 = DelayDllLoadHook;
-ExternC PfnDliHook __pfnDliFailureHook2 = DelayDllLoadHook;
-
-#endif // MOZ_METRO
-
 #if defined(__GNUC__)
 } // extern "C"
 #endif
deleted file mode 100644
--- a/toolkit/library/winvccorlib/dummyvccorlib.cpp
+++ /dev/null
@@ -1,20 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include <windows.h>
-
-// A dummy vccorlib.dll for shunting winrt initialization calls when we are not
-// using the winrt library. For a longer explanantion see nsDllMain.cpp.
-
-extern "C" {
-__declspec(dllexport) long __stdcall __InitializeWinRTRuntime(unsigned long data) { return S_OK; }
-}
-
-namespace Platform {
-namespace Details {
-__declspec(dllexport) HRESULT InitializeData(int __threading_model) { return S_OK; }
-__declspec(dllexport) void UninitializeData(int __threading_model) { }
-}
-}
deleted file mode 100644
--- a/toolkit/library/winvccorlib/moz.build
+++ /dev/null
@@ -1,17 +0,0 @@
-# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# When we're linking GTest we recurse into this directory but don't need
-# to generate this library
-if not CONFIG['LINK_GTEST']:
-    LIBRARY_NAME = 'dummyvccorlib'
-
-    FORCE_SHARED_LIB = True
-
-SOURCES += [
-    'dummyvccorlib.cpp',
-]
-
--- a/toolkit/modules/SpatialNavigation.jsm
+++ b/toolkit/modules/SpatialNavigation.jsm
@@ -120,16 +120,38 @@ function _onInputKeyPress (event, callba
   // loaded, and this is the first keypress in the page.
   if (currentlyFocused instanceof Ci.nsIDOMHTMLBodyElement) {
     focusManager.moveFocus(currentlyFocusedWindow, null, focusManager.MOVEFOCUS_FIRST, 0);
     event.stopPropagation();
     event.preventDefault();
     return;
   }
 
+  if ((currentlyFocused instanceof Ci.nsIDOMHTMLInputElement &&
+      currentlyFocused.mozIsTextField(false)) ||
+      currentlyFocused instanceof Ci.nsIDOMHTMLTextAreaElement) {
+    // If there is a text selection, remain in the element.
+    if (currentlyFocused.selectionEnd - currentlyFocused.selectionStart != 0) {
+      return;
+    }
+
+    // If there is no text, there is nothing special to do.
+    if (currentlyFocused.textLength > 0) {
+      if (key == PrefObserver['keyCodeRight'] ||
+          key == PrefObserver['keyCodeDown'] ) {
+        // We are moving forward into the document.
+        if (currentlyFocused.textLength != currentlyFocused.selectionEnd) {
+          return;
+        }
+      } else if (currentlyFocused.selectionStart != 0) {
+        return;
+      }
+    }
+  }
+
   let windowUtils = currentlyFocusedWindow.QueryInterface(Ci.nsIInterfaceRequestor)
                                           .getInterface(Ci.nsIDOMWindowUtils);
   let cssPageRect = _getRootBounds(windowUtils);
   let searchRect = _getSearchRect(currentlyFocused, key, cssPageRect);
 
   let nodes = {};
   nodes.length = 0;
 
--- a/uriloader/exthandler/Makefile.in
+++ b/uriloader/exthandler/Makefile.in
@@ -1,38 +1,13 @@
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-ifeq ($(MOZ_WIDGET_TOOLKIT),os2)
-OSDIR		= os2
-else
-ifeq ($(MOZ_WIDGET_TOOLKIT),windows)
-OSDIR		= win
-else
-ifeq ($(MOZ_WIDGET_TOOLKIT),cocoa)
-OSDIR		= mac
-else
-ifeq ($(MOZ_WIDGET_TOOLKIT),android)
-OSDIR		= android
-else
-ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
-OSDIR		= gonk
-else
-OSDIR		= unix
-endif
-endif
-endif
-endif
-endif
-
-VPATH		:= $(srcdir) $(srcdir)/$(OSDIR)
-
-
 LOCAL_INCLUDES = -I$(srcdir)
 
