From edbe43df4faf870f00b607bdfd76f89fb7caddf0 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Thu, 12 Dec 2013 18:10:04 +0900
Subject: [PATCH 001/459] Bug 939367 - Part 2: Move requirements.txt into
 tools/docs

Trivial change. No review.

DONTBUILD (NPOTB)

--HG--
rename : build/docs/requirements.txt => tools/docs/requirements.txt
---
 {build => tools}/docs/requirements.txt | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename {build => tools}/docs/requirements.txt (100%)

diff --git a/build/docs/requirements.txt b/tools/docs/requirements.txt
similarity index 100%
rename from build/docs/requirements.txt
rename to tools/docs/requirements.txt

From e627be4fe169246ed24236bad0b6250018c66104 Mon Sep 17 00:00:00 2001
From: Masayuki Nakano <masayuki@d-toybox.com>
Date: Thu, 12 Dec 2013 18:39:04 +0900
Subject: [PATCH 002/459] Bug 948839 Mark special flag of drag over event true
 if it's consumed on content r=smaug

---
 content/events/src/nsDOMEvent.cpp          | 21 +++++++++++++++++++++
 content/events/src/nsEventStateManager.cpp |  5 +++--
 widget/MouseEvents.h                       |  5 ++++-
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
index 52369931bbf1..171f9844af12 100644
--- a/content/events/src/nsDOMEvent.cpp
+++ b/content/events/src/nsDOMEvent.cpp
@@ -487,6 +487,27 @@ nsDOMEvent::PreventDefaultInternal(bool aCalledByDefaultHandler)
   if (!aCalledByDefaultHandler) {
     mEvent->mFlags.mDefaultPreventedByContent = true;
   }
+
+  if (!IsTrusted()) {
+    return;
+  }
+
+  WidgetDragEvent* dragEvent = mEvent->AsDragEvent();
+  if (!dragEvent) {
+    return;
+  }
+
+  nsCOMPtr<nsINode> node = do_QueryInterface(mEvent->currentTarget);
+  if (!node) {
+    nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(mEvent->currentTarget);
+    if (!win) {
+      return;
+    }
+    node = win->GetExtantDoc();
+  }
+  if (!nsContentUtils::IsChromeDoc(node->OwnerDoc())) {
+    dragEvent->mDefaultPreventedOnContent = true;
+  }
 }
 
 void
diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index d6b33c7e695b..67edf1722fe3 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -3571,9 +3571,10 @@ nsEventStateManager::PostHandleEvent(nsPresContext* aPresContext,
         // For now, do this only for dragover.
         //XXXsmaug dragenter needs some more work.
         if (aEvent->message == NS_DRAGDROP_OVER && !isChromeDoc) {
-          // Someone has called preventDefault(), check whether is was content.
+          // Someone has called preventDefault(), check whether is was on
+          // content or chrome.
           dragSession->SetOnlyChromeDrop(
-            !aEvent->mFlags.mDefaultPreventedByContent);
+            !dragEvent->mDefaultPreventedOnContent);
         }
       } else if (aEvent->message == NS_DRAGDROP_OVER && !isChromeDoc) {
         // No one called preventDefault(), so handle drop only in chrome.
diff --git a/widget/MouseEvents.h b/widget/MouseEvents.h
index e4dd6bebd941..c49f4bbb5c42 100644
--- a/widget/MouseEvents.h
+++ b/widget/MouseEvents.h
@@ -250,7 +250,7 @@ public:
 
   WidgetDragEvent(bool aIsTrusted, uint32_t aMessage, nsIWidget* aWidget) :
     WidgetMouseEvent(aIsTrusted, aMessage, aWidget, NS_DRAG_EVENT, eReal),
-    userCancelled(false)
+    userCancelled(false), mDefaultPreventedOnContent(false)
   {
     mFlags.mCancelable =
       (aMessage != NS_DRAGDROP_EXIT_SYNTH &&
@@ -263,6 +263,8 @@ public:
 
   // If this is true, user has cancelled the drag operation.
   bool userCancelled;
+  // If this is true, the drag event's preventDefault() is called on content.
+  bool mDefaultPreventedOnContent;
 
   // XXX Not tested by test_assign_event_data.html
   void AssignDragEventData(const WidgetDragEvent& aEvent, bool aCopyTargets)
@@ -272,6 +274,7 @@ public:
     dataTransfer = aEvent.dataTransfer;
     // XXX userCancelled isn't copied, is this instentionally?
     userCancelled = false;
+    mDefaultPreventedOnContent = aEvent.mDefaultPreventedOnContent;
   }
 };
 

From 539b6f395d58961f04784f8463043673f987b6f2 Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Thu, 12 Dec 2013 10:18:37 +0000
Subject: [PATCH 003/459] Bug 938406 - DataStore - proper event sent when the
 first revision is created, r=ehsan

---
 dom/datastore/DataStore.jsm                |  2 +-
 dom/datastore/DataStoreCursor.jsm          |  2 +-
 dom/datastore/DataStoreDB.jsm              |  2 +-
 dom/datastore/DataStoreService.js          | 20 ++++++++++++--------
 dom/datastore/DataStoreServiceInternal.jsm |  2 +-
 5 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/dom/datastore/DataStore.jsm b/dom/datastore/DataStore.jsm
index afe1a2645f1d..e43df1e92b8e 100644
--- a/dom/datastore/DataStore.jsm
+++ b/dom/datastore/DataStore.jsm
@@ -9,7 +9,7 @@
 this.EXPORTED_SYMBOLS = ["DataStore"];
 
 function debug(s) {
-  // dump('DEBUG DataStore: ' + s + '\n');
+  //dump('DEBUG DataStore: ' + s + '\n');
 }
 
 const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
diff --git a/dom/datastore/DataStoreCursor.jsm b/dom/datastore/DataStoreCursor.jsm
index ef88c8186fcf..96f0cd3e7cf0 100644
--- a/dom/datastore/DataStoreCursor.jsm
+++ b/dom/datastore/DataStoreCursor.jsm
@@ -9,7 +9,7 @@
 this.EXPORTED_SYMBOLS = ['DataStoreCursor'];
 
 function debug(s) {
-  // dump('DEBUG DataStoreCursor: ' + s + '\n');
+  //dump('DEBUG DataStoreCursor: ' + s + '\n');
 }
 
 const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
diff --git a/dom/datastore/DataStoreDB.jsm b/dom/datastore/DataStoreDB.jsm
index bf5383550754..ec563875e543 100644
--- a/dom/datastore/DataStoreDB.jsm
+++ b/dom/datastore/DataStoreDB.jsm
@@ -9,7 +9,7 @@ const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 this.EXPORTED_SYMBOLS = ['DataStoreDB'];
 
 function debug(s) {
-  // dump('DEBUG DataStoreDB: ' + s + '\n');
+  //dump('DEBUG DataStoreDB: ' + s + '\n');
 }
 
 const DATASTOREDB_VERSION = 1;
diff --git a/dom/datastore/DataStoreService.js b/dom/datastore/DataStoreService.js
index 2e5485c43a77..24842bdd3fad 100644
--- a/dom/datastore/DataStoreService.js
+++ b/dom/datastore/DataStoreService.js
@@ -9,7 +9,7 @@
 /* static functions */
 
 function debug(s) {
-  // dump('DEBUG DataStoreService: ' + s + '\n');
+  //dump('DEBUG DataStoreService: ' + s + '\n');
 }
 
 const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
@@ -137,17 +137,13 @@ DataStoreService.prototype = {
         request.onsuccess = function(aEvent) {
           let cursor = aEvent.target.result;
           if (cursor) {
-            ppmm.broadcastAsyncMessage('datastore-first-revision-created',
-                                       { name: aName, owner: aOwner });
+            debug("First revision already created.");
+            self.enableDataStore(aAppId, aName, aOwner);
           } else {
             // If the revision doesn't exist, let's create the first one.
             db.addRevision(aRevisionStore, 0, REVISION_VOID, function() {
               debug("First revision created.");
-              if (aName in self.stores && aAppId in self.stores[aName]) {
-                self.stores[aName][aAppId].enabled = true;
-                ppmm.broadcastAsyncMessage('datastore-first-revision-created',
-                                           { name: aName, owner: aOwner });
-              }
+              self.enableDataStore(aAppId, aName, aOwner);
             });
           }
         };
@@ -155,6 +151,14 @@ DataStoreService.prototype = {
     );
   },
 
+  enableDataStore: function(aAppId, aName, aOwner) {
+    if (aName in this.stores && aAppId in this.stores[aName]) {
+      this.stores[aName][aAppId].enabled = true;
+      ppmm.broadcastAsyncMessage('datastore-first-revision-created',
+                                 { name: aName, owner: aOwner });
+    }
+  },
+
   addPermissions: function(aAppId, aName, aOrigin, aOwner, aReadOnly) {
     // When a new DataStore is installed, the permissions must be set for the
     // owner app.
diff --git a/dom/datastore/DataStoreServiceInternal.jsm b/dom/datastore/DataStoreServiceInternal.jsm
index e7816f8db6ab..f301a3793e30 100644
--- a/dom/datastore/DataStoreServiceInternal.jsm
+++ b/dom/datastore/DataStoreServiceInternal.jsm
@@ -9,7 +9,7 @@ const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 this.EXPORTED_SYMBOLS = ["DataStoreServiceInternal"];
 
 function debug(s) {
-  // dump('DEBUG DataStoreServiceInternal: ' + s + '\n');
+  //dump('DEBUG DataStoreServiceInternal: ' + s + '\n');
 }
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");

From cc0161739c645b925694074d5b93d721286c31e4 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Thu, 12 Dec 2013 11:21:59 +0000
Subject: [PATCH 004/459] Bug 949038 - Fix windows browser build error in
 jsweakmap.h with generational GC r=terrence

---
 js/src/jsweakmap.cpp      | 17 +++++++++++++----
 js/src/vm/ScopeObject.cpp | 13 +++++++++++--
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 8fb35a416116..5d6bb8f013c4 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -269,17 +269,26 @@ TryPreserveReflector(JSContext *cx, HandleObject obj)
 }
 
 static inline void
-WeakMapPostWriteBarrier(JSRuntime *rt, ObjectValueMap *map, JSObject *key)
+WeakMapPostWriteBarrier(JSRuntime *rt, ObjectValueMap *weakMap, JSObject *key)
 {
 #ifdef JSGC_GENERATIONAL
     /*
      * Strip the barriers from the type before inserting into the store buffer.
      * This will automatically ensure that barriers do not fire during GC.
+     *
+     * Some compilers complain about instantiating the WeakMap class for
+     * unbarriered type arguments, so we cast to a HashMap instead.  Because of
+     * WeakMap's multiple inheritace, We need to do this in two stages, first to
+     * the HashMap base class and then to the unbarriered version.
      */
-    typedef WeakMap<JSObject *, Value> UnbarrieredObjectValueMap;
-    typedef gc::HashKeyRef<UnbarrieredObjectValueMap, JSObject *> Ref;
+    ObjectValueMap::Base *baseHashMap = static_cast<ObjectValueMap::Base *>(weakMap);
+
+    typedef HashMap<JSObject *, Value> UnbarrieredMap;
+    UnbarrieredMap *unbarrieredMap = reinterpret_cast<UnbarrieredMap *>(baseHashMap);
+
+    typedef gc::HashKeyRef<UnbarrieredMap, JSObject *> Ref;
     if (key && IsInsideNursery(rt, key))
-        rt->gcStoreBuffer.putGeneric(Ref(reinterpret_cast<UnbarrieredObjectValueMap *>(map), key));
+        rt->gcStoreBuffer.putGeneric(Ref((unbarrieredMap), key));
 #endif
 }
 
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 55e844f8410f..b3a069b1c397 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -1535,11 +1535,20 @@ DebugScopes::proxiedScopesPostWriteBarrier(JSRuntime *rt, ObjectWeakMap *map,
     /*
      * Strip the barriers from the type before inserting into the store buffer.
      * This will automatically ensure that barriers do not fire during GC.
+     *
+     * Some compilers complain about instantiating the WeakMap class for
+     * unbarriered type arguments, so we cast to a HashMap instead.  Because of
+     * WeakMap's multiple inheritace, We need to do this in two stages, first to
+     * the HashMap base class and then to the unbarriered version.
      */
-    typedef WeakMap<JSObject *, JSObject *> UnbarrieredMap;
+    ObjectWeakMap::Base *baseHashMap = static_cast<ObjectWeakMap::Base *>(map);
+
+    typedef HashMap<JSObject *, JSObject *> UnbarrieredMap;
+    UnbarrieredMap *unbarrieredMap = reinterpret_cast<UnbarrieredMap *>(baseHashMap);
+
     typedef gc::HashKeyRef<UnbarrieredMap, JSObject *> Ref;
     if (key && IsInsideNursery(rt, key))
-        rt->gcStoreBuffer.putGeneric(Ref(reinterpret_cast<UnbarrieredMap *>(map), key.get()));
+        rt->gcStoreBuffer.putGeneric(Ref(unbarrieredMap, key.get()));
 #endif
 }
 

From 717525839f9d3c9804045ad3566747f1b6386c21 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Thu, 12 Dec 2013 11:22:00 +0000
Subject: [PATCH 005/459] Bug 948423 - Use relookupOrAdd() to insert into has
 type representation hash map following possible mutation by GC r=sfink

---
 js/src/builtin/TypeRepresentation.cpp  |  2 +-
 js/src/jit-test/tests/gc/bug-948423.js | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-948423.js

diff --git a/js/src/builtin/TypeRepresentation.cpp b/js/src/builtin/TypeRepresentation.cpp
index 78cd8237b0f5..346a87502841 100644
--- a/js/src/builtin/TypeRepresentation.cpp
+++ b/js/src/builtin/TypeRepresentation.cpp
@@ -383,7 +383,7 @@ TypeRepresentation::addToTableOrFree(JSContext *cx,
         return nullptr;
 
     // Next, attempt to add the type representation to the table.
-    if (!comp->typeReprs.add(p, this)) {
+    if (!comp->typeReprs.relookupOrAdd(p, this, this)) {
         js_ReportOutOfMemory(cx);
         js_free(this); // do not finalize, not present in the table
         return nullptr;
diff --git a/js/src/jit-test/tests/gc/bug-948423.js b/js/src/jit-test/tests/gc/bug-948423.js
new file mode 100644
index 000000000000..d9470c7d2b5f
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-948423.js
@@ -0,0 +1,20 @@
+var ArrayType = TypedObject.ArrayType;
+var StructType = TypedObject.StructType;
+var uint8 = TypedObject.uint8;
+var uint32 = TypedObject.uint32;
+var ObjectType = TypedObject.Object;
+function runTests() {
+  (function DimensionLinkedToUndimension() {
+    var UintsA = uint32.array();
+    var FiveUintsA = UintsA.dimension(5);
+    var FiveUintsB = uint32.array(5);
+    assertEq(true, 
+	FiveUintsA.equivalent(FiveUintsB)
+	);
+  })();
+  (function PrototypeHierarchy() {
+    schedulegc(3);
+    var Uint8s = uint8.array();
+  })();
+}
+runTests();

From 2eeb665fa5ae42fb2e184d1b144fe963cee4c8ed Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Thu, 12 Dec 2013 20:39:19 +0900
Subject: [PATCH 006/459] Bug 948914 - Remove redundant default style for <pre>
 element from quirk.css. r=dbaron

---
 layout/style/quirk.css | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/layout/style/quirk.css b/layout/style/quirk.css
index 0665f6cd8129..e658bb70acb0 100644
--- a/layout/style/quirk.css
+++ b/layout/style/quirk.css
@@ -161,13 +161,6 @@ td > ol:-moz-only-whitespace:-moz-last-node, th > ol:-moz-only-whitespace:-moz-l
 }
 
 
-/* Quirk: support the ways of making PRE have wrapping */
-
-pre[wrap], pre[cols], pre[width] {
-  white-space: pre-wrap;
-}
-
-
 /* Quirk: DD not in DL has text-indent instead of margin (b=5119) */
 
 :not(dl) > dd {

From 182a8c2ebe79eb4e609819dfe0c14b01871cd8bc Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 13 Dec 2013 01:33:02 +1300
Subject: [PATCH 007/459] Bug 945634. The fixed-pos anchor point should be in
 the layer's coordinate system, whose 0,0 is the top-left of the fixed-pos
 frame. r=mattwoodrow

---
 gfx/layers/Layers.cpp             | 3 ++-
 layout/base/FrameLayerBuilder.cpp | 3 +--
 layout/base/nsDisplayList.cpp     | 5 ++---
 layout/base/nsLayoutUtils.cpp     | 3 +--
 layout/base/nsLayoutUtils.h       | 1 -
 5 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 1aa0a3b90e17..541226feeeda 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -1276,7 +1276,8 @@ Layer::PrintInfo(nsACString& aTo, const char* aPrefix)
     }
   }
   if (GetIsFixedPosition()) {
-    aTo.AppendPrintf(" [isFixedPosition anchor=%f,%f]", mAnchor.x, mAnchor.y);
+    aTo.AppendPrintf(" [isFixedPosition anchor=%f,%f margin=%f,%f,%f,%f]", mAnchor.x, mAnchor.y,
+                     mMargins.top, mMargins.right, mMargins.bottom, mMargins.left);
   }
   if (GetIsStickyPosition()) {
     aTo.AppendPrintf(" [isStickyPosition scrollId=%d outer=%f,%f %fx%f "
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 9bb95ac0a123..3c4d96df5782 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -1674,8 +1674,7 @@ ContainerState::SetFixedPositionLayerData(Layer* aLayer,
   }
 
   nsLayoutUtils::SetFixedPositionLayerData(aLayer,
-      viewportFrame, viewportSize, aFixedPosFrame, mContainerReferenceFrame,
-      presContext, mParameters);
+      viewportFrame, viewportSize, aFixedPosFrame, presContext, mParameters);
 }
 
 void
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index b5a1495957b8..ae5ce6fdbeef 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -3363,9 +3363,8 @@ nsDisplayStickyPosition::BuildLayer(nsDisplayListBuilder* aBuilder,
   }
 
   nsLayoutUtils::SetFixedPositionLayerData(layer, scrollFrame, scrollFrameSize,
-                                           mStickyPosFrame, ReferenceFrame(),
-                                           presContext,
-                                           aContainerParameters);
+                                           mStickyPosFrame,
+                                           presContext, aContainerParameters);
 
   ViewID scrollId = nsLayoutUtils::FindOrCreateIDFor(
     stickyScrollContainer->ScrollFrame()->GetScrolledFrame()->GetContent());
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 208dfb981906..aef7bb43b61a 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -1204,14 +1204,13 @@ nsLayoutUtils::SetFixedPositionLayerData(Layer* aLayer,
                                          const nsIFrame* aViewportFrame,
                                          nsSize aViewportSize,
                                          const nsIFrame* aFixedPosFrame,
-                                         const nsIFrame* aReferenceFrame,
                                          nsPresContext* aPresContext,
                                          const ContainerLayerParameters& aContainerParameters) {
   // Find out the rect of the viewport frame relative to the reference frame.
   // This, in conjunction with the container scale, will correspond to the
   // coordinate-space of the built layer.
   float factor = aPresContext->AppUnitsPerDevPixel();
-  nsPoint origin = aViewportFrame->GetOffsetToCrossDoc(aReferenceFrame);
+  nsPoint origin = aViewportFrame->GetOffsetToCrossDoc(aFixedPosFrame);
   LayerRect anchorRect(NSAppUnitsToFloatPixels(origin.x, factor) *
                          aContainerParameters.mXScale,
                        NSAppUnitsToFloatPixels(origin.y, factor) *
diff --git a/layout/base/nsLayoutUtils.h b/layout/base/nsLayoutUtils.h
index aa036d88604c..4224503b9c38 100644
--- a/layout/base/nsLayoutUtils.h
+++ b/layout/base/nsLayoutUtils.h
@@ -378,7 +378,6 @@ public:
   static void SetFixedPositionLayerData(Layer* aLayer, const nsIFrame* aViewportFrame,
                                         nsSize aViewportSize,
                                         const nsIFrame* aFixedPosFrame,
-                                        const nsIFrame* aReferenceFrame,
                                         nsPresContext* aPresContext,
                                         const ContainerLayerParameters& aContainerParameters);
 

From ef518dc5119735c0628c5a75d82eae6c7ad2f72d Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 12 Dec 2013 08:25:29 -0500
Subject: [PATCH 008/459] Bug 948777 - Build netwerk/sctp/src in unified mode;
 r=jesup

---
 netwerk/sctp/src/moz.build | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/netwerk/sctp/src/moz.build b/netwerk/sctp/src/moz.build
index 1d7f90da74de..b4186410660e 100644
--- a/netwerk/sctp/src/moz.build
+++ b/netwerk/sctp/src/moz.build
@@ -10,7 +10,7 @@ EXPORTS.mozilla.net += [
     'usrsctp.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'netinet/sctp_asconf.c',
     'netinet/sctp_auth.c',
     'netinet/sctp_bsd_addr.c',
@@ -20,14 +20,12 @@ SOURCES += [
     'netinet/sctp_hashdriver.c',
     'netinet/sctp_indata.c',
     'netinet/sctp_input.c',
-    'netinet/sctp_output.c',
     'netinet/sctp_pcb.c',
     'netinet/sctp_peeloff.c',
     'netinet/sctp_sha1.c',
     'netinet/sctp_ss_functions.c',
     'netinet/sctp_sysctl.c',
     'netinet/sctp_timer.c',
-    'netinet/sctp_userspace.c',
     'netinet/sctp_usrreq.c',
     'netinet/sctputil.c',
     'netinet6/sctp6_usrreq.c',
@@ -35,9 +33,19 @@ SOURCES += [
     'user_mbuf.c',
     'user_recv_thread.c',
     'user_sctp_timer_iterate.c',
+]
+
+# These files cannot be built in unified mode because they rely on __FAVOR_BSD in udp.h.
+SOURCES += [
+    'netinet/sctp_output.c',
     'user_socket.c',
 ]
 
+# This file cannot be built in unified mode because of compilation failures on Windows.
+SOURCES += [
+    'netinet/sctp_userspace.c',
+]
+
 if CONFIG['OS_TARGET'] == 'Android':
     SOURCES += [
         'ifaddrs_android.cpp',

From 8b72ea8324379dc6b40e39522558817e8afaba96 Mon Sep 17 00:00:00 2001
From: Chris Peterson <cpeterson@mozilla.com>
Date: Tue, 10 Dec 2013 22:58:51 -0800
Subject: [PATCH 009/459] Bug 949360 - Check for Image AllocateBuffer()
 failures. r=nical

---
 gfx/layers/ImageContainer.cpp             | 16 ++++++++++------
 gfx/layers/ipc/SharedPlanarYCbCrImage.cpp | 20 ++++++++++++--------
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index 8d51ce7c6944..e977f69143be 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -490,14 +490,17 @@ PlanarYCbCrImage::CopyData(const Data& aData)
   mData = aData;
 
   // update buffer size
-  mBufferSize = mData.mCbCrStride * mData.mCbCrSize.height * 2 +
+  size_t size = mData.mCbCrStride * mData.mCbCrSize.height * 2 +
                 mData.mYStride * mData.mYSize.height;
 
   // get new buffer
-  mBuffer = AllocateBuffer(mBufferSize);
+  mBuffer = AllocateBuffer(size);
   if (!mBuffer)
     return;
 
+  // update buffer size
+  mBufferSize = size;
+
   mData.mYChannel = mBuffer;
   mData.mCbChannel = mData.mYChannel + mData.mYStride * mData.mYSize.height;
   mData.mCrChannel = mData.mCbChannel + mData.mCbCrStride * mData.mCbCrSize.height;
@@ -536,11 +539,12 @@ PlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 uint8_t*
 PlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
-  // update buffer size
-  mBufferSize = aSize;
-
   // get new buffer
-  mBuffer = AllocateBuffer(mBufferSize); 
+  mBuffer = AllocateBuffer(aSize);
+  if (mBuffer) {
+    // update buffer size
+    mBufferSize = aSize;
+  }
   return mBuffer;
 }
 
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index a842f5d7ee00..3f7e969a1cf6 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -126,14 +126,16 @@ SharedPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
   NS_ABORT_IF_FALSE(!mTextureClient->IsAllocated(), "This image already has allocated data");
   size_t size = YCbCrImageDataSerializer::ComputeMinBufferSize(aSize);
+
+  // get new buffer _without_ setting mBuffer.
+  if (!mTextureClient->Allocate(size)) {
+    return nullptr;
+  }
+
   // update buffer size
   mBufferSize = size;
 
-  // get new buffer _without_ setting mBuffer.
-  bool status = mTextureClient->Allocate(mBufferSize);
-  MOZ_ASSERT(status);
   YCbCrImageDataSerializer serializer(mTextureClient->GetBuffer());
-
   return serializer.GetData();
 }
 
@@ -248,17 +250,19 @@ DeprecatedSharedPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
   NS_ABORT_IF_FALSE(!mAllocated, "This image already has allocated data");
   size_t size = YCbCrImageDataSerializer::ComputeMinBufferSize(aSize);
+
+  // get new buffer _without_ setting mBuffer.
+  if (!AllocateBuffer(size)) {
+    return nullptr;
+  }
+
   // update buffer size
   mBufferSize = size;
 
-  // get new buffer _without_ setting mBuffer.
-  AllocateBuffer(mBufferSize);
   YCbCrImageDataSerializer serializer(mShmem.get<uint8_t>());
-
   return serializer.GetData();
 }
 
-
 void
 DeprecatedSharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 {

From d36297d1a529925f2155e167179de9576e6fdd20 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 15:14:12 +0100
Subject: [PATCH 010/459] Bug 939614: IonMonkey: Add recompile check, r=jandem

---
 js/src/jit/CodeGenerator.cpp          | 19 ++++++++++++++++
 js/src/jit/CodeGenerator.h            |  2 ++
 js/src/jit/IonBuilder.cpp             | 14 ++++++++++++
 js/src/jit/IonBuilder.h               |  2 ++
 js/src/jit/LIR-Common.h               | 17 ++++++++++++++
 js/src/jit/LOpcodes.h                 |  1 +
 js/src/jit/Lowering.cpp               |  9 ++++++++
 js/src/jit/Lowering.h                 |  1 +
 js/src/jit/MIR.h                      | 32 +++++++++++++++++++++++++++
 js/src/jit/MOpcodes.h                 |  3 ++-
 js/src/jit/ParallelSafetyAnalysis.cpp |  1 +
 11 files changed, 100 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 7cbe48d16495..5a6bff5dab95 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -7928,5 +7928,24 @@ CodeGenerator::visitAssertRangeV(LAssertRangeV *ins)
     return true;
 }
 
+typedef bool (*RecompileFn)(JSContext *);
+static const VMFunction RecompileFnInfo = FunctionInfo<RecompileFn>(Recompile);
+
+bool
+CodeGenerator::visitRecompileCheck(LRecompileCheck *ins)
+{
+    Register useCount = ToRegister(ins->scratch());
+
+    masm.movePtr(ImmPtr(ins->mir()->script()->addressOfUseCount()), useCount);
+    Address ptr(useCount, 0);
+    masm.add32(Imm32(1), ptr);
+
+    OutOfLineCode *ool = oolCallVM(RecompileFnInfo, ins, (ArgList()), StoreRegisterTo(useCount));
+    masm.branch32(Assembler::Above, ptr, Imm32(ins->mir()->useCount()), ool->entry());
+    masm.bind(ool->rejoin());
+
+    return true;
+}
+
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index e522f27da234..5a42247fd604 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -336,6 +336,8 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitAssertRangeF(LAssertRangeF *ins);
     bool visitAssertRangeV(LAssertRangeV *ins);
 
+    bool visitRecompileCheck(LRecompileCheck *ins);
+
     IonScriptCounts *extractUnassociatedScriptCounts() {
         IonScriptCounts *counts = unassociatedScriptCounts_;
         unassociatedScriptCounts_ = nullptr;  // prevent delete in dtor
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 28b2285a8fdc..c45572433eb7 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -691,6 +691,8 @@ IonBuilder::build()
         current->add(lazyArguments_);
     }
 
+    insertRecompileCheck();
+
     if (!traverseBytecode())
         return false;
 
@@ -848,6 +850,8 @@ IonBuilder::buildInline(IonBuilder *callerBuilder, MResumePoint *callerResumePoi
         current->add(lazyArguments_);
     }
 
+    insertRecompileCheck();
+
     if (!traverseBytecode())
         return false;
 
@@ -3339,6 +3343,7 @@ IonBuilder::jsop_loophead(jsbytecode *pc)
     assertValidLoopHeadOp(pc);
 
     current->add(MInterruptCheck::New(alloc()));
+    insertRecompileCheck();
 
     return true;
 }
@@ -5991,6 +5996,15 @@ ClassHasResolveHook(CompileCompartment *comp, const Class *clasp, PropertyName *
     return true;
 }
 
+void
+IonBuilder::insertRecompileCheck()
+{
+    if (info().executionMode() != SequentialExecution)
+        return;
+
+    return;
+}
+
 JSObject *
 IonBuilder::testSingletonProperty(JSObject *obj, PropertyName *name)
 {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 2404e147d2df..a844910be45a 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -325,6 +325,8 @@ class IonBuilder : public MIRGenerator
     bool resumeAfter(MInstruction *ins);
     bool maybeInsertResume();
 
+    void insertRecompileCheck();
+
     bool initParameters();
     void rewriteParameter(uint32_t slotIdx, MDefinition *param, int32_t argIndex);
     void rewriteParameters();
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 13c803502d6c..7ed29e1ac609 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -5768,6 +5768,23 @@ class LAssertRangeV : public LInstructionHelper<0, BOX_PIECES, 3>
     }
 };
 
+class LRecompileCheck : public LInstructionHelper<0, 0, 1>
+{
+  public:
+    LIR_HEADER(RecompileCheck)
+
+    LRecompileCheck(const LDefinition &scratch) {
+        setTemp(0, scratch);
+    }
+
+    const LDefinition *scratch() {
+        return getTemp(0);
+    }
+    MRecompileCheck *mir() {
+        return mir_->toRecompileCheck();
+    }
+};
+
 } // namespace jit
 } // namespace js
 
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 44d9db360964..2b13b1ad1f66 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -280,6 +280,7 @@
     _(AsmJSCall)                    \
     _(AsmJSCheckOverRecursed)       \
     _(CheckInterruptPar)            \
+    _(RecompileCheck)               \
     _(AssertRangeI)                 \
     _(AssertRangeD)                 \
     _(AssertRangeF)                 \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 3209d31927ff..6e2800c04241 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3421,6 +3421,15 @@ LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
     return defineBox(lir, ins);
 }
 
+bool
+LIRGenerator::visitRecompileCheck(MRecompileCheck *ins)
+{
+    LRecompileCheck *lir = new(alloc()) LRecompileCheck(temp());
+    if (!add(lir, ins))
+        return false;
+    return assignSafepoint(lir, ins);
+}
+
 static void
 SpewResumePoint(MBasicBlock *block, MInstruction *ins, MResumePoint *resumePoint)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index 8302b9f16d68..c2a86f313d4f 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -261,6 +261,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitSetDOMProperty(MSetDOMProperty *ins);
     bool visitGetDOMProperty(MGetDOMProperty *ins);
     bool visitGetDOMMember(MGetDOMMember *ins);
+    bool visitRecompileCheck(MRecompileCheck *ins);
 };
 
 } // namespace jit
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 1cf9adfa4365..cd4cba1d0c7e 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9204,6 +9204,38 @@ class MHaveSameClass
     }
 };
 
+class MRecompileCheck : public MNullaryInstruction
+{
+    JSScript *script_;
+    uint32_t recompileThreshold_;
+
+    MRecompileCheck(JSScript *script_, uint32_t recompileThreshold)
+      : script_(script_),
+        recompileThreshold_(recompileThreshold)
+    {
+        setGuard();
+    }
+
+  public:
+    INSTRUCTION_HEADER(RecompileCheck);
+
+    static MRecompileCheck *New(TempAllocator &alloc, JSScript *script_, uint32_t useCount) {
+        return new(alloc) MRecompileCheck(script_, useCount);
+    }
+
+    JSScript *script() const {
+        return script_;
+    }
+
+    uint32_t recompileThreshold() const {
+        return recompileThreshold_;
+    }
+
+    AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
+};
+
 class MAsmJSNeg : public MUnaryInstruction
 {
     MAsmJSNeg(MDefinition *op, MIRType type)
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 12cee893cefa..08b622ba6395 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -211,7 +211,8 @@ namespace jit {
     _(RestPar)                                                              \
     _(ForkJoinSlice)                                                        \
     _(GuardThreadLocalObject)                                               \
-    _(CheckInterruptPar)
+    _(CheckInterruptPar)                                                    \
+    _(RecompileCheck)
 
 // Forward declarations of MIR types.
 #define FORWARD_DECLARE(op) class M##op;
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index 446e0f159f6c..a4d1e76bb6eb 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -311,6 +311,7 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     UNSAFE_OP(AsmJSParameter)
     UNSAFE_OP(AsmJSCall)
     UNSAFE_OP(AsmJSCheckOverRecursed)
+    DROP_OP(RecompileCheck)
 
     // It looks like this could easily be made safe:
     UNSAFE_OP(ConvertElementsToDoubles)

From 35bb78bfb0f5c06b4ef0c61ed7d040fcacc46f8c Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 15:14:12 +0100
Subject: [PATCH 011/459] Bug 939614: IonMonkey: Split IonOptions in IonOptions
 and IonOptimizations, r=jandem

---
 js/src/jit/AsmJS.cpp                      |   4 +-
 js/src/jit/BaselineCompiler.cpp           |   2 +-
 js/src/jit/CodeGenerator.cpp              |   7 +-
 js/src/jit/Ion.cpp                        | 119 +++++++----
 js/src/jit/Ion.h                          | 241 +---------------------
 js/src/jit/IonAnalysis.cpp                |   5 +-
 js/src/jit/IonBuilder.cpp                 |  69 ++++---
 js/src/jit/IonBuilder.h                   |  12 +-
 js/src/jit/IonCode.h                      |  10 +-
 js/src/jit/IonOptimizationLevels.cpp      | 110 ++++++++++
 js/src/jit/IonOptimizationLevels.h        | 203 ++++++++++++++++++
 js/src/jit/JitOptions.cpp                 | 160 ++++++++++++++
 js/src/jit/JitOptions.h                   |  76 +++++++
 js/src/jit/Lowering.cpp                   |   2 +-
 js/src/jit/MCallOptimize.cpp              |   3 +
 js/src/jit/MIR.h                          |   7 +-
 js/src/jit/MIRGenerator.h                 |   8 +-
 js/src/jit/MIRGraph.cpp                   |   4 +-
 js/src/jit/UnreachableCodeElimination.cpp |   4 +-
 js/src/jit/shared/Lowering-shared-inl.h   |   4 +-
 js/src/jsapi.cpp                          |  13 +-
 js/src/jsscript.h                         |   6 +-
 js/src/jsworkers.cpp                      |   1 -
 js/src/moz.build                          |   2 +
 js/src/shell/js.cpp                       |  53 ++---
 25 files changed, 762 insertions(+), 363 deletions(-)
 create mode 100644 js/src/jit/IonOptimizationLevels.cpp
 create mode 100644 js/src/jit/IonOptimizationLevels.h
 create mode 100644 js/src/jit/JitOptions.cpp
 create mode 100644 js/src/jit/JitOptions.h

diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index f7e70f9c1109..c58c82ea132b 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -1936,7 +1936,9 @@ class FunctionCompiler
 
         graph_  = lifo_.new_<MIRGraph>(alloc_);
         info_   = lifo_.new_<CompileInfo>(locals_.count(), SequentialExecution);
-        mirGen_ = lifo_.new_<MIRGenerator>(CompileCompartment::get(cx()->compartment()), alloc_, graph_, info_);
+        const OptimizationInfo *optimizationInfo = js_IonOptimizations.get(Optimization_AsmJS);
+        mirGen_ = lifo_.new_<MIRGenerator>(CompileCompartment::get(cx()->compartment()), alloc_,
+                                           graph_, info_, optimizationInfo);
 
         if (!newBlock(/* pred = */ nullptr, &curBlock_, fn_))
             return false;
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index febad931dae9..3e78fff94a01 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -637,7 +637,7 @@ BaselineCompiler::emitUseCountIncrement()
 
     Label skipCall;
 
-    uint32_t minUses = UsesBeforeIonRecompile(script, pc);
+    uint32_t minUses = UsesBeforeIonCompile(script, pc);
     masm.branch32(Assembler::LessThan, countReg, Imm32(minUses), &skipCall);
 
     masm.branchPtr(Assembler::Equal,
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 5a6bff5dab95..cc1095ff392b 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -22,6 +22,7 @@
 #include "jit/ExecutionModeInlines.h"
 #include "jit/IonCaches.h"
 #include "jit/IonLinker.h"
+#include "jit/IonOptimizationLevels.h"
 #include "jit/IonSpewer.h"
 #include "jit/MIRGenerator.h"
 #include "jit/MoveEmitter.h"
@@ -5857,7 +5858,9 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
 {
     RootedScript script(cx, gen->info().script());
     ExecutionMode executionMode = gen->info().executionMode();
-    JS_ASSERT(!HasIonScript(script, executionMode));
+    OptimizationLevel optimizationLevel = gen->optimizationInfo().level();
+
+    JS_ASSERT_IF(HasIonScript(script, executionMode), executionMode == SequentialExecution);
 
     // Check to make sure we didn't have a mid-build invalidation. If so, we
     // will trickle to jit::Compile() and return Method_Skipped.
@@ -5885,7 +5888,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                      safepointIndices_.length(), osiIndices_.length(),
                      cacheList_.length(), runtimeData_.length(),
                      safepoints_.size(), callTargets.length(),
-                     patchableBackedges_.length());
+                     patchableBackedges_.length(), optimizationLevel);
     if (!ionScript) {
         recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
         return false;
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index ba3ee46a154d..a13f7bac1eff 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -27,6 +27,7 @@
 #include "jit/ExecutionModeInlines.h"
 #include "jit/IonAnalysis.h"
 #include "jit/IonBuilder.h"
+#include "jit/IonOptimizationLevels.h"
 #include "jit/IonSpewer.h"
 #include "jit/JitCompartment.h"
 #include "jit/LICM.h"
@@ -49,9 +50,6 @@
 using namespace js;
 using namespace js::jit;
 
-// Global variables.
-IonOptions jit::js_IonOptions;
-
 // Assert that IonCode is gc::Cell aligned.
 JS_STATIC_ASSERT(sizeof(IonCode) % gc::CellSize == 0);
 
@@ -761,7 +759,8 @@ IonScript::New(JSContext *cx, types::RecompileInfo recompileInfo,
                uint32_t frameSlots, uint32_t frameSize, size_t snapshotsSize,
                size_t bailoutEntries, size_t constants, size_t safepointIndices,
                size_t osiIndices, size_t cacheEntries, size_t runtimeSize,
-               size_t safepointsSize, size_t callTargetEntries, size_t backedgeEntries)
+               size_t safepointsSize, size_t callTargetEntries, size_t backedgeEntries,
+               OptimizationLevel optimizationLevel)
 {
     static const int DataAlignment = sizeof(void *);
 
@@ -848,6 +847,7 @@ IonScript::New(JSContext *cx, types::RecompileInfo recompileInfo,
     script->frameSize_ = frameSize;
 
     script->recompileInfo_ = recompileInfo;
+    script->optimizationLevel_ = optimizationLevel;
 
     return script;
 }
@@ -1233,7 +1233,9 @@ OptimizeMIR(MIRGenerator *mir)
 
     // Alias analysis is required for LICM and GVN so that we don't move
     // loads across stores.
-    if (js_IonOptions.licm || js_IonOptions.gvn) {
+    if (mir->optimizationInfo().licmEnabled() ||
+        mir->optimizationInfo().gvnEnabled())
+    {
         AliasAnalysis analysis(mir, graph);
         if (!analysis.analyze())
             return false;
@@ -1253,8 +1255,8 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (js_IonOptions.gvn) {
-        ValueNumberer gvn(mir, graph, js_IonOptions.gvnIsOptimistic);
+    if (mir->optimizationInfo().gvnEnabled()) {
+        ValueNumberer gvn(mir, graph, mir->optimizationInfo().gvnKind() == GVN_Optimistic);
         if (!gvn.analyze())
             return false;
         IonSpewPass("GVN");
@@ -1264,7 +1266,7 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (js_IonOptions.uce) {
+    if (mir->optimizationInfo().uceEnabled()) {
         UnreachableCodeElimination uce(mir, graph);
         if (!uce.analyze())
             return false;
@@ -1275,7 +1277,7 @@ OptimizeMIR(MIRGenerator *mir)
     if (mir->shouldCancel("UCE"))
         return false;
 
-    if (js_IonOptions.licm) {
+    if (mir->optimizationInfo().licmEnabled()) {
         // LICM can hoist instructions from conditional branches and trigger
         // repeated bailouts. Disable it if this script is known to bailout
         // frequently.
@@ -1292,7 +1294,7 @@ OptimizeMIR(MIRGenerator *mir)
         }
     }
 
-    if (js_IonOptions.rangeAnalysis) {
+    if (mir->optimizationInfo().rangeAnalysisEnabled()) {
         RangeAnalysis r(mir, graph);
         if (!r.addBetaNodes())
             return false;
@@ -1318,7 +1320,7 @@ OptimizeMIR(MIRGenerator *mir)
         if (mir->shouldCancel("RA De-Beta"))
             return false;
 
-        if (js_IonOptions.uce) {
+        if (mir->optimizationInfo().uceEnabled()) {
             bool shouldRunUCE = false;
             if (!r.prepareForUCE(&shouldRunUCE))
                 return false;
@@ -1350,7 +1352,7 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (js_IonOptions.eaa) {
+    if (mir->optimizationInfo().eaaEnabled()) {
         EffectiveAddressAnalysis eaa(graph);
         if (!eaa.analyze())
             return false;
@@ -1372,7 +1374,7 @@ OptimizeMIR(MIRGenerator *mir)
     // Passes after this point must not move instructions; these analyses
     // depend on knowing the final order in which instructions will execute.
 
-    if (js_IonOptions.edgeCaseAnalysis && !mir->compilingAsmJS()) {
+    if (mir->optimizationInfo().edgeCaseAnalysisEnabled()) {
         EdgeCaseAnalysis edgeCaseAnalysis(mir, graph);
         if (!edgeCaseAnalysis.analyzeLate())
             return false;
@@ -1383,7 +1385,7 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (!mir->compilingAsmJS()) {
+    if (mir->optimizationInfo().eliminateRedundantChecksEnabled()) {
         // Note: check elimination has to run after all other passes that move
         // instructions. Since check uses are replaced with the actual index,
         // code motion after this pass could incorrectly move a load or store
@@ -1416,7 +1418,7 @@ GenerateLIR(MIRGenerator *mir)
 
     AllocationIntegrityState integrity(*lir);
 
-    switch (js_IonOptions.registerAllocator) {
+    switch (mir->optimizationInfo().registerAllocator()) {
       case RegisterAllocator_LSRA: {
 #ifdef DEBUG
         if (!integrity.record())
@@ -1628,7 +1630,8 @@ TrackPropertiesForSingletonScopes(JSContext *cx, JSScript *script, BaselineFrame
 static AbortReason
 IonCompile(JSContext *cx, JSScript *script,
            BaselineFrame *baselineFrame, jsbytecode *osrPc, bool constructing,
-           ExecutionMode executionMode, bool recompile)
+           ExecutionMode executionMode, bool recompile,
+           OptimizationLevel optimizationLevel)
 {
 #if JS_TRACE_LOGGING
     AutoTraceLog logger(TraceLogging::defaultLogger(),
@@ -1636,6 +1639,8 @@ IonCompile(JSContext *cx, JSScript *script,
                         TraceLogging::ION_COMPILE_STOP,
                         script);
 #endif
+    JS_ASSERT(optimizationLevel > Optimization_DontCompile);
+
     TrackPropertiesForSingletonScopes(cx, script, baselineFrame);
 
     LifoAlloc *alloc = cx->new_<LifoAlloc>(BUILDER_LIFO_ALLOC_PRIMARY_CHUNK_SIZE);
@@ -1683,10 +1688,13 @@ IonCompile(JSContext *cx, JSScript *script,
     if (!constraints)
         return AbortReason_Alloc;
 
+    const OptimizationInfo *optimizationInfo = js_IonOptimizations.get(optimizationLevel);
+
     IonBuilder *builder = alloc->new_<IonBuilder>((JSContext *) nullptr,
                                                   CompileCompartment::get(cx->compartment()),
                                                   temp, graph, constraints,
-                                                  &inspector, info, baselineFrameInspector);
+                                                  &inspector, info, optimizationInfo,
+                                                  baselineFrameInspector);
     if (!builder)
         return AbortReason_Alloc;
 
@@ -1867,6 +1875,17 @@ CanIonCompileScript(JSContext *cx, HandleScript script, bool osr)
     return CheckScriptSize(cx, script) == Method_Compiled;
 }
 
+static OptimizationLevel
+GetOptimizationLevel(HandleScript script, ExecutionMode executionMode)
+{
+    if (executionMode == ParallelExecution)
+        return Optimization_Normal;
+
+    JS_ASSERT(executionMode == SequentialExecution);
+
+    return js_IonOptimizations.levelForUseCount(script->getUseCount());
+}
+
 static MethodStatus
 Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode *osrPc,
         bool constructing, ExecutionMode executionMode)
@@ -1874,6 +1893,8 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     JS_ASSERT(jit::IsIonEnabled(cx));
     JS_ASSERT(jit::IsBaselineEnabled(cx));
     JS_ASSERT_IF(osrPc != nullptr, (JSOp)*osrPc == JSOP_LOOPENTRY);
+    JS_ASSERT_IF(executionMode == ParallelExecution, !osrFrame && !osrPC);
+    JS_ASSERT_IF(executionMode == ParallelExecution, !HasIonScript(script, executionMode));
 
     if (!script->hasBaselineScript())
         return Method_Skipped;
@@ -1895,23 +1916,44 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     }
 
     bool recompile = false;
+    OptimizationLevel optimizationLevel = GetOptimizationLevel(script, executionMode);
+    if (optimizationLevel == Optimization_DontCompile)
+        return Method_Skipped;
 
     IonScript *scriptIon = GetIonScript(script, executionMode);
     if (scriptIon) {
         if (!scriptIon->method())
             return Method_CantCompile;
-        return Method_Compiled;
-    }
 
-    if (executionMode == SequentialExecution) {
-        // Use getUseCount instead of incUseCount to avoid bumping the
-        // use count twice.
-        if (script->getUseCount() < UsesBeforeIonRecompile(script, osrPc ? osrPc : script->code()))
-            return Method_Skipped;
+        MethodStatus failedState = Method_Compiled;
+
+        // If we keep failing to enter the script due to an OSR pc mismatch,
+        // recompile with the right pc.
+        if (osrPc && script->ionScript()->osrPc() != osrPc) {
+            uint32_t count = script->ionScript()->incrOsrPcMismatchCounter();
+            if (count <= js_IonOptions.osrPcMismatchesBeforeRecompile)
+                return Method_Skipped;
+
+            failedState = Method_Skipped;
+        }
+
+        // Don't recompile/overwrite higher optimized code,
+        // with a lower optimization level.
+        if (optimizationLevel <= scriptIon->optimizationLevel())
+            return failedState;
+
+        // Don't start compiling if already compiling
+        if (scriptIon->isRecompiling())
+            return failedState;
+
+        if (osrPc)
+            script->ionScript()->resetOsrPcMismatchCounter();
+
+        recompile = true;
     }
 
     AbortReason reason = IonCompile(cx, script, osrFrame, osrPc, constructing, executionMode,
-                                    recompile);
+                                    recompile, optimizationLevel);
     if (reason == AbortReason_Error)
         return Method_Error;
 
@@ -1961,7 +2003,11 @@ jit::CanEnterAtBranch(JSContext *cx, JSScript *script, BaselineFrame *osrFrame,
         return Method_CantCompile;
     }
 
-    // Attempt compilation. Returns Method_Compiled if already compiled.
+    // Attempt compilation.
+    // - Returns Method_Compiled if the right ionscript is present
+    //   (Meaning it was present or a sequantial compile finished)
+    // - Returns Method_Skipped if pc doesn't match
+    //   (This means a background thread compilation with that pc could have started or not.)
     RootedScript rscript(cx, script);
     MethodStatus status = Compile(cx, rscript, osrFrame, pc, isConstructing, SequentialExecution);
     if (status != Method_Compiled) {
@@ -1970,20 +2016,6 @@ jit::CanEnterAtBranch(JSContext *cx, JSScript *script, BaselineFrame *osrFrame,
         return status;
     }
 
-    if (script->ionScript()->osrPc() != pc) {
-        // If we keep failing to enter the script due to an OSR pc mismatch,
-        // invalidate the script to force a recompile.
-        uint32_t count = script->ionScript()->incrOsrPcMismatchCounter();
-
-        if (count > js_IonOptions.osrPcMismatchesBeforeRecompile) {
-            if (!Invalidate(cx, script, SequentialExecution, true))
-                return Method_Error;
-        }
-        return Method_Skipped;
-    }
-
-    script->ionScript()->resetOsrPcMismatchCounter();
-
     return Method_Compiled;
 }
 
@@ -2699,11 +2731,14 @@ jit::ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode)
 }
 
 uint32_t
-jit::UsesBeforeIonRecompile(JSScript *script, jsbytecode *pc)
+jit::UsesBeforeIonCompile(JSScript *script, jsbytecode *pc)
 {
     JS_ASSERT(pc == script->code() || JSOp(*pc) == JSOP_LOOPENTRY);
 
-    uint32_t minUses = js_IonOptions.usesBeforeCompile;
+    OptimizationLevel level = js_IonOptimizations.nextLevel(Optimization_DontCompile);
+    const OptimizationInfo *info = js_IonOptimizations.get(level);
+
+    uint32_t minUses = info->usesBeforeCompile();
 
     // If the script is too large to compile on the main thread, we can still
     // compile it off thread. In these cases, increase the use count threshold
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 37ad4e778387..3052a540bab8 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -16,248 +16,13 @@
 
 #include "jit/CompileInfo.h"
 #include "jit/CompileWrappers.h"
+#include "jit/IonOptions.h"
 
 namespace js {
 namespace jit {
 
 class TempAllocator;
 
-// Possible register allocators which may be used.
-enum IonRegisterAllocator {
-    RegisterAllocator_LSRA,
-    RegisterAllocator_Backtracking,
-    RegisterAllocator_Stupid
-};
-
-struct IonOptions
-{
-    // Toggles whether global value numbering is used.
-    //
-    // Default: true
-    bool gvn;
-
-    // Toggles whether global value numbering is optimistic (true) or
-    // pessimistic (false).
-    //
-    // Default: true
-    bool gvnIsOptimistic;
-
-    // Toggles whether loop invariant code motion is performed.
-    //
-    // Default: true
-    bool licm;
-
-    // Toggles whether functions may be entered at loop headers.
-    //
-    // Default: true
-    bool osr;
-
-    // Toggles whether large scripts are rejected.
-    //
-    // Default: true
-    bool limitScriptSize;
-
-    // Describes which register allocator to use.
-    //
-    // Default: LSRA
-    IonRegisterAllocator registerAllocator;
-
-    // Toggles whether inlining is performed.
-    //
-    // Default: true
-    bool inlining;
-
-    // Toggles whether Edge Case Analysis is used.
-    //
-    // Default: true
-    bool edgeCaseAnalysis;
-
-    // Toggles whether Range Analysis is used.
-    //
-    // Default: true
-    bool rangeAnalysis;
-
-    // Whether to enable extra code to perform dynamic validation of
-    // RangeAnalysis results.
-    //
-    // Default: false
-    bool checkRangeAnalysis;
-
-    // Whether to protect the GC heap during Ion compilation and ensure that
-    // only threadsafe operations are performed on it.
-    //
-    // Default: false
-    bool checkThreadSafety;
-
-    // Whether to perform expensive graph-consistency DEBUG-only assertions.
-    // It can be useful to disable this to reduce DEBUG-compile time of large
-    // asm.js programs.
-    //
-    // Default: true
-    bool checkGraphConsistency;
-
-    // Toggles whether Unreachable Code Elimination is performed.
-    //
-    // Default: true
-    bool uce;
-
-    // Toggles whether Effective Address Analysis is performed.
-    //
-    // Default: true
-    bool eaa;
-
-#ifdef CHECK_OSIPOINT_REGISTERS
-    // Emit extra code to verify live regs at the start of a VM call
-    // are not modified before its OsiPoint.
-    //
-    // Default: false
-    bool checkOsiPointRegisters;
-#endif
-
-    // How many invocations or loop iterations are needed before functions
-    // are compiled with the baseline compiler.
-    //
-    // Default: 10
-    uint32_t baselineUsesBeforeCompile;
-
-    // How many invocations or loop iterations are needed before functions
-    // are compiled.
-    //
-    // Default: 1,000
-    uint32_t usesBeforeCompile;
-
-    // How many invocations or loop iterations are needed before calls
-    // are inlined, as a fraction of usesBeforeCompile.
-    //
-    // Default: .125
-    double usesBeforeInliningFactor;
-
-    // How many times we will try to enter a script via OSR before
-    // invalidating the script.
-    //
-    // Default: 6,000
-    uint32_t osrPcMismatchesBeforeRecompile;
-
-    // Number of bailouts without invalidation before we set
-    // JSScript::hadFrequentBailouts and invalidate.
-    //
-    // Default: 10
-    uint32_t frequentBailoutThreshold;
-
-    // Number of exception bailouts (resuming into catch/finally block) before
-    // we invalidate and forbid Ion compilation.
-    //
-    // Default: 10
-    uint32_t exceptionBailoutThreshold;
-
-    // Whether Ion should compile try-catch statements.
-    //
-    // Default: true
-    bool compileTryCatch;
-
-    // How many actual arguments are accepted on the C stack.
-    //
-    // Default: 4,096
-    uint32_t maxStackArgs;
-
-    // The maximum inlining depth.
-    //
-    // Default: 3
-    uint32_t maxInlineDepth;
-
-    // The maximum inlining depth for functions.
-    //
-    // Inlining small functions has almost no compiling overhead
-    // and removes the otherwise needed call overhead.
-    // The value is currently very low.
-    // Actually it is only needed to make sure we don't blow out the stack.
-    //
-    // Default: 10
-    uint32_t smallFunctionMaxInlineDepth;
-
-    // The bytecode length limit for small function.
-    //
-    // The default for this was arrived at empirically via benchmarking.
-    // We may want to tune it further after other optimizations have gone
-    // in.
-    //
-    // Default: 100
-    uint32_t smallFunctionMaxBytecodeLength;
-
-    // The maximum number of functions to polymorphically inline at a call site.
-    //
-    // Default: 4
-    uint32_t polyInlineMax;
-
-    // The maximum total bytecode size of an inline call site.
-    //
-    // Default: 1000
-    uint32_t inlineMaxTotalBytecodeLength;
-
-    // Whether functions are compiled immediately.
-    //
-    // Default: false
-    bool eagerCompilation;
-
-    // How many uses of a parallel kernel before we attempt compilation.
-    //
-    // Default: 1
-    uint32_t usesBeforeCompilePar;
-
-    // The maximum bytecode length the caller may have,
-    // before we stop inlining large functions in that caller.
-    //
-    // Default: 10000
-    uint32_t inliningMaxCallerBytecodeLength;
-
-    void setEagerCompilation() {
-        eagerCompilation = true;
-        usesBeforeCompile = 0;
-        baselineUsesBeforeCompile = 0;
-    }
-
-    MOZ_CONSTEXPR IonOptions()
-      : gvn(true),
-        gvnIsOptimistic(true),
-        licm(true),
-        osr(true),
-        limitScriptSize(true),
-        registerAllocator(RegisterAllocator_LSRA),
-        inlining(true),
-        edgeCaseAnalysis(true),
-        rangeAnalysis(true),
-        checkRangeAnalysis(false),
-        checkThreadSafety(false),
-        checkGraphConsistency(true),
-        uce(true),
-        eaa(true),
-#ifdef CHECK_OSIPOINT_REGISTERS
-        checkOsiPointRegisters(false),
-#endif
-        baselineUsesBeforeCompile(10),
-        usesBeforeCompile(1000),
-        usesBeforeInliningFactor(.125),
-        osrPcMismatchesBeforeRecompile(6000),
-        frequentBailoutThreshold(10),
-        exceptionBailoutThreshold(10),
-        compileTryCatch(true),
-        maxStackArgs(4096),
-        maxInlineDepth(3),
-        smallFunctionMaxInlineDepth(10),
-        smallFunctionMaxBytecodeLength(100),
-        polyInlineMax(4),
-        inlineMaxTotalBytecodeLength(1000),
-        eagerCompilation(false),
-        usesBeforeCompilePar(1),
-        inliningMaxCallerBytecodeLength(10000)
-    {
-    }
-
-    uint32_t usesBeforeInlining() {
-        return usesBeforeCompile * usesBeforeInliningFactor;
-    }
-};
-
 enum MethodStatus
 {
     Method_Error,
@@ -308,8 +73,6 @@ class IonContext
     int assemblerCount_;
 };
 
-extern IonOptions js_IonOptions;
-
 // Initialize Ion statically for all JSRuntimes.
 bool InitializeIon();
 
@@ -416,7 +179,7 @@ TooManyArguments(unsigned nargs)
 
 void ForbidCompilation(JSContext *cx, JSScript *script);
 void ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode);
-uint32_t UsesBeforeIonRecompile(JSScript *script, jsbytecode *pc);
+uint32_t UsesBeforeIonCompile(JSScript *script, jsbytecode *pc);
 
 void PurgeCaches(JSScript *script, JS::Zone *zone);
 size_t SizeOfIonData(JSScript *script, mozilla::MallocSizeOf mallocSizeOf);
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 839c3ecb2305..d91b5e49d5b9 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -12,6 +12,7 @@
 #include "jit/BaselineJIT.h"
 #include "jit/Ion.h"
 #include "jit/IonBuilder.h"
+#include "jit/IonOptimizationLevels.h"
 #include "jit/LIR.h"
 #include "jit/Lowering.h"
 #include "jit/MIRGraph.h"
@@ -2158,10 +2159,12 @@ jit::AnalyzeNewScriptProperties(JSContext *cx, JSFunction *fun,
 
     AutoTempAllocatorRooter root(cx, &temp);
 
+    const OptimizationInfo *optimizationInfo = js_IonOptimizations.get(Optimization_Normal);
+
     types::CompilerConstraintList *constraints = types::NewCompilerConstraintList(temp);
     BaselineInspector inspector(script);
     IonBuilder builder(cx, CompileCompartment::get(cx->compartment()), &temp, &graph, constraints,
-                       &inspector, &info, /* baselineFrame = */ nullptr);
+                       &inspector, &info, optimizationInfo, /* baselineFrame = */ nullptr);
 
     if (!builder.build()) {
         if (builder.abortReason() == AbortReason_Alloc)
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index c45572433eb7..151c4ab38d22 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -18,6 +18,7 @@
 #include "jit/BaselineInspector.h"
 #include "jit/ExecutionModeInlines.h"
 #include "jit/Ion.h"
+#include "jit/IonOptimizationLevels.h"
 #include "jit/IonSpewer.h"
 #include "jit/Lowering.h"
 #include "jit/MIRGraph.h"
@@ -101,11 +102,13 @@ jit::NewBaselineFrameInspector(TempAllocator *temp, BaselineFrame *frame)
     return inspector;
 }
 
-IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp, MIRGraph *graph,
-                       types::CompilerConstraintList *constraints,
-                       BaselineInspector *inspector, CompileInfo *info, BaselineFrameInspector *baselineFrame,
-                       size_t inliningDepth, uint32_t loopDepth)
-  : MIRGenerator(comp, temp, graph, info),
+IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp,
+                       MIRGraph *graph, types::CompilerConstraintList *constraints,
+                       BaselineInspector *inspector, CompileInfo *info,
+                       const OptimizationInfo *optimizationInfo,
+                       BaselineFrameInspector *baselineFrame, size_t inliningDepth,
+                       uint32_t loopDepth)
+  : MIRGenerator(comp, temp, graph, info, optimizationInfo),
     backgroundCodegen_(nullptr),
     analysisContext(analysisContext),
     baselineFrame_(baselineFrame),
@@ -327,6 +330,9 @@ IonBuilder::DontInline(JSScript *targetScript, const char *reason)
 IonBuilder::InliningDecision
 IonBuilder::canInlineTarget(JSFunction *target, CallInfo &callInfo)
 {
+    if (!optimizationInfo().inlineInterpreted())
+        return InliningDecision_DontInline;
+
     if (!target->isInterpreted())
         return DontInline(nullptr, "Non-interpreted target");
 
@@ -3851,9 +3857,9 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
     AutoAccumulateReturns aar(graph(), returns);
 
     // Build the graph.
-    IonBuilder inlineBuilder(analysisContext, compartment,
-                             &alloc(), &graph(), constraints(), &inspector, info, nullptr,
-                             inliningDepth_ + 1, loopDepth_);
+    IonBuilder inlineBuilder(analysisContext, compartment, &alloc(), &graph(), constraints(),
+                             &inspector, info, &optimizationInfo(), nullptr, inliningDepth_ + 1,
+                             loopDepth_);
     if (!inlineBuilder.buildInline(this, outerResumePoint, callInfo)) {
         if (analysisContext && analysisContext->isExceptionPending()) {
             IonSpew(IonSpew_Abort, "Inline builder raised exception.");
@@ -3965,19 +3971,9 @@ IonBuilder::patchInlinedReturns(CallInfo &callInfo, MIRGraphReturns &returns, MB
     return phi;
 }
 
-static bool
-IsSmallFunction(JSScript *script)
-{
-    return script->length() <= js_IonOptions.smallFunctionMaxBytecodeLength;
-}
-
 IonBuilder::InliningDecision
 IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
 {
-    // Only inline when inlining is enabled.
-    if (!inliningEnabled())
-        return InliningDecision_DontInline;
-
     // When there is no target, inlining is impossible.
     if (target == nullptr)
         return InliningDecision_DontInline;
@@ -3997,30 +3993,30 @@ IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
     // Skip heuristics if we have an explicit hint to inline.
     if (!targetScript->shouldInline()) {
         // Cap the inlining depth.
-        if (IsSmallFunction(targetScript)) {
-            if (inliningDepth_ >= js_IonOptions.smallFunctionMaxInlineDepth)
+        if (js_IonOptions.isSmallFunction(targetScript)) {
+            if (inliningDepth_ >= optimizationInfo().smallFunctionMaxInlineDepth())
                 return DontInline(targetScript, "Vetoed: exceeding allowed inline depth");
         } else {
-            if (inliningDepth_ >= js_IonOptions.maxInlineDepth)
+            if (inliningDepth_ >= optimizationInfo().maxInlineDepth())
                 return DontInline(targetScript, "Vetoed: exceeding allowed inline depth");
 
             if (targetScript->hasLoops())
                 return DontInline(targetScript, "Vetoed: big function that contains a loop");
 
             // Caller must not be excessively large.
-            if (script()->length() >= js_IonOptions.inliningMaxCallerBytecodeLength)
+            if (script()->length() >= optimizationInfo().inliningMaxCallerBytecodeLength())
                 return DontInline(targetScript, "Vetoed: caller excessively large");
         }
 
         // Callee must not be excessively large.
         // This heuristic also applies to the callsite as a whole.
-        if (targetScript->length() > js_IonOptions.inlineMaxTotalBytecodeLength)
+        if (targetScript->length() > optimizationInfo().inlineMaxTotalBytecodeLength())
             return DontInline(targetScript, "Vetoed: callee excessively large");
 
         // Callee must have been called a few times to have somewhat stable
         // type information, except for definite properties analysis,
         // as the caller has not run yet.
-        if (targetScript->getUseCount() < js_IonOptions.usesBeforeInlining() &&
+        if (targetScript->getUseCount() < optimizationInfo().usesBeforeInlining() &&
             info().executionMode() != DefinitePropertiesAnalysis)
         {
             return DontInline(targetScript, "Vetoed: callee is insufficiently hot.");
@@ -4063,7 +4059,7 @@ IonBuilder::selectInliningTargets(ObjectVector &targets, CallInfo &callInfo, Boo
         // Enforce a maximum inlined bytecode limit at the callsite.
         if (inlineable && target->isInterpreted()) {
             totalSize += target->nonLazyScript()->length();
-            if (totalSize > js_IonOptions.inlineMaxTotalBytecodeLength)
+            if (totalSize > optimizationInfo().inlineMaxTotalBytecodeLength())
                 inlineable = false;
         }
 
@@ -4157,9 +4153,6 @@ IonBuilder::InliningStatus
 IonBuilder::inlineCallsite(ObjectVector &targets, ObjectVector &originals,
                            bool lambda, CallInfo &callInfo)
 {
-    if (!inliningEnabled())
-        return InliningStatus_NotInlined;
-
     if (targets.length() == 0)
         return InliningStatus_NotInlined;
 
@@ -5999,10 +5992,28 @@ ClassHasResolveHook(CompileCompartment *comp, const Class *clasp, PropertyName *
 void
 IonBuilder::insertRecompileCheck()
 {
+    // PJS doesn't recompile and doesn't need recompile checks.
     if (info().executionMode() != SequentialExecution)
         return;
 
-    return;
+    // No need for recompile checks if this is the highest optimization level.
+    OptimizationLevel curLevel = optimizationInfo().level();
+    if (js_IonOptimizations.isLastLevel(curLevel))
+        return;
+
+    // Add recompile check.
+
+    // Get the topmost builder. The topmost script will get recompiled when
+    // usecount is high enough to justify a higher optimization level.
+    IonBuilder *topBuilder = this;
+    while (topBuilder->callerBuilder_)
+        topBuilder = topBuilder->callerBuilder_;
+
+    // Add recompile check to recompile when the usecount reaches the usecount
+    // of the next optimization level.
+    OptimizationLevel nextLevel = js_IonOptimizations.nextLevel(curLevel);
+    const OptimizationInfo *info = js_IonOptimizations.get(nextLevel);
+    current->add(MRecompileCheck::New(alloc(), topBuilder->script(), info->usesBeforeCompile()));
 }
 
 JSObject *
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index a844910be45a..d2af9d5b8b89 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -13,6 +13,7 @@
 // JSScript.
 
 #include "jit/BytecodeAnalysis.h"
+#include "jit/IonOptimizationLevels.h"
 #include "jit/MIR.h"
 #include "jit/MIRGenerator.h"
 #include "jit/MIRGraph.h"
@@ -211,9 +212,10 @@ class IonBuilder : public MIRGenerator
     static int CmpSuccessors(const void *a, const void *b);
 
   public:
-    IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp, MIRGraph *graph,
-               types::CompilerConstraintList *constraints,
-               BaselineInspector *inspector, CompileInfo *info, BaselineFrameInspector *baselineFrame,
+    IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp,
+               MIRGraph *graph, types::CompilerConstraintList *constraints,
+               BaselineInspector *inspector, CompileInfo *info,
+               const OptimizationInfo *optimizationInfo, BaselineFrameInspector *baselineFrame,
                size_t inliningDepth = 0, uint32_t loopDepth = 0);
 
     bool build();
@@ -230,10 +232,6 @@ class IonBuilder : public MIRGenerator
     bool abort(const char *message, ...);
     void spew(const char *message);
 
-    static bool inliningEnabled() {
-        return js_IonOptions.inlining;
-    }
-
     JSFunction *getSingleCallTarget(types::TemporaryTypeSet *calleeTypes);
     bool getPolyCallTargets(types::TemporaryTypeSet *calleeTypes, bool constructing,
                             ObjectVector &targets, uint32_t maxTargets, bool *gotLambda);
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index 8167d1fa80e9..d3ecaa94223e 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -14,6 +14,7 @@
 #include "jstypes.h"
 
 #include "gc/Heap.h"
+#include "jit/IonOptimizationLevels.h"
 #include "jit/IonTypes.h"
 
 namespace JSC {
@@ -261,6 +262,9 @@ struct IonScript
     // Identifier of the compilation which produced this code.
     types::RecompileInfo recompileInfo_;
 
+    // The optimization level this script was compiled in.
+    OptimizationLevel optimizationLevel_;
+
     // Number of times we tried to enter this script via OSR but failed due to
     // a LOOPENTRY pc other than osrPc_.
     uint32_t osrPcMismatchCounter_;
@@ -335,7 +339,8 @@ struct IonScript
                           size_t snapshotsSize, size_t snapshotEntries,
                           size_t constants, size_t safepointIndexEntries, size_t osiIndexEntries,
                           size_t cacheEntries, size_t runtimeSize, size_t safepointsSize,
-                          size_t callTargetEntries, size_t backedgeEntries);
+                          size_t callTargetEntries, size_t backedgeEntries,
+                          OptimizationLevel optimizationLevel);
     static void Trace(JSTracer *trc, IonScript *script);
     static void Destroy(FreeOp *fop, IonScript *script);
 
@@ -526,6 +531,9 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
+    OptimizationLevel optimizationLevel() const {
+        return optimizationLevel_;
+    }
     uint32_t incrOsrPcMismatchCounter() {
         return ++osrPcMismatchCounter_;
     }
diff --git a/js/src/jit/IonOptimizationLevels.cpp b/js/src/jit/IonOptimizationLevels.cpp
new file mode 100644
index 000000000000..e6679c8ccbf7
--- /dev/null
+++ b/js/src/jit/IonOptimizationLevels.cpp
@@ -0,0 +1,110 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "jit/IonOptimizationLevels.h"
+
+#include "jsanalyze.h"
+#include "jsscript.h"
+
+using namespace js;
+using namespace js::jit;
+
+namespace js {
+namespace jit {
+
+OptimizationInfos js_IonOptimizations;
+
+void
+OptimizationInfo::initNormalOptimizationInfo()
+{
+    level_ = Optimization_Normal;
+
+    eaa_ = true;
+    edgeCaseAnalysis_ = true;
+    eliminateRedundantChecks_ = true;
+    inlineInterpreted_ = true;
+    inlineNative_ = true;
+    gvn_ = true;
+    gvnKind_ = GVN_Optimistic;
+    licm_ = true;
+    uce_ = true;
+    rangeAnalysis_ = true;
+    registerAllocator_ = RegisterAllocator_LSRA;
+
+    inlineMaxTotalBytecodeLength_ = 1000;
+    inliningMaxCallerBytecodeLength_ = 10000;
+    maxInlineDepth_ = 3;
+    smallFunctionMaxInlineDepth_ = 10;
+    usesBeforeCompile_ = 1000;
+    usesBeforeInliningFactor_ = 0.125;
+}
+
+void
+OptimizationInfo::initAsmjsOptimizationInfo()
+{
+    // The AsmJS optimization level
+    // Disables some passes that don't work well with asmjs.
+
+    // Take normal option values for not specified values.
+    initNormalOptimizationInfo();
+
+    level_ = Optimization_AsmJS;
+    edgeCaseAnalysis_ = false;
+    eliminateRedundantChecks_ = false;
+}
+
+OptimizationInfos::OptimizationInfos()
+{
+    infos_[Optimization_Normal - 1].initNormalOptimizationInfo();
+    infos_[Optimization_AsmJS - 1].initAsmjsOptimizationInfo();
+
+#ifdef DEBUG
+    OptimizationLevel prev = nextLevel(Optimization_DontCompile);
+    while (!isLastLevel(prev)) {
+        OptimizationLevel next = nextLevel(prev);
+        JS_ASSERT(get(prev)->usesBeforeCompile() < get(next)->usesBeforeCompile());
+        prev = next;
+    }
+#endif
+}
+
+OptimizationLevel
+OptimizationInfos::nextLevel(OptimizationLevel level)
+{
+    JS_ASSERT(!isLastLevel(level));
+    switch (level) {
+      case Optimization_DontCompile:
+        return Optimization_Normal;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unknown optimization level.");
+    }
+}
+
+bool
+OptimizationInfos::isLastLevel(OptimizationLevel level)
+{
+    return level == Optimization_Normal;
+}
+
+OptimizationLevel
+OptimizationInfos::levelForUseCount(uint32_t useCount)
+{
+    OptimizationLevel prev = Optimization_DontCompile;
+
+    while (!isLastLevel(prev)) {
+        OptimizationLevel level = nextLevel(prev);
+        const OptimizationInfo *info = get(level);
+        if (useCount < info->usesBeforeCompile())
+            return prev;
+
+        prev = level;
+    }
+
+    return prev;
+}
+
+} // namespace jit
+} // namespace js
diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
new file mode 100644
index 000000000000..012a07968706
--- /dev/null
+++ b/js/src/jit/IonOptimizationLevels.h
@@ -0,0 +1,203 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef jit_IonOptimizationLevels_h
+#define jit_IonOptimizationLevels_h
+
+#include "jsbytecode.h"
+#include "jstypes.h"
+
+#include "jit/IonOptions.h"
+#include "js/TypeDecls.h"
+
+namespace js {
+namespace jit {
+
+enum OptimizationLevel
+{
+    Optimization_DontCompile,
+    Optimization_Normal,
+    Optimization_AsmJS,
+    Optimization_Count
+};
+
+class OptimizationInfo
+{
+  public:
+    OptimizationLevel level_;
+
+    // Toggles whether Effective Address Analysis is performed.
+    bool eaa_;
+
+    // Toggles whether Edge Case Analysis is used.
+    bool edgeCaseAnalysis_;
+
+    // Toggles whether redundant checks get removed.
+    bool eliminateRedundantChecks_;
+
+    // Toggles whether interpreted scripts get inlined.
+    bool inlineInterpreted_;
+
+    // Toggles whether native scripts get inlined.
+    bool inlineNative_;
+
+    // Toggles whether global value numbering is used.
+    bool gvn_;
+
+    // Toggles whether global value numbering is optimistic or pessimistic.
+    IonGvnKind gvnKind_;
+
+    // Toggles whether loop invariant code motion is performed.
+    bool licm_;
+
+    // Toggles whether Unreachable Code Elimination is performed.
+    bool uce_;
+
+    // Toggles whether Range Analysis is used.
+    bool rangeAnalysis_;
+
+    // Describes which register allocator to use.
+    IonRegisterAllocator registerAllocator_;
+
+    // The maximum total bytecode size of an inline call site.
+    uint32_t inlineMaxTotalBytecodeLength_;
+
+    // The maximum bytecode length the caller may have,
+    // before we stop inlining large functions in that caller.
+    uint32_t inliningMaxCallerBytecodeLength_;
+
+    // The maximum inlining depth.
+    uint32_t maxInlineDepth_;
+
+    // The maximum inlining depth for functions.
+    //
+    // Inlining small functions has almost no compiling overhead
+    // and removes the otherwise needed call overhead.
+    // The value is currently very low.
+    // Actually it is only needed to make sure we don't blow out the stack.
+    uint32_t smallFunctionMaxInlineDepth_;
+
+    // How many invocations or loop iterations are needed before functions
+    // are compiled.
+    uint32_t usesBeforeCompile_;
+
+    // How many invocations or loop iterations are needed before calls
+    // are inlined, as a fraction of usesBeforeCompile.
+    double usesBeforeInliningFactor_;
+
+    OptimizationInfo()
+    { }
+
+    void initNormalOptimizationInfo();
+    void initAsmjsOptimizationInfo();
+
+    OptimizationLevel level() const {
+        return level_;
+    }
+
+    bool inlineInterpreted() const {
+        return inlineInterpreted_ && !js_IonOptions.disableInlining;
+    }
+
+    bool inlineNative() const {
+        return inlineNative_ && !js_IonOptions.disableInlining;
+    }
+
+    uint32_t usesBeforeCompile() const {
+        if (js_IonOptions.forceDefaultIonUsesBeforeCompile)
+            return js_IonOptions.forcedDefaultIonUsesBeforeCompile;
+        return usesBeforeCompile_;
+    }
+
+    bool gvnEnabled() const {
+        return gvn_ && !js_IonOptions.disableGvn;
+    }
+
+    bool licmEnabled() const {
+        return licm_ && !js_IonOptions.disableLicm;
+    }
+
+    bool uceEnabled() const {
+        return uce_ && !js_IonOptions.disableUce;
+    }
+
+    bool rangeAnalysisEnabled() const {
+        return rangeAnalysis_ && !js_IonOptions.disableRangeAnalysis;
+    }
+
+    bool eaaEnabled() const {
+        return eaa_ && !js_IonOptions.disableEaa;
+    }
+
+    bool edgeCaseAnalysisEnabled() const {
+        return edgeCaseAnalysis_ && !js_IonOptions.disableEdgeCaseAnalysis;
+    }
+
+    bool eliminateRedundantChecksEnabled() const {
+        return eliminateRedundantChecks_;
+    }
+
+    IonGvnKind gvnKind() const {
+        if (!js_IonOptions.forceGvnKind)
+            return gvnKind_;
+        return js_IonOptions.forcedGvnKind;
+    }
+
+    IonRegisterAllocator registerAllocator() const {
+        if (!js_IonOptions.forceRegisterAllocator)
+            return registerAllocator_;
+        return js_IonOptions.forcedRegisterAllocator;
+    }
+
+    uint32_t smallFunctionMaxInlineDepth() const {
+        return smallFunctionMaxInlineDepth_;
+    }
+
+    bool isSmallFunction(JSScript *script) const;
+
+    uint32_t maxInlineDepth() const {
+        return maxInlineDepth_;
+    }
+
+    uint32_t inlineMaxTotalBytecodeLength() const {
+        return inlineMaxTotalBytecodeLength_;
+    }
+
+    uint32_t inliningMaxCallerBytecodeLength() const {
+        return inlineMaxTotalBytecodeLength_;
+    }
+
+    uint32_t usesBeforeInlining() const {
+        return usesBeforeCompile() * usesBeforeInliningFactor_;
+    }
+};
+
+class OptimizationInfos
+{
+  private:
+    OptimizationInfo infos_[Optimization_Count - 1];
+
+  public:
+    OptimizationInfos();
+
+    const OptimizationInfo *get(OptimizationLevel level) {
+        JS_ASSERT(level < Optimization_Count);
+        JS_ASSERT(level != Optimization_DontCompile);
+
+        return &infos_[level - 1];
+    }
+
+    OptimizationLevel nextLevel(OptimizationLevel level);
+    bool isLastLevel(OptimizationLevel level);
+    OptimizationLevel levelForUseCount(uint32_t useCount);
+};
+
+extern OptimizationInfos js_IonOptimizations;
+
+} // namespace jit
+} // namespace js
+
+#endif /* jit_IonOptimizationLevels_h */
diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
new file mode 100644
index 000000000000..3c3bf41d8dfb
--- /dev/null
+++ b/js/src/jit/JitOptions.cpp
@@ -0,0 +1,160 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "jit/IonOptions.h"
+
+using namespace js;
+using namespace js::jit;
+
+namespace js {
+namespace jit {
+
+IonOptions js_IonOptions;
+
+IonOptions::IonOptions()
+{
+    // Whether to perform expensive graph-consistency DEBUG-only assertions.
+    // It can be useful to disable this to reduce DEBUG-compile time of large
+    // asm.js programs.
+    checkGraphConsistency = true;
+
+#ifdef CHECK_OSIPOINT_REGISTERS
+    // Emit extra code to verify live regs at the start of a VM call
+    // are not modified before its OsiPoint.
+    checkOsiPointRegisters = false;
+#endif
+
+    // Whether to enable extra code to perform dynamic validation of
+    // RangeAnalysis results.
+    checkRangeAnalysis = false;
+
+    // Whether to protect the GC heap during Ion compilation and ensure that
+    // only threadsafe operations are performed on it.
+    checkThreadSafety = false;
+
+    // Whether Ion should compile try-catch statements.
+    compileTryCatch = true;
+
+    // Toggle whether global value numbering is globally disabled.
+    disableGvn = false;
+
+    // Toggles whether loop invariant code motion is globally disabled.
+    disableLicm = false;
+
+    // Toggles whether inlining is globally disabled.
+    disableInlining = false;
+
+    // Toggles whether Edge Case Analysis is gobally disabled.
+    disableEdgeCaseAnalysis = false;
+
+    // Toggles whether Range Analysis is globally disabled.
+    disableRangeAnalysis = false;
+
+    // Toggles whether Unreachable Code Elimination is globally disabled.
+    disableUce = false;
+
+    // Toggles whether Effective Address Analysis is globally disabled.
+    disableEaa = false;
+
+    // Whether functions are compiled immediately.
+    eagerCompilation = false;
+
+    // Force how many invocation or loop iterations are needed before compiling
+    // a function with the highest ionmonkey optimization level.
+    // (i.e. OptimizationLevel_Normal)
+    forceDefaultIonUsesBeforeCompile = false;
+    forcedDefaultIonUsesBeforeCompile = 1000;
+
+    // Force the GVN kind to be optimistic or pessimistic instead of letting
+    // the optimization pass decide.
+    forceGvnKind = false;
+    forcedGvnKind = GVN_Optimistic;
+
+    // Force the used register allocator instead of letting the
+    // optimization pass decide.
+    forceRegisterAllocator = false;
+    forcedRegisterAllocator = RegisterAllocator_LSRA;
+
+    // Toggles whether large scripts are rejected.
+    limitScriptSize = true;
+
+    // Toggles whether functions may be entered at loop headers.
+    osr = true;
+
+    // How many invocations or loop iterations are needed before functions
+    // are compiled with the baseline compiler.
+    baselineUsesBeforeCompile = 10;
+
+    // Number of exception bailouts (resuming into catch/finally block) before
+    // we invalidate and forbid Ion compilation.
+    exceptionBailoutThreshold = 10;
+
+    // Number of bailouts without invalidation before we set
+    // JSScript::hadFrequentBailouts and invalidate.
+    frequentBailoutThreshold = 10;
+
+    // How many actual arguments are accepted on the C stack.
+    maxStackArgs = 4096;
+
+    // How many times we will try to enter a script via OSR before
+    // invalidating the script.
+    osrPcMismatchesBeforeRecompile = 6000;
+
+    // The bytecode length limit for small function.
+    //
+    // The default for this was arrived at empirically via benchmarking.
+    // We may want to tune it further after other optimizations have gone
+    // in.
+    smallFunctionMaxBytecodeLength_ = 100;
+
+    // How many uses of a parallel kernel before we attempt compilation.
+    usesBeforeCompilePar = 1;
+}
+
+bool
+IonOptions::isSmallFunction(JSScript *script) const
+{
+    return script->length() <= smallFunctionMaxBytecodeLength_;
+}
+
+void
+IonOptions::setEagerCompilation()
+{
+    eagerCompilation = true;
+    baselineUsesBeforeCompile = 0;
+    forceDefaultIonUsesBeforeCompile = true;
+    forcedDefaultIonUsesBeforeCompile = 0;
+}
+
+void
+IonOptions::setUsesBeforeCompile(uint32_t useCount)
+{
+    forceDefaultIonUsesBeforeCompile = true;
+    forcedDefaultIonUsesBeforeCompile = useCount;
+
+    // Undo eager compilation
+    if (eagerCompilation && useCount != 0) {
+        jit::IonOptions defaultValues;
+        eagerCompilation = false;
+        baselineUsesBeforeCompile = defaultValues.baselineUsesBeforeCompile;
+    }
+}
+
+void
+IonOptions::resetUsesBeforeCompile()
+{
+    forceDefaultIonUsesBeforeCompile = false;
+
+    // Undo eager compilation
+    if (eagerCompilation) {
+        jit::IonOptions defaultValues;
+        eagerCompilation = false;
+        baselineUsesBeforeCompile = defaultValues.baselineUsesBeforeCompile;
+    }
+}
+
+} // namespace jit
+} // namespace js
diff --git a/js/src/jit/JitOptions.h b/js/src/jit/JitOptions.h
new file mode 100644
index 000000000000..2f3d3d65cd18
--- /dev/null
+++ b/js/src/jit/JitOptions.h
@@ -0,0 +1,76 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef jit_IonOptions_h
+#define jit_IonOptions_h
+
+#include "jit/IonTypes.h"
+
+#ifdef JS_ION
+
+namespace js {
+namespace jit {
+
+// Possible register allocators which may be used.
+enum IonRegisterAllocator {
+    RegisterAllocator_LSRA,
+    RegisterAllocator_Backtracking,
+    RegisterAllocator_Stupid
+};
+
+enum IonGvnKind {
+    GVN_Optimistic,
+    GVN_Pessimistic
+};
+
+struct IonOptions
+{
+    bool checkGraphConsistency;
+#ifdef CHECK_OSIPOINT_REGISTERS
+    bool checkOsiPointRegisters;
+#endif
+    bool checkRangeAnalysis;
+    bool checkThreadSafety;
+    bool compileTryCatch;
+    bool disableGvn;
+    bool disableLicm;
+    bool disableInlining;
+    bool disableEdgeCaseAnalysis;
+    bool disableRangeAnalysis;
+    bool disableUce;
+    bool disableEaa;
+    bool eagerCompilation;
+    bool forceDefaultIonUsesBeforeCompile;
+    uint32_t forcedDefaultIonUsesBeforeCompile;
+    bool forceGvnKind;
+    IonGvnKind forcedGvnKind;
+    bool forceRegisterAllocator;
+    IonRegisterAllocator forcedRegisterAllocator;
+    bool limitScriptSize;
+    bool osr;
+    uint32_t baselineUsesBeforeCompile;
+    uint32_t exceptionBailoutThreshold;
+    uint32_t frequentBailoutThreshold;
+    uint32_t maxStackArgs;
+    uint32_t osrPcMismatchesBeforeRecompile;
+    uint32_t smallFunctionMaxBytecodeLength_;
+    uint32_t usesBeforeCompilePar;
+
+    IonOptions();
+    bool isSmallFunction(JSScript *script) const;
+    void setEagerCompilation();
+    void setUsesBeforeCompile(uint32_t useCount);
+    void resetUsesBeforeCompile();
+};
+
+extern IonOptions js_IonOptions;
+
+} // namespace jit
+} // namespace js
+
+#endif // JS_ION
+
+#endif /* jit_IonOptions_h */
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 6e2800c04241..5f65fe844778 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3550,7 +3550,7 @@ LIRGenerator::visitBlock(MBasicBlock *block)
     if (!definePhis())
         return false;
 
-    if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
+    if (gen->optimizationInfo().registerAllocator() == RegisterAllocator_LSRA) {
         if (!add(new(alloc()) LLabel()))
             return false;
     }
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 6292fc1ab510..d5e4dde8fc8b 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -24,6 +24,9 @@ namespace jit {
 IonBuilder::InliningStatus
 IonBuilder::inlineNativeCall(CallInfo &callInfo, JSNative native)
 {
+    if (!optimizationInfo().inlineNative())
+        return InliningStatus_NotInlined;
+
     // Array natives.
     if (native == js_Array)
         return inlineArray(callInfo);
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index cd4cba1d0c7e..c35b7ab9b1ed 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9204,13 +9204,16 @@ class MHaveSameClass
     }
 };
 
+// Increase the usecount of the provided script upon execution and test if
+// the usecount surpasses the threshold. Upon hit it will recompile the
+// outermost script (i.e. not the inlined script).
 class MRecompileCheck : public MNullaryInstruction
 {
     JSScript *script_;
     uint32_t recompileThreshold_;
 
-    MRecompileCheck(JSScript *script_, uint32_t recompileThreshold)
-      : script_(script_),
+    MRecompileCheck(JSScript *script, uint32_t recompileThreshold)
+      : script_(script),
         recompileThreshold_(recompileThreshold)
     {
         setGuard();
diff --git a/js/src/jit/MIRGenerator.h b/js/src/jit/MIRGenerator.h
index 93fe32a795c5..bce7c0c963e0 100644
--- a/js/src/jit/MIRGenerator.h
+++ b/js/src/jit/MIRGenerator.h
@@ -29,11 +29,13 @@ namespace jit {
 class MBasicBlock;
 class MIRGraph;
 class MStart;
+class OptimizationInfo;
 
 class MIRGenerator
 {
   public:
-    MIRGenerator(CompileCompartment *compartment, TempAllocator *alloc, MIRGraph *graph, CompileInfo *info);
+    MIRGenerator(CompileCompartment *compartment, TempAllocator *alloc, MIRGraph *graph,
+                 CompileInfo *info, const OptimizationInfo *optimizationInfo);
 
     TempAllocator &alloc() {
         return *alloc_;
@@ -50,6 +52,9 @@ class MIRGenerator
     CompileInfo &info() {
         return *info_;
     }
+    const OptimizationInfo &optimizationInfo() const {
+        return *optimizationInfo_;
+    }
 
     template <typename T>
     T * allocate(size_t count = 1) {
@@ -127,6 +132,7 @@ class MIRGenerator
 
   protected:
     CompileInfo *info_;
+    const OptimizationInfo *optimizationInfo_;
     TempAllocator *alloc_;
     JSFunction *fun_;
     uint32_t nslots_;
diff --git a/js/src/jit/MIRGraph.cpp b/js/src/jit/MIRGraph.cpp
index ac4034f6a536..3965afec7f6d 100644
--- a/js/src/jit/MIRGraph.cpp
+++ b/js/src/jit/MIRGraph.cpp
@@ -17,9 +17,11 @@ using namespace js;
 using namespace js::jit;
 
 MIRGenerator::MIRGenerator(CompileCompartment *compartment,
-                           TempAllocator *alloc, MIRGraph *graph, CompileInfo *info)
+                           TempAllocator *alloc, MIRGraph *graph, CompileInfo *info,
+                           const OptimizationInfo *optimizationInfo)
   : compartment(compartment),
     info_(info),
+    optimizationInfo_(optimizationInfo),
     alloc_(alloc),
     graph_(graph),
     error_(false),
diff --git a/js/src/jit/UnreachableCodeElimination.cpp b/js/src/jit/UnreachableCodeElimination.cpp
index ea37feb5d541..dec3d1caf8a3 100644
--- a/js/src/jit/UnreachableCodeElimination.cpp
+++ b/js/src/jit/UnreachableCodeElimination.cpp
@@ -82,8 +82,8 @@ UnreachableCodeElimination::removeUnmarkedBlocksAndCleanup()
 
     // Pass 5: It's important for optimizations to re-run GVN (and in
     // turn alias analysis) after UCE if we eliminated branches.
-    if (rerunAliasAnalysis_ && js_IonOptions.gvn) {
-        ValueNumberer gvn(mir_, graph_, js_IonOptions.gvnIsOptimistic);
+    if (rerunAliasAnalysis_ && mir_->optimizationInfo().gvnEnabled()) {
+        ValueNumberer gvn(mir_, graph_, mir_->optimizationInfo().gvnKind() == GVN_Optimistic);
         if (!gvn.clear() || !gvn.analyze())
             return false;
         IonSpewPass("GVN-after-UCE");
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index 940d346cae9d..fdce3c69c6f8 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -76,7 +76,7 @@ LIRGeneratorShared::defineFixed(LInstructionHelper<1, X, Y> *lir, MDefinition *m
     if (!define(lir, mir, def))
         return false;
 
-    if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
+    if (gen->optimizationInfo().registerAllocator() == RegisterAllocator_LSRA) {
         if (!add(new(alloc()) LNop))
             return false;
     }
@@ -163,7 +163,7 @@ LIRGeneratorShared::defineReturn(LInstruction *lir, MDefinition *mir)
     if (!add(lir))
         return false;
 
-    if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
+    if (gen->optimizationInfo().registerAllocator() == RegisterAllocator_LSRA) {
         if (!add(new(alloc()) LNop))
             return false;
     }
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 38996d6f9ae1..c6739f38d2a7 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -5980,18 +5980,21 @@ JS_PUBLIC_API(void)
 JS_SetGlobalJitCompilerOption(JSContext *cx, JSJitCompilerOption opt, uint32_t value)
 {
 #ifdef JS_ION
-    jit::IonOptions defaultValues;
 
     switch (opt) {
       case JSJITCOMPILER_BASELINE_USECOUNT_TRIGGER:
-        if (value == uint32_t(-1))
+        if (value == uint32_t(-1)) {
+            jit::IonOptions defaultValues;
             value = defaultValues.baselineUsesBeforeCompile;
+        }
         jit::js_IonOptions.baselineUsesBeforeCompile = value;
         break;
       case JSJITCOMPILER_ION_USECOUNT_TRIGGER:
-        if (value == uint32_t(-1))
-            value = defaultValues.usesBeforeCompile;
-        jit::js_IonOptions.usesBeforeCompile = value;
+        if (value == uint32_t(-1)) {
+            jit::js_IonOptions.resetUsesBeforeCompile();
+            break;
+        }
+        jit::js_IonOptions.setUsesBeforeCompile(value);
         if (value == 0)
             jit::js_IonOptions.setEagerCompilation();
         break;
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 544f3798767f..2f8616f056f2 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -590,8 +590,10 @@ class JSScript : public js::gc::BarrieredCell<JSScript>
     uint32_t        sourceEnd_;
 
     uint32_t        useCount;   /* Number of times the script has been called
-                                 * or has had backedges taken. Reset if the
-                                 * script's JIT code is forcibly discarded. */
+                                 * or has had backedges taken. When running in
+                                 * ion, also increased for any inlined scripts.
+                                 * Reset if the script's JIT code is forcibly
+                                 * discarded. */
 
 #ifdef DEBUG
     // Unique identifier within the compartment for this script, used for
diff --git a/js/src/jsworkers.cpp b/js/src/jsworkers.cpp
index 61cf70e8eca8..ce332a9f0163 100644
--- a/js/src/jsworkers.cpp
+++ b/js/src/jsworkers.cpp
@@ -746,7 +746,6 @@ WorkerThread::handleIonWorkload(WorkerThreadState &state)
     ionBuilder = state.ionWorklist.popCopy();
 
     DebugOnly<ExecutionMode> executionMode = ionBuilder->info().executionMode();
-    JS_ASSERT(jit::GetIonScript(ionBuilder->script(), executionMode) == ION_COMPILING_SCRIPT);
 
 #if JS_TRACE_LOGGING
     AutoTraceLog logger(TraceLogging::getLogger(TraceLogging::ION_BACKGROUND_COMPILER),
diff --git a/js/src/moz.build b/js/src/moz.build
index 31769c7439b5..51468c1b5f5f 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -257,6 +257,8 @@ if CONFIG['ENABLE_ION']:
         'jit/IonCaches.cpp',
         'jit/IonFrames.cpp',
         'jit/IonMacroAssembler.cpp',
+        'jit/IonOptimizationLevels.cpp',
+        'jit/IonOptions.cpp',
         'jit/IonSpewer.cpp',
         'jit/JSONSpewer.cpp',
         'jit/LICM.cpp',
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 501bc02295ff..7079590b3eac 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -5440,39 +5440,42 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
     }
 
     if (const char *str = op->getStringOption("ion-gvn")) {
-        if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.gvn = false;
-        else if (strcmp(str, "pessimistic") == 0)
-            jit::js_IonOptions.gvnIsOptimistic = false;
-        else if (strcmp(str, "optimistic") == 0)
-            jit::js_IonOptions.gvnIsOptimistic = true;
-        else
+        if (strcmp(str, "off") == 0) {
+            jit::js_IonOptions.disableGvn = true;
+        } else if (strcmp(str, "pessimistic") == 0) {
+            jit::js_IonOptions.forceGvnKind = true;
+            jit::js_IonOptions.forcedGvnKind = jit::GVN_Pessimistic;
+        } else if (strcmp(str, "optimistic") == 0) {
+            jit::js_IonOptions.forceGvnKind = true;
+            jit::js_IonOptions.forcedGvnKind = jit::GVN_Optimistic;
+        } else {
             return OptionFailure("ion-gvn", str);
+        }
     }
 
     if (const char *str = op->getStringOption("ion-licm")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.licm = true;
+            jit::js_IonOptions.disableLicm = false;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.licm = false;
+            jit::js_IonOptions.disableLicm = true;
         else
             return OptionFailure("ion-licm", str);
     }
 
     if (const char *str = op->getStringOption("ion-edgecase-analysis")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.edgeCaseAnalysis = true;
+            jit::js_IonOptions.disableEdgeCaseAnalysis = false;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.edgeCaseAnalysis = false;
+            jit::js_IonOptions.disableEdgeCaseAnalysis = true;
         else
             return OptionFailure("ion-edgecase-analysis", str);
     }
 
      if (const char *str = op->getStringOption("ion-range-analysis")) {
          if (strcmp(str, "on") == 0)
-             jit::js_IonOptions.rangeAnalysis = true;
+             jit::js_IonOptions.disableRangeAnalysis = false;
          else if (strcmp(str, "off") == 0)
-             jit::js_IonOptions.rangeAnalysis = false;
+             jit::js_IonOptions.disableRangeAnalysis = true;
          else
              return OptionFailure("ion-range-analysis", str);
      }
@@ -5485,9 +5488,9 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
 
     if (const char *str = op->getStringOption("ion-inlining")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.inlining = true;
+            jit::js_IonOptions.disableInlining = false;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.inlining = false;
+            jit::js_IonOptions.disableInlining = true;
         else
             return OptionFailure("ion-inlining", str);
     }
@@ -5512,7 +5515,7 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
 
     int32_t useCount = op->getIntOption("ion-uses-before-compile");
     if (useCount >= 0)
-        jit::js_IonOptions.usesBeforeCompile = useCount;
+        jit::js_IonOptions.setUsesBeforeCompile(useCount);
 
     useCount = op->getIntOption("baseline-uses-before-compile");
     if (useCount >= 0)
@@ -5522,14 +5525,18 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
         jit::js_IonOptions.baselineUsesBeforeCompile = 0;
 
     if (const char *str = op->getStringOption("ion-regalloc")) {
-        if (strcmp(str, "lsra") == 0)
-            jit::js_IonOptions.registerAllocator = jit::RegisterAllocator_LSRA;
-        else if (strcmp(str, "backtracking") == 0)
-            jit::js_IonOptions.registerAllocator = jit::RegisterAllocator_Backtracking;
-        else if (strcmp(str, "stupid") == 0)
-            jit::js_IonOptions.registerAllocator = jit::RegisterAllocator_Stupid;
-        else
+        if (strcmp(str, "lsra") == 0) {
+            jit::js_IonOptions.forceRegisterAllocator = true;
+            jit::js_IonOptions.forcedRegisterAllocator = jit::RegisterAllocator_LSRA;
+        } else if (strcmp(str, "backtracking") == 0) {
+            jit::js_IonOptions.forceRegisterAllocator = true;
+            jit::js_IonOptions.forcedRegisterAllocator = jit::RegisterAllocator_Backtracking;
+        } else if (strcmp(str, "stupid") == 0) {
+            jit::js_IonOptions.forceRegisterAllocator = true;
+            jit::js_IonOptions.forcedRegisterAllocator = jit::RegisterAllocator_Stupid;
+        } else {
             return OptionFailure("ion-regalloc", str);
+        }
     }
 
     if (op->getBoolOption("ion-eager"))

From 513653733ac9f71f4c816f847b92b4ea8fb15da5 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 15:14:13 +0100
Subject: [PATCH 012/459] Bug 939614: IonMonkey: Rename IonOption to JitOption,
 r=jandem

---
 js/src/builtin/TestingFunctions.cpp        |  4 +-
 js/src/jit/Bailouts.cpp                    |  2 +-
 js/src/jit/BaselineJIT.cpp                 |  2 +-
 js/src/jit/Ion.cpp                         | 14 ++---
 js/src/jit/Ion.h                           |  4 +-
 js/src/jit/IonAnalysis.cpp                 |  4 +-
 js/src/jit/IonBuilder.cpp                  |  6 +--
 js/src/jit/IonFrames.cpp                   |  2 +-
 js/src/jit/IonOptimizationLevels.h         | 30 +++++------
 js/src/jit/JitOptions.cpp                  | 20 ++++----
 js/src/jit/JitOptions.h                    | 13 ++---
 js/src/jit/LinearScan.cpp                  |  4 +-
 js/src/jit/LiveRangeAllocator.h            |  2 +-
 js/src/jit/Lowering.cpp                    |  2 +-
 js/src/jit/RangeAnalysis.cpp               |  2 +-
 js/src/jit/shared/CodeGenerator-shared.cpp |  2 +-
 js/src/jsapi.cpp                           | 10 ++--
 js/src/moz.build                           |  2 +-
 js/src/shell/js.cpp                        | 60 +++++++++++-----------
 js/src/vm/ForkJoin.cpp                     |  4 +-
 20 files changed, 96 insertions(+), 93 deletions(-)

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 8d1a8b1a91f2..c6261995b272 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -956,7 +956,7 @@ static bool
 EnableOsiPointRegisterChecks(JSContext *, unsigned, jsval *vp)
 {
 #if defined(JS_ION) && defined(CHECK_OSIPOINT_REGISTERS)
-    jit::js_IonOptions.checkOsiPointRegisters = true;
+    jit::js_JitOptions.checkOsiPointRegisters = true;
 #endif
     JS_SET_RVAL(cx, vp, JSVAL_VOID);
     return true;
@@ -1125,7 +1125,7 @@ SetIonCheckGraphCoherency(JSContext *cx, unsigned argc, jsval *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 #ifdef JS_ION
-    jit::js_IonOptions.checkGraphConsistency = ToBoolean(args.get(0));
+    jit::js_JitOptions.checkGraphConsistency = ToBoolean(args.get(0));
 #endif
     args.rval().setUndefined();
     return true;
diff --git a/js/src/jit/Bailouts.cpp b/js/src/jit/Bailouts.cpp
index fe49af0216ca..c00f3a893936 100644
--- a/js/src/jit/Bailouts.cpp
+++ b/js/src/jit/Bailouts.cpp
@@ -196,7 +196,7 @@ jit::CheckFrequentBailouts(JSContext *cx, JSScript *script)
         // we compile this script LICM will be disabled.
         IonScript *ionScript = script->ionScript();
 
-        if (ionScript->numBailouts() >= js_IonOptions.frequentBailoutThreshold &&
+        if (ionScript->numBailouts() >= js_JitOptions.frequentBailoutThreshold &&
             !script->hadFrequentBailouts())
         {
             script->setHadFrequentBailouts();
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 0956e75f4ca6..7cf1bc170c7d 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -276,7 +276,7 @@ CanEnterBaselineJIT(JSContext *cx, HandleScript script, bool osr)
     if (IsJSDEnabled(cx) || cx->runtime()->parallelWarmup > 0) {
         if (osr)
             return Method_Skipped;
-    } else if (script->incUseCount() <= js_IonOptions.baselineUsesBeforeCompile) {
+    } else if (script->incUseCount() <= js_JitOptions.baselineUsesBeforeCompile) {
         return Method_Skipped;
     }
 
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index a13f7bac1eff..1bad578a6f59 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -1705,7 +1705,7 @@ IonCompile(JSContext *cx, JSScript *script,
     IonSpewNewFunction(graph, builderScript);
 
     mozilla::Maybe<AutoProtectHeapForCompilation> protect;
-    if (js_IonOptions.checkThreadSafety &&
+    if (js_JitOptions.checkThreadSafety &&
         cx->runtime()->gcIncrementalState == gc::NO_INCREMENTAL &&
         !cx->runtime()->profilingScripts &&
         !cx->runtime()->spsProfiler.enabled())
@@ -1816,7 +1816,7 @@ static const uint32_t MAX_DOM_WORKER_LOCALS_AND_ARGS = 2048;
 static MethodStatus
 CheckScriptSize(JSContext *cx, JSScript* script)
 {
-    if (!js_IonOptions.limitScriptSize)
+    if (!js_JitOptions.limitScriptSize)
         return Method_Compiled;
 
     if (script->length() > MAX_OFF_THREAD_SCRIPT_SIZE) {
@@ -1893,7 +1893,7 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     JS_ASSERT(jit::IsIonEnabled(cx));
     JS_ASSERT(jit::IsBaselineEnabled(cx));
     JS_ASSERT_IF(osrPc != nullptr, (JSOp)*osrPc == JSOP_LOOPENTRY);
-    JS_ASSERT_IF(executionMode == ParallelExecution, !osrFrame && !osrPC);
+    JS_ASSERT_IF(executionMode == ParallelExecution, !osrFrame && !osrPc);
     JS_ASSERT_IF(executionMode == ParallelExecution, !HasIonScript(script, executionMode));
 
     if (!script->hasBaselineScript())
@@ -1931,7 +1931,7 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
         // recompile with the right pc.
         if (osrPc && script->ionScript()->osrPc() != osrPc) {
             uint32_t count = script->ionScript()->incrOsrPcMismatchCounter();
-            if (count <= js_IonOptions.osrPcMismatchesBeforeRecompile)
+            if (count <= js_JitOptions.osrPcMismatchesBeforeRecompile)
                 return Method_Skipped;
 
             failedState = Method_Skipped;
@@ -1994,7 +1994,7 @@ jit::CanEnterAtBranch(JSContext *cx, JSScript *script, BaselineFrame *osrFrame,
         return Method_Skipped;
 
     // Optionally ignore on user request.
-    if (!js_IonOptions.osr)
+    if (!js_JitOptions.osr)
         return Method_Skipped;
 
     // Mark as forbidden if frame can't be handled.
@@ -2077,7 +2077,7 @@ jit::CanEnter(JSContext *cx, RunState &state)
     // If --ion-eager is used, compile with Baseline first, so that we
     // can directly enter IonMonkey.
     RootedScript rscript(cx, script);
-    if (js_IonOptions.eagerCompilation && !rscript->hasBaselineScript()) {
+    if (js_JitOptions.eagerCompilation && !rscript->hasBaselineScript()) {
         MethodStatus status = CanEnterBaselineMethod(cx, state);
         if (status != Method_Compiled)
             return status;
@@ -2752,7 +2752,7 @@ jit::UsesBeforeIonCompile(JSScript *script, jsbytecode *pc)
     if (numLocalsAndArgs > MAX_MAIN_THREAD_LOCALS_AND_ARGS)
         minUses = minUses * (numLocalsAndArgs / (double) MAX_MAIN_THREAD_LOCALS_AND_ARGS);
 
-    if (JSOp(*pc) != JSOP_LOOPENTRY || js_IonOptions.eagerCompilation)
+    if (JSOp(*pc) != JSOP_LOOPENTRY || js_JitOptions.eagerCompilation)
         return minUses;
 
     // It's more efficient to enter outer loops, rather than inner loops, via OSR.
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 3052a540bab8..16b588ba0dc6 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -16,7 +16,7 @@
 
 #include "jit/CompileInfo.h"
 #include "jit/CompileWrappers.h"
-#include "jit/IonOptions.h"
+#include "jit/JitOptions.h"
 
 namespace js {
 namespace jit {
@@ -174,7 +174,7 @@ IsIonInlinablePC(jsbytecode *pc) {
 inline bool
 TooManyArguments(unsigned nargs)
 {
-    return (nargs >= SNAPSHOT_MAX_NARGS || nargs > js_IonOptions.maxStackArgs);
+    return (nargs >= SNAPSHOT_MAX_NARGS || nargs > js_JitOptions.maxStackArgs);
 }
 
 void ForbidCompilation(JSContext *cx, JSScript *script);
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index d91b5e49d5b9..a685efa82c89 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1334,7 +1334,7 @@ void
 jit::AssertGraphCoherency(MIRGraph &graph)
 {
 #ifdef DEBUG
-    if (!js_IonOptions.checkGraphConsistency)
+    if (!js_JitOptions.checkGraphConsistency)
         return;
     AssertBasicGraphCoherency(graph);
     AssertReversePostOrder(graph);
@@ -1349,7 +1349,7 @@ jit::AssertExtendedGraphCoherency(MIRGraph &graph)
     // are split)
 
 #ifdef DEBUG
-    if (!js_IonOptions.checkGraphConsistency)
+    if (!js_JitOptions.checkGraphConsistency)
         return;
     AssertGraphCoherency(graph);
 
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 151c4ab38d22..8ba29ac96c83 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -2038,7 +2038,7 @@ IonBuilder::restartLoop(CFGState state)
 {
     spew("New types at loop header, restarting loop body");
 
-    if (js_IonOptions.limitScriptSize) {
+    if (js_JitOptions.limitScriptSize) {
         if (++numLoopRestarts_ >= MAX_LOOP_RESTARTS)
             return ControlStatus_Abort;
     }
@@ -3438,7 +3438,7 @@ IonBuilder::jsop_try()
 {
     JS_ASSERT(JSOp(*pc) == JSOP_TRY);
 
-    if (!js_IonOptions.compileTryCatch)
+    if (!js_JitOptions.compileTryCatch)
         return abort("Try-catch support disabled");
 
     // Try-finally is not yet supported.
@@ -3993,7 +3993,7 @@ IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
     // Skip heuristics if we have an explicit hint to inline.
     if (!targetScript->shouldInline()) {
         // Cap the inlining depth.
-        if (js_IonOptions.isSmallFunction(targetScript)) {
+        if (js_JitOptions.isSmallFunction(targetScript)) {
             if (inliningDepth_ >= optimizationInfo().smallFunctionMaxInlineDepth())
                 return DontInline(targetScript, "Vetoed: exceeding allowed inline depth");
         } else {
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index cecde0dee5cc..66beb292251b 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -1061,7 +1061,7 @@ static void
 MarkJitActivation(JSTracer *trc, const JitActivationIterator &activations)
 {
 #ifdef CHECK_OSIPOINT_REGISTERS
-    if (js_IonOptions.checkOsiPointRegisters) {
+    if (js_JitOptions.checkOsiPointRegisters) {
         // GC can modify spilled registers, breaking our register checks.
         // To handle this, we disable these checks for the current VM call
         // when a GC happens.
diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
index 012a07968706..748f73794c49 100644
--- a/js/src/jit/IonOptimizationLevels.h
+++ b/js/src/jit/IonOptimizationLevels.h
@@ -10,7 +10,7 @@
 #include "jsbytecode.h"
 #include "jstypes.h"
 
-#include "jit/IonOptions.h"
+#include "jit/JitOptions.h"
 #include "js/TypeDecls.h"
 
 namespace js {
@@ -99,41 +99,41 @@ class OptimizationInfo
     }
 
     bool inlineInterpreted() const {
-        return inlineInterpreted_ && !js_IonOptions.disableInlining;
+        return inlineInterpreted_ && !js_JitOptions.disableInlining;
     }
 
     bool inlineNative() const {
-        return inlineNative_ && !js_IonOptions.disableInlining;
+        return inlineNative_ && !js_JitOptions.disableInlining;
     }
 
     uint32_t usesBeforeCompile() const {
-        if (js_IonOptions.forceDefaultIonUsesBeforeCompile)
-            return js_IonOptions.forcedDefaultIonUsesBeforeCompile;
+        if (js_JitOptions.forceDefaultIonUsesBeforeCompile)
+            return js_JitOptions.forcedDefaultIonUsesBeforeCompile;
         return usesBeforeCompile_;
     }
 
     bool gvnEnabled() const {
-        return gvn_ && !js_IonOptions.disableGvn;
+        return gvn_ && !js_JitOptions.disableGvn;
     }
 
     bool licmEnabled() const {
-        return licm_ && !js_IonOptions.disableLicm;
+        return licm_ && !js_JitOptions.disableLicm;
     }
 
     bool uceEnabled() const {
-        return uce_ && !js_IonOptions.disableUce;
+        return uce_ && !js_JitOptions.disableUce;
     }
 
     bool rangeAnalysisEnabled() const {
-        return rangeAnalysis_ && !js_IonOptions.disableRangeAnalysis;
+        return rangeAnalysis_ && !js_JitOptions.disableRangeAnalysis;
     }
 
     bool eaaEnabled() const {
-        return eaa_ && !js_IonOptions.disableEaa;
+        return eaa_ && !js_JitOptions.disableEaa;
     }
 
     bool edgeCaseAnalysisEnabled() const {
-        return edgeCaseAnalysis_ && !js_IonOptions.disableEdgeCaseAnalysis;
+        return edgeCaseAnalysis_ && !js_JitOptions.disableEdgeCaseAnalysis;
     }
 
     bool eliminateRedundantChecksEnabled() const {
@@ -141,15 +141,15 @@ class OptimizationInfo
     }
 
     IonGvnKind gvnKind() const {
-        if (!js_IonOptions.forceGvnKind)
+        if (!js_JitOptions.forceGvnKind)
             return gvnKind_;
-        return js_IonOptions.forcedGvnKind;
+        return js_JitOptions.forcedGvnKind;
     }
 
     IonRegisterAllocator registerAllocator() const {
-        if (!js_IonOptions.forceRegisterAllocator)
+        if (!js_JitOptions.forceRegisterAllocator)
             return registerAllocator_;
-        return js_IonOptions.forcedRegisterAllocator;
+        return js_JitOptions.forcedRegisterAllocator;
     }
 
     uint32_t smallFunctionMaxInlineDepth() const {
diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
index 3c3bf41d8dfb..a7d6dc1a6e67 100644
--- a/js/src/jit/JitOptions.cpp
+++ b/js/src/jit/JitOptions.cpp
@@ -4,7 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "jit/IonOptions.h"
+#include "jit/JitOptions.h"
+
+#include "jsscript.h"
 
 using namespace js;
 using namespace js::jit;
@@ -12,9 +14,9 @@ using namespace js::jit;
 namespace js {
 namespace jit {
 
-IonOptions js_IonOptions;
+JitOptions js_JitOptions;
 
-IonOptions::IonOptions()
+JitOptions::JitOptions()
 {
     // Whether to perform expensive graph-consistency DEBUG-only assertions.
     // It can be useful to disable this to reduce DEBUG-compile time of large
@@ -115,13 +117,13 @@ IonOptions::IonOptions()
 }
 
 bool
-IonOptions::isSmallFunction(JSScript *script) const
+JitOptions::isSmallFunction(JSScript *script) const
 {
     return script->length() <= smallFunctionMaxBytecodeLength_;
 }
 
 void
-IonOptions::setEagerCompilation()
+JitOptions::setEagerCompilation()
 {
     eagerCompilation = true;
     baselineUsesBeforeCompile = 0;
@@ -130,27 +132,27 @@ IonOptions::setEagerCompilation()
 }
 
 void
-IonOptions::setUsesBeforeCompile(uint32_t useCount)
+JitOptions::setUsesBeforeCompile(uint32_t useCount)
 {
     forceDefaultIonUsesBeforeCompile = true;
     forcedDefaultIonUsesBeforeCompile = useCount;
 
     // Undo eager compilation
     if (eagerCompilation && useCount != 0) {
-        jit::IonOptions defaultValues;
+        jit::JitOptions defaultValues;
         eagerCompilation = false;
         baselineUsesBeforeCompile = defaultValues.baselineUsesBeforeCompile;
     }
 }
 
 void
-IonOptions::resetUsesBeforeCompile()
+JitOptions::resetUsesBeforeCompile()
 {
     forceDefaultIonUsesBeforeCompile = false;
 
     // Undo eager compilation
     if (eagerCompilation) {
-        jit::IonOptions defaultValues;
+        jit::JitOptions defaultValues;
         eagerCompilation = false;
         baselineUsesBeforeCompile = defaultValues.baselineUsesBeforeCompile;
     }
diff --git a/js/src/jit/JitOptions.h b/js/src/jit/JitOptions.h
index 2f3d3d65cd18..4703e94f5768 100644
--- a/js/src/jit/JitOptions.h
+++ b/js/src/jit/JitOptions.h
@@ -4,10 +4,11 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef jit_IonOptions_h
-#define jit_IonOptions_h
+#ifndef jit_JitOptions_h
+#define jit_JitOptions_h
 
 #include "jit/IonTypes.h"
+#include "js/TypeDecls.h"
 
 #ifdef JS_ION
 
@@ -26,7 +27,7 @@ enum IonGvnKind {
     GVN_Pessimistic
 };
 
-struct IonOptions
+struct JitOptions
 {
     bool checkGraphConsistency;
 #ifdef CHECK_OSIPOINT_REGISTERS
@@ -59,18 +60,18 @@ struct IonOptions
     uint32_t smallFunctionMaxBytecodeLength_;
     uint32_t usesBeforeCompilePar;
 
-    IonOptions();
+    JitOptions();
     bool isSmallFunction(JSScript *script) const;
     void setEagerCompilation();
     void setUsesBeforeCompile(uint32_t useCount);
     void resetUsesBeforeCompile();
 };
 
-extern IonOptions js_IonOptions;
+extern JitOptions js_JitOptions;
 
 } // namespace jit
 } // namespace js
 
 #endif // JS_ION
 
-#endif /* jit_IonOptions_h */
+#endif /* jit_JitOptions_h */
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index cd22f4d36818..154de5762109 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -1128,7 +1128,7 @@ LinearScanAllocator::canCoexist(LiveInterval *a, LiveInterval *b)
 void
 LinearScanAllocator::validateIntervals()
 {
-    if (!js_IonOptions.checkGraphConsistency)
+    if (!js_JitOptions.checkGraphConsistency)
         return;
 
     for (IntervalIterator i(active.begin()); i != active.end(); i++) {
@@ -1174,7 +1174,7 @@ LinearScanAllocator::validateIntervals()
 void
 LinearScanAllocator::validateAllocations()
 {
-    if (!js_IonOptions.checkGraphConsistency)
+    if (!js_JitOptions.checkGraphConsistency)
         return;
 
     for (IntervalIterator i(handled.begin()); i != handled.end(); i++) {
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index a469ebda4aeb..db8feecd035e 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -600,7 +600,7 @@ class LiveRangeAllocator : protected RegisterAllocator
     void validateVirtualRegisters()
     {
 #ifdef DEBUG
-        if (!js_IonOptions.checkGraphConsistency)
+        if (!js_JitOptions.checkGraphConsistency)
             return;
 
         for (size_t i = 1; i < graph.numVirtualRegisters(); i++) {
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 5f65fe844778..7257a52951d6 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -523,7 +523,7 @@ LIRGenerator::visitAssertFloat32(MAssertFloat32 *assertion)
     if (!allowFloat32Optimizations())
         return true;
 
-    if (type != MIRType_Value && !js_IonOptions.eagerCompilation) {
+    if (type != MIRType_Value && !js_JitOptions.eagerCompilation) {
         JS_ASSERT_IF(checkIsFloat32, type == MIRType_Float32);
         JS_ASSERT_IF(!checkIsFloat32, type != MIRType_Float32);
     }
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index a60f4ca555a1..3db801399761 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -2040,7 +2040,7 @@ RangeAnalysis::analyze()
 bool
 RangeAnalysis::addRangeAssertions()
 {
-    if (!js_IonOptions.checkRangeAnalysis)
+    if (!js_JitOptions.checkRangeAnalysis)
         return true;
 
     // Check the computed range for this instruction, if the option is set. Note
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index bb6aecb62e36..879c06987db8 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -603,7 +603,7 @@ CodeGeneratorShared::verifyOsiPointRegs(LSafepoint *safepoint)
 bool
 CodeGeneratorShared::shouldVerifyOsiPointRegs(LSafepoint *safepoint)
 {
-    if (!js_IonOptions.checkOsiPointRegisters)
+    if (!js_JitOptions.checkOsiPointRegisters)
         return false;
 
     if (gen->info().executionMode() != SequentialExecution)
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index c6739f38d2a7..2ad682aded64 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -5984,19 +5984,19 @@ JS_SetGlobalJitCompilerOption(JSContext *cx, JSJitCompilerOption opt, uint32_t v
     switch (opt) {
       case JSJITCOMPILER_BASELINE_USECOUNT_TRIGGER:
         if (value == uint32_t(-1)) {
-            jit::IonOptions defaultValues;
+            jit::JitOptions defaultValues;
             value = defaultValues.baselineUsesBeforeCompile;
         }
-        jit::js_IonOptions.baselineUsesBeforeCompile = value;
+        jit::js_JitOptions.baselineUsesBeforeCompile = value;
         break;
       case JSJITCOMPILER_ION_USECOUNT_TRIGGER:
         if (value == uint32_t(-1)) {
-            jit::js_IonOptions.resetUsesBeforeCompile();
+            jit::js_JitOptions.resetUsesBeforeCompile();
             break;
         }
-        jit::js_IonOptions.setUsesBeforeCompile(value);
+        jit::js_JitOptions.setUsesBeforeCompile(value);
         if (value == 0)
-            jit::js_IonOptions.setEagerCompilation();
+            jit::js_JitOptions.setEagerCompilation();
         break;
       case JSJITCOMPILER_ION_ENABLE:
         if (value == 1) {
diff --git a/js/src/moz.build b/js/src/moz.build
index 51468c1b5f5f..de817201df82 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -258,8 +258,8 @@ if CONFIG['ENABLE_ION']:
         'jit/IonFrames.cpp',
         'jit/IonMacroAssembler.cpp',
         'jit/IonOptimizationLevels.cpp',
-        'jit/IonOptions.cpp',
         'jit/IonSpewer.cpp',
+        'jit/JitOptions.cpp',
         'jit/JSONSpewer.cpp',
         'jit/LICM.cpp',
         'jit/LinearScan.cpp',
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 7079590b3eac..8386af16dc35 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -5441,13 +5441,13 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
 
     if (const char *str = op->getStringOption("ion-gvn")) {
         if (strcmp(str, "off") == 0) {
-            jit::js_IonOptions.disableGvn = true;
+            jit::js_JitOptions.disableGvn = true;
         } else if (strcmp(str, "pessimistic") == 0) {
-            jit::js_IonOptions.forceGvnKind = true;
-            jit::js_IonOptions.forcedGvnKind = jit::GVN_Pessimistic;
+            jit::js_JitOptions.forceGvnKind = true;
+            jit::js_JitOptions.forcedGvnKind = jit::GVN_Pessimistic;
         } else if (strcmp(str, "optimistic") == 0) {
-            jit::js_IonOptions.forceGvnKind = true;
-            jit::js_IonOptions.forcedGvnKind = jit::GVN_Optimistic;
+            jit::js_JitOptions.forceGvnKind = true;
+            jit::js_JitOptions.forcedGvnKind = jit::GVN_Optimistic;
         } else {
             return OptionFailure("ion-gvn", str);
         }
@@ -5455,95 +5455,95 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
 
     if (const char *str = op->getStringOption("ion-licm")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.disableLicm = false;
+            jit::js_JitOptions.disableLicm = false;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.disableLicm = true;
+            jit::js_JitOptions.disableLicm = true;
         else
             return OptionFailure("ion-licm", str);
     }
 
     if (const char *str = op->getStringOption("ion-edgecase-analysis")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.disableEdgeCaseAnalysis = false;
+            jit::js_JitOptions.disableEdgeCaseAnalysis = false;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.disableEdgeCaseAnalysis = true;
+            jit::js_JitOptions.disableEdgeCaseAnalysis = true;
         else
             return OptionFailure("ion-edgecase-analysis", str);
     }
 
      if (const char *str = op->getStringOption("ion-range-analysis")) {
          if (strcmp(str, "on") == 0)
-             jit::js_IonOptions.disableRangeAnalysis = false;
+             jit::js_JitOptions.disableRangeAnalysis = false;
          else if (strcmp(str, "off") == 0)
-             jit::js_IonOptions.disableRangeAnalysis = true;
+             jit::js_JitOptions.disableRangeAnalysis = true;
          else
              return OptionFailure("ion-range-analysis", str);
      }
 
     if (op->getBoolOption("ion-check-range-analysis"))
-        jit::js_IonOptions.checkRangeAnalysis = true;
+        jit::js_JitOptions.checkRangeAnalysis = true;
 
     if (op->getBoolOption("ion-check-thread-safety"))
-        jit::js_IonOptions.checkThreadSafety = true;
+        jit::js_JitOptions.checkThreadSafety = true;
 
     if (const char *str = op->getStringOption("ion-inlining")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.disableInlining = false;
+            jit::js_JitOptions.disableInlining = false;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.disableInlining = true;
+            jit::js_JitOptions.disableInlining = true;
         else
             return OptionFailure("ion-inlining", str);
     }
 
     if (const char *str = op->getStringOption("ion-osr")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.osr = true;
+            jit::js_JitOptions.osr = true;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.osr = false;
+            jit::js_JitOptions.osr = false;
         else
             return OptionFailure("ion-osr", str);
     }
 
     if (const char *str = op->getStringOption("ion-limit-script-size")) {
         if (strcmp(str, "on") == 0)
-            jit::js_IonOptions.limitScriptSize = true;
+            jit::js_JitOptions.limitScriptSize = true;
         else if (strcmp(str, "off") == 0)
-            jit::js_IonOptions.limitScriptSize = false;
+            jit::js_JitOptions.limitScriptSize = false;
         else
             return OptionFailure("ion-limit-script-size", str);
     }
 
     int32_t useCount = op->getIntOption("ion-uses-before-compile");
     if (useCount >= 0)
-        jit::js_IonOptions.setUsesBeforeCompile(useCount);
+        jit::js_JitOptions.setUsesBeforeCompile(useCount);
 
     useCount = op->getIntOption("baseline-uses-before-compile");
     if (useCount >= 0)
-        jit::js_IonOptions.baselineUsesBeforeCompile = useCount;
+        jit::js_JitOptions.baselineUsesBeforeCompile = useCount;
 
     if (op->getBoolOption("baseline-eager"))
-        jit::js_IonOptions.baselineUsesBeforeCompile = 0;
+        jit::js_JitOptions.baselineUsesBeforeCompile = 0;
 
     if (const char *str = op->getStringOption("ion-regalloc")) {
         if (strcmp(str, "lsra") == 0) {
-            jit::js_IonOptions.forceRegisterAllocator = true;
-            jit::js_IonOptions.forcedRegisterAllocator = jit::RegisterAllocator_LSRA;
+            jit::js_JitOptions.forceRegisterAllocator = true;
+            jit::js_JitOptions.forcedRegisterAllocator = jit::RegisterAllocator_LSRA;
         } else if (strcmp(str, "backtracking") == 0) {
-            jit::js_IonOptions.forceRegisterAllocator = true;
-            jit::js_IonOptions.forcedRegisterAllocator = jit::RegisterAllocator_Backtracking;
+            jit::js_JitOptions.forceRegisterAllocator = true;
+            jit::js_JitOptions.forcedRegisterAllocator = jit::RegisterAllocator_Backtracking;
         } else if (strcmp(str, "stupid") == 0) {
-            jit::js_IonOptions.forceRegisterAllocator = true;
-            jit::js_IonOptions.forcedRegisterAllocator = jit::RegisterAllocator_Stupid;
+            jit::js_JitOptions.forceRegisterAllocator = true;
+            jit::js_JitOptions.forcedRegisterAllocator = jit::RegisterAllocator_Stupid;
         } else {
             return OptionFailure("ion-regalloc", str);
         }
     }
 
     if (op->getBoolOption("ion-eager"))
-        jit::js_IonOptions.setEagerCompilation();
+        jit::js_JitOptions.setEagerCompilation();
 
     if (op->getBoolOption("ion-compile-try-catch"))
-        jit::js_IonOptions.compileTryCatch = true;
+        jit::js_JitOptions.compileTryCatch = true;
 
 #ifdef JS_THREADSAFE
     bool parallelCompilation = false;
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index 1f2e41df78fe..83be1584e784 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -2207,8 +2207,8 @@ js::ParallelTestsShouldPass(JSContext *cx)
 {
     return jit::IsIonEnabled(cx) &&
            jit::IsBaselineEnabled(cx) &&
-           !jit::js_IonOptions.eagerCompilation &&
-           jit::js_IonOptions.baselineUsesBeforeCompile != 0 &&
+           !jit::js_JitOptions.eagerCompilation &&
+           jit::js_JitOptions.baselineUsesBeforeCompile != 0 &&
            cx->runtime()->gcZeal() == 0;
 }
 

From 5c72865a1aa97bd4c6e9e47108dc95b4dca7f0ca Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 15:14:13 +0100
Subject: [PATCH 013/459] Bug 939614: IonMonkey: Use logic in UsesBeforeCompile
 to get actual needed usecount, r=jandem

---
 js/src/jit/BaselineCompiler.cpp      |  3 +-
 js/src/jit/Ion.cpp                   | 50 ++----------------------
 js/src/jit/Ion.h                     |  1 -
 js/src/jit/IonBuilder.cpp            |  3 +-
 js/src/jit/IonOptimizationLevels.cpp | 58 +++++++++++++++++++++-------
 js/src/jit/IonOptimizationLevels.h   | 20 +++++-----
 js/src/jit/JitOptions.h              | 11 ++++++
 7 files changed, 73 insertions(+), 73 deletions(-)

diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index 3e78fff94a01..c10a24191f7b 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -637,7 +637,8 @@ BaselineCompiler::emitUseCountIncrement()
 
     Label skipCall;
 
-    uint32_t minUses = UsesBeforeIonCompile(script, pc);
+    const OptimizationInfo *info = js_IonOptimizations.get(js_IonOptimizations.firstLevel());
+    uint32_t minUses = info->usesBeforeCompile(script, pc);
     masm.branch32(Assembler::LessThan, countReg, Imm32(minUses), &skipCall);
 
     masm.branchPtr(Assembler::Equal,
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 1bad578a6f59..f96cb7f39bb9 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -1802,17 +1802,6 @@ CheckScript(JSContext *cx, JSScript *script, bool osr)
     return true;
 }
 
-// Longer scripts can only be compiled off thread, as these compilations
-// can be expensive and stall the main thread for too long.
-static const uint32_t MAX_OFF_THREAD_SCRIPT_SIZE = 100 * 1000;
-static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2 * 1000;
-static const uint32_t MAX_MAIN_THREAD_LOCALS_AND_ARGS = 256;
-
-// DOM Worker runtimes don't have off thread compilation, but can also compile
-// larger scripts since this doesn't stall the main thread.
-static const uint32_t MAX_DOM_WORKER_SCRIPT_SIZE = 16 * 1000;
-static const uint32_t MAX_DOM_WORKER_LOCALS_AND_ARGS = 2048;
-
 static MethodStatus
 CheckScriptSize(JSContext *cx, JSScript* script)
 {
@@ -1876,14 +1865,14 @@ CanIonCompileScript(JSContext *cx, HandleScript script, bool osr)
 }
 
 static OptimizationLevel
-GetOptimizationLevel(HandleScript script, ExecutionMode executionMode)
+GetOptimizationLevel(HandleScript script, jsbytecode *pc, ExecutionMode executionMode)
 {
     if (executionMode == ParallelExecution)
         return Optimization_Normal;
 
     JS_ASSERT(executionMode == SequentialExecution);
 
-    return js_IonOptimizations.levelForUseCount(script->getUseCount());
+    return js_IonOptimizations.levelForScript(script, pc);
 }
 
 static MethodStatus
@@ -1916,7 +1905,7 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     }
 
     bool recompile = false;
-    OptimizationLevel optimizationLevel = GetOptimizationLevel(script, executionMode);
+    OptimizationLevel optimizationLevel = GetOptimizationLevel(script, osrPc, executionMode);
     if (optimizationLevel == Optimization_DontCompile)
         return Method_Skipped;
 
@@ -2730,39 +2719,6 @@ jit::ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode)
     MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
-uint32_t
-jit::UsesBeforeIonCompile(JSScript *script, jsbytecode *pc)
-{
-    JS_ASSERT(pc == script->code() || JSOp(*pc) == JSOP_LOOPENTRY);
-
-    OptimizationLevel level = js_IonOptimizations.nextLevel(Optimization_DontCompile);
-    const OptimizationInfo *info = js_IonOptimizations.get(level);
-
-    uint32_t minUses = info->usesBeforeCompile();
-
-    // If the script is too large to compile on the main thread, we can still
-    // compile it off thread. In these cases, increase the use count threshold
-    // to improve the compilation's type information and hopefully avoid later
-    // recompilation.
-
-    if (script->length() > MAX_MAIN_THREAD_SCRIPT_SIZE)
-        minUses = minUses * (script->length() / (double) MAX_MAIN_THREAD_SCRIPT_SIZE);
-
-    uint32_t numLocalsAndArgs = analyze::TotalSlots(script);
-    if (numLocalsAndArgs > MAX_MAIN_THREAD_LOCALS_AND_ARGS)
-        minUses = minUses * (numLocalsAndArgs / (double) MAX_MAIN_THREAD_LOCALS_AND_ARGS);
-
-    if (JSOp(*pc) != JSOP_LOOPENTRY || js_JitOptions.eagerCompilation)
-        return minUses;
-
-    // It's more efficient to enter outer loops, rather than inner loops, via OSR.
-    // To accomplish this, we use a slightly higher threshold for inner loops.
-    // Note that the loop depth is always > 0 so we will prefer non-OSR over OSR.
-    uint32_t loopDepth = GET_UINT8(pc);
-    JS_ASSERT(loopDepth > 0);
-    return minUses + loopDepth * 100;
-}
-
 void
 AutoFlushCache::updateTop(uintptr_t p, size_t len)
 {
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 16b588ba0dc6..f516f1e12698 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -179,7 +179,6 @@ TooManyArguments(unsigned nargs)
 
 void ForbidCompilation(JSContext *cx, JSScript *script);
 void ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode);
-uint32_t UsesBeforeIonCompile(JSScript *script, jsbytecode *pc);
 
 void PurgeCaches(JSScript *script, JS::Zone *zone);
 size_t SizeOfIonData(JSScript *script, mozilla::MallocSizeOf mallocSizeOf);
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 8ba29ac96c83..1a1bd7d6baee 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6013,7 +6013,8 @@ IonBuilder::insertRecompileCheck()
     // of the next optimization level.
     OptimizationLevel nextLevel = js_IonOptimizations.nextLevel(curLevel);
     const OptimizationInfo *info = js_IonOptimizations.get(nextLevel);
-    current->add(MRecompileCheck::New(alloc(), topBuilder->script(), info->usesBeforeCompile()));
+    uint32_t useCount = info->usesBeforeCompile(topBuilder->script());
+    current->add(MRecompileCheck::New(alloc(), topBuilder->script(), useCount));
 }
 
 JSObject *
diff --git a/js/src/jit/IonOptimizationLevels.cpp b/js/src/jit/IonOptimizationLevels.cpp
index e6679c8ccbf7..cd2009d03acd 100644
--- a/js/src/jit/IonOptimizationLevels.cpp
+++ b/js/src/jit/IonOptimizationLevels.cpp
@@ -56,23 +56,49 @@ OptimizationInfo::initAsmjsOptimizationInfo()
     eliminateRedundantChecks_ = false;
 }
 
+uint32_t
+OptimizationInfo::usesBeforeCompile(JSScript *script, jsbytecode *pc) const
+{
+    JS_ASSERT(pc == nullptr || pc == script->code() || JSOp(*pc) == JSOP_LOOPENTRY);
+
+    if (pc == script->code())
+        pc = nullptr;
+
+    uint32_t minUses = usesBeforeCompile_;
+    if (js_JitOptions.forceDefaultIonUsesBeforeCompile)
+        minUses = js_JitOptions.forcedDefaultIonUsesBeforeCompile;
+
+    // If the script is too large to compile on the main thread, we can still
+    // compile it off thread. In these cases, increase the use count threshold
+    // to improve the compilation's type information and hopefully avoid later
+    // recompilation.
+
+    if (script->length() > MAX_MAIN_THREAD_SCRIPT_SIZE)
+        minUses = minUses * (script->length() / (double) MAX_MAIN_THREAD_SCRIPT_SIZE);
+
+    uint32_t numLocalsAndArgs = analyze::TotalSlots(script);
+    if (numLocalsAndArgs > MAX_MAIN_THREAD_LOCALS_AND_ARGS)
+        minUses = minUses * (numLocalsAndArgs / (double) MAX_MAIN_THREAD_LOCALS_AND_ARGS);
+
+    if (!pc || js_JitOptions.eagerCompilation)
+        return minUses;
+
+    // It's more efficient to enter outer loops, rather than inner loops, via OSR.
+    // To accomplish this, we use a slightly higher threshold for inner loops.
+    // Note that the loop depth is always > 0 so we will prefer non-OSR over OSR.
+    uint32_t loopDepth = GET_UINT8(pc);
+    JS_ASSERT(loopDepth > 0);
+    return minUses + loopDepth * 100;
+}
+
 OptimizationInfos::OptimizationInfos()
 {
     infos_[Optimization_Normal - 1].initNormalOptimizationInfo();
     infos_[Optimization_AsmJS - 1].initAsmjsOptimizationInfo();
-
-#ifdef DEBUG
-    OptimizationLevel prev = nextLevel(Optimization_DontCompile);
-    while (!isLastLevel(prev)) {
-        OptimizationLevel next = nextLevel(prev);
-        JS_ASSERT(get(prev)->usesBeforeCompile() < get(next)->usesBeforeCompile());
-        prev = next;
-    }
-#endif
 }
 
 OptimizationLevel
-OptimizationInfos::nextLevel(OptimizationLevel level)
+OptimizationInfos::nextLevel(OptimizationLevel level) const
 {
     JS_ASSERT(!isLastLevel(level));
     switch (level) {
@@ -83,21 +109,27 @@ OptimizationInfos::nextLevel(OptimizationLevel level)
     }
 }
 
+OptimizationLevel
+OptimizationInfos::firstLevel() const
+{
+    return nextLevel(Optimization_DontCompile);
+}
+
 bool
-OptimizationInfos::isLastLevel(OptimizationLevel level)
+OptimizationInfos::isLastLevel(OptimizationLevel level) const
 {
     return level == Optimization_Normal;
 }
 
 OptimizationLevel
-OptimizationInfos::levelForUseCount(uint32_t useCount)
+OptimizationInfos::levelForScript(JSScript *script, jsbytecode *pc) const
 {
     OptimizationLevel prev = Optimization_DontCompile;
 
     while (!isLastLevel(prev)) {
         OptimizationLevel level = nextLevel(prev);
         const OptimizationInfo *info = get(level);
-        if (useCount < info->usesBeforeCompile())
+        if (script->getUseCount() < info->usesBeforeCompile(script, pc))
             return prev;
 
         prev = level;
diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
index 748f73794c49..fc37b652d2cd 100644
--- a/js/src/jit/IonOptimizationLevels.h
+++ b/js/src/jit/IonOptimizationLevels.h
@@ -106,11 +106,7 @@ class OptimizationInfo
         return inlineNative_ && !js_JitOptions.disableInlining;
     }
 
-    uint32_t usesBeforeCompile() const {
-        if (js_JitOptions.forceDefaultIonUsesBeforeCompile)
-            return js_JitOptions.forcedDefaultIonUsesBeforeCompile;
-        return usesBeforeCompile_;
-    }
+    uint32_t usesBeforeCompile(JSScript *script, jsbytecode *pc = nullptr) const;
 
     bool gvnEnabled() const {
         return gvn_ && !js_JitOptions.disableGvn;
@@ -171,7 +167,10 @@ class OptimizationInfo
     }
 
     uint32_t usesBeforeInlining() const {
-        return usesBeforeCompile() * usesBeforeInliningFactor_;
+        uint32_t usesBeforeCompile = usesBeforeCompile_;
+        if (js_JitOptions.forceDefaultIonUsesBeforeCompile)
+            usesBeforeCompile = js_JitOptions.forcedDefaultIonUsesBeforeCompile;
+        return usesBeforeCompile * usesBeforeInliningFactor_;
     }
 };
 
@@ -183,16 +182,17 @@ class OptimizationInfos
   public:
     OptimizationInfos();
 
-    const OptimizationInfo *get(OptimizationLevel level) {
+    const OptimizationInfo *get(OptimizationLevel level) const {
         JS_ASSERT(level < Optimization_Count);
         JS_ASSERT(level != Optimization_DontCompile);
 
         return &infos_[level - 1];
     }
 
-    OptimizationLevel nextLevel(OptimizationLevel level);
-    bool isLastLevel(OptimizationLevel level);
-    OptimizationLevel levelForUseCount(uint32_t useCount);
+    OptimizationLevel nextLevel(OptimizationLevel level) const;
+    OptimizationLevel firstLevel() const;
+    bool isLastLevel(OptimizationLevel level) const;
+    OptimizationLevel levelForScript(JSScript *script, jsbytecode *pc = nullptr) const;
 };
 
 extern OptimizationInfos js_IonOptimizations;
diff --git a/js/src/jit/JitOptions.h b/js/src/jit/JitOptions.h
index 4703e94f5768..a6f3d5843063 100644
--- a/js/src/jit/JitOptions.h
+++ b/js/src/jit/JitOptions.h
@@ -15,6 +15,17 @@
 namespace js {
 namespace jit {
 
+// Longer scripts can only be compiled off thread, as these compilations
+// can be expensive and stall the main thread for too long.
+static const uint32_t MAX_OFF_THREAD_SCRIPT_SIZE = 100 * 1000;
+static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2 * 1000;
+static const uint32_t MAX_MAIN_THREAD_LOCALS_AND_ARGS = 256;
+
+// DOM Worker runtimes don't have off thread compilation, but can also compile
+// larger scripts since this doesn't stall the main thread.
+static const uint32_t MAX_DOM_WORKER_SCRIPT_SIZE = 16 * 1000;
+static const uint32_t MAX_DOM_WORKER_LOCALS_AND_ARGS = 2048;
+
 // Possible register allocators which may be used.
 enum IonRegisterAllocator {
     RegisterAllocator_LSRA,

From c1566d3c2c5651572d53957bc21ba4a016225b30 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 15:14:13 +0100
Subject: [PATCH 014/459] Bug 939614: IonMonkey: Enable reschedule same
 optimizationLevel if osrPc is different, r=jandem

---
 js/src/jit/Ion.cpp | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index f96cb7f39bb9..92a1e4aed529 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -1726,15 +1726,15 @@ IonCompile(JSContext *cx, JSScript *script,
         return builder->abortReason();
     }
 
+    if (recompile) {
+        JS_ASSERT(executionMode == SequentialExecution);
+        builderScript->ionScript()->setRecompiling();
+    } else {
+        SetIonScript(builder->script(), executionMode, ION_COMPILING_SCRIPT);
+    }
+
     // If possible, compile the script off thread.
     if (OffThreadCompilationAvailable(cx)) {
-        if (recompile) {
-            JS_ASSERT(executionMode == SequentialExecution);
-            builderScript->ionScript()->setRecompiling();
-        } else {
-            SetIonScript(builder->script(), executionMode, ION_COMPILING_SCRIPT);
-        }
-
         if (!StartOffThreadIonCompile(cx, builder)) {
             IonSpew(IonSpew_Abort, "Unable to start off-thread ion compilation.");
             return AbortReason_Alloc;
@@ -1928,9 +1928,15 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
 
         // Don't recompile/overwrite higher optimized code,
         // with a lower optimization level.
-        if (optimizationLevel <= scriptIon->optimizationLevel())
+        if (optimizationLevel < scriptIon->optimizationLevel())
             return failedState;
 
+        if (optimizationLevel == scriptIon->optimizationLevel() &&
+            (!osrPc || script->ionScript()->osrPc() == osrPc))
+        {
+            return failedState;
+        }
+
         // Don't start compiling if already compiling
         if (scriptIon->isRecompiling())
             return failedState;

From 4cd98a6cc14f46d95dd9245288a8345007548f8b Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 15:14:13 +0100
Subject: [PATCH 015/459] Bug 939614: IonMonkey: Properly spew recompiling
 instead of analyzing, r=jandem

---
 js/src/jit/IonBuilder.cpp          | 13 +++++++++++--
 js/src/jit/IonOptimizationLevels.h | 17 +++++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 1a1bd7d6baee..24eeae4a238e 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -609,8 +609,17 @@ IonBuilder::build()
     if (!current)
         return false;
 
-    IonSpew(IonSpew_Scripts, "Analyzing script %s:%d (%p) (usecount=%d)",
-            script()->filename(), script()->lineno(), (void *)script(), (int)script()->getUseCount());
+#ifdef DEBUG
+    if (info().executionMode() == SequentialExecution && script()->hasIonScript()) {
+        IonSpew(IonSpew_Scripts, "Recompiling script %s:%d (%p) (usecount=%d, level=%s)",
+                script()->filename(), script()->lineno(), (void *)script(),
+                (int)script()->getUseCount(), OptimizationLevelString(optimizationInfo().level()));
+    } else {
+        IonSpew(IonSpew_Scripts, "Analyzing script %s:%d (%p) (usecount=%d, level=%s)",
+                script()->filename(), script()->lineno(), (void *)script(),
+                (int)script()->getUseCount(), OptimizationLevelString(optimizationInfo().level()));
+    }
+#endif
 
     if (!initParameters())
         return false;
diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
index fc37b652d2cd..b939bfbfdd30 100644
--- a/js/src/jit/IonOptimizationLevels.h
+++ b/js/src/jit/IonOptimizationLevels.h
@@ -24,6 +24,23 @@ enum OptimizationLevel
     Optimization_Count
 };
 
+#ifdef DEBUG
+inline const char *
+OptimizationLevelString(OptimizationLevel level)
+{
+    switch (level) {
+      case Optimization_DontCompile:
+        return "Optimization_DontCompile";
+      case Optimization_Normal:
+        return "Optimization_Normal";
+      case Optimization_AsmJS:
+        return "Optimization_AsmJS";
+      default:
+        MOZ_ASSUME_UNREACHABLE("Invalid OptimizationLevel");
+    }
+}
+#endif
+
 class OptimizationInfo
 {
   public:

From 50418a12fcdffd44b438886f26aed17ba2652d46 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Thu, 12 Dec 2013 06:35:00 -0800
Subject: [PATCH 016/459] Bug 948992 - Copy the deviceSerial to ADB's device
 manager. r=jgriffin

---
 testing/marionette/client/marionette/runner/base.py      | 9 ++++++---
 .../marionette/client/marionette/runner/mixins/b2g.py    | 8 +++++---
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/testing/marionette/client/marionette/runner/base.py b/testing/marionette/client/marionette/runner/base.py
index 206811ec13e9..b98f4650c314 100644
--- a/testing/marionette/client/marionette/runner/base.py
+++ b/testing/marionette/client/marionette/runner/base.py
@@ -634,12 +634,14 @@ class BaseMarionetteTestRunner(object):
                                              logcat_dir=self.logcat_dir,
                                              gecko_path=self.gecko_path,
                                              symbols_path=self.symbols_path,
-                                             timeout=self.timeout)
+                                             timeout=self.timeout,
+                                             device_serial=self.device_serial)
             else:
                 self.marionette = Marionette(host=host,
                                              port=int(port),
                                              baseurl=self.baseurl,
-                                             timeout=self.timeout)
+                                             timeout=self.timeout,
+                                             device_serial=self.device_serial)
         elif self.emulator:
             self.marionette = Marionette.getMarionetteOrExit(
                                          emulator=self.emulator,
@@ -653,7 +655,8 @@ class BaseMarionetteTestRunner(object):
                                          gecko_path=self.gecko_path,
                                          symbols_path=self.symbols_path,
                                          timeout=self.timeout,
-                                         sdcard=self.sdcard)
+                                         sdcard=self.sdcard,
+                                         device_serial=self.device_serial)
         else:
             raise Exception("must specify binary, address or emulator")
 
diff --git a/testing/marionette/client/marionette/runner/mixins/b2g.py b/testing/marionette/client/marionette/runner/mixins/b2g.py
index 8cbe388d152c..9a48cf267e9d 100644
--- a/testing/marionette/client/marionette/runner/mixins/b2g.py
+++ b/testing/marionette/client/marionette/runner/mixins/b2g.py
@@ -12,12 +12,11 @@ class B2GTestCaseMixin(object):
     def __init__(self, *args, **kwargs):
         self._device_manager = None
 
-    @property
-    def device_manager(self, *args, **kwargs):
+    def get_device_manager(self, *args, **kwargs):
         if not self._device_manager:
             dm_type = os.environ.get('DM_TRANS', 'adb')
             if dm_type == 'adb':
-                self._device_manager = mozdevice.DeviceManagerADB()
+                self._device_manager = mozdevice.DeviceManagerADB(**kwargs)
             elif dm_type == 'sut':
                 host = os.environ.get('TEST_DEVICE')
                 if not host:
@@ -27,3 +26,6 @@ class B2GTestCaseMixin(object):
                 raise Exception('Unknown device manager type: %s' % dm_type)
         return self._device_manager
 
+    @property
+    def device_manager(self):
+        return self.get_device_manager()

From 4b94156b002352ac3c222266b6234db1037ac8fe Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Thu, 12 Dec 2013 23:41:05 +0900
Subject: [PATCH 017/459] Bug 778236 - Treat gyp files as if their content was
 defined in moz.build files. r=gps

---
 build/autoconf/arch.m4                        |   1 +
 build/gyp.mozbuild                            | 109 ++++
 build/virtualenv_packages.txt                 |   1 +
 config/config.mk                              |  27 +-
 configure.in                                  | 184 +------
 js/src/build/autoconf/arch.m4                 |   1 +
 js/src/config/config.mk                       |  27 +-
 media/mtransport/third_party/moz.build        |  13 +-
 media/mtransport/third_party/nICEr/nicer.gyp  |   3 -
 .../third_party/nrappkit/nrappkit.gyp         |   3 -
 media/webrtc/moz.build                        |  33 +-
 .../tools/gyp/pylib/gyp/generator/mozmake.py  | 485 ------------------
 .../webrtc/trunk/tools/gyp/pylib/gyp/input.py |   4 +
 .../audio_coding/codecs/opus/opus.gypi        |   2 +-
 .../modules/audio_device/audio_device.gypi    |  11 +-
 media/webrtc/webrtc_config.gypi               |  54 --
 .../mozbuild/backend/recursivemake.py         |   1 -
 python/mozbuild/mozbuild/frontend/emitter.py  |  11 +-
 .../mozbuild/mozbuild/frontend/gyp_reader.py  | 190 +++++++
 python/mozbuild/mozbuild/frontend/reader.py   |  53 +-
 .../mozbuild/frontend/sandbox_symbols.py      |  25 +
 .../test/backend/test_recursivemake.py        |   2 -
 22 files changed, 478 insertions(+), 762 deletions(-)
 create mode 100644 build/gyp.mozbuild
 delete mode 100644 media/webrtc/trunk/tools/gyp/pylib/gyp/generator/mozmake.py
 delete mode 100644 media/webrtc/webrtc_config.gypi
 create mode 100644 python/mozbuild/mozbuild/frontend/gyp_reader.py

diff --git a/build/autoconf/arch.m4 b/build/autoconf/arch.m4
index a351ac16bb9d..7c64ab9db339 100644
--- a/build/autoconf/arch.m4
+++ b/build/autoconf/arch.m4
@@ -247,6 +247,7 @@ fi # CPU_ARCH = arm
 AC_SUBST(HAVE_ARM_SIMD)
 AC_SUBST(HAVE_ARM_NEON)
 AC_SUBST(BUILD_ARM_NEON)
+AC_SUBST(ARM_ARCH)
 
 if test -n "$MOZ_ARCH"; then
   NSPR_CONFIGURE_ARGS="$NSPR_CONFIGURE_ARGS --with-arch=$MOZ_ARCH"
diff --git a/build/gyp.mozbuild b/build/gyp.mozbuild
new file mode 100644
index 000000000000..5c00df5c30c5
--- /dev/null
+++ b/build/gyp.mozbuild
@@ -0,0 +1,109 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+gyp_vars = {
+    'build_with_mozilla': 1,
+    'build_with_chromium': 0,
+    'have_clock_monotonic': 1 if CONFIG['HAVE_CLOCK_MONOTONIC'] else 0,
+    'have_ethtool_cmd_speed_hi': 1 if CONFIG['MOZ_WEBRTC_HAVE_ETHTOOL_SPEED_HI'] else 0,
+    'include_alsa_audio': 1 if CONFIG['MOZ_ALSA'] else 0,
+    'include_pulse_audio': 1 if CONFIG['MOZ_PULSEAUDIO'] else 0,
+    # basic stuff for everything
+    'include_internal_video_render': 0,
+    'clang_use_chrome_plugins': 0,
+    'enable_protobuf': 0,
+    'include_tests': 0,
+    'enable_android_opensl': 1,
+    # use_system_lib* still seems to be in use in trunk/build
+    'use_system_libjpeg': 0,
+    'use_system_libvpx': 0,
+    'build_libjpeg': 0,
+    'build_libvpx': 0,
+    # saves 4MB when webrtc_trace is off
+    'enable_lazy_trace_alloc': 1,
+
+     # turn off mandatory use of NEON and instead use NEON detection
+    'arm_neon': 0,
+
+    'moz_widget_toolkit_gonk': 0,
+
+    # (for vp8) chromium sets to 0 also
+    'use_temporal_layers': 0,
+    # Creates AEC internal sample dump files in current directory
+    # 'aec_debug_dump': 1,
+
+    # codec enable/disables:
+    # Note: if you change one here, you must modify layout/media/webrtc/Makefile.in!
+    'include_g711': 1,
+    'include_opus': 1,
+    'include_g722': 0,
+    'include_ilbc': 0,
+    'include_isac': 0,
+    'include_pcm16b': 1,
+}
+
+os = CONFIG['OS_TARGET']
+
+if os == 'WINNT':
+    gyp_vars.update(
+        MSVS_VERSION=CONFIG['_MSVS_VERSION'],
+        MSVS_OS_BITS=64 if CONFIG['HAVE_64BIT_OS'] else 32,
+    )
+elif os == 'Android':
+    if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
+        gyp_vars['build_with_gonk'] = 1
+        gyp_vars['moz_widget_toolkit_gonk'] = 1
+    else:
+        gyp_vars.update(
+            gtest_target_type='executable',
+            android_toolchain=CONFIG['ANDROID_TOOLCHAIN'],
+        )
+
+flavors = {
+    'WINNT': 'win',
+    'Android': 'linux' if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk' else 'android',
+    'Linux': 'linux',
+    'Darwin': 'mac' if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa' else 'ios',
+    'SunOS': 'solaris',
+    'GNU_kFreeBSD': 'freebsd',
+    'DragonFly': 'dragonfly',
+    'FreeBSD': 'freebsd',
+    'NetBSD': 'netbsd',
+    'OpenBSD': 'openbsd',
+}
+gyp_vars['OS'] = flavors[os]
+
+arches = {
+    'x86_64': 'x64',
+    'arm': 'arm',
+    'x86': 'ia32',
+    'ppc': 'ppc',
+    'ppc64': 'ppc',
+    'ia64': 'ia64',
+}
+
+gyp_vars['target_arch'] = arches[CONFIG['CPU_ARCH']]
+
+if CONFIG['ARM_ARCH']:
+    # We currently don't have a way to convert a string to an int in moz.build.
+    # As of writing, ARM_ARCH is not going to be over 8, so a string comparison
+    # works.
+    if CONFIG['ARM_ARCH'] < '7':
+        gyp_vars['armv7'] = 0
+    elif os == 'Android':
+        gyp_vars['armv7'] = 1
+    else:
+        # CPU detection for ARM works on Android only.  armv7 always uses CPU
+        # detection, so we have to set armv7=0 for non-Android target
+        gyp_vars['armv7'] = 0
+
+# Don't try to compile ssse3/sse4.1 code if toolchain doesn't support
+if CONFIG['INTEL_ARCHITECTURE']:
+    if not CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSSE3'] or not CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSE4_1']:
+        gyp_vars['yuv_disable_asm'] = 1
+
+if CONFIG['MACOS_SDK_DIR']:
+    gyp_vars['mac_sdk_path'] = CONFIG['MACOS_SDK_DIR']
diff --git a/build/virtualenv_packages.txt b/build/virtualenv_packages.txt
index 056423aa3f6e..aade8e7598e3 100644
--- a/build/virtualenv_packages.txt
+++ b/build/virtualenv_packages.txt
@@ -17,3 +17,4 @@ moztreedocs.pth:tools/docs
 copy:build/buildconfig.py
 packages.txt:testing/mozbase/packages.txt
 objdir:build
+gyp.pth:media/webrtc/trunk/tools/gyp/pylib
diff --git a/config/config.mk b/config/config.mk
index 2c1903172a22..379eb9aa9141 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -587,10 +587,11 @@ OS_COMPILE_CMMFLAGS += -fobjc-abi-version=2 -fobjc-legacy-dispatch
 endif
 endif
 
