Merge m-c onto Ionmonkey.
authorSean Stangl <sstangl@mozilla.com>
Thu, 31 May 2012 17:17:52 -0700
changeset 112562 474d3f16960fb6bc790f0f46b77d0248424b84ef
parent 112561 f55395bc4e6135df5532fa68bf73c39782fcff71 (diff)
parent 99413 4411b40ef38e56a4be310af0900cacec212803b6 (current diff)
child 112563 16141b0a3d124b4312a014b20924b33b9cefae6f
push id1708
push userakeybl@mozilla.com
push dateMon, 19 Nov 2012 21:10:21 +0000
treeherdermozilla-beta@27b14fe50103 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone15.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge m-c onto Ionmonkey.
accessible/public/nsIAccessibilityService.h
accessible/src/atk/AccessibleWrap.cpp
accessible/src/atk/AccessibleWrap.h
accessible/src/atk/ApplicationAccessibleWrap.cpp
accessible/src/atk/ApplicationAccessibleWrap.h
accessible/src/atk/DocAccessibleWrap.h
accessible/src/atk/nsAccessibleWrap.cpp
accessible/src/atk/nsAccessibleWrap.h
accessible/src/atk/nsDocAccessibleWrap.cpp
accessible/src/atk/nsDocAccessibleWrap.h
accessible/src/atk/nsMaiInterfaceTable.cpp
accessible/src/atk/nsTextAccessibleWrap.h
accessible/src/base/AccEvent.cpp
accessible/src/base/AccEvent.h
accessible/src/base/AccIterator.cpp
accessible/src/base/AccIterator.h
accessible/src/base/Makefile.in
accessible/src/base/NotificationController.cpp
accessible/src/base/NotificationController.h
accessible/src/base/TextAttrs.cpp
accessible/src/base/TextAttrs.h
accessible/src/base/nsARIAMap.h
accessible/src/base/nsAccDocManager.cpp
accessible/src/base/nsAccDocManager.h
accessible/src/base/nsAccTreeWalker.cpp
accessible/src/base/nsAccTreeWalker.h
accessible/src/base/nsAccUtils.cpp
accessible/src/base/nsAccUtils.h
accessible/src/base/nsAccessNode.cpp
accessible/src/base/nsAccessNode.h
accessible/src/base/nsAccessibilityService.cpp
accessible/src/base/nsAccessibilityService.h
accessible/src/base/nsAccessible.cpp
accessible/src/base/nsAccessible.h
accessible/src/base/nsBaseWidgetAccessible.h
accessible/src/base/nsCaretAccessible.cpp
accessible/src/base/nsCoreUtils.cpp
accessible/src/base/nsDocAccessible.cpp
accessible/src/base/nsDocAccessible.h
accessible/src/base/nsEventShell.cpp
accessible/src/base/nsEventShell.h
accessible/src/base/nsTextAccessible.cpp
accessible/src/base/nsTextAccessible.h
accessible/src/base/nsTextEquivUtils.cpp
accessible/src/base/nsTextEquivUtils.h
accessible/src/generic/ARIAGridAccessible.cpp
accessible/src/generic/ARIAGridAccessible.h
accessible/src/generic/Accessible.cpp
accessible/src/generic/Accessible.h
accessible/src/generic/ApplicationAccessible.cpp
accessible/src/generic/ApplicationAccessible.h
accessible/src/generic/DocAccessible.cpp
accessible/src/generic/DocAccessible.h
accessible/src/generic/FormControlAccessible.cpp
accessible/src/generic/FormControlAccessible.h
accessible/src/generic/OuterDocAccessible.cpp
accessible/src/generic/OuterDocAccessible.h
accessible/src/generic/RootAccessible.cpp
accessible/src/generic/RootAccessible.h
accessible/src/html/HTMLFormControlAccessible.cpp
accessible/src/html/HTMLFormControlAccessible.h
accessible/src/html/nsHTMLImageAccessible.cpp
accessible/src/html/nsHTMLImageAccessible.h
accessible/src/html/nsHTMLImageMapAccessible.cpp
accessible/src/html/nsHTMLLinkAccessible.cpp
accessible/src/html/nsHTMLLinkAccessible.h
accessible/src/html/nsHTMLSelectAccessible.cpp
accessible/src/html/nsHTMLSelectAccessible.h
accessible/src/html/nsHTMLTableAccessible.cpp
accessible/src/html/nsHTMLTableAccessible.h
accessible/src/html/nsHyperTextAccessible.cpp
accessible/src/html/nsHyperTextAccessible.h
accessible/src/mac/AccessibleWrap.h
accessible/src/mac/AccessibleWrap.mm
accessible/src/mac/DocAccessibleWrap.h
accessible/src/mac/DocAccessibleWrap.mm
accessible/src/mac/mozTextAccessible.mm
accessible/src/mac/nsAccessibleWrap.h
accessible/src/mac/nsAccessibleWrap.mm
accessible/src/mac/nsDocAccessibleWrap.h
accessible/src/mac/nsDocAccessibleWrap.mm
accessible/src/mac/nsTextAccessibleWrap.h
accessible/src/msaa/AccessibleWrap.cpp
accessible/src/msaa/CAccessibleText.cpp
accessible/src/msaa/CAccessibleText.h
accessible/src/msaa/DocAccessibleWrap.cpp
accessible/src/msaa/TextLeafAccessibleWrap.cpp
accessible/src/msaa/TextLeafAccessibleWrap.h
accessible/src/msaa/nsAccessNodeWrap.cpp
accessible/src/msaa/nsAccessNodeWrap.h
accessible/src/msaa/nsAccessibleWrap.cpp
accessible/src/msaa/nsAccessibleWrap.h
accessible/src/msaa/nsDocAccessibleWrap.cpp
accessible/src/msaa/nsDocAccessibleWrap.h
accessible/src/msaa/nsHyperTextAccessibleWrap.cpp
accessible/src/msaa/nsHyperTextAccessibleWrap.h
accessible/src/msaa/nsTextAccessibleWrap.cpp
accessible/src/msaa/nsTextAccessibleWrap.h
accessible/src/other/nsAccessibleWrap.cpp
accessible/src/other/nsAccessibleWrap.h
accessible/src/other/nsDocAccessibleWrap.h
accessible/src/other/nsTextAccessibleWrap.h
accessible/src/xforms/nsXFormsAccessible.cpp
accessible/src/xforms/nsXFormsAccessible.h
accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
accessible/src/xforms/nsXFormsFormControlsAccessible.h
accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
accessible/src/xpcom/nsAccEvent.cpp
accessible/src/xul/XULFormControlAccessible.cpp
accessible/src/xul/XULFormControlAccessible.h
accessible/src/xul/nsXULAlertAccessible.cpp
accessible/src/xul/nsXULAlertAccessible.h
accessible/src/xul/nsXULColorPickerAccessible.cpp
accessible/src/xul/nsXULColorPickerAccessible.h
accessible/src/xul/nsXULComboboxAccessible.cpp
accessible/src/xul/nsXULComboboxAccessible.h
accessible/src/xul/nsXULListboxAccessible.cpp
accessible/src/xul/nsXULListboxAccessible.h
accessible/src/xul/nsXULMenuAccessible.cpp
accessible/src/xul/nsXULMenuAccessible.h
accessible/src/xul/nsXULSliderAccessible.cpp
accessible/src/xul/nsXULSliderAccessible.h
accessible/src/xul/nsXULTabAccessible.cpp
accessible/src/xul/nsXULTreeAccessible.cpp
accessible/src/xul/nsXULTreeAccessible.h
accessible/src/xul/nsXULTreeGridAccessible.cpp
accessible/src/xul/nsXULTreeGridAccessible.h
accessible/tests/mochitest/test_OuterDocAccessible.html
b2g/app/nsBrowserApp.cpp
b2g/chrome/jar.mn
browser/app/macbuild/Contents/_CodeSignature/CodeResources
browser/app/nsBrowserApp.cpp
browser/app/profile/firefox.js
browser/base/content/browser-context.inc
browser/base/content/browser.js
browser/base/content/browser.xul
browser/base/content/highlighter.css
browser/base/content/nsContextMenu.js
browser/base/content/test/subtst_contextmenu.html
browser/base/content/test/test_contextmenu.html
browser/base/jar.mn
browser/components/nsBrowserGlue.js
browser/components/places/tests/unit/bookmarks.corrupt.html
browser/components/places/tests/unit/bookmarks.preplaces.html
browser/components/places/tests/unit/test_384370.js
browser/components/places/tests/unit/test_398914.js
browser/components/places/tests/unit/test_457441-import-export-corrupt-bookmarks-html.js
browser/components/places/tests/unit/test_bookmarksRestoreNotification.js
browser/components/places/tests/unit/test_bookmarks_html.js
browser/components/sessionstore/src/nsSessionStore.js
browser/components/sessionstore/test/Makefile.in
browser/components/shell/src/nsWindowsShellService.cpp
browser/components/shell/src/nsWindowsShellService.h
browser/devtools/highlighter/test/browser_inspector_highlighter.js
browser/devtools/shared/Templater.jsm
browser/devtools/styleinspector/StyleInspector.jsm
browser/devtools/webconsole/HUDService.jsm
browser/devtools/webconsole/PropertyPanelAsync.jsm
browser/devtools/webconsole/test/Makefile.in
browser/devtools/webconsole/test/browser_webconsole_bug_653531_highlighter_console_helper.js
browser/devtools/webconsole/test/browser_webconsole_bug_678816.js
browser/devtools/webconsole/test/browser_webconsole_consoleonpage.js
browser/devtools/webconsole/test/browser_webconsole_hud_getters.js
browser/devtools/webconsole/test/browser_webconsole_registries.js
browser/devtools/webconsole/test/test-bug-678816-content.js
browser/locales/en-US/chrome/browser/browser.dtd
browser/locales/en-US/chrome/browser/browser.properties
build/mobile/devicemanagerADB.py
build/mobile/devicemanagerSUT.py
build/mobile/robocop/Actions.java.in
chrome/src/nsChromeProtocolHandler.cpp
config/autoconf.mk.in
config/system-headers
configure.in
content/base/public/nsContentUtils.h
content/base/public/nsDeprecatedOperationList.h
content/base/public/nsIDocument.h
content/base/src/nsContentSink.cpp
content/base/src/nsContentUtils.cpp
content/base/src/nsDOMFile.cpp
content/base/src/nsDocument.cpp
content/base/src/nsDocument.h
content/base/src/nsFrameMessageManager.cpp
content/base/src/nsGenericElement.cpp
content/base/src/nsObjectLoadingContent.cpp
content/base/src/nsObjectLoadingContent.h
content/base/src/nsScriptLoader.cpp
content/base/src/nsXMLHttpRequest.cpp
content/base/src/nsXMLHttpRequest.h
content/canvas/src/DocumentRendererChild.cpp
content/canvas/src/Makefile.in
content/canvas/src/WebGLContext.cpp
content/canvas/src/WebGLContext.h
content/canvas/src/WebGLContextGL.cpp
content/canvas/src/WebGLContextUtils.cpp
content/canvas/src/WebGLContextValidate.cpp
content/canvas/src/nsCanvasRenderingContext2DAzure.cpp
content/events/src/nsContentEventHandler.cpp
content/events/src/nsIMEStateManager.cpp
content/html/content/public/nsHTMLMediaElement.h
content/html/content/src/nsGenericHTMLElement.cpp
content/html/content/src/nsHTMLAnchorElement.cpp
content/html/content/src/nsHTMLInputElement.cpp
content/html/content/src/nsHTMLMediaElement.cpp
content/html/content/src/nsHTMLTextAreaElement.cpp
content/html/content/src/nsTextEditorState.cpp
content/html/document/src/nsHTMLDocument.cpp
content/media/MediaResource.cpp
content/media/nsBuiltinDecoder.cpp
content/media/ogg/nsOggCodecState.cpp
content/media/ogg/nsOggCodecState.h
content/media/ogg/nsOggReader.cpp
content/media/ogg/nsOggReader.h
content/media/webm/nsWebMReader.cpp
content/media/webm/nsWebMReader.h
content/svg/content/src/nsSVGElement.cpp
content/svg/content/src/nsSVGSVGElement.cpp
content/xbl/public/Makefile.in
content/xbl/src/nsBindingManager.cpp
content/xbl/src/nsXBLBinding.cpp
content/xbl/src/nsXBLPrototypeBinding.h
content/xbl/src/nsXBLPrototypeResources.cpp
content/xbl/src/nsXBLResourceLoader.cpp
content/xbl/src/nsXBLService.cpp
content/xbl/src/nsXBLService.h
content/xbl/src/nsXBLWindowKeyHandler.cpp
content/xbl/src/nsXBLWindowKeyHandler.h
content/xml/document/src/nsXMLContentSink.cpp
content/xul/content/src/nsXULElement.cpp
content/xul/content/src/nsXULElement.h
content/xul/document/src/nsXULContentSink.cpp
content/xul/document/src/nsXULDocument.cpp
db/sqlite3/src/Makefile.in
docshell/base/nsDocShell.cpp
dom/Makefile.in
dom/base/nsDOMClassInfo.cpp
dom/base/nsDOMClassInfoClasses.h
dom/base/nsDOMWindowUtils.cpp
dom/base/nsFocusManager.cpp
dom/base/nsGlobalWindow.cpp
dom/base/nsGlobalWindow.h
dom/base/nsJSEnvironment.cpp
dom/base/nsPIDOMWindow.h
dom/battery/test/marionette/test_battery.py
dom/imptests/failures/webapps/WebStorage/tests/submissions/Infraware/test_event_constructor.html.json
dom/imptests/failures/webapps/WebStorage/tests/submissions/Ms2ger/test_event_constructor_js.html.json
dom/indexedDB/IDBEvents.cpp
dom/indexedDB/IDBFactory.cpp
dom/indexedDB/IndexedDatabaseManager.cpp
dom/interfaces/base/nsIDOMWindowUtils.idl
dom/interfaces/canvas/nsIDOMWebGLRenderingContext.idl
dom/interfaces/css/nsIDOMCSS2Properties.idl
dom/interfaces/storage/nsPIDOMStorage.h
dom/ipc/TabChild.cpp
dom/ipc/TabChild.h
dom/locales/en-US/chrome/dom/dom.properties
dom/plugins/base/nsNPAPIPluginInstance.cpp
dom/plugins/base/nsNPAPIPluginInstance.h
dom/plugins/base/nsPluginInstanceOwner.cpp
dom/plugins/base/nsPluginInstanceOwner.h
dom/plugins/base/nsPluginStreamListenerPeer.cpp
dom/plugins/ipc/PPluginModule.ipdl
dom/plugins/ipc/PluginInstanceChild.cpp
dom/plugins/ipc/PluginInstanceParent.cpp
dom/plugins/ipc/PluginInstanceParent.h
dom/plugins/ipc/PluginModuleChild.cpp
dom/plugins/ipc/PluginModuleParent.cpp
dom/plugins/ipc/PluginModuleParent.h
dom/plugins/test/reftest/reftest.list
dom/sms/tests/manifest.ini
dom/sms/tests/test_emulators.py
dom/src/storage/PStorage.ipdl
dom/src/storage/StorageChild.cpp
dom/src/storage/StorageChild.h
dom/src/storage/StorageParent.cpp
dom/src/storage/StorageParent.h
dom/src/storage/nsDOMStorage.cpp
dom/src/storage/nsDOMStorage.h
dom/src/storage/nsDOMStorageDBWrapper.cpp
dom/src/storage/nsDOMStorageDBWrapper.h
dom/telephony/test/marionette/test_dial_answer.py
dom/telephony/test/marionette/test_dial_between_emulators.py
dom/telephony/test/marionette/test_dial_listeners.py
dom/tests/mochitest/dom-level1-core/exclusions.js
dom/workers/RuntimeService.cpp
dom/workers/XMLHttpRequest.cpp
editor/libeditor/base/nsEditRules.h
editor/libeditor/base/nsEditorCommands.cpp
editor/libeditor/base/nsEditorEventListener.cpp
editor/libeditor/base/nsEditorEventListener.h
editor/libeditor/html/nsHTMLAbsPosition.cpp
editor/libeditor/html/nsHTMLDataTransfer.cpp
editor/libeditor/html/nsHTMLEditRules.cpp
editor/libeditor/html/nsHTMLEditRules.h
editor/libeditor/html/nsHTMLEditor.cpp
editor/libeditor/html/nsHTMLEditor.h
editor/libeditor/html/nsHTMLEditorStyle.cpp
editor/libeditor/text/nsPlaintextEditor.cpp
editor/libeditor/text/nsPlaintextEditor.h
editor/libeditor/text/nsTextEditRules.cpp
editor/libeditor/text/nsTextEditRules.h
extensions/spellcheck/hunspell/src/mozHunspell.cpp
extensions/spellcheck/src/mozEnglishWordUtils.cpp
gfx/angle/Makefile.in
gfx/angle/src/libEGL/Makefile.in
gfx/angle/src/libGLESv2/Makefile.in
gfx/gl/GLContext.h
gfx/gl/GLContextProviderCGL.mm
gfx/gl/GLContextProviderEGL.cpp
gfx/gl/GLContextProviderGLX.cpp
gfx/layers/ImageLayers.h
gfx/layers/Layers.h
gfx/layers/basic/BasicLayers.cpp
gfx/layers/d3d10/ImageLayerD3D10.cpp
gfx/layers/d3d10/ImageLayerD3D10.h
gfx/layers/ipc/ShadowLayers.cpp
gfx/skia/SkPostConfig.patch
gfx/skia/arm-fixes.patch
gfx/skia/arm-opts.patch
gfx/skia/fix-comma-end-enum-list.patch
gfx/skia/fix-gradient-clamp.patch
gfx/skia/getpostextpath.patch
gfx/skia/mingw-fix.patch
gfx/skia/new-aa.patch
gfx/skia/old-android-fonthost.patch
gfx/skia/radial-gradients.patch
gfx/skia/skia_restrict_problem.patch
gfx/skia/uninitialized-margin.patch
gfx/skia/user-config.patch
gfx/src/nsRegion.cpp
gfx/thebes/gfxASurface.cpp
gfx/thebes/gfxASurface.h
gfx/thebes/gfxAndroidPlatform.cpp
gfx/thebes/gfxAndroidPlatform.h
gfx/thebes/gfxContext.cpp
gfx/thebes/gfxDWriteFonts.h
gfx/thebes/gfxFT2FontBase.cpp
gfx/thebes/gfxFT2FontList.cpp
gfx/thebes/gfxFT2FontList.h
gfx/thebes/gfxFont.cpp
gfx/thebes/gfxFont.h
gfx/thebes/gfxFontUtils.cpp
gfx/thebes/gfxMacPlatformFontList.mm
gfx/thebes/gfxOS2Platform.cpp
gfx/thebes/gfxPattern.cpp
gfx/thebes/gfxPlatform.cpp
gfx/thebes/gfxPlatform.h
gfx/thebes/gfxPlatformGtk.cpp
gfx/thebes/gfxPlatformMac.cpp
gfx/thebes/gfxQtPlatform.cpp
gfx/thebes/gfxScriptItemizer.cpp
gfx/thebes/gfxScriptItemizer.h
gfx/thebes/gfxUserFontSet.cpp
gfx/thebes/gfxUserFontSet.h
gfx/thebes/gfxUtils.cpp
gfx/thebes/gfxWindowsPlatform.cpp
gfx/thebes/gfxWindowsSurface.cpp
intl/locale/public/nsCharsetAlias.h
intl/locale/src/nsCharsetAlias.cpp
intl/lwbrk/tests/TestLineBreak.cpp
intl/uconv/src/nsCharsetConverterManager.cpp
intl/uconv/src/nsConverterOutputStream.cpp
intl/uconv/src/nsTextToSubURI.cpp
intl/unicharutil/src/nsUnicodeNormalizer.cpp
ipc/chromium/src/base/third_party/nspr/prtime.cc
ipc/chromium/src/base/third_party/nspr/prtime.h
js/src/Makefile.in
js/src/builtin/ParallelArray.cpp
js/src/config/system-headers
js/src/configure.in
js/src/frontend/BytecodeCompiler.cpp
js/src/frontend/BytecodeEmitter.cpp
js/src/frontend/BytecodeEmitter.h
js/src/frontend/FoldConstants.cpp
js/src/frontend/ParseNode.h
js/src/frontend/Parser.cpp
js/src/frontend/Parser.h
js/src/gc/Barrier.h
js/src/gc/Marking.cpp
js/src/gc/Marking.h