 LOCAL_INCLUDES += -I$(topsrcdir)/dom/base \
             -I$(topsrcdir)/dom/ipc \
             -I$(topsrcdir)/content/base/src \
             -I$(topsrcdir)/content/events/src \
             -I$(topsrcdir)/netwerk/base/src \
             -I$(topsrcdir)/netwerk/protocol/http
--- a/widget/gonk/Makefile.in
+++ b/widget/gonk/Makefile.in
@@ -7,21 +7,16 @@
 #     http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-VPATH           = \
-  $(srcdir) \
-  $(srcdir)/libui \
-  $(NULL)
-
 include $(topsrcdir)/config/rules.mk
 
 CXXFLAGS += \
 	-I$(ANDROID_SOURCE)/hardware/libhardware/include \
 	-I$(ANDROID_SOURCE)/hardware/libhardware_legacy/include \
 	-I$(ANDROID_SOURCE)/frameworks/native/opengl/include \
 	$(NULL)
 
--- a/widget/gonk/ParentProcessController.cpp
+++ b/widget/gonk/ParentProcessController.cpp
@@ -27,17 +27,17 @@ public:
         nsCOMPtr<nsIContent> content = nsLayoutUtils::FindContentFor(mFrameMetrics.mScrollId);
         if (content) {
             APZCCallbackHelper::UpdateSubFrame(content, mFrameMetrics);
         }
         return NS_OK;
     }
 
 protected:
-    const FrameMetrics mFrameMetrics;
+    FrameMetrics mFrameMetrics;
 };
 
 void
 ParentProcessController::RequestContentRepaint(const FrameMetrics& aFrameMetrics)
 {
     if (aFrameMetrics.mScrollId == FrameMetrics::NULL_SCROLL_ID) {
         return;
     }
--- a/widget/xpwidgets/APZCCallbackHelper.cpp
+++ b/widget/xpwidgets/APZCCallbackHelper.cpp
@@ -67,27 +67,25 @@ MaybeAlignAndClampDisplayPort(mozilla::l
   // Correct the display-port by the difference between the requested scroll
   // offset and the resulting scroll offset after setting the requested value.
   CSSRect& displayPort = aFrameMetrics.mDisplayPort;
   displayPort += aActualScrollOffset - aFrameMetrics.mScrollOffset;
 
   // Expand the display port to the next tile boundaries, if tiled thebes layers
   // are enabled.
   if (Preferences::GetBool("layers.force-tiles")) {
-    // aFrameMetrics.mZoom is the zoom amount reported by the APZC,
-    // scale by ScreenToLayerScale to get the gecko zoom amount
     displayPort =
       ExpandDisplayPortToTileBoundaries(displayPort + aActualScrollOffset,
-                                        aFrameMetrics.mZoom * ScreenToLayerScale(1))
+                                        aFrameMetrics.LayersPixelsPerCSSPixel())
       - aActualScrollOffset;
   }
 
   // Finally, clamp the display port to the scrollable rect.
   CSSRect scrollableRect = aFrameMetrics.mScrollableRect;
-  displayPort = scrollableRect.ClampRect(displayPort + aActualScrollOffset)
+  displayPort = scrollableRect.Intersect(displayPort + aActualScrollOffset)
     - aActualScrollOffset;
 }
 
 void
 APZCCallbackHelper::UpdateRootFrame(nsIDOMWindowUtils* aUtils,
                                     FrameMetrics& aMetrics)
 {
     // Precondition checks
@@ -148,45 +146,50 @@ APZCCallbackHelper::UpdateRootFrame(nsID
                                      aMetrics.mDisplayPort.y,
                                      aMetrics.mDisplayPort.width,
                                      aMetrics.mDisplayPort.height,
                                      element);
 }
 
 void
 APZCCallbackHelper::UpdateSubFrame(nsIContent* aContent,
-                                   const FrameMetrics& aMetrics)
+                                   FrameMetrics& aMetrics)
 {
     // Precondition checks
     MOZ_ASSERT(aContent);
     if (aMetrics.mScrollId == FrameMetrics::NULL_SCROLL_ID) {
         return;
     }
 
     nsCOMPtr<nsIDOMWindowUtils> utils = GetDOMWindowUtils(aContent);
     if (!utils) {
         return;
     }
 
     // We currently do not support zooming arbitrary subframes. They can only
     // be scrolled, so here we only have to set the scroll position and displayport.
 