-COMPILE_CFLAGS	= $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CFLAGS) $(CFLAGS)
-COMPILE_CXXFLAGS = $(STL_FLAGS) $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CXXFLAGS) $(CXXFLAGS)
-COMPILE_CMFLAGS = $(OS_COMPILE_CMFLAGS)
-COMPILE_CMMFLAGS = $(OS_COMPILE_CMMFLAGS)
+COMPILE_CFLAGS	= $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CFLAGS) $(CFLAGS) $(EXTRA_COMPILE_FLAGS)
+COMPILE_CXXFLAGS = $(STL_FLAGS) $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CXXFLAGS) $(CXXFLAGS) $(EXTRA_COMPILE_FLAGS)
+COMPILE_CMFLAGS = $(OS_COMPILE_CMFLAGS) $(EXTRA_COMPILE_FLAGS)
+COMPILE_CMMFLAGS = $(OS_COMPILE_CMMFLAGS) $(EXTRA_COMPILE_FLAGS)
+ASFLAGS += $(EXTRA_ASSEMBLER_FLAGS)
 
 ifndef CROSS_COMPILE
 HOST_CFLAGS += $(RTL_FLAGS)
@@ -884,3 +885,21 @@ MOZ_GTK2_CFLAGS := -I$(topsrcdir)/widget/gtk/compat $(MOZ_GTK2_CFLAGS)
 endif
 
 DEFINES += -DNO_NSPR_10_SUPPORT
+
+ifdef IS_GYP_DIR
+LOCAL_INCLUDES += \
+  -I$(topsrcdir)/ipc/chromium/src \
+  -I$(topsrcdir)/ipc/glue \
+  -I$(DEPTH)/ipc/ipdl/_ipdlheaders \
+  $(NULL)
+
+ifeq (WINNT,$(OS_TARGET))
+# These get set via VC project file settings for normal GYP builds.
+DEFINES += -DUNICODE -D_UNICODE
+LOCAL_INCLUDES += -I'$(MOZ_DIRECTX_SDK_PATH)/include'
+endif
+
+STL_FLAGS=
+# Skip most Mozilla-specific include locations.
+INCLUDES = -I. $(LOCAL_INCLUDES) -I$(DEPTH)/dist/include
+endif
diff --git a/configure.in b/configure.in
index 42222f74dc22..60df11849621 100644
--- a/configure.in
+++ b/configure.in
@@ -456,16 +456,17 @@ case "$target" in
 
         if test "$_CC_MAJOR_VERSION" = "16"; then
             _CC_SUITE=10
-            _MSVS_VERSION=2010
+            MSVS_VERSION=2010
         elif test "$_CC_MAJOR_VERSION" = "17"; then
             _CC_SUITE=11
-            _MSVS_VERSION=2012
+            MSVS_VERSION=2012
         elif test "$_CC_MAJOR_VERSION" = "18"; then
             _CC_SUITE=12
-            _MSVS_VERSION=2013
+            MSVS_VERSION=2013
         else
             AC_MSG_ERROR([This version ($CC_VERSION) of the MSVC compiler is unsupported. See https://developer.mozilla.org/en/Windows_Build_Prerequisites.])
         fi
+	AC_SUBST(MSVS_VERSION)
 
         AC_DEFINE(HAVE_SEH_EXCEPTIONS)
 
@@ -5068,29 +5069,15 @@ AC_TRY_COMPILE([#include <linux/ethtool.h>],
                [ struct ethtool_cmd cmd; cmd.speed_hi = 0; ],
                MOZ_WEBRTC_HAVE_ETHTOOL_SPEED_HI=1)
 
+AC_SUBST(MOZ_WEBRTC_HAVE_ETHTOOL_SPEED_HI)
+
 # target_arch is from {ia32|x64|arm|ppc}
 case "$CPU_ARCH" in
-x86_64)
-    WEBRTC_TARGET_ARCH=x64
-    ;;
-
-arm*)
-    WEBRTC_TARGET_ARCH=arm
-    ;;
-
-x86)
-    WEBRTC_TARGET_ARCH=ia32
-    ;;
-
-ppc*)
-    WEBRTC_TARGET_ARCH=ppc
-    ;;
-ia64)
-    WEBRTC_TARGET_ARCH=ia64
+x86_64 | arm | x86 | ppc* | ia64)
+    :
     ;;
 *)
 # unsupported arch for webrtc
-    WEBRTC_TARGET_ARCH=unknown
     MOZ_WEBRTC=
     ;;
 
@@ -8838,161 +8825,6 @@ case "$host" in
     ;;
 esac
 
-# Generate Makefiles for WebRTC directly from .gyp files
-if test "${OS_TARGET}" = "WINNT"; then
-   if test "$HAVE_64BIT_OS"; then
-      OS_BITS=64
-   else
-      OS_BITS=32
-   fi
-   EXTRA_GYP_DEFINES="-D MSVS_VERSION=${_MSVS_VERSION} -D MSVS_OS_BITS=${OS_BITS}"
-
-elif test "${OS_TARGET}" = "Android"; then
-   if test "${MOZ_WIDGET_TOOLKIT}" = "gonk"; then
-      EXTRA_GYP_DEFINES="-G os=linux "
-   else
-      EXTRA_GYP_DEFINES="-D gtest_target_type=executable -D android_toolchain=${android_toolchain} -G os=android "
-   fi
-fi
-
-if test -n "$ARM_ARCH"; then
-    if test "$ARM_ARCH" -lt 7; then
-        EXTRA_GYP_DEFINES="${EXTRA_GYP_DEFINES} -D armv7=0 "
-    else
-        if test "${OS_TARGET}" = "Android"; then
-            EXTRA_GYP_DEFINES="${EXTRA_GYP_DEFINES} -D armv7=1 "
-        else
-            dnl CPU detection for ARM works on Android only.  armv7 always uses CPU detection, so
-            dnl we have to set armv7=0 for non-Android target
-            EXTRA_GYP_DEFINES="${EXTRA_GYP_DEFINES} -D armv7=0 "
-        fi
-    fi
-fi
-
-# Keep libcubeb and audio_device backends in sync
-if test -n "$MOZ_ALSA"; then
-   EXTRA_GYP_DEFINES="$EXTRA_GYP_DEFINES -D include_alsa_audio=1"
-else
-   EXTRA_GYP_DEFINES="$EXTRA_GYP_DEFINES -D include_alsa_audio=0"
-fi
-if test -n "$MOZ_PULSEAUDIO"; then
-   EXTRA_GYP_DEFINES="$EXTRA_GYP_DEFINES -D include_pulse_audio=1"
-else
-   EXTRA_GYP_DEFINES="$EXTRA_GYP_DEFINES -D include_pulse_audio=0"
-fi
-
-# Don't try to compile ssse3/sse4.1 code if toolchain doesn't support
-if test -n "$INTEL_ARCHITECTURE"; then
-  if test -z "$HAVE_TOOLCHAIN_SUPPORT_MSSSE3" -o -z "$HAVE_TOOLCHAIN_SUPPORT_MSSE4_1"; then
-    EXTRA_GYP_DEFINES="$EXTRA_GYP_DEFINES -D yuv_disable_asm=1"
-  fi
-fi
-
-if test -n "$MOZ_WEBRTC"; then
-   AC_MSG_RESULT("generating WebRTC Makefiles...")
-
-   if test "${MOZ_WIDGET_TOOLKIT}" = "gonk"; then
-      EXTRA_GYP_DEFINES="${EXTRA_GYP_DEFINES} -D build_with_gonk=1"
-   fi
-
-dnl Any --include files must also appear in -D FORCED_INCLUDE_FILE= entries
-dnl so that regeneration via dependencies works correctly
-   WEBRTC_CONFIG="-D build_with_mozilla=1 -D build_with_chromium=0 --include ${srcdir}/media/webrtc/webrtc_config.gypi -D FORCED_INCLUDE_FILE=${srcdir}/media/webrtc/webrtc_config.gypi"
-
-   if test -n HAVE_CLOCK_MONOTONIC; then
-      WEBRTC_CONFIG="${WEBRTC_CONFIG} -D have_clock_monotonic=1"
-   else
-      WEBRTC_CONFIG="${WEBRTC_CONFIG} -D have_clock_monotonic=0"
-   fi
-
-   if test -n "$MOZ_WEBRTC_HAVE_ETHTOOL_SPEED_HI"; then
-      WEBRTC_CONFIG="${WEBRTC_CONFIG} -D have_ethtool_cmd_speed_hi=1"
-   else
-      WEBRTC_CONFIG="${WEBRTC_CONFIG} -D have_ethtool_cmd_speed_hi=0"
-   fi
-
-   if test -n "$CROSS_COMPILE"; then
-      case "$target" in
-      *-mingw*)
-      	GYP_MOZMAKE_OPTIONS="-G os=win"
-        ;;
-      *-darwin*)
-        GYP_MOZMAKE_OPTIONS="-G os=mac"
-        if test "$MACOS_SDK_DIR"; then
-           GYP_MOZMAKE_OPTIONS="${GYP_MOZMAKE_OPTIONS} -D mac_sdk_path=$MACOS_SDK_DIR"
-        fi
-        ;;
-      *-*linux*)
-        GYP_MOZMAKE_OPTIONS="-G os=linux"
-        ;;
-      *)
-        AC_MSG_ERROR([Don't know what options to give to WebRTC for cross-compilation])
-    	;;
-      esac
-   fi
-
-   GYP_WEBRTC_OPTIONS="--format=mozmake ${GYP_MOZMAKE_OPTIONS} ${WEBRTC_CONFIG} -D target_arch=${WEBRTC_TARGET_ARCH} ${EXTRA_GYP_DEFINES} --depth=${srcdir}/media/webrtc/trunk --toplevel-dir=${srcdir} -G OBJDIR=${_objdir}"
-
-   $PYTHON ${srcdir}/media/webrtc/trunk/build/gyp_chromium \
-     $GYP_WEBRTC_OPTIONS \
-     --generator-output=${_objdir}/media/webrtc/trunk \
-     ${srcdir}/media/webrtc/trunk/peerconnection.gyp
-   if test "$?" != 0; then
-      AC_MSG_ERROR([failed to generate WebRTC Makefiles])
-   fi
-
-   # XXX disable until we land the tranche with signaling
-   if test -n "$MOZ_WEBRTC_SIGNALING"; then
-     AC_MSG_RESULT("generating WebRTC/Signaling Makefiles...")
-     $PYTHON ${srcdir}/media/webrtc/trunk/build/gyp_chromium \
-       $GYP_WEBRTC_OPTIONS \
-       -D build_for_test=0 \
-       --generator-output=${_objdir}/media/webrtc/signaling \
-       ${srcdir}/media/webrtc/signaling/signaling.gyp
-     if test "$?" != 0; then
-        AC_MSG_ERROR([failed to generate WebRTC/Signaling Makefiles])
-     fi
-
-     AC_MSG_RESULT("generating WebRTC/SignalingTest Makefiles...")
-     $PYTHON ${srcdir}/media/webrtc/trunk/build/gyp_chromium --format=mozmake \
-       $GYP_WEBRTC_OPTIONS \
-       -D build_for_test=1 \
-       --generator-output=${_objdir}/media/webrtc/signalingtest \
-       ${srcdir}/media/webrtc/signaling/signaling.gyp
-     if test "$?" != 0; then
-       AC_MSG_ERROR([failed to generate WebRTC/SignalingTest Makefiles])
-     fi
-   fi
-
-   AC_MSG_RESULT("generating gtest Makefiles...")
-   # Ok to pass some extra -D's that are ignored here
-   $PYTHON ${srcdir}/media/webrtc/trunk/build/gyp_chromium \
-     $GYP_WEBRTC_OPTIONS \
-     --generator-output=${_objdir}/media/webrtc/trunk/testing/ \
-     ${srcdir}/media/webrtc/trunk/testing/gtest.gyp
-   if test "$?" != 0; then
-      AC_MSG_ERROR([failed to generate gtest Makefiles])
-   fi
-
-   AC_MSG_RESULT("generating nrappkit Makefiles...")
-   $PYTHON ${srcdir}/media/webrtc/trunk/build/gyp_chromium --format=mozmake \
-     $GYP_WEBRTC_OPTIONS \
-     --generator-output=${_objdir}/media/mtransport/third_party/nrappkit \
-     ${srcdir}/media/mtransport/third_party/nrappkit/nrappkit.gyp
-   if test "$?" != 0; then
-      AC_MSG_ERROR([failed to generate nrappkit Makefiles])
-   fi
-
-   AC_MSG_RESULT("generating nICEr Makefiles...")
-   $PYTHON ${srcdir}/media/webrtc/trunk/build/gyp_chromium --format=mozmake \
-     $GYP_WEBRTC_OPTIONS \
-     --generator-output=${_objdir}/media/mtransport/third_party/nICEr \
-     ${srcdir}/media/mtransport/third_party/nICEr/nicer.gyp
-   if test "$?" != 0; then
-      AC_MSG_ERROR([failed to generate nICEr Makefiles])
-   fi
-fi
-
 # Run jemalloc configure script
 
 if test -z "$MOZ_NATIVE_JEMALLOC" -a "$MOZ_MEMORY" && test -n "$MOZ_JEMALLOC3" -o -n "$MOZ_REPLACE_MALLOC"; then
diff --git a/js/src/build/autoconf/arch.m4 b/js/src/build/autoconf/arch.m4
index a351ac16bb9d..7c64ab9db339 100644
--- a/js/src/build/autoconf/arch.m4
+++ b/js/src/build/autoconf/arch.m4
@@ -247,6 +247,7 @@ fi # CPU_ARCH = arm
 AC_SUBST(HAVE_ARM_SIMD)
 AC_SUBST(HAVE_ARM_NEON)
 AC_SUBST(BUILD_ARM_NEON)
+AC_SUBST(ARM_ARCH)
 
 if test -n "$MOZ_ARCH"; then
   NSPR_CONFIGURE_ARGS="$NSPR_CONFIGURE_ARGS --with-arch=$MOZ_ARCH"
diff --git a/js/src/config/config.mk b/js/src/config/config.mk
index 2c1903172a22..379eb9aa9141 100644
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -587,10 +587,11 @@ OS_COMPILE_CMMFLAGS += -fobjc-abi-version=2 -fobjc-legacy-dispatch
 endif
 endif
 
-COMPILE_CFLAGS	= $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CFLAGS) $(CFLAGS)
-COMPILE_CXXFLAGS = $(STL_FLAGS) $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CXXFLAGS) $(CXXFLAGS)
-COMPILE_CMFLAGS = $(OS_COMPILE_CMFLAGS)
-COMPILE_CMMFLAGS = $(OS_COMPILE_CMMFLAGS)
+COMPILE_CFLAGS	= $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CFLAGS) $(CFLAGS) $(EXTRA_COMPILE_FLAGS)
+COMPILE_CXXFLAGS = $(STL_FLAGS) $(VISIBILITY_FLAGS) $(DEFINES) $(INCLUDES) $(DSO_CFLAGS) $(DSO_PIC_CFLAGS) $(RTL_FLAGS) $(OS_CPPFLAGS) $(OS_COMPILE_CXXFLAGS) $(CXXFLAGS) $(EXTRA_COMPILE_FLAGS)
+COMPILE_CMFLAGS = $(OS_COMPILE_CMFLAGS) $(EXTRA_COMPILE_FLAGS)
+COMPILE_CMMFLAGS = $(OS_COMPILE_CMMFLAGS) $(EXTRA_COMPILE_FLAGS)
+ASFLAGS += $(EXTRA_ASSEMBLER_FLAGS)
 
 ifndef CROSS_COMPILE
 HOST_CFLAGS += $(RTL_FLAGS)
@@ -884,3 +885,21 @@ MOZ_GTK2_CFLAGS := -I$(topsrcdir)/widget/gtk/compat $(MOZ_GTK2_CFLAGS)
 endif
 
 DEFINES += -DNO_NSPR_10_SUPPORT
+
+ifdef IS_GYP_DIR
+LOCAL_INCLUDES += \
+  -I$(topsrcdir)/ipc/chromium/src \
+  -I$(topsrcdir)/ipc/glue \
+  -I$(DEPTH)/ipc/ipdl/_ipdlheaders \
+  $(NULL)
+
+ifeq (WINNT,$(OS_TARGET))
+# These get set via VC project file settings for normal GYP builds.
+DEFINES += -DUNICODE -D_UNICODE
+LOCAL_INCLUDES += -I'$(MOZ_DIRECTX_SDK_PATH)/include'
+endif
+
+STL_FLAGS=
+# Skip most Mozilla-specific include locations.
+INCLUDES = -I. $(LOCAL_INCLUDES) -I$(DEPTH)/dist/include
+endif
diff --git a/media/mtransport/third_party/moz.build b/media/mtransport/third_party/moz.build
index 2cd7ad5c9a18..dfc73472cbef 100644
--- a/media/mtransport/third_party/moz.build
+++ b/media/mtransport/third_party/moz.build
@@ -4,4 +4,15 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-PARALLEL_EXTERNAL_MAKE_DIRS += ['nrappkit', 'nICEr']
+include('/build/gyp.mozbuild')
+
+GYP_DIRS += [
+    'nICEr',
+    'nrappkit',
+]
+
+GYP_DIRS['nICEr'].input = 'nICEr/nicer.gyp'
+GYP_DIRS['nICEr'].variables = gyp_vars
+
+GYP_DIRS['nrappkit'].input = 'nrappkit/nrappkit.gyp'
+GYP_DIRS['nrappkit'].variables = gyp_vars
diff --git a/media/mtransport/third_party/nICEr/nicer.gyp b/media/mtransport/third_party/nICEr/nicer.gyp
index 8bf16d3a5b49..f8cc39e6c4d6 100644
--- a/media/mtransport/third_party/nICEr/nicer.gyp
+++ b/media/mtransport/third_party/nICEr/nicer.gyp
@@ -34,9 +34,6 @@
               "./src/net",
               "./src/stun",
               "./src/util",
-
-	      # Mozilla, hopefully towards the end
-             '$(DEPTH)/dist/include',
           ],
 
           'sources' : [
diff --git a/media/mtransport/third_party/nrappkit/nrappkit.gyp b/media/mtransport/third_party/nrappkit/nrappkit.gyp
index 94e81924b148..b22923838f00 100644
--- a/media/mtransport/third_party/nrappkit/nrappkit.gyp
+++ b/media/mtransport/third_party/nrappkit/nrappkit.gyp
@@ -22,9 +22,6 @@
 	      'src/stats',
 	      'src/util',
 	      'src/util/libekr',
-
-	      # Mozilla, hopefully towards the end
-             '$(DEPTH)/dist/include',
           ],
 
           'sources' : [
diff --git a/media/webrtc/moz.build b/media/webrtc/moz.build
index f6034dc30d3d..5c5243a4c55c 100644
--- a/media/webrtc/moz.build
+++ b/media/webrtc/moz.build
@@ -4,13 +4,30 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-EXTERNAL_MAKE_DIRS += [
-    'trunk',
-    'signaling',
-]
+include('/build/gyp.mozbuild')
+
+GYP_DIRS += ['trunk']
+
+GYP_DIRS['trunk'].input = 'trunk/peerconnection.gyp'
+GYP_DIRS['trunk'].variables = gyp_vars
+
+if CONFIG['MOZ_WEBRTC_SIGNALING']:
+    GYP_DIRS += ['signaling']
+    GYP_DIRS['signaling'].input = 'signaling/signaling.gyp'
+    GYP_DIRS['signaling'].variables = gyp_vars.copy()
+    GYP_DIRS['signaling'].variables.update(
+        build_for_test=0
+    )
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gonk':
-    EXTERNAL_MAKE_DIRS += [
-        'trunk/testing',
-        'signalingtest',
-    ]
+    GYP_DIRS += ['trunk/testing']
+    GYP_DIRS['trunk/testing'].input = 'trunk/testing/gtest.gyp'
+    GYP_DIRS['trunk/testing'].variables = gyp_vars
+
+    if CONFIG['MOZ_WEBRTC_SIGNALING']:
+        GYP_DIRS += ['signalingtest']
+        GYP_DIRS['signalingtest'].input = 'signaling/signaling.gyp'
+        GYP_DIRS['signalingtest'].variables = gyp_vars.copy()
+        GYP_DIRS['signalingtest'].variables.update(
+            build_for_test=1
+        )
diff --git a/media/webrtc/trunk/tools/gyp/pylib/gyp/generator/mozmake.py b/media/webrtc/trunk/tools/gyp/pylib/gyp/generator/mozmake.py
deleted file mode 100644
index 482d38e9cc6e..000000000000
--- a/media/webrtc/trunk/tools/gyp/pylib/gyp/generator/mozmake.py
+++ /dev/null
@@ -1,485 +0,0 @@
-# Copyright (c) 2012 Mozilla Foundation. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import collections
-import gyp
-import gyp.common
-import sys
-import platform
-import os
-import re
-import shlex
-from mozbuild.util import (
-    FileAvoidWrite,
-    shell_quote,
-)
-
-generator_wants_sorted_dependencies = True
-
-generator_default_variables = {
-}
-for dirname in ['INTERMEDIATE_DIR', 'SHARED_INTERMEDIATE_DIR', 'PRODUCT_DIR',
-                'LIB_DIR', 'SHARED_LIB_DIR']:
-  # Some gyp steps fail if these are empty(!).
-  generator_default_variables[dirname] = 'dir'
-for unused in ['RULE_INPUT_PATH', 'RULE_INPUT_ROOT', 'RULE_INPUT_NAME',
-               'RULE_INPUT_DIRNAME', 'RULE_INPUT_EXT',
-               'EXECUTABLE_PREFIX', 'EXECUTABLE_SUFFIX',
-               'STATIC_LIB_PREFIX', 'STATIC_LIB_SUFFIX',
-               'SHARED_LIB_PREFIX', 'SHARED_LIB_SUFFIX',
-               'LINKER_SUPPORTS_ICF']:
-  generator_default_variables[unused] = ''
-
-COMMON_HEADER = """# This makefile was automatically generated from %(buildfile)s. Please do not edit it directly.
-DEPTH		= %(depth)s
-topsrcdir	= %(topsrcdir)s
-srcdir          = %(srcdir)s
-VPATH           = %(srcdir)s
-
-EXTERNALLY_MANAGED_MAKE_FILE := 1
-
-"""
-
-COMMON_FOOTER = """
-
-include %(common_mk_path)s
-"""
-
-COMMON_MK = """# This file was generated by mozmake.py. Do not edit it directly.
-ifndef COMMON_MK_INCLUDED
-COMMON_MK_INCLUDED := 1
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES += \\
-  -I$(topsrcdir)/ipc/chromium/src \\
-  -I$(topsrcdir)/ipc/glue \\
-  -I$(DEPTH)/ipc/ipdl/_ipdlheaders \\
-  $(NULL)
-
-ifdef MOZ_DEBUG
-CFLAGS += $(CPPFLAGS_Debug) $(CFLAGS_Debug)
-CXXFLAGS += $(CPPFLAGS_Debug) $(CXXFLAGS_Debug)
-DEFINES += $(DEFINES_Debug)
-LOCAL_INCLUDES += $(INCLUDES_Debug)
-ASFLAGS += $(ASFLAGS_Debug)
-else # non-MOZ_DEBUG
-CFLAGS += $(CPPFLAGS_Release) $(CFLAGS_Release)
-CXXFLAGS += $(CPPFLAGS_Release) $(CXXFLAGS_Release)
-DEFINES += $(DEFINES_Release)
-LOCAL_INCLUDES += $(INCLUDES_Release)
-ASFLAGS += $(ASFLAGS_Release)
-endif
-
-ifeq (WINNT,$(OS_TARGET))
-# These get set via VC project file settings for normal GYP builds.
-DEFINES += -DUNICODE -D_UNICODE
-LOCAL_INCLUDES += -I'$(MOZ_DIRECTX_SDK_PATH)/include'
-endif
-
-# Don't use STL wrappers when compiling Google code.
-STL_FLAGS =
-
-# Skip most Mozilla-specific include locations.
-INCLUDES = -I. $(LOCAL_INCLUDES) -I$(DEPTH)/dist/include
-
-# Ensure that subdirs for sources get created before compiling
-ifdef OBJS
-SUB_SRCDIRS := $(addsuffix .dirstamp,$(addprefix $(CURDIR)/,$(sort $(dir $(OBJS)))))
-$(OBJS): $(SUB_SRCDIRS)
-$(SUB_SRCDIRS):
-	$(MKDIR) -p $(dir $@)
-	touch $@
-endif
-
-# COPY_SRCS get copied to the current directory to be compiled
-
-define COPY_SRC
-$(notdir $(1)): $(1)
-	$$(INSTALL) $$(IFLAGS1) '$$<' .
-
-endef # COPY_SRC
-ifdef COPY_SRCS
-GARBAGE += $(notdir $(COPY_SRCS))
-$(foreach s,$(COPY_SRCS), $(eval $(call COPY_SRC,$(s))))
-endif
-
-# Rules for regenerating Makefiles from GYP files.
-Makefile: %(input_gypfiles)s %(generator)s
-	$(PYTHON) %(commandline)s
-	@$(TOUCH) $@
-endif
-
-include $(topsrcdir)/config/recurse.mk
-"""
-
-def ensure_directory_exists(path):
-  dir = os.path.dirname(path)
-  if dir and not os.path.exists(dir):
-    os.makedirs(dir)
-
-def GetFlavor(params):
-  """Returns |params.flavor| if it's set, the system's default flavor else."""
-  system = platform.system().lower()
-  flavors = {
-    'microsoft': 'win',
-    'windows'  : 'win',
-    'cygwin'   : 'win',
-    'darwin'   : 'mac',
-    'sunos'    : 'solaris',
-    'dragonfly': 'dragonfly',
-    'freebsd'  : 'freebsd',
-    'netbsd'   : 'netbsd',
-    'openbsd'  : 'openbsd',
-  }
-
-  if 'flavor' in params:
-    return params['flavor']
-  if system in flavors:
-    return flavors[system]
-
-  return 'linux'
-
-
-def CalculateVariables(default_variables, params):
-  generator_flags = params.get('generator_flags', {})
-  default_variables['OS'] = generator_flags.get('os', GetFlavor(params))
-
-
-def CalculateGeneratorInputInfo(params):
-  """Calculate the generator specific info that gets fed to input (called by
-  gyp)."""
-  generator_flags = params.get('generator_flags', {})
-  if generator_flags.get('adjust_static_libraries', False):
-    global generator_wants_static_library_dependencies_adjusted
-    generator_wants_static_library_dependencies_adjusted = True
-
-def WriteMakefile(filename, data, build_file, depth, topsrcdir, srcdir, relative_path, common_mk_path, extra_data=None):
-  if not os.path.isabs(topsrcdir):
-    topsrcdir = depth + "/" + topsrcdir
-  if not os.path.isabs(srcdir):
-    srcdir = depth + "/" + srcdir
-  #TODO: should compare with the existing file and not overwrite it if the
-  # contents are the same!
-  ensure_directory_exists(filename)
-  with FileAvoidWrite(filename) as f:
-    f.write(COMMON_HEADER % {'buildfile': build_file,
-                             'depth': depth,
-                             'topsrcdir': topsrcdir,
-                             'srcdir': srcdir})
-    for k, v in data.iteritems():
-      f.write("%s = %s\n" % (k, " \\\n  ".join([''] + v) if isinstance(v, list) else v))
-    f.write(COMMON_FOOTER % {'common_mk_path': common_mk_path})
-    if extra_data:
-      f.write(extra_data)
-
-def WriteCommonMk(path, build_files, scriptname, commandline):
-  with FileAvoidWrite(path) as f:
-    f.write(COMMON_MK % {'input_gypfiles': ' '.join(build_files),
-                         'generator': scriptname,
-                         'commandline': ' '.join(commandline)})
-
-def striplib(name):
-  "Strip lib prefixes from library names."
-  if name[:3] == 'lib':
-    return name[3:]
-  return name
-
-AS_EXTENSIONS = set([
-  '.s',
-  '.S'
-])
-CPLUSPLUS_EXTENSIONS = set([
-  '.cc',
-  '.cpp',
-  '.cxx'
-])
-COMPILABLE_EXTENSIONS = set([
-  '.c',
-  '.s',
-  '.S',
-  '.m',
-  '.mm'
-])
-COMPILABLE_EXTENSIONS.update(CPLUSPLUS_EXTENSIONS)
-
-def swapslashes(p):
-  "Swap backslashes for forward slashes in a path."
-  return p.replace('\\', '/')
-
-def getdepth(s):
-  """Given a relative path, return a relative path consisting
-  of .. segments that would lead to the parent directory."""
-  return "/".join(".." for x in swapslashes(s).split("/") if x)
-
-def Compilable(filename):
-  return os.path.splitext(filename)[1] in COMPILABLE_EXTENSIONS
-
-class MakefileGenerator(object):
-  def __init__(self, target_dicts, data, options, depth, topsrcdir, relative_topsrcdir, relative_srcdir, output_dir, flavor, common_mk_path):
-    self.target_dicts = target_dicts
-    self.data = data
-    self.options = options
-    self.depth = depth
-    self.relative_srcdir = swapslashes(relative_srcdir)
-    self.topsrcdir = swapslashes(topsrcdir)
-    self.relative_topsrcdir = swapslashes(relative_topsrcdir)
-    self.srcdir = swapslashes(os.path.join(topsrcdir, relative_srcdir))
-    self.output_dir = output_dir
-    self.flavor = flavor
-    self.common_mk_path = common_mk_path
-    # Directories to be built in order.
-    self.dirs = []
-    # Directories that can be built in any order, but before |dirs|.
-    self.parallel_dirs = []
-    # Targets that have been processed.
-    self.visited = set()
-    # Link dependencies.
-    self.target_link_deps = {}
-
-  def CalculateMakefilePath(self, build_file, target_name):
-    """Determine where to write a Makefile for a given gyp file."""
-    rel_path = gyp.common.RelativePath(os.path.dirname(build_file),
-                                       self.srcdir)
-    # Add a subdir using the build_file name and the target_name.
-    rel_path = os.path.join(rel_path,
-                             os.path.splitext(os.path.basename(build_file))[0]
-                             + "_" + target_name)
-    output_file = os.path.join(self.output_dir, rel_path, "Makefile")
-    return swapslashes(rel_path), swapslashes(output_file)
-
-  def ProcessTargets(self, needed_targets):
-    """
-    Put all targets in proper order so that dependencies get built before
-    the targets that need them. Targets that have no dependencies
-    can get built in parallel_dirs. Targets with dependencies must be in
-    dirs, and must also be listed after any of their dependencies.
-    """
-    for qualified_target in needed_targets:
-      if qualified_target in self.visited:
-        continue
-      self.ProcessTarget(qualified_target)
-
-  def ProcessTarget(self, qualified_target):
-    """
-    Write a Makefile.in for |qualified_target| and add it to |dirs| or
-    |parallel_dirs| as appropriate, after processing all of its
-    dependencies.
-    """
-    spec = self.target_dicts[qualified_target]
-    if 'dependencies' in spec and spec['dependencies']:
-      for dep in spec['dependencies']:
-        if dep not in self.visited:
-          self.ProcessTarget(dep)
-      dirs = self.dirs
-    else:
-      # no dependencies
-      dirs = self.parallel_dirs
-    # Now write a Makefile for this target
-    build_file, target, toolset = gyp.common.ParseQualifiedTarget(
-      qualified_target)
-    build_file = os.path.abspath(build_file)
-    rel_path, output_file = self.CalculateMakefilePath(build_file, target)
-    subdepth = self.depth + "/" + getdepth(rel_path)
-    if self.WriteTargetMakefile(output_file, rel_path, qualified_target, spec, build_file, subdepth):
-        # If WriteTargetMakefile returns True, then this is a useful target
-      dirs.append(rel_path)
-    self.visited.add(qualified_target)
-
-  def WriteTargetMakefile(self, output_file, rel_path, qualified_target, spec, build_file, depth):
-    configs = spec['configurations']
-    # Update global list of link dependencies.
-    if spec['type'] in ('static_library', 'shared_library'):
-      self.target_link_deps[qualified_target] = "$(call EXPAND_LIBNAME_PATH,%s,$(DEPTH)/%s/%s)" % (striplib(spec['target_name']), self.relative_srcdir, rel_path)
-
-    data = {}
-    #TODO: handle actions/rules/copies
-    if 'actions' in spec:
-      pass
-    if 'rules' in spec:
-      pass
-    if 'copies' in spec:
-      pass
-    libs = []
-    if 'dependencies' in spec:
-      for dep in spec['dependencies']:
-        if dep in self.target_link_deps:
-          libs.append(self.target_link_deps[dep])
-    if libs:
-      data['EXTRA_LIBS'] = libs
-
-    # Get DEFINES/INCLUDES
-    for configname in sorted(configs.keys()):
-      config = configs[configname]
-      #XXX: this sucks
-      defines = config.get('defines')
-      if defines:
-        data['DEFINES_%s' % configname] = [shell_quote("-D%s" % d) for d in defines]
-      includes = []
-      for i in config.get('include_dirs', []):
-        # Make regular paths into srcdir-relative paths, leave
-        # variable-specified paths alone.
-        if i.startswith("$(") or os.path.isabs(i):
-          if ' ' in i:
-            includes.append('"%s"' % i)
-          else:
-            includes.append(i)
-        else:
-          includes.append("$(srcdir)/" + i)
-      if includes:
-        data['INCLUDES_%s' % configname] = ["-I%s" %i for i in includes]
-      #XXX: handle mac stuff?
-# we want to use our compiler options in general
-#      cflags = config.get('cflags')
-#      if cflags:
-#        data['CPPFLAGS_%s' % configname] = cflags
-#      cflags_c = config.get('cflags_c')
-#      if cflags_c:
-#        data['CFLAGS_%s' % configname] = cflags_c
-#      cflags_cc = config.get('cflags_cc')
-#      if cflags_cc:
-#        data['CXXFLAGS_%s' % configname] = cflags_cc
-# we need to keep pkg-config flags however
-      cflags_mozilla = config.get('cflags_mozilla')
-      if cflags_mozilla:
-        data['CPPFLAGS_%s' % configname] = cflags_mozilla
-      asflags_mozilla = config.get('asflags_mozilla')
-      if asflags_mozilla:
-        data['ASFLAGS_%s' % configname] = asflags_mozilla
-    sources = {
-      'CPPSRCS': {'exts': CPLUSPLUS_EXTENSIONS, 'files': []},
-      'CSRCS': {'exts': ['.c'], 'files': []},
-      'CMSRCS': {'exts': ['.m'], 'files': []},
-      'CMMSRCS': {'exts': ['.mm'], 'files': []},
-      'SSRCS': {'exts': AS_EXTENSIONS, 'files': []},
-      }
-    copy_srcs = []
-    for s in spec.get('sources', []):
-      if not Compilable(s):
-        continue
-
-      # Special-case absolute paths, they'll get copied into the objdir
-      # for compiling.
-      if os.path.isabs(s):
-        # GNU Make falls down pretty badly with spaces in filenames.
-        # Conveniently, using a single-character ? as a wildcard
-        # works fairly well.
-        copy_srcs.append(s.replace(' ', '?'))
-        s = os.path.basename(s)
-
-      ext = os.path.splitext(s)[1]
-      for source_type, d in sources.iteritems():
-        if ext in d['exts']:
-          d['files'].append(s)
-          break
-      
-    for source_type, d in sources.iteritems():
-      if d['files']:
-        data[source_type] = d['files']
-
-    if copy_srcs:
-      data['COPY_SRCS'] = copy_srcs
-
-    if spec['type'] == 'executable':
-      data['PROGRAM'] = spec['target_name']
-    elif spec['type'] == 'static_library':
-      data['LIBRARY_NAME'] = striplib(spec['target_name'])
-      data['FORCE_STATIC_LIB'] = 1
-    elif spec['type'] in ('loadable_module', 'shared_library'):
-      data['LIBRARY_NAME'] = striplib(spec['target_name'])
-      data['FORCE_SHARED_LIB'] = 1
-    else:
-      # Maybe nothing?
-      return False
-    WriteMakefile(output_file, data, build_file, depth, self.topsrcdir,
-                  # we set srcdir up one directory, since the subdir
-                  # doesn't actually exist in the source directory
-                  swapslashes(os.path.normpath(os.path.join(self.topsrcdir, self.relative_srcdir, os.path.split(rel_path)[0]))),
-                  self.relative_srcdir,
-                  self.common_mk_path)
-    return True
-
-def GenerateOutput(target_list, target_dicts, data, params):
-  options = params['options']
-  flavor = GetFlavor(params)
-  generator_flags = params.get('generator_flags', {})
-
-  # Get a few directories into Mozilla-common naming conventions
-  # The root of the source repository.
-  topsrcdir = os.path.abspath(options.toplevel_dir)
-  # The object directory (root of the build).
-  objdir = os.path.abspath(generator_flags['OBJDIR'] if 'OBJDIR' in generator_flags else '.')
-  # A relative path from the objdir to the topsrcdir
-  relative_topsrcdir = gyp.common.RelativePath(topsrcdir, objdir)
-  # The directory containing the gyp file on which gyp was invoked.
-  gyp_file_dir = os.path.abspath(os.path.dirname(params['build_files'][0]) or '.')
-  # The relative path from topsrcdir to gyp_file_dir
-  relative_srcdir = gyp.common.RelativePath(gyp_file_dir, topsrcdir)
-  # The relative path from objdir to gyp_file_dir
-  srcdir = gyp.common.RelativePath(gyp_file_dir, objdir)
-  # The absolute path to the source dir
-  abs_srcdir = topsrcdir + "/" + relative_srcdir
-  # The path to get up to the root of the objdir from the output dir.
-  depth = getdepth(relative_srcdir)
-  # The output directory.
-  output_dir = os.path.abspath(options.generator_output or '.')
-  # The path to the root Makefile
-  makefile_path = os.path.join(output_dir, "Makefile")
-
-  def topsrcdir_path(path):
-    return "$(topsrcdir)/" + swapslashes(gyp.common.RelativePath(path, topsrcdir))
-  def objdir_path(path):
-    return "$(DEPTH)/" + swapslashes(gyp.common.RelativePath(path, objdir))
-
-  # Find the list of targets that derive from the gyp file(s) being built.
-  needed_targets = set()
-  build_files = set()
-  for build_file in params['build_files']:
-    build_file = os.path.normpath(build_file)
-    for target in gyp.common.AllTargets(target_list, target_dicts, build_file):
-      needed_targets.add(target)
-      build_file_, _, _ = gyp.common.ParseQualifiedTarget(target)
-      build_files.add(topsrcdir_path(build_file_))
-
-  common_mk_path = objdir_path(os.path.join(output_dir, "common.mk"))
-
-  generator = MakefileGenerator(target_dicts, data, options, depth, topsrcdir, relative_topsrcdir, relative_srcdir, output_dir, flavor, common_mk_path)
-  generator.ProcessTargets(needed_targets)
-
-  # Write the top-level makefile, which simply calls the other makefiles
-  topdata = {'DIRS': generator.dirs}
-  if generator.parallel_dirs:
-    topdata['PARALLEL_DIRS'] = generator.parallel_dirs
-  WriteMakefile(makefile_path, topdata, params['build_files'][0],
-                depth,
-                swapslashes(topsrcdir),
-                swapslashes(abs_srcdir),
-                swapslashes(relative_srcdir),
-                common_mk_path)
-  scriptname = "$(topsrcdir)/media/webrtc/trunk/tools/gyp/pylib/gyp/generator/mozmake.py"
-  # Reassemble a commandline from parts so that all the paths are correct
-  # NOTE: this MUST match the commandline generated in configure.in!
-  # since we don't see --include statements, duplicate them in FORCE_INCLUDE_FILE lines
-  # Being in a define, they also get used by the common.mk invocation of gyp so they
-  # they don't disappear in the second round of tail-swallowing
-  forced_includes = ""
-  for option in options.defines:
-    if option[:20] == "FORCED_INCLUDE_FILE=":
-      forced_includes += "--include=%s" % option[20:]
-
-  commandline = [topsrcdir_path(sys.argv[0]),
-                 "--format=mozmake",
-                 forced_includes,
-                 "--depth=%s" % topsrcdir_path(options.depth),
-                 "--generator-output=%s" % objdir_path(options.generator_output),
-                 "--toplevel-dir=$(topsrcdir)",
-                 "-G OBJDIR=$(DEPTH)"] + \
-                 ['-G %s' % g for g in options.generator_flags if not g.startswith('OBJDIR=')] + \
-                 ['-D%s' % d for d in options.defines] + \
-                 [topsrcdir_path(b) for b in params['build_files']]
-
-  WriteCommonMk(os.path.join(output_dir, "common.mk"),
-                build_files,
-                scriptname,
-                commandline)
diff --git a/media/webrtc/trunk/tools/gyp/pylib/gyp/input.py b/media/webrtc/trunk/tools/gyp/pylib/gyp/input.py
index 65236671f97a..f211e02c22ae 100644
--- a/media/webrtc/trunk/tools/gyp/pylib/gyp/input.py
+++ b/media/webrtc/trunk/tools/gyp/pylib/gyp/input.py
@@ -1424,6 +1424,10 @@ class DependencyGraphNode(object):
     self.dependencies = []
     self.dependents = []
 
+  # This Mozilla change makes DependencyGraphNode more idempotent.
+  def __hash__(self):
+    return hash(self.ref)
+
   def FlattenToList(self):
     # flat_list is the sorted list of dependencies - actually, the list items
     # are the "ref" attributes of DependencyGraphNodes.  Every target will
diff --git a/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/opus/opus.gypi b/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/opus/opus.gypi
index b60cee549b93..00e77e7d31d0 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/opus/opus.gypi
+++ b/media/webrtc/trunk/webrtc/modules/audio_coding/codecs/opus/opus.gypi
@@ -15,7 +15,7 @@
         ['build_with_mozilla==1', {
           # Mozilla provides its own build of the opus library.
           'include_dirs': [
-            '$(DIST)/include/opus',
+            '/media/libopus/include',
            ]
         }, {
           'dependencies': [
diff --git a/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi
index 9a24f931fdfe..67bc5753eb3b 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi
+++ b/media/webrtc/trunk/webrtc/modules/audio_device/audio_device.gypi
@@ -47,9 +47,6 @@
       ],
       'conditions': [
         ['build_with_mozilla==1', {
-          'include_dirs': [
-            '$(DIST)/include',
-          ],
           'cflags_mozilla': [
             '$(NSPR_CFLAGS)',
           ],
@@ -76,14 +73,16 @@
         }],
         ['OS=="android"', {
           'include_dirs': [
-            '$(topsrcdir)/widget/android',
+            '/widget/android',
             'android',
           ],
         }], # OS==android
         ['moz_widget_toolkit_gonk==1', {
+          'cflags_mozilla': [
+            '-I$(ANDROID_SOURCE)/frameworks/wilhelm/include',
+            '-I$(ANDROID_SOURCE)/system/media/wilhelm/include',
+          ],
           'include_dirs': [
-            '$(ANDROID_SOURCE)/frameworks/wilhelm/include',
-            '$(ANDROID_SOURCE)/system/media/wilhelm/include',
             'android',
           ],
         }], # moz_widget_toolkit_gonk==1
diff --git a/media/webrtc/webrtc_config.gypi b/media/webrtc/webrtc_config.gypi
deleted file mode 100644
index 445d95146181..000000000000
--- a/media/webrtc/webrtc_config.gypi
+++ /dev/null
@@ -1,54 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# definitions to control what gets built in webrtc
-# NOTE!!! if you change something here, due to .gyp files not
-# being reprocessed on .gypi changes, run this before building:
-# "find . -name '*.gyp' | xargs touch"
-{
-  'variables': {
-    'build_with_mozilla': 1,
-    'build_with_chromium': 0,
-    # basic stuff for everything
-    'include_internal_video_render': 0,
-    'clang_use_chrome_plugins': 0,
-    'enable_protobuf': 0,
-    'include_tests': 0,
-    'enable_android_opensl': 1,
-# use_system_lib* still seems to be in use in trunk/build
-    'use_system_libjpeg': 0,
-    'use_system_libvpx': 0,
-    'build_libjpeg': 0,
-    'build_libvpx': 0,
-    # saves 4MB when webrtc_trace is off
-    'enable_lazy_trace_alloc': 1,
-
-    # turn off mandatory use of NEON and instead use NEON detection
-    'arm_neon': 0,
-
-    #if "-D build_with_gonk=1", then set moz_widget_toolkit_gonk to 1
-    'moz_widget_toolkit_gonk': 0,
-    'variables': {
-      'build_with_gonk%': 0,
-    },
-    'conditions': [
-      ['build_with_gonk==1', {
-         'moz_widget_toolkit_gonk': 1,
-      }],
-    ],
-# (for vp8) chromium sets to 0 also
-    'use_temporal_layers': 0,
-# Creates AEC internal sample dump files in current directory
-#    'aec_debug_dump': 1,
-
-    # codec enable/disables:
-    # Note: if you change one here, you must modify layout/media/webrtc/Makefile.in!
-    'include_g711': 1,
-    'include_opus': 1,
-    'include_g722': 0,
-    'include_ilbc': 0,
-    'include_isac': 0,
-    'include_pcm16b': 1,
-  }
-}
diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index c045566232e8..279c390e84b2 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -93,7 +93,6 @@ class BackendMakeFile(object):
         self.fh = FileAvoidWrite(self.name, capture_diff=True)
         self.fh.write('# THIS FILE WAS AUTOMATICALLY GENERATED. DO NOT EDIT.\n')
         self.fh.write('\n')
-        self.fh.write('MOZBUILD_DERIVED := 1\n')
 
     def write(self, buf):
         self.fh.write(buf)
diff --git a/python/mozbuild/mozbuild/frontend/emitter.py b/python/mozbuild/mozbuild/frontend/emitter.py
index 06f98b9de028..27a9bfda88a6 100644
--- a/python/mozbuild/mozbuild/frontend/emitter.py
+++ b/python/mozbuild/mozbuild/frontend/emitter.py
@@ -49,6 +49,8 @@ from .reader import (
     SandboxValidationError,
 )
 
+from .gyp_reader import GypSandbox
+
 
 class TreeMetadataEmitter(LoggingMixin):
     """Converts the executed mozbuild files into data structures.
@@ -91,7 +93,7 @@ class TreeMetadataEmitter(LoggingMixin):
                     raise Exception('Unhandled object of type %s' % type(o))
 
         for out in output:
-            if isinstance(out, MozbuildSandbox):
+            if isinstance(out, (MozbuildSandbox, GypSandbox)):
                 # Keep all sandboxes around, we will need them later.
                 sandboxes[out['OBJDIR']] = out
 
@@ -107,7 +109,7 @@ class TreeMetadataEmitter(LoggingMixin):
                 sandbox_execution_time += out.execution_time
 
             else:
-                raise Exception('Unhandled output type: %s' % out)
+                raise Exception('Unhandled output type: %s' % type(out))
 
         start = time.time()
         objs = list(self._emit_libs_derived(sandboxes))
@@ -209,6 +211,8 @@ class TreeMetadataEmitter(LoggingMixin):
             ANDROID_RES_DIRS='ANDROID_RES_DIRS',
             CPP_UNIT_TESTS='CPP_UNIT_TESTS',
             EXPORT_LIBRARY='EXPORT_LIBRARY',
+            EXTRA_ASSEMBLER_FLAGS='EXTRA_ASSEMBLER_FLAGS',
+            EXTRA_COMPILE_FLAGS='EXTRA_COMPILE_FLAGS',
             EXTRA_COMPONENTS='EXTRA_COMPONENTS',
             EXTRA_JS_MODULES='EXTRA_JS_MODULES',
             EXTRA_PP_COMPONENTS='EXTRA_PP_COMPONENTS',
@@ -220,6 +224,7 @@ class TreeMetadataEmitter(LoggingMixin):
             GENERATED_FILES='GENERATED_FILES',
             HOST_LIBRARY_NAME='HOST_LIBRARY_NAME',
             IS_COMPONENT='IS_COMPONENT',
+            IS_GYP_DIR='IS_GYP_DIR',
             JS_MODULES_PATH='JS_MODULES_PATH',
             LIBS='LIBS',
             LIBXUL_LIBRARY='LIBXUL_LIBRARY',
@@ -229,7 +234,7 @@ class TreeMetadataEmitter(LoggingMixin):
             SDK_LIBRARY='SDK_LIBRARY',
         )
         for mak, moz in varmap.items():
-            if sandbox[moz]:
+            if moz in sandbox and sandbox[moz]:
                 passthru.variables[mak] = sandbox[moz]
 
         # NO_VISIBILITY_FLAGS is slightly different
diff --git a/python/mozbuild/mozbuild/frontend/gyp_reader.py b/python/mozbuild/mozbuild/frontend/gyp_reader.py
new file mode 100644
index 000000000000..2f674f96b3d7
--- /dev/null
+++ b/python/mozbuild/mozbuild/frontend/gyp_reader.py
@@ -0,0 +1,190 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import unicode_literals
+import gyp
+import sys
+import time
+import os
+import mozpack.path as mozpath
+from mozpack.files import FileFinder
+from .sandbox import (
+    alphabetical_sorted,
+    GlobalNamespace,
+)
+from .sandbox_symbols import VARIABLES
+
+# Define this module as gyp.generator.mozbuild so that gyp can use it
+# as a generator under the name "mozbuild".
+sys.modules['gyp.generator.mozbuild'] = sys.modules[__name__]
+
+# build/gyp_chromium does this:
+#   script_dir = os.path.dirname(os.path.realpath(__file__))
+#   chrome_src = os.path.abspath(os.path.join(script_dir, os.pardir))
+#   sys.path.insert(0, os.path.join(chrome_src, 'tools', 'gyp', 'pylib'))
+# We're not importing gyp_chromium, but we want both script_dir and
+# chrome_src for the default includes, so go backwards from the pylib
+# directory, which is the parent directory of gyp module.
+chrome_src = mozpath.abspath(mozpath.join(mozpath.dirname(gyp.__file__),
+    '../../../..'))
+script_dir = mozpath.join(chrome_src, 'build')
+
+# Default variables gyp uses when evaluating gyp files.
+generator_default_variables = {
+}
+for dirname in ['INTERMEDIATE_DIR', 'SHARED_INTERMEDIATE_DIR', 'PRODUCT_DIR',
+                'LIB_DIR', 'SHARED_LIB_DIR']:
+  # Some gyp steps fail if these are empty(!).
+  generator_default_variables[dirname] = b'dir'
+
+for unused in ['RULE_INPUT_PATH', 'RULE_INPUT_ROOT', 'RULE_INPUT_NAME',
+               'RULE_INPUT_DIRNAME', 'RULE_INPUT_EXT',
+               'EXECUTABLE_PREFIX', 'EXECUTABLE_SUFFIX',
+               'STATIC_LIB_PREFIX', 'STATIC_LIB_SUFFIX',
+               'SHARED_LIB_PREFIX', 'SHARED_LIB_SUFFIX',
+               'LINKER_SUPPORTS_ICF']:
+  generator_default_variables[unused] = b''
+
+
+class GypSandbox(GlobalNamespace):
+    """Class mimicking MozbuildSandbox for processing of the data
+    extracted from Gyp by a mozbuild backend.
+
+    Inherits from GlobalNamespace because it doesn't need the extra
+    functionality from Sandbox.
+    """
+    def __init__(self, main_path, dependencies_paths=[]):
+        self.main_path = main_path
+        self.all_paths = set([main_path]) | set(dependencies_paths)
+        self.execution_time = 0
+        GlobalNamespace.__init__(self, allowed_variables=VARIABLES)
+
+    def get_affected_tiers(self):
+        tiers = (VARIABLES[key][3] for key in self if key in VARIABLES)
+        return set(tier for tier in tiers if tier)
+
+
+def encode(value):
+    if isinstance(value, unicode):
+        return value.encode('utf-8')
+    return value
+
+
+def read_from_gyp(config, path, output, vars):
+    """Read a gyp configuration and emits GypSandboxes for the backend to
+    process.
+
+    config is a ConfigEnvironment, path is the path to a root gyp configuration
+    file, output is the base path under which the objdir for the various gyp
+    dependencies will be, and vars a dict of variables to pass to the gyp
+    processor.
+    """
+
+    time_start = time.time()
+
+    # gyp expects plain str instead of unicode. The frontend code gives us
+    # unicode strings, so convert them.
+    path = encode(path)
+    str_vars = dict((name, encode(value)) for name, value in vars.items())
+
+    params = {
+        b'parallel': False,
+        b'generator_flags': {},
+        b'build_files': [path],
+    }
+
+    # Files that gyp_chromium always includes
+    includes = [encode(mozpath.join(script_dir, 'common.gypi'))]
+    finder = FileFinder(chrome_src, find_executables=False)
+    includes.extend(encode(mozpath.join(chrome_src, name))
+        for name, _ in finder.find('*/supplement.gypi'))
+
+    # Read the given gyp file and its dependencies.
+    generator, flat_list, targets, data = \
+        gyp.Load([path], format=b'mozbuild',
+            default_variables=str_vars,
+            includes=includes,
+            depth=encode(mozpath.dirname(path)),
+            params=params)
+
+    # Process all targets from the given gyp files and its dependencies.
+    # The path given to AllTargets needs to use os.sep, while the frontend code
+    # gives us paths normalized with forward slash separator.
+    for target in gyp.common.AllTargets(flat_list, targets, path.replace(b'/', os.sep)):
+        build_file, target_name, toolset = gyp.common.ParseQualifiedTarget(target)
+        # The list of included files returned by gyp are relative to build_file
+        included_files = [mozpath.abspath(mozpath.join(mozpath.dirname(build_file), f))
+                          for f in data[build_file]['included_files']]
+        # Emit a sandbox for each target.
+        sandbox = GypSandbox(mozpath.abspath(build_file), included_files)
+
+        with sandbox.allow_all_writes() as d:
+            topsrcdir = d['TOPSRCDIR'] = config.topsrcdir
+            d['TOPOBJDIR'] = config.topobjdir
+            relsrcdir = d['RELATIVEDIR'] = mozpath.relpath(mozpath.dirname(build_file), config.topsrcdir)
+            d['SRCDIR'] = mozpath.join(topsrcdir, relsrcdir)
+
+            # Each target is given its own objdir. The base of that objdir
+            # is derived from the relative path from the root gyp file path
+            # to the current build_file, placed under the given output
+            # directory. Since several targets can be in a given build_file,
+            # separate them in subdirectories using the build_file basename
+            # and the target_name.
+            reldir  = mozpath.relpath(mozpath.dirname(build_file),
+                                      mozpath.dirname(path))
+            subdir = '%s_%s' % (
+                mozpath.splitext(mozpath.basename(build_file))[0],
+                target_name,
+            )
+            d['OBJDIR'] = mozpath.join(output, reldir, subdir)
+            d['IS_GYP_DIR'] = True
+
+        spec = targets[target]
+
+        # Derive which gyp configuration to use based on MOZ_DEBUG.
+        c = 'Debug' if config.substs['MOZ_DEBUG'] else 'Release'
+        if c not in spec['configurations']:
+            raise RuntimeError('Missing %s gyp configuration for target %s '
+                               'in %s' % (c, target_name, build_file))
+        target_conf = spec['configurations'][c]
+
+        if spec['type'] == 'none':
+            continue
+        elif spec['type'] == 'static_library':
+            sandbox['FORCE_STATIC_LIB'] = True
+            # Remove leading 'lib' from the target_name if any, and use as
+            # library name.
+            name = spec['target_name']
+            if name.startswith('lib'):
+                name = name[3:]
+            # The sandbox expects an unicode string.
+            sandbox['LIBRARY_NAME'] = name.decode('utf-8')
+            # The sandbox expects alphabetical order when adding sources
+            sources = alphabetical_sorted(spec.get('sources', []))
+            # gyp files contain headers in sources lists.
+            sandbox['SOURCES'] = \
+                [f for f in sources if mozpath.splitext(f)[-1] != '.h']
+
+            for define in target_conf.get('defines', []):
+                if '=' in define:
+                    name, value = define.split('=', 1)
+                    sandbox['DEFINES'][name] = value
+                else:
+                    sandbox['DEFINES'][define] = True
+
+            for include in target_conf.get('include_dirs', []):
+                sandbox['LOCAL_INCLUDES'] += [include]
+
+            with sandbox.allow_all_writes() as d:
+                d['EXTRA_ASSEMBLER_FLAGS'] = target_conf.get('asflags_mozilla', [])
+                d['EXTRA_COMPILE_FLAGS'] = target_conf.get('cflags_mozilla', [])
+        else:
+            # Ignore other types than static_library because we don't have
+            # anything using them, and we're not testing them. They can be
+            # added when that becomes necessary.
+            raise NotImplementedError('Unsupported gyp target type: %s' % spec['type'])
+
+        sandbox.execution_time = time.time() - time_start
+        yield sandbox
+        time_start = time.time()
diff --git a/python/mozbuild/mozbuild/frontend/reader.py b/python/mozbuild/mozbuild/frontend/reader.py
index 990cde719e9b..98613fead466 100644
--- a/python/mozbuild/mozbuild/frontend/reader.py
+++ b/python/mozbuild/mozbuild/frontend/reader.py
@@ -59,7 +59,6 @@ from .sandbox_symbols import (
     VARIABLES,
 )
 
-
 if sys.version_info.major == 2:
     text_type = unicode
     type_type = types.TypeType
@@ -734,25 +733,58 @@ class BuildReader(object):
                        ' and '.join(', '.join(matches).rsplit(', ', 1)),
                        's are' if len(matches) > 1 else ' is'))
 
-        yield sandbox
-
-        # Traverse into referenced files.
-
         # We first collect directories populated in variables.
         dir_vars = ['DIRS', 'PARALLEL_DIRS', 'TOOL_DIRS']
 
         if self.config.substs.get('ENABLE_TESTS', False) == '1':
             dir_vars.extend(['TEST_DIRS', 'TEST_TOOL_DIRS'])
 
+        dirs = [(v, sandbox[v]) for v in dir_vars if v in sandbox]
+
+        curdir = mozpath.dirname(path)
+
+        gyp_sandboxes = []
+        for target_dir in sandbox['GYP_DIRS']:
+            gyp_dir = sandbox['GYP_DIRS'][target_dir]
+            for v in ('input', 'variables'):
+                if not getattr(gyp_dir, v):
+                    raise Exception('Missing value for GYP_DIRS["%s"].%s' %
+                        (target_dir, v))
+
+            # The make backend assumes sandboxes for sub-directories are
+            # emitted after their parent, so accumulate the gyp sandboxes.
+            # We could emit the parent sandbox before processing gyp
+            # configuration, but we need to add the gyp objdirs to that sandbox
+            # first.
+            from .gyp_reader import read_from_gyp
+            gyp_sandboxes.extend(read_from_gyp(self.config,
+                                               mozpath.join(curdir, gyp_dir.input),
+                                               mozpath.join(sandbox['OBJDIR'],
+                                               target_dir),
+                                 gyp_dir.variables))
+
+        # Add the gyp subdirectories to DIRS. We don't care about trying to
+        # place some of them in PARALLEL_DIRS because they're only going to be
+        # relevant for the compile and libs tiers. The compile tier is already
+        # parallelized, and the libs tier is always serialized, and will remain
+        # so until the library linking operations are moved out of it, at which
+        # point PARALLEL_DIRS will be irrelevant anyways.
+        for gyp_sandbox in gyp_sandboxes:
+            sandbox['DIRS'].append(mozpath.relpath(gyp_sandbox['OBJDIR'], sandbox['OBJDIR']))
+
+        yield sandbox
+
+        for gyp_sandbox in gyp_sandboxes:
+            yield gyp_sandbox
+
+        # Traverse into referenced files.
+
         # It's very tempting to use a set here. Unfortunately, the recursive
         # make backend needs order preserved. Once we autogenerate all backend
         # files, we should be able to convert this to a set.
         recurse_info = OrderedDict()
-        for var in dir_vars:
-            if not var in sandbox:
-                continue
-
-            for d in sandbox[var]:
+        for var, var_dirs in dirs:
+            for d in var_dirs:
                 if d in recurse_info:
                     raise SandboxValidationError(
                         'Directory (%s) registered multiple times in %s' % (
@@ -783,7 +815,6 @@ class BuildReader(object):
                                        'parent': sandbox['RELATIVEDIR'],
                                        'var': 'DIRS'}
 
-        curdir = mozpath.dirname(path)
         for relpath, child_metadata in recurse_info.items():
             child_path = mozpath.join(curdir, relpath, 'moz.build')
 
diff --git a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
index 45d816cc2477..520fb02666ce 100644
--- a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
+++ b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
@@ -573,6 +573,31 @@ VARIABLES = {
         the $(DIST_SUBDIR) directory of the otherwise default value is used.
         """, 'libs'),
 
+    'GYP_DIRS': (StrictOrderingOnAppendListWithFlagsFactory({
+            'variables': dict,
+            'input': unicode,
+        }), list,
+        """Defines a list of object directories handled by gyp configurations.
+
+        Elements of this list give the relative object directory. For each
+        element of the list, GYP_DIRS may be accessed as a dictionary
+        (GYP_DIRS[foo]). The object this returns has attributes that need to be
+        set to further specify gyp processing:
+            - input, gives the path to the root gyp configuration file for that
+              object directory.
+            - variables, a dictionary containing variables and values to pass
+              to the gyp processor.
+
+        Typical use looks like:
+            GYP_DIRS += ['foo', 'bar']
+            GYP_DIRS['foo'].input = 'foo/foo.gyp'
+            GYP_DIRS['foo'].variables = {
+                'foo': 'bar',
+                (...)
+            }
+            (...)
+        """, None),
+
     'SPHINX_TREES': (dict, dict,
         """Describes what the Sphinx documentation tree will look like.
 
diff --git a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
index f5f8a78b0bb1..c913eb6c2c59 100644
--- a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
+++ b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
@@ -212,7 +212,6 @@ class TestRecursiveMakeBackend(BackendTester):
 
         lines = [l.strip() for l in open(p, 'rt').readlines()[2:]]
         self.assertEqual(lines, [
-            'MOZBUILD_DERIVED := 1',
             'DIRS := dir1',
             'PARALLEL_DIRS := dir2',
             'TEST_DIRS := dir3',
@@ -243,7 +242,6 @@ class TestRecursiveMakeBackend(BackendTester):
         backend_path = mozpath.join(env.topobjdir, 'backend.mk')
         lines = [l.strip() for l in open(backend_path, 'rt').readlines()[2:]]
         self.assertEqual(lines, [
-            'MOZBUILD_DERIVED := 1',
             'DIRS := dir',
             'PARALLEL_DIRS := p_dir',
             'DIRS += external',

From f31e7b8bc42497ae3e45616c39991232f28a56e9 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Thu, 12 Dec 2013 23:41:06 +0900
Subject: [PATCH 018/459] Bug 778236 - Remove EXTERNAL_MAKE_DIRS and
 PARALLEL_EXTERNAL_MAKE_DIRS. r=gps

---
 python/mozbuild/mozbuild/backend/recursivemake.py   | 11 -----------
 python/mozbuild/mozbuild/frontend/data.py           |  4 ----
 python/mozbuild/mozbuild/frontend/emitter.py        |  2 --
 python/mozbuild/mozbuild/frontend/reader.py         |  4 ++--
 .../mozbuild/mozbuild/frontend/sandbox_symbols.py   | 12 ------------
 python/mozbuild/mozbuild/test/backend/common.py     |  5 -----
 .../backend/data/external_make_dirs/Makefile.in     |  0
 .../backend/data/external_make_dirs/dir/Makefile.in |  0
 .../backend/data/external_make_dirs/dir/moz.build   |  0
 .../data/external_make_dirs/external/Makefile.in    |  0
 .../data/external_make_dirs/external/moz.build      |  0
 .../test/backend/data/external_make_dirs/moz.build  |  8 --------
 .../data/external_make_dirs/p_dir/Makefile.in       |  0
 .../backend/data/external_make_dirs/p_dir/moz.build |  0
 .../data/external_make_dirs/p_external/Makefile.in  |  0
 .../data/external_make_dirs/p_external/moz.build    |  0
 .../mozbuild/test/backend/test_recursivemake.py     | 13 -------------
 .../test/frontend/data/traversal-all-vars/moz.build |  3 ---
 .../mozbuild/mozbuild/test/frontend/test_emitter.py |  3 ---
 .../mozbuild/mozbuild/test/frontend/test_sandbox.py |  8 --------
 20 files changed, 2 insertions(+), 71 deletions(-)
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/Makefile.in
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/dir/Makefile.in
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/dir/moz.build
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/external/Makefile.in
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/external/moz.build
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/moz.build
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_dir/Makefile.in
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_dir/moz.build
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_external/Makefile.in
 delete mode 100644 python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_external/moz.build

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index 279c390e84b2..3742ad4f340b 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -891,17 +891,6 @@ class RecursiveMakeBackend(CommonBackend):
             self._traversal.add(backend_file.relobjdir,
                                 tools=relativize(obj.test_tool_dirs))
 
-        if len(obj.external_make_dirs):
-            fh.write('DIRS += %s\n' % ' '.join(obj.external_make_dirs))
-            self._traversal.add(backend_file.relobjdir,
-                                dirs=relativize(obj.external_make_dirs))
-
-        if len(obj.parallel_external_make_dirs):
-            fh.write('PARALLEL_DIRS += %s\n' %
-                ' '.join(obj.parallel_external_make_dirs))
-            self._traversal.add(backend_file.relobjdir,
-                                parallel=relativize(obj.parallel_external_make_dirs))
-
         # The directory needs to be registered whether subdirectories have been
         # registered or not.
         self._traversal.add(backend_file.relobjdir)
diff --git a/python/mozbuild/mozbuild/frontend/data.py b/python/mozbuild/mozbuild/frontend/data.py
index 2820611056dd..4ad4ba1d63ee 100644
--- a/python/mozbuild/mozbuild/frontend/data.py
+++ b/python/mozbuild/mozbuild/frontend/data.py
@@ -102,8 +102,6 @@ class DirectoryTraversal(SandboxDerived):
         'test_tool_dirs',
         'tier_dirs',
         'tier_static_dirs',
-        'external_make_dirs',
-        'parallel_external_make_dirs',
     )
 
     def __init__(self, sandbox):
@@ -116,8 +114,6 @@ class DirectoryTraversal(SandboxDerived):
         self.test_tool_dirs = []
         self.tier_dirs = OrderedDict()
         self.tier_static_dirs = OrderedDict()
-        self.external_make_dirs = []
-        self.parallel_external_make_dirs = []
 
 
 class BaseConfigSubstitution(SandboxDerived):
diff --git a/python/mozbuild/mozbuild/frontend/emitter.py b/python/mozbuild/mozbuild/frontend/emitter.py
index 27a9bfda88a6..d4ffb481f841 100644
--- a/python/mozbuild/mozbuild/frontend/emitter.py
+++ b/python/mozbuild/mozbuild/frontend/emitter.py
@@ -495,8 +495,6 @@ class TreeMetadataEmitter(LoggingMixin):
         o.tool_dirs = sandbox.get('TOOL_DIRS', [])
         o.test_dirs = sandbox.get('TEST_DIRS', [])
         o.test_tool_dirs = sandbox.get('TEST_TOOL_DIRS', [])
-        o.external_make_dirs = sandbox.get('EXTERNAL_MAKE_DIRS', [])
-        o.parallel_external_make_dirs = sandbox.get('PARALLEL_EXTERNAL_MAKE_DIRS', [])
         o.is_tool_dir = sandbox.get('IS_TOOL_DIR', False)
         o.affected_tiers = sandbox.get_affected_tiers()
 
diff --git a/python/mozbuild/mozbuild/frontend/reader.py b/python/mozbuild/mozbuild/frontend/reader.py
index 98613fead466..76ee9d0c866e 100644
--- a/python/mozbuild/mozbuild/frontend/reader.py
+++ b/python/mozbuild/mozbuild/frontend/reader.py
@@ -760,8 +760,8 @@ class BuildReader(object):
             gyp_sandboxes.extend(read_from_gyp(self.config,
                                                mozpath.join(curdir, gyp_dir.input),
                                                mozpath.join(sandbox['OBJDIR'],
-                                               target_dir),
-                                 gyp_dir.variables))
+                                                            target_dir),
+                                               gyp_dir.variables))
 
         # Add the gyp subdirectories to DIRS. We don't care about trying to
         # place some of them in PARALLEL_DIRS because they're only going to be
diff --git a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
index 520fb02666ce..8c70a9589524 100644
--- a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
+++ b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
@@ -384,18 +384,6 @@ VARIABLES = {
         populated by calling add_tier_dir().
         """, None),
 
-    'EXTERNAL_MAKE_DIRS': (list, list,
-        """Directories that build with make but don't use moz.build files.
-
-        This is like ``DIRS`` except it implies that ``make`` is used to build the
-        directory and that the directory does not define itself with moz.build
-        files.
-        """, None),
-
-    'PARALLEL_EXTERNAL_MAKE_DIRS': (list, list,
-        """Parallel version of ``EXTERNAL_MAKE_DIRS``.
-        """, None),
-
     'CONFIGURE_SUBST_FILES': (StrictOrderingOnAppendList, list,
         """Output files that will be generated using configure-like substitution.
 
diff --git a/python/mozbuild/mozbuild/test/backend/common.py b/python/mozbuild/mozbuild/test/backend/common.py
index 706eadd34d9d..7da9ac11330d 100644
--- a/python/mozbuild/mozbuild/test/backend/common.py
+++ b/python/mozbuild/mozbuild/test/backend/common.py
@@ -42,11 +42,6 @@ CONFIGS = {
             ('MOZ_BAR', 'bar'),
         ],
     },
-    'external_make_dirs': {
-        'defines': [],
-        'non_global_defines': [],
-        'substs': [],
-    },
     'substitute_config_files': {
         'defines': [],
         'non_global_defines': [],
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/Makefile.in b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/Makefile.in
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/dir/Makefile.in b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/dir/Makefile.in
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/dir/moz.build b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/dir/moz.build
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/external/Makefile.in b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/external/Makefile.in
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/external/moz.build b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/external/moz.build
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/moz.build b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/moz.build
deleted file mode 100644
index c3faea5a47f5..000000000000
--- a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/moz.build
+++ /dev/null
@@ -1,8 +0,0 @@
-# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
-# Any copyright is dedicated to the Public Domain.
-# http://creativecommons.org/publicdomain/zero/1.0/
-
-DIRS = ['dir']
-PARALLEL_DIRS = ['p_dir']
-EXTERNAL_MAKE_DIRS = ['external']
-PARALLEL_EXTERNAL_MAKE_DIRS = ['p_external']
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_dir/Makefile.in b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_dir/Makefile.in
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_dir/moz.build b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_dir/moz.build
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_external/Makefile.in b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_external/Makefile.in
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_external/moz.build b/python/mozbuild/mozbuild/test/backend/data/external_make_dirs/p_external/moz.build
deleted file mode 100644
index e69de29bb2d1..000000000000
diff --git a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
index c913eb6c2c59..005c358a7bdf 100644
--- a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
+++ b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
@@ -235,19 +235,6 @@ class TestRecursiveMakeBackend(BackendTester):
         self.assertEqual(os.path.getmtime(makefile_path), makefile_mtime)
         self.assertEqual(os.path.getmtime(backend_path), backend_mtime)
 
-    def test_external_make_dirs(self):
-        """Ensure we have make recursion into external make directories."""
-        env = self._consume('external_make_dirs', RecursiveMakeBackend)
-
-        backend_path = mozpath.join(env.topobjdir, 'backend.mk')
-        lines = [l.strip() for l in open(backend_path, 'rt').readlines()[2:]]
-        self.assertEqual(lines, [
-            'DIRS := dir',
-            'PARALLEL_DIRS := p_dir',
-            'DIRS += external',
-            'PARALLEL_DIRS += p_external',
-        ])
-
     def test_substitute_config_files(self):
         """Ensure substituted config files are produced."""
         env = self._consume('substitute_config_files', RecursiveMakeBackend)
diff --git a/python/mozbuild/mozbuild/test/frontend/data/traversal-all-vars/moz.build b/python/mozbuild/mozbuild/test/frontend/data/traversal-all-vars/moz.build
index d3023636a45d..260f5be06674 100644
--- a/python/mozbuild/mozbuild/test/frontend/data/traversal-all-vars/moz.build
+++ b/python/mozbuild/mozbuild/test/frontend/data/traversal-all-vars/moz.build
@@ -7,6 +7,3 @@ PARALLEL_DIRS = ['parallel']
 TEST_DIRS = ['test']
 TEST_TOOL_DIRS = ['test_tool']
 TOOL_DIRS = ['tool']
-EXTERNAL_MAKE_DIRS = ['external_make']
-PARALLEL_EXTERNAL_MAKE_DIRS = ['parallel_external_make']
-
diff --git a/python/mozbuild/mozbuild/test/frontend/test_emitter.py b/python/mozbuild/mozbuild/test/frontend/test_emitter.py
index b84d5d82a7cc..8da848d565c5 100644
--- a/python/mozbuild/mozbuild/test/frontend/test_emitter.py
+++ b/python/mozbuild/mozbuild/test/frontend/test_emitter.py
@@ -102,9 +102,6 @@ class TestEmitterBasic(unittest.TestCase):
                 self.assertEqual(o.test_dirs, ['test'])
                 self.assertEqual(o.test_tool_dirs, ['test_tool'])
                 self.assertEqual(o.tool_dirs, ['tool'])
-                self.assertEqual(o.external_make_dirs, ['external_make'])
-                self.assertEqual(o.parallel_external_make_dirs,
-                    ['parallel_external_make'])
 
     def test_tier_simple(self):
         reader = self.reader('traversal-tier-simple')
diff --git a/python/mozbuild/mozbuild/test/frontend/test_sandbox.py b/python/mozbuild/mozbuild/test/frontend/test_sandbox.py
index f83b78b905da..4bca7010099f 100644
--- a/python/mozbuild/mozbuild/test/frontend/test_sandbox.py
+++ b/python/mozbuild/mozbuild/test/frontend/test_sandbox.py
@@ -285,14 +285,6 @@ add_tier_dir('t1', 'bat', static=True)
 
         self.assertEqual(sandbox['DIRS'], ['foo'])
 
-    def test_external_make_dirs(self):
-        sandbox = self.sandbox()
-        sandbox.exec_source('EXTERNAL_MAKE_DIRS += ["foo"]', 'test.py')
-        sandbox.exec_source('PARALLEL_EXTERNAL_MAKE_DIRS += ["bar"]', 'test.py')
-
-        self.assertEqual(sandbox['EXTERNAL_MAKE_DIRS'], ['foo'])
-        self.assertEqual(sandbox['PARALLEL_EXTERNAL_MAKE_DIRS'], ['bar'])
-
     def test_error(self):
         sandbox = self.sandbox()
 

From f228b7ff3f819153a84b2ed88271b78fc8ae9ed4 Mon Sep 17 00:00:00 2001
From: Dave Hunt <dhunt@mozilla.com>
Date: Thu, 12 Dec 2013 10:26:37 -0500
Subject: [PATCH 019/459] Bug 949401 - Marionette python client is missing
 resources from latest marionette_client 0.7.0, r=mdas

---
 testing/marionette/client/MANIFEST.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testing/marionette/client/MANIFEST.in b/testing/marionette/client/MANIFEST.in
index 091d4d73a649..9e70dc42a2f6 100644
--- a/testing/marionette/client/MANIFEST.in
+++ b/testing/marionette/client/MANIFEST.in
@@ -1,2 +1,3 @@
 recursive-include marionette/touch *.js
+recursive-include marionette/runner/mixins/resources *
 exclude MANIFEST.in

From 6070fe07e3ba89aacc3ee0fb521364beda1aab1d Mon Sep 17 00:00:00 2001
From: Dave Hunt <dhunt@mozilla.com>
Date: Thu, 12 Dec 2013 10:30:17 -0500
Subject: [PATCH 020/459] Bug 949406 - Bump marionette_client version to 0.7.1,
 r=mdas

---
 testing/marionette/client/setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/marionette/client/setup.py b/testing/marionette/client/setup.py
index 6d8443d80464..bdd2d5bb0463 100644
--- a/testing/marionette/client/setup.py
+++ b/testing/marionette/client/setup.py
@@ -1,7 +1,7 @@
 import os
 from setuptools import setup, find_packages
 
-version = '0.7.0'
+version = '0.7.1'
 
 # get documentation from the README
 try:

From 3c69d60dd6f5d38ec12abfe9f13340c8f2048363 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 16:43:52 +0100
Subject: [PATCH 021/459] Bug 879402 - Use template object to faster set the
 input and index properties on CreateRegExpMatchResult, r=bhackett

---
 js/src/builtin/RegExp.cpp  | 41 ++++++++++++++++++++++----------------
 js/src/jsarray.cpp         | 32 +++++++++++++++++++++++++++++
 js/src/jsarray.h           |  7 +++++++
 js/src/jsobjinlines.h      | 14 ++++++++++++-
 js/src/vm/RegExpObject.cpp | 39 +++++++++++++++++++++++++++++++++++-
 js/src/vm/RegExpObject.h   | 10 ++++++++++
 6 files changed, 124 insertions(+), 19 deletions(-)

diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index 4c817d66dc3b..15dded23cbdb 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -18,13 +18,6 @@ using namespace js::types;
 
 using mozilla::ArrayLength;
 
-static inline bool
-DefinePropertyHelper(JSContext *cx, HandleObject obj, Handle<PropertyName*> name, HandleValue v)
-{
-    return !!baseops::DefineProperty(cx, obj, name, v,
-                                     JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE);
-}
-
 bool
 js::CreateRegExpMatchResult(JSContext *cx, HandleString input_, const jschar *chars, size_t length,
                             MatchPairs &matches, MutableHandleValue rval)
@@ -69,22 +62,36 @@ js::CreateRegExpMatchResult(JSContext *cx, HandleString input_, const jschar *ch
         }
     }
 
+    /* Get the templateObject that defines the shape and type of the output object */
+    JSObject *templateObject = cx->compartment()->regExps.getOrCreateMatchResultTemplateObject(cx);
+    if (!templateObject)
+        return false;
+
     /* Copy the rooted vector into the array object. */
-    RootedObject array(cx, NewDenseCopiedArray(cx, elements.length(), elements.begin()));
-    if (!array)
-        return false;
+    RootedObject arr(cx, NewDenseCopiedArrayWithTemplate(cx, elements.length(), elements.begin(),
+                                                         templateObject));
 
-    /* Set the |index| property. */
+    /* Set the |index| property. (TemplateObject positions it in slot 0) */
     RootedValue index(cx, Int32Value(matches[0].start));
-    if (!DefinePropertyHelper(cx, array, cx->names().index, index))
-        return false;
+    arr->nativeSetSlot(0, index);
 
-    /* Set the |input| property. */
+    /* Set the |input| property. (TemplateObject positions it in slot 1) */
     RootedValue inputVal(cx, StringValue(input));
-    if (!DefinePropertyHelper(cx, array, cx->names().input, inputVal))
-        return false;
+    arr->nativeSetSlot(1, inputVal);
 
-    rval.setObject(*array);
+#ifdef DEBUG
+    RootedValue test(cx);
+    RootedId id(cx, NameToId(cx->names().index));
+    if (!baseops::GetProperty(cx, arr, id, &test))
+        return false;
+    JS_ASSERT(test == index);
+    id = NameToId(cx->names().input);
+    if (!baseops::GetProperty(cx, arr, id, &test))
+        return false;
+    JS_ASSERT(test == inputVal);
+#endif
+
+    rval.setObject(*arr);
     return true;
 }
 
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 002af3e2435c..85b3f2b0b194 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -3295,6 +3295,38 @@ js::NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values,
     return arr;
 }
 
+ArrayObject *
+js::NewDenseCopiedArrayWithTemplate(JSContext *cx, uint32_t length, const Value *values,
+                                    JSObject *templateObject)
+{
+    gc::AllocKind allocKind = GuessArrayGCKind(length);
+    JS_ASSERT(CanBeFinalizedInBackground(allocKind, &ArrayObject::class_));
+    allocKind = GetBackgroundAllocKind(allocKind);
+
+    RootedTypeObject type(cx, templateObject->type());
+    if (!type)
+        return nullptr;
+
+    RootedShape shape(cx, templateObject->lastProperty());
+    if (!shape)
+        return nullptr;
+
+    gc::InitialHeap heap = GetInitialHeap(GenericObject, &ArrayObject::class_);
+    Rooted<ArrayObject *> arr(cx, JSObject::createArray(cx, allocKind, heap, shape, type, length));
+    if (!arr)
+        return nullptr;
+
+    if (!EnsureNewArrayElements(cx, arr, length))
+        return nullptr;
+
+    arr->setDenseInitializedLength(length);
+    arr->initDenseElements(0, values, length);
+
+    probes::CreateObject(cx, arr);
+
+    return arr;
+}
+
 #ifdef DEBUG
 bool
 js_ArrayInfo(JSContext *cx, unsigned argc, Value *vp)
diff --git a/js/src/jsarray.h b/js/src/jsarray.h
index f41faba728fd..cf64ffbefc4d 100644
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -70,6 +70,13 @@ extern ArrayObject *
 NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, JSObject *proto = nullptr,
                     NewObjectKind newKind = GenericObject);
 
+/*
+ * Create a dense array based on templateObject from the given array values,
+ * which must be rooted.
+ */
+extern ArrayObject *
+NewDenseCopiedArrayWithTemplate(JSContext *cx, uint32_t length, const Value *values,
+                                JSObject *templateObject);
 /*
  * Determines whether a write to the given element on |obj| should fail because
  * |obj| is an Array with a non-writable length, and writing that element would
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 2eb4e64ce7bd..42c5d31eeb60 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -500,12 +500,24 @@ JSObject::createArray(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::
     if (!obj)
         return nullptr;
 
+    js::HeapSlot *slots = nullptr;
+    if (size_t nDynamicSlots = dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan())) {
+        slots = cx->pod_malloc<js::HeapSlot>(nDynamicSlots);
+        if (!slots)
+            return nullptr;
+        js::Debug_SetSlotRangeToCrashOnTouch(slots, nDynamicSlots);
+    }
+
     obj->shape_.init(shape);
     obj->type_.init(type);
-    obj->slots = nullptr;
+    obj->slots = slots;
     obj->setFixedElements();
     new (obj->getElementsHeader()) js::ObjectElements(capacity, length);
 
+    size_t span = shape->slotSpan();
+    if (span)
+        obj->initializeSlotRange(0, span);
+
     return &obj->as<js::ArrayObject>();
 }
 
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index 36edd78f11bf..f3ac68f68dff 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -20,6 +20,8 @@
 #include "vm/Shape-inl.h"
 
 using namespace js;
+
+using mozilla::DebugOnly;
 using js::frontend::TokenStream;
 
 JS_STATIC_ASSERT(IgnoreCaseFlag == JSREG_FOLD);
@@ -630,7 +632,7 @@ RegExpShared::executeMatchOnly(JSContext *cx, const jschar *chars, size_t length
 /* RegExpCompartment */
 
 RegExpCompartment::RegExpCompartment(JSRuntime *rt)
-  : map_(rt), inUse_(rt)
+  : map_(rt), inUse_(rt), matchResultTemplateObject_(nullptr)
 {}
 
 RegExpCompartment::~RegExpCompartment()
@@ -639,6 +641,39 @@ RegExpCompartment::~RegExpCompartment()
     JS_ASSERT(inUse_.empty());
 }
 
+HeapPtrObject &
+RegExpCompartment::getOrCreateMatchResultTemplateObject(JSContext *cx)
+{
+    if (matchResultTemplateObject_)
+        return matchResultTemplateObject_;
+
+    /* Create template array object */
+    RootedObject templateObject(cx, NewDenseUnallocatedArray(cx, 0, nullptr, TenuredObject));
+
+    /* Set dummy index property */
+    RootedValue index(cx, Int32Value(0));
+    if (!baseops::DefineProperty(cx, templateObject, cx->names().index, index,
+                                 JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE))
+        return matchResultTemplateObject_; // = nullptr
+
+    /* Set dummy input property */
+    RootedValue inputVal(cx, StringValue(cx->runtime()->emptyString));
+    if (!baseops::DefineProperty(cx, templateObject, cx->names().input, inputVal,
+                                 JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE))
+        return matchResultTemplateObject_; // = nullptr
+
+    // Make sure that the properties are in the right slots.
+    DebugOnly<Shape *> shape = templateObject->lastProperty();
+    JS_ASSERT(shape->previous()->slot() == 0 &&
+              shape->previous()->propidRef() == NameToId(cx->names().index));
+    JS_ASSERT(shape->slot() == 1 &&
+              shape->propidRef() == NameToId(cx->names().input));
+
+    matchResultTemplateObject_ = templateObject;
+
+    return matchResultTemplateObject_;
+}
+
 bool
 RegExpCompartment::init(JSContext *cx)
 {
@@ -669,6 +704,8 @@ RegExpCompartment::sweep(JSRuntime *rt)
             e.removeFront();
         }
     }
+
+    matchResultTemplateObject_ = nullptr;
 }
 
 void
diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
index f80541e3255a..02e6ea881ac2 100644
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -318,6 +318,13 @@ class RegExpCompartment
     typedef HashSet<RegExpShared *, DefaultHasher<RegExpShared*>, RuntimeAllocPolicy> PendingSet;
     PendingSet inUse_;
 
+    /*
+     * This is the template object where the result of re.exec() is based on,
+     * if there is a result. This is used in CreateRegExpMatchResult to set
+     * the input/index properties faster.
+     */
+    HeapPtrObject matchResultTemplateObject_;
+
   public:
     RegExpCompartment(JSRuntime *rt);
     ~RegExpCompartment();
@@ -331,6 +338,9 @@ class RegExpCompartment
     /* Like 'get', but compile 'maybeOpt' (if non-null). */
     bool get(JSContext *cx, HandleAtom source, JSString *maybeOpt, RegExpGuard *g);
 
+    /* Get or create template object used to base the result of .exec() on. */
+    HeapPtrObject &getOrCreateMatchResultTemplateObject(JSContext *cx);
+
     size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf);
 };
 

From 2d7afabc14c8adbb8f48b951d2786176139d826f Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Mon, 9 Dec 2013 20:54:49 +0100
Subject: [PATCH 022/459] Bug 944707 - Stop locking when getting the preferred
 samplerate from the AudioStream. r=kinetik

--HG--
extra : rebase_source : bbf7b305d13f252e7c743bb9abf12da078db865b
---
 content/media/AudioStream.cpp           | 30 +++++++++----------------
 content/media/AudioStream.h             |  7 ++++--
 content/media/MediaStreamGraph.cpp      |  7 ++++++
 content/media/MediaStreamGraphImpl.h    |  4 ++++
 content/media/webaudio/AudioContext.cpp | 13 ++++++++++-
 5 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/content/media/AudioStream.cpp b/content/media/AudioStream.cpp
index 9e02f77cb2df..0955272938a7 100644
--- a/content/media/AudioStream.cpp
+++ b/content/media/AudioStream.cpp
@@ -76,6 +76,15 @@ bool AudioStream::sCubebLatencyPrefSet;
   return GetCubebContextUnlocked();
 }
 
+/*static*/ void AudioStream::InitPreferredSampleRate()
+{
+  StaticMutexAutoLock lock(sMutex);
+  if (sPreferredSampleRate != 0 ||
+      cubeb_get_preferred_sample_rate(GetCubebContextUnlocked(), &sPreferredSampleRate) != CUBEB_OK) {
+    sPreferredSampleRate = 44100;
+  }
+}
+
 /*static*/ cubeb* AudioStream::GetCubebContextUnlocked()
 {
   sMutex.AssertCurrentThreadOwns();
@@ -266,25 +275,8 @@ int64_t AudioStream::GetWritten()
 
 /*static*/ int AudioStream::PreferredSampleRate()
 {
-  const int fallbackSampleRate = 44100;
-  StaticMutexAutoLock lock(sMutex);
-  if (sPreferredSampleRate != 0) {
-    return sPreferredSampleRate;
-  }
-
-  cubeb* cubebContext = GetCubebContextUnlocked();
-  if (!cubebContext) {
-    sPreferredSampleRate = fallbackSampleRate;
-  }
-  // Get the preferred samplerate for this platform, or fallback to something
-  // sensible if we fail. We cache the value, because this might be accessed
-  // often, and the complexity of the function call below depends on the
-  // backend used.
-  if (cubeb_get_preferred_sample_rate(cubebContext,
-                                      &sPreferredSampleRate) != CUBEB_OK) {
-    sPreferredSampleRate = fallbackSampleRate;
-  }
-
+  MOZ_ASSERT(sPreferredSampleRate,
+             "sPreferredSampleRate has not been initialized!");
   return sPreferredSampleRate;
 }
 
diff --git a/content/media/AudioStream.h b/content/media/AudioStream.h
index fc040020c32a..2739de44082c 100644
--- a/content/media/AudioStream.h
+++ b/content/media/AudioStream.h
@@ -179,8 +179,11 @@ public:
   // Returns the maximum number of channels supported by the audio hardware.
   static int MaxNumberOfChannels();
 
-  // Returns the samplerate the systems prefer, because it is the
-  // samplerate the hardware/mixer supports.
+  // Queries the samplerate the hardware/mixer runs at, and stores it.
+  // Can be called on any thread. When this returns, it is safe to call
+  // PreferredSampleRate without locking.
+  static void InitPreferredSampleRate();
+  // Get the aformentionned sample rate. Does not lock.
   static int PreferredSampleRate();
 
   AudioStream();
diff --git a/content/media/MediaStreamGraph.cpp b/content/media/MediaStreamGraph.cpp
index 671db6eeaf2f..db8fd8c577c3 100644
--- a/content/media/MediaStreamGraph.cpp
+++ b/content/media/MediaStreamGraph.cpp
@@ -1328,6 +1328,12 @@ MediaStreamGraphImpl::ForceShutDown()
   }
 }
 
+void
+MediaStreamGraphImpl::Init()
+{
+  AudioStream::InitPreferredSampleRate();
+}
+
 namespace {
 
 class MediaStreamGraphInitThreadRunnable : public nsRunnable {
@@ -1340,6 +1346,7 @@ public:
   {
     char aLocal;
     profiler_register_thread("MediaStreamGraph", &aLocal);
+    mGraph->Init();
     mGraph->RunThread();
     return NS_OK;
   }
diff --git a/content/media/MediaStreamGraphImpl.h b/content/media/MediaStreamGraphImpl.h
index c8cd27a8b1be..76b036e1c4df 100644
--- a/content/media/MediaStreamGraphImpl.h
+++ b/content/media/MediaStreamGraphImpl.h
@@ -150,6 +150,10 @@ public:
    */
   void ShutdownThreads();
 
+  /**
+   * Called before the thread runs.
+   */
+  void Init();
   // The following methods run on the graph thread (or possibly the main thread if
   // mLifecycleState > LIFECYCLE_RUNNING)
   /**
diff --git a/content/media/webaudio/AudioContext.cpp b/content/media/webaudio/AudioContext.cpp
index c757d574a6b4..f269163652f7 100644
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -34,6 +34,7 @@
 #include "ConvolverNode.h"
 #include "OscillatorNode.h"
 #include "nsNetUtil.h"
+#include "AudioStream.h"
 
 namespace mozilla {
 namespace dom {
@@ -65,12 +66,22 @@ NS_INTERFACE_MAP_END_INHERITING(nsDOMEventTargetHelper)
 
 static uint8_t gWebAudioOutputKey;
 
+float GetSampleRateForAudioContext(bool aIsOffline, float aSampleRate)
+{
+  if (aIsOffline) {
+    return aSampleRate;
+  } else {
+    AudioStream::InitPreferredSampleRate();
+    return static_cast<float>(AudioStream::PreferredSampleRate());
+  }
+}
+
 AudioContext::AudioContext(nsPIDOMWindow* aWindow,
                            bool aIsOffline,
                            uint32_t aNumberOfChannels,
                            uint32_t aLength,
                            float aSampleRate)
-  : mSampleRate(aIsOffline ? aSampleRate : IdealAudioRate())
+  : mSampleRate(GetSampleRateForAudioContext(aIsOffline, aSampleRate))
   , mNumberOfChannels(aNumberOfChannels)
   , mIsOffline(aIsOffline)
   , mIsStarted(!aIsOffline)

From 371ad746eb72aac3fd9e38b71eec450c12f49d29 Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Thu, 12 Dec 2013 15:31:51 +0100
Subject: [PATCH 023/459] Bug 916384 - Stop calling onaudioprocess on the
 ScriptProcessorNode it has no inputs or outputs. r=roc

Quoting the spec: "audioprocess events are only dispatched if the
ScriptProcessorNode has at least one input or one output connected".

--HG--
extra : rebase_source : bbf52a183a55b75d394a885624a4080a9467fac4
---
 content/media/MediaStreamGraph.h              |  8 +++++
 .../media/webaudio/ScriptProcessorNode.cpp    | 31 +++++++++++++++++
 content/media/webaudio/test/mochitest.ini     |  1 +
 .../test_scriptProcessorNodeNotConnected.html | 33 +++++++++++++++++++
 ...st_scriptProcessorNodeZeroInputOutput.html |  2 ++
 5 files changed, 75 insertions(+)
 create mode 100644 content/media/webaudio/test/test_scriptProcessorNodeNotConnected.html

diff --git a/content/media/MediaStreamGraph.h b/content/media/MediaStreamGraph.h
index 928713309b77..8d4c802100f3 100644
--- a/content/media/MediaStreamGraph.h
+++ b/content/media/MediaStreamGraph.h
@@ -445,6 +445,10 @@ public:
   {
     mConsumers.RemoveElement(aPort);
   }
+  uint32_t ConsumerCount()
+  {
+    return mConsumers.Length();
+  }
   const StreamBuffer& GetStreamBuffer() { return mBuffer; }
   GraphTime GetStreamBufferStartTime() { return mBufferStartTime; }
   /**
@@ -944,6 +948,10 @@ public:
   {
     return mInputs.Contains(aPort);
   }
+  uint32_t InputPortCount()
+  {
+    return mInputs.Length();
+  }
   virtual void DestroyImpl();
   /**
    * This gets called after we've computed the blocking states for all
diff --git a/content/media/webaudio/ScriptProcessorNode.cpp b/content/media/webaudio/ScriptProcessorNode.cpp
index 5b31c878e1da..94f5720dda74 100644
--- a/content/media/webaudio/ScriptProcessorNode.cpp
+++ b/content/media/webaudio/ScriptProcessorNode.cpp
@@ -67,6 +67,13 @@ private:
       return front;
     }
 
+    // Empties the buffer queue.
+    void Clear()
+    {
+      mMutex.AssertCurrentThreadOwns();
+      mBufferList.clear();
+    }
+
   private:
     typedef std::deque<AudioChunk> BufferList;
 
@@ -167,6 +174,18 @@ public:
     return mDelaySoFar == TRACK_TICKS_MAX ? 0 : mDelaySoFar;
   }
 
+  void Reset()
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+    mDelaySoFar = TRACK_TICKS_MAX;
+    mLatency = 0.0f;
+    {
+      MutexAutoLock lock(mOutputQueue.Lock());
+      mOutputQueue.Clear();
+    }
+    mLastEventTime = TimeStamp();
+  }
+
 private:
   OutputQueue mOutputQueue;
   // How much delay we've seen so far.  This measures the amount of delay
@@ -224,6 +243,18 @@ public:
       return;
     }
 
+    // This node is not connected to anything. Per spec, we don't fire the
+    // onaudioprocess event. We also want to clear out the input and output
+    // buffer queue, and output a null buffer.
+    if (!(aStream->ConsumerCount() ||
+          aStream->AsProcessedStream()->InputPortCount())) {
+      aOutput->SetNull(WEBAUDIO_BLOCK_SIZE);
+      mSharedBuffers->Reset();
+      mSeenNonSilenceInput = false;
+      mInputWriteIndex = 0;
+      return;
+    }
+
     // First, record our input buffer
     for (uint32_t i = 0; i < mInputChannels.Length(); ++i) {
       if (aInput.IsNull()) {
diff --git a/content/media/webaudio/test/mochitest.ini b/content/media/webaudio/test/mochitest.ini
index 4f90f304440e..2a7590942710 100644
--- a/content/media/webaudio/test/mochitest.ini
+++ b/content/media/webaudio/test/mochitest.ini
@@ -108,6 +108,7 @@ support-files =
 [test_scriptProcessorNode.html]
 [test_scriptProcessorNodeChannelCount.html]
 [test_scriptProcessorNodeZeroInputOutput.html]
+[test_scriptProcessorNodeNotConnected.html]
 [test_singleSourceDest.html]
 [test_waveShaper.html]
 [test_waveShaperNoCurve.html]
diff --git a/content/media/webaudio/test/test_scriptProcessorNodeNotConnected.html b/content/media/webaudio/test/test_scriptProcessorNodeNotConnected.html
new file mode 100644
index 000000000000..b2a0e97f8c33
--- /dev/null
+++ b/content/media/webaudio/test/test_scriptProcessorNodeNotConnected.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test AudioBufferSourceNode: should not fire audioprocess if not connected.</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="webaudio.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(function() {
+  var context = new AudioContext();
+
+  var sp = context.createScriptProcessor(2048, 2, 2);
+  sp.onaudioprocess = function(e) {
+    ok(false, "Should not call onaudioprocess if the node is not connected.");
+    sp.onaudioprocess = null;
+    SimpleTest.finish();
+  };
+  setTimeout(function() {
+    console.log(sp.onaudioprocess);
+    if (sp.onaudioprocess) {
+      ok(true, "onaudioprocess not fired.");
+      SimpleTest.finish();
+    }
+  }, 4000);
+});
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/webaudio/test/test_scriptProcessorNodeZeroInputOutput.html b/content/media/webaudio/test/test_scriptProcessorNodeZeroInputOutput.html
index 393ce4b385af..6ac8beda0a54 100644
--- a/content/media/webaudio/test/test_scriptProcessorNodeZeroInputOutput.html
+++ b/content/media/webaudio/test/test_scriptProcessorNodeZeroInputOutput.html
@@ -28,7 +28,9 @@ addLoadEvent(function() {
 
       SimpleTest.finish();
     };
+    sp.connect(context.destination);
   };
+  sp.connect(context.destination);
 });
 
 </script>

From e567c68e9131f48f0346be8f1b9c8b545e809079 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 12 Dec 2013 11:25:41 -0500
Subject: [PATCH 024/459] Backed out changeset a2e719af19a2 (bug 948777)
 because of mochitest-3 crashes on Windows XP

---
 netwerk/sctp/src/moz.build | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/netwerk/sctp/src/moz.build b/netwerk/sctp/src/moz.build
index b4186410660e..1d7f90da74de 100644
--- a/netwerk/sctp/src/moz.build
+++ b/netwerk/sctp/src/moz.build
@@ -10,7 +10,7 @@ EXPORTS.mozilla.net += [
     'usrsctp.h',
 ]
 
-UNIFIED_SOURCES += [
+SOURCES += [
     'netinet/sctp_asconf.c',
     'netinet/sctp_auth.c',
     'netinet/sctp_bsd_addr.c',
@@ -20,12 +20,14 @@ UNIFIED_SOURCES += [
     'netinet/sctp_hashdriver.c',
     'netinet/sctp_indata.c',
     'netinet/sctp_input.c',
+    'netinet/sctp_output.c',
     'netinet/sctp_pcb.c',
     'netinet/sctp_peeloff.c',
     'netinet/sctp_sha1.c',
     'netinet/sctp_ss_functions.c',
     'netinet/sctp_sysctl.c',
     'netinet/sctp_timer.c',
+    'netinet/sctp_userspace.c',
     'netinet/sctp_usrreq.c',
     'netinet/sctputil.c',
     'netinet6/sctp6_usrreq.c',
@@ -33,19 +35,9 @@ UNIFIED_SOURCES += [
     'user_mbuf.c',
     'user_recv_thread.c',
     'user_sctp_timer_iterate.c',
-]
-
-# These files cannot be built in unified mode because they rely on __FAVOR_BSD in udp.h.
-SOURCES += [
-    'netinet/sctp_output.c',
     'user_socket.c',
 ]
 
-# This file cannot be built in unified mode because of compilation failures on Windows.
-SOURCES += [
-    'netinet/sctp_userspace.c',
-]
-
 if CONFIG['OS_TARGET'] == 'Android':
     SOURCES += [
         'ifaddrs_android.cpp',

From e9e9c7d188f476b0c2c6a3c897ecc92a24a59145 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 12 Dec 2013 11:26:24 -0500
Subject: [PATCH 025/459] Backed out changeset 6d9cf51a012a (bug 949360)
 because of mochitest-3 timeouts on a CLOSED TREE

---
 gfx/layers/ImageContainer.cpp             | 16 ++++++----------
 gfx/layers/ipc/SharedPlanarYCbCrImage.cpp | 20 ++++++++------------
 2 files changed, 14 insertions(+), 22 deletions(-)

diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index e977f69143be..8d51ce7c6944 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -490,17 +490,14 @@ PlanarYCbCrImage::CopyData(const Data& aData)
   mData = aData;
 
   // update buffer size
-  size_t size = mData.mCbCrStride * mData.mCbCrSize.height * 2 +
+  mBufferSize = mData.mCbCrStride * mData.mCbCrSize.height * 2 +
                 mData.mYStride * mData.mYSize.height;
 
   // get new buffer
-  mBuffer = AllocateBuffer(size);
+  mBuffer = AllocateBuffer(mBufferSize);
   if (!mBuffer)
     return;
 
-  // update buffer size
-  mBufferSize = size;
-
   mData.mYChannel = mBuffer;
   mData.mCbChannel = mData.mYChannel + mData.mYStride * mData.mYSize.height;
   mData.mCrChannel = mData.mCbChannel + mData.mCbCrStride * mData.mCbCrSize.height;
@@ -539,12 +536,11 @@ PlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 uint8_t*
 PlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
+  // update buffer size
+  mBufferSize = aSize;
+
   // get new buffer
-  mBuffer = AllocateBuffer(aSize);
-  if (mBuffer) {
-    // update buffer size
-    mBufferSize = aSize;
-  }
+  mBuffer = AllocateBuffer(mBufferSize); 
   return mBuffer;
 }
 
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index 3f7e969a1cf6..a842f5d7ee00 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -126,16 +126,14 @@ SharedPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
   NS_ABORT_IF_FALSE(!mTextureClient->IsAllocated(), "This image already has allocated data");
   size_t size = YCbCrImageDataSerializer::ComputeMinBufferSize(aSize);
-
-  // get new buffer _without_ setting mBuffer.
-  if (!mTextureClient->Allocate(size)) {
-    return nullptr;
-  }
-
   // update buffer size
   mBufferSize = size;
 
+  // get new buffer _without_ setting mBuffer.
+  bool status = mTextureClient->Allocate(mBufferSize);
+  MOZ_ASSERT(status);
   YCbCrImageDataSerializer serializer(mTextureClient->GetBuffer());
+
   return serializer.GetData();
 }
 
@@ -250,19 +248,17 @@ DeprecatedSharedPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
   NS_ABORT_IF_FALSE(!mAllocated, "This image already has allocated data");
   size_t size = YCbCrImageDataSerializer::ComputeMinBufferSize(aSize);
-
-  // get new buffer _without_ setting mBuffer.
-  if (!AllocateBuffer(size)) {
-    return nullptr;
-  }
-
   // update buffer size
   mBufferSize = size;
 
+  // get new buffer _without_ setting mBuffer.
+  AllocateBuffer(mBufferSize);
   YCbCrImageDataSerializer serializer(mShmem.get<uint8_t>());
+
   return serializer.GetData();
 }
 
+
 void
 DeprecatedSharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 {

From d7d012bff76d9dcfe2ceff51476e4ae3aaa2333b Mon Sep 17 00:00:00 2001
From: Chris Peterson <cpeterson@mozilla.com>
Date: Tue, 10 Dec 2013 22:58:51 -0800
Subject: [PATCH 026/459] Bug 949360 - Check for Image AllocateBuffer()
 failures. r=nical

Relanded on a CLOSED TREE
---
 gfx/layers/ImageContainer.cpp             | 16 ++++++++++------
 gfx/layers/ipc/SharedPlanarYCbCrImage.cpp | 20 ++++++++++++--------
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index 8d51ce7c6944..e977f69143be 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -490,14 +490,17 @@ PlanarYCbCrImage::CopyData(const Data& aData)
   mData = aData;
 
   // update buffer size
-  mBufferSize = mData.mCbCrStride * mData.mCbCrSize.height * 2 +
+  size_t size = mData.mCbCrStride * mData.mCbCrSize.height * 2 +
                 mData.mYStride * mData.mYSize.height;
 
   // get new buffer
-  mBuffer = AllocateBuffer(mBufferSize);
+  mBuffer = AllocateBuffer(size);
   if (!mBuffer)
     return;
 
+  // update buffer size
+  mBufferSize = size;
+
   mData.mYChannel = mBuffer;
   mData.mCbChannel = mData.mYChannel + mData.mYStride * mData.mYSize.height;
   mData.mCrChannel = mData.mCbChannel + mData.mCbCrStride * mData.mCbCrSize.height;
@@ -536,11 +539,12 @@ PlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 uint8_t*
 PlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
-  // update buffer size
-  mBufferSize = aSize;
-
   // get new buffer
-  mBuffer = AllocateBuffer(mBufferSize); 
+  mBuffer = AllocateBuffer(aSize);
+  if (mBuffer) {
+    // update buffer size
+    mBufferSize = aSize;
+  }
   return mBuffer;
 }
 
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index a842f5d7ee00..3f7e969a1cf6 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -126,14 +126,16 @@ SharedPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
   NS_ABORT_IF_FALSE(!mTextureClient->IsAllocated(), "This image already has allocated data");
   size_t size = YCbCrImageDataSerializer::ComputeMinBufferSize(aSize);
+
+  // get new buffer _without_ setting mBuffer.
+  if (!mTextureClient->Allocate(size)) {
+    return nullptr;
+  }
+
   // update buffer size
   mBufferSize = size;
 
-  // get new buffer _without_ setting mBuffer.
-  bool status = mTextureClient->Allocate(mBufferSize);
-  MOZ_ASSERT(status);
   YCbCrImageDataSerializer serializer(mTextureClient->GetBuffer());
-
   return serializer.GetData();
 }
 
@@ -248,17 +250,19 @@ DeprecatedSharedPlanarYCbCrImage::AllocateAndGetNewBuffer(uint32_t aSize)
 {
   NS_ABORT_IF_FALSE(!mAllocated, "This image already has allocated data");
   size_t size = YCbCrImageDataSerializer::ComputeMinBufferSize(aSize);
+
+  // get new buffer _without_ setting mBuffer.
+  if (!AllocateBuffer(size)) {
+    return nullptr;
+  }
+
   // update buffer size
   mBufferSize = size;
 
-  // get new buffer _without_ setting mBuffer.
-  AllocateBuffer(mBufferSize);
   YCbCrImageDataSerializer serializer(mShmem.get<uint8_t>());
-
   return serializer.GetData();
 }
 
-
 void
 DeprecatedSharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 {

From 5e3b1f18b34db90d77c9f7f3d2fc0ed278eb5e9f Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 12 Dec 2013 08:42:24 -0800
Subject: [PATCH 027/459] Bug 932982 - Trace type constraints and allow
 preserving jitcode in GCs without also marking all type information,
 r=billm,jandem.

---
 js/public/MemoryMetrics.h         |   1 -
 js/src/gc/Marking.cpp             |  46 +----
 js/src/gc/RootMarking.cpp         |   5 -
 js/src/gc/Statistics.cpp          |   1 -
 js/src/gc/Statistics.h            |   1 -
 js/src/gc/Zone.cpp                |  31 +--
 js/src/gc/Zone.h                  |   2 -
 js/src/jit/CodeGenerator.cpp      |   6 +-
 js/src/jit/Ion.cpp                |  17 +-
 js/src/jit/Ion.h                  |   2 +-
 js/src/jit/IonBuilder.cpp         |   6 +-
 js/src/jit/IonCode.h              |   3 +
 js/src/jit/MIR.cpp                |   2 +-
 js/src/jscompartment.cpp          |  11 +-
 js/src/jscompartment.h            |   3 -
 js/src/jsgc.cpp                   |  14 +-
 js/src/jsgc.h                     |   7 +-
 js/src/jsinfer.cpp                | 329 +++++++++++++++---------------
 js/src/jsinfer.h                  | 122 ++++-------
 js/src/jsinferinlines.h           |  78 ++-----
 js/src/vm/MemoryMetrics.cpp       |   1 -
 js/xpconnect/src/XPCJSRuntime.cpp |   4 -
 22 files changed, 258 insertions(+), 434 deletions(-)

diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index 95ac91b9f6d5..f974259467d5 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -393,7 +393,6 @@ struct CompartmentStats
     macro(Other,   NotLiveGCThing, baselineStubsOptimized) \
     macro(Other,   NotLiveGCThing, ionData) \
     macro(Other,   NotLiveGCThing, typeInferenceTypeScripts) \
-    macro(Other,   NotLiveGCThing, typeInferencePendingArrays) \
     macro(Other,   NotLiveGCThing, typeInferenceAllocationSiteTables) \
     macro(Other,   NotLiveGCThing, typeInferenceArrayTypeTables) \
     macro(Other,   NotLiveGCThing, typeInferenceObjectTypeTables) \
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index b0c8a6555988..d0e3bde29e8a 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1122,14 +1122,11 @@ gc::MarkCycleCollectorChildren(JSTracer *trc, Shape *shape)
 static void
 ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
 {
-    /* Don't mark properties for singletons. They'll be purged by the GC. */
-    if (!type->singleton) {
-        unsigned count = type->getPropertyCount();
-        for (unsigned i = 0; i < count; i++) {
-            types::Property *prop = type->getProperty(i);
-            if (prop && JSID_IS_STRING(prop->id))
-                PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
-        }
+    unsigned count = type->getPropertyCount();
+    for (unsigned i = 0; i < count; i++) {
+        types::Property *prop = type->getProperty(i);
+        if (prop && JSID_IS_STRING(prop->id))
+            PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
     }
 
     if (TaggedProto(type->proto).isObject())
@@ -1350,7 +1347,7 @@ GCMarker::restoreValueArray(JSObject *obj, void **vpp, void **endp)
 }
 
 void
-GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr)
+GCMarker::processMarkStackOther(uintptr_t tag, uintptr_t addr)
 {
     if (tag == TypeTag) {
         ScanTypeObject(this, reinterpret_cast<types::TypeObject *>(addr));
@@ -1364,35 +1361,6 @@ GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t ad
             pushObject(obj);
     } else if (tag == IonCodeTag) {
         MarkChildren(this, reinterpret_cast<jit::IonCode *>(addr));
-    } else if (tag == ArenaTag) {
-        ArenaHeader *aheader = reinterpret_cast<ArenaHeader *>(addr);
-        AllocKind thingKind = aheader->getAllocKind();
-        size_t thingSize = Arena::thingSize(thingKind);
-
-        for ( ; aheader; aheader = aheader->next) {
-            Arena *arena = aheader->getArena();
-            FreeSpan firstSpan(aheader->getFirstFreeSpan());
-            const FreeSpan *span = &firstSpan;
-
-            for (uintptr_t thing = arena->thingsStart(thingKind); ; thing += thingSize) {
-                JS_ASSERT(thing <= arena->thingsEnd());
-                if (thing == span->first) {
-                    if (!span->hasNext())
-                        break;
-                    thing = span->last;
-                    span = span->nextSpan();
-                } else {
-                    JSObject *object = reinterpret_cast<JSObject *>(thing);
-                    if (object->hasSingletonType() && object->markIfUnmarked(getMarkColor()))
-                        pushObject(object);
-                    budget.step();
-                }
-            }
-            if (budget.isOverBudget()) {
-                pushArenaList(aheader);
-                return;
-            }
-        }
     }
 }
 
@@ -1430,7 +1398,7 @@ GCMarker::processMarkStackTop(SliceBudget &budget)
         goto scan_obj;
     }
 
-    processMarkStackOther(budget, tag, addr);
+    processMarkStackOther(tag, addr);
     return;
 
   scan_value_array:
diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index 8ae3e85fd559..541ad84d996c 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -726,11 +726,6 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
         if (IS_GC_MARKING_TRACER(trc) && !zone->isCollecting())
             continue;
 
-        if (IS_GC_MARKING_TRACER(trc) && zone->isPreservingCode()) {
-            gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_MARK_TYPES);
-            zone->markTypes(trc);
-        }
-
         /* Do not discard scripts with counts while profiling. */
         if (rt->profilingScripts && !rt->isHeapMinorCollecting()) {
             for (CellIterUnderGC i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 7744b61d53f5..be76eee734a1 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -276,7 +276,6 @@ static const PhaseInfo phases[] = {
     { PHASE_PURGE, "Purge", PHASE_NO_PARENT },
     { PHASE_MARK, "Mark", PHASE_NO_PARENT },
     { PHASE_MARK_ROOTS, "Mark Roots", PHASE_MARK },
-    { PHASE_MARK_TYPES, "Mark Types", PHASE_MARK_ROOTS },
     { PHASE_MARK_DELAYED, "Mark Delayed", PHASE_MARK },
     { PHASE_SWEEP, "Sweep", PHASE_NO_PARENT },
     { PHASE_SWEEP_MARK, "Mark During Sweeping", PHASE_SWEEP },
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 3240fd238f53..1029fd52fe8e 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -28,7 +28,6 @@ enum Phase {
     PHASE_PURGE,
     PHASE_MARK,
     PHASE_MARK_ROOTS,
-    PHASE_MARK_TYPES,
     PHASE_MARK_DELAYED,
     PHASE_SWEEP,
     PHASE_SWEEP_MARK,
diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
index ad0c2fae7fde..539faabbd7c8 100644
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -80,35 +80,6 @@ Zone::setNeedsBarrier(bool needs, ShouldUpdateIon updateIon)
     needsBarrier_ = needs;
 }
 
-void
-Zone::markTypes(JSTracer *trc)
-{
-    /*
-     * Mark all scripts, type objects and singleton JS objects in the
-     * compartment. These can be referred to directly by type sets, which we
-     * cannot modify while code which depends on these type sets is active.
-     */
-    JS_ASSERT(isPreservingCode());
-
-    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-        JSScript *script = i.get<JSScript>();
-        MarkScriptRoot(trc, &script, "mark_types_script");
-        JS_ASSERT(script == i.get<JSScript>());
-    }
-
-    for (size_t thingKind = FINALIZE_OBJECT0; thingKind < FINALIZE_OBJECT_LIMIT; thingKind++) {
-        ArenaHeader *aheader = allocator.arenas.getFirstArena(static_cast<AllocKind>(thingKind));
-        if (aheader)
-            trc->runtime->gcMarker.pushArenaList(aheader);
-    }
-
-    for (CellIterUnderGC i(this, FINALIZE_TYPE_OBJECT); !i.done(); i.next()) {
-        types::TypeObject *type = i.get<types::TypeObject>();
-        MarkTypeObjectRoot(trc, &type, "mark_types_scan");
-        JS_ASSERT(type == i.get<types::TypeObject>());
-    }
-}
-
 void
 Zone::resetGCMallocBytes()
 {
@@ -144,7 +115,7 @@ Zone::sweep(FreeOp *fop, bool releaseTypes)
     if (active)
         releaseTypes = false;
 
-    if (!isPreservingCode()) {
+    {
         gcstats::AutoPhase ap(fop->runtime()->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
         types.sweep(fop, releaseTypes);
     }
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index ebad06d0b6c9..a2fe6a22a022 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -310,8 +310,6 @@ struct Zone : public JS::shadow::Zone,
         js_ReportAllocationOverflow(nullptr);
     }
 
-    void markTypes(JSTracer *trc);
-
     js::types::TypeZone types;
 
     void sweep(js::FreeOp *fop, bool releaseTypes);
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index cc1095ff392b..c15f164ec681 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -5890,7 +5890,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                      safepoints_.size(), callTargets.length(),
                      patchableBackedges_.length(), optimizationLevel);
     if (!ionScript) {
-        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
         return false;
     }
 
@@ -5915,7 +5915,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         // Use js_free instead of IonScript::Destroy: the cache list and
         // backedge list are still uninitialized.
         js_free(ionScript);
-        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
         return false;
     }
 
@@ -5936,7 +5936,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                         /* resetUses */ false, /* cancelOffThread*/ false))
         {
             js_free(ionScript);
-            recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+            recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
             return false;
         }
     }
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 92a1e4aed529..546e31c1ca8c 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2508,7 +2508,7 @@ jit::InvalidateAll(FreeOp *fop, Zone *zone)
 
 
 void
-jit::Invalidate(types::TypeCompartment &types, FreeOp *fop,
+jit::Invalidate(types::TypeZone &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
@@ -2591,7 +2591,7 @@ void
 jit::Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
-    jit::Invalidate(cx->compartment()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
+    jit::Invalidate(cx->zone()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
                     cancelOffThread);
 }
 
@@ -2638,14 +2638,13 @@ FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool p
     else
         script->setIonScript(nullptr);
 
-    // If this script has Ion code on the stack, invalidation() will return
-    // true. In this case we have to wait until destroying it.
-    if (!ionScript->invalidated()) {
-        types::TypeCompartment &types = script->compartment()->types;
-        ionScript->recompileInfo().compilerOutput(types)->invalidate();
+    types::TypeZone &types = script->zone()->types;
+    ionScript->recompileInfo().compilerOutput(types)->invalidate();
 
+    // If this script has Ion code on the stack, invalidated() will return
+    // true. In this case we have to wait until destroying it.
+    if (!ionScript->invalidated())
         jit::IonScript::Destroy(fop, ionScript);
-    }
 }
 
 void
@@ -2664,8 +2663,6 @@ jit::FinishDiscardJitCode(FreeOp *fop, JSCompartment *comp)
     // Free optimized baseline stubs.
     if (comp->jitCompartment())
         comp->jitCompartment()->optimizedStubSpace()->free();
-
-    comp->types.clearCompilerOutputs(fop);
 }
 
 void
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index f516f1e12698..780fc993901f 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -127,7 +127,7 @@ IonExecStatus IonCannon(JSContext *cx, RunState &state);
 IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
-void Invalidate(types::TypeCompartment &types, FreeOp *fop,
+void Invalidate(types::TypeZone &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
                 bool cancelOffThread = true);
 void Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 24eeae4a238e..2ca4b692c083 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6321,7 +6321,7 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints(), staticType))
+        property.configured(constraints()))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -6411,7 +6411,7 @@ IonBuilder::setStaticName(JSObject *staticObject, PropertyName *name)
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints(), staticType))
+        property.configured(constraints()))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -7861,7 +7861,7 @@ IonBuilder::getDefiniteSlot(types::TemporaryTypeSet *types, PropertyName *name,
     *property = type->property(id);
     return property->maybeTypes() &&
            property->maybeTypes()->definiteProperty() &&
-           !property->configured(constraints(), type);
+           !property->configured(constraints());
 }
 
 bool
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index d3ecaa94223e..286cbeb9e882 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -531,6 +531,9 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
+    types::RecompileInfo& recompileInfoRef() {
+        return recompileInfo_;
+    }
     OptimizationLevel optimizationLevel() const {
         return optimizationLevel_;
     }
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index aad9234a367f..882b468f6a7b 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3025,7 +3025,7 @@ jit::PropertyReadIsIdempotent(types::CompilerConstraintList *constraints,
 
             // Check if the property has been reconfigured or is a getter.
             types::HeapTypeSetKey property = object->property(NameToId(name));
-            if (property.configured(constraints, object))
+            if (property.configured(constraints))
                 return false;
         }
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index a4132018c96f..f9dd807606db 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -48,7 +48,6 @@ JSCompartment::JSCompartment(Zone *zone, const JS::CompartmentOptions &options =
 #endif
     global_(nullptr),
     enterCompartmentDepth(0),
-    lastCodeRelease(0),
     data(nullptr),
     objectMetadataCallback(nullptr),
     lastAnimationTime(0),
@@ -545,13 +544,6 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
         WeakMapBase::sweepCompartment(this);
     }
 
-    if (zone()->isPreservingCode()) {
-        gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
-        types.sweepShapes(fop);
-    } else {
-        JS_ASSERT(!types.constrainedOutputs);
-    }
-
     NativeIterator *ni = enumerators->next();
     while (ni != enumerators) {
         JSObject *iterObj = ni->iterObj();
@@ -864,7 +856,6 @@ JSCompartment::clearTraps(FreeOp *fop)
 
 void
 JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                      size_t *tiPendingArrays,
                                       size_t *tiAllocationSiteTables,
                                       size_t *tiArrayTypeTables,
                                       size_t *tiObjectTypeTables,
@@ -876,7 +867,7 @@ JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                       size_t *baselineStubsOptimized)
 {
     *compartmentObject += mallocSizeOf(this);
-    types.addSizeOfExcludingThis(mallocSizeOf, tiPendingArrays, tiAllocationSiteTables,
+    types.addSizeOfExcludingThis(mallocSizeOf, tiAllocationSiteTables,
                                  tiArrayTypeTables, tiObjectTypeTables);
     *shapesCompartmentTables += baseShapes.sizeOfExcludingThis(mallocSizeOf)
                               + initialShapes.sizeOfExcludingThis(mallocSizeOf)
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 15a93afe1280..f44c2b09e390 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -187,8 +187,6 @@ struct JSCompartment
      */
     void adoptWorkerAllocator(js::Allocator *workerAllocator);
 
-
-    int64_t                      lastCodeRelease;
     bool                         activeAnalysis;
 
     /* Type information about the scripts and objects in this compartment. */
@@ -221,7 +219,6 @@ struct JSCompartment
 
   public:
     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                size_t *tiPendingArrays,
                                 size_t *tiAllocationSiteTables,
                                 size_t *tiArrayTypeTables,
                                 size_t *tiObjectTypeTables,
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index dd3cde985825..27242bdcdb39 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2854,13 +2854,9 @@ ShouldPreserveJITCode(JSCompartment *comp, int64_t currentTime)
 
     if (rt->alwaysPreserveCode)
         return true;
-    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime &&
-        comp->lastCodeRelease + (PRMJ_USEC_PER_SEC * 300) >= currentTime)
-    {
+    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime)
         return true;
-    }
 
-    comp->lastCodeRelease = currentTime;
     return false;
 }
 
@@ -3939,12 +3935,12 @@ BeginSweepingZoneGroup(JSRuntime *rt)
         bool releaseTypes = ReleaseObservedTypes(rt);
         for (GCCompartmentGroupIter c(rt); !c.done(); c.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            c->sweep(&fop, releaseTypes);
+            c->sweep(&fop, releaseTypes && !c->zone()->isPreservingCode());
         }
 
         for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            zone->sweep(&fop, releaseTypes);
+            zone->sweep(&fop, releaseTypes && !zone->isPreservingCode());
         }
     }
 
@@ -5293,10 +5289,6 @@ js::ReleaseAllJITCode(FreeOp *fop)
             jit::FinishDiscardBaselineScript(fop, script);
         }
     }
-
-    /* Sweep now invalidated compiler outputs from each compartment. */
-    for (CompartmentsIter comp(fop->runtime(), SkipAtoms); !comp.done(); comp.next())
-        comp->types.clearCompilerOutputs(fop);
 #endif
 }
 
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 2e5cbe360930..9159f31ec024 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -1091,7 +1091,6 @@ struct GCMarker : public JSTracer {
         ObjectTag,
         TypeTag,
         XmlTag,
-        ArenaTag,
         SavedValueArrayTag,
         IonCodeTag,
         LastTag = IonCodeTag
@@ -1119,10 +1118,6 @@ struct GCMarker : public JSTracer {
         pushTaggedPtr(ObjectTag, obj);
     }
 
-    void pushArenaList(gc::ArenaHeader *firstArena) {
-        pushTaggedPtr(ArenaTag, firstArena);
-    }
-
     void pushType(types::TypeObject *type) {
         pushTaggedPtr(TypeTag, type);
     }
@@ -1229,7 +1224,7 @@ struct GCMarker : public JSTracer {
     bool restoreValueArray(JSObject *obj, void **vpp, void **endp);
     void saveValueRanges();
     inline void processMarkStackTop(SliceBudget &budget);
-    void processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr);
+    void processMarkStackOther(uintptr_t tag, uintptr_t addr);
 
     void appendGrayRoot(void *thing, JSGCTraceKind kind);
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 0c1fe0167a3c..51c19af54640 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -243,14 +243,6 @@ types::TypeHasProperty(JSContext *cx, TypeObject *obj, jsid id, const Value &val
         if (id == id___proto__(cx) || id == id_constructor(cx) || id == id_caller(cx))
             return true;
 
-        /*
-         * If we called in here while resolving a type constraint, we may be in the
-         * middle of resolving a standard class and the type sets will not be updated
-         * until the outer TypeSet::add finishes.
-         */
-        if (cx->compartment()->types.pendingCount)
-            return true;
-
         Type type = GetValueType(value);
 
         AutoEnterAnalysis enter(cx);
@@ -742,12 +734,12 @@ class TypeCompilerConstraint : public TypeConstraint
 
     void newType(JSContext *cx, TypeSet *source, Type type) {
         if (data.invalidateOnNewType(type))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
     }
 
     void newPropertyState(JSContext *cx, TypeSet *source) {
         if (data.invalidateOnNewPropertyState(source))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
     }
 
     void newObjectState(JSContext *cx, TypeObject *object) {
@@ -755,7 +747,16 @@ class TypeCompilerConstraint : public TypeConstraint
         // will be sent on changes to its state, so always invalidate any
         // associated compilations.
         if (object->unknownProperties() || data.invalidateOnNewObjectState(object))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
+    }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (data.shouldSweep() || compilation.shouldSweep(zone))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeCompilerConstraint<T> >(compilation, data);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
     }
 };
 
@@ -908,13 +909,21 @@ class TypeConstraintFreezeStack : public TypeConstraint
 
     const char *kind() { return "freezeStack"; }
 
-    void newType(JSContext *cx, TypeSet *source, Type type)
-    {
+    void newType(JSContext *cx, TypeSet *source, Type type) {
         /*
          * Unlike TypeConstraintFreeze, triggering this constraint once does
          * not disable it on future changes to the type set.
          */
-        cx->compartment()->types.addPendingRecompile(cx, script_);
+        cx->zone()->types.addPendingRecompile(cx, script_);
+    }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsScriptAboutToBeFinalized(&script_))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintFreezeStack>(script_);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
     }
 };
 
@@ -929,15 +938,22 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
 
     CompilerOutput co(script, executionMode);
 
-    TypeCompartment &types = cx->compartment()->types;
-    if (!types.constrainedOutputs) {
-        types.constrainedOutputs = cx->new_< Vector<CompilerOutput> >(cx);
-        if (!types.constrainedOutputs)
+    TypeZone &types = cx->zone()->types;
+    if (!types.compilerOutputs) {
+        types.compilerOutputs = cx->new_< Vector<CompilerOutput> >(cx);
+        if (!types.compilerOutputs)
             return false;
     }
 
-    uint32_t index = types.constrainedOutputs->length();
-    if (!types.constrainedOutputs->append(co))
+#ifdef DEBUG
+    for (size_t i = 0; i < types.compilerOutputs->length(); i++) {
+        const CompilerOutput &co = (*types.compilerOutputs)[i];
+        JS_ASSERT_IF(co.isValid(), co.script() != script || co.mode() != executionMode);
+    }
+#endif
+
+    uint32_t index = types.compilerOutputs->length();
+    if (!types.compilerOutputs->append(co))
         return false;
 
     *precompileInfo = RecompileInfo(index);
@@ -979,8 +995,8 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
             array[i].add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeStack>(entry.script), false);
     }
 
-    if (!succeeded || types.constrainedOutputs->back().pendingInvalidation()) {
-        types.constrainedOutputs->back().invalidate();
+    if (!succeeded || types.compilerOutputs->back().pendingInvalidation()) {
+        types.compilerOutputs->back().invalidate();
         script->resetUseCount();
         return false;
     }
@@ -1009,6 +1025,8 @@ class ConstraintDataFreeze
                ? property.maybeTypes()->isSubset(expected)
                : property.maybeTypes()->empty();
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1195,6 +1213,8 @@ class ConstraintDataFreezeObjectFlags
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1289,6 +1309,8 @@ class ConstraintDataFreezeObjectForInlinedCall
     {
         return true;
     }
+
+    bool shouldSweep() { return false; }
 };
 
 // Constraint which triggers recompilation when the template object for a
@@ -1315,6 +1337,11 @@ class ConstraintDataFreezeObjectForNewScriptTemplate
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() {
+        // Note: |templateObject| is only used for equality testing.
+        return false;
+    }
 };
 
 // Constraint which triggers recompilation when the underlying data pointer for
@@ -1341,6 +1368,11 @@ class ConstraintDataFreezeObjectForTypedArrayBuffer
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() {
+        // Note: |viewData| is only used for equality testing.
+        return false;
+    }
 };
 
 } /* anonymous namespace */
@@ -1413,10 +1445,7 @@ namespace {
 class ConstraintDataFreezeConfiguredProperty
 {
   public:
-    TypeObjectKey *object;
-
-    ConstraintDataFreezeConfiguredProperty(TypeObjectKey *object)
-      : object(object)
+    ConstraintDataFreezeConfiguredProperty()
     {}
 
     const char *kind() { return "freezeConfiguredProperty"; }
@@ -1430,31 +1459,16 @@ class ConstraintDataFreezeConfiguredProperty
     bool constraintHolds(JSContext *cx,
                          const HeapTypeSetKey &property, TemporaryTypeSet *expected)
     {
-        // Everywhere compiled code depends on definite properties associated
-        // with a type object's newScript, we need to make sure there are
-        // constraints in place which will mark those properties as configured
-        // should the definite properties be invalidated.
-        TypeObject *type = object->isSingleObject()
-                           ? object->asSingleObject()->type()
-                           : object->asTypeObject();
-        if (type->flags & OBJECT_FLAG_NEW_SCRIPT_REGENERATE) {
-            type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
-            if (type->hasNewScript()) {
-                CheckNewScriptProperties(cx, type, type->newScript()->fun);
-            } else {
-                JS_ASSERT(type->flags & OBJECT_FLAG_ADDENDUM_CLEARED);
-                type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
-            }
-        }
-
         return !property.maybeTypes()->configuredProperty();
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
 
 bool
-HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *type)
+HeapTypeSetKey::configured(CompilerConstraintList *constraints)
 {
     if (maybeTypes() && maybeTypes()->configuredProperty())
         return true;
@@ -1463,7 +1477,7 @@ HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *t
 
     typedef CompilerConstraintInstance<ConstraintDataFreezeConfiguredProperty> T;
     constraints->add(alloc->new_<T>(alloc, *this,
-                                    ConstraintDataFreezeConfiguredProperty(type)));
+                                    ConstraintDataFreezeConfiguredProperty()));
     return false;
 }
 
@@ -1986,7 +2000,7 @@ PrototypeHasIndexedProperty(CompilerConstraintList *constraints, JSObject *obj)
         if (type->unknownProperties())
             return true;
         HeapTypeSetKey index = type->property(JSID_VOID);
-        if (index.configured(constraints, type) || index.isOwnProperty(constraints))
+        if (index.configured(constraints) || index.isOwnProperty(constraints))
             return true;
         obj = obj->getProto();
     } while (obj);
@@ -2024,27 +2038,8 @@ types::TypeCanHaveExtraIndexedProperties(CompilerConstraintList *constraints,
     return PrototypeHasIndexedProperty(constraints, proto);
 }
 
-bool
-TypeCompartment::growPendingArray(JSContext *cx)
-{
-    unsigned newCapacity = js::Max(unsigned(100), pendingCapacity * 2);
-    PendingWork *newArray = js_pod_calloc<PendingWork>(newCapacity);
-    if (!newArray) {
-        cx->compartment()->types.setPendingNukeTypes(cx);
-        return false;
-    }
-
-    PodCopy(newArray, pendingArray, pendingCount);
-    js_free(pendingArray);
-
-    pendingArray = newArray;
-    pendingCapacity = newCapacity;
-
-    return true;
-}
-
 void
-TypeCompartment::processPendingRecompiles(FreeOp *fop)
+TypeZone::processPendingRecompiles(FreeOp *fop)
 {
     if (!pendingRecompiles)
         return;
@@ -2095,11 +2090,9 @@ TypeZone::nukeTypes(FreeOp *fop)
      */
     JS_ASSERT(pendingNukeTypes);
 
-    for (CompartmentsInZoneIter comp(zone()); !comp.done(); comp.next()) {
-        if (comp->types.pendingRecompiles) {
-            fop->free_(comp->types.pendingRecompiles);
-            comp->types.pendingRecompiles = nullptr;
-        }
+    if (pendingRecompiles) {
+        fop->free_(pendingRecompiles);
+        pendingRecompiles = nullptr;
     }
 
     inferenceEnabled = false;
@@ -2119,7 +2112,7 @@ TypeZone::nukeTypes(FreeOp *fop)
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
+TypeZone::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 {
     CompilerOutput *co = info.compilerOutput(cx);
     if (!co || !co->isValid() || co->pendingInvalidation())
@@ -2145,7 +2138,7 @@ TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, JSScript *script)
+TypeZone::addPendingRecompile(JSContext *cx, JSScript *script)
 {
     JS_ASSERT(script);
 
@@ -3146,6 +3139,15 @@ class TypeConstraintClearDefiniteGetterSetter : public TypeConstraint
     }
 
     void newType(JSContext *cx, TypeSet *source, Type type) {}
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsTypeObjectAboutToBeFinalized(&object))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteGetterSetter>(object);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
+    }
 };
 
 bool
@@ -3192,6 +3194,15 @@ class TypeConstraintClearDefiniteSingle : public TypeConstraint
         if (source->baseFlags() || source->getObjectCount() > 1)
             object->clearAddendum(cx);
     }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsTypeObjectAboutToBeFinalized(&object))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteSingle>(object);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
+    }
 };
 
 void
@@ -3941,8 +3952,19 @@ ConstraintTypeSet::sweep(Zone *zone)
         }
     }
 
-    /* All constraints are wiped out on each GC. */
+    /*
+     * Type constraints only hold weak references. Copy constraints referring
+     * to data that is still live into the zone's new arena.
+     */
+    TypeConstraint *constraint = constraintList;
     constraintList = nullptr;
+    while (constraint) {
+        if (TypeConstraint *copy = constraint->sweep(zone->types)) {
+            copy->next = constraintList;
+            constraintList = copy;
+        }
+        constraint = constraint->next;
+    }
 }
 
 inline void
@@ -3962,18 +3984,6 @@ TypeObject::clearProperties()
 inline void
 TypeObject::sweep(FreeOp *fop)
 {
-    if (singleton) {
-        JS_ASSERT(!hasNewScript());
-
-        /*
-         * All properties can be discarded. We will regenerate them as needed
-         * as code gets reanalyzed.
-         */
-        clearProperties();
-
-        return;
-    }
-
     if (!isMarked()) {
         if (addendum)
             fop->free_(addendum);
@@ -3996,6 +4006,14 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < oldCapacity; i++) {
             Property *prop = oldArray[i];
             if (prop) {
+                if (singleton && !prop->types.constraintList) {
+                    /*
+                     * Don't copy over properties of singleton objects which
+                     * don't have associated constraints. The contents of these
+                     * type sets will be regenerated as necessary.
+                     */
+                    continue;
+                }
                 Property *newProp = typeLifoAlloc.new_<Property>(*prop);
                 if (newProp) {
                     Property **pentry =
@@ -4015,12 +4033,17 @@ TypeObject::sweep(FreeOp *fop)
         setBasePropertyCount(propertyCount);
     } else if (propertyCount == 1) {
         Property *prop = (Property *) propertySet;
-        Property *newProp = typeLifoAlloc.new_<Property>(*prop);
-        if (newProp) {
-            propertySet = (Property **) newProp;
-            newProp->types.sweep(zone());
+        if (singleton && !prop->types.constraintList) {
+            // Skip, as above.
+            clearProperties();
         } else {
-            zone()->types.setPendingNukeTypes();
+            Property *newProp = typeLifoAlloc.new_<Property>(*prop);
+            if (newProp) {
+                propertySet = (Property **) newProp;
+                newProp->types.sweep(zone());
+            } else {
+                zone()->types.setPendingNukeTypes();
+            }
         }
     }
 
@@ -4028,14 +4051,6 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < basePropertyCount(); i++)
             JS_ASSERT(propertySet[i]);
     }
-
-    /*
-     * The GC will clear out the constraints ensuring the correctness of the
-     * newScript information, these constraints will need to be regenerated
-     * the next time we compile code which depends on this info.
-     */
-    if (hasNewScript())
-        flags |= OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
 }
 
 void
@@ -4119,52 +4134,6 @@ TypeCompartment::sweep(FreeOp *fop)
                 e.rekeyFront(key);
         }
     }
-
-    /*
-     * The pending array is reset on GC, it can grow large (75+ KB) and is easy
-     * to reallocate if the compartment becomes active again.
-     */
-    if (pendingArray)
-        fop->free_(pendingArray);
-
-    pendingArray = nullptr;
-    pendingCapacity = 0;
-}
-
-void
-TypeCompartment::sweepShapes(FreeOp *fop)
-{
-    /*
-     * Sweep any weak shape references that may be finalized even if a GC is
-     * preserving type information.
-     */
-    if (objectTypeTable) {
-        for (ObjectTypeTable::Enum e(*objectTypeTable); !e.empty(); e.popFront()) {
-            const ObjectTableKey &key = e.front().key();
-            ObjectTableEntry &entry = e.front().value();
-
-            if (IsShapeAboutToBeFinalized(entry.shape.unsafeGet())) {
-                fop->free_(key.properties);
-                fop->free_(entry.types);
-                e.removeFront();
-            }
-        }
-    }
-}
-
-void
-TypeCompartment::clearCompilerOutputs(FreeOp *fop)
-{
-    if (constrainedOutputs) {
-        fop->delete_(constrainedOutputs);
-        constrainedOutputs = nullptr;
-    }
-
-    if (pendingRecompiles) {
-        JS_ASSERT(pendingRecompiles->length() == 0);
-        fop->delete_(pendingRecompiles);
-        pendingRecompiles = nullptr;
-    }
 }
 
 void
@@ -4193,7 +4162,6 @@ JSCompartment::sweepNewTypeObjectTable(TypeObjectWithNewScriptSet &table)
 
 TypeCompartment::~TypeCompartment()
 {
-    js_free(pendingArray);
     js_delete(arrayTypeTable);
     js_delete(objectTypeTable);
     js_delete(allocationSiteTable);
@@ -4212,12 +4180,6 @@ TypeScript::Sweep(FreeOp *fop, JSScript *script)
     /* Remove constraints and references to dead objects from the persistent type sets. */
     for (unsigned i = 0; i < num; i++)
         typeArray[i].sweep(compartment->zone());
-
-    /*
-     * Freeze constraints on stack type sets need to be regenerated the next
-     * time the script is analyzed.
-     */
-    script->clearHasFreezeConstraints();
 }
 
 void
@@ -4234,20 +4196,10 @@ Zone::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, size_t *typePoo
 
 void
 TypeCompartment::addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                        size_t *pendingArrays,
                                         size_t *allocationSiteTables,
                                         size_t *arrayTypeTables,
                                         size_t *objectTypeTables)
 {
-    /* Pending arrays are cleared on GC along with the analysis pool. */
-    *pendingArrays += mallocSizeOf(pendingArray);
-
-    /*
-     * TypeCompartment::pendingRecompiles is non-nullptr only while inference
-     * code is running.
-     */
-    JS_ASSERT(!pendingRecompiles);
-
     if (allocationSiteTable)
         *allocationSiteTables += allocationSiteTable->sizeOfIncludingThis(mallocSizeOf);
 
@@ -4289,6 +4241,8 @@ TypeObject::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
 TypeZone::TypeZone(Zone *zone)
   : zone_(zone),
     typeLifoAlloc(TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
+    compilerOutputs(nullptr),
+    pendingRecompiles(nullptr),
     pendingNukeTypes(false),
     inferenceEnabled(false)
 {
@@ -4296,6 +4250,8 @@ TypeZone::TypeZone(Zone *zone)
 
 TypeZone::~TypeZone()
 {
+    js_delete(compilerOutputs);
+    js_delete(pendingRecompiles);
 }
 
 void
@@ -4312,11 +4268,21 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
     LifoAlloc oldAlloc(typeLifoAlloc.defaultChunkSize());
     oldAlloc.steal(&typeLifoAlloc);
 
-    /*
-     * Sweep analysis information and everything depending on it from the
-     * compartment, including all remaining mjit code if inference is
-     * enabled in the compartment.
-     */
+    /* Sweep and find compressed indexes for each compiler output. */
+    size_t newCompilerOutputCount = 0;
+    if (compilerOutputs) {
+        for (size_t i = 0; i < compilerOutputs->length(); i++) {
+            CompilerOutput &output = (*compilerOutputs)[i];
+            if (output.isValid()) {
+                JSScript *script = output.script();
+                if (IsScriptAboutToBeFinalized(&script))
+                    output.invalidate();
+                else
+                    output.setSweepIndex(newCompilerOutputCount++);
+            }
+        }
+    }
+
     if (inferenceEnabled) {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_TI);
 
@@ -4328,6 +4294,21 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
                 if (releaseTypes) {
                     script->types->destroy();
                     script->types = nullptr;
+
+                    /*
+                     * Freeze constraints on stack type sets need to be
+                     * regenerated the next time the script is analyzed.
+                     */
+                    script->clearHasFreezeConstraints();
+
+                    JS_ASSERT(!script->hasIonScript());
+                    JS_ASSERT(!script->hasParallelIonScript());
+                } else {
+                    /* Update the recompile indexes in any IonScripts still on the script. */
+                    if (script->hasIonScript())
+                        script->ionScript()->recompileInfoRef().shouldSweep(*this);
+                    if (script->hasParallelIonScript())
+                        script->parallelIonScript()->recompileInfoRef().shouldSweep(*this);
                 }
             }
         }
@@ -4347,6 +4328,20 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
             comp->types.sweep(fop);
     }
 
+    if (compilerOutputs) {
+        size_t sweepIndex = 0;
+        for (size_t i = 0; i < compilerOutputs->length(); i++) {
+            CompilerOutput output = (*compilerOutputs)[i];
+            if (output.isValid()) {
+                JS_ASSERT(sweepIndex == output.sweepIndex());
+                output.setSweepIndex(0);
+                (*compilerOutputs)[sweepIndex++] = output;
+            }
+        }
+        JS_ASSERT(sweepIndex == newCompilerOutputCount);
+        JS_ALWAYS_TRUE(compilerOutputs->resize(newCompilerOutputCount));
+    }
+
     {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_CLEAR_SCRIPT_ANALYSIS);
         for (CellIterUnderGC i(zone(), FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 690631dfa7ad..38c3be127e82 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -177,7 +177,7 @@ namespace analyze {
 
 namespace types {
 
-class TypeCompartment;
+class TypeZone;
 class TypeSet;
 class TypeObjectKey;
 
@@ -278,28 +278,10 @@ inline Type GetValueType(const Value &val);
  * Type information about the values observed within scripts and about the
  * contents of the heap is accumulated as the program executes. Compilation
  * accumulates constraints relating type information on the heap with the
- * compilations that should be invalidated when those types change. This data
- * is periodically cleared to reduce memory usage.
- *
- * GCs may clear both analysis information and jitcode. Sometimes GCs will
- * preserve all information and code, and will not collect any scripts, type
- * objects or singleton JS objects.
- *
- * The following data is cleared by all non-preserving GCs:
- *
- * - The ScriptAnalysis for each analyzed script and data from each analysis
- *   pass performed.
- *
- * - Property type sets for singleton JS objects.
- *
- * - Type constraints and dead references in all type sets.
- *
- * The following data is occasionally cleared by non-preserving GCs:
- *
- * - TypeScripts and their type sets are occasionally destroyed, per a timer.
- *
- * - When a JSScript or TypeObject is swept, type information for its contents
- *   is destroyed.
+ * compilations that should be invalidated when those types change. Type
+ * information and constraints are allocated in the zone's typeLifoAlloc,
+ * and on GC all data referring to live things is copied into a new allocator.
+ * Thus, type set and constraints only hold weak references.
  */
 
 /*
@@ -334,6 +316,12 @@ public:
      * state.
      */
     virtual void newObjectState(JSContext *cx, TypeObject *object) {}
+
+    /*
+     * If the data this constraint refers to is still live, copy it into the
+     * zone's new allocator. Type constraints only hold weak references.
+     */
+    virtual TypeConstraint *sweep(TypeZone &zone) = 0;
 };
 
 /* Flags and other state stored in TypeSet::flags */
@@ -394,13 +382,6 @@ enum {
     /* If set, addendum information should not be installed on this object. */
     OBJECT_FLAG_ADDENDUM_CLEARED      = 0x2,
 
-    /*
-     * If set, type constraints covering the correctness of the newScript
-     * definite properties need to be regenerated before compiling any jitcode
-     * which depends on this information.
-     */
-    OBJECT_FLAG_NEW_SCRIPT_REGENERATE = 0x4,
-
     /*
      * Whether we have ensured all type sets in the compartment contain
      * ANYOBJECT instead of this object.
@@ -869,12 +850,6 @@ struct TypeTypedObject : public TypeObjectAddendum
  * information is sensitive to changes in the property's type. Future changes
  * to the property (whether those uncovered by analysis or those occurring
  * in the VM) will treat these properties like those of any other type object.
- *
- * When a GC occurs, we wipe out all analysis information for all the
- * compartment's scripts, so can destroy all properties on singleton type
- * objects at the same time. If there is no reference on the stack to the
- * type object itself, the type object is also destroyed, and the JS object
- * reverts to having a lazy type.
  */
 
 /* Type information about an object accessed by a script. */
@@ -1316,7 +1291,7 @@ class HeapTypeSetKey
 
     void freeze(CompilerConstraintList *constraints);
     JSValueType knownTypeTag(CompilerConstraintList *constraints);
-    bool configured(CompilerConstraintList *constraints, TypeObjectKey *type);
+    bool configured(CompilerConstraintList *constraints);
     bool isOwnProperty(CompilerConstraintList *constraints);
     bool knownSubset(CompilerConstraintList *constraints, const HeapTypeSetKey &other);
     JSObject *singleton(CompilerConstraintList *constraints);
@@ -1339,6 +1314,10 @@ class CompilerOutput
     // Whether this compilation is about to be invalidated.
     bool pendingInvalidation_ : 1;
 
+    // During sweeping, the list of compiler outputs is compacted and invalidated
+    // outputs are removed. This gives the new index for a valid compiler output.
+    uint32_t sweepIndex_ : 29;
+
   public:
     CompilerOutput()
       : script_(nullptr), mode_(SequentialExecution), pendingInvalidation_(false)
@@ -1366,6 +1345,15 @@ class CompilerOutput
     bool pendingInvalidation() {
         return pendingInvalidation_;
     }
+
+    void setSweepIndex(uint32_t index) {
+        if (index >= 1 << 29)
+            MOZ_CRASH();
+        sweepIndex_ = index;
+    }
+    uint32_t sweepIndex() {
+        return sweepIndex_;
+    }
 };
 
 class RecompileInfo
@@ -1380,8 +1368,9 @@ class RecompileInfo
     bool operator == (const RecompileInfo &o) const {
         return outputIndex == o.outputIndex;
     }
-    CompilerOutput *compilerOutput(TypeCompartment &types) const;
+    CompilerOutput *compilerOutput(TypeZone &types) const;
     CompilerOutput *compilerOutput(JSContext *cx) const;
+    bool shouldSweep(TypeZone &types);
 };
 
 /* Type information for a compartment. */
@@ -1389,32 +1378,9 @@ struct TypeCompartment
 {
     /* Constraint solving worklist structures. */
 
-    /*
-     * Worklist of types which need to be propagated to constraints. We use a
-     * worklist to avoid blowing the native stack.
-     */
-    struct PendingWork
-    {
-        TypeConstraint *constraint;
-        ConstraintTypeSet *source;
-        Type type;
-    };
-    PendingWork *pendingArray;
-    unsigned pendingCount;
-    unsigned pendingCapacity;
-
-    /* Whether we are currently resolving the pending worklist. */
-    bool resolving;
-
     /* Number of scripts in this compartment. */
     unsigned scriptCount;
 
-    /* Valid & Invalid script referenced by type constraints. */
-    Vector<CompilerOutput> *constrainedOutputs;
-
-    /* Pending recompilations to perform before execution of JIT code can resume. */
-    Vector<RecompileInfo> *pendingRecompiles;
-
     /* Table for referencing types of objects keyed to an allocation site. */
     AllocationSiteTable *allocationSiteTable;
 
@@ -1438,14 +1404,6 @@ struct TypeCompartment
 
     inline JSCompartment *compartment();
 
-    /* Add a type to register with a list of constraints. */
-    inline void addPending(JSContext *cx, TypeConstraint *constraint,
-                           ConstraintTypeSet *source, Type type);
-    bool growPendingArray(JSContext *cx);
-
-    /* Resolve pending type registrations, excluding delayed ones. */
-    inline void resolvePending(JSContext *cx);
-
     /* Prints results of this compartment if spew is enabled or force is set. */
     void print(JSContext *cx, bool force);
 
@@ -1461,26 +1419,16 @@ struct TypeCompartment
     /* Get or make an object for an allocation site, and add to the allocation site table. */
     TypeObject *addAllocationSiteTypeObject(JSContext *cx, AllocationSiteKey key);
 
-    void processPendingRecompiles(FreeOp *fop);
-
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes(ExclusiveContext *cx);
 
-    /* Mark a script as needing recompilation once inference has finished. */
-    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
-    void addPendingRecompile(JSContext *cx, JSScript *script);
-
     /* Mark any type set containing obj as having a generic object type. */
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
     void sweep(FreeOp *fop);
-    void sweepShapes(FreeOp *fop);
-    void clearCompilerOutputs(FreeOp *fop);
-
     void finalizeObjects();
 
     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                size_t *pendingArrays,
                                 size_t *allocationSiteTables,
                                 size_t *arrayTypeTables,
                                 size_t *objectTypeTables);
@@ -1496,6 +1444,16 @@ struct TypeZone
     static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 8 * 1024;
     js::LifoAlloc                typeLifoAlloc;
 
+    /*
+     * All Ion compilations that have occured in this zone, for indexing via
+     * RecompileInfo. This includes both valid and invalid compilations, though
+     * invalidated compilations are swept on GC.
+     */
+    Vector<CompilerOutput> *compilerOutputs;
+
+    /* Pending recompilations to perform before execution of JIT code can resume. */
+    Vector<RecompileInfo> *pendingRecompiles;
+
     /*
      * Bit set if all current types must be marked as unknown, and all scripts
      * recompiled. Caused by OOM failure within inference operations.
@@ -1516,6 +1474,12 @@ struct TypeZone
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes();
 
+    /* Mark a script as needing recompilation once inference has finished. */
+    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
+    void addPendingRecompile(JSContext *cx, JSScript *script);
+
+    void processPendingRecompiles(FreeOp *fop);
+
     void nukeTypes(FreeOp *fop);
 };
 
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index c4e07abd3271..328daf0a076c 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -104,17 +104,29 @@ CompilerOutput::ion() const
 }
 
 inline CompilerOutput*
-RecompileInfo::compilerOutput(TypeCompartment &types) const
+RecompileInfo::compilerOutput(TypeZone &types) const
 {
-    if (!types.constrainedOutputs || outputIndex >= types.constrainedOutputs->length())
+    if (!types.compilerOutputs || outputIndex >= types.compilerOutputs->length())
         return nullptr;
-    return &(*types.constrainedOutputs)[outputIndex];
+    return &(*types.compilerOutputs)[outputIndex];
 }
 
 inline CompilerOutput*
 RecompileInfo::compilerOutput(JSContext *cx) const
 {
-    return compilerOutput(cx->compartment()->types);
+    return compilerOutput(cx->zone()->types);
+}
+
+inline bool
+RecompileInfo::shouldSweep(TypeZone &types)
+{
+    CompilerOutput *output = compilerOutput(types);
+    if (!output || !output->isValid())
+        return true;
+
+    // Update this info for the output's new index in the zone's compiler outputs.
+    outputIndex = output->sweepIndex();
+    return false;
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -288,14 +300,13 @@ struct AutoEnterAnalysis
          * If there are no more type inference activations on the stack,
          * process any triggered recompilations. Note that we should not be
          * invoking any scripted code while type inference is running.
-         * :TODO: assert this.
          */
         if (!compartment->activeAnalysis) {
-            TypeCompartment *types = &compartment->types;
-            if (compartment->zone()->types.pendingNukeTypes)
-                compartment->zone()->types.nukeTypes(freeOp);
-            else if (types->pendingRecompiles)
-                types->processPendingRecompiles(freeOp);
+            TypeZone &types = compartment->zone()->types;
+            if (types.pendingNukeTypes)
+                types.nukeTypes(freeOp);
+            else if (types.pendingRecompiles)
+                types.processPendingRecompiles(freeOp);
         }
     }
 
@@ -852,50 +863,6 @@ TypeCompartment::compartment()
     return (JSCompartment *)((char *)this - offsetof(JSCompartment, types));
 }
 
-inline void
-TypeCompartment::addPending(JSContext *cx, TypeConstraint *constraint,
-                            ConstraintTypeSet *source, Type type)
-{
-    JS_ASSERT(this == &cx->compartment()->types);
-    JS_ASSERT(!cx->runtime()->isHeapBusy());
-
-    InferSpew(ISpewOps, "pending: %sC%p%s %s",
-              InferSpewColor(constraint), constraint, InferSpewColorReset(),
-              TypeString(type));
-
-    if ((pendingCount == pendingCapacity) && !growPendingArray(cx))
-        return;
-
-    PendingWork &pending = pendingArray[pendingCount++];
-    pending.constraint = constraint;
-    pending.source = source;
-    pending.type = type;
-}
-
-inline void
-TypeCompartment::resolvePending(JSContext *cx)
-{
-    JS_ASSERT(this == &cx->compartment()->types);
-
-    if (resolving) {
-        /* There is an active call further up resolving the worklist. */
-        return;
-    }
-
-    resolving = true;
-
-    /* Handle all pending type registrations. */
-    while (pendingCount) {
-        const PendingWork &pending = pendingArray[--pendingCount];
-        InferSpew(ISpewOps, "resolve: %sC%p%s %s",
-                  InferSpewColor(pending.constraint), pending.constraint,
-                  InferSpewColorReset(), TypeString(pending.type));
-        pending.constraint->newType(cx, pending.source, pending.type);
-    }
-
-    resolving = false;
-}
-
 /////////////////////////////////////////////////////////////////////
 // TypeSet
 /////////////////////////////////////////////////////////////////////
@@ -1219,10 +1186,9 @@ ConstraintTypeSet::addType(ExclusiveContext *cxArg, Type type)
     if (JSContext *cx = cxArg->maybeJSContext()) {
         TypeConstraint *constraint = constraintList;
         while (constraint) {
-            cx->compartment()->types.addPending(cx, constraint, this, type);
+            constraint->newType(cx, this, type);
             constraint = constraint->next;
         }
-        cx->compartment()->types.resolvePending(cx);
     } else {
         JS_ASSERT(!constraintList);
     }
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index 3ba7d433c6f8..ee09906df5bd 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -215,7 +215,6 @@ StatsCompartmentCallback(JSRuntime *rt, void *data, JSCompartment *compartment)
 
     // Measure the compartment object itself, and things hanging off it.
     compartment->addSizeOfIncludingThis(rtStats->mallocSizeOf_,
-                                        &cStats.typeInferencePendingArrays,
                                         &cStats.typeInferenceAllocationSiteTables,
                                         &cStats.typeInferenceArrayTypeTables,
                                         &cStats.typeInferenceObjectTypeTables,
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 1a12e11d83b3..b225830e8efe 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2122,10 +2122,6 @@ ReportCompartmentStats(const JS::CompartmentStats &cStats,
                    cStats.typeInferenceTypeScripts,
                    "Memory used by type sets associated with scripts.");
 
-    ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/pending-arrays"),
-                   cStats.typeInferencePendingArrays,
-                   "Memory used for solving constraints during type inference.");
-
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/allocation-site-tables"),
                    cStats.typeInferenceAllocationSiteTables,
                    "Memory indexing type objects associated with allocation sites.");

From df442b71cb7ff5d931bebd28041ff7361d3145fa Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 12 Dec 2013 17:43:49 +0100
Subject: [PATCH 028/459] Bug 879402 - Fix possible leak in createArray and
 make it work for ggc, r=bhackett

---
 js/src/jsobjinlines.h | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 42c5d31eeb60..4bda696f6ac1 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -494,12 +494,6 @@ JSObject::createArray(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::
      */
     JS_ASSERT(js::gc::GetGCKindSlots(kind) >= js::ObjectElements::VALUES_PER_HEADER);
 
-    uint32_t capacity = js::gc::GetGCKindSlots(kind) - js::ObjectElements::VALUES_PER_HEADER;
-
-    JSObject *obj = js_NewGCObject<js::CanGC>(cx, kind, heap);
-    if (!obj)
-        return nullptr;
-
     js::HeapSlot *slots = nullptr;
     if (size_t nDynamicSlots = dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan())) {
         slots = cx->pod_malloc<js::HeapSlot>(nDynamicSlots);
@@ -508,6 +502,19 @@ JSObject::createArray(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::
         js::Debug_SetSlotRangeToCrashOnTouch(slots, nDynamicSlots);
     }
 
+    JSObject *obj = js_NewGCObject<js::CanGC>(cx, kind, heap);
+    if (!obj) {
+        js_free(slots);
+        return nullptr;
+    }
+
+#ifdef JSGC_GENERATIONAL
+    if (slots && heap != js::gc::TenuredHeap)
+        cx->asJSContext()->runtime()->gcNursery.notifyInitialSlots(obj, slots);
+#endif
+
+    uint32_t capacity = js::gc::GetGCKindSlots(kind) - js::ObjectElements::VALUES_PER_HEADER;
+
     obj->shape_.init(shape);
     obj->type_.init(type);
     obj->slots = slots;

From 55cc6f590018a0ba23f5ec1c0cb928fcf0f068fb Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Thu, 12 Dec 2013 13:56:32 -0500
Subject: [PATCH 029/459] Backed out changeset a29d7f5ddde6 (bug 932982) for
 ggc asserts.