js/src/gc/Root.h
js/src/ion/CodeGenerator.cpp
js/src/ion/Ion.cpp
js/src/ion/Ion.h
js/src/ion/IonBuilder.cpp
js/src/ion/IonCaches.cpp
js/src/ion/IonCompartment.h
js/src/ion/VMFunctions.cpp
js/src/jit-test/jit_test.py
js/src/js.msg
js/src/jsapi-tests/testDebugger.cpp
js/src/jsapi-tests/testVersion.cpp
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsarray.cpp
js/src/jsatom.cpp
js/src/jsbool.cpp
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jscntxtinlines.h
js/src/jscompartment.cpp
js/src/jscompartment.h
js/src/jsdate.cpp
js/src/jsdbgapi.cpp
js/src/jsexn.cpp
js/src/jsfriendapi.cpp
js/src/jsfriendapi.h
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsfuninlines.h
js/src/jsgc.cpp
js/src/jsgc.h
js/src/jsinfer.cpp
js/src/jsinfer.h
js/src/jsinferinlines.h
js/src/jsinterp.cpp
js/src/jsinterpinlines.h
js/src/jsiter.cpp
js/src/jsiter.h
js/src/jsnum.cpp
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/json.cpp
js/src/jsopcode.cpp
js/src/jsopcode.tbl
js/src/jsproxy.cpp
js/src/jsproxy.h
js/src/jsprvtd.h
js/src/jspubtd.h
js/src/jsreflect.cpp
js/src/jsscope.cpp
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jsscriptinlines.h
js/src/jsstr.cpp
js/src/jstypedarray.cpp
js/src/jstypedarrayinlines.h
js/src/jsweakcache.h
js/src/jsweakmap.cpp
js/src/jswrapper.cpp
js/src/jswrapper.h
js/src/jsxml.cpp
js/src/methodjit/Compiler.cpp
js/src/methodjit/Compiler.h
js/src/methodjit/FastOps.cpp
js/src/methodjit/InvokeHelpers.cpp
js/src/methodjit/MethodJIT.cpp
js/src/methodjit/MethodJIT.h
js/src/methodjit/MonoIC.cpp
js/src/methodjit/PolyIC.cpp
js/src/methodjit/StubCalls.cpp
js/src/shell/js.cpp
js/src/tests/browser.js
js/src/tests/shell.js
js/src/vm/ArgumentsObject.cpp
js/src/vm/ArgumentsObject.h
js/src/vm/Debugger.cpp
js/src/vm/GlobalObject.cpp
js/src/vm/RegExpObject.cpp
js/src/vm/RegExpObject.h
js/src/vm/ScopeObject.cpp
js/src/vm/Stack-inl.h
js/src/vm/Stack.cpp
js/src/vm/Stack.h
js/xpconnect/loader/mozJSComponentLoader.cpp
js/xpconnect/shell/xpcshell.cpp
js/xpconnect/src/XPCComponents.cpp
js/xpconnect/src/XPCJSRuntime.cpp
js/xpconnect/src/XPCQuickStubs.h
js/xpconnect/src/XPCRuntimeService.cpp
js/xpconnect/src/XPCWrappedNative.cpp
js/xpconnect/src/XPCWrappedNativeScope.cpp
js/xpconnect/src/nsXPConnect.cpp
js/xpconnect/src/xpcprivate.h
js/xpconnect/wrappers/AccessCheck.cpp
js/xpconnect/wrappers/WrapperFactory.cpp
js/xpconnect/wrappers/XrayWrapper.cpp
layout/base/FrameLayerBuilder.cpp
layout/base/FrameLayerBuilder.h
layout/base/nsBidi.cpp
layout/base/nsCSSFrameConstructor.cpp
layout/base/nsCSSFrameConstructor.h
layout/base/nsCSSRendering.cpp
layout/base/nsDisplayList.cpp
layout/base/nsDocumentViewer.cpp
layout/base/nsFrameManager.cpp
layout/base/nsIPresShell.h
layout/base/nsLayoutUtils.cpp
layout/base/nsLayoutUtils.h
layout/base/nsPresContext.cpp
layout/base/nsPresContext.h
layout/base/nsPresShell.cpp
layout/base/nsPresShell.h
layout/build/nsLayoutModule.cpp
layout/build/nsLayoutStatics.cpp
layout/forms/nsButtonFrameRenderer.cpp
layout/forms/nsComboboxControlFrame.cpp
layout/forms/nsComboboxControlFrame.h
layout/forms/nsFieldSetFrame.cpp
layout/forms/nsFileControlFrame.cpp
layout/forms/nsFileControlFrame.h
layout/forms/nsGfxCheckboxControlFrame.cpp
layout/forms/nsGfxCheckboxControlFrame.h
layout/forms/nsGfxRadioControlFrame.cpp
layout/forms/nsHTMLButtonControlFrame.cpp
layout/forms/nsHTMLButtonControlFrame.h
layout/forms/nsIComboboxControlFrame.h
layout/forms/nsIListControlFrame.h
layout/forms/nsImageControlFrame.cpp
layout/forms/nsListControlFrame.cpp
layout/forms/nsListControlFrame.h
layout/forms/nsTextControlFrame.cpp
layout/forms/nsTextControlFrame.h
layout/generic/nsAbsoluteContainingBlock.cpp
layout/generic/nsBRFrame.cpp
layout/generic/nsBlockFrame.cpp
layout/generic/nsBlockFrame.h
layout/generic/nsContainerFrame.cpp
layout/generic/nsFrame.cpp
layout/generic/nsFrame.h
layout/generic/nsFrameSelection.h
layout/generic/nsGfxScrollFrame.cpp
layout/generic/nsGfxScrollFrame.h
layout/generic/nsHTMLCanvasFrame.cpp
layout/generic/nsHTMLCanvasFrame.h
layout/generic/nsHTMLReflowState.cpp
layout/generic/nsIFrame.h
layout/generic/nsImageFrame.cpp
layout/generic/nsImageFrame.h
layout/generic/nsInlineFrame.cpp
layout/generic/nsInlineFrame.h
layout/generic/nsObjectFrame.cpp
layout/generic/nsObjectFrame.h
layout/generic/nsPageContentFrame.cpp
layout/generic/nsPlaceholderFrame.h
layout/generic/nsSelection.cpp
layout/generic/nsSubDocumentFrame.cpp
layout/generic/nsSubDocumentFrame.h
layout/generic/nsTextFrame.h
layout/generic/nsTextFrameThebes.cpp
layout/generic/nsVideoFrame.cpp
layout/generic/nsVideoFrame.h
layout/ipc/RenderFrameParent.cpp
layout/mathml/nsMathMLmpaddedFrame.cpp
layout/printing/nsPrintEngine.cpp
layout/reftests/border-radius/reftest.list
layout/reftests/bugs/reftest.list
layout/reftests/forms/placeholder/placeholder-15.html
layout/reftests/forms/placeholder/placeholder-16.html
layout/reftests/forms/placeholder/placeholder-17.html
layout/reftests/svg/as-image/reftest.list
layout/reftests/svg/reftest.list
layout/reftests/text-overflow/reftest.list
layout/reftests/text/reftest.list
layout/style/Declaration.cpp
layout/style/nsCSSDataBlock.cpp
layout/style/nsCSSDataBlock.h
layout/style/nsCSSRuleProcessor.cpp
layout/style/nsCSSValue.h
layout/style/nsComputedDOMStyle.cpp
layout/style/nsRuleNode.cpp
layout/style/nsRuleNode.h
layout/style/nsStyleStruct.cpp
layout/style/nsStyleStruct.h
layout/style/nsStyleUtil.cpp
layout/style/nsStyleUtil.h
layout/style/test/property_database.js
layout/svg/base/src/nsSVGContainerFrame.h
layout/tables/nsTableCellFrame.cpp
layout/tables/nsTableCellFrame.h
layout/tables/nsTableFrame.cpp
layout/tables/nsTableOuterFrame.cpp
layout/tables/nsTableOuterFrame.h
layout/tables/nsTableRowFrame.cpp
layout/tables/nsTableRowFrame.h
layout/xul/base/public/nsXULPopupManager.h
layout/xul/base/src/nsBox.cpp
layout/xul/base/src/nsBoxObject.cpp
layout/xul/base/src/nsGroupBoxFrame.cpp
layout/xul/base/src/nsListBoxBodyFrame.cpp
layout/xul/base/src/nsMenuBarFrame.cpp
layout/xul/base/src/nsMenuBarListener.cpp
layout/xul/base/src/nsSplitterFrame.cpp
layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
mfbt/CheckedInt.h
mobile/android/app/android/drawable-hdpi/alertaddons.png
mobile/android/app/android/drawable-hdpi/alertdownloads.png
mobile/android/app/android/drawable/alertaddons.png
mobile/android/app/android/drawable/alertdownloads.png
mobile/android/base/GeckoApp.java
mobile/android/base/GeckoAppShell.java
mobile/android/base/GeckoConnectivityReceiver.java
mobile/android/base/Makefile.in
mobile/xul/app/mobile.js
mobile/xul/app/nsBrowserApp.cpp
modules/libpref/src/init/all.js
mozglue/android/APKOpen.cpp
netwerk/cache/nsCacheEntry.cpp
netwerk/cache/nsCacheEntry.h
netwerk/cache/nsCacheRequest.h
netwerk/cache/nsCacheService.cpp
netwerk/cache/nsCacheService.h
netwerk/cache/nsCacheSession.cpp
netwerk/cache/nsCacheSession.h
netwerk/cache/nsMemoryCacheDevice.cpp
netwerk/cache/nsMemoryCacheDevice.h
netwerk/mime/nsMIMEHeaderParamImpl.cpp
netwerk/protocol/ftp/FTPChannelChild.cpp
netwerk/protocol/ftp/FTPChannelChild.h
netwerk/protocol/ftp/nsFTPChannel.h
netwerk/protocol/ftp/nsFtpConnectionThread.cpp
netwerk/protocol/http/HttpBaseChannel.cpp
netwerk/protocol/http/HttpBaseChannel.h
netwerk/protocol/http/HttpChannelChild.cpp
netwerk/protocol/http/HttpChannelParent.cpp
netwerk/protocol/http/HttpChannelParent.h
netwerk/protocol/http/PHttpChannel.ipdl
netwerk/protocol/http/PHttpChannelParams.h
netwerk/protocol/http/SpdySession.cpp
netwerk/protocol/http/SpdySession.h
netwerk/protocol/http/SpdySession2.cpp
netwerk/protocol/http/SpdySession2.h
netwerk/protocol/http/SpdySession3.cpp
netwerk/protocol/http/SpdySession3.h
netwerk/protocol/http/SpdyStream.cpp
netwerk/protocol/http/SpdyStream.h
netwerk/protocol/http/SpdyStream2.cpp
netwerk/protocol/http/SpdyStream3.cpp
netwerk/protocol/http/nsAHttpConnection.h
netwerk/protocol/http/nsHttpAuthCache.cpp
netwerk/protocol/http/nsHttpChannel.cpp
netwerk/protocol/http/nsHttpChannel.h
netwerk/protocol/http/nsHttpConnection.cpp
netwerk/protocol/http/nsHttpConnection.h
netwerk/protocol/http/nsHttpConnectionInfo.cpp
netwerk/protocol/http/nsHttpConnectionInfo.h
netwerk/protocol/http/nsHttpConnectionMgr.cpp
netwerk/protocol/http/nsHttpConnectionMgr.h
netwerk/protocol/http/nsHttpHandler.cpp
netwerk/protocol/http/nsHttpHandler.h
netwerk/protocol/http/nsHttpHeaderArray.cpp
netwerk/protocol/http/nsHttpHeaderArray.h
netwerk/protocol/http/nsHttpPipeline.cpp
netwerk/protocol/http/nsHttpRequestHead.h
netwerk/protocol/http/nsHttpResponseHead.cpp
netwerk/protocol/http/nsHttpResponseHead.h
netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp
netwerk/protocol/wyciwyg/WyciwygChannelChild.h
netwerk/protocol/wyciwyg/nsWyciwygChannel.cpp
netwerk/protocol/wyciwyg/nsWyciwygChannel.h
netwerk/streamconv/converters/mozTXTToHTMLConv.cpp
other-licenses/android/Makefile.in
parser/html/nsAHtml5TreeBuilderState.h
parser/html/nsHtml5Atom.cpp
parser/html/nsHtml5AtomTable.h
parser/html/nsHtml5MetaScannerCppSupplement.h
parser/html/nsHtml5Module.cpp
parser/html/nsHtml5Module.h
parser/html/nsHtml5Parser.cpp
parser/html/nsHtml5Parser.h
parser/html/nsHtml5PendingNotification.h
parser/html/nsHtml5Portability.cpp
parser/html/nsHtml5StreamParser.cpp
parser/html/nsHtml5StreamParser.h
parser/html/nsHtml5TreeBuilderCppSupplement.h
parser/html/nsHtml5TreeBuilderHSupplement.h
parser/html/nsHtml5TreeOpExecutor.cpp
parser/html/nsHtml5TreeOpExecutor.h
parser/html/nsHtml5TreeOperation.cpp
parser/html/nsHtml5TreeOperation.h
parser/html/nsParserUtils.cpp
security/manager/boot/src/nsSecureBrowserUIImpl.cpp
security/manager/boot/src/nsSecureBrowserUIImpl.h
security/manager/boot/src/nsSecurityWarningDialogs.cpp
security/manager/boot/src/nsSecurityWarningDialogs.h
security/manager/boot/src/nsStrictTransportSecurityService.cpp
security/manager/boot/src/nsStrictTransportSecurityService.h
security/manager/pki/src/nsASN1Tree.cpp
security/manager/pki/src/nsFormSigningDialog.cpp
security/manager/pki/src/nsNSSDialogHelper.cpp
security/manager/pki/src/nsNSSDialogHelper.h
security/manager/pki/src/nsNSSDialogs.cpp
security/manager/ssl/src/NSSErrorsService.cpp
security/manager/ssl/src/SSLServerCertVerification.cpp
security/manager/ssl/src/TransportSecurityInfo.cpp
security/manager/ssl/src/TransportSecurityInfo.h
security/manager/ssl/src/nsCERTValInParamWrapper.cpp
security/manager/ssl/src/nsCERTValInParamWrapper.h
security/manager/ssl/src/nsCMS.cpp
security/manager/ssl/src/nsCRLManager.cpp
security/manager/ssl/src/nsCertOverrideService.cpp
security/manager/ssl/src/nsCertOverrideService.h
security/manager/ssl/src/nsCertPicker.cpp
security/manager/ssl/src/nsCertTree.cpp
security/manager/ssl/src/nsCertTree.h
security/manager/ssl/src/nsClientAuthRemember.cpp
security/manager/ssl/src/nsClientAuthRemember.h
security/manager/ssl/src/nsCrypto.cpp
security/manager/ssl/src/nsCrypto.h
security/manager/ssl/src/nsDataSignatureVerifier.cpp
security/manager/ssl/src/nsIdentityChecking.cpp
security/manager/ssl/src/nsKeygenHandler.cpp
security/manager/ssl/src/nsKeygenThread.cpp
security/manager/ssl/src/nsKeygenThread.h
security/manager/ssl/src/nsNSSASN1Object.cpp
security/manager/ssl/src/nsNSSASN1Object.h
security/manager/ssl/src/nsNSSCallbacks.cpp
security/manager/ssl/src/nsNSSCallbacks.h
security/manager/ssl/src/nsNSSCertHelper.cpp
security/manager/ssl/src/nsNSSCertTrust.cpp
security/manager/ssl/src/nsNSSCertTrust.h
security/manager/ssl/src/nsNSSCertValidity.h
security/manager/ssl/src/nsNSSCertificate.cpp
security/manager/ssl/src/nsNSSCertificate.h
security/manager/ssl/src/nsNSSCertificateDB.cpp
security/manager/ssl/src/nsNSSCertificateFakeTransport.cpp
security/manager/ssl/src/nsNSSComponent.cpp
security/manager/ssl/src/nsNSSComponent.h
security/manager/ssl/src/nsNSSIOLayer.cpp
security/manager/ssl/src/nsNSSIOLayer.h
security/manager/ssl/src/nsNSSShutDown.cpp
security/manager/ssl/src/nsNSSShutDown.h
security/manager/ssl/src/nsNTLMAuthModule.cpp
security/manager/ssl/src/nsOCSPResponder.cpp
security/manager/ssl/src/nsOCSPResponder.h
security/manager/ssl/src/nsPK11TokenDB.cpp
security/manager/ssl/src/nsPKCS11Slot.cpp
security/manager/ssl/src/nsPKCS12Blob.cpp
security/manager/ssl/src/nsPKCS12Blob.h
security/manager/ssl/src/nsPSMBackgroundThread.cpp
security/manager/ssl/src/nsPSMBackgroundThread.h
security/manager/ssl/src/nsProtectedAuthThread.h
security/manager/ssl/src/nsRecentBadCerts.cpp
security/manager/ssl/src/nsRecentBadCerts.h
security/manager/ssl/src/nsSDR.cpp
security/manager/ssl/src/nsSSLStatus.cpp
security/manager/ssl/src/nsSSLStatus.h
security/manager/ssl/src/nsSmartCardEvent.cpp
security/manager/ssl/src/nsSmartCardEvent.h
security/manager/ssl/src/nsStreamCipher.cpp
security/manager/ssl/src/nsUsageArrayHelper.cpp
security/manager/ssl/src/nsUsageArrayHelper.h
testing/jetpack/jetpack-location.txt
testing/testsuite-targets.mk
toolkit/components/aboutmemory/content/aboutMemory.js
toolkit/components/places/tests/head_common.js
toolkit/components/telemetry/TelemetryHistograms.h
toolkit/content/widgets/videocontrols.xml
toolkit/crashreporter/Makefile.in
toolkit/crashreporter/nsExceptionHandler.cpp
toolkit/mozapps/downloads/tests/chrome/test_backspace_key_removes.xul
toolkit/mozapps/downloads/tests/chrome/test_bug_412360.xul
toolkit/mozapps/downloads/tests/chrome/test_delete_key_removes.xul
toolkit/mozapps/extensions/AddonRepository.jsm
toolkit/mozapps/extensions/AddonUpdateChecker.jsm
toolkit/mozapps/extensions/LightweightThemeManager.jsm
toolkit/mozapps/extensions/XPIProvider.jsm
toolkit/mozapps/extensions/content/extensions.js
toolkit/mozapps/extensions/nsBlocklistService.js
toolkit/mozapps/installer/packager.mk
toolkit/mozapps/update/nsUpdateService.js
toolkit/mozapps/update/test/unit/head_update.js.in
toolkit/profile/nsToolkitProfileService.cpp
toolkit/xre/nsAndroidStartup.cpp
toolkit/xre/nsAppRunner.cpp
toolkit/xre/nsEmbedFunctions.cpp
toolkit/xre/nsNativeAppSupportWin.cpp
toolkit/xre/nsUpdateDriver.cpp
toolkit/xre/nsXREDirProvider.cpp
toolkit/xre/nsXREDirProvider.h
tools/relic/README
tools/relic/make-id-list
tools/relic/relic
uriloader/exthandler/mac/nsOSHelperAppService.mm
uriloader/prefetch/nsOfflineCacheUpdate.cpp
uriloader/prefetch/nsOfflineCacheUpdate.h
webapprt/locales/en-US/webapp-uninstaller/webapp-uninstaller.properties
widget/android/AndroidBridge.cpp
widget/android/AndroidBridge.h
widget/android/AndroidJNI.cpp
widget/android/GfxInfo.cpp
widget/android/nsWindow.cpp
widget/cocoa/TextInputHandler.h
widget/cocoa/TextInputHandler.mm
widget/cocoa/nsChildView.h
widget/cocoa/nsChildView.mm
widget/cocoa/nsDeviceContextSpecX.mm
widget/cocoa/nsMenuX.mm
widget/cocoa/nsPrintDialogX.mm
widget/gtk2/nsWindow.cpp
widget/gtk2/nsWindow.h
widget/nsGUIEvent.h
widget/nsIRollupListener.h
widget/os2/nsWindow.cpp
widget/qt/nsWindow.cpp
widget/windows/nsAppShell.cpp
widget/windows/nsClipboard.cpp
widget/windows/nsDragService.cpp
widget/windows/nsDragService.h
widget/windows/nsFilePicker.cpp
widget/windows/nsWindow.cpp
widget/windows/nsWindow.h
widget/xpwidgets/GfxInfoX11.cpp
widget/xpwidgets/nsBaseWidget.cpp
widget/xpwidgets/nsBaseWidget.h
xpcom/base/nsCycleCollector.cpp
xpcom/base/nsMemoryReporterManager.cpp
xpcom/build/nsXULAppAPI.h
xpcom/ds/nsCRT.cpp
xpcom/ds/nsCRT.h
xpcom/ds/nsHashtable.cpp
xpcom/ds/nsVariant.cpp
xpcom/glue/nsISupportsImpl.h
xpcom/glue/nsTArray.h
xpcom/io/nsBinaryStream.cpp
xpcom/io/nsEscape.cpp
xpcom/io/nsLocalFileUnix.cpp
xulrunner/app/nsXULRunnerApp.cpp
xulrunner/stub/nsXULStub.cpp
old mode 100755
new mode 100644
old mode 100755
new mode 100644
--- a/config/find_vanilla_new_calls
+++ b/config/find_vanilla_new_calls
@@ -55,20 +55,20 @@ if [ ! -f $file ] ; then
 fi
 