+    CSSPoint actualScrollOffset;
     nsIScrollableFrame* sf = nsLayoutUtils::FindScrollableFrameFor(aMetrics.mScrollId);
     if (sf) {
         sf->ScrollToCSSPixelsApproximate(aMetrics.mScrollOffset);
+        actualScrollOffset = CSSPoint::FromAppUnits(sf->GetScrollPosition());
     }
 
     nsCOMPtr<nsIDOMElement> element = do_QueryInterface(aContent);
     if (element) {
+        MaybeAlignAndClampDisplayPort(aMetrics, actualScrollOffset);
         utils->SetDisplayPortForElement(aMetrics.mDisplayPort.x,
                                         aMetrics.mDisplayPort.y,
                                         aMetrics.mDisplayPort.width,
                                         aMetrics.mDisplayPort.height,
                                         element);
     }
+
+    aMetrics.mScrollOffset = actualScrollOffset;
 }
 
 already_AddRefed<nsIDOMWindowUtils>
 APZCCallbackHelper::GetDOMWindowUtils(const nsIDocument* aDoc)
 {
     nsCOMPtr<nsIDOMWindowUtils> utils;
     nsCOMPtr<nsIDOMWindow> window = aDoc->GetDefaultView();
     if (window) {
--- a/widget/xpwidgets/APZCCallbackHelper.h
+++ b/widget/xpwidgets/APZCCallbackHelper.h
@@ -37,19 +37,23 @@ public:
        layers are enabled, this will align the displayport to tile boundaries.
        Setting the scroll position can cause some small adjustments to be made
        to the actual scroll position. aMetrics' display port and scroll position
        will be updated with any modifications made. */
     static void UpdateRootFrame(nsIDOMWindowUtils* aUtils,
                                 FrameMetrics& aMetrics);
 
     /* Applies the scroll parameters from the given FrameMetrics object to the subframe
-       corresponding to the given content object. */
+       corresponding to the given content object. If tiled thebes
+       layers are enabled, this will align the displayport to tile boundaries.
+       Setting the scroll position can cause some small adjustments to be made
+       to the actual scroll position. aMetrics' display port and scroll position
+       will be updated with any modifications made. */
     static void UpdateSubFrame(nsIContent* aContent,
-                               const FrameMetrics& aMetrics);
+                               FrameMetrics& aMetrics);
 
     /* Get the DOMWindowUtils for the window corresponding to the given document. */
     static already_AddRefed<nsIDOMWindowUtils> GetDOMWindowUtils(const nsIDocument* aDoc);
 
     /* Get the DOMWindowUtils for the window corresponding to the givent content
        element. This might be an iframe inside the tab, for instance. */
     static already_AddRefed<nsIDOMWindowUtils> GetDOMWindowUtils(const nsIContent* aContent);
 
--- a/xpcom/base/nsMemoryInfoDumper.cpp
+++ b/xpcom/base/nsMemoryInfoDumper.cpp
@@ -1,17 +1,17 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/nsMemoryInfoDumper.h"
 
-#ifdef XP_LINUX
+#if defined(XP_LINUX) || defined(__FreeBSD__)
 #include "mozilla/Preferences.h"
 #endif
 #include "mozilla/unused.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/ContentChild.h"
 #include "nsIConsoleService.h"
 #include "nsICycleCollectorListener.h"
 #include "nsIMemoryReporter.h"
@@ -26,17 +26,17 @@
 
 #ifdef XP_WIN
 #include <process.h>
 #define getpid _getpid
 #else
 #include <unistd.h>
 #endif
 
-#ifdef XP_LINUX
+#if defined(XP_LINUX) || defined(__FreeBSD__)
 #include <fcntl.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #endif
 
 #ifdef ANDROID
 #include "android/log.h"
 #endif
@@ -105,17 +105,17 @@ public:
 private:
   const nsString mIdentifier;
   const bool mDumpAllTraces;
   const bool mDumpChildProcesses;
 };
 
 } // anonymous namespace
 
-#ifdef XP_LINUX // {
+#if defined(XP_LINUX) || defined(__FreeBSD__) // {
 namespace {
 