---
 js/public/MemoryMetrics.h         |   1 +
 js/src/gc/Marking.cpp             |  46 ++++-
 js/src/gc/RootMarking.cpp         |   5 +
 js/src/gc/Statistics.cpp          |   1 +
 js/src/gc/Statistics.h            |   1 +
 js/src/gc/Zone.cpp                |  31 ++-
 js/src/gc/Zone.h                  |   2 +
 js/src/jit/CodeGenerator.cpp      |   6 +-
 js/src/jit/Ion.cpp                |  17 +-
 js/src/jit/Ion.h                  |   2 +-
 js/src/jit/IonBuilder.cpp         |   6 +-
 js/src/jit/IonCode.h              |   3 -
 js/src/jit/MIR.cpp                |   2 +-
 js/src/jscompartment.cpp          |  11 +-
 js/src/jscompartment.h            |   3 +
 js/src/jsgc.cpp                   |  14 +-
 js/src/jsgc.h                     |   7 +-
 js/src/jsinfer.cpp                | 329 +++++++++++++++---------------
 js/src/jsinfer.h                  | 122 +++++++----
 js/src/jsinferinlines.h           |  78 +++++--
 js/src/vm/MemoryMetrics.cpp       |   1 +
 js/xpconnect/src/XPCJSRuntime.cpp |   4 +
 22 files changed, 434 insertions(+), 258 deletions(-)

diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index f974259467d5..95ac91b9f6d5 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -393,6 +393,7 @@ struct CompartmentStats
     macro(Other,   NotLiveGCThing, baselineStubsOptimized) \
     macro(Other,   NotLiveGCThing, ionData) \
     macro(Other,   NotLiveGCThing, typeInferenceTypeScripts) \
+    macro(Other,   NotLiveGCThing, typeInferencePendingArrays) \
     macro(Other,   NotLiveGCThing, typeInferenceAllocationSiteTables) \
     macro(Other,   NotLiveGCThing, typeInferenceArrayTypeTables) \
     macro(Other,   NotLiveGCThing, typeInferenceObjectTypeTables) \
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index d0e3bde29e8a..b0c8a6555988 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1122,11 +1122,14 @@ gc::MarkCycleCollectorChildren(JSTracer *trc, Shape *shape)
 static void
 ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
 {
-    unsigned count = type->getPropertyCount();
-    for (unsigned i = 0; i < count; i++) {
-        types::Property *prop = type->getProperty(i);
-        if (prop && JSID_IS_STRING(prop->id))
-            PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
+    /* Don't mark properties for singletons. They'll be purged by the GC. */
+    if (!type->singleton) {
+        unsigned count = type->getPropertyCount();
+        for (unsigned i = 0; i < count; i++) {
+            types::Property *prop = type->getProperty(i);
+            if (prop && JSID_IS_STRING(prop->id))
+                PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
+        }
     }
 
     if (TaggedProto(type->proto).isObject())
@@ -1347,7 +1350,7 @@ GCMarker::restoreValueArray(JSObject *obj, void **vpp, void **endp)
 }
 
 void
-GCMarker::processMarkStackOther(uintptr_t tag, uintptr_t addr)
+GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr)
 {
     if (tag == TypeTag) {
         ScanTypeObject(this, reinterpret_cast<types::TypeObject *>(addr));
@@ -1361,6 +1364,35 @@ GCMarker::processMarkStackOther(uintptr_t tag, uintptr_t addr)
             pushObject(obj);
     } else if (tag == IonCodeTag) {
         MarkChildren(this, reinterpret_cast<jit::IonCode *>(addr));
+    } else if (tag == ArenaTag) {
+        ArenaHeader *aheader = reinterpret_cast<ArenaHeader *>(addr);
+        AllocKind thingKind = aheader->getAllocKind();
+        size_t thingSize = Arena::thingSize(thingKind);
+
+        for ( ; aheader; aheader = aheader->next) {
+            Arena *arena = aheader->getArena();
+            FreeSpan firstSpan(aheader->getFirstFreeSpan());
+            const FreeSpan *span = &firstSpan;
+
+            for (uintptr_t thing = arena->thingsStart(thingKind); ; thing += thingSize) {
+                JS_ASSERT(thing <= arena->thingsEnd());
+                if (thing == span->first) {
+                    if (!span->hasNext())
+                        break;
+                    thing = span->last;
+                    span = span->nextSpan();
+                } else {
+                    JSObject *object = reinterpret_cast<JSObject *>(thing);
+                    if (object->hasSingletonType() && object->markIfUnmarked(getMarkColor()))
+                        pushObject(object);
+                    budget.step();
+                }
+            }
+            if (budget.isOverBudget()) {
+                pushArenaList(aheader);
+                return;
+            }
+        }
     }
 }
 
@@ -1398,7 +1430,7 @@ GCMarker::processMarkStackTop(SliceBudget &budget)
         goto scan_obj;
     }
 
-    processMarkStackOther(tag, addr);
+    processMarkStackOther(budget, tag, addr);
     return;
 
   scan_value_array:
diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index 541ad84d996c..8ae3e85fd559 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -726,6 +726,11 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
         if (IS_GC_MARKING_TRACER(trc) && !zone->isCollecting())
             continue;
 
+        if (IS_GC_MARKING_TRACER(trc) && zone->isPreservingCode()) {
+            gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_MARK_TYPES);
+            zone->markTypes(trc);
+        }
+
         /* Do not discard scripts with counts while profiling. */
         if (rt->profilingScripts && !rt->isHeapMinorCollecting()) {
             for (CellIterUnderGC i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index be76eee734a1..7744b61d53f5 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -276,6 +276,7 @@ static const PhaseInfo phases[] = {
     { PHASE_PURGE, "Purge", PHASE_NO_PARENT },
     { PHASE_MARK, "Mark", PHASE_NO_PARENT },
     { PHASE_MARK_ROOTS, "Mark Roots", PHASE_MARK },
+    { PHASE_MARK_TYPES, "Mark Types", PHASE_MARK_ROOTS },
     { PHASE_MARK_DELAYED, "Mark Delayed", PHASE_MARK },
     { PHASE_SWEEP, "Sweep", PHASE_NO_PARENT },
     { PHASE_SWEEP_MARK, "Mark During Sweeping", PHASE_SWEEP },
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 1029fd52fe8e..3240fd238f53 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -28,6 +28,7 @@ enum Phase {
     PHASE_PURGE,
     PHASE_MARK,
     PHASE_MARK_ROOTS,
+    PHASE_MARK_TYPES,
     PHASE_MARK_DELAYED,
     PHASE_SWEEP,
     PHASE_SWEEP_MARK,
diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
index 539faabbd7c8..ad0c2fae7fde 100644
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -80,6 +80,35 @@ Zone::setNeedsBarrier(bool needs, ShouldUpdateIon updateIon)
     needsBarrier_ = needs;
 }
 
+void
+Zone::markTypes(JSTracer *trc)
+{
+    /*
+     * Mark all scripts, type objects and singleton JS objects in the
+     * compartment. These can be referred to directly by type sets, which we
+     * cannot modify while code which depends on these type sets is active.
+     */
+    JS_ASSERT(isPreservingCode());
+
+    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+        JSScript *script = i.get<JSScript>();
+        MarkScriptRoot(trc, &script, "mark_types_script");
+        JS_ASSERT(script == i.get<JSScript>());
+    }
+
+    for (size_t thingKind = FINALIZE_OBJECT0; thingKind < FINALIZE_OBJECT_LIMIT; thingKind++) {
+        ArenaHeader *aheader = allocator.arenas.getFirstArena(static_cast<AllocKind>(thingKind));
+        if (aheader)
+            trc->runtime->gcMarker.pushArenaList(aheader);
+    }
+
+    for (CellIterUnderGC i(this, FINALIZE_TYPE_OBJECT); !i.done(); i.next()) {
+        types::TypeObject *type = i.get<types::TypeObject>();
+        MarkTypeObjectRoot(trc, &type, "mark_types_scan");
+        JS_ASSERT(type == i.get<types::TypeObject>());
+    }
+}
+
 void
 Zone::resetGCMallocBytes()
 {
@@ -115,7 +144,7 @@ Zone::sweep(FreeOp *fop, bool releaseTypes)
     if (active)
         releaseTypes = false;
 
-    {
+    if (!isPreservingCode()) {
         gcstats::AutoPhase ap(fop->runtime()->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
         types.sweep(fop, releaseTypes);
     }
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index a2fe6a22a022..ebad06d0b6c9 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -310,6 +310,8 @@ struct Zone : public JS::shadow::Zone,
         js_ReportAllocationOverflow(nullptr);
     }
 
+    void markTypes(JSTracer *trc);
+
     js::types::TypeZone types;
 
     void sweep(js::FreeOp *fop, bool releaseTypes);
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index c15f164ec681..cc1095ff392b 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -5890,7 +5890,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                      safepoints_.size(), callTargets.length(),
                      patchableBackedges_.length(), optimizationLevel);
     if (!ionScript) {
-        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
         return false;
     }
 
@@ -5915,7 +5915,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         // Use js_free instead of IonScript::Destroy: the cache list and
         // backedge list are still uninitialized.
         js_free(ionScript);
-        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
         return false;
     }
 
@@ -5936,7 +5936,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                         /* resetUses */ false, /* cancelOffThread*/ false))
         {
             js_free(ionScript);
-            recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
+            recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
             return false;
         }
     }
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 546e31c1ca8c..92a1e4aed529 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2508,7 +2508,7 @@ jit::InvalidateAll(FreeOp *fop, Zone *zone)
 
 
 void
-jit::Invalidate(types::TypeZone &types, FreeOp *fop,
+jit::Invalidate(types::TypeCompartment &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
@@ -2591,7 +2591,7 @@ void
 jit::Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
-    jit::Invalidate(cx->zone()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
+    jit::Invalidate(cx->compartment()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
                     cancelOffThread);
 }
 
@@ -2638,13 +2638,14 @@ FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool p
     else
         script->setIonScript(nullptr);
 
-    types::TypeZone &types = script->zone()->types;
-    ionScript->recompileInfo().compilerOutput(types)->invalidate();
-
-    // If this script has Ion code on the stack, invalidated() will return
+    // If this script has Ion code on the stack, invalidation() will return
     // true. In this case we have to wait until destroying it.
-    if (!ionScript->invalidated())
+    if (!ionScript->invalidated()) {
+        types::TypeCompartment &types = script->compartment()->types;
+        ionScript->recompileInfo().compilerOutput(types)->invalidate();
+
         jit::IonScript::Destroy(fop, ionScript);
+    }
 }
 
 void
@@ -2663,6 +2664,8 @@ jit::FinishDiscardJitCode(FreeOp *fop, JSCompartment *comp)
     // Free optimized baseline stubs.
     if (comp->jitCompartment())
         comp->jitCompartment()->optimizedStubSpace()->free();
+
+    comp->types.clearCompilerOutputs(fop);
 }
 
 void
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 780fc993901f..f516f1e12698 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -127,7 +127,7 @@ IonExecStatus IonCannon(JSContext *cx, RunState &state);
 IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
-void Invalidate(types::TypeZone &types, FreeOp *fop,
+void Invalidate(types::TypeCompartment &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
                 bool cancelOffThread = true);
 void Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 2ca4b692c083..24eeae4a238e 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6321,7 +6321,7 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints()))
+        property.configured(constraints(), staticType))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -6411,7 +6411,7 @@ IonBuilder::setStaticName(JSObject *staticObject, PropertyName *name)
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints()))
+        property.configured(constraints(), staticType))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -7861,7 +7861,7 @@ IonBuilder::getDefiniteSlot(types::TemporaryTypeSet *types, PropertyName *name,
     *property = type->property(id);
     return property->maybeTypes() &&
            property->maybeTypes()->definiteProperty() &&
-           !property->configured(constraints());
+           !property->configured(constraints(), type);
 }
 
 bool
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index 286cbeb9e882..d3ecaa94223e 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -531,9 +531,6 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
-    types::RecompileInfo& recompileInfoRef() {
-        return recompileInfo_;
-    }
     OptimizationLevel optimizationLevel() const {
         return optimizationLevel_;
     }
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 882b468f6a7b..aad9234a367f 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3025,7 +3025,7 @@ jit::PropertyReadIsIdempotent(types::CompilerConstraintList *constraints,
 
             // Check if the property has been reconfigured or is a getter.
             types::HeapTypeSetKey property = object->property(NameToId(name));
-            if (property.configured(constraints))
+            if (property.configured(constraints, object))
                 return false;
         }
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index f9dd807606db..a4132018c96f 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -48,6 +48,7 @@ JSCompartment::JSCompartment(Zone *zone, const JS::CompartmentOptions &options =
 #endif
     global_(nullptr),
     enterCompartmentDepth(0),
+    lastCodeRelease(0),
     data(nullptr),
     objectMetadataCallback(nullptr),
     lastAnimationTime(0),
@@ -544,6 +545,13 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
         WeakMapBase::sweepCompartment(this);
     }
 
+    if (zone()->isPreservingCode()) {
+        gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
+        types.sweepShapes(fop);
+    } else {
+        JS_ASSERT(!types.constrainedOutputs);
+    }
+
     NativeIterator *ni = enumerators->next();
     while (ni != enumerators) {
         JSObject *iterObj = ni->iterObj();
@@ -856,6 +864,7 @@ JSCompartment::clearTraps(FreeOp *fop)
 
 void
 JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                      size_t *tiPendingArrays,
                                       size_t *tiAllocationSiteTables,
                                       size_t *tiArrayTypeTables,
                                       size_t *tiObjectTypeTables,
@@ -867,7 +876,7 @@ JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                       size_t *baselineStubsOptimized)
 {
     *compartmentObject += mallocSizeOf(this);
-    types.addSizeOfExcludingThis(mallocSizeOf, tiAllocationSiteTables,
+    types.addSizeOfExcludingThis(mallocSizeOf, tiPendingArrays, tiAllocationSiteTables,
                                  tiArrayTypeTables, tiObjectTypeTables);
     *shapesCompartmentTables += baseShapes.sizeOfExcludingThis(mallocSizeOf)
                               + initialShapes.sizeOfExcludingThis(mallocSizeOf)
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index f44c2b09e390..15a93afe1280 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -187,6 +187,8 @@ struct JSCompartment
      */
     void adoptWorkerAllocator(js::Allocator *workerAllocator);
 
+
+    int64_t                      lastCodeRelease;
     bool                         activeAnalysis;
 
     /* Type information about the scripts and objects in this compartment. */
@@ -219,6 +221,7 @@ struct JSCompartment
 
   public:
     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                size_t *tiPendingArrays,
                                 size_t *tiAllocationSiteTables,
                                 size_t *tiArrayTypeTables,
                                 size_t *tiObjectTypeTables,
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 27242bdcdb39..dd3cde985825 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2854,9 +2854,13 @@ ShouldPreserveJITCode(JSCompartment *comp, int64_t currentTime)
 
     if (rt->alwaysPreserveCode)
         return true;
-    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime)
+    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime &&
+        comp->lastCodeRelease + (PRMJ_USEC_PER_SEC * 300) >= currentTime)
+    {
         return true;
+    }
 
+    comp->lastCodeRelease = currentTime;
     return false;
 }
 
@@ -3935,12 +3939,12 @@ BeginSweepingZoneGroup(JSRuntime *rt)
         bool releaseTypes = ReleaseObservedTypes(rt);
         for (GCCompartmentGroupIter c(rt); !c.done(); c.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            c->sweep(&fop, releaseTypes && !c->zone()->isPreservingCode());
+            c->sweep(&fop, releaseTypes);
         }
 
         for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            zone->sweep(&fop, releaseTypes && !zone->isPreservingCode());
+            zone->sweep(&fop, releaseTypes);
         }
     }
 
@@ -5289,6 +5293,10 @@ js::ReleaseAllJITCode(FreeOp *fop)
             jit::FinishDiscardBaselineScript(fop, script);
         }
     }
+
+    /* Sweep now invalidated compiler outputs from each compartment. */
+    for (CompartmentsIter comp(fop->runtime(), SkipAtoms); !comp.done(); comp.next())
+        comp->types.clearCompilerOutputs(fop);
 #endif
 }
 
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 9159f31ec024..2e5cbe360930 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -1091,6 +1091,7 @@ struct GCMarker : public JSTracer {
         ObjectTag,
         TypeTag,
         XmlTag,
+        ArenaTag,
         SavedValueArrayTag,
         IonCodeTag,
         LastTag = IonCodeTag
@@ -1118,6 +1119,10 @@ struct GCMarker : public JSTracer {
         pushTaggedPtr(ObjectTag, obj);
     }
 
+    void pushArenaList(gc::ArenaHeader *firstArena) {
+        pushTaggedPtr(ArenaTag, firstArena);
+    }
+
     void pushType(types::TypeObject *type) {
         pushTaggedPtr(TypeTag, type);
     }
@@ -1224,7 +1229,7 @@ struct GCMarker : public JSTracer {
     bool restoreValueArray(JSObject *obj, void **vpp, void **endp);
     void saveValueRanges();
     inline void processMarkStackTop(SliceBudget &budget);
-    void processMarkStackOther(uintptr_t tag, uintptr_t addr);
+    void processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr);
 
     void appendGrayRoot(void *thing, JSGCTraceKind kind);
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 51c19af54640..0c1fe0167a3c 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -243,6 +243,14 @@ types::TypeHasProperty(JSContext *cx, TypeObject *obj, jsid id, const Value &val
         if (id == id___proto__(cx) || id == id_constructor(cx) || id == id_caller(cx))
             return true;
 
+        /*
+         * If we called in here while resolving a type constraint, we may be in the
+         * middle of resolving a standard class and the type sets will not be updated
+         * until the outer TypeSet::add finishes.
+         */
+        if (cx->compartment()->types.pendingCount)
+            return true;
+
         Type type = GetValueType(value);
 
         AutoEnterAnalysis enter(cx);
@@ -734,12 +742,12 @@ class TypeCompilerConstraint : public TypeConstraint
 
     void newType(JSContext *cx, TypeSet *source, Type type) {
         if (data.invalidateOnNewType(type))
-            cx->zone()->types.addPendingRecompile(cx, compilation);
+            cx->compartment()->types.addPendingRecompile(cx, compilation);
     }
 
     void newPropertyState(JSContext *cx, TypeSet *source) {
         if (data.invalidateOnNewPropertyState(source))
-            cx->zone()->types.addPendingRecompile(cx, compilation);
+            cx->compartment()->types.addPendingRecompile(cx, compilation);
     }
 
     void newObjectState(JSContext *cx, TypeObject *object) {
@@ -747,16 +755,7 @@ class TypeCompilerConstraint : public TypeConstraint
         // will be sent on changes to its state, so always invalidate any
         // associated compilations.
         if (object->unknownProperties() || data.invalidateOnNewObjectState(object))
-            cx->zone()->types.addPendingRecompile(cx, compilation);
-    }
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (data.shouldSweep() || compilation.shouldSweep(zone))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeCompilerConstraint<T> >(compilation, data);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
+            cx->compartment()->types.addPendingRecompile(cx, compilation);
     }
 };
 
@@ -909,21 +908,13 @@ class TypeConstraintFreezeStack : public TypeConstraint
 
     const char *kind() { return "freezeStack"; }
 
-    void newType(JSContext *cx, TypeSet *source, Type type) {
+    void newType(JSContext *cx, TypeSet *source, Type type)
+    {
         /*
          * Unlike TypeConstraintFreeze, triggering this constraint once does
          * not disable it on future changes to the type set.
          */
-        cx->zone()->types.addPendingRecompile(cx, script_);
-    }
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (IsScriptAboutToBeFinalized(&script_))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintFreezeStack>(script_);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
+        cx->compartment()->types.addPendingRecompile(cx, script_);
     }
 };
 
@@ -938,22 +929,15 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
 
     CompilerOutput co(script, executionMode);
 
-    TypeZone &types = cx->zone()->types;
-    if (!types.compilerOutputs) {
-        types.compilerOutputs = cx->new_< Vector<CompilerOutput> >(cx);
-        if (!types.compilerOutputs)
+    TypeCompartment &types = cx->compartment()->types;
+    if (!types.constrainedOutputs) {
+        types.constrainedOutputs = cx->new_< Vector<CompilerOutput> >(cx);
+        if (!types.constrainedOutputs)
             return false;
     }
 
-#ifdef DEBUG
-    for (size_t i = 0; i < types.compilerOutputs->length(); i++) {
-        const CompilerOutput &co = (*types.compilerOutputs)[i];
-        JS_ASSERT_IF(co.isValid(), co.script() != script || co.mode() != executionMode);
-    }
-#endif
-
-    uint32_t index = types.compilerOutputs->length();
-    if (!types.compilerOutputs->append(co))
+    uint32_t index = types.constrainedOutputs->length();
+    if (!types.constrainedOutputs->append(co))
         return false;
 
     *precompileInfo = RecompileInfo(index);
@@ -995,8 +979,8 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
             array[i].add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeStack>(entry.script), false);
     }
 
-    if (!succeeded || types.compilerOutputs->back().pendingInvalidation()) {
-        types.compilerOutputs->back().invalidate();
+    if (!succeeded || types.constrainedOutputs->back().pendingInvalidation()) {
+        types.constrainedOutputs->back().invalidate();
         script->resetUseCount();
         return false;
     }
@@ -1025,8 +1009,6 @@ class ConstraintDataFreeze
                ? property.maybeTypes()->isSubset(expected)
                : property.maybeTypes()->empty();
     }
-
-    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1213,8 +1195,6 @@ class ConstraintDataFreezeObjectFlags
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
-
-    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1309,8 +1289,6 @@ class ConstraintDataFreezeObjectForInlinedCall
     {
         return true;
     }
-
-    bool shouldSweep() { return false; }
 };
 
 // Constraint which triggers recompilation when the template object for a
@@ -1337,11 +1315,6 @@ class ConstraintDataFreezeObjectForNewScriptTemplate
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
-
-    bool shouldSweep() {
-        // Note: |templateObject| is only used for equality testing.
-        return false;
-    }
 };
 
 // Constraint which triggers recompilation when the underlying data pointer for
@@ -1368,11 +1341,6 @@ class ConstraintDataFreezeObjectForTypedArrayBuffer
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
-
-    bool shouldSweep() {
-        // Note: |viewData| is only used for equality testing.
-        return false;
-    }
 };
 
 } /* anonymous namespace */
@@ -1445,7 +1413,10 @@ namespace {
 class ConstraintDataFreezeConfiguredProperty
 {
   public:
-    ConstraintDataFreezeConfiguredProperty()
+    TypeObjectKey *object;
+
+    ConstraintDataFreezeConfiguredProperty(TypeObjectKey *object)
+      : object(object)
     {}
 
     const char *kind() { return "freezeConfiguredProperty"; }
@@ -1459,16 +1430,31 @@ class ConstraintDataFreezeConfiguredProperty
     bool constraintHolds(JSContext *cx,
                          const HeapTypeSetKey &property, TemporaryTypeSet *expected)
     {
+        // Everywhere compiled code depends on definite properties associated
+        // with a type object's newScript, we need to make sure there are
+        // constraints in place which will mark those properties as configured
+        // should the definite properties be invalidated.
+        TypeObject *type = object->isSingleObject()
+                           ? object->asSingleObject()->type()
+                           : object->asTypeObject();
+        if (type->flags & OBJECT_FLAG_NEW_SCRIPT_REGENERATE) {
+            type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
+            if (type->hasNewScript()) {
+                CheckNewScriptProperties(cx, type, type->newScript()->fun);
+            } else {
+                JS_ASSERT(type->flags & OBJECT_FLAG_ADDENDUM_CLEARED);
+                type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
+            }
+        }
+
         return !property.maybeTypes()->configuredProperty();
     }
-
-    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
 
 bool
-HeapTypeSetKey::configured(CompilerConstraintList *constraints)
+HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *type)
 {
     if (maybeTypes() && maybeTypes()->configuredProperty())
         return true;
@@ -1477,7 +1463,7 @@ HeapTypeSetKey::configured(CompilerConstraintList *constraints)
 
     typedef CompilerConstraintInstance<ConstraintDataFreezeConfiguredProperty> T;
     constraints->add(alloc->new_<T>(alloc, *this,
-                                    ConstraintDataFreezeConfiguredProperty()));
+                                    ConstraintDataFreezeConfiguredProperty(type)));
     return false;
 }
 
@@ -2000,7 +1986,7 @@ PrototypeHasIndexedProperty(CompilerConstraintList *constraints, JSObject *obj)
         if (type->unknownProperties())
             return true;
         HeapTypeSetKey index = type->property(JSID_VOID);
-        if (index.configured(constraints) || index.isOwnProperty(constraints))
+        if (index.configured(constraints, type) || index.isOwnProperty(constraints))
             return true;
         obj = obj->getProto();
     } while (obj);
@@ -2038,8 +2024,27 @@ types::TypeCanHaveExtraIndexedProperties(CompilerConstraintList *constraints,
     return PrototypeHasIndexedProperty(constraints, proto);
 }
 
+bool
+TypeCompartment::growPendingArray(JSContext *cx)
+{
+    unsigned newCapacity = js::Max(unsigned(100), pendingCapacity * 2);
+    PendingWork *newArray = js_pod_calloc<PendingWork>(newCapacity);
+    if (!newArray) {
+        cx->compartment()->types.setPendingNukeTypes(cx);
+        return false;
+    }
+
+    PodCopy(newArray, pendingArray, pendingCount);
+    js_free(pendingArray);
+
+    pendingArray = newArray;
+    pendingCapacity = newCapacity;
+
+    return true;
+}
+
 void
-TypeZone::processPendingRecompiles(FreeOp *fop)
+TypeCompartment::processPendingRecompiles(FreeOp *fop)
 {
     if (!pendingRecompiles)
         return;
@@ -2090,9 +2095,11 @@ TypeZone::nukeTypes(FreeOp *fop)
      */
     JS_ASSERT(pendingNukeTypes);
 
-    if (pendingRecompiles) {
-        fop->free_(pendingRecompiles);
-        pendingRecompiles = nullptr;
+    for (CompartmentsInZoneIter comp(zone()); !comp.done(); comp.next()) {
+        if (comp->types.pendingRecompiles) {
+            fop->free_(comp->types.pendingRecompiles);
+            comp->types.pendingRecompiles = nullptr;
+        }
     }
 
     inferenceEnabled = false;
@@ -2112,7 +2119,7 @@ TypeZone::nukeTypes(FreeOp *fop)
 }
 
 void
-TypeZone::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
+TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 {
     CompilerOutput *co = info.compilerOutput(cx);
     if (!co || !co->isValid() || co->pendingInvalidation())
@@ -2138,7 +2145,7 @@ TypeZone::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 }
 
 void
-TypeZone::addPendingRecompile(JSContext *cx, JSScript *script)
+TypeCompartment::addPendingRecompile(JSContext *cx, JSScript *script)
 {
     JS_ASSERT(script);
 
@@ -3139,15 +3146,6 @@ class TypeConstraintClearDefiniteGetterSetter : public TypeConstraint
     }
 
     void newType(JSContext *cx, TypeSet *source, Type type) {}
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (IsTypeObjectAboutToBeFinalized(&object))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteGetterSetter>(object);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
-    }
 };
 
 bool
@@ -3194,15 +3192,6 @@ class TypeConstraintClearDefiniteSingle : public TypeConstraint
         if (source->baseFlags() || source->getObjectCount() > 1)
             object->clearAddendum(cx);
     }
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (IsTypeObjectAboutToBeFinalized(&object))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteSingle>(object);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
-    }
 };
 
 void
@@ -3952,19 +3941,8 @@ ConstraintTypeSet::sweep(Zone *zone)
         }
     }
 
-    /*
-     * Type constraints only hold weak references. Copy constraints referring
-     * to data that is still live into the zone's new arena.
-     */
-    TypeConstraint *constraint = constraintList;
+    /* All constraints are wiped out on each GC. */
     constraintList = nullptr;
-    while (constraint) {
-        if (TypeConstraint *copy = constraint->sweep(zone->types)) {
-            copy->next = constraintList;
-            constraintList = copy;
-        }
-        constraint = constraint->next;
-    }
 }
 
 inline void
@@ -3984,6 +3962,18 @@ TypeObject::clearProperties()
 inline void
 TypeObject::sweep(FreeOp *fop)
 {
+    if (singleton) {
+        JS_ASSERT(!hasNewScript());
+
+        /*
+         * All properties can be discarded. We will regenerate them as needed
+         * as code gets reanalyzed.
+         */
+        clearProperties();
+
+        return;
+    }
+
     if (!isMarked()) {
         if (addendum)
             fop->free_(addendum);
@@ -4006,14 +3996,6 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < oldCapacity; i++) {
             Property *prop = oldArray[i];
             if (prop) {
-                if (singleton && !prop->types.constraintList) {
-                    /*
-                     * Don't copy over properties of singleton objects which
-                     * don't have associated constraints. The contents of these
-                     * type sets will be regenerated as necessary.
-                     */
-                    continue;
-                }
                 Property *newProp = typeLifoAlloc.new_<Property>(*prop);
                 if (newProp) {
                     Property **pentry =
@@ -4033,17 +4015,12 @@ TypeObject::sweep(FreeOp *fop)
         setBasePropertyCount(propertyCount);
     } else if (propertyCount == 1) {
         Property *prop = (Property *) propertySet;
-        if (singleton && !prop->types.constraintList) {
-            // Skip, as above.
-            clearProperties();
+        Property *newProp = typeLifoAlloc.new_<Property>(*prop);
+        if (newProp) {
+            propertySet = (Property **) newProp;
+            newProp->types.sweep(zone());
         } else {
-            Property *newProp = typeLifoAlloc.new_<Property>(*prop);
-            if (newProp) {
-                propertySet = (Property **) newProp;
-                newProp->types.sweep(zone());
-            } else {
-                zone()->types.setPendingNukeTypes();
-            }
+            zone()->types.setPendingNukeTypes();
         }
     }
 
@@ -4051,6 +4028,14 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < basePropertyCount(); i++)
             JS_ASSERT(propertySet[i]);
     }
+
+    /*
+     * The GC will clear out the constraints ensuring the correctness of the
+     * newScript information, these constraints will need to be regenerated
+     * the next time we compile code which depends on this info.
+     */
+    if (hasNewScript())
+        flags |= OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
 }
 
 void
@@ -4134,6 +4119,52 @@ TypeCompartment::sweep(FreeOp *fop)
                 e.rekeyFront(key);
         }
     }
+
+    /*
+     * The pending array is reset on GC, it can grow large (75+ KB) and is easy
+     * to reallocate if the compartment becomes active again.
+     */
+    if (pendingArray)
+        fop->free_(pendingArray);
+
+    pendingArray = nullptr;
+    pendingCapacity = 0;
+}
+
+void
+TypeCompartment::sweepShapes(FreeOp *fop)
+{
+    /*
+     * Sweep any weak shape references that may be finalized even if a GC is
+     * preserving type information.
+     */
+    if (objectTypeTable) {
+        for (ObjectTypeTable::Enum e(*objectTypeTable); !e.empty(); e.popFront()) {
+            const ObjectTableKey &key = e.front().key();
+            ObjectTableEntry &entry = e.front().value();
+
+            if (IsShapeAboutToBeFinalized(entry.shape.unsafeGet())) {
+                fop->free_(key.properties);
+                fop->free_(entry.types);
+                e.removeFront();
+            }
+        }
+    }
+}
+
+void
+TypeCompartment::clearCompilerOutputs(FreeOp *fop)
+{
+    if (constrainedOutputs) {
+        fop->delete_(constrainedOutputs);
+        constrainedOutputs = nullptr;
+    }
+
+    if (pendingRecompiles) {
+        JS_ASSERT(pendingRecompiles->length() == 0);
+        fop->delete_(pendingRecompiles);
+        pendingRecompiles = nullptr;
+    }
 }
 
 void
@@ -4162,6 +4193,7 @@ JSCompartment::sweepNewTypeObjectTable(TypeObjectWithNewScriptSet &table)
 
 TypeCompartment::~TypeCompartment()
 {
+    js_free(pendingArray);
     js_delete(arrayTypeTable);
     js_delete(objectTypeTable);
     js_delete(allocationSiteTable);
@@ -4180,6 +4212,12 @@ TypeScript::Sweep(FreeOp *fop, JSScript *script)
     /* Remove constraints and references to dead objects from the persistent type sets. */
     for (unsigned i = 0; i < num; i++)
         typeArray[i].sweep(compartment->zone());
+
+    /*
+     * Freeze constraints on stack type sets need to be regenerated the next
+     * time the script is analyzed.
+     */
+    script->clearHasFreezeConstraints();
 }
 
 void
@@ -4196,10 +4234,20 @@ Zone::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, size_t *typePoo
 
 void
 TypeCompartment::addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                        size_t *pendingArrays,
                                         size_t *allocationSiteTables,
                                         size_t *arrayTypeTables,
                                         size_t *objectTypeTables)
 {
+    /* Pending arrays are cleared on GC along with the analysis pool. */
+    *pendingArrays += mallocSizeOf(pendingArray);
+
+    /*
+     * TypeCompartment::pendingRecompiles is non-nullptr only while inference
+     * code is running.
+     */
+    JS_ASSERT(!pendingRecompiles);
+
     if (allocationSiteTable)
         *allocationSiteTables += allocationSiteTable->sizeOfIncludingThis(mallocSizeOf);
 
@@ -4241,8 +4289,6 @@ TypeObject::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
 TypeZone::TypeZone(Zone *zone)
   : zone_(zone),
     typeLifoAlloc(TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
-    compilerOutputs(nullptr),
-    pendingRecompiles(nullptr),
     pendingNukeTypes(false),
     inferenceEnabled(false)
 {
@@ -4250,8 +4296,6 @@ TypeZone::TypeZone(Zone *zone)
 
 TypeZone::~TypeZone()
 {
-    js_delete(compilerOutputs);
-    js_delete(pendingRecompiles);
 }
 
 void
@@ -4268,21 +4312,11 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
     LifoAlloc oldAlloc(typeLifoAlloc.defaultChunkSize());
     oldAlloc.steal(&typeLifoAlloc);
 
-    /* Sweep and find compressed indexes for each compiler output. */
-    size_t newCompilerOutputCount = 0;
-    if (compilerOutputs) {
-        for (size_t i = 0; i < compilerOutputs->length(); i++) {
-            CompilerOutput &output = (*compilerOutputs)[i];
-            if (output.isValid()) {
-                JSScript *script = output.script();
-                if (IsScriptAboutToBeFinalized(&script))
-                    output.invalidate();
-                else
-                    output.setSweepIndex(newCompilerOutputCount++);
-            }
-        }
-    }
-
+    /*
+     * Sweep analysis information and everything depending on it from the
+     * compartment, including all remaining mjit code if inference is
+     * enabled in the compartment.
+     */
     if (inferenceEnabled) {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_TI);
 
@@ -4294,21 +4328,6 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
                 if (releaseTypes) {
                     script->types->destroy();
                     script->types = nullptr;
-
-                    /*
-                     * Freeze constraints on stack type sets need to be
-                     * regenerated the next time the script is analyzed.
-                     */
-                    script->clearHasFreezeConstraints();
-
-                    JS_ASSERT(!script->hasIonScript());
-                    JS_ASSERT(!script->hasParallelIonScript());
-                } else {
-                    /* Update the recompile indexes in any IonScripts still on the script. */
-                    if (script->hasIonScript())
-                        script->ionScript()->recompileInfoRef().shouldSweep(*this);
-                    if (script->hasParallelIonScript())
-                        script->parallelIonScript()->recompileInfoRef().shouldSweep(*this);
                 }
             }
         }
@@ -4328,20 +4347,6 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
             comp->types.sweep(fop);
     }
 
-    if (compilerOutputs) {
-        size_t sweepIndex = 0;
-        for (size_t i = 0; i < compilerOutputs->length(); i++) {
-            CompilerOutput output = (*compilerOutputs)[i];
-            if (output.isValid()) {
-                JS_ASSERT(sweepIndex == output.sweepIndex());
-                output.setSweepIndex(0);
-                (*compilerOutputs)[sweepIndex++] = output;
-            }
-        }
-        JS_ASSERT(sweepIndex == newCompilerOutputCount);
-        JS_ALWAYS_TRUE(compilerOutputs->resize(newCompilerOutputCount));
-    }
-
     {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_CLEAR_SCRIPT_ANALYSIS);
         for (CellIterUnderGC i(zone(), FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 38c3be127e82..690631dfa7ad 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -177,7 +177,7 @@ namespace analyze {
 
 namespace types {
 
-class TypeZone;
+class TypeCompartment;
 class TypeSet;
 class TypeObjectKey;
 
@@ -278,10 +278,28 @@ inline Type GetValueType(const Value &val);
  * Type information about the values observed within scripts and about the
  * contents of the heap is accumulated as the program executes. Compilation
  * accumulates constraints relating type information on the heap with the
- * compilations that should be invalidated when those types change. Type
- * information and constraints are allocated in the zone's typeLifoAlloc,
- * and on GC all data referring to live things is copied into a new allocator.
- * Thus, type set and constraints only hold weak references.
+ * compilations that should be invalidated when those types change. This data
+ * is periodically cleared to reduce memory usage.
+ *
+ * GCs may clear both analysis information and jitcode. Sometimes GCs will
+ * preserve all information and code, and will not collect any scripts, type
+ * objects or singleton JS objects.
+ *
+ * The following data is cleared by all non-preserving GCs:
+ *
+ * - The ScriptAnalysis for each analyzed script and data from each analysis
+ *   pass performed.
+ *
+ * - Property type sets for singleton JS objects.
+ *
+ * - Type constraints and dead references in all type sets.
+ *
+ * The following data is occasionally cleared by non-preserving GCs:
+ *
+ * - TypeScripts and their type sets are occasionally destroyed, per a timer.
+ *
+ * - When a JSScript or TypeObject is swept, type information for its contents
+ *   is destroyed.
  */
 
 /*
@@ -316,12 +334,6 @@ public:
      * state.
      */
     virtual void newObjectState(JSContext *cx, TypeObject *object) {}
-
-    /*
-     * If the data this constraint refers to is still live, copy it into the
-     * zone's new allocator. Type constraints only hold weak references.
-     */
-    virtual TypeConstraint *sweep(TypeZone &zone) = 0;
 };
 
 /* Flags and other state stored in TypeSet::flags */
@@ -382,6 +394,13 @@ enum {
     /* If set, addendum information should not be installed on this object. */
     OBJECT_FLAG_ADDENDUM_CLEARED      = 0x2,
 
+    /*
+     * If set, type constraints covering the correctness of the newScript
+     * definite properties need to be regenerated before compiling any jitcode
+     * which depends on this information.
+     */
+    OBJECT_FLAG_NEW_SCRIPT_REGENERATE = 0x4,
+
     /*
      * Whether we have ensured all type sets in the compartment contain
      * ANYOBJECT instead of this object.
@@ -850,6 +869,12 @@ struct TypeTypedObject : public TypeObjectAddendum
  * information is sensitive to changes in the property's type. Future changes
  * to the property (whether those uncovered by analysis or those occurring
  * in the VM) will treat these properties like those of any other type object.
+ *
+ * When a GC occurs, we wipe out all analysis information for all the
+ * compartment's scripts, so can destroy all properties on singleton type
+ * objects at the same time. If there is no reference on the stack to the
+ * type object itself, the type object is also destroyed, and the JS object
+ * reverts to having a lazy type.
  */
 
 /* Type information about an object accessed by a script. */
@@ -1291,7 +1316,7 @@ class HeapTypeSetKey
 
     void freeze(CompilerConstraintList *constraints);
     JSValueType knownTypeTag(CompilerConstraintList *constraints);
-    bool configured(CompilerConstraintList *constraints);
+    bool configured(CompilerConstraintList *constraints, TypeObjectKey *type);
     bool isOwnProperty(CompilerConstraintList *constraints);
     bool knownSubset(CompilerConstraintList *constraints, const HeapTypeSetKey &other);
     JSObject *singleton(CompilerConstraintList *constraints);
@@ -1314,10 +1339,6 @@ class CompilerOutput
     // Whether this compilation is about to be invalidated.
     bool pendingInvalidation_ : 1;
 
-    // During sweeping, the list of compiler outputs is compacted and invalidated
-    // outputs are removed. This gives the new index for a valid compiler output.
-    uint32_t sweepIndex_ : 29;
-
   public:
     CompilerOutput()
       : script_(nullptr), mode_(SequentialExecution), pendingInvalidation_(false)
@@ -1345,15 +1366,6 @@ class CompilerOutput
     bool pendingInvalidation() {
         return pendingInvalidation_;
     }
-
-    void setSweepIndex(uint32_t index) {
-        if (index >= 1 << 29)
-            MOZ_CRASH();
-        sweepIndex_ = index;
-    }
-    uint32_t sweepIndex() {
-        return sweepIndex_;
-    }
 };
 
 class RecompileInfo
@@ -1368,9 +1380,8 @@ class RecompileInfo
     bool operator == (const RecompileInfo &o) const {
         return outputIndex == o.outputIndex;
     }
-    CompilerOutput *compilerOutput(TypeZone &types) const;
+    CompilerOutput *compilerOutput(TypeCompartment &types) const;
     CompilerOutput *compilerOutput(JSContext *cx) const;
-    bool shouldSweep(TypeZone &types);
 };
 
 /* Type information for a compartment. */
@@ -1378,9 +1389,32 @@ struct TypeCompartment
 {
     /* Constraint solving worklist structures. */
 
+    /*
+     * Worklist of types which need to be propagated to constraints. We use a
+     * worklist to avoid blowing the native stack.
+     */
+    struct PendingWork
+    {
+        TypeConstraint *constraint;
+        ConstraintTypeSet *source;
+        Type type;
+    };
+    PendingWork *pendingArray;
+    unsigned pendingCount;
+    unsigned pendingCapacity;
+
+    /* Whether we are currently resolving the pending worklist. */
+    bool resolving;
+
     /* Number of scripts in this compartment. */
     unsigned scriptCount;
 
+    /* Valid & Invalid script referenced by type constraints. */
+    Vector<CompilerOutput> *constrainedOutputs;
+
+    /* Pending recompilations to perform before execution of JIT code can resume. */
+    Vector<RecompileInfo> *pendingRecompiles;
+
     /* Table for referencing types of objects keyed to an allocation site. */
     AllocationSiteTable *allocationSiteTable;
 
@@ -1404,6 +1438,14 @@ struct TypeCompartment
 
     inline JSCompartment *compartment();
 
+    /* Add a type to register with a list of constraints. */
+    inline void addPending(JSContext *cx, TypeConstraint *constraint,
+                           ConstraintTypeSet *source, Type type);
+    bool growPendingArray(JSContext *cx);
+
+    /* Resolve pending type registrations, excluding delayed ones. */
+    inline void resolvePending(JSContext *cx);
+
     /* Prints results of this compartment if spew is enabled or force is set. */
     void print(JSContext *cx, bool force);
 
@@ -1419,16 +1461,26 @@ struct TypeCompartment
     /* Get or make an object for an allocation site, and add to the allocation site table. */
     TypeObject *addAllocationSiteTypeObject(JSContext *cx, AllocationSiteKey key);
 
+    void processPendingRecompiles(FreeOp *fop);
+
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes(ExclusiveContext *cx);
 
+    /* Mark a script as needing recompilation once inference has finished. */
+    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
+    void addPendingRecompile(JSContext *cx, JSScript *script);
+
     /* Mark any type set containing obj as having a generic object type. */
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
     void sweep(FreeOp *fop);
+    void sweepShapes(FreeOp *fop);
+    void clearCompilerOutputs(FreeOp *fop);
+
     void finalizeObjects();
 
     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                size_t *pendingArrays,
                                 size_t *allocationSiteTables,
                                 size_t *arrayTypeTables,
                                 size_t *objectTypeTables);
@@ -1444,16 +1496,6 @@ struct TypeZone
     static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 8 * 1024;
     js::LifoAlloc                typeLifoAlloc;
 
-    /*
-     * All Ion compilations that have occured in this zone, for indexing via
-     * RecompileInfo. This includes both valid and invalid compilations, though
-     * invalidated compilations are swept on GC.
-     */
-    Vector<CompilerOutput> *compilerOutputs;
-
-    /* Pending recompilations to perform before execution of JIT code can resume. */
-    Vector<RecompileInfo> *pendingRecompiles;
-
     /*
      * Bit set if all current types must be marked as unknown, and all scripts
      * recompiled. Caused by OOM failure within inference operations.
@@ -1474,12 +1516,6 @@ struct TypeZone
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes();
 
-    /* Mark a script as needing recompilation once inference has finished. */
-    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
-    void addPendingRecompile(JSContext *cx, JSScript *script);
-
-    void processPendingRecompiles(FreeOp *fop);
-
     void nukeTypes(FreeOp *fop);
 };
 
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index 328daf0a076c..c4e07abd3271 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -104,29 +104,17 @@ CompilerOutput::ion() const
 }
 
 inline CompilerOutput*
-RecompileInfo::compilerOutput(TypeZone &types) const
+RecompileInfo::compilerOutput(TypeCompartment &types) const
 {
-    if (!types.compilerOutputs || outputIndex >= types.compilerOutputs->length())
+    if (!types.constrainedOutputs || outputIndex >= types.constrainedOutputs->length())
         return nullptr;
-    return &(*types.compilerOutputs)[outputIndex];
+    return &(*types.constrainedOutputs)[outputIndex];
 }
 
 inline CompilerOutput*
 RecompileInfo::compilerOutput(JSContext *cx) const
 {
-    return compilerOutput(cx->zone()->types);
-}
-
-inline bool
-RecompileInfo::shouldSweep(TypeZone &types)
-{
-    CompilerOutput *output = compilerOutput(types);
-    if (!output || !output->isValid())
-        return true;
-
-    // Update this info for the output's new index in the zone's compiler outputs.
-    outputIndex = output->sweepIndex();
-    return false;
+    return compilerOutput(cx->compartment()->types);
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -300,13 +288,14 @@ struct AutoEnterAnalysis
          * If there are no more type inference activations on the stack,
          * process any triggered recompilations. Note that we should not be
          * invoking any scripted code while type inference is running.
+         * :TODO: assert this.
          */
         if (!compartment->activeAnalysis) {
-            TypeZone &types = compartment->zone()->types;
-            if (types.pendingNukeTypes)
-                types.nukeTypes(freeOp);
-            else if (types.pendingRecompiles)
-                types.processPendingRecompiles(freeOp);
+            TypeCompartment *types = &compartment->types;
+            if (compartment->zone()->types.pendingNukeTypes)
+                compartment->zone()->types.nukeTypes(freeOp);
+            else if (types->pendingRecompiles)
+                types->processPendingRecompiles(freeOp);
         }
     }
 
@@ -863,6 +852,50 @@ TypeCompartment::compartment()
     return (JSCompartment *)((char *)this - offsetof(JSCompartment, types));
 }
 
+inline void
+TypeCompartment::addPending(JSContext *cx, TypeConstraint *constraint,
+                            ConstraintTypeSet *source, Type type)
+{
+    JS_ASSERT(this == &cx->compartment()->types);
+    JS_ASSERT(!cx->runtime()->isHeapBusy());
+
+    InferSpew(ISpewOps, "pending: %sC%p%s %s",
+              InferSpewColor(constraint), constraint, InferSpewColorReset(),
+              TypeString(type));
+
+    if ((pendingCount == pendingCapacity) && !growPendingArray(cx))
+        return;
+
+    PendingWork &pending = pendingArray[pendingCount++];
+    pending.constraint = constraint;
+    pending.source = source;
+    pending.type = type;
+}
+
+inline void
+TypeCompartment::resolvePending(JSContext *cx)
+{
+    JS_ASSERT(this == &cx->compartment()->types);
+
+    if (resolving) {
+        /* There is an active call further up resolving the worklist. */
+        return;
+    }
+
+    resolving = true;
+
+    /* Handle all pending type registrations. */
+    while (pendingCount) {
+        const PendingWork &pending = pendingArray[--pendingCount];
+        InferSpew(ISpewOps, "resolve: %sC%p%s %s",
+                  InferSpewColor(pending.constraint), pending.constraint,
+                  InferSpewColorReset(), TypeString(pending.type));
+        pending.constraint->newType(cx, pending.source, pending.type);
+    }
+
+    resolving = false;
+}
+
 /////////////////////////////////////////////////////////////////////
 // TypeSet
 /////////////////////////////////////////////////////////////////////
@@ -1186,9 +1219,10 @@ ConstraintTypeSet::addType(ExclusiveContext *cxArg, Type type)
     if (JSContext *cx = cxArg->maybeJSContext()) {
         TypeConstraint *constraint = constraintList;
         while (constraint) {
-            constraint->newType(cx, this, type);
+            cx->compartment()->types.addPending(cx, constraint, this, type);
             constraint = constraint->next;
         }
+        cx->compartment()->types.resolvePending(cx);
     } else {
         JS_ASSERT(!constraintList);
     }
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index ee09906df5bd..3ba7d433c6f8 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -215,6 +215,7 @@ StatsCompartmentCallback(JSRuntime *rt, void *data, JSCompartment *compartment)
 
     // Measure the compartment object itself, and things hanging off it.
     compartment->addSizeOfIncludingThis(rtStats->mallocSizeOf_,
+                                        &cStats.typeInferencePendingArrays,
                                         &cStats.typeInferenceAllocationSiteTables,
                                         &cStats.typeInferenceArrayTypeTables,
                                         &cStats.typeInferenceObjectTypeTables,
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index b225830e8efe..1a12e11d83b3 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2122,6 +2122,10 @@ ReportCompartmentStats(const JS::CompartmentStats &cStats,
                    cStats.typeInferenceTypeScripts,
                    "Memory used by type sets associated with scripts.");
 
+    ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/pending-arrays"),
+                   cStats.typeInferencePendingArrays,
+                   "Memory used for solving constraints during type inference.");
+
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/allocation-site-tables"),
                    cStats.typeInferenceAllocationSiteTables,
                    "Memory indexing type objects associated with allocation sites.");

From f89b3f4cd4bb848a3095987c6f1fa2a3da3d020d Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Thu, 12 Dec 2013 13:56:50 -0500
Subject: [PATCH 030/459] Backed out 6 changesets (bug 939614) for Hf timeouts
 on a CLOSED TREE.

Backed out changeset 50cc92857bf7 (bug 939614)
Backed out changeset 62a6568217da (bug 939614)
Backed out changeset 31d0d40d4a7c (bug 939614)
Backed out changeset 2b87186ddb6d (bug 939614)
Backed out changeset fa2005c9ca02 (bug 939614)
Backed out changeset 7d3c745a811f (bug 939614)
---
 js/src/builtin/TestingFunctions.cpp        |   4 +-
 js/src/jit/AsmJS.cpp                       |   4 +-
 js/src/jit/Bailouts.cpp                    |   2 +-
 js/src/jit/BaselineCompiler.cpp            |   3 +-
 js/src/jit/BaselineJIT.cpp                 |   2 +-
 js/src/jit/CodeGenerator.cpp               |  26 +--
 js/src/jit/CodeGenerator.h                 |   2 -
 js/src/jit/Ion.cpp                         | 181 +++++++--------
 js/src/jit/Ion.h                           | 242 ++++++++++++++++++++-
 js/src/jit/IonAnalysis.cpp                 |   9 +-
 js/src/jit/IonBuilder.cpp                  |  99 +++------
 js/src/jit/IonBuilder.h                    |  14 +-
 js/src/jit/IonCode.h                       |  10 +-
 js/src/jit/IonFrames.cpp                   |   2 +-
 js/src/jit/IonOptimizationLevels.cpp       | 142 ------------
 js/src/jit/IonOptimizationLevels.h         | 220 -------------------
 js/src/jit/JitOptions.cpp                  | 162 --------------
 js/src/jit/JitOptions.h                    |  88 --------
 js/src/jit/LIR-Common.h                    |  17 --
 js/src/jit/LOpcodes.h                      |   1 -
 js/src/jit/LinearScan.cpp                  |   4 +-
 js/src/jit/LiveRangeAllocator.h            |   2 +-
 js/src/jit/Lowering.cpp                    |  13 +-
 js/src/jit/Lowering.h                      |   1 -
 js/src/jit/MCallOptimize.cpp               |   3 -
 js/src/jit/MIR.h                           |  35 ---
 js/src/jit/MIRGenerator.h                  |   8 +-
 js/src/jit/MIRGraph.cpp                    |   4 +-
 js/src/jit/MOpcodes.h                      |   3 +-
 js/src/jit/ParallelSafetyAnalysis.cpp      |   1 -
 js/src/jit/RangeAnalysis.cpp               |   2 +-
 js/src/jit/UnreachableCodeElimination.cpp  |   4 +-
 js/src/jit/shared/CodeGenerator-shared.cpp |   2 +-
 js/src/jit/shared/Lowering-shared-inl.h    |   4 +-
 js/src/jsapi.cpp                           |  17 +-
 js/src/jsscript.h                          |   6 +-
 js/src/jsworkers.cpp                       |   1 +
 js/src/moz.build                           |   2 -
 js/src/shell/js.cpp                        |  73 +++----
 js/src/vm/ForkJoin.cpp                     |   4 +-
 40 files changed, 443 insertions(+), 976 deletions(-)
 delete mode 100644 js/src/jit/IonOptimizationLevels.cpp
 delete mode 100644 js/src/jit/IonOptimizationLevels.h
 delete mode 100644 js/src/jit/JitOptions.cpp
 delete mode 100644 js/src/jit/JitOptions.h

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index c6261995b272..8d1a8b1a91f2 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -956,7 +956,7 @@ static bool
 EnableOsiPointRegisterChecks(JSContext *, unsigned, jsval *vp)
 {
 #if defined(JS_ION) && defined(CHECK_OSIPOINT_REGISTERS)
-    jit::js_JitOptions.checkOsiPointRegisters = true;
+    jit::js_IonOptions.checkOsiPointRegisters = true;
 #endif
     JS_SET_RVAL(cx, vp, JSVAL_VOID);
     return true;
@@ -1125,7 +1125,7 @@ SetIonCheckGraphCoherency(JSContext *cx, unsigned argc, jsval *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 #ifdef JS_ION
-    jit::js_JitOptions.checkGraphConsistency = ToBoolean(args.get(0));
+    jit::js_IonOptions.checkGraphConsistency = ToBoolean(args.get(0));
 #endif
     args.rval().setUndefined();
     return true;
diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index c58c82ea132b..f7e70f9c1109 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -1936,9 +1936,7 @@ class FunctionCompiler
 
         graph_  = lifo_.new_<MIRGraph>(alloc_);
         info_   = lifo_.new_<CompileInfo>(locals_.count(), SequentialExecution);
-        const OptimizationInfo *optimizationInfo = js_IonOptimizations.get(Optimization_AsmJS);
-        mirGen_ = lifo_.new_<MIRGenerator>(CompileCompartment::get(cx()->compartment()), alloc_,
-                                           graph_, info_, optimizationInfo);
+        mirGen_ = lifo_.new_<MIRGenerator>(CompileCompartment::get(cx()->compartment()), alloc_, graph_, info_);
 
         if (!newBlock(/* pred = */ nullptr, &curBlock_, fn_))
             return false;
diff --git a/js/src/jit/Bailouts.cpp b/js/src/jit/Bailouts.cpp
index c00f3a893936..fe49af0216ca 100644
--- a/js/src/jit/Bailouts.cpp
+++ b/js/src/jit/Bailouts.cpp
@@ -196,7 +196,7 @@ jit::CheckFrequentBailouts(JSContext *cx, JSScript *script)
         // we compile this script LICM will be disabled.
         IonScript *ionScript = script->ionScript();
 
-        if (ionScript->numBailouts() >= js_JitOptions.frequentBailoutThreshold &&
+        if (ionScript->numBailouts() >= js_IonOptions.frequentBailoutThreshold &&
             !script->hadFrequentBailouts())
         {
             script->setHadFrequentBailouts();
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index c10a24191f7b..febad931dae9 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -637,8 +637,7 @@ BaselineCompiler::emitUseCountIncrement()
 
     Label skipCall;
 
-    const OptimizationInfo *info = js_IonOptimizations.get(js_IonOptimizations.firstLevel());
-    uint32_t minUses = info->usesBeforeCompile(script, pc);
+    uint32_t minUses = UsesBeforeIonRecompile(script, pc);
     masm.branch32(Assembler::LessThan, countReg, Imm32(minUses), &skipCall);
 
     masm.branchPtr(Assembler::Equal,
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 7cf1bc170c7d..0956e75f4ca6 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -276,7 +276,7 @@ CanEnterBaselineJIT(JSContext *cx, HandleScript script, bool osr)
     if (IsJSDEnabled(cx) || cx->runtime()->parallelWarmup > 0) {
         if (osr)
             return Method_Skipped;
-    } else if (script->incUseCount() <= js_JitOptions.baselineUsesBeforeCompile) {
+    } else if (script->incUseCount() <= js_IonOptions.baselineUsesBeforeCompile) {
         return Method_Skipped;
     }
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index cc1095ff392b..7cbe48d16495 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -22,7 +22,6 @@
 #include "jit/ExecutionModeInlines.h"
 #include "jit/IonCaches.h"
 #include "jit/IonLinker.h"
-#include "jit/IonOptimizationLevels.h"
 #include "jit/IonSpewer.h"
 #include "jit/MIRGenerator.h"
 #include "jit/MoveEmitter.h"
@@ -5858,9 +5857,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
 {
     RootedScript script(cx, gen->info().script());
     ExecutionMode executionMode = gen->info().executionMode();
-    OptimizationLevel optimizationLevel = gen->optimizationInfo().level();
-
-    JS_ASSERT_IF(HasIonScript(script, executionMode), executionMode == SequentialExecution);
+    JS_ASSERT(!HasIonScript(script, executionMode));
 
     // Check to make sure we didn't have a mid-build invalidation. If so, we
     // will trickle to jit::Compile() and return Method_Skipped.
@@ -5888,7 +5885,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                      safepointIndices_.length(), osiIndices_.length(),
                      cacheList_.length(), runtimeData_.length(),
                      safepoints_.size(), callTargets.length(),
-                     patchableBackedges_.length(), optimizationLevel);
+                     patchableBackedges_.length());
     if (!ionScript) {
         recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
         return false;
@@ -7931,24 +7928,5 @@ CodeGenerator::visitAssertRangeV(LAssertRangeV *ins)
     return true;
 }
 
-typedef bool (*RecompileFn)(JSContext *);
-static const VMFunction RecompileFnInfo = FunctionInfo<RecompileFn>(Recompile);
-
-bool
-CodeGenerator::visitRecompileCheck(LRecompileCheck *ins)
-{
-    Register useCount = ToRegister(ins->scratch());
-
-    masm.movePtr(ImmPtr(ins->mir()->script()->addressOfUseCount()), useCount);
-    Address ptr(useCount, 0);
-    masm.add32(Imm32(1), ptr);
-
-    OutOfLineCode *ool = oolCallVM(RecompileFnInfo, ins, (ArgList()), StoreRegisterTo(useCount));
-    masm.branch32(Assembler::Above, ptr, Imm32(ins->mir()->useCount()), ool->entry());
-    masm.bind(ool->rejoin());
-
-    return true;
-}
-
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 5a42247fd604..e522f27da234 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -336,8 +336,6 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitAssertRangeF(LAssertRangeF *ins);
     bool visitAssertRangeV(LAssertRangeV *ins);
 
-    bool visitRecompileCheck(LRecompileCheck *ins);
-
     IonScriptCounts *extractUnassociatedScriptCounts() {
         IonScriptCounts *counts = unassociatedScriptCounts_;
         unassociatedScriptCounts_ = nullptr;  // prevent delete in dtor
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 92a1e4aed529..ba3ee46a154d 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -27,7 +27,6 @@
 #include "jit/ExecutionModeInlines.h"
 #include "jit/IonAnalysis.h"
 #include "jit/IonBuilder.h"
-#include "jit/IonOptimizationLevels.h"
 #include "jit/IonSpewer.h"
 #include "jit/JitCompartment.h"
 #include "jit/LICM.h"
@@ -50,6 +49,9 @@
 using namespace js;
 using namespace js::jit;
 
+// Global variables.
+IonOptions jit::js_IonOptions;
+
 // Assert that IonCode is gc::Cell aligned.
 JS_STATIC_ASSERT(sizeof(IonCode) % gc::CellSize == 0);
 
@@ -759,8 +761,7 @@ IonScript::New(JSContext *cx, types::RecompileInfo recompileInfo,
                uint32_t frameSlots, uint32_t frameSize, size_t snapshotsSize,
                size_t bailoutEntries, size_t constants, size_t safepointIndices,
                size_t osiIndices, size_t cacheEntries, size_t runtimeSize,
-               size_t safepointsSize, size_t callTargetEntries, size_t backedgeEntries,
-               OptimizationLevel optimizationLevel)
+               size_t safepointsSize, size_t callTargetEntries, size_t backedgeEntries)
 {
     static const int DataAlignment = sizeof(void *);
 
@@ -847,7 +848,6 @@ IonScript::New(JSContext *cx, types::RecompileInfo recompileInfo,
     script->frameSize_ = frameSize;
 
     script->recompileInfo_ = recompileInfo;
-    script->optimizationLevel_ = optimizationLevel;
 
     return script;
 }
@@ -1233,9 +1233,7 @@ OptimizeMIR(MIRGenerator *mir)
 
     // Alias analysis is required for LICM and GVN so that we don't move
     // loads across stores.
-    if (mir->optimizationInfo().licmEnabled() ||
-        mir->optimizationInfo().gvnEnabled())
-    {
+    if (js_IonOptions.licm || js_IonOptions.gvn) {
         AliasAnalysis analysis(mir, graph);
         if (!analysis.analyze())
             return false;
@@ -1255,8 +1253,8 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (mir->optimizationInfo().gvnEnabled()) {
-        ValueNumberer gvn(mir, graph, mir->optimizationInfo().gvnKind() == GVN_Optimistic);
+    if (js_IonOptions.gvn) {
+        ValueNumberer gvn(mir, graph, js_IonOptions.gvnIsOptimistic);
         if (!gvn.analyze())
             return false;
         IonSpewPass("GVN");
@@ -1266,7 +1264,7 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (mir->optimizationInfo().uceEnabled()) {
+    if (js_IonOptions.uce) {
         UnreachableCodeElimination uce(mir, graph);
         if (!uce.analyze())
             return false;
@@ -1277,7 +1275,7 @@ OptimizeMIR(MIRGenerator *mir)
     if (mir->shouldCancel("UCE"))
         return false;
 
-    if (mir->optimizationInfo().licmEnabled()) {
+    if (js_IonOptions.licm) {
         // LICM can hoist instructions from conditional branches and trigger
         // repeated bailouts. Disable it if this script is known to bailout
         // frequently.
@@ -1294,7 +1292,7 @@ OptimizeMIR(MIRGenerator *mir)
         }
     }
 
-    if (mir->optimizationInfo().rangeAnalysisEnabled()) {
+    if (js_IonOptions.rangeAnalysis) {
         RangeAnalysis r(mir, graph);
         if (!r.addBetaNodes())
             return false;
@@ -1320,7 +1318,7 @@ OptimizeMIR(MIRGenerator *mir)
         if (mir->shouldCancel("RA De-Beta"))
             return false;
 
-        if (mir->optimizationInfo().uceEnabled()) {
+        if (js_IonOptions.uce) {
             bool shouldRunUCE = false;
             if (!r.prepareForUCE(&shouldRunUCE))
                 return false;
@@ -1352,7 +1350,7 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (mir->optimizationInfo().eaaEnabled()) {
+    if (js_IonOptions.eaa) {
         EffectiveAddressAnalysis eaa(graph);
         if (!eaa.analyze())
             return false;
@@ -1374,7 +1372,7 @@ OptimizeMIR(MIRGenerator *mir)
     // Passes after this point must not move instructions; these analyses
     // depend on knowing the final order in which instructions will execute.
 
-    if (mir->optimizationInfo().edgeCaseAnalysisEnabled()) {
+    if (js_IonOptions.edgeCaseAnalysis && !mir->compilingAsmJS()) {
         EdgeCaseAnalysis edgeCaseAnalysis(mir, graph);
         if (!edgeCaseAnalysis.analyzeLate())
             return false;
@@ -1385,7 +1383,7 @@ OptimizeMIR(MIRGenerator *mir)
             return false;
     }
 
-    if (mir->optimizationInfo().eliminateRedundantChecksEnabled()) {
+    if (!mir->compilingAsmJS()) {
         // Note: check elimination has to run after all other passes that move
         // instructions. Since check uses are replaced with the actual index,
         // code motion after this pass could incorrectly move a load or store
@@ -1418,7 +1416,7 @@ GenerateLIR(MIRGenerator *mir)
 
     AllocationIntegrityState integrity(*lir);
 
-    switch (mir->optimizationInfo().registerAllocator()) {
+    switch (js_IonOptions.registerAllocator) {
       case RegisterAllocator_LSRA: {
 #ifdef DEBUG
         if (!integrity.record())
@@ -1630,8 +1628,7 @@ TrackPropertiesForSingletonScopes(JSContext *cx, JSScript *script, BaselineFrame
 static AbortReason
 IonCompile(JSContext *cx, JSScript *script,
            BaselineFrame *baselineFrame, jsbytecode *osrPc, bool constructing,
-           ExecutionMode executionMode, bool recompile,
-           OptimizationLevel optimizationLevel)
+           ExecutionMode executionMode, bool recompile)
 {
 #if JS_TRACE_LOGGING
     AutoTraceLog logger(TraceLogging::defaultLogger(),
@@ -1639,8 +1636,6 @@ IonCompile(JSContext *cx, JSScript *script,
                         TraceLogging::ION_COMPILE_STOP,
                         script);
 #endif
-    JS_ASSERT(optimizationLevel > Optimization_DontCompile);
-
     TrackPropertiesForSingletonScopes(cx, script, baselineFrame);
 
     LifoAlloc *alloc = cx->new_<LifoAlloc>(BUILDER_LIFO_ALLOC_PRIMARY_CHUNK_SIZE);
@@ -1688,13 +1683,10 @@ IonCompile(JSContext *cx, JSScript *script,
     if (!constraints)
         return AbortReason_Alloc;
 
-    const OptimizationInfo *optimizationInfo = js_IonOptimizations.get(optimizationLevel);
-
     IonBuilder *builder = alloc->new_<IonBuilder>((JSContext *) nullptr,
                                                   CompileCompartment::get(cx->compartment()),
                                                   temp, graph, constraints,
-                                                  &inspector, info, optimizationInfo,
-                                                  baselineFrameInspector);
+                                                  &inspector, info, baselineFrameInspector);
     if (!builder)
         return AbortReason_Alloc;
 
@@ -1705,7 +1697,7 @@ IonCompile(JSContext *cx, JSScript *script,
     IonSpewNewFunction(graph, builderScript);
 
     mozilla::Maybe<AutoProtectHeapForCompilation> protect;
-    if (js_JitOptions.checkThreadSafety &&
+    if (js_IonOptions.checkThreadSafety &&
         cx->runtime()->gcIncrementalState == gc::NO_INCREMENTAL &&
         !cx->runtime()->profilingScripts &&
         !cx->runtime()->spsProfiler.enabled())
@@ -1726,15 +1718,15 @@ IonCompile(JSContext *cx, JSScript *script,
         return builder->abortReason();
     }
 
-    if (recompile) {
-        JS_ASSERT(executionMode == SequentialExecution);
-        builderScript->ionScript()->setRecompiling();
-    } else {
-        SetIonScript(builder->script(), executionMode, ION_COMPILING_SCRIPT);
-    }
-
     // If possible, compile the script off thread.
     if (OffThreadCompilationAvailable(cx)) {
+        if (recompile) {
+            JS_ASSERT(executionMode == SequentialExecution);
+            builderScript->ionScript()->setRecompiling();
+        } else {
+            SetIonScript(builder->script(), executionMode, ION_COMPILING_SCRIPT);
+        }
+
         if (!StartOffThreadIonCompile(cx, builder)) {
             IonSpew(IonSpew_Abort, "Unable to start off-thread ion compilation.");
             return AbortReason_Alloc;
@@ -1802,10 +1794,21 @@ CheckScript(JSContext *cx, JSScript *script, bool osr)
     return true;
 }
 
+// Longer scripts can only be compiled off thread, as these compilations
+// can be expensive and stall the main thread for too long.
+static const uint32_t MAX_OFF_THREAD_SCRIPT_SIZE = 100 * 1000;
+static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2 * 1000;
+static const uint32_t MAX_MAIN_THREAD_LOCALS_AND_ARGS = 256;
+
+// DOM Worker runtimes don't have off thread compilation, but can also compile
+// larger scripts since this doesn't stall the main thread.
+static const uint32_t MAX_DOM_WORKER_SCRIPT_SIZE = 16 * 1000;
+static const uint32_t MAX_DOM_WORKER_LOCALS_AND_ARGS = 2048;
+
 static MethodStatus
 CheckScriptSize(JSContext *cx, JSScript* script)
 {
-    if (!js_JitOptions.limitScriptSize)
+    if (!js_IonOptions.limitScriptSize)
         return Method_Compiled;
 
     if (script->length() > MAX_OFF_THREAD_SCRIPT_SIZE) {
@@ -1864,17 +1867,6 @@ CanIonCompileScript(JSContext *cx, HandleScript script, bool osr)
     return CheckScriptSize(cx, script) == Method_Compiled;
 }
 
-static OptimizationLevel
-GetOptimizationLevel(HandleScript script, jsbytecode *pc, ExecutionMode executionMode)
-{
-    if (executionMode == ParallelExecution)
-        return Optimization_Normal;
-
-    JS_ASSERT(executionMode == SequentialExecution);
-
-    return js_IonOptimizations.levelForScript(script, pc);
-}
-
 static MethodStatus
 Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode *osrPc,
         bool constructing, ExecutionMode executionMode)
@@ -1882,8 +1874,6 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     JS_ASSERT(jit::IsIonEnabled(cx));
     JS_ASSERT(jit::IsBaselineEnabled(cx));
     JS_ASSERT_IF(osrPc != nullptr, (JSOp)*osrPc == JSOP_LOOPENTRY);
-    JS_ASSERT_IF(executionMode == ParallelExecution, !osrFrame && !osrPc);
-    JS_ASSERT_IF(executionMode == ParallelExecution, !HasIonScript(script, executionMode));
 
     if (!script->hasBaselineScript())
         return Method_Skipped;
@@ -1905,50 +1895,23 @@ Compile(JSContext *cx, HandleScript script, BaselineFrame *osrFrame, jsbytecode
     }
 
     bool recompile = false;
-    OptimizationLevel optimizationLevel = GetOptimizationLevel(script, osrPc, executionMode);
-    if (optimizationLevel == Optimization_DontCompile)
-        return Method_Skipped;
 
     IonScript *scriptIon = GetIonScript(script, executionMode);
     if (scriptIon) {
         if (!scriptIon->method())
             return Method_CantCompile;
+        return Method_Compiled;
+    }
 
-        MethodStatus failedState = Method_Compiled;
-
-        // If we keep failing to enter the script due to an OSR pc mismatch,
-        // recompile with the right pc.
-        if (osrPc && script->ionScript()->osrPc() != osrPc) {
-            uint32_t count = script->ionScript()->incrOsrPcMismatchCounter();
-            if (count <= js_JitOptions.osrPcMismatchesBeforeRecompile)
-                return Method_Skipped;
-
-            failedState = Method_Skipped;
-        }
-
-        // Don't recompile/overwrite higher optimized code,
-        // with a lower optimization level.
-        if (optimizationLevel < scriptIon->optimizationLevel())
-            return failedState;
-
-        if (optimizationLevel == scriptIon->optimizationLevel() &&
-            (!osrPc || script->ionScript()->osrPc() == osrPc))
-        {
-            return failedState;
-        }
-
-        // Don't start compiling if already compiling
-        if (scriptIon->isRecompiling())
-            return failedState;
-
-        if (osrPc)
-            script->ionScript()->resetOsrPcMismatchCounter();
-
-        recompile = true;
+    if (executionMode == SequentialExecution) {
+        // Use getUseCount instead of incUseCount to avoid bumping the
+        // use count twice.
+        if (script->getUseCount() < UsesBeforeIonRecompile(script, osrPc ? osrPc : script->code()))
+            return Method_Skipped;
     }
 
     AbortReason reason = IonCompile(cx, script, osrFrame, osrPc, constructing, executionMode,
-                                    recompile, optimizationLevel);
+                                    recompile);
     if (reason == AbortReason_Error)
         return Method_Error;
 
@@ -1989,7 +1952,7 @@ jit::CanEnterAtBranch(JSContext *cx, JSScript *script, BaselineFrame *osrFrame,
         return Method_Skipped;
 
     // Optionally ignore on user request.
-    if (!js_JitOptions.osr)
+    if (!js_IonOptions.osr)
         return Method_Skipped;
 
     // Mark as forbidden if frame can't be handled.
@@ -1998,11 +1961,7 @@ jit::CanEnterAtBranch(JSContext *cx, JSScript *script, BaselineFrame *osrFrame,
         return Method_CantCompile;
     }
 
-    // Attempt compilation.
-    // - Returns Method_Compiled if the right ionscript is present
-    //   (Meaning it was present or a sequantial compile finished)
-    // - Returns Method_Skipped if pc doesn't match
-    //   (This means a background thread compilation with that pc could have started or not.)
+    // Attempt compilation. Returns Method_Compiled if already compiled.
     RootedScript rscript(cx, script);
     MethodStatus status = Compile(cx, rscript, osrFrame, pc, isConstructing, SequentialExecution);
     if (status != Method_Compiled) {
@@ -2011,6 +1970,20 @@ jit::CanEnterAtBranch(JSContext *cx, JSScript *script, BaselineFrame *osrFrame,
         return status;
     }
 
+    if (script->ionScript()->osrPc() != pc) {
+        // If we keep failing to enter the script due to an OSR pc mismatch,
+        // invalidate the script to force a recompile.
+        uint32_t count = script->ionScript()->incrOsrPcMismatchCounter();
+
+        if (count > js_IonOptions.osrPcMismatchesBeforeRecompile) {
+            if (!Invalidate(cx, script, SequentialExecution, true))
+                return Method_Error;
+        }
+        return Method_Skipped;
+    }
+
+    script->ionScript()->resetOsrPcMismatchCounter();
+
     return Method_Compiled;
 }
 
@@ -2072,7 +2045,7 @@ jit::CanEnter(JSContext *cx, RunState &state)
     // If --ion-eager is used, compile with Baseline first, so that we
     // can directly enter IonMonkey.
     RootedScript rscript(cx, script);
-    if (js_JitOptions.eagerCompilation && !rscript->hasBaselineScript()) {
+    if (js_IonOptions.eagerCompilation && !rscript->hasBaselineScript()) {
         MethodStatus status = CanEnterBaselineMethod(cx, state);
         if (status != Method_Compiled)
             return status;
@@ -2725,6 +2698,36 @@ jit::ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode)
     MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
+uint32_t
+jit::UsesBeforeIonRecompile(JSScript *script, jsbytecode *pc)
+{
+    JS_ASSERT(pc == script->code() || JSOp(*pc) == JSOP_LOOPENTRY);
+
+    uint32_t minUses = js_IonOptions.usesBeforeCompile;
+
+    // If the script is too large to compile on the main thread, we can still
+    // compile it off thread. In these cases, increase the use count threshold
+    // to improve the compilation's type information and hopefully avoid later
+    // recompilation.
+
+    if (script->length() > MAX_MAIN_THREAD_SCRIPT_SIZE)
+        minUses = minUses * (script->length() / (double) MAX_MAIN_THREAD_SCRIPT_SIZE);
+
+    uint32_t numLocalsAndArgs = analyze::TotalSlots(script);
+    if (numLocalsAndArgs > MAX_MAIN_THREAD_LOCALS_AND_ARGS)
+        minUses = minUses * (numLocalsAndArgs / (double) MAX_MAIN_THREAD_LOCALS_AND_ARGS);
+
+    if (JSOp(*pc) != JSOP_LOOPENTRY || js_IonOptions.eagerCompilation)
+        return minUses;
+
+    // It's more efficient to enter outer loops, rather than inner loops, via OSR.
+    // To accomplish this, we use a slightly higher threshold for inner loops.
+    // Note that the loop depth is always > 0 so we will prefer non-OSR over OSR.
+    uint32_t loopDepth = GET_UINT8(pc);
+    JS_ASSERT(loopDepth > 0);
+    return minUses + loopDepth * 100;
+}
+
 void
 AutoFlushCache::updateTop(uintptr_t p, size_t len)
 {
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index f516f1e12698..37ad4e778387 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -16,13 +16,248 @@
 
 #include "jit/CompileInfo.h"
 #include "jit/CompileWrappers.h"
-#include "jit/JitOptions.h"
 
 namespace js {
 namespace jit {
 
 class TempAllocator;
 
+// Possible register allocators which may be used.
+enum IonRegisterAllocator {
+    RegisterAllocator_LSRA,
+    RegisterAllocator_Backtracking,
+    RegisterAllocator_Stupid
+};
+
+struct IonOptions
+{
+    // Toggles whether global value numbering is used.
+    //
+    // Default: true
+    bool gvn;
+
+    // Toggles whether global value numbering is optimistic (true) or
+    // pessimistic (false).
+    //
+    // Default: true
+    bool gvnIsOptimistic;
+
+    // Toggles whether loop invariant code motion is performed.
+    //
+    // Default: true
+    bool licm;
+
+    // Toggles whether functions may be entered at loop headers.
+    //
+    // Default: true
+    bool osr;
+
+    // Toggles whether large scripts are rejected.
+    //
+    // Default: true
+    bool limitScriptSize;
+
+    // Describes which register allocator to use.
+    //
+    // Default: LSRA
+    IonRegisterAllocator registerAllocator;
+
+    // Toggles whether inlining is performed.
+    //
+    // Default: true
+    bool inlining;
+
+    // Toggles whether Edge Case Analysis is used.
+    //
+    // Default: true
+    bool edgeCaseAnalysis;
+
+    // Toggles whether Range Analysis is used.
+    //
+    // Default: true
+    bool rangeAnalysis;
+
+    // Whether to enable extra code to perform dynamic validation of
+    // RangeAnalysis results.
+    //
+    // Default: false
+    bool checkRangeAnalysis;
+
+    // Whether to protect the GC heap during Ion compilation and ensure that
+    // only threadsafe operations are performed on it.
+    //
+    // Default: false
+    bool checkThreadSafety;
+
+    // Whether to perform expensive graph-consistency DEBUG-only assertions.
+    // It can be useful to disable this to reduce DEBUG-compile time of large
+    // asm.js programs.
+    //
+    // Default: true
+    bool checkGraphConsistency;
+
+    // Toggles whether Unreachable Code Elimination is performed.
+    //
+    // Default: true
+    bool uce;
+
+    // Toggles whether Effective Address Analysis is performed.
+    //
+    // Default: true
+    bool eaa;
+
+#ifdef CHECK_OSIPOINT_REGISTERS
+    // Emit extra code to verify live regs at the start of a VM call
+    // are not modified before its OsiPoint.
+    //
+    // Default: false
+    bool checkOsiPointRegisters;
+#endif
+
+    // How many invocations or loop iterations are needed before functions
+    // are compiled with the baseline compiler.
+    //
+    // Default: 10
+    uint32_t baselineUsesBeforeCompile;
+
+    // How many invocations or loop iterations are needed before functions
+    // are compiled.
+    //
+    // Default: 1,000
+    uint32_t usesBeforeCompile;
+
+    // How many invocations or loop iterations are needed before calls
+    // are inlined, as a fraction of usesBeforeCompile.
+    //
+    // Default: .125
+    double usesBeforeInliningFactor;
+
+    // How many times we will try to enter a script via OSR before
+    // invalidating the script.
+    //
+    // Default: 6,000
+    uint32_t osrPcMismatchesBeforeRecompile;
+
+    // Number of bailouts without invalidation before we set
+    // JSScript::hadFrequentBailouts and invalidate.
+    //
+    // Default: 10
+    uint32_t frequentBailoutThreshold;
+
+    // Number of exception bailouts (resuming into catch/finally block) before
+    // we invalidate and forbid Ion compilation.
+    //
+    // Default: 10
+    uint32_t exceptionBailoutThreshold;
+
+    // Whether Ion should compile try-catch statements.
+    //
+    // Default: true
+    bool compileTryCatch;
+
+    // How many actual arguments are accepted on the C stack.
+    //
+    // Default: 4,096
+    uint32_t maxStackArgs;
+
+    // The maximum inlining depth.
+    //
+    // Default: 3
+    uint32_t maxInlineDepth;
+
+    // The maximum inlining depth for functions.
+    //
+    // Inlining small functions has almost no compiling overhead
+    // and removes the otherwise needed call overhead.
+    // The value is currently very low.
+    // Actually it is only needed to make sure we don't blow out the stack.
+    //
+    // Default: 10
+    uint32_t smallFunctionMaxInlineDepth;
+
+    // The bytecode length limit for small function.
+    //
+    // The default for this was arrived at empirically via benchmarking.
+    // We may want to tune it further after other optimizations have gone
+    // in.
+    //
+    // Default: 100
+    uint32_t smallFunctionMaxBytecodeLength;
+
+    // The maximum number of functions to polymorphically inline at a call site.
+    //
+    // Default: 4
+    uint32_t polyInlineMax;
+
+    // The maximum total bytecode size of an inline call site.
+    //
+    // Default: 1000
+    uint32_t inlineMaxTotalBytecodeLength;
+
+    // Whether functions are compiled immediately.
+    //
+    // Default: false
+    bool eagerCompilation;
+
+    // How many uses of a parallel kernel before we attempt compilation.
+    //
+    // Default: 1
+    uint32_t usesBeforeCompilePar;
+
+    // The maximum bytecode length the caller may have,
+    // before we stop inlining large functions in that caller.
+    //
+    // Default: 10000
+    uint32_t inliningMaxCallerBytecodeLength;
+
+    void setEagerCompilation() {
+        eagerCompilation = true;
+        usesBeforeCompile = 0;
+        baselineUsesBeforeCompile = 0;
+    }
+
+    MOZ_CONSTEXPR IonOptions()
+      : gvn(true),
+        gvnIsOptimistic(true),
+        licm(true),
+        osr(true),
+        limitScriptSize(true),
+        registerAllocator(RegisterAllocator_LSRA),
+        inlining(true),
+        edgeCaseAnalysis(true),
+        rangeAnalysis(true),
+        checkRangeAnalysis(false),
+        checkThreadSafety(false),
+        checkGraphConsistency(true),
+        uce(true),
+        eaa(true),
+#ifdef CHECK_OSIPOINT_REGISTERS
+        checkOsiPointRegisters(false),
+#endif
+        baselineUsesBeforeCompile(10),
+        usesBeforeCompile(1000),
+        usesBeforeInliningFactor(.125),
+        osrPcMismatchesBeforeRecompile(6000),
+        frequentBailoutThreshold(10),
+        exceptionBailoutThreshold(10),
+        compileTryCatch(true),
+        maxStackArgs(4096),
+        maxInlineDepth(3),
+        smallFunctionMaxInlineDepth(10),
+        smallFunctionMaxBytecodeLength(100),
+        polyInlineMax(4),
+        inlineMaxTotalBytecodeLength(1000),
+        eagerCompilation(false),
+        usesBeforeCompilePar(1),
+        inliningMaxCallerBytecodeLength(10000)
+    {
+    }
+
+    uint32_t usesBeforeInlining() {
+        return usesBeforeCompile * usesBeforeInliningFactor;
+    }
+};
+
 enum MethodStatus
 {
     Method_Error,
@@ -73,6 +308,8 @@ class IonContext
     int assemblerCount_;
 };
 
+extern IonOptions js_IonOptions;
+
 // Initialize Ion statically for all JSRuntimes.
 bool InitializeIon();
 
@@ -174,11 +411,12 @@ IsIonInlinablePC(jsbytecode *pc) {
 inline bool
 TooManyArguments(unsigned nargs)
 {
-    return (nargs >= SNAPSHOT_MAX_NARGS || nargs > js_JitOptions.maxStackArgs);
+    return (nargs >= SNAPSHOT_MAX_NARGS || nargs > js_IonOptions.maxStackArgs);
 }
 
 void ForbidCompilation(JSContext *cx, JSScript *script);
 void ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode);
+uint32_t UsesBeforeIonRecompile(JSScript *script, jsbytecode *pc);
 
 void PurgeCaches(JSScript *script, JS::Zone *zone);
 size_t SizeOfIonData(JSScript *script, mozilla::MallocSizeOf mallocSizeOf);
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index a685efa82c89..839c3ecb2305 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -12,7 +12,6 @@
 #include "jit/BaselineJIT.h"
 #include "jit/Ion.h"
 #include "jit/IonBuilder.h"
-#include "jit/IonOptimizationLevels.h"
 #include "jit/LIR.h"
 #include "jit/Lowering.h"
 #include "jit/MIRGraph.h"
@@ -1334,7 +1333,7 @@ void
 jit::AssertGraphCoherency(MIRGraph &graph)
 {
 #ifdef DEBUG
-    if (!js_JitOptions.checkGraphConsistency)
+    if (!js_IonOptions.checkGraphConsistency)
         return;
     AssertBasicGraphCoherency(graph);
     AssertReversePostOrder(graph);
@@ -1349,7 +1348,7 @@ jit::AssertExtendedGraphCoherency(MIRGraph &graph)
     // are split)
 
 #ifdef DEBUG
-    if (!js_JitOptions.checkGraphConsistency)
+    if (!js_IonOptions.checkGraphConsistency)
         return;
     AssertGraphCoherency(graph);
 
@@ -2159,12 +2158,10 @@ jit::AnalyzeNewScriptProperties(JSContext *cx, JSFunction *fun,
 
     AutoTempAllocatorRooter root(cx, &temp);
 
-    const OptimizationInfo *optimizationInfo = js_IonOptimizations.get(Optimization_Normal);
-
     types::CompilerConstraintList *constraints = types::NewCompilerConstraintList(temp);
     BaselineInspector inspector(script);
     IonBuilder builder(cx, CompileCompartment::get(cx->compartment()), &temp, &graph, constraints,
-                       &inspector, &info, optimizationInfo, /* baselineFrame = */ nullptr);
+                       &inspector, &info, /* baselineFrame = */ nullptr);
 
     if (!builder.build()) {
         if (builder.abortReason() == AbortReason_Alloc)
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 24eeae4a238e..28b2285a8fdc 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -18,7 +18,6 @@
 #include "jit/BaselineInspector.h"
 #include "jit/ExecutionModeInlines.h"
 #include "jit/Ion.h"
-#include "jit/IonOptimizationLevels.h"
 #include "jit/IonSpewer.h"
 #include "jit/Lowering.h"
 #include "jit/MIRGraph.h"
@@ -102,13 +101,11 @@ jit::NewBaselineFrameInspector(TempAllocator *temp, BaselineFrame *frame)
     return inspector;
 }
 
-IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp,
-                       MIRGraph *graph, types::CompilerConstraintList *constraints,
-                       BaselineInspector *inspector, CompileInfo *info,
-                       const OptimizationInfo *optimizationInfo,
-                       BaselineFrameInspector *baselineFrame, size_t inliningDepth,
-                       uint32_t loopDepth)
-  : MIRGenerator(comp, temp, graph, info, optimizationInfo),
+IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp, MIRGraph *graph,
+                       types::CompilerConstraintList *constraints,
+                       BaselineInspector *inspector, CompileInfo *info, BaselineFrameInspector *baselineFrame,
+                       size_t inliningDepth, uint32_t loopDepth)
+  : MIRGenerator(comp, temp, graph, info),
     backgroundCodegen_(nullptr),
     analysisContext(analysisContext),
     baselineFrame_(baselineFrame),
@@ -330,9 +327,6 @@ IonBuilder::DontInline(JSScript *targetScript, const char *reason)
 IonBuilder::InliningDecision
 IonBuilder::canInlineTarget(JSFunction *target, CallInfo &callInfo)
 {
-    if (!optimizationInfo().inlineInterpreted())
-        return InliningDecision_DontInline;
-
     if (!target->isInterpreted())
         return DontInline(nullptr, "Non-interpreted target");
 
@@ -609,17 +603,8 @@ IonBuilder::build()
     if (!current)
         return false;
 
-#ifdef DEBUG
-    if (info().executionMode() == SequentialExecution && script()->hasIonScript()) {
-        IonSpew(IonSpew_Scripts, "Recompiling script %s:%d (%p) (usecount=%d, level=%s)",
-                script()->filename(), script()->lineno(), (void *)script(),
-                (int)script()->getUseCount(), OptimizationLevelString(optimizationInfo().level()));
-    } else {
-        IonSpew(IonSpew_Scripts, "Analyzing script %s:%d (%p) (usecount=%d, level=%s)",
-                script()->filename(), script()->lineno(), (void *)script(),
-                (int)script()->getUseCount(), OptimizationLevelString(optimizationInfo().level()));
-    }
-#endif
+    IonSpew(IonSpew_Scripts, "Analyzing script %s:%d (%p) (usecount=%d)",
+            script()->filename(), script()->lineno(), (void *)script(), (int)script()->getUseCount());
 
     if (!initParameters())
         return false;
@@ -706,8 +691,6 @@ IonBuilder::build()
         current->add(lazyArguments_);
     }
 
-    insertRecompileCheck();
-
     if (!traverseBytecode())
         return false;
 
@@ -865,8 +848,6 @@ IonBuilder::buildInline(IonBuilder *callerBuilder, MResumePoint *callerResumePoi
         current->add(lazyArguments_);
     }
 
-    insertRecompileCheck();
-
     if (!traverseBytecode())
         return false;
 
@@ -2047,7 +2028,7 @@ IonBuilder::restartLoop(CFGState state)
 {
     spew("New types at loop header, restarting loop body");
 
-    if (js_JitOptions.limitScriptSize) {
+    if (js_IonOptions.limitScriptSize) {
         if (++numLoopRestarts_ >= MAX_LOOP_RESTARTS)
             return ControlStatus_Abort;
     }
@@ -3358,7 +3339,6 @@ IonBuilder::jsop_loophead(jsbytecode *pc)
     assertValidLoopHeadOp(pc);
 
     current->add(MInterruptCheck::New(alloc()));
-    insertRecompileCheck();
 
     return true;
 }
@@ -3447,7 +3427,7 @@ IonBuilder::jsop_try()
 {
     JS_ASSERT(JSOp(*pc) == JSOP_TRY);
 
-    if (!js_JitOptions.compileTryCatch)
+    if (!js_IonOptions.compileTryCatch)
         return abort("Try-catch support disabled");
 
     // Try-finally is not yet supported.
@@ -3866,9 +3846,9 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
     AutoAccumulateReturns aar(graph(), returns);
 
     // Build the graph.
-    IonBuilder inlineBuilder(analysisContext, compartment, &alloc(), &graph(), constraints(),
-                             &inspector, info, &optimizationInfo(), nullptr, inliningDepth_ + 1,
-                             loopDepth_);
+    IonBuilder inlineBuilder(analysisContext, compartment,
+                             &alloc(), &graph(), constraints(), &inspector, info, nullptr,
+                             inliningDepth_ + 1, loopDepth_);
     if (!inlineBuilder.buildInline(this, outerResumePoint, callInfo)) {
         if (analysisContext && analysisContext->isExceptionPending()) {
             IonSpew(IonSpew_Abort, "Inline builder raised exception.");
@@ -3980,9 +3960,19 @@ IonBuilder::patchInlinedReturns(CallInfo &callInfo, MIRGraphReturns &returns, MB
     return phi;
 }
 
+static bool
+IsSmallFunction(JSScript *script)
+{
+    return script->length() <= js_IonOptions.smallFunctionMaxBytecodeLength;
+}
+
 IonBuilder::InliningDecision
 IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
 {
+    // Only inline when inlining is enabled.
+    if (!inliningEnabled())
+        return InliningDecision_DontInline;
+
     // When there is no target, inlining is impossible.
     if (target == nullptr)
         return InliningDecision_DontInline;
@@ -4002,30 +3992,30 @@ IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
     // Skip heuristics if we have an explicit hint to inline.
     if (!targetScript->shouldInline()) {
         // Cap the inlining depth.
-        if (js_JitOptions.isSmallFunction(targetScript)) {
-            if (inliningDepth_ >= optimizationInfo().smallFunctionMaxInlineDepth())
+        if (IsSmallFunction(targetScript)) {
+            if (inliningDepth_ >= js_IonOptions.smallFunctionMaxInlineDepth)
                 return DontInline(targetScript, "Vetoed: exceeding allowed inline depth");
         } else {
-            if (inliningDepth_ >= optimizationInfo().maxInlineDepth())
+            if (inliningDepth_ >= js_IonOptions.maxInlineDepth)
                 return DontInline(targetScript, "Vetoed: exceeding allowed inline depth");
 
             if (targetScript->hasLoops())
                 return DontInline(targetScript, "Vetoed: big function that contains a loop");
 
             // Caller must not be excessively large.
-            if (script()->length() >= optimizationInfo().inliningMaxCallerBytecodeLength())
+            if (script()->length() >= js_IonOptions.inliningMaxCallerBytecodeLength)
                 return DontInline(targetScript, "Vetoed: caller excessively large");
         }
 
         // Callee must not be excessively large.
         // This heuristic also applies to the callsite as a whole.
-        if (targetScript->length() > optimizationInfo().inlineMaxTotalBytecodeLength())
+        if (targetScript->length() > js_IonOptions.inlineMaxTotalBytecodeLength)
             return DontInline(targetScript, "Vetoed: callee excessively large");
 
         // Callee must have been called a few times to have somewhat stable
         // type information, except for definite properties analysis,
         // as the caller has not run yet.
-        if (targetScript->getUseCount() < optimizationInfo().usesBeforeInlining() &&
+        if (targetScript->getUseCount() < js_IonOptions.usesBeforeInlining() &&
             info().executionMode() != DefinitePropertiesAnalysis)
         {
             return DontInline(targetScript, "Vetoed: callee is insufficiently hot.");
@@ -4068,7 +4058,7 @@ IonBuilder::selectInliningTargets(ObjectVector &targets, CallInfo &callInfo, Boo
         // Enforce a maximum inlined bytecode limit at the callsite.
         if (inlineable && target->isInterpreted()) {
             totalSize += target->nonLazyScript()->length();
-            if (totalSize > optimizationInfo().inlineMaxTotalBytecodeLength())
+            if (totalSize > js_IonOptions.inlineMaxTotalBytecodeLength)
                 inlineable = false;
         }
 
@@ -4162,6 +4152,9 @@ IonBuilder::InliningStatus
 IonBuilder::inlineCallsite(ObjectVector &targets, ObjectVector &originals,
                            bool lambda, CallInfo &callInfo)
 {
+    if (!inliningEnabled())
+        return InliningStatus_NotInlined;
+
     if (targets.length() == 0)
         return InliningStatus_NotInlined;
 
@@ -5998,34 +5991,6 @@ ClassHasResolveHook(CompileCompartment *comp, const Class *clasp, PropertyName *
     return true;
 }
 
-void
-IonBuilder::insertRecompileCheck()
-{
-    // PJS doesn't recompile and doesn't need recompile checks.
-    if (info().executionMode() != SequentialExecution)
-        return;
-
-    // No need for recompile checks if this is the highest optimization level.
-    OptimizationLevel curLevel = optimizationInfo().level();
-    if (js_IonOptimizations.isLastLevel(curLevel))
-        return;
-
-    // Add recompile check.
-
-    // Get the topmost builder. The topmost script will get recompiled when
-    // usecount is high enough to justify a higher optimization level.
-    IonBuilder *topBuilder = this;
-    while (topBuilder->callerBuilder_)
-        topBuilder = topBuilder->callerBuilder_;
-
-    // Add recompile check to recompile when the usecount reaches the usecount
-    // of the next optimization level.
-    OptimizationLevel nextLevel = js_IonOptimizations.nextLevel(curLevel);
-    const OptimizationInfo *info = js_IonOptimizations.get(nextLevel);
-    uint32_t useCount = info->usesBeforeCompile(topBuilder->script());
-    current->add(MRecompileCheck::New(alloc(), topBuilder->script(), useCount));
-}
-
 JSObject *
 IonBuilder::testSingletonProperty(JSObject *obj, PropertyName *name)
 {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index d2af9d5b8b89..2404e147d2df 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -13,7 +13,6 @@
 // JSScript.
 
 #include "jit/BytecodeAnalysis.h"
-#include "jit/IonOptimizationLevels.h"
 #include "jit/MIR.h"
 #include "jit/MIRGenerator.h"
 #include "jit/MIRGraph.h"
@@ -212,10 +211,9 @@ class IonBuilder : public MIRGenerator
     static int CmpSuccessors(const void *a, const void *b);
 
   public:
-    IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp,
-               MIRGraph *graph, types::CompilerConstraintList *constraints,
-               BaselineInspector *inspector, CompileInfo *info,
-               const OptimizationInfo *optimizationInfo, BaselineFrameInspector *baselineFrame,
+    IonBuilder(JSContext *analysisContext, CompileCompartment *comp, TempAllocator *temp, MIRGraph *graph,
+               types::CompilerConstraintList *constraints,
+               BaselineInspector *inspector, CompileInfo *info, BaselineFrameInspector *baselineFrame,
                size_t inliningDepth = 0, uint32_t loopDepth = 0);
 
     bool build();
@@ -232,6 +230,10 @@ class IonBuilder : public MIRGenerator
     bool abort(const char *message, ...);
     void spew(const char *message);
 
+    static bool inliningEnabled() {
+        return js_IonOptions.inlining;
+    }
+
     JSFunction *getSingleCallTarget(types::TemporaryTypeSet *calleeTypes);
     bool getPolyCallTargets(types::TemporaryTypeSet *calleeTypes, bool constructing,
                             ObjectVector &targets, uint32_t maxTargets, bool *gotLambda);
@@ -323,8 +325,6 @@ class IonBuilder : public MIRGenerator
     bool resumeAfter(MInstruction *ins);
     bool maybeInsertResume();
 
-    void insertRecompileCheck();
-
     bool initParameters();
     void rewriteParameter(uint32_t slotIdx, MDefinition *param, int32_t argIndex);
     void rewriteParameters();
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index d3ecaa94223e..8167d1fa80e9 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -14,7 +14,6 @@
 #include "jstypes.h"
 
 #include "gc/Heap.h"
-#include "jit/IonOptimizationLevels.h"
 #include "jit/IonTypes.h"
 
 namespace JSC {
@@ -262,9 +261,6 @@ struct IonScript
     // Identifier of the compilation which produced this code.
     types::RecompileInfo recompileInfo_;
 
-    // The optimization level this script was compiled in.
-    OptimizationLevel optimizationLevel_;
-
     // Number of times we tried to enter this script via OSR but failed due to
     // a LOOPENTRY pc other than osrPc_.
     uint32_t osrPcMismatchCounter_;
@@ -339,8 +335,7 @@ struct IonScript
                           size_t snapshotsSize, size_t snapshotEntries,
                           size_t constants, size_t safepointIndexEntries, size_t osiIndexEntries,
                           size_t cacheEntries, size_t runtimeSize, size_t safepointsSize,
-                          size_t callTargetEntries, size_t backedgeEntries,
-                          OptimizationLevel optimizationLevel);
+                          size_t callTargetEntries, size_t backedgeEntries);
     static void Trace(JSTracer *trc, IonScript *script);
     static void Destroy(FreeOp *fop, IonScript *script);
 
@@ -531,9 +526,6 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
-    OptimizationLevel optimizationLevel() const {
-        return optimizationLevel_;
-    }
     uint32_t incrOsrPcMismatchCounter() {
         return ++osrPcMismatchCounter_;
     }
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index 66beb292251b..cecde0dee5cc 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -1061,7 +1061,7 @@ static void
 MarkJitActivation(JSTracer *trc, const JitActivationIterator &activations)
 {
 #ifdef CHECK_OSIPOINT_REGISTERS
-    if (js_JitOptions.checkOsiPointRegisters) {
+    if (js_IonOptions.checkOsiPointRegisters) {
         // GC can modify spilled registers, breaking our register checks.
         // To handle this, we disable these checks for the current VM call
         // when a GC happens.
diff --git a/js/src/jit/IonOptimizationLevels.cpp b/js/src/jit/IonOptimizationLevels.cpp
deleted file mode 100644
index cd2009d03acd..000000000000
--- a/js/src/jit/IonOptimizationLevels.cpp
+++ /dev/null
@@ -1,142 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "jit/IonOptimizationLevels.h"
-
-#include "jsanalyze.h"
-#include "jsscript.h"
-
-using namespace js;
-using namespace js::jit;
-
-namespace js {
-namespace jit {
-
-OptimizationInfos js_IonOptimizations;
-
-void
-OptimizationInfo::initNormalOptimizationInfo()
-{
-    level_ = Optimization_Normal;
-
-    eaa_ = true;
-    edgeCaseAnalysis_ = true;
-    eliminateRedundantChecks_ = true;
-    inlineInterpreted_ = true;
-    inlineNative_ = true;
-    gvn_ = true;
-    gvnKind_ = GVN_Optimistic;
-    licm_ = true;
-    uce_ = true;
-    rangeAnalysis_ = true;
-    registerAllocator_ = RegisterAllocator_LSRA;
-
-    inlineMaxTotalBytecodeLength_ = 1000;
-    inliningMaxCallerBytecodeLength_ = 10000;
-    maxInlineDepth_ = 3;
-    smallFunctionMaxInlineDepth_ = 10;
-    usesBeforeCompile_ = 1000;
-    usesBeforeInliningFactor_ = 0.125;
-}
-
-void
-OptimizationInfo::initAsmjsOptimizationInfo()
-{
-    // The AsmJS optimization level
-    // Disables some passes that don't work well with asmjs.
-
-    // Take normal option values for not specified values.
-    initNormalOptimizationInfo();
-
-    level_ = Optimization_AsmJS;
-    edgeCaseAnalysis_ = false;
-    eliminateRedundantChecks_ = false;
-}
-
-uint32_t
-OptimizationInfo::usesBeforeCompile(JSScript *script, jsbytecode *pc) const
-{
-    JS_ASSERT(pc == nullptr || pc == script->code() || JSOp(*pc) == JSOP_LOOPENTRY);
-
-    if (pc == script->code())
-        pc = nullptr;
-
-    uint32_t minUses = usesBeforeCompile_;
-    if (js_JitOptions.forceDefaultIonUsesBeforeCompile)
-        minUses = js_JitOptions.forcedDefaultIonUsesBeforeCompile;
-
-    // If the script is too large to compile on the main thread, we can still
-    // compile it off thread. In these cases, increase the use count threshold
-    // to improve the compilation's type information and hopefully avoid later
-    // recompilation.
-
-    if (script->length() > MAX_MAIN_THREAD_SCRIPT_SIZE)
-        minUses = minUses * (script->length() / (double) MAX_MAIN_THREAD_SCRIPT_SIZE);
-
-    uint32_t numLocalsAndArgs = analyze::TotalSlots(script);
-    if (numLocalsAndArgs > MAX_MAIN_THREAD_LOCALS_AND_ARGS)
-        minUses = minUses * (numLocalsAndArgs / (double) MAX_MAIN_THREAD_LOCALS_AND_ARGS);
-
-    if (!pc || js_JitOptions.eagerCompilation)
-        return minUses;
-
-    // It's more efficient to enter outer loops, rather than inner loops, via OSR.
-    // To accomplish this, we use a slightly higher threshold for inner loops.
-    // Note that the loop depth is always > 0 so we will prefer non-OSR over OSR.
-    uint32_t loopDepth = GET_UINT8(pc);
-    JS_ASSERT(loopDepth > 0);
-    return minUses + loopDepth * 100;
-}
-
-OptimizationInfos::OptimizationInfos()
-{
-    infos_[Optimization_Normal - 1].initNormalOptimizationInfo();
-    infos_[Optimization_AsmJS - 1].initAsmjsOptimizationInfo();
-}
-
-OptimizationLevel
-OptimizationInfos::nextLevel(OptimizationLevel level) const
-{
-    JS_ASSERT(!isLastLevel(level));
-    switch (level) {
-      case Optimization_DontCompile:
-        return Optimization_Normal;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unknown optimization level.");
-    }
-}
-
-OptimizationLevel
-OptimizationInfos::firstLevel() const
-{
-    return nextLevel(Optimization_DontCompile);
-}
-
-bool
-OptimizationInfos::isLastLevel(OptimizationLevel level) const
-{
-    return level == Optimization_Normal;
-}
-
-OptimizationLevel
-OptimizationInfos::levelForScript(JSScript *script, jsbytecode *pc) const
-{
-    OptimizationLevel prev = Optimization_DontCompile;
-
-    while (!isLastLevel(prev)) {
-        OptimizationLevel level = nextLevel(prev);
-        const OptimizationInfo *info = get(level);
-        if (script->getUseCount() < info->usesBeforeCompile(script, pc))
-            return prev;
-
-        prev = level;
-    }
-
-    return prev;
-}
-
-} // namespace jit
-} // namespace js
diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
deleted file mode 100644
index b939bfbfdd30..000000000000
--- a/js/src/jit/IonOptimizationLevels.h
+++ /dev/null
@@ -1,220 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef jit_IonOptimizationLevels_h
-#define jit_IonOptimizationLevels_h
-
-#include "jsbytecode.h"
-#include "jstypes.h"
-
-#include "jit/JitOptions.h"
-#include "js/TypeDecls.h"
-
-namespace js {
-namespace jit {
-
-enum OptimizationLevel
-{
-    Optimization_DontCompile,
-    Optimization_Normal,
-    Optimization_AsmJS,
-    Optimization_Count
-};
-
-#ifdef DEBUG
-inline const char *
-OptimizationLevelString(OptimizationLevel level)
-{
-    switch (level) {
-      case Optimization_DontCompile:
-        return "Optimization_DontCompile";
-      case Optimization_Normal:
-        return "Optimization_Normal";
-      case Optimization_AsmJS:
-        return "Optimization_AsmJS";
-      default:
-        MOZ_ASSUME_UNREACHABLE("Invalid OptimizationLevel");
-    }
-}
-#endif
-
-class OptimizationInfo
-{
-  public:
-    OptimizationLevel level_;
-
-    // Toggles whether Effective Address Analysis is performed.
-    bool eaa_;
-
-    // Toggles whether Edge Case Analysis is used.
-    bool edgeCaseAnalysis_;
-
-    // Toggles whether redundant checks get removed.
-    bool eliminateRedundantChecks_;
-
-    // Toggles whether interpreted scripts get inlined.
-    bool inlineInterpreted_;
-
-    // Toggles whether native scripts get inlined.
-    bool inlineNative_;
-
-    // Toggles whether global value numbering is used.
-    bool gvn_;
-
-    // Toggles whether global value numbering is optimistic or pessimistic.
-    IonGvnKind gvnKind_;
-
-    // Toggles whether loop invariant code motion is performed.
-    bool licm_;
-
-    // Toggles whether Unreachable Code Elimination is performed.
-    bool uce_;
-
-    // Toggles whether Range Analysis is used.
-    bool rangeAnalysis_;
-
-    // Describes which register allocator to use.
-    IonRegisterAllocator registerAllocator_;
-
-    // The maximum total bytecode size of an inline call site.
-    uint32_t inlineMaxTotalBytecodeLength_;
-
-    // The maximum bytecode length the caller may have,
-    // before we stop inlining large functions in that caller.
-    uint32_t inliningMaxCallerBytecodeLength_;
-
-    // The maximum inlining depth.
-    uint32_t maxInlineDepth_;
-
-    // The maximum inlining depth for functions.
-    //
-    // Inlining small functions has almost no compiling overhead
-    // and removes the otherwise needed call overhead.
-    // The value is currently very low.
-    // Actually it is only needed to make sure we don't blow out the stack.
-    uint32_t smallFunctionMaxInlineDepth_;
-
-    // How many invocations or loop iterations are needed before functions
-    // are compiled.
-    uint32_t usesBeforeCompile_;
-
-    // How many invocations or loop iterations are needed before calls
-    // are inlined, as a fraction of usesBeforeCompile.
-    double usesBeforeInliningFactor_;
-
-    OptimizationInfo()
-    { }
-
-    void initNormalOptimizationInfo();
-    void initAsmjsOptimizationInfo();
-
-    OptimizationLevel level() const {
-        return level_;
-    }
-
-    bool inlineInterpreted() const {
-        return inlineInterpreted_ && !js_JitOptions.disableInlining;
-    }
-
-    bool inlineNative() const {
-        return inlineNative_ && !js_JitOptions.disableInlining;
-    }
-
-    uint32_t usesBeforeCompile(JSScript *script, jsbytecode *pc = nullptr) const;
-
-    bool gvnEnabled() const {
-        return gvn_ && !js_JitOptions.disableGvn;
-    }
-
-    bool licmEnabled() const {
-        return licm_ && !js_JitOptions.disableLicm;
-    }
-
-    bool uceEnabled() const {
-        return uce_ && !js_JitOptions.disableUce;
-    }
-
-    bool rangeAnalysisEnabled() const {
-        return rangeAnalysis_ && !js_JitOptions.disableRangeAnalysis;
-    }
-
-    bool eaaEnabled() const {
-        return eaa_ && !js_JitOptions.disableEaa;
-    }
-
-    bool edgeCaseAnalysisEnabled() const {
-        return edgeCaseAnalysis_ && !js_JitOptions.disableEdgeCaseAnalysis;
-    }
-
-    bool eliminateRedundantChecksEnabled() const {
-        return eliminateRedundantChecks_;
-    }
-
-    IonGvnKind gvnKind() const {
-        if (!js_JitOptions.forceGvnKind)
-            return gvnKind_;
-        return js_JitOptions.forcedGvnKind;
-    }
-
-    IonRegisterAllocator registerAllocator() const {
-        if (!js_JitOptions.forceRegisterAllocator)
-            return registerAllocator_;
-        return js_JitOptions.forcedRegisterAllocator;
-    }
-
-    uint32_t smallFunctionMaxInlineDepth() const {
-        return smallFunctionMaxInlineDepth_;
-    }
-
-    bool isSmallFunction(JSScript *script) const;
-
-    uint32_t maxInlineDepth() const {
-        return maxInlineDepth_;
-    }
-
-    uint32_t inlineMaxTotalBytecodeLength() const {
-        return inlineMaxTotalBytecodeLength_;
-    }
-
-    uint32_t inliningMaxCallerBytecodeLength() const {
-        return inlineMaxTotalBytecodeLength_;
-    }
-
-    uint32_t usesBeforeInlining() const {
-        uint32_t usesBeforeCompile = usesBeforeCompile_;
-        if (js_JitOptions.forceDefaultIonUsesBeforeCompile)
-            usesBeforeCompile = js_JitOptions.forcedDefaultIonUsesBeforeCompile;
-        return usesBeforeCompile * usesBeforeInliningFactor_;
-    }
-};
-
-class OptimizationInfos
-{
-  private:
-    OptimizationInfo infos_[Optimization_Count - 1];
-
-  public:
-    OptimizationInfos();
-
-    const OptimizationInfo *get(OptimizationLevel level) const {
-        JS_ASSERT(level < Optimization_Count);
-        JS_ASSERT(level != Optimization_DontCompile);
-
-        return &infos_[level - 1];
-    }
-
-    OptimizationLevel nextLevel(OptimizationLevel level) const;
-    OptimizationLevel firstLevel() const;
-    bool isLastLevel(OptimizationLevel level) const;
-    OptimizationLevel levelForScript(JSScript *script, jsbytecode *pc = nullptr) const;
-};
-
-extern OptimizationInfos js_IonOptimizations;
-
-} // namespace jit
-} // namespace js
-
-#endif /* jit_IonOptimizationLevels_h */
diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
deleted file mode 100644
index a7d6dc1a6e67..000000000000
--- a/js/src/jit/JitOptions.cpp
+++ /dev/null
@@ -1,162 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "jit/JitOptions.h"
-
-#include "jsscript.h"
-
-using namespace js;
-using namespace js::jit;
-
-namespace js {
-namespace jit {
-
-JitOptions js_JitOptions;
-
-JitOptions::JitOptions()
-{
-    // Whether to perform expensive graph-consistency DEBUG-only assertions.
-    // It can be useful to disable this to reduce DEBUG-compile time of large
-    // asm.js programs.
-    checkGraphConsistency = true;
-
-#ifdef CHECK_OSIPOINT_REGISTERS
-    // Emit extra code to verify live regs at the start of a VM call
-    // are not modified before its OsiPoint.
-    checkOsiPointRegisters = false;
-#endif
-
-    // Whether to enable extra code to perform dynamic validation of
-    // RangeAnalysis results.
-    checkRangeAnalysis = false;
-
-    // Whether to protect the GC heap during Ion compilation and ensure that
-    // only threadsafe operations are performed on it.
-    checkThreadSafety = false;
-
-    // Whether Ion should compile try-catch statements.
-    compileTryCatch = true;
-
-    // Toggle whether global value numbering is globally disabled.
-    disableGvn = false;
-
-    // Toggles whether loop invariant code motion is globally disabled.
-    disableLicm = false;
-
-    // Toggles whether inlining is globally disabled.
-    disableInlining = false;
-
-    // Toggles whether Edge Case Analysis is gobally disabled.
-    disableEdgeCaseAnalysis = false;
-
-    // Toggles whether Range Analysis is globally disabled.
-    disableRangeAnalysis = false;
-
-    // Toggles whether Unreachable Code Elimination is globally disabled.
-    disableUce = false;
-
-    // Toggles whether Effective Address Analysis is globally disabled.
-    disableEaa = false;
-
-    // Whether functions are compiled immediately.
-    eagerCompilation = false;
-
-    // Force how many invocation or loop iterations are needed before compiling
-    // a function with the highest ionmonkey optimization level.
-    // (i.e. OptimizationLevel_Normal)
-    forceDefaultIonUsesBeforeCompile = false;
-    forcedDefaultIonUsesBeforeCompile = 1000;
-
-    // Force the GVN kind to be optimistic or pessimistic instead of letting
-    // the optimization pass decide.
-    forceGvnKind = false;
-    forcedGvnKind = GVN_Optimistic;
-
-    // Force the used register allocator instead of letting the
-    // optimization pass decide.
-    forceRegisterAllocator = false;
-    forcedRegisterAllocator = RegisterAllocator_LSRA;
-
-    // Toggles whether large scripts are rejected.
-    limitScriptSize = true;
-
-    // Toggles whether functions may be entered at loop headers.
-    osr = true;
-
-    // How many invocations or loop iterations are needed before functions
-    // are compiled with the baseline compiler.
-    baselineUsesBeforeCompile = 10;
-
-    // Number of exception bailouts (resuming into catch/finally block) before
-    // we invalidate and forbid Ion compilation.
-    exceptionBailoutThreshold = 10;
-
-    // Number of bailouts without invalidation before we set
-    // JSScript::hadFrequentBailouts and invalidate.
-    frequentBailoutThreshold = 10;
-
-    // How many actual arguments are accepted on the C stack.
-    maxStackArgs = 4096;
-
-    // How many times we will try to enter a script via OSR before
-    // invalidating the script.
-    osrPcMismatchesBeforeRecompile = 6000;
-
-    // The bytecode length limit for small function.
-    //
-    // The default for this was arrived at empirically via benchmarking.
-    // We may want to tune it further after other optimizations have gone
-    // in.
-    smallFunctionMaxBytecodeLength_ = 100;
-
-    // How many uses of a parallel kernel before we attempt compilation.
-    usesBeforeCompilePar = 1;
-}
-
-bool
-JitOptions::isSmallFunction(JSScript *script) const
-{
-    return script->length() <= smallFunctionMaxBytecodeLength_;
-}
-
-void
-JitOptions::setEagerCompilation()
-{
-    eagerCompilation = true;
-    baselineUsesBeforeCompile = 0;
-    forceDefaultIonUsesBeforeCompile = true;
-    forcedDefaultIonUsesBeforeCompile = 0;
-}
-
-void
-JitOptions::setUsesBeforeCompile(uint32_t useCount)
-{
-    forceDefaultIonUsesBeforeCompile = true;
-    forcedDefaultIonUsesBeforeCompile = useCount;
-
-    // Undo eager compilation
-    if (eagerCompilation && useCount != 0) {
-        jit::JitOptions defaultValues;
-        eagerCompilation = false;
-        baselineUsesBeforeCompile = defaultValues.baselineUsesBeforeCompile;
-    }
-}
-
-void
-JitOptions::resetUsesBeforeCompile()
-{
-    forceDefaultIonUsesBeforeCompile = false;
-
-    // Undo eager compilation
-    if (eagerCompilation) {
-        jit::JitOptions defaultValues;
-        eagerCompilation = false;
-        baselineUsesBeforeCompile = defaultValues.baselineUsesBeforeCompile;
-    }
-}
-
-} // namespace jit
-} // namespace js
diff --git a/js/src/jit/JitOptions.h b/js/src/jit/JitOptions.h
deleted file mode 100644
index a6f3d5843063..000000000000
--- a/js/src/jit/JitOptions.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef jit_JitOptions_h
-#define jit_JitOptions_h
-
-#include "jit/IonTypes.h"
-#include "js/TypeDecls.h"
-
-#ifdef JS_ION
-
-namespace js {
-namespace jit {
-
-// Longer scripts can only be compiled off thread, as these compilations
-// can be expensive and stall the main thread for too long.
-static const uint32_t MAX_OFF_THREAD_SCRIPT_SIZE = 100 * 1000;
-static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2 * 1000;
-static const uint32_t MAX_MAIN_THREAD_LOCALS_AND_ARGS = 256;
-
-// DOM Worker runtimes don't have off thread compilation, but can also compile
-// larger scripts since this doesn't stall the main thread.
-static const uint32_t MAX_DOM_WORKER_SCRIPT_SIZE = 16 * 1000;
-static const uint32_t MAX_DOM_WORKER_LOCALS_AND_ARGS = 2048;
-
-// Possible register allocators which may be used.
-enum IonRegisterAllocator {
-    RegisterAllocator_LSRA,
-    RegisterAllocator_Backtracking,
-    RegisterAllocator_Stupid
-};
-
-enum IonGvnKind {
-    GVN_Optimistic,
-    GVN_Pessimistic
-};
-
-struct JitOptions
-{
-    bool checkGraphConsistency;
-#ifdef CHECK_OSIPOINT_REGISTERS
-    bool checkOsiPointRegisters;
-#endif
-    bool checkRangeAnalysis;
-    bool checkThreadSafety;
-    bool compileTryCatch;
-    bool disableGvn;
-    bool disableLicm;
-    bool disableInlining;
-    bool disableEdgeCaseAnalysis;
-    bool disableRangeAnalysis;
-    bool disableUce;
-    bool disableEaa;
-    bool eagerCompilation;
-    bool forceDefaultIonUsesBeforeCompile;
-    uint32_t forcedDefaultIonUsesBeforeCompile;
-    bool forceGvnKind;
-    IonGvnKind forcedGvnKind;
-    bool forceRegisterAllocator;
-    IonRegisterAllocator forcedRegisterAllocator;
-    bool limitScriptSize;
-    bool osr;
-    uint32_t baselineUsesBeforeCompile;
-    uint32_t exceptionBailoutThreshold;
-    uint32_t frequentBailoutThreshold;
-    uint32_t maxStackArgs;
-    uint32_t osrPcMismatchesBeforeRecompile;
-    uint32_t smallFunctionMaxBytecodeLength_;
-    uint32_t usesBeforeCompilePar;
-
-    JitOptions();
-    bool isSmallFunction(JSScript *script) const;
-    void setEagerCompilation();
-    void setUsesBeforeCompile(uint32_t useCount);
-    void resetUsesBeforeCompile();
-};
-
-extern JitOptions js_JitOptions;
-
-} // namespace jit
-} // namespace js
-
-#endif // JS_ION
-
-#endif /* jit_JitOptions_h */
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 7ed29e1ac609..13c803502d6c 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -5768,23 +5768,6 @@ class LAssertRangeV : public LInstructionHelper<0, BOX_PIECES, 3>
     }
 };
 
-class LRecompileCheck : public LInstructionHelper<0, 0, 1>
-{
-  public:
-    LIR_HEADER(RecompileCheck)
-
-    LRecompileCheck(const LDefinition &scratch) {
-        setTemp(0, scratch);
-    }
-
-    const LDefinition *scratch() {
-        return getTemp(0);
-    }
-    MRecompileCheck *mir() {
-        return mir_->toRecompileCheck();
-    }
-};
-
 } // namespace jit
 } // namespace js
 
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 2b13b1ad1f66..44d9db360964 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -280,7 +280,6 @@
     _(AsmJSCall)                    \
     _(AsmJSCheckOverRecursed)       \
     _(CheckInterruptPar)            \
-    _(RecompileCheck)               \
     _(AssertRangeI)                 \
     _(AssertRangeD)                 \
     _(AssertRangeF)                 \
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index 154de5762109..cd22f4d36818 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -1128,7 +1128,7 @@ LinearScanAllocator::canCoexist(LiveInterval *a, LiveInterval *b)
 void
 LinearScanAllocator::validateIntervals()
 {
-    if (!js_JitOptions.checkGraphConsistency)
+    if (!js_IonOptions.checkGraphConsistency)
         return;
 
     for (IntervalIterator i(active.begin()); i != active.end(); i++) {
@@ -1174,7 +1174,7 @@ LinearScanAllocator::validateIntervals()
 void
 LinearScanAllocator::validateAllocations()
 {
-    if (!js_JitOptions.checkGraphConsistency)
+    if (!js_IonOptions.checkGraphConsistency)
         return;
 
     for (IntervalIterator i(handled.begin()); i != handled.end(); i++) {
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index db8feecd035e..a469ebda4aeb 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -600,7 +600,7 @@ class LiveRangeAllocator : protected RegisterAllocator
     void validateVirtualRegisters()
     {
 #ifdef DEBUG
-        if (!js_JitOptions.checkGraphConsistency)
+        if (!js_IonOptions.checkGraphConsistency)
             return;
 
         for (size_t i = 1; i < graph.numVirtualRegisters(); i++) {
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 7257a52951d6..3209d31927ff 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -523,7 +523,7 @@ LIRGenerator::visitAssertFloat32(MAssertFloat32 *assertion)
     if (!allowFloat32Optimizations())
         return true;
 
-    if (type != MIRType_Value && !js_JitOptions.eagerCompilation) {
+    if (type != MIRType_Value && !js_IonOptions.eagerCompilation) {
         JS_ASSERT_IF(checkIsFloat32, type == MIRType_Float32);
         JS_ASSERT_IF(!checkIsFloat32, type != MIRType_Float32);
     }
@@ -3421,15 +3421,6 @@ LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
     return defineBox(lir, ins);
 }
 
-bool
-LIRGenerator::visitRecompileCheck(MRecompileCheck *ins)
-{
-    LRecompileCheck *lir = new(alloc()) LRecompileCheck(temp());
-    if (!add(lir, ins))
-        return false;
-    return assignSafepoint(lir, ins);
-}
-
 static void
 SpewResumePoint(MBasicBlock *block, MInstruction *ins, MResumePoint *resumePoint)
 {
@@ -3550,7 +3541,7 @@ LIRGenerator::visitBlock(MBasicBlock *block)
     if (!definePhis())
         return false;
 
-    if (gen->optimizationInfo().registerAllocator() == RegisterAllocator_LSRA) {
+    if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
         if (!add(new(alloc()) LLabel()))
             return false;
     }
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index c2a86f313d4f..8302b9f16d68 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -261,7 +261,6 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitSetDOMProperty(MSetDOMProperty *ins);
     bool visitGetDOMProperty(MGetDOMProperty *ins);
     bool visitGetDOMMember(MGetDOMMember *ins);
-    bool visitRecompileCheck(MRecompileCheck *ins);
 };
 
 } // namespace jit
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index d5e4dde8fc8b..6292fc1ab510 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -24,9 +24,6 @@ namespace jit {
 IonBuilder::InliningStatus
 IonBuilder::inlineNativeCall(CallInfo &callInfo, JSNative native)
 {
-    if (!optimizationInfo().inlineNative())
-        return InliningStatus_NotInlined;
-
     // Array natives.
     if (native == js_Array)
         return inlineArray(callInfo);
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index c35b7ab9b1ed..1cf9adfa4365 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9204,41 +9204,6 @@ class MHaveSameClass
     }
 };
 
-// Increase the usecount of the provided script upon execution and test if
-// the usecount surpasses the threshold. Upon hit it will recompile the
-// outermost script (i.e. not the inlined script).
-class MRecompileCheck : public MNullaryInstruction
-{
-    JSScript *script_;
-    uint32_t recompileThreshold_;
-
-    MRecompileCheck(JSScript *script, uint32_t recompileThreshold)
-      : script_(script),
-        recompileThreshold_(recompileThreshold)
-    {
-        setGuard();
-    }
-
-  public:
-    INSTRUCTION_HEADER(RecompileCheck);
-
-    static MRecompileCheck *New(TempAllocator &alloc, JSScript *script_, uint32_t useCount) {
-        return new(alloc) MRecompileCheck(script_, useCount);
-    }
-
-    JSScript *script() const {
-        return script_;
-    }
-
-    uint32_t recompileThreshold() const {
-        return recompileThreshold_;
-    }
-
-    AliasSet getAliasSet() const {
-        return AliasSet::None();
-    }
-};
-
 class MAsmJSNeg : public MUnaryInstruction
 {
     MAsmJSNeg(MDefinition *op, MIRType type)
diff --git a/js/src/jit/MIRGenerator.h b/js/src/jit/MIRGenerator.h
index bce7c0c963e0..93fe32a795c5 100644
--- a/js/src/jit/MIRGenerator.h
+++ b/js/src/jit/MIRGenerator.h
@@ -29,13 +29,11 @@ namespace jit {
 class MBasicBlock;
 class MIRGraph;
 class MStart;
-class OptimizationInfo;
 
 class MIRGenerator
 {
   public:
-    MIRGenerator(CompileCompartment *compartment, TempAllocator *alloc, MIRGraph *graph,
-                 CompileInfo *info, const OptimizationInfo *optimizationInfo);
+    MIRGenerator(CompileCompartment *compartment, TempAllocator *alloc, MIRGraph *graph, CompileInfo *info);
 
     TempAllocator &alloc() {
         return *alloc_;
@@ -52,9 +50,6 @@ class MIRGenerator
     CompileInfo &info() {
         return *info_;
     }
-    const OptimizationInfo &optimizationInfo() const {
-        return *optimizationInfo_;
-    }
 
     template <typename T>
     T * allocate(size_t count = 1) {
@@ -132,7 +127,6 @@ class MIRGenerator
 
   protected:
     CompileInfo *info_;
-    const OptimizationInfo *optimizationInfo_;
     TempAllocator *alloc_;
     JSFunction *fun_;
     uint32_t nslots_;
diff --git a/js/src/jit/MIRGraph.cpp b/js/src/jit/MIRGraph.cpp
index 3965afec7f6d..ac4034f6a536 100644
--- a/js/src/jit/MIRGraph.cpp
+++ b/js/src/jit/MIRGraph.cpp
@@ -17,11 +17,9 @@ using namespace js;
 using namespace js::jit;
 
 MIRGenerator::MIRGenerator(CompileCompartment *compartment,
-                           TempAllocator *alloc, MIRGraph *graph, CompileInfo *info,
-                           const OptimizationInfo *optimizationInfo)
+                           TempAllocator *alloc, MIRGraph *graph, CompileInfo *info)
   : compartment(compartment),
     info_(info),
-    optimizationInfo_(optimizationInfo),
     alloc_(alloc),
     graph_(graph),
     error_(false),
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 08b622ba6395..12cee893cefa 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -211,8 +211,7 @@ namespace jit {
     _(RestPar)                                                              \
     _(ForkJoinSlice)                                                        \
     _(GuardThreadLocalObject)                                               \
-    _(CheckInterruptPar)                                                    \
-    _(RecompileCheck)
+    _(CheckInterruptPar)
 
 // Forward declarations of MIR types.
 #define FORWARD_DECLARE(op) class M##op;
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index a4d1e76bb6eb..446e0f159f6c 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -311,7 +311,6 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     UNSAFE_OP(AsmJSParameter)
     UNSAFE_OP(AsmJSCall)
     UNSAFE_OP(AsmJSCheckOverRecursed)
-    DROP_OP(RecompileCheck)
 
     // It looks like this could easily be made safe:
     UNSAFE_OP(ConvertElementsToDoubles)
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index 3db801399761..a60f4ca555a1 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -2040,7 +2040,7 @@ RangeAnalysis::analyze()
 bool
 RangeAnalysis::addRangeAssertions()
 {
-    if (!js_JitOptions.checkRangeAnalysis)
+    if (!js_IonOptions.checkRangeAnalysis)
         return true;
 
     // Check the computed range for this instruction, if the option is set. Note
diff --git a/js/src/jit/UnreachableCodeElimination.cpp b/js/src/jit/UnreachableCodeElimination.cpp
index dec3d1caf8a3..ea37feb5d541 100644
--- a/js/src/jit/UnreachableCodeElimination.cpp
+++ b/js/src/jit/UnreachableCodeElimination.cpp
@@ -82,8 +82,8 @@ UnreachableCodeElimination::removeUnmarkedBlocksAndCleanup()
 
     // Pass 5: It's important for optimizations to re-run GVN (and in
     // turn alias analysis) after UCE if we eliminated branches.
-    if (rerunAliasAnalysis_ && mir_->optimizationInfo().gvnEnabled()) {
-        ValueNumberer gvn(mir_, graph_, mir_->optimizationInfo().gvnKind() == GVN_Optimistic);
+    if (rerunAliasAnalysis_ && js_IonOptions.gvn) {
+        ValueNumberer gvn(mir_, graph_, js_IonOptions.gvnIsOptimistic);
         if (!gvn.clear() || !gvn.analyze())
             return false;
         IonSpewPass("GVN-after-UCE");
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index 879c06987db8..bb6aecb62e36 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -603,7 +603,7 @@ CodeGeneratorShared::verifyOsiPointRegs(LSafepoint *safepoint)
 bool
 CodeGeneratorShared::shouldVerifyOsiPointRegs(LSafepoint *safepoint)
 {
-    if (!js_JitOptions.checkOsiPointRegisters)
+    if (!js_IonOptions.checkOsiPointRegisters)
         return false;
 
     if (gen->info().executionMode() != SequentialExecution)
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index fdce3c69c6f8..940d346cae9d 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -76,7 +76,7 @@ LIRGeneratorShared::defineFixed(LInstructionHelper<1, X, Y> *lir, MDefinition *m
     if (!define(lir, mir, def))
         return false;
 
-    if (gen->optimizationInfo().registerAllocator() == RegisterAllocator_LSRA) {
+    if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
         if (!add(new(alloc()) LNop))
             return false;
     }
@@ -163,7 +163,7 @@ LIRGeneratorShared::defineReturn(LInstruction *lir, MDefinition *mir)
     if (!add(lir))
         return false;
 
-    if (gen->optimizationInfo().registerAllocator() == RegisterAllocator_LSRA) {
+    if (js_IonOptions.registerAllocator == RegisterAllocator_LSRA) {
         if (!add(new(alloc()) LNop))
             return false;
     }
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 2ad682aded64..38996d6f9ae1 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -5980,23 +5980,20 @@ JS_PUBLIC_API(void)
 JS_SetGlobalJitCompilerOption(JSContext *cx, JSJitCompilerOption opt, uint32_t value)
 {
 #ifdef JS_ION
+    jit::IonOptions defaultValues;
 
     switch (opt) {
       case JSJITCOMPILER_BASELINE_USECOUNT_TRIGGER:
-        if (value == uint32_t(-1)) {
-            jit::JitOptions defaultValues;
+        if (value == uint32_t(-1))
             value = defaultValues.baselineUsesBeforeCompile;
-        }
-        jit::js_JitOptions.baselineUsesBeforeCompile = value;
+        jit::js_IonOptions.baselineUsesBeforeCompile = value;
         break;
       case JSJITCOMPILER_ION_USECOUNT_TRIGGER:
-        if (value == uint32_t(-1)) {
-            jit::js_JitOptions.resetUsesBeforeCompile();
-            break;
-        }
-        jit::js_JitOptions.setUsesBeforeCompile(value);
+        if (value == uint32_t(-1))
+            value = defaultValues.usesBeforeCompile;
+        jit::js_IonOptions.usesBeforeCompile = value;
         if (value == 0)
-            jit::js_JitOptions.setEagerCompilation();
+            jit::js_IonOptions.setEagerCompilation();
         break;
       case JSJITCOMPILER_ION_ENABLE:
         if (value == 1) {
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 2f8616f056f2..544f3798767f 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -590,10 +590,8 @@ class JSScript : public js::gc::BarrieredCell<JSScript>
     uint32_t        sourceEnd_;
 
     uint32_t        useCount;   /* Number of times the script has been called
-                                 * or has had backedges taken. When running in
-                                 * ion, also increased for any inlined scripts.
-                                 * Reset if the script's JIT code is forcibly
-                                 * discarded. */
+                                 * or has had backedges taken. Reset if the
+                                 * script's JIT code is forcibly discarded. */
 
 #ifdef DEBUG
     // Unique identifier within the compartment for this script, used for
diff --git a/js/src/jsworkers.cpp b/js/src/jsworkers.cpp
index ce332a9f0163..61cf70e8eca8 100644
--- a/js/src/jsworkers.cpp
+++ b/js/src/jsworkers.cpp
@@ -746,6 +746,7 @@ WorkerThread::handleIonWorkload(WorkerThreadState &state)
     ionBuilder = state.ionWorklist.popCopy();
 
     DebugOnly<ExecutionMode> executionMode = ionBuilder->info().executionMode();
+    JS_ASSERT(jit::GetIonScript(ionBuilder->script(), executionMode) == ION_COMPILING_SCRIPT);
 
 #if JS_TRACE_LOGGING
     AutoTraceLog logger(TraceLogging::getLogger(TraceLogging::ION_BACKGROUND_COMPILER),
diff --git a/js/src/moz.build b/js/src/moz.build
index de817201df82..31769c7439b5 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -257,9 +257,7 @@ if CONFIG['ENABLE_ION']:
         'jit/IonCaches.cpp',
         'jit/IonFrames.cpp',
         'jit/IonMacroAssembler.cpp',
-        'jit/IonOptimizationLevels.cpp',
         'jit/IonSpewer.cpp',
-        'jit/JitOptions.cpp',
         'jit/JSONSpewer.cpp',
         'jit/LICM.cpp',
         'jit/LinearScan.cpp',
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 8386af16dc35..501bc02295ff 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -5440,110 +5440,103 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
     }
 
     if (const char *str = op->getStringOption("ion-gvn")) {
-        if (strcmp(str, "off") == 0) {
-            jit::js_JitOptions.disableGvn = true;
-        } else if (strcmp(str, "pessimistic") == 0) {
-            jit::js_JitOptions.forceGvnKind = true;
-            jit::js_JitOptions.forcedGvnKind = jit::GVN_Pessimistic;
-        } else if (strcmp(str, "optimistic") == 0) {
-            jit::js_JitOptions.forceGvnKind = true;
-            jit::js_JitOptions.forcedGvnKind = jit::GVN_Optimistic;
-        } else {
+        if (strcmp(str, "off") == 0)
+            jit::js_IonOptions.gvn = false;
+        else if (strcmp(str, "pessimistic") == 0)
+            jit::js_IonOptions.gvnIsOptimistic = false;
+        else if (strcmp(str, "optimistic") == 0)
+            jit::js_IonOptions.gvnIsOptimistic = true;
+        else
             return OptionFailure("ion-gvn", str);
-        }
     }
 
     if (const char *str = op->getStringOption("ion-licm")) {
         if (strcmp(str, "on") == 0)
-            jit::js_JitOptions.disableLicm = false;
+            jit::js_IonOptions.licm = true;
         else if (strcmp(str, "off") == 0)
-            jit::js_JitOptions.disableLicm = true;
+            jit::js_IonOptions.licm = false;
         else
             return OptionFailure("ion-licm", str);
     }
 
     if (const char *str = op->getStringOption("ion-edgecase-analysis")) {
         if (strcmp(str, "on") == 0)
-            jit::js_JitOptions.disableEdgeCaseAnalysis = false;
+            jit::js_IonOptions.edgeCaseAnalysis = true;
         else if (strcmp(str, "off") == 0)
-            jit::js_JitOptions.disableEdgeCaseAnalysis = true;
+            jit::js_IonOptions.edgeCaseAnalysis = false;
         else
             return OptionFailure("ion-edgecase-analysis", str);
     }
 
      if (const char *str = op->getStringOption("ion-range-analysis")) {
          if (strcmp(str, "on") == 0)
-             jit::js_JitOptions.disableRangeAnalysis = false;
+             jit::js_IonOptions.rangeAnalysis = true;
          else if (strcmp(str, "off") == 0)
-             jit::js_JitOptions.disableRangeAnalysis = true;
+             jit::js_IonOptions.rangeAnalysis = false;
          else
              return OptionFailure("ion-range-analysis", str);
      }
 
     if (op->getBoolOption("ion-check-range-analysis"))
-        jit::js_JitOptions.checkRangeAnalysis = true;
+        jit::js_IonOptions.checkRangeAnalysis = true;
 
     if (op->getBoolOption("ion-check-thread-safety"))
-        jit::js_JitOptions.checkThreadSafety = true;
+        jit::js_IonOptions.checkThreadSafety = true;
 
     if (const char *str = op->getStringOption("ion-inlining")) {
         if (strcmp(str, "on") == 0)
-            jit::js_JitOptions.disableInlining = false;
+            jit::js_IonOptions.inlining = true;
         else if (strcmp(str, "off") == 0)
-            jit::js_JitOptions.disableInlining = true;
+            jit::js_IonOptions.inlining = false;
         else
             return OptionFailure("ion-inlining", str);
     }
 
     if (const char *str = op->getStringOption("ion-osr")) {
         if (strcmp(str, "on") == 0)
-            jit::js_JitOptions.osr = true;
+            jit::js_IonOptions.osr = true;
         else if (strcmp(str, "off") == 0)
-            jit::js_JitOptions.osr = false;
+            jit::js_IonOptions.osr = false;
         else
             return OptionFailure("ion-osr", str);
     }
 
     if (const char *str = op->getStringOption("ion-limit-script-size")) {
         if (strcmp(str, "on") == 0)
-            jit::js_JitOptions.limitScriptSize = true;
+            jit::js_IonOptions.limitScriptSize = true;
         else if (strcmp(str, "off") == 0)
-            jit::js_JitOptions.limitScriptSize = false;
+            jit::js_IonOptions.limitScriptSize = false;
         else
             return OptionFailure("ion-limit-script-size", str);
     }
 
     int32_t useCount = op->getIntOption("ion-uses-before-compile");
     if (useCount >= 0)
-        jit::js_JitOptions.setUsesBeforeCompile(useCount);
+        jit::js_IonOptions.usesBeforeCompile = useCount;
 
     useCount = op->getIntOption("baseline-uses-before-compile");
     if (useCount >= 0)
-        jit::js_JitOptions.baselineUsesBeforeCompile = useCount;
+        jit::js_IonOptions.baselineUsesBeforeCompile = useCount;
 
     if (op->getBoolOption("baseline-eager"))
-        jit::js_JitOptions.baselineUsesBeforeCompile = 0;
+        jit::js_IonOptions.baselineUsesBeforeCompile = 0;
 
     if (const char *str = op->getStringOption("ion-regalloc")) {
-        if (strcmp(str, "lsra") == 0) {
-            jit::js_JitOptions.forceRegisterAllocator = true;
-            jit::js_JitOptions.forcedRegisterAllocator = jit::RegisterAllocator_LSRA;
-        } else if (strcmp(str, "backtracking") == 0) {
-            jit::js_JitOptions.forceRegisterAllocator = true;
-            jit::js_JitOptions.forcedRegisterAllocator = jit::RegisterAllocator_Backtracking;
-        } else if (strcmp(str, "stupid") == 0) {
-            jit::js_JitOptions.forceRegisterAllocator = true;
-            jit::js_JitOptions.forcedRegisterAllocator = jit::RegisterAllocator_Stupid;
-        } else {
+        if (strcmp(str, "lsra") == 0)
+            jit::js_IonOptions.registerAllocator = jit::RegisterAllocator_LSRA;
+        else if (strcmp(str, "backtracking") == 0)
+            jit::js_IonOptions.registerAllocator = jit::RegisterAllocator_Backtracking;
+        else if (strcmp(str, "stupid") == 0)
+            jit::js_IonOptions.registerAllocator = jit::RegisterAllocator_Stupid;
+        else
             return OptionFailure("ion-regalloc", str);
-        }
     }
 
     if (op->getBoolOption("ion-eager"))
-        jit::js_JitOptions.setEagerCompilation();
+        jit::js_IonOptions.setEagerCompilation();
 
     if (op->getBoolOption("ion-compile-try-catch"))
-        jit::js_JitOptions.compileTryCatch = true;
+        jit::js_IonOptions.compileTryCatch = true;
 
 #ifdef JS_THREADSAFE
     bool parallelCompilation = false;
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index 83be1584e784..1f2e41df78fe 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -2207,8 +2207,8 @@ js::ParallelTestsShouldPass(JSContext *cx)
 {
     return jit::IsIonEnabled(cx) &&
            jit::IsBaselineEnabled(cx) &&
-           !jit::js_JitOptions.eagerCompilation &&
-           jit::js_JitOptions.baselineUsesBeforeCompile != 0 &&
+           !jit::js_IonOptions.eagerCompilation &&
+           jit::js_IonOptions.baselineUsesBeforeCompile != 0 &&
            cx->runtime()->gcZeal() == 0;
 }
 

From fd36ed6219a873c46cbb98c3f440e9cfaa51dfbc Mon Sep 17 00:00:00 2001
From: Monica Chew <mmc@mozilla.com>
Date: Thu, 12 Dec 2013 11:20:11 -0800
Subject: [PATCH 031/459] Bug 837202: Add telemetry for application reputation
 check (r=paolo,yoric)

---
 .../downloads/ApplicationReputation.cpp       | 53 ++++++++++++++++++-
 toolkit/components/telemetry/Histograms.json  | 18 +++++++
 2 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/downloads/ApplicationReputation.cpp b/toolkit/components/downloads/ApplicationReputation.cpp
index d8fc7c633f29..9e3e5f2cbe47 100644
--- a/toolkit/components/downloads/ApplicationReputation.cpp
+++ b/toolkit/components/downloads/ApplicationReputation.cpp
@@ -21,6 +21,7 @@
 
 #include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
+#include "mozilla/Telemetry.h"
 
 #include "nsCOMPtr.h"
 #include "nsDebug.h"
@@ -33,6 +34,7 @@
 #include "nsXPCOMStrings.h"
 
 using mozilla::Preferences;
+using mozilla::Telemetry::Accumulate;
 
 // Preferences that we need to initialize the query. We may need another
 // preference than browser.safebrowsing.malware.enabled, or simply use
@@ -61,6 +63,27 @@ public:
   ~PendingLookup();
 
 private:
+  /**
+   * Telemetry states.
+   */
+  /**
+   * The download appeared on the allowlist, blocklist, or no list (and thus
+   * could trigger a remote query).
+   */
+  enum {
+    ALLOW_LIST = 0,
+    BLOCK_LIST = 1,
+    NO_LIST = 2,
+  } LIST_TYPES;
+  /**
+   * Status of the remote response (valid or not).
+   */
+  enum {
+    SERVER_RESPONSE_VALID = 0,
+    SERVER_RESPONSE_FAILED = 1,
+    SERVER_RESPONSE_INVALID = 2,
+  } SERVER_RESPONSE_TYPES;
+
   nsCOMPtr<nsIApplicationReputationQuery> mQuery;
   nsCOMPtr<nsIApplicationReputationCallback> mCallback;
   /**
@@ -105,6 +128,8 @@ PendingLookup::~PendingLookup() {
 
 nsresult
 PendingLookup::OnComplete(bool shouldBlock, nsresult rv) {
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SHOULD_BLOCK,
+    shouldBlock);
   nsresult res = mCallback->OnComplete(shouldBlock, rv);
   return res;
 }
@@ -119,15 +144,18 @@ PendingLookup::HandleEvent(const nsACString& tables) {
   nsCString allow_list;
   Preferences::GetCString(PREF_DOWNLOAD_ALLOW_TABLE, &allow_list);
   if (FindInReadable(tables, allow_list)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, ALLOW_LIST);
     return OnComplete(false, NS_OK);
   }
 
   nsCString block_list;
   Preferences::GetCString(PREF_DOWNLOAD_BLOCK_TABLE, &block_list);
   if (FindInReadable(tables, block_list)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, BLOCK_LIST);
     return OnComplete(true, NS_OK);
   }
 
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, NO_LIST);
 #if 0
   nsresult rv = SendRemoteQuery();
   if (NS_FAILED(rv)) {
@@ -268,16 +296,32 @@ PendingLookup::OnStopRequestInternal(nsIRequest *aRequest,
                                      nsISupports *aContext,
                                      nsresult aResult,
                                      bool* aShouldBlock) {
+  if (NS_FAILED(aResult)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
+    return aResult;
+  }
+
   *aShouldBlock = false;
   nsresult rv;
   nsCOMPtr<nsIHttpChannel> channel = do_QueryInterface(aRequest, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_FAILED(rv)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
+    return rv;
+  }
 
   uint32_t status = 0;
   rv = channel->GetResponseStatus(&status);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_FAILED(rv)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
+    return rv;
+  }
 
   if (status != 200) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
     return NS_ERROR_NOT_AVAILABLE;
   }
 
@@ -285,11 +329,15 @@ PendingLookup::OnStopRequestInternal(nsIRequest *aRequest,
   safe_browsing::ClientDownloadResponse response;
   if (!response.ParseFromString(buf)) {
     NS_WARNING("Could not parse protocol buffer");
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+                                   SERVER_RESPONSE_INVALID);
     return NS_ERROR_CANNOT_CONVERT_DATA;
   }
 