 tmpfile1=`mktemp`
 tmpfile2=`mktemp`
 nm -C $file > $tmpfile1
 
 # Need to double-escape '[' and ']' to stop grep from interpreting them
 # specially.
-grep 'operator new(unsigned int)'        $tmpfile1 >> $tmpfile2
-grep 'operator new(unsigned long)'       $tmpfile1 >> $tmpfile2
-grep 'operator new\\[\\](unsigned int)'  $tmpfile1 >> $tmpfile2
-grep 'operator new\\[\\](unsigned long)' $tmpfile1 >> $tmpfile2
+grep '^operator new(unsigned int)'        $tmpfile1 >> $tmpfile2
+grep '^operator new(unsigned long)'       $tmpfile1 >> $tmpfile2
+grep '^operator new\\[\\](unsigned int)'  $tmpfile1 >> $tmpfile2
+grep '^operator new\\[\\](unsigned long)' $tmpfile1 >> $tmpfile2
 rm -f $tmpfile1
 
 if [ -s $tmpfile2 ] ; then
     echo "TEST-UNEXPECTED-FAIL | find_vanilla_new_calls | found calls are listed below"
     cat $tmpfile2
     echo
     rm -f $tmpfile2
     exit 1
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -502,18 +502,18 @@ nsresult nsObjectLoadingContent::IsPlugi
     rv = topWindow->GetDocument(getter_AddRefs(topDocument));
     NS_ENSURE_SUCCESS(rv, rv);
     nsCOMPtr<nsIDocument> topDoc = do_QueryInterface(topDocument);
     nsIURI* topUri = topDoc->GetDocumentURI();
 
     nsCOMPtr<nsIPermissionManager> permissionManager = do_GetService(NS_PERMISSIONMANAGER_CONTRACTID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
     PRUint32 permission;
-    rv = permissionManager->TestPermission(topUri,
-                                           "plugins",
+    rv = permissionManager->TestPermission(topUri,
+                                           "plugins",
                                            &permission);
     NS_ENSURE_SUCCESS(rv, rv);
     if (permission == nsIPermissionManager::ALLOW_ACTION) {
       mShouldPlay = true;
     } else {
       return NS_ERROR_PLUGIN_CLICKTOPLAY;
     }
   }
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@@ -256,20 +256,20 @@ public:
    * @param aIsFocused Whether the element is currently focused.
    *
    * @note The caller is responsible to call ContentStatesChanged.
    */
   void UpdateValidityUIBits(bool aIsFocused);
 
   bool DefaultChecked() const {
     return HasAttr(kNameSpaceID_None, nsGkAtoms::checked);
-  }
-
-  /**
-   * Fires change event if mFocusedValue and current value held are unequal.
+  }
+
+  /**
+   * Fires change event if mFocusedValue and current value held are unequal.
    */
   void FireChangeEventIfNeeded();
 
 protected:
   // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
   // by the nsITextControlElement version.
   using nsGenericHTMLFormElement::IsSingleLineTextControl;
 
--- a/content/html/content/src/nsHTMLLegendElement.cpp
+++ b/content/html/content/src/nsHTMLLegendElement.cpp
@@ -101,30 +101,30 @@ nsHTMLLegendElement::GetAttributeChangeH
   nsChangeHint retval =
       nsGenericHTMLElement::GetAttributeChangeHint(aAttribute, aModType);
   if (aAttribute == nsGkAtoms::align) {
     NS_UpdateHint(retval, NS_STYLE_HINT_REFLOW);
   }
   return retval;
 }
 
-nsresult
-nsHTMLLegendElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
-                             nsIAtom* aPrefix, const nsAString& aValue,
-                             bool aNotify)
-{
-  return nsGenericHTMLElement::SetAttr(aNameSpaceID, aAttribute,
-                                       aPrefix, aValue, aNotify);
-}
-nsresult
-nsHTMLLegendElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
-                               bool aNotify)
-{
-  return nsGenericHTMLElement::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
-}
+nsresult
+nsHTMLLegendElement::SetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
+                             nsIAtom* aPrefix, const nsAString& aValue,
+                             bool aNotify)
+{
+  return nsGenericHTMLElement::SetAttr(aNameSpaceID, aAttribute,
+                                       aPrefix, aValue, aNotify);
+}
+nsresult
+nsHTMLLegendElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
+                               bool aNotify)
+{
+  return nsGenericHTMLElement::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
+}
 
 nsresult
 nsHTMLLegendElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                                 nsIContent* aBindingParent,
                                 bool aCompileEventHandlers)
 {
   return nsGenericHTMLElement::BindToTree(aDocument, aParent,
                                           aBindingParent,
--- a/content/media/ogg/nsOggReader.h
+++ b/content/media/ogg/nsOggReader.h
@@ -194,18 +194,18 @@ private:
   nsresult DecodeVorbis(ogg_packet* aPacket);
 
   // Decodes a packet of Opus data, and inserts its samples into the
   // audio queue.
   nsresult DecodeOpus(ogg_packet* aPacket);
 
   // Decodes a packet of Theora data, and inserts its frame into the
   // video queue. May return NS_ERROR_OUT_OF_MEMORY. Caller must have obtained
-  // the reader's monitor. aTimeThreshold is the current playback position
-  // in media time in microseconds. Frames with an end time before this will
+  // the reader's monitor. aTimeThreshold is the current playback position
+  // in media time in microseconds. Frames with an end time before this will
   // not be enqueued.
   nsresult DecodeTheora(ogg_packet* aPacket, PRInt64 aTimeThreshold);
 
   // Read a page of data from the Ogg file. Returns the offset of the start
   // of the page, or -1 if the page read failed.
   PRInt64 ReadOggPage(ogg_page* aPage);
 
   // Reads and decodes header packets for aState, until either header decode
new file mode 100644
--- /dev/null
+++ b/content/xbl/public/nsIXBLService.h
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+
+  Private interface to the XBL service
+
+*/
+
+#ifndef nsIXBLService_h__
+#define nsIXBLService_h__
+
+#include "nsISupports.h"
+
+class nsIContent;
+class nsIDocument;
+class nsIDOMEventTarget;
+class nsIDOMNodeList;
+class nsXBLBinding;
+class nsXBLDocumentInfo;
+class nsIURI;
+class nsIAtom;
+class nsIPrincipal;
+
+#define NS_IXBLSERVICE_IID      \
+{ 0x8a25483c, 0x1ac6, 0x4796, { 0xa6, 0x12, 0x5a, 0xe0, 0x5c, 0x83, 0x65, 0x0b } }
+
+class nsIXBLService : public nsISupports
+{
+public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IXBLSERVICE_IID)
+
+  // This function loads a particular XBL file and installs all of the bindings
+  // onto the element.  aOriginPrincipal must not be null here.
+  NS_IMETHOD LoadBindings(nsIContent* aContent, nsIURI* aURL,
+                          nsIPrincipal* aOriginPrincipal, bool aAugmentFlag,
+                          nsXBLBinding** aBinding, bool* aResolveStyle) = 0;
+
+  // Indicates whether or not a binding is fully loaded.
+  NS_IMETHOD BindingReady(nsIContent* aBoundElement, nsIURI* aURI, bool* aIsReady) = 0;
+
+  // Retrieves our base class (e.g., tells us what type of frame and content node to build)
+  NS_IMETHOD ResolveTag(nsIContent* aContent, PRInt32* aNameSpaceID, nsIAtom** aResult) = 0;
+
+  // This method checks the hashtable and then calls FetchBindingDocument on a
+  // miss.  aOriginPrincipal or aBoundDocument may be null to bypass security
+  // checks.
+  NS_IMETHOD LoadBindingDocumentInfo(nsIContent* aBoundElement,
+                                     nsIDocument* aBoundDocument,
+                                     nsIURI* aBindingURI,
+                                     nsIPrincipal* aOriginPrincipal,
+                                     bool aForceSyncLoad,
+                                     nsXBLDocumentInfo** aResult) = 0;
+
+  // Hooks up the global key event handlers to the document root.
+  NS_IMETHOD AttachGlobalKeyHandler(nsIDOMEventTarget* aTarget) = 0;
+  NS_IMETHOD DetachGlobalKeyHandler(nsIDOMEventTarget* aTarget) = 0;
+  
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIXBLService, NS_IXBLSERVICE_IID)
+
+#endif // nsIXBLService_h__
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -901,16 +901,17 @@ static const char js_methodjit_chrome_st
 static const char js_methodjit_always_str[]   = JS_OPTIONS_DOT_STR "methodjit_always";
 static const char js_typeinfer_str[]          = JS_OPTIONS_DOT_STR "typeinference";
 static const char js_pccounts_content_str[]   = JS_OPTIONS_DOT_STR "pccounts.content";
 static const char js_pccounts_chrome_str[]    = JS_OPTIONS_DOT_STR "pccounts.chrome";
 static const char js_jit_hardening_str[]      = JS_OPTIONS_DOT_STR "jit_hardening";
 static const char js_memlog_option_str[] = JS_OPTIONS_DOT_STR "mem.log";
 static const char js_disable_explicit_compartment_gc[] =
   JS_OPTIONS_DOT_STR "disable_explicit_compartment_gc";
+static const char js_ion_content_str[]        = JS_OPTIONS_DOT_STR "ion.content";
 
 int
 nsJSContext::JSOptionChangedCallback(const char *pref, void *data)
 {
   nsJSContext *context = reinterpret_cast<nsJSContext *>(data);
   PRUint32 oldDefaultJSOptions = context->mDefaultJSOptions;
   PRUint32 newDefaultJSOptions = oldDefaultJSOptions;
 
@@ -938,26 +939,28 @@ nsJSContext::JSOptionChangedCallback(con
                                                js_methodjit_chrome_str :
                                                js_methodjit_content_str);
   bool usePCCounts = Preferences::GetBool(chromeWindow || !contentWindow ?
                                             js_pccounts_chrome_str :
                                             js_pccounts_content_str);
   bool useMethodJITAlways = Preferences::GetBool(js_methodjit_always_str);
   bool useTypeInference = !chromeWindow && contentWindow && Preferences::GetBool(js_typeinfer_str);
   bool useHardening = Preferences::GetBool(js_jit_hardening_str);
+  bool useIon = Preferences::GetBool(js_ion_content_str);
   nsCOMPtr<nsIXULRuntime> xr = do_GetService(XULRUNTIME_SERVICE_CONTRACTID);
   if (xr) {
     bool safeMode = false;
     xr->GetInSafeMode(&safeMode);
     if (safeMode) {
       useMethodJIT = false;
       usePCCounts = false;
       useTypeInference = false;
       useMethodJITAlways = true;
       useHardening = false;
+      useIon = false;
     }
   }
 
   if (useMethodJIT)
     newDefaultJSOptions |= JSOPTION_METHODJIT;
   else
     newDefaultJSOptions &= ~JSOPTION_METHODJIT;
 
@@ -971,16 +974,21 @@ nsJSContext::JSOptionChangedCallback(con
   else
     newDefaultJSOptions &= ~JSOPTION_METHODJIT_ALWAYS;
 
   if (useTypeInference)
     newDefaultJSOptions |= JSOPTION_TYPE_INFERENCE;
   else
     newDefaultJSOptions &= ~JSOPTION_TYPE_INFERENCE;
 
+  if (useIon)
+    newDefaultJSOptions |= JSOPTION_ION;
+  else
+    newDefaultJSOptions &= ~JSOPTION_ION;
+
 #ifdef DEBUG
   // In debug builds, warnings are enabled in chrome context if
   // javascript.options.strict.debug is true
   bool strictDebug = Preferences::GetBool(js_strict_debug_option_str);
   if (strictDebug && (newDefaultJSOptions & JSOPTION_STRICT) == 0) {
     if (chromeWindow || !contentWindow)
       newDefaultJSOptions |= JSOPTION_STRICT;
   }
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -144,16 +144,17 @@ enum {
   PREF_strict = 0,
   PREF_werror,
   PREF_relimit,
   PREF_methodjit,
   PREF_methodjit_always,
   PREF_typeinference,
   PREF_jit_hardening,
   PREF_mem_max,
+  PREF_ion,
 
 #ifdef JS_GC_ZEAL
   PREF_gczeal,
 #endif
 
   PREF_COUNT
 };
 
@@ -162,17 +163,18 @@ enum {
 const char* gPrefsToWatch[] = {
   JS_OPTIONS_DOT_STR "strict",
   JS_OPTIONS_DOT_STR "werror",
   JS_OPTIONS_DOT_STR "relimit",
   JS_OPTIONS_DOT_STR "methodjit.content",
   JS_OPTIONS_DOT_STR "methodjit_always",
   JS_OPTIONS_DOT_STR "typeinference",
   JS_OPTIONS_DOT_STR "jit_hardening",
-  JS_OPTIONS_DOT_STR "mem.max"
+  JS_OPTIONS_DOT_STR "mem.max",
+  JS_OPTIONS_DOT_STR "ion.content"
 
 #ifdef JS_GC_ZEAL
   , PREF_WORKERS_GCZEAL
 #endif
 };
 
 PR_STATIC_ASSERT(NS_ARRAY_LENGTH(gPrefsToWatch) == PREF_COUNT);
 
@@ -209,16 +211,19 @@ PrefCallback(const char* aPrefName, void
       newOptions |= JSOPTION_METHODJIT;
     }
     if (Preferences::GetBool(gPrefsToWatch[PREF_methodjit_always])) {
       newOptions |= JSOPTION_METHODJIT_ALWAYS;
     }
     if (Preferences::GetBool(gPrefsToWatch[PREF_typeinference])) {
       newOptions |= JSOPTION_TYPE_INFERENCE;
     }
+    if (Preferences::GetBool(gPrefsToWatch[PREF_ion])) {
+      newOptions |= JSOPTION_ION;
+    }
     newOptions |= JSOPTION_ALLOW_XML;
 
     RuntimeService::SetDefaultJSContextOptions(newOptions);
     rts->UpdateAllWorkerJSContextOptions();
   }
 #ifdef JS_GC_ZEAL
   else if (!strcmp(aPrefName, gPrefsToWatch[PREF_gczeal])) {
     PRInt32 gczeal = Preferences::GetInt(gPrefsToWatch[PREF_gczeal]);
--- a/gfx/angle/angle-intrinsic-msvc2005.patch
+++ b/gfx/angle/angle-intrinsic-msvc2005.patch
@@ -8,19 +8,19 @@ diff --git a/gfx/angle/src/libGLESv2/Tex
  // functionality. [OpenGL ES 2.0.24] section 3.7 page 63.
  
  #include "libGLESv2/Texture.h"
  
  #include <d3dx9tex.h>
  
  #include <algorithm>
 +
-+#if _MSC_VER <= 1400
-+#define _interlockedbittestandreset _interlockedbittestandreset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
-+#define _interlockedbittestandset _interlockedbittestandset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
++#if _MSC_VER <= 1400
++#define _interlockedbittestandreset _interlockedbittestandreset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
++#define _interlockedbittestandset _interlockedbittestandset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
 +#endif
 +
  #include <intrin.h>
  
  #include "common/debug.h"
  
  #include "libEGL/Display.h"
  
@@ -33,20 +33,20 @@ diff --git a/gfx/angle/src/libGLESv2/mat
  // Use of this source code is governed by a BSD-style license that can be
  // found in the LICENSE file.
  //
  
  // mathutil.h: Math and bit manipulation functions.
  