 /*
  * The following code supports dumping about:memory upon receiving a signal.
  *
  * We listen for the following signals:
  *
  *  - SIGRTMIN:     Dump our memory reporters (and those of our child
@@ -547,17 +547,17 @@ nsMemoryInfoDumper::nsMemoryInfoDumper()
 
 nsMemoryInfoDumper::~nsMemoryInfoDumper()
 {
 }
 
 /* static */ void
 nsMemoryInfoDumper::Initialize()
 {
-#ifdef XP_LINUX
+#if defined(XP_LINUX) || defined(__FreeBSD__)
   SignalPipeWatcher::Create();
   FifoWatcher::MaybeCreate();
 #endif
 }
 
 static void
 EnsureNonEmptyIdentifier(nsAString& aIdentifier)
 {
--- a/xpcom/base/nsMemoryReporterManager.cpp
+++ b/xpcom/base/nsMemoryReporterManager.cpp
@@ -12,17 +12,17 @@
 #include "nsMemoryReporterManager.h"
 #include "nsISimpleEnumerator.h"
 #include "nsITimer.h"
 #include "nsThreadUtils.h"
 #include "nsIDOMWindow.h"
 #include "nsPIDOMWindow.h"
 #include "nsIObserverService.h"
 #include "nsIGlobalObject.h"
-#if defined(XP_LINUX)
+#if defined(XP_LINUX) || defined(__FreeBSD__)
 #include "nsMemoryInfoDumper.h"
 #endif
 #include "mozilla/Attributes.h"
 #include "mozilla/PodOperations.h"
 #include "mozilla/Services.h"
 #include "mozilla/Telemetry.h"
 #include "mozilla/dom/PMemoryReportRequestParent.h" // for dom::MemoryReport
 
@@ -893,17 +893,17 @@ nsMemoryReporterManager::Init()
 #endif
 
     RegisterStrongReporter(new AtomTablesReporter());
 
 #ifdef MOZ_DMD
     RegisterStrongReporter(new mozilla::dmd::DMDReporter());
 #endif
 
-#if defined(XP_LINUX)
+#if defined(XP_LINUX) || defined(__FreeBSD__)
     nsMemoryInfoDumper::Initialize();
 #endif
 
     return NS_OK;
 }
 
 namespace {
 
--- a/xpcom/ds/TimeStamp_windows.cpp
+++ b/xpcom/ds/TimeStamp_windows.cpp
@@ -2,20 +2,16 @@
 /* vim:set ts=2 sw=2 sts=2 et cindent: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // Implement TimeStamp::Now() with QueryPerformanceCounter() controlled with
 // values of GetTickCount().
 
-// XXX Forcing log to be able to catch issues in the field.  Should be removed
-// before this reaches the Release or even Beta channel.
-#define FORCE_PR_LOG
-
 #include "mozilla/MathAlgorithms.h"
 #include "mozilla/Mutex.h"
 #include "mozilla/TimeStamp.h"
 #include "nsWindowsHelpers.h"
 #include <windows.h>
 
 #include "nsCRT.h"
 #include "prlog.h"
--- a/xpcom/glue/moz.build
+++ b/xpcom/glue/moz.build
@@ -103,8 +103,11 @@ SDK_LIBRARY = [
 
 FORCE_STATIC_LIB = True
 
 if CONFIG['_MSC_VER']:
     DEFINES['_USE_ANSI_CPP'] = True
 
 if CONFIG['TARGET_XPCOM_ABI']:
     DEFINES['TARGET_XPCOM_ABI'] = '"%s"' % CONFIG['TARGET_XPCOM_ABI']
+
+if CONFIG['ENABLE_TESTS']:
+    DIRS += ['tests/gtest']
--- a/xpcom/glue/tests/gtest/TestFileUtils.cpp
+++ b/xpcom/glue/tests/gtest/TestFileUtils.cpp
@@ -7,17 +7,16 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <string.h>
-#include <unistd.h>
 
 #include "FileUtils.h"
 
 #include "gtest/gtest.h"
 
 namespace mozilla {
 
 #ifdef ReadSysFile_PRESENT
--- a/xpcom/tests/Makefile.in
+++ b/xpcom/tests/Makefile.in
@@ -1,14 +1,12 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-VPATH += $(topsrcdir)/build
-
 LIBS += $(XPCOM_LIBS)
 
 # Make sure we have symbols in case we need to debug these.
 MOZ_DEBUG_SYMBOLS = 1
 
 include $(topsrcdir)/config/rules.mk
 
 LOCAL_INCLUDES	= \