   // There are several more verdicts, but we only respect one for now and treat
   // everything else as SAFE.
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+    SERVER_RESPONSE_VALID);
   if (response.verdict() == safe_browsing::ClientDownloadResponse::DANGEROUS) {
     *aShouldBlock = true;
   }
@@ -335,6 +383,7 @@ ApplicationReputationService::QueryReputation(
   NS_ENSURE_ARG_POINTER(aQuery);
   NS_ENSURE_ARG_POINTER(aCallback);
 
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_COUNT, true);
   nsresult rv = QueryReputationInternal(aQuery, aCallback);
   if (NS_FAILED(rv)) {
     aCallback->OnComplete(false, rv);
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index a8e5707d4a06..6a2cab5804b6 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -23,6 +23,24 @@
     "extended_statistics_ok": true,
     "description": "time spent updating accessibility (ms)"
   },
+  "APPLICATION_REPUTATION_SHOULD_BLOCK": {
+    "kind": "boolean",
+    "description": "Application reputation verdict (shouldBlock=false is OK)"
+  },
+  "APPLICATION_REPUTATION_LOCAL": {
+    "kind": "enumerated",
+    "n_values": 3,
+    "description": "Application reputation local results (0=ALLOW, 1=BLOCK, 2=NONE)"
+  },
+  "APPLICATION_REPUTATION_SERVER": {
+    "kind": "enumerated",
+    "n_values": 3,
+    "description": "Application reputation remote status (0 = OK, 1 = FAIL, 2 = INVALID)"
+  },
+  "APPLICATION_REPUTATION_COUNT": {
+    "kind": "flag",
+    "description": "Application reputation query count (both local and remote)"
+  },
   "BACKGROUNDFILESAVER_THREAD_COUNT": {
     "kind": "enumerated",
     "n_values": 21,

From 1b008d2a72c165059fbeb3aced9e8ae19e64466e Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <benj@benj.me>
Date: Thu, 12 Dec 2013 20:23:29 +0100
Subject: [PATCH 032/459] Bug 904918: Odin Float32 support; p=bbouvier,dougc
 r=luke,sstangl

Authors:
- Douglas Crosher (dougc) for the ARM backend support
- Benjamin Bouvier (bbouvier) for everything else
---
 js/src/assembler/assembler/X86Assembler.h |   6 +-
 js/src/jit/AsmJS.cpp                      | 560 +++++++++++++++++-----
 js/src/jit/AsmJSLink.cpp                  |  22 +-
 js/src/jit/AsmJSModule.cpp                |  22 +
 js/src/jit/AsmJSModule.h                  |  18 +-
 js/src/jit/Lowering.cpp                   |   6 +-
 js/src/jit/MIR.h                          |   6 +-
 js/src/jit/arm/Assembler-arm.cpp          |   1 +
 js/src/jit/arm/CodeGenerator-arm.cpp      |  46 +-
 js/src/jit/arm/CodeGenerator-arm.h        |  13 +-
 js/src/jit/arm/Lowering-arm.cpp           |   3 +
 js/src/jit/arm/MacroAssembler-arm.cpp     |   5 +-
 js/src/jit/arm/MacroAssembler-arm.h       |   8 +-
 js/src/jit/shared/Assembler-shared.h      |  13 +-
 js/src/jit/shared/Lowering-x86-shared.cpp |   3 +
 js/src/jit/x64/Assembler-x64.cpp          |   2 +
 js/src/jit/x64/CodeGenerator-x64.cpp      |  21 +-
 js/src/jit/x86/Assembler-x86.h            |  10 +
 js/src/jit/x86/CodeGenerator-x86.cpp      | 138 +++---
 js/src/jit/x86/CodeGenerator-x86.h        |   8 +-
 js/src/jsmath.cpp                         |  15 +-
 js/src/jsmath.h                           |   3 +
 22 files changed, 654 insertions(+), 275 deletions(-)

diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index bd3f2e542db5..da9f01cbea14 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -270,7 +270,7 @@ private:
         OP_GROUP2_Ev1                   = 0xD1,
         OP_GROUP2_EvCL                  = 0xD3,
         OP_FPU6                         = 0xDD,
-        OP_FLD32                        = 0xD9,
+        OP_FPU6_F32                     = 0xD9,
         OP_CALL_rel32                   = 0xE8,
         OP_JMP_rel32                    = 0xE9,
         PRE_SSE_F2                      = 0xF2,
@@ -732,7 +732,7 @@ public:
     void fld32_m(int offset, RegisterID base)
     {
         spew("fld        %s0x%x(%s)", PRETTY_PRINT_OFFSET(offset), nameIReg(base));
-        m_formatter.oneByteOp(OP_FLD32, FPU6_OP_FLD, base, offset);
+        m_formatter.oneByteOp(OP_FPU6_F32, FPU6_OP_FLD, base, offset);
     }
     void fisttp_m(int offset, RegisterID base)
     {
@@ -747,7 +747,7 @@ public:
     void fstp32_m(int offset, RegisterID base)
     {
         spew("fstp32       %s0x%x(%s)", PRETTY_PRINT_OFFSET(offset), nameIReg(base));
-        m_formatter.oneByteOp(OP_FLD32, FPU6_OP_FSTP, base, offset);
+        m_formatter.oneByteOp(OP_FPU6_F32, FPU6_OP_FSTP, base, offset);
     }
 
     void negl_r(RegisterID dst)
diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index f7e70f9c1109..01a05500dd00 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -368,7 +368,10 @@ class Type
   public:
     enum Which {
         Double,
-        Doublish,
+        MaybeDouble,
+        Float,
+        MaybeFloat,
+        Floatish,
         Fixnum,
         Int,
         Signed,
@@ -407,8 +410,20 @@ class Type
         return which_ == Double;
     }
 
-    bool isDoublish() const {
-        return isDouble() || which_ == Doublish;
+    bool isMaybeDouble() const {
+        return isDouble() || which_ == MaybeDouble;
+    }
+
+    bool isFloat() const {
+        return which_ == Float;
+    }
+
+    bool isMaybeFloat() const {
+        return isFloat() || which_ == MaybeFloat;
+    }
+
+    bool isFloatish() const {
+        return isMaybeFloat() || which_ == Floatish;
     }
 
     bool isVoid() const {
@@ -420,14 +435,18 @@ class Type
     }
 
     bool isVarType() const {
-        return isInt() || isDouble();
+        return isInt() || isDouble() || isFloat();
     }
 
     MIRType toMIRType() const {
         switch (which_) {
           case Double:
-          case Doublish:
+          case MaybeDouble:
             return MIRType_Double;
+          case Float:
+          case Floatish:
+          case MaybeFloat:
+            return MIRType_Float32;
           case Fixnum:
           case Int:
           case Signed:
@@ -442,14 +461,17 @@ class Type
 
     const char *toChars() const {
         switch (which_) {
-          case Double:    return "double";
-          case Doublish:  return "doublish";
-          case Fixnum:    return "fixnum";
-          case Int:       return "int";
-          case Signed:    return "signed";
-          case Unsigned:  return "unsigned";
-          case Intish:    return "intish";
-          case Void:      return "void";
+          case Double:      return "double";
+          case MaybeDouble: return "double?";
+          case Float:       return "float";
+          case Floatish:    return "floatish";
+          case MaybeFloat:  return "float?";
+          case Fixnum:      return "fixnum";
+          case Int:         return "int";
+          case Signed:      return "signed";
+          case Unsigned:    return "unsigned";
+          case Intish:      return "intish";
+          case Void:        return "void";
         }
         MOZ_ASSUME_UNREACHABLE("Invalid Type");
     }
@@ -465,7 +487,8 @@ class RetType
     enum Which {
         Void = Type::Void,
         Signed = Type::Signed,
-        Double = Type::Double
+        Double = Type::Double,
+        Float = Type::Float
     };
 
   private:
@@ -478,6 +501,7 @@ class RetType
         switch (coercion) {
           case AsmJS_ToInt32: which_ = Signed; break;
           case AsmJS_ToNumber: which_ = Double; break;
+          case AsmJS_FRound: which_ = Float; break;
         }
     }
     Which which() const {
@@ -490,6 +514,7 @@ class RetType
         switch (which_) {
           case Void: return AsmJSModule::Return_Void;
           case Signed: return AsmJSModule::Return_Int32;
+          case Float: // will be converted to a Double
           case Double: return AsmJSModule::Return_Double;
         }
         MOZ_ASSUME_UNREACHABLE("Unexpected return type");
@@ -499,6 +524,7 @@ class RetType
           case Void: return MIRType_None;
           case Signed: return MIRType_Int32;
           case Double: return MIRType_Double;
+          case Float: return MIRType_Float32;
         }
         MOZ_ASSUME_UNREACHABLE("Unexpected return type");
     }
@@ -534,7 +560,8 @@ class VarType
   public:
     enum Which {
         Int = Type::Int,
-        Double = Type::Double
+        Double = Type::Double,
+        Float = Type::Float
     };
 
   private:
@@ -549,6 +576,7 @@ class VarType
         switch (coercion) {
           case AsmJS_ToInt32: which_ = Int; break;
           case AsmJS_ToNumber: which_ = Double; break;
+          case AsmJS_FRound: which_ = Float; break;
         }
     }
     Which which() const {
@@ -558,18 +586,40 @@ class VarType
         return Type::Which(which_);
     }
     MIRType toMIRType() const {
-        return which_ == Int ? MIRType_Int32 : MIRType_Double;
+        switch(which_) {
+          case Int:     return MIRType_Int32;
+          case Double:  return MIRType_Double;
+          case Float:   return MIRType_Float32;
+        }
+        MOZ_ASSUME_UNREACHABLE("VarType can only be Int, Double or Float");
+        return MIRType_None;
     }
     AsmJSCoercion toCoercion() const {
-        return which_ == Int ? AsmJS_ToInt32 : AsmJS_ToNumber;
+        switch(which_) {
+          case Int:     return AsmJS_ToInt32;
+          case Double:  return AsmJS_ToNumber;
+          case Float:   return AsmJS_FRound;
+        }
+        MOZ_ASSUME_UNREACHABLE("VarType can only be Int, Double or Float");
+        return AsmJS_ToInt32;
     }
     static VarType FromMIRType(MIRType type) {
-        JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double);
-        return type == MIRType_Int32 ? Int : Double;
+        JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double || type == MIRType_Float32);
+        switch(type) {
+          case MIRType_Int32:   return Int;
+          case MIRType_Float32: return Float;
+          case MIRType_Double:  return Double;
+          default: MOZ_ASSUME_UNREACHABLE("FromMIRType MIR type not handled"); return Int;
+        }
     }
     static VarType FromCheckedType(Type type) {
-        JS_ASSERT(type.isInt() || type.isDoublish());
-        return type.isDoublish() ? Double : Int;
+        JS_ASSERT(type.isInt() || type.isMaybeDouble() || type.isFloatish());
+        if (type.isMaybeDouble())
+            return Double;
+        else if (type.isFloatish())
+            return Float;
+        else
+            return Int;
     }
     bool operator==(VarType rhs) const { return which_ == rhs.which_; }
     bool operator!=(VarType rhs) const { return which_ != rhs.which_; }
@@ -584,6 +634,7 @@ operator<=(Type lhs, VarType rhs)
     switch (rhs.which()) {
       case VarType::Int:    return lhs.isInt();
       case VarType::Double: return lhs.isDouble();
+      case VarType::Float:  return lhs.isFloat();
     }
     MOZ_ASSUME_UNREACHABLE("Unexpected rhs type");
 }
@@ -706,6 +757,8 @@ class NumLit
     Value v_;
 
   public:
+    NumLit() {}
+
     NumLit(Which w, Value v)
       : which_(w), v_(v)
     {}
@@ -792,6 +845,29 @@ ExtractNumericLiteral(ParseNode *pn)
     return NumLit(NumLit::NegativeInt, Int32Value(i64));
 }
 
+static bool
+ExtractFRoundableLiteral(ParseNode *pn, double *value)
+{
+    if (!IsNumericLiteral(pn))
+        return false;
+
+    NumLit literal = ExtractNumericLiteral(pn);
+    switch (literal.which()) {
+      case NumLit::Double:
+        *value = literal.toDouble();
+        return true;
+      case NumLit::Fixnum:
+      case NumLit::NegativeInt:
+      case NumLit::BigUnsigned:
+        literal = NumLit(NumLit::Double, DoubleValue(literal.toInt32()));
+        *value = literal.toDouble();
+        return true;
+      case NumLit::OutOfRangeInt:
+        break;
+    }
+    return false;
+}
+
 static inline bool
 IsLiteralInt(ParseNode *pn, uint32_t *u32)
 {
@@ -848,32 +924,9 @@ TypedArrayLoadType(ArrayBufferView::ViewType viewType)
       case ArrayBufferView::TYPE_UINT32:
         return Type::Intish;
       case ArrayBufferView::TYPE_FLOAT32:
+        return Type::MaybeFloat;
       case ArrayBufferView::TYPE_FLOAT64:
-        return Type::Doublish;
-      default:;
-    }
-    MOZ_ASSUME_UNREACHABLE("Unexpected array type");
-}
-
-enum ArrayStoreEnum {
-    ArrayStore_Intish,
-    ArrayStore_Doublish
-};
-
-static ArrayStoreEnum
-TypedArrayStoreType(ArrayBufferView::ViewType viewType)
-{
-    switch (viewType) {
-      case ArrayBufferView::TYPE_INT8:
-      case ArrayBufferView::TYPE_INT16:
-      case ArrayBufferView::TYPE_INT32:
-      case ArrayBufferView::TYPE_UINT8:
-      case ArrayBufferView::TYPE_UINT16:
-      case ArrayBufferView::TYPE_UINT32:
-        return ArrayStore_Intish;
-      case ArrayBufferView::TYPE_FLOAT32:
-      case ArrayBufferView::TYPE_FLOAT64:
-        return ArrayStore_Doublish;
+        return Type::MaybeDouble;
       default:;
     }
     MOZ_ASSUME_UNREACHABLE("Unexpected array type");
@@ -1305,7 +1358,8 @@ class MOZ_STACK_CLASS ModuleCompiler
             !addStandardLibraryMathName("sqrt", AsmJSMathBuiltin_sqrt) ||
             !addStandardLibraryMathName("abs", AsmJSMathBuiltin_abs) ||
             !addStandardLibraryMathName("atan2", AsmJSMathBuiltin_atan2) ||
-            !addStandardLibraryMathName("imul", AsmJSMathBuiltin_imul))
+            !addStandardLibraryMathName("imul", AsmJSMathBuiltin_imul) ||
+            !addStandardLibraryMathName("fround", AsmJSMathBuiltin_fround))
         {
             return false;
         }
@@ -1441,7 +1495,7 @@ class MOZ_STACK_CLASS ModuleCompiler
     bool addGlobalVarInitConstant(PropertyName *varName, VarType type, const Value &v,
                                   bool isConst) {
         uint32_t index;
-        if (!module_->addGlobalVarInitConstant(v, &index))
+        if (!module_->addGlobalVarInitConstant(v, type.toCoercion(), &index))
             return false;
         Global *global = moduleLifo_.new_<Global>(Global::Variable);
         if (!global)
@@ -1808,9 +1862,16 @@ class FunctionCompiler
         Local(VarType t, unsigned slot) : type(t), slot(slot) {}
     };
 
+    struct TypedValue
+    {
+        VarType type;
+        Value value;
+        TypedValue(VarType t, const Value &v) : type(t), value(v) {}
+    };
+
   private:
     typedef HashMap<PropertyName*, Local> LocalMap;
-    typedef js::Vector<Value> VarInitializerVector;
+    typedef js::Vector<TypedValue> VarInitializerVector;
     typedef HashMap<PropertyName*, BlockVector> LabeledBlockMap;
     typedef HashMap<ParseNode*, BlockVector> UnlabeledBlockMap;
     typedef js::Vector<ParseNode*, 4> NodeStack;
@@ -1924,7 +1985,7 @@ class FunctionCompiler
             return failName(pn, "duplicate local name '%s' not allowed", name);
         if (!locals_.add(p, name, Local(type, locals_.count())))
             return false;
-        return varInitializers_.append(init);
+        return varInitializers_.append(TypedValue(type, init));
     }
 
     bool prepareToEmitMIR(const VarTypeVector &argTypes)
@@ -1950,7 +2011,8 @@ class FunctionCompiler
         }
         unsigned firstLocalSlot = argTypes.length();
         for (unsigned i = 0; i < varInitializers_.length(); i++) {
-            MConstant *ins = MConstant::New(alloc(), varInitializers_[i]);
+            MConstant *ins = MConstant::NewAsmJS(alloc(), varInitializers_[i].value,
+                                                 varInitializers_[i].type.toMIRType());
             curBlock_->add(ins);
             curBlock_->initSlot(info().localSlot(firstLocalSlot + i), ins);
         }
@@ -2010,6 +2072,16 @@ class FunctionCompiler
         return constant;
     }
 
+    MDefinition *constantFloat(float f)
+    {
+        if (!curBlock_)
+            return NULL;
+
+        MConstant *constant = MConstant::NewAsmJS(alloc(), DoubleValue(double(f)), MIRType_Float32);
+        curBlock_->add(constant);
+        return constant;
+    }
+
     template <class T>
     MDefinition *unary(MDefinition *op)
     {
@@ -2869,10 +2941,39 @@ CheckGlobalVariableInitConstant(ModuleCompiler &m, PropertyName *varName, ParseN
     return m.addGlobalVarInitConstant(varName, type, literal.value(), isConst);
 }
 
+static bool
+CheckFloat32Coercion(ModuleCompiler &m, ParseNode *callNode, ParseNode **coercedExpr,
+                     const char* errorMessage)
+{
+    JS_ASSERT(callNode->isKind(PNK_CALL));
+
+    ParseNode *callee = CallCallee(callNode);
+    if (!callee->isKind(PNK_NAME))
+        return m.fail(callee, errorMessage);
+
+    PropertyName *calleeName = callee->name();
+
+    const ModuleCompiler::Global *global = m.lookupGlobal(calleeName);
+    if (!global || global->which() != ModuleCompiler::Global::MathBuiltin ||
+        global->mathBuiltin() != AsmJSMathBuiltin_fround)
+    {
+        return m.fail(callee, errorMessage);
+    }
+
+    unsigned numArgs = CallArgListLength(callNode);
+    if (numArgs != 1)
+        return m.failf(callee, "fround passed %u arguments, expected one", numArgs);
+
+    if (coercedExpr)
+        *coercedExpr = CallArgList(callNode);
+    return true;
+}
+
 static bool
 CheckTypeAnnotation(ModuleCompiler &m, ParseNode *coercionNode, AsmJSCoercion *coercion,
                     ParseNode **coercedExpr = nullptr)
 {
+    static const char *errorMessage = "in coercion expression, the expression must be of the form +x, fround(x) or x|0";
     switch (coercionNode->getKind()) {
       case PNK_BITOR: {
         ParseNode *rhs = BinaryRight(coercionNode);
@@ -2895,21 +2996,20 @@ CheckTypeAnnotation(ModuleCompiler &m, ParseNode *coercionNode, AsmJSCoercion *c
             *coercedExpr = UnaryKid(coercionNode);
         return true;
       }
+      case PNK_CALL: {
+        *coercion = AsmJS_FRound;
+        return CheckFloat32Coercion(m, coercionNode, coercedExpr, errorMessage);
+      }
       default:;
     }
 
-    return m.fail(coercionNode, "in coercion expression, the expression must be of the form +x or x|0");
+    return m.fail(coercionNode, errorMessage);
 }
 
 static bool
-CheckGlobalVariableInitImport(ModuleCompiler &m, PropertyName *varName, ParseNode *initNode,
-                              bool isConst)
+CheckGlobalVariableImportExpr(ModuleCompiler &m, PropertyName *varName, AsmJSCoercion coercion,
+                              ParseNode *coercedExpr, bool isConst)
 {
-    AsmJSCoercion coercion;
-    ParseNode *coercedExpr;
-    if (!CheckTypeAnnotation(m, initNode, &coercion, &coercedExpr))
-        return false;
-
     if (!coercedExpr->isKind(PNK_DOT))
         return m.failName(coercedExpr, "invalid import expression for global '%s'", varName);
 
@@ -2925,6 +3025,35 @@ CheckGlobalVariableInitImport(ModuleCompiler &m, PropertyName *varName, ParseNod
     return m.addGlobalVarImport(varName, field, coercion, isConst);
 }
 
+static bool
+CheckGlobalVariableInitImport(ModuleCompiler &m, PropertyName *varName, ParseNode *initNode,
+                              bool isConst)
+{
+    AsmJSCoercion coercion;
+    ParseNode *coercedExpr;
+    if (!CheckTypeAnnotation(m, initNode, &coercion, &coercedExpr))
+        return false;
+    return CheckGlobalVariableImportExpr(m, varName, coercion, coercedExpr, isConst);
+}
+
+static bool
+CheckGlobalVariableInitFloat32(ModuleCompiler &m, PropertyName *varName, ParseNode *initNode,
+                               bool isConst)
+{
+    ParseNode *arg = NULL;
+    if (!CheckFloat32Coercion(m, initNode, &arg, "call must be of the form fround(x)"))
+        return false;
+
+    if (IsNumericLiteral(arg)) {
+        double value;
+        if (!ExtractFRoundableLiteral(arg, &value))
+            return m.fail(arg, "float global initializer needs to be a double literal");
+        return m.addGlobalVarInitConstant(varName, VarType::Float, DoubleValue(value), isConst);
+    }
+
+    return CheckGlobalVariableImportExpr(m, varName, AsmJSCoercion::AsmJS_FRound, arg, isConst);
+}
+
 static bool
 CheckNewArrayView(ModuleCompiler &m, PropertyName *varName, ParseNode *newExpr)
 {
@@ -3027,6 +3156,9 @@ CheckModuleGlobal(ModuleCompiler &m, ParseNode *var, bool isConst)
     if (initNode->isKind(PNK_BITOR) || initNode->isKind(PNK_POS))
         return CheckGlobalVariableInitImport(m, var->name(), initNode, isConst);
 
+    if (initNode->isKind(PNK_CALL))
+        return CheckGlobalVariableInitFloat32(m, var->name(), initNode, isConst);
+
     if (initNode->isKind(PNK_NEW))
         return CheckNewArrayView(m, var->name(), initNode);
 
@@ -3058,7 +3190,7 @@ static bool
 ArgFail(FunctionCompiler &f, PropertyName *argName, ParseNode *stmt)
 {
     return f.failName(stmt, "expecting argument type declaration for '%s' of the "
-                      "form 'arg = arg|0' or 'arg = +arg'", argName);
+                      "form 'arg = arg|0' or 'arg = +arg' or 'arg = fround(arg)'", argName);
 }
 
 static bool
@@ -3170,6 +3302,18 @@ CheckVariable(FunctionCompiler &f, ParseNode *var)
     if (!initNode)
         return f.failName(var, "var '%s' needs explicit type declaration via an initial value", name);
 
+    if (initNode->isKind(PNK_CALL)) {
+        ParseNode *coercedVar = NULL;
+        if (!CheckFloat32Coercion(f.m(), initNode, &coercedVar, "caller in var initializer can only be fround"))
+            return false;
+
+        double value;
+        if (!ExtractFRoundableLiteral(coercedVar, &value))
+            return f.failName(coercedVar, "float initializer for '%s' needs to be a double literal", name);
+
+        return f.addVariable(var, name, VarType::Float, DoubleValue(value));
+    }
+
     if (!IsNumericLiteral(initNode))
         return f.failName(initNode, "initializer for '%s' needs to be a numeric literal", name);
 
@@ -3416,7 +3560,7 @@ CheckArrayAccess(FunctionCompiler &f, ParseNode *elem, ArrayBufferView::ViewType
 }
 
 static bool
-CheckArrayLoad(FunctionCompiler &f, ParseNode *elem, MDefinition **def, Type *type)
+CheckLoadArray(FunctionCompiler &f, ParseNode *elem, MDefinition **def, Type *type)
 {
     ArrayBufferView::ViewType viewType;
     MDefinition *pointerDef;
@@ -3443,15 +3587,30 @@ CheckStoreArray(FunctionCompiler &f, ParseNode *lhs, ParseNode *rhs, MDefinition
     if (!CheckExpr(f, rhs, &rhsDef, &rhsType))
         return false;
 
-    switch (TypedArrayStoreType(viewType)) {
-      case ArrayStore_Intish:
+    switch (viewType) {
+      case ArrayBufferView::TYPE_INT8:
+      case ArrayBufferView::TYPE_INT16:
+      case ArrayBufferView::TYPE_INT32:
+      case ArrayBufferView::TYPE_UINT8:
+      case ArrayBufferView::TYPE_UINT16:
+      case ArrayBufferView::TYPE_UINT32:
         if (!rhsType.isIntish())
             return f.failf(lhs, "%s is not a subtype of intish", rhsType.toChars());
         break;
-      case ArrayStore_Doublish:
-        if (!rhsType.isDoublish())
-            return f.failf(lhs, "%s is not a subtype of doublish", rhsType.toChars());
+      case ArrayBufferView::TYPE_FLOAT32:
+        if (rhsType.isMaybeDouble())
+            rhsDef = f.unary<MToFloat32>(rhsDef);
+        else if (!rhsType.isFloatish())
+            return f.failf(lhs, "%s is not a subtype of double? or floatish", rhsType.toChars());
         break;
+      case ArrayBufferView::TYPE_FLOAT64:
+        if (rhsType.isFloat())
+            rhsDef = f.unary<MToDouble>(rhsDef);
+        else if (!rhsType.isMaybeDouble())
+            return f.failf(lhs, "%s is not a subtype of float or double?", rhsType.toChars());
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected view type");
     }
 
     f.storeHeap(viewType, pointerDef, rhsDef, needsBoundsCheck);
@@ -3564,7 +3723,7 @@ CheckMathAbs(FunctionCompiler &f, ParseNode *call, RetType retType, MDefinition
         return true;
     }
 
-    if (argType.isDoublish()) {
+    if (argType.isMaybeDouble()) {
         if (retType != RetType::Double)
             return f.failf(call, "return type is double, used as %s", retType.toType().toChars());
         *def = f.unary<MAbs>(argDef, MIRType_Double);
@@ -3572,7 +3731,15 @@ CheckMathAbs(FunctionCompiler &f, ParseNode *call, RetType retType, MDefinition
         return true;
     }
 
-    return f.failf(call, "%s is not a subtype of signed or doublish", argType.toChars());
+    if (argType.isMaybeFloat()) {
+        if (retType != RetType::Float)
+            return f.failf(call, "return type is float, used as %s", retType.toType().toChars());
+        *def = f.unary<MAbs>(argDef, MIRType_Float32);
+        *type = Type::Float;
+        return true;
+    }
+
+    return f.failf(call, "%s is not a subtype of signed, float? or double?", argType.toChars());
 }
 
 static bool
@@ -3588,7 +3755,7 @@ CheckMathSqrt(FunctionCompiler &f, ParseNode *call, RetType retType, MDefinition
     if (!CheckExpr(f, arg, &argDef, &argType))
         return false;
 
-    if (argType.isDoublish()) {
+    if (argType.isMaybeDouble()) {
         if (retType != RetType::Double)
             return f.failf(call, "return type is double, used as %s", retType.toType().toChars());
         *def = f.unary<MSqrt>(argDef, MIRType_Double);
@@ -3596,7 +3763,15 @@ CheckMathSqrt(FunctionCompiler &f, ParseNode *call, RetType retType, MDefinition
         return true;
     }
 
-    return f.failf(call, "%s is not a subtype of doublish", argType.toChars());
+    if (argType.isMaybeFloat()) {
+        if (retType != RetType::Float)
+            return f.failf(call, "return type is float, used as %s", retType.toType().toChars());
+        *def = f.unary<MSqrt>(argDef, MIRType_Float32);
+        *type = Type::Float;
+        return true;
+    }
+
+    return f.failf(call, "%s is neither a subtype of double? nor float?", argType.toChars());
 }
 
 typedef bool (*CheckArgType)(FunctionCompiler &f, ParseNode *argNode, Type type);
@@ -3672,7 +3847,7 @@ static bool
 CheckIsVarType(FunctionCompiler &f, ParseNode *argNode, Type type)
 {
     if (!type.isVarType())
-        return f.failf(argNode, "%s is not a subtype of int or double", type.toChars());
+        return f.failf(argNode, "%s is not a subtype of int, float or double", type.toChars());
     return true;
 }
 
@@ -3786,6 +3961,9 @@ CheckFFICall(FunctionCompiler &f, ParseNode *callNode, unsigned ffiIndex, RetTyp
 {
     PropertyName *calleeName = CallCallee(callNode)->name();
 
+    if (retType == RetType::Float)
+        return f.fail(callNode, "FFI calls can't return float");
+
     FunctionCompiler::Call call(f, retType);
     if (!CheckCallArgs(f, callNode, CheckIsExternType, &call))
         return false;
@@ -3801,11 +3979,88 @@ CheckFFICall(FunctionCompiler &f, ParseNode *callNode, unsigned ffiIndex, RetTyp
     return true;
 }
 
+static bool CheckCall(FunctionCompiler &f, ParseNode *call, RetType retType, MDefinition **def, Type *type);
+
 static bool
-CheckIsDoublish(FunctionCompiler &f, ParseNode *argNode, Type type)
+CheckFRoundArg(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *type, const char* error)
 {
-    if (!type.isDoublish())
-        return f.failf(argNode, "%s is not a subtype of doublish", type.toChars());
+    ParseNode *arg = NULL;
+    if (!CheckFloat32Coercion(f.m(), expr, &arg, error))
+        return false;
+
+    if (arg->isKind(PNK_CALL))
+        return CheckCall(f, arg, RetType::Float, def, type);
+
+    if (IsNumericLiteral(arg)) {
+        double value;
+        if (!ExtractFRoundableLiteral(arg, &value))
+            return f.fail(arg, "call to fround with literal expects the literal to be a double");
+
+        *def = f.constantFloat(value);
+        *type = Type::Float;
+        return true;
+    }
+
+    MDefinition *inputDef;
+    Type inputType;
+    if (!CheckExpr(f, arg, &inputDef, &inputType))
+        return false;
+
+    if (inputType.isMaybeDouble() || inputType.isSigned())
+        *def = f.unary<MToFloat32>(inputDef);
+    else if (inputType.isUnsigned())
+        *def = f.unary<MAsmJSUnsignedToFloat32>(inputDef);
+    else if (inputType.isFloatish())
+        *def = inputDef;
+    else
+        return f.failf(arg, "%s is not a subtype of signed, unsigned, double? or floatish", inputType.toChars());
+
+    *type = Type::Float;
+    return true;
+}
+
+static bool
+CheckFRound(FunctionCompiler &f, ParseNode *callNode, RetType retType, MDefinition **def, Type *type)
+{
+    MDefinition *operand;
+    Type operandType;
+    if (!CheckFRoundArg(f, callNode, &operand, &operandType, "coercion to float should use fround"))
+        return false;
+
+    switch (retType.which()) {
+      case RetType::Double:
+        *def = f.unary<MToDouble>(operand);
+        *type = Type::Double;
+        return true;
+      case RetType::Signed:
+        *def = f.unary<MTruncateToInt32>(operand);
+        *type = Type::Signed;
+        return true;
+      case RetType::Float:
+        *def = operand;
+        *type = Type::Float;
+        return true;
+      case RetType::Void:
+        // definition and return types should be ignored by the caller
+        return true;
+    }
+
+    MOZ_ASSUME_UNREACHABLE("return value of fround is ignored");
+}
+
+static bool
+CheckIsMaybeDouble(FunctionCompiler &f, ParseNode *argNode, Type type)
+{
+    if (!type.isMaybeDouble())
+        return f.failf(argNode, "%s is not a subtype of double?", type.toChars());
+    return true;
+}
+
+static bool
+CheckIsMaybeFloat(FunctionCompiler &f, ParseNode *argNode, Type type)
+{
+    if (!type.isMaybeFloat())
+        return f.failf(argNode, "%s is not a subtype of float?", type.toChars());
     return true;
 }
 
@@ -3814,39 +4069,46 @@ CheckMathBuiltinCall(FunctionCompiler &f, ParseNode *callNode, AsmJSMathBuiltin
                      RetType retType, MDefinition **def, Type *type)
 {
     unsigned arity = 0;
-    AsmJSImmKind callee;
+    AsmJSImmKind doubleCallee, floatCallee;
     switch (mathBuiltin) {
-      case AsmJSMathBuiltin_imul:  return CheckMathIMul(f, callNode, retType, def, type);
-      case AsmJSMathBuiltin_abs:   return CheckMathAbs(f, callNode, retType, def, type);
-      case AsmJSMathBuiltin_sqrt:  return CheckMathSqrt(f, callNode, retType, def, type);
-      case AsmJSMathBuiltin_sin:   arity = 1; callee = AsmJSImm_SinD;   break;
-      case AsmJSMathBuiltin_cos:   arity = 1; callee = AsmJSImm_CosD;   break;
-      case AsmJSMathBuiltin_tan:   arity = 1; callee = AsmJSImm_TanD;   break;
-      case AsmJSMathBuiltin_asin:  arity = 1; callee = AsmJSImm_ASinD;  break;
-      case AsmJSMathBuiltin_acos:  arity = 1; callee = AsmJSImm_ACosD;  break;
-      case AsmJSMathBuiltin_atan:  arity = 1; callee = AsmJSImm_ATanD;  break;
-      case AsmJSMathBuiltin_ceil:  arity = 1; callee = AsmJSImm_CeilD;  break;
-      case AsmJSMathBuiltin_floor: arity = 1; callee = AsmJSImm_FloorD; break;
-      case AsmJSMathBuiltin_exp:   arity = 1; callee = AsmJSImm_ExpD;   break;
-      case AsmJSMathBuiltin_log:   arity = 1; callee = AsmJSImm_LogD;   break;
-      case AsmJSMathBuiltin_pow:   arity = 2; callee = AsmJSImm_PowD;   break;
-      case AsmJSMathBuiltin_atan2: arity = 2; callee = AsmJSImm_ATan2D; break;
+      case AsmJSMathBuiltin_imul:   return CheckMathIMul(f, callNode, retType, def, type);
+      case AsmJSMathBuiltin_abs:    return CheckMathAbs(f, callNode, retType, def, type);
+      case AsmJSMathBuiltin_sqrt:   return CheckMathSqrt(f, callNode, retType, def, type);
+      case AsmJSMathBuiltin_fround: return CheckFRound(f, callNode, retType, def, type);
+      case AsmJSMathBuiltin_sin:    arity = 1; doubleCallee = AsmJSImm_SinD; floatCallee = AsmJSImm_SinF;      break;
+      case AsmJSMathBuiltin_cos:    arity = 1; doubleCallee = AsmJSImm_CosD; floatCallee = AsmJSImm_CosF;      break;
+      case AsmJSMathBuiltin_tan:    arity = 1; doubleCallee = AsmJSImm_TanD; floatCallee = AsmJSImm_TanF;      break;
+      case AsmJSMathBuiltin_asin:   arity = 1; doubleCallee = AsmJSImm_ASinD; floatCallee = AsmJSImm_ASinF;    break;
+      case AsmJSMathBuiltin_acos:   arity = 1; doubleCallee = AsmJSImm_ACosD; floatCallee = AsmJSImm_ACosF;    break;
+      case AsmJSMathBuiltin_atan:   arity = 1; doubleCallee = AsmJSImm_ATanD; floatCallee = AsmJSImm_ATanF;    break;
+      case AsmJSMathBuiltin_ceil:   arity = 1; doubleCallee = AsmJSImm_CeilD; floatCallee = AsmJSImm_CeilF;    break;
+      case AsmJSMathBuiltin_floor:  arity = 1; doubleCallee = AsmJSImm_FloorD; floatCallee = AsmJSImm_FloorF;  break;
+      case AsmJSMathBuiltin_exp:    arity = 1; doubleCallee = AsmJSImm_ExpD; floatCallee = AsmJSImm_ExpF;      break;
+      case AsmJSMathBuiltin_log:    arity = 1; doubleCallee = AsmJSImm_LogD; floatCallee = AsmJSImm_LogF;      break;
+      case AsmJSMathBuiltin_pow:    arity = 2; doubleCallee = AsmJSImm_PowD; floatCallee = AsmJSImm_Invalid;   break;
+      case AsmJSMathBuiltin_atan2:  arity = 2; doubleCallee = AsmJSImm_ATan2D; floatCallee = AsmJSImm_Invalid; break;
     }
 
+    if (retType == RetType::Float && floatCallee == AsmJSImm_Invalid)
+        return f.fail(callNode, "math builtin cannot be used as float");
+    if (retType != RetType::Double && retType != RetType::Float)
+        return f.failf(callNode, "return type of math function is double or float, used as %s", retType.toType().toChars());
+
     FunctionCompiler::Call call(f, retType);
-    if (!CheckCallArgs(f, callNode, CheckIsDoublish, &call))
+    if (retType == RetType::Float && !CheckCallArgs(f, callNode, CheckIsMaybeFloat, &call))
+        return false;
+    if (retType == RetType::Double && !CheckCallArgs(f, callNode, CheckIsMaybeDouble, &call))
         return false;
 
     if (call.sig().args().length() != arity)
         return f.failf(callNode, "call passed %u arguments, expected %u", call.sig().args().length(), arity);
 
-    if (!f.builtinCall(callee, call, MIRType_Double, def))
+    if (retType == RetType::Float && !f.builtinCall(floatCallee, call, retType.toMIRType(), def))
+        return false;
+    if (retType == RetType::Double && !f.builtinCall(doubleCallee, call, retType.toMIRType(), def))
         return false;
 
-    if (retType != RetType::Double)
-        return f.failf(callNode, "return type is double, used as %s", retType.toType().toChars());
-
-    *type = Type::Double;
+    *type = retType.toType();
     return true;
 }
 
@@ -3898,14 +4160,14 @@ CheckPos(FunctionCompiler &f, ParseNode *pos, MDefinition **def, Type *type)
     if (!CheckExpr(f, operand, &operandDef, &operandType))
         return false;
 
-    if (operandType.isSigned())
+    if (operandType.isMaybeFloat() || operandType.isSigned())
         *def = f.unary<MToDouble>(operandDef);
     else if (operandType.isUnsigned())
         *def = f.unary<MAsmJSUnsignedToDouble>(operandDef);
-    else if (operandType.isDoublish())
+    else if (operandType.isMaybeDouble())
         *def = operandDef;
     else
-        return f.failf(operand, "%s is not a subtype of signed, unsigned or doublish", operandType.toChars());
+        return f.failf(operand, "%s is not a subtype of signed, unsigned, float or double?", operandType.toChars());
 
     *type = Type::Double;
     return true;
@@ -3947,13 +4209,19 @@ CheckNeg(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *type)
         return true;
     }
 
-    if (operandType.isDoublish()) {
+    if (operandType.isMaybeDouble()) {
         *def = f.unary<MAsmJSNeg>(operandDef, MIRType_Double);
         *type = Type::Double;
         return true;
     }
 
-    return f.failf(operand, "%s is not a subtype of int or doublish", operandType.toChars());
+    if (operandType.isMaybeFloat()) {
+        *def = f.unary<MAsmJSNeg>(operandDef, MIRType_Float32);
+        *type = Type::Floatish;
+        return true;
+    }
+
+    return f.failf(operand, "%s is not a subtype of int, float? or double?", operandType.toChars());
 }
 
 static bool
@@ -3967,14 +4235,14 @@ CheckCoerceToInt(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *
     if (!CheckExpr(f, operand, &operandDef, &operandType))
         return false;
 
-    if (operandType.isDoublish()) {
+    if (operandType.isMaybeDouble() || operandType.isMaybeFloat()) {
         *def = f.unary<MTruncateToInt32>(operandDef);
         *type = Type::Signed;
         return true;
     }
 
     if (!operandType.isIntish())
-        return f.failf(operand, "%s is not a subtype of doublish or intish", operandType.toChars());
+        return f.failf(operand, "%s is not a subtype of double?, float? or intish", operandType.toChars());
 
     *def = operandDef;
     *type = Type::Signed;
@@ -4071,6 +4339,8 @@ CheckConditional(FunctionCompiler &f, ParseNode *ternary, MDefinition **def, Typ
         *type = Type::Int;
     } else if (thenType.isDouble() && elseType.isDouble()) {
         *type = Type::Double;
+    } else if (thenType.isFloat() && elseType.isFloat()) {
+        *type = Type::Float;
     } else {
         return f.failf(ternary, "then/else branches of conditional must both produce int or double, "
                        "current types are %s and %s", thenType.toChars(), elseType.toChars());
@@ -4130,14 +4400,19 @@ CheckMultiply(FunctionCompiler &f, ParseNode *star, MDefinition **def, Type *typ
         return true;
     }
 
-    if (!lhsType.isDoublish())
-        return f.failf(lhs, "%s is not a subtype of doublish", lhsType.toChars());
-    if (!rhsType.isDoublish())
-        return f.failf(rhs, "%s is not a subtype of doublish", rhsType.toChars());
+    if (lhsType.isMaybeDouble() && rhsType.isMaybeDouble()) {
+        *def = f.mul(lhsDef, rhsDef, MIRType_Double, MMul::Normal);
+        *type = Type::Double;
+        return true;
+    }
 
-    *def = f.mul(lhsDef, rhsDef, MIRType_Double, MMul::Normal);
-    *type = Type::Double;
-    return true;
+    if (lhsType.isMaybeFloat() && rhsType.isMaybeFloat()) {
+        *def = f.mul(lhsDef, rhsDef, MIRType_Float32, MMul::Normal);
+        *type = Type::Floatish;
+        return true;
+    }
+
+    return f.fail(star, "multiply operands must be both int, both double? or both float?");
 }
 
 static bool
@@ -4185,13 +4460,18 @@ CheckAddOrSub(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *typ
                ? f.binary<MAdd>(lhsDef, rhsDef, MIRType_Int32)
                : f.binary<MSub>(lhsDef, rhsDef, MIRType_Int32);
         *type = Type::Intish;
-    } else if (lhsType.isDoublish() && rhsType.isDoublish()) {
+    } else if (lhsType.isMaybeDouble() && rhsType.isMaybeDouble()) {
         *def = expr->isKind(PNK_ADD)
                ? f.binary<MAdd>(lhsDef, rhsDef, MIRType_Double)
                : f.binary<MSub>(lhsDef, rhsDef, MIRType_Double);
         *type = Type::Double;
+    } else if (lhsType.isMaybeFloat() && rhsType.isMaybeFloat()) {
+        *def = expr->isKind(PNK_ADD)
+               ? f.binary<MAdd>(lhsDef, rhsDef, MIRType_Float32)
+               : f.binary<MSub>(lhsDef, rhsDef, MIRType_Float32);
+        *type = Type::Floatish;
     } else {
-        return f.failf(expr, "operands to +/- must both be int or doublish, got %s and %s",
+        return f.failf(expr, "operands to + or - must both be int, float? or double?, got %s and %s",
                        lhsType.toChars(), rhsType.toChars());
     }
 
@@ -4214,7 +4494,7 @@ CheckDivOrMod(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *typ
     if (!CheckExpr(f, rhs, &rhsDef, &rhsType))
         return false;
 
-    if (lhsType.isDoublish() && rhsType.isDoublish()) {
+    if (lhsType.isMaybeDouble() && rhsType.isMaybeDouble()) {
         *def = expr->isKind(PNK_DIV)
                ? f.div(lhsDef, rhsDef, MIRType_Double, /* unsignd = */ false)
                : f.mod(lhsDef, rhsDef, MIRType_Double, /* unsignd = */ false);
@@ -4222,6 +4502,15 @@ CheckDivOrMod(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *typ
         return true;
     }
 
+    if (lhsType.isMaybeFloat() && rhsType.isMaybeFloat()) {
+        if (expr->isKind(PNK_DIV))
+            *def = f.div(lhsDef, rhsDef, MIRType_Float32, /* unsignd = */ false);
+        else
+            return f.fail(expr, "modulo cannot receive float arguments");
+        *type = Type::Floatish;
+        return true;
+    }
+
     if (lhsType.isSigned() && rhsType.isSigned()) {
         if (expr->isKind(PNK_DIV))
             *def = f.div(lhsDef, rhsDef, MIRType_Int32, /* unsignd = */ false);
@@ -4240,7 +4529,7 @@ CheckDivOrMod(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *typ
         return true;
     }
 
-    return f.failf(expr, "arguments to / or %% must both be double, signed, or unsigned; "
+    return f.failf(expr, "arguments to / or %% must both be double?, float?, signed, or unsigned; "
                    "%s and %s are given", lhsType.toChars(), rhsType.toChars());
 }
 
@@ -4274,7 +4563,13 @@ CheckComparison(FunctionCompiler &f, ParseNode *comp, MDefinition **def, Type *t
         return true;
     }
 
-    return f.failf(comp, "arguments to a comparison must both be signed, unsigned or doubles; "
+    if (lhsType.isFloat() && rhsType.isFloat()) {
+        *def = f.compare(lhsDef, rhsDef, comp->getOp(), MCompare::Compare_Float32);
+        *type = Type::Int;
+        return true;
+    }
+
+    return f.failf(comp, "arguments to a comparison must both be signed, unsigned, floats or doubles; "
                    "%s and %s are given", lhsType.toChars(), rhsType.toChars());
 }
 
@@ -4345,6 +4640,18 @@ CheckBitwise(FunctionCompiler &f, ParseNode *bitwise, MDefinition **def, Type *t
     return true;
 }
 
+static bool
+CheckUncoercedCall(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *type)
+{
+    static const char* callError = "all function calls must either be ignored (via "
+                                   "f(); or comma-expression), coerced to signed "
+                                   "(via f()|0), coerced to float (via fround(f()))"
+                                   " or coerced to double (via +f())";
+
+    JS_ASSERT(expr->isKind(PNK_CALL));
+    return CheckFRoundArg(f, expr, def, type, callError);
+}
+
 static bool
 CheckExpr(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *type)
 {
@@ -4358,7 +4665,7 @@ CheckExpr(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *type)
 
     switch (expr->getKind()) {
       case PNK_NAME:        return CheckVarRef(f, expr, def, type);
-      case PNK_ELEM:        return CheckArrayLoad(f, expr, def, type);
+      case PNK_ELEM:        return CheckLoadArray(f, expr, def, type);
       case PNK_ASSIGN:      return CheckAssign(f, expr, def, type);
       case PNK_POS:         return CheckPos(f, expr, def, type);
       case PNK_NOT:         return CheckNot(f, expr, def, type);
@@ -4367,10 +4674,7 @@ CheckExpr(FunctionCompiler &f, ParseNode *expr, MDefinition **def, Type *type)
       case PNK_COMMA:       return CheckComma(f, expr, def, type);
       case PNK_CONDITIONAL: return CheckConditional(f, expr, def, type);
       case PNK_STAR:        return CheckMultiply(f, expr, def, type);
-
-      case PNK_CALL:        return f.fail(expr, "all function calls must either be ignored (via "
-                                                "f(); or comma-expression), coerced to signed "
-                                                "(via f()|0) or coerced to double (via +f())");
+      case PNK_CALL:        return CheckUncoercedCall(f, expr, def, type);
 
       case PNK_ADD:
       case PNK_SUB:         return CheckAddOrSub(f, expr, def, type);
@@ -4792,6 +5096,8 @@ CheckReturn(FunctionCompiler &f, ParseNode *returnStmt)
         retType = RetType::Signed;
     else if (type.isDouble())
         retType = RetType::Double;
+    else if (type.isFloat())
+        retType = RetType::Float;
     else if (type.isVoid())
         retType = RetType::Void;
     else
@@ -5605,7 +5911,7 @@ GenerateEntry(ModuleCompiler &m, const AsmJSModule::ExportedFunction &exportedFu
                 masm.load32(src, scratch);
                 masm.storePtr(scratch, Address(StackPointer, iter->offsetFromArgBase()));
             } else {
-                JS_ASSERT(iter.mirType() == MIRType_Double);
+                JS_ASSERT(iter.mirType() == MIRType_Double || iter.mirType() == MIRType_Float32);
                 masm.loadDouble(src, ScratchFloatReg);
                 masm.storeDouble(ScratchFloatReg, Address(StackPointer, iter->offsetFromArgBase()));
             }
@@ -5629,6 +5935,9 @@ GenerateEntry(ModuleCompiler &m, const AsmJSModule::ExportedFunction &exportedFu
       case RetType::Signed:
         masm.storeValue(JSVAL_TYPE_INT32, ReturnReg, Address(argv, 0));
         break;
+      case RetType::Float:
+        masm.convertFloatToDouble(ReturnFloatReg, ReturnFloatReg);
+        // Fall through as ReturnFloatReg now contains a Double
       case RetType::Double:
         masm.canonicalizeDouble(ReturnFloatReg);
         masm.storeDouble(ReturnFloatReg, Address(argv, 0));
@@ -5873,6 +6182,9 @@ GenerateFFIInterpreterExit(ModuleCompiler &m, const ModuleCompiler::ExitDescript
         masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
         masm.loadDouble(argv, ReturnFloatReg);
         break;
+      case RetType::Float:
+        MOZ_ASSUME_UNREACHABLE("Float32 shouldn't be returned from a FFI");
+        break;
     }
 
     // Note: the caller is IonMonkey code which means there are no non-volatile
@@ -5924,6 +6236,9 @@ GenerateFFIInterpreterExit(ModuleCompiler &m, const ModuleCompiler::ExitDescript
         masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
         masm.loadDouble(argv, ReturnFloatReg);
         break;
+      case RetType::Float:
+        MOZ_ASSUME_UNREACHABLE("Float32 shouldn't be returned from a FFI");
+        break;
     }
 
     masm.freeStack(reserveSize + sizeof(int32_t));
@@ -6128,6 +6443,9 @@ GenerateFFIIonExit(ModuleCompiler &m, const ModuleCompiler::ExitDescriptor &exit
       case RetType::Double:
         masm.convertValueToDouble(JSReturnOperand, ReturnFloatReg, &oolConvert);
         break;
+      case RetType::Float:
+        MOZ_ASSUME_UNREACHABLE("Float shouldn't be returned from a FFI");
+        break;
     }
 
     masm.bind(&done);
diff --git a/js/src/jit/AsmJSLink.cpp b/js/src/jit/AsmJSLink.cpp
index 9a3755e75231..eed158104541 100644
--- a/js/src/jit/AsmJSLink.cpp
+++ b/js/src/jit/AsmJSLink.cpp
@@ -70,10 +70,17 @@ ValidateGlobalVariable(JSContext *cx, const AsmJSModule &module, AsmJSModule::Gl
     switch (global.varInitKind()) {
       case AsmJSModule::Global::InitConstant: {
         const Value &v = global.varInitConstant();
-        if (v.isInt32())
+        switch (global.varInitCoercion()) {
+          case AsmJS_ToInt32:
             *(int32_t *)datum = v.toInt32();
-        else
+            break;
+          case AsmJS_ToNumber:
             *(double *)datum = v.toDouble();
+            break;
+          case AsmJS_FRound:
+            *(float *)datum = static_cast<float>(v.toDouble());
+            break;
+        }
         break;
       }
       case AsmJSModule::Global::InitImport: {
@@ -82,7 +89,7 @@ ValidateGlobalVariable(JSContext *cx, const AsmJSModule &module, AsmJSModule::Gl
         if (!GetDataProperty(cx, importVal, field, &v))
             return false;
 
-        switch (global.varImportCoercion()) {
+        switch (global.varInitCoercion()) {
           case AsmJS_ToInt32:
             if (!ToInt32(cx, v, (int32_t *)datum))
                 return false;
@@ -91,6 +98,10 @@ ValidateGlobalVariable(JSContext *cx, const AsmJSModule &module, AsmJSModule::Gl
             if (!ToNumber(cx, v, (double *)datum))
                 return false;
             break;
+          case AsmJS_FRound:
+            if (!RoundFloat32(cx, v, (float *)datum))
+                return false;
+            break;
         }
         break;
       }
@@ -157,6 +168,7 @@ ValidateMathBuiltin(JSContext *cx, AsmJSModule::Global &global, HandleValue glob
       case AsmJSMathBuiltin_abs: native = js_math_abs; break;
       case AsmJSMathBuiltin_atan2: native = math_atan2; break;
       case AsmJSMathBuiltin_imul: native = math_imul; break;
+      case AsmJSMathBuiltin_fround: native = math_fround; break;
     }
 
     if (!IsNativeFunction(v, native))
@@ -364,6 +376,10 @@ CallAsmJS(JSContext *cx, unsigned argc, Value *vp)
             if (!ToNumber(cx, v, (double*)&coercedArgs[i]))
                 return false;
             break;
+          case AsmJS_FRound:
+            if (!RoundFloat32(cx, v, (float *)&coercedArgs[i]))
+                return false;
+            break;
         }
     }
 
diff --git a/js/src/jit/AsmJSModule.cpp b/js/src/jit/AsmJSModule.cpp
index 83a9b2f63635..33fb1751ad23 100644
--- a/js/src/jit/AsmJSModule.cpp
+++ b/js/src/jit/AsmJSModule.cpp
@@ -235,28 +235,50 @@ AddressOf(AsmJSImmKind kind, ExclusiveContext *cx)
         return FuncCast(NumberMod);
       case AsmJSImm_SinD:
         return FuncCast<double (double)>(sin);
+      case AsmJSImm_SinF:
+        return FuncCast<float (float)>(sinf);
       case AsmJSImm_CosD:
         return FuncCast<double (double)>(cos);
+      case AsmJSImm_CosF:
+        return FuncCast<float (float)>(cosf);
       case AsmJSImm_TanD:
         return FuncCast<double (double)>(tan);
+      case AsmJSImm_TanF:
+        return FuncCast<float (float)>(tanf);
       case AsmJSImm_ASinD:
         return FuncCast<double (double)>(asin);
+      case AsmJSImm_ASinF:
+        return FuncCast<float (float)>(asinf);
       case AsmJSImm_ACosD:
         return FuncCast<double (double)>(acos);
+      case AsmJSImm_ACosF:
+        return FuncCast<float (float)>(acosf);
       case AsmJSImm_ATanD:
         return FuncCast<double (double)>(atan);
+      case AsmJSImm_ATanF:
+        return FuncCast<float (float)>(atanf);
       case AsmJSImm_CeilD:
         return FuncCast<double (double)>(ceil);
+      case AsmJSImm_CeilF:
+        return FuncCast<float (float)>(ceilf);
       case AsmJSImm_FloorD:
         return FuncCast<double (double)>(floor);
+      case AsmJSImm_FloorF:
+        return FuncCast<float (float)>(floorf);
       case AsmJSImm_ExpD:
         return FuncCast<double (double)>(exp);
+      case AsmJSImm_ExpF:
+        return FuncCast<float (float)>(expf);
       case AsmJSImm_LogD:
         return FuncCast<double (double)>(log);
+      case AsmJSImm_LogF:
+        return FuncCast<float (float)>(logf);
       case AsmJSImm_PowD:
         return FuncCast(ecmaPow);
       case AsmJSImm_ATan2D:
         return FuncCast(ecmaAtan2);
+      case AsmJSImm_Invalid:
+        break;
     }
 
     MOZ_ASSUME_UNREACHABLE("Bad AsmJSImmKind");
diff --git a/js/src/jit/AsmJSModule.h b/js/src/jit/AsmJSModule.h
index 91d2b815d6bb..ea1e6e99bbad 100644
--- a/js/src/jit/AsmJSModule.h
+++ b/js/src/jit/AsmJSModule.h
@@ -29,7 +29,8 @@ namespace js {
 enum AsmJSCoercion
 {
     AsmJS_ToInt32,
-    AsmJS_ToNumber
+    AsmJS_ToNumber,
+    AsmJS_FRound
 };
 
 // The asm.js spec recognizes this set of builtin Math functions.
@@ -39,7 +40,8 @@ enum AsmJSMathBuiltin
     AsmJSMathBuiltin_asin, AsmJSMathBuiltin_acos, AsmJSMathBuiltin_atan,
     AsmJSMathBuiltin_ceil, AsmJSMathBuiltin_floor, AsmJSMathBuiltin_exp,
     AsmJSMathBuiltin_log, AsmJSMathBuiltin_pow, AsmJSMathBuiltin_sqrt,
-    AsmJSMathBuiltin_abs, AsmJSMathBuiltin_atan2, AsmJSMathBuiltin_imul
+    AsmJSMathBuiltin_abs, AsmJSMathBuiltin_atan2, AsmJSMathBuiltin_imul,
+    AsmJSMathBuiltin_fround
 };
 
 // Static-link data is used to patch a module either after it has been
@@ -105,9 +107,9 @@ class AsmJSModule
                 struct {
                     uint32_t index_;
                     VarInitKind initKind_;
+                    AsmJSCoercion coercion_;
                     union {
                         Value constant_; // will only contain int32/double
-                        AsmJSCoercion coercion_;
                     } init;
                 } var;
                 uint32_t ffiIndex_;
@@ -151,10 +153,9 @@ class AsmJSModule
             JS_ASSERT(pod.u.var.initKind_ == InitConstant);
             return pod.u.var.init.constant_;
         }
-        AsmJSCoercion varImportCoercion() const {
+        AsmJSCoercion varInitCoercion() const {
             JS_ASSERT(pod.which_ == Variable);
-            JS_ASSERT(pod.u.var.initKind_ == InitImport);
-            return pod.u.var.init.coercion_;
+            return pod.u.var.coercion_;
         }
         PropertyName *varImportField() const {
             JS_ASSERT(pod.which_ == Variable);
@@ -455,13 +456,14 @@ class AsmJSModule
         return charsBegin_ + pod.charsLength_;
     }
 
-    bool addGlobalVarInitConstant(const Value &v, uint32_t *globalIndex) {
+    bool addGlobalVarInitConstant(const Value &v, AsmJSCoercion coercion, uint32_t *globalIndex) {
         JS_ASSERT(pod.funcPtrTableAndExitBytes_ == 0);
         if (pod.numGlobalVars_ == UINT32_MAX)
             return false;
         Global g(Global::Variable, nullptr);
         g.pod.u.var.initKind_ = Global::InitConstant;
         g.pod.u.var.init.constant_ = v;
+        g.pod.u.var.coercion_ = coercion;
         g.pod.u.var.index_ = *globalIndex = pod.numGlobalVars_++;
         return globals_.append(g);
     }
@@ -469,7 +471,7 @@ class AsmJSModule
         JS_ASSERT(pod.funcPtrTableAndExitBytes_ == 0);
         Global g(Global::Variable, name);
         g.pod.u.var.initKind_ = Global::InitImport;
-        g.pod.u.var.init.coercion_ = coercion;
+        g.pod.u.var.coercion_ = coercion;
         g.pod.u.var.index_ = *globalIndex = pod.numGlobalVars_++;
         return globals_.append(g);
     }
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 3209d31927ff..92ceb8941332 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3300,7 +3300,7 @@ LIRGenerator::visitAsmJSParameter(MAsmJSParameter *ins)
     if (abi.argInRegister())
         return defineFixed(new(alloc()) LAsmJSParameter, ins, LAllocation(abi.reg()));
 
-    JS_ASSERT(ins->type() == MIRType_Int32 || ins->type() == MIRType_Double);
+    JS_ASSERT(IsNumberType(ins->type()));
     LAllocation::Kind argKind = ins->type() == MIRType_Int32
                                 ? LAllocation::INT_ARGUMENT
                                 : LAllocation::DOUBLE_ARGUMENT;
@@ -3312,7 +3312,7 @@ LIRGenerator::visitAsmJSReturn(MAsmJSReturn *ins)
 {
     MDefinition *rval = ins->getOperand(0);
     LAsmJSReturn *lir = new(alloc()) LAsmJSReturn;
-    if (rval->type() == MIRType_Double)
+    if (IsFloatingPointType(rval->type()))
         lir->setOperand(0, useFixed(rval, ReturnFloatReg));
     else if (rval->type() == MIRType_Int32)
         lir->setOperand(0, useFixed(rval, ReturnReg));
@@ -3330,7 +3330,7 @@ LIRGenerator::visitAsmJSVoidReturn(MAsmJSVoidReturn *ins)
 bool
 LIRGenerator::visitAsmJSPassStackArg(MAsmJSPassStackArg *ins)
 {
-    if (ins->arg()->type() == MIRType_Double) {
+    if (IsFloatingPointType(ins->arg()->type())) {
         JS_ASSERT(!ins->arg()->isEmittedAtUses());
         return add(new(alloc()) LAsmJSPassStackArg(useRegisterAtStart(ins->arg())), ins);
     }
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 1cf9adfa4365..23713460447c 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9241,7 +9241,9 @@ class MAsmJSLoadHeap : public MUnaryInstruction, public MAsmJSHeapAccess
       : MUnaryInstruction(ptr), MAsmJSHeapAccess(vt, false)
     {
         setMovable();
-        if (vt == ArrayBufferView::TYPE_FLOAT32 || vt == ArrayBufferView::TYPE_FLOAT64)
+        if (vt == ArrayBufferView::TYPE_FLOAT32)
+            setResultType(MIRType_Float32);
+        else if (vt == ArrayBufferView::TYPE_FLOAT64)
             setResultType(MIRType_Double);
         else
             setResultType(MIRType_Int32);
@@ -9291,7 +9293,7 @@ class MAsmJSLoadGlobalVar : public MNullaryInstruction
     MAsmJSLoadGlobalVar(MIRType type, unsigned globalDataOffset, bool isConstant)
       : globalDataOffset_(globalDataOffset), isConstant_(isConstant)
     {
-        JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double);
+        JS_ASSERT(IsNumberType(type));
         setResultType(type);
         setMovable();
     }
diff --git a/js/src/jit/arm/Assembler-arm.cpp b/js/src/jit/arm/Assembler-arm.cpp
index a44225a13097..a149027d1159 100644
--- a/js/src/jit/arm/Assembler-arm.cpp
+++ b/js/src/jit/arm/Assembler-arm.cpp
@@ -45,6 +45,7 @@ ABIArgGenerator::next(MIRType type)
         current_ = ABIArg(Register::FromCode(intRegIndex_));
         intRegIndex_++;
         break;
+      case MIRType_Float32:
       case MIRType_Double:
         if (floatRegIndex_ == NumFloatArgRegs) {
             static const int align = sizeof(double) - 1;
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index 305791e39562..ae1984e96efc 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -1969,12 +1969,10 @@ CodeGeneratorARM::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
         JS_ASSERT(ptrImm >= 0);
         if (isFloat) {
             VFPRegister vd(ToFloatRegister(ins->output()));
-            if (size == 32) {
+            if (size == 32)
                 masm.ma_vldr(Operand(HeapReg, ptrImm), vd.singleOverlay(), Assembler::Always);
-                masm.as_vcvt(vd, vd.singleOverlay(), false, Assembler::Always);
-            } else {
+            else
                 masm.ma_vldr(Operand(HeapReg, ptrImm), vd, Assembler::Always);
-            }
         }  else {
             masm.ma_dataTransferN(IsLoad, size, isSigned, HeapReg, Imm32(ptrImm),
                                   ToRegister(ins->output()), Offset, Assembler::Always);
@@ -1987,12 +1985,10 @@ CodeGeneratorARM::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
     if (mir->skipBoundsCheck()) {
         if (isFloat) {
             VFPRegister vd(ToFloatRegister(ins->output()));
-            if (size == 32) {
+            if (size == 32)
                 masm.ma_vldr(vd.singleOverlay(), HeapReg, ptrReg, 0, Assembler::Always);
-                masm.as_vcvt(vd, vd.singleOverlay(), false, Assembler::Always);
-            } else {
+            else
                 masm.ma_vldr(vd, HeapReg, ptrReg, 0, Assembler::Always);
-            }
         } else {
             masm.ma_dataTransferN(IsLoad, size, isSigned, HeapReg, ptrReg,
                                   ToRegister(ins->output()), Offset, Assembler::Always);
@@ -2003,12 +1999,12 @@ CodeGeneratorARM::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
     BufferOffset bo = masm.ma_BoundsCheck(ptrReg);
     if (isFloat) {
         FloatRegister dst = ToFloatRegister(ins->output());
-        masm.ma_vmov(NANReg, dst, Assembler::AboveOrEqual);
         VFPRegister vd(dst);
         if (size == 32) {
+            masm.convertDoubleToFloat(NANReg, dst, Assembler::AboveOrEqual);
             masm.ma_vldr(vd.singleOverlay(), HeapReg, ptrReg, 0, Assembler::Below);
-            masm.as_vcvt(vd, vd.singleOverlay(), false, Assembler::Below);
         } else {
+            masm.ma_vmov(NANReg, dst, Assembler::AboveOrEqual);
             masm.ma_vldr(vd, HeapReg, ptrReg, 0, Assembler::Below);
         }
     } else {
@@ -2044,12 +2040,10 @@ CodeGeneratorARM::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
         JS_ASSERT(ptrImm >= 0);
         if (isFloat) {
             VFPRegister vd(ToFloatRegister(ins->value()));
-            if (size == 32) {
-                masm.as_vcvt(VFPRegister(ScratchFloatReg).singleOverlay(), vd, false, Assembler::Always);
-                masm.ma_vstr(VFPRegister(ScratchFloatReg).singleOverlay(), Operand(HeapReg, ptrImm), Assembler::Always);
-            } else {
+            if (size == 32)
+                masm.ma_vstr(vd.singleOverlay(), Operand(HeapReg, ptrImm), Assembler::Always);
+            else
                 masm.ma_vstr(vd, Operand(HeapReg, ptrImm), Assembler::Always);
-            }
         } else {
             masm.ma_dataTransferN(IsStore, size, isSigned, HeapReg, Imm32(ptrImm),
                                   ToRegister(ins->value()), Offset, Assembler::Always);
@@ -2064,7 +2058,7 @@ CodeGeneratorARM::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
         if (isFloat) {
             VFPRegister vd(ToFloatRegister(ins->value()));
             if (size == 32)
-                masm.storeFloat(vd, HeapReg, ptrReg, Assembler::Always);
+                masm.ma_vstr(vd.singleOverlay(), HeapReg, ptrReg, 0, Assembler::Always);
             else
                 masm.ma_vstr(vd, HeapReg, ptrReg, 0, Assembler::Always);
         } else {
@@ -2078,7 +2072,7 @@ CodeGeneratorARM::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
     if (isFloat) {
         VFPRegister vd(ToFloatRegister(ins->value()));
         if (size == 32)
-            masm.storeFloat(vd, HeapReg, ptrReg, Assembler::Below);
+            masm.ma_vstr(vd.singleOverlay(), HeapReg, ptrReg, 0, Assembler::Below);
         else
             masm.ma_vstr(vd, HeapReg, ptrReg, 0, Assembler::Below);
     } else {
@@ -2229,10 +2223,14 @@ CodeGeneratorARM::visitAsmJSLoadGlobalVar(LAsmJSLoadGlobalVar *ins)
 {
     const MAsmJSLoadGlobalVar *mir = ins->mir();
     unsigned addr = mir->globalDataOffset();
-    if (mir->type() == MIRType_Int32)
+    if (mir->type() == MIRType_Int32) {
         masm.ma_dtr(IsLoad, GlobalReg, Imm32(addr), ToRegister(ins->output()));
-    else
+    } else if (mir->type() == MIRType_Float32) {
+        VFPRegister vd(ToFloatRegister(ins->output()));
+        masm.ma_vldr(Operand(GlobalReg, addr), vd.singleOverlay());
+    } else {
         masm.ma_vldr(Operand(GlobalReg, addr), ToFloatRegister(ins->output()));
+    }
     return true;
 }
 
@@ -2242,12 +2240,16 @@ CodeGeneratorARM::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
     const MAsmJSStoreGlobalVar *mir = ins->mir();
 
     MIRType type = mir->value()->type();
-    JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double);
+    JS_ASSERT(IsNumberType(type));
     unsigned addr = mir->globalDataOffset();
-    if (mir->value()->type() == MIRType_Int32)
+    if (mir->value()->type() == MIRType_Int32) {
         masm.ma_dtr(IsStore, GlobalReg, Imm32(addr), ToRegister(ins->value()));
-    else
+    } else if (mir->value()->type() == MIRType_Float32) {
+        VFPRegister vd(ToFloatRegister(ins->value()));
+        masm.ma_vstr(vd.singleOverlay(), Operand(GlobalReg, addr));
+    } else {
         masm.ma_vstr(ToFloatRegister(ins->value()), Operand(GlobalReg, addr));
+    }
     return true;
 }
 
diff --git a/js/src/jit/arm/CodeGenerator-arm.h b/js/src/jit/arm/CodeGenerator-arm.h
index e9f431010169..a916315a485b 100644
--- a/js/src/jit/arm/CodeGenerator-arm.h
+++ b/js/src/jit/arm/CodeGenerator-arm.h
@@ -176,10 +176,19 @@ class CodeGeneratorARM : public CodeGeneratorShared
     bool generateInvalidateEpilogue();
   protected:
     void postAsmJSCall(LAsmJSCall *lir) {
-#if  !defined(JS_CPU_ARM_HARDFP)
+#ifndef JS_CPU_ARM_HARDFP
         if (lir->mir()->callee().which() == MAsmJSCall::Callee::Builtin) {
-            if (lir->mir()->type() == MIRType_Double)
+            switch (lir->mir()->type()) {
+              case MIRType_Double:
                 masm.ma_vxfer(r0, r1, d0);
+                break;
+              case MIRType_Float32:
+                masm.as_vxfer(r0, InvalidReg, VFPRegister(d0).singleOverlay(),
+                              Assembler::CoreToFloat);
+                break;
+              default:
+                break;
+            }
         }
 #endif
     }
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index fd206d8736cc..8f4ca0c78d19 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -412,6 +412,9 @@ LIRGeneratorARM::visitAsmJSNeg(MAsmJSNeg *ins)
     if (ins->type() == MIRType_Int32)
         return define(new(alloc()) LNegI(useRegisterAtStart(ins->input())), ins);
 
+    if(ins->type() == MIRType_Float32)
+        return define(new(alloc()) LNegF(useRegisterAtStart(ins->input())), ins);
+
     JS_ASSERT(ins->type() == MIRType_Double);
     return define(new(alloc()) LNegD(useRegisterAtStart(ins->input())), ins);
 }
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 28af4f12de64..fe039c5ec771 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -74,9 +74,10 @@ MacroAssemblerARM::convertUInt32ToFloat32(const Register &src, const FloatRegist
     as_vcvt(VFPRegister(dest).singleOverlay(), dest.uintOverlay());
 }
 
-void MacroAssemblerARM::convertDoubleToFloat(const FloatRegister &src, const FloatRegister &dest)
+void MacroAssemblerARM::convertDoubleToFloat(const FloatRegister &src, const FloatRegister &dest,
+                                             Condition c)
 {
-    as_vcvt(VFPRegister(dest).singleOverlay(), VFPRegister(src));
+    as_vcvt(VFPRegister(dest).singleOverlay(), VFPRegister(src), false, c);
 }
 
 // there are two options for implementing emitTruncateDouble.
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index d6db34bccc3d..9fb423cb43b1 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -50,7 +50,8 @@ class MacroAssemblerARM : public Assembler
     void convertInt32ToDouble(const Address &src, FloatRegister dest);
     void convertUInt32ToFloat32(const Register &src, const FloatRegister &dest);
     void convertUInt32ToDouble(const Register &src, const FloatRegister &dest);
-    void convertDoubleToFloat(const FloatRegister &src, const FloatRegister &dest);
+    void convertDoubleToFloat(const FloatRegister &src, const FloatRegister &dest,
+                              Condition c = Always);
     void branchTruncateDouble(const FloatRegister &src, const Register &dest, Label *fail);
     void convertDoubleToInt32(const FloatRegister &src, const Register &dest, Label *fail,
                               bool negativeZeroCheck = true);
@@ -1494,11 +1495,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         return as_cmp(bounded, Imm8(0));
     }
 
-    void storeFloat(VFPRegister src, Register base, Register index, Condition cond) {
-        as_vcvt(VFPRegister(ScratchFloatReg).singleOverlay(), src, false, cond);
-        ma_vstr(VFPRegister(ScratchFloatReg).singleOverlay(), base, index, 0, cond);
-
-    }
     void moveFloat(FloatRegister src, FloatRegister dest) {
         as_vmov(VFPRegister(src).singleOverlay(), VFPRegister(dest).singleOverlay());
     }
diff --git a/js/src/jit/shared/Assembler-shared.h b/js/src/jit/shared/Assembler-shared.h
index b358b6d2667a..62123dee1cd0 100644
--- a/js/src/jit/shared/Assembler-shared.h
+++ b/js/src/jit/shared/Assembler-shared.h
@@ -691,17 +691,28 @@ enum AsmJSImmKind
 #endif
     AsmJSImm_ModD,
     AsmJSImm_SinD,
+    AsmJSImm_SinF,
     AsmJSImm_CosD,
+    AsmJSImm_CosF,
     AsmJSImm_TanD,
+    AsmJSImm_TanF,
     AsmJSImm_ASinD,
+    AsmJSImm_ASinF,
     AsmJSImm_ACosD,
+    AsmJSImm_ACosF,
     AsmJSImm_ATanD,
+    AsmJSImm_ATanF,
     AsmJSImm_CeilD,
+    AsmJSImm_CeilF,
     AsmJSImm_FloorD,
+    AsmJSImm_FloorF,
     AsmJSImm_ExpD,
+    AsmJSImm_ExpF,
     AsmJSImm_LogD,
+    AsmJSImm_LogF,
     AsmJSImm_PowD,
-    AsmJSImm_ATan2D
+    AsmJSImm_ATan2D,
+    AsmJSImm_Invalid
 };
 
 // Pointer to be embedded as an immediate in asm.js code.
diff --git a/js/src/jit/shared/Lowering-x86-shared.cpp b/js/src/jit/shared/Lowering-x86-shared.cpp
index 4f30e4045cb9..8895dba562bc 100644
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -227,6 +227,9 @@ LIRGeneratorX86Shared::visitAsmJSNeg(MAsmJSNeg *ins)
     if (ins->type() == MIRType_Int32)
         return defineReuseInput(new(alloc()) LNegI(useRegisterAtStart(ins->input())), ins, 0);
 
+    if (ins->type() == MIRType_Float32)
+        return defineReuseInput(new(alloc()) LNegF(useRegisterAtStart(ins->input())), ins, 0);
+
     JS_ASSERT(ins->type() == MIRType_Double);
     return defineReuseInput(new(alloc()) LNegD(useRegisterAtStart(ins->input())), ins, 0);
 }
diff --git a/js/src/jit/x64/Assembler-x64.cpp b/js/src/jit/x64/Assembler-x64.cpp
index eb80b1cd0fd2..992a2e497b9a 100644
--- a/js/src/jit/x64/Assembler-x64.cpp
+++ b/js/src/jit/x64/Assembler-x64.cpp
@@ -39,6 +39,7 @@ ABIArgGenerator::next(MIRType type)
       case MIRType_Pointer:
         current_ = ABIArg(IntArgRegs[regIndex_++]);
         break;
+      case MIRType_Float32:
       case MIRType_Double:
         current_ = ABIArg(FloatArgRegs[regIndex_++]);
         break;
@@ -58,6 +59,7 @@ ABIArgGenerator::next(MIRType type)
         current_ = ABIArg(IntArgRegs[intRegIndex_++]);
         break;
       case MIRType_Double:
+      case MIRType_Float32:
         if (floatRegIndex_ == NumFloatArgRegs) {
             current_ = ABIArg(stackOffset_);
             stackOffset_ += sizeof(uint64_t);
diff --git a/js/src/jit/x64/CodeGenerator-x64.cpp b/js/src/jit/x64/CodeGenerator-x64.cpp
index 7e8deea7a876..3ed262503409 100644
--- a/js/src/jit/x64/CodeGenerator-x64.cpp
+++ b/js/src/jit/x64/CodeGenerator-x64.cpp
@@ -409,15 +409,6 @@ CodeGeneratorX64::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
         srcAddr = Operand(HeapReg, ToRegister(ptr), TimesOne);
     }
 
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        FloatRegister dest = ToFloatRegister(ins->output());
-        uint32_t before = masm.size();
-        masm.loadFloat(srcAddr, dest);
-        uint32_t after = masm.size();
-        masm.cvtss2sd(dest, dest);
-        return skipNote || gen->noteHeapAccess(AsmJSHeapAccess(before, after, vt, ToAnyRegister(ins->output())));
-    }
-
     uint32_t before = masm.size();
     switch (vt) {
       case ArrayBufferView::TYPE_INT8:    masm.movsbl(srcAddr, ToRegister(ins->output())); break;
@@ -426,6 +417,7 @@ CodeGeneratorX64::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
       case ArrayBufferView::TYPE_UINT16:  masm.movzwl(srcAddr, ToRegister(ins->output())); break;
       case ArrayBufferView::TYPE_INT32:
       case ArrayBufferView::TYPE_UINT32:  masm.movl(srcAddr, ToRegister(ins->output())); break;
+      case ArrayBufferView::TYPE_FLOAT32: masm.loadFloat(srcAddr, ToFloatRegister(ins->output())); break;
       case ArrayBufferView::TYPE_FLOAT64: masm.loadDouble(srcAddr, ToFloatRegister(ins->output())); break;
       default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
@@ -453,14 +445,6 @@ CodeGeneratorX64::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
         dstAddr = Operand(HeapReg, ToRegister(ins->ptr()), TimesOne);
     }
 
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        masm.convertDoubleToFloat(ToFloatRegister(ins->value()), ScratchFloatReg);
-        uint32_t before = masm.size();
-        masm.storeFloat(ScratchFloatReg, dstAddr);
-        uint32_t after = masm.size();
-        return skipNote || gen->noteHeapAccess(AsmJSHeapAccess(before, after));
-    }
-
     uint32_t before = masm.size();
     if (ins->value()->isConstant()) {
         switch (vt) {
@@ -480,6 +464,7 @@ CodeGeneratorX64::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
           case ArrayBufferView::TYPE_UINT16:  masm.movw(ToRegister(ins->value()), dstAddr); break;
           case ArrayBufferView::TYPE_INT32:
           case ArrayBufferView::TYPE_UINT32:  masm.movl(ToRegister(ins->value()), dstAddr); break;
+          case ArrayBufferView::TYPE_FLOAT32: masm.storeFloat(ToFloatRegister(ins->value()), dstAddr); break;
           case ArrayBufferView::TYPE_FLOAT64: masm.storeDouble(ToFloatRegister(ins->value()), dstAddr); break;
           default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
         }
@@ -508,7 +493,7 @@ CodeGeneratorX64::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
     MAsmJSStoreGlobalVar *mir = ins->mir();
 
     MIRType type = mir->value()->type();
-    JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double);
+    JS_ASSERT(IsNumberType(type));
 
     CodeOffsetLabel label;
     if (type == MIRType_Int32)
diff --git a/js/src/jit/x86/Assembler-x86.h b/js/src/jit/x86/Assembler-x86.h
index 302f76bcd3b7..684ce02afa79 100644
--- a/js/src/jit/x86/Assembler-x86.h
+++ b/js/src/jit/x86/Assembler-x86.h
@@ -278,6 +278,16 @@ class Assembler : public AssemblerX86Shared
         }
     }
 
+    void fstp32(const Operand &src) {
+        switch (src.kind()) {
+          case Operand::MEM_REG_DISP:
+            masm.fstp32_m(src.disp(), src.base());
+            break;
+          default:
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+        }
+    }
+
     void cmpl(const Register src, ImmWord ptr) {
         masm.cmpl_ir(ptr.value, src.code());
     }
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index e7b7b755f56a..534518ff2eaa 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -410,16 +410,21 @@ CodeGeneratorX86::visitAsmJSUInt32ToFloat32(LAsmJSUInt32ToFloat32 *lir)
 class jit::OutOfLineLoadTypedArrayOutOfBounds : public OutOfLineCodeBase<CodeGeneratorX86>
 {
     AnyRegister dest_;
+    bool isFloat32Load_;
   public:
-    OutOfLineLoadTypedArrayOutOfBounds(AnyRegister dest) : dest_(dest) {}
+    OutOfLineLoadTypedArrayOutOfBounds(AnyRegister dest, bool isFloat32Load)
+      : dest_(dest), isFloat32Load_(isFloat32Load)
+    {}
+
     const AnyRegister &dest() const { return dest_; }
+    bool isFloat32Load() const { return isFloat32Load_; }
     bool accept(CodeGeneratorX86 *codegen) { return codegen->visitOutOfLineLoadTypedArrayOutOfBounds(this); }
 };
 
 template<typename T>
 void
-CodeGeneratorX86::loadNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
-                                                const LDefinition *out)
+CodeGeneratorX86::loadViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
+                                      const LDefinition *out)
 {
     switch (vt) {
       case ArrayBufferView::TYPE_INT8:    masm.movsblWithPatch(srcAddr, ToRegister(out)); break;
@@ -429,6 +434,7 @@ CodeGeneratorX86::loadNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, co
       case ArrayBufferView::TYPE_UINT16:  masm.movzwlWithPatch(srcAddr, ToRegister(out)); break;
       case ArrayBufferView::TYPE_INT32:
       case ArrayBufferView::TYPE_UINT32:  masm.movlWithPatch(srcAddr, ToRegister(out)); break;
+      case ArrayBufferView::TYPE_FLOAT32: masm.movssWithPatch(srcAddr, ToFloatRegister(out)); break;
       case ArrayBufferView::TYPE_FLOAT64: masm.movsdWithPatch(srcAddr, ToFloatRegister(out)); break;
       default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
@@ -436,19 +442,11 @@ CodeGeneratorX86::loadNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, co
 
 template<typename T>
 bool
-CodeGeneratorX86::loadViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
-                                      const LDefinition *out)
+CodeGeneratorX86::loadAndNoteViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
+                                             const LDefinition *out)
 {
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        FloatRegister dest = ToFloatRegister(out);
-        uint32_t before = masm.size();
-        masm.movssWithPatch(srcAddr, dest);
-        uint32_t after = masm.size();
-        masm.cvtss2sd(dest, dest);
-        return gen->noteHeapAccess(AsmJSHeapAccess(before, after, vt, AnyRegister(dest)));
-    }
     uint32_t before = masm.size();
-    loadNonFloat32ViewTypeElement(vt, srcAddr, out);
+    loadViewTypeElement(vt, srcAddr, out);
     uint32_t after = masm.size();
     return gen->noteHeapAccess(AsmJSHeapAccess(before, after, vt, ToAnyRegister(out)));
 }
@@ -458,13 +456,15 @@ CodeGeneratorX86::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic
 {
     const MLoadTypedArrayElementStatic *mir = ins->mir();
     ArrayBufferView::ViewType vt = mir->viewType();
+    JS_ASSERT_IF(vt == ArrayBufferView::TYPE_FLOAT32, mir->type() == MIRType_Float32);
 
     Register ptr = ToRegister(ins->ptr());
     const LDefinition *out = ins->output();
 
     OutOfLineLoadTypedArrayOutOfBounds *ool = nullptr;
+    bool isFloat32Load = (vt == ArrayBufferView::TYPE_FLOAT32);
     if (!mir->fallible()) {
-        ool = new(alloc()) OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out));
+        ool = new(alloc()) OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out), isFloat32Load);
         if (!addOutOfLineCode(ool))
             return false;
     }
@@ -476,18 +476,11 @@ CodeGeneratorX86::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic
         return false;
 
     Address srcAddr(ptr, (int32_t) mir->base());
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        JS_ASSERT(mir->type() == MIRType_Float32);
-        FloatRegister dest = ToFloatRegister(out);
-        masm.movssWithPatch(srcAddr, dest);
-        masm.canonicalizeFloat(dest);
-        if (ool)
-            masm.bind(ool->rejoin());
-        return true;
-    }
-    loadNonFloat32ViewTypeElement(vt, srcAddr, out);
+    loadViewTypeElement(vt, srcAddr, out);
     if (vt == ArrayBufferView::TYPE_FLOAT64)
         masm.canonicalizeDouble(ToFloatRegister(out));
+    if (vt == ArrayBufferView::TYPE_FLOAT32)
+        masm.canonicalizeFloat(ToFloatRegister(out));
     if (ool)
         masm.bind(ool->rejoin());
     return true;
@@ -507,33 +500,25 @@ CodeGeneratorX86::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
         // immediate in the instruction. This displacement will fixed up when the
         // base address is known during dynamic linking (AsmJSModule::initHeap).
         PatchedAbsoluteAddress srcAddr((void *) ptr->toConstant()->toInt32());
-        return loadViewTypeElement(vt, srcAddr, out);
+        return loadAndNoteViewTypeElement(vt, srcAddr, out);
     }
 
     Register ptrReg = ToRegister(ptr);
     Address srcAddr(ptrReg, 0);
 
     if (mir->skipBoundsCheck())
-        return loadViewTypeElement(vt, srcAddr, out);
+        return loadAndNoteViewTypeElement(vt, srcAddr, out);
 
-    OutOfLineLoadTypedArrayOutOfBounds *ool = new(alloc()) OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out));
+    bool isFloat32Load = vt == ArrayBufferView::TYPE_FLOAT32;
+    OutOfLineLoadTypedArrayOutOfBounds *ool = new(alloc()) OutOfLineLoadTypedArrayOutOfBounds(ToAnyRegister(out), isFloat32Load);
     if (!addOutOfLineCode(ool))
         return false;
 
     CodeOffsetLabel cmp = masm.cmplWithPatch(ptrReg, Imm32(0));
     masm.j(Assembler::AboveOrEqual, ool->entry());
 
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        FloatRegister dest = ToFloatRegister(out);
-        uint32_t before = masm.size();
-        masm.movssWithPatch(srcAddr, dest);
-        uint32_t after = masm.size();
-        masm.cvtss2sd(dest, dest);
-        masm.bind(ool->rejoin());
-        return gen->noteHeapAccess(AsmJSHeapAccess(before, after, vt, AnyRegister(dest), cmp.offset()));
-    }
     uint32_t before = masm.size();
-    loadNonFloat32ViewTypeElement(vt, srcAddr, out);
+    loadViewTypeElement(vt, srcAddr, out);
     uint32_t after = masm.size();
     masm.bind(ool->rejoin());
     return gen->noteHeapAccess(AsmJSHeapAccess(before, after, vt, ToAnyRegister(out), cmp.offset()));
@@ -543,7 +528,10 @@ bool
 CodeGeneratorX86::visitOutOfLineLoadTypedArrayOutOfBounds(OutOfLineLoadTypedArrayOutOfBounds *ool)
 {
     if (ool->dest().isFloat()) {
-        masm.loadConstantDouble(GenericNaN(), ool->dest().fpu());
+        if (ool->isFloat32Load())
+            masm.loadConstantFloat32(float(GenericNaN()), ool->dest().fpu());
+        else
+            masm.loadConstantDouble(GenericNaN(), ool->dest().fpu());
     } else {
         Register destReg = ool->dest().gpr();
         masm.mov(ImmWord(0), destReg);
@@ -554,8 +542,8 @@ CodeGeneratorX86::visitOutOfLineLoadTypedArrayOutOfBounds(OutOfLineLoadTypedArra
 
 template<typename T>
 void
-CodeGeneratorX86::storeNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
-                                                 const T &dstAddr)
+CodeGeneratorX86::storeViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
+                                       const T &dstAddr)
 {
     switch (vt) {
       case ArrayBufferView::TYPE_INT8:
@@ -565,6 +553,7 @@ CodeGeneratorX86::storeNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, c
       case ArrayBufferView::TYPE_UINT16:  masm.movwWithPatch(ToRegister(value), dstAddr); break;
       case ArrayBufferView::TYPE_INT32:
       case ArrayBufferView::TYPE_UINT32:  masm.movlWithPatch(ToRegister(value), dstAddr); break;
+      case ArrayBufferView::TYPE_FLOAT32: masm.movssWithPatch(ToFloatRegister(value), dstAddr); break;
       case ArrayBufferView::TYPE_FLOAT64: masm.movsdWithPatch(ToFloatRegister(value), dstAddr); break;
       default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
@@ -572,18 +561,11 @@ CodeGeneratorX86::storeNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, c
 
 template<typename T>
 bool
-CodeGeneratorX86::storeViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
-                                       const T &dstAddr)
+CodeGeneratorX86::storeAndNoteViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
+                                              const T &dstAddr)
 {
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        uint32_t before = masm.size();
-        masm.convertDoubleToFloat(ToFloatRegister(value), ScratchFloatReg);
-        masm.movssWithPatch(ScratchFloatReg, dstAddr);
-        uint32_t after = masm.size();
-        return gen->noteHeapAccess(AsmJSHeapAccess(before, after));
-    }
     uint32_t before = masm.size();
-    storeNonFloat32ViewTypeElement(vt, value, dstAddr);
+    storeViewTypeElement(vt, value, dstAddr);
     uint32_t after = masm.size();
     return gen->noteHeapAccess(AsmJSHeapAccess(before, after));
 }
@@ -602,13 +584,7 @@ CodeGeneratorX86::visitStoreTypedArrayElementStatic(LStoreTypedArrayElementStati
     masm.j(Assembler::AboveOrEqual, &rejoin);
 
     Address dstAddr(ptr, (int32_t) mir->base());
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        JS_ASSERT(mir->value()->type() == MIRType_Float32);
-        masm.movssWithPatch(ToFloatRegister(value), dstAddr);
-        masm.bind(&rejoin);
-        return true;
-    }
-    storeNonFloat32ViewTypeElement(vt, value, dstAddr);
+    storeViewTypeElement(vt, value, dstAddr);
     masm.bind(&rejoin);
     return true;
 }
@@ -627,29 +603,21 @@ CodeGeneratorX86::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
         // immediate in the instruction. This displacement will fixed up when the
         // base address is known during dynamic linking (AsmJSModule::initHeap).
         PatchedAbsoluteAddress dstAddr((void *) ptr->toConstant()->toInt32());
-        return storeViewTypeElement(vt, value, dstAddr);
+        return storeAndNoteViewTypeElement(vt, value, dstAddr);
     }
 
     Register ptrReg = ToRegister(ptr);
     Address dstAddr(ptrReg, 0);
 
     if (mir->skipBoundsCheck())
-        return storeViewTypeElement(vt, value, dstAddr);
+        return storeAndNoteViewTypeElement(vt, value, dstAddr);
 
     CodeOffsetLabel cmp = masm.cmplWithPatch(ptrReg, Imm32(0));
     Label rejoin;
     masm.j(Assembler::AboveOrEqual, &rejoin);
 
-    if (vt == ArrayBufferView::TYPE_FLOAT32) {
-        masm.convertDoubleToFloat(ToFloatRegister(value), ScratchFloatReg);
-        uint32_t before = masm.size();
-        masm.movssWithPatch(ScratchFloatReg, dstAddr);
-        uint32_t after = masm.size();
-        masm.bind(&rejoin);
-        return gen->noteHeapAccess(AsmJSHeapAccess(before, after, cmp.offset()));
-    }
     uint32_t before = masm.size();
-    storeNonFloat32ViewTypeElement(vt, value, dstAddr);
+    storeViewTypeElement(vt, value, dstAddr);
     uint32_t after = masm.size();
     masm.bind(&rejoin);
     return gen->noteHeapAccess(AsmJSHeapAccess(before, after, cmp.offset()));
@@ -659,10 +627,14 @@ bool
 CodeGeneratorX86::visitAsmJSLoadGlobalVar(LAsmJSLoadGlobalVar *ins)
 {
     MAsmJSLoadGlobalVar *mir = ins->mir();
+    MIRType type = mir->type();
+    JS_ASSERT(IsNumberType(type));
 
     CodeOffsetLabel label;
-    if (mir->type() == MIRType_Int32)
+    if (type == MIRType_Int32)
         label = masm.movlWithPatch(PatchedAbsoluteAddress(), ToRegister(ins->output()));
+    else if (type == MIRType_Float32)
+        label = masm.movssWithPatch(PatchedAbsoluteAddress(), ToFloatRegister(ins->output()));
     else
         label = masm.movsdWithPatch(PatchedAbsoluteAddress(), ToFloatRegister(ins->output()));
 
@@ -675,11 +647,13 @@ CodeGeneratorX86::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
     MAsmJSStoreGlobalVar *mir = ins->mir();
 
     MIRType type = mir->value()->type();
-    JS_ASSERT(type == MIRType_Int32 || type == MIRType_Double);
+    JS_ASSERT(IsNumberType(type));
 
     CodeOffsetLabel label;
     if (type == MIRType_Int32)
         label = masm.movlWithPatch(ToRegister(ins->value()), PatchedAbsoluteAddress());
+    else if (type == MIRType_Float32)
+        label = masm.movssWithPatch(ToFloatRegister(ins->value()), PatchedAbsoluteAddress());
     else
         label = masm.movsdWithPatch(ToFloatRegister(ins->value()), PatchedAbsoluteAddress());
 
@@ -713,13 +687,18 @@ void
 CodeGeneratorX86::postAsmJSCall(LAsmJSCall *lir)
 {
     MAsmJSCall *mir = lir->mir();
-    if (mir->type() != MIRType_Double || mir->callee().which() != MAsmJSCall::Callee::Builtin)
+    if (!IsFloatingPointType(mir->type()) || mir->callee().which() != MAsmJSCall::Callee::Builtin)
         return;
 
-    masm.reserveStack(sizeof(double));
-    masm.fstp(Operand(esp, 0));
-    masm.loadDouble(Operand(esp, 0), ReturnFloatReg);
-    masm.freeStack(sizeof(double));
+    if (mir->type() == MIRType_Float32) {
+        Operand op(esp, -sizeof(float));
+        masm.fstp32(op);
+        masm.loadFloat(op, ReturnFloatReg);
+    } else {
+        Operand op(esp, -sizeof(double));
+        masm.fstp(op);
+        masm.loadDouble(op, ReturnFloatReg);
+    }
 }
 
 void
@@ -1013,7 +992,12 @@ CodeGeneratorX86::visitOutOfLineTruncateFloat32(OutOfLineTruncateFloat32 *ool)
         masm.setupUnalignedABICall(1, output);
         masm.cvtss2sd(input, input);
         masm.passABIArg(input);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
+
+        if (gen->compilingAsmJS())
+            masm.callWithABI(AsmJSImm_ToInt32);
+        else
+            masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
+
         masm.storeCallResult(output);
         masm.pop(input);
 
diff --git a/js/src/jit/x86/CodeGenerator-x86.h b/js/src/jit/x86/CodeGenerator-x86.h
index 6b6a7ac1410a..daf82715b922 100644
--- a/js/src/jit/x86/CodeGenerator-x86.h
+++ b/js/src/jit/x86/CodeGenerator-x86.h
@@ -30,16 +30,16 @@ class CodeGeneratorX86 : public CodeGeneratorX86Shared
     ValueOperand ToTempValue(LInstruction *ins, size_t pos);
 
     template<typename T>
-    bool loadViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
+    bool loadAndNoteViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
                              const LDefinition *out);
     template<typename T>
-    void loadNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
+    void loadViewTypeElement(ArrayBufferView::ViewType vt, const T &srcAddr,
                                        const LDefinition *out);
     template<typename T>
-    bool storeViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
+    bool storeAndNoteViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
                               const T &dstAddr);
     template<typename T>
-    void storeNonFloat32ViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
+    void storeViewTypeElement(ArrayBufferView::ViewType vt, const LAllocation *value,
                                         const T &dstAddr);
     void storeElementTyped(const LAllocation *value, MIRType valueType, MIRType elementType,
                            const Register &elements, const LAllocation *index);
diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
index 718cd2acd15f..10169094b64b 100644
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -460,6 +460,16 @@ js::math_imul(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
+// Implements Math.fround (20.2.2.16) up to step 3
+bool
+js::RoundFloat32(JSContext *cx, Handle<Value> v, float *out)
+{
+    double d;
+    bool success = ToNumber(cx, v, &d);
+    *out = static_cast<float>(d);
+    return success;
+}
+
 bool
 js::math_fround(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -470,11 +480,10 @@ js::math_fround(JSContext *cx, unsigned argc, Value *vp)
         return true;
     }
 
-    double x;
-    if (!ToNumber(cx, args[0], &x))
+    float f;
+    if (!RoundFloat32(cx, args[0], &f))
         return false;
 
-    float f = x;
     args.rval().setDouble(static_cast<double>(f));
     return true;
 }
diff --git a/js/src/jsmath.h b/js/src/jsmath.h
index 717f46019b5c..28fb924f0031 100644
--- a/js/src/jsmath.h
+++ b/js/src/jsmath.h
@@ -84,6 +84,9 @@ namespace js {
 extern bool
 math_imul(JSContext *cx, unsigned argc, js::Value *vp);
 
+extern bool
+RoundFloat32(JSContext *cx, Handle<Value> v, float *out);
+
 extern bool
 math_fround(JSContext *cx, unsigned argc, js::Value *vp);
 

From 0199c03803f0576674775919d4f19f281318e7a7 Mon Sep 17 00:00:00 2001
From: Benjamin Bouvier <benj@benj.me>
Date: Thu, 12 Dec 2013 20:23:35 +0100
Subject: [PATCH 033/459] Bug 904918: Odin Float32 support: tests; r=luke

---
 js/src/jit-test/lib/asm.js                    |   4 +-
 js/src/jit-test/tests/asm.js/testFloat32.js   | 301 ++++++++++++++++++
 .../jit-test/tests/asm.js/testHeapAccess.js   |   1 +
 js/src/jit-test/tests/asm.js/testZOOB.js      |  17 +-
 4 files changed, 316 insertions(+), 7 deletions(-)
 create mode 100644 js/src/jit-test/tests/asm.js/testFloat32.js

diff --git a/js/src/jit-test/lib/asm.js b/js/src/jit-test/lib/asm.js
index d5f22ae9aaa7..8d98b7d3cdcc 100644
--- a/js/src/jit-test/lib/asm.js
+++ b/js/src/jit-test/lib/asm.js
@@ -57,7 +57,7 @@ function assertAsmDirectiveFail(str)
         eval(str);
     } catch (e) {
         if ((''+e).indexOf(ASM_DIRECTIVE_FAIL_STRING) == -1)
-            throw new Error("Didn't catch the expected directive failure error; instead caught: " + e);
+            throw new Error("Didn't catch the expected directive failure error; instead caught: " + e + "\nStack: " + new Error().stack);
         caught = true;
     }
     if (!caught)
@@ -85,7 +85,7 @@ function assertAsmTypeFail()
         Function.apply(null, arguments);
     } catch (e) {
         if ((''+e).indexOf(ASM_TYPE_FAIL_STRING) == -1)
-            throw new Error("Didn't catch the expected type failure error; instead caught: " + e);
+            throw new Error("Didn't catch the expected type failure error; instead caught: " + e + "\nStack: " + new Error().stack);
         caught = true;
     }
     if (!caught)
diff --git a/js/src/jit-test/tests/asm.js/testFloat32.js b/js/src/jit-test/tests/asm.js/testFloat32.js
new file mode 100644
index 000000000000..4b78b4c9e5c0
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/testFloat32.js
@@ -0,0 +1,301 @@
+load(libdir + "asm.js");
+const TO_FLOAT32 = "var toF = glob.Math.fround;";
+const HEAP32 = "var f32 = new glob.Float32Array(heap);";
+var heap = new ArrayBuffer(4096);
+
+// Module linking
+assertAsmLinkAlwaysFail(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() {} return f"), null);
+assertAsmLinkAlwaysFail(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() {} return f"), {fround: Math.fround});
+assertAsmLinkFail(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() {} return f"), {Math: {fround: Math.imul}});
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() {} return f"), {Math:{fround: Math.fround}})(), undefined);
+
+// Argument coercions
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = unknown(x); } return f");
+assertAsmTypeFail('glob', USE_ASM + "function f(i) { i = toF(i); } return f");
+assertAsmTypeFail('glob', USE_ASM + "var cos = glob.Math.cos; function f(x) { x = cos(x); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(x, x); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF('hi'); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(loat); } return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(i) { i = toF(i); } return f"), this)(), undefined);
+
+// Local variables declarations
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = unknown(); } return f");
+assertAsmTypeFail('glob', USE_ASM + "var cos = glob.Math.cos; function f() { var i = cos(); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(x, x); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF('hi'); } return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5); } return f"), this)(), undefined);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5.); } return f"), this)(), undefined);
+
+// Return values
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(4, 4); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF({}); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(x); } return f");
+
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(42); } return f"), this)(), 42);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(0.); } return f"), this)(), 0);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(-0.); } return f"), this)(), -0);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var inf = glob.Infinity; function f() { return toF(inf); } return f"), this)(), Infinity);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(13.37); } return f"), this)(), Math.fround(13.37));
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return +toF(4.); } return f"), this)(), 4);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return +~~toF(4.5); } return f"), this)(), 4);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(4.5) | 0; } return f"), this)(), 4);
+
+// Assign values
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5.); i = 5; return toF(i); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5.); i = 6.; return toF(i); } return f");
+
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5.); return toF(i); } return f"), this)(), 5);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5.); i = toF(42); return toF(i); } return f"), this)(), 42);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5.); i = toF(6.); return toF(i); } return f"), this)(), 6);
+
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { var i = toF(5.); f32[0] = toF(6.); i = f32[0]; return toF(i); } return f");
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { var i = toF(5.); f32[0] = toF(6.); i = toF(f32[0]); return toF(i); } return f"), this, null, heap)(), 6);
+
+// Special array assignments (the other ones are tested in testHeapAccess)
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { var i = 5.; f32[0] = i; return toF(f32[0]); } return f"), this, null, heap)(), 5);
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "var f64 = new glob.Float64Array(heap); function f() { var i = toF(5.); f64[0] = i; return +f64[0]; } return f"), this, null, heap)(), 5);
+
+var HEAP64 = "var f64 = new glob.Float64Array(heap);"
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 1.5; return +f32[0]; } return f"), this, null, heap)(), 1.5);
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + HEAP64 + "function f() { f64[0] = 1.5; return toF(f64[0]); } return f"), this, null, heap)(), 1.5);
+
+// Coercions
+// -> from Float32
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { var i = toF(5.); var n = 0; n = i | 0; return n | 0; } return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(x); var n = 0.; n = +x; return +n; } return f"), this)(16.64), Math.fround(16.64));
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(x); var n = 0; n = ~~x; return n | 0; } return f"), this)(16.64), 16);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(x); var n = 0; n = ~~x >>> 0; return n | 0; } return f"), this)(16.64), 16);
+
+// -> from float?
+function makeCoercion(coercionFunc) {
+    return USE_ASM + HEAP32 + TO_FLOAT32 + "function f(x) { x = toF(x); f32[0] = x; return " + coercionFunc('f32[0]') + " } return f";
+}
+assertAsmTypeFail('glob', 'ffi', 'heap', makeCoercion(x => x + '|0'));
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', makeCoercion(x => '+' + x)), this, null, heap)(16.64), Math.fround(16.64));
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', makeCoercion(x => 'toF(' + x + ')')), this, null, heap)(16.64), Math.fround(16.64));
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', makeCoercion(x => '~~+' + x + '|0')), this, null, heap)(16.64), 16);
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', makeCoercion(x => '~~toF(' + x + ')|0')), this, null, heap)(16.64), 16);
+
+// -> to Float32
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = x|0; return toF(~~x); } return f"), this)(23), 23);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = x|0; return toF(x >> 0); } return f"), this)(23), 23);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = +x; return toF(x); } return f"), this)(13.37), Math.fround(13.37));
+
+UINT32_MAX = Math.pow(2, 32)-1;
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = x|0; return toF(x >>> 0); } return f"), this)(-1), Math.fround(UINT32_MAX));
+
+// Global variables imports
+assertAsmTypeFail('glob', USE_ASM + "var x = toF(); function f() {} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var x = some(3); function f() {} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var x = toF(); function f() {} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var x = toF(3, 4); function f() {} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var x = toF({x: 3}); function f() {} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var x = toF(true); function f() {} return f");
+assertAsmTypeFail('glob', USE_ASM + "var x = toF(3);" + TO_FLOAT32 + "function f() {} return f");
+
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var x = toF(3.5); function f() {} return f"), this)(), undefined);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var x = toF(3); function f() {} return f"), this)(), undefined);
+assertEq(asmLink(asmCompile('glob', 'ffi', USE_ASM + TO_FLOAT32 + "var x = toF(ffi.x); function f() {} return f"), this, {x:3})(), undefined);
+assertEq(asmLink(asmCompile('glob', 'ffi', USE_ASM + TO_FLOAT32 + "var x = toF(ffi.x); function f() {} return f"), this, {x:3.5})(), undefined);
+
+// Global variables uses
+values = [2.01, 13.37, -3.141592653]
+specials = [NaN, Infinity]
+
+for (v of values) {
+    assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var x = toF(" + v + "); function f() {return toF(x);} return f"), this)(), Math.fround(v));
+    assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var x = toF(0.); function f() {x = toF(" + v + "); return toF(x);} return f"), this)(), Math.fround(v));
+    assertEq(asmLink(asmCompile('glob', 'ffi', USE_ASM + TO_FLOAT32 + "var x = toF(ffi.x); function f() {return toF(x);} return f"), this, {x:v})(), Math.fround(v));
+}
+
+for (v of specials) {
+    assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var special = glob." + v + "; var g=toF(0.); function f() {g=toF(special); return toF(g);} return f"), this)(), Math.fround(v));
+}
+
+// Math builtins
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var imul = glob.Math.imul; function f() {var x = toF(1.5), y = toF(2.4); return imul(x, y) | 0;} return f");
+
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var abs = glob.Math.abs; function f() {var x = toF(1.5); return +abs(x);} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var abs = glob.Math.abs; function f() {var x = toF(1.5); return abs(x) | 0;} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var abs = glob.Math.abs; function f() {var x = toF(1.5); return toF(abs(x))} return f"), this)(), Math.fround(1.5));
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var abs = glob.Math.abs; function f() {var x = toF(-1.5); return toF(abs(x))} return f"), this)(), Math.fround(1.5));
+
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var sqrt = glob.Math.sqrt; function f() {var x = toF(1.5); return +sqrt(x);} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var sqrt = glob.Math.sqrt; function f() {var x = toF(1.5); return sqrt(x) | 0;} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var sqrt = glob.Math.sqrt; function f() {var x = toF(2.25); return toF(sqrt(x))} return f"), this)(), Math.fround(1.5));
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var sqrt = glob.Math.sqrt; function f() {var x = toF(-1.); return toF(sqrt(x))} return f"), this)(), NaN);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var sqrt = glob.Math.sqrt; var inf = glob.Infinity; function f() {var x = toF(0.); x = toF(inf); return toF(sqrt(x))} return f"), this)(), Infinity);
+
+// float?s
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + HEAP32 + TO_FLOAT32 + "var sqrt = glob.Math.sqrt; function f(x) { x = toF(x); f32[0] = x; return toF(sqrt(f32[0])) } return f"), this, null, heap)(64), Math.fround(8));
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + HEAP32 + TO_FLOAT32 + "var cos = glob.Math.cos; function f(x) { x = toF(x); f32[0] = x; return toF(cos(f32[0])) } return f"), this, null, heap)(3.141592653), -1);
+
+// All Math functions with arity 1 behave like cos and sin
+var cosModule = asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.cos; function f(x) {x = toF(x); return toF(g(x))} return f"), this);
+for (v of [0, 3.141592653, Math.Infinity, NaN])
+    assertEq(cosModule(v), Math.fround(Math.cos(Math.fround(v))));
+
+var sinModule = asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.sin; function f(x) {x = toF(x); return toF(g(x))} return f"), this);
+for (v of [0, 3.141592653, Math.Infinity, NaN])
+    assertEq(sinModule(v), Math.fround(Math.sin(Math.fround(v))));
+
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.cos; function f(x) {x = toF(x); return +(g(x))} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.cos; function f(x) {x = +x; return toF(g(x))} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.cos; function f(x) {x = x|0; return toF(g(x))} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.cos; function f(x) {x = toF(x); return g(x) | 0} return f");
+
+// Math functions with arity of two are not specialized for floats, so we shouldn't feed them with floats arguments or
+// return type
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.pow; function f(x) {x = toF(x); return toF(g(x, 2.))} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.pow; function f(x) {x = toF(x); return +g(x, 2.)} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.pow; function f(x) {x = toF(x); return toF(g(+x, 2.))} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.pow; function f(x) {x = toF(x); return +g(+x, 2.)} return f"), this)(3), 9);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = glob.Math.pow; function f(x) {x = toF(x); return toF(+g(+x, 2.))} return f"), this)(3), 9);
+
+// Other function calls
+// -> Signature comparisons
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function g(x){x=toF(x); return toF(x);} function f() {var x=toF(4.); var y=toF(0.); var z = 0.; y=toF(g(x)); z = +g(x); return toF(z); } return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var sqrt=glob.Math.sqrt; function g(x){x=toF(x); return toF(sqrt(x));} function f() {var x=toF(4.); var y=toF(0.); var z = 0.; y = toF(g(x)); z = +toF(g(x)); return toF(z); } return f"), this)(), 2);
+
+// -> FFI
+var FFI = "var ffi = env.ffi;";
+assertAsmTypeFail('glob', 'env', USE_ASM + TO_FLOAT32 + FFI + "function f() {var x = toF(3.14); return +ffi(x);} return f");
+assertAsmTypeFail('glob', 'env', USE_ASM + TO_FLOAT32 + FFI + "function f() {var x = toF(3.14); return toF(ffi(+x));} return f");
+
+var env = {ffi: function(x) { return x+1; }}; // use registers
+assertEq(asmLink(asmCompile('glob', 'env', USE_ASM + TO_FLOAT32 + FFI + "function f(x) {x = toF(x); return toF(+ffi(+x));} return f"), this, env)(5), Math.fround(6));
+env = {ffi: function(a,b,c,d,e,f,g,h,i) { return a+b+c+d+e+f+g+h+i; }}; // use stack arguments (> 8 arguments on linux x64)
+assertEq(asmLink(asmCompile('glob', 'env', USE_ASM + TO_FLOAT32 + FFI + "function f(x) {x = toF(x); return toF(+ffi(+x, 1., 2., 3., 4., 5., -5., -4., 1.));} return f"), this, env)(5), Math.fround(12));
+
+// -> Internal calls
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function g(x){x=toF(x);return toF(+x + 1.);} function f(x) {x = +x; return toF(g(x));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function g(x){x=toF(x);return toF(+x + 1.);} function f(x) {x = x|0; return toF(g(x));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function g(x){x=toF(x);return toF(+x + 1.);} function f(x) {x = x|0; return toF(g(x));} return f");
+
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function g(x){x=toF(x);return toF(+x + 1.);} function f(x) {x = toF(x); return toF(g(x));} return f"), this, env)(5), Math.fround(6));
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function g(x,y){x=toF(x);y=toF(y);return toF(+x + +y);} function f(x) {x = toF(x); return toF(g(x, toF(1.)));} return f"), this, env)(5), Math.fround(6));
+
+// --> internal calls with unused return values
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "var g = 4; function s(x) { x = +x; g = (g + ~~x)|0; return g|0;} function f(x) { x = +x; toF(s(x)); return g|0} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = 4; function s(x) { x = +x; g = (g + ~~x)|0; return toF(g|0);} function f(x) { x = +x; toF(s(x)); return g|0} return f"), this)(3), 7);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = 4; function s(x) { x = toF(x); g = (g + ~~x)|0; return toF(g|0);} function f(x) { x = toF(x); return (toF(s(x)), g)|0} return f"), this)(3), 7);
+
+// --> coerced calls
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = 4; function s(x) { x = toF(x); g = (g + ~~x)|0; return +(g|0);} function f(x) { x = toF(x); return toF(+s(x))} return f"), this)(3), 7);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = 4; function s(x) { x = toF(x); g = (g + ~~x)|0; return g|0;} function f(x) { x = toF(x); return toF(s(x)|0)} return f"), this)(3), 7);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "var g = 4; function s(x) { x = toF(x); g = (g + ~~x)|0; return toF(g|0);} function f(x) { x = toF(x); return toF(toF(s(x)))} return f"), this)(3), 7);
+
+// --> test pressure on registers in internal calls when there are |numArgs| arguments
+for (numArgs of [5, 9, 17, 33, 65, 129]) {
+    let code = (function(n) {
+        let args = "", coercions = "", sum = "", call="x";
+        for (let i = 0; i < n; i++) {
+            let name = 'a' + i;
+            args += name + ((i == n-1)?'':',');
+            coercions += name + '=toF(' + name + ');';
+            sum += ((i>0)?'+':'') + ' +' + name;
+            call += (i==0)?'':',toF(' + i + '.)'
+        }
+        return "function g(" + args + "){" + coercions + "return toF(" + sum + ");}"
+               +"function f(x) { x = toF(x); return toF(g(" + call + "))}";
+    })(numArgs);
+    assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + code + "return f"), this, env)(5), Math.fround(5 + numArgs * (numArgs-1) / 2));
+}
+
+// -> Pointer calls
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function a(x){x=toF(x);return toF(+x + .5);} function b(x){x=toF(x);return toF(+x - .5);} function f(x, n) {x=+x;n=n|0;return toF(t[n&1](x));} var t=[a,b]; return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function a(x){x=toF(x);return toF(+x + .5);} function b(x){x=toF(x);return toF(+x - .5);} function f(x, n) {x=x|0;n=n|0;return toF(t[n&1](x));} var t=[a,b]; return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function a(x){x=toF(x);return toF(+x + .5);} function b(x){x=toF(x);return toF(+x - .5);} function f(x, n) {x=toF(x);n=n|0;return t[n&1](x)|0;} var t=[a,b]; return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function a(x){x=toF(x);return toF(+x + .5);} function b(x){x=toF(x);return toF(+x - .5);} function f(x, n) {x=toF(x);n=n|0;return +t[n&1](x);} var t=[a,b]; return f");
+
+code = asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function a(x){x=toF(x);return toF(+x + .5);} function b(x){x=toF(x);return toF(+x - .5);}"
+               + "function f(x, n) {x=toF(x);n=n|0;return toF(t[n&1](x));} var t=[a,b]; return f"), this);
+assertEq(code(0, 0), .5);
+assertEq(code(0, 1), -.5);
+assertEq(code(13.37, 0), Math.fround(13.37 + .5));
+assertEq(code(13.37, 1), Math.fround(13.37 - .5));
+
+// Arithmetic operations
+// -> mul
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3 * toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3. * toF(4.)); } return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return +(toF(3.) * toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3) * toF(4) * toF(5));} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.) * toF(4.)); } return f"), this)(), 12);
+
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3 * f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3. * f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return +(toF(3.) * f32[0]);} return f");
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(toF(3.) * f32[0]);} return f"), this, null, heap)(), 12);
+
+var mul = asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x=toF(x); return toF(x * toF(4.));} return f"), this);
+assertEq(mul(Infinity), Infinity);
+assertEq(mul(NaN), NaN);
+assertEq(mul(0), 0);
+assertEq(mul(1), 4);
+assertEq(mul(0.33), Math.fround(0.33 * 4));
+
+// -> add
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3 + toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3.5 + toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return +(toF(3.5) + toF(4.));} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.5) + toF(4.)); } return f"), this)(), 7.5);
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.5) + toF(4.) + toF(4.5));} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(toF(3.5) + toF(4.)) + toF(4.5)); } return f"), this)(), 12);
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(toF(3) + f32[0]);} return f"), this, null, heap)(), 7);
+
+// --> no additions with float? or floatish
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3 + f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3. + f32[0]);} return f");
+
+// -> sub
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3 - toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3.5 - toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return +(toF(3.5) - toF(4.));} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.5) - toF(4.)); } return f"), this)(), -.5);
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.5) - toF(4.) - toF(4.5));} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(toF(3.5) - toF(4.)) - toF(4.5)); } return f"), this)(), -5);
+
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.5) + toF(4.) - toF(4.5));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.5) - toF(4.) + toF(4.5));} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(toF(3.5) + toF(4.)) - toF(4.5)); } return f"), this)(), 3);
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(toF(3.5) - toF(4.)) + toF(4.5)); } return f"), this)(), 4);
+
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3 - f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3. - f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return +(toF(3) - f32[0]);} return f");
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(toF(3) - f32[0]);} return f"), this, null, heap)(), -1);
+
+// -> div
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3 / toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(3.5 / toF(4.));} return f");
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return +(toF(3.5) / toF(4.));} return f");
+assertEq(asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(12.) / toF(4.)); } return f"), this)(), 3);
+
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3 / f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return toF(3. / f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 4.; return +(toF(3) / f32[0]);} return f");
+assertEq(asmLink(asmCompile('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { f32[0] = 2.; return toF(toF(4) / f32[0]);} return f"), this, null, heap)(), 2);
+
+// -> mod
+assertAsmTypeFail('glob', USE_ASM + TO_FLOAT32 + "function f() { return toF(toF(3.5) % toF(4.));} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { return toF(f32[0] % toF(4.));} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { return toF(toF(3.5) % f32[0]);} return f");
+assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { return toF(f32[1] % f32[0]);} return f");
+
+// Comparisons
+for (op of ['==', '!=', '<', '>', '<=', '>=']) {
+    let code = asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(x); if( x " + op + " toF(3.) ) return 1; else return 0; return -1; } return f"), this);
+    let ternary = asmLink(asmCompile('glob', USE_ASM + TO_FLOAT32 + "function f(x) { x = toF(x); return ((x " + op + " toF(3.)) ? 1 : 0)|0 } return f"), this);
+    for (v of [-5, 0, 2.5, 3, 13.37, NaN, Infinity]) {
+        let expected = eval("("+ v + " " + op + " 3)|0");
+        assertEq(code(v) | 0, expected);
+        assertEq(ternary(v) | 0, expected);
+    }
+
+    assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { if( f32[0] " + op + " toF(3.) ) return 1; else return 0; return -1; } return f");
+    assertAsmTypeFail('glob', 'ffi', 'heap', USE_ASM + TO_FLOAT32 + HEAP32 + "function f() { if( (toF(1.) + toF(2.)) " + op + " toF(3.) ) return 1; else return 0; return -1; } return f");
+}
diff --git a/js/src/jit-test/tests/asm.js/testHeapAccess.js b/js/src/jit-test/tests/asm.js/testHeapAccess.js
index 699b6d4a9b57..662f7bba06af 100644
--- a/js/src/jit-test/tests/asm.js/testHeapAccess.js
+++ b/js/src/jit-test/tests/asm.js/testHeapAccess.js
@@ -154,6 +154,7 @@ assertEq(new Float64Array(BUF_64KB)[1], 1.3);
 
 new Float32Array(BUF_64KB)[1] = 1.0;
 assertEq(asmLink(asmCompile('glob', 'imp', 'b', USE_ASM + HEAP_IMPORTS + 'function f() { return +f32[(4&0xffff)>>2] } return f'), this, null, BUF_64KB)(), 1.0);
+assertEq(asmLink(asmCompile('glob', 'imp', 'b', USE_ASM + HEAP_IMPORTS + 'var toFloat32 = glob.Math.fround; function f() { return toFloat32(f32[(4&0xffff)>>2]) } return f'), this, null, BUF_64KB)(), 1.0);
 new Float64Array(BUF_64KB)[1] = 1.3;
 assertEq(asmLink(asmCompile('glob', 'imp', 'b', USE_ASM + HEAP_IMPORTS + 'function f() { return +f64[(8&0xffff)>>3] } return f'), this, null, BUF_64KB)(), 1.3);
 
diff --git a/js/src/jit-test/tests/asm.js/testZOOB.js b/js/src/jit-test/tests/asm.js/testZOOB.js
index d68b5f5308c2..d8c38d394ce5 100644
--- a/js/src/jit-test/tests/asm.js/testZOOB.js
+++ b/js/src/jit-test/tests/asm.js/testZOOB.js
@@ -80,12 +80,12 @@ function testInt(ctor, shift, scale, disp) {
     }
 }
 
-function testFloat(ctor, shift, scale, disp) {
+function testFloat(ctor, shift, scale, disp, coercion) {
     var ab = new ArrayBuffer(4096);
     var arr = new ctor(ab);
     for (var i = 0; i < arr.length; i++)
         arr[i] = i;
-    var f = asmLink(asmCompile('glob', 'imp', 'b', USE_ASM + 'var arr=new glob.' + ctor.name + '(b); function f(i) {i=i|0; return +arr[((i<<' + scale + ')+' + disp + ')>>' + shift + '] } return f'), this, null, ab);
+    var f = asmLink(asmCompile('glob', 'imp', 'b', USE_ASM + 'var arr=new glob.' + ctor.name + '(b); var toF = glob.Math.fround; function f(i) {i=i|0; return ' + coercion + '(arr[((i<<' + scale + ')+' + disp + ')>>' + shift + ']) } return f'), this, null, ab);
     for (var i of [0,1,2,3,4,1023,1024,1025,4095,4096,4097])
         assertEq(f(i), +arr[((i<<scale)+disp)>>shift]);
 
@@ -94,7 +94,7 @@ function testFloat(ctor, shift, scale, disp) {
             assertEq(f(i+j), +arr[(((i+j)<<scale)+disp)>>shift]);
     }
 
-    var f = asmLink(asmCompile('glob', 'imp', 'b', USE_ASM + 'var arr=new glob.' + ctor.name + '(b); function f(i,j) {i=i|0;j=+j; arr[((i<<' + scale + ')+' + disp + ')>>' + shift + '] = j } return f'), this, null, ab);
+    var f = asmLink(asmCompile('glob', 'imp', 'b', USE_ASM + 'var arr=new glob.' + ctor.name + '(b); var toF = glob.Math.fround; function f(i,j) {i=i|0;j=+j; arr[((i<<' + scale + ')+' + disp + ')>>' + shift + '] = j } return f'), this, null, ab);
     for (var i of [0,1,2,3,4,1023,1024,1025,4095,4096,4097]) {
         var index = ((i<<scale)+disp)>>shift;
         var v = +arr[index];
@@ -114,6 +114,13 @@ function testFloat(ctor, shift, scale, disp) {
     }
 }
 
+function testFloat32(ctor, shift, scale, disp) {
+    testFloat(ctor, shift, scale, disp, "toF");
+}
+function testFloat64(ctor, shift, scale, disp) {
+    testFloat(ctor, shift, scale, disp, "+");
+}
+
 function test(tester, ctor, shift) {
     for (scale of [0,1,2,3]) {
         for (disp of [0,1,8,Math.pow(2,31)-1,Math.pow(2,31),Math.pow(2,32)-1])
@@ -127,5 +134,5 @@ test(testInt, Int16Array, 1);
 test(testInt, Uint16Array, 1);
 test(testInt, Int32Array, 2);
 test(testInt, Uint32Array, 2);
-test(testFloat, Float32Array, 2);
-test(testFloat, Float64Array, 3);
+test(testFloat32, Float32Array, 2);
+test(testFloat64, Float64Array, 3);

From 978e927a0eb251f6ecc514ce55e867e6b31413c2 Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Thu, 12 Dec 2013 16:05:31 +0100
Subject: [PATCH 034/459] Bug 949474 - Reflect the fact that the nominal range
 for the sampleRate argument of the AudioContext.createBuffer changed in the
 spec. r=ehsan

---
 content/media/webaudio/AudioContext.cpp          |  4 ++--
 .../media/webaudio/test/test_AudioBuffer.html    | 16 +++++++++++-----
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/content/media/webaudio/AudioContext.cpp b/content/media/webaudio/AudioContext.cpp
index f269163652f7..850727f1ef6c 100644
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -174,8 +174,8 @@ AudioContext::CreateBuffer(JSContext* aJSContext, uint32_t aNumberOfChannels,
                            uint32_t aLength, float aSampleRate,
                            ErrorResult& aRv)
 {
-  if (aSampleRate < 8000 || aSampleRate > 96000 || !aLength) {
-    aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  if (aSampleRate < 8000 || aSampleRate > 192000 || !aLength || !aNumberOfChannels) {
+    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }
 
diff --git a/content/media/webaudio/test/test_AudioBuffer.html b/content/media/webaudio/test/test_AudioBuffer.html
index 75eeb7ff00e5..47716853bf6c 100644
--- a/content/media/webaudio/test/test_AudioBuffer.html
+++ b/content/media/webaudio/test/test_AudioBuffer.html
@@ -81,15 +81,21 @@ addLoadEvent(function() {
 
   expectException(function() {
     context.createBuffer(2, 2048, 7999);
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INDEX_SIZE_ERR);
   expectException(function() {
-    context.createBuffer(2, 2048, 96001);
-  }, DOMException.NOT_SUPPORTED_ERR);
+    context.createBuffer(2, 2048, 192001);
+  }, DOMException.INDEX_SIZE_ERR);
   context.createBuffer(2, 2048, 8000);  // no exception
-  context.createBuffer(2, 2048, 96000); // no exception
+  context.createBuffer(2, 2048, 192000); // no exception
+  context.createBuffer(32, 2048, 48000); // no exception
+  // Null length
   expectException(function() {
     context.createBuffer(2, 0, 48000);
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INDEX_SIZE_ERR);
+  // Null number of channels
+  expectException(function() {
+    context.createBuffer(0, 2048, 48000);
+  }, DOMException.INDEX_SIZE_ERR);
   SimpleTest.finish();
 });
 

From 64bc3f2d7ed6b0b8b3a32f584d9011a359b479be Mon Sep 17 00:00:00 2001
From: Nicholas Hurley <hurley@todesschaf.org>
Date: Thu, 12 Dec 2013 11:26:50 -0800
Subject: [PATCH 035/459] Bug 948757 - Don't flood servers with bunches of
 speculative connections. r=mcmanus

---
 netwerk/base/public/nsISpeculativeConnect.idl | 9 +--------
 netwerk/base/src/Seer.cpp                     | 9 +--------
 netwerk/protocol/http/nsHttpConnectionMgr.cpp | 6 +-----
 3 files changed, 3 insertions(+), 21 deletions(-)

diff --git a/netwerk/base/public/nsISpeculativeConnect.idl b/netwerk/base/public/nsISpeculativeConnect.idl
index f4bcd3cf4039..7d436519b7e7 100644
--- a/netwerk/base/public/nsISpeculativeConnect.idl
+++ b/netwerk/base/public/nsISpeculativeConnect.idl
@@ -35,7 +35,7 @@ interface nsISpeculativeConnect : nsISupports
  * inline) to determine whether or not to actually make a speculative
  * connection.
  */
-[builtinclass, uuid(2b6d6fb6-ab28-4f4c-af84-bfdbb7866d72)]
+[builtinclass, uuid(f5f70897-2edf-4c00-a1c3-87d51b92cec5)]
 interface nsISpeculativeConnectionOverrider : nsISupports
 {
     /**
@@ -50,11 +50,4 @@ interface nsISpeculativeConnectionOverrider : nsISupports
      * connect via SPDY or not.
      */
     [infallible] readonly attribute boolean ignorePossibleSpdyConnections;
-
-    /**
-     * Used to determine if we will ignore the existence of any currently idle
-     * connections when we decide whether or not to make a speculative
-     * connection.
-     */
-    [infallible] readonly attribute boolean ignoreIdle;
 };
diff --git a/netwerk/base/src/Seer.cpp b/netwerk/base/src/Seer.cpp
index f024345f1831..85f0fbcdee85 100644
--- a/netwerk/base/src/Seer.cpp
+++ b/netwerk/base/src/Seer.cpp
@@ -305,13 +305,6 @@ Seer::Observe(nsISupports *subject, const char *topic,
 
 // Seer::nsISpeculativeConnectionOverrider
 
-NS_IMETHODIMP
-Seer::GetIgnoreIdle(bool *ignoreIdle)
-{
-  *ignoreIdle = true;
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 Seer::GetIgnorePossibleSpdyConnections(bool *ignorePossibleSpdyConnections)
 {
@@ -903,7 +896,7 @@ Seer::PredictForLink(nsIURI *targetURI, nsIURI *sourceURI,
     }
   }
 
-  mSpeculativeService->SpeculativeConnect(targetURI, this);
+  mSpeculativeService->SpeculativeConnect(targetURI, nullptr);
   if (verifier) {
     verifier->OnPredictPreconnect(targetURI);
   }
diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
index 05cd4c8ee39e..529702bf92d8 100644
--- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
@@ -334,7 +334,6 @@ public: // intentional!
 
     bool mOverridesOK;
     uint32_t mParallelSpeculativeConnectLimit;
-    bool mIgnoreIdle;
     bool mIgnorePossibleSpdyConnections;
 
     // As above, added manually so we can use nsRefPtr without inheriting from
@@ -381,7 +380,6 @@ nsHttpConnectionMgr::SpeculativeConnect(nsHttpConnectionInfo *ci,
         args->mOverridesOK = true;
         overrider->GetParallelSpeculativeConnectLimit(
             &args->mParallelSpeculativeConnectLimit);
-        overrider->GetIgnoreIdle(&args->mIgnoreIdle);
         overrider->GetIgnorePossibleSpdyConnections(
             &args->mIgnorePossibleSpdyConnections);
     }
@@ -2590,16 +2588,14 @@ nsHttpConnectionMgr::OnMsgSpeculativeConnect(int32_t, void *param)
     uint32_t parallelSpeculativeConnectLimit =
         gHttpHandler->ParallelSpeculativeConnectLimit();
     bool ignorePossibleSpdyConnections = false;
-    bool ignoreIdle = false;
 
     if (args->mOverridesOK) {
         parallelSpeculativeConnectLimit = args->mParallelSpeculativeConnectLimit;
         ignorePossibleSpdyConnections = args->mIgnorePossibleSpdyConnections;
-        ignoreIdle = args->mIgnoreIdle;
     }
 
     if (mNumHalfOpenConns < parallelSpeculativeConnectLimit &&
-        (ignoreIdle || !ent->mIdleConns.Length()) &&
+        ent->mIdleConns.Length() < parallelSpeculativeConnectLimit &&
         !RestrictConnections(ent, ignorePossibleSpdyConnections) &&
         !AtActiveConnectionLimit(ent, args->mTrans->Caps())) {
         CreateTransport(ent, args->mTrans, args->mTrans->Caps(), true);

From 79731ad42a6017c988b52954dd390c87fdc22854 Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Thu, 12 Dec 2013 19:27:55 +0000
Subject: [PATCH 036/459] Bug 920905 - DOMFile.name is used to show the
 filename in the b2g filepicker, r=fabrice

---
 b2g/components/FilePicker.js | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/b2g/components/FilePicker.js b/b2g/components/FilePicker.js
index e121a29433e7..1d04d961311a 100644
--- a/b2g/components/FilePicker.js
+++ b/b2g/components/FilePicker.js
@@ -32,6 +32,7 @@ const AUDIO_FILTERS = ['audio/basic', 'audio/L24', 'audio/mp4',
                        'audio/webm'];
 
 Cu.import('resource://gre/modules/XPCOMUtils.jsm');
+Cu.import("resource://gre/modules/FileUtils.jsm");
 
 XPCOMUtils.defineLazyServiceGetter(this, 'cpmm',
                                    '@mozilla.org/childprocessmessagemanager;1',
@@ -179,18 +180,39 @@ FilePicker.prototype = {
       return;
     }
 
-    var name = 'blob';
-    if (data.result.blob.type) {
-      let mimeSvc = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService);
-      let mimeInfo = mimeSvc.getFromTypeAndExtension(data.result.blob.type, '');
-      if (mimeInfo) {
-        name += '.' + mimeInfo.primaryExtension;
+    // The name to be shown can be part of the message, or can be taken from
+    // the DOMFile (if the blob is a DOMFile).
+    let name = data.result.name;
+    if (!name &&
+        (data.result.blob instanceof this.mParent.File) &&
+        data.result.blob.name) {
+      name = data.result.blob.name;
+    }
+
+    // Let's try to remove the full path and take just the filename.
+    if (name) {
+      let file = new FileUtils.File(data.result.blob.name);
+      if (file && file.leafName) {
+        name = file.leafName;
+      }
+    }
+
+    // the fallback is a filename composed by 'blob' + extension.
+    if (!name) {
+      name = 'blob';
+      if (data.result.blob.type) {
+        let mimeSvc = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService);
+        let mimeInfo = mimeSvc.getFromTypeAndExtension(data.result.blob.type, '');
+        if (mimeInfo) {
+          name += '.' + mimeInfo.primaryExtension;
+        }
       }
     }
 
     let file = new this.mParent.File(data.result.blob,
                                      { name: name,
                                        type: data.result.blob.type });
+
     if (file) {
       this.fireSuccess(file);
     } else {

From 919668270c84380d7ab446e379ca2b9198a93667 Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Thu, 12 Dec 2013 19:30:10 +0000
Subject: [PATCH 037/459] Bug 887836 - URLQuery object, r=khuey

---
 dom/base/URLSearchParams.cpp            | 236 ++++++++++++++++++++++++
 dom/base/URLSearchParams.h              |  76 ++++++++
 dom/base/moz.build                      |   2 +
 dom/base/test/mochitest.ini             |   1 +
 dom/base/test/test_urlSearchParams.html | 141 ++++++++++++++
 dom/bindings/Bindings.conf              |   5 +
 dom/webidl/URLSearchParams.webidl       |  26 +++
 dom/webidl/URLUtils.webidl              |   2 +-
 dom/webidl/moz.build                    |   1 +
 9 files changed, 489 insertions(+), 1 deletion(-)
 create mode 100644 dom/base/URLSearchParams.cpp
 create mode 100644 dom/base/URLSearchParams.h
 create mode 100644 dom/base/test/test_urlSearchParams.html
 create mode 100644 dom/webidl/URLSearchParams.webidl

diff --git a/dom/base/URLSearchParams.cpp b/dom/base/URLSearchParams.cpp
new file mode 100644
index 000000000000..af2f09371222
--- /dev/null
+++ b/dom/base/URLSearchParams.cpp
@@ -0,0 +1,236 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "URLSearchParams.h"
+#include "mozilla/dom/URLSearchParamsBinding.h"
+
+namespace mozilla {
+namespace dom {
+
+URLSearchParams::URLSearchParams()
+{
+}
+
+URLSearchParams::~URLSearchParams()
+{
+  DeleteAll();
+}
+
+JSObject*
+URLSearchParams::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
+{
+  return URLSearchParamsBinding::Wrap(aCx, aScope, this);
+}
+
+/* static */ already_AddRefed<URLSearchParams>
+URLSearchParams::Constructor(const GlobalObject& aGlobal,
+                             const nsAString& aInit,
+                             ErrorResult& aRv)
+{
+  nsRefPtr<URLSearchParams> sp = new URLSearchParams();
+  sp->ParseInput(aInit);
+  return sp.forget();
+}
+
+/* static */ already_AddRefed<URLSearchParams>
+URLSearchParams::Constructor(const GlobalObject& aGlobal,
+                             URLSearchParams& aInit,
+                             ErrorResult& aRv)
+{
+  nsRefPtr<URLSearchParams> sp = new URLSearchParams();
+  aInit.mSearchParams.EnumerateRead(CopyEnumerator, sp);
+  return sp.forget();
+}
+
+void
+URLSearchParams::ParseInput(const nsAString& aInput)
+{
+  nsAString::const_iterator start, end;
+  aInput.BeginReading(start);
+  aInput.EndReading(end);
+  nsAString::const_iterator iter(start);
+
+  while (start != end) {
+    nsAutoString string;
+
+    if (FindCharInReadable('&', iter, end)) {
+      string.Assign(Substring(start, iter));
+      start = ++iter;
+    } else {
+      string.Assign(Substring(start, end));
+      start = end;
+    }
+
+    if (string.IsEmpty()) {
+      continue;
+    }
+
+    nsAString::const_iterator eqStart, eqEnd;
+    string.BeginReading(eqStart);
+    string.EndReading(eqEnd);
+    nsAString::const_iterator eqIter(eqStart);
+
+    nsAutoString name;
+    nsAutoString value;
+
+    if (FindCharInReadable('=', eqIter, eqEnd)) {
+      name.Assign(Substring(eqStart, eqIter));
+
+      ++eqIter;
+      value.Assign(Substring(eqIter, eqEnd));
+    } else {
+      name.Assign(string);
+    }
+
+    nsAutoString decodedName;
+    DecodeString(name, decodedName);
+
+    nsAutoString decodedValue;
+    DecodeString(value, decodedValue);
+
+    Append(decodedName, decodedValue);
+  }
+}
+
+void
+URLSearchParams::DecodeString(const nsAString& aInput, nsAString& aOutput)
+{
+  nsAString::const_iterator start, end;
+  aInput.BeginReading(start);
+  aInput.EndReading(end);
+
+  while (start != end) {
+    // replace '+' with U+0020
+    if (*start == '+') {
+      aOutput.Append(' ');
+      ++start;
+      continue;
+    }
+
+    // Percent decode algorithm
+    if (*start == '%') {
+      nsAString::const_iterator first(start);
+      ++first;
+
+      nsAString::const_iterator second(first);
+      ++second;
+
+#define ASCII_HEX_DIGIT( x )    \
+  ((x >= 0x41 && x <= 0x46) ||  \
+   (x >= 0x61 && x <= 0x66) ||  \
+   (x >= 0x30 && x <= 0x39))
+
+#define HEX_DIGIT( x )              \
+   (*x >= 0x30 && *x <= 0x39        \
+     ? *x - 0x30                    \
+     : (*x >= 0x41 && *x <= 0x46    \
+        ? *x - 0x37                 \
+        : *x - 0x57))
+
+      if (first != end && second != end &&
+          ASCII_HEX_DIGIT(*first) && ASCII_HEX_DIGIT(*second)) {
+        aOutput.Append(HEX_DIGIT(first) * 16 + HEX_DIGIT(second));
+        start = ++second;
+        continue;
+
+      } else {
+        aOutput.Append('%');
+        ++start;
+        continue;
+      }
+    }
+
+    aOutput.Append(*start);
+    ++start;
+  }
+}
+
+/* static */ PLDHashOperator
+URLSearchParams::CopyEnumerator(const nsAString& aName,
+                                nsTArray<nsString>* aArray,
+                                void *userData)
+{
+  URLSearchParams* aSearchParams = static_cast<URLSearchParams*>(userData);
+
+  nsTArray<nsString>* newArray = new nsTArray<nsString>();
+  newArray->AppendElements(*aArray);
+
+  aSearchParams->mSearchParams.Put(aName, newArray);
+  return PL_DHASH_NEXT;
+}
+
+void
+URLSearchParams::Get(const nsAString& aName, nsString& aRetval)
+{
+  nsTArray<nsString>* array;
+  if (!mSearchParams.Get(aName, &array)) {
+    aRetval.Truncate();
+    return;
+  }
+
+  aRetval.Assign(array->ElementAt(0));
+}
+
+void
+URLSearchParams::GetAll(const nsAString& aName, nsTArray<nsString>& aRetval)
+{
+  nsTArray<nsString>* array;
+  if (!mSearchParams.Get(aName, &array)) {
+    return;
+  }
+
+  aRetval.AppendElements(*array);
+}
+
+void
+URLSearchParams::Set(const nsAString& aName, const nsAString& aValue)
+{
+  nsTArray<nsString>* array;
+  if (!mSearchParams.Get(aName, &array)) {
+    array = new nsTArray<nsString>();
+    array->AppendElement(aValue);
+    mSearchParams.Put(aName, array);
+  } else {
+    array->ElementAt(0) = aValue;
+  }
+}
+
+void
+URLSearchParams::Append(const nsAString& aName, const nsAString& aValue)
+{
+  nsTArray<nsString>* array;
+  if (!mSearchParams.Get(aName, &array)) {
+    array = new nsTArray<nsString>();
+    mSearchParams.Put(aName, array);
+  }
+
+  array->AppendElement(aValue);
+}
+
+bool
+URLSearchParams::Has(const nsAString& aName)
+{
+  return mSearchParams.Get(aName, nullptr);
+}
+
+void
+URLSearchParams::Delete(const nsAString& aName)
+{
+  nsTArray<nsString>* array;
+  if (!mSearchParams.Get(aName, &array)) {
+    return;
+  }
+
+  mSearchParams.Remove(aName);
+}
+
+void
+URLSearchParams::DeleteAll()
+{
+  mSearchParams.Clear();
+}
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/base/URLSearchParams.h b/dom/base/URLSearchParams.h
new file mode 100644
index 000000000000..90c3d579a94f
--- /dev/null
+++ b/dom/base/URLSearchParams.h
@@ -0,0 +1,76 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_URLSearchParams_h
+#define mozilla_dom_URLSearchParams_h
+
+#include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/ErrorResult.h"
+#include "nsClassHashtable.h"
+#include "nsHashKeys.h"
+
+namespace mozilla {
+namespace dom {
+
+class URLSearchParams MOZ_FINAL
+{
+public:
+  NS_INLINE_DECL_REFCOUNTING(URL)
+
+  URLSearchParams();
+  ~URLSearchParams();
+
+  // WebIDL methods
+  nsISupports* GetParentObject() const
+  {
+    return nullptr;
+  }
+
+  JSObject*
+  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope);
+
+  static already_AddRefed<URLSearchParams>
+  Constructor(const GlobalObject& aGlobal, const nsAString& aInit,
+              ErrorResult& aRv);
+
+  static already_AddRefed<URLSearchParams>
+  Constructor(const GlobalObject& aGlobal, URLSearchParams& aInit,
+              ErrorResult& aRv);
+
+  void Get(const nsAString& aName, nsString& aRetval);
+
+  void GetAll(const nsAString& aName, nsTArray<nsString >& aRetval);
+
+  void Set(const nsAString& aName, const nsAString& aValue);
+
+  void Append(const nsAString& aName, const nsAString& aValue);
+
+  bool Has(const nsAString& aName);
+
+  void Delete(const nsAString& aName);
+
+  uint32_t Size() const
+  {
+    return mSearchParams.Count();
+  }
+
+private:
+  void ParseInput(const nsAString& aInput);
+
+  void DeleteAll();
+
+  void DecodeString(const nsAString& aInput, nsAString& aOutput);
+
+  static PLDHashOperator
+  CopyEnumerator(const nsAString& aName, nsTArray<nsString>* aArray,
+                 void *userData);
+
+  nsClassHashtable<nsStringHashKey, nsTArray<nsString>> mSearchParams;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif /* mozilla_dom_URLSearchParams_h */
diff --git a/dom/base/moz.build b/dom/base/moz.build
index dc8c53494e92..b6c0ee9cd98a 100644
--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -62,6 +62,7 @@ EXPORTS.mozilla.dom += [
     'ScriptSettings.h',
     'StructuredCloneTags.h',
     'URL.h',
+    'URLSearchParams.h',
 ]
 
 UNIFIED_SOURCES += [
@@ -97,6 +98,7 @@ UNIFIED_SOURCES += [
     'nsWrapperCache.cpp',
     'ScriptSettings.cpp',
     'URL.cpp',
+    'URLSearchParams.cpp',
     'WindowNamedPropertiesHandler.cpp',
 ]
 
diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index 6b6403f395aa..51ded34a81c5 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -44,3 +44,4 @@ support-files =
 [test_openDialogChromeOnly.html]
 [test_messagemanager_targetchain.html]
 [test_url_empty_port.html]
+[test_urlSearchParams.html]
diff --git a/dom/base/test/test_urlSearchParams.html b/dom/base/test/test_urlSearchParams.html
new file mode 100644
index 000000000000..a6a4c18f563e
--- /dev/null
+++ b/dom/base/test/test_urlSearchParams.html
@@ -0,0 +1,141 @@
+
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=887836
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 887836</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=887836">Mozilla Bug 887836</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  <iframe name="x" id="x"></iframe>
+  <iframe name="y" id="y"></iframe>
+</div>
+<pre id="test">
+</pre>
+  <script type="application/javascript">
+
+  /** Test for Bug 887836 **/
+  ok("URLSearchParams" in window, "window.URLSearchParams exists");
+
+  function testSimpleURLSearchParams() {
+    var u = new URLSearchParams();
+    ok(u, "URLSearchParams created");
+    is(u.has('foo'), false, 'URLSearchParams.has(foo)');
+    is(u.get('foo'), '', 'URLSearchParams.get(foo)');
+    is(u.getAll('foo').length, 0, 'URLSearchParams.getAll(foo)');
+    is(u.size, 0, 'URLSearchParams.size()');
+
+    u.append('foo', 'bar');
+    is(u.has('foo'), true, 'URLSearchParams.has(foo)');
+    is(u.get('foo'), 'bar', 'URLSearchParams.get(foo)');
+    is(u.getAll('foo').length, 1, 'URLSearchParams.getAll(foo)');
+    is(u.size, 1, 'URLSearchParams.size()');
+
+    u.set('foo', 'bar2');
+    is(u.get('foo'), 'bar2', 'URLSearchParams.get(foo)');
+    is(u.getAll('foo').length, 1, 'URLSearchParams.getAll(foo)');
+    is(u.size, 1, 'URLSearchParams.size()');
+
+    u.delete('foo');
+    is(u.size, 0, 'URLSearchParams.size()');
+
+    runTest();
+  }
+
+  function testCopyURLSearchParams() {
+    var u = new URLSearchParams();
+    ok(u, "URLSearchParams created");
+    u.append('foo', 'bar');
+    is(u.size, 1, "u.size()");
+
+    var uu = new URLSearchParams(u);
+    is(uu.size, 1, "uu.size()");
+    is(uu.get('foo'), 'bar', 'uu.get()');
+
+    u.append('foo', 'bar2');
+    is(u.getAll('foo').length, 2, "u.getAll()");
+    is(uu.getAll('foo').length, 1, "uu.getAll()");
+
+    runTest();
+  }
+
+  function testParserURLSearchParams() {
+    var checks = [
+      { input: '', data: {} },
+      { input: 'a', data: { 'a' : [''] } },
+      { input: 'a=b', data: { 'a' : ['b'] } },
+      { input: 'a=', data: { 'a' : [''] } },
+      { input: '=b', data: { '' : ['b'] } },
+      { input: '&', data: {} },
+      { input: '&a', data: { 'a' : [''] } },
+      { input: 'a&', data: { 'a' : [''] } },
+      { input: 'a&a', data: { 'a' : ['', ''] } },
+      { input: 'a&b&c', data: { 'a' : [''], 'b' : [''], 'c' : [''] } },
+      { input: 'a=b&c=d', data: { 'a' : ['b'], 'c' : ['d'] } },
+      { input: 'a=b&c=d&', data: { 'a' : ['b'], 'c' : ['d'] } },
+      { input: '&&&a=b&&&&c=d&', data: { 'a' : ['b'], 'c' : ['d'] } },
+      { input: 'a=a&a=b&a=c', data: { 'a' : ['a', 'b', 'c'] } },
+      { input: 'a==a', data: { 'a' : ['=a'] } },
+      { input: 'a=a+b+c+d', data: { 'a' : ['a b c d'] } },
+      { input: '%=a', data: { '%' : ['a'] } },
+      { input: '%a=a', data: { '%a' : ['a'] } },
+      { input: '%a_=a', data: { '%a_' : ['a'] } },
+      { input: '%61=a', data: { 'a' : ['a'] } },
+      { input: '%=a', data: { '%' : ['a'] } },
+      { input: '%a=a', data: { '%a' : ['a'] } },
+      { input: '%a_=a', data: { '%a_' : ['a'] } },
+      { input: '%61=a', data: { 'a' : ['a'] } },
+      { input: '%61+%4d%4D=', data: { 'a MM' : [''] } },
+    ];
+
+    for (var i = 0; i < checks.length; ++i) {
+      var u = new URLSearchParams(checks[i].input);
+
+      var count = 0;
+      for (var key in checks[i].data) {
+        ++count;
+        ok(u.has(key), "key " + key + " found");
+
+        var all = u.getAll(key);
+        is(all.length, checks[i].data[key].length, "same number of elements");
+
+        for (var k = 0; k < all.length; ++k) {
+          is(all[k], checks[i].data[key][k], "value matches");
+        }
+      }
+
+      is(u.size, count, "size matches");
+    }
+
+    runTest();
+  }
+
+  var tests = [
+    testSimpleURLSearchParams,
+    testCopyURLSearchParams,
+    testParserURLSearchParams
+  ];
+
+  function runTest() {
+    if (!tests.length) {
+      SimpleTest.finish();
+      return;
+    }
+
+    var test = tests.shift();
+    test();
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  runTest();
+
+  </script>
+</body>
+</html>
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index 807edf96001a..8603e0f2f360 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1290,6 +1290,11 @@ DOMInterfaces = {
     'nativeOwnership': 'owned',
 }],
 
+'URLSearchParams' : {
+    'wrapperCache' : False,
+    'nativeOwnership': 'refcounted',
+},
+
 'VTTCue': {
     'nativeType': 'mozilla::dom::TextTrackCue'
 },
diff --git a/dom/webidl/URLSearchParams.webidl b/dom/webidl/URLSearchParams.webidl
new file mode 100644
index 000000000000..7d4d99a309e4
--- /dev/null
+++ b/dom/webidl/URLSearchParams.webidl
@@ -0,0 +1,26 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://url.spec.whatwg.org/#urlsearchparams
+ *
+ * To the extent possible under law, the editors have waived all copyright
+ * and related or neighboring rights to this work. In addition, as of 17
+ * February 2013, the editors have made this specification available under
+ * the Open Web Foundation Agreement Version 1.0, which is available at
+ * http://www.openwebfoundation.org/legal/the-owf-1-0-agreements/owfa-1-0.
+ */
+
+[Constructor(optional DOMString init = ""),
+ Constructor(URLSearchParams init)]
+interface URLSearchParams {
+  DOMString? get(DOMString name);
+  sequence<DOMString> getAll(DOMString name);
+  void set(DOMString name, DOMString value);
+  void append(DOMString name, DOMString value);
+  boolean has(DOMString name);
+  void delete(DOMString name);
+  readonly attribute unsigned long size;
+};
diff --git a/dom/webidl/URLUtils.webidl b/dom/webidl/URLUtils.webidl
index 338a61eabd02..ddd690ccef05 100644
--- a/dom/webidl/URLUtils.webidl
+++ b/dom/webidl/URLUtils.webidl
@@ -27,7 +27,7 @@ interface URLUtils {
            attribute DOMString port;
            attribute DOMString pathname;
            attribute DOMString search;
-           // attribute URLQuery? query;
+           // attribute URLSearchParams? searchParams;
            attribute DOMString hash;
 };
 
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index abcd6a2cbe59..108b38a1b3ec 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -407,6 +407,7 @@ WEBIDL_FILES = [
     'UIEvent.webidl',
     'UndoManager.webidl',
     'URL.webidl',
+    'URLSearchParams.webidl',
     'URLUtils.webidl',
     'URLUtilsReadOnly.webidl',
     'ValidityState.webidl',

From 41741d7eb0ad7be74cfb1338ba502947d9bd7f7c Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Thu, 12 Dec 2013 19:30:20 +0000
Subject: [PATCH 038/459] Bug 887836 - patch 2 - URLQuery in workers, r=khuey

---
 dom/workers/RegisterBindings.cpp           |   2 +
 dom/workers/test/mochitest.ini             |   2 +
 dom/workers/test/test_urlSearchParams.html |  43 +++++++
 dom/workers/test/urlSearchparams_worker.js | 133 +++++++++++++++++++++
 4 files changed, 180 insertions(+)
 create mode 100644 dom/workers/test/test_urlSearchParams.html
 create mode 100644 dom/workers/test/urlSearchparams_worker.js

diff --git a/dom/workers/RegisterBindings.cpp b/dom/workers/RegisterBindings.cpp
index 68ec92ee546c..a40dc6b100ae 100644
--- a/dom/workers/RegisterBindings.cpp
+++ b/dom/workers/RegisterBindings.cpp
@@ -26,6 +26,7 @@
 #include "mozilla/dom/XMLHttpRequestBinding.h"
 #include "mozilla/dom/XMLHttpRequestUploadBinding.h"
 #include "mozilla/dom/URLBinding.h"
+#include "mozilla/dom/URLSearchParamsBinding.h"
 #include "mozilla/dom/WorkerBinding.h"
 #include "mozilla/dom/WorkerLocationBinding.h"
 #include "mozilla/dom/WorkerNavigatorBinding.h"
@@ -70,6 +71,7 @@ WorkerPrivate::RegisterBindings(JSContext* aCx, JS::Handle<JSObject*> aGlobal)
       !XMLHttpRequestBinding_workers::GetConstructorObject(aCx, aGlobal) ||
       !XMLHttpRequestUploadBinding_workers::GetConstructorObject(aCx, aGlobal) ||
       !URLBinding_workers::GetConstructorObject(aCx, aGlobal) ||
+      !URLSearchParamsBinding::GetConstructorObject(aCx, global) ||
       !WorkerBinding::GetConstructorObject(aCx, aGlobal) ||
       !WorkerLocationBinding_workers::GetConstructorObject(aCx, aGlobal) ||
       !WorkerNavigatorBinding_workers::GetConstructorObject(aCx, aGlobal)) {
diff --git a/dom/workers/test/mochitest.ini b/dom/workers/test/mochitest.ini
index 422f786c2386..493592dd8b92 100644
--- a/dom/workers/test/mochitest.ini
+++ b/dom/workers/test/mochitest.ini
@@ -57,6 +57,7 @@ support-files =
   xhr_worker.js
   url_exceptions_worker.js
   jsversion_worker.js
+  urlSearchParams_worker.js
 