  #ifndef LIBGLESV2_MATHUTIL_H_
  #define LIBGLESV2_MATHUTIL_H_
-+
-+#if _MSC_VER <= 1400
-+#define _interlockedbittestandreset _interlockedbittestandreset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
-+#define _interlockedbittestandset _interlockedbittestandset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
++
++#if _MSC_VER <= 1400
++#define _interlockedbittestandreset _interlockedbittestandreset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
++#define _interlockedbittestandset _interlockedbittestandset_NAME_CHANGED_TO_AVOID_MSVS2005_ERROR
 +#endif
  
  #include <intrin.h>
  #include <math.h>
  #include <windows.h>
  
  namespace gl
  {
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -365,26 +365,26 @@ Layer::GetEffectiveOpacity()
   }
   return opacity;
 }
 
 void
 Layer::ComputeEffectiveTransformForMaskLayer(const gfx3DMatrix& aTransformToSurface)
 {
   if (mMaskLayer) {
-    mMaskLayer->mEffectiveTransform = aTransformToSurface;
-
-#ifdef DEBUG
-    gfxMatrix maskTranslation;
-    bool maskIs2D = mMaskLayer->GetTransform().CanDraw2D(&maskTranslation);
-    NS_ASSERTION(maskIs2D, "How did we end up with a 3D transform here?!");
-    NS_ASSERTION(maskTranslation.HasOnlyIntegerTranslation(),
-                 "Mask layer has invalid transform.");
-#endif
-    mMaskLayer->mEffectiveTransform.PreMultiply(mMaskLayer->GetTransform());
+    mMaskLayer->mEffectiveTransform = aTransformToSurface;
+
+#ifdef DEBUG
+    gfxMatrix maskTranslation;
+    bool maskIs2D = mMaskLayer->GetTransform().CanDraw2D(&maskTranslation);
+    NS_ASSERTION(maskIs2D, "How did we end up with a 3D transform here?!");
+    NS_ASSERTION(maskTranslation.HasOnlyIntegerTranslation(),
+                 "Mask layer has invalid transform.");
+#endif
+    mMaskLayer->mEffectiveTransform.PreMultiply(mMaskLayer->GetTransform());
   }
 }
 
 void
 ContainerLayer::FillSpecificAttributes(SpecificLayerAttributes& aAttrs)
 {
   aAttrs = ContainerLayerAttributes(GetFrameMetrics());
 }
--- a/gfx/layers/d3d10/LayerManagerD3D10.cpp
+++ b/gfx/layers/d3d10/LayerManagerD3D10.cpp
@@ -867,17 +867,17 @@ LayerD3D10::LoadMaskTexture()
       static_cast<LayerD3D10*>(maskLayer->ImplData())->GetAsTexture(&size);
   
     if (!maskSRV) {
       return SHADER_NO_MASK;
     }
 
     gfxMatrix maskTransform;
     bool maskIs2D = maskLayer->GetEffectiveTransform().CanDraw2D(&maskTransform);
-    NS_ASSERTION(maskIs2D, "How did we end up with a 3D transform here?!");
+    NS_ASSERTION(maskIs2D, "How did we end up with a 3D transform here?!");
     gfxRect bounds = gfxRect(gfxPoint(), size);
     bounds = maskTransform.TransformBounds(bounds);
 
     effect()->GetVariableByName("vMaskQuad")->AsVector()->SetFloatVector(
       ShaderConstantRectD3D10(
         (float)bounds.x,
         (float)bounds.y,
         (float)bounds.width,
--- a/gfx/layers/d3d9/CanvasLayerD3D9.h
+++ b/gfx/layers/d3d9/CanvasLayerD3D9.h
@@ -1,19 +1,19 @@
 /* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef GFX_CANVASLAYERD3D9_H
 #define GFX_CANVASLAYERD3D9_H
 
-#include "LayerManagerD3D9.h"
-#include "GLContext.h"
-#include "gfxASurface.h"
+#include "LayerManagerD3D9.h"
+#include "GLContext.h"
+#include "gfxASurface.h"
 
 namespace mozilla {
 namespace layers {
 
 class ShadowBufferD3D9;
 
 class THEBES_API CanvasLayerD3D9 :
   public CanvasLayer,
--- a/gfx/layers/d3d9/ThebesLayerD3D9.h
+++ b/gfx/layers/d3d9/ThebesLayerD3D9.h
@@ -79,36 +79,36 @@ private:
   void CopyRegion(IDirect3DTexture9* aSrc, const nsIntPoint &aSrcOffset,
                   IDirect3DTexture9* aDest, const nsIntPoint &aDestOffset,
                   const nsIntRegion &aCopyRegion, nsIntRegion* aValidRegion);
 };
 
 class ShadowThebesLayerD3D9 : public ShadowThebesLayer,
                               public LayerD3D9
 {
-public:
-  ShadowThebesLayerD3D9(LayerManagerD3D9 *aManager);
-  virtual ~ShadowThebesLayerD3D9();
-
-  virtual void
-  Swap(const ThebesBuffer& aNewFront, const nsIntRegion& aUpdatedRegion,
-       OptionalThebesBuffer* aNewBack, nsIntRegion* aNewBackValidRegion,
-       OptionalThebesBuffer* aReadOnlyFront, nsIntRegion* aFrontUpdatedRegion);
-  virtual void DestroyFrontBuffer();
-
-  virtual void Disconnect();
-
-  // LayerD3D9 impl
+public:
+  ShadowThebesLayerD3D9(LayerManagerD3D9 *aManager);
+  virtual ~ShadowThebesLayerD3D9();
+
+  virtual void
+  Swap(const ThebesBuffer& aNewFront, const nsIntRegion& aUpdatedRegion,
+       OptionalThebesBuffer* aNewBack, nsIntRegion* aNewBackValidRegion,
+       OptionalThebesBuffer* aReadOnlyFront, nsIntRegion* aFrontUpdatedRegion);
+  virtual void DestroyFrontBuffer();
+
+  virtual void Disconnect();
+
+  // LayerD3D9 impl
   Layer* GetLayer();
   virtual bool IsEmpty();
   virtual void RenderLayer() { RenderThebesLayer(); }
   virtual void CleanResources();
   virtual void LayerManagerDestroyed();
 
-  void RenderThebesLayer();
-
-private:
+  void RenderThebesLayer();
+
+private:
   nsRefPtr<ShadowBufferD3D9> mBuffer;
 };
 
 } /* layers */
 } /* mozilla */
 #endif /* GFX_THEBESLAYERD3D9_H */
--- a/js/public/Vector.h
+++ b/js/public/Vector.h
@@ -175,17 +175,17 @@ struct VectorImpl<T, N, AP, true>
  *  - see "Allocation policies" in jsalloc.h (default js::TempAllocPolicy)
  *
  * N.B: Vector is not reentrant: T member functions called during Vector member
  *      functions must not call back into the same object.
  */
 template <class T, size_t N, class AllocPolicy>
 class Vector : private AllocPolicy
 {
-    typedef typename tl::StaticAssert<tl::IsRelocatableHeapType<T>::result>::result _;
+    // typedef typename tl::StaticAssert<!tl::IsPostBarrieredType<T>::result>::result _;
 
     /* utilities */
 
     static const bool sElemIsPod = tl::IsPodType<T>::result;
     typedef VectorImpl<T, N, AllocPolicy, sElemIsPod> Impl;
     friend struct VectorImpl<T, N, AllocPolicy, sElemIsPod>;
 
     bool calculateNewCapacity(size_t curLength, size_t lengthInc, size_t &newCap);
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -117,16 +117,17 @@ CPPSRCS		= \
 		GlobalObject.cpp \
 		MethodGuard.cpp \
 		ObjectImpl.cpp \
 		Stack.cpp \
 		String.cpp \
 		BytecodeCompiler.cpp \
 		BytecodeEmitter.cpp \
 		FoldConstants.cpp \
+		ParallelArray.cpp \
 		ParseMaps.cpp \
 		ParseNode.cpp \
 		Parser.cpp \
 		SemanticAnalysis.cpp \
 		TokenStream.cpp \
 		TreeContext.cpp \
 		TestingFunctions.cpp \
 		LifoAlloc.cpp \
@@ -243,40 +244,112 @@ CPPSRCS += 	MethodJIT.cpp \
 		MonoIC.cpp \
 		PolyIC.cpp \
 		ImmutableSync.cpp \
 		InvokeHelpers.cpp \
 		Retcon.cpp \
 		TrampolineCompiler.cpp \
 		$(NULL)
 
+# Ion
+ifdef ENABLE_ION
+VPATH +=	$(srcdir)/ion
+VPATH +=	$(srcdir)/ion/shared
+
+CPPSRCS +=	MIR.cpp \
+		Bailouts.cpp \
+		BitSet.cpp \
+		C1Spewer.cpp \
+		CodeGenerator.cpp \
+		CodeGenerator-shared.cpp \
+		GreedyAllocator.cpp \
+		Ion.cpp \
+		IonAnalysis.cpp \
+		IonBuilder.cpp \
+		IonCaches.cpp \
+		IonFrames.cpp \
+		IonMacroAssembler.cpp \
+		IonSpewer.cpp \
+		JSONSpewer.cpp \
+		LICM.cpp \
+		LinearScan.cpp \
+		LIR.cpp \
+		Lowering.cpp \
+		Lowering-shared.cpp \
+		MCallOptimize.cpp \
+		MIRGraph.cpp \
+		MoveResolver.cpp \
+		RangeAnalysis.cpp \
+		Snapshots.cpp \
+		Safepoints.cpp \
+		TypeOracle.cpp \
+		TypePolicy.cpp \
+		ValueNumbering.cpp \
+		VMFunctions.cpp \
+		AliasAnalysis.cpp \
+		$(NULL)
+endif #ENABLE_ION
 ifeq (86, $(findstring 86,$(TARGET_CPU)))
+CPPSRCS +=	CodeGenerator-x86-shared.cpp
+CPPSRCS +=	IonFrames-x86-shared.cpp
+CPPSRCS +=	MoveEmitter-x86-shared.cpp
+CPPSRCS +=	Assembler-x86-shared.cpp
+CPPSRCS +=	Lowering-x86-shared.cpp
 ifeq (x86_64, $(TARGET_CPU))
 ifdef _MSC_VER
 ASFILES +=	TrampolineMasmX64.asm
 endif
 ifeq ($(OS_ARCH),WINNT)
 ifdef GNU_CC
 ASFILES +=	TrampolineMingwX64.s
 endif
 endif
 ifdef SOLARIS_SUNPRO_CXX
 ASFILES +=	TrampolineSUNWX64.s
 endif
 #CPPSRCS		+= only_on_x86_64.cpp
+VPATH +=	$(srcdir)/ion/x64
+CPPSRCS += 	Lowering-x64.cpp \
+		CodeGenerator-x64.cpp \
+		Trampoline-x64.cpp \
+		Assembler-x64.cpp \
+		Bailouts-x64.cpp \
+		MacroAssembler-x64.cpp \
+		$(NULL)
 else
 #CPPSRCS		+= only_on_x86.cpp
+VPATH +=	$(srcdir)/ion/x86
+CPPSRCS +=	Lowering-x86.cpp \
+		CodeGenerator-x86.cpp \
+		Trampoline-x86.cpp \
+		Assembler-x86.cpp \
+		Bailouts-x86.cpp \
+		MacroAssembler-x86.cpp \
+		$(NULL)
 ifdef SOLARIS_SUNPRO_CXX
 ASFILES +=	TrampolineSUNWX86.s
 endif
 endif
 endif
-ifeq (arm, $(TARGET_CPU))
+ifdef ENABLE_ION
+ifeq (arm, $(findstring arm, $(TARGET_CPU)))
 #CPPSRCS		+= only_on_arm.cpp
+VPATH +=	$(srcdir)/ion/arm
+CPPSRCS +=	Lowering-arm.cpp \
+		CodeGenerator-arm.cpp \
+		Trampoline-arm.cpp \
+		Assembler-arm.cpp \
+		Bailouts-arm.cpp \
+		IonFrames-arm.cpp \
+		MoveEmitter-arm.cpp \
+		Architecture-arm.cpp \
+		MacroAssembler-arm.cpp \
+		$(NULL)
 endif
+endif #ENABLE_ION
 ifeq (sparc, $(findstring sparc,$(TARGET_CPU)))
 ASFILES +=	TrampolineSparc.s
 endif
 ifeq (mips, $(findstring mips,$(TARGET_CPU)))
 CPPSRCS +=	TrampolineMIPS.cpp
 endif
 #
 # END enclude sources for the method JIT
@@ -336,17 +409,17 @@ CPPSRCS +=	ARMAssembler.cpp \
 
 ifeq (86, $(findstring 86,$(TARGET_CPU)))
 ifeq (x86_64, $(TARGET_CPU))
 #CPPSRCS		+= only_on_x86_64.cpp
 else
 #CPPSRCS		+= only_on_x86.cpp
 endif
 endif
-ifeq (arm, $(TARGET_CPU))
+ifeq (arm, $(findstring arm, $(TARGET_CPU)))
 #CPPSRCS		+= only_on_arm.cpp
 endif
 
 endif
 
 #
 # END enclude sources for the Nitro assembler
 #############################################
@@ -546,36 +619,35 @@ check-malloc-function-usage: $(filter-ou
 		"in Makefile.in" "cx->calloc_ or rt->calloc_" $^
 	$(srcdir)/config/check_source_count.py "\bjs_realloc\b" 0 \
 		"in Makefile.in" "cx->realloc_ or rt->realloc_" $^
 	$(srcdir)/config/check_source_count.py "\bjs_free\b" 0 \
 		"in Makefile.in" "cx->free_" $^
 
 	# We desire these numbers to go down, not up. See "User guide to memory
 	# management within SpiderMonkey" in jsutil.h.
-	$(srcdir)/config/check_source_count.py OffTheBooks:: 71 \
+	$(srcdir)/config/check_source_count.py OffTheBooks:: 73 \
 		"in Makefile.in" "{cx,rt}->{new_,array_new,malloc_,calloc_,realloc_}" $^
 	# This should go to zero, if possible.
 	$(srcdir)/config/check_source_count.py UnwantedForeground:: 31 \
 		"in Makefile.in" "{cx,rt}->{free_,delete_,array_delete}" $^
 
 ifneq ($(OS_ARCH),WINNT) # FIXME: this should be made work on Windows too.
 #check:: check-malloc-function-usage FIXME: disable on JM until closer to merge time.
 endif
 
 ifdef MOZ_VALGRIND
 ifndef MOZ_ASAN
 JITTEST_VALGRIND_FLAG = --valgrind
 endif
 endif
 
-JITFLAGS = ,m,am,amd,n,mn,amn,amdn,mdn
 check-jit-test::
 	$(wildcard $(RUN_TEST_PROGRAM)) $(PYTHON) -u $(srcdir)/jit-test/jit_test.py \
-	        --no-slow --no-progress --tinderbox --jitflags=$(JITFLAGS) $(JITTEST_VALGRIND_FLAG) \
+	        --no-slow --no-progress --tinderbox --tbpl $(JITTEST_VALGRIND_FLAG) \
 	        $(DIST)/bin/js$(BIN_SUFFIX)
 
 check:: check-jit-test
 
 # jstests doesn't have a --jitflags option, so we need to loop, updating the
 # exit code (RC) after each invocation.
 # FIXME: MethodJIT doesn't work for 1 test case (bug 644393), so
 # --no-extensions is set to skip that test. Remove as soon as possible.
--- a/js/src/MemoryMetrics.cpp
+++ b/js/src/MemoryMetrics.cpp
@@ -122,19 +122,25 @@ StatsCellCallback(JSRuntime *rt, void *d
     }
     case JSTRACE_SCRIPT:
     {
         JSScript *script = static_cast<JSScript *>(thing);
         cStats->gcHeapScripts += thingSize;
         cStats->scriptData += script->sizeOfData(rtStats->mallocSizeOf);
 #ifdef JS_METHODJIT
         cStats->mjitData += script->sizeOfJitScripts(rtStats->mallocSizeOf);
+# ifdef JS_ION
+        if (script->hasIonScript())
+            cStats->mjitData += script->ion->size();
+# endif
 #endif
         break;
     }
+    case JSTRACE_IONCODE:
+        break;
     case JSTRACE_TYPE_OBJECT:
     {
         types::TypeObject *obj = static_cast<types::TypeObject *>(thing);
         cStats->gcHeapTypeObjects += thingSize;
         obj->sizeOfExcludingThis(&cStats->typeInferenceSizes, rtStats->mallocSizeOf);
         break;
     }
 #if JS_HAS_XML_SUPPORT
--- a/js/src/assembler/assembler/ARMAssembler.cpp
+++ b/js/src/assembler/assembler/ARMAssembler.cpp
@@ -20,17 +20,17 @@
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- * 
+ *
  * ***** END LICENSE BLOCK ***** */
 
 #include "assembler/wtf/Platform.h"
 
 #if ENABLE_ASSEMBLER && WTF_CPU_ARM_TRADITIONAL
 
 #include "ARMAssembler.h"
 
@@ -99,17 +99,17 @@ ARMWord ARMAssembler::getOp2RegScale(Reg
     // [ 6:5]   Shift type. Only LSL ("00") is used here.
     // [ 4:4]   0.
     // [ 3:0]   The register to shift.
 
     ARMWord shift;  // Shift field. This is log2(scale).
     ARMWord lz;     // Leading zeroes.
 