 [test_404.html]
 [test_atob.html]
@@ -114,4 +115,5 @@ support-files =
 [test_xhr_system.html]
 [test_xhr_system.js]
 [test_url_exceptions.html]
+[test_urlSearchParams.html]
 [test_jsversion.html]
diff --git a/dom/workers/test/test_urlSearchParams.html b/dom/workers/test/test_urlSearchParams.html
new file mode 100644
index 000000000000..5635b4640d98
--- /dev/null
+++ b/dom/workers/test/test_urlSearchParams.html
@@ -0,0 +1,43 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for URLSearchParams object in workers</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none"></div>
+<pre id="test"></pre>
+<script class="testbody" type="text/javascript">
+
+  var worker = new Worker("urlSearchParams_worker.js");
+
+  worker.onmessage = function(event) {
+    is(event.target, worker);
+
+    if (event.data.type == 'finish') {
+      SimpleTest.finish();
+    } else if (event.data.type == 'status') {
+      ok(event.data.status, event.data.msg);
+    }
+  };
+
+  worker.onerror = function(event) {
+    is(event.target, worker);
+    ok(false, "Worker had an error: " + event.data);
+    SimpleTest.finish();
+  };
+
+  worker.postMessage(true);
+
+  SimpleTest.waitForExplicitFinish();
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/workers/test/urlSearchparams_worker.js b/dom/workers/test/urlSearchparams_worker.js
new file mode 100644
index 000000000000..bec0ea83fb37
--- /dev/null
+++ b/dom/workers/test/urlSearchparams_worker.js
@@ -0,0 +1,133 @@
+function ok(a, msg) {
+  dump("OK: " + !!a + "  =>  " + a + " " + msg + "\n");
+  postMessage({type: 'status', status: !!a, msg: a + ": " + msg });
+}
+
+function is(a, b, msg) {
+  dump("IS: " + (a===b) + "  =>  " + a + " | " + b + " " + msg + "\n");
+  postMessage({type: 'status', status: a === b, msg: a + " === " + b + ": " + msg });
+}
+
+onmessage = function() {
+  status = false;
+  try {
+    if ((URLSearchParams instanceof Object)) {
+      status = true;
+    }
+  } catch(e) {
+  }
+  ok(status, "URLSearchParams in workers \\o/");
+
+  function testSimpleURLSearchParams() {
+    var u = new URLSearchParams();
+    ok(u, "URLSearchParams created");
+    is(u.has('foo'), false, 'URLSearchParams.has(foo)');
+    is(u.get('foo'), '', 'URLSearchParams.get(foo)');
+    is(u.getAll('foo').length, 0, 'URLSearchParams.getAll(foo)');
+    is(u.size, 0, 'URLSearchParams.size()');
+
+    u.append('foo', 'bar');
+    is(u.has('foo'), true, 'URLSearchParams.has(foo)');
+    is(u.get('foo'), 'bar', 'URLSearchParams.get(foo)');
+    is(u.getAll('foo').length, 1, 'URLSearchParams.getAll(foo)');
+    is(u.size, 1, 'URLSearchParams.size()');
+
+    u.set('foo', 'bar2');
+    is(u.get('foo'), 'bar2', 'URLSearchParams.get(foo)');
+    is(u.getAll('foo').length, 1, 'URLSearchParams.getAll(foo)');
+    is(u.size, 1, 'URLSearchParams.size()');
+
+    u.delete('foo');
+    is(u.size, 0, 'URLSearchParams.size()');
+
+    runTest();
+  }
+
+  function testCopyURLSearchParams() {
+    var u = new URLSearchParams();
+    ok(u, "URLSearchParams created");
+    u.append('foo', 'bar');
+    is(u.size, 1, "u.size()");
+
+    var uu = new URLSearchParams(u);
+    is(uu.size, 1, "uu.size()");
+    is(uu.get('foo'), 'bar', 'uu.get()');
+
+    u.append('foo', 'bar2');
+    is(u.getAll('foo').length, 2, "u.getAll()");
+    is(uu.getAll('foo').length, 1, "uu.getAll()");
+
+    runTest();
+  }
+
+  function testParserURLSearchParams() {
+    var checks = [
+      { input: '', data: {} },
+      { input: 'a', data: { 'a' : [''] } },
+      { input: 'a=b', data: { 'a' : ['b'] } },
+      { input: 'a=', data: { 'a' : [''] } },
+      { input: '=b', data: { '' : ['b'] } },
+      { input: '&', data: {} },
+      { input: '&a', data: { 'a' : [''] } },
+      { input: 'a&', data: { 'a' : [''] } },
+      { input: 'a&a', data: { 'a' : ['', ''] } },
+      { input: 'a&b&c', data: { 'a' : [''], 'b' : [''], 'c' : [''] } },
+      { input: 'a=b&c=d', data: { 'a' : ['b'], 'c' : ['d'] } },
+      { input: 'a=b&c=d&', data: { 'a' : ['b'], 'c' : ['d'] } },
+      { input: '&&&a=b&&&&c=d&', data: { 'a' : ['b'], 'c' : ['d'] } },
+      { input: 'a=a&a=b&a=c', data: { 'a' : ['a', 'b', 'c'] } },
+      { input: 'a==a', data: { 'a' : ['=a'] } },
+      { input: 'a=a+b+c+d', data: { 'a' : ['a b c d'] } },
+      { input: '%=a', data: { '%' : ['a'] } },
+      { input: '%a=a', data: { '%a' : ['a'] } },
+      { input: '%a_=a', data: { '%a_' : ['a'] } },
+      { input: '%61=a', data: { 'a' : ['a'] } },
+      { input: '%=a', data: { '%' : ['a'] } },
+      { input: '%a=a', data: { '%a' : ['a'] } },
+      { input: '%a_=a', data: { '%a_' : ['a'] } },
+      { input: '%61=a', data: { 'a' : ['a'] } },
+      { input: '%61+%4d%4D=', data: { 'a MM' : [''] } },
+    ];
+
+    for (var i = 0; i < checks.length; ++i) {
+      var u = new URLSearchParams(checks[i].input);
+
+      var count = 0;
+      for (var key in checks[i].data) {
+        ++count;
+        ok(u.has(key), "key " + key + " found");
+
+        var all = u.getAll(key);
+        is(all.length, checks[i].data[key].length, "same number of elements");
+
+        for (var k = 0; k < all.length; ++k) {
+          is(all[k], checks[i].data[key][k], "value matches");
+        }
+      }
+
+      is(u.size, count, "size matches");
+    }
+
+    runTest();
+  }
+
+  var tests = [
+    testSimpleURLSearchParams,
+    testCopyURLSearchParams,
+    testParserURLSearchParams
+  ];
+
+  function runTest() {
+    if (!tests.length) {
+      postMessage({type: 'finish' });
+      return;
+    }
+
+    var test = tests.shift();
+    test();
+  }
+
+  runTest();
+}
+
+

From aeb5063aca149161e54fe57fe5dded8f655898ef Mon Sep 17 00:00:00 2001
From: Andrea Marchesini <amarchesini@mozilla.com>
Date: Thu, 12 Dec 2013 19:30:27 +0000
Subject: [PATCH 039/459] Bug 887836 - URLSearchParams and URL, r=ehsan, r=bz,
 r=smaug

--HG--
rename : dom/workers/test/urlSearchparams_worker.js => dom/workers/test/urlSearchParams_worker.js
---
 content/base/src/Link.cpp                     |  94 ++++++++-
 content/base/src/Link.h                       |  20 +-
 .../html/content/src/HTMLAnchorElement.cpp    |  22 +-
 content/html/content/src/HTMLAnchorElement.h  |  30 +--
 content/html/content/src/HTMLAreaElement.cpp  |  22 +-
 content/html/content/src/HTMLAreaElement.h    |  34 ++-
 content/html/content/src/HTMLLinkElement.cpp  |   2 +
 content/svg/content/src/SVGAElement.cpp       |  26 ++-
 content/svg/content/src/SVGAElement.h         |   1 +
 dom/base/URL.cpp                              |  89 ++++++++
 dom/base/URL.h                                |  19 +-
 dom/base/URLSearchParams.cpp                  | 193 ++++++++++++++++--
 dom/base/URLSearchParams.h                    |  64 +++++-
 dom/base/test/test_urlSearchParams.html       | 102 ++++++++-
 dom/bindings/Bindings.conf                    |   6 -
 .../mochitest/general/test_interfaces.html    |   1 +
 dom/webidl/URLUtils.webidl                    |   2 +-
 dom/workers/RegisterBindings.cpp              |   2 +-
 dom/workers/URL.cpp                           |  91 ++++++++-
 dom/workers/URL.h                             |  24 ++-
 ...ms_worker.js => urlSearchParams_worker.js} |  65 +++++-
 .../components/places/tests/cpp/mock_Link.h   | 129 ++++++++++++
 22 files changed, 935 insertions(+), 103 deletions(-)
 rename dom/workers/test/{urlSearchparams_worker.js => urlSearchParams_worker.js} (64%)

diff --git a/content/base/src/Link.cpp b/content/base/src/Link.cpp
index ef63ddefcf68..d5389a7490b2 100644
--- a/content/base/src/Link.cpp
+++ b/content/base/src/Link.cpp
@@ -214,7 +214,16 @@ Link::SetPathname(const nsAString &aPathname)
 }
 
 void
-Link::SetSearch(const nsAString &aSearch)
+Link::SetSearch(const nsAString& aSearch)
+{
+  SetSearchInternal(aSearch);
+  if (mSearchParams) {
+    mSearchParams->Invalidate();
+  }
+}
+
+void
+Link::SetSearchInternal(const nsAString& aSearch)
 {
   nsCOMPtr<nsIURI> uri(GetURIToMutate());
   nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
@@ -478,6 +487,9 @@ Link::ResetLinkState(bool aNotify, bool aHasHref)
 
   // If we've cached the URI, reset always invalidates it.
   mCachedURI = nullptr;
+  if (mSearchParams) {
+    mSearchParams->Invalidate();
+  }
 
   // Update our state back to the default.
   mLinkState = defaultState;
@@ -563,5 +575,85 @@ Link::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
   return n;
 }
 
+URLSearchParams*
+Link::GetSearchParams()
+{
+  CreateSearchParamsIfNeeded();
+  return mSearchParams;
+}
+
+void
+Link::SetSearchParams(URLSearchParams* aSearchParams)
+{
+  if (!aSearchParams) {
+    return;
+  }
+
+  if (!aSearchParams->HasURLAssociated()) {
+    MOZ_ASSERT(aSearchParams->IsValid());
+
+    mSearchParams = aSearchParams;
+    mSearchParams->SetObserver(this);
+  } else {
+    CreateSearchParamsIfNeeded();
+    mSearchParams->CopyFromURLSearchParams(*aSearchParams);
+  }
+
+  nsAutoString search;
+  mSearchParams->Serialize(search);
+  SetSearchInternal(search);
+}
+
+void
+Link::URLSearchParamsUpdated()
+{
+  MOZ_ASSERT(mSearchParams && mSearchParams->IsValid());
+
+  nsString search;
+  mSearchParams->Serialize(search);
+  SetSearchInternal(search);
+}
+
+void
+Link::URLSearchParamsNeedsUpdates()
+{
+  MOZ_ASSERT(mSearchParams);
+
+  nsAutoCString search;
+  nsCOMPtr<nsIURI> uri(GetURI());
+  nsCOMPtr<nsIURL> url(do_QueryInterface(uri));
+  if (url) {
+    nsresult rv = url->GetQuery(search);
+    if (NS_FAILED(rv)) {
+      NS_WARNING("Failed to get the query from a nsIURL.");
+    }
+  }
+
+  mSearchParams->ParseInput(search);
+}
+
+void
+Link::CreateSearchParamsIfNeeded()
+{
+  if (!mSearchParams) {
+    mSearchParams = new URLSearchParams();
+    mSearchParams->SetObserver(this);
+    mSearchParams->Invalidate();
+  }
+}
+
+void
+Link::Unlink()
+{
+  mSearchParams = nullptr;
+}
+
+void
+Link::Traverse(nsCycleCollectionTraversalCallback &cb)
+{
+  Link* tmp = this;
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSearchParams);
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/content/base/src/Link.h b/content/base/src/Link.h
index 163bf746f7cb..a297bd693976 100644
--- a/content/base/src/Link.h
+++ b/content/base/src/Link.h
@@ -13,6 +13,7 @@
 
 #include "mozilla/IHistory.h"
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/dom/URLSearchParams.h"
 #include "nsEventStates.h"
 #include "nsIContent.h"
 
@@ -25,7 +26,7 @@ class Element;
 { 0xb25edee6, 0xdd35, 0x4f8b,                             \
   { 0xab, 0x90, 0x66, 0xd0, 0xbd, 0x3c, 0x22, 0xd5 } }
 
-class Link : public nsISupports
+class Link : public URLSearchParamsObserver
 {
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(MOZILLA_DOM_LINK_IMPLEMENTATION_IID)
@@ -61,6 +62,7 @@ public:
   void SetHostname(const nsAString &aHostname);
   void SetPathname(const nsAString &aPathname);
   void SetSearch(const nsAString &aSearch);
+  void SetSearchParams(mozilla::dom::URLSearchParams* aSearchParams);
   void SetPort(const nsAString &aPort);
   void SetHash(const nsAString &aHash);
   void GetOrigin(nsAString &aOrigin);
@@ -71,6 +73,7 @@ public:
   void GetHostname(nsAString &_hostname);
   void GetPathname(nsAString &_pathname);
   void GetSearch(nsAString &_search);
+  URLSearchParams* GetSearchParams();
   void GetPort(nsAString &_port);
   void GetHash(nsAString &_hash);
 
@@ -109,6 +112,10 @@ public:
 
   bool ElementHasHref() const;
 
+  // URLSearchParamsObserver
+  void URLSearchParamsUpdated() MOZ_OVERRIDE;
+  void URLSearchParamsNeedsUpdates() MOZ_OVERRIDE;
+
 protected:
   virtual ~Link();
 
@@ -127,6 +134,10 @@ protected:
   nsIURI* GetCachedURI() const { return mCachedURI; }
   bool HasCachedURI() const { return !!mCachedURI; }
 
+  // CC methods
+  void Unlink();
+  void Traverse(nsCycleCollectionTraversalCallback &cb);
+
 private:
   /**
    * Unregisters from History so this node no longer gets notifications about
@@ -137,6 +148,10 @@ private:
   already_AddRefed<nsIURI> GetURIToMutate();
   void SetHrefAttribute(nsIURI *aURI);
 
+  void CreateSearchParamsIfNeeded();
+
+  void SetSearchInternal(const nsAString& aSearch);
+
   mutable nsCOMPtr<nsIURI> mCachedURI;
 
   Element * const mElement;
@@ -150,6 +165,9 @@ private:
   bool mNeedsRegistration;
 
   bool mRegistered;
+
+protected:
+  nsRefPtr<URLSearchParams> mSearchParams;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(Link, MOZILLA_DOM_LINK_IMPLEMENTATION_IID)
diff --git a/content/html/content/src/HTMLAnchorElement.cpp b/content/html/content/src/HTMLAnchorElement.cpp
index b70ad2905f44..9d599c9303a2 100644
--- a/content/html/content/src/HTMLAnchorElement.cpp
+++ b/content/html/content/src/HTMLAnchorElement.cpp
@@ -41,8 +41,26 @@ HTMLAnchorElement::~HTMLAnchorElement()
 {
 }
 
-NS_IMPL_ISUPPORTS_INHERITED2(HTMLAnchorElement, nsGenericHTMLElement,
-                             nsIDOMHTMLAnchorElement, Link)
+NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(HTMLAnchorElement)
+  NS_INTERFACE_TABLE_INHERITED2(HTMLAnchorElement,
+                                nsIDOMHTMLAnchorElement,
+                                Link)
+NS_INTERFACE_TABLE_TAIL_INHERITING(nsGenericHTMLElement)
+
+NS_IMPL_ADDREF_INHERITED(HTMLAnchorElement, Element)
+NS_IMPL_RELEASE_INHERITED(HTMLAnchorElement, Element)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLAnchorElement)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLAnchorElement,
+                                                  nsGenericHTMLElement)
+  tmp->Link::Traverse(cb);
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLAnchorElement,
+                                                nsGenericHTMLElement)
+  tmp->Link::Unlink();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ELEMENT_CLONE(HTMLAnchorElement)
 
diff --git a/content/html/content/src/HTMLAnchorElement.h b/content/html/content/src/HTMLAnchorElement.h
index 39ee17bc47cd..751b541537a6 100644
--- a/content/html/content/src/HTMLAnchorElement.h
+++ b/content/html/content/src/HTMLAnchorElement.h
@@ -33,6 +33,10 @@ public:
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
+  // CC
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(HTMLAnchorElement,
+                                           nsGenericHTMLElement)
+
   virtual int32_t TabIndexDefault() MOZ_OVERRIDE;
   virtual bool Draggable() const MOZ_OVERRIDE;
 
@@ -135,30 +139,14 @@ public:
     rv = SetText(aValue);
   }
 
-  void GetOrigin(nsAString& aOrigin)
-  {
-    Link::GetOrigin(aOrigin);
-  }
+  // Link::GetOrigin is OK for us
 
-  void GetUsername(nsAString& aUsername)
-  {
-    Link::GetUsername(aUsername);
-  }
+  // Link::GetUsername is OK for us
+  // Link::SetUsername is OK for us
 
-  void SetUsername(const nsAString& aUsername)
-  {
-    Link::SetUsername(aUsername);
-  }
+  // Link::Getpassword is OK for us
+  // Link::Setpassword is OK for us
 
-  void GetPassword(nsAString& aPassword)
-  {
-    Link::GetPassword(aPassword);
-  }
-
-  void SetPassword(const nsAString& aPassword)
-  {
-    Link::SetPassword(aPassword);
-  }
   // The XPCOM URI decomposition attributes are fine for us
   void GetCoords(nsString& aValue)
   {
diff --git a/content/html/content/src/HTMLAreaElement.cpp b/content/html/content/src/HTMLAreaElement.cpp
index d7ebcbd088c4..3cc9b7331d37 100644
--- a/content/html/content/src/HTMLAreaElement.cpp
+++ b/content/html/content/src/HTMLAreaElement.cpp
@@ -25,8 +25,26 @@ HTMLAreaElement::~HTMLAreaElement()
 {
 }
 
-NS_IMPL_ISUPPORTS_INHERITED2(HTMLAreaElement, nsGenericHTMLElement,
-                             nsIDOMHTMLAreaElement, Link)
+NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(HTMLAreaElement)
+  NS_INTERFACE_TABLE_INHERITED2(HTMLAreaElement,
+                                nsIDOMHTMLAreaElement,
+                                Link)
+NS_INTERFACE_TABLE_TAIL_INHERITING(nsGenericHTMLElement)
+
+NS_IMPL_ADDREF_INHERITED(HTMLAreaElement, Element)
+NS_IMPL_RELEASE_INHERITED(HTMLAreaElement, Element)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLAreaElement)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLAreaElement,
+                                                  nsGenericHTMLElement)
+  tmp->Link::Traverse(cb);
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLAreaElement,
+                                                nsGenericHTMLElement)
+  tmp->Link::Unlink();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ELEMENT_CLONE(HTMLAreaElement)
 
diff --git a/content/html/content/src/HTMLAreaElement.h b/content/html/content/src/HTMLAreaElement.h
index dd84662a6861..4523c7e21367 100644
--- a/content/html/content/src/HTMLAreaElement.h
+++ b/content/html/content/src/HTMLAreaElement.h
@@ -30,6 +30,10 @@ public:
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
+  // CC
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(HTMLAreaElement,
+                                           nsGenericHTMLElement)
+
   // DOM memory reporter participant
   NS_DECL_SIZEOF_EXCLUDING_THIS
 
@@ -108,33 +112,16 @@ public:
     SetHTMLAttr(nsGkAtoms::ping, aPing, aError);
   }
 
-  void GetOrigin(nsAString &aOrigin)
-  {
-    Link::GetOrigin(aOrigin);
-  }
+  // The Link::GetOrigin is OK for us
 
   // The XPCOM GetProtocol is OK for us
   // The XPCOM SetProtocol is OK for us
 
-  void GetUsername(nsAString& aUsername)
-  {
-    Link::GetUsername(aUsername);
-  }
+  // The Link::GetUsername is OK for us
+  // The Link::SetUsername is OK for us
 
-  void SetUsername(const nsAString& aUsername)
-  {
-    Link::SetUsername(aUsername);
-  }
-
-  void GetPassword(nsAString& aPassword)
-  {
-    Link::GetPassword(aPassword);
-  }
-
-  void SetPassword(const nsAString& aPassword)
-  {
-    Link::SetPassword(aPassword);
-  }
+  // The Link::GetPassword is OK for us
+  // The Link::SetPassword is OK for us
 
   // The XPCOM GetHost is OK for us
   // The XPCOM SetHost is OK for us
@@ -154,6 +141,9 @@ public:
   // The XPCOM GetHash is OK for us
   // The XPCOM SetHash is OK for us
 
+  // The Link::GetSearchParams is OK for us
+  // The Link::SetSearchParams is OK for us
+
   bool NoHref() const
   {
     return GetBoolAttr(nsGkAtoms::nohref);
diff --git a/content/html/content/src/HTMLLinkElement.cpp b/content/html/content/src/HTMLLinkElement.cpp
index 2ed55d397320..87f69e93001f 100644
--- a/content/html/content/src/HTMLLinkElement.cpp
+++ b/content/html/content/src/HTMLLinkElement.cpp
@@ -44,11 +44,13 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLLinkElement)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLLinkElement,
                                                   nsGenericHTMLElement)
   tmp->nsStyleLinkElement::Traverse(cb);
+  tmp->Link::Traverse(cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLLinkElement,
                                                 nsGenericHTMLElement)
   tmp->nsStyleLinkElement::Unlink();
+  tmp->Link::Unlink();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ADDREF_INHERITED(HTMLLinkElement, Element)
diff --git a/content/svg/content/src/SVGAElement.cpp b/content/svg/content/src/SVGAElement.cpp
index 49d870980141..1dc94402d7e1 100644
--- a/content/svg/content/src/SVGAElement.cpp
+++ b/content/svg/content/src/SVGAElement.cpp
@@ -34,12 +34,28 @@ nsSVGElement::StringInfo SVGAElement::sStringInfo[2] =
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ISUPPORTS_INHERITED4(SVGAElement, SVGAElementBase,
-                             nsIDOMNode,
-                             nsIDOMElement,
-                             nsIDOMSVGElement,
-                             Link)
+NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(SVGAElement)
+  NS_INTERFACE_TABLE_INHERITED4(SVGAElement,
+                                nsIDOMNode,
+                                nsIDOMElement,
+                                nsIDOMSVGElement,
+                                Link)
+NS_INTERFACE_TABLE_TAIL_INHERITING(SVGAElementBase)
 
+NS_IMPL_CYCLE_COLLECTION_CLASS(SVGAElement)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(SVGAElement,
+                                                  SVGAElementBase)
+  tmp->Link::Traverse(cb);
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(SVGAElement,
+                                                SVGAElementBase)
+  tmp->Link::Unlink();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_ADDREF_INHERITED(SVGAElement, SVGAElementBase)
+NS_IMPL_RELEASE_INHERITED(SVGAElement, SVGAElementBase)
 
 //----------------------------------------------------------------------
 // Implementation
diff --git a/content/svg/content/src/SVGAElement.h b/content/svg/content/src/SVGAElement.h
index 29728f0c21f5..23351b57e211 100644
--- a/content/svg/content/src/SVGAElement.h
+++ b/content/svg/content/src/SVGAElement.h
@@ -30,6 +30,7 @@ protected:
 
 public:
   NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(SVGAElement, SVGAElementBase)
 
   // nsINode interface methods
   virtual nsresult PreHandleEvent(nsEventChainPreVisitor& aVisitor) MOZ_OVERRIDE;
diff --git a/dom/base/URL.cpp b/dom/base/URL.cpp
index acf7bdfd7a87..9dd1d6041844 100644
--- a/dom/base/URL.cpp
+++ b/dom/base/URL.cpp
@@ -20,6 +20,15 @@
 namespace mozilla {
 namespace dom {
 
+NS_IMPL_CYCLE_COLLECTION_1(URL, mSearchParams)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(URL)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(URL)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(URL)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
 URL::URL(nsIURI* aURI)
   : mURI(aURI)
 {
@@ -212,6 +221,10 @@ URL::SetHref(const nsAString& aHref, ErrorResult& aRv)
   }
 
   aRv = mURI->SetSpec(href);
+
+  if (mSearchParams) {
+    mSearchParams->Invalidate();
+  }
 }
 
 void
@@ -288,6 +301,33 @@ URL::SetHost(const nsAString& aHost)
   mURI->SetHostPort(NS_ConvertUTF16toUTF8(aHost));
 }
 
+void
+URL::URLSearchParamsUpdated()
+{
+  MOZ_ASSERT(mSearchParams && mSearchParams->IsValid());
+
+  nsAutoString search;
+  mSearchParams->Serialize(search);
+  SetSearchInternal(search);
+}
+
+void
+URL::URLSearchParamsNeedsUpdates()
+{
+  MOZ_ASSERT(mSearchParams);
+
+  nsAutoCString search;
+  nsCOMPtr<nsIURL> url(do_QueryInterface(mURI));
+  if (url) {
+    nsresult rv = url->GetQuery(search);
+    if (NS_FAILED(rv)) {
+      NS_WARNING("Failed to get the query from a nsIURL.");
+    }
+  }
+
+  mSearchParams->ParseInput(search);
+}
+
 void
 URL::GetHostname(nsString& aHostname) const
 {
@@ -384,6 +424,16 @@ URL::GetSearch(nsString& aSearch) const
 
 void
 URL::SetSearch(const nsAString& aSearch)
+{
+  SetSearchInternal(aSearch);
+
+  if (mSearchParams) {
+    mSearchParams->Invalidate();
+  }
+}
+
+void
+URL::SetSearchInternal(const nsAString& aSearch)
 {
   nsCOMPtr<nsIURL> url(do_QueryInterface(mURI));
   if (!url) {
@@ -394,6 +444,35 @@ URL::SetSearch(const nsAString& aSearch)
   url->SetQuery(NS_ConvertUTF16toUTF8(aSearch));
 }
 
+URLSearchParams*
+URL::GetSearchParams()
+{
+  CreateSearchParamsIfNeeded();
+  return mSearchParams;
+}
+
+void
+URL::SetSearchParams(URLSearchParams* aSearchParams)
+{
+  if (!aSearchParams) {
+    return;
+  }
+
+  if (!aSearchParams->HasURLAssociated()) {
+    MOZ_ASSERT(aSearchParams->IsValid());
+
+    mSearchParams = aSearchParams;
+    mSearchParams->SetObserver(this);
+  } else {
+    CreateSearchParamsIfNeeded();
+    mSearchParams->CopyFromURLSearchParams(*aSearchParams);
+  }
+
+  nsAutoString search;
+  mSearchParams->Serialize(search);
+  SetSearchInternal(search);
+}
+
 void
 URL::GetHash(nsString& aHash) const
 {
@@ -422,5 +501,15 @@ bool IsChromeURI(nsIURI* aURI)
   return false;
 }
 
+void
+URL::CreateSearchParamsIfNeeded()
+{
+  if (!mSearchParams) {
+    mSearchParams = new URLSearchParams();
+    mSearchParams->SetObserver(this);
+    mSearchParams->Invalidate();
+  }
+}
+
 }
 }
diff --git a/dom/base/URL.h b/dom/base/URL.h
index 762f4e292e67..76a715e64919 100644
--- a/dom/base/URL.h
+++ b/dom/base/URL.h
@@ -6,6 +6,7 @@
 #define URL_h___
 
 #include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/URLSearchParams.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsAutoPtr.h"
 #include "nsString.h"
@@ -29,10 +30,11 @@ namespace workers {
 class URLProxy;
 }
 
-class URL MOZ_FINAL
+class URL MOZ_FINAL : public URLSearchParamsObserver
 {
 public:
-  NS_INLINE_DECL_REFCOUNTING(URL)
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(URL)
 
   URL(nsIURI* aURI);
 
@@ -108,16 +110,28 @@ public:
 
   void SetSearch(const nsAString& aArg);
 
+  URLSearchParams* GetSearchParams();
+
+  void SetSearchParams(URLSearchParams* aSearchParams);
+
   void GetHash(nsString& aRetval) const;
 
   void SetHash(const nsAString& aArg);
 
+  // URLSearchParamsObserver
+  void URLSearchParamsUpdated() MOZ_OVERRIDE;
+  void URLSearchParamsNeedsUpdates() MOZ_OVERRIDE;
+
 private:
   nsIURI* GetURI() const
   {
     return mURI;
   }
 
+  void CreateSearchParamsIfNeeded();
+
+  void SetSearchInternal(const nsAString& aSearch);
+
   static void CreateObjectURLInternal(const GlobalObject& aGlobal,
                                       nsISupports* aObject,
                                       const nsACString& aScheme,
@@ -126,6 +140,7 @@ private:
                                       ErrorResult& aError);
 
   nsCOMPtr<nsIURI> mURI;
+  nsRefPtr<URLSearchParams> mSearchParams;
 
   friend class mozilla::dom::workers::URLProxy;
 };
diff --git a/dom/base/URLSearchParams.cpp b/dom/base/URLSearchParams.cpp
index af2f09371222..b182250cb67e 100644
--- a/dom/base/URLSearchParams.cpp
+++ b/dom/base/URLSearchParams.cpp
@@ -9,8 +9,19 @@
 namespace mozilla {
 namespace dom {
 
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_1(URLSearchParams, mObserver)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(URLSearchParams)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(URLSearchParams)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(URLSearchParams)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
 URLSearchParams::URLSearchParams()
+  : mValid(false)
 {
+  SetIsDOMBinding();
 }
 
 URLSearchParams::~URLSearchParams()
@@ -30,7 +41,7 @@ URLSearchParams::Constructor(const GlobalObject& aGlobal,
                              ErrorResult& aRv)
 {
   nsRefPtr<URLSearchParams> sp = new URLSearchParams();
-  sp->ParseInput(aInit);
+  sp->ParseInput(NS_ConvertUTF16toUTF8(aInit));
   return sp.forget();
 }
 
@@ -41,19 +52,23 @@ URLSearchParams::Constructor(const GlobalObject& aGlobal,
 {
   nsRefPtr<URLSearchParams> sp = new URLSearchParams();
   aInit.mSearchParams.EnumerateRead(CopyEnumerator, sp);
+  sp->mValid = true;
   return sp.forget();
 }
 
 void
-URLSearchParams::ParseInput(const nsAString& aInput)
+URLSearchParams::ParseInput(const nsACString& aInput)
 {
-  nsAString::const_iterator start, end;
+  // Remove all the existing data before parsing a new input.
+  DeleteAll();
+
+  nsACString::const_iterator start, end;
   aInput.BeginReading(start);
   aInput.EndReading(end);
-  nsAString::const_iterator iter(start);
+  nsACString::const_iterator iter(start);
 
   while (start != end) {
-    nsAutoString string;
+    nsAutoCString string;
 
     if (FindCharInReadable('&', iter, end)) {
       string.Assign(Substring(start, iter));
@@ -67,13 +82,13 @@ URLSearchParams::ParseInput(const nsAString& aInput)
       continue;
     }
 
-    nsAString::const_iterator eqStart, eqEnd;
+    nsACString::const_iterator eqStart, eqEnd;
     string.BeginReading(eqStart);
     string.EndReading(eqEnd);
-    nsAString::const_iterator eqIter(eqStart);
+    nsACString::const_iterator eqIter(eqStart);
 
-    nsAutoString name;
-    nsAutoString value;
+    nsAutoCString name;
+    nsAutoCString value;
 
     if (FindCharInReadable('=', eqIter, eqEnd)) {
       name.Assign(Substring(eqStart, eqIter));
@@ -84,20 +99,23 @@ URLSearchParams::ParseInput(const nsAString& aInput)
       name.Assign(string);
     }
 
-    nsAutoString decodedName;
+    nsAutoCString decodedName;
     DecodeString(name, decodedName);
 
-    nsAutoString decodedValue;
+    nsAutoCString decodedValue;
     DecodeString(value, decodedValue);
 
-    Append(decodedName, decodedValue);
+    AppendInternal(NS_ConvertUTF8toUTF16(decodedName),
+                   NS_ConvertUTF8toUTF16(decodedValue));
   }
+
+  mValid = true;
 }
 
 void
-URLSearchParams::DecodeString(const nsAString& aInput, nsAString& aOutput)
+URLSearchParams::DecodeString(const nsACString& aInput, nsACString& aOutput)
 {
-  nsAString::const_iterator start, end;
+  nsACString::const_iterator start, end;
   aInput.BeginReading(start);
   aInput.EndReading(end);
 
@@ -111,10 +129,10 @@ URLSearchParams::DecodeString(const nsAString& aInput, nsAString& aOutput)
 
     // Percent decode algorithm
     if (*start == '%') {
-      nsAString::const_iterator first(start);
+      nsACString::const_iterator first(start);
       ++first;
 
-      nsAString::const_iterator second(first);
+      nsACString::const_iterator second(first);
       ++second;
 
 #define ASCII_HEX_DIGIT( x )    \
@@ -147,6 +165,18 @@ URLSearchParams::DecodeString(const nsAString& aInput, nsAString& aOutput)
   }
 }
 
+void
+URLSearchParams::CopyFromURLSearchParams(URLSearchParams& aSearchParams)
+{
+  // The other SearchParams must be valid before copying its data.
+  aSearchParams.Validate();
+
+  // Remove all the existing data before parsing a new input.
+  DeleteAll();
+  aSearchParams.mSearchParams.EnumerateRead(CopyEnumerator, this);
+  mValid = true;
+}
+
 /* static */ PLDHashOperator
 URLSearchParams::CopyEnumerator(const nsAString& aName,
                                 nsTArray<nsString>* aArray,
@@ -161,9 +191,28 @@ URLSearchParams::CopyEnumerator(const nsAString& aName,
   return PL_DHASH_NEXT;
 }
 
+void
+URLSearchParams::SetObserver(URLSearchParamsObserver* aObserver)
+{
+  MOZ_ASSERT(!mObserver);
+  mObserver = aObserver;
+}
+
+void
+URLSearchParams::Validate()
+{
+  MOZ_ASSERT(mValid || mObserver);
+  if (!mValid) {
+    mObserver->URLSearchParamsNeedsUpdates();
+    MOZ_ASSERT(mValid);
+  }
+}
+
 void
 URLSearchParams::Get(const nsAString& aName, nsString& aRetval)
 {
+  Validate();
+
   nsTArray<nsString>* array;
   if (!mSearchParams.Get(aName, &array)) {
     aRetval.Truncate();
@@ -176,6 +225,8 @@ URLSearchParams::Get(const nsAString& aName, nsString& aRetval)
 void
 URLSearchParams::GetAll(const nsAString& aName, nsTArray<nsString>& aRetval)
 {
+  Validate();
+
   nsTArray<nsString>* array;
   if (!mSearchParams.Get(aName, &array)) {
     return;
@@ -187,6 +238,10 @@ URLSearchParams::GetAll(const nsAString& aName, nsTArray<nsString>& aRetval)
 void
 URLSearchParams::Set(const nsAString& aName, const nsAString& aValue)
 {
+  // Before setting any new value we have to be sure to have all the previous
+  // values in place.
+  Validate();
+
   nsTArray<nsString>* array;
   if (!mSearchParams.Get(aName, &array)) {
     array = new nsTArray<nsString>();
@@ -195,10 +250,23 @@ URLSearchParams::Set(const nsAString& aName, const nsAString& aValue)
   } else {
     array->ElementAt(0) = aValue;
   }
+
+  NotifyObserver();
 }
 
 void
 URLSearchParams::Append(const nsAString& aName, const nsAString& aValue)
+{
+  // Before setting any new value we have to be sure to have all the previous
+  // values in place.
+  Validate();
+
+  AppendInternal(aName, aValue);
+  NotifyObserver();
+}
+
+void
+URLSearchParams::AppendInternal(const nsAString& aName, const nsAString& aValue)
 {
   nsTArray<nsString>* array;
   if (!mSearchParams.Get(aName, &array)) {
@@ -212,18 +280,32 @@ URLSearchParams::Append(const nsAString& aName, const nsAString& aValue)
 bool
 URLSearchParams::Has(const nsAString& aName)
 {
+  Validate();
   return mSearchParams.Get(aName, nullptr);
 }
 
 void
 URLSearchParams::Delete(const nsAString& aName)
 {
+  // Before deleting any value we have to be sure to have all the previous
+  // values in place.
+  Validate();
+
   nsTArray<nsString>* array;
   if (!mSearchParams.Get(aName, &array)) {
     return;
   }
 
   mSearchParams.Remove(aName);
+
+  NotifyObserver();
+}
+
+uint32_t
+URLSearchParams::Size()
+{
+  Validate();
+  return mSearchParams.Count();
 }
 
 void
@@ -232,5 +314,84 @@ URLSearchParams::DeleteAll()
   mSearchParams.Clear();
 }
 
+class MOZ_STACK_CLASS SerializeData
+{
+public:
+  SerializeData()
+    : mFirst(true)
+  {}
+
+  nsAutoString mValue;
+  bool mFirst;
+
+  void Serialize(const nsCString& aInput)
+  {
+    const unsigned char* p = (const unsigned char*) aInput.get();
+
+    while (p && *p) {
+      // ' ' to '+'
+      if (*p == 0x20) {
+        mValue.Append(0x2B);
+      // Percent Encode algorithm
+      } else if (*p == 0x2A || *p == 0x2D || *p == 0x2E ||
+                 (*p >= 0x30 && *p <= 0x39) ||
+                 (*p >= 0x41 && *p <= 0x5A) || *p == 0x5F ||
+                 (*p >= 0x61 && *p <= 0x7A)) {
+        mValue.Append(*p);
+      } else {
+        mValue.AppendPrintf("%%%X", *p);
+      }
+
+      ++p;
+    }
+  }
+};
+
+void
+URLSearchParams::Serialize(nsAString& aValue)
+{
+  MOZ_ASSERT(mValid);
+
+  SerializeData data;
+  mSearchParams.EnumerateRead(SerializeEnumerator, &data);
+  aValue.Assign(data.mValue);
+}
+
+/* static */ PLDHashOperator
+URLSearchParams::SerializeEnumerator(const nsAString& aName,
+                                     nsTArray<nsString>* aArray,
+                                     void *userData)
+{
+  SerializeData* data = static_cast<SerializeData*>(userData);
+
+  for (uint32_t i = 0, len = aArray->Length(); i < len; ++i) {
+    if (data->mFirst) {
+      data->mFirst = false;
+    } else {
+      data->mValue.Append(NS_LITERAL_STRING("&"));
+    }
+
+    data->Serialize(NS_ConvertUTF16toUTF8(aName));
+    data->mValue.Append(NS_LITERAL_STRING("="));
+    data->Serialize(NS_ConvertUTF16toUTF8(aArray->ElementAt(i)));
+  }
+
+  return PL_DHASH_NEXT;
+}
+
+void
+URLSearchParams::NotifyObserver()
+{
+  if (mObserver) {
+    mObserver->URLSearchParamsUpdated();
+  }
+}
+
+void
+URLSearchParams::Invalidate()
+{
+  mValid = false;
+}
+
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/base/URLSearchParams.h b/dom/base/URLSearchParams.h
index 90c3d579a94f..c876085fa237 100644
--- a/dom/base/URLSearchParams.h
+++ b/dom/base/URLSearchParams.h
@@ -8,28 +8,47 @@
 
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/ErrorResult.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
 #include "nsClassHashtable.h"
 #include "nsHashKeys.h"
+#include "nsISupports.h"
 
 namespace mozilla {
 namespace dom {
 
-class URLSearchParams MOZ_FINAL
+class URLSearchParamsObserver : public nsISupports
 {
 public:
-  NS_INLINE_DECL_REFCOUNTING(URL)
+  virtual ~URLSearchParamsObserver() {}
+
+  virtual void URLSearchParamsUpdated() = 0;
+  virtual void URLSearchParamsNeedsUpdates() = 0;
+};
+
+class URLSearchParams MOZ_FINAL : public nsISupports,
+                                  public nsWrapperCache
+{
+public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(URLSearchParams)
 
   URLSearchParams();
   ~URLSearchParams();
 
+  bool HasURLAssociated() const
+  {
+    return !!mObserver;
+  }
+
   // WebIDL methods
   nsISupports* GetParentObject() const
   {
     return nullptr;
   }
 
-  JSObject*
-  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope);
+  virtual JSObject*
+  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
   static already_AddRefed<URLSearchParams>
   Constructor(const GlobalObject& aGlobal, const nsAString& aInit,
@@ -39,6 +58,21 @@ public:
   Constructor(const GlobalObject& aGlobal, URLSearchParams& aInit,
               ErrorResult& aRv);
 
+  void ParseInput(const nsACString& aInput);
+
+  void CopyFromURLSearchParams(URLSearchParams& aSearchParams);
+
+  void SetObserver(URLSearchParamsObserver* aObserver);
+
+  void Invalidate();
+
+  bool IsValid() const
+  {
+    return mValid;
+  }
+
+  void Serialize(nsAString& aValue);
+
   void Get(const nsAString& aName, nsString& aRetval);
 
   void GetAll(const nsAString& aName, nsTArray<nsString >& aRetval);
@@ -51,23 +85,33 @@ public:
 
   void Delete(const nsAString& aName);
 
-  uint32_t Size() const
-  {
-    return mSearchParams.Count();
-  }
+  uint32_t Size();
 
 private:
-  void ParseInput(const nsAString& aInput);
+  void AppendInternal(const nsAString& aName, const nsAString& aValue);
 
   void DeleteAll();
 
-  void DecodeString(const nsAString& aInput, nsAString& aOutput);
+  void DecodeString(const nsACString& aInput, nsACString& aOutput);
+
+  void NotifyObserver();
 
   static PLDHashOperator
   CopyEnumerator(const nsAString& aName, nsTArray<nsString>* aArray,
                  void *userData);
 
+  static PLDHashOperator
+  SerializeEnumerator(const nsAString& aName, nsTArray<nsString>* aArray,
+                      void *userData);
+
+  void
+  Validate();
+
   nsClassHashtable<nsStringHashKey, nsTArray<nsString>> mSearchParams;
+
+  nsRefPtr<URLSearchParamsObserver> mObserver;
+
+  bool mValid;
 };
 
 } // namespace dom
diff --git a/dom/base/test/test_urlSearchParams.html b/dom/base/test/test_urlSearchParams.html
index a6a4c18f563e..272d01c6521a 100644
--- a/dom/base/test/test_urlSearchParams.html
+++ b/dom/base/test/test_urlSearchParams.html
@@ -19,7 +19,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=887836
 </div>
 <pre id="test">
 </pre>
-  <script type="application/javascript">
+<a href="http://www.example.net?a=b&c=d" id="anchor">foobar</a>
+<area href="http://www.example.net?a=b&c=d" id="area">foobar</area>
+<script type="application/javascript">
 
   /** Test for Bug 887836 **/
   ok("URLSearchParams" in window, "window.URLSearchParams exists");
@@ -117,10 +119,104 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=887836
     runTest();
   }
 
+  function testURL() {
+    var url = new URL('http://www.example.net?a=b&c=d');
+    ok(url.searchParams, "URL searchParams exists!");
+    ok(url.searchParams.has('a'), "URL.searchParams.has('a')");
+    is(url.searchParams.get('a'), 'b', "URL.searchParams.get('a')");
+    ok(url.searchParams.has('c'), "URL.searchParams.has('c')");
+    is(url.searchParams.get('c'), 'd', "URL.searchParams.get('c')");
+
+    url.searchParams.set('e', 'f');
+    ok(url.href.indexOf('e=f') != 1, 'URL right');
+
+    var u = new URLSearchParams();
+    u.append('foo', 'bar');
+    url.searchParams = u;
+    is(url.searchParams, u, "URL.searchParams is the same object");
+    is(url.searchParams.get('foo'), 'bar', "URL.searchParams.get('foo')");
+    is(url.href, 'http://www.example.net/?foo=bar', 'URL right');
+
+    url.searchParams = null;
+    is(url.searchParams.get('foo'), 'bar', "URL.searchParams.get('foo')");
+    is(url.href, 'http://www.example.net/?foo=bar', 'URL right');
+
+    var url2 = new URL('http://www.example.net?e=f');
+    url.searchParams = url2.searchParams;
+    isnot(url.searchParams, url2.searchParams, "URL.searchParams is not the same object");
+    is(url.searchParams.get('e'), 'f', "URL.searchParams.get('e')");
+
+    url.href = "http://www.example.net?bar=foo";
+    is(url.searchParams.get('bar'), 'foo', "URL.searchParams.get('bar')");
+
+    runTest();
+  }
+
+  function testElement(e) {
+    ok(e, 'element exists');
+    ok(e.searchParams, "e.searchParams exists!");
+    ok(e.searchParams.has('a'), "e.searchParams.has('a')");
+    is(e.searchParams.get('a'), 'b', "e.searchParams.get('a')");
+    ok(e.searchParams.has('c'), "e.searchParams.has('c')");
+    is(e.searchParams.get('c'), 'd', "e.searchParams.get('c')");
+
+    e.searchParams.set('e', 'f');
+    ok(e.href.indexOf('e=f') != 1, 'e is right');
+
+    var u = new URLSearchParams();
+    u.append('foo', 'bar');
+    e.searchParams = u;
+    is(e.searchParams, u, "e.searchParams is the same object");
+    is(e.searchParams.get('foo'), 'bar', "e.searchParams.get('foo')");
+    is(e.href, 'http://www.example.net/?foo=bar', 'e is right');
+
+    e.searchParams = null;
+    is(e.searchParams.get('foo'), 'bar', "e.searchParams.get('foo')");
+    is(e.href, 'http://www.example.net/?foo=bar', 'e is right');
+
+    var url2 = new URL('http://www.example.net?e=f');
+    e.searchParams = url2.searchParams;
+    isnot(e.searchParams, url2.searchParams, "e.searchParams is not the same object");
+    is(e.searchParams.get('e'), 'f', "e.searchParams.get('e')");
+
+    e.href = "http://www.example.net?bar=foo";
+    is(e.searchParams.get('bar'), 'foo', "e.searchParams.get('bar')");
+
+    e.setAttribute('href', "http://www.example.net?bar2=foo2");
+    is(e.searchParams.get('bar2'), 'foo2', "e.searchParams.get('bar2')");
+
+    runTest();
+  }
+
+  function testEncoding() {
+    var encoding = [ [ '1', '1' ],
+                     [ 'a b', 'a+b' ],
+                     [ '<>', '%3C%3E' ],
+                     [ '\u0541', '%D5%81'] ];
+
+    for (var i = 0; i < encoding.length; ++i) {
+      var a = new URLSearchParams();
+      a.set('a', encoding[i][0]);
+
+      var url = new URL('http://www.example.net');
+      url.searchParams = a;
+      is(url.href, 'http://www.example.net/?a=' + encoding[i][1]);
+
+      var url2 = new URL(url.href);
+      is(url2.searchParams.get('a'), encoding[i][0], 'a is still there');
+    }
+
+    runTest();
+  }
+
   var tests = [
     testSimpleURLSearchParams,
     testCopyURLSearchParams,
-    testParserURLSearchParams
+    testParserURLSearchParams,
+    testURL,
+    function() { testElement(document.getElementById('anchor')) },
+    function() { testElement(document.getElementById('area')) },
+    testEncoding
   ];
 
   function runTest() {
@@ -136,6 +232,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=887836
   SimpleTest.waitForExplicitFinish();
   runTest();
 
-  </script>
+</script>
 </body>
 </html>
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index 8603e0f2f360..333d277fd9c3 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1287,14 +1287,8 @@ DOMInterfaces = {
 {
     'workers': True,
     'wrapperCache': False,
-    'nativeOwnership': 'owned',
 }],
 
-'URLSearchParams' : {
-    'wrapperCache' : False,
-    'nativeOwnership': 'refcounted',
-},
-
 'VTTCue': {
     'nativeType': 'mozilla::dom::TextTrackCue'
 },
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index a55b12916683..f91b427f4114 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -614,6 +614,7 @@ var interfaceNamesInGlobalScope =
     "UIEvent",
     "UndoManager",
     "URL",
+    "URLSearchParams",
     {name: "UserDataHandler", xbl: true},
     "UserProximityEvent",
     {name: "USSDReceivedEvent", b2g: true, pref: "dom.mobileconnection.enabled"},
diff --git a/dom/webidl/URLUtils.webidl b/dom/webidl/URLUtils.webidl
index ddd690ccef05..033a6fca9291 100644
--- a/dom/webidl/URLUtils.webidl
+++ b/dom/webidl/URLUtils.webidl
@@ -27,7 +27,7 @@ interface URLUtils {
            attribute DOMString port;
            attribute DOMString pathname;
            attribute DOMString search;
-           // attribute URLSearchParams? searchParams;
+           attribute URLSearchParams? searchParams;
            attribute DOMString hash;
 };
 
diff --git a/dom/workers/RegisterBindings.cpp b/dom/workers/RegisterBindings.cpp
index a40dc6b100ae..aa6e7c5ea320 100644
--- a/dom/workers/RegisterBindings.cpp
+++ b/dom/workers/RegisterBindings.cpp
@@ -71,7 +71,7 @@ WorkerPrivate::RegisterBindings(JSContext* aCx, JS::Handle<JSObject*> aGlobal)
       !XMLHttpRequestBinding_workers::GetConstructorObject(aCx, aGlobal) ||
       !XMLHttpRequestUploadBinding_workers::GetConstructorObject(aCx, aGlobal) ||
       !URLBinding_workers::GetConstructorObject(aCx, aGlobal) ||
-      !URLSearchParamsBinding::GetConstructorObject(aCx, global) ||
+      !URLSearchParamsBinding::GetConstructorObject(aCx, aGlobal) ||
       !WorkerBinding::GetConstructorObject(aCx, aGlobal) ||
       !WorkerLocationBinding_workers::GetConstructorObject(aCx, aGlobal) ||
       !WorkerNavigatorBinding_workers::GetConstructorObject(aCx, aGlobal)) {
diff --git a/dom/workers/URL.cpp b/dom/workers/URL.cpp
index e2f0cb21040f..d9b69ff67978 100644
--- a/dom/workers/URL.cpp
+++ b/dom/workers/URL.cpp
@@ -19,6 +19,7 @@
 
 #include "mozilla/dom/URL.h"
 #include "mozilla/dom/URLBinding.h"
+#include "mozilla/dom/URLSearchParams.h"
 #include "nsIIOService.h"
 #include "nsNetCID.h"
 
@@ -536,6 +537,17 @@ private:
   mozilla::ErrorResult& mRv;
 };
 
+NS_IMPL_CYCLE_COLLECTION_1(URL, mSearchParams)
+
+// The reason for using worker::URL is to have different refcnt logging than
+// for main thread URL.
+NS_IMPL_CYCLE_COLLECTING_ADDREF(workers::URL)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(workers::URL)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(URL)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
 // static
 URL*
 URL::Constructor(const GlobalObject& aGlobal, const nsAString& aUrl,
@@ -606,10 +618,9 @@ URL::~URL()
 }
 
 JSObject*
-URL::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope,
-                bool* aTookOwnership)
+URL::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
 {
-  return URLBinding_workers::Wrap(aCx, aScope, this, aTookOwnership);
+  return URLBinding_workers::Wrap(aCx, aScope, this);
 }
 
 void
@@ -634,6 +645,10 @@ URL::SetHref(const nsAString& aHref, ErrorResult& aRv)
   if (!runnable->Dispatch(mWorkerPrivate->GetJSContext())) {
     JS_ReportPendingException(mWorkerPrivate->GetJSContext());
   }
+
+  if (mSearchParams) {
+    mSearchParams->Invalidate();
+  }
 }
 
 void
@@ -837,6 +852,16 @@ URL::GetSearch(nsString& aSearch) const
 
 void
 URL::SetSearch(const nsAString& aSearch)
+{
+  SetSearchInternal(aSearch);
+
+  if (mSearchParams) {
+    mSearchParams->Invalidate();
+  }
+}
+
+void
+URL::SetSearchInternal(const nsAString& aSearch)
 {
   ErrorResult rv;
   nsRefPtr<SetterRunnable> runnable =
@@ -848,6 +873,36 @@ URL::SetSearch(const nsAString& aSearch)
   }
 }
 
+mozilla::dom::URLSearchParams*
+URL::GetSearchParams()
+{
+  CreateSearchParamsIfNeeded();
+  return mSearchParams;
+}
+
+void
+URL::SetSearchParams(URLSearchParams* aSearchParams)
+{
+  if (!aSearchParams) {
+    return;
+  }
+
+  if (!aSearchParams->HasURLAssociated()) {
+    MOZ_ASSERT(aSearchParams->IsValid());
+
+    mSearchParams = aSearchParams;
+    mSearchParams->SetObserver(this);
+  } else {
+    CreateSearchParamsIfNeeded();
+    mSearchParams->CopyFromURLSearchParams(*aSearchParams);
+  }
+
+
+  nsString search;
+  mSearchParams->Serialize(search);
+  SetSearchInternal(search);
+}
+
 void
 URL::GetHash(nsString& aHash) const
 {
@@ -924,4 +979,34 @@ URL::RevokeObjectURL(const GlobalObject& aGlobal, const nsAString& aUrl)
   }
 }
 
+void
+URL::URLSearchParamsUpdated()
+{
+  MOZ_ASSERT(mSearchParams && mSearchParams->IsValid());
+
+  nsString search;
+  mSearchParams->Serialize(search);
+  SetSearchInternal(search);
+}
+
+void
+URL::URLSearchParamsNeedsUpdates()
+{
+  MOZ_ASSERT(mSearchParams);
+
+  nsString search;
+  GetSearch(search);
+  mSearchParams->ParseInput(NS_ConvertUTF16toUTF8(Substring(search, 1)));
+}
+
+void
+URL::CreateSearchParamsIfNeeded()
+{
+  if (!mSearchParams) {
+    mSearchParams = new URLSearchParams();
+    mSearchParams->SetObserver(this);
+    mSearchParams->Invalidate();
+  }
+}
+
 END_WORKERS_NAMESPACE
diff --git a/dom/workers/URL.h b/dom/workers/URL.h
index 57af9f20c512..922c6c837e13 100644
--- a/dom/workers/URL.h
+++ b/dom/workers/URL.h
@@ -11,7 +11,7 @@
 
 #include "mozilla/ErrorResult.h"
 #include "mozilla/dom/BindingDeclarations.h"
-#include "mozilla/dom/NonRefcountedDOMObject.h"
+#include "mozilla/dom/URLSearchParams.h"
 
 namespace mozilla {
 namespace dom {
@@ -23,9 +23,13 @@ BEGIN_WORKERS_NAMESPACE
 
 class URLProxy;
 
-class URL MOZ_FINAL : public NonRefcountedDOMObject
+class URL MOZ_FINAL : public mozilla::dom::URLSearchParamsObserver
 {
+  typedef mozilla::dom::URLSearchParams URLSearchParams;
+
 public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(URL)
 
   URL(WorkerPrivate* aWorkerPrivate, URLProxy* aURLProxy);
   ~URL();
@@ -38,8 +42,7 @@ public:
   }
 
   JSObject*
-  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope,
-             bool* aTookOwnership);
+  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope);
 
   // Methods for WebIDL
 
@@ -101,18 +104,31 @@ public:
 
   void SetSearch(const nsAString& aSearch);
 
+  URLSearchParams* GetSearchParams();
+
+  void SetSearchParams(URLSearchParams* aSearchParams);
+
   void GetHash(nsString& aHost) const;
 
   void SetHash(const nsAString& aHash);
 
+  // IURLSearchParamsObserver
+  void URLSearchParamsUpdated() MOZ_OVERRIDE;
+  void URLSearchParamsNeedsUpdates() MOZ_OVERRIDE;
+
 private:
   URLProxy* GetURLProxy() const
   {
     return mURLProxy;
   }
 
+  void CreateSearchParamsIfNeeded();
+
+  void SetSearchInternal(const nsAString& aSearch);
+
   WorkerPrivate* mWorkerPrivate;
   nsRefPtr<URLProxy> mURLProxy;
+  nsRefPtr<URLSearchParams> mSearchParams;
 };
 
 END_WORKERS_NAMESPACE
diff --git a/dom/workers/test/urlSearchparams_worker.js b/dom/workers/test/urlSearchParams_worker.js
similarity index 64%
rename from dom/workers/test/urlSearchparams_worker.js
rename to dom/workers/test/urlSearchParams_worker.js
index bec0ea83fb37..73f1d61ecac0 100644
--- a/dom/workers/test/urlSearchparams_worker.js
+++ b/dom/workers/test/urlSearchParams_worker.js
@@ -8,6 +8,11 @@ function is(a, b, msg) {
   postMessage({type: 'status', status: a === b, msg: a + " === " + b + ": " + msg });
 }
 
+function isnot(a, b, msg) {
+  dump("ISNOT: " + (a!==b) + "  =>  " + a + " | " + b + " " + msg + "\n");
+  postMessage({type: 'status', status: a !== b, msg: a + " !== " + b + ": " + msg });
+}
+
 onmessage = function() {
   status = false;
   try {
@@ -111,10 +116,66 @@ onmessage = function() {
     runTest();
   }
 
+  function testURL() {
+    var url = new URL('http://www.example.net?a=b&c=d');
+    ok(url.searchParams, "URL searchParams exists!");
+    ok(url.searchParams.has('a'), "URL.searchParams.has('a')");
+    is(url.searchParams.get('a'), 'b', "URL.searchParams.get('a')");
+    ok(url.searchParams.has('c'), "URL.searchParams.has('c')");
+    is(url.searchParams.get('c'), 'd', "URL.searchParams.get('c')");
+
+    url.searchParams.set('e', 'f');
+    ok(url.href.indexOf('e=f') != 1, 'URL right');
+
+    var u = new URLSearchParams();
+    u.append('foo', 'bar');
+    url.searchParams = u;
+    is(url.searchParams, u, "URL.searchParams is the same object");
+    is(url.searchParams.get('foo'), 'bar', "URL.searchParams.get('foo')");
+    is(url.href, 'http://www.example.net/?foo=bar', 'URL right');
+
+    url.searchParams = null;
+    is(url.searchParams.get('foo'), 'bar', "URL.searchParams.get('foo')");
+    is(url.href, 'http://www.example.net/?foo=bar', 'URL right');
+
+    var url2 = new URL('http://www.example.net?e=f');
+    url.searchParams = url2.searchParams;
+    isnot(url.searchParams, url2.searchParams, "URL.searchParams is not the same object");
+    is(url.searchParams.get('e'), 'f', "URL.searchParams.get('e')");
+
+    url.href = "http://www.example.net?bar=foo";
+    is(url.searchParams.get('bar'), 'foo', "URL.searchParams.get('bar')");
+
+    runTest();
+  }
+
+  function testEncoding() {
+    var encoding = [ [ '1', '1' ],
+                     [ 'a b', 'a+b' ],
+                     [ '<>', '%3C%3E' ],
+                     [ '\u0541', '%D5%81'] ];
+
+    for (var i = 0; i < encoding.length; ++i) {
+      var a = new URLSearchParams();
+      a.set('a', encoding[i][0]);
+
+      var url = new URL('http://www.example.net');
+      url.searchParams = a;
+      is(url.href, 'http://www.example.net/?a=' + encoding[i][1]);
+
+      var url2 = new URL(url.href);
+      is(url2.searchParams.get('a'), encoding[i][0], 'a is still there');
+    }
+
+    runTest();
+  }
+
   var tests = [
     testSimpleURLSearchParams,
     testCopyURLSearchParams,
-    testParserURLSearchParams
+    testParserURLSearchParams,
+    testURL,
+    testEncoding
   ];
 
   function runTest() {
@@ -129,5 +190,3 @@ onmessage = function() {
 
   runTest();
 }
-
-
diff --git a/toolkit/components/places/tests/cpp/mock_Link.h b/toolkit/components/places/tests/cpp/mock_Link.h
index 277fcfde1403..4a9713dc7a4d 100644
--- a/toolkit/components/places/tests/cpp/mock_Link.h
+++ b/toolkit/components/places/tests/cpp/mock_Link.h
@@ -13,6 +13,7 @@
 
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/dom/Link.h"
+#include "mozilla/dom/URLSearchParams.h"
 
 class mock_Link : public mozilla::dom::Link
 {
@@ -115,6 +116,134 @@ Link::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
   return 0;
 }
 
+void
+Link::URLSearchParamsUpdated()
+{
+  NS_NOTREACHED("Unexpected call to Link::URLSearchParamsUpdated");
+}
+
+void
+Link::URLSearchParamsNeedsUpdates()
+{
+  NS_NOTREACHED("Unexpected call to Link::URLSearchParamsNeedsUpdates");
+}
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(URLSearchParams)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(URLSearchParams)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(URLSearchParams)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_TRACE_WRAPPERCACHE(URLSearchParams)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(URLSearchParams)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(URLSearchParams)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(URLSearchParams)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+
+URLSearchParams::URLSearchParams()
+{
+}
+
+URLSearchParams::~URLSearchParams()
+{
+}
+
+JSObject*
+URLSearchParams::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
+{
+  return nullptr;
+}
+
+void
+URLSearchParams::ParseInput(const nsACString& aInput)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::ParseInput");
+}
+
+void
+URLSearchParams::CopyFromURLSearchParams(URLSearchParams& aSearchParams)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::CopyFromURLSearchParams");
+}
+
+void
+URLSearchParams::SetObserver(URLSearchParamsObserver* aObserver)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::SetObserver");
+}
+
+void
+URLSearchParams::Serialize(nsAString& aValue)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::Serialize");
+}
+
+void
+URLSearchParams::Get(const nsAString& aName, nsString& aRetval)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::Get");
+}
+
+void
+URLSearchParams::GetAll(const nsAString& aName, nsTArray<nsString >& aRetval)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::GetAll");
+}
+
+void
+URLSearchParams::Set(const nsAString& aName, const nsAString& aValue)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::Set");
+}
+
+void
+URLSearchParams::Append(const nsAString& aName, const nsAString& aValue)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::Append");
+}
+
+void
+URLSearchParams::AppendInternal(const nsAString& aName, const nsAString& aValue)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::AppendInternal");
+}
+
+bool
+URLSearchParams::Has(const nsAString& aName)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::Has");
+  return false;
+}
+
+void
+URLSearchParams::Delete(const nsAString& aName)
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::Delete");
+}
+
+void
+URLSearchParams::DeleteAll()
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::DeleteAll");
+}
+
+void
+URLSearchParams::NotifyObserver()
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::NotifyObserver");
+}
+
+void
+URLSearchParams::Invalidate()
+{
+  NS_NOTREACHED("Unexpected call to URLSearchParams::Invalidate");
+}
+
+
 } // namespace dom
 } // namespace mozilla
 

From cf5141986662c05a358bc188b7dd36ddbfb23fb0 Mon Sep 17 00:00:00 2001
From: Trevor Saunders <trev.saunders@gmail.com>
Date: Mon, 25 Nov 2013 14:28:06 -0500
Subject: [PATCH 040/459] bug 943023 - unify some of
 toolkit/components/url-classifier/ r=ehsan

---
 toolkit/components/url-classifier/moz.build | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/toolkit/components/url-classifier/moz.build b/toolkit/components/url-classifier/moz.build
index cc8fd93105f4..d728ecda24c0 100644
--- a/toolkit/components/url-classifier/moz.build
+++ b/toolkit/components/url-classifier/moz.build
@@ -17,20 +17,28 @@ XPIDL_SOURCES += [
 
 XPIDL_MODULE = 'url-classifier'
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'ChunkSet.cpp',
     'Classifier.cpp',
-    'HashStore.cpp',
     'LookupCache.cpp',
     'nsCheckSummedOutputStream.cpp',
     'nsUrlClassifierDBService.cpp',
-    'nsUrlClassifierPrefixSet.cpp',
     'nsUrlClassifierProxies.cpp',
-    'nsUrlClassifierStreamUpdater.cpp',
     'nsUrlClassifierUtils.cpp',
     'ProtocolParser.cpp',
 ]
 
+# define conflicting LOG() macros
+SOURCES += [
+    'nsUrlClassifierPrefixSet.cpp',
+    'nsUrlClassifierStreamUpdater.cpp',
+]
+
+# contains variables that conflict with LookupCache.cpp
+SOURCES += [
+    'HashStore.cpp',
+]
+
 EXTRA_COMPONENTS += [
     'nsURLClassifier.manifest',
     'nsUrlClassifierHashCompleter.js',

From 0c6e1524c992c8fdbdc02cdeec131c007e3e6761 Mon Sep 17 00:00:00 2001
From: Trevor Saunders <trev.saunders@gmail.com>
Date: Thu, 5 Dec 2013 16:28:21 -0500
Subject: [PATCH 041/459] bug 946946 - add Document.docShell r=bz

---
 dom/bindings/Bindings.conf | 1 +
 dom/webidl/Document.webidl | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index 333d277fd9c3..cb89c6176ea1 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1894,6 +1894,7 @@ addExternalIface('nsIInputStreamCallback', nativeType='nsIInputStreamCallback',
                  headerFile='nsIAsyncInputStream.h')
 addExternalIface('nsIStreamListener', nativeType='nsIStreamListener', notflattened=True)
 addExternalIface('nsISupports', nativeType='nsISupports')
+addExternalIface('nsIDocShell', nativeType='nsIDocShell', notflattened=True)
 addExternalIface('nsIEditor', nativeType='nsIEditor', notflattened=True)
 addExternalIface('nsIVariant', nativeType='nsIVariant', notflattened=True)
 addExternalIface('OutputStream', nativeType='nsIOutputStream',
diff --git a/dom/webidl/Document.webidl b/dom/webidl/Document.webidl
index d2949ba5852e..ebc541ae3043 100644
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -19,6 +19,7 @@ interface StyleSheetList;
 interface WindowProxy;
 interface nsISupports;
 interface URI;
+interface nsIDocShell;
 
 enum VisibilityState { "hidden", "visible" };
 
@@ -340,6 +341,8 @@ partial interface Document {
   void obsoleteSheet(URI sheetURI);
   [ChromeOnly, Throws]
   void obsoleteSheet(DOMString sheetURI);
+
+  [ChromeOnly] readonly attribute nsIDocShell? docShell;
 };
 
 // Extension to give chrome JS the ability to determine when a document was

From ae517971ad06501cbe0b04f3e826b20103d03664 Mon Sep 17 00:00:00 2001
From: Trevor Saunders <trev.saunders@gmail.com>
Date: Wed, 20 Nov 2013 14:18:25 -0500
Subject: [PATCH 042/459] bug 947022 - type nsIPresShell::mForwardingContainer
 and nsPresContext::mContainer r=bz

---
 content/base/src/nsContentUtils.cpp           |  3 +-
 content/base/src/nsDocument.cpp               |  3 +-
 content/events/src/nsDOMUIEvent.cpp           |  2 +-
 content/events/src/nsEventStateManager.cpp    | 16 ++---
 content/html/content/src/HTMLBodyElement.cpp  | 68 +++++++++----------
 content/smil/nsDOMTimeEvent.cpp               |  2 +-
 content/xul/document/src/XULDocument.cpp      |  7 +-
 dom/base/nsDOMWindowUtils.cpp                 |  3 +-
 dom/plugins/base/nsPluginInstanceOwner.cpp    |  9 +--
 .../src/nsComposerDocumentCommands.cpp        | 12 +---
 layout/base/nsCSSFrameConstructor.cpp         | 31 ++++-----
 layout/base/nsDocumentViewer.cpp              | 19 +++---
 layout/base/nsIPresShell.h                    |  6 +-
 layout/base/nsPresContext.cpp                 | 55 ++++++++-------
 layout/base/nsPresContext.h                   | 21 +++---
 layout/base/nsPresShell.cpp                   | 53 ++++++---------
 layout/generic/nsGfxScrollFrame.cpp           |  2 +-
 layout/mathml/nsMathMLmactionFrame.cpp        | 21 +++---
 layout/printing/nsPrintEngine.cpp             |  3 +-
 layout/svg/nsSVGOuterSVGFrame.cpp             |  2 +-
 layout/xul/nsMenuPopupFrame.cpp               |  8 +--
 layout/xul/nsResizerFrame.cpp                 |  3 +-
 layout/xul/nsTitleBarFrame.cpp                |  5 +-
 layout/xul/nsXULPopupManager.cpp              |  3 +-
 .../typeaheadfind/nsTypeAheadFind.cpp         | 14 ++--
 widget/xpwidgets/nsBaseWidget.cpp             |  3 +-
 26 files changed, 166 insertions(+), 208 deletions(-)

diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index b9690cac6bba..2fc03a3528a3 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -6581,8 +6581,7 @@ nsContentUtils::GetSelectionInTextControl(Selection* aSelection,
 nsIEditor*
 nsContentUtils::GetHTMLEditor(nsPresContext* aPresContext)
 {
-  nsCOMPtr<nsISupports> container = aPresContext->GetContainer();
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+  nsCOMPtr<nsIDocShell> docShell(aPresContext->GetDocShell());
   bool isEditable;
   if (!docShell ||
       NS_FAILED(docShell->GetEditable(&isEditable)) || !isEditable)
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index bf6c2119e09b..210e0613ad2d 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -6183,7 +6183,8 @@ nsDocument::DoNotifyPossibleTitleChange()
 
   nsCOMPtr<nsIPresShell> shell = GetShell();
   if (shell) {
-    nsCOMPtr<nsISupports> container = shell->GetPresContext()->GetContainer();
+    nsCOMPtr<nsISupports> container =
+      shell->GetPresContext()->GetContainerWeak();
     if (container) {
       nsCOMPtr<nsIBaseWindow> docShellWin = do_QueryInterface(container);
       if (docShellWin) {
diff --git a/content/events/src/nsDOMUIEvent.cpp b/content/events/src/nsDOMUIEvent.cpp
index 59882d559b9f..5c5e895b0772 100644
--- a/content/events/src/nsDOMUIEvent.cpp
+++ b/content/events/src/nsDOMUIEvent.cpp
@@ -63,7 +63,7 @@ nsDOMUIEvent::nsDOMUIEvent(mozilla::dom::EventTarget* aOwner,
   mView = nullptr;
   if (mPresContext)
   {
-    nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
+    nsISupports* container = mPresContext->GetContainerWeak();
     if (container)
     {
        nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index 67edf1722fe3..0466d203e1db 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -1455,7 +1455,7 @@ nsEventStateManager::GetAccessKeyLabelPrefix(nsAString& aPrefix)
   nsAutoString separator, modifierText;
   nsContentUtils::GetModifierSeparatorText(separator);
 
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
+  nsCOMPtr<nsISupports> container = mPresContext->GetContainerWeak();
   int32_t modifierMask = GetAccessModifierMaskFor(container);
 
   if (modifierMask & NS_MODIFIER_CONTROL) {
@@ -1489,7 +1489,7 @@ nsEventStateManager::HandleAccessKey(nsPresContext* aPresContext,
                                      ProcessingAccessKeyState aAccessKeyState,
                                      int32_t aModifierMask)
 {
-  nsCOMPtr<nsISupports> pcContainer = aPresContext->GetContainer();
+  nsCOMPtr<nsISupports> pcContainer = aPresContext->GetContainerWeak();
 
   // Alt or other accesskey modifier is down, we may need to do an accesskey
   if (mAccessKeys.Count() > 0 &&
@@ -2204,7 +2204,7 @@ nsEventStateManager::DetermineDragTarget(nsPresContext* aPresContext,
 {
   *aTargetNode = nullptr;
 
-  nsCOMPtr<nsISupports> container = aPresContext->GetContainer();
+  nsCOMPtr<nsISupports> container = aPresContext->GetContainerWeak();
   nsCOMPtr<nsPIDOMWindow> window = do_GetInterface(container);
   if (!window)
     return;
@@ -2423,10 +2423,7 @@ nsEventStateManager::GetMarkupDocumentViewer(nsIMarkupDocumentViewer** aMv)
   nsPresContext *presContext = presShell->GetPresContext();
   if(!presContext) return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsISupports> pcContainer = presContext->GetContainer();
-  if(!pcContainer) return NS_ERROR_FAILURE;
-
-  nsCOMPtr<nsIDocShell> docshell(do_QueryInterface(pcContainer));
+  nsCOMPtr<nsIDocShell> docshell(presContext->GetDocShell());
   if(!docshell) return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIContentViewer> cv;
@@ -2487,7 +2484,7 @@ nsEventStateManager::ChangeFullZoom(int32_t change)
 void
 nsEventStateManager::DoScrollHistory(int32_t direction)
 {
-  nsCOMPtr<nsISupports> pcContainer(mPresContext->GetContainer());
+  nsCOMPtr<nsISupports> pcContainer(mPresContext->GetContainerWeak());
   if (pcContainer) {
     nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(pcContainer));
     if (webNav) {
@@ -3787,8 +3784,7 @@ nsEventStateManager::UpdateCursor(nsPresContext* aPresContext,
 
   if (Preferences::GetBool("ui.use_activity_cursor", false)) {
     // Check whether or not to show the busy cursor
-    nsCOMPtr<nsISupports> pcContainer = aPresContext->GetContainer();
-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(pcContainer));
+    nsCOMPtr<nsIDocShell> docShell(aPresContext->GetDocShell());
     if (!docShell) return;
     uint32_t busyFlags = nsIDocShell::BUSY_FLAGS_NONE;
     docShell->GetBusyFlags(&busyFlags);
diff --git a/content/html/content/src/HTMLBodyElement.cpp b/content/html/content/src/HTMLBodyElement.cpp
index 9f17f945eb01..389cdd3d39d7 100644
--- a/content/html/content/src/HTMLBodyElement.cpp
+++ b/content/html/content/src/HTMLBodyElement.cpp
@@ -130,44 +130,41 @@ BodyRule::MapRuleInfoInto(nsRuleData* aData)
   // if marginwidth or marginheight is set in the <frame> and not set in the <body>
   // reflect them as margin in the <body>
   if (bodyMarginWidth == -1 || bodyMarginHeight == -1) {
-    nsCOMPtr<nsISupports> container = aData->mPresContext->GetContainer();
-    if (container) {
-      nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
-      if (docShell) {
-        nscoord frameMarginWidth=-1;  // default value
-        nscoord frameMarginHeight=-1; // default value
-        docShell->GetMarginWidth(&frameMarginWidth); // -1 indicates not set   
-        docShell->GetMarginHeight(&frameMarginHeight); 
-        if ((frameMarginWidth >= 0) && (bodyMarginWidth == -1)) { // set in <frame> & not in <body> 
-          if (eCompatibility_NavQuirks == mode) {
-            if ((bodyMarginHeight == -1) && (0 > frameMarginHeight)) // nav quirk 
-              frameMarginHeight = 0;
-          }
+    nsCOMPtr<nsIDocShell> docShell(aData->mPresContext->GetDocShell());
+    if (docShell) {
+      nscoord frameMarginWidth=-1;  // default value
+      nscoord frameMarginHeight=-1; // default value
+      docShell->GetMarginWidth(&frameMarginWidth); // -1 indicates not set
+      docShell->GetMarginHeight(&frameMarginHeight);
+      if ((frameMarginWidth >= 0) && (bodyMarginWidth == -1)) { // set in <frame> & not in <body>
+        if (eCompatibility_NavQuirks == mode) {
+          if ((bodyMarginHeight == -1) && (0 > frameMarginHeight)) // nav quirk
+            frameMarginHeight = 0;
         }
-        if ((frameMarginHeight >= 0) && (bodyMarginHeight == -1)) { // set in <frame> & not in <body> 
-          if (eCompatibility_NavQuirks == mode) {
-            if ((bodyMarginWidth == -1) && (0 > frameMarginWidth)) // nav quirk
-              frameMarginWidth = 0;
-          }
+      }
+      if ((frameMarginHeight >= 0) && (bodyMarginHeight == -1)) { // set in <frame> & not in <body>
+        if (eCompatibility_NavQuirks == mode) {
+          if ((bodyMarginWidth == -1) && (0 > frameMarginWidth)) // nav quirk
+            frameMarginWidth = 0;
         }
+      }
 
-        if ((bodyMarginWidth == -1) && (frameMarginWidth >= 0)) {
-          nsCSSValue* marginLeft = aData->ValueForMarginLeftValue();
-          if (marginLeft->GetUnit() == eCSSUnit_Null)
-            marginLeft->SetFloatValue((float)frameMarginWidth, eCSSUnit_Pixel);
-          nsCSSValue* marginRight = aData->ValueForMarginRightValue();
-          if (marginRight->GetUnit() == eCSSUnit_Null)
-            marginRight->SetFloatValue((float)frameMarginWidth, eCSSUnit_Pixel);
-        }
+      if ((bodyMarginWidth == -1) && (frameMarginWidth >= 0)) {
+        nsCSSValue* marginLeft = aData->ValueForMarginLeftValue();
+        if (marginLeft->GetUnit() == eCSSUnit_Null)
+          marginLeft->SetFloatValue((float)frameMarginWidth, eCSSUnit_Pixel);
+        nsCSSValue* marginRight = aData->ValueForMarginRightValue();
+        if (marginRight->GetUnit() == eCSSUnit_Null)
+          marginRight->SetFloatValue((float)frameMarginWidth, eCSSUnit_Pixel);
+      }
 
-        if ((bodyMarginHeight == -1) && (frameMarginHeight >= 0)) {
-          nsCSSValue* marginTop = aData->ValueForMarginTop();
-          if (marginTop->GetUnit() == eCSSUnit_Null)
-            marginTop->SetFloatValue((float)frameMarginHeight, eCSSUnit_Pixel);
-          nsCSSValue* marginBottom = aData->ValueForMarginBottom();
-          if (marginBottom->GetUnit() == eCSSUnit_Null)
-            marginBottom->SetFloatValue((float)frameMarginHeight, eCSSUnit_Pixel);
-        }
+      if ((bodyMarginHeight == -1) && (frameMarginHeight >= 0)) {
+        nsCSSValue* marginTop = aData->ValueForMarginTop();
+        if (marginTop->GetUnit() == eCSSUnit_Null)
+          marginTop->SetFloatValue((float)frameMarginHeight, eCSSUnit_Pixel);
+        nsCSSValue* marginBottom = aData->ValueForMarginBottom();
+        if (marginBottom->GetUnit() == eCSSUnit_Null)
+          marginBottom->SetFloatValue((float)frameMarginHeight, eCSSUnit_Pixel);
       }
     }
   }
@@ -462,8 +459,7 @@ HTMLBodyElement::GetAssociatedEditor()
     return nullptr;
   }
 
-  nsCOMPtr<nsISupports> container = presContext->GetContainer();
-  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShell> docShell = presContext->GetDocShell();
   if (!docShell) {
     return nullptr;
   }
diff --git a/content/smil/nsDOMTimeEvent.cpp b/content/smil/nsDOMTimeEvent.cpp
index a6469d482577..6994343a5d56 100644
--- a/content/smil/nsDOMTimeEvent.cpp
+++ b/content/smil/nsDOMTimeEvent.cpp
@@ -33,7 +33,7 @@ nsDOMTimeEvent::nsDOMTimeEvent(mozilla::dom::EventTarget* aOwner,
   mEvent->mFlags.mCancelable = false;
 
   if (mPresContext) {
-    nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
+    nsISupports* container = mPresContext->GetContainerWeak();
     if (container) {
       nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
       if (window) {
diff --git a/content/xul/document/src/XULDocument.cpp b/content/xul/document/src/XULDocument.cpp
index baad170ec961..be5f8fc7ec5e 100644
--- a/content/xul/document/src/XULDocument.cpp
+++ b/content/xul/document/src/XULDocument.cpp
@@ -2042,12 +2042,7 @@ XULDocument::StartLayout(void)
         if (! cx)
             return NS_ERROR_UNEXPECTED;
 
-        nsCOMPtr<nsISupports> container = cx->GetContainer();
-        NS_ASSERTION(container != nullptr, "pres context has no container");
-        if (! container)
-            return NS_ERROR_UNEXPECTED;
-
-        nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+        nsCOMPtr<nsIDocShell> docShell = cx->GetDocShell();
         NS_ASSERTION(docShell != nullptr, "container is not a docshell");
         if (! docShell)
             return NS_ERROR_UNEXPECTED;
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 7edc40bf2dbd..698c9de79ba3 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -325,8 +325,7 @@ MaybeReflowForInflationScreenWidthChange(nsPresContext *aPresContext)
     changed = changed ||
       (fontInflationWasEnabled != presShell->FontSizeInflationEnabled());
     if (changed) {
-      nsCOMPtr<nsISupports> container = aPresContext->GetContainer();
-      nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
+      nsCOMPtr<nsIDocShell> docShell = aPresContext->GetDocShell();
       if (docShell) {
         nsCOMPtr<nsIContentViewer> cv;
         docShell->GetContentViewer(getter_AddRefs(cv));
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index f20c42c60fd6..cb5974fe7358 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -498,7 +498,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetURL(const char *aURL,
   }
 
   // the container of the pres context will give us the link handler
-  nsCOMPtr<nsISupports> container = presContext->GetContainer();
+  nsCOMPtr<nsISupports> container = presContext->GetContainerWeak();
   NS_ENSURE_TRUE(container,NS_ERROR_FAILURE);
   nsCOMPtr<nsILinkHandler> lh = do_QueryInterface(container);
   NS_ENSURE_TRUE(lh, NS_ERROR_FAILURE);
@@ -554,12 +554,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::ShowStatus(const PRUnichar *aStatusMsg)
   if (!mObjectFrame) {
     return rv;
   }
-  nsCOMPtr<nsISupports> cont = mObjectFrame->PresContext()->GetContainer();
-  if (!cont) {
-    return NS_OK;
-  }
-
-  nsCOMPtr<nsIDocShellTreeItem> docShellItem(do_QueryInterface(cont, &rv));
+  nsCOMPtr<nsIDocShellTreeItem> docShellItem = mObjectFrame->PresContext()->GetDocShell();
   if (NS_FAILED(rv) || !docShellItem) {
     return rv;
   }
diff --git a/editor/composer/src/nsComposerDocumentCommands.cpp b/editor/composer/src/nsComposerDocumentCommands.cpp
index b74179b58a46..f45826372ea9 100644
--- a/editor/composer/src/nsComposerDocumentCommands.cpp
+++ b/editor/composer/src/nsComposerDocumentCommands.cpp
@@ -105,11 +105,7 @@ nsSetDocumentOptionsCommand::DoCommandParams(const char *aCommandName,
   rv = aParams->GetBooleanValue("plugins", &allowPlugins);
   if (NS_SUCCEEDED(rv))
   {
-    nsCOMPtr<nsISupports> container = presContext->GetContainer();
-    NS_ENSURE_TRUE(container, NS_ERROR_FAILURE);
-
-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container, &rv));
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIDocShell> docShell(presContext->GetDocShell());
     NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
 
     rv = docShell->SetAllowPlugins(allowPlugins);
@@ -158,11 +154,7 @@ nsSetDocumentOptionsCommand::GetCommandStateParams(const char *aCommandName,
   rv = aParams->GetBooleanValue("plugins", &allowPlugins);
   if (NS_SUCCEEDED(rv))
   {
-    nsCOMPtr<nsISupports> container = presContext->GetContainer();
-    NS_ENSURE_TRUE(container, NS_ERROR_FAILURE);
-
-    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container, &rv));
-    NS_ENSURE_SUCCESS(rv, rv);
+    nsCOMPtr<nsIDocShell> docShell(presContext->GetDocShell());
     NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
 
     allowPlugins = docShell->PluginsAllowedInCurrentDoc();
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index b6d3332d145f..c4a154168510 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -49,7 +49,7 @@
 #include "nsContentUtils.h"
 #include "nsIScriptError.h"
 #ifdef XP_MACOSX
-#include "nsIDocShellTreeItem.h"
+#include "nsIDocShell.h"
 #endif
 #include "ChildIterator.h"
 #include "nsError.h"
@@ -4094,22 +4094,19 @@ const nsCSSFrameConstructor::FrameConstructionData*
 nsCSSFrameConstructor::FindXULMenubarData(Element* aElement,
                                           nsStyleContext* aStyleContext)
 {
-  nsCOMPtr<nsISupports> container =
-    aStyleContext->PresContext()->GetContainer();
-  if (container) {
-    nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
-    if (treeItem) {
-      int32_t type;
-      treeItem->GetItemType(&type);
-      if (nsIDocShellTreeItem::typeChrome == type) {
-        nsCOMPtr<nsIDocShellTreeItem> parent;
-        treeItem->GetParent(getter_AddRefs(parent));
-        if (!parent) {
-          // This is the root.  Suppress the menubar, since on Mac
-          // window menus are not attached to the window.
-          static const FrameConstructionData sSuppressData = SUPPRESS_FCDATA();
-          return &sSuppressData;
-        }
+  nsCOMPtr<nsIDocShell> treeItem =
+    aStyleContext->PresContext()->GetDocShell();
+  if (treeItem) {
+    int32_t type;
+    treeItem->GetItemType(&type);
+    if (nsIDocShellTreeItem::typeChrome == type) {
+      nsCOMPtr<nsIDocShellTreeItem> parent;
+      treeItem->GetParent(getter_AddRefs(parent));
+      if (!parent) {
+        // This is the root.  Suppress the menubar, since on Mac
+        // window menus are not attached to the window.
+        static const FrameConstructionData sSuppressData = SUPPRESS_FCDATA();
+        return &sSuppressData;
       }
     }
   }
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index 268366040fce..0d39f8cdd258 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -617,7 +617,7 @@ nsDocumentViewer::SetContainer(nsIDocShell* aContainer)
 {
   mContainer = static_cast<nsDocShell*>(aContainer)->asWeakPtr();
   if (mPresContext) {
-    mPresContext->SetContainer(aContainer);
+    mPresContext->SetContainer(mContainer);
   }
 
   // We're loading a new document into the window where this document
@@ -887,7 +887,7 @@ nsDocumentViewer::InitInternal(nsIWidget* aParentWidget,
       requestor->GetInterface(NS_GET_IID(nsILinkHandler),
                               getter_AddRefs(linkHandler));
 
-      mPresContext->SetContainer(requestor);
+      mPresContext->SetContainer(mContainer);
       mPresContext->SetLinkHandler(linkHandler);
     }
 
@@ -1309,13 +1309,13 @@ AttachContainerRecurse(nsIDocShell* aShell)
     nsRefPtr<nsPresContext> pc;
     viewer->GetPresContext(getter_AddRefs(pc));
     if (pc) {
-      pc->SetContainer(aShell);
+      pc->SetContainer(static_cast<nsDocShell*>(aShell));
       pc->SetLinkHandler(nsCOMPtr<nsILinkHandler>(do_QueryInterface(aShell)));
     }
     nsCOMPtr<nsIPresShell> presShell;
     viewer->GetPresShell(getter_AddRefs(presShell));
     if (presShell) {
-      presShell->SetForwardingContainer(nullptr);
+      presShell->SetForwardingContainer(WeakPtr<nsDocShell>());
     }
   }
 
@@ -1343,7 +1343,7 @@ nsDocumentViewer::Open(nsISupports *aState, nsISHEntry *aSHEntry)
   mHidden = false;
 
   if (mPresShell)
-    mPresShell->SetForwardingContainer(nullptr);
+    mPresShell->SetForwardingContainer(WeakPtr<nsDocShell>());
 
   // Rehook the child presentations.  The child shells are still in
   // session history, so get them from there.
@@ -1469,7 +1469,8 @@ DetachContainerRecurse(nsIDocShell *aShell)
     nsCOMPtr<nsIPresShell> presShell;
     viewer->GetPresShell(getter_AddRefs(presShell));
     if (presShell) {
-      presShell->SetForwardingContainer(nsWeakPtr(do_GetWeakReference(aShell)));
+      auto weakShell = static_cast<nsDocShell*>(aShell)->asWeakPtr();
+      presShell->SetForwardingContainer(weakShell);
     }
   }
 
@@ -1590,9 +1591,7 @@ nsDocumentViewer::Destroy()
       mPresContext->SetContainer(nullptr);
     }
     if (mPresShell) {
-      nsWeakPtr container =
-        do_GetWeakReference(static_cast<nsIDocShell*>(mContainer));
-      mPresShell->SetForwardingContainer(container);
+      mPresShell->SetForwardingContainer(mContainer);
     }
 
     // Do the same for our children.  Note that we need to get the child
@@ -1993,7 +1992,7 @@ nsDocumentViewer::Show(void)
         mPresContext->SetLinkHandler(linkHandler);
       }
 
-      mPresContext->SetContainer(base_win);
+      mPresContext->SetContainer(mContainer);
     }
 
     if (mPresContext) {
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index 8ab4b2c8e885..30d4f6025165 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -22,6 +22,7 @@
 
 #include "mozilla/EventForwards.h"
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/WeakPtr.h"
 #include "gfxPoint.h"
 #include "nsTHashtable.h"
 #include "nsHashKeys.h"
@@ -42,6 +43,7 @@
 #include "nsMargin.h"
 
 class nsIContent;
+class nsDocShell;
 class nsIDocument;
 class nsIFrame;
 class nsPresContext;
@@ -956,7 +958,7 @@ public:
    * user events at the docshell's parent.  This pointer allows us to do that.
    * It should not be used for any other purpose.
    */
-  void SetForwardingContainer(nsWeakPtr aContainer)
+  void SetForwardingContainer(const mozilla::WeakPtr<nsDocShell> &aContainer)
   {
     mForwardingContainer = aContainer;
   }
@@ -1508,7 +1510,7 @@ protected:
   // Pointer into mFrameConstructor - this is purely so that FrameManager() and
   // GetRootFrame() can be inlined:
   nsFrameManagerBase*       mFrameManager;
-  nsWeakPtr                 mForwardingContainer;
+  mozilla::WeakPtr<nsDocShell>                 mForwardingContainer;
   nsRefreshDriver*          mHiddenInvalidationObserverRefreshDriver;
 #ifdef ACCESSIBILITY
   mozilla::a11y::DocAccessible* mDocAccessible;
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index a181bf8141b5..6127b581b1f8 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -12,7 +12,7 @@
 #include "nsCOMPtr.h"
 #include "nsPresContext.h"
 #include "nsIPresShell.h"
-#include "nsIDocShell.h"
+#include "nsDocShell.h"
 #include "nsIContentViewer.h"
 #include "nsPIDOMWindow.h"
 #include "nsStyleSet.h"
@@ -621,7 +621,7 @@ nsPresContext::GetDocumentColorPreferences()
 {
   int32_t useAccessibilityTheme = 0;
   bool usePrefColors = true;
-  nsCOMPtr<nsIDocShellTreeItem> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeItem> docShell(mContainer);
   if (docShell) {
     int32_t docShellType;
     docShell->GetItemType(&docShellType);
@@ -894,7 +894,7 @@ nsPresContext::UpdateAfterPreferencesChanged()
 {
   mPrefChangedTimer = nullptr;
 
-  nsCOMPtr<nsIDocShellTreeItem> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeItem> docShell(mContainer);
   if (docShell) {
     int32_t docShellType;
     docShell->GetItemType(&docShellType);
@@ -1479,26 +1479,35 @@ nsPresContext::ScreenWidthInchesForFontInflation(bool* aChanged)
 }
 
 void
-nsPresContext::SetContainer(nsISupports* aHandler)
+nsPresContext::SetContainer(nsIDocShell* aDocShell)
 {
-  mContainer = do_GetWeakReference(aHandler);
+  if (aDocShell) {
+    mContainer = static_cast<nsDocShell*>(aDocShell)->asWeakPtr();
+  } else {
+    mContainer = WeakPtr<nsDocShell>();
+  }
   InvalidateIsChromeCache();
   if (mContainer) {
     GetDocumentColorPreferences();
   }
 }
 
-already_AddRefed<nsISupports>
-nsPresContext::GetContainerInternal() const
+nsISupports*
+nsPresContext::GetContainerWeakInternal() const
 {
-  nsCOMPtr<nsISupports> result = do_QueryReferent(mContainer);
-  return result.forget();
+  return static_cast<nsIDocShell*>(mContainer);
 }
 
-already_AddRefed<nsISupports>
-nsPresContext::GetContainerExternal() const
+nsISupports*
+nsPresContext::GetContainerWeakExternal() const
 {
-  return GetContainerInternal();
+  return GetContainerWeakInternal();
+}
+
+nsIDocShell*
+nsPresContext::GetDocShell() const
+{
+  return mContainer;
 }
 
 bool
@@ -1596,7 +1605,7 @@ nsPresContext::GetBidi() const
 bool
 nsPresContext::IsTopLevelWindowInactive()
 {
-  nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShellTreeItem> treeItem(mContainer);
   if (!treeItem)
     return false;
 
@@ -1919,7 +1928,7 @@ nsPresContext::SetPrintSettings(nsIPrintSettings *aPrintSettings)
 bool
 nsPresContext::EnsureVisible()
 {
-  nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShell> docShell(mContainer);
   if (docShell) {
     nsCOMPtr<nsIContentViewer> cv;
     docShell->GetContentViewer(getter_AddRefs(cv));
@@ -1953,16 +1962,12 @@ bool
 nsPresContext::IsChromeSlow() const
 {
   bool isChrome = false;
-  nsCOMPtr<nsISupports> container = GetContainer();
-  if (container) {
-    nsresult result;
-    nsCOMPtr<nsIDocShellTreeItem> docShell(do_QueryInterface(container, &result));
-    if (NS_SUCCEEDED(result) && docShell) {
-      int32_t docShellType;
-      result = docShell->GetItemType(&docShellType);
-      if (NS_SUCCEEDED(result)) {
-        isChrome = nsIDocShellTreeItem::typeChrome == docShellType;
-      }
+  nsCOMPtr<nsIDocShellTreeItem> docShell(mContainer);
+  if (docShell) {
+    int32_t docShellType;
+    nsresult result = docShell->GetItemType(&docShellType);
+    if (NS_SUCCEEDED(result)) {
+      isChrome = nsIDocShellTreeItem::typeChrome == docShellType;
     }
   }
   mIsChrome = isChrome;
@@ -2697,7 +2702,7 @@ bool
 nsPresContext::IsDeviceSizePageSize()
 {
   bool isDeviceSizePageSize = false;
-  nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mContainer));
+  nsCOMPtr<nsIDocShell> docShell(mContainer);
   if (docShell) {
     isDeviceSizePageSize = docShell->GetDeviceSizeIsPageSize();
   }
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index 267028903357..4add2ffe7418 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -9,6 +9,7 @@
 #define nsPresContext_h___
 
 #include "mozilla/Attributes.h"
+#include "mozilla/WeakPtr.h"
 #include "nsColor.h"
 #include "nsCoord.h"
 #include "nsCOMPtr.h"
@@ -42,6 +43,8 @@ class nsBidiPresUtils;
 
 class nsAString;
 class nsIPrintSettings;
+class nsDocShell;
+class nsIDocShell;
 class nsIDocument;
 class nsILanguageAtomService;
 class nsITheme;
@@ -410,18 +413,20 @@ public:
   bool GetFocusRingOnAnything() const { return mFocusRingOnAnything; }
   uint8_t GetFocusRingStyle() const { return mFocusRingStyle; }
 
-  NS_HIDDEN_(void) SetContainer(nsISupports* aContainer);
+  NS_HIDDEN_(void) SetContainer(nsIDocShell* aContainer);
 
-  virtual NS_HIDDEN_(already_AddRefed<nsISupports>) GetContainerExternal() const;
-  NS_HIDDEN_(already_AddRefed<nsISupports>) GetContainerInternal() const;
+  virtual nsISupports* GetContainerWeakExternal() const;
+  nsISupports* GetContainerWeakInternal() const;
 #ifdef MOZILLA_INTERNAL_API
-  already_AddRefed<nsISupports> GetContainer() const
-  { return GetContainerInternal(); }
+  nsISupports* GetContainerWeak() const
+  { return GetContainerWeakInternal(); }
 #else
-  already_AddRefed<nsISupports> GetContainer() const
-  { return GetContainerExternal(); }
+  nsISupports* GetContainerWeak() const
+  { return GetContainerWeakExternal(); }
 #endif
 
+  nsIDocShell* GetDocShell() const;
+
   // XXX this are going to be replaced with set/get container
   void SetLinkHandler(nsILinkHandler* aHandler) { mLinkHandler = aHandler; }
   nsILinkHandler* GetLinkHandler() { return mLinkHandler; }
@@ -1171,7 +1176,7 @@ public:
 
 protected:
 
-  nsWeakPtr             mContainer;
+  mozilla::WeakPtr<nsDocShell>             mContainer;
 
   PRCList               mDOMMediaQueryLists;
 
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 79bd1f451038..a600299c2b9f 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -80,7 +80,7 @@
 #include "pldhash.h"
 #include "mozilla/dom/Touch.h"
 #include "nsIObserverService.h"
-#include "nsIDocShell.h"        // for reflow observation
+#include "nsDocShell.h"        // for reflow observation
 #include "nsIBaseWindow.h"
 #include "nsError.h"
 #include "nsLayoutUtils.h"
@@ -1369,8 +1369,7 @@ nsresult PresShell::SetPrefNoFramesRule(void)
   NS_ASSERTION(mPrefStyleSheet, "prefstylesheet should not be null");
   
   bool allowSubframes = true;
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();     
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+  nsCOMPtr<nsIDocShell> docShell(mPresContext->GetDocShell());
   if (docShell) {
     docShell->GetAllowSubframes(&allowSubframes);
   }
@@ -3645,11 +3644,7 @@ PresShell::CaptureHistoryState(nsILayoutHistoryState** aState)
   // content viewer's Hide() method...  by that point the docshell's
   // state could be wrong.  We should sort out a better ownership
   // model for the layout history state.
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
-  if (!container)
-    return NS_ERROR_FAILURE;
-
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(container));
+  nsCOMPtr<nsIDocShell> docShell(mPresContext->GetDocShell());
   if (!docShell)
     return NS_ERROR_FAILURE;
 
@@ -5081,8 +5076,7 @@ PresShell::AddCanvasBackgroundColorItem(nsDisplayListBuilder& aBuilder,
 
 static bool IsTransparentContainerElement(nsPresContext* aPresContext)
 {
-  nsCOMPtr<nsISupports> container = aPresContext->GetContainerInternal();
-  nsCOMPtr<nsIDocShellTreeItem> docShellItem = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> docShellItem = aPresContext->GetDocShell();
   nsCOMPtr<nsPIDOMWindow> pwin(do_GetInterface(docShellItem));
   if (!pwin)
     return false;
@@ -5567,8 +5561,7 @@ PresShell::AssumeAllImagesVisible()
 
   if (!sImageVisibilityEnabled &&
       sImageVisibilityEnabledForBrowserElementsOnly) {
-    nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
-    nsCOMPtr<nsIDocShell> docshell(do_QueryInterface(container));
+    nsCOMPtr<nsIDocShell> docshell(mPresContext->GetDocShell());
     if (!docshell || !docshell->GetIsInBrowserElement()) {
       return true;
     }
@@ -6006,13 +5999,13 @@ already_AddRefed<nsIPresShell>
 PresShell::GetParentPresShell()
 {
   NS_ENSURE_TRUE(mPresContext, nullptr);
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
-  if (!container) {
-    container = do_QueryReferent(mForwardingContainer);
-  }
 
   // Now, find the parent pres shell and send the event there
-  nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> treeItem = mPresContext->GetDocShell();
+  if (!treeItem) {
+    treeItem = mForwardingContainer.get();
+  }
+
   // Might have gone away, or never been around to start with
   NS_ENSURE_TRUE(treeItem, nullptr);
 
@@ -6327,8 +6320,8 @@ PresShell::HandleEvent(nsIFrame* aFrame,
       // would occur if the mouse button is held down while a tab change occurs.
       // If the docshell is visible, look for a scrolling container.
       bool vis;
-      nsCOMPtr<nsISupports> supports = mPresContext->GetContainer();
-      nsCOMPtr<nsIBaseWindow> baseWin(do_QueryInterface(supports));
+      nsCOMPtr<nsIBaseWindow> baseWin =
+        do_QueryInterface(mPresContext->GetContainerWeak());
       if (baseWin && NS_SUCCEEDED(baseWin->GetVisibility(&vis)) && vis) {
         captureRetarget = gCaptureInfo.mRetargetToElement;
         if (!captureRetarget) {
@@ -6702,8 +6695,7 @@ PresShell::GetTouchEventTargetDocument()
     return nullptr;
   }
 
-  nsCOMPtr<nsISupports> container = context->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> shellAsTreeItem = do_QueryInterface(container);
+  nsCOMPtr<nsIDocShellTreeItem> shellAsTreeItem = context->GetDocShell();
   if (!shellAsTreeItem) {
     return nullptr;
   }
@@ -7183,7 +7175,7 @@ PresShell::HandleDOMEventWithTarget(nsIContent* aTargetContent,
   // and the js context is out of date. This check detects the case
   // that caused a crash in bug 41013, but there may be a better way
   // to handle this situation!
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
+  nsCOMPtr<nsISupports> container = mPresContext->GetContainerWeak();
   if (container) {
 
     // Dispatch event to content
@@ -7204,7 +7196,7 @@ PresShell::HandleDOMEventWithTarget(nsIContent* aTargetContent,
   nsresult rv = NS_OK;
 
   PushCurrentEventInfo(nullptr, aTargetContent);
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
+  nsCOMPtr<nsISupports> container = mPresContext->GetContainerWeak();
   if (container) {
     rv = nsEventDispatcher::DispatchDOMEvent(aTargetContent, nullptr, aEvent,
                                              mPresContext, aStatus);
@@ -7877,13 +7869,10 @@ PresShell::DidDoReflow(bool aInterruptible, bool aWasInterrupted)
   
   HandlePostedReflowCallbacks(aInterruptible);
 
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
-  if (container) {
-    nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
-    if (docShell) {
-      DOMHighResTimeStamp now = GetPerformanceNow();
-      docShell->NotifyReflowObservers(aInterruptible, mLastReflowStart, now);
-    }
+  nsCOMPtr<nsIDocShell> docShell = mPresContext->GetDocShell();
+  if (docShell) {
+    DOMHighResTimeStamp now = GetPerformanceNow();
+    docShell->NotifyReflowObservers(aInterruptible, mLastReflowStart, now);
   }
 
   if (sSynthMouseMove) {
@@ -9628,7 +9617,7 @@ void nsIPresShell::ReleaseStatics()
 // Asks our docshell whether we're active.
 void PresShell::QueryIsActive()
 {
-  nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
+  nsCOMPtr<nsISupports> container = mPresContext->GetContainerWeak();
   if (mDocument) {
     nsIDocument* displayDoc = mDocument->GetDisplayDocument();
     if (displayDoc) {
@@ -9641,7 +9630,7 @@ void PresShell::QueryIsActive()
 
       nsIPresShell* displayPresShell = displayDoc->GetShell();
       if (displayPresShell) {
-        container = displayPresShell->GetPresContext()->GetContainer();
+        container = displayPresShell->GetPresContext()->GetContainerWeak();
       }
     }
   }
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 97239c0bc0b8..2712405a1861 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -2491,7 +2491,7 @@ ScrollFrameHelper::GetScrollbarStylesFromFrame() const
   }
 
   ScrollbarStyles result = presContext->GetViewportOverflowOverride();
-  nsCOMPtr<nsISupports> container = presContext->GetContainer();
+  nsCOMPtr<nsISupports> container = presContext->GetContainerWeak();
   nsCOMPtr<nsIScrollable> scrollable = do_QueryInterface(container);
   if (scrollable) {
     HandleScrollPref(scrollable, nsIScrollable::ScrollOrientation_X,
diff --git a/layout/mathml/nsMathMLmactionFrame.cpp b/layout/mathml/nsMathMLmactionFrame.cpp
index 673e42e70c3f..5f8d9d093089 100644
--- a/layout/mathml/nsMathMLmactionFrame.cpp
+++ b/layout/mathml/nsMathMLmactionFrame.cpp
@@ -8,7 +8,7 @@
 #include "nsPresContext.h"
 #include "nsINameSpaceManager.h"
 #include "prprf.h"         // For PR_snprintf()
-#include "nsIDocShellTreeItem.h"
+#include "nsIDocShell.h"
 #include "nsIDocShellTreeOwner.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsIInterfaceRequestorUtils.h"
@@ -246,17 +246,14 @@ NS_IMPL_ISUPPORTS1(nsMathMLmactionFrame::MouseListener,
 void
 ShowStatus(nsPresContext* aPresContext, nsString& aStatusMsg)
 {
-  nsCOMPtr<nsISupports> cont = aPresContext->GetContainer();
-  if (cont) {
-    nsCOMPtr<nsIDocShellTreeItem> docShellItem(do_QueryInterface(cont));
-    if (docShellItem) {
-      nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
-      docShellItem->GetTreeOwner(getter_AddRefs(treeOwner));
-      if (treeOwner) {
-        nsCOMPtr<nsIWebBrowserChrome> browserChrome(do_GetInterface(treeOwner));
-        if (browserChrome) {
-          browserChrome->SetStatus(nsIWebBrowserChrome::STATUS_LINK, aStatusMsg.get());
-        }
+  nsCOMPtr<nsIDocShellTreeItem> docShellItem(aPresContext->GetDocShell());
+  if (docShellItem) {
+    nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
+    docShellItem->GetTreeOwner(getter_AddRefs(treeOwner));
+    if (treeOwner) {
+      nsCOMPtr<nsIWebBrowserChrome> browserChrome(do_GetInterface(treeOwner));
+      if (browserChrome) {
+        browserChrome->SetStatus(nsIWebBrowserChrome::STATUS_LINK, aStatusMsg.get());
       }
     }
   }
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index 31445e87face..e24b1fb8c5c9 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -2214,8 +2214,7 @@ nsPrintEngine::ReflowPrintObject(nsPrintObject * aPO)
 
   // This docshell stuff is weird; will go away when we stop having multiple
   // presentations per document
-  nsCOMPtr<nsISupports> supps(do_QueryInterface(aPO->mDocShell));
-  aPO->mPresContext->SetContainer(supps);
+  aPO->mPresContext->SetContainer(aPO->mDocShell);
 
   aPO->mPresShell->BeginObservingDocument();
 
diff --git a/layout/svg/nsSVGOuterSVGFrame.cpp b/layout/svg/nsSVGOuterSVGFrame.cpp
index b3deae5305d9..c472e8111595 100644
--- a/layout/svg/nsSVGOuterSVGFrame.cpp
+++ b/layout/svg/nsSVGOuterSVGFrame.cpp
@@ -915,7 +915,7 @@ nsSVGOuterSVGFrame::IsRootOfReplacedElementSubDoc(nsIFrame **aEmbeddingFrame)
 {
   if (!mContent->GetParent()) {
     // Our content is the document element
-    nsCOMPtr<nsISupports> container = PresContext()->GetContainer();
+    nsCOMPtr<nsISupports> container = PresContext()->GetContainerWeak();
     nsCOMPtr<nsIDOMWindow> window = do_GetInterface(container);
     if (window) {
       nsCOMPtr<nsIDOMElement> frameElement;
diff --git a/layout/xul/nsMenuPopupFrame.cpp b/layout/xul/nsMenuPopupFrame.cpp
index f5b4e02d2149..f307e35ddd08 100644
--- a/layout/xul/nsMenuPopupFrame.cpp
+++ b/layout/xul/nsMenuPopupFrame.cpp
@@ -29,7 +29,7 @@
 #include "nsBoxLayoutState.h"
 #include "nsIScrollableFrame.h"
 #include "nsIRootBox.h"
-#include "nsIDocShellTreeItem.h"
+#include "nsIDocShell.h"
 #include "nsReadableUtils.h"
 #include "nsUnicharUtils.h"
 #include "nsLayoutUtils.h"
@@ -147,8 +147,7 @@ nsMenuPopupFrame::Init(nsIContent*      aContent,
     mIsDragPopup = true;
   }
 
-  nsCOMPtr<nsISupports> cont = PresContext()->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(cont);
+  nsCOMPtr<nsIDocShellTreeItem> dsti = PresContext()->GetDocShell();
   int32_t type = -1;
   if (dsti && NS_SUCCEEDED(dsti->GetItemType(&type)) &&
       type == nsIDocShellTreeItem::typeChrome)
@@ -280,8 +279,7 @@ nsMenuPopupFrame::CreateWidgetForView(nsView* aView)
   // should be in front of it.
   nsCOMPtr<nsIWidget> parentWidget;
   if (widgetData.mPopupLevel != ePopupLevelTop) {
-    nsCOMPtr<nsISupports> cont = PresContext()->GetContainer();
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(cont);
+    nsCOMPtr<nsIDocShellTreeItem> dsti = PresContext()->GetDocShell();
     if (!dsti)
       return NS_ERROR_FAILURE;
 
diff --git a/layout/xul/nsResizerFrame.cpp b/layout/xul/nsResizerFrame.cpp
index 41483ca6c6b2..2e082ef9f8b2 100644
--- a/layout/xul/nsResizerFrame.cpp
+++ b/layout/xul/nsResizerFrame.cpp
@@ -338,8 +338,7 @@ nsResizerFrame::GetContentToResize(nsIPresShell* aPresShell, nsIBaseWindow** aWi
 
     // don't allow resizing windows in content shells
     bool isChromeShell = false;
-    nsCOMPtr<nsISupports> cont = aPresShell->GetPresContext()->GetContainer();
-    nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(cont);
+    nsCOMPtr<nsIDocShellTreeItem> dsti = aPresShell->GetPresContext()->GetDocShell();
     if (dsti) {
       int32_t type = -1;
       isChromeShell = (NS_SUCCEEDED(dsti->GetItemType(&type)) &&
diff --git a/layout/xul/nsTitleBarFrame.cpp b/layout/xul/nsTitleBarFrame.cpp
index 44f5f47fa1a6..3e44250d37da 100644
--- a/layout/xul/nsTitleBarFrame.cpp
+++ b/layout/xul/nsTitleBarFrame.cpp
@@ -12,7 +12,7 @@
 #include "nsIWidget.h"
 #include "nsMenuPopupFrame.h"
 #include "nsPresContext.h"
-#include "nsIDocShellTreeItem.h"
+#include "nsIDocShell.h"
 #include "nsPIDOMWindow.h"
 #include "nsEventDispatcher.h"
 #include "nsDisplayList.h"
@@ -72,8 +72,7 @@ nsTitleBarFrame::HandleEvent(nsPresContext* aPresContext,
    case NS_MOUSE_BUTTON_DOWN:  {
        if (aEvent->AsMouseEvent()->button == WidgetMouseEvent::eLeftButton) {
          // titlebar has no effect in non-chrome shells
-         nsCOMPtr<nsISupports> cont = aPresContext->GetContainer();
-         nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(cont);
+         nsCOMPtr<nsIDocShellTreeItem> dsti = aPresContext->GetDocShell();
          if (dsti) {
            int32_t type = -1;
            if (NS_SUCCEEDED(dsti->GetItemType(&type)) &&
diff --git a/layout/xul/nsXULPopupManager.cpp b/layout/xul/nsXULPopupManager.cpp
index e666547c46d3..5a5e1f3abf42 100644
--- a/layout/xul/nsXULPopupManager.cpp
+++ b/layout/xul/nsXULPopupManager.cpp
@@ -1466,8 +1466,7 @@ nsXULPopupManager::MayShowPopup(nsMenuPopupFrame* aPopup)
   if (widget && widget->GetLastRollup() == aPopup->GetContent())
       return false;
 
-  nsCOMPtr<nsISupports> cont = aPopup->PresContext()->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_QueryInterface(cont);
+  nsCOMPtr<nsIDocShellTreeItem> dsti = aPopup->PresContext()->GetDocShell();
   nsCOMPtr<nsIBaseWindow> baseWin = do_QueryInterface(dsti);
   if (!baseWin)
     return false;
diff --git a/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp b/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
index fbeaf6a448d8..985d7e62897d 100644
--- a/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
+++ b/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
@@ -311,17 +311,15 @@ nsTypeAheadFind::FindItNow(nsIPresShell *aPresShell, bool aIsLinksOnly,
       nsISelectionController::SELECTION_NORMAL, getter_AddRefs(selection));
   }
  
-  nsCOMPtr<nsISupports> startingContainer = presContext->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(startingContainer));
-  NS_ASSERTION(treeItem, "Bug 175321 Crashes with Type Ahead Find [@ nsTypeAheadFind::FindItNow]");
-  if (!treeItem)
+  nsCOMPtr<nsIDocShell> startingDocShell(presContext->GetDocShell());
+  NS_ASSERTION(startingDocShell, "Bug 175321 Crashes with Type Ahead Find [@ nsTypeAheadFind::FindItNow]");
+  if (!startingDocShell)
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDocShellTreeItem> rootContentTreeItem;
   nsCOMPtr<nsIDocShell> currentDocShell;
-  nsCOMPtr<nsIDocShell> startingDocShell(do_QueryInterface(startingContainer));
 
-  treeItem->GetSameTypeRootTreeItem(getter_AddRefs(rootContentTreeItem));
+  startingDocShell->GetSameTypeRootTreeItem(getter_AddRefs(rootContentTreeItem));
   nsCOMPtr<nsIDocShell> rootContentDocShell =
     do_QueryInterface(rootContentTreeItem);
 
@@ -334,7 +332,7 @@ nsTypeAheadFind::FindItNow(nsIPresShell *aPresShell, bool aIsLinksOnly,
                                              getter_AddRefs(docShellEnumerator));
 
   // Default: can start at the current document
-  nsCOMPtr<nsISupports> currentContainer = startingContainer =
+  nsCOMPtr<nsISupports> currentContainer =
     do_QueryInterface(rootContentDocShell);
 
   // Iterate up to current shell, if there's more than 1 that we're
@@ -1224,7 +1222,7 @@ nsTypeAheadFind::GetPresShell()
   nsCOMPtr<nsIPresShell> shell = do_QueryReferent(mPresShell);
   if (shell) {
     nsPresContext *pc = shell->GetPresContext();
-    if (!pc || !nsCOMPtr<nsISupports>(pc->GetContainer())) {
+    if (!pc || !pc->GetContainerWeak()) {
       return nullptr;
     }
   }
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index 5e14b5ceea47..8640e221a71e 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -1513,8 +1513,7 @@ nsBaseWidget::GetRootAccessible()
   // If container is null then the presshell is not active. This often happens
   // when a preshell is being held onto for fastback.
   nsPresContext* presContext = presShell->GetPresContext();
-  nsCOMPtr<nsISupports> container = presContext->GetContainer();
-  NS_ENSURE_TRUE(container, nullptr);
+  NS_ENSURE_TRUE(presContext->GetContainerWeak(), nullptr);
 
   // Accessible creation might be not safe so use IsSafeToRunScript to
   // make sure it's not created at unsafe times.

From 19a2049c2c94072d1c0b61985197390659d6d585 Mon Sep 17 00:00:00 2001
From: Trevor Saunders <trev.saunders@gmail.com>
Date: Mon, 18 Nov 2013 13:52:21 -0500
Subject: [PATCH 043/459] bug 938197 - alias atk text attr names to gecko ones
 r=surkov

---
 accessible/src/atk/AccessibleWrap.cpp     |  2 +-
 accessible/src/atk/nsMaiInterfaceText.cpp | 86 ++++++++++++++++++++++-
 2 files changed, 84 insertions(+), 4 deletions(-)

diff --git a/accessible/src/atk/AccessibleWrap.cpp b/accessible/src/atk/AccessibleWrap.cpp
index 639ebec8769f..40609a1264f4 100644
--- a/accessible/src/atk/AccessibleWrap.cpp
+++ b/accessible/src/atk/AccessibleWrap.cpp
@@ -692,7 +692,7 @@ getRoleCB(AtkObject *aAtkObj)
   return aAtkObj->role;
 }
 
-AtkAttributeSet*
+static AtkAttributeSet*
 ConvertToAtkAttributeSet(nsIPersistentProperties* aAttributes)
 {
     if (!aAttributes)
diff --git a/accessible/src/atk/nsMaiInterfaceText.cpp b/accessible/src/atk/nsMaiInterfaceText.cpp
index 3e373d2d44f4..946acfd2a011 100644
--- a/accessible/src/atk/nsMaiInterfaceText.cpp
+++ b/accessible/src/atk/nsMaiInterfaceText.cpp
@@ -12,12 +12,87 @@
 
 #include "nsIAccessibleTypes.h"
 #include "nsIPersistentProperties2.h"
+#include "nsISimpleEnumerator.h"
 
 #include "mozilla/Likely.h"
 
+using namespace mozilla;
 using namespace mozilla::a11y;
 
-AtkAttributeSet* ConvertToAtkAttributeSet(nsIPersistentProperties* aAttributes);
+static const char* sAtkTextAttrNames[ATK_TEXT_ATTR_LAST_DEFINED];
+
+static AtkAttributeSet*
+ConvertToAtkTextAttributeSet(nsIPersistentProperties* aAttributes)
+{
+  if (!aAttributes)
+    return nullptr;
+
+  AtkAttributeSet* objAttributeSet = nullptr;
+  nsCOMPtr<nsISimpleEnumerator> propEnum;
+  nsresult rv = aAttributes->Enumerate(getter_AddRefs(propEnum));
+  NS_ENSURE_SUCCESS(rv, nullptr);
+
+  bool hasMore = false;
+  while (NS_SUCCEEDED(propEnum->HasMoreElements(&hasMore)) && hasMore) {
+    nsCOMPtr<nsISupports> sup;
+    rv = propEnum->GetNext(getter_AddRefs(sup));
+    NS_ENSURE_SUCCESS(rv, objAttributeSet);
+
+    nsCOMPtr<nsIPropertyElement> propElem(do_QueryInterface(sup));
+    NS_ENSURE_TRUE(propElem, objAttributeSet);
+
+    nsAutoCString name;
+    rv = propElem->GetKey(name);
+    NS_ENSURE_SUCCESS(rv, objAttributeSet);
+
+    nsAutoString value;
+    rv = propElem->GetValue(value);
+    NS_ENSURE_SUCCESS(rv, objAttributeSet);
+
+    AtkAttribute* objAttr = (AtkAttribute*)g_malloc(sizeof(AtkAttribute));
+    objAttr->name = g_strdup(name.get());
+    objAttr->value = g_strdup(NS_ConvertUTF16toUTF8(value).get());
+    objAttributeSet = g_slist_prepend(objAttributeSet, objAttr);
+
+    // Handle attributes where atk has its own name.
+    const char* atkName = nullptr;
+    nsAutoString atkValue;
+    if (name.EqualsLiteral("color")) {
+      // The format of the atk attribute is r,g,b and the gecko one is
+      // rgb(r,g,b).
+      atkValue = Substring(value, 5, value.Length() - 1);
+      atkName = sAtkTextAttrNames[ATK_TEXT_ATTR_FG_COLOR];
+    } else if (name.EqualsLiteral("background-color")) {
+      // The format of the atk attribute is r,g,b and the gecko one is
+      // rgb(r,g,b).
+      atkValue = Substring(value, 5, value.Length() - 1);
+      atkName = sAtkTextAttrNames[ATK_TEXT_ATTR_BG_COLOR];
+    } else if (name.EqualsLiteral("font-family")) {
+      atkValue = value;
+      atkName = sAtkTextAttrNames[ATK_TEXT_ATTR_FAMILY_NAME];
+    } else if (name.Equals("font-size")) {
+      // ATK wants the number of pixels without px at the end.
+      atkValue = StringHead(value, value.Length() - 2);
+      atkName = sAtkTextAttrNames[ATK_TEXT_ATTR_SIZE];
+    } else if (name.EqualsLiteral("font-weight")) {
+      atkValue = value;
+      atkName = sAtkTextAttrNames[ATK_TEXT_ATTR_WEIGHT];
+    } else if (name.EqualsLiteral("invalid")) {
+      atkValue = value;
+      atkName = sAtkTextAttrNames[ATK_TEXT_ATTR_INVALID];
+    }
+
+    if (atkName) {
+      objAttr = static_cast<AtkAttribute*>(g_malloc(sizeof(AtkAttribute)));
+      objAttr->name = g_strdup(atkName);
+      objAttr->value = g_strdup(NS_ConvertUTF16toUTF8(atkValue).get());
+      objAttributeSet = g_slist_prepend(objAttributeSet, objAttr);
+    }
+  }
+
+  // libatk-adaptor will free it
+  return objAttributeSet;
+}
 
 static void
 ConvertTexttoAsterisks(AccessibleWrap* accWrap, nsAString& aString)
@@ -188,7 +263,7 @@ getRunAttributesCB(AtkText *aText, gint aOffset,
   *aStartOffset = startOffset;
   *aEndOffset = endOffset;
 
-  return ConvertToAtkAttributeSet(attributes);
+  return ConvertToAtkTextAttributeSet(attributes);
 }
 
 static AtkAttributeSet*
@@ -203,7 +278,7 @@ getDefaultAttributesCB(AtkText *aText)
     return nullptr;
 
   nsCOMPtr<nsIPersistentProperties> attributes = text->DefaultTextAttributes();
-  return ConvertToAtkAttributeSet(attributes);
+  return ConvertToAtkTextAttributeSet(attributes);
 }
 
 static void
@@ -415,4 +490,9 @@ textInterfaceInitCB(AtkTextIface* aIface)
   aIface->remove_selection = removeTextSelectionCB;
   aIface->set_selection = setTextSelectionCB;
   aIface->set_caret_offset = setCaretOffsetCB;
+
+  // Cache the string values of the atk text attribute names.
+  for (uint32_t i = 0; i < ArrayLength(sAtkTextAttrNames); i++)
+    sAtkTextAttrNames[i] =
+      atk_text_attribute_get_name(static_cast<AtkTextAttribute>(i));
 }

From 612fb9d2cb9d8eb8156579a39c4aa85e4bf192b6 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Thu, 12 Dec 2013 14:42:04 -0500
Subject: [PATCH 044/459] Backed out changeset b6b911ca4dd8 (bug 837202) for
 OSX bustage. CLOSED TREE

---
 .../downloads/ApplicationReputation.cpp       | 53 +------------------
 toolkit/components/telemetry/Histograms.json  | 18 -------
 2 files changed, 2 insertions(+), 69 deletions(-)

diff --git a/toolkit/components/downloads/ApplicationReputation.cpp b/toolkit/components/downloads/ApplicationReputation.cpp
index 9e3e5f2cbe47..d8fc7c633f29 100644
--- a/toolkit/components/downloads/ApplicationReputation.cpp
+++ b/toolkit/components/downloads/ApplicationReputation.cpp
@@ -21,7 +21,6 @@
 
 #include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
-#include "mozilla/Telemetry.h"
 
 #include "nsCOMPtr.h"
 #include "nsDebug.h"
@@ -34,7 +33,6 @@
 #include "nsXPCOMStrings.h"
 
 using mozilla::Preferences;
-using mozilla::Telemetry::Accumulate;
 
 // Preferences that we need to initialize the query. We may need another
 // preference than browser.safebrowsing.malware.enabled, or simply use
@@ -63,27 +61,6 @@ public:
   ~PendingLookup();
 
 private:
-  /**
-   * Telemetry states.
-   */
-  /**
-   * The download appeared on the allowlist, blocklist, or no list (and thus
-   * could trigger a remote query).
-   */
-  enum {
-    ALLOW_LIST = 0,
-    BLOCK_LIST = 1,
-    NO_LIST = 2,
-  } LIST_TYPES;
-  /**
-   * Status of the remote response (valid or not).
-   */
-  enum {
-    SERVER_RESPONSE_VALID = 0,
-    SERVER_RESPONSE_FAILED = 1,
-    SERVER_RESPONSE_INVALID = 2,
-  } SERVER_RESPONSE_TYPES;
-
   nsCOMPtr<nsIApplicationReputationQuery> mQuery;
   nsCOMPtr<nsIApplicationReputationCallback> mCallback;
   /**
@@ -128,8 +105,6 @@ PendingLookup::~PendingLookup() {
 
 nsresult
 PendingLookup::OnComplete(bool shouldBlock, nsresult rv) {
-  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SHOULD_BLOCK,
-    shouldBlock);
   nsresult res = mCallback->OnComplete(shouldBlock, rv);
   return res;
 }
@@ -144,18 +119,15 @@ PendingLookup::HandleEvent(const nsACString& tables) {
   nsCString allow_list;
   Preferences::GetCString(PREF_DOWNLOAD_ALLOW_TABLE, &allow_list);
   if (FindInReadable(tables, allow_list)) {
-    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, ALLOW_LIST);
     return OnComplete(false, NS_OK);
   }
 
   nsCString block_list;
   Preferences::GetCString(PREF_DOWNLOAD_BLOCK_TABLE, &block_list);
   if (FindInReadable(tables, block_list)) {
-    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, BLOCK_LIST);
     return OnComplete(true, NS_OK);
   }
 
-  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, NO_LIST);
 #if 0
   nsresult rv = SendRemoteQuery();
   if (NS_FAILED(rv)) {
@@ -296,32 +268,16 @@ PendingLookup::OnStopRequestInternal(nsIRequest *aRequest,
                                      nsISupports *aContext,
                                      nsresult aResult,
                                      bool* aShouldBlock) {
-  if (NS_FAILED(aResult)) {
-    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
-      SERVER_RESPONSE_FAILED);
-    return aResult;
-  }
-
   *aShouldBlock = false;
   nsresult rv;
   nsCOMPtr<nsIHttpChannel> channel = do_QueryInterface(aRequest, &rv);
-  if (NS_FAILED(rv)) {
-    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
-      SERVER_RESPONSE_FAILED);
-    return rv;
-  }
+  NS_ENSURE_SUCCESS(rv, rv);
 
   uint32_t status = 0;
   rv = channel->GetResponseStatus(&status);
-  if (NS_FAILED(rv)) {
-    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
-      SERVER_RESPONSE_FAILED);
-    return rv;
-  }
+  NS_ENSURE_SUCCESS(rv, rv);
 
   if (status != 200) {
-    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
-      SERVER_RESPONSE_FAILED);
     return NS_ERROR_NOT_AVAILABLE;
   }
 
@@ -329,15 +285,11 @@ PendingLookup::OnStopRequestInternal(nsIRequest *aRequest,
   safe_browsing::ClientDownloadResponse response;
   if (!response.ParseFromString(buf)) {
     NS_WARNING("Could not parse protocol buffer");
-    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
-                                   SERVER_RESPONSE_INVALID);
     return NS_ERROR_CANNOT_CONVERT_DATA;
   }
 
   // There are several more verdicts, but we only respect one for now and treat
   // everything else as SAFE.
-  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
-    SERVER_RESPONSE_VALID);
   if (response.verdict() == safe_browsing::ClientDownloadResponse::DANGEROUS) {
     *aShouldBlock = true;
   }
@@ -383,7 +335,6 @@ ApplicationReputationService::QueryReputation(
   NS_ENSURE_ARG_POINTER(aQuery);
   NS_ENSURE_ARG_POINTER(aCallback);
 
-  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_COUNT, true);
   nsresult rv = QueryReputationInternal(aQuery, aCallback);
   if (NS_FAILED(rv)) {
     aCallback->OnComplete(false, rv);
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 6a2cab5804b6..a8e5707d4a06 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -23,24 +23,6 @@
     "extended_statistics_ok": true,
     "description": "time spent updating accessibility (ms)"
   },
-  "APPLICATION_REPUTATION_SHOULD_BLOCK": {
-    "kind": "boolean",
-    "description": "Application reputation verdict (shouldBlock=false is OK)"
-  },
-  "APPLICATION_REPUTATION_LOCAL": {
-    "kind": "enumerated",
-    "n_values": 3,
-    "description": "Application reputation local results (0=ALLOW, 1=BLOCK, 2=NONE)"
-  },
-  "APPLICATION_REPUTATION_SERVER": {
-    "kind": "enumerated",
-    "n_values": 3,
-    "description": "Application reputation remote status (0 = OK, 1 = FAIL, 2 = INVALID)"
-  },
-  "APPLICATION_REPUTATION_COUNT": {
-    "kind": "flag",
-    "description": "Application reputation query count (both local and remote)"
-  },
   "BACKGROUNDFILESAVER_THREAD_COUNT": {
     "kind": "enumerated",
     "n_values": 21,

From dcde6d6dea4e6a72d905d663a8f3707685ff5fcd Mon Sep 17 00:00:00 2001
From: Sean Stangl <sstangl@mozilla.com>
Date: Wed, 11 Dec 2013 14:06:04 -0800
Subject: [PATCH 045/459] Bug 949195 - Don't refer to IsInRequest() when
 JS_DEBUG is not defined. r=efaust

---
 js/public/RootingAPI.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/js/public/RootingAPI.h b/js/public/RootingAPI.h
index 45c4e0d596e2..bf48234811e7 100644
--- a/js/public/RootingAPI.h
+++ b/js/public/RootingAPI.h
@@ -648,7 +648,7 @@ struct GCMethods<T *>
 #endif
 };
 
-#if defined(JS_DEBUG)
+#ifdef JS_DEBUG
 /* This helper allows us to assert that Rooted<T> is scoped within a request. */
 extern JS_PUBLIC_API(bool)
 IsInRequest(JSContext *cx);
@@ -688,7 +688,9 @@ class MOZ_STACK_CLASS Rooted : public js::RootedBase<T>
       : ptr(js::GCMethods<T>::initial())
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+#ifdef JS_DEBUG
         MOZ_ASSERT(js::IsInRequest(cx));
+#endif
         init(js::ContextFriendFields::get(cx));
     }
 
@@ -697,7 +699,9 @@ class MOZ_STACK_CLASS Rooted : public js::RootedBase<T>
       : ptr(initial)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+#ifdef JS_DEBUG
         MOZ_ASSERT(js::IsInRequest(cx));
+#endif
         init(js::ContextFriendFields::get(cx));
     }
 

From f4ddb7d8f99fccff44d5c52c85e678c83201a39f Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Thu, 12 Dec 2013 16:05:53 -0500
Subject: [PATCH 046/459] Backed out changeset 71f9f57e5ddb (bug 949474) for
 test_bug808374.html failures. CLOSED TREE

---
 content/media/webaudio/AudioContext.cpp          |  4 ++--
 .../media/webaudio/test/test_AudioBuffer.html    | 16 +++++-----------
 2 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/content/media/webaudio/AudioContext.cpp b/content/media/webaudio/AudioContext.cpp
index 850727f1ef6c..f269163652f7 100644
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -174,8 +174,8 @@ AudioContext::CreateBuffer(JSContext* aJSContext, uint32_t aNumberOfChannels,
                            uint32_t aLength, float aSampleRate,
                            ErrorResult& aRv)
 {
-  if (aSampleRate < 8000 || aSampleRate > 192000 || !aLength || !aNumberOfChannels) {
-    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+  if (aSampleRate < 8000 || aSampleRate > 96000 || !aLength) {
+    aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
     return nullptr;
   }
 
diff --git a/content/media/webaudio/test/test_AudioBuffer.html b/content/media/webaudio/test/test_AudioBuffer.html
index 47716853bf6c..75eeb7ff00e5 100644
--- a/content/media/webaudio/test/test_AudioBuffer.html
+++ b/content/media/webaudio/test/test_AudioBuffer.html
@@ -81,21 +81,15 @@ addLoadEvent(function() {
 
   expectException(function() {
     context.createBuffer(2, 2048, 7999);
-  }, DOMException.INDEX_SIZE_ERR);
+  }, DOMException.NOT_SUPPORTED_ERR);
   expectException(function() {
-    context.createBuffer(2, 2048, 192001);
-  }, DOMException.INDEX_SIZE_ERR);
+    context.createBuffer(2, 2048, 96001);
+  }, DOMException.NOT_SUPPORTED_ERR);
   context.createBuffer(2, 2048, 8000);  // no exception
-  context.createBuffer(2, 2048, 192000); // no exception
-  context.createBuffer(32, 2048, 48000); // no exception
-  // Null length
+  context.createBuffer(2, 2048, 96000); // no exception
   expectException(function() {
     context.createBuffer(2, 0, 48000);
-  }, DOMException.INDEX_SIZE_ERR);
-  // Null number of channels
-  expectException(function() {
-    context.createBuffer(0, 2048, 48000);
-  }, DOMException.INDEX_SIZE_ERR);
+  }, DOMException.NOT_SUPPORTED_ERR);
   SimpleTest.finish();
 });
 

From 5990fb7b8b54d064b7c439cfdd71a9c54a8ad252 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 12 Dec 2013 13:10:54 -0800
Subject: [PATCH 047/459] Bug 932982 - Trace type constraints and allow
 preserving jitcode in GCs without also marking all type information,
 r=billm,jandem.

---
 js/public/MemoryMetrics.h         |   1 -
 js/src/gc/Marking.cpp             |  46 +----
 js/src/gc/RootMarking.cpp         |   5 -
 js/src/gc/Statistics.cpp          |   1 -
 js/src/gc/Statistics.h            |   1 -
 js/src/gc/Zone.cpp                |  31 +--
 js/src/gc/Zone.h                  |   2 -
 js/src/jit/CodeGenerator.cpp      |   6 +-
 js/src/jit/Ion.cpp                |  17 +-
 js/src/jit/Ion.h                  |   2 +-
 js/src/jit/IonBuilder.cpp         |   6 +-
 js/src/jit/IonCode.h              |   3 +
 js/src/jit/MIR.cpp                |   2 +-
 js/src/jscompartment.cpp          |  11 +-
 js/src/jscompartment.h            |   3 -
 js/src/jsgc.cpp                   |  14 +-
 js/src/jsgc.h                     |   7 +-
 js/src/jsinfer.cpp                | 329 +++++++++++++++---------------
 js/src/jsinfer.h                  | 122 ++++-------
 js/src/jsinferinlines.h           |  78 ++-----
 js/src/vm/MemoryMetrics.cpp       |   1 -
 js/xpconnect/src/XPCJSRuntime.cpp |   4 -
 22 files changed, 258 insertions(+), 434 deletions(-)

diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index 95ac91b9f6d5..f974259467d5 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -393,7 +393,6 @@ struct CompartmentStats
     macro(Other,   NotLiveGCThing, baselineStubsOptimized) \
     macro(Other,   NotLiveGCThing, ionData) \
     macro(Other,   NotLiveGCThing, typeInferenceTypeScripts) \
-    macro(Other,   NotLiveGCThing, typeInferencePendingArrays) \
     macro(Other,   NotLiveGCThing, typeInferenceAllocationSiteTables) \
     macro(Other,   NotLiveGCThing, typeInferenceArrayTypeTables) \
     macro(Other,   NotLiveGCThing, typeInferenceObjectTypeTables) \
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index b0c8a6555988..d0e3bde29e8a 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1122,14 +1122,11 @@ gc::MarkCycleCollectorChildren(JSTracer *trc, Shape *shape)
 static void
 ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
 {
-    /* Don't mark properties for singletons. They'll be purged by the GC. */
-    if (!type->singleton) {
-        unsigned count = type->getPropertyCount();
-        for (unsigned i = 0; i < count; i++) {
-            types::Property *prop = type->getProperty(i);
-            if (prop && JSID_IS_STRING(prop->id))
-                PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
-        }
+    unsigned count = type->getPropertyCount();
+    for (unsigned i = 0; i < count; i++) {
+        types::Property *prop = type->getProperty(i);
+        if (prop && JSID_IS_STRING(prop->id))
+            PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
     }
 
     if (TaggedProto(type->proto).isObject())
@@ -1350,7 +1347,7 @@ GCMarker::restoreValueArray(JSObject *obj, void **vpp, void **endp)
 }
 
 void
-GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr)
+GCMarker::processMarkStackOther(uintptr_t tag, uintptr_t addr)
 {
     if (tag == TypeTag) {
         ScanTypeObject(this, reinterpret_cast<types::TypeObject *>(addr));
@@ -1364,35 +1361,6 @@ GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t ad
             pushObject(obj);
     } else if (tag == IonCodeTag) {
         MarkChildren(this, reinterpret_cast<jit::IonCode *>(addr));
-    } else if (tag == ArenaTag) {
-        ArenaHeader *aheader = reinterpret_cast<ArenaHeader *>(addr);
-        AllocKind thingKind = aheader->getAllocKind();
-        size_t thingSize = Arena::thingSize(thingKind);
-
-        for ( ; aheader; aheader = aheader->next) {
-            Arena *arena = aheader->getArena();
-            FreeSpan firstSpan(aheader->getFirstFreeSpan());
-            const FreeSpan *span = &firstSpan;
-
-            for (uintptr_t thing = arena->thingsStart(thingKind); ; thing += thingSize) {
-                JS_ASSERT(thing <= arena->thingsEnd());
-                if (thing == span->first) {
-                    if (!span->hasNext())
-                        break;
-                    thing = span->last;
-                    span = span->nextSpan();
-                } else {
-                    JSObject *object = reinterpret_cast<JSObject *>(thing);
-                    if (object->hasSingletonType() && object->markIfUnmarked(getMarkColor()))
-                        pushObject(object);
-                    budget.step();
-                }
-            }
-            if (budget.isOverBudget()) {
-                pushArenaList(aheader);
-                return;
-            }
-        }
     }
 }
 
@@ -1430,7 +1398,7 @@ GCMarker::processMarkStackTop(SliceBudget &budget)
         goto scan_obj;
     }
 
-    processMarkStackOther(budget, tag, addr);
+    processMarkStackOther(tag, addr);
     return;
 
   scan_value_array:
diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index 8ae3e85fd559..541ad84d996c 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -726,11 +726,6 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
         if (IS_GC_MARKING_TRACER(trc) && !zone->isCollecting())
             continue;
 
-        if (IS_GC_MARKING_TRACER(trc) && zone->isPreservingCode()) {
-            gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_MARK_TYPES);
-            zone->markTypes(trc);
-        }
-
         /* Do not discard scripts with counts while profiling. */
         if (rt->profilingScripts && !rt->isHeapMinorCollecting()) {
             for (CellIterUnderGC i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 7744b61d53f5..be76eee734a1 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -276,7 +276,6 @@ static const PhaseInfo phases[] = {
     { PHASE_PURGE, "Purge", PHASE_NO_PARENT },
     { PHASE_MARK, "Mark", PHASE_NO_PARENT },
     { PHASE_MARK_ROOTS, "Mark Roots", PHASE_MARK },
-    { PHASE_MARK_TYPES, "Mark Types", PHASE_MARK_ROOTS },
     { PHASE_MARK_DELAYED, "Mark Delayed", PHASE_MARK },
     { PHASE_SWEEP, "Sweep", PHASE_NO_PARENT },
     { PHASE_SWEEP_MARK, "Mark During Sweeping", PHASE_SWEEP },
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 3240fd238f53..1029fd52fe8e 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -28,7 +28,6 @@ enum Phase {
     PHASE_PURGE,
     PHASE_MARK,
     PHASE_MARK_ROOTS,
-    PHASE_MARK_TYPES,
     PHASE_MARK_DELAYED,
     PHASE_SWEEP,
     PHASE_SWEEP_MARK,
diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
index ad0c2fae7fde..539faabbd7c8 100644
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -80,35 +80,6 @@ Zone::setNeedsBarrier(bool needs, ShouldUpdateIon updateIon)
     needsBarrier_ = needs;
 }
 
-void
-Zone::markTypes(JSTracer *trc)
-{
-    /*
-     * Mark all scripts, type objects and singleton JS objects in the
-     * compartment. These can be referred to directly by type sets, which we
-     * cannot modify while code which depends on these type sets is active.
-     */
-    JS_ASSERT(isPreservingCode());
-
-    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-        JSScript *script = i.get<JSScript>();
-        MarkScriptRoot(trc, &script, "mark_types_script");
-        JS_ASSERT(script == i.get<JSScript>());
-    }
-
-    for (size_t thingKind = FINALIZE_OBJECT0; thingKind < FINALIZE_OBJECT_LIMIT; thingKind++) {
-        ArenaHeader *aheader = allocator.arenas.getFirstArena(static_cast<AllocKind>(thingKind));
-        if (aheader)
-            trc->runtime->gcMarker.pushArenaList(aheader);
-    }
-
-    for (CellIterUnderGC i(this, FINALIZE_TYPE_OBJECT); !i.done(); i.next()) {
-        types::TypeObject *type = i.get<types::TypeObject>();
-        MarkTypeObjectRoot(trc, &type, "mark_types_scan");
-        JS_ASSERT(type == i.get<types::TypeObject>());
-    }
-}
-
 void
 Zone::resetGCMallocBytes()
 {
@@ -144,7 +115,7 @@ Zone::sweep(FreeOp *fop, bool releaseTypes)
     if (active)
         releaseTypes = false;
 
-    if (!isPreservingCode()) {
+    {
         gcstats::AutoPhase ap(fop->runtime()->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
         types.sweep(fop, releaseTypes);
     }
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index ebad06d0b6c9..a2fe6a22a022 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -310,8 +310,6 @@ struct Zone : public JS::shadow::Zone,
         js_ReportAllocationOverflow(nullptr);
     }
 
-    void markTypes(JSTracer *trc);
-
     js::types::TypeZone types;
 
     void sweep(js::FreeOp *fop, bool releaseTypes);
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 7cbe48d16495..f8a69038c4ac 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -5887,7 +5887,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                      safepoints_.size(), callTargets.length(),
                      patchableBackedges_.length());
     if (!ionScript) {
-        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
         return false;
     }
 
@@ -5912,7 +5912,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         // Use js_free instead of IonScript::Destroy: the cache list and
         // backedge list are still uninitialized.
         js_free(ionScript);
-        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
         return false;
     }
 
@@ -5933,7 +5933,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                         /* resetUses */ false, /* cancelOffThread*/ false))
         {
             js_free(ionScript);
-            recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+            recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
             return false;
         }
     }
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index ba3ee46a154d..5bf13a880301 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2481,7 +2481,7 @@ jit::InvalidateAll(FreeOp *fop, Zone *zone)
 
 
 void
-jit::Invalidate(types::TypeCompartment &types, FreeOp *fop,
+jit::Invalidate(types::TypeZone &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
@@ -2564,7 +2564,7 @@ void
 jit::Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
-    jit::Invalidate(cx->compartment()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
+    jit::Invalidate(cx->zone()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
                     cancelOffThread);
 }
 
@@ -2611,14 +2611,13 @@ FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool p
     else
         script->setIonScript(nullptr);
 
-    // If this script has Ion code on the stack, invalidation() will return
-    // true. In this case we have to wait until destroying it.
-    if (!ionScript->invalidated()) {
-        types::TypeCompartment &types = script->compartment()->types;
-        ionScript->recompileInfo().compilerOutput(types)->invalidate();
+    types::TypeZone &types = script->zone()->types;
+    ionScript->recompileInfo().compilerOutput(types)->invalidate();
 
+    // If this script has Ion code on the stack, invalidated() will return
+    // true. In this case we have to wait until destroying it.
+    if (!ionScript->invalidated())
         jit::IonScript::Destroy(fop, ionScript);
-    }
 }
 
 void
@@ -2637,8 +2636,6 @@ jit::FinishDiscardJitCode(FreeOp *fop, JSCompartment *comp)
     // Free optimized baseline stubs.
     if (comp->jitCompartment())
         comp->jitCompartment()->optimizedStubSpace()->free();
-
-    comp->types.clearCompilerOutputs(fop);
 }
 
 void
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 37ad4e778387..db6c5ee4f811 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -364,7 +364,7 @@ IonExecStatus IonCannon(JSContext *cx, RunState &state);
 IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
-void Invalidate(types::TypeCompartment &types, FreeOp *fop,
+void Invalidate(types::TypeZone &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
                 bool cancelOffThread = true);
 void Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 28b2285a8fdc..a85d3f37e01a 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6286,7 +6286,7 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints(), staticType))
+        property.configured(constraints()))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -6376,7 +6376,7 @@ IonBuilder::setStaticName(JSObject *staticObject, PropertyName *name)
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints(), staticType))
+        property.configured(constraints()))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -7826,7 +7826,7 @@ IonBuilder::getDefiniteSlot(types::TemporaryTypeSet *types, PropertyName *name,
     *property = type->property(id);
     return property->maybeTypes() &&
            property->maybeTypes()->definiteProperty() &&
-           !property->configured(constraints(), type);
+           !property->configured(constraints());
 }
 
 bool
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index 8167d1fa80e9..4acc08d50993 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -526,6 +526,9 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
+    types::RecompileInfo& recompileInfoRef() {
+        return recompileInfo_;
+    }
     uint32_t incrOsrPcMismatchCounter() {
         return ++osrPcMismatchCounter_;
     }
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index aad9234a367f..882b468f6a7b 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3025,7 +3025,7 @@ jit::PropertyReadIsIdempotent(types::CompilerConstraintList *constraints,
 
             // Check if the property has been reconfigured or is a getter.
             types::HeapTypeSetKey property = object->property(NameToId(name));
-            if (property.configured(constraints, object))
+            if (property.configured(constraints))
                 return false;
         }
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index a4132018c96f..f9dd807606db 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -48,7 +48,6 @@ JSCompartment::JSCompartment(Zone *zone, const JS::CompartmentOptions &options =
 #endif
     global_(nullptr),
     enterCompartmentDepth(0),
-    lastCodeRelease(0),
     data(nullptr),
     objectMetadataCallback(nullptr),
     lastAnimationTime(0),
@@ -545,13 +544,6 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
         WeakMapBase::sweepCompartment(this);
     }
 
-    if (zone()->isPreservingCode()) {
-        gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
-        types.sweepShapes(fop);
-    } else {
-        JS_ASSERT(!types.constrainedOutputs);
-    }
-
     NativeIterator *ni = enumerators->next();
     while (ni != enumerators) {
         JSObject *iterObj = ni->iterObj();
@@ -864,7 +856,6 @@ JSCompartment::clearTraps(FreeOp *fop)
 
 void
 JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                      size_t *tiPendingArrays,
                                       size_t *tiAllocationSiteTables,
                                       size_t *tiArrayTypeTables,
                                       size_t *tiObjectTypeTables,
@@ -876,7 +867,7 @@ JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                       size_t *baselineStubsOptimized)
 {
     *compartmentObject += mallocSizeOf(this);
-    types.addSizeOfExcludingThis(mallocSizeOf, tiPendingArrays, tiAllocationSiteTables,
+    types.addSizeOfExcludingThis(mallocSizeOf, tiAllocationSiteTables,
                                  tiArrayTypeTables, tiObjectTypeTables);
     *shapesCompartmentTables += baseShapes.sizeOfExcludingThis(mallocSizeOf)
                               + initialShapes.sizeOfExcludingThis(mallocSizeOf)
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 15a93afe1280..f44c2b09e390 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -187,8 +187,6 @@ struct JSCompartment
      */
     void adoptWorkerAllocator(js::Allocator *workerAllocator);
 
-
-    int64_t                      lastCodeRelease;
     bool                         activeAnalysis;
 
     /* Type information about the scripts and objects in this compartment. */
@@ -221,7 +219,6 @@ struct JSCompartment
 
   public:
     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                size_t *tiPendingArrays,
                                 size_t *tiAllocationSiteTables,
                                 size_t *tiArrayTypeTables,
                                 size_t *tiObjectTypeTables,
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index dd3cde985825..27242bdcdb39 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2854,13 +2854,9 @@ ShouldPreserveJITCode(JSCompartment *comp, int64_t currentTime)
 
     if (rt->alwaysPreserveCode)
         return true;
-    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime &&
-        comp->lastCodeRelease + (PRMJ_USEC_PER_SEC * 300) >= currentTime)
-    {
+    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime)
         return true;
-    }
 
-    comp->lastCodeRelease = currentTime;
     return false;
 }
 
@@ -3939,12 +3935,12 @@ BeginSweepingZoneGroup(JSRuntime *rt)
         bool releaseTypes = ReleaseObservedTypes(rt);
         for (GCCompartmentGroupIter c(rt); !c.done(); c.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            c->sweep(&fop, releaseTypes);
+            c->sweep(&fop, releaseTypes && !c->zone()->isPreservingCode());
         }
 
         for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            zone->sweep(&fop, releaseTypes);
+            zone->sweep(&fop, releaseTypes && !zone->isPreservingCode());
         }
     }
 
@@ -5293,10 +5289,6 @@ js::ReleaseAllJITCode(FreeOp *fop)
             jit::FinishDiscardBaselineScript(fop, script);
         }
     }
-
-    /* Sweep now invalidated compiler outputs from each compartment. */
-    for (CompartmentsIter comp(fop->runtime(), SkipAtoms); !comp.done(); comp.next())
-        comp->types.clearCompilerOutputs(fop);
 #endif
 }
 
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 2e5cbe360930..9159f31ec024 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -1091,7 +1091,6 @@ struct GCMarker : public JSTracer {
         ObjectTag,
         TypeTag,
         XmlTag,
-        ArenaTag,
         SavedValueArrayTag,
         IonCodeTag,
         LastTag = IonCodeTag
@@ -1119,10 +1118,6 @@ struct GCMarker : public JSTracer {
         pushTaggedPtr(ObjectTag, obj);
     }
 
-    void pushArenaList(gc::ArenaHeader *firstArena) {
-        pushTaggedPtr(ArenaTag, firstArena);
-    }
-
     void pushType(types::TypeObject *type) {
         pushTaggedPtr(TypeTag, type);
     }
@@ -1229,7 +1224,7 @@ struct GCMarker : public JSTracer {
     bool restoreValueArray(JSObject *obj, void **vpp, void **endp);
     void saveValueRanges();
     inline void processMarkStackTop(SliceBudget &budget);
-    void processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr);
+    void processMarkStackOther(uintptr_t tag, uintptr_t addr);
 
     void appendGrayRoot(void *thing, JSGCTraceKind kind);
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 0c1fe0167a3c..51c19af54640 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -243,14 +243,6 @@ types::TypeHasProperty(JSContext *cx, TypeObject *obj, jsid id, const Value &val
         if (id == id___proto__(cx) || id == id_constructor(cx) || id == id_caller(cx))
             return true;
 
-        /*
-         * If we called in here while resolving a type constraint, we may be in the
-         * middle of resolving a standard class and the type sets will not be updated
-         * until the outer TypeSet::add finishes.
-         */
-        if (cx->compartment()->types.pendingCount)
-            return true;
-
         Type type = GetValueType(value);
 
         AutoEnterAnalysis enter(cx);
@@ -742,12 +734,12 @@ class TypeCompilerConstraint : public TypeConstraint
 
     void newType(JSContext *cx, TypeSet *source, Type type) {
         if (data.invalidateOnNewType(type))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
     }
 
     void newPropertyState(JSContext *cx, TypeSet *source) {
         if (data.invalidateOnNewPropertyState(source))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
     }
 
     void newObjectState(JSContext *cx, TypeObject *object) {
@@ -755,7 +747,16 @@ class TypeCompilerConstraint : public TypeConstraint
         // will be sent on changes to its state, so always invalidate any
         // associated compilations.
         if (object->unknownProperties() || data.invalidateOnNewObjectState(object))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
+    }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (data.shouldSweep() || compilation.shouldSweep(zone))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeCompilerConstraint<T> >(compilation, data);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
     }
 };
 
@@ -908,13 +909,21 @@ class TypeConstraintFreezeStack : public TypeConstraint
 
     const char *kind() { return "freezeStack"; }
 
-    void newType(JSContext *cx, TypeSet *source, Type type)
-    {
+    void newType(JSContext *cx, TypeSet *source, Type type) {
         /*
          * Unlike TypeConstraintFreeze, triggering this constraint once does
          * not disable it on future changes to the type set.
          */
-        cx->compartment()->types.addPendingRecompile(cx, script_);
+        cx->zone()->types.addPendingRecompile(cx, script_);
+    }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsScriptAboutToBeFinalized(&script_))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintFreezeStack>(script_);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
     }
 };
 
@@ -929,15 +938,22 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
 
     CompilerOutput co(script, executionMode);
 
-    TypeCompartment &types = cx->compartment()->types;
-    if (!types.constrainedOutputs) {
-        types.constrainedOutputs = cx->new_< Vector<CompilerOutput> >(cx);
-        if (!types.constrainedOutputs)
+    TypeZone &types = cx->zone()->types;
+    if (!types.compilerOutputs) {
+        types.compilerOutputs = cx->new_< Vector<CompilerOutput> >(cx);
+        if (!types.compilerOutputs)
             return false;
     }
 
-    uint32_t index = types.constrainedOutputs->length();
-    if (!types.constrainedOutputs->append(co))
+#ifdef DEBUG
+    for (size_t i = 0; i < types.compilerOutputs->length(); i++) {
+        const CompilerOutput &co = (*types.compilerOutputs)[i];
+        JS_ASSERT_IF(co.isValid(), co.script() != script || co.mode() != executionMode);
+    }
+#endif
+
+    uint32_t index = types.compilerOutputs->length();
+    if (!types.compilerOutputs->append(co))
         return false;
 
     *precompileInfo = RecompileInfo(index);
@@ -979,8 +995,8 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
             array[i].add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeStack>(entry.script), false);
     }
 
-    if (!succeeded || types.constrainedOutputs->back().pendingInvalidation()) {
-        types.constrainedOutputs->back().invalidate();
+    if (!succeeded || types.compilerOutputs->back().pendingInvalidation()) {
+        types.compilerOutputs->back().invalidate();
         script->resetUseCount();
         return false;
     }
@@ -1009,6 +1025,8 @@ class ConstraintDataFreeze
                ? property.maybeTypes()->isSubset(expected)
                : property.maybeTypes()->empty();
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1195,6 +1213,8 @@ class ConstraintDataFreezeObjectFlags
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1289,6 +1309,8 @@ class ConstraintDataFreezeObjectForInlinedCall
     {
         return true;
     }
+
+    bool shouldSweep() { return false; }
 };
 
 // Constraint which triggers recompilation when the template object for a
@@ -1315,6 +1337,11 @@ class ConstraintDataFreezeObjectForNewScriptTemplate
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() {
+        // Note: |templateObject| is only used for equality testing.
+        return false;
+    }
 };
 
 // Constraint which triggers recompilation when the underlying data pointer for
@@ -1341,6 +1368,11 @@ class ConstraintDataFreezeObjectForTypedArrayBuffer
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() {
+        // Note: |viewData| is only used for equality testing.
+        return false;
+    }
 };
 
 } /* anonymous namespace */
@@ -1413,10 +1445,7 @@ namespace {
 class ConstraintDataFreezeConfiguredProperty
 {
   public:
-    TypeObjectKey *object;
-
-    ConstraintDataFreezeConfiguredProperty(TypeObjectKey *object)
-      : object(object)
+    ConstraintDataFreezeConfiguredProperty()
     {}
 
     const char *kind() { return "freezeConfiguredProperty"; }
@@ -1430,31 +1459,16 @@ class ConstraintDataFreezeConfiguredProperty
     bool constraintHolds(JSContext *cx,
                          const HeapTypeSetKey &property, TemporaryTypeSet *expected)
     {
-        // Everywhere compiled code depends on definite properties associated
-        // with a type object's newScript, we need to make sure there are
-        // constraints in place which will mark those properties as configured
-        // should the definite properties be invalidated.
-        TypeObject *type = object->isSingleObject()
-                           ? object->asSingleObject()->type()
-                           : object->asTypeObject();
-        if (type->flags & OBJECT_FLAG_NEW_SCRIPT_REGENERATE) {
-            type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
-            if (type->hasNewScript()) {
-                CheckNewScriptProperties(cx, type, type->newScript()->fun);
-            } else {
-                JS_ASSERT(type->flags & OBJECT_FLAG_ADDENDUM_CLEARED);
-                type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
-            }
-        }
-
         return !property.maybeTypes()->configuredProperty();
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
 
 bool
-HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *type)
+HeapTypeSetKey::configured(CompilerConstraintList *constraints)
 {
     if (maybeTypes() && maybeTypes()->configuredProperty())
         return true;
@@ -1463,7 +1477,7 @@ HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *t
 
     typedef CompilerConstraintInstance<ConstraintDataFreezeConfiguredProperty> T;
     constraints->add(alloc->new_<T>(alloc, *this,
-                                    ConstraintDataFreezeConfiguredProperty(type)));
+                                    ConstraintDataFreezeConfiguredProperty()));
     return false;
 }
 
@@ -1986,7 +2000,7 @@ PrototypeHasIndexedProperty(CompilerConstraintList *constraints, JSObject *obj)
         if (type->unknownProperties())
             return true;
         HeapTypeSetKey index = type->property(JSID_VOID);
-        if (index.configured(constraints, type) || index.isOwnProperty(constraints))
+        if (index.configured(constraints) || index.isOwnProperty(constraints))
             return true;
         obj = obj->getProto();
     } while (obj);
@@ -2024,27 +2038,8 @@ types::TypeCanHaveExtraIndexedProperties(CompilerConstraintList *constraints,
     return PrototypeHasIndexedProperty(constraints, proto);
 }
 
-bool
-TypeCompartment::growPendingArray(JSContext *cx)
-{
-    unsigned newCapacity = js::Max(unsigned(100), pendingCapacity * 2);
-    PendingWork *newArray = js_pod_calloc<PendingWork>(newCapacity);
-    if (!newArray) {
-        cx->compartment()->types.setPendingNukeTypes(cx);
-        return false;
-    }
-
-    PodCopy(newArray, pendingArray, pendingCount);
-    js_free(pendingArray);
-
-    pendingArray = newArray;
-    pendingCapacity = newCapacity;
-
-    return true;
-}
-
 void
-TypeCompartment::processPendingRecompiles(FreeOp *fop)
+TypeZone::processPendingRecompiles(FreeOp *fop)
 {
     if (!pendingRecompiles)
         return;
@@ -2095,11 +2090,9 @@ TypeZone::nukeTypes(FreeOp *fop)
      */
     JS_ASSERT(pendingNukeTypes);
 
-    for (CompartmentsInZoneIter comp(zone()); !comp.done(); comp.next()) {
-        if (comp->types.pendingRecompiles) {
-            fop->free_(comp->types.pendingRecompiles);
-            comp->types.pendingRecompiles = nullptr;
-        }
+    if (pendingRecompiles) {
+        fop->free_(pendingRecompiles);
+        pendingRecompiles = nullptr;
     }
 
     inferenceEnabled = false;
@@ -2119,7 +2112,7 @@ TypeZone::nukeTypes(FreeOp *fop)
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
+TypeZone::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 {
     CompilerOutput *co = info.compilerOutput(cx);
     if (!co || !co->isValid() || co->pendingInvalidation())
@@ -2145,7 +2138,7 @@ TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, JSScript *script)
+TypeZone::addPendingRecompile(JSContext *cx, JSScript *script)
 {
     JS_ASSERT(script);
 
@@ -3146,6 +3139,15 @@ class TypeConstraintClearDefiniteGetterSetter : public TypeConstraint
     }
 
     void newType(JSContext *cx, TypeSet *source, Type type) {}
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsTypeObjectAboutToBeFinalized(&object))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteGetterSetter>(object);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
+    }
 };
 
 bool
@@ -3192,6 +3194,15 @@ class TypeConstraintClearDefiniteSingle : public TypeConstraint
         if (source->baseFlags() || source->getObjectCount() > 1)
             object->clearAddendum(cx);
     }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsTypeObjectAboutToBeFinalized(&object))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteSingle>(object);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
+    }
 };
 
 void
@@ -3941,8 +3952,19 @@ ConstraintTypeSet::sweep(Zone *zone)
         }
     }
 
-    /* All constraints are wiped out on each GC. */
+    /*
+     * Type constraints only hold weak references. Copy constraints referring
+     * to data that is still live into the zone's new arena.
+     */
+    TypeConstraint *constraint = constraintList;
     constraintList = nullptr;
+    while (constraint) {
+        if (TypeConstraint *copy = constraint->sweep(zone->types)) {
+            copy->next = constraintList;
+            constraintList = copy;
+        }
+        constraint = constraint->next;
+    }
 }
 
 inline void
@@ -3962,18 +3984,6 @@ TypeObject::clearProperties()
 inline void
 TypeObject::sweep(FreeOp *fop)
 {
-    if (singleton) {
-        JS_ASSERT(!hasNewScript());
-
-        /*
-         * All properties can be discarded. We will regenerate them as needed
-         * as code gets reanalyzed.
-         */
-        clearProperties();
-
-        return;
-    }
-
     if (!isMarked()) {
         if (addendum)
             fop->free_(addendum);
@@ -3996,6 +4006,14 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < oldCapacity; i++) {
             Property *prop = oldArray[i];
             if (prop) {
+                if (singleton && !prop->types.constraintList) {
+                    /*
+                     * Don't copy over properties of singleton objects which
+                     * don't have associated constraints. The contents of these
+                     * type sets will be regenerated as necessary.
+                     */
+                    continue;
+                }
                 Property *newProp = typeLifoAlloc.new_<Property>(*prop);
                 if (newProp) {
                     Property **pentry =
@@ -4015,12 +4033,17 @@ TypeObject::sweep(FreeOp *fop)
         setBasePropertyCount(propertyCount);
     } else if (propertyCount == 1) {
         Property *prop = (Property *) propertySet;
-        Property *newProp = typeLifoAlloc.new_<Property>(*prop);
-        if (newProp) {
-            propertySet = (Property **) newProp;
-            newProp->types.sweep(zone());
+        if (singleton && !prop->types.constraintList) {
+            // Skip, as above.
+            clearProperties();
         } else {
-            zone()->types.setPendingNukeTypes();
+            Property *newProp = typeLifoAlloc.new_<Property>(*prop);
+            if (newProp) {
+                propertySet = (Property **) newProp;
+                newProp->types.sweep(zone());
+            } else {
+                zone()->types.setPendingNukeTypes();
+            }
         }
     }
 
@@ -4028,14 +4051,6 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < basePropertyCount(); i++)
             JS_ASSERT(propertySet[i]);
     }
-
-    /*
-     * The GC will clear out the constraints ensuring the correctness of the
-     * newScript information, these constraints will need to be regenerated
-     * the next time we compile code which depends on this info.
-     */
-    if (hasNewScript())
-        flags |= OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
 }
 
 void
@@ -4119,52 +4134,6 @@ TypeCompartment::sweep(FreeOp *fop)
                 e.rekeyFront(key);
         }
     }
-
-    /*
-     * The pending array is reset on GC, it can grow large (75+ KB) and is easy
-     * to reallocate if the compartment becomes active again.
-     */
-    if (pendingArray)
-        fop->free_(pendingArray);
-
-    pendingArray = nullptr;
-    pendingCapacity = 0;
-}
-
-void
-TypeCompartment::sweepShapes(FreeOp *fop)
-{
-    /*
-     * Sweep any weak shape references that may be finalized even if a GC is
-     * preserving type information.
-     */
-    if (objectTypeTable) {
-        for (ObjectTypeTable::Enum e(*objectTypeTable); !e.empty(); e.popFront()) {
-            const ObjectTableKey &key = e.front().key();
-            ObjectTableEntry &entry = e.front().value();
-
-            if (IsShapeAboutToBeFinalized(entry.shape.unsafeGet())) {
-                fop->free_(key.properties);
-                fop->free_(entry.types);
-                e.removeFront();
-            }
-        }
-    }
-}
-
-void
-TypeCompartment::clearCompilerOutputs(FreeOp *fop)
-{
-    if (constrainedOutputs) {
-        fop->delete_(constrainedOutputs);
-        constrainedOutputs = nullptr;
-    }
-
-    if (pendingRecompiles) {
-        JS_ASSERT(pendingRecompiles->length() == 0);
-        fop->delete_(pendingRecompiles);
-        pendingRecompiles = nullptr;
-    }
 }
 
 void
@@ -4193,7 +4162,6 @@ JSCompartment::sweepNewTypeObjectTable(TypeObjectWithNewScriptSet &table)
 
 TypeCompartment::~TypeCompartment()
 {
-    js_free(pendingArray);
     js_delete(arrayTypeTable);
     js_delete(objectTypeTable);
     js_delete(allocationSiteTable);
@@ -4212,12 +4180,6 @@ TypeScript::Sweep(FreeOp *fop, JSScript *script)
     /* Remove constraints and references to dead objects from the persistent type sets. */
     for (unsigned i = 0; i < num; i++)
         typeArray[i].sweep(compartment->zone());
-
-    /*
-     * Freeze constraints on stack type sets need to be regenerated the next
-     * time the script is analyzed.
-     */
-    script->clearHasFreezeConstraints();
 }
 
 void
@@ -4234,20 +4196,10 @@ Zone::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, size_t *typePoo
 
 void
 TypeCompartment::addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                        size_t *pendingArrays,
                                         size_t *allocationSiteTables,
                                         size_t *arrayTypeTables,
                                         size_t *objectTypeTables)
 {
-    /* Pending arrays are cleared on GC along with the analysis pool. */
-    *pendingArrays += mallocSizeOf(pendingArray);
-
-    /*
-     * TypeCompartment::pendingRecompiles is non-nullptr only while inference
-     * code is running.
-     */
-    JS_ASSERT(!pendingRecompiles);
-
     if (allocationSiteTable)
         *allocationSiteTables += allocationSiteTable->sizeOfIncludingThis(mallocSizeOf);
 
@@ -4289,6 +4241,8 @@ TypeObject::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
 TypeZone::TypeZone(Zone *zone)
   : zone_(zone),
     typeLifoAlloc(TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
+    compilerOutputs(nullptr),
+    pendingRecompiles(nullptr),
     pendingNukeTypes(false),
     inferenceEnabled(false)
 {
@@ -4296,6 +4250,8 @@ TypeZone::TypeZone(Zone *zone)
 
 TypeZone::~TypeZone()
 {
+    js_delete(compilerOutputs);
+    js_delete(pendingRecompiles);
 }
 
 void
@@ -4312,11 +4268,21 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
     LifoAlloc oldAlloc(typeLifoAlloc.defaultChunkSize());
     oldAlloc.steal(&typeLifoAlloc);
 
-    /*
-     * Sweep analysis information and everything depending on it from the
-     * compartment, including all remaining mjit code if inference is
-     * enabled in the compartment.
-     */
+    /* Sweep and find compressed indexes for each compiler output. */
+    size_t newCompilerOutputCount = 0;
+    if (compilerOutputs) {
+        for (size_t i = 0; i < compilerOutputs->length(); i++) {
+            CompilerOutput &output = (*compilerOutputs)[i];
+            if (output.isValid()) {
+                JSScript *script = output.script();
+                if (IsScriptAboutToBeFinalized(&script))
+                    output.invalidate();
+                else
+                    output.setSweepIndex(newCompilerOutputCount++);
+            }
+        }
+    }
+
     if (inferenceEnabled) {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_TI);
 
@@ -4328,6 +4294,21 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
                 if (releaseTypes) {
                     script->types->destroy();
                     script->types = nullptr;
+
+                    /*
+                     * Freeze constraints on stack type sets need to be
+                     * regenerated the next time the script is analyzed.
+                     */
+                    script->clearHasFreezeConstraints();
+
+                    JS_ASSERT(!script->hasIonScript());
+                    JS_ASSERT(!script->hasParallelIonScript());
+                } else {
+                    /* Update the recompile indexes in any IonScripts still on the script. */
+                    if (script->hasIonScript())
+                        script->ionScript()->recompileInfoRef().shouldSweep(*this);
+                    if (script->hasParallelIonScript())
+                        script->parallelIonScript()->recompileInfoRef().shouldSweep(*this);
                 }
             }
         }
@@ -4347,6 +4328,20 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
             comp->types.sweep(fop);
     }
 
+    if (compilerOutputs) {
+        size_t sweepIndex = 0;
+        for (size_t i = 0; i < compilerOutputs->length(); i++) {
+            CompilerOutput output = (*compilerOutputs)[i];
+            if (output.isValid()) {
+                JS_ASSERT(sweepIndex == output.sweepIndex());
+                output.setSweepIndex(0);
+                (*compilerOutputs)[sweepIndex++] = output;
+            }
+        }
+        JS_ASSERT(sweepIndex == newCompilerOutputCount);
+        JS_ALWAYS_TRUE(compilerOutputs->resize(newCompilerOutputCount));
+    }
+
     {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_CLEAR_SCRIPT_ANALYSIS);
         for (CellIterUnderGC i(zone(), FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 690631dfa7ad..38c3be127e82 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -177,7 +177,7 @@ namespace analyze {
 
 namespace types {
 
-class TypeCompartment;
+class TypeZone;
 class TypeSet;
 class TypeObjectKey;
 
@@ -278,28 +278,10 @@ inline Type GetValueType(const Value &val);
  * Type information about the values observed within scripts and about the
  * contents of the heap is accumulated as the program executes. Compilation
  * accumulates constraints relating type information on the heap with the
- * compilations that should be invalidated when those types change. This data
- * is periodically cleared to reduce memory usage.
- *
- * GCs may clear both analysis information and jitcode. Sometimes GCs will
- * preserve all information and code, and will not collect any scripts, type
- * objects or singleton JS objects.
- *
- * The following data is cleared by all non-preserving GCs:
- *
- * - The ScriptAnalysis for each analyzed script and data from each analysis
- *   pass performed.
- *
- * - Property type sets for singleton JS objects.
- *
- * - Type constraints and dead references in all type sets.
- *
- * The following data is occasionally cleared by non-preserving GCs:
- *
- * - TypeScripts and their type sets are occasionally destroyed, per a timer.
- *
- * - When a JSScript or TypeObject is swept, type information for its contents
- *   is destroyed.
+ * compilations that should be invalidated when those types change. Type
+ * information and constraints are allocated in the zone's typeLifoAlloc,
+ * and on GC all data referring to live things is copied into a new allocator.
+ * Thus, type set and constraints only hold weak references.
  */
 
 /*
@@ -334,6 +316,12 @@ public:
      * state.
      */
     virtual void newObjectState(JSContext *cx, TypeObject *object) {}
+
+    /*
+     * If the data this constraint refers to is still live, copy it into the
+     * zone's new allocator. Type constraints only hold weak references.
+     */
+    virtual TypeConstraint *sweep(TypeZone &zone) = 0;
 };
 
 /* Flags and other state stored in TypeSet::flags */
@@ -394,13 +382,6 @@ enum {
     /* If set, addendum information should not be installed on this object. */
     OBJECT_FLAG_ADDENDUM_CLEARED      = 0x2,
 
-    /*
-     * If set, type constraints covering the correctness of the newScript
-     * definite properties need to be regenerated before compiling any jitcode
-     * which depends on this information.
-     */
-    OBJECT_FLAG_NEW_SCRIPT_REGENERATE = 0x4,
-
     /*
      * Whether we have ensured all type sets in the compartment contain
      * ANYOBJECT instead of this object.
@@ -869,12 +850,6 @@ struct TypeTypedObject : public TypeObjectAddendum
  * information is sensitive to changes in the property's type. Future changes
  * to the property (whether those uncovered by analysis or those occurring
  * in the VM) will treat these properties like those of any other type object.
- *
- * When a GC occurs, we wipe out all analysis information for all the
- * compartment's scripts, so can destroy all properties on singleton type
- * objects at the same time. If there is no reference on the stack to the
- * type object itself, the type object is also destroyed, and the JS object
- * reverts to having a lazy type.
  */
 
 /* Type information about an object accessed by a script. */
@@ -1316,7 +1291,7 @@ class HeapTypeSetKey
 
     void freeze(CompilerConstraintList *constraints);
     JSValueType knownTypeTag(CompilerConstraintList *constraints);
-    bool configured(CompilerConstraintList *constraints, TypeObjectKey *type);
+    bool configured(CompilerConstraintList *constraints);
     bool isOwnProperty(CompilerConstraintList *constraints);
     bool knownSubset(CompilerConstraintList *constraints, const HeapTypeSetKey &other);
     JSObject *singleton(CompilerConstraintList *constraints);
@@ -1339,6 +1314,10 @@ class CompilerOutput
     // Whether this compilation is about to be invalidated.
     bool pendingInvalidation_ : 1;
 
+    // During sweeping, the list of compiler outputs is compacted and invalidated
+    // outputs are removed. This gives the new index for a valid compiler output.
+    uint32_t sweepIndex_ : 29;
+
   public:
     CompilerOutput()
       : script_(nullptr), mode_(SequentialExecution), pendingInvalidation_(false)
@@ -1366,6 +1345,15 @@ class CompilerOutput
     bool pendingInvalidation() {
         return pendingInvalidation_;
     }
+
+    void setSweepIndex(uint32_t index) {
+        if (index >= 1 << 29)
+            MOZ_CRASH();
+        sweepIndex_ = index;
+    }
+    uint32_t sweepIndex() {
+        return sweepIndex_;
+    }
 };
 
 class RecompileInfo
@@ -1380,8 +1368,9 @@ class RecompileInfo
     bool operator == (const RecompileInfo &o) const {
         return outputIndex == o.outputIndex;
     }
-    CompilerOutput *compilerOutput(TypeCompartment &types) const;
+    CompilerOutput *compilerOutput(TypeZone &types) const;
     CompilerOutput *compilerOutput(JSContext *cx) const;
+    bool shouldSweep(TypeZone &types);
 };
 
 /* Type information for a compartment. */
@@ -1389,32 +1378,9 @@ struct TypeCompartment
 {
     /* Constraint solving worklist structures. */
 
-    /*
-     * Worklist of types which need to be propagated to constraints. We use a
-     * worklist to avoid blowing the native stack.
-     */
-    struct PendingWork
-    {
-        TypeConstraint *constraint;
-        ConstraintTypeSet *source;
-        Type type;
-    };
-    PendingWork *pendingArray;
-    unsigned pendingCount;
-    unsigned pendingCapacity;
-
-    /* Whether we are currently resolving the pending worklist. */
-    bool resolving;
-
     /* Number of scripts in this compartment. */
     unsigned scriptCount;
 
-    /* Valid & Invalid script referenced by type constraints. */
-    Vector<CompilerOutput> *constrainedOutputs;
-
-    /* Pending recompilations to perform before execution of JIT code can resume. */
-    Vector<RecompileInfo> *pendingRecompiles;
-
     /* Table for referencing types of objects keyed to an allocation site. */
     AllocationSiteTable *allocationSiteTable;
 
@@ -1438,14 +1404,6 @@ struct TypeCompartment
 
     inline JSCompartment *compartment();
 
-    /* Add a type to register with a list of constraints. */
-    inline void addPending(JSContext *cx, TypeConstraint *constraint,
-                           ConstraintTypeSet *source, Type type);
-    bool growPendingArray(JSContext *cx);
-
-    /* Resolve pending type registrations, excluding delayed ones. */
-    inline void resolvePending(JSContext *cx);
-
     /* Prints results of this compartment if spew is enabled or force is set. */
     void print(JSContext *cx, bool force);
 
@@ -1461,26 +1419,16 @@ struct TypeCompartment
     /* Get or make an object for an allocation site, and add to the allocation site table. */
     TypeObject *addAllocationSiteTypeObject(JSContext *cx, AllocationSiteKey key);
 
-    void processPendingRecompiles(FreeOp *fop);
-
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes(ExclusiveContext *cx);
 
-    /* Mark a script as needing recompilation once inference has finished. */
-    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
-    void addPendingRecompile(JSContext *cx, JSScript *script);
-
     /* Mark any type set containing obj as having a generic object type. */
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
     void sweep(FreeOp *fop);
-    void sweepShapes(FreeOp *fop);
-    void clearCompilerOutputs(FreeOp *fop);
-
     void finalizeObjects();
 
     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                size_t *pendingArrays,
                                 size_t *allocationSiteTables,
                                 size_t *arrayTypeTables,
                                 size_t *objectTypeTables);
@@ -1496,6 +1444,16 @@ struct TypeZone
     static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 8 * 1024;
     js::LifoAlloc                typeLifoAlloc;
 
+    /*
+     * All Ion compilations that have occured in this zone, for indexing via
+     * RecompileInfo. This includes both valid and invalid compilations, though
+     * invalidated compilations are swept on GC.
+     */
+    Vector<CompilerOutput> *compilerOutputs;
+
+    /* Pending recompilations to perform before execution of JIT code can resume. */
+    Vector<RecompileInfo> *pendingRecompiles;
+
     /*
      * Bit set if all current types must be marked as unknown, and all scripts
      * recompiled. Caused by OOM failure within inference operations.
@@ -1516,6 +1474,12 @@ struct TypeZone
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes();
 
+    /* Mark a script as needing recompilation once inference has finished. */
+    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
+    void addPendingRecompile(JSContext *cx, JSScript *script);
+
+    void processPendingRecompiles(FreeOp *fop);
+
     void nukeTypes(FreeOp *fop);
 };
 
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index c4e07abd3271..328daf0a076c 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -104,17 +104,29 @@ CompilerOutput::ion() const
 }
 
 inline CompilerOutput*
-RecompileInfo::compilerOutput(TypeCompartment &types) const
+RecompileInfo::compilerOutput(TypeZone &types) const
 {
-    if (!types.constrainedOutputs || outputIndex >= types.constrainedOutputs->length())
+    if (!types.compilerOutputs || outputIndex >= types.compilerOutputs->length())
         return nullptr;
-    return &(*types.constrainedOutputs)[outputIndex];
+    return &(*types.compilerOutputs)[outputIndex];
 }
 
 inline CompilerOutput*
 RecompileInfo::compilerOutput(JSContext *cx) const
 {
-    return compilerOutput(cx->compartment()->types);
+    return compilerOutput(cx->zone()->types);
+}
+
+inline bool
+RecompileInfo::shouldSweep(TypeZone &types)
+{
+    CompilerOutput *output = compilerOutput(types);
+    if (!output || !output->isValid())
+        return true;
+
+    // Update this info for the output's new index in the zone's compiler outputs.
+    outputIndex = output->sweepIndex();
+    return false;
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -288,14 +300,13 @@ struct AutoEnterAnalysis
          * If there are no more type inference activations on the stack,
          * process any triggered recompilations. Note that we should not be
          * invoking any scripted code while type inference is running.
-         * :TODO: assert this.
          */
         if (!compartment->activeAnalysis) {
-            TypeCompartment *types = &compartment->types;
-            if (compartment->zone()->types.pendingNukeTypes)
-                compartment->zone()->types.nukeTypes(freeOp);
-            else if (types->pendingRecompiles)
-                types->processPendingRecompiles(freeOp);
+            TypeZone &types = compartment->zone()->types;
+            if (types.pendingNukeTypes)
+                types.nukeTypes(freeOp);
+            else if (types.pendingRecompiles)
+                types.processPendingRecompiles(freeOp);
         }
     }
 
@@ -852,50 +863,6 @@ TypeCompartment::compartment()
     return (JSCompartment *)((char *)this - offsetof(JSCompartment, types));
 }
 
-inline void
-TypeCompartment::addPending(JSContext *cx, TypeConstraint *constraint,
-                            ConstraintTypeSet *source, Type type)
-{
-    JS_ASSERT(this == &cx->compartment()->types);
-    JS_ASSERT(!cx->runtime()->isHeapBusy());
-
-    InferSpew(ISpewOps, "pending: %sC%p%s %s",
-              InferSpewColor(constraint), constraint, InferSpewColorReset(),
-              TypeString(type));
-
-    if ((pendingCount == pendingCapacity) && !growPendingArray(cx))
-        return;
-
-    PendingWork &pending = pendingArray[pendingCount++];
-    pending.constraint = constraint;
-    pending.source = source;
-    pending.type = type;
-}
-
-inline void
-TypeCompartment::resolvePending(JSContext *cx)
-{
-    JS_ASSERT(this == &cx->compartment()->types);
-
-    if (resolving) {
-        /* There is an active call further up resolving the worklist. */
-        return;
-    }
-
-    resolving = true;
-
-    /* Handle all pending type registrations. */
-    while (pendingCount) {
-        const PendingWork &pending = pendingArray[--pendingCount];
-        InferSpew(ISpewOps, "resolve: %sC%p%s %s",
-                  InferSpewColor(pending.constraint), pending.constraint,
-                  InferSpewColorReset(), TypeString(pending.type));
-        pending.constraint->newType(cx, pending.source, pending.type);
-    }
-
-    resolving = false;
-}
-
 /////////////////////////////////////////////////////////////////////
 // TypeSet
 /////////////////////////////////////////////////////////////////////
@@ -1219,10 +1186,9 @@ ConstraintTypeSet::addType(ExclusiveContext *cxArg, Type type)
     if (JSContext *cx = cxArg->maybeJSContext()) {
         TypeConstraint *constraint = constraintList;
         while (constraint) {
-            cx->compartment()->types.addPending(cx, constraint, this, type);
+            constraint->newType(cx, this, type);
             constraint = constraint->next;
         }
-        cx->compartment()->types.resolvePending(cx);
     } else {
         JS_ASSERT(!constraintList);
     }
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index 3ba7d433c6f8..ee09906df5bd 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -215,7 +215,6 @@ StatsCompartmentCallback(JSRuntime *rt, void *data, JSCompartment *compartment)
 
     // Measure the compartment object itself, and things hanging off it.
     compartment->addSizeOfIncludingThis(rtStats->mallocSizeOf_,
-                                        &cStats.typeInferencePendingArrays,
                                         &cStats.typeInferenceAllocationSiteTables,
                                         &cStats.typeInferenceArrayTypeTables,
                                         &cStats.typeInferenceObjectTypeTables,
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 1a12e11d83b3..b225830e8efe 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2122,10 +2122,6 @@ ReportCompartmentStats(const JS::CompartmentStats &cStats,
                    cStats.typeInferenceTypeScripts,
                    "Memory used by type sets associated with scripts.");
 
-    ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/pending-arrays"),
-                   cStats.typeInferencePendingArrays,
-                   "Memory used for solving constraints during type inference.");
-
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/allocation-site-tables"),
                    cStats.typeInferenceAllocationSiteTables,
                    "Memory indexing type objects associated with allocation sites.");

From 5b212815ea2bfe748287fc23cc77ae0da155e7ba Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Thu, 12 Dec 2013 16:11:54 -0500
Subject: [PATCH 048/459] Bug 948096.  Warn when people use window._content. 
 r=smaug,myk

---
 content/base/public/nsDeprecatedOperationList.h          | 1 +
 dom/base/nsGlobalWindow.h                                | 3 +++
 dom/locales/en-US/chrome/dom/dom.properties              | 2 ++
 webapprt/locales/en-US/webapprt/overrides/dom.properties | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/content/base/public/nsDeprecatedOperationList.h b/content/base/public/nsDeprecatedOperationList.h
index f0e2c0c6ee38..f8a8433cd02b 100644
--- a/content/base/public/nsDeprecatedOperationList.h
+++ b/content/base/public/nsDeprecatedOperationList.h
@@ -40,3 +40,4 @@ DEPRECATED_OPERATION(UseOfDOM3LoadMethod)
 DEPRECATED_OPERATION(ShowModalDialog)
 DEPRECATED_OPERATION(UnsafeCloneNode)
 DEPRECATED_OPERATION(UnsafeImportNode)
+DEPRECATED_OPERATION(Window_Content)
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 524bbba79674..2218c0e02fc4 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -946,6 +946,9 @@ public:
   JSObject* GetContent(JSContext* aCx, mozilla::ErrorResult& aError);
   JSObject* Get_content(JSContext* aCx, mozilla::ErrorResult& aError)
   {
+    if (mDoc) {
+      mDoc->WarnOnceAbout(nsIDocument::eWindow_Content);
+    }
     return GetContent(aCx, aError);
   }
 
diff --git a/dom/locales/en-US/chrome/dom/dom.properties b/dom/locales/en-US/chrome/dom/dom.properties
index 9e11a09e59c9..9a4245fba00b 100644
--- a/dom/locales/en-US/chrome/dom/dom.properties
+++ b/dom/locales/en-US/chrome/dom/dom.properties
@@ -146,3 +146,5 @@ ShowModalDialogWarning=Use of window.showModalDialog() is deprecated. Use window
 UnsafeCloneNodeWarning=The behavior of cloneNode() with no boolean argument is about to change from doing a deep clone to doing a shallow clone.  Make sure to pass an explicit boolean argument to keep your current behavior.
 # LOCALIZATION NOTE: Do not translate "importNode()"
 UnsafeImportNodeWarning=The behavior of importNode() with no boolean argument is about to change from doing a deep clone to doing a shallow clone.  Make sure to pass an explicit boolean argument to keep your current behavior.
+# LOCALIZATION NOTE: Do not translate "window._content" or "window.content"
+Window_ContentWarning=window._content is deprecated.  Please use window.content instead.
diff --git a/webapprt/locales/en-US/webapprt/overrides/dom.properties b/webapprt/locales/en-US/webapprt/overrides/dom.properties
index 732431b4e827..08870f7479be 100644
--- a/webapprt/locales/en-US/webapprt/overrides/dom.properties
+++ b/webapprt/locales/en-US/webapprt/overrides/dom.properties
@@ -146,3 +146,5 @@ ShowModalDialogWarning=Use of window.showModalDialog() is deprecated. Use window
 UnsafeCloneNodeWarning=The behavior of cloneNode() with no boolean argument is about to change from doing a deep clone to doing a shallow clone.  Make sure to pass an explicit boolean argument to keep your current behavior.
 # LOCALIZATION NOTE: Do not translate "importNode()"
 UnsafeImportNodeWarning=The behavior of importNode() with no boolean argument is about to change from doing a deep clone to doing a shallow clone.  Make sure to pass an explicit boolean argument to keep your current behavior.
+# LOCALIZATION NOTE: Do not translate "window._content" or "window.content"
+Window_ContentWarning=window._content is deprecated.  Please use window.content instead.

From 3e0c5f04f29bab34aaaa495bcb74aa6dc74fe4aa Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Thu, 12 Dec 2013 16:11:55 -0500
Subject: [PATCH 049/459] Bug 949264 part 1.  Share more codegen between events
 and CGNativeMember.  r=smaug

---
 dom/bindings/Codegen.py | 72 +++++++++--------------------------------
 1 file changed, 15 insertions(+), 57 deletions(-)

diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index d9d1ef26ee68..3bc27bf59c4e 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -11435,71 +11435,33 @@ class CGEventGetter(CGNativeMember):
                                                                    attr),
                                 (attr.type, []),
                                 ea)
-
-    def retval(self, type):
-        if type.isPrimitive() and type.tag() in builtinNames:
-            result = CGGeneric(builtinNames[type.tag()])
-            if type.nullable():
-                result = CGTemplatedType("Nullable", result)
-            return result.define()
-        if type.isDOMString():
-            return "void"
-        if type.isByteString():
-            return "void"
-        if type.isEnum():
-            enumName = type.unroll().inner.identifier.name
-            if type.nullable():
-                enumName = CGTemplatedType("Nullable",
-                                           CGGeneric(enumName)).define()
-            return enumName
-        if type.isGeckoInterface():
-            iface = type.unroll().inner;
-            nativeType = self.descriptorProvider.getDescriptor(
-                iface.identifier.name).nativeType
-            # Now trim off unnecessary namespaces
-            nativeType = nativeType.split("::")
-            if nativeType[0] == "mozilla":
-                nativeType.pop(0)
-                if nativeType[0] == "dom":
-                    nativeType.pop(0)
-            return CGWrapper(CGGeneric("::".join(nativeType)), post="*").define()
-        if type.isAny():
-            return "JS::Value"
-        if type.isObject():
-            return "JSObject*"
-        if type.isSpiderMonkeyInterface():
-            return "JSObject*"
-        raise TypeError("Don't know how to declare return value for %s" %
-                        type)
+        self.body = self.getMethodBody()
 
     def getArgs(self, returnType, argList):
-        args = [self.getArg(arg) for arg in argList]
-        if returnType.isDOMString():
-            args.append(Argument("nsString&", "aRetVal"))
-        elif returnType.isByteString():
-            args.append(Argument("nsCString&", "aRetVal"))
-        if needCx(returnType, argList, self.extendedAttrs, True):
-            args.insert(0, Argument("JSContext*", "aCx"))
         if not 'infallible' in self.extendedAttrs:
             raise TypeError("Event code generator does not support [Throws]!")
-        return args
+        if not self.member.isAttr():
+            raise TypeError("Event code generator does not support methods")
+        if self.member.isStatic():
+            raise TypeError("Event code generators does not support static attributes")
+        return CGNativeMember.getArgs(self, returnType, argList)
 
     def getMethodBody(self):
         type = self.member.type
         memberName = CGDictionary.makeMemberName(self.member.identifier.name)
         if (type.isPrimitive() and type.tag() in builtinNames) or type.isEnum() or type.isGeckoInterface():
-            return "  return " + memberName + ";"
+            return "return " + memberName + ";"
         if type.isDOMString() or type.isByteString():
-            return "  aRetVal = " + memberName + ";";
+            return "retval = " + memberName + ";";
         if type.isSpiderMonkeyInterface() or type.isObject():
-            ret =  "  if (%s) {\n" % memberName
-            ret += "    JS::ExposeObjectToActiveJS(%s);\n" % memberName
-            ret += "  }\n"
-            ret += "  return " + memberName + ";"
+            ret =  "if (%s) {\n" % memberName
+            ret += "  JS::ExposeObjectToActiveJS(%s);\n" % memberName
+            ret += "}\n"
+            ret += "return " + memberName + ";"
             return ret;
         if type.isAny():
-            ret =  "  JS::ExposeValueToActiveJS("+ memberName + ");\n"
-            ret += "  return " + memberName + ";"
+            ret =  "JS::ExposeValueToActiveJS("+ memberName + ");\n"
+            ret += "return " + memberName + ";"
             return ret;
         raise TypeError("Event code generator does not support this type!")
 
@@ -11513,11 +11475,7 @@ class CGEventGetter(CGNativeMember):
         if getattr(self.member, "originatingInterface",
                    cgClass.descriptor.interface) != cgClass.descriptor.interface:
             return ""
-        ret = self.retval(self.member.type);
-        methodName = self.descriptorProvider.name + '::' + self.name
-        args = (', '.join([a.declare() for a in self.args]))
-        body = self.getMethodBody()
-        return ret + "\n" + methodName + '(' + args + ') const\n{\n' + body + "\n}\n"
+        return CGNativeMember.define(self, cgClass)
 
 class CGEventSetter(CGNativeMember):
     def __init__(self):

From 6f31ec040a7bb2378fde84101dd029a5e86c5b64 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Thu, 12 Dec 2013 16:11:55 -0500
Subject: [PATCH 050/459] Bug 949264 part 2.  Support union members in
 generated events.  r=smaug

---
 dom/bindings/Codegen.py | 50 ++++++++++++++++++++++++++++++++++++++---
 1 file changed, 47 insertions(+), 3 deletions(-)

diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 3bc27bf59c4e..4302a7721e2b 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -3277,7 +3277,7 @@ for (uint32_t i = 0; i < length; ++i) {
                                  exceptionCodeIndented.define()))
         templateBody = CGWrapper(CGIndenter(CGList([templateBody, throw], "\n")), pre="{\n", post="\n}")
 
-        typeName = ("Owning" if isMember else "") + type.name
+        typeName = CGUnionStruct.unionTypeDecl(type, isMember)
         argumentTypeName = typeName + "Argument"
         if nullable:
             typeName = "Nullable<" + typeName + " >"
@@ -4702,7 +4702,7 @@ def getRetvalDeclarationForType(returnType, descriptorProvider,
             resultArgs = None
         return result, True, None, resultArgs
     if returnType.isUnion():
-        result = CGGeneric("Owning" + returnType.unroll().name)
+        result = CGGeneric(CGUnionStruct.unionTypeName(returnType.unroll(), True))
         if not isMember and typeNeedsRooting(returnType):
             if returnType.nullable():
                 result = CGTemplatedType("NullableRootedUnion", result)
@@ -6891,7 +6891,7 @@ class CGUnionStruct(CGThing):
                          default=CGGeneric("return false;")).define(), const=True))
 
         constructors = [ctor]
-        selfName = ("Owning" if self.ownsMembers else "") + str(self.type)
+        selfName = CGUnionStruct.unionTypeName(self.type, self.ownsMembers)
         if self.ownsMembers:
             if len(traceCases):
                 traceBody = CGSwitch("mType", traceCases,
@@ -6950,6 +6950,28 @@ class CGUnionStruct(CGThing):
     def isUnionCopyConstructible(type):
         return all(isTypeCopyConstructible(t) for t in type.flatMemberTypes)
 
+    @staticmethod
+    def unionTypeName(type, ownsMembers):
+        """
+        Returns a string name for this known union type.
+        """
+        assert type.isUnion() and not type.nullable()
+        return ("Owning" if ownsMembers else "") + type.name
+
+    @staticmethod
+    def unionTypeDecl(type, ownsMembers):
+        """
+        Returns a string for declaring this possibly-nullable union type.
+        """
+        assert type.isUnion()
+        nullable = type.nullable()
+        if nullable:
+            type = type.inner
+        decl = CGGeneric(CGUnionStruct.unionTypeName(type, ownsMembers))
+        if nullable:
+            decl = CGTemplatedType("Nullable", decl)
+        return decl.define()
+
 class CGUnionConversionStruct(CGThing):
     def __init__(self, type, descriptorProvider):
         CGThing.__init__(self)
@@ -9854,6 +9876,14 @@ class CGNativeMember(ClassMethod):
                 return CGDictionary.makeDictionaryName(type.inner), None, None
             # In this case we convert directly into our outparam to start with
             return "void", "", ""
+        if type.isUnion():
+            if isMember:
+                # Only the first member of the tuple matters here, but return
+                # bogus values for the others in case someone decides to use
+                # them.
+                return CGUnionStruct.unionTypeDecl(type, True), None, None
+            # In this case we convert directly into our outparam to start with
+            return "void", "", ""
 
         raise TypeError("Don't know how to declare return value for %s" %
                         type)
@@ -9883,6 +9913,10 @@ class CGNativeMember(ClassMethod):
             if nullable:
                 dictType = CGTemplatedType("Nullable", dictType)
             args.append(Argument("%s&" % dictType.define(), "retval"))
+        elif returnType.isUnion():
+            args.append(Argument("%s&" %
+                                 CGUnionStruct.unionTypeDecl(returnType, True),
+                                 "retval"))
         # And the ErrorResult
         if not 'infallible' in self.extendedAttrs:
             # Use aRv so it won't conflict with local vars named "rv"
@@ -11463,6 +11497,8 @@ class CGEventGetter(CGNativeMember):
             ret =  "JS::ExposeValueToActiveJS("+ memberName + ");\n"
             ret += "return " + memberName + ";"
             return ret;
+        if type.isUnion():
+            return "retval = " + memberName + ";"
         raise TypeError("Event code generator does not support this type!")
 
     def declare(self, cgClass):
@@ -11612,6 +11648,11 @@ class CGEventClass(CGBindingImplClass):
                     nativeType = "JS::Heap<JS::Value>"
                 elif m.type.isObject() or m.type.isSpiderMonkeyInterface():
                     nativeType = "JS::Heap<JSObject*>"
+                elif m.type.isUnion():
+                    nativeType = CGUnionStruct.unionTypeDecl(m.type, True)
+                else:
+                    raise TypeError("Don't know how to declare member of type %s" %
+                                    m.type)
                 members.append(ClassMember(CGDictionary.makeMemberName(m.identifier.name),
                                nativeType,
                                visibility="private",
@@ -11673,6 +11714,9 @@ class CGEventClass(CGBindingImplClass):
                     retVal += "  NS_IMPL_CYCLE_COLLECTION_TRACE_JSVAL_MEMBER_CALLBACK(" + name + ")\n"
                 elif m.type.isObject() or m.type.isSpiderMonkeyInterface():
                     retVal += "  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(" + name + ")\n"
+                elif typeNeedsRooting(m.type):
+                    raise TypeError("Need to implement tracing for event "
+                                    "member of type %s" % m.type)
         return retVal
 
     def define(self):

From ac153799bdf616a21fcc83022b6dc81f8dc9e3d9 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Thu, 12 Dec 2013 16:11:55 -0500
Subject: [PATCH 051/459] Bug 949264 part 3.  Use aRetVal for the outparam
 return value for CGNativeMember.  r=smaug

---
 dom/bindings/Codegen.py | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 4302a7721e2b..d94557fd328c 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -3845,7 +3845,7 @@ for (uint32_t i = 0; i < length; ++i) {
         if not isMember and isCallbackReturnValue:
             # Go ahead and just convert directly into our actual return value
             declType = CGWrapper(declType, post="&")
-            declArgs = "retval"
+            declArgs = "aRetVal"
         elif not isMember and typeNeedsRooting(type):
             declType = CGTemplatedType("RootedDictionary", declType);
             declArgs = "cx"
@@ -9789,13 +9789,13 @@ class CGNativeMember(ClassMethod):
                 # No need for a third element in the isMember case
                 return "nsString", None, None
             # Outparam
-            return "void", "", "retval = ${declName};"
+            return "void", "", "aRetVal = ${declName};"
         if type.isByteString():
             if isMember:
                 # No need for a third element in the isMember case
                 return "nsCString", None, None
             # Outparam
-            return "void", "", "retval = ${declName};"
+            return "void", "", "aRetVal = ${declName};"
         if type.isEnum():
             enumName = type.unroll().inner.identifier.name
             if type.nullable():
@@ -9855,12 +9855,12 @@ class CGNativeMember(ClassMethod):
             # Outparam.
             if type.nullable():
                 returnCode = ("if (${declName}.IsNull()) {\n"
-                              "  retval.SetNull();\n"
+                              "  aRetVal.SetNull();\n"
                               "} else {\n"
-                              "  retval.SetValue().SwapElements(${declName}.Value());\n"
+                              "  aRetVal.SetValue().SwapElements(${declName}.Value());\n"
                               "}")
             else:
-                returnCode = "retval.SwapElements(${declName});"
+                returnCode = "aRetVal.SwapElements(${declName});"
             return "void", "", returnCode
         if type.isDate():
             result = CGGeneric("Date")
@@ -9892,9 +9892,9 @@ class CGNativeMember(ClassMethod):
         args = [self.getArg(arg) for arg in argList]
         # Now the outparams
         if returnType.isDOMString():
-            args.append(Argument("nsString&", "retval"))
+            args.append(Argument("nsString&", "aRetVal"))
         elif returnType.isByteString():
-            args.append(Argument("nsCString&", "retval"))
+            args.append(Argument("nsCString&", "aRetVal"))
         elif returnType.isSequence():
             nullable = returnType.nullable()
             if nullable:
@@ -9904,7 +9904,7 @@ class CGNativeMember(ClassMethod):
             type = CGTemplatedType("nsTArray", CGGeneric(elementDecl))
             if nullable:
                 type = CGTemplatedType("Nullable", type)
-            args.append(Argument("%s&" % type.define(), "retval"))
+            args.append(Argument("%s&" % type.define(), "aRetVal"))
         elif returnType.isDictionary():
             nullable = returnType.nullable()
             if nullable:
@@ -9912,11 +9912,11 @@ class CGNativeMember(ClassMethod):
             dictType = CGGeneric(CGDictionary.makeDictionaryName(returnType.inner))
             if nullable:
                 dictType = CGTemplatedType("Nullable", dictType)
-            args.append(Argument("%s&" % dictType.define(), "retval"))
+            args.append(Argument("%s&" % dictType.define(), "aRetVal"))
         elif returnType.isUnion():
             args.append(Argument("%s&" %
                                  CGUnionStruct.unionTypeDecl(returnType, True),
-                                 "retval"))
+                                 "aRetVal"))
         # And the ErrorResult
         if not 'infallible' in self.extendedAttrs:
             # Use aRv so it won't conflict with local vars named "rv"
@@ -11486,7 +11486,7 @@ class CGEventGetter(CGNativeMember):
         if (type.isPrimitive() and type.tag() in builtinNames) or type.isEnum() or type.isGeckoInterface():
             return "return " + memberName + ";"
         if type.isDOMString() or type.isByteString():
-            return "retval = " + memberName + ";";
+            return "aRetVal = " + memberName + ";";
         if type.isSpiderMonkeyInterface() or type.isObject():
             ret =  "if (%s) {\n" % memberName
             ret += "  JS::ExposeObjectToActiveJS(%s);\n" % memberName
@@ -11498,7 +11498,7 @@ class CGEventGetter(CGNativeMember):
             ret += "return " + memberName + ";"
             return ret;
         if type.isUnion():
-            return "retval = " + memberName + ";"
+            return "aRetVal = " + memberName + ";"
         raise TypeError("Event code generator does not support this type!")
 
     def declare(self, cgClass):

From f5f63077e215d0ae945e9b9ff728316a076e0f0b Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Thu, 12 Dec 2013 16:11:56 -0500
Subject: [PATCH 052/459] Bug 949271.  Fix callback and JS-implemented codegen
 for sequence-of-union and variadic-union arguments.  r=smaug

---
 dom/bindings/Codegen.py                 | 11 +++++++----
 dom/bindings/test/TestBindingHeader.h   |  3 +++
 dom/bindings/test/TestCodeGen.webidl    |  3 +++
 dom/bindings/test/TestExampleGen.webidl |  3 +++
 dom/bindings/test/TestJSImplGen.webidl  | 11 ++++++-----
 5 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index d94557fd328c..c32b821fa513 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -9506,7 +9506,10 @@ class CGForwardDeclarations(CGWrapper):
             elif t.isCallbackInterface():
                 builder.addInMozillaDom(t.inner.identifier.name)
             elif t.isUnion():
-                builder.addInMozillaDom(str(t))
+                # Forward declare both the owning and non-owning version,
+                # since we don't know which one we might want
+                builder.addInMozillaDom(CGUnionStruct.unionTypeName(t, False))
+                builder.addInMozillaDom(CGUnionStruct.unionTypeName(t, True))
             # Don't need to do anything for void, primitive, string, any or object.
             # There may be some other cases we are missing.
 
@@ -9961,9 +9964,9 @@ class CGNativeMember(ClassMethod):
             return decl.define(), True, True
 
         if type.isUnion():
-            if type.nullable():
-                type = type.inner
-            return str(type), True, True
+            # unionTypeDecl will handle nullable types, so return False for
+            # auto-wrapping in Nullable
+            return CGUnionStruct.unionTypeDecl(type, isMember), True, False
 
         if type.isGeckoInterface() and not type.isCallbackInterface():
             iface = type.unroll().inner
diff --git a/dom/bindings/test/TestBindingHeader.h b/dom/bindings/test/TestBindingHeader.h
index 305cdb7a9b04..01b641c2bb4b 100644
--- a/dom/bindings/test/TestBindingHeader.h
+++ b/dom/bindings/test/TestBindingHeader.h
@@ -559,6 +559,9 @@ public:
   void PassNullableUnionWithDefaultValue11(const Nullable<UnrestrictedFloatOrString>& arg);
   void PassNullableUnionWithDefaultValue12(const Nullable<UnrestrictedFloatOrString>& arg);
 
+  void PassSequenceOfUnions(const Sequence<OwningCanvasPatternOrCanvasGradient>&);
+  void PassVariadicUnion(const Sequence<OwningCanvasPatternOrCanvasGradient>&);
+
   void ReceiveUnion(OwningCanvasPatternOrCanvasGradient&);
   void ReceiveUnion2(JSContext*, OwningObjectOrLong&);
   void ReceiveUnionContainingNull(OwningCanvasPatternOrNullOrCanvasGradient&);
diff --git a/dom/bindings/test/TestCodeGen.webidl b/dom/bindings/test/TestCodeGen.webidl
index a2c0f99b6af0..667395af6591 100644
--- a/dom/bindings/test/TestCodeGen.webidl
+++ b/dom/bindings/test/TestCodeGen.webidl
@@ -505,6 +505,9 @@ interface TestInterface {
   void passNullableUnionWithDefaultValue11(optional (unrestricted float or DOMString)? arg = 1);
   void passNullableUnionWithDefaultValue12(optional (unrestricted float or DOMString)? arg = null);
 
+  void passSequenceOfUnions(sequence<(CanvasPattern or CanvasGradient)> arg);
+  void passVariadicUnion((CanvasPattern or CanvasGradient)... arg);
+
   (CanvasPattern or CanvasGradient) receiveUnion();
   (object or long) receiveUnion2();
   (CanvasPattern? or CanvasGradient) receiveUnionContainingNull();
diff --git a/dom/bindings/test/TestExampleGen.webidl b/dom/bindings/test/TestExampleGen.webidl
index 63777e4c26a5..45638ec4b62a 100644
--- a/dom/bindings/test/TestExampleGen.webidl
+++ b/dom/bindings/test/TestExampleGen.webidl
@@ -401,6 +401,9 @@ interface TestExampleInterface {
   void passNullableUnionWithDefaultValue11(optional (unrestricted float or DOMString)? arg = 1);
   void passNullableUnionWithDefaultValue12(optional (unrestricted float or DOMString)? arg = null);
 
+  void passSequenceOfUnions(sequence<(CanvasPattern or CanvasGradient)> arg);
+  void passVariadicUnion((CanvasPattern or CanvasGradient)... arg);
+
   //(CanvasPattern or CanvasGradient) receiveUnion();
   //(object or long) receiveUnion2();
   //(CanvasPattern? or CanvasGradient) receiveUnionContainingNull();
diff --git a/dom/bindings/test/TestJSImplGen.webidl b/dom/bindings/test/TestJSImplGen.webidl
index 6135630c82e7..db9535aa1748 100644
--- a/dom/bindings/test/TestJSImplGen.webidl
+++ b/dom/bindings/test/TestJSImplGen.webidl
@@ -380,12 +380,10 @@ interface TestJSImplInterface {
   void passUnion14(optional (object or long?) arg = 5);
 #endif
   void passUnionWithNullable((object? or long) arg);
-  // FIXME: Bug 863948 Nullable unions not supported yet
-  //   void passNullableUnion((object or long)? arg);
+  void passNullableUnion((object or long)? arg);
   void passOptionalUnion(optional (object or long) arg);
-  // FIXME: Bug 863948 Nullable unions not supported yet
-  //  void passOptionalNullableUnion(optional (object or long)? arg);
-  //  void passOptionalNullableUnionWithDefaultValue(optional (object or long)? arg = null);
+  void passOptionalNullableUnion(optional (object or long)? arg);
+  void passOptionalNullableUnionWithDefaultValue(optional (object or long)? arg = null);
   //void passUnionWithInterfaces((TestJSImplInterface or TestExternalInterface) arg);
   //void passUnionWithInterfacesAndNullable((TestJSImplInterface? or TestExternalInterface) arg);
   //void passUnionWithSequence((sequence<object> or long) arg);
@@ -425,6 +423,9 @@ interface TestJSImplInterface {
   void passNullableUnionWithDefaultValue11(optional (unrestricted float or DOMString)? arg = 1);
   void passNullableUnionWithDefaultValue12(optional (unrestricted float or DOMString)? arg = null);
 
+  void passSequenceOfUnions(sequence<(CanvasPattern or CanvasGradient)> arg);
+  void passVariadicUnion((CanvasPattern or CanvasGradient)... arg);
+
   //(CanvasPattern or CanvasGradient) receiveUnion();
   //(object or long) receiveUnion2();
   //(CanvasPattern? or CanvasGradient) receiveUnionContainingNull();

From 3676b948cfbd194bb5ea6332012b72b2b576b894 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Thu, 12 Dec 2013 16:11:56 -0500
Subject: [PATCH 053/459] Bug 949471.  history.state should be null, not
 undefined, when there is no state.  r=smaug

---
 dom/base/nsHistory.cpp                        |  2 +-
 dom/base/test/mochitest.ini                   |  1 +
 dom/base/test/test_history_state_null.html    | 25 +++++++++++++++++++
 .../mochitest/whatwg/test_bug500328.html      | 12 ++++-----
 4 files changed, 33 insertions(+), 7 deletions(-)
 create mode 100644 dom/base/test/test_history_state_null.html

diff --git a/dom/base/nsHistory.cpp b/dom/base/nsHistory.cpp
index 66a31e9af083..a2c3f9d67c59 100644
--- a/dom/base/nsHistory.cpp
+++ b/dom/base/nsHistory.cpp
@@ -139,7 +139,7 @@ nsHistory::GetState(JSContext* aCx, ErrorResult& aRv) const
     return jsData;
   }
 
-  return JS::UndefinedValue();
+  return JS::NullValue();
 }
 
 void
diff --git a/dom/base/test/mochitest.ini b/dom/base/test/mochitest.ini
index 51ded34a81c5..ab46010005f5 100644
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -19,6 +19,7 @@ support-files =
 [test_gsp-quirks.html]
 [test_gsp-standards.html]
 [test_history_document_open.html]
+[test_history_state_null.html]
 [test_innersize_scrollport.html]
 [test_messageChannel.html]
 [test_messageChannel_cloning.html]
diff --git a/dom/base/test/test_history_state_null.html b/dom/base/test/test_history_state_null.html
new file mode 100644
index 000000000000..9e53de749587
--- /dev/null
+++ b/dom/base/test/test_history_state_null.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=949471
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 949471</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+  /** Test for Bug 949471 **/
+    ise(history.state, null, "history.state should be null by default");
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=949471">Mozilla Bug 949471</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/dom/tests/mochitest/whatwg/test_bug500328.html b/dom/tests/mochitest/whatwg/test_bug500328.html
index a7dbefb4ad61..bbfb5cf666e0 100644
--- a/dom/tests/mochitest/whatwg/test_bug500328.html
+++ b/dom/tests/mochitest/whatwg/test_bug500328.html
@@ -278,18 +278,18 @@ function runTest() {
 
   iframeCw.history.back();
   popstateExpected("Going back to page 0 should trigger a popstate.");
-  is(gLastPopStateEvent.state, null,
+  ise(gLastPopStateEvent.state, null,
       "Going back to page 0 should pop a null state.");
-  is(iframeCw.history.state, null,
+  ise(iframeCw.history.state, null,
       "Going back to page 0 should pop a null state.");
-  is(iframeCw.location.search, "",
+  ise(iframeCw.location.search, "",
       "Going back to page 0 should clear the querystring.");
 
   iframeCw.history.forward();
   popstateExpected("Going forward to page 1 should trigger a popstate.");
   is(JSON.stringify(gLastPopStateEvent.state), JSON.stringify(testObj1),
       "Wrong state object popped after going forward to page 1.");
-  ok(gLastPopStateEvent.state === iframeCw.history.state,
+  ise(gLastPopStateEvent.state, iframeCw.history.state,
       "Wrong state object in document after going forward to page 1.");
   ok(iframeCw.location.toString().match(/file_bug500328_1.html$/),
       "Going forward to page 1 should leave us at original page.");
@@ -300,7 +300,7 @@ function runTest() {
   popstateExpected("Going forward to page 2 should trigger a popstate.");
   is(JSON.stringify(gLastPopStateEvent.state), JSON.stringify(testObj2),
      "Wrong state object popped after going forward to page 2.");
-  ok(iframeCw.history.state === gLastPopStateEvent.state,
+  ise(iframeCw.history.state, gLastPopStateEvent.state,
      "Wrong state object in document after going forward to page 2.");
   ok(iframeCw.location.toString().match(/file_bug500328_1.html\?test1#foo$/),
      "Going forward to page 2 took us to " + iframeCw.location.toString());
@@ -329,7 +329,7 @@ function runTest() {
       "search should be ?test1 after clicking link.");
   is(iframeCw.location.hash, "#1",
       "hash should be #1 after clicking link.");
-  ok(iframeCw.history.state === null,
+  ise(iframeCw.history.state, null,
      "Wrong state object in document after clicking link to hash '#1'.");
 
   /*

From 572e483ff0acd954d6e0c10cc081041c5a0bec85 Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Thu, 12 Dec 2013 16:17:35 -0500
Subject: [PATCH 054/459] Bug 942164 - Refcount imgRequest consumers. r=seth

---
 image/src/imgRequest.cpp       |  2 +-
 image/src/imgStatusTracker.cpp | 24 ++++++++++++------------
 image/src/imgStatusTracker.h   |  6 +++---
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp
index 67529d330fd1..b570496f0197 100644
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -637,7 +637,7 @@ NS_IMETHODIMP imgRequest::OnStartRequest(nsIRequest *aRequest, nsISupports *ctxt
     PR_LOG(GetImgLog(), PR_LOG_WARNING,
            ("[this=%p] imgRequest::OnStartRequest -- "
             "RetargetDeliveryTo rv %d=%s\n",
-            this, NS_SUCCEEDED(rv) ? "succeeded" : "failed", rv));
+            this, rv, NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
   }
 
   return NS_OK;
diff --git a/image/src/imgStatusTracker.cpp b/image/src/imgStatusTracker.cpp
index b4fd8147d976..3fb2640c9c50 100644
--- a/image/src/imgStatusTracker.cpp
+++ b/image/src/imgStatusTracker.cpp
@@ -357,7 +357,7 @@ imgStatusTracker::NotifyCurrentState(imgRequestProxy* proxy)
 
 #define NOTIFY_IMAGE_OBSERVERS(func) \
   do { \
-    nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(proxies); \
+    nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(proxies); \
     while (iter.HasMore()) { \
       nsRefPtr<imgRequestProxy> proxy = iter.GetNext(); \
       if (!proxy->NotificationsDeferred()) { \
@@ -367,7 +367,7 @@ imgStatusTracker::NotifyCurrentState(imgRequestProxy* proxy)
   } while (false);
 
 /* static */ void
-imgStatusTracker::SyncNotifyState(nsTObserverArray<imgRequestProxy*>& proxies,
+imgStatusTracker::SyncNotifyState(nsTObserverArray<nsRefPtr<imgRequestProxy> >& proxies,
                                   bool hasImage, uint32_t state,
                                   nsIntRect& dirtyRect, bool hadLastPart)
 {
@@ -505,7 +505,7 @@ imgStatusTracker::SyncNotifyDifference(const ImageStatusDiff& diff)
   mInvalidRect.SetEmpty();
 
   if (diff.unblockedOnload) {
-    nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+    nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
     while (iter.HasMore()) {
       // Hold on to a reference to this proxy, since notifying the state can
       // cause it to disappear.
@@ -550,7 +550,7 @@ imgStatusTracker::SyncNotify(imgRequestProxy* proxy)
     r = mImage->FrameRect(imgIContainer::FRAME_CURRENT);
   }
 
-  nsTObserverArray<imgRequestProxy*> array;
+  nsTObserverArray<nsRefPtr<imgRequestProxy> > array;
   array.AppendElement(proxy);
   SyncNotifyState(array, !!mImage, mState, r, mHadLastPart);
 }
@@ -781,7 +781,7 @@ imgStatusTracker::OnUnlockedDraw()
 {
   MOZ_ASSERT(NS_IsMainThread());
   RecordUnlockedDraw();
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendUnlockedDraw(iter.GetNext());
   }
@@ -838,7 +838,7 @@ imgStatusTracker::OnStartRequest()
 {
   MOZ_ASSERT(NS_IsMainThread());
   RecordStartRequest();
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendStartRequest(iter.GetNext());
   }
@@ -909,7 +909,7 @@ imgStatusTracker::OnStopRequest(bool aLastPart,
 
   RecordStopRequest(aLastPart, aStatus);
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator srIter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator srIter(mConsumers);
   while (srIter.HasMore()) {
     SendStopRequest(srIter.GetNext(), aLastPart, aStatus);
   }
@@ -926,7 +926,7 @@ imgStatusTracker::OnDiscard()
   RecordDiscard();
 
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendDiscard(iter.GetNext());
   }
@@ -939,7 +939,7 @@ imgStatusTracker::FrameChanged(const nsIntRect* aDirtyRect)
   RecordFrameChanged(aDirtyRect);
 
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendFrameChanged(iter.GetNext(), aDirtyRect);
   }
@@ -952,7 +952,7 @@ imgStatusTracker::OnStopFrame()
   RecordStopFrame();
 
   /* notify the kids */
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendStopFrame(iter.GetNext());
   }
@@ -970,7 +970,7 @@ imgStatusTracker::OnDataAvailable()
     return;
   }
   // Notify any imgRequestProxys that are observing us that we have an Image.
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     iter.GetNext()->SetHasImage();
   }
@@ -1021,7 +1021,7 @@ imgStatusTracker::MaybeUnblockOnload()
 
   RecordUnblockOnload();
 
-  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
+  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendUnblockOnload(iter.GetNext());
   }
diff --git a/image/src/imgStatusTracker.h b/image/src/imgStatusTracker.h
index d70fdbef97d8..6ca06c95c062 100644
--- a/image/src/imgStatusTracker.h
+++ b/image/src/imgStatusTracker.h
@@ -9,7 +9,6 @@
 
 class imgDecoderObserver;
 class imgIContainer;
-class imgRequestProxy;
 class imgStatusNotifyRunnable;
 class imgRequestNotifyRunnable;
 class imgStatusTrackerObserver;
@@ -21,6 +20,7 @@ class nsIRunnable;
 #include "nsTObserverArray.h"
 #include "nsThreadUtils.h"
 #include "nsRect.h"
+#include "imgRequestProxy.h"
 
 namespace mozilla {
 namespace image {
@@ -306,7 +306,7 @@ private:
 
   // Main thread only, since imgRequestProxy calls are expected on the main
   // thread, and mConsumers is not threadsafe.
-  static void SyncNotifyState(nsTObserverArray<imgRequestProxy*>& proxies,
+  static void SyncNotifyState(nsTObserverArray<nsRefPtr<imgRequestProxy> >& proxies,
                               bool hasImage, uint32_t state,
                               nsIntRect& dirtyRect, bool hadLastPart);
 
@@ -322,7 +322,7 @@ private:
   // List of proxies attached to the image. Each proxy represents a consumer
   // using the image. Array and/or individual elements should only be accessed
   // on the main thread.
-  nsTObserverArray<imgRequestProxy*> mConsumers;
+  nsTObserverArray<nsRefPtr<imgRequestProxy> > mConsumers;
 
   mozilla::RefPtr<imgDecoderObserver> mTrackerObserver;
 

From 8368a30b640bab1af2a5ba092e3b5f65dbf32c3b Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Thu, 12 Dec 2013 13:21:38 -0800
Subject: [PATCH 055/459] Backed out changeset a9654d11cb26 (bug 948757) for
 m-bc bustage

---
 netwerk/base/public/nsISpeculativeConnect.idl | 9 ++++++++-
 netwerk/base/src/Seer.cpp                     | 9 ++++++++-
 netwerk/protocol/http/nsHttpConnectionMgr.cpp | 6 +++++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/netwerk/base/public/nsISpeculativeConnect.idl b/netwerk/base/public/nsISpeculativeConnect.idl
index 7d436519b7e7..f4bcd3cf4039 100644
--- a/netwerk/base/public/nsISpeculativeConnect.idl
+++ b/netwerk/base/public/nsISpeculativeConnect.idl
@@ -35,7 +35,7 @@ interface nsISpeculativeConnect : nsISupports
  * inline) to determine whether or not to actually make a speculative
  * connection.
  */
-[builtinclass, uuid(f5f70897-2edf-4c00-a1c3-87d51b92cec5)]
+[builtinclass, uuid(2b6d6fb6-ab28-4f4c-af84-bfdbb7866d72)]
 interface nsISpeculativeConnectionOverrider : nsISupports
 {
     /**
@@ -50,4 +50,11 @@ interface nsISpeculativeConnectionOverrider : nsISupports
      * connect via SPDY or not.
      */
     [infallible] readonly attribute boolean ignorePossibleSpdyConnections;
+
+    /**
+     * Used to determine if we will ignore the existence of any currently idle
+     * connections when we decide whether or not to make a speculative
+     * connection.
+     */
+    [infallible] readonly attribute boolean ignoreIdle;
 };
diff --git a/netwerk/base/src/Seer.cpp b/netwerk/base/src/Seer.cpp
index 85f0fbcdee85..f024345f1831 100644
--- a/netwerk/base/src/Seer.cpp
+++ b/netwerk/base/src/Seer.cpp
@@ -305,6 +305,13 @@ Seer::Observe(nsISupports *subject, const char *topic,
 
 // Seer::nsISpeculativeConnectionOverrider
 
+NS_IMETHODIMP
+Seer::GetIgnoreIdle(bool *ignoreIdle)
+{
+  *ignoreIdle = true;
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 Seer::GetIgnorePossibleSpdyConnections(bool *ignorePossibleSpdyConnections)
 {
@@ -896,7 +903,7 @@ Seer::PredictForLink(nsIURI *targetURI, nsIURI *sourceURI,
     }
   }
 
-  mSpeculativeService->SpeculativeConnect(targetURI, nullptr);
+  mSpeculativeService->SpeculativeConnect(targetURI, this);
   if (verifier) {
     verifier->OnPredictPreconnect(targetURI);
   }
diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
index 529702bf92d8..05cd4c8ee39e 100644
--- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
@@ -334,6 +334,7 @@ public: // intentional!
 
     bool mOverridesOK;
     uint32_t mParallelSpeculativeConnectLimit;
+    bool mIgnoreIdle;
     bool mIgnorePossibleSpdyConnections;
 
     // As above, added manually so we can use nsRefPtr without inheriting from
@@ -380,6 +381,7 @@ nsHttpConnectionMgr::SpeculativeConnect(nsHttpConnectionInfo *ci,
         args->mOverridesOK = true;
         overrider->GetParallelSpeculativeConnectLimit(
             &args->mParallelSpeculativeConnectLimit);
+        overrider->GetIgnoreIdle(&args->mIgnoreIdle);
         overrider->GetIgnorePossibleSpdyConnections(
             &args->mIgnorePossibleSpdyConnections);
     }
@@ -2588,14 +2590,16 @@ nsHttpConnectionMgr::OnMsgSpeculativeConnect(int32_t, void *param)
     uint32_t parallelSpeculativeConnectLimit =
         gHttpHandler->ParallelSpeculativeConnectLimit();
     bool ignorePossibleSpdyConnections = false;
+    bool ignoreIdle = false;
 
     if (args->mOverridesOK) {
         parallelSpeculativeConnectLimit = args->mParallelSpeculativeConnectLimit;
         ignorePossibleSpdyConnections = args->mIgnorePossibleSpdyConnections;
+        ignoreIdle = args->mIgnoreIdle;
     }
 
     if (mNumHalfOpenConns < parallelSpeculativeConnectLimit &&
-        ent->mIdleConns.Length() < parallelSpeculativeConnectLimit &&
+        (ignoreIdle || !ent->mIdleConns.Length()) &&
         !RestrictConnections(ent, ignorePossibleSpdyConnections) &&
         !AtActiveConnectionLimit(ent, args->mTrans->Caps())) {
         CreateTransport(ent, args->mTrans, args->mTrans->Caps(), true);

From 07d5ad43a7b49929eaa1ff5c3ecd4a3fef601ca2 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Thu, 12 Dec 2013 13:25:52 -0800
Subject: [PATCH 056/459] Bug 946835 part 1: Add reftest to test all the
 possible values of the "flex-flow" shorthand. r=mats

---
 .../flexbox/flexbox-flex-flow-1-ref.html      | 127 ++++++++++++++++++
 .../flexbox/flexbox-flex-flow-1.html          | 120 +++++++++++++++++
 .../w3c-css/submitted/flexbox/reftest.list    |   3 +
 3 files changed, 250 insertions(+)
 create mode 100644 layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1-ref.html
 create mode 100644 layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1.html

diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1-ref.html b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1-ref.html
new file mode 100644
index 000000000000..f46e11b39af2
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1-ref.html
@@ -0,0 +1,127 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      height: 60px;
+      width: 60px;
+      font: 10px sans-serif;
+      background: yellow;
+      float: left;
+      border: 1px solid black;
+    }
+    .flexContainer > * {
+      border: 1px dotted gray;
+      width: 28px;
+      height: 28px;
+      float: left;
+    }
+
+    /* The single-line flex containers' flex items are shrunk in main axis: */
+    .singleLineHoriz > * {
+      width: 13px;
+    }
+    .singleLineVert  > * {
+      height: 13px;
+      float: none;
+    }
+  </style>
+</head>
+<body>
+  <!-- single-line (flex-wrap unspecified): -->
+  <div class="flexContainer singleLineHoriz"><!-- flex-flow: row -->
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer singleLineHoriz"><!-- flex-flow: row-reverse -->
+    <div>4</div><div>3</div><div>2</div><div>1</div>
+  </div>
+  <div class="flexContainer singleLineVert"><!-- flex-flow: column -->
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer singleLineVert"><!-- flex-flow: column-reverse -->
+    <div>4</div><div>3</div><div>2</div><div>1</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", after flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: row wrap -->
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: row-reverse wrap -->
+    <div>2</div><div>1</div><div>4</div><div>3</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column wrap -->
+    <div>1</div><div>3</div><div>2</div><div>4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column-reverse wrap -->
+    <div>2</div><div>4</div><div>1</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", before flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: wrap row -->
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap row-reverse -->
+    <div>2</div><div>1</div><div>4</div><div>3</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap column -->
+    <div>1</div><div>3</div><div>2</div><div>4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap column-reverse -->
+    <div>2</div><div>4</div><div>1</div><div>3</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", after flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: row wrap-reverse -->
+    <div>3</div><div>4</div><div>1</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: row-reverse wrap-reverse -->
+    <div>4</div><div>3</div><div>2</div><div>1</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column wrap-reverse -->
+    <div>3</div><div>1</div><div>4</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: column-reverse wrap-reverse -->
+    <div>4</div><div>2</div><div>3</div><div>1</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", before flex-direction: -->
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse row -->
+    <div>3</div><div>4</div><div>1</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse row-reverse -->
+    <div>4</div><div>3</div><div>2</div><div>1</div>
+  </div>
+  <div class="flexContainer"> <!-- flex-flow: wrap-reverse column -->
+    <div>3</div><div>1</div><div>4</div><div>2</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse column-reverse -->
+    <div>4</div><div>2</div><div>3</div><div>1</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now just specifying flex-wrap (no flex-direction) -->
+  <div class="flexContainer"><!-- flex-flow: wrap -->
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer"><!-- flex-flow: wrap-reverse -->
+    <div>3</div><div>4</div><div>1</div><div>2</div>
+  </div>
+
+</body>
+</html>
diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1.html b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1.html
new file mode 100644
index 000000000000..f7814d3fd984
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-flex-flow-1.html
@@ -0,0 +1,120 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Test: Testing all the values of the "flex-flow" shorthand property</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#flex-flow-property">
+  <link rel="match" href="flexbox-flex-flow-1-ref.html">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      display: flex;
+      height: 60px;
+      width: 60px;
+      font: 10px sans-serif;
+      background: yellow;
+      float: left;
+      border: 1px solid black;
+    }
+    .flexContainer > * {
+      border: 1px dotted gray;
+      width: 28px;
+      height: 28px;
+    }
+  </style>
+</head>
+<body>
+  <!-- single-line (flex-wrap unspecified): -->
+  <div class="flexContainer" style="flex-flow: row">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: row-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", after flex-direction: -->
+  <div class="flexContainer" style="flex-flow: row wrap">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: row-reverse wrap">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column wrap">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column-reverse wrap">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap", before flex-direction: -->
+  <div class="flexContainer" style="flex-flow: wrap row">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap row-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap column">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap column-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", after flex-direction: -->
+  <div class="flexContainer" style="flex-flow: row wrap-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: row-reverse wrap-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column wrap-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: column-reverse wrap-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now using "wrap-reverse", before flex-direction: -->
+  <div class="flexContainer" style="flex-flow: wrap-reverse row">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse row-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse column">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse column-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+
+  <div style="clear:both"></div>
+
+  <!-- now just specifying flex-wrap (no flex-direction) -->
+  <div class="flexContainer" style="flex-flow: wrap">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+  <div class="flexContainer" style="flex-flow: wrap-reverse">
+    <div>1</div><div>2</div><div>3</div><div>4</div>
+  </div>
+
+</body>
+</html>
diff --git a/layout/reftests/w3c-css/submitted/flexbox/reftest.list b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
index 72ca7f89ca79..f5d030c89c6e 100644
--- a/layout/reftests/w3c-css/submitted/flexbox/reftest.list
+++ b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
@@ -64,6 +64,9 @@ fuzzy-if(Android,158,32) == flexbox-align-self-vert-rtl-1.xhtml  flexbox-align-s
 == flexbox-break-request-vert-2a.html  flexbox-break-request-vert-2-ref.html
 == flexbox-break-request-vert-2b.html  flexbox-break-request-vert-2-ref.html
 
+# Tests for flex-flow shorthand property
+== flexbox-flex-flow-1.html flexbox-flex-flow-1-ref.html
+
 # Tests for flex-wrap property
 == flexbox-flex-wrap-horiz-1.html flexbox-flex-wrap-horiz-1-ref.html
 == flexbox-flex-wrap-horiz-2.html flexbox-flex-wrap-horiz-2-ref.html

From d75a744000ee902daa106bc7999e48c0e7fd80bc Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Thu, 12 Dec 2013 13:25:53 -0800
Subject: [PATCH 057/459] Bug 946835 part 2: Add reftest for baseline alignment
 in multiple lines in a 'flex-wrap:wrap" flex container. r=mats

--HG--
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1-ref.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml
---
 ...xbox-align-self-baseline-horiz-2-ref.xhtml | 56 +++++++++++++++++++
 .../flexbox-align-self-baseline-horiz-2.xhtml | 56 +++++++++++++++++++
 .../w3c-css/submitted/flexbox/reftest.list    |  3 +-
 3 files changed, 114 insertions(+), 1 deletion(-)
 create mode 100644 layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml
 create mode 100644 layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml

diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml
new file mode 100644
index 000000000000..73a31237552c
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Reference case for behavior of the 'baseline' value for align-items and
+     align-self, in a multi-line flex container.
+
+     This reference case just consists of three single-line flex containers,
+     to match the testcase's one flex container with three flex lines.
+-->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <style>
+      .flexbox {
+        display: flex;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px;
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+    </div>
+    <div class="flexbox">
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+    </div>
+    <div class="flexbox">
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml
new file mode 100644
index 000000000000..204b57cafa5b
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Testcase for behavior of the 'baseline' value for align-items (and
+     align-self, implicitly), in a multi-line flex container.
+     This test baseline-aligns variously-sized flex items, and the container's
+     vertical size depends on the aggregate post-alignment height of its items.
+  -->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="match" href="flexbox-align-self-baseline-horiz-2-ref.xhtml"/>
+    <style>
+      .flexbox {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px; /* 3 items per Flex Line */
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/w3c-css/submitted/flexbox/reftest.list b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
index f5d030c89c6e..c13a8bb08a89 100644
--- a/layout/reftests/w3c-css/submitted/flexbox/reftest.list
+++ b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
@@ -5,7 +5,8 @@
 == flexbox-align-content-vert-1b.xhtml  flexbox-align-content-vert-1-ref.xhtml
 
 # Tests for cross-axis alignment (align-self / align-items properties)
-== flexbox-align-self-baseline-horiz-1.xhtml  flexbox-align-self-baseline-horiz-1-ref.xhtml
+== flexbox-align-self-baseline-horiz-1.xhtml flexbox-align-self-baseline-horiz-1-ref.xhtml
+== flexbox-align-self-baseline-horiz-2.xhtml flexbox-align-self-baseline-horiz-2-ref.xhtml
 
 == flexbox-align-self-stretch-vert-1.html flexbox-align-self-stretch-vert-1-ref.html
 

From 53f5416ef289cde6fab5470eee48b145e77ddd95 Mon Sep 17 00:00:00 2001
From: Daniel Holbert <dholbert@cs.stanford.edu>
Date: Thu, 12 Dec 2013 13:25:55 -0800
Subject: [PATCH 058/459] Bug 946835 part 3: Add reftest for baseline alignment
 in multiple lines in a 'flex-wrap:wrap-reverse" flex container. r=mats

--HG--
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2-ref.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-2.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml
---
 ...xbox-align-self-baseline-horiz-3-ref.xhtml | 58 +++++++++++++++++++
 .../flexbox-align-self-baseline-horiz-3.xhtml | 56 ++++++++++++++++++
 .../w3c-css/submitted/flexbox/reftest.list    |  1 +
 3 files changed, 115 insertions(+)
 create mode 100644 layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml
 create mode 100644 layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml

diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml
new file mode 100644
index 000000000000..e8b2791f44d4
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Reference case for behavior of the 'baseline' value for align-items and
+     align-self, in a multi-line flex container.
+
+     This reference case just consists of three single-line flex containers,
+     to match the testcase's one flex container with three flex lines.
+-->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <style>
+      .flexbox {
+        display: flex;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px;
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <!-- Note: The lines are reversed here with respect to the testcase,
+         due to the testcase's "wrap-reverse". -->
+    <div class="flexbox">
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+    <div class="flexbox">
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+    </div>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml
new file mode 100644
index 000000000000..24f300f9c181
--- /dev/null
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!-- Testcase for behavior of the 'baseline' value for align-items (and
+     align-self, implicitly), in a wrap-reverse multi-line flex container.
+     This test baseline-aligns variously-sized flex items, and the container's
+     vertical size depends on the aggregate post-alignment height of its items.
+  -->
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>CSS Test: Baseline alignment of block flex items with 'baseline' value for 'align-items' / 'align-self' in a multi-line flex container</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com"/>
+    <link rel="help" href="http://www.w3.org/TR/css3-flexbox/#baseline-participation"/>
+    <link rel="match" href="flexbox-align-self-baseline-horiz-3-ref.xhtml"/>
+    <style>
+      .flexbox {
+        display: flex;
+        flex-wrap: wrap-reverse;
+        align-items: baseline;
+        width: 90px;
+      }
+
+      .flexbox > * {
+        width: 28px; /* 3 items per Flex Line */
+        background: yellow;
+        border: 1px solid black;
+      }
+
+      .big    { font: 24px sans-serif; }
+      .medium { font: 14px sans-serif; }
+      .small  { font: 8px sans-serif;  }
+
+   </style>
+  </head>
+  <body>
+    <div class="flexbox">
+      <!-- First flex line: Just 3 different sizes of text -->
+      <div class="big">a</div>
+      <div class="small">b</div>
+      <div class="medium">c</div>
+
+      <!-- Second flex line: different margin/padding amounts on each item,
+           and one non-baseline-aligned item.-->
+      <div class="medium" style="padding-top: 10px">d</div>
+      <div class="medium" style="margin-bottom: 8px">e</div>
+      <div class="medium" style="align-self: stretch">f</div>
+
+      <!-- Third flex line: other margin/padding amounts on each item -->
+      <div class="small" style="margin-top: 20px">g</div>
+      <div class="big">h</div>
+      <div class="medium" style="padding-bottom: 6px">i</div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/w3c-css/submitted/flexbox/reftest.list b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
index c13a8bb08a89..bd89be0f7662 100644
--- a/layout/reftests/w3c-css/submitted/flexbox/reftest.list
+++ b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
@@ -7,6 +7,7 @@
 # Tests for cross-axis alignment (align-self / align-items properties)
 == flexbox-align-self-baseline-horiz-1.xhtml flexbox-align-self-baseline-horiz-1-ref.xhtml
 == flexbox-align-self-baseline-horiz-2.xhtml flexbox-align-self-baseline-horiz-2-ref.xhtml
+== flexbox-align-self-baseline-horiz-3.xhtml flexbox-align-self-baseline-horiz-3-ref.xhtml
 
 == flexbox-align-self-stretch-vert-1.html flexbox-align-self-stretch-vert-1-ref.html
 

From 14d4d00983978f250477e2922d86c5ee8a9097d1 Mon Sep 17 00:00:00 2001
From: Ethan Hugg <ethanhugg@gmail.com>
Date: Fri, 30 Aug 2013 12:51:05 -0700
Subject: [PATCH 059/459] Bug 901560 - Datachannel no longer make second ICE
 component r=abr

---
 .../nICEr/src/ice/ice_media_stream.c          |  3 +-
 .../signaling/src/sipcc/core/gsm/gsm_sdp.c    | 54 +++----------------
 2 files changed, 9 insertions(+), 48 deletions(-)

diff --git a/media/mtransport/third_party/nICEr/src/ice/ice_media_stream.c b/media/mtransport/third_party/nICEr/src/ice/ice_media_stream.c
index df56d964d63e..92aaf1d16cbc 100644
--- a/media/mtransport/third_party/nICEr/src/ice/ice_media_stream.c
+++ b/media/mtransport/third_party/nICEr/src/ice/ice_media_stream.c
@@ -846,7 +846,8 @@ int nr_ice_media_stream_disable_component(nr_ice_media_stream *stream, int compo
       ABORT(r);
 
     /* Can only disable before pairing */
-    if (comp->state != NR_ICE_COMPONENT_UNPAIRED)
+    if (comp->state != NR_ICE_COMPONENT_UNPAIRED &&
+        comp->state != NR_ICE_COMPONENT_DISABLED)
       ABORT(R_FAILED);
 
     comp->state = NR_ICE_COMPONENT_DISABLED;
diff --git a/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c b/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
index 57cca165a2e3..daae2e6a3084 100644
--- a/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
+++ b/media/webrtc/signaling/src/sipcc/core/gsm/gsm_sdp.c
@@ -4,8 +4,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include <errno.h>
-
 #include "cpr_in.h"
 #include "cpr_rand.h"
 #include "cpr_stdlib.h"
@@ -103,38 +101,6 @@ extern cc_media_cap_table_t g_media_table;
 
 extern boolean g_disable_mass_reg_debug_print;
 
-/*
- * gsmsdp_requires_two_dc_components
- *
- * returns TRUE if we are talking to Firefox and it's
- * a version that required two components for datachannel.
- */
-static boolean gsmsdp_requires_two_dc_components(void *sdp) {
-#define FIRST_VERSION_TO_USE_ONE_DC_COMPONENT 26
-    const char *owner_name = sdp_get_owner_username(sdp);
-    unsigned long remote_version;
-    char* strtoul_end;
-
-    if (strncmp(owner_name, SIPSDP_ORIGIN_APPNAME,
-        strlen(SIPSDP_ORIGIN_APPNAME)) == 0) {
-        /* This means we are talking to firefox, now read the major version */
-        errno = 0;
-        remote_version = strtoul(owner_name + strlen(SIPSDP_ORIGIN_APPNAME),
-            &strtoul_end, 10);
-        if (errno ||
-            strtoul_end == (owner_name + strlen(SIPSDP_ORIGIN_APPNAME)) ||
-            !remote_version) {
-            /* Unable to parse remote, must not be earlier firefox */
-            return FALSE;
-        }
-
-        return (remote_version < FIRST_VERSION_TO_USE_ONE_DC_COMPONENT) ?
-            TRUE : FALSE;
-    }
-
-    return FALSE;
-}
-
 /**
  * A wraper function to return the media capability supported by
  * the platform and session. This is a convient place if policy
@@ -5731,6 +5697,13 @@ gsmsdp_create_local_sdp (fsmdef_dcb_t *dcb_p, boolean force_streams_enabled,
          */
         if (media_enabled && ( media_cap->enabled || force_streams_enabled)) {
             level = level + 1;  /* next level */
+
+            /* Only audio and video use two ICE components */
+            if (media_cap->type != SDP_MEDIA_AUDIO &&
+                media_cap->type != SDP_MEDIA_VIDEO) {
+                vcmDisableRtcpComponent(dcb_p->peerconnection, level);
+            }
+
             ip_mode = platform_get_ip_address_mode();
             if (ip_mode >= CPR_IP_MODE_IPV6) {
                 if (gsmsdp_add_media_line(dcb_p, media_cap, cap_index,
@@ -7019,19 +6992,6 @@ gsmsdp_install_peer_ice_attributes(fsm_fcb_t *fcb_p)
         }
       }
 
-      /* If this is Datachannel and we are talking to anything other
-         than an older version of Firefox then disable the second component
-         of the ICE stream */
-      if (media->type == DATA &&
-          !gsmsdp_requires_two_dc_components(sdp_p->dest_sdp)) {
-        vcm_res = vcmDisableRtcpComponent(dcb_p->peerconnection,
-          media->level);
-
-        if (vcm_res) {
-          return CC_CAUSE_SETTING_ICE_SESSION_PARAMETERS_FAILED;
-        }
-      }
-
       sdp_res = sdp_attr_get_ice_attribute(sdp_p->dest_sdp, media->level, 0,
         SDP_ATTR_ICE_UFRAG, 1, &ufrag);
       if (sdp_res != SDP_SUCCESS)

From b85bf618cb9026f24a92a904e814b0e99149d9a1 Mon Sep 17 00:00:00 2001
From: Brandon Benvie <bbenvie@mozilla.com>
Date: Fri, 13 Dec 2013 11:11:20 -0800
Subject: [PATCH 060/459] Bug 943681 - Convert to Promise.jsm in the
 webconsole. r=msucan

---
 browser/devtools/webconsole/hudservice.js     |  4 +--
 browser/devtools/webconsole/panel.js          |  2 +-
 ...r_webconsole_bug_613642_maintain_scroll.js | 36 +++++++------------
 browser/devtools/webconsole/test/head.js      |  2 +-
 browser/devtools/webconsole/webconsole.js     |  2 +-
 5 files changed, 17 insertions(+), 29 deletions(-)

diff --git a/browser/devtools/webconsole/hudservice.js b/browser/devtools/webconsole/hudservice.js
index caca70d3502b..fed0a290ab69 100644
--- a/browser/devtools/webconsole/hudservice.js
+++ b/browser/devtools/webconsole/hudservice.js
@@ -11,9 +11,9 @@ const {Cc, Ci, Cu} = require("chrome");
 let WebConsoleUtils = require("devtools/toolkit/webconsole/utils").Utils;
 let Heritage = require("sdk/core/heritage");
 
-loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
 loader.lazyGetter(this, "Telemetry", () => require("devtools/shared/telemetry"));
 loader.lazyGetter(this, "WebConsoleFrame", () => require("devtools/webconsole/webconsole").WebConsoleFrame);
+loader.lazyImporter(this, "promise", "resource://gre/modules/Promise.jsm", "Promise");
 loader.lazyImporter(this, "gDevTools", "resource:///modules/devtools/gDevTools.jsm");
 loader.lazyImporter(this, "devtools", "resource://gre/modules/devtools/Loader.jsm");
 loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
@@ -110,6 +110,7 @@ HUD_SERVICE.prototype =
   function HS_openBrowserConsole(aTarget, aIframeWindow, aChromeWindow)
   {
     let hud = new BrowserConsole(aTarget, aIframeWindow, aChromeWindow);
+    this._browserConsoleID = hud.hudId;
     this.consoles.set(hud.hudId, hud);
     return hud.init();
   },
@@ -259,7 +260,6 @@ HUD_SERVICE.prototype =
     connect().then(getTarget).then(openWindow).then((aWindow) => {
       this.openBrowserConsole(target, aWindow, aWindow)
         .then((aBrowserConsole) => {
-          this._browserConsoleID = aBrowserConsole.hudId;
           this._browserConsoleDefer.resolve(aBrowserConsole);
           this._browserConsoleDefer = null;
         })
diff --git a/browser/devtools/webconsole/panel.js b/browser/devtools/webconsole/panel.js
index 48a71f576ec5..466f84834dec 100644
--- a/browser/devtools/webconsole/panel.js
+++ b/browser/devtools/webconsole/panel.js
@@ -6,7 +6,7 @@
 
 const {Cc, Ci, Cu} = require("chrome");
 
-loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
+loader.lazyImporter(this, "promise", "resource://gre/modules/Promise.jsm", "Promise");
 loader.lazyGetter(this, "HUDService", () => require("devtools/webconsole/hudservice"));
 loader.lazyGetter(this, "EventEmitter", () => require("devtools/shared/event-emitter"));
 
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js b/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js
index 13f018556268..63da224c9a48 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js
@@ -95,37 +95,25 @@ function testGen() {
     testNext();
   };
   EventUtils.synthesizeKey("VK_END", {});
-  yield;
+  yield undefined;
 
   let oldScrollTop = scrollBox.scrollTop;
 
   content.console.log("test message 151");
 
-  waitForMessages({
-    webconsole: hud,
-    messages: [{
-      text: "test message 151",
-      category: CATEGORY_WEBDEV,
-      severity: SEVERITY_LOG,
-    }],
-  }).then(() => {
-    scrollBox.onscroll = () => {
-      if (scrollBox.scrollTop == oldScrollTop) {
-        // Wait for scroll to change.
-        return;
-      }
-      scrollBox.onscroll = null;
-      isnot(scrollBox.scrollTop, oldScrollTop, "scroll location updated (moved to bottom again)");
-      testNext();
-    };
-  });
+  scrollBox.onscroll = () => {
+    dump("\n\nSCROLLED\n\n");
+    if (scrollBox.scrollTop == oldScrollTop) {
+      // Wait for scroll to change.
+      return;
+    }
+    scrollBox.onscroll = null;
+    isnot(scrollBox.scrollTop, oldScrollTop, "scroll location updated (moved to bottom again)");
+    hud = testDriver = null;
+    finishTest();
+  };
 
   yield undefined;
-
-  hud = testDriver = null;
-  finishTest();
-  
-  yield undefined;
 }
 
 function test() {
diff --git a/browser/devtools/webconsole/test/head.js b/browser/devtools/webconsole/test/head.js
index c60e972e605a..744401b971de 100644
--- a/browser/devtools/webconsole/test/head.js
+++ b/browser/devtools/webconsole/test/head.js
@@ -8,7 +8,7 @@ let WebConsoleUtils, gDevTools, TargetFactory, console, promise, require;
 (() => {
   gDevTools = Cu.import("resource:///modules/devtools/gDevTools.jsm", {}).gDevTools;
   console = Cu.import("resource://gre/modules/devtools/Console.jsm", {}).console;
-  promise = Cu.import("resource://gre/modules/commonjs/sdk/core/promise.js", {}).Promise;
+  promise = Cu.import("resource://gre/modules/Promise.jsm", {}).Promise;
 
   let tools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
   let utils = tools.require("devtools/toolkit/webconsole/utils");
diff --git a/browser/devtools/webconsole/webconsole.js b/browser/devtools/webconsole/webconsole.js
index 5e477227fc98..46673010ec1e 100644
--- a/browser/devtools/webconsole/webconsole.js
+++ b/browser/devtools/webconsole/webconsole.js
@@ -14,7 +14,7 @@ loader.lazyServiceGetter(this, "clipboardHelper",
                          "@mozilla.org/widget/clipboardhelper;1",
                          "nsIClipboardHelper");
 loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
-loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
+loader.lazyImporter(this, "promise", "resource://gre/modules/Promise.jsm", "Promise");
 loader.lazyGetter(this, "EventEmitter", () => require("devtools/shared/event-emitter"));
 loader.lazyGetter(this, "AutocompletePopup",
                   () => require("devtools/shared/autocomplete-popup").AutocompletePopup);

From e7550d5c34b0960b0ab4a843f36b0725cb860a41 Mon Sep 17 00:00:00 2001
From: Sriram Ramasubramanian <sriram@mozilla.com>
Date: Thu, 26 Sep 2013 15:17:22 -0700
Subject: [PATCH 061/459] Bug 919777: Change the width to be fill_parent for
 titles in TwoLinePageRow. [r=lucasr]

---
 mobile/android/base/resources/layout/two_line_page_row.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/resources/layout/two_line_page_row.xml b/mobile/android/base/resources/layout/two_line_page_row.xml
index 65ec3844fd3b..94125a24e9cd 100644
--- a/mobile/android/base/resources/layout/two_line_page_row.xml
+++ b/mobile/android/base/resources/layout/two_line_page_row.xml
@@ -20,7 +20,7 @@
         <org.mozilla.gecko.home.FadedTextView
                 android:id="@+id/title"
                 style="@style/Widget.TwoLinePageRow.Title"
-                android:layout_width="wrap_content"
+                android:layout_width="fill_parent"
                 android:layout_height="wrap_content"
                 gecko:fadeWidth="30dp"/>
 

From 5f8f582d79bf37f0fe0de1fc28437452e3ec16b5 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 00:00:23 -0800
Subject: [PATCH 062/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/837a95ee7a5d
Author: Cristian Rodriguez <crdlc@tid.es>
Desc: Merge pull request #14565 from crdlc/bug-924843

Bug 924843 - Icons on grid do not re-arrange automatically when dragging...

========

https://hg.mozilla.org/integration/gaia-central/rev/18421b9ecd89
Author: crdlc <crdlc@tid.es>
Desc: Bug 924843 - Icons on grid do not re-arrange automatically when dragging over collections
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 073e1333333b..7a469a0bf06a 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "5bfef5faac50d14e055f642a44ed2df8483fb2fe", 
+    "revision": "837a95ee7a5d0745c91ab868a3a24a183cb30f60", 
     "repo_path": "/integration/gaia-central"
 }

From 6729764aed36ebe8e44a6e2a8f660213ccba5bd9 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 00:35:23 -0800
Subject: [PATCH 063/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/cfb69584f3b0
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Merge pull request #14224 from flodolo/separate_header

Bug 944749 - [Settings][l12y] Use different labels for menu items and headers, r=kaze

========

https://hg.mozilla.org/integration/gaia-central/rev/c62a6e4de4f7
Author: Francesco Lodolo (:flod) <flod@lodolo.net>
Desc: Bug 944749 - [Settings][l12y] Use different labels for menu items and headers

Don't reuse labels in different contexts (and with different space available).
Use fallback to original string for headers ({{id}}) to reduce impact on existing localizations.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 7a469a0bf06a..3b7f57518676 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "837a95ee7a5d0745c91ab868a3a24a183cb30f60", 
+    "revision": "cfb69584f3b0181f31248efa42040558a3639e27", 
     "repo_path": "/integration/gaia-central"
 }

From 9edf9eff133fd3f0b79c87f6e2e9a8e98250b695 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tdz@users.sourceforge.net>
Date: Thu, 12 Dec 2013 09:57:56 +0100
Subject: [PATCH 064/459] Bug 947905: Release OmxDecoder on main thread

OmxDecoder refers to MediaResource, which must be released on
the main thread. This patch changes the MP3 parser logic to send
a runnable to the main thread for releasing OmxDecoder.
---
 content/media/omx/OmxDecoder.cpp | 43 ++++++++++++++++++++++++++------
 content/media/omx/OmxDecoder.h   |  2 +-
 2 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/content/media/omx/OmxDecoder.cpp b/content/media/omx/OmxDecoder.cpp
index 5ce86774dcb9..1d53cde4f766 100644
--- a/content/media/omx/OmxDecoder.cpp
+++ b/content/media/omx/OmxDecoder.cpp
@@ -41,6 +41,25 @@ using namespace mozilla;
 
 namespace mozilla {
 
+class ReleaseOmxDecoderRunnable : public nsRunnable
+{
+public:
+  ReleaseOmxDecoderRunnable(const android::sp<android::OmxDecoder>& aOmxDecoder)
+  : mOmxDecoder(aOmxDecoder)
+  {
+  }
+
+  NS_METHOD Run() MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    mOmxDecoder = nullptr; // release OmxDecoder
+    return NS_OK;
+  }
+
+private:
+  android::sp<android::OmxDecoder> mOmxDecoder;
+};
+
 class OmxDecoderProcessCachedDataTask : public Task
 {
 public:
@@ -53,7 +72,13 @@ public:
   {
     MOZ_ASSERT(!NS_IsMainThread());
     MOZ_ASSERT(mOmxDecoder.get());
-    mOmxDecoder->ProcessCachedData(mOffset, false);
+    int64_t rem = mOmxDecoder->ProcessCachedData(mOffset, false);
+
+    if (rem <= 0) {
+      ReleaseOmxDecoderRunnable* r = new ReleaseOmxDecoderRunnable(mOmxDecoder);
+      mOmxDecoder.clear();
+      NS_DispatchToMainThread(r);
+    }
   }
 
 private:
@@ -292,6 +317,8 @@ OmxDecoder::OmxDecoder(MediaResource *aResource,
 
 OmxDecoder::~OmxDecoder()
 {
+  MOZ_ASSERT(NS_IsMainThread());
+
   ReleaseMediaResources();
 
   // unregister AMessage handler from ALooper.
@@ -398,7 +425,7 @@ bool OmxDecoder::TryLoad() {
       // Feed MP3 parser with cached data. Local files will be fully
       // cached already, network streams will update with sucessive
       // calls to NotifyDataArrived.
-      if (ProcessCachedData(0, true)) {
+      if (ProcessCachedData(0, true) >= 0) {
         durationUs = mMP3FrameParser.GetDuration();
         if (durationUs > totalDurationUs) {
           totalDurationUs = durationUs;
@@ -1017,7 +1044,7 @@ void OmxDecoder::ReleaseAllPendingVideoBuffersLocked()
   releasingVideoBuffers.clear();
 }
 
-bool OmxDecoder::ProcessCachedData(int64_t aOffset, bool aWaitForCompletion)
+int64_t OmxDecoder::ProcessCachedData(int64_t aOffset, bool aWaitForCompletion)
 {
   // We read data in chunks of 32 KiB. We can reduce this
   // value if media, such as sdcards, is too slow.
@@ -1030,10 +1057,10 @@ bool OmxDecoder::ProcessCachedData(int64_t aOffset, bool aWaitForCompletion)
   MOZ_ASSERT(mResource);
 
   int64_t resourceLength = mResource->GetCachedDataEnd(0);
-  NS_ENSURE_TRUE(resourceLength >= 0, false);
+  NS_ENSURE_TRUE(resourceLength >= 0, -1);
 
   if (aOffset >= resourceLength) {
-    return true; // Cache is empty, nothing to do
+    return 0; // Cache is empty, nothing to do
   }
 
   int64_t bufferLength = std::min<int64_t>(resourceLength-aOffset, sReadSize);
@@ -1041,7 +1068,7 @@ bool OmxDecoder::ProcessCachedData(int64_t aOffset, bool aWaitForCompletion)
   nsAutoArrayPtr<char> buffer(new char[bufferLength]);
 
   nsresult rv = mResource->ReadFromCache(buffer.get(), aOffset, bufferLength);
-  NS_ENSURE_SUCCESS(rv, false);
+  NS_ENSURE_SUCCESS(rv, -1);
 
   nsRefPtr<OmxDecoderNotifyDataArrivedRunnable> runnable(
     new OmxDecoderNotifyDataArrivedRunnable(this,
@@ -1051,11 +1078,11 @@ bool OmxDecoder::ProcessCachedData(int64_t aOffset, bool aWaitForCompletion)
                                             resourceLength));
 
   rv = NS_DispatchToMainThread(runnable.get());
-  NS_ENSURE_SUCCESS(rv, false);
+  NS_ENSURE_SUCCESS(rv, -1);
 
   if (aWaitForCompletion) {
     runnable->WaitForCompletion();
   }
 
-  return true;
+  return resourceLength - aOffset - bufferLength;
 }
diff --git a/content/media/omx/OmxDecoder.h b/content/media/omx/OmxDecoder.h
index b0e7ce3b91cb..96b55c068cd9 100644
--- a/content/media/omx/OmxDecoder.h
+++ b/content/media/omx/OmxDecoder.h
@@ -238,7 +238,7 @@ public:
   // Called on ALooper thread.
   void onMessageReceived(const sp<AMessage> &msg);
 
-  bool ProcessCachedData(int64_t aOffset, bool aWaitForCompletion);
+  int64_t ProcessCachedData(int64_t aOffset, bool aWaitForCompletion);
 };
 
 }

From 9e5ce04585a5f3ae229f4f7280ee26a2240d02a6 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 01:25:24 -0800
Subject: [PATCH 065/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/041a8edf5c4a
Author: Amir Nissim <amirnissim@gmail.com>
Desc: Merge pull request #14405 from EverythingMe/946176-collection-tap

Bug 946176 - [e.me][Bug] Collections Tapping issues [r=evyatar]

========

https://hg.mozilla.org/integration/gaia-central/rev/386b3376c582
Author: Ran Ben Aharon <ran@ranbena.com>
Desc: Bug 946176 - [e.me][Bug] Collections Tapping issues [r=evyatar]
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 3b7f57518676..79d09453ff37 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "cfb69584f3b0181f31248efa42040558a3639e27", 
+    "revision": "041a8edf5c4a212d8d19dc367a5dddddd0c76321", 
     "repo_path": "/integration/gaia-central"
 }

From f20d4af27024f3914fc24b3cb141c240386689be Mon Sep 17 00:00:00 2001
From: Vivien Nicolas <21@vingtetun.org>
Date: Thu, 12 Dec 2013 11:41:47 +0100
Subject: [PATCH 066/459] Bug 946999 - [Homescreen] With APZ turned on the
 homescreen is not rendered until you touch the screen in certain conditions.
 r=kats

---
 gfx/layers/ipc/AsyncPanZoomController.cpp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index 14c16ffc77b9..a1a034ffa564 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -1276,7 +1276,9 @@ void AsyncPanZoomController::RequestContentRepaint() {
             mFrameMetrics.mScrollOffset.x) < EPSILON &&
       fabsf(mLastPaintRequestMetrics.mScrollOffset.y -
             mFrameMetrics.mScrollOffset.y) < EPSILON &&
-      mFrameMetrics.mZoom == mLastPaintRequestMetrics.mZoom) {
+      mFrameMetrics.mZoom == mLastPaintRequestMetrics.mZoom &&
+      fabsf(mFrameMetrics.mViewport.width - mLastPaintRequestMetrics.mViewport.width) < EPSILON &&
+      fabsf(mFrameMetrics.mViewport.height - mLastPaintRequestMetrics.mViewport.height) < EPSILON) {
     return;
   }
 
@@ -1463,8 +1465,10 @@ void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aLayerMetri
       aLayerMetrics.mCompositionBounds.height == mFrameMetrics.mCompositionBounds.height) {
     // Remote content has sync'd up to the composition geometry
     // change, so we can accept the viewport it's calculated.
-    if (mFrameMetrics.mViewport.width != aLayerMetrics.mViewport.width)
+    if (mFrameMetrics.mViewport.width != aLayerMetrics.mViewport.width ||
+        mFrameMetrics.mViewport.height != aLayerMetrics.mViewport.height) {
       needContentRepaint = true;
+    }
     mFrameMetrics.mViewport = aLayerMetrics.mViewport;
   }
 

From cdaec2a0c8c4afaa5e9173e9ed6349d6cc13faa1 Mon Sep 17 00:00:00 2001
From: Vivien Nicolas <21@vingtetun.org>
Date: Thu, 12 Dec 2013 11:43:45 +0100
Subject: [PATCH 067/459] Bug 946339 - Tap and hold does not highlight the
 targeted element. r=fabrice

---
 dom/browser-element/BrowserElementPanning.js | 64 ++++++++++----------
 1 file changed, 33 insertions(+), 31 deletions(-)

diff --git a/dom/browser-element/BrowserElementPanning.js b/dom/browser-element/BrowserElementPanning.js
index af22e553e5f7..e2a4b58eb683 100644
--- a/dom/browser-element/BrowserElementPanning.js
+++ b/dom/browser-element/BrowserElementPanning.js
@@ -45,21 +45,16 @@ const ContentPanning = {
       this.watchedEventsType = 'mouse';
     }
 
-    // If we are using an AsyncPanZoomController for the parent frame,
-    // it will handle subframe scrolling too. We don't need to listen for
-    // these events.
-    if (!docShell.asyncPanZoomEnabled) {
-      let els = Cc["@mozilla.org/eventlistenerservice;1"]
-                  .getService(Ci.nsIEventListenerService);
+    let els = Cc["@mozilla.org/eventlistenerservice;1"]
+                .getService(Ci.nsIEventListenerService);
 
-      events.forEach(function(type) {
-        // Using the system group for mouse/touch events to avoid
-        // missing events if .stopPropagation() has been called.
-        els.addSystemEventListener(global, type,
-                                   this.handleEvent.bind(this),
-                                   /* useCapture = */ false);
-      }.bind(this));
-    }
+    events.forEach(function(type) {
+      // Using the system group for mouse/touch events to avoid
+      // missing events if .stopPropagation() has been called.
+      els.addSystemEventListener(global, type,
+                                 this.handleEvent.bind(this),
+                                 /* useCapture = */ false);
+    }.bind(this));
 
     addMessageListener("Viewport:Change", this._recvViewportChange.bind(this));
     addMessageListener("Gesture:DoubleTap", this._recvDoubleTap.bind(this));
@@ -70,6 +65,8 @@ const ContentPanning = {
   },
 
   handleEvent: function cp_handleEvent(evt) {
+    this._tryDelayMouseEvents();
+
     if (evt.defaultPrevented || evt.multipleActionsPrevented) {
       // clean up panning state even if touchend/mouseup has been preventDefault.
       if(evt.type === 'touchend' || evt.type === 'mouseup') {
@@ -82,13 +79,6 @@ const ContentPanning = {
       return;
     }
 
-    let start = Date.now();
-    let thread = Services.tm.currentThread;
-    while (this._delayEvents && (Date.now() - start) < this._activeDurationMs) {
-      thread.processNextEvent(true);
-    }
-    this._delayEvents = false;
-
     switch (evt.type) {
       case 'mousedown':
       case 'touchstart':
@@ -189,7 +179,8 @@ const ContentPanning = {
 
     // We prevent start events to avoid sending a focus event at the end of this
     // touch series. See bug 889717.
-    if (this.panning || this.preventNextClick) {
+    if (docShell.asyncPanZoomEnabled === false &&
+        (this.panning || this.preventNextClick)) {
       evt.preventDefault();
     }
   },
@@ -228,7 +219,7 @@ const ContentPanning = {
         let view = target.ownerDocument ? target.ownerDocument.defaultView
                                         : target;
         view.addEventListener('click', this, true, true);
-      } else {
+      } else if (docShell.asyncPanZoomEnabled === false) {
         // We prevent end events to avoid sending a focus event. See bug 889717.
         evt.preventDefault();
       }
@@ -236,12 +227,7 @@ const ContentPanning = {
       this.notify(this._activationTimer);
 
       this._delayEvents = true;
-      let start = Date.now();
-      let thread = Services.tm.currentThread;
-      while (this._delayEvents && (Date.now() - start) < this._activeDurationMs) {
-        thread.processNextEvent(true);
-      }
-      this._delayEvents = false;
+      this._tryDelayMouseEvents();
     }
 
     this._finishPanning();
@@ -278,7 +264,12 @@ const ContentPanning = {
     }
 
     let isPan = KineticPanning.isPan();
-    this.scrollCallback(delta.scale(-1));
+
+    // If the application is not managed by the AsyncPanZoomController, then
+    // scroll manually.
+    if (docShell.asyncPanZoomEnabled === false) {
+      this.scrollCallback(delta.scale(-1));
+    }
 
     // If we've detected a pan gesture, cancel the active state of the
     // current target.
@@ -454,6 +445,15 @@ const ContentPanning = {
     return this._activeDurationMs = duration;
   },
 
+  _tryDelayMouseEvents: function cp_tryDelayMouseEvents() {
+    let start = Date.now();
+    let thread = Services.tm.currentThread;
+    while (this._delayEvents && (Date.now() - start) < this._activeDurationMs) {
+      thread.processNextEvent(true);
+    }
+    this._delayEvents = false;
+  },
+
   _resetActive: function cp_resetActive() {
     let elt = this.pointerDownTarget || this.target;
     let root = elt.ownerDocument || elt.document;
@@ -594,7 +594,9 @@ const ContentPanning = {
     delete this.primaryPointerId;
     this._activationTimer.cancel();
 
-    if (this.panning) {
+    // If there is a scroll action but the application is not managed by
+    // the AsyncPanZoom controller, let's do a manual kinetic panning action.
+    if (this.panning && docShell.asyncPanZoomEnabled === false) {
       KineticPanning.start(this);
     }
   }

From e6d324a04214e79809b19020bd107b4e53712e67 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 02:50:24 -0800
Subject: [PATCH 068/459] Bumping gaia.json for 3 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/5eec0ba9c37b
Author: Malini Das <mdas@mozilla.com>
Desc: Bug 947001 - Add requirements.txt to MANIFEST.in file so it gets packaged to pypi, bump version. r=dhunt

========

https://hg.mozilla.org/integration/gaia-central/rev/d55ebc02e92f
Author: EragonJ <eragonj@eragonj.me>
Desc: Merge pull request #14602 from EragonJ/bug-947432

Bug 947432 - [DSDS] Marketplace and Payment indication in Settings

========

https://hg.mozilla.org/integration/gaia-central/rev/2bdcb009fdc9
Author: EragonJ <eragonj@eragonj.me>
Desc: Bug 947432 - [DSDS] Marketplace and Payment indication in Settings

- update strings
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 79d09453ff37..c7ef08352cfe 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "041a8edf5c4a212d8d19dc367a5dddddd0c76321", 
+    "revision": "5eec0ba9c37b697e3055427ebdd54e8bdc3194dd", 
     "repo_path": "/integration/gaia-central"
 }

From c533d73a07c518b0882cc5d67d4ba3016da95039 Mon Sep 17 00:00:00 2001
From: Shawn Huang <shuang@mozilla.com>
Date: Thu, 12 Dec 2013 19:37:42 +0800
Subject: [PATCH 069/459] Bug 941462 - Reply internal error code when getting
 I/O error from BlueZ, r=gyeh

---
 dom/bluetooth/BluetoothCommon.h                    | 3 +++
 dom/bluetooth/bluez/linux/BluetoothDBusService.cpp | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/dom/bluetooth/BluetoothCommon.h b/dom/bluetooth/BluetoothCommon.h
index 2cf6d41eaa25..ac3e488b6f35 100644
--- a/dom/bluetooth/BluetoothCommon.h
+++ b/dom/bluetooth/BluetoothCommon.h
@@ -108,6 +108,9 @@ extern bool gBluetoothDebugFlag;
 #define BLUETOOTH_ADDRESS_NONE   "00:00:00:00:00:00"
 #define BLUETOOTH_ADDRESS_BYTES  6
 
+// Bluetooth stack internal error, such as I/O error
+#define ERR_INTERNAL_ERROR "InternalError"
+
 BEGIN_BLUETOOTH_NAMESPACE
 
 enum BluetoothSocketType {
diff --git a/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp b/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp
index 7dbbc202b6aa..dcbbc96d04fc 100644
--- a/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp
+++ b/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp
@@ -497,6 +497,14 @@ RunDBusCallback(DBusMessage* aMsg, void* aBluetoothReplyRunnable,
   nsAutoString replyError;
   BluetoothValue v;
   aFunc(aMsg, nullptr, v, replyError);
+
+  // Bug 941462. When blueZ replys 'I/O error', we treat it as 'internal error'.
+  // This usually happned when the first pairing request has not yet finished,
+  // the second pairing request issued immediately.
+  if (replyError.EqualsLiteral("I/O error")) {
+    replyError.AssignLiteral(ERR_INTERNAL_ERROR);
+  }
+
   DispatchBluetoothReply(replyRunnable, v, replyError);
 }
 

From 880a39208d0a1bc7bce3fd6c5dc7ed8d951ef087 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tdz@users.sourceforge.net>
Date: Tue, 29 Oct 2013 16:03:39 +0100
Subject: [PATCH 070/459] Bug 932728: Don't inherit DBusWatcher from
 RawDBusConnection, r=qdot

DBusWatcher is not a DBus connection, so it shouldn't inherit from
it. This patch converts the inheritance into a class member.
---
 ipc/dbus/DBusThread.cpp | 71 +++++++++++++++++++++++------------------
 1 file changed, 40 insertions(+), 31 deletions(-)

diff --git a/ipc/dbus/DBusThread.cpp b/ipc/dbus/DBusThread.cpp
index 346815ad5da1..1ad3deae6b7d 100644
--- a/ipc/dbus/DBusThread.cpp
+++ b/ipc/dbus/DBusThread.cpp
@@ -71,7 +71,7 @@
 namespace mozilla {
 namespace ipc {
 
-class DBusWatcher : public RawDBusConnection
+class DBusWatcher
 {
 public:
   DBusWatcher()
@@ -94,17 +94,6 @@ public:
   void HandleWatchAdd();
   void HandleWatchRemove();
 
-  // Information about the sockets we're polling. Socket counts
-  // increase/decrease depending on how many add/remove watch signals
-  // we're received via the control sockets.
-  nsTArray<pollfd> mPollData;
-  nsTArray<DBusWatch*> mWatchData;
-
-  // Sockets for receiving dbus control information (watch
-  // add/removes, loop shutdown, etc...)
-  ScopedClose mControlFdR;
-  ScopedClose mControlFdW;
-
 private:
   struct PollFdComparator {
     bool Equals(const pollfd& a, const pollfd& b) const {
@@ -131,6 +120,19 @@ private:
   static void        DBusWakeupFunction(void* aData);
 
   bool SetUp();
+
+  // Information about the sockets we're polling. Socket counts
+  // increase/decrease depending on how many add/remove watch signals
+  // we're received via the control sockets.
+  nsTArray<pollfd> mPollData;
+  nsTArray<DBusWatch*> mWatchData;
+
+  // Sockets for receiving dbus control information (watch
+  // add/removes, loop shutdown, etc...)
+  ScopedClose mControlFdR;
+  ScopedClose mControlFdW;
+
+  nsRefPtr<RawDBusConnection> mConnection;
 };
 
 bool
@@ -149,12 +151,12 @@ DBusWatcher::CleanUp()
 {
   MOZ_ASSERT(!NS_IsMainThread());
 
-  dbus_connection_set_wakeup_main_function(mConnection, nullptr,
-                                           nullptr, nullptr);
-  dbus_bool_t success = dbus_connection_set_watch_functions(mConnection,
-                                                            nullptr, nullptr,
-                                                            nullptr, nullptr,
-                                                            nullptr);
+  dbus_connection_set_wakeup_main_function(mConnection->GetConnection(),
+                                           nullptr, nullptr, nullptr);
+  dbus_bool_t success =
+    dbus_connection_set_watch_functions(mConnection->GetConnection(),
+                                        nullptr, nullptr, nullptr,
+                                        nullptr, nullptr);
   if (success != TRUE) {
     NS_WARNING("dbus_connection_set_watch_functions failed");
   }
@@ -258,7 +260,8 @@ DBusWatcher::Poll()
 
         DBusDispatchStatus dbusDispatchStatus;
         do {
-          dbusDispatchStatus = dbus_connection_dispatch(GetConnection());
+          dbusDispatchStatus =
+            dbus_connection_dispatch(mConnection->GetConnection());
         } while (dbusDispatchStatus == DBUS_DISPATCH_DATA_REMAINS);
 
         // Break at this point since we don't know if the operation
@@ -513,21 +516,27 @@ DBusWatcher::SetUp()
 
   mWatchData.AppendElement(static_cast<DBusWatch*>(nullptr));
 
+  nsRefPtr<RawDBusConnection> connection = new RawDBusConnection();
+
   // If we can't establish a connection to dbus, nothing else will work
-  nsresult rv = EstablishDBusConnection();
+  nsresult rv = connection->EstablishDBusConnection();
   if (NS_FAILED(rv)) {
     NS_WARNING("Cannot create DBus Connection for DBus Thread!");
     return false;
   }
 
   dbus_bool_t success =
-    dbus_connection_set_watch_functions(mConnection, AddWatchFunction,
-                                        RemoveWatchFunction,
+    dbus_connection_set_watch_functions(connection->GetConnection(),
+                                        AddWatchFunction, RemoveWatchFunction,
                                         ToggleWatchFunction, this, nullptr);
   NS_ENSURE_TRUE(success == TRUE, false);
 
-  dbus_connection_set_wakeup_main_function(mConnection, DBusWakeupFunction,
+  dbus_connection_set_wakeup_main_function(connection->GetConnection(),
+                                           DBusWakeupFunction,
                                            this, nullptr);
+
+  mConnection = connection;
+
   return true;
 }
 
@@ -565,11 +574,11 @@ public:
   }
 
 private:
-  nsRefPtr<DBusWatcher> mDBusWatcher;
+  nsAutoPtr<DBusWatcher> mDBusWatcher;
 };
 
-static StaticRefPtr<DBusWatcher> gDBusWatcher;
-static StaticRefPtr<nsIThread>   gDBusServiceThread;
+static DBusWatcher*            gDBusWatcher;
+static StaticRefPtr<nsIThread> gDBusServiceThread;
 
 // Startup/Shutdown utility functions
 
@@ -579,7 +588,7 @@ StartDBus()
   MOZ_ASSERT(!NS_IsMainThread());
   NS_ENSURE_TRUE(!gDBusWatcher, true);
 
-  nsRefPtr<DBusWatcher> dbusWatcher(new DBusWatcher());
+  nsAutoPtr<DBusWatcher> dbusWatcher(new DBusWatcher());
 
   bool eventLoopStarted = dbusWatcher->Initialize();
   NS_ENSURE_TRUE(eventLoopStarted, false);
@@ -603,7 +612,7 @@ StartDBus()
   rv = gDBusServiceThread->Dispatch(pollTask, NS_DISPATCH_NORMAL);
   NS_ENSURE_SUCCESS(rv, false);
 
-  gDBusWatcher = dbusWatcher;
+  gDBusWatcher = dbusWatcher.forget();
 
   return true;
 }
@@ -614,7 +623,7 @@ StopDBus()
   MOZ_ASSERT(!NS_IsMainThread());
   NS_ENSURE_TRUE(gDBusServiceThread, true);
 
-  nsRefPtr<DBusWatcher> dbusWatcher(gDBusWatcher);
+  DBusWatcher* dbusWatcher = gDBusWatcher;
   gDBusWatcher = nullptr;
 
   if (dbusWatcher && !dbusWatcher->Stop()) {
@@ -630,9 +639,9 @@ nsresult
 DispatchToDBusThread(nsIRunnable* event)
 {
   nsRefPtr<nsIThread> dbusServiceThread(gDBusServiceThread);
-  nsRefPtr<DBusWatcher> dbusWatcher(gDBusWatcher);
+  DBusWatcher* dbusWatcher = gDBusWatcher;
 
-  NS_ENSURE_TRUE(dbusServiceThread.get() && dbusWatcher.get(),
+  NS_ENSURE_TRUE(dbusServiceThread.get() && dbusWatcher,
                  NS_ERROR_NOT_INITIALIZED);
 
   nsresult rv = dbusServiceThread->Dispatch(event, NS_DISPATCH_NORMAL);

From d6f5d45a38a6884816efb4c10448817d6d2e73b9 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tdz@users.sourceforge.net>
Date: Thu, 12 Dec 2013 12:56:00 +0100
Subject: [PATCH 071/459] Bug 932728: Open only one connection to DBus,
 r=echou,qdot

Bluetooth maintains two connections to the DBus server and the DBus
system itself maintains a third one. This implies some overhead and
makes the code more difficult to understand.

This patch changes the Bluetooth code to use the connection that is
established by the DBus system.
---
 .../bluez/linux/BluetoothDBusService.cpp      | 190 ++++++++++--------
 .../bluez/linux/BluetoothDBusService.h        |   2 -
 ipc/dbus/DBusThread.cpp                       |  29 ++-
 ipc/dbus/DBusThread.h                         |   5 +
 ipc/dbus/RawDBusConnection.h                  |   3 +-
 5 files changed, 135 insertions(+), 94 deletions(-)

diff --git a/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp b/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp
index dcbbc96d04fc..c6bfb8c5487f 100644
--- a/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp
+++ b/dom/bluetooth/bluez/linux/BluetoothDBusService.cpp
@@ -167,12 +167,6 @@ static const char* sBluetoothDBusSignals[] =
   "type='signal',interface='org.bluez.Control'"
 };
 
-/**
- * DBus Connection held for the BluetoothCommandThread to use. Should never be
- * used by any other thread.
- */
-static nsRefPtr<RawDBusConnection> gThreadConnection;
-
 // Only A2DP and HID are authorized.
 static nsTArray<BluetoothServiceClass> sAuthorizedServiceClass;
 
@@ -974,9 +968,9 @@ AppendDeviceName(BluetoothSignal& aSignal)
 
   nsString devicePath = arr[0].value().get_nsString();
 
-  nsRefPtr<RawDBusConnection> threadConnection = gThreadConnection;
+  RawDBusConnection* connection = GetDBusConnection();
 
-  if (!threadConnection.get()) {
+  if (!connection) {
     BT_WARNING("%s: DBus connection has been closed.", __FUNCTION__);
     return;
   }
@@ -985,7 +979,7 @@ AppendDeviceName(BluetoothSignal& aSignal)
     new AppendDeviceNameReplyHandler(nsCString(DBUS_DEVICE_IFACE),
                                      devicePath, aSignal);
 
-  bool success = threadConnection->SendWithReply(
+  bool success = connection->SendWithReply(
     AppendDeviceNameReplyHandler::Callback, handler.get(), 1000,
     NS_ConvertUTF16toUTF8(devicePath).get(), DBUS_DEVICE_IFACE,
     "GetProperties", DBUS_TYPE_INVALID);
@@ -1219,9 +1213,9 @@ public:
       return;
     }
 
-    nsRefPtr<RawDBusConnection> threadConnection = gThreadConnection;
+    RawDBusConnection* connection = GetDBusConnection();
 
-    if (!threadConnection.get()) {
+    if (!connection) {
       BT_WARNING("%s: DBus connection has been closed.", __FUNCTION__);
       return;
     }
@@ -1229,7 +1223,7 @@ public:
     // There is no "RegisterAgent" function defined in device interface.
     // When we call "CreatePairedDevice", it will do device agent registration
     // for us. (See maemo.org/api_refs/5.0/beta/bluez/adapter.html)
-    if (!dbus_connection_register_object_path(threadConnection->GetConnection(),
+    if (!dbus_connection_register_object_path(connection->GetConnection(),
                                               KEY_REMOTE_AGENT,
                                               mAgentVTable,
                                               nullptr)) {
@@ -1305,9 +1299,9 @@ private:
     const char* agentPath = KEY_LOCAL_AGENT;
     const char* capabilities = B2G_AGENT_CAPABILITIES;
 
-    nsRefPtr<RawDBusConnection> threadConnection = gThreadConnection;
+    RawDBusConnection* connection = GetDBusConnection();
 
-    if (!threadConnection.get()) {
+    if (!connection) {
       BT_WARNING("%s: DBus connection has been closed.", __FUNCTION__);
       return false;
     }
@@ -1318,7 +1312,7 @@ private:
     // signal will be passed to local agent. If we start pairing process with
     // calling CreatePairedDevice, we'll get signal which should be passed to
     // device agent.
-    if (!dbus_connection_register_object_path(threadConnection->GetConnection(),
+    if (!dbus_connection_register_object_path(connection->GetConnection(),
                                               KEY_LOCAL_AGENT,
                                               aAgentVTable,
                                               nullptr)) {
@@ -1332,7 +1326,7 @@ private:
     MOZ_ASSERT(handler.get());
     MOZ_ASSERT(!sAdapterPath.IsEmpty());
 
-    bool success = threadConnection->SendWithReply(
+    bool success = connection->SendWithReply(
       RegisterAgentReplyHandler::Callback, handler.get(), -1,
       NS_ConvertUTF16toUTF8(sAdapterPath).get(),
       DBUS_ADAPTER_IFACE, "RegisterAgent",
@@ -1367,9 +1361,9 @@ public:
 
     MOZ_ASSERT(NS_IsMainThread());
 
-    nsRefPtr<RawDBusConnection> threadConnection = gThreadConnection;
+    RawDBusConnection* connection = GetDBusConnection();
 
-    if (!threadConnection.get()) {
+    if (!connection) {
       BT_WARNING("%s: DBus connection has been closed.", __FUNCTION__);
       return NS_ERROR_FAILURE;
     }
@@ -1383,7 +1377,7 @@ public:
 
     const dbus_uint32_t* services = sServices;
 
-    bool success = threadConnection->SendWithReply(
+    bool success = connection->SendWithReply(
       DBusReplyHandler::Callback, handler.get(), -1,
       NS_ConvertUTF16toUTF8(sAdapterPath).get(),
       DBUS_ADAPTER_IFACE, "AddReservedServiceRecords",
@@ -1727,7 +1721,7 @@ OnDefaultAdapterReply(DBusMessage* aReply, void* aData)
 bool
 BluetoothDBusService::IsReady()
 {
-  if (!IsEnabled() || !mConnection || !gThreadConnection || IsToggling()) {
+  if (!IsEnabled() || !GetDBusConnection() || IsToggling()) {
     BT_WARNING("Bluetooth service is not ready yet!");
     return false;
   }
@@ -1745,25 +1739,8 @@ BluetoothDBusService::StartInternal()
     return NS_ERROR_FAILURE;
   }
 
-  if (mConnection) {
-    return NS_OK;
-  }
-
-  mConnection = new RawDBusConnection();
-
-  if (NS_FAILED(mConnection->EstablishDBusConnection())) {
-    BT_WARNING("Cannot start Main Thread DBus connection!");
-    StopDBus();
-    return NS_ERROR_FAILURE;
-  }
-
-  gThreadConnection = new RawDBusConnection();
-
-  if (NS_FAILED(gThreadConnection->EstablishDBusConnection())) {
-    BT_WARNING("Cannot start Sync Thread DBus connection!");
-    StopDBus();
-    return NS_ERROR_FAILURE;
-  }
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
 
   DBusError err;
   dbus_error_init(&err);
@@ -1773,7 +1750,7 @@ BluetoothDBusService::StartInternal()
   // signals we want, register all of them in this thread at startup.
   // The event handler will sort the destinations out as needed.
   for (uint32_t i = 0; i < ArrayLength(sBluetoothDBusSignals); ++i) {
-    dbus_bus_add_match(mConnection->GetConnection(),
+    dbus_bus_add_match(connection->GetConnection(),
                        sBluetoothDBusSignals[i],
                        &err);
     if (dbus_error_is_set(&err)) {
@@ -1782,7 +1759,7 @@ BluetoothDBusService::StartInternal()
   }
 
   // Add a filter for all incoming messages_base
-  if (!dbus_connection_add_filter(mConnection->GetConnection(),
+  if (!dbus_connection_add_filter(connection->GetConnection(),
                                   EventFilter, nullptr, nullptr)) {
     BT_WARNING("Cannot create DBus Event Filter for DBus Thread!");
     return NS_ERROR_FAILURE;
@@ -1800,11 +1777,11 @@ BluetoothDBusService::StartInternal()
    * explicitly here.
    */
   if (sAdapterPath.IsEmpty()) {
-    bool success = mConnection->SendWithReply(OnDefaultAdapterReply, nullptr,
-                                              1000, "/",
-                                              DBUS_MANAGER_IFACE,
-                                              "DefaultAdapter",
-                                              DBUS_TYPE_INVALID);
+    bool success = connection->SendWithReply(OnDefaultAdapterReply, nullptr,
+                                             1000, "/",
+                                             DBUS_MANAGER_IFACE,
+                                             "DefaultAdapter",
+                                             DBUS_TYPE_INVALID);
     if (!success) {
       BT_WARNING("Failed to query default adapter!");
     }
@@ -1834,15 +1811,16 @@ BluetoothDBusService::StopInternal()
     }
   }
 
-  if (!mConnection) {
-    StopDBus();
+  RawDBusConnection* connection = GetDBusConnection();
+
+  if (!connection) {
     return NS_OK;
   }
 
   DBusError err;
   dbus_error_init(&err);
   for (uint32_t i = 0; i < ArrayLength(sBluetoothDBusSignals); ++i) {
-    dbus_bus_remove_match(mConnection->GetConnection(),
+    dbus_bus_remove_match(connection->GetConnection(),
                           sBluetoothDBusSignals[i],
                           &err);
     if (dbus_error_is_set(&err)) {
@@ -1850,24 +1828,21 @@ BluetoothDBusService::StopInternal()
     }
   }
 
-  dbus_connection_remove_filter(mConnection->GetConnection(),
+  dbus_connection_remove_filter(connection->GetConnection(),
                                 EventFilter, nullptr);
 
-  if (!dbus_connection_unregister_object_path(gThreadConnection->GetConnection(),
+  if (!dbus_connection_unregister_object_path(connection->GetConnection(),
                                               KEY_LOCAL_AGENT)) {
     BT_WARNING("%s: Can't unregister object path %s for agent!",
         __FUNCTION__, KEY_LOCAL_AGENT);
   }
 
-  if (!dbus_connection_unregister_object_path(gThreadConnection->GetConnection(),
+  if (!dbus_connection_unregister_object_path(connection->GetConnection(),
                                               KEY_REMOTE_AGENT)) {
     BT_WARNING("%s: Can't unregister object path %s for agent!",
         __FUNCTION__, KEY_REMOTE_AGENT);
   }
 
-  mConnection = nullptr;
-  gThreadConnection = nullptr;
-
   // unref stored DBusMessages before clear the hashtable
   sPairingReqTable->EnumerateRead(UnrefDBusMessages, nullptr);
   sPairingReqTable->Clear();
@@ -1951,14 +1926,14 @@ protected:
     // Acquire another reference to this reply handler
     nsRefPtr<DefaultAdapterPathReplyHandler> handler = this;
 
-    nsRefPtr<RawDBusConnection> threadConnection = gThreadConnection;
+    RawDBusConnection* connection = GetDBusConnection();
 
-    if (!threadConnection.get()) {
+    if (!connection) {
       aReplyError = NS_LITERAL_STRING("DBus connection has been closed.");
       return false;
     }
 
-    bool success = threadConnection->SendWithReply(
+    bool success = connection->SendWithReply(
       DefaultAdapterPathReplyHandler::Callback, handler.get(), 1000,
       NS_ConvertUTF16toUTF8(mAdapterPath).get(),
       DBUS_ADAPTER_IFACE, "GetProperties", DBUS_TYPE_INVALID);
@@ -2019,7 +1994,10 @@ BluetoothDBusService::GetDefaultAdapterPathInternal(
   nsRefPtr<DefaultAdapterPathReplyHandler> handler =
     new DefaultAdapterPathReplyHandler(aRunnable);
 
-  bool success = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool success = connection->SendWithReply(
     DefaultAdapterPathReplyHandler::Callback,
     handler.get(), 1000,
     "/", DBUS_MANAGER_IFACE, "DefaultAdapter",
@@ -2064,7 +2042,10 @@ BluetoothDBusService::SendDiscoveryMessage(const char* aMessageName,
 
   nsRefPtr<BluetoothReplyRunnable> runnable(aRunnable);
 
-  bool success = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool success = connection->SendWithReply(
     OnSendDiscoveryMessageReply,
     static_cast<void*>(aRunnable), -1,
     NS_ConvertUTF16toUTF8(sAdapterPath).get(),
@@ -2104,13 +2085,12 @@ BluetoothDBusService::SendAsyncDBusMessage(const nsAString& aObjectPath,
                                            DBusReplyCallback aCallback)
 {
   MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mConnection);
   MOZ_ASSERT(IsEnabled());
   MOZ_ASSERT(aCallback);
   MOZ_ASSERT(!aObjectPath.IsEmpty());
   MOZ_ASSERT(aInterface);
 
-  NS_ENSURE_TRUE(mConnection, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(GetDBusConnection(), NS_ERROR_FAILURE);
 
   nsAutoPtr<BluetoothServiceClass> serviceClass(new BluetoothServiceClass());
   if (!strcmp(aInterface, DBUS_SINK_IFACE)) {
@@ -2122,7 +2102,10 @@ BluetoothDBusService::SendAsyncDBusMessage(const nsAString& aObjectPath,
     return NS_ERROR_FAILURE;
   }
 
-  bool ret = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool ret = connection->SendWithReply(
     aCallback, static_cast<void*>(serviceClass.forget()), -1,
     NS_ConvertUTF16toUTF8(aObjectPath).get(),
     aInterface, NS_ConvertUTF16toUTF8(aMessage).get(),
@@ -2267,16 +2250,16 @@ protected:
     mObjectPath = GetObjectPathFromAddress(sAdapterPath,
       mDeviceAddresses[mProcessedDeviceAddresses]);
 
-    nsRefPtr<RawDBusConnection> threadConnection = gThreadConnection;
+    RawDBusConnection* connection = GetDBusConnection();
 
-    if (!threadConnection.get()) {
+    if (!connection) {
       BT_WARNING("%s: DBus connection has been closed.", __FUNCTION__);
       return false;
     }
 
     nsRefPtr<BluetoothArrayOfDevicePropertiesReplyHandler> handler = this;
 
-    bool success = threadConnection->SendWithReply(
+    bool success = connection->SendWithReply(
       BluetoothArrayOfDevicePropertiesReplyHandler::Callback,
       handler.get(), 1000,
       NS_ConvertUTF16toUTF8(mObjectPath).get(),
@@ -2435,10 +2418,13 @@ BluetoothDBusService::SetProperty(BluetoothObjectType aType,
 
   nsRefPtr<BluetoothReplyRunnable> runnable = aRunnable;
 
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
   // msg is unref'd as part of SendWithReply
-  bool success = mConnection->SendWithReply(GetVoidCallback,
-                                            (void*)aRunnable,
-                                            1000, msg);
+  bool success = connection->SendWithReply(GetVoidCallback,
+                                           (void*)aRunnable,
+                                           1000, msg);
   if (!success) {
     BT_WARNING("SendWithReply failed");
     return NS_ERROR_FAILURE;
@@ -2476,9 +2462,12 @@ BluetoothDBusService::CreatePairedDeviceInternal(
   nsRefPtr<BluetoothReplyRunnable> runnable = aRunnable;
   MOZ_ASSERT(!sAdapterPath.IsEmpty());
 
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
   // Then send CreatePairedDevice, it will register a temp device agent then
   // unregister it after pairing process is over
-  bool ret = mConnection->SendWithReply(
+  bool ret = connection->SendWithReply(
     GetObjectPathCallback, (void*)runnable, aTimeout,
     NS_ConvertUTF16toUTF8(sAdapterPath).get(),
     DBUS_ADAPTER_IFACE,
@@ -2531,7 +2520,10 @@ BluetoothDBusService::RemoveDeviceInternal(const nsAString& aDeviceAddress,
 
   nsRefPtr<BluetoothReplyRunnable> runnable(aRunnable);
 
-  bool success = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool success = connection->SendWithReply(
     OnRemoveDeviceReply, static_cast<void*>(runnable.get()), -1,
     NS_ConvertUTF16toUTF8(sAdapterPath).get(),
     DBUS_ADAPTER_IFACE, "RemoveDevice",
@@ -2582,7 +2574,9 @@ BluetoothDBusService::SetPinCodeInternal(const nsAString& aDeviceAddress,
     errorStr.AssignLiteral("Couldn't append arguments to dbus message.");
     result = false;
   } else {
-    result = mConnection->Send(reply);
+    RawDBusConnection* connection = GetDBusConnection();
+    MOZ_ASSERT(connection);
+    result = connection->Send(reply);
   }
 
   dbus_message_unref(msg);
@@ -2628,7 +2622,9 @@ BluetoothDBusService::SetPasskeyInternal(const nsAString& aDeviceAddress,
     errorStr.AssignLiteral("Couldn't append arguments to dbus message.");
     result = false;
   } else {
-    result = mConnection->Send(reply);
+    RawDBusConnection* connection = GetDBusConnection();
+    MOZ_ASSERT(connection);
+    result = connection->Send(reply);
   }
 
   dbus_message_unref(msg);
@@ -2672,7 +2668,10 @@ BluetoothDBusService::SetPairingConfirmationInternal(
     return false;
   }
 
-  bool result = mConnection->Send(reply);
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool result = connection->Send(reply);
   if (!result) {
     errorStr.AssignLiteral("Can't send message!");
   }
@@ -2915,7 +2914,10 @@ BluetoothDBusService::GetServiceChannel(const nsAString& aDeviceAddress,
   nsRefPtr<OnGetServiceChannelReplyHandler> handler =
     new OnGetServiceChannelReplyHandler(objectPath, aServiceUUID, aManager);
 
-  bool success = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool success = connection->SendWithReply(
     OnGetServiceChannelReplyHandler::Callback, handler, -1,
     NS_ConvertUTF16toUTF8(objectPath).get(),
     DBUS_DEVICE_IFACE, "GetServiceAttributeValue",
@@ -2960,7 +2962,6 @@ BluetoothDBusService::UpdateSdpRecords(const nsAString& aDeviceAddress,
   MOZ_ASSERT(!aDeviceAddress.IsEmpty());
   MOZ_ASSERT(!sAdapterPath.IsEmpty());
   MOZ_ASSERT(aManager);
-  MOZ_ASSERT(mConnection);
 
   nsString objectPath(GetObjectPathFromAddress(sAdapterPath, aDeviceAddress));
 
@@ -2969,13 +2970,16 @@ BluetoothDBusService::UpdateSdpRecords(const nsAString& aDeviceAddress,
   OnUpdateSdpRecordsRunnable* callbackRunnable =
     new OnUpdateSdpRecordsRunnable(objectPath, aManager);
 
-  return mConnection->SendWithReply(DiscoverServicesCallback,
-                                    (void*)callbackRunnable, -1,
-                                    NS_ConvertUTF16toUTF8(objectPath).get(),
-                                    DBUS_DEVICE_IFACE,
-                                    "DiscoverServices",
-                                    DBUS_TYPE_STRING, &EmptyCString(),
-                                    DBUS_TYPE_INVALID);
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  return connection->SendWithReply(DiscoverServicesCallback,
+                                   (void*)callbackRunnable, -1,
+                                   NS_ConvertUTF16toUTF8(objectPath).get(),
+                                   DBUS_DEVICE_IFACE,
+                                   "DiscoverServices",
+                                   DBUS_TYPE_STRING, &EmptyCString(),
+                                   DBUS_TYPE_INVALID);
 }
 
 void
@@ -3152,7 +3156,10 @@ BluetoothDBusService::SendMetaData(const nsAString& aTitle,
 
   nsRefPtr<BluetoothReplyRunnable> runnable(aRunnable);
 
-  bool ret = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool ret = connection->SendWithReply(
     GetVoidCallback, (void*)runnable.get(), -1,
     NS_ConvertUTF16toUTF8(objectPath).get(),
     DBUS_CTL_IFACE, "UpdateMetaData",
@@ -3251,7 +3258,10 @@ BluetoothDBusService::SendPlayStatus(int64_t aDuration,
 
   nsRefPtr<BluetoothReplyRunnable> runnable(aRunnable);
 
-  bool ret = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool ret = connection->SendWithReply(
     GetVoidCallback, (void*)runnable.get(), -1,
     NS_ConvertUTF16toUTF8(objectPath).get(),
     DBUS_CTL_IFACE, "UpdatePlayStatus",
@@ -3300,7 +3310,10 @@ BluetoothDBusService::UpdatePlayStatus(uint32_t aDuration,
 
   uint32_t tempPlayStatus = aPlayStatus;
 
-  bool ret = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool ret = connection->SendWithReply(
     ControlCallback, nullptr, -1,
     NS_ConvertUTF16toUTF8(objectPath).get(),
     DBUS_CTL_IFACE, "UpdatePlayStatus",
@@ -3330,7 +3343,10 @@ BluetoothDBusService::UpdateNotification(ControlEventId aEventId,
     GetObjectPathFromAddress(sAdapterPath, address);
   uint16_t eventId = aEventId;
 
-  bool ret = mConnection->SendWithReply(
+  RawDBusConnection* connection = GetDBusConnection();
+  MOZ_ASSERT(connection);
+
+  bool ret = connection->SendWithReply(
     ControlCallback, nullptr, -1,
     NS_ConvertUTF16toUTF8(objectPath).get(),
     DBUS_CTL_IFACE, "UpdateNotification",
diff --git a/dom/bluetooth/bluez/linux/BluetoothDBusService.h b/dom/bluetooth/bluez/linux/BluetoothDBusService.h
index 251efd2982f0..0d939da9da3d 100644
--- a/dom/bluetooth/bluez/linux/BluetoothDBusService.h
+++ b/dom/bluetooth/bluez/linux/BluetoothDBusService.h
@@ -194,8 +194,6 @@ private:
                                 const char* aInterface,
                                 const nsAString& aMessage,
                                 mozilla::ipc::DBusReplyCallback aCallback);
-
-  nsRefPtr<mozilla::ipc::RawDBusConnection> mConnection;
 };
 
 END_BLUETOOTH_NAMESPACE
diff --git a/ipc/dbus/DBusThread.cpp b/ipc/dbus/DBusThread.cpp
index 1ad3deae6b7d..a04e2b33f400 100644
--- a/ipc/dbus/DBusThread.cpp
+++ b/ipc/dbus/DBusThread.cpp
@@ -75,10 +75,14 @@ class DBusWatcher
 {
 public:
   DBusWatcher()
+  : mConnection(nullptr)
   { }
 
   ~DBusWatcher()
-  { }
+  {
+    // Connection has been released
+    MOZ_ASSERT(!mConnection);
+  }
 
   bool Initialize();
   void CleanUp();
@@ -94,6 +98,8 @@ public:
   void HandleWatchAdd();
   void HandleWatchRemove();
 
+  RawDBusConnection* GetConnection();
+
 private:
   struct PollFdComparator {
     bool Equals(const pollfd& a, const pollfd& b) const {
@@ -132,9 +138,15 @@ private:
   ScopedClose mControlFdR;
   ScopedClose mControlFdW;
 
-  nsRefPtr<RawDBusConnection> mConnection;
+  RawDBusConnection* mConnection;
 };
 
+RawDBusConnection*
+DBusWatcher::GetConnection()
+{
+  return mConnection;
+}
+
 bool
 DBusWatcher::Initialize()
 {
@@ -175,6 +187,9 @@ DBusWatcher::CleanUp()
   // DBusWatch pointers are maintained by DBus, so we won't leak by
   // clearing.
   mWatchData.Clear();
+
+  delete mConnection;
+  mConnection = nullptr;
 }
 
 void
@@ -516,7 +531,7 @@ DBusWatcher::SetUp()
 
   mWatchData.AppendElement(static_cast<DBusWatch*>(nullptr));
 
-  nsRefPtr<RawDBusConnection> connection = new RawDBusConnection();
+  RawDBusConnection* connection = new RawDBusConnection();
 
   // If we can't establish a connection to dbus, nothing else will work
   nsresult rv = connection->EstablishDBusConnection();
@@ -652,5 +667,13 @@ DispatchToDBusThread(nsIRunnable* event)
   return NS_OK;
 }
 
+RawDBusConnection*
+GetDBusConnection()
+{
+  NS_ENSURE_TRUE(gDBusWatcher, nullptr);
+
+  return gDBusWatcher->GetConnection();
+}
+
 }
 }
diff --git a/ipc/dbus/DBusThread.h b/ipc/dbus/DBusThread.h
index fdce20afce8b..b67091e3b103 100644
--- a/ipc/dbus/DBusThread.h
+++ b/ipc/dbus/DBusThread.h
@@ -14,6 +14,8 @@ class nsIRunnable;
 namespace mozilla {
 namespace ipc {
 
+class RawDBusConnection;
+
 /**
  * Starts the DBus thread, which handles returning signals to objects
  * that call asynchronous functions. This should be called from the
@@ -40,6 +42,9 @@ bool StopDBus();
 nsresult
 DispatchToDBusThread(nsIRunnable* event);
 
+RawDBusConnection*
+GetDBusConnection(void);
+
 }
 }
 
diff --git a/ipc/dbus/RawDBusConnection.h b/ipc/dbus/RawDBusConnection.h
index 616a964b3e2a..06329b7a1006 100644
--- a/ipc/dbus/RawDBusConnection.h
+++ b/ipc/dbus/RawDBusConnection.h
@@ -14,7 +14,6 @@
 #include <string>
 #include "nscore.h"
 #include "mozilla/Scoped.h"
-#include <mozilla/RefPtr.h>
 #include <mozilla/Mutex.h>
 
 struct DBusConnection;
@@ -26,7 +25,7 @@ namespace ipc {
 
 typedef void (*DBusReplyCallback)(DBusMessage*, void*);
 
-class RawDBusConnection : public AtomicRefCounted<RawDBusConnection>
+class RawDBusConnection
 {
   struct ScopedDBusConnectionPtrTraits : ScopedFreePtrTraits<DBusConnection>
   {

From b3c5ff39857d46237eabcc22b4cfb8ec0584b1b9 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tdz@users.sourceforge.net>
Date: Tue, 29 Oct 2013 16:03:40 +0100
Subject: [PATCH 072/459] Bug 932728: Use private DBus connection, r=qdot

Using a private DBus connection gives each of its users, such as
Bluetooth, its own connection to the DBus server. This simplifies
the use of DBusWatch structures and ensures that all resources of
a connection are free'd when the connection gets closed.
---
 ipc/dbus/RawDBusConnection.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ipc/dbus/RawDBusConnection.cpp b/ipc/dbus/RawDBusConnection.cpp
index bc13d2e83b68..9b2e02a3754d 100644
--- a/ipc/dbus/RawDBusConnection.cpp
+++ b/ipc/dbus/RawDBusConnection.cpp
@@ -202,7 +202,7 @@ nsresult RawDBusConnection::EstablishDBusConnection()
   }
   DBusError err;
   dbus_error_init(&err);
-  mConnection = dbus_bus_get(DBUS_BUS_SYSTEM, &err);
+  mConnection = dbus_bus_get_private(DBUS_BUS_SYSTEM, &err);
   if (dbus_error_is_set(&err)) {
     dbus_error_free(&err);
     return NS_ERROR_FAILURE;
@@ -214,6 +214,7 @@ nsresult RawDBusConnection::EstablishDBusConnection()
 void RawDBusConnection::ScopedDBusConnectionPtrTraits::release(DBusConnection* ptr)
 {
   if (ptr) {
+    dbus_connection_close(ptr);
     dbus_connection_unref(ptr);
   }
 }

From 49a80cc3320bc68159f75f79692edd5bbbaa9bd4 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tdz@users.sourceforge.net>
Date: Tue, 29 Oct 2013 16:03:40 +0100
Subject: [PATCH 073/459] Bug 932728: Run DBus on the I/O thread, r=qdot

This patch converts DBusWatcher to run on the I/O thread. When a
caller starts DBus, StartDBus creates a new connection and adds
it to the I/O thread's poll loop. DBusWatchers are created and
removed automatically by the DBus libary.