     // Calculate shift=log2(scale).
-#if WTF_ARM_ARCH_AT_LEAST(5)
+#if WTF_ARM_ARCH_AT_LEAST_5
     asm (
     "   clz     %[lz], %[scale]\n"
     : [lz]      "=r"  (lz)
     : [scale]   "r"   (scale)
     : // No clobbers.
     );
 #else
     lz = 0; // Accumulate leading zeroes.
@@ -120,17 +120,17 @@ ARMWord ARMAssembler::getOp2RegScale(Reg
         }
     }
 #endif
     if (lz >= 32) {
         return INVALID_IMM;
     }
     shift = 31-lz;
     // Check that scale was a power of 2.
-    if ((1<<shift) != scale) {
+    if ((1u<<shift) != scale) {
         return INVALID_IMM;
     }
 
     return (shift << 7) | (reg);
 }
 
 int ARMAssembler::genInt(int reg, ARMWord imm, bool positive)
 {
@@ -311,17 +311,17 @@ ARMWord ARMAssembler::encodeComplexImm(A
 
 // Memory load/store helpers
 // TODO: this does not take advantage of all of ARMv7's instruction encodings, it should.
 void ARMAssembler::dataTransferN(bool isLoad, bool isSigned, int size, RegisterID rt, RegisterID base, int32_t offset)
 {
     bool posOffset = true;
 
     // There may be more elegant ways of handling this, but this one works.
-    if (offset == 0x80000000) {
+    if (offset == int32_t(0x80000000)) {
         // For even bigger offsets, load the entire offset into a register, then do an
         // indexed load using the base register and the index register.
         moveImm(offset, ARMRegisters::S0);
         mem_reg_off(isLoad, isSigned, size, posOffset, rt, base, ARMRegisters::S0);
         return;
     }
     if (offset < 0) {
         offset = - offset;
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -55,16 +55,21 @@
     } while (0)
 #else
 # define MAYBE_PAD ""
 # define FIXME_INSN_PRINTING ((void) 0)
 #endif
 
 // TODO: We don't print the condition code in our JaegerSpew lines. Doing this
 // is awkward whilst maintaining a consistent field width.
+namespace js {
+    namespace ion {
+        class Assembler;
+    }
+}
 
 namespace JSC {
 
     typedef uint32_t ARMWord;
 
     namespace ARMRegisters {
         typedef enum {
             r0 = 0,
@@ -83,17 +88,18 @@ namespace JSC {
             r11,
             r12,
             ip = r12,
             r13,
             sp = r13,
             r14,
             lr = r14,
             r15,
-            pc = r15
+            pc = r15,
+            invalid_reg
         } RegisterID;
 
         typedef enum {
             d0,
             d1,
             d2,
             d3,
             SD0 = d3,
@@ -119,40 +125,39 @@ namespace JSC {
             d23,
             d24,
             d25,
             d26,
             d27,
             d28,
             d29,
             d30,
-            d31
+            d31,
+            invalid_freg
         } FPRegisterID;
 
         inline FPRegisterID floatShadow(FPRegisterID s)
         {
             return (FPRegisterID)(s*2);
         }
         inline FPRegisterID doubleShadow(FPRegisterID d)
         {
             return (FPRegisterID)(d / 2);
         }
     } // namespace ARMRegisters
-
     class ARMAssembler {
     public:
         
 #ifdef JS_METHODJIT_SPEW
         bool isOOLPath;
         // Assign a default value to keep Valgrind quiet.
         ARMAssembler() : isOOLPath(false) { }
 #else
         ARMAssembler() { }
 #endif
-
         typedef ARMRegisters::RegisterID RegisterID;
         typedef ARMRegisters::FPRegisterID FPRegisterID;
         typedef AssemblerBufferWithConstantPool<2048, 4, 4, ARMAssembler> ARMBuffer;
         typedef SegmentedVector<int, 64> Jumps;
 
         unsigned char *buffer() const { return m_buffer.buffer(); }
         bool oom() const { return m_buffer.oom(); }
 
@@ -274,33 +279,35 @@ namespace JSC {
         } Shift;
 
         static const ARMWord INVALID_IMM = 0xf0000000;
         static const ARMWord InvalidBranchTarget = 0xffffffff;
         static const int DefaultPrefetching = 2;
 
         class JmpSrc {
             friend class ARMAssembler;
+            friend class js::ion::Assembler;
         public:
             JmpSrc()
                 : m_offset(-1)
             {
             }
-
+            int offset() {return m_offset;}
         private:
             JmpSrc(int offset)
                 : m_offset(offset)
             {
             }
 
             int m_offset;
         };
 
         class JmpDst {
             friend class ARMAssembler;
+            friend class js::ion::Assembler;
         public:
             JmpDst()
                 : m_offset(-1)
                 , m_used(false)
             {
             }
 
             bool isUsed() const { return m_used; }
@@ -579,17 +586,17 @@ namespace JSC {
                 mnemonic_size = "h";
                 break;
             case 4:
                 mnemonic_size = "";
                 break;
             }
             char const * off_sign = (posOffset) ? ("+") : ("-");
             js::JaegerSpew(js::JSpew_Insns, 
-                           IPFX "%sr%s%s %s, [%s, #%s%u]\n", 
+                           IPFX "%sr%s%s %s, [%s, #%s%u]\n",
                            MAYBE_PAD, mnemonic_act, mnemonic_sign, mnemonic_size,
                            nameGpReg(rd), nameGpReg(rb), off_sign, offset);
             if (size == 32 || (size == 8 && !isSigned)) {
                 /* All (the one) 32 bit ops and the unsigned 8 bit ops use the original encoding.*/
                 emitInst(static_cast<ARMWord>(cc) | DTR |
                          (isLoad ? DT_LOAD : 0) |
                          (size == 8 ? DT_BYTE : 0) |
                          (posOffset ? DT_UP : 0), rd, rb, offset);
@@ -916,19 +923,19 @@ namespace JSC {
 
         // General helpers
 
         void forceFlushConstantPool()
         {
             m_buffer.flushWithoutBarrier(true);
         }
 
-        int size()
+        size_t size() const
         {
-            return m_buffer.size();
+            return m_buffer.uncheckedSize();
         }
 
         void ensureSpace(int insnSpace, int constSpace)
         {
             m_buffer.ensureSpace(insnSpace, constSpace);
         }
 
         void ensureSpace(int space)
@@ -1030,17 +1037,17 @@ namespace JSC {
 
         static void patchConstantPoolLoad(void* loadAddr, void* constPoolAddr);
 
         // Patch pointers
 
         static void linkPointer(void* code, JmpDst from, void* to)
         {
             js::JaegerSpew(js::JSpew_Insns,
-                           ISPFX "##linkPointer     ((%p + %#x)) points to ((%p))\n",
+                           "##linkPointer     ((%p + %#x)) points to ((%p))\n",
                            code, from.m_offset, to);
 
             patchPointerInternal(reinterpret_cast<intptr_t>(code) + from.m_offset, to);
         }
 
         static void repatchInt32(void* from, int32_t to)
         {
             js::JaegerSpew(js::JSpew_Insns,
@@ -1048,17 +1055,17 @@ namespace JSC {
                            from, to);
 
             patchPointerInternal(reinterpret_cast<intptr_t>(from), reinterpret_cast<void*>(to));
         }
 
         static void repatchPointer(void* from, void* to)
         {
             js::JaegerSpew(js::JSpew_Insns,
-                           ISPFX "##repatchPointer  ((%p)) points to ((%p))\n",
+                           "##repatchPointer  ((%p)) points to ((%p))\n",
                            from, to);
 
             patchPointerInternal(reinterpret_cast<intptr_t>(from), to);
         }
 
         static void repatchLoadPtrToLEA(void* from)
         {
             // On arm, this is a patch from LDR to ADD. It is restricted conversion,
@@ -1597,17 +1604,17 @@ namespace JSC {
             emitVFPInst(static_cast<ARMWord>(cc) | VFP_DXFER | VFP_MOV |
                         (fromFP ? DT_LOAD : 0) |
                         (isDbl ? VFP_DBL : 0), RD(r1), RN(r2), isDbl ? DM(rFP) : SM(rFP));
         }
 
         void fcpyd_r(int dd, int dm, Condition cc = AL)
         {
             js::JaegerSpew(js::JSpew_Insns,
-                    IPFX   "%-15s %s, %s\n", MAYBE_PAD, "vmov.f64", 
+                           IPFX   "%-15s %s, %s\n", MAYBE_PAD, "vmov.f64",
                            nameFpRegD(dd), nameFpRegD(dm));
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
             emitVFPInst(static_cast<ARMWord>(cc) | FCPYD, DD(dd), DM(dm), 0);
         }
 
         void faddd_r(int dd, int dn, int dm, Condition cc = AL)
         {
@@ -1720,15 +1727,29 @@ namespace JSC {
         }
 
         void fmstat(Condition cc = AL)
         {
             // TODO: emitInst doesn't work for VFP instructions, though it
             // seems to work for current usage.
             m_buffer.putInt(static_cast<ARMWord>(cc) | FMSTAT);
         }
-    };
+
+
+        // things added to make IONMONKEY happy!
+        // what is the offset (from the beginning of the buffer) to the address
+        // of the next instruction
+        int nextOffset() {
+            return m_buffer.uncheckedSize();
+        }
+        void putInst32(uint32_t data) {
+            m_buffer.putInt(data);
+        }
+        uint32_t *editSrc(JmpSrc src) {
+            return (uint32_t*)(((char*)m_buffer.data()) + src.offset());
+        }
+    }; // ARMAssembler
 
 } // namespace JSC
 
 #endif // ENABLE(ASSEMBLER) && CPU(ARM_TRADITIONAL)
 
 #endif // ARMAssembler_h
--- a/js/src/assembler/assembler/AssemblerBuffer.h
+++ b/js/src/assembler/assembler/AssemblerBuffer.h
@@ -30,16 +30,17 @@
 #ifndef AssemblerBuffer_h
 #define AssemblerBuffer_h
 
 #include "assembler/wtf/Platform.h"
 
 #if ENABLE_ASSEMBLER
 
 #include <string.h>
+#include <limits.h>
 #include "assembler/jit/ExecutableAllocator.h"
 #include "assembler/wtf/Assertions.h"
 
 namespace JSC {
 
     class AssemblerBuffer {
         static const int inlineCapacity = 256;
     public:
@@ -192,16 +193,24 @@ namespace JSC {
         {
             /*
              * If |extraCapacity| is zero (as it almost always is) this is an
              * allocator-friendly doubling growth strategy.
              */
             int newCapacity = m_capacity + m_capacity + extraCapacity;
             char* newBuffer;
 
+            // Do not allow offsets to grow beyond INT_MAX / 2. This mirrors
+            // Assembler-shared.h.
+            if (newCapacity >= INT_MAX / 2) {
+                m_size = 0;
+                m_oom = true;
+                return;
+            }
+
             if (m_buffer == m_inlineBuffer) {
                 newBuffer = static_cast<char*>(malloc(newCapacity));
                 if (!newBuffer) {
                     m_size = 0;
                     m_oom = true;
                     return;
                 }
                 memcpy(newBuffer, m_buffer, m_size);
--- a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
+++ b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
@@ -35,17 +35,17 @@
 
 #if ENABLE_ASSEMBLER
 
 #include "AssemblerBuffer.h"
 #include "assembler/wtf/SegmentedVector.h"
 #include "assembler/wtf/Assertions.h"
 
 #include "methodjit/Logging.h"
-
+#include "jsnum.h"
 #define ASSEMBLER_HAS_CONSTANT_POOL 1
 
 namespace JSC {
 
 /*
     On a constant pool 4 or 8 bytes data can be stored. The values can be
     constants or addresses. The addresses should be 32 or 64 bits. The constants
     should be double-precisions float or integer numbers which are hard to be
@@ -157,52 +157,62 @@ public:
 
     void putShort(int value)
     {
         flushIfNoSpaceFor(2);
         AssemblerBuffer::putShort(value);
         correctDeltas(2);
     }
 
+    // Puts 1 word worth of data into the instruction stream
     void putIntUnchecked(int value)
     {
         AssemblerBuffer::putIntUnchecked(value);
         correctDeltas(4);
     }
-
+    // Puts one word worth of data into the instruction stream, and makes sure
+    // there is enough space to place it, dumping the constant pool if there isn't
     void putInt(int value)
     {
         flushIfNoSpaceFor(4);
         AssemblerBuffer::putInt(value);
         correctDeltas(4);
     }
-
+    // puts 64 bits worth of data into the instruction stream
     void putInt64Unchecked(int64_t value)
     {
         AssemblerBuffer::putInt64Unchecked(value);
         correctDeltas(8);
     }
 
     int size()
     {
         flushIfNoSpaceFor(maxInstructionSize, sizeof(uint64_t));
         return AssemblerBuffer::size();
     }
 
-    int uncheckedSize()
+    int uncheckedSize() const
     {
         return AssemblerBuffer::size();
     }
 
+    // copy all of our instructions and pools into their final location
     void* executableAllocAndCopy(ExecutableAllocator* allocator, ExecutablePool** poolp, CodeKind kind)
     {
         flushConstantPool(false);
         return AssemblerBuffer::executableAllocAndCopy(allocator, poolp, kind);
     }
 
+    // places 1 int worth of data into a pool, and mashes an instruction into place to
+    // hold this offset.
+    // the caller of putIntWithConstantInt passes in some token that represents an
+    // instruction, as well as the raw data that is to be placed in the pool.
+    // Traditionally, this 'token' has been the instruction that we wish to encode
+    // in the end, however, I have started encoding it in a much simpler manner,
+    // using bitfields and a fairly flat representation.
     void putIntWithConstantInt(uint32_t insn, uint32_t constant, bool isReusable = false)
     {
         flushIfNoSpaceFor(4, 4);
 
         m_loadOffsets.append(AssemblerBuffer::size());
         if (isReusable)
             for (int i = 0; i < m_numConsts; ++i) {
                 if (m_mask[i] == ReusableConst && m_pool[i] == constant) {
@@ -216,29 +226,85 @@ public:
         m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
 
         AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, m_numConsts));
         ++m_numConsts;
 
         correctDeltas(4, 4);
     }
 
+    uint32_t *getPoolSpace(uint32_t insn, uint32_t constant, bool isReusable = false)
+    {
+        flushIfNoSpaceFor(4, 4);
+
+        m_loadOffsets.append(AssemblerBuffer::size());
+        if (isReusable)
+            for (int i = 0; i < m_numConsts; ++i) {
+                if (m_mask[i] == ReusableConst && m_pool[i] == constant) {
+                    AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, i));
+                    correctDeltas(4);
+                    return;
+                }
+            }
+
+        m_pool[m_numConsts] = constant;
+        m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
+
+        AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, m_numConsts));
+        ++m_numConsts;
+
+        correctDeltas(4, 4);
+    }
+
+    void putIntWithConstantDouble(uint32_t insn, double constant)
+    {
+        flushIfNoSpaceFor(4, 8);
+
+        m_loadOffsets.append(AssemblerBuffer::size());
+        bool isReusable = false;
+
+        union DoublePun {
+            struct {
+#if defined(IS_LITTLE_ENDIAN) && !defined(FPU_IS_ARM_FPA)
+                uint32_t lo, hi;
+#else
+                uint32_t hi, lo;
+#endif
+            } s;
+            double d;
+        } dpun;
+
+        dpun.d = constant;
+        
+        m_pool[m_numConsts] = dpun.s.lo;
+        m_pool[m_numConsts+1] = dpun.s.hi;
+        m_mask[m_numConsts] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
+        m_mask[m_numConsts+1] = static_cast<char>(isReusable ? ReusableConst : UniqueConst);
+
+        AssemblerBuffer::putInt(AssemblerType::patchConstantPoolLoad(insn, m_numConsts));
+        m_numConsts+=2;
+
+        correctDeltas(4, 8);
+    }
+
     // This flushing mechanism can be called after any unconditional jumps.
     void flushWithoutBarrier(bool isForced = false)
     {
         // Flush if constant pool is more than 60% full to avoid overuse of this function.
         if (isForced || (5 * m_numConsts * sizeof(uint32_t)) > (3 * maxPoolSize))
             flushConstantPool(false);
     }
 
+    // return the address of the pool; we really shouldn't be using this.
     uint32_t* poolAddress()
     {
         return m_pool;
     }
 
+    // how many constants have been placed into the pool thusfar?
     int sizeOfConstantPool()
     {
         return m_numConsts;
     }
 
     int flushCount()
     {
         return m_flushCount;
@@ -258,16 +324,18 @@ private:
     {
         correctDeltas(insnSize);
 
         m_maxDistance -= m_lastConstDelta;
         ASSERT(m_maxDistance >= 0);
         m_lastConstDelta = constSize;
     }
 
+    // place a constant pool after the last instruction placed, and
+    // optionally place a jump to ensure we don't start executing the pool.
     void flushConstantPool(bool useBarrier = true)
     {
         js::JaegerSpew(js::JSpew_Insns, " -- FLUSHING CONSTANT POOL WITH %d CONSTANTS --\n",
                        m_numConsts);
         if (m_numConsts == 0)
             return;
         m_flushCount++;
         int alignPool = (AssemblerBuffer::size() + (useBarrier ? barrierSize : 0)) & (sizeof(uint64_t) - 1);
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -77,36 +77,50 @@ namespace X86Registers {
         r9,
         r10,
         r11,
         r12,
         r13,
         r14,
         r15
 #endif
+        ,invalid_reg
     } RegisterID;
 
     typedef enum {
         xmm0,
         xmm1,
         xmm2,
         xmm3,
         xmm4,
         xmm5,
         xmm6,
         xmm7
+#if WTF_CPU_X86_64
+       ,xmm8,
+        xmm9,
+        xmm10,
+        xmm11,
+        xmm12,
+        xmm13,
+        xmm14,
+        xmm15
+#endif
+       ,invalid_xmm
     } XMMRegisterID;
 
     static const char* nameFPReg(XMMRegisterID fpreg)
     {
-        static const char* xmmnames[8]
+        static const char* xmmnames[16]
           = { "%xmm0", "%xmm1", "%xmm2", "%xmm3",
-              "%xmm4", "%xmm5", "%xmm6", "%xmm7" };
+              "%xmm4", "%xmm5", "%xmm6", "%xmm7",
+              "%xmm8", "%xmm9", "%xmm10", "%xmm11",
+              "%xmm12", "%xmm13", "%xmm14", "%xmm15" };
         int off = (XMMRegisterID)fpreg - (XMMRegisterID)xmm0;
-        return (off < 0 || off > 7) ? "%xmm?" : xmmnames[off];
+        return (off < 0 || off > 15) ? "%xmm?" : xmmnames[off];
     }
 
     static const char* nameIReg(int szB, RegisterID reg)
     {
         static const char* r64names[16]
           = { "%rax", "%rcx", "%rdx", "%rbx", "%rsp", "%rbp", "%rsi", "%rdi",
               "%r8", "%r9", "%r10", "%r11", "%r12", "%r13", "%r14", "%r15" };
         static const char* r32names[16]
@@ -172,24 +186,31 @@ public:
     {
         static const char* names[16]
           = { "o ", "no", "b ", "ae", "e ", "ne", "be", "a ",
               "s ", "ns", "p ", "np", "l ", "ge", "le", "g " };
         int ix = (int)cc;
         return (ix < 0 || ix > 15) ? "??" : names[ix];
     }
 