The I/O thread provides all features of the DBus thread. So most
of the existing code has been removed or rewritten. The former
includes the control socket and the DBus thread, the latter is in
the DBusWatcher code.
---
 ipc/dbus/DBusThread.cpp        | 632 +++++++--------------------------
 ipc/dbus/DBusThread.h          |  13 +-
 ipc/dbus/RawDBusConnection.cpp |  85 +++--
 3 files changed, 183 insertions(+), 547 deletions(-)

diff --git a/ipc/dbus/DBusThread.cpp b/ipc/dbus/DBusThread.cpp
index a04e2b33f400..53b635468220 100644
--- a/ipc/dbus/DBusThread.cpp
+++ b/ipc/dbus/DBusThread.cpp
@@ -66,79 +66,46 @@
 #define LOG(args...) if (BTDEBUG) printf(args);
 #endif
 
-#define DEFAULT_INITIAL_POLLFD_COUNT 8
-
 namespace mozilla {
 namespace ipc {
 
-class DBusWatcher
+class DBusWatcher : public MessageLoopForIO::Watcher
 {
 public:
-  DBusWatcher()
-  : mConnection(nullptr)
-  { }
-
-  ~DBusWatcher()
+  DBusWatcher(RawDBusConnection* aConnection, DBusWatch* aWatch)
+  : mConnection(aConnection),
+    mWatch(aWatch)
   {
-    // Connection has been released
-    MOZ_ASSERT(!mConnection);
+    MOZ_ASSERT(mConnection);
+    MOZ_ASSERT(mWatch);
   }
 
-  bool Initialize();
-  void CleanUp();
+  ~DBusWatcher()
+  { }
 
-  void WakeUp();
-  bool Stop();
+  void StartWatching();
+  void StopWatching();
 
-  bool Poll();
-
-  bool AddWatch(DBusWatch* aWatch);
-  void RemoveWatch(DBusWatch* aWatch);
-
-  void HandleWatchAdd();
-  void HandleWatchRemove();
+  static void        FreeFunction(void* aData);
+  static dbus_bool_t AddWatchFunction(DBusWatch* aWatch, void* aData);
+  static void        RemoveWatchFunction(DBusWatch* aWatch, void* aData);
+  static void        ToggleWatchFunction(DBusWatch* aWatch, void* aData);
 
   RawDBusConnection* GetConnection();
 
 private:
-  struct PollFdComparator {
-    bool Equals(const pollfd& a, const pollfd& b) const {
-      return ((a.fd == b.fd) && (a.events == b.events));
-    }
-    bool LessThan(const pollfd& a, const pollfd&b) const {
-      return false;
-    }
-  };
+  void OnFileCanReadWithoutBlocking(int aFd);
+  void OnFileCanWriteWithoutBlocking(int aFd);
 
-  enum DBusEventTypes {
-    DBUS_EVENT_LOOP_EXIT = 1,
-    DBUS_EVENT_LOOP_ADD = 2,
-    DBUS_EVENT_LOOP_REMOVE = 3,
-    DBUS_EVENT_LOOP_WAKEUP = 4
-  };
+  // Read watcher for libevent. Only to be accessed on IO Thread.
+  MessageLoopForIO::FileDescriptorWatcher mReadWatcher;
 
-  static unsigned int UnixEventsToDBusFlags(short events);
-  static short        DBusFlagsToUnixEvents(unsigned int flags);
-
-  static dbus_bool_t AddWatchFunction(DBusWatch* aWatch, void* aData);
-  static void        RemoveWatchFunction(DBusWatch* aWatch, void* aData);
-  static void        ToggleWatchFunction(DBusWatch* aWatch, void* aData);
-  static void        DBusWakeupFunction(void* aData);
-
-  bool SetUp();
-
-  // Information about the sockets we're polling. Socket counts
-  // increase/decrease depending on how many add/remove watch signals
-  // we're received via the control sockets.
-  nsTArray<pollfd> mPollData;
-  nsTArray<DBusWatch*> mWatchData;
-
-  // Sockets for receiving dbus control information (watch
-  // add/removes, loop shutdown, etc...)
-  ScopedClose mControlFdR;
-  ScopedClose mControlFdW;
+  // Write watcher for libevent. Only to be accessed on IO Thread.
+  MessageLoopForIO::FileDescriptorWatcher mWriteWatcher;
 
+  // DBus structures
   RawDBusConnection* mConnection;
+  DBusWatch* mWatch;
 };
 
 RawDBusConnection*
@@ -147,487 +114,166 @@ DBusWatcher::GetConnection()
   return mConnection;
 }
 
-bool
-DBusWatcher::Initialize()
+void DBusWatcher::StartWatching()
 {
-  if (!SetUp()) {
-    CleanUp();
-    return false;
-  }
+  MOZ_ASSERT(!NS_IsMainThread());
+  MOZ_ASSERT(mWatch);
 
-  return true;
+  int fd = dbus_watch_get_unix_fd(mWatch);
+
+  MessageLoopForIO* ioLoop = MessageLoopForIO::current();
+  ioLoop->WatchFileDescriptor(fd, true, MessageLoopForIO::WATCH_READ,
+                              &mReadWatcher, this);
+  ioLoop->WatchFileDescriptor(fd, true, MessageLoopForIO::WATCH_WRITE,
+                              &mWriteWatcher, this);
 }
 
-void
-DBusWatcher::CleanUp()
+void DBusWatcher::StopWatching()
 {
   MOZ_ASSERT(!NS_IsMainThread());
 
-  dbus_connection_set_wakeup_main_function(mConnection->GetConnection(),
-                                           nullptr, nullptr, nullptr);
-  dbus_bool_t success =
-    dbus_connection_set_watch_functions(mConnection->GetConnection(),
-                                        nullptr, nullptr, nullptr,
-                                        nullptr, nullptr);
-  if (success != TRUE) {
-    NS_WARNING("dbus_connection_set_watch_functions failed");
-  }
-
-#ifdef DEBUG
-  LOG("Removing DBus Sockets\n");
-#endif
-  if (mControlFdW.get()) {
-    mControlFdW.dispose();
-  }
-  if (mControlFdR.get()) {
-    mControlFdR.dispose();
-  }
-  mPollData.Clear();
-
-  // DBusWatch pointers are maintained by DBus, so we won't leak by
-  // clearing.
-  mWatchData.Clear();
-
-  delete mConnection;
-  mConnection = nullptr;
-}
-
-void
-DBusWatcher::WakeUp()
-{
-  static const char control = DBUS_EVENT_LOOP_WAKEUP;
-
-  struct pollfd fds = {
-    mControlFdW.get(),
-    POLLOUT,
-    0
-  };
-
-  int nfds = TEMP_FAILURE_RETRY(poll(&fds, 1, 0));
-  NS_ENSURE_TRUE_VOID(nfds == 1);
-  NS_ENSURE_TRUE_VOID(fds.revents == POLLOUT);
-
-  ssize_t res = TEMP_FAILURE_RETRY(
-    write(mControlFdW.get(), &control, sizeof(control)));
-  if (res < 0) {
-    NS_WARNING("Cannot write wakeup bit to DBus controller!");
-  }
-}
-
-bool
-DBusWatcher::Stop()
-{
-  static const char data = DBUS_EVENT_LOOP_EXIT;
-
-  ssize_t res =
-    TEMP_FAILURE_RETRY(write(mControlFdW.get(), &data, sizeof(data)));
-  NS_ENSURE_TRUE(res == 1, false);
-
-  return true;
-}
-
-bool
-DBusWatcher::Poll()
-{
-  int res = TEMP_FAILURE_RETRY(poll(mPollData.Elements(),
-                                    mPollData.Length(), -1));
-  NS_ENSURE_TRUE(res > 0, false);
-
-  bool continueThread = true;
-
-  nsTArray<pollfd>::size_type i = 0;
-
-  while (i < mPollData.Length()) {
-    if (mPollData[i].revents == POLLIN) {
-      if (mPollData[i].fd == mControlFdR.get()) {
-        char data;
-        res = TEMP_FAILURE_RETRY(read(mControlFdR.get(), &data, sizeof(data)));
-        NS_ENSURE_TRUE(res > 0, false);
-
-        switch (data) {
-          case DBUS_EVENT_LOOP_EXIT:
-            continueThread = false;
-            break;
-          case DBUS_EVENT_LOOP_ADD:
-            HandleWatchAdd();
-            break;
-          case DBUS_EVENT_LOOP_REMOVE:
-            HandleWatchRemove();
-            // don't increment i, or we'll skip one element
-            continue;
-          case DBUS_EVENT_LOOP_WAKEUP:
-            NS_ProcessPendingEvents(NS_GetCurrentThread(),
-                                    PR_INTERVAL_NO_TIMEOUT);
-            break;
-          default:
-#if DEBUG
-            nsCString warning("unknown command ");
-            warning.AppendInt(data);
-            NS_WARNING(warning.get());
-#endif
-            break;
-        }
-      } else {
-        short events = mPollData[i].revents;
-        mPollData[i].revents = 0;
-
-        dbus_watch_handle(mWatchData[i], UnixEventsToDBusFlags(events));
-
-        DBusDispatchStatus dbusDispatchStatus;
-        do {
-          dbusDispatchStatus =
-            dbus_connection_dispatch(mConnection->GetConnection());
-        } while (dbusDispatchStatus == DBUS_DISPATCH_DATA_REMAINS);
-
-        // Break at this point since we don't know if the operation
-        // was destructive
-        break;
-      }
-    }
-
-    ++i;
-  }
-
-  return continueThread;
-}
-
-bool
-DBusWatcher::AddWatch(DBusWatch* aWatch)
-{
-  static const char control = DBUS_EVENT_LOOP_ADD;
-
-  if (dbus_watch_get_enabled(aWatch) == FALSE) {
-    return true;
-  }
-
-  // note that we can't just send the watch and inspect it later
-  // because we may get a removeWatch call before this data is reacted
-  // to by our eventloop and remove this watch..  reading the add first
-  // and then inspecting the recently deceased watch would be bad.
-  ssize_t res =
-    TEMP_FAILURE_RETRY(write(mControlFdW.get(),&control, sizeof(control)));
-  if (res < 0) {
-    LOG("Cannot write DBus add watch control data to socket!\n");
-    return false;
-  }
-
-  int fd = dbus_watch_get_unix_fd(aWatch);
-  res = TEMP_FAILURE_RETRY(write(mControlFdW.get(), &fd, sizeof(fd)));
-  if (res < 0) {
-    LOG("Cannot write DBus add watch descriptor data to socket!\n");
-    return false;
-  }
-
-  unsigned int flags = dbus_watch_get_flags(aWatch);
-  res = TEMP_FAILURE_RETRY(write(mControlFdW.get(), &flags, sizeof(flags)));
-  if (res < 0) {
-    LOG("Cannot write DBus add watch flag data to socket!\n");
-    return false;
-  }
-
-  res = TEMP_FAILURE_RETRY(write(mControlFdW.get(), &aWatch, sizeof(aWatch)));
-  if (res < 0) {
-    LOG("Cannot write DBus add watch struct data to socket!\n");
-    return false;
-  }
-
-  return true;
-}
-
-void
-DBusWatcher::RemoveWatch(DBusWatch* aWatch)
-{
-  static const char control = DBUS_EVENT_LOOP_REMOVE;
-
-  ssize_t res =
-    TEMP_FAILURE_RETRY(write(mControlFdW.get(), &control, sizeof(control)));
-  if (res < 0) {
-    LOG("Cannot write DBus remove watch control data to socket!\n");
-    return;
-  }
-
-  int fd = dbus_watch_get_unix_fd(aWatch);
-  res = TEMP_FAILURE_RETRY(write(mControlFdW.get(), &fd, sizeof(fd)));
-  if (res < 0) {
-    LOG("Cannot write DBus remove watch descriptor data to socket!\n");
-    return;
-  }
-
-  unsigned int flags = dbus_watch_get_flags(aWatch);
-  res = TEMP_FAILURE_RETRY(write(mControlFdW.get(), &flags, sizeof(flags)));
-  if (res < 0) {
-    LOG("Cannot write DBus remove watch flag data to socket!\n");
-    return;
-  }
-}
-
-void
-DBusWatcher::HandleWatchAdd()
-{
-  int fd;
-  ssize_t res = TEMP_FAILURE_RETRY(read(mControlFdR.get(), &fd, sizeof(fd)));
-  if (res < 0) {
-    LOG("Cannot read DBus watch add descriptor data from socket!\n");
-    return;
-  }
-
-  unsigned int flags;
-  res = TEMP_FAILURE_RETRY(read(mControlFdR.get(), &flags, sizeof(flags)));
-  if (res < 0) {
-    LOG("Cannot read DBus watch add flag data from socket!\n");
-    return;
-  }
-
-  DBusWatch* watch;
-  res = TEMP_FAILURE_RETRY(read(mControlFdR.get(), &watch, sizeof(watch)));
-  if (res < 0) {
-    LOG("Cannot read DBus watch add watch data from socket!\n");
-    return;
-  }
-
-  struct pollfd p = {
-    fd, // .fd
-    DBusFlagsToUnixEvents(flags), // .events
-    0 // .revents
-  };
-  if (mPollData.Contains(p, PollFdComparator())) {
-    return;
-  }
-  mPollData.AppendElement(p);
-  mWatchData.AppendElement(watch);
-}
-
-void
-DBusWatcher::HandleWatchRemove()
-{
-  int fd;
-  ssize_t res = TEMP_FAILURE_RETRY(read(mControlFdR.get(), &fd, sizeof(fd)));
-  if (res < 0) {
-    LOG("Cannot read DBus watch remove descriptor data from socket!\n");
-    return;
-  }
-
-  unsigned int flags;
-  res = TEMP_FAILURE_RETRY(read(mControlFdR.get(), &flags, sizeof(flags)));
-  if (res < 0) {
-    LOG("Cannot read DBus watch remove flag data from socket!\n");
-    return;
-  }
-
-  struct pollfd p = {
-    fd, // .fd
-    DBusFlagsToUnixEvents(flags), // .events
-    0 // .revents
-  };
-  int index = mPollData.IndexOf(p, 0, PollFdComparator());
-  // There are times where removes can be requested for watches that
-  // haven't been added (for example, whenever gecko comes up after
-  // adapters have already been enabled), so check to make sure we're
-  // using the watch in the first place
-  if (index < 0) {
-    LOG("DBus requested watch removal of non-existant socket, ignoring...");
-    return;
-  }
-  mPollData.RemoveElementAt(index);
-
-  // DBusWatch pointers are maintained by DBus, so we won't leak by
-  // removing.
-  mWatchData.RemoveElementAt(index);
-}
-
-// Flag conversion
-
-unsigned int
-DBusWatcher::UnixEventsToDBusFlags(short events)
-{
-  return (events & DBUS_WATCH_READABLE ? POLLIN : 0) |
-         (events & DBUS_WATCH_WRITABLE ? POLLOUT : 0) |
-         (events & DBUS_WATCH_ERROR ? POLLERR : 0) |
-         (events & DBUS_WATCH_HANGUP ? POLLHUP : 0);
-}
-
-short
-DBusWatcher::DBusFlagsToUnixEvents(unsigned int flags)
-{
-  return (flags & POLLIN ? DBUS_WATCH_READABLE : 0) |
-         (flags & POLLOUT ? DBUS_WATCH_WRITABLE : 0) |
-         (flags & POLLERR ? DBUS_WATCH_ERROR : 0) |
-         (flags & POLLHUP ? DBUS_WATCH_HANGUP : 0);
+  mReadWatcher.StopWatchingFileDescriptor();
+  mWriteWatcher.StopWatchingFileDescriptor();
 }
 
 // DBus utility functions, used as function pointers in DBus setup
 
+void
+DBusWatcher::FreeFunction(void* aData)
+{
+  delete static_cast<DBusWatcher*>(aData);
+}
+
 dbus_bool_t
 DBusWatcher::AddWatchFunction(DBusWatch* aWatch, void* aData)
 {
-  MOZ_ASSERT(aData);
-  DBusWatcher* dbusWatcher = static_cast<DBusWatcher*>(aData);
-  return dbusWatcher->AddWatch(aWatch);
+  MOZ_ASSERT(!NS_IsMainThread());
+
+  RawDBusConnection* connection = static_cast<RawDBusConnection*>(aData);
+
+  DBusWatcher* dbusWatcher = new DBusWatcher(connection, aWatch);
+  dbus_watch_set_data(aWatch, dbusWatcher, DBusWatcher::FreeFunction);
+
+  if (dbus_watch_get_enabled(aWatch)) {
+    dbusWatcher->StartWatching();
+  }
+
+  return TRUE;
 }
 
 void
 DBusWatcher::RemoveWatchFunction(DBusWatch* aWatch, void* aData)
 {
-  MOZ_ASSERT(aData);
-  DBusWatcher* dbusWatcher = static_cast<DBusWatcher*>(aData);
-  dbusWatcher->RemoveWatch(aWatch);
+  MOZ_ASSERT(!NS_IsMainThread());
+
+  DBusWatcher* dbusWatcher =
+    static_cast<DBusWatcher*>(dbus_watch_get_data(aWatch));
+  dbusWatcher->StopWatching();
 }
 
 void
 DBusWatcher::ToggleWatchFunction(DBusWatch* aWatch, void* aData)
 {
-  MOZ_ASSERT(aData);
-  DBusWatcher* dbusWatcher = static_cast<DBusWatcher*>(aData);
+  MOZ_ASSERT(!NS_IsMainThread());
+
+  DBusWatcher* dbusWatcher =
+    static_cast<DBusWatcher*>(dbus_watch_get_data(aWatch));
 
   if (dbus_watch_get_enabled(aWatch)) {
-    dbusWatcher->AddWatch(aWatch);
+    dbusWatcher->StartWatching();
   } else {
-    dbusWatcher->RemoveWatch(aWatch);
+    dbusWatcher->StopWatching();
   }
 }
 
 void
-DBusWatcher::DBusWakeupFunction(void* aData)
-{
-  MOZ_ASSERT(aData);
-  DBusWatcher* dbusWatcher = static_cast<DBusWatcher*>(aData);
-  dbusWatcher->WakeUp();
-}
-
-bool
-DBusWatcher::SetUp()
+DBusWatcher::OnFileCanReadWithoutBlocking(int aFd)
 {
   MOZ_ASSERT(!NS_IsMainThread());
 
-  // If we already have a connection, exit
-  if (mConnection) {
-    return false;
-  }
+  dbus_watch_handle(mWatch, DBUS_WATCH_READABLE);
 
-  // socketpair opens two sockets for the process to communicate on.
-  // This is how android's implementation of the dbus event loop
-  // communicates with itself in relation to IPC signals. These
-  // sockets are contained sequentially in the same struct in the
-  // android code, but we break them out into class members here.
-  // Therefore we read into a local array and then copy.
-
-  int sockets[2];
-  if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sockets) < 0) {
-    return false;
-  }
-
-  mControlFdR.rwget() = sockets[0];
-  mControlFdW.rwget() = sockets[1];
-
-  pollfd* p = mPollData.AppendElement();
-
-  p->fd = mControlFdR.get();
-  p->events = POLLIN;
-  p->revents = 0;
-
-  // Due to the fact that mPollData and mWatchData have to match, we
-  // push a null to the front of mWatchData since it has the control
-  // fd in the first slot of mPollData.
-
-  mWatchData.AppendElement(static_cast<DBusWatch*>(nullptr));
-
-  RawDBusConnection* connection = new RawDBusConnection();
-
-  // If we can't establish a connection to dbus, nothing else will work
-  nsresult rv = connection->EstablishDBusConnection();
-  if (NS_FAILED(rv)) {
-    NS_WARNING("Cannot create DBus Connection for DBus Thread!");
-    return false;
-  }
-
-  dbus_bool_t success =
-    dbus_connection_set_watch_functions(connection->GetConnection(),
-                                        AddWatchFunction, RemoveWatchFunction,
-                                        ToggleWatchFunction, this, nullptr);
-  NS_ENSURE_TRUE(success == TRUE, false);
-
-  dbus_connection_set_wakeup_main_function(connection->GetConnection(),
-                                           DBusWakeupFunction,
-                                           this, nullptr);
-
-  mConnection = connection;
-
-  return true;
+  DBusDispatchStatus dbusDispatchStatus;
+  do {
+    dbusDispatchStatus =
+      dbus_connection_dispatch(mConnection->GetConnection());
+  } while (dbusDispatchStatus == DBUS_DISPATCH_DATA_REMAINS);
 }
 
-// Main task for polling the DBus system
+void
+DBusWatcher::OnFileCanWriteWithoutBlocking(int aFd)
+{
+  MOZ_ASSERT(!NS_IsMainThread());
 
-class DBusPollTask : public nsRunnable
+  dbus_watch_handle(mWatch, DBUS_WATCH_WRITABLE);
+}
+
+class WatchDBusConnectionTask : public Task
 {
 public:
-  DBusPollTask(DBusWatcher* aDBusWatcher)
-  : mDBusWatcher(aDBusWatcher)
-  { }
+  WatchDBusConnectionTask(RawDBusConnection* aConnection)
+  : mConnection(aConnection)
+  {
+    MOZ_ASSERT(mConnection);
+  }
 
-  NS_IMETHOD Run()
+  void Run()
   {
     MOZ_ASSERT(!NS_IsMainThread());
 
-    bool continueThread;
-
-    do {
-      continueThread = mDBusWatcher->Poll();
-    } while (continueThread);
-
-    mDBusWatcher->CleanUp();
-
-    nsIThread* thread;
-    nsresult rv = NS_GetCurrentThread(&thread);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsRefPtr<nsIRunnable> runnable =
-      NS_NewRunnableMethod(thread, &nsIThread::Shutdown);
-    rv = NS_DispatchToMainThread(runnable);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    return NS_OK;
+    dbus_bool_t success =
+      dbus_connection_set_watch_functions(mConnection->GetConnection(),
+                                          DBusWatcher::AddWatchFunction,
+                                          DBusWatcher::RemoveWatchFunction,
+                                          DBusWatcher::ToggleWatchFunction,
+                                          mConnection, nullptr);
+    NS_ENSURE_TRUE_VOID(success == TRUE);
   }
 
 private:
-  nsAutoPtr<DBusWatcher> mDBusWatcher;
+  RawDBusConnection* mConnection;
 };
 
-static DBusWatcher*            gDBusWatcher;
-static StaticRefPtr<nsIThread> gDBusServiceThread;
+class DeleteDBusConnectionTask : public Task
+{
+public:
+  DeleteDBusConnectionTask(RawDBusConnection* aConnection)
+  : mConnection(aConnection)
+  {
+    MOZ_ASSERT(mConnection);
+  }
 
-// Startup/Shutdown utility functions
+  void Run()
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+
+    // This command closes the DBus connection and all instances of
+    // DBusWatch will be removed and free'd.
+    delete mConnection;
+  }
+
+private:
+  RawDBusConnection* mConnection;
+};
+
+ // Startup/Shutdown utility functions
+
+static RawDBusConnection* gDBusConnection;
 
 bool
 StartDBus()
 {
   MOZ_ASSERT(!NS_IsMainThread());
-  NS_ENSURE_TRUE(!gDBusWatcher, true);
+  NS_ENSURE_TRUE(!gDBusConnection, true);
 
-  nsAutoPtr<DBusWatcher> dbusWatcher(new DBusWatcher());
-
-  bool eventLoopStarted = dbusWatcher->Initialize();
-  NS_ENSURE_TRUE(eventLoopStarted, false);
-
-  nsresult rv;
-
-  if (!gDBusServiceThread) {
-    nsIThread* dbusServiceThread;
-    rv = NS_NewNamedThread("DBus Thread", &dbusServiceThread);
-    NS_ENSURE_SUCCESS(rv, false);
-    gDBusServiceThread = dbusServiceThread;
-  }
-
-#ifdef DEBUG
-  LOG("DBus Thread Starting\n");
-#endif
-
-  nsRefPtr<nsIRunnable> pollTask(new DBusPollTask(dbusWatcher));
-  NS_ENSURE_TRUE(pollTask, false);
-
-  rv = gDBusServiceThread->Dispatch(pollTask, NS_DISPATCH_NORMAL);
+  RawDBusConnection* connection = new RawDBusConnection();
+  nsresult rv = connection->EstablishDBusConnection();
   NS_ENSURE_SUCCESS(rv, false);
 
-  gDBusWatcher = dbusWatcher.forget();
+  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
+    new WatchDBusConnectionTask(connection));
+
+  gDBusConnection = connection;
 
   return true;
 }
@@ -636,33 +282,21 @@ bool
 StopDBus()
 {
   MOZ_ASSERT(!NS_IsMainThread());
-  NS_ENSURE_TRUE(gDBusServiceThread, true);
+  NS_ENSURE_TRUE(gDBusConnection, true);
 
-  DBusWatcher* dbusWatcher = gDBusWatcher;
-  gDBusWatcher = nullptr;
+  RawDBusConnection* connection = gDBusConnection;
+  gDBusConnection = nullptr;
 
-  if (dbusWatcher && !dbusWatcher->Stop()) {
-    return false;
-  }
-
-  gDBusServiceThread = nullptr;
+  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
+    new DeleteDBusConnectionTask(connection));
 
   return true;
 }
 
 nsresult
-DispatchToDBusThread(nsIRunnable* event)
+DispatchToDBusThread(Task* task)
 {
-  nsRefPtr<nsIThread> dbusServiceThread(gDBusServiceThread);
-  DBusWatcher* dbusWatcher = gDBusWatcher;
-
-  NS_ENSURE_TRUE(dbusServiceThread.get() && dbusWatcher,
-                 NS_ERROR_NOT_INITIALIZED);
-
-  nsresult rv = dbusServiceThread->Dispatch(event, NS_DISPATCH_NORMAL);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  dbusWatcher->WakeUp();
+  XRE_GetIOMessageLoop()->PostTask(FROM_HERE, task);
 
   return NS_OK;
 }
@@ -670,9 +304,9 @@ DispatchToDBusThread(nsIRunnable* event)
 RawDBusConnection*
 GetDBusConnection()
 {
-  NS_ENSURE_TRUE(gDBusWatcher, nullptr);
+  NS_ENSURE_TRUE(gDBusConnection, nullptr);
 
-  return gDBusWatcher->GetConnection();
+  return gDBusConnection;
 }
 
 }
diff --git a/ipc/dbus/DBusThread.h b/ipc/dbus/DBusThread.h
index b67091e3b103..e688b1555935 100644
--- a/ipc/dbus/DBusThread.h
+++ b/ipc/dbus/DBusThread.h
@@ -9,7 +9,7 @@
 
 #include "nscore.h"
 
-class nsIRunnable;
+class Task;
 
 namespace mozilla {
 namespace ipc {
@@ -34,14 +34,19 @@ bool StartDBus();
 bool StopDBus();
 
 /**
- * Dispatch an event to the DBus thread
+ * Dispatch a task to the DBus I/O thread
  *
- * @param event An nsIRunnable to run in the DBus thread
+ * @param task A task to run on the DBus I/O thread
  * @return NS_OK on success, or an error code otherwise
  */
 nsresult
-DispatchToDBusThread(nsIRunnable* event);
+DispatchToDBusThread(Task* task);
 
+/**
+ * Returns the connection to the DBus server
+ *
+ * @return The DBus connection on success, or nullptr otherwise
+ */
 RawDBusConnection*
 GetDBusConnection(void);
 
diff --git a/ipc/dbus/RawDBusConnection.cpp b/ipc/dbus/RawDBusConnection.cpp
index 9b2e02a3754d..588bd8e82dd4 100644
--- a/ipc/dbus/RawDBusConnection.cpp
+++ b/ipc/dbus/RawDBusConnection.cpp
@@ -5,6 +5,7 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include <dbus/dbus.h>
+#include "base/message_loop.h"
 #include "mozilla/Monitor.h"
 #include "nsThreadUtils.h"
 #include "DBusThread.h"
@@ -34,11 +35,15 @@ using namespace mozilla::ipc;
 namespace mozilla {
 namespace ipc {
 
-class DBusConnectionSendRunnableBase : public nsRunnable
+class DBusConnectionSendTaskBase : public Task
 {
+public:
+  virtual ~DBusConnectionSendTaskBase()
+  { }
+
 protected:
-  DBusConnectionSendRunnableBase(DBusConnection* aConnection,
-                                 DBusMessage* aMessage)
+  DBusConnectionSendTaskBase(DBusConnection* aConnection,
+                             DBusMessage* aMessage)
   : mConnection(aConnection),
     mMessage(aMessage)
   {
@@ -46,9 +51,6 @@ protected:
     MOZ_ASSERT(mMessage);
   }
 
-  virtual ~DBusConnectionSendRunnableBase()
-  { }
-
   DBusConnection*   mConnection;
   DBusMessageRefPtr mMessage;
 };
@@ -57,35 +59,33 @@ protected:
 // Sends a message and returns the message's serial number to the
 // disaptching thread. Only run it in DBus thread.
 //
-class DBusConnectionSendRunnable : public DBusConnectionSendRunnableBase
+class DBusConnectionSendTask : public DBusConnectionSendTaskBase
 {
 public:
-  DBusConnectionSendRunnable(DBusConnection* aConnection,
-                             DBusMessage* aMessage)
-  : DBusConnectionSendRunnableBase(aConnection, aMessage)
+  DBusConnectionSendTask(DBusConnection* aConnection,
+                         DBusMessage* aMessage)
+  : DBusConnectionSendTaskBase(aConnection, aMessage)
   { }
 
-  NS_IMETHOD Run()
+  virtual ~DBusConnectionSendTask()
+  { }
+
+  void Run() MOZ_OVERRIDE
   {
-    MOZ_ASSERT(!NS_IsMainThread());
+    MOZ_ASSERT(MessageLoop::current());
 
-    dbus_bool_t success = dbus_connection_send(mConnection, mMessage, nullptr);
-
-    NS_ENSURE_TRUE(success == TRUE, NS_ERROR_FAILURE);
-
-    return NS_OK;
+    dbus_bool_t success = dbus_connection_send(mConnection,
+                                               mMessage,
+                                               nullptr);
+    NS_ENSURE_TRUE_VOID(success == TRUE);
   }
-
-protected:
-  ~DBusConnectionSendRunnable()
-  { }
 };
 
 //
 // Sends a message and executes a callback function for the reply. Only
 // run it in DBus thread.
 //
-class DBusConnectionSendWithReplyRunnable : public DBusConnectionSendRunnableBase
+class DBusConnectionSendWithReplyTask : public DBusConnectionSendTaskBase
 {
 private:
   class NotifyData
@@ -130,24 +130,27 @@ private:
   }
 
 public:
-  DBusConnectionSendWithReplyRunnable(DBusConnection* aConnection,
-                                      DBusMessage* aMessage,
-                                      int aTimeout,
-                                      DBusReplyCallback aCallback,
-                                      void* aData)
-  : DBusConnectionSendRunnableBase(aConnection, aMessage),
+  DBusConnectionSendWithReplyTask(DBusConnection* aConnection,
+                                  DBusMessage* aMessage,
+                                  int aTimeout,
+                                  DBusReplyCallback aCallback,
+                                  void* aData)
+  : DBusConnectionSendTaskBase(aConnection, aMessage),
     mCallback(aCallback),
     mData(aData),
     mTimeout(aTimeout)
   { }
 
-  NS_IMETHOD Run()
+  virtual ~DBusConnectionSendWithReplyTask()
+  { }
+
+  void Run() MOZ_OVERRIDE
   {
-    MOZ_ASSERT(!NS_IsMainThread());
+    MOZ_ASSERT(MessageLoop::current());
 
     // Freed at end of Notify
     nsAutoPtr<NotifyData> data(new NotifyData(mCallback, mData));
-    NS_ENSURE_TRUE(data, NS_ERROR_OUT_OF_MEMORY);
+    NS_ENSURE_TRUE_VOID(data);
 
     DBusPendingCall* call;
 
@@ -155,21 +158,15 @@ public:
                                                           mMessage,
                                                           &call,
                                                           mTimeout);
-    NS_ENSURE_TRUE(success == TRUE, NS_ERROR_FAILURE);
+    NS_ENSURE_TRUE_VOID(success == TRUE);
 
     success = dbus_pending_call_set_notify(call, Notify, data, nullptr);
-    NS_ENSURE_TRUE(success == TRUE, NS_ERROR_FAILURE);
+    NS_ENSURE_TRUE_VOID(success == TRUE);
 
     data.forget();
     dbus_message_unref(mMessage);
-
-    return NS_OK;
   };
 
-protected:
-  ~DBusConnectionSendWithReplyRunnable()
-  { }
-
 private:
   DBusReplyCallback mCallback;
   void*             mData;
@@ -221,8 +218,8 @@ void RawDBusConnection::ScopedDBusConnectionPtrTraits::release(DBusConnection* p
 
 bool RawDBusConnection::Send(DBusMessage* aMessage)
 {
-  nsRefPtr<DBusConnectionSendRunnable> t(
-    new DBusConnectionSendRunnable(mConnection, aMessage));
+  DBusConnectionSendTask* t =
+    new DBusConnectionSendTask(mConnection, aMessage);
   MOZ_ASSERT(t);
 
   nsresult rv = DispatchToDBusThread(t);
@@ -242,9 +239,9 @@ bool RawDBusConnection::SendWithReply(DBusReplyCallback aCallback,
                                       int aTimeout,
                                       DBusMessage* aMessage)
 {
-  nsRefPtr<nsIRunnable> t(
-    new DBusConnectionSendWithReplyRunnable(mConnection, aMessage,
-                                            aTimeout, aCallback, aData));
+  DBusConnectionSendWithReplyTask* t =
+    new DBusConnectionSendWithReplyTask(mConnection, aMessage, aTimeout,
+                                        aCallback, aData);
   MOZ_ASSERT(t);
 
   nsresult rv = DispatchToDBusThread(t);

From 6c0a7b39d84036f3b4d4013cb6c1eaebec11f543 Mon Sep 17 00:00:00 2001
From: Jim Blandy <jimb@mozilla.com>
Date: Thu, 12 Dec 2013 13:52:35 -0800
Subject: [PATCH 074/459] Bug 948459: Reliably clean up DebugScopes::liveScopes
 when DebugScopeObjects are finalized. r=luke

---
 js/src/vm/ScopeObject.cpp | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index b3a069b1c397..4997f4022e25 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -1600,8 +1600,28 @@ DebugScopes::sweep(JSRuntime *rt)
      * creating an uncollectable cycle with suspended generator frames.
      */
     for (MissingScopeMap::Enum e(missingScopes); !e.empty(); e.popFront()) {
-        if (IsObjectAboutToBeFinalized(e.front().value().unsafeGet()))
+        DebugScopeObject **debugScope = e.front().value().unsafeGet();
+        if (IsObjectAboutToBeFinalized(debugScope)) {
+            /*
+             * Note that onPopCall and onPopBlock rely on missingScopes to find
+             * scope objects that we synthesized for the debugger's sake, and
+             * clean up the synthetic scope objects' entries in liveScopes. So
+             * if we remove an entry frcom missingScopes here, we must also
+             * remove the corresponding liveScopes entry.
+             *
+             * Since the DebugScopeObject is the only thing using its scope
+             * object, and the DSO is about to be finalized, you might assume
+             * that the synthetic SO is also about to be finalized too, and thus
+             * the loop below will take care of things. But complex GC behavior
+             * means that marks are only conservative approximations of
+             * liveness; we should assume that anything could be marked.
+             *
+             * Thus, we must explicitly remove the entries from both liveScopes
+             * and missingScopes here.
+             */
+            liveScopes.remove(&(*debugScope)->scope());
             e.removeFront();
+        }
     }
 
     for (LiveScopeMap::Enum e(liveScopes); !e.empty(); e.popFront()) {

From e3463fe50e31aba1602d0f0d3671b52641665404 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Thu, 12 Dec 2013 14:13:20 -0800
Subject: [PATCH 075/459] Bug 948238 - Read browser.tabs.remote once at startup
 and never again (r=bsmedberg)

---
 accessible/src/windows/msaa/nsWinUtils.cpp    |  2 +-
 browser/base/content/browser.js               |  2 +-
 browser/base/content/tabbrowser.xml           |  4 ++--
 browser/components/nsBrowserGlue.js           |  2 +-
 .../sessionstore/src/SessionStore.jsm         |  2 +-
 browser/metro/base/content/browser.js         |  2 +-
 dom/ipc/ContentParent.cpp                     |  3 ++-
 dom/ipc/TabChild.cpp                          |  5 +++--
 gfx/thebes/gfxPlatform.cpp                    |  3 ++-
 layout/forms/nsListControlFrame.cpp           |  4 ++--
 .../components/satchel/nsFormAutoComplete.js  |  5 ++---
 toolkit/xre/nsAppRunner.cpp                   | 21 +++++++++++++++++++
 widget/xpwidgets/nsBaseWidget.cpp             |  2 +-
 xpcom/system/nsIXULRuntime.idl                | 17 ++++++++++++++-
 14 files changed, 56 insertions(+), 18 deletions(-)

diff --git a/accessible/src/windows/msaa/nsWinUtils.cpp b/accessible/src/windows/msaa/nsWinUtils.cpp
index 86fc214aeb93..c21bf8835c01 100644
--- a/accessible/src/windows/msaa/nsWinUtils.cpp
+++ b/accessible/src/windows/msaa/nsWinUtils.cpp
@@ -58,7 +58,7 @@ nsWinUtils::MaybeStartWindowEmulation()
   // with tabs.
   if (Compatibility::IsJAWS() || Compatibility::IsWE() ||
       Compatibility::IsDolphin() ||
-      Preferences::GetBool("browser.tabs.remote")) {
+      BrowserTabsRemote()) {
     RegisterNativeWindow(kClassNameTabContent);
     sHWNDCache = new nsRefPtrHashtable<nsPtrHashKey<void>, DocAccessible>(4);
     return true;
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 649bb5091852..453e481035ed 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -742,7 +742,7 @@ var gBrowserInit = {
   delayedStartupFinished: false,
 
   onLoad: function() {
-    gMultiProcessBrowser = gPrefService.getBoolPref("browser.tabs.remote");
+    gMultiProcessBrowser = Services.appinfo.browserTabsRemote;
 
     var mustLoadSidebar = false;
 
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 7ca0cd0f28c3..8dab3c672dd3 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -3037,7 +3037,7 @@
               "-moz-default-background-color" :
               Services.prefs.getCharPref("browser.display.background_color");
 
-          if (Services.prefs.getBoolPref("browser.tabs.remote")) {
+          if (Services.appinfo.browserTabsRemote) {
             messageManager.addMessageListener("DOMTitleChanged", this);
             messageManager.addMessageListener("contextmenu", this);
           }
@@ -3103,7 +3103,7 @@
           document.removeEventListener("keypress", this, false);
           window.removeEventListener("sizemodechange", this, false);
 
-          if (Services.prefs.getBoolPref("browser.tabs.remote")) {
+          if (Services.appinfo.browserTabsRemote) {
             messageManager.removeMessageListener("DOMTitleChanged", this);
             messageManager.removeMessageListener("contextmenu", this);
           }
diff --git a/browser/components/nsBrowserGlue.js b/browser/components/nsBrowserGlue.js
index b458b436b41b..f17ce6701b2d 100644
--- a/browser/components/nsBrowserGlue.js
+++ b/browser/components/nsBrowserGlue.js
@@ -481,7 +481,7 @@ BrowserGlue.prototype = {
     SessionStore.init();
     BrowserUITelemetry.init();
 
-    if (Services.prefs.getBoolPref("browser.tabs.remote"))
+    if (Services.appinfo.browserTabsRemote)
       ContentClick.init();
 
     Services.obs.notifyObservers(null, "browser-ui-startup-complete", "");
diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index c809c36b6074..0d6b5aacd262 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -389,7 +389,7 @@ let SessionStoreInternal = {
       throw new Error("SessionStore.init() must only be called once!");
     }
 
-    this._disabledForMultiProcess = Services.prefs.getBoolPref("browser.tabs.remote");
+    this._disabledForMultiProcess = Services.appinfo.browserTabsRemote;
     if (this._disabledForMultiProcess) {
       this._deferredInitialized.resolve();
       return;
diff --git a/browser/metro/base/content/browser.js b/browser/metro/base/content/browser.js
index 073302c581e8..de5315929d34 100644
--- a/browser/metro/base/content/browser.js
+++ b/browser/metro/base/content/browser.js
@@ -1429,7 +1429,7 @@ Tab.prototype = {
 
     browser.setAttribute("type", "content");
 
-    let useRemote = Services.prefs.getBoolPref("browser.tabs.remote");
+    let useRemote = Services.appinfo.browserTabsRemote;
     let useLocal = Util.isLocalScheme(aURI);
     browser.setAttribute("remote", (!useLocal && useRemote) ? "true" : "false");
 
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index ba5c80569a8f..1bda5817ddff 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -79,6 +79,7 @@
 #include "nsISupportsPrimitives.h"
 #include "nsIURIFixup.h"
 #include "nsIWindowWatcher.h"
+#include "nsIXULRuntime.h"
 #include "nsMemoryReporterManager.h"
 #include "nsServiceManagerUtils.h"
 #include "nsStyleSheetService.h"
@@ -3113,7 +3114,7 @@ ContentParent::ShouldContinueFromReplyTimeout()
 {
   // The only time ContentParent sends blocking messages is for CPOWs, so
   // timeouts should only ever occur in electrolysis-enabled sessions.
-  MOZ_ASSERT(Preferences::GetBool("browser.tabs.remote", false));
+  MOZ_ASSERT(BrowserTabsRemote());
   return false;
 }
 
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 2ce740927236..8306641297ff 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -55,6 +55,7 @@
 #include "nsIWebBrowserFocus.h"
 #include "nsIWebBrowserSetup.h"
 #include "nsIWebProgress.h"
+#include "nsIXULRuntime.h"
 #include "nsInterfaceHashtable.h"
 #include "nsPIDOMWindow.h"
 #include "nsPIWindowRoot.h"
@@ -2314,8 +2315,8 @@ TabChild::InitRenderingState()
                                      false);
     }
 
-    // This state can't really change during the lifetime of the child.
-    sCpowsEnabled = Preferences::GetBool("browser.tabs.remote", false);
+    // This state can't change during the lifetime of the child.
+    sCpowsEnabled = BrowserTabsRemote();
     if (Preferences::GetBool("dom.ipc.cpows.force-enabled", false))
       sCpowsEnabled = true;
 
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 69df30cc6475..b563f75429e4 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -85,6 +85,7 @@
 #include "mozilla/Mutex.h"
 
 #include "nsIGfxInfo.h"
+#include "nsIXULRuntime.h"
 
 using namespace mozilla;
 using namespace mozilla::layers;
@@ -2075,7 +2076,7 @@ InitLayersAccelerationPrefs()
     sPrefLayoutFrameRate = Preferences::GetInt("layout.frame_rate", -1);
     sBufferRotationEnabled = Preferences::GetBool("layers.bufferrotation.enabled", true);
     sComponentAlphaEnabled = Preferences::GetBool("layers.componentalpha.enabled", true);
-    sPrefBrowserTabsRemote = Preferences::GetBool("browser.tabs.remote", false);
+    sPrefBrowserTabsRemote = BrowserTabsRemote();
 
 #ifdef XP_WIN
     if (sPrefLayersAccelerationForceEnabled) {
diff --git a/layout/forms/nsListControlFrame.cpp b/layout/forms/nsListControlFrame.cpp
index 99488a81bcec..f5b039c73c2b 100644
--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@@ -16,6 +16,7 @@
 #include "nsIPresShell.h"
 #include "nsEventStateManager.h"
 #include "nsIDOMMouseEvent.h"
+#include "nsIXULRuntime.h"
 #include "nsFontMetrics.h"
 #include "nsIScrollableFrame.h"
 #include "nsCSSRendering.h"
@@ -1806,8 +1807,7 @@ nsListControlFrame::MouseDown(nsIDOMEvent* aMouseEvent)
   } else {
     // NOTE: the combo box is responsible for dropping it down
     if (mComboboxFrame) {
-      if (XRE_GetProcessType() == GeckoProcessType_Content &&
-          Preferences::GetBool("browser.tabs.remote", false)) {
+      if (XRE_GetProcessType() == GeckoProcessType_Content && BrowserTabsRemote()) {
         nsContentUtils::DispatchChromeEvent(mContent->OwnerDoc(), mContent,
                                             NS_LITERAL_STRING("mozshowdropdown"), true,
                                             false);
diff --git a/toolkit/components/satchel/nsFormAutoComplete.js b/toolkit/components/satchel/nsFormAutoComplete.js
index 9fc3447ceb6c..5c454ac2a6e0 100644
--- a/toolkit/components/satchel/nsFormAutoComplete.js
+++ b/toolkit/components/satchel/nsFormAutoComplete.js
@@ -488,9 +488,8 @@ FormAutoCompleteResult.prototype = {
 };
 
 
-if (Services.appinfo.processType == Services.appinfo.PROCESS_TYPE_CONTENT &&
-    Services.prefs.prefHasUserValue("browser.tabs.remote") &&
-    Services.prefs.getBoolPref("browser.tabs.remote")) {
+let remote = Services.appinfo.browserTabsRemote;
+if (Services.appinfo.processType == Services.appinfo.PROCESS_TYPE_CONTENT && remote) {
   // Register the stub FormAutoComplete module in the child which will
   // forward messages to the parent through the process message manager.
   let component = [FormAutoCompleteChild];
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index f5dd1d72496a..d4f9f5cbdb5d 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -789,6 +789,16 @@ nsXULAppInfo::GetProcessType(uint32_t* aResult)
   return NS_OK;
 }
 
+static bool gBrowserTabsRemote = false;
+static bool gBrowserTabsRemoteInitialized = false;
+
+NS_IMETHODIMP
+nsXULAppInfo::GetBrowserTabsRemote(bool* aResult)
+{
+  *aResult = BrowserTabsRemote();
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsXULAppInfo::EnsureContentProcess()
 {
@@ -4368,6 +4378,17 @@ XRE_GetProcessType()
   return mozilla::startup::sChildProcessType;
 }
 
+bool
+mozilla::BrowserTabsRemote()
+{
+  if (!gBrowserTabsRemoteInitialized) {
+    gBrowserTabsRemote = Preferences::GetBool("browser.tabs.remote", false);
+    gBrowserTabsRemoteInitialized = true;
+  }
+
+  return gBrowserTabsRemote;
+}
+
 void
 SetupErrorHandling(const char* progname)
 {
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index 8640e221a71e..1916ced3277d 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -935,7 +935,7 @@ CheckForBasicBackends(nsTArray<LayersBackend>& aHints)
   for (size_t i = 0; i < aHints.Length(); ++i) {
     if (aHints[i] == LAYERS_BASIC &&
         !Preferences::GetBool("layers.offmainthreadcomposition.force-basic", false) &&
-        !Preferences::GetBool("browser.tabs.remote", false)) {
+        !BrowserTabsRemote()) {
       // basic compositor is not stable enough for regular use
       aHints[i] = LAYERS_NONE;
     }
diff --git a/xpcom/system/nsIXULRuntime.idl b/xpcom/system/nsIXULRuntime.idl
index 07466fc070f6..0b8cb5005768 100644
--- a/xpcom/system/nsIXULRuntime.idl
+++ b/xpcom/system/nsIXULRuntime.idl
@@ -4,6 +4,15 @@
 
 #include "nsISupports.idl"
 
+%{C++
+
+namespace mozilla {
+// Simple C++ getter for nsIXULRuntime::browserTabsRemote
+bool BrowserTabsRemote();
+}
+
+%}
+
 /**
  * Provides information about the XUL runtime.
  * @status UNSTABLE - This interface is not frozen and will probably change in
@@ -11,7 +20,7 @@
  *                    stable/frozen, please contact Benjamin Smedberg.
  */
 
-[scriptable, uuid(cb0b8eda-4c83-4d0e-a63c-d3b65714bc85)]
+[scriptable, uuid(33bd1630-611e-11e3-949a-0800200c9a66)]
 interface nsIXULRuntime : nsISupports
 {
   /**
@@ -67,6 +76,12 @@ interface nsIXULRuntime : nsISupports
    */
   readonly attribute unsigned long processType;
 
+  /**
+   * If true, browser tabs may be opened in a different process from the main
+   * browser UI.
+   */
+  readonly attribute boolean browserTabsRemote;
+
   /**
    * Signal the apprunner to invalidate caches on the next restart.
    * This will cause components to be autoregistered and all

From 2ca767aa8888d9c4fd1c6bd82b025deebf101386 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Thu, 12 Dec 2013 14:17:37 -0800
Subject: [PATCH 076/459] Bug 929012 - Annotate on crash reports that content
 processes are turned on (r=bsmedberg)

---
 toolkit/xre/nsAppRunner.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index d4f9f5cbdb5d..c64b4cc17ba2 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -3874,6 +3874,11 @@ XREMain::XRE_mainRun()
   mDirProvider.DoStartup();
 
 #ifdef MOZ_CRASHREPORTER
+  if (BrowserTabsRemote()) {
+    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("DOMIPCEnabled"),
+                                       NS_LITERAL_CSTRING("1"));
+  }
+
   nsCString userAgentLocale;
   if (NS_SUCCEEDED(Preferences::GetCString("general.useragent.locale", &userAgentLocale))) {
     CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("useragent_locale"), userAgentLocale);

From fb15e657d0193d23e0936023a0483344fe15d8d8 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Thu, 12 Dec 2013 14:17:41 -0800
Subject: [PATCH 077/459] Bug 924366 - Animated GIFs shouldn't loop before they
 have finished decoding (r=seth)

---
 image/src/FrameAnimator.cpp | 58 ++++++++++++++++++-------------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/image/src/FrameAnimator.cpp b/image/src/FrameAnimator.cpp
index bb1f720ed27d..2d20bb6efbcc 100644
--- a/image/src/FrameAnimator.cpp
+++ b/image/src/FrameAnimator.cpp
@@ -88,45 +88,45 @@ FrameAnimator::AdvanceFrame(TimeStamp aTime)
   // If we're done decoding, we know we've got everything we're going to get.
   // If we aren't, we only display fully-downloaded frames; everything else
   // gets delayed.
-  bool needToWait = !mDoneDecoding &&
-                    mFrameBlender.RawGetFrame(nextFrameIndex) &&
-                    !mFrameBlender.RawGetFrame(nextFrameIndex)->ImageComplete();
+  bool canDisplay = mDoneDecoding ||
+                    (mFrameBlender.RawGetFrame(nextFrameIndex) &&
+                     mFrameBlender.RawGetFrame(nextFrameIndex)->ImageComplete());
 
-  if (needToWait) {
+  if (!canDisplay) {
     // Uh oh, the frame we want to show is currently being decoded (partial)
     // Wait until the next refresh driver tick and try again
     return ret;
-  } else {
-    // If we're done decoding the next frame, go ahead and display it now and
-    // reinit with the next frame's delay time.
-    if (mFrameBlender.GetNumFrames() == nextFrameIndex) {
-      // End of an animation loop...
+  }
 
-      // If we are not looping forever, initialize the loop counter
-      if (mLoopCounter < 0 && mFrameBlender.GetLoopCount() >= 0) {
-        mLoopCounter = mFrameBlender.GetLoopCount();
-      }
+  // If we're done decoding the next frame, go ahead and display it now and
+  // reinit with the next frame's delay time.
+  if (mFrameBlender.GetNumFrames() == nextFrameIndex) {
+    // End of an animation loop...
 
-      // If animation mode is "loop once", or we're at end of loop counter, it's time to stop animating
-      if (mAnimationMode == imgIContainer::kLoopOnceAnimMode || mLoopCounter == 0) {
-        ret.animationFinished = true;
-      }
-
-      nextFrameIndex = 0;
-
-      if (mLoopCounter > 0) {
-        mLoopCounter--;
-      }
-
-      // If we're done, exit early.
-      if (ret.animationFinished) {
-        return ret;
-      }
+    // If we are not looping forever, initialize the loop counter
+    if (mLoopCounter < 0 && mFrameBlender.GetLoopCount() >= 0) {
+      mLoopCounter = mFrameBlender.GetLoopCount();
     }
 
-    timeout = mFrameBlender.GetTimeoutForFrame(nextFrameIndex);
+    // If animation mode is "loop once", or we're at end of loop counter, it's time to stop animating
+    if (mAnimationMode == imgIContainer::kLoopOnceAnimMode || mLoopCounter == 0) {
+      ret.animationFinished = true;
+    }
+
+    nextFrameIndex = 0;
+
+    if (mLoopCounter > 0) {
+      mLoopCounter--;
+    }
+
+    // If we're done, exit early.
+    if (ret.animationFinished) {
+      return ret;
+    }
   }
 
+  timeout = mFrameBlender.GetTimeoutForFrame(nextFrameIndex);
+
   // Bad data
   if (timeout < 0) {
     ret.animationFinished = true;

From 57737a44011ec8c4817b354994bd83ed75ceefe7 Mon Sep 17 00:00:00 2001
From: Cykesiopka <cykesiopka.bmo@gmail.com>
Date: Thu, 12 Dec 2013 17:36:59 -0500
Subject: [PATCH 078/459] Bug 835150 - Remove fast-package make target and
 references to MOZ_FAST_PACKAGE. r=mshal

---
 CLOBBER                 | 5 +----
 client.mk               | 4 ++--
 mobile/android/build.mk | 3 ---
 3 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/CLOBBER b/CLOBBER
index 67876f8d1244..91acfa9390b2 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -18,7 +18,4 @@
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
 
-Bug 934646 needs a clobber -- the icon resources previously copied
-into $OBJDIR/mobile/android/base/res will conflict with those in
-$BRANDING_DIRECTORY/res.
-
+Bug 887836 - webidl changes require a Windows clobber.
diff --git a/client.mk b/client.mk
index 561a294b1187..49c0a2ae82d6 100644
--- a/client.mk
+++ b/client.mk
@@ -175,7 +175,7 @@ CONFIGURES := $(TOPSRCDIR)/configure
 CONFIGURES += $(TOPSRCDIR)/js/src/configure
 
 # Make targets that are going to be passed to the real build system
-OBJDIR_TARGETS = install export libs clean realclean distclean maybe_clobber_profiledbuild upload sdk installer package fast-package package-compare stage-package source-package l10n-check
+OBJDIR_TARGETS = install export libs clean realclean distclean maybe_clobber_profiledbuild upload sdk installer package package-compare stage-package source-package l10n-check
 
 #######################################################################
 # Rules
@@ -224,7 +224,7 @@ build_all: build
 clobber clobber_all: clean
 
 # helper target for mobile
-build_and_deploy: build fast-package install
+build_and_deploy: build package install
 
 # Do everything from scratch
 everything: clean build
diff --git a/mobile/android/build.mk b/mobile/android/build.mk
index e4069388a349..d983063c3951 100644
--- a/mobile/android/build.mk
+++ b/mobile/android/build.mk
@@ -10,9 +10,6 @@ installer:
 package:
 	@$(MAKE) -C mobile/android/installer
 
-fast-package:
-	@$(MAKE) package MOZ_FAST_PACKAGE=1
-
 ifeq ($(OS_TARGET),Android)
 ifneq ($(MOZ_ANDROID_INSTALL_TARGET),)
 ANDROID_SERIAL = $(MOZ_ANDROID_INSTALL_TARGET)

From 98d5e0c51a0f1d3923edc0e4d28ab1ff001f2d0c Mon Sep 17 00:00:00 2001
From: Douglas Crosher <dtc-moz@scieneer.com>
Date: Thu, 5 Dec 2013 10:44:40 +1100
Subject: [PATCH 079/459] Bug 906964 - ARM: Revert the reservation of some
 head-room in the constant pools as it caused or tickled bug 944972.
 r=mjrosenb

---
 js/src/jit/arm/Assembler-arm.h | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/js/src/jit/arm/Assembler-arm.h b/js/src/jit/arm/Assembler-arm.h
index b535a1fe9825..362d7d183470 100644
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -1299,17 +1299,12 @@ class Assembler
     void initWithAllocator() {
         m_buffer.initWithAllocator();
 
-        // Note that the sizes for the double pools are set to 1020 rather than 1024 to
-        // work around a rare edge case that would otherwise bail out - which is not
-        // possible for Asm.js code and causes a compilation failure.  See the comment at
-        // the fail_bail call within IonAssemberBufferWithConstantPools.h: finishPool().
-
         // Set up the backwards double region
-        new (&pools_[2]) Pool (1020, 8, 4, 8, 8, m_buffer.LifoAlloc_, true);
+        new (&pools_[2]) Pool (1024, 8, 4, 8, 8, m_buffer.LifoAlloc_, true);
         // Set up the backwards 32 bit region
         new (&pools_[3]) Pool (4096, 4, 4, 8, 4, m_buffer.LifoAlloc_, true, true);
         // Set up the forwards double region
-        new (doublePool) Pool (1020, 8, 4, 8, 8, m_buffer.LifoAlloc_, false, false, &pools_[2]);
+        new (doublePool) Pool (1024, 8, 4, 8, 8, m_buffer.LifoAlloc_, false, false, &pools_[2]);
         // Set up the forwards 32 bit region
         new (int32Pool) Pool (4096, 4, 4, 8, 4, m_buffer.LifoAlloc_, false, true, &pools_[3]);
         for (int i = 0; i < 4; i++) {

From 47521f776ec7b3751079afdab6b27784e3b47f98 Mon Sep 17 00:00:00 2001
From: Jan-Ivar Bruaroey <jib@mozilla.com>
Date: Wed, 11 Dec 2013 23:42:12 -0500
Subject: [PATCH 080/459] Bug 908695 - Collect pipelines on main, dispatch to
 STS for stats. r=jesup

---
 .../src/mediapipeline/MediaPipeline.cpp       |   1 +
 .../src/peerconnection/PeerConnectionImpl.cpp | 133 ++++++++++++------
 .../src/peerconnection/PeerConnectionImpl.h   |  26 ++--
 .../peerconnection/PeerConnectionMedia.cpp    |  67 ---------
 .../src/peerconnection/PeerConnectionMedia.h  |  11 +-
 .../signaling/test/signaling_unittests.cpp    |   4 +-
 6 files changed, 119 insertions(+), 123 deletions(-)

diff --git a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
index 400a77519e8c..0cf31c4da5af 100644
--- a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
+++ b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
@@ -50,6 +50,7 @@ namespace mozilla {
 static char kDTLSExporterLabel[] = "EXTRACTOR-dtls_srtp";
 
 MediaPipeline::~MediaPipeline() {
+  ASSERT_ON_THREAD(main_thread_);
   MOZ_ASSERT(!stream_);  // Check that we have shut down already.
   MOZ_MTLOG(ML_INFO, "Destroying MediaPipeline: " << description_);
 }
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
index a360d1b43aa7..fac55f2b0617 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@@ -1191,24 +1191,68 @@ PeerConnectionImpl::GetTimeSinceEpoch(DOMHighResTimeStamp *result) {
   *result = perf->Now() + perf->Timing()->NavigationStart();
   return NS_OK;
 }
+
+class RTCStatsReportInternalConstruct : public RTCStatsReportInternal {
+public:
+  RTCStatsReportInternalConstruct(const nsString &pcid, DOMHighResTimeStamp now) {
+    mPcid = pcid;
+    mInboundRTPStreamStats.Construct();
+    mOutboundRTPStreamStats.Construct();
+    mMediaStreamTrackStats.Construct();
+    mMediaStreamStats.Construct();
+    mTransportStats.Construct();
+    mIceComponentStats.Construct();
+    mIceCandidatePairStats.Construct();
+    mIceCandidateStats.Construct();
+    mCodecStats.Construct();
+  }
+};
+
+// Specialized helper - push map[key] if specified or all map values onto array
+
+static void
+PushBackSelect(std::vector<RefPtr<MediaPipeline>>& aDst,
+               const std::map<TrackID, RefPtr<mozilla::MediaPipeline>> & aSrc,
+               TrackID aKey = 0) {
+  auto begin = aKey ? aSrc.find(aKey) : aSrc.begin(), it = begin;
+  for (auto end = (aKey && begin != aSrc.end())? ++begin : aSrc.end();
+       it != end; ++it) {
+    aDst.push_back(it->second);
+  }
+}
 #endif
 
 NS_IMETHODIMP
-PeerConnectionImpl::GetStats(MediaStreamTrack *aSelector,
-                             bool internalStats) {
+PeerConnectionImpl::GetStats(MediaStreamTrack *aSelector, bool internalStats) {
   PC_AUTO_ENTER_API_CALL(true);
 
 #ifdef MOZILLA_INTERNAL_API
-  uint32_t track = aSelector ? aSelector->GetTrackID() : 0;
+  MOZ_ASSERT(mMedia);
+
+  // Gather up pipelines from mMedia and dispatch them to STS for inspection
+
+  nsAutoPtr<std::vector<RefPtr<MediaPipeline>>> pipelines(
+      new std::vector<RefPtr<MediaPipeline>>());
+  TrackID trackId = aSelector ? aSelector->GetTrackID() : 0;
+
+  for (int i = 0, len = mMedia->LocalStreamsLength(); i < len; i++) {
+    PushBackSelect(*pipelines, mMedia->GetLocalStream(i)->GetPipelines(), trackId);
+  }
+  for (int i = 0, len = mMedia->RemoteStreamsLength(); i < len; i++) {
+    PushBackSelect(*pipelines, mMedia->GetRemoteStream(i)->GetPipelines(), trackId);
+  }
+
   DOMHighResTimeStamp now;
   nsresult rv = GetTimeSinceEpoch(&now);
   NS_ENSURE_SUCCESS(rv, rv);
+
   nsRefPtr<PeerConnectionImpl> pc(this);
   RUN_ON_THREAD(mSTSThread,
                 WrapRunnable(pc,
                              &PeerConnectionImpl::GetStats_s,
-                             track,
+                             trackId,
                              internalStats,
+                             pipelines,
                              now),
                 NS_DISPATCH_NORMAL);
 #endif
@@ -1798,44 +1842,51 @@ PeerConnectionImpl::IceGatheringStateChange_m(PCImplIceGatheringState aState)
 }
 
 #ifdef MOZILLA_INTERNAL_API
-class RTCStatsReportInternalConstruct : public RTCStatsReportInternal {
-public:
-  RTCStatsReportInternalConstruct(const nsString &pcid, DOMHighResTimeStamp now) {
-    mPcid = pcid;
-    mInboundRTPStreamStats.Construct();
-    mOutboundRTPStreamStats.Construct();
-    mMediaStreamTrackStats.Construct();
-    mMediaStreamStats.Construct();
-    mTransportStats.Construct();
-    mIceComponentStats.Construct();
-    mIceCandidatePairStats.Construct();
-    mIceCandidateStats.Construct();
-    mCodecStats.Construct();
-  }
-};
-
-nsresult PeerConnectionImpl::GetStatsImpl_s(
+nsresult
+PeerConnectionImpl::GetStatsImpl_s(
     TrackID trackId,
     bool internalStats,
+    nsAutoPtr<std::vector<RefPtr<MediaPipeline>>> pipelines,
     DOMHighResTimeStamp now,
     RTCStatsReportInternal *report) {
+
+  // Gather stats from pipelines provided (can't touch mMedia + stream on STS)
+
+  for (auto it = pipelines->begin(); it != pipelines->end(); ++it) {
+    const MediaPipeline& mp = **it;
+    nsString idstr = (mp.Conduit()->type() == MediaSessionConduit::AUDIO) ?
+        NS_LITERAL_STRING("audio_") : NS_LITERAL_STRING("video_");
+    idstr.AppendInt(mp.trackid());
+
+    switch (mp.direction()) {
+      case MediaPipeline::TRANSMIT: {
+        RTCOutboundRTPStreamStats s;
+        s.mTimestamp.Construct(now);
+        s.mId.Construct(NS_LITERAL_STRING("outbound_rtp_") + idstr);
+        s.mType.Construct(RTCStatsType::Outboundrtp);
+        // TODO: Get SSRC
+        // int channel = mp.Conduit()->GetChannel();
+        s.mSsrc.Construct(NS_LITERAL_STRING("123457"));
+        s.mPacketsSent.Construct(mp.rtp_packets_sent());
+        s.mBytesSent.Construct(mp.rtp_bytes_sent());
+        report->mOutboundRTPStreamStats.Value().AppendElement(s);
+        break;
+      }
+      case MediaPipeline::RECEIVE: {
+        RTCInboundRTPStreamStats s;
+        s.mTimestamp.Construct(now);
+        s.mId.Construct(NS_LITERAL_STRING("inbound_rtp_") + idstr);
+        s.mType.Construct(RTCStatsType::Inboundrtp);
+        s.mSsrc.Construct(NS_LITERAL_STRING("123457"));
+        s.mPacketsReceived.Construct(mp.rtp_packets_received());
+        s.mBytesReceived.Construct(mp.rtp_bytes_received());
+        report->mInboundRTPStreamStats.Value().AppendElement(s);
+        break;
+      }
+    }
+  }
+
   if (mMedia) {
-    nsresult rv;
-
-    // Gather stats from media pipeline (can't touch stream itself on STS)
-
-    for (int i = 0, len = mMedia->LocalStreamsLength(); i < len; i++) {
-      rv = mMedia->GetLocalStream(i)->GetPipelineStats(now, trackId,
-          &report->mInboundRTPStreamStats.Value(),
-          &report->mOutboundRTPStreamStats.Value());
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-    for (int i = 0, len = mMedia->RemoteStreamsLength(); i < len; i++) {
-      rv = mMedia->GetRemoteStream(i)->GetPipelineStats(now, trackId,
-          &report->mInboundRTPStreamStats.Value(),
-          &report->mOutboundRTPStreamStats.Value());
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
 
     // Gather stats from ICE
 
@@ -1902,27 +1953,29 @@ nsresult PeerConnectionImpl::GetStatsImpl_s(
 void PeerConnectionImpl::GetStats_s(
     TrackID trackId,
     bool internalStats,
+    nsAutoPtr<std::vector<RefPtr<MediaPipeline>>> pipelines,
     DOMHighResTimeStamp now) {
 
   nsAutoPtr<RTCStatsReportInternal> report(new RTCStatsReportInternalConstruct(
       NS_ConvertASCIItoUTF16(mHandle.c_str()), now));
 
-  nsresult rv = report ? GetStatsImpl_s(trackId, internalStats, now, report)
+  nsresult rv = report ? GetStatsImpl_s(trackId, internalStats, pipelines, now,
+                                        report)
                        : NS_ERROR_UNEXPECTED;
 
   nsRefPtr<PeerConnectionImpl> pc(this);
   RUN_ON_THREAD(mThread,
                 WrapRunnable(pc,
                              &PeerConnectionImpl::OnStatsReport_m,
-                             trackId,
                              rv,
+                             pipelines, // return for release on main thread
                              report),
                 NS_DISPATCH_NORMAL);
 }
 
 void PeerConnectionImpl::OnStatsReport_m(
-    TrackID trackId,
     nsresult result,
+    nsAutoPtr<std::vector<RefPtr<MediaPipeline>>> pipelines, //returned for release
     nsAutoPtr<RTCStatsReportInternal> report) {
   nsRefPtr<PeerConnectionObserver> pco = do_QueryObjectReferent(mPCObserver);
   if (pco) {
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
index 2b7186cb4996..334598f130db 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.h
@@ -55,6 +55,7 @@ class NrIceCtx;
 class NrIceMediaStream;
 class NrIceStunServer;
 class NrIceTurnServer;
+class MediaPipeline;
 
 #ifdef USE_FAKE_MEDIA_STREAMS
 typedef Fake_DOMMediaStream DOMMediaStream;
@@ -529,19 +530,24 @@ private:
 
 #ifdef MOZILLA_INTERNAL_API
   // Fills in an RTCStatsReportInternal. Must be run on STS.
-  void GetStats_s(mozilla::TrackID trackId,
-                  bool internalStats,
-                  DOMHighResTimeStamp now);
+  void GetStats_s(
+      mozilla::TrackID trackId,
+      bool internalStats,
+      nsAutoPtr<std::vector<mozilla::RefPtr<mozilla::MediaPipeline>>> pipelines,
+      DOMHighResTimeStamp now);
 
-  nsresult GetStatsImpl_s(mozilla::TrackID trackId,
-                          bool internalStats,
-                          DOMHighResTimeStamp now,
-                          mozilla::dom::RTCStatsReportInternal *report);
+  nsresult GetStatsImpl_s(
+      mozilla::TrackID trackId,
+      bool internalStats,
+      nsAutoPtr<std::vector<mozilla::RefPtr<mozilla::MediaPipeline>>> pipelines,
+      DOMHighResTimeStamp now,
+      mozilla::dom::RTCStatsReportInternal *report);
 
   // Sends an RTCStatsReport to JS. Must run on main thread.
-  void OnStatsReport_m(mozilla::TrackID trackId,
-                       nsresult result,
-                       nsAutoPtr<mozilla::dom::RTCStatsReportInternal> report);
+  void OnStatsReport_m(
+      nsresult result,
+      nsAutoPtr<std::vector<mozilla::RefPtr<mozilla::MediaPipeline>>> pipelines,
+      nsAutoPtr<mozilla::dom::RTCStatsReportInternal> report);
 
   // Fetches logs matching pattern from RLogRingBuffer. Must be run on STS.
   void GetLogging_s(const std::string& pattern);
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
index a3702677eb4a..0e9bc9b06188 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
@@ -452,73 +452,6 @@ PeerConnectionMedia::IceStreamReady(NrIceMediaStream *aStream)
   CSFLogDebug(logTag, "%s: %s", __FUNCTION__, aStream->name().c_str());
 }
 
-// This method exists for the unittests.
-// It allows visibility into the pipelines and flows.
-// It returns nullptr if no pipeline exists for this track number.
-mozilla::RefPtr<mozilla::MediaPipeline>
-SourceStreamInfo::GetPipeline(int aTrack) {
-  std::map<int, mozilla::RefPtr<mozilla::MediaPipeline> >::iterator it =
-    mPipelines.find(aTrack);
-
-  if (it == mPipelines.end()) {
-    return nullptr;
-  }
-
-  return it->second;
-}
-
-// This methods gathers statistics for the getStats API.
-// aTrack == 0 means gather stats for all tracks.
-
-nsresult
-SourceStreamInfo::GetPipelineStats(DOMHighResTimeStamp now, int aTrack,
-                                   Sequence<RTCInboundRTPStreamStats > *inbound,
-                                   Sequence<RTCOutboundRTPStreamStats > *outbound)
-{
-#ifdef MOZILLA_INTERNAL_API
-  ASSERT_ON_THREAD(mParent->GetSTSThread());
-  // walk through all the MediaPipelines and gather stats
-  for (std::map<int, RefPtr<MediaPipeline> >::iterator it = mPipelines.begin();
-       it != mPipelines.end();
-       ++it) {
-    if (!aTrack || aTrack == it->first) {
-      const MediaPipeline &mp = *it->second;
-      nsString idstr = (mp.Conduit()->type() == MediaSessionConduit::AUDIO) ?
-          NS_LITERAL_STRING("audio_") : NS_LITERAL_STRING("video_");
-      idstr.AppendInt(mp.trackid());
-
-      switch (mp.direction()) {
-        case MediaPipeline::TRANSMIT: {
-          RTCOutboundRTPStreamStats s;
-          s.mTimestamp.Construct(now);
-          s.mId.Construct(NS_LITERAL_STRING("outbound_rtp_") + idstr);
-          s.mType.Construct(RTCStatsType::Outboundrtp);
-          // TODO: Get SSRC
-          // int channel = mp.Conduit()->GetChannel();
-          s.mSsrc.Construct(NS_LITERAL_STRING("123457"));
-          s.mPacketsSent.Construct(mp.rtp_packets_sent());
-          s.mBytesSent.Construct(mp.rtp_bytes_sent());
-          outbound->AppendElement(s);
-          break;
-        }
-        case MediaPipeline::RECEIVE: {
-          RTCInboundRTPStreamStats s;
-          s.mTimestamp.Construct(now);
-          s.mId.Construct(NS_LITERAL_STRING("inbound_rtp_") + idstr);
-          s.mType.Construct(RTCStatsType::Inboundrtp);
-          s.mSsrc.Construct(NS_LITERAL_STRING("123457"));
-          s.mPacketsReceived.Construct(mp.rtp_packets_received());
-          s.mBytesReceived.Construct(mp.rtp_bytes_received());
-          inbound->AppendElement(s);
-          break;
-        }
-      }
-    }
-  }
-#endif
-  return NS_OK;
-}
-
 void
 LocalSourceStreamInfo::StorePipeline(int aTrack,
   mozilla::RefPtr<mozilla::MediaPipeline> aPipeline)
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
index ac73618d00e6..0b95de101f83 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h
@@ -184,12 +184,13 @@ public:
     MOZ_ASSERT(mMediaStream);
   }
 
-  mozilla::RefPtr<mozilla::MediaPipeline> GetPipeline(int aTrack);
-  nsresult GetPipelineStats(DOMHighResTimeStamp now, int aTrack,
-    mozilla::dom::Sequence<mozilla::dom::RTCInboundRTPStreamStats > *inbound,
-    mozilla::dom::Sequence<mozilla::dom::RTCOutboundRTPStreamStats > *outbound);
+  // This method exists for stats and the unittests.
+  // It allows visibility into the pipelines and flows.
+  const std::map<mozilla::TrackID, mozilla::RefPtr<mozilla::MediaPipeline>>&
+  GetPipelines() const { return mPipelines; }
+
 protected:
-  std::map<int, mozilla::RefPtr<mozilla::MediaPipeline> > mPipelines;
+  std::map<mozilla::TrackID, mozilla::RefPtr<mozilla::MediaPipeline>> mPipelines;
   nsRefPtr<DOMMediaStream> mMediaStream;
   PeerConnectionMedia *mParent;
 };
diff --git a/media/webrtc/signaling/test/signaling_unittests.cpp b/media/webrtc/signaling/test/signaling_unittests.cpp
index 53f3cd9acd7c..52aee19422e2 100644
--- a/media/webrtc/signaling/test/signaling_unittests.cpp
+++ b/media/webrtc/signaling/test/signaling_unittests.cpp
@@ -1124,7 +1124,9 @@ void CreateAnswer(sipcc::MediaConstraints& constraints, std::string offer,
       return nullptr;
     }
 
-    return streamInfo->GetPipeline(track);
+    const auto &pipelines = streamInfo->GetPipelines();
+    auto it = pipelines.find(track);
+    return (it == pipelines.end())? nullptr : it->second;
   }
 
   void CheckMediaPipeline(int stream, int track, uint32_t flags,

From cf1bd82337a2119145a5c36dea636d9d614a0a5c Mon Sep 17 00:00:00 2001
From: Suhas Nandakumar <snandaku@cisco.com>
Date: Mon, 11 Nov 2013 02:39:54 -0800
Subject: [PATCH 081/459] Bug 934667 - Add preferences to enable loopback
 devices. r=jesup

---
 dom/media/MediaManager.cpp | 58 ++++++++++++++++++++++++++++++--------
 1 file changed, 47 insertions(+), 11 deletions(-)

diff --git a/dom/media/MediaManager.cpp b/dom/media/MediaManager.cpp
index fcbe21e34047..426fa77e89c8 100644
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -662,25 +662,36 @@ template<class SourceType>
 static SourceSet *
   GetSources(MediaEngine *engine,
              const MediaTrackConstraintsInternal &aConstraints,
-             void (MediaEngine::* aEnumerate)(nsTArray<nsRefPtr<SourceType> >*))
+             void (MediaEngine::* aEnumerate)(nsTArray<nsRefPtr<SourceType> >*),
+             char* media_device_name = nullptr)
 {
   const SourceType * const type = nullptr;
-
+  nsString deviceName;
   // First collect sources
   SourceSet candidateSet;
   {
     nsTArray<nsRefPtr<SourceType> > sources;
     (engine->*aEnumerate)(&sources);
-
     /**
       * We're allowing multiple tabs to access the same camera for parity
       * with Chrome.  See bug 811757 for some of the issues surrounding
       * this decision.  To disallow, we'd filter by IsAvailable() as we used
       * to.
       */
-
     for (uint32_t len = sources.Length(), i = 0; i < len; i++) {
-      candidateSet.AppendElement(new MediaDevice(sources[i]));
+#ifdef DEBUG
+      sources[i]->GetName(deviceName);
+      if (media_device_name && strlen(media_device_name) > 0)  {
+        if (deviceName.EqualsASCII(media_device_name)) {
+          candidateSet.AppendElement(new MediaDevice(sources[i]));
+          break;
+        }
+      } else {
+#endif
+        candidateSet.AppendElement(new MediaDevice(sources[i]));
+#ifdef DEBUG
+      }
+#endif
     }
   }
 
@@ -1003,24 +1014,29 @@ public:
     const MediaStreamConstraintsInternal& aConstraints,
     already_AddRefed<nsIGetUserMediaDevicesSuccessCallback> aSuccess,
     already_AddRefed<nsIDOMGetUserMediaErrorCallback> aError,
-    uint64_t aWindowId)
+    uint64_t aWindowId, char* aAudioLoopbackDev, char* aVideoLoopbackDev)
     : mConstraints(aConstraints)
     , mSuccess(aSuccess)
     , mError(aError)
     , mManager(MediaManager::GetInstance())
-    , mWindowId(aWindowId) {}
+    , mWindowId(aWindowId)
+    , mLoopbackAudioDevice(aAudioLoopbackDev)
+    , mLoopbackVideoDevice(aVideoLoopbackDev) {}
 
   NS_IMETHOD
   Run()
   {
     NS_ASSERTION(!NS_IsMainThread(), "Don't call on main thread");
+
     MediaEngine *backend = mManager->GetBackend(mWindowId);
 
     ScopedDeletePtr<SourceSet> final (GetSources(backend, mConstraints.mVideom,
-                                          &MediaEngine::EnumerateVideoDevices));
+                                          &MediaEngine::EnumerateVideoDevices,
+                                          mLoopbackVideoDevice));
     {
       ScopedDeletePtr<SourceSet> s (GetSources(backend, mConstraints.mAudiom,
-                                        &MediaEngine::EnumerateAudioDevices));
+                                        &MediaEngine::EnumerateAudioDevices,
+                                        mLoopbackAudioDevice));
       final->MoveElementsFrom(*s);
     }
     NS_DispatchToMainThread(new DeviceSuccessCallbackRunnable(mSuccess, mError,
@@ -1034,6 +1050,11 @@ private:
   already_AddRefed<nsIDOMGetUserMediaErrorCallback> mError;
   nsRefPtr<MediaManager> mManager;
   uint64_t mWindowId;
+  // Audio & Video loopback devices to be used based on
+  // the preference settings. This is currently used for
+  // automated media tests only.
+  char* mLoopbackAudioDevice;
+  char* mLoopbackVideoDevice;
 };
 
 MediaManager::MediaManager()
@@ -1392,13 +1413,28 @@ MediaManager::GetUserMediaDevices(nsPIDOMWindow* aWindow,
 
   nsCOMPtr<nsIGetUserMediaDevicesSuccessCallback> onSuccess(aOnSuccess);
   nsCOMPtr<nsIDOMGetUserMediaErrorCallback> onError(aOnError);
+  char* loopbackAudioDevice = nullptr;
+  char* loopbackVideoDevice = nullptr;
+  nsresult rv;
+#ifdef DEBUG
+  // Check if the preference for using loopback devices is enabled.
+  nsCOMPtr<nsIPrefService> prefs = do_GetService("@mozilla.org/preferences-service;1", &rv);
+  if (NS_SUCCEEDED(rv)) {
+    nsCOMPtr<nsIPrefBranch> branch = do_QueryInterface(prefs);
+    if (branch) {
+      branch->GetCharPref("media.audio_loopback_dev", &loopbackAudioDevice);
+      branch->GetCharPref("media.video_loopback_dev", &loopbackVideoDevice);
+    }
+  }
+#endif
 
   nsCOMPtr<nsIRunnable> gUMDRunnable = new GetUserMediaDevicesRunnable(
-    aConstraints, onSuccess.forget(), onError.forget(), aWindow->WindowID()
+    aConstraints, onSuccess.forget(), onError.forget(), aWindow->WindowID(),
+    loopbackAudioDevice, loopbackVideoDevice
   );
 
   nsCOMPtr<nsIThread> deviceThread;
-  nsresult rv = NS_NewThread(getter_AddRefs(deviceThread));
+  rv = NS_NewThread(getter_AddRefs(deviceThread));
   NS_ENSURE_SUCCESS(rv, rv);
 
 

From ae39aa6b052692e1c4a711781341f83cec46af93 Mon Sep 17 00:00:00 2001
From: Mike Connor <mconnor@mozilla.com>
Date: Fri, 13 Dec 2013 13:38:29 -0500
Subject: [PATCH 082/459] bug 936198 - update small Yahoo! icon, including on
 MetroFx, r=gavin

--HG--
extra : rebase_source : 770893767db1836b13e5cf4bd0904b402ce0d15b
---
 browser/locales/en-US/searchplugins/yahoo.xml        | 2 +-
 browser/locales/en-US/searchplugins/yahoometrofx.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/browser/locales/en-US/searchplugins/yahoo.xml b/browser/locales/en-US/searchplugins/yahoo.xml
index 353938f6de62..d80b70e96c00 100644
--- a/browser/locales/en-US/searchplugins/yahoo.xml
+++ b/browser/locales/en-US/searchplugins/yahoo.xml
@@ -6,7 +6,7 @@
 <ShortName>Yahoo</ShortName>
 <Description>Yahoo Search</Description>
 <InputEncoding>UTF-8</InputEncoding>
-<Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAAAAAANAQAAJgAAACAgAAAAAAAA/AMAADMBAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAADUSURBVDjLY2AYPmBPzZn/65L2/W8SmoeClwXt+g+SQ1ZbxTTrPwzDNaNrRMYghciGoBgA03xv37P/MABiT9Jb9x9ZIbIhMP48p03/GUBOhNkE8gIIgBSCFPz++QeMX11697+MqQtsKLIBYAPRnXtu3i2wJpDBIBqkCKQ5iykPTIMMgLkOqwEgDLIR5hKQRhiGBRrI6fAARPYCDIM0ggCyZhCGeQHkVRibAeZfGAYFILLfYa5AjwmMNIBuG7rT0aMRHAPYElKf0jK4RlwJCaQG7oWhDwAW40nUCGVbdgAAAABJRU5ErkJggolQTkcNChoKAAAADUlIRFIAAAAgAAAAIAgGAAAAc3p69AAAA8NJREFUWMPtVmtsDFEU3j+IR7s7d4SISEMi6pUQ/CIRjyAVhBDxChJtvRptbXdn1iMtjbfW7s7caQmNRxVRVLWVVCtCEQklS6mttI3Eo+GPCvHKce5sdzqdndn10489ycnMnLn33O9+59xzrs0Wl7jE5X+X7Q4pyc3R+QJPRZHQPA+Rc5mKnJwuEt8Yp+1w/1g+xAR/sofQXzj/ucjTUoGXdwicvEKwKzOtJzmUNTih1sMrEE1ForQzYC5eHm3lS3AoE03nE9oWOZijGxHl+1gLW4A5n2Ur6Gv06UqgoywAnOi5a0LLQ44oCKhuImvKvpk9Jgiefs1J9I7ssSk7HWEC9qmbKHO1QYjmUrcTBXKIBE7ih+3Ep6qbger6J8Zm4rdzgDIo7Ntp9w83GVPksh1MCCEk8nJmxCfkJ5VAU9Ub+Nz2BdofvYNgfTs01bTCi+pWeFAcUEFkcV7I5I5pyr4ZSEHHEDLxKAwgiy8YGsmUvCREOyelsOwMU7978HE4tagCrm67A3opT70NxyZdhG1cIRRNvwJV7ga4nF4H5RvroNrTALV7HsLR8aXqJsKLuDl5msawAUCGzdeni3rlSk9qqLqrVMdBKBhbpgEIXAui7QCkoZ6YXQHPLge1f50d3yBwvQUOJZ/FUEk6X7LXFIA++/GjySyOLPE2OQ5BSUqlttBN4T6sTdwL6+z7oFpoUG2VOXchG0OQ4Tiq5okhIZ+YAUC7pM/85+bZHErENPt+qMy6p4E4vaAGGsua1XcWCgbSieNE8xMRNAMg8NLibgZ4+soqm1lSZWNybXUcgUBFiwbi+5cfcGD4GdiMdhcyJVqeBvrMDACrrt0M8LTS+kwruIAE6Rh374RLGoALq2phvT1f3bkQ/TgWGQGg7a2h5NKFuNBLKycsDBswDIW6hCyZdwNWJ+5R2YlaE+zSrAgGCK2OrPs8XWtBIewaeBz2J5+GKqE7D+56G6E45SocHn3OsjqiPaBfgxUm1tSMVTJqKBjFvikX4WPTJ+ho/gzNt9rhNRamV7Vt0Hb/HZSurFFPixmAbCIP03qB3T/ZwynjevQHrIJptrRepr1ArzsHFkPekJNqrMNlOSdK4iHFfzCs0w2bC+obFmvHrPRj0ZoTyQShmWah0Dcny8ZE6A0xQeL1/pbZcnsbfBX+00UELxwuHPwQEf+M0Xha8YJykl1OzPxkEF8iMlCPx72zqzou/ScArFZ7HPIMVk5x4mN00oG0fwgp/Yi2Fnyewf+pmf0Kh0TfjH+qh6NbRI76jLkQl7jE5S+qIPrIdKZBVAAAAABJRU5ErkJggg==</Image>
+<Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAEACAA8DQAAJgAAACAgAAABAAgAowsAAGINAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAAAJcEhZcwAACxMAAAsTAQCanBgAAApPaUNDUFBob3Rvc2hvcCBJQ0MgcHJvZmlsZQAAeNqdU2dUU+kWPffe9EJLiICUS29SFQggUkKLgBSRJiohCRBKiCGh2RVRwRFFRQQbyKCIA46OgIwVUSwMigrYB+Qhoo6Do4iKyvvhe6Nr1rz35s3+tdc+56zznbPPB8AIDJZIM1E1gAypQh4R4IPHxMbh5C5AgQokcAAQCLNkIXP9IwEA+H48PCsiwAe+AAF40wsIAMBNm8AwHIf/D+pCmVwBgIQBwHSROEsIgBQAQHqOQqYAQEYBgJ2YJlMAoAQAYMtjYuMAUC0AYCd/5tMAgJ34mXsBAFuUIRUBoJEAIBNliEQAaDsArM9WikUAWDAAFGZLxDkA2C0AMElXZkgAsLcAwM4QC7IACAwAMFGIhSkABHsAYMgjI3gAhJkAFEbyVzzxK64Q5yoAAHiZsjy5JDlFgVsILXEHV1cuHijOSRcrFDZhAmGaQC7CeZkZMoE0D+DzzAAAoJEVEeCD8/14zg6uzs42jrYOXy3qvwb/ImJi4/7lz6twQAAA4XR+0f4sL7MagDsGgG3+oiXuBGheC6B194tmsg9AtQCg6dpX83D4fjw8RaGQudnZ5eTk2ErEQlthyld9/mfCX8BX/Wz5fjz89/XgvuIkgTJdgUcE+ODCzPRMpRzPkgmEYtzmj0f8twv//B3TIsRJYrlYKhTjURJxjkSajPMypSKJQpIpxSXS/2Ti3yz7Az7fNQCwaj4Be5EtqF1jA/ZLJxBYdMDi9wAA8rtvwdQoCAOAaIPhz3f/7z/9R6AlAIBmSZJxAABeRCQuVMqzP8cIAABEoIEqsEEb9MEYLMAGHMEF3MEL/GA2hEIkxMJCEEIKZIAccmAprIJCKIbNsB0qYC/UQB00wFFohpNwDi7CVbgOPXAP+mEInsEovIEJBEHICBNhIdqIAWKKWCOOCBeZhfghwUgEEoskIMmIFFEiS5E1SDFSilQgVUgd8j1yAjmHXEa6kTvIADKC/Ia8RzGUgbJRPdQMtUO5qDcahEaiC9BkdDGajxagm9BytBo9jDah59CraA/ajz5DxzDA6BgHM8RsMC7Gw0KxOCwJk2PLsSKsDKvGGrBWrAO7ifVjz7F3BBKBRcAJNgR3QiBhHkFIWExYTthIqCAcJDQR2gk3CQOEUcInIpOoS7QmuhH5xBhiMjGHWEgsI9YSjxMvEHuIQ8Q3JBKJQzInuZACSbGkVNIS0kbSblIj6SypmzRIGiOTydpka7IHOZQsICvIheSd5MPkM+Qb5CHyWwqdYkBxpPhT4ihSympKGeUQ5TTlBmWYMkFVo5pS3aihVBE1j1pCraG2Uq9Rh6gTNHWaOc2DFklLpa2ildMaaBdo92mv6HS6Ed2VHk6X0FfSy+lH6JfoA/R3DA2GFYPHiGcoGZsYBxhnGXcYr5hMphnTixnHVDA3MeuY55kPmW9VWCq2KnwVkcoKlUqVJpUbKi9Uqaqmqt6qC1XzVctUj6leU32uRlUzU+OpCdSWq1WqnVDrUxtTZ6k7qIeqZ6hvVD+kfln9iQZZw0zDT0OkUaCxX+O8xiALYxmzeCwhaw2rhnWBNcQmsc3ZfHYqu5j9HbuLPaqpoTlDM0ozV7NS85RmPwfjmHH4nHROCecop5fzforeFO8p4ikbpjRMuTFlXGuqlpeWWKtIq1GrR+u9Nq7tp52mvUW7WfuBDkHHSidcJ0dnj84FnedT2VPdpwqnFk09OvWuLqprpRuhu0R3v26n7pievl6Ankxvp955vef6HH0v/VT9bfqn9UcMWAazDCQG2wzOGDzFNXFvPB0vx9vxUUNdw0BDpWGVYZfhhJG50Tyj1UaNRg+MacZc4yTjbcZtxqMmBiYhJktN6k3umlJNuaYppjtMO0zHzczNos3WmTWbPTHXMueb55vXm9+3YFp4Wiy2qLa4ZUmy5FqmWe62vG6FWjlZpVhVWl2zRq2drSXWu627pxGnuU6TTque1mfDsPG2ybaptxmw5dgG2662bbZ9YWdiF2e3xa7D7pO9k326fY39PQcNh9kOqx1aHX5ztHIUOlY63prOnO4/fcX0lukvZ1jPEM/YM+O2E8spxGmdU5vTR2cXZ7lzg/OIi4lLgssulz4umxvG3ci95Ep09XFd4XrS9Z2bs5vC7ajbr+427mnuh9yfzDSfKZ5ZM3PQw8hD4FHl0T8Ln5Uwa9+sfk9DT4FntecjL2MvkVet17C3pXeq92HvFz72PnKf4z7jPDfeMt5ZX8w3wLfIt8tPw2+eX4XfQ38j/2T/ev/RAKeAJQFnA4mBQYFbAvv4enwhv44/Ottl9rLZ7UGMoLlBFUGPgq2C5cGtIWjI7JCtIffnmM6RzmkOhVB+6NbQB2HmYYvDfgwnhYeFV4Y/jnCIWBrRMZc1d9HcQ3PfRPpElkTem2cxTzmvLUo1Kj6qLmo82je6NLo/xi5mWczVWJ1YSWxLHDkuKq42bmy+3/zt84fineIL43sXmC/IXXB5oc7C9IWnFqkuEiw6lkBMiE44lPBBECqoFowl8hN3JY4KecIdwmciL9E20YjYQ1wqHk7ySCpNepLskbw1eSTFM6Us5bmEJ6mQvEwNTN2bOp4WmnYgbTI9Or0xg5KRkHFCqiFNk7Zn6mfmZnbLrGWFsv7Fbou3Lx6VB8lrs5CsBVktCrZCpuhUWijXKgeyZ2VXZr/Nico5lqueK83tzLPK25A3nO+f/+0SwhLhkralhktXLR1Y5r2sajmyPHF52wrjFQUrhlYGrDy4irYqbdVPq+1Xl65+vSZ6TWuBXsHKgsG1AWvrC1UK5YV969zX7V1PWC9Z37Vh+oadGz4ViYquFNsXlxV/2CjceOUbh2/Kv5nclLSpq8S5ZM9m0mbp5t4tnlsOlqqX5pcObg3Z2rQN31a07fX2Rdsvl80o27uDtkO5o788uLxlp8nOzTs/VKRU9FT6VDbu0t21Ydf4btHuG3u89jTs1dtbvPf9Psm+21UBVU3VZtVl+0n7s/c/romq6fiW+21drU5tce3HA9ID/QcjDrbXudTVHdI9VFKP1ivrRw7HH77+ne93LQ02DVWNnMbiI3BEeeTp9wnf9x4NOtp2jHus4QfTH3YdZx0vakKa8ppGm1Oa+1tiW7pPzD7R1ureevxH2x8PnDQ8WXlK81TJadrpgtOTZ/LPjJ2VnX1+LvncYNuitnvnY87fag9v77oQdOHSRf+L5zu8O85c8rh08rLb5RNXuFearzpfbep06jz+k9NPx7ucu5quuVxrue56vbV7ZvfpG543zt30vXnxFv/W1Z45Pd2983pv98X39d8W3X5yJ/3Oy7vZdyfurbxPvF/0QO1B2UPdh9U/W/7c2O/cf2rAd6Dz0dxH9waFg8/+kfWPD0MFj5mPy4YNhuueOD45OeI/cv3p/KdDz2TPJp4X/qL+y64XFi9++NXr187RmNGhl/KXk79tfKX96sDrGa/bxsLGHr7JeDMxXvRW++3Bd9x3He+j3w9P5Hwgfyj/aPmx9VPQp/uTGZOT/wQDmPP8YzMt2wAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAACZ0lEQVR42mzSP4icZRTF4ee+38xOkp2sG5cQxVJIIaaKkICxTkqJjQhpJFYiop2F1YKFQqoUVpEoCBYSS7dfOxVFWGIsokUE/0TEye7OzPe977XYNWk83b0cDoffvXHWGxkKYjt0N1fi+FaJIzNIFSJ0kDXn0z5nF1O9Sp5PzaizamLD2NELo5W4sOwXqqX/04o1R2wg9PYs/GXUmTjqpGNxwvWdFzz19Akvjj+XUkYTggylFLfml93due+tZ7+y577BrkJnbNWke8yHmzvgi/4lq+WU1XjCsThl2p1ya3GZ4KNrt03KuhXH0SkkkbTOL5+u2PnuZ/D8axtGMTaKsbOvrINP3v/W3Y9XhCJjQCrUWRedVpaq3nvn7oHXrz8jD8PfvnEGbL0716LXytIoxqizkups4R/VwhB7hpi7sXkbXNo86bkrazK5sXnbEHND7BvMLcykOotz3vlxvZw+faRb08VEiVC64rPdSw/pZ/Ly9EutNi3TkHOLOvN3u3OnHNx7MFio5qq5Ifdce/WHhwEfXPnekPuq/UPPQhrAKOV0MFdyRFQFRefr7Z9wRrb0zfYd1aCpGmr2BvtSTkcp1wZLnX0tx4oQjeHX+UF97P75QGspM7VMqTfopVwb0aY1F4ZWlFK1SCVDHQKUEvphj0ztkEdrvZoLtOkoNS2XlkHJIlroIky7Jw8atDSJdQ/aPTUdtJBaLqVmlJpqQataCZKhY/L4HwcEI/Qbv1v8tivbIdVG1UtNnPVmFmPEoT9l/Dc9Ujp42Mx4uGl6I5pmgdjGzaLbopsdJqZHWZnqtKkXcZU8D/8OAPAMQ4kD8KK1AAAAAElFTkSuQmCCiVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEJGlDQ1BJQ0MgUHJvZmlsZQAAOBGFVd9v21QUPolvUqQWPyBYR4eKxa9VU1u5GxqtxgZJk6XtShal6dgqJOQ6N4mpGwfb6baqT3uBNwb8AUDZAw9IPCENBmJ72fbAtElThyqqSUh76MQPISbtBVXhu3ZiJ1PEXPX6yznfOec7517bRD1fabWaGVWIlquunc8klZOnFpSeTYrSs9RLA9Sr6U4tkcvNEi7BFffO6+EdigjL7ZHu/k72I796i9zRiSJPwG4VHX0Z+AxRzNRrtksUvwf7+Gm3BtzzHPDTNgQCqwKXfZwSeNHHJz1OIT8JjtAq6xWtCLwGPLzYZi+3YV8DGMiT4VVuG7oiZpGzrZJhcs/hL49xtzH/Dy6bdfTsXYNY+5yluWO4D4neK/ZUvok/17X0HPBLsF+vuUlhfwX4j/rSfAJ4H1H0qZJ9dN7nR19frRTeBt4Fe9FwpwtN+2p1MXscGLHR9SXrmMgjONd1ZxKzpBeA71b4tNhj6JGoyFNp4GHgwUp9qplfmnFW5oTdy7NamcwCI49kv6fN5IAHgD+0rbyoBc3SOjczohbyS1drbq6pQdqumllRC/0ymTtej8gpbbuVwpQfyw66dqEZyxZKxtHpJn+tZnpnEdrYBbueF9qQn93S7HQGGHnYP7w6L+YGHNtd1FJitqPAR+hERCNOFi1i1alKO6RQnjKUxL1GNjwlMsiEhcPLYTEiT9ISbN15OY/jx4SMshe9LaJRpTvHr3C/ybFYP1PZAfwfYrPsMBtnE6SwN9ib7AhLwTrBDgUKcm06FSrTfSj187xPdVQWOk5Q8vxAfSiIUc7Z7xr6zY/+hpqwSyv0I0/QMTRb7RMgBxNodTfSPqdraz/sDjzKBrv4zu2+a2t0/HHzjd2Lbcc2sG7GtsL42K+xLfxtUgI7YHqKlqHK8HbCCXgjHT1cAdMlDetv4FnQ2lLasaOl6vmB0CMmwT/IPszSueHQqv6i/qluqF+oF9TfO2qEGTumJH0qfSv9KH0nfS/9TIp0Wboi/SRdlb6RLgU5u++9nyXYe69fYRPdil1o1WufNSdTTsp75BfllPy8/LI8G7AUuV8ek6fkvfDsCfbNDP0dvRh0CrNqTbV7LfEEGDQPJQadBtfGVMWEq3QWWdufk6ZSNsjG2PQjp3ZcnOWWing6noonSInvi0/Ex+IzAreevPhe+CawpgP1/pMTMDo64G0sTCXIM+KdOnFWRfQKdJvQzV1+Bt8OokmrdtY2yhVX2a+qrykJfMq4Ml3VR4cVzTQVz+UoNne4vcKLoyS+gyKO6EHe+75Fdt0Mbe5bRIf/wjvrVmhbqBN97RD1vxrahvBOfOYzoosH9bq94uejSOQGkVM6sN/7HelL4t10t9F4gPdVzydEOx83Gv+uNxo7XyL/FtFl8z9ZAHF4bBsrEwAAAAlwSFlzAAALEwAACxMBAJqcGAAAByVJREFUWAm1l1uIldcVx9d3ruMZZzRaay+pCjFJH6LSRqxQqA1NH0pBiH3Qp774kEAg4EOkxKdQSCjUFvpm6YsNVNoSaGjFtmga2yZgCIIawdv04g2kM7Uz6lzO+c758v/t/9lzTB/61Oxhn7332muv9V+3vb8pnooDVRkzZ4oY/LmK6mQZa05frX6yFJ9Ae7x4qd2IuV1FFM9WMfhaI9Z+pQBAL+aiEZ0QgNBm2YuZmxHF9VZMXqmivFaLweUyuteWYvHGVPWr2f+F7YvF/ola9DZGVJsHUXs8YvBEK1ZrXt9URDwqxY1BdGMQvWjGqkgA+iLUtazHuADUoowHYugKTilaR7SIpZjWqOMRfY090RbasS4JglpFtzWIcqwZa+pSqnWVcLLXijXpZCFpvbgb/VhMe8huMLPylWkci8/oSD8xJq7hj4WUWvXrlbqVrUyKtBYdpX3Bh9YbzsdErwRgbZKyFP+KdqxPssu4l2hDAOOxIj6bCHigKWRNCcpMCHHHB4TJLc+TXxKHnC51Ct+Qgxl/TZ0qE5Be/EdWTwjqQuJJAPIB8qAZk4kZoXJnvHH+27Hq0+0YX12PH+w7E3/8zbWkitN2M8pS7kCKZ761OV55c2fcm+nG7J1e7N/+e3m2nbyKQcAhnHWZLC86B1rxiFRvSIkIgJHFVWzZ+qk4fG5HEr4wV8buVb+Vuv5QeVZsi/HeW//eHZ1HbNfLT5+Jc2dndBav9KXugfqc+pLsv6Xxvk6kVheumnpDnXlTVMZWfHh+Li6cdOKvmGzEC69+WTskzwr1SfUJ9ZWp7z/0pWXlF9+ejQtnUdCWnAxQ+al5Tdz80lIVEP8x9eZQWCQwOTAhNc34Re+rUW8U0S+r2Ns8nWzBKgONBOeX3V3RaCpPRN7XeFcO7yYl+InML2U3VdBVHszHzbSXYLBJkuTSQzBuphoYZ7X/u8O30gFAHHxzi+Yop8ETcfDXW5JyKMd/fFuO9l3mYuwLAl5gbMg8QuKdYQg4Zjcxo7HikMeIn37vcizes9Ide9bGhs9NLPN9YX0ndnzHpbZ4vx9HXr6kc6Sobo2hIkuzOnIh0xMFRlvc0waWL+p3UePCQ/Myjjx/JSnl59CJbUkJgl75g+ZD/D978Yrc7EuMPe4ESo6OYsaasiiX7tADAyny5cGtyMHsDxzFnP0Tx6Z0SfsW27B1PHZ+c13seGZdbNo2Lo6Iu7e7cfznfxc/8ggNQBhZI9dSs2c5k+rFaHBXmZhd32xTGdlZPvzDvefj9XddlgeObYVpuf1o3zkpyrEnCJwBDjlmr9i7XP3jgrYkDamhEqRA8UOBxZ53tcOtBbgyzr53M65f8DU6sVZ1o067cfFBvP+XGzrDOa5s+JkTShIc+dBtlLOLlRpqAUDc+yqQMnViNq81edDVnPixno/vP/dXjn2svbbnPa1RiqXEHVkYQ06RWygnFEtpbZDLAJws2X1OHgfCv+hiRkZU8Y+pmbjwzjTE1D48PR1TV+5IMErgsjex2A8TJrqCHH9Cw6U0BGBkPUWrKTZnPq4L9WqIOFvEO8ml+vbRvyUB/Jw6OiUa9GydM58qQl6lTrNHyiENrwyTkOvXLziVkMlOOsesVKyIFtZB1zfDAGvdyj4xtkD7yHQ8Ynn4hCrwvYA+DOJCSlXAZl3MjNQobNzVPK7gJm0AiPsQyEg0c6s1cbEB5X08AmDz1TTLucApzHHyJgADvUqVysJMKOSicLRQl+emOIvbnaw+ot2pSTzl5zzJVjPaZ6ix7zCSN4E1shOAWnqbyYH8bOqd1h9AGJ0qtl6LRBubcBKxbo6xh60kWlbLjgG4NJ2ETkwqbl7SeUXVSCq+BF1C2bWEgEO4CxBGvOydGmu3ooXv7AEogLFqn2JtWKO8yc9xAmDxjhGiWMOQXe63zCvHtIjOpGOIwvGJlhRQepyzaiu0MQ4MnFhuT7CiJQC+sUg4jtOYO+1IH9OdCwgBSmOkP2r60CarHeXMjxw3PGyvOBnN670EgOPOc1yEYgDYCxbqTPDXki1srChi4R6lpQ+uDmVFDtkA5GH1qJEvQFgacqCFT37pyP+Y+DMJs0Y54NgbiIVn61jhEUrNARuNIi3vOQf8iUeQuNzILe4b/jFZ7RDYJhTbVRaJTxyWh8PgO93hQJCBsSa2GQyyoLlBzWDxgnm9l0JgADgNgVxElCH22xs4NCsaieSUyzWXaSTLDAPlGQB0Kt6JaqpzYjkJQT9id60aNwqZjVqlz9Kqp+JcfDjOAqhirNoCI6MelpVPAjZ/CbFv45Y9YNcicqDMKm/Xo/FPJdMlqZ9SIK7qSrrci9mbl6q3/DGQ5f7XuK347rgKeuMgiicEfLPmT0rGY1K5SdI/ryritlMbJrr/PZ8+I8qf9PF8qhMrT39QHfHLkhj/fz/bi+eb83F/VxX1b6jWvt6KdTs/AvvCmqXE235jAAAAAElFTkSuQmCC</Image>
 <Url type="application/x-suggestions+json" method="GET"
      template="http://ff.search.yahoo.com/gossip?output=fxjson&amp;command={searchTerms}" />
 <Url type="text/html" method="GET" template="http://search.yahoo.com/search">
diff --git a/browser/locales/en-US/searchplugins/yahoometrofx.xml b/browser/locales/en-US/searchplugins/yahoometrofx.xml
index 24eb8039bf56..f0d6fac71352 100644
--- a/browser/locales/en-US/searchplugins/yahoometrofx.xml
+++ b/browser/locales/en-US/searchplugins/yahoometrofx.xml
@@ -6,7 +6,7 @@
 <ShortName>Yahoo</ShortName>
 <Description>Yahoo Search</Description>
 <InputEncoding>UTF-8</InputEncoding>
-<Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAAAAAANAQAAJgAAACAgAAAAAAAA/AMAADMBAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAADUSURBVDjLY2AYPmBPzZn/65L2/W8SmoeClwXt+g+SQ1ZbxTTrPwzDNaNrRMYghciGoBgA03xv37P/MABiT9Jb9x9ZIbIhMP48p03/GUBOhNkE8gIIgBSCFPz++QeMX11697+MqQtsKLIBYAPRnXtu3i2wJpDBIBqkCKQ5iykPTIMMgLkOqwEgDLIR5hKQRhiGBRrI6fAARPYCDIM0ggCyZhCGeQHkVRibAeZfGAYFILLfYa5AjwmMNIBuG7rT0aMRHAPYElKf0jK4RlwJCaQG7oWhDwAW40nUCGVbdgAAAABJRU5ErkJggolQTkcNChoKAAAADUlIRFIAAAAgAAAAIAgGAAAAc3p69AAAA8NJREFUWMPtVmtsDFEU3j+IR7s7d4SISEMi6pUQ/CIRjyAVhBDxChJtvRptbXdn1iMtjbfW7s7caQmNRxVRVLWVVCtCEQklS6mttI3Eo+GPCvHKce5sdzqdndn10489ycnMnLn33O9+59xzrs0Wl7jE5X+X7Q4pyc3R+QJPRZHQPA+Rc5mKnJwuEt8Yp+1w/1g+xAR/sofQXzj/ucjTUoGXdwicvEKwKzOtJzmUNTih1sMrEE1ForQzYC5eHm3lS3AoE03nE9oWOZijGxHl+1gLW4A5n2Ur6Gv06UqgoywAnOi5a0LLQ44oCKhuImvKvpk9Jgiefs1J9I7ssSk7HWEC9qmbKHO1QYjmUrcTBXKIBE7ih+3Ep6qbger6J8Zm4rdzgDIo7Ntp9w83GVPksh1MCCEk8nJmxCfkJ5VAU9Ub+Nz2BdofvYNgfTs01bTCi+pWeFAcUEFkcV7I5I5pyr4ZSEHHEDLxKAwgiy8YGsmUvCREOyelsOwMU7978HE4tagCrm67A3opT70NxyZdhG1cIRRNvwJV7ga4nF4H5RvroNrTALV7HsLR8aXqJsKLuDl5msawAUCGzdeni3rlSk9qqLqrVMdBKBhbpgEIXAui7QCkoZ6YXQHPLge1f50d3yBwvQUOJZ/FUEk6X7LXFIA++/GjySyOLPE2OQ5BSUqlttBN4T6sTdwL6+z7oFpoUG2VOXchG0OQ4Tiq5okhIZ+YAUC7pM/85+bZHErENPt+qMy6p4E4vaAGGsua1XcWCgbSieNE8xMRNAMg8NLibgZ4+soqm1lSZWNybXUcgUBFiwbi+5cfcGD4GdiMdhcyJVqeBvrMDACrrt0M8LTS+kwruIAE6Rh374RLGoALq2phvT1f3bkQ/TgWGQGg7a2h5NKFuNBLKycsDBswDIW6hCyZdwNWJ+5R2YlaE+zSrAgGCK2OrPs8XWtBIewaeBz2J5+GKqE7D+56G6E45SocHn3OsjqiPaBfgxUm1tSMVTJqKBjFvikX4WPTJ+ho/gzNt9rhNRamV7Vt0Hb/HZSurFFPixmAbCIP03qB3T/ZwynjevQHrIJptrRepr1ArzsHFkPekJNqrMNlOSdK4iHFfzCs0w2bC+obFmvHrPRj0ZoTyQShmWah0Dcny8ZE6A0xQeL1/pbZcnsbfBX+00UELxwuHPwQEf+M0Xha8YJykl1OzPxkEF8iMlCPx72zqzou/ScArFZ7HPIMVk5x4mN00oG0fwgp/Yi2Fnyewf+pmf0Kh0TfjH+qh6NbRI76jLkQl7jE5S+qIPrIdKZBVAAAAABJRU5ErkJggg==</Image>
+<Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAEACAA8DQAAJgAAACAgAAABAAgAowsAAGINAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAAAJcEhZcwAACxMAAAsTAQCanBgAAApPaUNDUFBob3Rvc2hvcCBJQ0MgcHJvZmlsZQAAeNqdU2dUU+kWPffe9EJLiICUS29SFQggUkKLgBSRJiohCRBKiCGh2RVRwRFFRQQbyKCIA46OgIwVUSwMigrYB+Qhoo6Do4iKyvvhe6Nr1rz35s3+tdc+56zznbPPB8AIDJZIM1E1gAypQh4R4IPHxMbh5C5AgQokcAAQCLNkIXP9IwEA+H48PCsiwAe+AAF40wsIAMBNm8AwHIf/D+pCmVwBgIQBwHSROEsIgBQAQHqOQqYAQEYBgJ2YJlMAoAQAYMtjYuMAUC0AYCd/5tMAgJ34mXsBAFuUIRUBoJEAIBNliEQAaDsArM9WikUAWDAAFGZLxDkA2C0AMElXZkgAsLcAwM4QC7IACAwAMFGIhSkABHsAYMgjI3gAhJkAFEbyVzzxK64Q5yoAAHiZsjy5JDlFgVsILXEHV1cuHijOSRcrFDZhAmGaQC7CeZkZMoE0D+DzzAAAoJEVEeCD8/14zg6uzs42jrYOXy3qvwb/ImJi4/7lz6twQAAA4XR+0f4sL7MagDsGgG3+oiXuBGheC6B194tmsg9AtQCg6dpX83D4fjw8RaGQudnZ5eTk2ErEQlthyld9/mfCX8BX/Wz5fjz89/XgvuIkgTJdgUcE+ODCzPRMpRzPkgmEYtzmj0f8twv//B3TIsRJYrlYKhTjURJxjkSajPMypSKJQpIpxSXS/2Ti3yz7Az7fNQCwaj4Be5EtqF1jA/ZLJxBYdMDi9wAA8rtvwdQoCAOAaIPhz3f/7z/9R6AlAIBmSZJxAABeRCQuVMqzP8cIAABEoIEqsEEb9MEYLMAGHMEF3MEL/GA2hEIkxMJCEEIKZIAccmAprIJCKIbNsB0qYC/UQB00wFFohpNwDi7CVbgOPXAP+mEInsEovIEJBEHICBNhIdqIAWKKWCOOCBeZhfghwUgEEoskIMmIFFEiS5E1SDFSilQgVUgd8j1yAjmHXEa6kTvIADKC/Ia8RzGUgbJRPdQMtUO5qDcahEaiC9BkdDGajxagm9BytBo9jDah59CraA/ajz5DxzDA6BgHM8RsMC7Gw0KxOCwJk2PLsSKsDKvGGrBWrAO7ifVjz7F3BBKBRcAJNgR3QiBhHkFIWExYTthIqCAcJDQR2gk3CQOEUcInIpOoS7QmuhH5xBhiMjGHWEgsI9YSjxMvEHuIQ8Q3JBKJQzInuZACSbGkVNIS0kbSblIj6SypmzRIGiOTydpka7IHOZQsICvIheSd5MPkM+Qb5CHyWwqdYkBxpPhT4ihSympKGeUQ5TTlBmWYMkFVo5pS3aihVBE1j1pCraG2Uq9Rh6gTNHWaOc2DFklLpa2ildMaaBdo92mv6HS6Ed2VHk6X0FfSy+lH6JfoA/R3DA2GFYPHiGcoGZsYBxhnGXcYr5hMphnTixnHVDA3MeuY55kPmW9VWCq2KnwVkcoKlUqVJpUbKi9Uqaqmqt6qC1XzVctUj6leU32uRlUzU+OpCdSWq1WqnVDrUxtTZ6k7qIeqZ6hvVD+kfln9iQZZw0zDT0OkUaCxX+O8xiALYxmzeCwhaw2rhnWBNcQmsc3ZfHYqu5j9HbuLPaqpoTlDM0ozV7NS85RmPwfjmHH4nHROCecop5fzforeFO8p4ikbpjRMuTFlXGuqlpeWWKtIq1GrR+u9Nq7tp52mvUW7WfuBDkHHSidcJ0dnj84FnedT2VPdpwqnFk09OvWuLqprpRuhu0R3v26n7pievl6Ankxvp955vef6HH0v/VT9bfqn9UcMWAazDCQG2wzOGDzFNXFvPB0vx9vxUUNdw0BDpWGVYZfhhJG50Tyj1UaNRg+MacZc4yTjbcZtxqMmBiYhJktN6k3umlJNuaYppjtMO0zHzczNos3WmTWbPTHXMueb55vXm9+3YFp4Wiy2qLa4ZUmy5FqmWe62vG6FWjlZpVhVWl2zRq2drSXWu627pxGnuU6TTque1mfDsPG2ybaptxmw5dgG2662bbZ9YWdiF2e3xa7D7pO9k326fY39PQcNh9kOqx1aHX5ztHIUOlY63prOnO4/fcX0lukvZ1jPEM/YM+O2E8spxGmdU5vTR2cXZ7lzg/OIi4lLgssulz4umxvG3ci95Ep09XFd4XrS9Z2bs5vC7ajbr+427mnuh9yfzDSfKZ5ZM3PQw8hD4FHl0T8Ln5Uwa9+sfk9DT4FntecjL2MvkVet17C3pXeq92HvFz72PnKf4z7jPDfeMt5ZX8w3wLfIt8tPw2+eX4XfQ38j/2T/ev/RAKeAJQFnA4mBQYFbAvv4enwhv44/Ottl9rLZ7UGMoLlBFUGPgq2C5cGtIWjI7JCtIffnmM6RzmkOhVB+6NbQB2HmYYvDfgwnhYeFV4Y/jnCIWBrRMZc1d9HcQ3PfRPpElkTem2cxTzmvLUo1Kj6qLmo82je6NLo/xi5mWczVWJ1YSWxLHDkuKq42bmy+3/zt84fineIL43sXmC/IXXB5oc7C9IWnFqkuEiw6lkBMiE44lPBBECqoFowl8hN3JY4KecIdwmciL9E20YjYQ1wqHk7ySCpNepLskbw1eSTFM6Us5bmEJ6mQvEwNTN2bOp4WmnYgbTI9Or0xg5KRkHFCqiFNk7Zn6mfmZnbLrGWFsv7Fbou3Lx6VB8lrs5CsBVktCrZCpuhUWijXKgeyZ2VXZr/Nico5lqueK83tzLPK25A3nO+f/+0SwhLhkralhktXLR1Y5r2sajmyPHF52wrjFQUrhlYGrDy4irYqbdVPq+1Xl65+vSZ6TWuBXsHKgsG1AWvrC1UK5YV969zX7V1PWC9Z37Vh+oadGz4ViYquFNsXlxV/2CjceOUbh2/Kv5nclLSpq8S5ZM9m0mbp5t4tnlsOlqqX5pcObg3Z2rQN31a07fX2Rdsvl80o27uDtkO5o788uLxlp8nOzTs/VKRU9FT6VDbu0t21Ydf4btHuG3u89jTs1dtbvPf9Psm+21UBVU3VZtVl+0n7s/c/romq6fiW+21drU5tce3HA9ID/QcjDrbXudTVHdI9VFKP1ivrRw7HH77+ne93LQ02DVWNnMbiI3BEeeTp9wnf9x4NOtp2jHus4QfTH3YdZx0vakKa8ppGm1Oa+1tiW7pPzD7R1ureevxH2x8PnDQ8WXlK81TJadrpgtOTZ/LPjJ2VnX1+LvncYNuitnvnY87fag9v77oQdOHSRf+L5zu8O85c8rh08rLb5RNXuFearzpfbep06jz+k9NPx7ucu5quuVxrue56vbV7ZvfpG543zt30vXnxFv/W1Z45Pd2983pv98X39d8W3X5yJ/3Oy7vZdyfurbxPvF/0QO1B2UPdh9U/W/7c2O/cf2rAd6Dz0dxH9waFg8/+kfWPD0MFj5mPy4YNhuueOD45OeI/cv3p/KdDz2TPJp4X/qL+y64XFi9++NXr187RmNGhl/KXk79tfKX96sDrGa/bxsLGHr7JeDMxXvRW++3Bd9x3He+j3w9P5Hwgfyj/aPmx9VPQp/uTGZOT/wQDmPP8YzMt2wAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAACZ0lEQVR42mzSP4icZRTF4ee+38xOkp2sG5cQxVJIIaaKkICxTkqJjQhpJFYiop2F1YKFQqoUVpEoCBYSS7dfOxVFWGIsokUE/0TEye7OzPe977XYNWk83b0cDoffvXHWGxkKYjt0N1fi+FaJIzNIFSJ0kDXn0z5nF1O9Sp5PzaizamLD2NELo5W4sOwXqqX/04o1R2wg9PYs/GXUmTjqpGNxwvWdFzz19Akvjj+XUkYTggylFLfml93due+tZ7+y577BrkJnbNWke8yHmzvgi/4lq+WU1XjCsThl2p1ya3GZ4KNrt03KuhXH0SkkkbTOL5+u2PnuZ/D8axtGMTaKsbOvrINP3v/W3Y9XhCJjQCrUWRedVpaq3nvn7oHXrz8jD8PfvnEGbL0716LXytIoxqizkups4R/VwhB7hpi7sXkbXNo86bkrazK5sXnbEHND7BvMLcykOotz3vlxvZw+faRb08VEiVC64rPdSw/pZ/Ly9EutNi3TkHOLOvN3u3OnHNx7MFio5qq5Ifdce/WHhwEfXPnekPuq/UPPQhrAKOV0MFdyRFQFRefr7Z9wRrb0zfYd1aCpGmr2BvtSTkcp1wZLnX0tx4oQjeHX+UF97P75QGspM7VMqTfopVwb0aY1F4ZWlFK1SCVDHQKUEvphj0ztkEdrvZoLtOkoNS2XlkHJIlroIky7Jw8atDSJdQ/aPTUdtJBaLqVmlJpqQataCZKhY/L4HwcEI/Qbv1v8tivbIdVG1UtNnPVmFmPEoT9l/Dc9Ujp42Mx4uGl6I5pmgdjGzaLbopsdJqZHWZnqtKkXcZU8D/8OAPAMQ4kD8KK1AAAAAElFTkSuQmCCiVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEJGlDQ1BJQ0MgUHJvZmlsZQAAOBGFVd9v21QUPolvUqQWPyBYR4eKxa9VU1u5GxqtxgZJk6XtShal6dgqJOQ6N4mpGwfb6baqT3uBNwb8AUDZAw9IPCENBmJ72fbAtElThyqqSUh76MQPISbtBVXhu3ZiJ1PEXPX6yznfOec7517bRD1fabWaGVWIlquunc8klZOnFpSeTYrSs9RLA9Sr6U4tkcvNEi7BFffO6+EdigjL7ZHu/k72I796i9zRiSJPwG4VHX0Z+AxRzNRrtksUvwf7+Gm3BtzzHPDTNgQCqwKXfZwSeNHHJz1OIT8JjtAq6xWtCLwGPLzYZi+3YV8DGMiT4VVuG7oiZpGzrZJhcs/hL49xtzH/Dy6bdfTsXYNY+5yluWO4D4neK/ZUvok/17X0HPBLsF+vuUlhfwX4j/rSfAJ4H1H0qZJ9dN7nR19frRTeBt4Fe9FwpwtN+2p1MXscGLHR9SXrmMgjONd1ZxKzpBeA71b4tNhj6JGoyFNp4GHgwUp9qplfmnFW5oTdy7NamcwCI49kv6fN5IAHgD+0rbyoBc3SOjczohbyS1drbq6pQdqumllRC/0ymTtej8gpbbuVwpQfyw66dqEZyxZKxtHpJn+tZnpnEdrYBbueF9qQn93S7HQGGHnYP7w6L+YGHNtd1FJitqPAR+hERCNOFi1i1alKO6RQnjKUxL1GNjwlMsiEhcPLYTEiT9ISbN15OY/jx4SMshe9LaJRpTvHr3C/ybFYP1PZAfwfYrPsMBtnE6SwN9ib7AhLwTrBDgUKcm06FSrTfSj187xPdVQWOk5Q8vxAfSiIUc7Z7xr6zY/+hpqwSyv0I0/QMTRb7RMgBxNodTfSPqdraz/sDjzKBrv4zu2+a2t0/HHzjd2Lbcc2sG7GtsL42K+xLfxtUgI7YHqKlqHK8HbCCXgjHT1cAdMlDetv4FnQ2lLasaOl6vmB0CMmwT/IPszSueHQqv6i/qluqF+oF9TfO2qEGTumJH0qfSv9KH0nfS/9TIp0Wboi/SRdlb6RLgU5u++9nyXYe69fYRPdil1o1WufNSdTTsp75BfllPy8/LI8G7AUuV8ek6fkvfDsCfbNDP0dvRh0CrNqTbV7LfEEGDQPJQadBtfGVMWEq3QWWdufk6ZSNsjG2PQjp3ZcnOWWing6noonSInvi0/Ex+IzAreevPhe+CawpgP1/pMTMDo64G0sTCXIM+KdOnFWRfQKdJvQzV1+Bt8OokmrdtY2yhVX2a+qrykJfMq4Ml3VR4cVzTQVz+UoNne4vcKLoyS+gyKO6EHe+75Fdt0Mbe5bRIf/wjvrVmhbqBN97RD1vxrahvBOfOYzoosH9bq94uejSOQGkVM6sN/7HelL4t10t9F4gPdVzydEOx83Gv+uNxo7XyL/FtFl8z9ZAHF4bBsrEwAAAAlwSFlzAAALEwAACxMBAJqcGAAAByVJREFUWAm1l1uIldcVx9d3ruMZZzRaay+pCjFJH6LSRqxQqA1NH0pBiH3Qp774kEAg4EOkxKdQSCjUFvpm6YsNVNoSaGjFtmga2yZgCIIawdv04g2kM7Uz6lzO+c758v/t/9lzTB/61Oxhn7332muv9V+3vb8pnooDVRkzZ4oY/LmK6mQZa05frX6yFJ9Ae7x4qd2IuV1FFM9WMfhaI9Z+pQBAL+aiEZ0QgNBm2YuZmxHF9VZMXqmivFaLweUyuteWYvHGVPWr2f+F7YvF/ola9DZGVJsHUXs8YvBEK1ZrXt9URDwqxY1BdGMQvWjGqkgA+iLUtazHuADUoowHYugKTilaR7SIpZjWqOMRfY090RbasS4JglpFtzWIcqwZa+pSqnWVcLLXijXpZCFpvbgb/VhMe8huMLPylWkci8/oSD8xJq7hj4WUWvXrlbqVrUyKtBYdpX3Bh9YbzsdErwRgbZKyFP+KdqxPssu4l2hDAOOxIj6bCHigKWRNCcpMCHHHB4TJLc+TXxKHnC51Ct+Qgxl/TZ0qE5Be/EdWTwjqQuJJAPIB8qAZk4kZoXJnvHH+27Hq0+0YX12PH+w7E3/8zbWkitN2M8pS7kCKZ761OV55c2fcm+nG7J1e7N/+e3m2nbyKQcAhnHWZLC86B1rxiFRvSIkIgJHFVWzZ+qk4fG5HEr4wV8buVb+Vuv5QeVZsi/HeW//eHZ1HbNfLT5+Jc2dndBav9KXugfqc+pLsv6Xxvk6kVheumnpDnXlTVMZWfHh+Li6cdOKvmGzEC69+WTskzwr1SfUJ9ZWp7z/0pWXlF9+ejQtnUdCWnAxQ+al5Tdz80lIVEP8x9eZQWCQwOTAhNc34Re+rUW8U0S+r2Ns8nWzBKgONBOeX3V3RaCpPRN7XeFcO7yYl+InML2U3VdBVHszHzbSXYLBJkuTSQzBuphoYZ7X/u8O30gFAHHxzi+Yop8ETcfDXW5JyKMd/fFuO9l3mYuwLAl5gbMg8QuKdYQg4Zjcxo7HikMeIn37vcizes9Ide9bGhs9NLPN9YX0ndnzHpbZ4vx9HXr6kc6Sobo2hIkuzOnIh0xMFRlvc0waWL+p3UePCQ/Myjjx/JSnl59CJbUkJgl75g+ZD/D978Yrc7EuMPe4ESo6OYsaasiiX7tADAyny5cGtyMHsDxzFnP0Tx6Z0SfsW27B1PHZ+c13seGZdbNo2Lo6Iu7e7cfznfxc/8ggNQBhZI9dSs2c5k+rFaHBXmZhd32xTGdlZPvzDvefj9XddlgeObYVpuf1o3zkpyrEnCJwBDjlmr9i7XP3jgrYkDamhEqRA8UOBxZ53tcOtBbgyzr53M65f8DU6sVZ1o067cfFBvP+XGzrDOa5s+JkTShIc+dBtlLOLlRpqAUDc+yqQMnViNq81edDVnPixno/vP/dXjn2svbbnPa1RiqXEHVkYQ06RWygnFEtpbZDLAJws2X1OHgfCv+hiRkZU8Y+pmbjwzjTE1D48PR1TV+5IMErgsjex2A8TJrqCHH9Cw6U0BGBkPUWrKTZnPq4L9WqIOFvEO8ml+vbRvyUB/Jw6OiUa9GydM58qQl6lTrNHyiENrwyTkOvXLziVkMlOOsesVKyIFtZB1zfDAGvdyj4xtkD7yHQ8Ynn4hCrwvYA+DOJCSlXAZl3MjNQobNzVPK7gJm0AiPsQyEg0c6s1cbEB5X08AmDz1TTLucApzHHyJgADvUqVysJMKOSicLRQl+emOIvbnaw+ot2pSTzl5zzJVjPaZ6ix7zCSN4E1shOAWnqbyYH8bOqd1h9AGJ0qtl6LRBubcBKxbo6xh60kWlbLjgG4NJ2ETkwqbl7SeUXVSCq+BF1C2bWEgEO4CxBGvOydGmu3ooXv7AEogLFqn2JtWKO8yc9xAmDxjhGiWMOQXe63zCvHtIjOpGOIwvGJlhRQepyzaiu0MQ4MnFhuT7CiJQC+sUg4jtOYO+1IH9OdCwgBSmOkP2r60CarHeXMjxw3PGyvOBnN670EgOPOc1yEYgDYCxbqTPDXki1srChi4R6lpQ+uDmVFDtkA5GH1qJEvQFgacqCFT37pyP+Y+DMJs0Y54NgbiIVn61jhEUrNARuNIi3vOQf8iUeQuNzILe4b/jFZ7RDYJhTbVRaJTxyWh8PgO93hQJCBsSa2GQyyoLlBzWDxgnm9l0JgADgNgVxElCH22xs4NCsaieSUyzWXaSTLDAPlGQB0Kt6JaqpzYjkJQT9id60aNwqZjVqlz9Kqp+JcfDjOAqhirNoCI6MelpVPAjZ/CbFv45Y9YNcicqDMKm/Xo/FPJdMlqZ9SIK7qSrrci9mbl6q3/DGQ5f7XuK347rgKeuMgiicEfLPmT0rGY1K5SdI/ryritlMbJrr/PZ8+I8qf9PF8qhMrT39QHfHLkhj/fz/bi+eb83F/VxX1b6jWvt6KdTs/AvvCmqXE235jAAAAAElFTkSuQmCC</Image>
 <Image width="74" height="74">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEoAAABKCAIAAACTslUmAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyRpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw%2FeHBhY2tldCBiZWdpbj0i77u%2FIiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8%2BIDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0xNDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNiAoTWFjaW50b3NoKSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpDOUM2QjI5NUY0MkExMUUyQjUzMEMyNEUyNjY3NEQyNyIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDpDOUM2QjI5NkY0MkExMUUyQjUzMEMyNEUyNjY3NEQyNyI%2BIDx4bXBNTTpEZXJpdmVkRnJvbSBzdFJlZjppbnN0YW5jZUlEPSJ4bXAuaWlkOkM5QzZCMjkzRjQyQTExRTJCNTMwQzI0RTI2Njc0RDI3IiBzdFJlZjpkb2N1bWVudElEPSJ4bXAuZGlkOkM5QzZCMjk0RjQyQTExRTJCNTMwQzI0RTI2Njc0RDI3Ii8%2BIDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY%2BIDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8%2BaVyByAAABG1JREFUeNrsmmtMU2cYgFtKS%2B%2F0gqVQadVUJIgUjCaMLXMbg%2BEtKgiCZMmybFli%2FEHiH7c%2F27JLMpct%2FFiyiyYTIxiic8FFjMapW4MDWWSU4gUUSnX0tPTGSq%2FQdu8oq66nHkhT0868X86P97u8b8%2BT73sv30npR4rbaM9uy6A90w3xEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxEA%2FxSC3zqVpn8Vjql9eoKpWywhyOhMPJZodCYZ%2FT57a6iRGLoXdyXGsIzYfi6j5%2FsKKottBpdDomnQ7jDAgTvZPpggdgFe9sLm%2FWsLjM2CkuU5gvyCuVlzeXum2e%2FqMDg526UDAWksFkSFaL4Yl0HUbnsa3taYGXWyzb1bY9WyFcciVPyn3l8JbiHUXdref%2FMrkoVpqGiLTwvZWbFE3te5fDFm3yktyWjkaxUkSFN5wGeNkrhXVf7SQfyCUbP5df%2F80uCkWTzpz60PLaB1VZgqw579zZA%2Bf87sA%2FLpSZEVwIHlk8Vvl%2BTWG1%2Bkm6YpUIwsnVI1ry1Lw%2FaLkznWI8RVme6jklCEw2s%2BbDKtt9%2B2DnkOG6EUaq3t2iadzAYDFAHv9lYvqeLarFFrJ5OVwIsCCXNWn6vhvwOn0xloEtOBdMMV7R9nWLEp0GjgRPwSbFyeYu%2B4Tjxvc3S%2BrWR%2FBc5lndab3z4QwtvBBdVvBebK1cfJssxtpX1bozetLJJBJ7pWT6Xr5GHjMCB3XnF9uAykW4tG29kUHYxrcvvKGqUEJ62H%2By4cC1t0p2Fz8yUionW57SmVKPJ8gVkAdl63JeOvQCCIOndFP%2FBvern2shs7d07FOU58fGGDmfbIQYNqcejyvmxB3f2FJWsFkRDoUvvn85GAj%2B%2FMk1Y5%2Bx6fhevowXx4go1ojH7nU%2BmEk9HgTM%2BBN02taPa5jsTOuYrb2%2Bc7L%2FQcOxOo6IvUwjpkRPZpLxKMoOyIfgciDYxu21H1VzJZzlGyH0lrTA%2B%2FMPE3XijgiigmyKZVOk4mtqKD12b%2FTSGMUsnR6tlZ%2F4o1BY37tyPyJ7HV7I5uCxpkTjSpLznuE3I6E3QwEZM%2B53%2Bd1Wj%2FnWYtlhvPFQKBfA%2FUiYFxtpR7pvQ1aMyAPHb%2F5%2BYpAv44N6wq%2FEqF5Rm0RCYpjYsGd9BuM%2F%2B9P15tlfv%2BydHrVGuncujA6d1kOxtqpS%2BfgyuBx1t%2FZEQgs9gw4Nti4wG0ij66zlrrXnvUs7PqulM%2BjRwYZvd4fDYUjxFIqA8ePBnzx2T6Sbo5a%2B3tUElQ3cZc8fvpgwZPLve7A5%2FtnAtk9rouGRxWdRqwDDuUM9ltuPimaBnA%2B1jnSNRKISz3vn0%2Btby4TW0F7fMfzDCPkOHrtpnrm%2BowMnGk89zrZQAC2GWShuljRCFc%2Be6p%2BNBXJBYY16daVSqpZGAwl4FJy66btWuDqMXRn3zfjiKio25kFRDh54%2Fev%2BNMXDD4GIh3iIh3iIh3iIh3iIh3iIh3iIh3iIh3iI939pfwswANago8DqAlG2AAAAAElFTkSuQmCC</Image>
 <Url type="application/x-suggestions+json" method="GET"
      template="http://ff.search.yahoo.com/gossip?output=fxjson&amp;command={searchTerms}" />

From 640e4550f05c5178d3ad1958f83425d1e1bedf39 Mon Sep 17 00:00:00 2001
From: Mike Connor <mconnor@mozilla.com>
Date: Fri, 13 Dec 2013 13:42:30 -0500
Subject: [PATCH 083/459] bug 947275 - updated Bing branding for desktop and
 Metro, r=gavin

--HG--
extra : rebase_source : 375fe6e5cc5c7cc13326a35c1572c69dbec58bd1
---
 browser/locales/en-US/searchplugins/bing.xml        | 2 +-
 browser/locales/en-US/searchplugins/bingmetrofx.xml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/browser/locales/en-US/searchplugins/bing.xml b/browser/locales/en-US/searchplugins/bing.xml
index ef02aff5a785..0705329654f9 100644
--- a/browser/locales/en-US/searchplugins/bing.xml
+++ b/browser/locales/en-US/searchplugins/bing.xml
@@ -6,7 +6,7 @@
     <ShortName>Bing</ShortName>
     <Description>Bing. Search by Microsoft.</Description>
     <InputEncoding>UTF-8</InputEncoding>
-    <Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAAAAAD/AAAAJgAAACAgAAAAAAAA+AMAACUBAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAADGSURBVDjLY/i/TPQ/JZiBOgZsd/z/f08AhCbLgJdH/4MBiKaaAWtUIK4i4DJUA95d/v//xsz//788+o8VPN4GMRCnATAAMuByF8IFx3NR1dxbjscAkCTI+dicDDIIBkAuxWoALs0wDLIABH5+QDIA5DeY0wmFPMhrMAA34Gw1QhAtkFAwyHWwAIZahkiJoBiAOQ1kILpmkMHIaqBRy4BiOihgYACkCBQ2IIwcrSBDkNIFZl7YaARxAShcYAaAMCxaaZOZKMAAOzkOfhyf540AAAAASUVORK5CYIKJUE5HDQoaCgAAAA1JSERSAAAAIAAAACAIBgAAAHN6evQAAAO/SURBVFjDxZRJTxRBFMfrJiC7enKJ28nEGL+AXo2J+gFcrkr0C4gLKjCAoILKIgKyjSZG40FFMephHERcLm4XVzTRi7I4DHRPL8/3qqq7q6d7ZIgRO/mFzlT1+/3fq6ZZ8lzB9smq3JGxQwtgPhmvyHk1XpO3kZF8/EgOjB2eX8hJbkY3/4WjOTBRkQuMbuaVCsHEsVwOoxTzhpROHs8TnMjDAMe8hX/KcQFJOZVIFQaYPEE//mMqBb9QyKlGInmQiFCASpkG0WPVoF7m5xio63OmSvCreqEgIkjUILVEPjCeRhIWQF2fCwmCZI5QSqeIunyYOilg7iZEf5QWYDQG6nrW1OQLaj08aQFM1RdAskHApmhRkopHAgHU9ayp84RJop6Q0lMFME2cRs4UYoA674HQAHIt2bgUtNt7+R76PYzUUAS0gb2QbF8npA35rjTpSKV4urEQZhopQL0YCUEFfAG+xEC7s4//netFz+iDZZA8XSiEUsrFTUUwc1bAnHRE6nEk6+K012U4AtbX8JD25Cjo17e6wplzRaAR55FmCnAG5RIqlOnihQb3wXTLMnf/tAp11roc9HtlfG/6lbpf5ko5LcWgI2xGngVhPKkJ7/hNP2hYXN3LaZLjVEZKaO0rwHwbDdQx7uzkUr2VKIFUWwkGOItFJMZIMID54SaoewRFvpH6xup2WQzWx1v+YtoE6G1CnLqAtGMA9yHEfBoMoPesB3WPdr5Y0OyhN4txujgdRjcEG7q3i4uNi6UcphYyn9YGHlDXOS0enkzSVsw71J0OkfTLelEHRkepoBMDqMnN+MHgBMJEUpZSueBJeYe8y5AAT8rBRDGniwLIxDx12MiGyr11pTNV5iLHysEOreHyYL2rG1G8CMxLApZe0PqU9uLoE2Bc2+TvTOlQFTpQd9aNzfxZ37/y6G0utYhuAfN1QHSvBPvHy0AI6kYIJYqQztJwxkrykfKg/OcrsC6vdsVWj4D5Cjn0rgL7Wzz4QUiMgv26FayBbWD2r+JnyOnHwgPbwX7TyvcEPmLf42BdWe1KrZ7FYPUKmJM+DCu2P7Rg1lfiC9jxA5641xPbRB8FwBeCMDNB5/VgN9jvLmcXhqTvr4D9cI9P6Ir7/DDnbcyEe2YOeI72XRz3YDo7cMxrgl2GSDn9AmZiUZWAsOcPhHWYSahIVRh/IWYjrKvZZBmlSwTRJQAISxdk7CobWYYuXXHUA5wARlfJkD1XyawyD1Bk6Rhdpc+Z1lG4Fm+G/1bkEhX8SczlnaXP8Juz5TddEmZvDz4eOQAAAABJRU5ErkJggg==</Image>
+    <Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAEACADaCwAAJgAAACAgAAABAAgAlAIAAAAMAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIAgAAAJCRaDYAAAAJcEhZcwAACxMAAAsTAQCanBgAAApPaUNDUFBob3Rvc2hvcCBJQ0MgcHJvZmlsZQAAeNqdU2dUU+kWPffe9EJLiICUS29SFQggUkKLgBSRJiohCRBKiCGh2RVRwRFFRQQbyKCIA46OgIwVUSwMigrYB+Qhoo6Do4iKyvvhe6Nr1rz35s3+tdc+56zznbPPB8AIDJZIM1E1gAypQh4R4IPHxMbh5C5AgQokcAAQCLNkIXP9IwEA+H48PCsiwAe+AAF40wsIAMBNm8AwHIf/D+pCmVwBgIQBwHSROEsIgBQAQHqOQqYAQEYBgJ2YJlMAoAQAYMtjYuMAUC0AYCd/5tMAgJ34mXsBAFuUIRUBoJEAIBNliEQAaDsArM9WikUAWDAAFGZLxDkA2C0AMElXZkgAsLcAwM4QC7IACAwAMFGIhSkABHsAYMgjI3gAhJkAFEbyVzzxK64Q5yoAAHiZsjy5JDlFgVsILXEHV1cuHijOSRcrFDZhAmGaQC7CeZkZMoE0D+DzzAAAoJEVEeCD8/14zg6uzs42jrYOXy3qvwb/ImJi4/7lz6twQAAA4XR+0f4sL7MagDsGgG3+oiXuBGheC6B194tmsg9AtQCg6dpX83D4fjw8RaGQudnZ5eTk2ErEQlthyld9/mfCX8BX/Wz5fjz89/XgvuIkgTJdgUcE+ODCzPRMpRzPkgmEYtzmj0f8twv//B3TIsRJYrlYKhTjURJxjkSajPMypSKJQpIpxSXS/2Ti3yz7Az7fNQCwaj4Be5EtqF1jA/ZLJxBYdMDi9wAA8rtvwdQoCAOAaIPhz3f/7z/9R6AlAIBmSZJxAABeRCQuVMqzP8cIAABEoIEqsEEb9MEYLMAGHMEF3MEL/GA2hEIkxMJCEEIKZIAccmAprIJCKIbNsB0qYC/UQB00wFFohpNwDi7CVbgOPXAP+mEInsEovIEJBEHICBNhIdqIAWKKWCOOCBeZhfghwUgEEoskIMmIFFEiS5E1SDFSilQgVUgd8j1yAjmHXEa6kTvIADKC/Ia8RzGUgbJRPdQMtUO5qDcahEaiC9BkdDGajxagm9BytBo9jDah59CraA/ajz5DxzDA6BgHM8RsMC7Gw0KxOCwJk2PLsSKsDKvGGrBWrAO7ifVjz7F3BBKBRcAJNgR3QiBhHkFIWExYTthIqCAcJDQR2gk3CQOEUcInIpOoS7QmuhH5xBhiMjGHWEgsI9YSjxMvEHuIQ8Q3JBKJQzInuZACSbGkVNIS0kbSblIj6SypmzRIGiOTydpka7IHOZQsICvIheSd5MPkM+Qb5CHyWwqdYkBxpPhT4ihSympKGeUQ5TTlBmWYMkFVo5pS3aihVBE1j1pCraG2Uq9Rh6gTNHWaOc2DFklLpa2ildMaaBdo92mv6HS6Ed2VHk6X0FfSy+lH6JfoA/R3DA2GFYPHiGcoGZsYBxhnGXcYr5hMphnTixnHVDA3MeuY55kPmW9VWCq2KnwVkcoKlUqVJpUbKi9Uqaqmqt6qC1XzVctUj6leU32uRlUzU+OpCdSWq1WqnVDrUxtTZ6k7qIeqZ6hvVD+kfln9iQZZw0zDT0OkUaCxX+O8xiALYxmzeCwhaw2rhnWBNcQmsc3ZfHYqu5j9HbuLPaqpoTlDM0ozV7NS85RmPwfjmHH4nHROCecop5fzforeFO8p4ikbpjRMuTFlXGuqlpeWWKtIq1GrR+u9Nq7tp52mvUW7WfuBDkHHSidcJ0dnj84FnedT2VPdpwqnFk09OvWuLqprpRuhu0R3v26n7pievl6Ankxvp955vef6HH0v/VT9bfqn9UcMWAazDCQG2wzOGDzFNXFvPB0vx9vxUUNdw0BDpWGVYZfhhJG50Tyj1UaNRg+MacZc4yTjbcZtxqMmBiYhJktN6k3umlJNuaYppjtMO0zHzczNos3WmTWbPTHXMueb55vXm9+3YFp4Wiy2qLa4ZUmy5FqmWe62vG6FWjlZpVhVWl2zRq2drSXWu627pxGnuU6TTque1mfDsPG2ybaptxmw5dgG2662bbZ9YWdiF2e3xa7D7pO9k326fY39PQcNh9kOqx1aHX5ztHIUOlY63prOnO4/fcX0lukvZ1jPEM/YM+O2E8spxGmdU5vTR2cXZ7lzg/OIi4lLgssulz4umxvG3ci95Ep09XFd4XrS9Z2bs5vC7ajbr+427mnuh9yfzDSfKZ5ZM3PQw8hD4FHl0T8Ln5Uwa9+sfk9DT4FntecjL2MvkVet17C3pXeq92HvFz72PnKf4z7jPDfeMt5ZX8w3wLfIt8tPw2+eX4XfQ38j/2T/ev/RAKeAJQFnA4mBQYFbAvv4enwhv44/Ottl9rLZ7UGMoLlBFUGPgq2C5cGtIWjI7JCtIffnmM6RzmkOhVB+6NbQB2HmYYvDfgwnhYeFV4Y/jnCIWBrRMZc1d9HcQ3PfRPpElkTem2cxTzmvLUo1Kj6qLmo82je6NLo/xi5mWczVWJ1YSWxLHDkuKq42bmy+3/zt84fineIL43sXmC/IXXB5oc7C9IWnFqkuEiw6lkBMiE44lPBBECqoFowl8hN3JY4KecIdwmciL9E20YjYQ1wqHk7ySCpNepLskbw1eSTFM6Us5bmEJ6mQvEwNTN2bOp4WmnYgbTI9Or0xg5KRkHFCqiFNk7Zn6mfmZnbLrGWFsv7Fbou3Lx6VB8lrs5CsBVktCrZCpuhUWijXKgeyZ2VXZr/Nico5lqueK83tzLPK25A3nO+f/+0SwhLhkralhktXLR1Y5r2sajmyPHF52wrjFQUrhlYGrDy4irYqbdVPq+1Xl65+vSZ6TWuBXsHKgsG1AWvrC1UK5YV969zX7V1PWC9Z37Vh+oadGz4ViYquFNsXlxV/2CjceOUbh2/Kv5nclLSpq8S5ZM9m0mbp5t4tnlsOlqqX5pcObg3Z2rQN31a07fX2Rdsvl80o27uDtkO5o788uLxlp8nOzTs/VKRU9FT6VDbu0t21Ydf4btHuG3u89jTs1dtbvPf9Psm+21UBVU3VZtVl+0n7s/c/romq6fiW+21drU5tce3HA9ID/QcjDrbXudTVHdI9VFKP1ivrRw7HH77+ne93LQ02DVWNnMbiI3BEeeTp9wnf9x4NOtp2jHus4QfTH3YdZx0vakKa8ppGm1Oa+1tiW7pPzD7R1ureevxH2x8PnDQ8WXlK81TJadrpgtOTZ/LPjJ2VnX1+LvncYNuitnvnY87fag9v77oQdOHSRf+L5zu8O85c8rh08rLb5RNXuFearzpfbep06jz+k9NPx7ucu5quuVxrue56vbV7ZvfpG543zt30vXnxFv/W1Z45Pd2983pv98X39d8W3X5yJ/3Oy7vZdyfurbxPvF/0QO1B2UPdh9U/W/7c2O/cf2rAd6Dz0dxH9waFg8/+kfWPD0MFj5mPy4YNhuueOD45OeI/cv3p/KdDz2TPJp4X/qL+y64XFi9++NXr187RmNGhl/KXk79tfKX96sDrGa/bxsLGHr7JeDMxXvRW++3Bd9x3He+j3w9P5Hwgfyj/aPmx9VPQp/uTGZOT/wQDmPP8YzMt2wAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAABBUlEQVR42mL8v4OBJMAEZ/0nTgMLnLXtitKRO9JmCi9cNR/wsP8mrOHfP8YbL4RvvBBWFXuvI/WGsJMYSHUSMujbY8LN/ttM4bmO1BtW5n+ENdipPmndbrHjqiIn6x9DuZc2yk8tlZ7hc5Kx/AtzxecMDAzff7Mcuys9/7gOAT8wMjAUOZ9x0XhI2A98HL+Eub/vuSG/8ozGmy+cEEF+zp/YNYjxfvPTv9O63fLpBx6ICCvz32DD24EGt7Fo4Gb/zcX2Z84RPbiIqfyLZJtL4rzfsDvJUf3R91+sC09o//7LJMn/NdXmkqHsSyzeQ0t8j9/znn8s7ql9Dy34cWogIbUSCQADAJ+jWQrH9LCsAAAAAElFTkSuQmCCiVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAACW0lEQVR4nGP8v5OBpoCJtsbTwQIWTKGUxe5mCi9M5V/oSL9mZf5HoQWMmHEQOD0AwuBg/WMo+8pB/ZGZwguyLcDiAzj48Zvl+D2pTz/YKLGAcBxcfSZCtulEWUAhGDQW3HstcOOF8P//jKRagC+SkQE/58/0pa7c7L9N5V+aKTw3kH3FxvKXmhYI83y3VXl64Jbs3htye2/IsbH8NZB9Zabw3FT+JR/nTypYwMDAEGBw+8AtWQj71x/mU/clT92XZGT8ry7+zlzxhbnic0n+LxRZIC/8yUju5blH4siC//8z3nghfOOF8MLj2jKCnydH7EXTRVoqCjC4g0f2yXteTEHSLNCVft0WcNhM4QXxiYmEIIIATcm3mpJvn37gmX7Q8OozYYLqycloTz/wLDulRYzpDMT4QFf6NZz95gvnyjMa+27I/SM6xxGwQJj7R6rtJQYGhk8/2NaeU9t+RfH3X2ZcihWEP5Fmgazg53qfY9zsv1ed0dh4UeXbL5yKudl/R5tdd9O6T4IFGhJvyz1OHbkts/qc2qfv7LiUMTIwOGk8irW4yo8jP2O3wEzxubHcy7I1Dq+/cOIymoGBQVn0Q5rtRTXx93jUYLFAX+b1sw88p+5L4tHGy/Er2uy6m9YDRsb/eJRht8BS+emCY7q4NDAyMLhpPYixuMbD/gu/0VD1WBtezz7w9O81vvNKEE1cTfxdmu0lZdEPxBiNzwIGBoa//xhXndFYfU4NUsnwcf6Ms7jmpPGQ1BoHpwUQcOOF0OT9RoayryJNr3Oz/ybRcCIsoBwMmkp/8FoAADmgy6ulKggYAAAAAElFTkSuQmCC</Image>
     <Url type="application/x-suggestions+json" template="http://api.bing.com/osjson.aspx">
         <Param name="query" value="{searchTerms}"/>
         <Param name="form" value="OSDJAS"/>
diff --git a/browser/locales/en-US/searchplugins/bingmetrofx.xml b/browser/locales/en-US/searchplugins/bingmetrofx.xml
index d5f7eddee839..a29b4a7ca820 100644
--- a/browser/locales/en-US/searchplugins/bingmetrofx.xml
+++ b/browser/locales/en-US/searchplugins/bingmetrofx.xml
@@ -6,8 +6,8 @@
     <ShortName>Bing</ShortName>
     <Description>Bing. Search by Microsoft.</Description>
     <InputEncoding>UTF-8</InputEncoding>
-    <Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAAAAAD/AAAAJgAAACAgAAAAAAAA+AMAACUBAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAADGSURBVDjLY/i/TPQ/JZiBOgZsd/z/f08AhCbLgJdH/4MBiKaaAWtUIK4i4DJUA95d/v//xsz//788+o8VPN4GMRCnATAAMuByF8IFx3NR1dxbjscAkCTI+dicDDIIBkAuxWoALs0wDLIABH5+QDIA5DeY0wmFPMhrMAA34Gw1QhAtkFAwyHWwAIZahkiJoBiAOQ1kILpmkMHIaqBRy4BiOihgYACkCBQ2IIwcrSBDkNIFZl7YaARxAShcYAaAMCxaaZOZKMAAOzkOfhyf540AAAAASUVORK5CYIKJUE5HDQoaCgAAAA1JSERSAAAAIAAAACAIBgAAAHN6evQAAAO/SURBVFjDxZRJTxRBFMfrJiC7enKJ28nEGL+AXo2J+gFcrkr0C4gLKjCAoILKIgKyjSZG40FFMephHERcLm4XVzTRi7I4DHRPL8/3qqq7q6d7ZIgRO/mFzlT1+/3fq6ZZ8lzB9smq3JGxQwtgPhmvyHk1XpO3kZF8/EgOjB2eX8hJbkY3/4WjOTBRkQuMbuaVCsHEsVwOoxTzhpROHs8TnMjDAMe8hX/KcQFJOZVIFQaYPEE//mMqBb9QyKlGInmQiFCASpkG0WPVoF7m5xio63OmSvCreqEgIkjUILVEPjCeRhIWQF2fCwmCZI5QSqeIunyYOilg7iZEf5QWYDQG6nrW1OQLaj08aQFM1RdAskHApmhRkopHAgHU9ayp84RJop6Q0lMFME2cRs4UYoA674HQAHIt2bgUtNt7+R76PYzUUAS0gb2QbF8npA35rjTpSKV4urEQZhopQL0YCUEFfAG+xEC7s4//netFz+iDZZA8XSiEUsrFTUUwc1bAnHRE6nEk6+K012U4AtbX8JD25Cjo17e6wplzRaAR55FmCnAG5RIqlOnihQb3wXTLMnf/tAp11roc9HtlfG/6lbpf5ko5LcWgI2xGngVhPKkJ7/hNP2hYXN3LaZLjVEZKaO0rwHwbDdQx7uzkUr2VKIFUWwkGOItFJMZIMID54SaoewRFvpH6xup2WQzWx1v+YtoE6G1CnLqAtGMA9yHEfBoMoPesB3WPdr5Y0OyhN4txujgdRjcEG7q3i4uNi6UcphYyn9YGHlDXOS0enkzSVsw71J0OkfTLelEHRkepoBMDqMnN+MHgBMJEUpZSueBJeYe8y5AAT8rBRDGniwLIxDx12MiGyr11pTNV5iLHysEOreHyYL2rG1G8CMxLApZe0PqU9uLoE2Bc2+TvTOlQFTpQd9aNzfxZ37/y6G0utYhuAfN1QHSvBPvHy0AI6kYIJYqQztJwxkrykfKg/OcrsC6vdsVWj4D5Cjn0rgL7Wzz4QUiMgv26FayBbWD2r+JnyOnHwgPbwX7TyvcEPmLf42BdWe1KrZ7FYPUKmJM+DCu2P7Rg1lfiC9jxA5641xPbRB8FwBeCMDNB5/VgN9jvLmcXhqTvr4D9cI9P6Ir7/DDnbcyEe2YOeI72XRz3YDo7cMxrgl2GSDn9AmZiUZWAsOcPhHWYSahIVRh/IWYjrKvZZBmlSwTRJQAISxdk7CobWYYuXXHUA5wARlfJkD1XyawyD1Bk6Rhdpc+Z1lG4Fm+G/1bkEhX8SczlnaXP8Juz5TddEmZvDz4eOQAAAABJRU5ErkJggg==</Image>
-    <Image width="74" height="74">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEoAAABKCAIAAACTslUmAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyRpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw%2FeHBhY2tldCBiZWdpbj0i77u%2FIiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8%2BIDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0xNDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RSZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIHhtcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNiAoTWFjaW50b3NoKSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpDOUM2QjI5MUY0MkExMUUyQjUzMEMyNEUyNjY3NEQyNyIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDpDOUM2QjI5MkY0MkExMUUyQjUzMEMyNEUyNjY3NEQyNyI%2BIDx4bXBNTTpEZXJpdmVkRnJvbSBzdFJlZjppbnN0YW5jZUlEPSJ4bXAuaWlkOkM5QzZCMjhGRjQyQTExRTJCNTMwQzI0RTI2Njc0RDI3IiBzdFJlZjpkb2N1bWVudElEPSJ4bXAuZGlkOkM5QzZCMjkwRjQyQTExRTJCNTMwQzI0RTI2Njc0RDI3Ii8%2BIDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY%2BIDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8%2BWCTAWgAAA21JREFUeNrsm11IU2EYx3d2vvblttK0iSusFpFtIlkYKajYRTeRXfiBdBXVhVYXIQVdRxHRRUQ3EWSRQVJa3XRRVpSGReVXgVo5ZlNjqftw29nOV29eiOdk6j5yR3lexnjZzvOc97f3fZ%2Fn%2FxzeYb8uO1Srt6lVq7oBHuABHuABHuABHuABHuABHuABHuABHuABHuABHuABHuClrhFJ9JV%2Bume2H%2F3%2BOtDaALMHeIAHoWW5GkYb1Lp0jNKjvhidFoITYjS4ovEwMqeAsO4iLHZyvR3TmmVfi4yP8wxx7o8o3nJjvSsGD5Fo8qvovAO42brQZRoTaS1EL23RMX5yOPL5MdP7ADErFw9T45qCWt3eeoxOi8kQX5urKzml3X0k3HUj%2FOGOSuATGkYSjw7MTesLNMHn5n1ukfGqcAqjjbg5R23InPdKtFADTxqFwPgKCC1orJH%2BR9Gv7UJoUh6%2B07Ko3BLacYjIypMMzuIw1Tb57x%2FlvS7lzh4%2F5Qq2X2SdHYt6oGzl%2BtJGtTFbYu51%2BZoPi2GvEvMe63rna65bCtsfpTrU7r1dxf74INmN5g2GinNKTOu8ZzDQdkJk%2FEs3ESOBQNtJFD8ls7p1n2zdKgJv%2Btl5kWVitRIj08HnF%2BRawF6pLDw0A9xod7xLukvwj879hLTuVBieZzChSCs1V6dZUo3Hs1LfZILSVJouuRTjybITYdmBxEu8lQxOpG%2BROh9JMR7rfCtxbcikbBXxuaK37Zcpb9bZmWI8prdFJhH15WeQIonVD0p0KLnLlj3T9zDVi3PSyXy6J%2FGuzzDVNOEZthhUYtZ2Y%2FVN2dQhbY2UauojZ%2BjNVW6sT3IDo8VUd1e75zhGahaJJZReV9xgrLklU9hI94Q6r6dec87WeMbKa6hy%2FTtZRwaest9ecmP9Qnhq7hZFQYjaXIqkCUbq5OnB3e1vrUe2SsGbKc41%2BrKztP0g6s6vS9gQqhswQoOqQYyg%2F6VeUFEbenFJ5CKKqPfku8ji0Jc1ovd4cvrPL6FXV9iR94n%2B0P%2F5JDxGbSqm86upjUUqfPEsL%2FJRdriD6WmZSQNiEm6%2FPAf9MY2RtBYS2QXEOhsq59TaNZgmbWb9BYTQhOAf5zwDSKCiKJLcp2YY%2FI8B8AAP8AAP8AAP8AAP8AAP8AAP8ABPYe23AAMAXYk%2FgLbQd%2FsAAAAASUVORK5CYII%3D</Image>
+    <Image width="16" height="16">data:image/x-icon;base64,AAABAAIAEBAAAAEACADaCwAAJgAAACAgAAABAAgAlAIAAAAMAACJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIAgAAAJCRaDYAAAAJcEhZcwAACxMAAAsTAQCanBgAAApPaUNDUFBob3Rvc2hvcCBJQ0MgcHJvZmlsZQAAeNqdU2dUU+kWPffe9EJLiICUS29SFQggUkKLgBSRJiohCRBKiCGh2RVRwRFFRQQbyKCIA46OgIwVUSwMigrYB+Qhoo6Do4iKyvvhe6Nr1rz35s3+tdc+56zznbPPB8AIDJZIM1E1gAypQh4R4IPHxMbh5C5AgQokcAAQCLNkIXP9IwEA+H48PCsiwAe+AAF40wsIAMBNm8AwHIf/D+pCmVwBgIQBwHSROEsIgBQAQHqOQqYAQEYBgJ2YJlMAoAQAYMtjYuMAUC0AYCd/5tMAgJ34mXsBAFuUIRUBoJEAIBNliEQAaDsArM9WikUAWDAAFGZLxDkA2C0AMElXZkgAsLcAwM4QC7IACAwAMFGIhSkABHsAYMgjI3gAhJkAFEbyVzzxK64Q5yoAAHiZsjy5JDlFgVsILXEHV1cuHijOSRcrFDZhAmGaQC7CeZkZMoE0D+DzzAAAoJEVEeCD8/14zg6uzs42jrYOXy3qvwb/ImJi4/7lz6twQAAA4XR+0f4sL7MagDsGgG3+oiXuBGheC6B194tmsg9AtQCg6dpX83D4fjw8RaGQudnZ5eTk2ErEQlthyld9/mfCX8BX/Wz5fjz89/XgvuIkgTJdgUcE+ODCzPRMpRzPkgmEYtzmj0f8twv//B3TIsRJYrlYKhTjURJxjkSajPMypSKJQpIpxSXS/2Ti3yz7Az7fNQCwaj4Be5EtqF1jA/ZLJxBYdMDi9wAA8rtvwdQoCAOAaIPhz3f/7z/9R6AlAIBmSZJxAABeRCQuVMqzP8cIAABEoIEqsEEb9MEYLMAGHMEF3MEL/GA2hEIkxMJCEEIKZIAccmAprIJCKIbNsB0qYC/UQB00wFFohpNwDi7CVbgOPXAP+mEInsEovIEJBEHICBNhIdqIAWKKWCOOCBeZhfghwUgEEoskIMmIFFEiS5E1SDFSilQgVUgd8j1yAjmHXEa6kTvIADKC/Ia8RzGUgbJRPdQMtUO5qDcahEaiC9BkdDGajxagm9BytBo9jDah59CraA/ajz5DxzDA6BgHM8RsMC7Gw0KxOCwJk2PLsSKsDKvGGrBWrAO7ifVjz7F3BBKBRcAJNgR3QiBhHkFIWExYTthIqCAcJDQR2gk3CQOEUcInIpOoS7QmuhH5xBhiMjGHWEgsI9YSjxMvEHuIQ8Q3JBKJQzInuZACSbGkVNIS0kbSblIj6SypmzRIGiOTydpka7IHOZQsICvIheSd5MPkM+Qb5CHyWwqdYkBxpPhT4ihSympKGeUQ5TTlBmWYMkFVo5pS3aihVBE1j1pCraG2Uq9Rh6gTNHWaOc2DFklLpa2ildMaaBdo92mv6HS6Ed2VHk6X0FfSy+lH6JfoA/R3DA2GFYPHiGcoGZsYBxhnGXcYr5hMphnTixnHVDA3MeuY55kPmW9VWCq2KnwVkcoKlUqVJpUbKi9Uqaqmqt6qC1XzVctUj6leU32uRlUzU+OpCdSWq1WqnVDrUxtTZ6k7qIeqZ6hvVD+kfln9iQZZw0zDT0OkUaCxX+O8xiALYxmzeCwhaw2rhnWBNcQmsc3ZfHYqu5j9HbuLPaqpoTlDM0ozV7NS85RmPwfjmHH4nHROCecop5fzforeFO8p4ikbpjRMuTFlXGuqlpeWWKtIq1GrR+u9Nq7tp52mvUW7WfuBDkHHSidcJ0dnj84FnedT2VPdpwqnFk09OvWuLqprpRuhu0R3v26n7pievl6Ankxvp955vef6HH0v/VT9bfqn9UcMWAazDCQG2wzOGDzFNXFvPB0vx9vxUUNdw0BDpWGVYZfhhJG50Tyj1UaNRg+MacZc4yTjbcZtxqMmBiYhJktN6k3umlJNuaYppjtMO0zHzczNos3WmTWbPTHXMueb55vXm9+3YFp4Wiy2qLa4ZUmy5FqmWe62vG6FWjlZpVhVWl2zRq2drSXWu627pxGnuU6TTque1mfDsPG2ybaptxmw5dgG2662bbZ9YWdiF2e3xa7D7pO9k326fY39PQcNh9kOqx1aHX5ztHIUOlY63prOnO4/fcX0lukvZ1jPEM/YM+O2E8spxGmdU5vTR2cXZ7lzg/OIi4lLgssulz4umxvG3ci95Ep09XFd4XrS9Z2bs5vC7ajbr+427mnuh9yfzDSfKZ5ZM3PQw8hD4FHl0T8Ln5Uwa9+sfk9DT4FntecjL2MvkVet17C3pXeq92HvFz72PnKf4z7jPDfeMt5ZX8w3wLfIt8tPw2+eX4XfQ38j/2T/ev/RAKeAJQFnA4mBQYFbAvv4enwhv44/Ottl9rLZ7UGMoLlBFUGPgq2C5cGtIWjI7JCtIffnmM6RzmkOhVB+6NbQB2HmYYvDfgwnhYeFV4Y/jnCIWBrRMZc1d9HcQ3PfRPpElkTem2cxTzmvLUo1Kj6qLmo82je6NLo/xi5mWczVWJ1YSWxLHDkuKq42bmy+3/zt84fineIL43sXmC/IXXB5oc7C9IWnFqkuEiw6lkBMiE44lPBBECqoFowl8hN3JY4KecIdwmciL9E20YjYQ1wqHk7ySCpNepLskbw1eSTFM6Us5bmEJ6mQvEwNTN2bOp4WmnYgbTI9Or0xg5KRkHFCqiFNk7Zn6mfmZnbLrGWFsv7Fbou3Lx6VB8lrs5CsBVktCrZCpuhUWijXKgeyZ2VXZr/Nico5lqueK83tzLPK25A3nO+f/+0SwhLhkralhktXLR1Y5r2sajmyPHF52wrjFQUrhlYGrDy4irYqbdVPq+1Xl65+vSZ6TWuBXsHKgsG1AWvrC1UK5YV969zX7V1PWC9Z37Vh+oadGz4ViYquFNsXlxV/2CjceOUbh2/Kv5nclLSpq8S5ZM9m0mbp5t4tnlsOlqqX5pcObg3Z2rQN31a07fX2Rdsvl80o27uDtkO5o788uLxlp8nOzTs/VKRU9FT6VDbu0t21Ydf4btHuG3u89jTs1dtbvPf9Psm+21UBVU3VZtVl+0n7s/c/romq6fiW+21drU5tce3HA9ID/QcjDrbXudTVHdI9VFKP1ivrRw7HH77+ne93LQ02DVWNnMbiI3BEeeTp9wnf9x4NOtp2jHus4QfTH3YdZx0vakKa8ppGm1Oa+1tiW7pPzD7R1ureevxH2x8PnDQ8WXlK81TJadrpgtOTZ/LPjJ2VnX1+LvncYNuitnvnY87fag9v77oQdOHSRf+L5zu8O85c8rh08rLb5RNXuFearzpfbep06jz+k9NPx7ucu5quuVxrue56vbV7ZvfpG543zt30vXnxFv/W1Z45Pd2983pv98X39d8W3X5yJ/3Oy7vZdyfurbxPvF/0QO1B2UPdh9U/W/7c2O/cf2rAd6Dz0dxH9waFg8/+kfWPD0MFj5mPy4YNhuueOD45OeI/cv3p/KdDz2TPJp4X/qL+y64XFi9++NXr187RmNGhl/KXk79tfKX96sDrGa/bxsLGHr7JeDMxXvRW++3Bd9x3He+j3w9P5Hwgfyj/aPmx9VPQp/uTGZOT/wQDmPP8YzMt2wAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAABBUlEQVR42mL8v4OBJMAEZ/0nTgMLnLXtitKRO9JmCi9cNR/wsP8mrOHfP8YbL4RvvBBWFXuvI/WGsJMYSHUSMujbY8LN/ttM4bmO1BtW5n+ENdipPmndbrHjqiIn6x9DuZc2yk8tlZ7hc5Kx/AtzxecMDAzff7Mcuys9/7gOAT8wMjAUOZ9x0XhI2A98HL+Eub/vuSG/8ozGmy+cEEF+zp/YNYjxfvPTv9O63fLpBx6ICCvz32DD24EGt7Fo4Gb/zcX2Z84RPbiIqfyLZJtL4rzfsDvJUf3R91+sC09o//7LJMn/NdXmkqHsSyzeQ0t8j9/znn8s7ql9Dy34cWogIbUSCQADAJ+jWQrH9LCsAAAAAElFTkSuQmCCiVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAACW0lEQVR4nGP8v5OBpoCJtsbTwQIWTKGUxe5mCi9M5V/oSL9mZf5HoQWMmHEQOD0AwuBg/WMo+8pB/ZGZwguyLcDiAzj48Zvl+D2pTz/YKLGAcBxcfSZCtulEWUAhGDQW3HstcOOF8P//jKRagC+SkQE/58/0pa7c7L9N5V+aKTw3kH3FxvKXmhYI83y3VXl64Jbs3htye2/IsbH8NZB9Zabw3FT+JR/nTypYwMDAEGBw+8AtWQj71x/mU/clT92XZGT8ry7+zlzxhbnic0n+LxRZIC/8yUju5blH4siC//8z3nghfOOF8MLj2jKCnydH7EXTRVoqCjC4g0f2yXteTEHSLNCVft0WcNhM4QXxiYmEIIIATcm3mpJvn37gmX7Q8OozYYLqycloTz/wLDulRYzpDMT4QFf6NZz95gvnyjMa+27I/SM6xxGwQJj7R6rtJQYGhk8/2NaeU9t+RfH3X2ZcihWEP5Fmgazg53qfY9zsv1ed0dh4UeXbL5yKudl/R5tdd9O6T4IFGhJvyz1OHbkts/qc2qfv7LiUMTIwOGk8irW4yo8jP2O3wEzxubHcy7I1Dq+/cOIymoGBQVn0Q5rtRTXx93jUYLFAX+b1sw88p+5L4tHGy/Er2uy6m9YDRsb/eJRht8BS+emCY7q4NDAyMLhpPYixuMbD/gu/0VD1WBtezz7w9O81vvNKEE1cTfxdmu0lZdEPxBiNzwIGBoa//xhXndFYfU4NUsnwcf6Ms7jmpPGQ1BoHpwUQcOOF0OT9RoayryJNr3Oz/ybRcCIsoBwMmkp/8FoAADmgy6ulKggYAAAAAElFTkSuQmCC</Image>
+    <Image width="74" height="74">data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEoAAABKCAYAAAAc0MJxAAAEJGlDQ1BJQ0MgUHJvZmlsZQAAOBGFVd9v21QUPolvUqQWPyBYR4eKxa9VU1u5GxqtxgZJk6XtShal6dgqJOQ6N4mpGwfb6baqT3uBNwb8AUDZAw9IPCENBmJ72fbAtElThyqqSUh76MQPISbtBVXhu3ZiJ1PEXPX6yznfOec7517bRD1fabWaGVWIlquunc8klZOnFpSeTYrSs9RLA9Sr6U4tkcvNEi7BFffO6+EdigjL7ZHu/k72I796i9zRiSJPwG4VHX0Z+AxRzNRrtksUvwf7+Gm3BtzzHPDTNgQCqwKXfZwSeNHHJz1OIT8JjtAq6xWtCLwGPLzYZi+3YV8DGMiT4VVuG7oiZpGzrZJhcs/hL49xtzH/Dy6bdfTsXYNY+5yluWO4D4neK/ZUvok/17X0HPBLsF+vuUlhfwX4j/rSfAJ4H1H0qZJ9dN7nR19frRTeBt4Fe9FwpwtN+2p1MXscGLHR9SXrmMgjONd1ZxKzpBeA71b4tNhj6JGoyFNp4GHgwUp9qplfmnFW5oTdy7NamcwCI49kv6fN5IAHgD+0rbyoBc3SOjczohbyS1drbq6pQdqumllRC/0ymTtej8gpbbuVwpQfyw66dqEZyxZKxtHpJn+tZnpnEdrYBbueF9qQn93S7HQGGHnYP7w6L+YGHNtd1FJitqPAR+hERCNOFi1i1alKO6RQnjKUxL1GNjwlMsiEhcPLYTEiT9ISbN15OY/jx4SMshe9LaJRpTvHr3C/ybFYP1PZAfwfYrPsMBtnE6SwN9ib7AhLwTrBDgUKcm06FSrTfSj187xPdVQWOk5Q8vxAfSiIUc7Z7xr6zY/+hpqwSyv0I0/QMTRb7RMgBxNodTfSPqdraz/sDjzKBrv4zu2+a2t0/HHzjd2Lbcc2sG7GtsL42K+xLfxtUgI7YHqKlqHK8HbCCXgjHT1cAdMlDetv4FnQ2lLasaOl6vmB0CMmwT/IPszSueHQqv6i/qluqF+oF9TfO2qEGTumJH0qfSv9KH0nfS/9TIp0Wboi/SRdlb6RLgU5u++9nyXYe69fYRPdil1o1WufNSdTTsp75BfllPy8/LI8G7AUuV8ek6fkvfDsCfbNDP0dvRh0CrNqTbV7LfEEGDQPJQadBtfGVMWEq3QWWdufk6ZSNsjG2PQjp3ZcnOWWing6noonSInvi0/Ex+IzAreevPhe+CawpgP1/pMTMDo64G0sTCXIM+KdOnFWRfQKdJvQzV1+Bt8OokmrdtY2yhVX2a+qrykJfMq4Ml3VR4cVzTQVz+UoNne4vcKLoyS+gyKO6EHe+75Fdt0Mbe5bRIf/wjvrVmhbqBN97RD1vxrahvBOfOYzoosH9bq94uejSOQGkVM6sN/7HelL4t10t9F4gPdVzydEOx83Gv+uNxo7XyL/FtFl8z9ZAHF4bBsrEwAABh1JREFUeAHtm1tMXEUYx//Lci13uS63Xa6lgoBQDNACkaQJNWmtDxpE+2AaEzW13h580sSmLzVqjMbEW2zQNsbaxNq+SGmsaJXSWgQboFxaLoFlodx22eW6C86cdpuFLDLdc9mzyUwyOWfP+c7MfL/zzew338zROH4MWQNPWxLw21KCCwgEOChGQ+CgOChGAoxi3KI4KEYCjGLcojgoRgKMYtyilAQ1MaeFeVHLWKVvivlL0eyW4TB88lsOtieYUW6YQlWmBfroFSmKVk0ZkoCi2qytaXDTFCXkE1cAXaQVjxmmUZVhRmHSIvw0vj2llAzUxlc/Zg7Dzx00A2FByyjRT2F3+gzK9TZsC/Q9aLKBcgVnXQpEc69OyP7aVXx04AbydUuuIqo/V/xfz+7ww4Jd8WpFvwjfa7FolT0rgINi5MZBcVCMBBjFuEVxUIwEGMW4RfkKKIdDg1Uy/VF7UsQz3wrCi6dzkBY9f3eKYyBTnAD1TXG8DkqrXcOenDv48s+se1McB/KTZwg0OqGeQ2yoYyvOitz3Oiiq5YH8GZz6exk2Mie0O7RoH44V8mfNQGb8rBC6qSbQMmKXFYHirhJVgAomXW1vnhFn2gzr2kg7YP9ElJC/uwokRNhQlk7iXSR0U6RbhMZPuS6qClCUzrOFUzjbkSpY1DpaLj/GLaEkbEMzCd0EL6P0XuimgoRugmQe11QDKpqMRY/nmNDUneyCZvNT62IgLvXohOyvdaAwZQa7iLVVp1tBy5I6qQYUVay+eAIXCagH7VB0XLs+FCvkT5vXkBVvRgUJSVdnWWCQKCStKlA0zl5qmMDVwXiPDYKGpPvGo4Tc0Ho3JE3HtWcKJ5EQ7rmlqc4zry82eQzJ3YM0JP1Tux6dphB3t5mvqQ5UAVmIyEmYZVZAKUHVgaKK1xWPKqU/cz2qBFWdacN7T3Ti4aRpZkXkFlTVYO5Ulk6RKzNsJPejezwI3/+TiL9uxXt18qxKUE5g9LgjYQlHa4dgtIzidHssLnQlYdGufLNV2fVcQTnPkyLseL3KhG+f/xcp0VbnZcWOyr8aD1Wjcatz3ZE4dS0N07ZgD0vx/DHVg6JeelNvOBpa0zBmDvVcU5FPqhpUy2AIvr6ix8BkhEg1xT+uSlA3xoLwRUsquowPiddQohIUB1WdbUIR8b7dpVtTgfiqJZnM9eLc3fbqNUVBPVk4jCOVJmxcSjBa/EkX0+H3vkRZfKWy9AkUJC2IAq0YqEPl/XiuZL2nPbOgxTet8filKxmOVek9FV2kDYcrB0goeV4UJPqw7KD8/FbxVk0v9uZa7jfWtqzByetxONueiiUSS5I6BfnbUVcyROJb0wggixdSJFlBBZMGv1N78/4bXbZrcLojGj+0pQkLCVIosLGMioxxvFo5Iir2tLFM+ls2UDSmfXxftzAFoc7ieeIsnpTRWaTe+pGqAexMFTcWuYMkG6j48Hkc399DFjVXcJE4iydaU4mzGLZZG0RdDwmwo37nIOqKZkDXCOVKkluUPsaCD/f3oedOII42ZsrqLFYRV+Pw7lFFFkklBZWfPI2DJaN4tzFdVmcxLWYOr5Fu9miye39MDquSDFRR6iQCyILk2+cekaOdQpnbAldwsHQIT5NupvS+dUlAbY9dIAN1KKas4gL4mxGmDmpNrhGv7BpDdIjnKymblc9yXSPVV+r0W5j3f01By+0ElnqZZdLjzKSbDaLAy/vSJQPl1Px8VwQ+/yMLCyvijDWUfO3wQtkgnsozK7rHwKnHxqPkoGgFo2Z/HGvKQA/5NuZBk4Z8M7NnhxEvV5gQGeydbuauzbKAohXRXXQN12LIdh4DVhnncXSLz5vVg8RJ9d72HneQ6DXZQDkrpKsoxy5k/q/DGU68+EPlA9hHu5nzQZUdZQdF9V1a0eDjyzo0dqasU5/+xdfmjeCl8nHyBdbquntq+6EIKKfSl2+H4oNLWbAsBCE3cRZvkG6WHae+buZsr+tRUVC0YhqDahsJQU22VbXdzBWQ81xxUM6Kfe0ofVjR1wgwtpeD4qAYCTCKcYvioBgJMIpxi+KgGAkwinGL4qAYCTCKcYvioBgJMIr9BxXt0eTNXoXQAAAAAElFTkSuQmCC</Image>
     <Url type="application/x-suggestions+json" template="http://api.bing.com/osjson.aspx">
         <Param name="query" value="{searchTerms}"/>
         <Param name="form" value="MOZW"/>