+    // Rounding modes for ROUNDSD.
+    typedef enum {
+        RoundToNearest = 0x0,
+        RoundDown      = 0x1,
+        RoundUp        = 0x2,
+        RoundToZero    = 0x3
+    } RoundingMode;
+
 private:
     typedef enum {
         OP_ADD_EvGv                     = 0x01,
         OP_ADD_GvEv                     = 0x03,
         OP_OR_EvGv                      = 0x09,
         OP_OR_GvEv                      = 0x0B,
         OP_2BYTE_ESCAPE                 = 0x0F,
-        OP_3BYTE_ESCAPE                 = 0x3A,
         OP_AND_EvGv                     = 0x21,
         OP_AND_GvEv                     = 0x23,
         OP_SUB_EvGv                     = 0x29,
         OP_SUB_GvEv                     = 0x2B,
         PRE_PREDICT_BRANCH_NOT_TAKEN    = 0x2E,
         OP_XOR_EvGv                     = 0x31,
         OP_XOR_GvEv                     = 0x33,
         OP_CMP_EvGv                     = 0x39,
@@ -208,35 +229,38 @@ private:
 #endif
         PRE_OPERAND_SIZE                = 0x66,
         PRE_SSE_66                      = 0x66,
         OP_PUSH_Iz                      = 0x68,
         OP_IMUL_GvEvIz                  = 0x69,
         OP_GROUP1_EbIb                  = 0x80,
         OP_GROUP1_EvIz                  = 0x81,
         OP_GROUP1_EvIb                  = 0x83,
+        OP_TEST_EbGb                    = 0x84,
         OP_TEST_EvGv                    = 0x85,
         OP_XCHG_EvGv                    = 0x87,
         OP_MOV_EbGv                     = 0x88,
         OP_MOV_EvGv                     = 0x89,
         OP_MOV_GvEv                     = 0x8B,
         OP_LEA                          = 0x8D,
         OP_GROUP1A_Ev                   = 0x8F,
+        OP_NOP                          = 0x90,
         OP_CDQ                          = 0x99,
         OP_MOV_EAXOv                    = 0xA1,
         OP_MOV_OvEAX                    = 0xA3,
         OP_MOV_EAXIv                    = 0xB8,
         OP_GROUP2_EvIb                  = 0xC1,
         OP_RET_Iz                       = 0xC2,
         OP_RET                          = 0xC3,
         OP_GROUP11_EvIb                 = 0xC6,
         OP_GROUP11_EvIz                 = 0xC7,
         OP_INT3                         = 0xCC,
         OP_GROUP2_Ev1                   = 0xD1,
         OP_GROUP2_EvCL                  = 0xD3,
+	OP_FPU6				= 0xDD,
         OP_CALL_rel32                   = 0xE8,
         OP_JMP_rel32                    = 0xE9,
         PRE_SSE_F2                      = 0xF2,
         PRE_SSE_F3                      = 0xF3,
         OP_HLT                          = 0xF4,
         OP_GROUP3_EbIb                  = 0xF6,
         OP_GROUP3_Ev                    = 0xF7,
         OP_GROUP3_EvIz                  = 0xF7, // OP_GROUP3_Ev has an immediate, when instruction is a test. 
@@ -245,16 +269,17 @@ private:
 
     typedef enum {
         OP2_MOVSD_VsdWsd    = 0x10,
         OP2_MOVSD_WsdVsd    = 0x11,
         OP2_UNPCKLPS_VsdWsd = 0x14,
         OP2_CVTSI2SD_VsdEd  = 0x2A,
         OP2_CVTTSD2SI_GdWsd = 0x2C,
         OP2_UCOMISD_VsdWsd  = 0x2E,
+        OP2_MOVMSKPD_EdVd   = 0x50,
         OP2_ADDSD_VsdWsd    = 0x58,
         OP2_MULSD_VsdWsd    = 0x59,
         OP2_CVTSS2SD_VsdEd  = 0x5A,
         OP2_CVTSD2SS_VsdEd  = 0x5A,
         OP2_SUBSD_VsdWsd    = 0x5C,
         OP2_DIVSD_VsdWsd    = 0x5E,
         OP2_SQRTSD_VsdWsd   = 0x51,
         OP2_ANDPD_VpdWpd    = 0x54,
@@ -268,19 +293,27 @@ private:
         OP2_MOVSX_GvEb      = 0xBE,
         OP2_MOVSX_GvEw      = 0xBF,
         OP2_MOVZX_GvEb      = 0xB6,
         OP2_MOVZX_GvEw      = 0xB7,
         OP2_PEXTRW_GdUdIb   = 0xC5
     } TwoByteOpcodeID;
 
     typedef enum {
+        OP3_ROUNDSD_VsdWsd  = 0x0B,
+        OP3_PTEST_VdVd      = 0x17,
         OP3_PINSRD_VsdWsd   = 0x22
     } ThreeByteOpcodeID;
 
+    typedef enum {
+        ESCAPE_PTEST        = 0x38,
+        ESCAPE_PINSRD       = 0x3A,
+        ESCAPE_ROUNDSD      = 0x3A 
+    } ThreeByteEscape;
+
     TwoByteOpcodeID jccRel32(Condition cond)
     {
         return (TwoByteOpcodeID)(OP2_JCC_rel32 + cond);
     }
 
     TwoByteOpcodeID setccOpcode(Condition cond)
     {
         return (TwoByteOpcodeID)(OP_SETCC + cond);
@@ -305,16 +338,18 @@ private:
         GROUP3_OP_NOT  = 2,
         GROUP3_OP_NEG  = 3,
         GROUP3_OP_IDIV = 7,
 
         GROUP5_OP_CALLN = 2,
         GROUP5_OP_JMPN  = 4,
         GROUP5_OP_PUSH  = 6,
 
+        FPU6_OP_FSTP = 3,
+
         GROUP11_MOV = 0
     } GroupOpcodeID;
     
     class X86InstructionFormatter;
 public:
 
 #ifdef JS_METHODJIT_SPEW
     bool isOOLPath;
@@ -324,61 +359,75 @@ public:
         friend class X86Assembler;
         friend class X86InstructionFormatter;
     public:
         JmpSrc()
             : m_offset(-1)
         {
         }
 
-    private:
         JmpSrc(int offset)
             : m_offset(offset)
         {
         }
 
+        int offset() const {
+            return m_offset;
+        }
+
+    private:
         int m_offset;
     };
     
     class JmpDst {
         friend class X86Assembler;
         friend class X86InstructionFormatter;
     public:
         JmpDst()
             : m_offset(-1)
             , m_used(false)
         {
         }
 
         bool isUsed() const { return m_used; }
         void used() { m_used = true; }
         bool isValid() const { return m_offset != -1; }
-    private:
+
         JmpDst(int offset)
             : m_offset(offset)
             , m_used(false)
         {
             ASSERT(m_offset == offset);
         }
-
+        int offset() const {
+            return m_offset;
+        }
+    private:
         signed int m_offset : 31;
         bool m_used : 1;
     };
 
     X86Assembler()
 #ifdef JS_METHODJIT_SPEW
       : isOOLPath(false)
 #endif
     {
     }
 
     size_t size() const { return m_formatter.size(); }
     unsigned char *buffer() const { return m_formatter.buffer(); }
     bool oom() const { return m_formatter.oom(); }
 
+    void nop()
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "nop\n", MAYBE_PAD);
+        m_formatter.oneByteOp(OP_NOP);
+    }
+
     // Stack operations:
 
     void push_r(RegisterID reg)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "push       %s\n", MAYBE_PAD, nameIReg(reg));
         m_formatter.oneByteOp(OP_PUSH_EAX, reg);
     }
@@ -434,17 +483,19 @@ public:
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "addl       %s, %s\n", MAYBE_PAD,
                        nameIReg(4,src), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_ADD_EvGv, src, dst);
     }
 
     void addl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "addl       %s0x%x(%s), %s\n", MAYBE_PAD,
+                       PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_ADD_GvEv, dst, base, offset);
     }
 
     void addl_rm(RegisterID src, int offset, RegisterID base)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_ADD_EvGv, src, base, offset);
     }
@@ -528,17 +579,19 @@ public:
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "andl       %s, %s\n", MAYBE_PAD,
                        nameIReg(4,src), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_AND_EvGv, src, dst);
     }
 
     void andl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "andl       %s0x%x(%s), %s\n", MAYBE_PAD,
+                       PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_AND_GvEv, dst, base, offset);
     }
 
     void andl_rm(RegisterID src, int offset, RegisterID base)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_AND_EvGv, src, base, offset);
     }
@@ -614,16 +667,21 @@ public:
             m_formatter.immediate8(imm);
         } else {
             m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, addr);
             m_formatter.immediate32(imm);
         }
     }
 #endif
 
+    void fstp_m(int offset, RegisterID base)
+    {
+	m_formatter.oneByteOp(OP_FPU6, FPU6_OP_FSTP, base, offset);
+    }
+
     void negl_r(RegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "negl       %s\n", MAYBE_PAD, nameIReg(4,dst));
         m_formatter.oneByteOp(OP_GROUP3_Ev, GROUP3_OP_NEG, dst);
     }
 
     void negl_m(int offset, RegisterID base)
@@ -744,17 +802,19 @@ public:
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "subl       %s, %s\n", MAYBE_PAD,
                        nameIReg(4,src), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_SUB_EvGv, src, dst);
     }
 
     void subl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "subl        %s0x%x(%s), %s\n", MAYBE_PAD,
+                       PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_SUB_GvEv, dst, base, offset);
     }
 
     void subl_rm(RegisterID src, int offset, RegisterID base)
     {
         FIXME_INSN_PRINTING;
         m_formatter.oneByteOp(OP_SUB_EvGv, src, base, offset);
     }
@@ -967,16 +1027,28 @@ public:
                        IPFX "shlq       $%d, %s\n", MAYBE_PAD, imm, nameIReg(8, dst));
         if (imm == 1)
             m_formatter.oneByteOp64(OP_GROUP2_Ev1, GROUP2_OP_SHL, dst);
         else {
             m_formatter.oneByteOp64(OP_GROUP2_EvIb, GROUP2_OP_SHL, dst);
             m_formatter.immediate8(imm);
         }
     }
+
+    void shrq_i8r(int imm, RegisterID dst)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "shrq       $%d, %s\n", MAYBE_PAD, imm, nameIReg(8, dst));
+        if (imm == 1)
+            m_formatter.oneByteOp64(OP_GROUP2_Ev1, GROUP2_OP_SHR, dst);
+        else {
+            m_formatter.oneByteOp64(OP_GROUP2_EvIb, GROUP2_OP_SHR, dst);
+            m_formatter.immediate8(imm);
+        }
+    }
 #endif
 
     void imull_rr(RegisterID src, RegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "imull       %s, %s\n", MAYBE_PAD, nameIReg(4,src), nameIReg(4, dst));
         m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, src);
     }
@@ -1088,17 +1160,19 @@ public:
         } else {
             m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, index, scale, offset);
             m_formatter.immediate32(imm);
         }
     }
 
     void cmpl_im_force32(int imm, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "cmpl       $0x%x, %s0x%x(%s)\n", MAYBE_PAD,
+                       imm, PRETTY_PRINT_OFFSET(offset), nameIReg(4,base));
         m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, offset);
         m_formatter.immediate32(imm);
     }
 
 #if WTF_CPU_X86_64
     void cmpq_rr(RegisterID src, RegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
@@ -1203,16 +1277,24 @@ public:
 
     void testl_rr(RegisterID src, RegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "testl      %s, %s\n", MAYBE_PAD,
                        nameIReg(4,src), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
     }
+
+    void testb_rr(RegisterID src, RegisterID dst)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "testb      %s, %s\n", MAYBE_PAD,
+                       nameIReg(1,src), nameIReg(1,dst));
+        m_formatter.oneByteOp(OP_TEST_EbGb, src, dst);
+    }
     
     void testl_i32r(int imm, RegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "testl      $0x%x, %s\n", MAYBE_PAD,
                        imm, nameIReg(dst));
         m_formatter.oneByteOp(OP_GROUP3_EvIz, GROUP3_OP_TEST, dst);
         m_formatter.immediate32(imm);
@@ -1620,17 +1702,19 @@ public:
                        nameIReg(4, src), nameIReg(8, dst));
         m_formatter.oneByteOp64(OP_MOVSXD_GvEv, dst, src);
     }
     
     
 #else
     void movl_rm(RegisterID src, void* addr)
     {
-        FIXME_INSN_PRINTING;
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "movl       %s, 0(%p)\n", MAYBE_PAD,
+                       nameIReg(4, src), addr);
         if (src == X86Registers::eax)
             movl_EAXm(addr);
         else 
             m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
     }
     
     void movl_mr(void* addr, RegisterID dst)
     {
@@ -1784,17 +1868,19 @@ public:
         JmpSrc r = JmpSrc(m_formatter.size());
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "call       *%s\n", MAYBE_PAD, nameIReg(dst));
         return r;
     }
     
     void call_m(int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "call       %s0x%x(%s)\n", MAYBE_PAD,
+                       PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, base, offset);
     }
 
     JmpSrc jmp()
     {
         m_formatter.oneByteOp(OP_JMP_rel32);
         JmpSrc r = m_formatter.immediateRel32();
         js::JaegerSpew(js::JSpew_Insns,
@@ -1822,16 +1908,28 @@ public:
 
     void jmp_m(int offset, RegisterID base, RegisterID index, int scale) {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "jmp       ((%d(%s,%s,%d)))\n", MAYBE_PAD,
                        offset, nameIReg(base), nameIReg(index), scale);
         m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, base, index, scale, offset);
     }
 
+#if WTF_CPU_X86_64
+    void jmp_rip(int ripOffset) {
+        // rip-relative addressing.
+        m_formatter.oneByteRipOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, ripOffset);
+    }
+
+    void immediate64(int64_t imm)
+    {
+        m_formatter.immediate64(imm);
+    }
+#endif
+
     JmpSrc jne()
     {
         return jCC(ConditionNE);
     }
     
     JmpSrc jnz()
     {
         // printing done by jne()
@@ -1951,16 +2049,27 @@ public:
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "addsd      %s0x%x(%s), %s\n", MAYBE_PAD,
                        PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameFPReg(dst));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, (RegisterID)dst, base, offset);
     }
 
+#if !WTF_CPU_X86_64
+    void addsd_mr(const void* address, XMMRegisterID dst)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "addsd      %p, %s\n", MAYBE_PAD,
+                       address, nameFPReg(dst));
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_ADDSD_VsdWsd, (RegisterID)dst, address);
+    }
+#endif
+
     void cvtss2sd_rr(XMMRegisterID src, XMMRegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "cvtps2pd   %s, %s\n", MAYBE_PAD,
                        nameFPReg(src), nameFPReg(dst));
         m_formatter.prefix(PRE_SSE_F3);
         m_formatter.twoByteOp(OP2_CVTSS2SD_VsdEd, (RegisterID)dst, (RegisterID)src);
     }
@@ -1998,16 +2107,25 @@ public:
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "cvtsi2sd   %s0x%x(%s), %s\n", MAYBE_PAD,
                        PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameFPReg(dst));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, offset);
     }
 
+    void cvtsi2sd_mr(int offset, RegisterID base, RegisterID index, int scale, XMMRegisterID dst)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "cvtsi2sd   %d(%s,%s,%d), %s\n", MAYBE_PAD,
+                       offset, nameIReg(base), nameIReg(index), scale, nameFPReg(dst));
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, base, index, scale, offset);
+    }
+
 #if !WTF_CPU_X86_64
     void cvtsi2sd_mr(void* address, XMMRegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "cvtsi2sd   %p, %s\n", MAYBE_PAD,
                        address, nameFPReg(dst));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_CVTSI2SD_VsdEd, (RegisterID)dst, address);
@@ -2018,16 +2136,27 @@ public:
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "cvttsd2si  %s, %s\n", MAYBE_PAD,
                        nameFPReg(src), nameIReg(dst));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_CVTTSD2SI_GdWsd, dst, (RegisterID)src);
     }
 
+#if WTF_CPU_X86_64
+    void cvttsd2sq_rr(XMMRegisterID src, RegisterID dst)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "cvttsd2sq  %s, %s\n", MAYBE_PAD,
+                       nameFPReg(src), nameIReg(dst));
+        m_formatter.prefix(PRE_SSE_F2);
+        m_formatter.twoByteOp64(OP2_CVTTSD2SI_GdWsd, dst, (RegisterID)src);
+    }
+#endif
+
     void unpcklps_rr(XMMRegisterID src, XMMRegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "unpcklps   %s, %s\n", MAYBE_PAD,
                        nameFPReg(src), nameFPReg(dst));
         m_formatter.twoByteOp(OP2_UNPCKLPS_VsdWsd, (RegisterID)dst, (RegisterID)src);
     }
 
@@ -2045,16 +2174,33 @@ public:
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "pslldq     %s, %d\n", MAYBE_PAD,
                        nameFPReg(dest), shift);
         m_formatter.prefix(PRE_SSE_66);
         m_formatter.twoByteOp(OP2_PSRLDQ_Vd, (RegisterID)3, (RegisterID)dest);
         m_formatter.immediate8(shift);
     }
 
+    void movmskpd_rr(XMMRegisterID src, RegisterID dst)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "movmskpd   %s, %s\n", MAYBE_PAD,
+                       nameFPReg(src), nameIReg(dst));
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp(OP2_MOVMSKPD_EdVd, dst, (RegisterID)src);
+    }
+
+    void ptest_rr(XMMRegisterID lhs, XMMRegisterID rhs) {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "ptest      %s, %s\n", MAYBE_PAD,
+                       nameFPReg(lhs), nameFPReg(rhs));
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP3_PTEST_VdVd, ESCAPE_PTEST, (RegisterID)rhs, (RegisterID)lhs);
+    }
+
     void movd_rr(XMMRegisterID src, RegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "movd       %s, %s\n", MAYBE_PAD,
                        nameFPReg(src), nameIReg(dst));
         m_formatter.prefix(PRE_SSE_66);
         m_formatter.twoByteOp(OP2_MOVD_EdVd, (RegisterID)src, dst);
     }
@@ -2273,23 +2419,44 @@ public:
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "sqrtsd     %s, %s\n", MAYBE_PAD,
                        nameFPReg(src), nameFPReg(dst));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_SQRTSD_VsdWsd, (RegisterID)dst, (RegisterID)src);
     }
 
+    void roundsd_rr(XMMRegisterID src, XMMRegisterID dst, RoundingMode mode)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "roundsd     %s, %s, %d\n", MAYBE_PAD,
+                       nameFPReg(src), nameFPReg(dst), (int)mode);
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP3_ROUNDSD_VsdWsd, ESCAPE_ROUNDSD, (RegisterID)dst, (RegisterID)src);
+        m_formatter.immediate8(mode);
+    }
+
     void pinsrd_rr(RegisterID src, XMMRegisterID dst)
     {
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "pinsrd     $1, %s, %s\n", MAYBE_PAD,
                        nameIReg(src), nameFPReg(dst));
         m_formatter.prefix(PRE_SSE_66);
-        m_formatter.threeByteOp(OP3_PINSRD_VsdWsd, (RegisterID)dst, (RegisterID)src);
+        m_formatter.threeByteOp(OP3_PINSRD_VsdWsd, ESCAPE_PINSRD, (RegisterID)dst, (RegisterID)src);
+        m_formatter.immediate8(0x01); // the $1
+    }
+
+    void pinsrd_mr(int offset, RegisterID base, XMMRegisterID dst)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       IPFX "pinsrd     $1, %s0x%x(%s), %s\n", MAYBE_PAD,
+                       PRETTY_PRINT_OFFSET(offset),
+                       nameIReg(base), nameFPReg(dst));
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP3_PINSRD_VsdWsd, ESCAPE_PINSRD, (RegisterID)dst, base, offset);
         m_formatter.immediate8(0x01); // the $1
     }
 
     // Misc instructions:
 
     void int3()
     {
         js::JaegerSpew(js::JSpew_Insns, IPFX "int3\n", MAYBE_PAD);
@@ -2335,16 +2502,20 @@ public:
 
     JmpDst label()
     {
         JmpDst r = JmpDst(m_formatter.size());
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "#label     ((%d))\n", MAYBE_PAD, r.m_offset);
         return r;
     }
+
+    size_t currentOffset() const {
+        return m_formatter.size();
+    }
     
     static JmpDst labelFor(JmpSrc jump, intptr_t offset = 0)
     {
         FIXME_INSN_PRINTING;
         return JmpDst(jump.m_offset + offset);
     }
     
     JmpDst align(int alignment)
@@ -2358,22 +2529,50 @@ public:
 
     // Linking & patching:
     //
     // 'link' and 'patch' methods are for use on unprotected code - such as the code
     // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
     // code has been finalized it is (platform support permitting) within a non-
     // writable region of memory; to modify the code in an execute-only execuable
     // pool the 'repatch' and 'relink' methods should be used.
+    
+    // Like Lua's emitter, we thread jump lists through the unpatched target
+    // field, which will get fixed up when the label (which has a pointer to
+    // the head of the jump list) is bound.
+    bool nextJump(const JmpSrc& from, JmpSrc* next)
+    {
+        char* code = reinterpret_cast<char*>(m_formatter.data());
+        int32_t offset = getInt32(code + from.m_offset);
+        if (offset == -1)
+            return false;
+        *next = JmpSrc(offset);
+        return true;
+    }
+    void setNextJump(const JmpSrc& from, const JmpSrc &to)
+    {
+        // Sanity check - if the assembler has OOM'd, it will start overwriting
+        // its internal buffer and thus our links could be garbage.
+        if (oom())
+            return;
+
+        char* code = reinterpret_cast<char*>(m_formatter.data());
+        setInt32(code + from.m_offset, to.m_offset);
+    }
 
     void linkJump(JmpSrc from, JmpDst to)
     {
         ASSERT(from.m_offset != -1);
         ASSERT(to.m_offset != -1);
 
+        // Sanity check - if the assembler has OOM'd, it will start overwriting
+        // its internal buffer and thus our links could be garbage.
+        if (oom())
+            return;
+
         js::JaegerSpew(js::JSpew_Insns,
                        IPFX "##link     ((%d)) jumps to ((%d))\n", MAYBE_PAD,
                        from.m_offset, to.m_offset);
         char* code = reinterpret_cast<char*>(m_formatter.data());
         setRel32(code + from.m_offset, code + to.m_offset);
     }
     
     static void linkJump(void* code, JmpSrc from, void* to)
@@ -2507,44 +2706,64 @@ public:
         return m_formatter.executableAllocAndCopy(allocator, poolp, kind);
     }
 
     void executableCopy(void* buffer)
     {
         memcpy(buffer, m_formatter.buffer(), size());
     }
 
-private:
-
-    static void setPointer(void* where, void* value)
-    {
-        js::JaegerSpew(js::JSpew_Insns,
-                       ISPFX "##setPtr     ((where=%p)) ((value=%p))\n", where, value);
-        reinterpret_cast<void**>(where)[-1] = value;
-    }
-
-    static void setInt32(void* where, int32_t value)
-    {
-        reinterpret_cast<int32_t*>(where)[-1] = value;
-    }
-
     static void setRel32(void* from, void* to)
     {
         intptr_t offset = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
         ASSERT(offset == static_cast<int32_t>(offset));
 #define JS_CRASH(x) *(int *)x = 0
         if (offset != static_cast<int32_t>(offset))
             JS_CRASH(0xC0DE);
 #undef JS_CRASH
 
         js::JaegerSpew(js::JSpew_Insns,
                        ISPFX "##setRel32 ((from=%p)) ((to=%p))\n", from, to);
         setInt32(from, offset);
     }
 
+    static void *getRel32Target(void* where)
+    {
+        int32_t rel = getInt32(where);
+        return (char *)where + rel;
+    }
+
+    static void *getPointer(void* where)
+    {
+        return reinterpret_cast<void **>(where)[-1];
+    }
+
+    static void **getPointerRef(void* where)
+    {
+        return &reinterpret_cast<void **>(where)[-1];
+    }
+
+    static void setPointer(void* where, const void* value)
+    {
+        js::JaegerSpew(js::JSpew_Insns,
+                       ISPFX "##setPtr     ((where=%p)) ((value=%p))\n", where, value);
+        reinterpret_cast<const void**>(where)[-1] = value;
+    }
+
+private:
+
+    static int32_t getInt32(void* where)
+    {
+        return reinterpret_cast<int32_t*>(where)[-1];
+    }
+    static void setInt32(void* where, int32_t value)
+    {
+        reinterpret_cast<int32_t*>(where)[-1] = value;
+    }
+
     class X86InstructionFormatter {
 
         static const int maxInstructionSize = 16;
 
     public:
 
         // Legacy prefix bytes:
         //
@@ -2616,16 +2835,24 @@ private:
 
 #if !WTF_CPU_X86_64
         void oneByteOp(OneByteOpcodeID opcode, int reg, void* address)
         {
             m_buffer.ensureSpace(maxInstructionSize);
             m_buffer.putByteUnchecked(opcode);
             memoryModRM(reg, address);
         }
+#else
+        void oneByteRipOp(OneByteOpcodeID opcode, int reg, int ripOffset)
+        {
+            m_buffer.ensureSpace(maxInstructionSize);
+            m_buffer.putByteUnchecked(opcode);
+            putModRm(ModRmMemoryNoDisp, reg, noBase);
+            m_buffer.putIntUnchecked(ripOffset);
+        }
 #endif
 
         void twoByteOp(TwoByteOpcodeID opcode)
         {
             m_buffer.ensureSpace(maxInstructionSize);
             m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);
             m_buffer.putByteUnchecked(opcode);
         }
@@ -2662,26 +2889,36 @@ private:
         {
             m_buffer.ensureSpace(maxInstructionSize);
             m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);
             m_buffer.putByteUnchecked(opcode);
             memoryModRM(reg, address);
         }
 #endif
 
-        void threeByteOp(ThreeByteOpcodeID opcode, int reg, RegisterID rm)
+        void threeByteOp(ThreeByteOpcodeID opcode, ThreeByteEscape escape, int reg, RegisterID rm)
         {
             m_buffer.ensureSpace(maxInstructionSize);
             emitRexIfNeeded(reg, 0, rm);
             m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);
-            m_buffer.putByteUnchecked(OP_3BYTE_ESCAPE);
+            m_buffer.putByteUnchecked(escape);
             m_buffer.putByteUnchecked(opcode);
             registerModRM(reg, rm);
         }
 
+        void threeByteOp(ThreeByteOpcodeID opcode, ThreeByteEscape escape, int reg, RegisterID base, int offset)
+        {
+            m_buffer.ensureSpace(maxInstructionSize);
+            emitRexIfNeeded(reg, 0, base);
+            m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            m_buffer.putByteUnchecked(escape);
+            m_buffer.putByteUnchecked(opcode);
+            memoryModRM(reg, base, offset);
+        }
+
 #if WTF_CPU_X86_64
         // Quad-word-sized operands:
         //
         // Used to format 64-bit operantions, planting a REX.w prefix.
         // When planting d64 or f64 instructions, not requiring a REX.w prefix,
         // the normal (non-'64'-postfixed) formatters should be used.
 
         void oneByteOp64(OneByteOpcodeID opcode)
--- a/js/src/assembler/jit/ExecutableAllocator.h
+++ b/js/src/assembler/jit/ExecutableAllocator.h
@@ -491,8 +491,9 @@ private:
     static size_t determinePageSize();
 };
 
 }
 
 #endif // ENABLE(ASSEMBLER)
 
 #endif // !defined(ExecutableAllocator)
+
--- a/js/src/assembler/wtf/Platform.h
+++ b/js/src/assembler/wtf/Platform.h
@@ -240,16 +240,17 @@
     && !defined(__VFP_FP__) \
     && !defined(_WIN32_WCE) \
     && !defined(ANDROID)
 #define WTF_CPU_MIDDLE_ENDIAN 1
 
 #endif
 
 #define WTF_ARM_ARCH_AT_LEAST(N) (CPU(ARM) && WTF_ARM_ARCH_VERSION >= N)
+#define WTF_ARM_ARCH_AT_LEAST_5 (WTF_CPU_ARM && WTF_ARM_ARCH_VERSION >= 5)
 
 /* Set WTF_ARM_ARCH_VERSION */
 #if   defined(__ARM_ARCH_4__) \
     || defined(__ARM_ARCH_4T__) \
     || defined(__MARM_ARMV4__) \
     || defined(_ARMV4I_)
 #define WTF_ARM_ARCH_VERSION 4
 
new file mode 100644
--- /dev/null
+++ b/js/src/builtin/ParallelArray.cpp
@@ -0,0 +1,1096 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=4 sw=4 et tw=99:
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Intel RiverTrail implementation.
+ *
+ * The Initial Developer of the Original Code is
+ *   Intel Corporation
+ * Portions created by the Initial Developer are Copyright (C) 2011
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Stephan Herhut <stephan.a.herhut@intel.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "jsapi.h"
+#include "jsobj.h"
+#include "jsprf.h"
+
+#include "vm/MethodGuard-inl.h"
+#include "jsobjinlines.h"
+#include "jsarrayinlines.h"
+
+using namespace js;
+
+enum {
+    JSSLOT_PA_LENGTH = 0,
+    JSSLOT_PA_BUFFER,
+    JSSLOT_PA_MAX
+};
+
+inline uint32_t
+GetLength(JSObject *obj)
+{
+    return uint32_t(obj->getSlot(JSSLOT_PA_LENGTH).toInt32());
+}
+
+inline JSObject *
+GetBuffer(JSObject *obj)
+{
+    return &(obj->getSlot(JSSLOT_PA_BUFFER).toObject());
+}
+
+static JSObject *
+NewParallelArray(JSContext *cx, JSObject *buffer, uint32_t length)
+{
+    JSObject *result = NewBuiltinClassInstance(cx, &ParallelArrayClass);
+    if (!result)
+        return NULL;
+
+    result->setSlot(JSSLOT_PA_LENGTH, Int32Value(int32_t(length)));
+    result->setSlot(JSSLOT_PA_BUFFER, ObjectValue(*buffer));
+
+    return result;
+}
+
+static JSBool
+ParallelArray_get(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    bool ok;
+    RootedObject obj(cx, NonGenericMethodGuard(cx, args, ParallelArray_get, &ParallelArrayClass, &ok));
+    if (!obj)
+        return ok;
+
+    if (args.length() < 1) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
+                             "ParallelArray.get", "0", "s");
+        return false;
+    }
+
+    uint32_t index;
+    if (!ToUint32(cx, args[0], &index))
+        return false;
+
+    uint32_t length = GetLength(obj);
+
+    if (index >= length)
+        return false;
+
+    args.rval() = GetBuffer(obj)->getDenseArrayElement(index);
+
+    return true;
+}
+
+static JSBool
+ParallelArray_build(JSContext *cx, uint32_t length, const Value &thisv, JSObject *elementalFun,
+                    bool passElement, unsigned extrasc, Value *extrasp, Value *vp)
+{
+    /* create data store for results */
+    RootedObject buffer(cx, NewDenseAllocatedArray(cx, length));
+    if (!buffer)
+        return false;
+
+    buffer->ensureDenseArrayInitializedLength(cx, length, 0);
+
+    /* grab source buffer if we need to pass elements */
+    RootedObject srcBuffer(cx);
+    if (passElement)
+        srcBuffer = &(thisv.toObject().getSlot(JSSLOT_PA_BUFFER).toObject());
+
+    /* prepare call frame on stack */
+    InvokeArgsGuard args;
+    cx->stack.pushInvokeArgs(cx, extrasc + 1, &args);
+
+    RootedObject extra(cx);
+    for (uint32_t i = 0; i < length; i++) {
+        args.setCallee(ObjectValue(*elementalFun));
+        if (passElement)
+            args[0] = srcBuffer->getDenseArrayElement(i);
+        else
+            args[0].setNumber(i);
+
+        /* set value of this */
+        args.thisv() = thisv;
+
+        /* set extra arguments */
+        for (unsigned j = 0; j < extrasc; j++) {
+            extra = &extrasp[j].toObject();
+
+            if (!extra->getElement(cx, extra, i, &(args[j+1])))
+                return false;
+        }
+
+        /* call */
+        if (!Invoke(cx, args))
+            return false;
+
+        /* set result element */
+        buffer->setDenseArrayElementWithType(cx, i, args.rval());
+    }
+
+    /* create ParallelArray wrapper class */
+    RootedObject result(cx, NewParallelArray(cx, buffer, length));
+    if (!result)
+        return false;
+
+    vp->setObject(*result);
+    return true;
+}
+
+static JSBool
+ParallelArray_construct(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    if (args.length() < 1) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
+                             "ParallelArray", "0", "s");
+        return false;
+    }
+
+    if (args.length() == 1) {
+        /* first case: init using an array value */
+        if (!args[0].isObject()) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NOT_NONNULL_OBJECT);
+            return false;
+        }
+
+        RootedObject src(cx, &(args[0].toObject()));
+
+        uint32_t srcLen;
+        if (!js_GetLengthProperty(cx, src, &srcLen))
+            return false;
+
+        /* allocate buffer for result */
+        RootedObject buffer(cx, NewDenseAllocatedArray(cx, srcLen));
+        if (!buffer)
+            return false;
+
+        buffer->ensureDenseArrayInitializedLength(cx, srcLen, 0);
+
+        for (uint32_t i = 0; i < srcLen; i++) {
+            Value elem;
+            if (src->isDenseArray() && (i < src->getDenseArrayInitializedLength())) {
+                /* dense array case */
+                elem = src->getDenseArrayElement(i);
+                if (elem.isMagic(JS_ARRAY_HOLE))
+                    elem.setUndefined();
+            } else {
+                /* generic case */
+                if (!src->getElement(cx, src, i, &elem))
+                    return false;
+            }
+
+            buffer->setDenseArrayElementWithType(cx, i, elem);
+        }
+
+        RootedObject result(cx, NewParallelArray(cx, buffer, srcLen));
+        if (!result)
+            return false;
+
+        args.rval().setObject(*result);
+        return true;
+    }
+
+    /* second case: init using length and function */
+    /* extract first argument, the length */
+    uint32_t length;
+    if (!ToUint32(cx, args[0], &length))
+        return false;
+
+    /* extract second argument, the elemental function */
+    RootedObject elementalFun(cx, js_ValueToCallableObject(cx, &args[1], JSV2F_SEARCH_STACK));
+    if (!elementalFun)
+        return false;
+
+    /* use build with |this| set to |undefined| */
+    return ParallelArray_build(cx, length, UndefinedValue(), elementalFun, false, 0, NULL, &(args.rval()));
+}
+
+/* forward declaration */
+static JSBool
+ParallelArray_mapOrCombine(JSContext *cx, unsigned argc, Value *vp, bool isMap);
+
+static JSBool
+ParallelArray_map(JSContext *cx, unsigned argc, Value *vp)
+{
+    return ParallelArray_mapOrCombine(cx, argc, vp, true);
+}
+
+static JSBool
+ParallelArray_combine(JSContext *cx, unsigned argc, Value *vp)
+{
+    return ParallelArray_mapOrCombine(cx, argc, vp, false);
+}
+
+static JSBool
+ParallelArray_mapOrCombine(JSContext *cx, unsigned argc, Value *vp, bool isMap)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    /* make sure we are called on a ParallelArray */
+    bool ok;
+    RootedObject obj(cx);
+    obj = NonGenericMethodGuard(cx, args, (isMap ? ParallelArray_map : ParallelArray_combine),
+                                &ParallelArrayClass, &ok);
+    if (!obj)
+        return ok;
+
+    if (args.length() < 1) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
+                             (isMap ? "map" : "combine"), "0", "s");
+        return false;
+    }
+
+    /* extract first argument, the elemental function */
+    RootedObject elementalFun(cx, js_ValueToCallableObject(cx, &args[0], JSV2F_SEARCH_STACK));
+    if (!elementalFun)
+        return false;
+
+    /* check extra arguments for map to be objects */
+    if (isMap && (argc > 1)) {
+        for (unsigned i = 1; i < argc; i++) {
+            if (!args[i].isObject()) {
+                char buffer[4];
+                JS_snprintf(buffer, 4, "%d", i+1);
+                JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_MAP_INVALID_ARG,
+                                     buffer);
+
+                return false;
+            }
+        }
+    }
+
+    return ParallelArray_build(cx, GetLength(obj), ObjectValue(*obj), elementalFun, isMap,
+                               (isMap ? argc-1 : 0), ((argc > 1) ? &(args[1]) : NULL), &(args.rval()));
+}
+
+/* forward declaration */
+static JSBool
+ParallelArray_scanOrReduce(JSContext *cx, unsigned argc, Value *vp, bool isScan);
+
+static JSBool
+ParallelArray_scan(JSContext *cx, unsigned argc, Value *vp)
+{
+    return ParallelArray_scanOrReduce(cx, argc, vp, true);
+}
+
+static JSBool
+ParallelArray_reduce(JSContext *cx, unsigned argc, Value *vp)
+{
+    return ParallelArray_scanOrReduce(cx, argc, vp, false);
+}
+
+static JSBool
+ParallelArray_scanOrReduce(JSContext *cx, unsigned argc, Value *vp, bool isScan)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    /* make sure we are called on a ParallelArray */
+    bool ok;
+    RootedObject obj(cx);
+    obj = NonGenericMethodGuard(cx, args, (isScan ? ParallelArray_scan : ParallelArray_reduce), &ParallelArrayClass, &ok);
+    if (!obj)
+        return ok;
+
+    if (args.length() < 1) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
+                             (isScan ? "scan" : "reduce"), "0", "s");
+        return false;
+    }
+
+    uint32_t length = GetLength(obj);
+
+    RootedObject result(cx);
+    RootedObject resBuffer(cx);
+    if (isScan) {
+        /* create data store for results */
+        resBuffer = NewDenseAllocatedArray(cx, length);
+        if (!resBuffer)
+            return false;
+
+        resBuffer->ensureDenseArrayInitializedLength(cx, length, 0);
+
+        /* create ParallelArray wrapper class */
+        result = NewParallelArray(cx, resBuffer, length);
+        if (!result)
+            return false;
+    }
+
+    /* extract first argument, the elemental function */
+    RootedObject elementalFun(cx, js_ValueToCallableObject(cx, &args[0], JSV2F_SEARCH_STACK));
+    if (!elementalFun)
+        return false;
+
+    /* special case of empty arrays */
+    if (length == 0) {
+        args.rval() = (isScan ? ObjectValue(*result) : UndefinedValue());
+        return true;
+    }
+
+    RootedObject buffer(cx, GetBuffer(obj));
+
+    Value accu = buffer->getDenseArrayElement(0);
+    if (isScan)
+        resBuffer->setDenseArrayElementWithType(cx, 0, accu);
+
+    /* prepare call frame on stack */
+    InvokeArgsGuard ag;
+    if (!cx->stack.pushInvokeArgs(cx, 2, &ag))
+        return false;
+
+    for (uint32_t i = 1; i < length; i++) {
+        /* fill frame with current values */
+        ag.setCallee(ObjectValue(*elementalFun));
+        ag[0] = accu;
+        ag[1] = buffer->getDenseArrayElement(i);
+
+        /* We set |this| inside of the kernel to the |this| we were invoked on. */
+        /* This is a random choice, as we need some value here. */
+        ag.thisv() = args.thisv();
+
+        /* call */
+        if (!Invoke(cx, ag))
+            return false;
+
+        /* remember result for next round */
+        accu = ag.rval();
+        if (isScan)
+            resBuffer->setDenseArrayElementWithType(cx, i, accu);
+    }
+
+    args.rval() = (isScan ? ObjectValue(*result) : accu);
+
+    return true;
+}
+
+static JSBool
+ParallelArray_filter(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    /* make sure we are called on a ParallelArray */
+    bool ok;
+    RootedObject obj(cx);
+    obj = NonGenericMethodGuard(cx, args, ParallelArray_filter, &ParallelArrayClass, &ok);
+    if (!obj)
+        return ok;
+
+    if (args.length() < 1) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
+                             "filter", "0", "s");
+        return false;
+    }
+
+    /* extract first argument, the elemental function */
+    RootedObject elementalFun(cx, js_ValueToCallableObject(cx, &args[0], JSV2F_SEARCH_STACK));
+    if (!elementalFun)
+        return false;
+
+    RootedObject buffer(cx, GetBuffer(obj));
+    uint32_t length = GetLength(obj);
+
+    /* We just assume the length of the input as the length of the output. */
+    RootedObject resBuffer(cx, NewDenseAllocatedArray(cx, length));
+    if (!resBuffer)
+        return false;
+
+    resBuffer->ensureDenseArrayInitializedLength(cx, length, 0);
+
+    /* prepare call frame on stack */
+    InvokeArgsGuard frame;
+    cx->stack.pushInvokeArgs(cx, 1, &frame);
+
+    uint32_t pos = 0;
+    for (uint32_t i = 0; i < length; i++) {
+        frame.setCallee(ObjectValue(*elementalFun));
+        frame[0].setNumber(i);
+        frame.thisv() = ObjectValue(*obj);
+
+        /* call */
+        if (!Invoke(cx, frame))
+            return false;
+
+        if (js_ValueToBoolean(frame.rval()))
+            resBuffer->setDenseArrayElementWithType(cx, pos++, buffer->getDenseArrayElement(i));
+    }
+
+    /* shrink the array to the proper size */
+    resBuffer->setArrayLength(cx, pos);
+
+    /* create ParallelArray wrapper class */
+    RootedObject result(cx, NewParallelArray(cx, resBuffer, pos));
+    if (!result)
+        return false;
+
+    args.rval() = ObjectValue(*result);
+    return true;
+}
+
+static JSBool
+ParallelArray_scatter(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    /* make sure we are called on a ParallelArray */
+    bool ok;
+    RootedObject obj(cx);
+    obj = NonGenericMethodGuard(cx, args, ParallelArray_scatter, &ParallelArrayClass, &ok);
+    if (!obj)
+        return ok;
+
+    RootedObject buffer(cx, GetBuffer(obj));
+
+    if (args.length() < 1) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
+                             "scatter", "0", "s");
+        return false;
+    }
+
+    /* grab the scatter vector */
+    if (!args[0].isObject()) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_SCATTER_INVALID_VEC);
+        return false;
+    }
+    RootedObject targets(cx, &args[0].toObject());
+
+    uint32_t scatterLen;
+    if (!JS_GetArrayLength(cx, targets, &scatterLen))
+        return false;
+
+    if (scatterLen > GetLength(obj)) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_SCATTER_INVALID_VEC);
+        return false;
+    }
+
+    /* next, default value */
+    RootedValue defValue(cx, UndefinedValue());
+    if (args.length() >= 2)
+        defValue = args[1];
+
+    RootedObject conflictFun(cx);
+    /* conflict resolution function */
+    if ((args.length() >= 3) && !args[2].isUndefined()) {
+        conflictFun = js_ValueToCallableObject(cx, &args[2], JSV2F_SEARCH_STACK);
+        if (!conflictFun)
+            return false;
+    }
+
+    /* optional length */
+    uint32_t length;
+    if (args.length() >= 4) {
+        if (!ToUint32(cx, args[3], &length))
+            return false;
+    } else {
+        /* we assume the source's length */
+        length = GetLength(obj);
+    }
+
+    /* allocate space for the result */
+    RootedObject resBuffer(cx, NewDenseAllocatedArray(cx, length));
+    if (!resBuffer)
+        return false;
+
+    resBuffer->ensureDenseArrayInitializedLength(cx, length, 0);
+
+    /* iterate over the scatter vector */
+    for (uint32_t i = 0; i < scatterLen; i++) {
+        /* read target index */
+        RootedValue elem(cx);
+        if (!targets->getElement(cx, targets, i, elem.address()))
+            return false;
+
+        uint32_t targetIdx;
+        if (!ToUint32(cx, elem, &targetIdx))
+            return false;
+
+        if (targetIdx >= length) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_SCATTER_BNDS);
+            return false;
+        }
+
+        /* read current value */
+        RootedValue readV(cx, buffer->getDenseArrayElement(i));
+
+        RootedValue previous(cx, resBuffer->getDenseArrayElement(targetIdx));
+
+        if (!previous.reference().isMagic(JS_ARRAY_HOLE)) {
+            if (conflictFun) {
+                /* we have a conflict, so call the resolution function to resovle it */
+                InvokeArgsGuard ag;
+                if (!cx->stack.pushInvokeArgs(cx, 2, &ag))
+                    return false;
+                ag.setCallee(ObjectValue(*conflictFun));
+                ag[0] = readV;
+                ag[1] = previous;
+
+                /* random choice for |this| */
+                ag.thisv() = args.thisv();
+
+                if (!Invoke(cx, ag))
+                    return false;
+
+                readV = ag.rval();
+            } else {
+                /* no conflict function defined, yet we have a conflict -> fail */
+                JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_SCATTER_CONFLICT);
+                return false;
+            }
+        }
+
+        /* write back */
+        resBuffer->setDenseArrayElementWithType(cx, targetIdx, readV);
+    }
+
+    /* fill holes */
+    for (uint32_t i = 0; i < length; i++) {
+        if (resBuffer->getDenseArrayElement(i).isMagic(JS_ARRAY_HOLE))
+            resBuffer->setDenseArrayElementWithType(cx, i, defValue);
+    }
+
+    /* create ParallelArray wrapper class */
+    RootedObject result(cx, NewParallelArray(cx, resBuffer, length));
+    if (!result)
+        return false;
+
+    args.rval() = ObjectValue(*result);
+    return true;
+}
+
+static JSBool
+ParallelArray_forward_method(JSContext *cx, unsigned argc, Value *vp, Native native, HandleId id)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    bool ok;
+    RootedObject obj(cx, NonGenericMethodGuard(cx, args, native, &ParallelArrayClass, &ok));
+    if (!obj)
+        return ok;
+
+    RootedValue callable(cx);
+    RootedObject buffer(cx, GetBuffer(obj));
+    if (!GetMethod(cx, buffer, id, 0, callable.address()))
+        return false;
+
+    RootedValue rval(cx);
+    if (!Invoke(cx, ObjectOrNullValue(buffer), callable, argc, vp, rval.address()))
+        return false;
+
+    *vp = rval;
+    return true;
+}
+
+static JSBool
+ParallelArray_toString(JSContext *cx, unsigned argc, Value *vp)
+{
+    RootedId id(cx, NameToId(cx->runtime->atomState.toStringAtom->asPropertyName()));
+    return ParallelArray_forward_method(cx, argc, vp, ParallelArray_toString, id);
+}
+
+static JSBool
+ParallelArray_toLocaleString(JSContext *cx, unsigned argc, Value *vp)
+{
+    RootedId id(cx, NameToId(cx->runtime->atomState.toStringAtom->asPropertyName()));
+    return ParallelArray_forward_method(cx, argc, vp, ParallelArray_toLocaleString, id);
+}
+
+static JSBool
+ParallelArray_toSource(JSContext *cx, unsigned argc, Value *vp)
+{
+    RootedId id(cx, NameToId(cx->runtime->atomState.toStringAtom->asPropertyName()));
+    return ParallelArray_forward_method(cx, argc, vp, ParallelArray_toSource, id);
+}
+
+static JSBool
+ParallelArray_length_getter(JSContext *cx, HandleObject obj, HandleId id, Value *vp)
+{
+    /* we do not support prototype chaining for now */
+    if (obj->getClass() == &ParallelArrayClass) {
+        /* return the length of the ParallelArray object */
+        vp->setNumber(GetLength(obj));
+    } else {
+        /* return the length of the prototype's function object */
+        JS_ASSERT(obj->getClass() == &ParallelArrayProtoClass);
+        vp->setInt32(0);
+    }
+
+    return true;
+}
+
+/* Checks whether the index is in range. We guarantee dense arrays. */
+static inline bool
+IsDenseArrayIndex(JSObject *obj, uint32_t index)
+{
+    JS_ASSERT(obj->isDenseArray());
+
+    return index < obj->getDenseArrayInitializedLength();
+}
+
+/* checks whether id is an index */
+static inline bool
+IsDenseArrayId(JSContext *cx, JSObject *obj, HandleId id)
+{
+    JS_ASSERT(obj->isDenseArray());
+
+    uint32_t i;
+    return (js_IdIsIndex(id, &i) && IsDenseArrayIndex(obj, i));
+}
+
+static JSBool
+ParallelArray_lookupGeneric(JSContext *cx, HandleObject obj, HandleId id, JSObject **objp,
+                            JSProperty **propp)
+{
+    RootedObject buffer(cx, GetBuffer(obj));
+
+    if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom) ||
+        IsDenseArrayId(cx, buffer, id))
+    {
+        *propp = (JSProperty *) 1; /* TRUE */
+        *objp = obj;
+        return true;
+    }
+
+    RootedObject proto(cx, obj->getProto());
+    if (proto)
+        return proto->lookupGeneric(cx, id, objp, propp);
+
+    *objp = NULL;
+    *propp = NULL;
+    return true;
+}
+
+static JSBool
+ParallelArray_lookupProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, JSObject **objp,
+                             JSProperty **propp)
+{
+    RootedId id(cx, NameToId(name));
+    return ParallelArray_lookupGeneric(cx, obj, id, objp, propp);
+}
+
+static JSBool
+ParallelArray_lookupElement(JSContext *cx, HandleObject obj, uint32_t index, JSObject **objp,
+                            JSProperty **propp)
+{
+    if (IsDenseArrayIndex(GetBuffer(obj), index)) {
+        *propp = (JSProperty *) 1;  /* TRUE */
+        *objp = obj;
+        return true;
+    }
+
+    JSObject *proto = obj->getProto();
+    if (proto)
+        return proto->lookupElement(cx, index, objp, propp);
+
+    *objp = NULL;
+    *propp = NULL;
+    return true;
+}
+
+static JSBool
+ParallelArray_lookupSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, JSObject **objp,
+                            JSProperty **propp)
+{
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
+    return ParallelArray_lookupGeneric(cx, obj, id, objp, propp);
+}
+
+static JSBool
+ParallelArray_getGeneric(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id, Value *vp)
+{
+    if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
+        vp->setNumber(GetLength(obj));
+        return true;
+    }
+
+    RootedObject buffer(cx, GetBuffer(obj));
+    if (IsDenseArrayId(cx, buffer, id))
+        return buffer->getGeneric(cx, receiver, id, vp);
+
+    RootedObject proto(cx, obj->getProto());
+    if (proto)
+        return proto->getGeneric(cx, receiver, id, vp);
+
+    vp->setUndefined();
+    return true;
+}
+
+static JSBool
+ParallelArray_getProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
+                          HandlePropertyName name, Value *vp)
+{
+    RootedId id(cx, NameToId(name));
+    return ParallelArray_getGeneric(cx, obj, receiver, id, vp);
+}
+
+static JSBool
+ParallelArray_getElement(JSContext *cx, HandleObject obj, HandleObject receiver, uint32_t index, Value *vp)
+{
+    RootedObject buffer(cx, GetBuffer(obj));
+    if (IsDenseArrayIndex(buffer, index)) {
+        *vp = buffer->getDenseArrayElement(index);
+        return true;
+    }
+
+    RootedObject proto(cx, obj->getProto());
+    if (proto)
+        return proto->getElement(cx, receiver, index, vp);
+
+    vp->setUndefined();
+    return true;
+}
+
+static JSBool
+ParallelArray_getSpecial(JSContext *cx, HandleObject obj, HandleObject receiver, HandleSpecialId sid, Value *vp)
+{
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
+    return ParallelArray_getGeneric(cx, obj, receiver, id, vp);
+}
+
+static JSBool
+ParallelArray_defineGeneric(JSContext *cx, HandleObject obj, HandleId id, const Value *value,
+                            JSPropertyOp getter, StrictPropertyOp setter, unsigned attrs)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+
+    return false;
+}
+
+static JSBool
+ParallelArray_defineProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, const Value *value,
+                             JSPropertyOp getter, StrictPropertyOp setter, unsigned attrs)
+{
+    RootedId id(cx, NameToId(name));
+    return ParallelArray_defineGeneric(cx, obj, id, value, getter, setter, attrs);
+}
+
+static JSBool
+ParallelArray_defineElement(JSContext *cx, HandleObject obj, uint32_t index, const Value *value,
+                            PropertyOp getter, StrictPropertyOp setter, unsigned attrs)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+
+    return false;
+}
+
+static JSBool
+ParallelArray_defineSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, const Value *value,
+                            PropertyOp getter, StrictPropertyOp setter, unsigned attrs)
+{
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
+    return ParallelArray_defineGeneric(cx, obj, id, value, getter, setter, attrs);
+}
+
+static JSBool
+ParallelArray_setGeneric(JSContext *cx, HandleObject obj, HandleId id, Value *vp, JSBool strict)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+
+    return false;
+}
+
+static JSBool
+ParallelArray_setProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, Value *vp, JSBool strict)
+{
+    RootedId id(cx, NameToId(name));
+    return ParallelArray_setGeneric(cx, obj, id, vp, strict);
+}
+
+static JSBool
+ParallelArray_setElement(JSContext *cx, HandleObject obj, uint32_t index, Value *vp, JSBool strict)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+
+    return false;
+}
+
+static JSBool
+ParallelArray_setSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, Value *vp, JSBool strict)
+{
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
+    return ParallelArray_setGeneric(cx, obj, id, vp, strict);
+}
+
+static JSBool
+ParallelArray_getGenericAttributes(JSContext *cx, HandleObject obj, HandleId id, unsigned *attrsp)
+{
+    if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
+        *attrsp = JSPROP_PERMANENT | JSPROP_READONLY;
+    } else {
+        /* this must be an element then */
+        *attrsp = JSPROP_PERMANENT | JSPROP_READONLY | JSPROP_ENUMERATE;
+    }
+
+    return true;
+}
+
+static JSBool
+ParallelArray_getPropertyAttributes(JSContext *cx, HandleObject obj, HandlePropertyName name, unsigned *attrsp)
+{
+    RootedId id(cx, NameToId(name));
+    return ParallelArray_getGenericAttributes(cx, obj, id, attrsp);
+}
+
+static JSBool
+ParallelArray_getElementAttributes(JSContext *cx, HandleObject obj, uint32_t index, unsigned *attrsp)
+{
+    *attrsp = JSPROP_PERMANENT | JSPROP_READONLY | JSPROP_ENUMERATE;
+    return true;
+}
+
+static JSBool
+ParallelArray_getSpecialAttributes(JSContext *cx, HandleObject obj, HandleSpecialId sid, unsigned *attrsp)
+{
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
+    return ParallelArray_getGenericAttributes(cx, obj, id, attrsp);
+}
+
+static JSBool
+ParallelArray_setGenericAttributes(JSContext *cx, HandleObject obj, HandleId id, unsigned *attrsp)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+
+    return false;
+}
+
+static JSBool
+ParallelArray_setPropertyAttributes(JSContext *cx, HandleObject obj, HandlePropertyName name, unsigned *attrsp)
+{
+    RootedId id(cx, NameToId(name));
+    return ParallelArray_setGenericAttributes(cx, obj, id, attrsp);
+}
+
+static JSBool
+ParallelArray_setElementAttributes(JSContext *cx, HandleObject obj, uint32_t index, unsigned *attrsp)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+
+    return false;
+}
+
+static JSBool
+ParallelArray_setSpecialAttributes(JSContext *cx, HandleObject obj, HandleSpecialId sid, unsigned *attrsp)
+{
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
+    return ParallelArray_setGenericAttributes(cx, obj, id, attrsp);
+}
+
+static JSBool
+ParallelArray_deleteGeneric(JSContext *cx, HandleObject obj, HandleId id, Value *rval, JSBool strict)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+    return false;
+}
+
+static JSBool
+ParallelArray_deleteProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, Value *rval, JSBool strict)
+{
+    RootedId id(cx, NameToId(name));
+    return ParallelArray_deleteGeneric(cx, obj, id, rval, strict);
+}
+
+static JSBool
+ParallelArray_deleteElement(JSContext *cx, HandleObject obj, uint32_t index, Value *rval, JSBool strict)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_PAR_ARRAY_IMMUTABLE);
+
+    return false;
+}
+
+static JSBool
+ParallelArray_deleteSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid, Value *rval, JSBool strict)
+{
+    RootedId id(cx, SPECIALID_TO_JSID(sid));
+    return ParallelArray_deleteGeneric(cx, obj, id, rval, strict);
+}
+
+static JSBool
+ParallelArray_enumerate(JSContext *cx, HandleObject obj, JSIterateOp enum_op, Value *statep, jsid *idp)
+{
+    /*
+     * Iteration is "length" (if JSENUMERATE_INIT_ALL), then [0, length).
+     * *statep is JSVAL_TRUE if enumerating "length" and
+     * JSVAL_TO_INT(index) when enumerating index.
+     */
+    switch (enum_op) {
+      case JSENUMERATE_INIT_ALL:
+        statep->setBoolean(true);
+        if (idp)
+            *idp = ::INT_TO_JSID(GetLength(obj) + 1);
+        break;
+
+      case JSENUMERATE_INIT:
+        statep->setInt32(0);
+        if (idp)
+            *idp = ::INT_TO_JSID(GetLength(obj));
+        break;
+
+      case JSENUMERATE_NEXT:
+        if (statep->isTrue()) {
+            *idp = AtomToId(cx->runtime->atomState.lengthAtom);
+            statep->setInt32(0);
+        } else {
+            uint32_t index = statep->toInt32();
+            if (index < GetLength(obj)) {
+                *idp = ::INT_TO_JSID(index);
+                statep->setInt32(index + 1);
+            } else {
+                JS_ASSERT(index == GetLength(obj));
+                statep->setNull();
+            }
+        }
+        break;
+
+      case JSENUMERATE_DESTROY:
+        statep->setNull();
+        break;
+    }
+
+    return true;
+}
+
+static void
+ParallelArray_trace(JSTracer *trc, JSObject *obj)
+{
+    gc::MarkSlot(trc, &obj->getSlotRef(JSSLOT_PA_LENGTH), "parallel-array-length");
+    gc::MarkSlot(trc, &obj->getSlotRef(JSSLOT_PA_BUFFER), "parallel-array-buffer");
+}
+
+Class js::ParallelArrayProtoClass = {
+    "ParallelArray",
+    JSCLASS_HAS_CACHED_PROTO(JSProto_ParallelArray),
+    JS_PropertyStub,         /* addProperty */
+    JS_PropertyStub,         /* delProperty */
+    JS_PropertyStub,         /* getProperty */
+    JS_StrictPropertyStub,   /* setProperty */
+    JS_EnumerateStub,
+    JS_ResolveStub,
+    JS_ConvertStub
+};
+
+Class js::ParallelArrayClass = {
+    "ParallelArray",
+    JSCLASS_HAS_RESERVED_SLOTS(JSSLOT_PA_MAX) | JSCLASS_HAS_CACHED_PROTO(JSProto_ParallelArray) | Class::NON_NATIVE,
+    JS_PropertyStub,         /* addProperty */
+    JS_PropertyStub,         /* delProperty */
+    JS_PropertyStub,         /* getProperty */
+    JS_StrictPropertyStub,   /* setProperty */
+    JS_EnumerateStub,