From 0909f112c05f50af996753907d4caa9a5619bff0 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Thu, 12 Dec 2013 13:10:54 -0800
Subject: [PATCH 084/459] Bug 932982 - Trace type constraints and allow
 preserving jitcode in GCs without also marking all type information, r=billm,
 r=jandem

---
 CLOBBER                           |   5 +-
 js/public/MemoryMetrics.h         |   1 -
 js/src/gc/Marking.cpp             |  46 +----
 js/src/gc/RootMarking.cpp         |   5 -
 js/src/gc/Statistics.cpp          |   1 -
 js/src/gc/Statistics.h            |   1 -
 js/src/gc/Zone.cpp                |  31 +--
 js/src/gc/Zone.h                  |   2 -
 js/src/jit/CodeGenerator.cpp      |   6 +-
 js/src/jit/Ion.cpp                |  17 +-
 js/src/jit/Ion.h                  |   2 +-
 js/src/jit/IonBuilder.cpp         |   6 +-
 js/src/jit/IonCode.h              |   3 +
 js/src/jit/MIR.cpp                |   2 +-
 js/src/jscompartment.cpp          |  11 +-
 js/src/jscompartment.h            |   3 -
 js/src/jsgc.cpp                   |  14 +-
 js/src/jsgc.h                     |   7 +-
 js/src/jsinfer.cpp                | 329 +++++++++++++++---------------
 js/src/jsinfer.h                  | 122 ++++-------
 js/src/jsinferinlines.h           |  78 ++-----
 js/src/vm/MemoryMetrics.cpp       |   1 -
 js/xpconnect/src/XPCJSRuntime.cpp |   4 -
 23 files changed, 260 insertions(+), 437 deletions(-)

diff --git a/CLOBBER b/CLOBBER
index f61ddd42af5e..8e6beba9f279 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -21,6 +21,5 @@
 # Are you updating CLOBBER because you think it's needed for your WebIDL
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
-Bug 928195 rewrote WebIDL build system integration from the ground up. This
-will hopefully be the last required clobber due to WebIDLs poorly interacting
-with the build system.
+
+Bug 932982 apparently requires a clobber or else we get B2G mochitest-2 failures.
diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index 95ac91b9f6d5..f974259467d5 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -393,7 +393,6 @@ struct CompartmentStats
     macro(Other,   NotLiveGCThing, baselineStubsOptimized) \
     macro(Other,   NotLiveGCThing, ionData) \
     macro(Other,   NotLiveGCThing, typeInferenceTypeScripts) \
-    macro(Other,   NotLiveGCThing, typeInferencePendingArrays) \
     macro(Other,   NotLiveGCThing, typeInferenceAllocationSiteTables) \
     macro(Other,   NotLiveGCThing, typeInferenceArrayTypeTables) \
     macro(Other,   NotLiveGCThing, typeInferenceObjectTypeTables) \
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index b0c8a6555988..d0e3bde29e8a 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1122,14 +1122,11 @@ gc::MarkCycleCollectorChildren(JSTracer *trc, Shape *shape)
 static void
 ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
 {
-    /* Don't mark properties for singletons. They'll be purged by the GC. */
-    if (!type->singleton) {
-        unsigned count = type->getPropertyCount();
-        for (unsigned i = 0; i < count; i++) {
-            types::Property *prop = type->getProperty(i);
-            if (prop && JSID_IS_STRING(prop->id))
-                PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
-        }
+    unsigned count = type->getPropertyCount();
+    for (unsigned i = 0; i < count; i++) {
+        types::Property *prop = type->getProperty(i);
+        if (prop && JSID_IS_STRING(prop->id))
+            PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
     }
 
     if (TaggedProto(type->proto).isObject())
@@ -1350,7 +1347,7 @@ GCMarker::restoreValueArray(JSObject *obj, void **vpp, void **endp)
 }
 
 void
-GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr)
+GCMarker::processMarkStackOther(uintptr_t tag, uintptr_t addr)
 {
     if (tag == TypeTag) {
         ScanTypeObject(this, reinterpret_cast<types::TypeObject *>(addr));
@@ -1364,35 +1361,6 @@ GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t ad
             pushObject(obj);
     } else if (tag == IonCodeTag) {
         MarkChildren(this, reinterpret_cast<jit::IonCode *>(addr));
-    } else if (tag == ArenaTag) {
-        ArenaHeader *aheader = reinterpret_cast<ArenaHeader *>(addr);
-        AllocKind thingKind = aheader->getAllocKind();
-        size_t thingSize = Arena::thingSize(thingKind);
-
-        for ( ; aheader; aheader = aheader->next) {
-            Arena *arena = aheader->getArena();
-            FreeSpan firstSpan(aheader->getFirstFreeSpan());
-            const FreeSpan *span = &firstSpan;
-
-            for (uintptr_t thing = arena->thingsStart(thingKind); ; thing += thingSize) {
-                JS_ASSERT(thing <= arena->thingsEnd());
-                if (thing == span->first) {
-                    if (!span->hasNext())
-                        break;
-                    thing = span->last;
-                    span = span->nextSpan();
-                } else {
-                    JSObject *object = reinterpret_cast<JSObject *>(thing);
-                    if (object->hasSingletonType() && object->markIfUnmarked(getMarkColor()))
-                        pushObject(object);
-                    budget.step();
-                }
-            }
-            if (budget.isOverBudget()) {
-                pushArenaList(aheader);
-                return;
-            }
-        }
     }
 }
 
@@ -1430,7 +1398,7 @@ GCMarker::processMarkStackTop(SliceBudget &budget)
         goto scan_obj;
     }
 
-    processMarkStackOther(budget, tag, addr);
+    processMarkStackOther(tag, addr);
     return;
 
   scan_value_array:
diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index 8ae3e85fd559..541ad84d996c 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -726,11 +726,6 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
         if (IS_GC_MARKING_TRACER(trc) && !zone->isCollecting())
             continue;
 
-        if (IS_GC_MARKING_TRACER(trc) && zone->isPreservingCode()) {
-            gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_MARK_TYPES);
-            zone->markTypes(trc);
-        }
-
         /* Do not discard scripts with counts while profiling. */
         if (rt->profilingScripts && !rt->isHeapMinorCollecting()) {
             for (CellIterUnderGC i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 7744b61d53f5..be76eee734a1 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -276,7 +276,6 @@ static const PhaseInfo phases[] = {
     { PHASE_PURGE, "Purge", PHASE_NO_PARENT },
     { PHASE_MARK, "Mark", PHASE_NO_PARENT },
     { PHASE_MARK_ROOTS, "Mark Roots", PHASE_MARK },
-    { PHASE_MARK_TYPES, "Mark Types", PHASE_MARK_ROOTS },
     { PHASE_MARK_DELAYED, "Mark Delayed", PHASE_MARK },
     { PHASE_SWEEP, "Sweep", PHASE_NO_PARENT },
     { PHASE_SWEEP_MARK, "Mark During Sweeping", PHASE_SWEEP },
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 3240fd238f53..1029fd52fe8e 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -28,7 +28,6 @@ enum Phase {
     PHASE_PURGE,
     PHASE_MARK,
     PHASE_MARK_ROOTS,
-    PHASE_MARK_TYPES,
     PHASE_MARK_DELAYED,
     PHASE_SWEEP,
     PHASE_SWEEP_MARK,
diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
index ad0c2fae7fde..539faabbd7c8 100644
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -80,35 +80,6 @@ Zone::setNeedsBarrier(bool needs, ShouldUpdateIon updateIon)
     needsBarrier_ = needs;
 }
 
-void
-Zone::markTypes(JSTracer *trc)
-{
-    /*
-     * Mark all scripts, type objects and singleton JS objects in the
-     * compartment. These can be referred to directly by type sets, which we
-     * cannot modify while code which depends on these type sets is active.
-     */
-    JS_ASSERT(isPreservingCode());
-
-    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
-        JSScript *script = i.get<JSScript>();
-        MarkScriptRoot(trc, &script, "mark_types_script");
-        JS_ASSERT(script == i.get<JSScript>());
-    }
-
-    for (size_t thingKind = FINALIZE_OBJECT0; thingKind < FINALIZE_OBJECT_LIMIT; thingKind++) {
-        ArenaHeader *aheader = allocator.arenas.getFirstArena(static_cast<AllocKind>(thingKind));
-        if (aheader)
-            trc->runtime->gcMarker.pushArenaList(aheader);
-    }
-
-    for (CellIterUnderGC i(this, FINALIZE_TYPE_OBJECT); !i.done(); i.next()) {
-        types::TypeObject *type = i.get<types::TypeObject>();
-        MarkTypeObjectRoot(trc, &type, "mark_types_scan");
-        JS_ASSERT(type == i.get<types::TypeObject>());
-    }
-}
-
 void
 Zone::resetGCMallocBytes()
 {
@@ -144,7 +115,7 @@ Zone::sweep(FreeOp *fop, bool releaseTypes)
     if (active)
         releaseTypes = false;
 
-    if (!isPreservingCode()) {
+    {
         gcstats::AutoPhase ap(fop->runtime()->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
         types.sweep(fop, releaseTypes);
     }
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index ebad06d0b6c9..a2fe6a22a022 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -310,8 +310,6 @@ struct Zone : public JS::shadow::Zone,
         js_ReportAllocationOverflow(nullptr);
     }
 
-    void markTypes(JSTracer *trc);
-
     js::types::TypeZone types;
 
     void sweep(js::FreeOp *fop, bool releaseTypes);
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 63efbd13937e..09fa15507436 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -5825,7 +5825,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                      safepoints_.size(), callTargets.length(),
                      patchableBackedges_.length());
     if (!ionScript) {
-        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
         return false;
     }
 
@@ -5850,7 +5850,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         // Use js_free instead of IonScript::Destroy: the cache list and
         // backedge list are still uninitialized.
         js_free(ionScript);
-        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
         return false;
     }
 
@@ -5871,7 +5871,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                         /* resetUses */ false, /* cancelOffThread*/ false))
         {
             js_free(ionScript);
-            recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
+            recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
             return false;
         }
     }
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 3ca40db2aad5..c103cc61bd38 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2481,7 +2481,7 @@ jit::InvalidateAll(FreeOp *fop, Zone *zone)
 
 
 void
-jit::Invalidate(types::TypeCompartment &types, FreeOp *fop,
+jit::Invalidate(types::TypeZone &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
@@ -2564,7 +2564,7 @@ void
 jit::Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
-    jit::Invalidate(cx->compartment()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
+    jit::Invalidate(cx->zone()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
                     cancelOffThread);
 }
 
@@ -2611,14 +2611,13 @@ FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool p
     else
         script->setIonScript(nullptr);
 
-    // If this script has Ion code on the stack, invalidation() will return
-    // true. In this case we have to wait until destroying it.
-    if (!ionScript->invalidated()) {
-        types::TypeCompartment &types = script->compartment()->types;
-        ionScript->recompileInfo().compilerOutput(types)->invalidate();
+    types::TypeZone &types = script->zone()->types;
+    ionScript->recompileInfo().compilerOutput(types)->invalidate();
 
+    // If this script has Ion code on the stack, invalidated() will return
+    // true. In this case we have to wait until destroying it.
+    if (!ionScript->invalidated())
         jit::IonScript::Destroy(fop, ionScript);
-    }
 }
 
 void
@@ -2637,8 +2636,6 @@ jit::FinishDiscardJitCode(FreeOp *fop, JSCompartment *comp)
     // Free optimized baseline stubs.
     if (comp->jitCompartment())
         comp->jitCompartment()->optimizedStubSpace()->free();
-
-    comp->types.clearCompilerOutputs(fop);
 }
 
 void
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index bf495ccf0e43..ac9a0562714a 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -364,7 +364,7 @@ IonExecStatus IonCannon(JSContext *cx, RunState &state);
 IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
-void Invalidate(types::TypeCompartment &types, FreeOp *fop,
+void Invalidate(types::TypeZone &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
                 bool cancelOffThread = true);
 void Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index ef0a2e6b7986..2c210df8eb92 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6296,7 +6296,7 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints(), staticType))
+        property.configured(constraints()))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -6386,7 +6386,7 @@ IonBuilder::setStaticName(JSObject *staticObject, PropertyName *name)
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints(), staticType))
+        property.configured(constraints()))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -7836,7 +7836,7 @@ IonBuilder::getDefiniteSlot(types::TemporaryTypeSet *types, PropertyName *name,
     *property = type->property(id);
     return property->maybeTypes() &&
            property->maybeTypes()->definiteProperty() &&
-           !property->configured(constraints(), type);
+           !property->configured(constraints());
 }
 
 bool
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index 8167d1fa80e9..4acc08d50993 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -526,6 +526,9 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
+    types::RecompileInfo& recompileInfoRef() {
+        return recompileInfo_;
+    }
     uint32_t incrOsrPcMismatchCounter() {
         return ++osrPcMismatchCounter_;
     }
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index aad9234a367f..882b468f6a7b 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3025,7 +3025,7 @@ jit::PropertyReadIsIdempotent(types::CompilerConstraintList *constraints,
 
             // Check if the property has been reconfigured or is a getter.
             types::HeapTypeSetKey property = object->property(NameToId(name));
-            if (property.configured(constraints, object))
+            if (property.configured(constraints))
                 return false;
         }
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 2d1fbff3ca19..84f911528a8e 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -48,7 +48,6 @@ JSCompartment::JSCompartment(Zone *zone, const JS::CompartmentOptions &options =
 #endif
     global_(nullptr),
     enterCompartmentDepth(0),
-    lastCodeRelease(0),
     data(nullptr),
     objectMetadataCallback(nullptr),
     lastAnimationTime(0),
@@ -545,13 +544,6 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
         WeakMapBase::sweepCompartment(this);
     }
 
-    if (zone()->isPreservingCode()) {
-        gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
-        types.sweepShapes(fop);
-    } else {
-        JS_ASSERT(!types.constrainedOutputs);
-    }
-
     NativeIterator *ni = enumerators->next();
     while (ni != enumerators) {
         JSObject *iterObj = ni->iterObj();
@@ -856,7 +848,6 @@ JSCompartment::clearTraps(FreeOp *fop)
 
 void
 JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                      size_t *tiPendingArrays,
                                       size_t *tiAllocationSiteTables,
                                       size_t *tiArrayTypeTables,
                                       size_t *tiObjectTypeTables,
@@ -868,7 +859,7 @@ JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                       size_t *baselineStubsOptimized)
 {
     *compartmentObject += mallocSizeOf(this);
-    types.addSizeOfExcludingThis(mallocSizeOf, tiPendingArrays, tiAllocationSiteTables,
+    types.addSizeOfExcludingThis(mallocSizeOf, tiAllocationSiteTables,
                                  tiArrayTypeTables, tiObjectTypeTables);
     *shapesCompartmentTables += baseShapes.sizeOfExcludingThis(mallocSizeOf)
                               + initialShapes.sizeOfExcludingThis(mallocSizeOf)
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index 15a93afe1280..f44c2b09e390 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -187,8 +187,6 @@ struct JSCompartment
      */
     void adoptWorkerAllocator(js::Allocator *workerAllocator);
 
-
-    int64_t                      lastCodeRelease;
     bool                         activeAnalysis;
 
     /* Type information about the scripts and objects in this compartment. */
@@ -221,7 +219,6 @@ struct JSCompartment
 
   public:
     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                size_t *tiPendingArrays,
                                 size_t *tiAllocationSiteTables,
                                 size_t *tiArrayTypeTables,
                                 size_t *tiObjectTypeTables,
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 909dff6c5c63..80d2b3fafd45 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2857,13 +2857,9 @@ ShouldPreserveJITCode(JSCompartment *comp, int64_t currentTime)
 
     if (rt->alwaysPreserveCode)
         return true;
-    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime &&
-        comp->lastCodeRelease + (PRMJ_USEC_PER_SEC * 300) >= currentTime)
-    {
+    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime)
         return true;
-    }
 
-    comp->lastCodeRelease = currentTime;
     return false;
 }
 
@@ -3942,12 +3938,12 @@ BeginSweepingZoneGroup(JSRuntime *rt)
         bool releaseTypes = ReleaseObservedTypes(rt);
         for (GCCompartmentGroupIter c(rt); !c.done(); c.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            c->sweep(&fop, releaseTypes);
+            c->sweep(&fop, releaseTypes && !c->zone()->isPreservingCode());
         }
 
         for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            zone->sweep(&fop, releaseTypes);
+            zone->sweep(&fop, releaseTypes && !zone->isPreservingCode());
         }
     }
 
@@ -5304,10 +5300,6 @@ js::ReleaseAllJITCode(FreeOp *fop)
             jit::FinishDiscardBaselineScript(fop, script);
         }
     }
-
-    /* Sweep now invalidated compiler outputs from each compartment. */
-    for (CompartmentsIter comp(fop->runtime(), SkipAtoms); !comp.done(); comp.next())
-        comp->types.clearCompilerOutputs(fop);
 #endif
 }
 
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 2e5cbe360930..9159f31ec024 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -1091,7 +1091,6 @@ struct GCMarker : public JSTracer {
         ObjectTag,
         TypeTag,
         XmlTag,
-        ArenaTag,
         SavedValueArrayTag,
         IonCodeTag,
         LastTag = IonCodeTag
@@ -1119,10 +1118,6 @@ struct GCMarker : public JSTracer {
         pushTaggedPtr(ObjectTag, obj);
     }
 
-    void pushArenaList(gc::ArenaHeader *firstArena) {
-        pushTaggedPtr(ArenaTag, firstArena);
-    }
-
     void pushType(types::TypeObject *type) {
         pushTaggedPtr(TypeTag, type);
     }
@@ -1229,7 +1224,7 @@ struct GCMarker : public JSTracer {
     bool restoreValueArray(JSObject *obj, void **vpp, void **endp);
     void saveValueRanges();
     inline void processMarkStackTop(SliceBudget &budget);
-    void processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr);
+    void processMarkStackOther(uintptr_t tag, uintptr_t addr);
 
     void appendGrayRoot(void *thing, JSGCTraceKind kind);
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 0c1fe0167a3c..51c19af54640 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -243,14 +243,6 @@ types::TypeHasProperty(JSContext *cx, TypeObject *obj, jsid id, const Value &val
         if (id == id___proto__(cx) || id == id_constructor(cx) || id == id_caller(cx))
             return true;
 
-        /*
-         * If we called in here while resolving a type constraint, we may be in the
-         * middle of resolving a standard class and the type sets will not be updated
-         * until the outer TypeSet::add finishes.
-         */
-        if (cx->compartment()->types.pendingCount)
-            return true;
-
         Type type = GetValueType(value);
 
         AutoEnterAnalysis enter(cx);
@@ -742,12 +734,12 @@ class TypeCompilerConstraint : public TypeConstraint
 
     void newType(JSContext *cx, TypeSet *source, Type type) {
         if (data.invalidateOnNewType(type))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
     }
 
     void newPropertyState(JSContext *cx, TypeSet *source) {
         if (data.invalidateOnNewPropertyState(source))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
     }
 
     void newObjectState(JSContext *cx, TypeObject *object) {
@@ -755,7 +747,16 @@ class TypeCompilerConstraint : public TypeConstraint
         // will be sent on changes to its state, so always invalidate any
         // associated compilations.
         if (object->unknownProperties() || data.invalidateOnNewObjectState(object))
-            cx->compartment()->types.addPendingRecompile(cx, compilation);
+            cx->zone()->types.addPendingRecompile(cx, compilation);
+    }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (data.shouldSweep() || compilation.shouldSweep(zone))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeCompilerConstraint<T> >(compilation, data);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
     }
 };
 
@@ -908,13 +909,21 @@ class TypeConstraintFreezeStack : public TypeConstraint
 
     const char *kind() { return "freezeStack"; }
 
-    void newType(JSContext *cx, TypeSet *source, Type type)
-    {
+    void newType(JSContext *cx, TypeSet *source, Type type) {
         /*
          * Unlike TypeConstraintFreeze, triggering this constraint once does
          * not disable it on future changes to the type set.
          */
-        cx->compartment()->types.addPendingRecompile(cx, script_);
+        cx->zone()->types.addPendingRecompile(cx, script_);
+    }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsScriptAboutToBeFinalized(&script_))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintFreezeStack>(script_);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
     }
 };
 
@@ -929,15 +938,22 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
 
     CompilerOutput co(script, executionMode);
 
-    TypeCompartment &types = cx->compartment()->types;
-    if (!types.constrainedOutputs) {
-        types.constrainedOutputs = cx->new_< Vector<CompilerOutput> >(cx);
-        if (!types.constrainedOutputs)
+    TypeZone &types = cx->zone()->types;
+    if (!types.compilerOutputs) {
+        types.compilerOutputs = cx->new_< Vector<CompilerOutput> >(cx);
+        if (!types.compilerOutputs)
             return false;
     }
 
-    uint32_t index = types.constrainedOutputs->length();
-    if (!types.constrainedOutputs->append(co))
+#ifdef DEBUG
+    for (size_t i = 0; i < types.compilerOutputs->length(); i++) {
+        const CompilerOutput &co = (*types.compilerOutputs)[i];
+        JS_ASSERT_IF(co.isValid(), co.script() != script || co.mode() != executionMode);
+    }
+#endif
+
+    uint32_t index = types.compilerOutputs->length();
+    if (!types.compilerOutputs->append(co))
         return false;
 
     *precompileInfo = RecompileInfo(index);
@@ -979,8 +995,8 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
             array[i].add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeStack>(entry.script), false);
     }
 
-    if (!succeeded || types.constrainedOutputs->back().pendingInvalidation()) {
-        types.constrainedOutputs->back().invalidate();
+    if (!succeeded || types.compilerOutputs->back().pendingInvalidation()) {
+        types.compilerOutputs->back().invalidate();
         script->resetUseCount();
         return false;
     }
@@ -1009,6 +1025,8 @@ class ConstraintDataFreeze
                ? property.maybeTypes()->isSubset(expected)
                : property.maybeTypes()->empty();
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1195,6 +1213,8 @@ class ConstraintDataFreezeObjectFlags
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1289,6 +1309,8 @@ class ConstraintDataFreezeObjectForInlinedCall
     {
         return true;
     }
+
+    bool shouldSweep() { return false; }
 };
 
 // Constraint which triggers recompilation when the template object for a
@@ -1315,6 +1337,11 @@ class ConstraintDataFreezeObjectForNewScriptTemplate
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() {
+        // Note: |templateObject| is only used for equality testing.
+        return false;
+    }
 };
 
 // Constraint which triggers recompilation when the underlying data pointer for
@@ -1341,6 +1368,11 @@ class ConstraintDataFreezeObjectForTypedArrayBuffer
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
+
+    bool shouldSweep() {
+        // Note: |viewData| is only used for equality testing.
+        return false;
+    }
 };
 
 } /* anonymous namespace */
@@ -1413,10 +1445,7 @@ namespace {
 class ConstraintDataFreezeConfiguredProperty
 {
   public:
-    TypeObjectKey *object;
-
-    ConstraintDataFreezeConfiguredProperty(TypeObjectKey *object)
-      : object(object)
+    ConstraintDataFreezeConfiguredProperty()
     {}
 
     const char *kind() { return "freezeConfiguredProperty"; }
@@ -1430,31 +1459,16 @@ class ConstraintDataFreezeConfiguredProperty
     bool constraintHolds(JSContext *cx,
                          const HeapTypeSetKey &property, TemporaryTypeSet *expected)
     {
-        // Everywhere compiled code depends on definite properties associated
-        // with a type object's newScript, we need to make sure there are
-        // constraints in place which will mark those properties as configured
-        // should the definite properties be invalidated.
-        TypeObject *type = object->isSingleObject()
-                           ? object->asSingleObject()->type()
-                           : object->asTypeObject();
-        if (type->flags & OBJECT_FLAG_NEW_SCRIPT_REGENERATE) {
-            type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
-            if (type->hasNewScript()) {
-                CheckNewScriptProperties(cx, type, type->newScript()->fun);
-            } else {
-                JS_ASSERT(type->flags & OBJECT_FLAG_ADDENDUM_CLEARED);
-                type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
-            }
-        }
-
         return !property.maybeTypes()->configuredProperty();
     }
+
+    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
 
 bool
-HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *type)
+HeapTypeSetKey::configured(CompilerConstraintList *constraints)
 {
     if (maybeTypes() && maybeTypes()->configuredProperty())
         return true;
@@ -1463,7 +1477,7 @@ HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *t
 
     typedef CompilerConstraintInstance<ConstraintDataFreezeConfiguredProperty> T;
     constraints->add(alloc->new_<T>(alloc, *this,
-                                    ConstraintDataFreezeConfiguredProperty(type)));
+                                    ConstraintDataFreezeConfiguredProperty()));
     return false;
 }
 
@@ -1986,7 +2000,7 @@ PrototypeHasIndexedProperty(CompilerConstraintList *constraints, JSObject *obj)
         if (type->unknownProperties())
             return true;
         HeapTypeSetKey index = type->property(JSID_VOID);
-        if (index.configured(constraints, type) || index.isOwnProperty(constraints))
+        if (index.configured(constraints) || index.isOwnProperty(constraints))
             return true;
         obj = obj->getProto();
     } while (obj);
@@ -2024,27 +2038,8 @@ types::TypeCanHaveExtraIndexedProperties(CompilerConstraintList *constraints,
     return PrototypeHasIndexedProperty(constraints, proto);
 }
 
-bool
-TypeCompartment::growPendingArray(JSContext *cx)
-{
-    unsigned newCapacity = js::Max(unsigned(100), pendingCapacity * 2);
-    PendingWork *newArray = js_pod_calloc<PendingWork>(newCapacity);
-    if (!newArray) {
-        cx->compartment()->types.setPendingNukeTypes(cx);
-        return false;
-    }
-
-    PodCopy(newArray, pendingArray, pendingCount);
-    js_free(pendingArray);
-
-    pendingArray = newArray;
-    pendingCapacity = newCapacity;
-
-    return true;
-}
-
 void
-TypeCompartment::processPendingRecompiles(FreeOp *fop)
+TypeZone::processPendingRecompiles(FreeOp *fop)
 {
     if (!pendingRecompiles)
         return;
@@ -2095,11 +2090,9 @@ TypeZone::nukeTypes(FreeOp *fop)
      */
     JS_ASSERT(pendingNukeTypes);
 
-    for (CompartmentsInZoneIter comp(zone()); !comp.done(); comp.next()) {
-        if (comp->types.pendingRecompiles) {
-            fop->free_(comp->types.pendingRecompiles);
-            comp->types.pendingRecompiles = nullptr;
-        }
+    if (pendingRecompiles) {
+        fop->free_(pendingRecompiles);
+        pendingRecompiles = nullptr;
     }
 
     inferenceEnabled = false;
@@ -2119,7 +2112,7 @@ TypeZone::nukeTypes(FreeOp *fop)
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
+TypeZone::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 {
     CompilerOutput *co = info.compilerOutput(cx);
     if (!co || !co->isValid() || co->pendingInvalidation())
@@ -2145,7 +2138,7 @@ TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, JSScript *script)
+TypeZone::addPendingRecompile(JSContext *cx, JSScript *script)
 {
     JS_ASSERT(script);
 
@@ -3146,6 +3139,15 @@ class TypeConstraintClearDefiniteGetterSetter : public TypeConstraint
     }
 
     void newType(JSContext *cx, TypeSet *source, Type type) {}
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsTypeObjectAboutToBeFinalized(&object))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteGetterSetter>(object);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
+    }
 };
 
 bool
@@ -3192,6 +3194,15 @@ class TypeConstraintClearDefiniteSingle : public TypeConstraint
         if (source->baseFlags() || source->getObjectCount() > 1)
             object->clearAddendum(cx);
     }
+
+    TypeConstraint *sweep(TypeZone &zone) {
+        if (IsTypeObjectAboutToBeFinalized(&object))
+            return nullptr;
+        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteSingle>(object);
+        if (!res)
+            zone.setPendingNukeTypes();
+        return res;
+    }
 };
 
 void
@@ -3941,8 +3952,19 @@ ConstraintTypeSet::sweep(Zone *zone)
         }
     }
 
-    /* All constraints are wiped out on each GC. */
+    /*
+     * Type constraints only hold weak references. Copy constraints referring
+     * to data that is still live into the zone's new arena.
+     */
+    TypeConstraint *constraint = constraintList;
     constraintList = nullptr;
+    while (constraint) {
+        if (TypeConstraint *copy = constraint->sweep(zone->types)) {
+            copy->next = constraintList;
+            constraintList = copy;
+        }
+        constraint = constraint->next;
+    }
 }
 
 inline void
@@ -3962,18 +3984,6 @@ TypeObject::clearProperties()
 inline void
 TypeObject::sweep(FreeOp *fop)
 {
-    if (singleton) {
-        JS_ASSERT(!hasNewScript());
-
-        /*
-         * All properties can be discarded. We will regenerate them as needed
-         * as code gets reanalyzed.
-         */
-        clearProperties();
-
-        return;
-    }
-
     if (!isMarked()) {
         if (addendum)
             fop->free_(addendum);
@@ -3996,6 +4006,14 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < oldCapacity; i++) {
             Property *prop = oldArray[i];
             if (prop) {
+                if (singleton && !prop->types.constraintList) {
+                    /*
+                     * Don't copy over properties of singleton objects which
+                     * don't have associated constraints. The contents of these
+                     * type sets will be regenerated as necessary.
+                     */
+                    continue;
+                }
                 Property *newProp = typeLifoAlloc.new_<Property>(*prop);
                 if (newProp) {
                     Property **pentry =
@@ -4015,12 +4033,17 @@ TypeObject::sweep(FreeOp *fop)
         setBasePropertyCount(propertyCount);
     } else if (propertyCount == 1) {
         Property *prop = (Property *) propertySet;
-        Property *newProp = typeLifoAlloc.new_<Property>(*prop);
-        if (newProp) {
-            propertySet = (Property **) newProp;
-            newProp->types.sweep(zone());
+        if (singleton && !prop->types.constraintList) {
+            // Skip, as above.
+            clearProperties();
         } else {
-            zone()->types.setPendingNukeTypes();
+            Property *newProp = typeLifoAlloc.new_<Property>(*prop);
+            if (newProp) {
+                propertySet = (Property **) newProp;
+                newProp->types.sweep(zone());
+            } else {
+                zone()->types.setPendingNukeTypes();
+            }
         }
     }
 
@@ -4028,14 +4051,6 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < basePropertyCount(); i++)
             JS_ASSERT(propertySet[i]);
     }
-
-    /*
-     * The GC will clear out the constraints ensuring the correctness of the
-     * newScript information, these constraints will need to be regenerated
-     * the next time we compile code which depends on this info.
-     */
-    if (hasNewScript())
-        flags |= OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
 }
 
 void
@@ -4119,52 +4134,6 @@ TypeCompartment::sweep(FreeOp *fop)
                 e.rekeyFront(key);
         }
     }
-
-    /*
-     * The pending array is reset on GC, it can grow large (75+ KB) and is easy
-     * to reallocate if the compartment becomes active again.
-     */
-    if (pendingArray)
-        fop->free_(pendingArray);
-
-    pendingArray = nullptr;
-    pendingCapacity = 0;
-}
-
-void
-TypeCompartment::sweepShapes(FreeOp *fop)
-{
-    /*
-     * Sweep any weak shape references that may be finalized even if a GC is
-     * preserving type information.
-     */
-    if (objectTypeTable) {
-        for (ObjectTypeTable::Enum e(*objectTypeTable); !e.empty(); e.popFront()) {
-            const ObjectTableKey &key = e.front().key();
-            ObjectTableEntry &entry = e.front().value();
-
-            if (IsShapeAboutToBeFinalized(entry.shape.unsafeGet())) {
-                fop->free_(key.properties);
-                fop->free_(entry.types);
-                e.removeFront();
-            }
-        }
-    }
-}
-
-void
-TypeCompartment::clearCompilerOutputs(FreeOp *fop)
-{
-    if (constrainedOutputs) {
-        fop->delete_(constrainedOutputs);
-        constrainedOutputs = nullptr;
-    }
-
-    if (pendingRecompiles) {
-        JS_ASSERT(pendingRecompiles->length() == 0);
-        fop->delete_(pendingRecompiles);
-        pendingRecompiles = nullptr;
-    }
 }
 
 void
@@ -4193,7 +4162,6 @@ JSCompartment::sweepNewTypeObjectTable(TypeObjectWithNewScriptSet &table)
 
 TypeCompartment::~TypeCompartment()
 {
-    js_free(pendingArray);
     js_delete(arrayTypeTable);
     js_delete(objectTypeTable);
     js_delete(allocationSiteTable);
@@ -4212,12 +4180,6 @@ TypeScript::Sweep(FreeOp *fop, JSScript *script)
     /* Remove constraints and references to dead objects from the persistent type sets. */
     for (unsigned i = 0; i < num; i++)
         typeArray[i].sweep(compartment->zone());
-
-    /*
-     * Freeze constraints on stack type sets need to be regenerated the next
-     * time the script is analyzed.
-     */
-    script->clearHasFreezeConstraints();
 }
 
 void
@@ -4234,20 +4196,10 @@ Zone::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, size_t *typePoo
 
 void
 TypeCompartment::addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                        size_t *pendingArrays,
                                         size_t *allocationSiteTables,
                                         size_t *arrayTypeTables,
                                         size_t *objectTypeTables)
 {
-    /* Pending arrays are cleared on GC along with the analysis pool. */
-    *pendingArrays += mallocSizeOf(pendingArray);
-
-    /*
-     * TypeCompartment::pendingRecompiles is non-nullptr only while inference
-     * code is running.
-     */
-    JS_ASSERT(!pendingRecompiles);
-
     if (allocationSiteTable)
         *allocationSiteTables += allocationSiteTable->sizeOfIncludingThis(mallocSizeOf);
 
@@ -4289,6 +4241,8 @@ TypeObject::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
 TypeZone::TypeZone(Zone *zone)
   : zone_(zone),
     typeLifoAlloc(TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
+    compilerOutputs(nullptr),
+    pendingRecompiles(nullptr),
     pendingNukeTypes(false),
     inferenceEnabled(false)
 {
@@ -4296,6 +4250,8 @@ TypeZone::TypeZone(Zone *zone)
 
 TypeZone::~TypeZone()
 {
+    js_delete(compilerOutputs);
+    js_delete(pendingRecompiles);
 }
 
 void
@@ -4312,11 +4268,21 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
     LifoAlloc oldAlloc(typeLifoAlloc.defaultChunkSize());
     oldAlloc.steal(&typeLifoAlloc);
 
-    /*
-     * Sweep analysis information and everything depending on it from the
-     * compartment, including all remaining mjit code if inference is
-     * enabled in the compartment.
-     */
+    /* Sweep and find compressed indexes for each compiler output. */
+    size_t newCompilerOutputCount = 0;
+    if (compilerOutputs) {
+        for (size_t i = 0; i < compilerOutputs->length(); i++) {
+            CompilerOutput &output = (*compilerOutputs)[i];
+            if (output.isValid()) {
+                JSScript *script = output.script();
+                if (IsScriptAboutToBeFinalized(&script))
+                    output.invalidate();
+                else
+                    output.setSweepIndex(newCompilerOutputCount++);
+            }
+        }
+    }
+
     if (inferenceEnabled) {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_TI);
 
@@ -4328,6 +4294,21 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
                 if (releaseTypes) {
                     script->types->destroy();
                     script->types = nullptr;
+
+                    /*
+                     * Freeze constraints on stack type sets need to be
+                     * regenerated the next time the script is analyzed.
+                     */
+                    script->clearHasFreezeConstraints();
+
+                    JS_ASSERT(!script->hasIonScript());
+                    JS_ASSERT(!script->hasParallelIonScript());
+                } else {
+                    /* Update the recompile indexes in any IonScripts still on the script. */
+                    if (script->hasIonScript())
+                        script->ionScript()->recompileInfoRef().shouldSweep(*this);
+                    if (script->hasParallelIonScript())
+                        script->parallelIonScript()->recompileInfoRef().shouldSweep(*this);
                 }
             }
         }
@@ -4347,6 +4328,20 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
             comp->types.sweep(fop);
     }
 
+    if (compilerOutputs) {
+        size_t sweepIndex = 0;
+        for (size_t i = 0; i < compilerOutputs->length(); i++) {
+            CompilerOutput output = (*compilerOutputs)[i];
+            if (output.isValid()) {
+                JS_ASSERT(sweepIndex == output.sweepIndex());
+                output.setSweepIndex(0);
+                (*compilerOutputs)[sweepIndex++] = output;
+            }
+        }
+        JS_ASSERT(sweepIndex == newCompilerOutputCount);
+        JS_ALWAYS_TRUE(compilerOutputs->resize(newCompilerOutputCount));
+    }
+
     {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_CLEAR_SCRIPT_ANALYSIS);
         for (CellIterUnderGC i(zone(), FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 690631dfa7ad..38c3be127e82 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -177,7 +177,7 @@ namespace analyze {
 
 namespace types {
 
-class TypeCompartment;
+class TypeZone;
 class TypeSet;
 class TypeObjectKey;
 
@@ -278,28 +278,10 @@ inline Type GetValueType(const Value &val);
  * Type information about the values observed within scripts and about the
  * contents of the heap is accumulated as the program executes. Compilation
  * accumulates constraints relating type information on the heap with the
- * compilations that should be invalidated when those types change. This data
- * is periodically cleared to reduce memory usage.
- *
- * GCs may clear both analysis information and jitcode. Sometimes GCs will
- * preserve all information and code, and will not collect any scripts, type
- * objects or singleton JS objects.
- *
- * The following data is cleared by all non-preserving GCs:
- *
- * - The ScriptAnalysis for each analyzed script and data from each analysis
- *   pass performed.
- *
- * - Property type sets for singleton JS objects.
- *
- * - Type constraints and dead references in all type sets.
- *
- * The following data is occasionally cleared by non-preserving GCs:
- *
- * - TypeScripts and their type sets are occasionally destroyed, per a timer.
- *
- * - When a JSScript or TypeObject is swept, type information for its contents
- *   is destroyed.
+ * compilations that should be invalidated when those types change. Type
+ * information and constraints are allocated in the zone's typeLifoAlloc,
+ * and on GC all data referring to live things is copied into a new allocator.
+ * Thus, type set and constraints only hold weak references.
  */
 
 /*
@@ -334,6 +316,12 @@ public:
      * state.
      */
     virtual void newObjectState(JSContext *cx, TypeObject *object) {}
+
+    /*
+     * If the data this constraint refers to is still live, copy it into the
+     * zone's new allocator. Type constraints only hold weak references.
+     */
+    virtual TypeConstraint *sweep(TypeZone &zone) = 0;
 };
 
 /* Flags and other state stored in TypeSet::flags */
@@ -394,13 +382,6 @@ enum {
     /* If set, addendum information should not be installed on this object. */
     OBJECT_FLAG_ADDENDUM_CLEARED      = 0x2,
 
-    /*
-     * If set, type constraints covering the correctness of the newScript
-     * definite properties need to be regenerated before compiling any jitcode
-     * which depends on this information.
-     */
-    OBJECT_FLAG_NEW_SCRIPT_REGENERATE = 0x4,
-
     /*
      * Whether we have ensured all type sets in the compartment contain
      * ANYOBJECT instead of this object.
@@ -869,12 +850,6 @@ struct TypeTypedObject : public TypeObjectAddendum
  * information is sensitive to changes in the property's type. Future changes
  * to the property (whether those uncovered by analysis or those occurring
  * in the VM) will treat these properties like those of any other type object.
- *
- * When a GC occurs, we wipe out all analysis information for all the
- * compartment's scripts, so can destroy all properties on singleton type
- * objects at the same time. If there is no reference on the stack to the
- * type object itself, the type object is also destroyed, and the JS object
- * reverts to having a lazy type.
  */
 
 /* Type information about an object accessed by a script. */
@@ -1316,7 +1291,7 @@ class HeapTypeSetKey
 
     void freeze(CompilerConstraintList *constraints);
     JSValueType knownTypeTag(CompilerConstraintList *constraints);
-    bool configured(CompilerConstraintList *constraints, TypeObjectKey *type);
+    bool configured(CompilerConstraintList *constraints);
     bool isOwnProperty(CompilerConstraintList *constraints);
     bool knownSubset(CompilerConstraintList *constraints, const HeapTypeSetKey &other);
     JSObject *singleton(CompilerConstraintList *constraints);
@@ -1339,6 +1314,10 @@ class CompilerOutput
     // Whether this compilation is about to be invalidated.
     bool pendingInvalidation_ : 1;
 
+    // During sweeping, the list of compiler outputs is compacted and invalidated
+    // outputs are removed. This gives the new index for a valid compiler output.
+    uint32_t sweepIndex_ : 29;
+
   public:
     CompilerOutput()
       : script_(nullptr), mode_(SequentialExecution), pendingInvalidation_(false)
@@ -1366,6 +1345,15 @@ class CompilerOutput
     bool pendingInvalidation() {
         return pendingInvalidation_;
     }
+
+    void setSweepIndex(uint32_t index) {
+        if (index >= 1 << 29)
+            MOZ_CRASH();
+        sweepIndex_ = index;
+    }
+    uint32_t sweepIndex() {
+        return sweepIndex_;
+    }
 };
 
 class RecompileInfo
@@ -1380,8 +1368,9 @@ class RecompileInfo
     bool operator == (const RecompileInfo &o) const {
         return outputIndex == o.outputIndex;
     }
-    CompilerOutput *compilerOutput(TypeCompartment &types) const;
+    CompilerOutput *compilerOutput(TypeZone &types) const;
     CompilerOutput *compilerOutput(JSContext *cx) const;
+    bool shouldSweep(TypeZone &types);
 };
 
 /* Type information for a compartment. */
@@ -1389,32 +1378,9 @@ struct TypeCompartment
 {
     /* Constraint solving worklist structures. */
 
-    /*
-     * Worklist of types which need to be propagated to constraints. We use a
-     * worklist to avoid blowing the native stack.
-     */
-    struct PendingWork
-    {
-        TypeConstraint *constraint;
-        ConstraintTypeSet *source;
-        Type type;
-    };
-    PendingWork *pendingArray;
-    unsigned pendingCount;
-    unsigned pendingCapacity;
-
-    /* Whether we are currently resolving the pending worklist. */
-    bool resolving;
-
     /* Number of scripts in this compartment. */
     unsigned scriptCount;
 
-    /* Valid & Invalid script referenced by type constraints. */
-    Vector<CompilerOutput> *constrainedOutputs;
-
-    /* Pending recompilations to perform before execution of JIT code can resume. */
-    Vector<RecompileInfo> *pendingRecompiles;
-
     /* Table for referencing types of objects keyed to an allocation site. */
     AllocationSiteTable *allocationSiteTable;
 
@@ -1438,14 +1404,6 @@ struct TypeCompartment
 
     inline JSCompartment *compartment();
 
-    /* Add a type to register with a list of constraints. */
-    inline void addPending(JSContext *cx, TypeConstraint *constraint,
-                           ConstraintTypeSet *source, Type type);
-    bool growPendingArray(JSContext *cx);
-
-    /* Resolve pending type registrations, excluding delayed ones. */
-    inline void resolvePending(JSContext *cx);
-
     /* Prints results of this compartment if spew is enabled or force is set. */
     void print(JSContext *cx, bool force);
 
@@ -1461,26 +1419,16 @@ struct TypeCompartment
     /* Get or make an object for an allocation site, and add to the allocation site table. */
     TypeObject *addAllocationSiteTypeObject(JSContext *cx, AllocationSiteKey key);
 
-    void processPendingRecompiles(FreeOp *fop);
-
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes(ExclusiveContext *cx);
 
-    /* Mark a script as needing recompilation once inference has finished. */
-    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
-    void addPendingRecompile(JSContext *cx, JSScript *script);
-
     /* Mark any type set containing obj as having a generic object type. */
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
     void sweep(FreeOp *fop);
-    void sweepShapes(FreeOp *fop);
-    void clearCompilerOutputs(FreeOp *fop);
-
     void finalizeObjects();
 
     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                size_t *pendingArrays,
                                 size_t *allocationSiteTables,
                                 size_t *arrayTypeTables,
                                 size_t *objectTypeTables);
@@ -1496,6 +1444,16 @@ struct TypeZone
     static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 8 * 1024;
     js::LifoAlloc                typeLifoAlloc;
 
+    /*
+     * All Ion compilations that have occured in this zone, for indexing via
+     * RecompileInfo. This includes both valid and invalid compilations, though
+     * invalidated compilations are swept on GC.
+     */
+    Vector<CompilerOutput> *compilerOutputs;
+
+    /* Pending recompilations to perform before execution of JIT code can resume. */
+    Vector<RecompileInfo> *pendingRecompiles;
+
     /*
      * Bit set if all current types must be marked as unknown, and all scripts
      * recompiled. Caused by OOM failure within inference operations.
@@ -1516,6 +1474,12 @@ struct TypeZone
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes();
 
+    /* Mark a script as needing recompilation once inference has finished. */
+    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
+    void addPendingRecompile(JSContext *cx, JSScript *script);
+
+    void processPendingRecompiles(FreeOp *fop);
+
     void nukeTypes(FreeOp *fop);
 };
 
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index 0166b368d659..faad1f66ff62 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -103,17 +103,29 @@ CompilerOutput::ion() const
 }
 
 inline CompilerOutput*
-RecompileInfo::compilerOutput(TypeCompartment &types) const
+RecompileInfo::compilerOutput(TypeZone &types) const
 {
-    if (!types.constrainedOutputs || outputIndex >= types.constrainedOutputs->length())
+    if (!types.compilerOutputs || outputIndex >= types.compilerOutputs->length())
         return nullptr;
-    return &(*types.constrainedOutputs)[outputIndex];
+    return &(*types.compilerOutputs)[outputIndex];
 }
 
 inline CompilerOutput*
 RecompileInfo::compilerOutput(JSContext *cx) const
 {
-    return compilerOutput(cx->compartment()->types);
+    return compilerOutput(cx->zone()->types);
+}
+
+inline bool
+RecompileInfo::shouldSweep(TypeZone &types)
+{
+    CompilerOutput *output = compilerOutput(types);
+    if (!output || !output->isValid())
+        return true;
+
+    // Update this info for the output's new index in the zone's compiler outputs.
+    outputIndex = output->sweepIndex();
+    return false;
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -287,14 +299,13 @@ struct AutoEnterAnalysis
          * If there are no more type inference activations on the stack,
          * process any triggered recompilations. Note that we should not be
          * invoking any scripted code while type inference is running.
-         * :TODO: assert this.
          */
         if (!compartment->activeAnalysis) {
-            TypeCompartment *types = &compartment->types;
-            if (compartment->zone()->types.pendingNukeTypes)
-                compartment->zone()->types.nukeTypes(freeOp);
-            else if (types->pendingRecompiles)
-                types->processPendingRecompiles(freeOp);
+            TypeZone &types = compartment->zone()->types;
+            if (types.pendingNukeTypes)
+                types.nukeTypes(freeOp);
+            else if (types.pendingRecompiles)
+                types.processPendingRecompiles(freeOp);
         }
     }
 
@@ -848,50 +859,6 @@ TypeCompartment::compartment()
     return (JSCompartment *)((char *)this - offsetof(JSCompartment, types));
 }
 
-inline void
-TypeCompartment::addPending(JSContext *cx, TypeConstraint *constraint,
-                            ConstraintTypeSet *source, Type type)
-{
-    JS_ASSERT(this == &cx->compartment()->types);
-    JS_ASSERT(!cx->runtime()->isHeapBusy());
-
-    InferSpew(ISpewOps, "pending: %sC%p%s %s",
-              InferSpewColor(constraint), constraint, InferSpewColorReset(),
-              TypeString(type));
-
-    if ((pendingCount == pendingCapacity) && !growPendingArray(cx))
-        return;
-
-    PendingWork &pending = pendingArray[pendingCount++];
-    pending.constraint = constraint;
-    pending.source = source;
-    pending.type = type;
-}
-
-inline void
-TypeCompartment::resolvePending(JSContext *cx)
-{
-    JS_ASSERT(this == &cx->compartment()->types);
-
-    if (resolving) {
-        /* There is an active call further up resolving the worklist. */
-        return;
-    }
-
-    resolving = true;
-
-    /* Handle all pending type registrations. */
-    while (pendingCount) {
-        const PendingWork &pending = pendingArray[--pendingCount];
-        InferSpew(ISpewOps, "resolve: %sC%p%s %s",
-                  InferSpewColor(pending.constraint), pending.constraint,
-                  InferSpewColorReset(), TypeString(pending.type));
-        pending.constraint->newType(cx, pending.source, pending.type);
-    }
-
-    resolving = false;
-}
-
 /////////////////////////////////////////////////////////////////////
 // TypeSet
 /////////////////////////////////////////////////////////////////////
@@ -1215,10 +1182,9 @@ ConstraintTypeSet::addType(ExclusiveContext *cxArg, Type type)
     if (JSContext *cx = cxArg->maybeJSContext()) {
         TypeConstraint *constraint = constraintList;
         while (constraint) {
-            cx->compartment()->types.addPending(cx, constraint, this, type);
+            constraint->newType(cx, this, type);
             constraint = constraint->next;
         }
-        cx->compartment()->types.resolvePending(cx);
     } else {
         JS_ASSERT(!constraintList);
     }
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index 3ba7d433c6f8..ee09906df5bd 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -215,7 +215,6 @@ StatsCompartmentCallback(JSRuntime *rt, void *data, JSCompartment *compartment)
 
     // Measure the compartment object itself, and things hanging off it.
     compartment->addSizeOfIncludingThis(rtStats->mallocSizeOf_,
-                                        &cStats.typeInferencePendingArrays,
                                         &cStats.typeInferenceAllocationSiteTables,
                                         &cStats.typeInferenceArrayTypeTables,
                                         &cStats.typeInferenceObjectTypeTables,
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 2f33a01747fa..8a8d8391a7f5 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2087,10 +2087,6 @@ ReportCompartmentStats(const JS::CompartmentStats &cStats,
                    cStats.typeInferenceTypeScripts,
                    "Memory used by type sets associated with scripts.");
 
-    ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/pending-arrays"),
-                   cStats.typeInferencePendingArrays,
-                   "Memory used for solving constraints during type inference.");
-
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/allocation-site-tables"),
                    cStats.typeInferenceAllocationSiteTables,
                    "Memory indexing type objects associated with allocation sites.");

From dc08516cffdd9ca07df051fda58e3b808c7d35e5 Mon Sep 17 00:00:00 2001
From: Benoit Girard <b56girard@gmail.com>
Date: Wed, 11 Dec 2013 23:16:03 -0500
Subject: [PATCH 085/459] Bug 941095 - Part 1: Support SetPermitSubpixelAA with
 Quartz. r=bas

--HG--
extra : rebase_source : 69171a8a17a34c822b34f48babecf18ffa08bf56
---
 gfx/2d/DrawTargetCG.cpp | 8 ++++++++
 gfx/2d/DrawTargetCG.h   | 1 +
 2 files changed, 9 insertions(+)

diff --git a/gfx/2d/DrawTargetCG.cpp b/gfx/2d/DrawTargetCG.cpp
index 98f5ce75d7c6..d8f703e83d9e 100644
--- a/gfx/2d/DrawTargetCG.cpp
+++ b/gfx/2d/DrawTargetCG.cpp
@@ -1338,6 +1338,7 @@ DrawTargetCG::Init(BackendType aType,
   // XXX: Create input parameter to control interpolation and
   //      use the default for content.
   CGContextSetInterpolationQuality(mCg, kCGInterpolationLow);
+  CGContextSetShouldSmoothFonts(mCg, GetPermitSubpixelAA());
 
 
   if (aType == BACKEND_COREGRAPHICS_ACCELERATED) {
@@ -1377,6 +1378,7 @@ DrawTargetCG::Init(CGContextRef cgContext, const IntSize &aSize)
   mSize = aSize;
 
   mCg = cgContext;
+  CGContextSetShouldSmoothFonts(mCg, GetPermitSubpixelAA());
   CGContextRetain(mCg);
 
   assert(mCg);
@@ -1530,6 +1532,12 @@ DrawTargetCG::MarkChanged()
   }
 }
 
+void
+DrawTargetCG::SetPermitSubpixelAA(bool aPermitSubpixelAA) {
+  DrawTarget::SetPermitSubpixelAA(aPermitSubpixelAA);
+  CGContextSetShouldSmoothFonts(mCg, aPermitSubpixelAA);
+}
+
 CGContextRef
 BorrowedCGContext::BorrowCGContextFromDrawTarget(DrawTarget *aDT)
 {
diff --git a/gfx/2d/DrawTargetCG.h b/gfx/2d/DrawTargetCG.h
index 3a972852d06d..a46acdc14ff4 100644
--- a/gfx/2d/DrawTargetCG.h
+++ b/gfx/2d/DrawTargetCG.h
@@ -154,6 +154,7 @@ public:
 
   virtual IntSize GetSize() { return mSize; }
 
+  virtual void SetPermitSubpixelAA(bool aPermitSubpixelAA) MOZ_OVERRIDE;
 
   /* This is for creating good compatible surfaces */
   virtual TemporaryRef<SourceSurface> CreateSourceSurfaceFromData(unsigned char *aData,

From 892081b54a585f676ec6fcf71872f7fb436d9d3f Mon Sep 17 00:00:00 2001
From: Benoit Girard <b56girard@gmail.com>
Date: Fri, 13 Dec 2013 13:53:18 -0500
Subject: [PATCH 086/459] Bug 941095 - Part 2: Disable subpixelaa + component
 alpha. r=mattwoodrow

--HG--
extra : rebase_source : 7e3a0d3710fb29b47615cc0254135d3b44637ed8
---
 gfx/layers/Layers.cpp                     | 14 +++++++++-----
 gfx/layers/Layers.h                       |  8 +++++++-
 layout/base/FrameLayerBuilder.cpp         | 17 +++++++++++------
 layout/reftests/transform-3d/reftest.list |  4 ++--
 4 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 5fffb03188e6..af3a4f3bfb3e 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -1494,10 +1494,12 @@ PrintInfo(nsACString& aTo, LayerComposite* aLayerComposite)
 void
 SetAntialiasingFlags(Layer* aLayer, gfxContext* aTarget)
 {
+  bool permitSubpixelAA = !(aLayer->GetContentFlags() & Layer::CONTENT_DISABLE_SUBPIXEL_AA);
   if (!aTarget->IsCairo()) {
     RefPtr<DrawTarget> dt = aTarget->GetDrawTarget();
 
     if (dt->GetFormat() != FORMAT_B8G8R8A8) {
+      dt->SetPermitSubpixelAA(permitSubpixelAA);
       return;
     }
 
@@ -1507,20 +1509,22 @@ SetAntialiasingFlags(Layer* aLayer, gfxContext* aTarget)
     transformedBounds.RoundOut();
     IntRect intTransformedBounds;
     transformedBounds.ToIntRect(&intTransformedBounds);
-    dt->SetPermitSubpixelAA(!(aLayer->GetContentFlags() & Layer::CONTENT_COMPONENT_ALPHA) ||
-                            dt->GetOpaqueRect().Contains(intTransformedBounds));
+    permitSubpixelAA &= !(aLayer->GetContentFlags() & Layer::CONTENT_COMPONENT_ALPHA) ||
+                        dt->GetOpaqueRect().Contains(intTransformedBounds);
+    dt->SetPermitSubpixelAA(permitSubpixelAA);
   } else {
     nsRefPtr<gfxASurface> surface = aTarget->CurrentSurface();
     if (surface->GetContentType() != GFX_CONTENT_COLOR_ALPHA) {
       // Destination doesn't have alpha channel; no need to set any special flags
+      surface->SetSubpixelAntialiasingEnabled(permitSubpixelAA);
       return;
     }
 
     const nsIntRect& bounds = aLayer->GetVisibleRegion().GetBounds();
-    surface->SetSubpixelAntialiasingEnabled(
-        !(aLayer->GetContentFlags() & Layer::CONTENT_COMPONENT_ALPHA) ||
+    permitSubpixelAA &= !(aLayer->GetContentFlags() & Layer::CONTENT_COMPONENT_ALPHA) ||
         surface->GetOpaqueRect().Contains(
-          aTarget->UserToDevice(gfxRect(bounds.x, bounds.y, bounds.width, bounds.height))));
+        aTarget->UserToDevice(gfxRect(bounds.x, bounds.y, bounds.width, bounds.height)));
+    surface->SetSubpixelAntialiasingEnabled(permitSubpixelAA);
   }
 }
 
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index b560e5fce2dc..38721dd66fff 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -684,7 +684,13 @@ public:
      * transaction where there is no possibility of redrawing the content, so the
      * implementation should be ready for that.
      */
-    CONTENT_MAY_CHANGE_TRANSFORM = 0x08
+    CONTENT_MAY_CHANGE_TRANSFORM = 0x08,
+
+    /**
+     * Disable subpixel AA for this layer. This is used if the display isn't suited
+     * for subpixel AA like hidpi or rotated content.
+     */
+    CONTENT_DISABLE_SUBPIXEL_AA = 0x10
   };
   /**
    * CONSTRUCTION PHASE ONLY
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 3c4d96df5782..2f0853c9be8e 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -1798,13 +1798,18 @@ ContainerState::PopThebesLayerData()
     // mask layer for image and color layers
     SetupMaskLayer(layer, data->mItemClip);
   }
-  uint32_t flags;
+
+  uint32_t flags = 0;
+  nsIWidget* widget = mContainerReferenceFrame->PresContext()->GetRootWidget();
+  // Disable subpixelAA on hidpi
+  bool hidpi = widget && widget->GetDefaultScale().scale >= 2;
+  if (hidpi) {
+    flags |= Layer::CONTENT_DISABLE_SUBPIXEL_AA;
+  }
   if (isOpaque && !data->mForceTransparentSurface) {
-    flags = Layer::CONTENT_OPAQUE;
-  } else if (data->mNeedComponentAlpha) {
-    flags = Layer::CONTENT_COMPONENT_ALPHA;
-  } else {
-    flags = 0;
+    flags |= Layer::CONTENT_OPAQUE;
+  } else if (data->mNeedComponentAlpha && !hidpi) {
+    flags |= Layer::CONTENT_COMPONENT_ALPHA;
   }
   layer->SetContentFlags(flags);
 
diff --git a/layout/reftests/transform-3d/reftest.list b/layout/reftests/transform-3d/reftest.list
index 2d81127ca9cb..447369b3adc9 100644
--- a/layout/reftests/transform-3d/reftest.list
+++ b/layout/reftests/transform-3d/reftest.list
@@ -22,8 +22,8 @@ fails-if(Android&&AndroidVersion!=17) == rotatex-perspective-3a.html rotatex-per
 skip-if(B2G) == preserve3d-4a.html green-rect.html
 fuzzy-if(Android&&AndroidVersion>=15,4,300) == preserve3d-5a.html preserve3d-5-ref.html
 == scale3d-z.html scalez-1-ref.html
-fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fuzzy-if(OSX==10.8,145,752) == scale3d-all.html scale3d-1-ref.html # subpixel AA
-fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fuzzy-if(OSX==10.8,145,752) == scale3d-all-separate.html scale3d-1-ref.html # subpixel AA
+fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fuzzy-if(OSX==10.8,224,924) fuzzy-if(OSX==10.9,224,924) == scale3d-all.html scale3d-1-ref.html # subpixel AA
+fuzzy-if(winWidget,102,580) fuzzy-if(d2d,143,681) fuzzy-if(OSX==10.8,224,924) fuzzy-if(OSX==10.9,224,924) == scale3d-all-separate.html scale3d-1-ref.html # subpixel AA
 == scale3d-xz.html scale3d-1-ref.html
 == translatez-1a.html translatez-1-ref.html
 != translatez-1b.html translatez-1-ref.html

From fd192955fd7bedb3949c26359bdec39f8206a91d Mon Sep 17 00:00:00 2001
From: Chris Lord <chrislord.net@gmail.com>
Date: Fri, 13 Dec 2013 19:37:34 +0000
Subject: [PATCH 087/459] Bug 936500 - Always build layers for
 nsDisplayScrollLayer. r=tn

APZC information is associated with layers, and having those layers suddenly
disappear because they became occluded, or their displayports are off-screen
has undesired effects.
---
 layout/base/nsDisplayList.cpp | 10 ++++++++++
 layout/base/nsDisplayList.h   |  2 ++
 2 files changed, 12 insertions(+)

diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 6f9a05370177..b2999c012802 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -3498,6 +3498,16 @@ nsDisplayScrollLayer::BuildLayer(nsDisplayListBuilder* aBuilder,
   return layer.forget();
 }
 
+bool
+nsDisplayScrollLayer::ShouldBuildLayerEvenIfInvisible(nsDisplayListBuilder* aBuilder)
+{
+  if (nsLayoutUtils::GetDisplayPort(mScrolledFrame->GetContent(), nullptr)) {
+    return true;
+  }
+
+  return nsDisplayWrapList::ShouldBuildLayerEvenIfInvisible(aBuilder);
+}
+
 bool
 nsDisplayScrollLayer::ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                         nsRegion* aVisibleRegion,
diff --git a/layout/base/nsDisplayList.h b/layout/base/nsDisplayList.h
index 2b28efd826cf..77a5fab0311f 100644
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@@ -2713,6 +2713,8 @@ public:
                                              LayerManager* aManager,
                                              const ContainerLayerParameters& aContainerParameters) MOZ_OVERRIDE;
 
+  virtual bool ShouldBuildLayerEvenIfInvisible(nsDisplayListBuilder* aBuilder) MOZ_OVERRIDE;
+
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,
                                    nsRegion* aVisibleRegion,
                                    const nsRect& aAllowVisibleRegionExpansion) MOZ_OVERRIDE;

From 8fa042c6ad8fb43538a286acc9a4ed0551cb2360 Mon Sep 17 00:00:00 2001
From: Chris Lord <chrislord.net@gmail.com>
Date: Fri, 13 Dec 2013 19:37:42 +0000
Subject: [PATCH 088/459] Bug 936500 - Don't copy Axis when creating a
 FlingAnimation. r=kats

FlingAnimation was, likely accidentally, creating copies of the axes it was
animating and operating on those, which lead to problems when displayports
were calculated based on the original copies which housed old values.
---
 gfx/layers/ipc/AsyncPanZoomController.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index a1a034ffa564..c2fefad6d5e5 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -280,7 +280,7 @@ GetFrameTime() {
 
 class FlingAnimation: public AsyncPanZoomAnimation {
 public:
-  FlingAnimation(AxisX aX, AxisY aY)
+  FlingAnimation(AxisX& aX, AxisY& aY)
     : AsyncPanZoomAnimation(TimeDuration::FromMilliseconds(gFlingRepaintInterval))
     , mX(aX)
     , mY(aY)
@@ -295,8 +295,8 @@ public:
                       const TimeDuration& aDelta);
 
 private:
-  AxisX mX;
-  AxisY mY;
+  AxisX& mX;
+  AxisY& mY;
 };
 
 class ZoomAnimation: public AsyncPanZoomAnimation {

From 774e6ed76a32f43117dde1293fe29d36947800a5 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Thu, 12 Dec 2013 15:30:53 -0800
Subject: [PATCH 089/459] Bug 949283 - Add a post-barrier to missingScopes for
 the JSObject* in ScopeKeyIter; r=jonco

---
 js/src/vm/ScopeObject.cpp | 32 ++++++++++++++++++++++++++++++++
 js/src/vm/ScopeObject.h   | 16 +++++++++++++++-
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 5e61bf7f5675..d80c61eb46db 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -1570,6 +1570,37 @@ DebugScopes::proxiedScopesPostWriteBarrier(JSRuntime *rt, ObjectWeakMap *map,
 #endif
 }
 
+#ifdef JSGC_GENERATIONAL
+class DebugScopes::MissingScopesRef : public BufferableRef
+{
+    MissingScopeMap *map;
+    ScopeIterKey key;
+
+  public:
+    MissingScopesRef(MissingScopeMap *m, const ScopeIterKey &k) : map(m), key(k) {}
+
+    void mark(JSTracer *trc) {
+        ScopeIterKey prior = key;
+        MissingScopeMap::Ptr p = map->lookup(key);
+        if (!p)
+            return;
+        JS_SET_TRACING_LOCATION(trc, &const_cast<ScopeIterKey &>(p->key()).enclosingScope());
+        Mark(trc, &key.enclosingScope(), "MissingScopesRef");
+        map->rekeyIfMoved(prior, key);
+    }
+};
+#endif
+
+/* static */ JS_ALWAYS_INLINE void
+DebugScopes::missingScopesPostWriteBarrier(JSRuntime *rt, MissingScopeMap *map,
+                                           const ScopeIterKey &key)
+{
+#ifdef JSGC_GENERATIONAL
+    if (key.enclosingScope() && IsInsideNursery(rt, key.enclosingScope()))
+        rt->gcStoreBuffer.putGeneric(MissingScopesRef(map, key));
+#endif
+}
+
 /* static */ JS_ALWAYS_INLINE void
 DebugScopes::liveScopesPostWriteBarrier(JSRuntime *rt, LiveScopeMap *map, ScopeObject *key)
 {
@@ -1763,6 +1794,7 @@ DebugScopes::addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject
         js_ReportOutOfMemory(cx);
         return false;
     }
+    missingScopesPostWriteBarrier(cx->runtime(), &scopes->missingScopes, si);
 
     JS_ASSERT(!scopes->liveScopes.has(&debugScope.scope()));
     if (!scopes->liveScopes.put(&debugScope.scope(), si)) {
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index 4dafb301719a..e6a5f4c4f68e 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -597,11 +597,22 @@ class ScopeIterKey
     StaticBlockObject *block() const { return block_; }
     ScopeIter::Type type() const { return type_; }
     bool hasScopeObject() const { return hasScopeObject_; }
+    JSObject *enclosingScope() const { return cur_; }
+    JSObject *&enclosingScope() { return cur_; }
 
     /* For use as hash policy */
     typedef ScopeIterKey Lookup;
     static HashNumber hash(ScopeIterKey si);
     static bool match(ScopeIterKey si1, ScopeIterKey si2);
+    bool operator!=(const ScopeIterKey &other) const {
+        return frame_ != other.frame_ ||
+               cur_ != other.cur_ ||
+               block_ != other.block_ ||
+               type_ != other.type_;
+    }
+    static void rekey(ScopeIterKey &k, const ScopeIterKey& newKey) {
+        k = newKey;
+    }
 };
 
 class ScopeIterVal
@@ -613,7 +624,7 @@ class ScopeIterVal
     RelocatablePtr<StaticBlockObject> block_;
     ScopeIter::Type type_;
     bool hasScopeObject_;
-    
+
     static void staticAsserts();
 
   public:
@@ -704,6 +715,9 @@ class DebugScopes
                     ScopeIterKey,
                     RuntimeAllocPolicy> MissingScopeMap;
     MissingScopeMap missingScopes;
+    class MissingScopesRef;
+    static JS_ALWAYS_INLINE void missingScopesPostWriteBarrier(JSRuntime *rt, MissingScopeMap *map,
+                                                               const ScopeIterKey &key);
 
     /*
      * The map from scope objects of live frames to the live frame. This map

From 3635aa6f6f5868cf21e59e39c83c23cda2525b56 Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Fri, 6 Dec 2013 16:37:52 -0500
Subject: [PATCH 090/459] Bug 863872 - If we have overdue TelemetryPings, try
 to send them all. r=nfroyd, feedback=irving.

---
 .../components/telemetry/TelemetryFile.jsm    |  75 ++++-
 toolkit/components/telemetry/TelemetryPing.js |  26 +-
 .../tests/unit/test_TelemetryPing.js          |   4 +-
 .../tests/unit/test_TelemetrySendOldPings.js  | 265 ++++++++++++++++++
 .../telemetry/tests/unit/xpcshell.ini         |   2 +
 5 files changed, 353 insertions(+), 19 deletions(-)
 create mode 100644 toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js

diff --git a/toolkit/components/telemetry/TelemetryFile.jsm b/toolkit/components/telemetry/TelemetryFile.jsm
index 7a21d5c2fd4e..8db9eb815b58 100644
--- a/toolkit/components/telemetry/TelemetryFile.jsm
+++ b/toolkit/components/telemetry/TelemetryFile.jsm
@@ -22,8 +22,13 @@ const PR_EXCL = 0x80;
 const RW_OWNER = parseInt("0600", 8);
 const RWX_OWNER = parseInt("0700", 8);
 
-// Delete ping files that have been lying around for longer than this.
-const MAX_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
+// Files that have been lying around for longer than MAX_PING_FILE_AGE are
+// deleted without being loaded.
+const MAX_PING_FILE_AGE = 14 * 24 * 60 * 60 * 1000; // 2 weeks
+
+// Files that are older than OVERDUE_PING_FILE_AGE, but younger than
+// MAX_PING_FILE_AGE indicate that we need to send all of our pings ASAP.
+const OVERDUE_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
 
 // The number of outstanding saved pings that we have issued loading
 // requests for.
@@ -32,6 +37,14 @@ let pingsLoaded = 0;
 // The number of those requests that have actually completed.
 let pingLoadsCompleted = 0;
 
+// The number of pings that we have destroyed due to being older
+// than MAX_PING_FILE_AGE.
+let pingsDiscarded = 0;
+
+// The number of pings that are older than OVERDUE_PING_FILE_AGE
+// but younger than MAX_PING_FILE_AGE.
+let pingsOverdue = 0;
+
 // If |true|, send notifications "telemetry-test-save-complete"
 // and "telemetry-test-load-complete" once save/load is complete.
 let shouldNotifyUponSave = false;
@@ -41,6 +54,14 @@ let pendingPings = [];
 
 this.TelemetryFile = {
 
+  get MAX_PING_FILE_AGE() {
+    return MAX_PING_FILE_AGE;
+  },
+
+  get OVERDUE_PING_FILE_AGE() {
+    return OVERDUE_PING_FILE_AGE;
+  },
+
   /**
    * Save a single ping to a file.
    *
@@ -142,7 +163,7 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadSavedPings: function(sync, onLoad = null) {
+  loadSavedPings: function(sync, onLoad = null, onDone = null) {
     let directory = ensurePingDirectory();
     let entries = directory.directoryEntries
                            .QueryInterface(Ci.nsIDirectoryEnumerator);
@@ -150,7 +171,7 @@ this.TelemetryFile = {
     pingLoadsCompleted = 0;
     try {
       while (entries.hasMoreElements()) {
-        this.loadHistograms(entries.nextFile, sync, onLoad);
+        this.loadHistograms(entries.nextFile, sync, onLoad, onDone);
       }
     } finally {
       entries.close();
@@ -169,20 +190,26 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadHistograms: function loadHistograms(file, sync, onLoad = null) {
-    let now = new Date();
+  loadHistograms: function loadHistograms(file, sync, onLoad = null, onDone = null) {
+    let now = Date.now();
     if (now - file.lastModifiedTime > MAX_PING_FILE_AGE) {
       // We haven't had much luck in sending this file; delete it.
       file.remove(true);
+      pingsDiscarded++;
       return;
     }
 
+    // This file is a bit stale, and overdue for sending.
+    if (now - file.lastModifiedTime > OVERDUE_PING_FILE_AGE) {
+      pingsOverdue++;
+    }
+
     pingsLoaded++;
     if (sync) {
       let stream = Cc["@mozilla.org/network/file-input-stream;1"]
                    .createInstance(Ci.nsIFileInputStream);
       stream.init(file, -1, -1, 0);
-      addToPendingPings(file, stream, onLoad);
+      addToPendingPings(file, stream, onLoad, onDone);
     } else {
       let channel = NetUtil.newChannel(file);
       channel.contentType = "application/json";
@@ -191,7 +218,7 @@ this.TelemetryFile = {
         if (!Components.isSuccessCode(result)) {
           return;
         }
-        addToPendingPings(file, stream, onLoad);
+        addToPendingPings(file, stream, onLoad, onDone);
       }).bind(this));
     }
   },
@@ -203,6 +230,22 @@ this.TelemetryFile = {
     return pingsLoaded;
   },
 
+  /**
+   * The number of pings loaded that are older than OVERDUE_PING_FILE_AGE
+   * but younger than MAX_PING_FILE_AGE.
+   */
+  get pingsOverdue() {
+    return pingsOverdue;
+  },
+
+  /**
+   * The number of pings that we just tossed out for being older than
+   * MAX_PING_FILE_AGE.
+   */
+  get pingsDiscarded() {
+    return pingsDiscarded;
+  },
+
   /**
    * Iterate destructively through the pending pings.
    *
@@ -249,7 +292,7 @@ function ensurePingDirectory() {
   return directory;
 };
 
-function addToPendingPings(file, stream, onLoad) {
+function addToPendingPings(file, stream, onLoad, onDone) {
   let success = false;
 
   try {
@@ -263,19 +306,25 @@ function addToPendingPings(file, stream, onLoad) {
     }
     pingLoadsCompleted++;
     pendingPings.push(ping);
-    if (shouldNotifyUponSave &&
-        pingLoadsCompleted == pingsLoaded) {
-      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
-    }
     success = true;
   } catch (e) {
     // An error reading the file, or an error parsing the contents.
     stream.close();           // close is idempotent.
     file.remove(true); // FIXME: Should be false, isn't it?
   }
+
   if (onLoad) {
     onLoad(success);
   }
+
+  if (pingLoadsCompleted == pingsLoaded) {
+    if (onDone) {
+      onDone();
+    }
+    if (shouldNotifyUponSave) {
+      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
+    }
+  }
 };
 
 function finishTelemetrySave(ok, stream) {
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index b96bbde06be2..ed7cc2f26f01 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -39,6 +39,8 @@ const PREF_PREVIOUS_BUILDID = PREF_BRANCH + "previousBuildID";
 const TELEMETRY_INTERVAL = 60000;
 // Delay before intializing telemetry (ms)
 const TELEMETRY_DELAY = 60000;
+// Delay before initializing telemetry if we're testing (ms)
+const TELEMETRY_TEST_DELAY = 100;
 
 // Seconds of idle time before pinging.
 // On idle-daily a gather-telemetry notification is fired, during it probes can
@@ -218,6 +220,9 @@ TelemetryPing.prototype = {
       ret.savedPings = TelemetryFile.pingsLoaded;
     }
 
+    ret.pingsOverdue = TelemetryFile.pingsOverdue;
+    ret.pingsDiscarded = TelemetryFile.pingsDiscarded;
+
     return ret;
   },
 
@@ -599,7 +604,9 @@ TelemetryPing.prototype = {
 
   popPayloads: function popPayloads(reason) {
     function payloadIter() {
-      yield this.getSessionPayloadAndSlug(reason);
+      if (reason != "overdue-flush") {
+        yield this.getSessionPayloadAndSlug(reason);
+      }
       let iterator = TelemetryFile.popPendingPings(reason);
       for (let data of iterator) {
         yield data;
@@ -761,7 +768,7 @@ TelemetryPing.prototype = {
   /**
    * Initializes telemetry within a timer. If there is no PREF_SERVER set, don't turn on telemetry.
    */
-  setup: function setup() {
+  setup: function setup(aTesting) {
     // Initialize some probes that are kept in their own modules
     this._thirdPartyCookies = new ThirdPartyCookieProbe();
     this._thirdPartyCookies.init();
@@ -824,7 +831,17 @@ TelemetryPing.prototype = {
         {
           let success_histogram = Telemetry.getHistogramById("READ_SAVED_PING_SUCCESS");
           success_histogram.add(success);
-        }));
+        }), () =>
+        {
+          // If we have any TelemetryPings lying around, we'll be aggressive
+          // and try to send them all off ASAP.
+          if (TelemetryFile.pingsOverdue > 0) {
+            // It doesn't really matter what we pass to this.send as a reason,
+            // since it's never sent to the server. All that this.send does with
+            // the reason is check to make sure it's not a test-ping.
+            this.send("overdue-flush", this._server);
+          }
+        });
       this.attachObservers();
       this.gatherMemory();
 
@@ -832,7 +849,8 @@ TelemetryPing.prototype = {
       });
       delete this._timer;
     }
-    this._timer.initWithCallback(timerCallback.bind(this), TELEMETRY_DELAY,
+    this._timer.initWithCallback(timerCallback.bind(this),
+                                 aTesting ? TELEMETRY_TEST_DELAY : TELEMETRY_DELAY,
                                  Ci.nsITimer.TYPE_ONE_SHOT);
   },
 
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
index c859b779c947..06d9292719cd 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
@@ -142,7 +142,7 @@ function decodeRequestPayload(request) {
     let observer = {
       buffer: "",
       onStreamComplete: function(loader, context, status, length, result) {
-	this.buffer = String.fromCharCode.apply(this, result);
+        this.buffer = String.fromCharCode.apply(this, result);
       }
     };
 
@@ -363,7 +363,7 @@ function runOldPingFileTest() {
   do_check_true(histogramsFile.exists());
 
   let mtime = histogramsFile.lastModifiedTime;
-  histogramsFile.lastModifiedTime = mtime - 8 * 24 * 60 * 60 * 1000; // 8 days.
+  histogramsFile.lastModifiedTime = mtime - 14 * 24 * 60 * 60 * 1000; // 14 days.
   TelemetryPing.testLoadHistograms(histogramsFile, true);
   do_check_false(histogramsFile.exists());
 }
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js b/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
new file mode 100644
index 000000000000..0ba9707d8f53
--- /dev/null
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
@@ -0,0 +1,265 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/
+
+/**
+ * This test case populates the profile with some fake stored
+ * pings, and checks that:
+ *
+ * 1) Pings that are considered "expired" are deleted and never sent.
+ * 2) Pings that are considered "overdue" trigger a send of all
+ *    overdue and recent pings.
+ */
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+// Get the TelemetryPing definitions directly so we can test it without going through xpcom.
+// That gives us Cc, Ci, Cr and Cu, as well as a number of consts like PREF_ENABLED,
+// and PREF_SERVER.
+Services.scriptloader.loadSubScript("resource://gre/components/TelemetryPing.js");
+
+Cu.import("resource://testing-common/httpd.js");
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/TelemetryFile.jsm");
+
+// We increment TelemetryFile's MAX_PING_FILE_AGE and
+// OVERDUE_PING_FILE_AGE by 1ms so that our test pings exceed
+// those points in time.
+const EXPIRED_PING_FILE_AGE = TelemetryFile.MAX_PING_FILE_AGE + 1;
+const OVERDUE_PING_FILE_AGE = TelemetryFile.OVERDUE_PING_FILE_AGE + 1;
+
+const PING_SAVE_FOLDER = "saved-telemetry-pings";
+const PING_TIMEOUT_LENGTH = 1500;
+const EXPIRED_PINGS = 5;
+const OVERDUE_PINGS = 6;
+const RECENT_PINGS = 4;
+
+const TOTAL_EXPECTED_PINGS = OVERDUE_PINGS + RECENT_PINGS;
+
+let gHttpServer = new HttpServer();
+let gCreatedPings = 0;
+let gSeenPings = 0;
+
+/**
+ * Creates some TelemetryPings for the current session and
+ * saves them to disk. Each ping gets a unique ID slug based on
+ * an incrementor.
+ *
+ * @param aNum the number of pings to create.
+ * @param aAge the age in milliseconds to offset from now. A value
+ *             of 10 would make the ping 10ms older than now, for
+ *             example.
+ * @returns an Array with the created pings.
+ */
+function createSavedPings(aNum, aAge) {
+  // Create a TelemetryPing service that we can generate payloads from.
+  // Luckily, the TelemetryPing constructor does nothing that we need to
+  // clean up.
+  let pingService = new TelemetryPing();
+  let pings = [];
+  let age = Date.now() - aAge;
+  for (let i = 0; i < aNum; ++i) {
+    let payload = pingService.getPayload();
+    let ping = { slug: "test-ping-" + gCreatedPings, reason: "test", payload: payload };
+    TelemetryFile.savePing(ping);
+    if (aAge) {
+      // savePing writes to the file synchronously, so we're good to
+      // modify the lastModifedTime now.
+      let file = getSaveFileForPing(ping);
+      file.lastModifiedTime = age;
+    }
+    gCreatedPings++;
+    pings.push(ping);
+  }
+  return pings;
+}
+
+/**
+ * Deletes locally saved pings in aPings if they
+ * exist.
+ *
+ * @param aPings an Array of pings to delete.
+ */
+function clearPings(aPings) {
+  for (let ping of aPings) {
+    let file = getSaveFileForPing(ping);
+    if (file.exists()) {
+      file.remove(false);
+    }
+  }
+}
+
+/**
+ * Returns a handle for the file that aPing should be
+ * stored in locally.
+ *
+ * @returns nsILocalFile
+ */
+function getSaveFileForPing(aPing) {
+  let file = Services.dirsvc.get("ProfD", Ci.nsILocalFile).clone();
+  file.append(PING_SAVE_FOLDER);
+  file.append(aPing.slug);
+  return file;
+}
+
+/**
+ * Wait for PING_TIMEOUT_LENGTH ms, and make sure we didn't receive
+ * TelemetryPings in that time.
+ *
+ * @returns Promise
+ */
+function assertReceivedNoPings() {
+  let deferred = Promise.defer();
+
+  do_timeout(PING_TIMEOUT_LENGTH, function() {
+    if (gSeenPings > 0) {
+      deferred.reject();
+    } else {
+      deferred.resolve();
+    }
+  });
+
+  return deferred.promise;
+}
+
+/**
+ * Returns a Promise that rejects if the number of TelemetryPings
+ * received by the HttpServer is not equal to aExpectedNum.
+ *
+ * @param aExpectedNum the number of pings we expect to receive.
+ * @returns Promise
+ */
+function assertReceivedPings(aExpectedNum) {
+  let deferred = Promise.defer();
+
+  do_timeout(PING_TIMEOUT_LENGTH, function() {
+    if (gSeenPings == aExpectedNum) {
+      deferred.resolve();
+    } else {
+      deferred.reject("Saw " + gSeenPings + " TelemetryPings, " +
+                      "but expected " + aExpectedNum);
+    }
+  })
+
+  return deferred.promise;
+}
+
+/**
+ * Throws if any pings in aPings is saved locally.
+ *
+ * @param aPings an Array of pings to check.
+ */
+function assertNotSaved(aPings) {
+  let saved = 0;
+  for (let ping of aPings) {
+    let file = getSaveFileForPing(ping);
+    if (file.exists()) {
+      saved++;
+    }
+  }
+  if (saved > 0) {
+    do_throw("Found " + saved + " unexpected saved pings.");
+  }
+}
+
+/**
+ * Our handler function for the HttpServer that simply
+ * increments the gSeenPings global when it successfully
+ * receives and decodes a TelemetryPing payload.
+ *
+ * @param aRequest the HTTP request sent from HttpServer.
+ */
+function pingHandler(aRequest) {
+  gSeenPings++;
+}
+
+/**
+ * Returns a Promise that resolves when gHttpServer has been
+ * successfully shut down.
+ *
+ * @returns Promise
+ */
+function stopHttpServer() {
+  let deferred = Promise.defer();
+  gHttpServer.stop(function() {
+    deferred.resolve();
+  })
+  return deferred.promise;
+}
+
+/**
+ * Teardown a TelemetryPing instance and clear out any pending
+ * pings to put as back in the starting state.
+ */
+function resetTelemetry(aPingService) {
+  aPingService.uninstall();
+  // Quick and dirty way to clear TelemetryFile's pendingPings
+  // collection, and put it back in its initial state.
+  let gen = TelemetryFile.popPendingPings();
+  for (let item of gen) {};
+}
+
+/**
+ * Creates and returns a TelemetryPing instance in "testing"
+ * mode.
+ */
+function startTelemetry() {
+  let service = new TelemetryPing();
+  service.setup(true);
+  return service;
+}
+
+function run_test() {
+  gHttpServer.registerPrefixHandler("/submit/telemetry/", pingHandler);
+  gHttpServer.start(-1);
+  do_get_profile();
+  Services.prefs.setBoolPref(PREF_ENABLED, true);
+  Services.prefs.setCharPref(PREF_SERVER,
+                             "http://localhost:" + gHttpServer.identity.primaryPort);
+  run_next_test();
+}
+
+/**
+ * Test that pings that are considered too old are just chucked out
+ * immediately and never sent.
+ */
+add_task(function test_expired_pings_are_deleted() {
+  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
+  let pingService = startTelemetry();
+  yield assertReceivedNoPings();
+  assertNotSaved(expiredPings);
+  resetTelemetry(pingService);
+})
+
+/**
+ * Test that really recent pings are not sent on Telemetry initialization.
+ */
+add_task(function test_recent_pings_not_sent() {
+  let recentPings = createSavedPings(RECENT_PINGS);
+  let pingService = startTelemetry();
+  yield assertReceivedNoPings();
+  resetTelemetry(pingService);
+  clearPings(recentPings);
+});
+
+/**
+ * Create some recent, expired and overdue pings. The overdue pings should
+ * trigger a send of all recent and overdue pings, but the expired pings
+ * should just be deleted.
+ */
+add_task(function test_overdue_pings_trigger_send() {
+  let recentPings = createSavedPings(RECENT_PINGS);
+  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
+  let overduePings = createSavedPings(OVERDUE_PINGS, OVERDUE_PING_FILE_AGE);
+
+  let pingService = startTelemetry();
+  yield assertReceivedPings(TOTAL_EXPECTED_PINGS);
+
+  assertNotSaved(recentPings);
+  assertNotSaved(expiredPings);
+  assertNotSaved(overduePings);
+  resetTelemetry(pingService);
+})
+
+add_task(function teardown() {
+  yield stopHttpServer();
+});
diff --git a/toolkit/components/telemetry/tests/unit/xpcshell.ini b/toolkit/components/telemetry/tests/unit/xpcshell.ini
index 339219fedcdc..5a0d1b138cd3 100644
--- a/toolkit/components/telemetry/tests/unit/xpcshell.ini
+++ b/toolkit/components/telemetry/tests/unit/xpcshell.ini
@@ -12,3 +12,5 @@ tail =
 [test_TelemetryStopwatch.js]
 [test_TelemetryPingBuildID.js]
 [test_ThirdPartyCookieProbe.js]
+[test_TelemetrySendOldPings.js]
+skip-if = debug == true

From a6f4a5beea4fbcd862b272dddbb2896fbe4f0e2c Mon Sep 17 00:00:00 2001
From: Eric Faust <efaustbmo@gmail.com>
Date: Fri, 13 Dec 2013 12:01:30 -0800
Subject: [PATCH 091/459] Bug 926012 - Part 1: Clean up __proto__ setting
 semantics on native objects. (r=Waldo)

---
 js/src/js.msg              |  1 +
 js/src/jsapi.cpp           | 11 ++++++++++-
 js/src/jsobj.cpp           | 28 ++++++++--------------------
 js/src/jsobj.h             |  5 ++++-
 js/src/jsobjinlines.h      | 29 +++++++++++++++++++++++++++++
 js/src/vm/GlobalObject.cpp | 17 +++++++----------
 6 files changed, 59 insertions(+), 32 deletions(-)

diff --git a/js/src/js.msg b/js/src/js.msg
index 072f28a8a3e6..75e0dce894c4 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -433,3 +433,4 @@ MSG_DEF(JSMSG_NO_EXPORT_NAME,           378, 0, JSEXN_SYNTAXERR, "missing export
 MSG_DEF(JSMSG_DECLARATION_AFTER_EXPORT, 379, 0, JSEXN_SYNTAXERR, "missing declaration after 'export' keyword")
 MSG_DEF(JSMSG_INVALID_PROTOTYPE,        380, 0, JSEXN_TYPEERR, "prototype field is not an object")
 MSG_DEF(JSMSG_TYPEDOBJECT_HANDLE_TO_UNSIZED, 381, 0, JSEXN_TYPEERR, "cannot create a handle to an unsized type")
+MSG_DEF(JSMSG_SETPROTOTYPEOF_FAIL,      382, 0, JSEXN_TYPEERR, "[[SetPrototypeOf]] failed")
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 882c65b08b8e..a731c49ca07e 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -2374,7 +2374,16 @@ JS_SetPrototype(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<JSObject*>
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, proto);
 
-    return SetClassAndProto(cx, obj, obj->getClass(), proto, false);
+    bool succeeded;
+    if (!JSObject::setProto(cx, obj, proto, &succeeded))
+        return false;
+
+    if (!succeeded) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_SETPROTOTYPEOF_FAIL);
+        return false;
+    }
+
+    return true;
 }
 
 JS_PUBLIC_API(JSObject *)
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index b362833bff1a..9ed490c295ed 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1888,9 +1888,10 @@ JSObject::ReserveForTradeGuts(JSContext *cx, JSObject *aArg, JSObject *bArg,
     const Class *bClass = b->getClass();
     Rooted<TaggedProto> aProto(cx, a->getTaggedProto());
     Rooted<TaggedProto> bProto(cx, b->getTaggedProto());
-    if (!SetClassAndProto(cx, a, bClass, bProto, false))
+    bool success;
+    if (!SetClassAndProto(cx, a, bClass, bProto, &success) || !success)
         return false;
-    if (!SetClassAndProto(cx, b, aClass, aProto, false))
+    if (!SetClassAndProto(cx, b, aClass, aProto, &success) || !success)
         return false;
 
     if (a->tenuredSizeOfThis() == b->tenuredSizeOfThis())
@@ -2898,10 +2899,9 @@ static const ClassInitializerOp lazy_prototype_init[JSProto_LIMIT] = {
 
 bool
 js::SetClassAndProto(JSContext *cx, HandleObject obj,
-                     const Class *clasp, Handle<js::TaggedProto> proto, bool checkForCycles)
+                     const Class *clasp, Handle<js::TaggedProto> proto,
+                     bool *succeeded)
 {
-    JS_ASSERT_IF(!checkForCycles, obj.get() != proto.raw());
-
     /*
      * Regenerate shapes for all of the scopes along the old prototype chain,
      * in case any entries were filled by looking up through obj. Stop when a
@@ -2921,6 +2921,7 @@ js::SetClassAndProto(JSContext *cx, HandleObject obj,
      *
      * :XXX: bug 707717 make this code less brittle.
      */
+    *succeeded = false;
     RootedObject oldproto(cx, obj);
     while (oldproto && oldproto->isNative()) {
         if (oldproto->hasSingletonType()) {
@@ -2933,21 +2934,6 @@ js::SetClassAndProto(JSContext *cx, HandleObject obj,
         oldproto = oldproto->getProto();
     }
 
-    if (checkForCycles) {
-        JS_ASSERT(!proto.isLazy());
-        RootedObject obj2(cx);
-        for (obj2 = proto.toObjectOrNull(); obj2; ) {
-            if (obj2 == obj) {
-                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_CYCLIC_VALUE,
-                                     js_proto_str);
-                return false;
-            }
-
-            if (!JSObject::getProto(cx, obj2, &obj2))
-                return false;
-        }
-    }
-
     if (obj->hasSingletonType()) {
         /*
          * Just splice the prototype, but mark the properties as unknown for
@@ -2956,6 +2942,7 @@ js::SetClassAndProto(JSContext *cx, HandleObject obj,
         if (!obj->splicePrototype(cx, clasp, proto))
             return false;
         MarkTypeObjectUnknownProperties(cx, obj->type());
+        *succeeded = true;
         return true;
     }
 
@@ -2981,6 +2968,7 @@ js::SetClassAndProto(JSContext *cx, HandleObject obj,
     MarkTypeObjectUnknownProperties(cx, type, true);
 
     obj->setType(type);
+    *succeeded = true;
     return true;
 }
 
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index f3fbbf9ef59b..1a003445390c 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -478,6 +478,9 @@ class JSObject : public js::ObjectImpl
     }
     static inline bool getProto(JSContext *cx, js::HandleObject obj,
                                 js::MutableHandleObject protop);
+    // Returns false on error, success of operation in outparam.
+    static inline bool setProto(JSContext *cx, JS::HandleObject obj,
+                                JS::HandleObject proto, bool *succeeded);
 
     // uninlinedSetType() is the same as setType(), but not inlined.
     inline void setType(js::types::TypeObject *newType);
@@ -1600,7 +1603,7 @@ GetClassPrototypePure(GlobalObject *global, JSProtoKey protoKey);
 
 extern bool
 SetClassAndProto(JSContext *cx, HandleObject obj,
-                 const Class *clasp, Handle<TaggedProto> proto, bool checkForCycles);
+                 const Class *clasp, Handle<TaggedProto> proto, bool *succeeded);
 
 extern JSObject *
 NonNullObject(JSContext *cx, const Value &v);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 5704017a5eb4..492d5d244515 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -21,6 +21,8 @@
 #include "jsgcinlines.h"
 #include "jsinferinlines.h"
 
+#include "vm/ObjectImpl-inl.h"
+
 /* static */ inline bool
 JSObject::setGenericAttributes(JSContext *cx, js::HandleObject obj,
                                js::HandleId id, unsigned *attrsp)
@@ -408,6 +410,33 @@ JSObject::getProto(JSContext *cx, js::HandleObject obj, js::MutableHandleObject
     }
 }
 
+/* static */ inline bool
+JSObject::setProto(JSContext *cx, JS::HandleObject obj, JS::HandleObject proto, bool *succeeded)
+{
+    /* ES6 9.1.2 step 5 forbids changing [[Prototype]] if not [[Extensible]]. */
+    bool extensible;
+    if (!JSObject::isExtensible(cx, obj, &extensible))
+        return false;
+    if (!extensible) {
+        *succeeded = false;
+        return true;
+    }
+
+    /* ES6 9.1.2 step 6 forbids generating cyclical prototype chains. */
+    js::RootedObject obj2(cx);
+    for (obj2 = proto; obj2; ) {
+        if (obj2 == obj) {
+            *succeeded = false;
+            return true;
+        }
+
+        if (!JSObject::getProto(cx, obj2, &obj2))
+            return false;
+    }
+
+    return SetClassAndProto(cx, obj, obj->getClass(), proto, succeeded);
+}
+
 inline bool JSObject::isVarObj()
 {
     if (is<js::DebugScopeObject>())
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index 51948545ca95..a37680794248 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -137,15 +137,6 @@ ProtoSetterImpl(JSContext *cx, CallArgs args)
 
     Rooted<JSObject*> obj(cx, &args.thisv().toObject());
 
-    /* ES5 8.6.2 forbids changing [[Prototype]] if not [[Extensible]]. */
-    bool extensible;
-    if (!JSObject::isExtensible(cx, obj, &extensible))
-        return false;
-    if (!extensible) {
-        obj->reportNotExtensible(cx);
-        return false;
-    }
-
     /*
      * Disallow mutating the [[Prototype]] of a proxy that wasn't simply
      * wrapping some other object.  Also disallow it on ArrayBuffer objects,
@@ -173,9 +164,15 @@ ProtoSetterImpl(JSContext *cx, CallArgs args)
     if (!CheckAccess(cx, obj, nid, JSAccessMode(JSACC_PROTO | JSACC_WRITE), &v, &dummy))
         return false;
 
-    if (!SetClassAndProto(cx, obj, obj->getClass(), newProto, true))
+    bool success;
+    if (!JSObject::setProto(cx, obj, newProto, &success))
         return false;
 
+    if (!success) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_SETPROTOTYPEOF_FAIL);
+        return false;
+    }
+
     args.rval().setUndefined();
     return true;
 }

From 7f87debdf912a60f08b77e629c09d59581cebf86 Mon Sep 17 00:00:00 2001
From: Eric Faust <efaustbmo@gmail.com>
Date: Fri, 13 Dec 2013 12:01:30 -0800
Subject: [PATCH 092/459] Bug 926012 - Part 2: Allow __proto__ sets on proxies.
 (r=Waldo)

---
 js/src/jsobjinlines.h                         |  6 ++++
 js/src/jsproxy.cpp                            | 31 +++++++++++++----
 js/src/jsproxy.h                              | 18 ++++++++++
 .../ecma_5/extensions/proxy-__proto__.js      | 15 ++------
 js/src/vm/GlobalObject.cpp                    | 34 +++++--------------
 5 files changed, 61 insertions(+), 43 deletions(-)

diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 492d5d244515..efa47d470594 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -413,6 +413,12 @@ JSObject::getProto(JSContext *cx, js::HandleObject obj, js::MutableHandleObject
 /* static */ inline bool
 JSObject::setProto(JSContext *cx, JS::HandleObject obj, JS::HandleObject proto, bool *succeeded)
 {
+    /* Proxies live in their own little world. */
+    if (obj->getTaggedProto().isLazy()) {
+        JS_ASSERT(obj->is<js::ProxyObject>());
+        return js::Proxy::setPrototypeOf(cx, obj, proto, succeeded);
+    }
+
     /* ES6 9.1.2 step 5 forbids changing [[Prototype]] if not [[Extensible]]. */
     bool extensible;
     if (!JSObject::isExtensible(cx, obj, &extensible))
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index 52efb84f3d8c..670bad717d76 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -345,9 +345,17 @@ BaseProxyHandler::weakmapKeyDelegate(JSObject *proxy)
 bool
 BaseProxyHandler::getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject protop)
 {
-    // The default implementation here just uses proto of the proxy object.
-    protop.set(proxy->getTaggedProto().toObjectOrNull());
-    return true;
+    MOZ_ASSUME_UNREACHABLE("Must override getPrototypeOf with lazy prototype.");
+}
+
+bool
+BaseProxyHandler::setPrototypeOf(JSContext *cx, HandleObject, HandleObject, bool *)
+{
+    // Disallow sets of protos on proxies with lazy protos, but no hook.
+    // This keeps us away from the footgun of having the first proto set opt
+    // you out of having dynamic protos altogether.
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_SETPROTOTYPEOF_FAIL);
+    return false;
 }
 
 bool
@@ -2305,7 +2313,7 @@ ScriptedDirectProxyHandler ScriptedDirectProxyHandler::singleton;
 #define INVOKE_ON_PROTOTYPE(cx, handler, proxy, protoCall)                   \
     JS_BEGIN_MACRO                                                           \
         RootedObject proto(cx);                                              \
-        if (!handler->getPrototypeOf(cx, proxy, &proto))                     \
+        if (!JSObject::getProto(cx, proxy, &proto))                          \
             return false;                                                    \
         if (!proto)                                                          \
             return true;                                                     \
@@ -2543,7 +2551,9 @@ Proxy::set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id
             return false;
         if (!hasOwn) {
             RootedObject proto(cx);
-            if (!handler->getPrototypeOf(cx, proxy, &proto))
+            // Proxies might still use the normal prototype mechanism, rather than
+            // a hook, so query the engine proper
+            if (!JSObject::getProto(cx, proxy, &proto))
                 return false;
             if (proto) {
                 Rooted<PropertyDescriptor> desc(cx);
@@ -2725,14 +2735,23 @@ Proxy::defaultValue(JSContext *cx, HandleObject proxy, JSType hint, MutableHandl
     return proxy->as<ProxyObject>().handler()->defaultValue(cx, proxy, hint, vp);
 }
 
+JSObject * const Proxy::LazyProto = reinterpret_cast<JSObject *>(0x1);
+
 bool
 Proxy::getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject proto)
 {
+    JS_ASSERT(proxy->getTaggedProto().isLazy());
     JS_CHECK_RECURSION(cx, return false);
     return proxy->as<ProxyObject>().handler()->getPrototypeOf(cx, proxy, proto);
 }
 
-JSObject * const Proxy::LazyProto = reinterpret_cast<JSObject *>(0x1);
+bool
+Proxy::setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto, bool *bp)
+{
+    JS_ASSERT(proxy->getTaggedProto().isLazy());
+    JS_CHECK_RECURSION(cx, return false);
+    return proxy->as<ProxyObject>().handler()->setPrototypeOf(cx, proxy, proto, bp);
+}
 
 /* static */ bool
 Proxy::watch(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, JS::HandleObject callable)
diff --git a/js/src/jsproxy.h b/js/src/jsproxy.h
index 0c6b4d4e2b5e..1888b660cead 100644
--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@@ -47,6 +47,22 @@ class JS_FRIEND_API(Wrapper);
  * BaseProxyHandler provides implementations of the derived traps in terms of
  * the (pure virtual) fundamental traps.
  *
+ * In addition to the normal traps, there are two models for proxy prototype
+ * chains. First, proxies may opt to use the standard prototype mechanism used
+ * throughout the engine. To do so, simply pass a prototype to NewProxyObject()
+ * at creation time. All prototype accesses will then "just work" to treat the
+ * proxy as a "normal" object. Alternatively, if instead the proxy wishes to
+ * implement more complicated prototype semantics (if, for example, it wants to
+ * delegate the prototype lookup to a wrapped object), it may pass Proxy::LazyProto
+ * as the prototype at create time and opt in to the trapped prototype system,
+ * which guarantees that their trap will be called on any and every prototype
+ * chain access of the object.
+ *
+ * This system is implemented with two traps: {get,set}PrototypeOf. The default
+ * implementation of setPrototypeOf throws a TypeError. Since it is not possible
+ * to create an object without a sense of prototype chain, handler implementors
+ * must provide a getPrototypeOf trap if opting in to the dynamic prototype system.
+ *
  * To minimize code duplication, a set of abstract proxy handler classes is
  * provided, from which other handlers may inherit. These abstract classes
  * are organized in the following hierarchy:
@@ -167,6 +183,7 @@ class JS_FRIEND_API(BaseProxyHandler)
     virtual bool defaultValue(JSContext *cx, HandleObject obj, JSType hint, MutableHandleValue vp);
     virtual void finalize(JSFreeOp *fop, JSObject *proxy);
     virtual bool getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject protop);
+    virtual bool setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto, bool *bp);
 
     // These two hooks must be overridden, or not overridden, in tandem -- no
     // overriding just one!
@@ -294,6 +311,7 @@ class Proxy
     static bool regexp_toShared(JSContext *cx, HandleObject proxy, RegExpGuard *g);
     static bool defaultValue(JSContext *cx, HandleObject obj, JSType hint, MutableHandleValue vp);
     static bool getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject protop);
+    static bool setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto, bool *bp);
 
     static bool watch(JSContext *cx, HandleObject proxy, HandleId id, HandleObject callable);
     static bool unwatch(JSContext *cx, HandleObject proxy, HandleId id);
diff --git a/js/src/tests/ecma_5/extensions/proxy-__proto__.js b/js/src/tests/ecma_5/extensions/proxy-__proto__.js
index 9bfe3e3ad545..480d43048f8f 100644
--- a/js/src/tests/ecma_5/extensions/proxy-__proto__.js
+++ b/js/src/tests/ecma_5/extensions/proxy-__proto__.js
@@ -34,20 +34,11 @@ function testProxy(creator, args, proto)
   assertEq(protoGetter.call(pobj), proto);
 
   // Attempt [[Prototype]] mutation
-  try
-  {
-    protoSetter.call(pobj);
-    throw new Error("should throw trying to mutate a proxy's [[Prototype]]");
-  }
-  catch (e)
-  {
-    assertEq(e instanceof TypeError, true,
-             "expected TypeError, instead got: " + e);
-  }
+  protoSetter.call(pobj, null);
 
   // Check [[Prototype]] after attempted mutation
-  assertEq(Object.getPrototypeOf(pobj), proto);
-  assertEq(protoGetter.call(pobj), proto);
+  assertEq(Object.getPrototypeOf(pobj), null);
+  assertEq(protoGetter.call(pobj), null);
 }
 
 // Proxy object with non-null [[Prototype]]
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index a37680794248..aff455ebc495 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -68,7 +68,7 @@ ThrowTypeError(JSContext *cx, unsigned argc, Value *vp)
 }
 
 static bool
-TestProtoGetterThis(HandleValue v)
+TestProtoThis(HandleValue v)
 {
     return !v.isNullOrUndefined();
 }
@@ -76,7 +76,7 @@ TestProtoGetterThis(HandleValue v)
 static bool
 ProtoGetterImpl(JSContext *cx, CallArgs args)
 {
-    JS_ASSERT(TestProtoGetterThis(args.thisv()));
+    JS_ASSERT(TestProtoThis(args.thisv()));
 
     HandleValue thisv = args.thisv();
     if (thisv.isPrimitive() && !BoxNonStrictThis(cx, args))
@@ -97,31 +97,17 @@ static bool
 ProtoGetter(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    return CallNonGenericMethod(cx, TestProtoGetterThis, ProtoGetterImpl, args);
+    return CallNonGenericMethod(cx, TestProtoThis, ProtoGetterImpl, args);
 }
 
 namespace js {
 size_t sSetProtoCalled = 0;
 } // namespace js
 
-static bool
-TestProtoSetterThis(HandleValue v)
-{
-    if (v.isNullOrUndefined())
-        return false;
-
-    /* These will work as if on a boxed primitive; dumb, but whatever. */
-    if (!v.isObject())
-        return true;
-
-    /* Otherwise, only accept non-proxies. */
-    return !v.toObject().is<ProxyObject>();
-}
-
 static bool
 ProtoSetterImpl(JSContext *cx, CallArgs args)
 {
-    JS_ASSERT(TestProtoSetterThis(args.thisv()));
+    JS_ASSERT(TestProtoThis(args.thisv()));
 
     HandleValue thisv = args.thisv();
     if (thisv.isPrimitive()) {
@@ -138,15 +124,13 @@ ProtoSetterImpl(JSContext *cx, CallArgs args)
     Rooted<JSObject*> obj(cx, &args.thisv().toObject());
 
     /*
-     * Disallow mutating the [[Prototype]] of a proxy that wasn't simply
-     * wrapping some other object.  Also disallow it on ArrayBuffer objects,
-     * which due to their complicated delegate-object shenanigans can't easily
+     * Disallow mutating the [[Prototype]] on ArrayBuffer objects, which
+     * due to their complicated delegate-object shenanigans can't easily
      * have a mutable [[Prototype]].
      */
-    if (obj->is<ProxyObject>() || obj->is<ArrayBufferObject>()) {
+    if (obj->is<ArrayBufferObject>()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,
-                             "Object", "__proto__ setter",
-                             obj->is<ProxyObject>() ? "Proxy" : "ArrayBuffer");
+                             "Object", "__proto__ setter", "ArrayBuffer");
         return false;
     }
 
@@ -181,7 +165,7 @@ static bool
 ProtoSetter(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    return CallNonGenericMethod(cx, TestProtoSetterThis, ProtoSetterImpl, args);
+    return CallNonGenericMethod(cx, TestProtoThis, ProtoSetterImpl, args);
 }
 
 JSObject *

From 46a65bdd10d9cc24fa5a5df83208e4e3b0b45e79 Mon Sep 17 00:00:00 2001
From: Eric Faust <efaustbmo@gmail.com>
Date: Fri, 13 Dec 2013 12:01:30 -0800
Subject: [PATCH 093/459] Bug 926012 - Part 3: Convert wrappers to using
 dynamic prototype hooks. (r=bholley)

---
 dom/base/nsGlobalWindow.cpp                | 30 +++----------
 js/src/jsapi-tests/testBug604087.cpp       |  8 ++--
 js/src/jsproxy.cpp                         | 13 ++++++
 js/src/jsproxy.h                           |  2 +
 js/src/jswrapper.cpp                       | 32 +++++++++----
 js/src/jswrapper.h                         | 11 +++--
 js/src/shell/js.cpp                        | 39 +++++++++++++---
 js/xpconnect/wrappers/WaiveXrayWrapper.cpp |  7 +++
 js/xpconnect/wrappers/WaiveXrayWrapper.h   |  3 ++
 js/xpconnect/wrappers/WrapperFactory.cpp   | 52 ++++++++++------------
 js/xpconnect/wrappers/WrapperFactory.h     |  1 +
 js/xpconnect/wrappers/XrayWrapper.cpp      | 51 +++++++++++++++++++++
 js/xpconnect/wrappers/XrayWrapper.h        |  5 +++
 13 files changed, 178 insertions(+), 76 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index b8bf96e9298a..dbcc1f5078fe 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1011,11 +1011,7 @@ static JSObject*
 NewOuterWindowProxy(JSContext *cx, JS::Handle<JSObject*> parent, bool isChrome)
 {
   JSAutoCompartment ac(cx, parent);
-  JS::Rooted<JSObject*> proto(cx);
-  if (!js::GetObjectProto(cx, parent, &proto))
-    return nullptr;
-
-  JSObject *obj = js::Wrapper::New(cx, parent, proto, parent,
+  JSObject *obj = js::Wrapper::New(cx, parent, parent,
                                    isChrome ? &nsChromeOuterWindowProxy::singleton
                                             : &nsOuterWindowProxy::singleton);
 
@@ -2103,26 +2099,11 @@ nsGlobalWindow::CreateOuterObject(nsGlobalWindow* aNewInner)
 
   js::SetProxyExtra(outer, 0, js::PrivateValue(ToSupports(this)));
 
-  return SetOuterObject(cx, outer);
-}
-
-nsresult
-nsGlobalWindow::SetOuterObject(JSContext* aCx, JS::Handle<JSObject*> aOuterObject)
-{
-  JSAutoCompartment ac(aCx, aOuterObject);
+  JSAutoCompartment ac(cx, outer);
 
   // Inform the nsJSContext, which is the canonical holder of the outer.
   MOZ_ASSERT(IsOuterWindow());
-  mContext->SetWindowProxy(aOuterObject);
-
-  // Set up the prototype for the outer object.
-  JS::Rooted<JSObject*> inner(aCx, JS_GetParent(aOuterObject));
-  JS::Rooted<JSObject*> proto(aCx);
-  if (!JS_GetPrototype(aCx, inner, &proto)) {
-    return NS_ERROR_FAILURE;
-  }
-  JS_SetPrototype(aCx, aOuterObject, proto);
-
+  mContext->SetWindowProxy(outer);
   return NS_OK;
 }
 
@@ -2457,8 +2438,9 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
         JS_SetParent(cx, mJSObject, newInnerWindow->mJSObject);
 
         JS::Rooted<JSObject*> obj(cx, mJSObject);
-        rv = SetOuterObject(cx, obj);
-        NS_ENSURE_SUCCESS(rv, rv);
+
+        // Inform the nsJSContext, which is the canonical holder of the outer.
+        mContext->SetWindowProxy(obj);
 
         NS_ASSERTION(!JS_IsExceptionPending(cx),
                      "We might overwrite a pending exception!");
diff --git a/js/src/jsapi-tests/testBug604087.cpp b/js/src/jsapi-tests/testBug604087.cpp
index 63b4efb4581d..ebd791286685 100644
--- a/js/src/jsapi-tests/testBug604087.cpp
+++ b/js/src/jsapi-tests/testBug604087.cpp
@@ -60,13 +60,12 @@ static JSObject *
 Wrap(JSContext *cx, JS::HandleObject existing, JS::HandleObject obj,
      JS::HandleObject proto, JS::HandleObject parent, unsigned flags)
 {
-    return js::Wrapper::New(cx, obj, proto, parent, &js::CrossCompartmentWrapper::singleton);
+    return js::Wrapper::New(cx, obj, parent, &js::CrossCompartmentWrapper::singleton);
 }
 
 BEGIN_TEST(testBug604087)
 {
-    JS::RootedObject outerObj(cx, js::Wrapper::New(cx, global, global->getProto(), global,
-                                               &OuterWrapper::singleton));
+    JS::RootedObject outerObj(cx, js::Wrapper::New(cx, global, global, &OuterWrapper::singleton));
     JS::RootedObject compartment2(cx, JS_NewGlobalObject(cx, getGlobalClass(), nullptr, JS::FireOnNewGlobalHook));
     JS::RootedObject compartment3(cx, JS_NewGlobalObject(cx, getGlobalClass(), nullptr, JS::FireOnNewGlobalHook));
     JS::RootedObject compartment4(cx, JS_NewGlobalObject(cx, getGlobalClass(), nullptr, JS::FireOnNewGlobalHook));
@@ -87,8 +86,7 @@ BEGIN_TEST(testBug604087)
     JS::RootedObject next(cx);
     {
         JSAutoCompartment ac(cx, compartment2);
-        next = js::Wrapper::New(cx, compartment2, compartment2->getProto(), compartment2,
-                                &OuterWrapper::singleton);
+        next = js::Wrapper::New(cx, compartment2, compartment2, &OuterWrapper::singleton);
         CHECK(next);
     }
 
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index 670bad717d76..b1d4dcdd6605 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -516,6 +516,19 @@ DirectProxyHandler::hasInstance(JSContext *cx, HandleObject proxy, MutableHandle
     return true;
 }
 
+bool
+DirectProxyHandler::getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject protop)
+{
+    RootedObject target(cx, proxy->as<ProxyObject>().target());
+    return JSObject::getProto(cx, target, protop);
+}
+
+bool
+DirectProxyHandler::setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto, bool *bp)
+{
+    RootedObject target(cx, proxy->as<ProxyObject>().target());
+    return JSObject::setProto(cx, target, proto, bp);
+}
 
 bool
 DirectProxyHandler::objectClassIs(HandleObject proxy, ESClassValue classValue,
diff --git a/js/src/jsproxy.h b/js/src/jsproxy.h
index 1888b660cead..12cc9ceab9d1 100644
--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@@ -252,6 +252,8 @@ class JS_PUBLIC_API(DirectProxyHandler) : public BaseProxyHandler
                             CallArgs args) MOZ_OVERRIDE;
     virtual bool hasInstance(JSContext *cx, HandleObject proxy, MutableHandleValue v,
                              bool *bp) MOZ_OVERRIDE;
+    virtual bool getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject protop);
+    virtual bool setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto, bool *bp);
     virtual bool objectClassIs(HandleObject obj, ESClassValue classValue,
                                JSContext *cx) MOZ_OVERRIDE;
     virtual const char *className(JSContext *cx, HandleObject proxy) MOZ_OVERRIDE;
diff --git a/js/src/jswrapper.cpp b/js/src/jswrapper.cpp
index e28a33acb16b..7a2e1c2c1587 100644
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -39,7 +39,7 @@ Wrapper::defaultValue(JSContext *cx, HandleObject proxy, JSType hint, MutableHan
 }
 
 JSObject *
-Wrapper::New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent, Wrapper *handler)
+Wrapper::New(JSContext *cx, JSObject *obj, JSObject *parent, Wrapper *handler)
 {
     JS_ASSERT(parent);
 
@@ -48,7 +48,7 @@ Wrapper::New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent, Wr
     RootedValue priv(cx, ObjectValue(*obj));
     ProxyOptions options;
     options.setCallable(obj->isCallable());
-    return NewProxyObject(cx, handler, priv, proto, parent, options);
+    return NewProxyObject(cx, handler, priv, Proxy::LazyProto, parent, options);
 }
 
 JSObject *
@@ -141,7 +141,8 @@ js::TransparentObjectWrapper(JSContext *cx, HandleObject existing, HandleObject
 {
     // Allow wrapping outer window proxies.
     JS_ASSERT(!obj->is<WrapperObject>() || obj->getClass()->ext.innerObject);
-    return Wrapper::New(cx, obj, wrappedProto, parent, &CrossCompartmentWrapper::singleton);
+    JS_ASSERT(wrappedProto == Proxy::LazyProto);
+    return Wrapper::New(cx, obj, parent, &CrossCompartmentWrapper::singleton);
 }
 
 ErrorCopier::~ErrorCopier()
@@ -578,11 +579,6 @@ bool
 CrossCompartmentWrapper::getPrototypeOf(JSContext *cx, HandleObject wrapper,
                                         MutableHandleObject protop)
 {
-    if (!wrapper->getTaggedProto().isLazy()) {
-        protop.set(wrapper->getTaggedProto().toObjectOrNull());
-        return true;
-    }
-
     {
         RootedObject wrapped(cx, wrappedObject(wrapper));
         AutoCompartment call(cx, wrapped);
@@ -595,6 +591,17 @@ CrossCompartmentWrapper::getPrototypeOf(JSContext *cx, HandleObject wrapper,
     return cx->compartment()->wrap(cx, protop);
 }
 
+bool
+CrossCompartmentWrapper::setPrototypeOf(JSContext *cx, HandleObject wrapper,
+                                        HandleObject proto, bool *bp)
+{
+    RootedObject protoCopy(cx, proto);
+    PIERCE(cx, wrapper,
+           cx->compartment()->wrap(cx, &protoCopy),
+           Wrapper::setPrototypeOf(cx, wrapper, protoCopy, bp),
+           NOTHING);
+}
+
 CrossCompartmentWrapper CrossCompartmentWrapper::singleton(0u);
 
 /* Security wrappers. */
@@ -646,6 +653,15 @@ SecurityWrapper<Base>::nativeCall(JSContext *cx, IsAcceptableThis test, NativeIm
     return false;
 }
 
+template <class Base>
+bool
+SecurityWrapper<Base>::setPrototypeOf(JSContext *cx, HandleObject wrapper,
+                                      HandleObject proto, bool *bp)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNWRAP_DENIED);
+    return false;
+}
+
 // For security wrappers, we run the DefaultValue algorithm on the wrapper
 // itself, which means that the existing security policy on operations like
 // toString() will take effect and do the right thing here.
diff --git a/js/src/jswrapper.h b/js/src/jswrapper.h
index 5d68b8d17a69..08f57ef03c0a 100644
--- a/js/src/jswrapper.h
+++ b/js/src/jswrapper.h
@@ -49,8 +49,7 @@ class JS_FRIEND_API(Wrapper) : public DirectProxyHandler
     void setSafeToUnwrap(bool safe) { mSafeToUnwrap = safe; }
     bool isSafeToUnwrap() { return mSafeToUnwrap; }
 
-    static JSObject *New(JSContext *cx, JSObject *obj, JSObject *proto,
-                         JSObject *parent, Wrapper *handler);
+    static JSObject *New(JSContext *cx, JSObject *obj, JSObject *parent, Wrapper *handler);
 
     static JSObject *Renew(JSContext *cx, JSObject *existing, JSObject *obj, Wrapper *handler);
 
@@ -120,7 +119,10 @@ class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
     virtual bool regexp_toShared(JSContext *cx, HandleObject proxy, RegExpGuard *g) MOZ_OVERRIDE;
     virtual bool defaultValue(JSContext *cx, HandleObject wrapper, JSType hint,
                               MutableHandleValue vp) MOZ_OVERRIDE;
-    virtual bool getPrototypeOf(JSContext *cx, HandleObject proxy, MutableHandleObject protop);
+    virtual bool getPrototypeOf(JSContext *cx, HandleObject proxy,
+                                MutableHandleObject protop) MOZ_OVERRIDE;
+    virtual bool setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto,
+                                bool *bp) MOZ_OVERRIDE;
 
     static CrossCompartmentWrapper singleton;
     static CrossCompartmentWrapper singletonWithPrototype;
@@ -155,6 +157,9 @@ class JS_FRIEND_API(SecurityWrapper) : public Base
     virtual bool defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
                                 MutableHandle<JSPropertyDescriptor> desc) MOZ_OVERRIDE;
 
+    virtual bool setPrototypeOf(JSContext *cx, HandleObject proxy, HandleObject proto,
+                                bool *bp) MOZ_OVERRIDE;
+
     virtual bool watch(JSContext *cx, JS::HandleObject proxy, JS::HandleId id,
                        JS::HandleObject callable) MOZ_OVERRIDE;
     virtual bool unwatch(JSContext *cx, JS::HandleObject proxy, JS::HandleId id) MOZ_OVERRIDE;
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 2d526784902c..96d3553a7ebc 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3743,6 +3743,34 @@ ThisFilename(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
+/*
+ * Internal class for testing hasPrototype easily.
+ * Uses passed in prototype instead of target's.
+ */
+class WrapperWithProto : public Wrapper
+{
+  public:
+    explicit WrapperWithProto(unsigned flags)
+      : Wrapper(flags, true)
+    { }
+
+    static JSObject *New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent,
+                         Wrapper *handler);
+};
+
+/* static */ JSObject *
+WrapperWithProto::New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent,
+                      Wrapper *handler)
+{
+    JS_ASSERT(parent);
+    AutoMarkInDeadZone amd(cx->zone());
+
+    RootedValue priv(cx, ObjectValue(*obj));
+    ProxyOptions options;
+    options.setCallable(obj->isCallable());
+    return NewProxyObject(cx, handler, priv, proto, parent, options);
+}
+
 static bool
 Wrap(JSContext *cx, unsigned argc, jsval *vp)
 {
@@ -3753,10 +3781,7 @@ Wrap(JSContext *cx, unsigned argc, jsval *vp)
     }
 
     RootedObject obj(cx, JSVAL_TO_OBJECT(v));
-    RootedObject proto(cx);
-    if (!JSObject::getProto(cx, obj, &proto))
-        return false;
-    JSObject *wrapped = Wrapper::New(cx, obj, proto, &obj->global(),
+    JSObject *wrapped = Wrapper::New(cx, obj, &obj->global(),
                                      &Wrapper::singleton);
     if (!wrapped)
         return false;
@@ -3779,9 +3804,9 @@ WrapWithProto(JSContext *cx, unsigned argc, jsval *vp)
         return false;
     }
 
-    JSObject *wrapped = Wrapper::New(cx, &obj.toObject(), proto.toObjectOrNull(),
-                                     &obj.toObject().global(),
-                                     &Wrapper::singletonWithPrototype);
+    JSObject *wrapped = WrapperWithProto::New(cx, &obj.toObject(), proto.toObjectOrNull(),
+                                              &obj.toObject().global(),
+                                              &Wrapper::singletonWithPrototype);
     if (!wrapped)
         return false;
 
diff --git a/js/xpconnect/wrappers/WaiveXrayWrapper.cpp b/js/xpconnect/wrappers/WaiveXrayWrapper.cpp
index 3f5a068a4a1c..bc5d3b419e08 100644
--- a/js/xpconnect/wrappers/WaiveXrayWrapper.cpp
+++ b/js/xpconnect/wrappers/WaiveXrayWrapper.cpp
@@ -91,4 +91,11 @@ WaiveXrayWrapper::nativeCall(JSContext *cx, JS::IsAcceptableThis test,
            WrapperFactory::WaiveXrayAndWrap(cx, args.rval());
 }
 
+bool
+WaiveXrayWrapper::getPrototypeOf(JSContext *cx, HandleObject wrapper, MutableHandleObject protop)
+{
+    return CrossCompartmentWrapper::getPrototypeOf(cx, wrapper, protop) &&
+           (!protop || WrapperFactory::WaiveXrayAndWrap(cx, protop));
+}
+
 }
diff --git a/js/xpconnect/wrappers/WaiveXrayWrapper.h b/js/xpconnect/wrappers/WaiveXrayWrapper.h
index ea0337e9ce76..985c891423cf 100644
--- a/js/xpconnect/wrappers/WaiveXrayWrapper.h
+++ b/js/xpconnect/wrappers/WaiveXrayWrapper.h
@@ -38,6 +38,9 @@ class WaiveXrayWrapper : public js::CrossCompartmentWrapper {
     virtual bool nativeCall(JSContext *cx, JS::IsAcceptableThis test,
                             JS::NativeImpl impl, JS::CallArgs args) MOZ_OVERRIDE;
 
+    virtual bool getPrototypeOf(JSContext *cx, JS::Handle<JSObject*> wrapper,
+                                JS::MutableHandle<JSObject*> protop) MOZ_OVERRIDE;
+
     static WaiveXrayWrapper singleton;
 };
 
diff --git a/js/xpconnect/wrappers/WrapperFactory.cpp b/js/xpconnect/wrappers/WrapperFactory.cpp
index f2581ad9c70b..2c8c13eb8c9e 100644
--- a/js/xpconnect/wrappers/WrapperFactory.cpp
+++ b/js/xpconnect/wrappers/WrapperFactory.cpp
@@ -75,18 +75,8 @@ WrapperFactory::CreateXrayWaiver(JSContext *cx, HandleObject obj)
     MOZ_ASSERT(!GetXrayWaiver(obj));
     XPCWrappedNativeScope *scope = GetObjectScope(obj);
 
-    // Get a waiver for the proto.
-    RootedObject proto(cx);
-    if (!js::GetObjectProto(cx, obj, &proto))
-        return nullptr;
-    if (proto && !(proto = WaiveXray(cx, proto)))
-        return nullptr;
-
-    // Create the waiver.
     JSAutoCompartment ac(cx, obj);
-    if (!JS_WrapObject(cx, &proto))
-        return nullptr;
-    JSObject *waiver = Wrapper::New(cx, obj, proto,
+    JSObject *waiver = Wrapper::New(cx, obj,
                                     JS_GetGlobalForObject(cx, obj),
                                     &XrayWaiver);
     if (!waiver)
@@ -409,10 +399,6 @@ WrapperFactory::Rewrap(JSContext *cx, HandleObject existing, HandleObject obj,
     XrayType xrayType = GetXrayType(obj);
     bool waiveXrayFlag = flags & WAIVE_XRAY_WRAPPER_FLAG;
 
-    // By default we use the wrapped proto of the underlying object as the
-    // prototype for our wrapper, but we may select something different below.
-    RootedObject proxyProto(cx, wrappedProto);
-
     Wrapper *wrapper;
     CompartmentPrivate *targetdata = EnsureCompartmentPrivate(target);
 
@@ -498,10 +484,10 @@ WrapperFactory::Rewrap(JSContext *cx, HandleObject existing, HandleObject obj,
 
     DEBUG_CheckUnwrapSafety(obj, wrapper, origin, target);
 
-    if (existing && proxyProto == wrappedProto)
+    if (existing)
         return Wrapper::Renew(cx, existing, obj, wrapper);
 
-    return Wrapper::New(cx, obj, proxyProto, parent, wrapper);
+    return Wrapper::New(cx, obj, parent, wrapper);
 }
 
 JSObject *
@@ -549,10 +535,22 @@ WrapperFactory::WaiveXrayAndWrap(JSContext *cx, MutableHandleValue vp)
     if (vp.isPrimitive())
         return JS_WrapValue(cx, vp);
 
-    JSObject *obj = js::UncheckedUnwrap(&vp.toObject());
+    RootedObject obj(cx, &vp.toObject());
+    if (!WaiveXrayAndWrap(cx, &obj))
+        return false;
+
+    vp.setObject(*obj);
+    return true;
+}
+
+bool
+WrapperFactory::WaiveXrayAndWrap(JSContext *cx, MutableHandleObject argObj)
+{
+    MOZ_ASSERT(argObj);
+    RootedObject obj(cx, js::UncheckedUnwrap(argObj));
     MOZ_ASSERT(!js::IsInnerObject(obj));
     if (js::IsObjectInContextCompartment(obj, cx)) {
-        vp.setObject(*obj);
+        argObj.set(obj);
         return true;
     }
 
@@ -570,24 +568,23 @@ WrapperFactory::WaiveXrayAndWrap(JSContext *cx, MutableHandleValue vp)
     if (!obj)
         return false;
 
-    vp.setObject(*obj);
-    return JS_WrapValue(cx, vp);
+    if (!JS_WrapObject(cx, &obj))
+        return false;
+    argObj.set(obj);
+    return true;
 }
 
 JSObject *
 WrapperFactory::WrapSOWObject(JSContext *cx, JSObject *objArg)
 {
     RootedObject obj(cx, objArg);
-    RootedObject proto(cx);
 
     // If we're not allowing XBL scopes, that means we're running as a remote
     // XUL domain, in which we can't have SOWs. We should never be called in
     // that case.
     MOZ_ASSERT(xpc::AllowXBLScope(js::GetContextCompartment(cx)));
-    if (!JS_GetPrototype(cx, obj, &proto))
-        return nullptr;
     JSObject *wrapperObj =
-        Wrapper::New(cx, obj, proto, JS_GetGlobalForObject(cx, obj),
+        Wrapper::New(cx, obj, JS_GetGlobalForObject(cx, obj),
                      &FilteringWrapper<SameCompartmentSecurityWrapper,
                      Opaque>::singleton);
     return wrapperObj;
@@ -603,11 +600,8 @@ WrapperFactory::IsComponentsObject(JSObject *obj)
 JSObject *
 WrapperFactory::WrapComponentsObject(JSContext *cx, HandleObject obj)
 {
-    RootedObject proto(cx);
-    if (!JS_GetPrototype(cx, obj, &proto))
-        return nullptr;
     JSObject *wrapperObj =
-        Wrapper::New(cx, obj, proto, JS_GetGlobalForObject(cx, obj),
+        Wrapper::New(cx, obj, JS_GetGlobalForObject(cx, obj),
                      &FilteringWrapper<SameCompartmentSecurityWrapper, ComponentsObjectPolicy>::singleton);
 
     return wrapperObj;
diff --git a/js/xpconnect/wrappers/WrapperFactory.h b/js/xpconnect/wrappers/WrapperFactory.h
index cfdc28e99b3b..1aab6c7e674a 100644
--- a/js/xpconnect/wrappers/WrapperFactory.h
+++ b/js/xpconnect/wrappers/WrapperFactory.h
@@ -64,6 +64,7 @@ class WrapperFactory {
 
     // Wrap wrapped object into a waiver wrapper and then re-wrap it.
     static bool WaiveXrayAndWrap(JSContext *cx, JS::MutableHandleValue vp);
+    static bool WaiveXrayAndWrap(JSContext *cx, JS::MutableHandleObject object);
 
     // Wrap a (same compartment) object in a SOW.
     static JSObject *WrapSOWObject(JSContext *cx, JSObject *obj);
diff --git a/js/xpconnect/wrappers/XrayWrapper.cpp b/js/xpconnect/wrappers/XrayWrapper.cpp
index 7f2021227c28..2610670ab612 100644
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -304,6 +304,7 @@ enum ExpandoSlots {
     JSSLOT_EXPANDO_NEXT = 0,
     JSSLOT_EXPANDO_ORIGIN,
     JSSLOT_EXPANDO_EXCLUSIVE_GLOBAL,
+    JSSLOT_EXPANDO_PROTOTYPE,
     JSSLOT_EXPANDO_COUNT
 };
 
@@ -1792,6 +1793,56 @@ XrayWrapper<Base, Traits>::defaultValue(JSContext *cx, HandleObject wrapper,
     return js::DefaultValue(cx, wrapper, hint, vp);
 }
 
+template <typename Base, typename Traits>
+bool
+XrayWrapper<Base, Traits>::getPrototypeOf(JSContext *cx, JS::HandleObject wrapper,
+                                          JS::MutableHandleObject protop)
+{
+    RootedObject target(cx, Traits::getTargetObject(wrapper));
+    RootedObject expando(cx, Traits::singleton.getExpandoObject(cx, target, wrapper));
+
+    // We want to keep the Xray's prototype distinct from that of content, but only
+    // if there's been a set. If there's not an expando, or the expando slot is |undefined|,
+    // hand back content's proto, appropriately wrapped.
+    //
+    // NB: Our baseclass's getPrototypeOf() will appropriately wrap its return value, so there is
+    // no need for us to.
+
+    if (!expando)
+        return Base::getPrototypeOf(cx, wrapper, protop);
+
+    RootedValue v(cx);
+    {
+        JSAutoCompartment ac(cx, expando);
+        v = JS_GetReservedSlot(expando, JSSLOT_EXPANDO_PROTOTYPE);
+    }
+
+    if (v.isUndefined())
+        return Base::getPrototypeOf(cx, wrapper, protop);
+
+    protop.set(v.toObjectOrNull());
+    return JS_WrapObject(cx, protop);
+}
+
+template <typename Base, typename Traits>
+bool
+XrayWrapper<Base, Traits>::setPrototypeOf(JSContext *cx, JS::HandleObject wrapper,
+                                          JS::HandleObject proto, bool *bp)
+{
+    RootedObject target(cx, Traits::getTargetObject(wrapper));
+    RootedObject expando(cx, Traits::singleton.ensureExpandoObject(cx, wrapper, target));
+
+    // The expando lives in the target's compartment, so do our installation there.
+    JSAutoCompartment ac(cx, target);
+
+    RootedValue v(cx, ObjectValue(*proto));
+    if (!JS_WrapValue(cx, &v))
+        return false;
+    JS_SetReservedSlot(expando, JSSLOT_EXPANDO_PROTOTYPE, v);
+    *bp = true;
+    return true;
+}
+
 
 /*
  * The Permissive / Security variants should be used depending on whether the
diff --git a/js/xpconnect/wrappers/XrayWrapper.h b/js/xpconnect/wrappers/XrayWrapper.h
index b5332c277d52..465a5c66804f 100644
--- a/js/xpconnect/wrappers/XrayWrapper.h
+++ b/js/xpconnect/wrappers/XrayWrapper.h
@@ -106,6 +106,11 @@ class XrayWrapper : public Base {
                               JSType hint, JS::MutableHandleValue vp)
                               MOZ_OVERRIDE;
 
+    virtual bool getPrototypeOf(JSContext *cx, JS::HandleObject wrapper,
+                                JS::MutableHandleObject protop) MOZ_OVERRIDE;
+    virtual bool setPrototypeOf(JSContext *cx, JS::HandleObject wrapper,
+                                JS::HandleObject proto, bool *bp) MOZ_OVERRIDE;
+
     static XrayWrapper singleton;
 
   private:

From fad917b723a0dd9bf77f4e0ee3a9279311c9c5c9 Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Fri, 13 Dec 2013 15:15:07 -0500
Subject: [PATCH 094/459] Bug 948406 - Append some zeros to EGL attrib lists to
 work around a bug in Android/B2G emulator - r=vladv

---
 gfx/gl/GLContextProviderEGL.cpp | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/gfx/gl/GLContextProviderEGL.cpp b/gfx/gl/GLContextProviderEGL.cpp
index ba6b9f2c46e2..570e7363f4ce 100644
--- a/gfx/gl/GLContextProviderEGL.cpp
+++ b/gfx/gl/GLContextProviderEGL.cpp
@@ -134,16 +134,26 @@ namespace gl {
 static bool
 CreateConfig(EGLConfig* aConfig);
 
+// append three zeros at the end of attribs list to work around
+// EGL implementation bugs that iterate until they find 0, instead of
+// EGL_NONE. See bug 948406.
+#define EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS \
+     LOCAL_EGL_NONE, 0, 0, 0
+
+static EGLint gTerminationAttribs[] = {
+    EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS
+};
+
 static EGLint gContextAttribs[] = {
     LOCAL_EGL_CONTEXT_CLIENT_VERSION, 2,
-    LOCAL_EGL_NONE
+    EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS
 };
 
 static EGLint gContextAttribsRobustness[] = {
     LOCAL_EGL_CONTEXT_CLIENT_VERSION, 2,
     //LOCAL_EGL_CONTEXT_ROBUST_ACCESS_EXT, LOCAL_EGL_TRUE,
     LOCAL_EGL_CONTEXT_RESET_NOTIFICATION_STRATEGY_EXT, LOCAL_EGL_LOSE_CONTEXT_ON_RESET_EXT,
-    LOCAL_EGL_NONE
+    EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS
 };
 
 static int
@@ -576,7 +586,9 @@ protected:
             pbattrs.AppendElement(bindToTextureFormat);
         }
 
-        pbattrs.AppendElement(LOCAL_EGL_NONE);
+        for (size_t i = 0; i < MOZ_ARRAY_LENGTH(gTerminationAttribs); i++) {
+          pbattrs.AppendElement(gTerminationAttribs[i]);
+        }
 
         surface = sEGLLibrary.fCreatePbufferSurface(EGL_DISPLAY(), config, &pbattrs[0]);
         if (!surface) {
@@ -609,7 +621,7 @@ GLContextEGL::ResizeOffscreen(const gfxIntSize& aNewSize)
 static const EGLint kEGLConfigAttribsOffscreenPBuffer[] = {
     LOCAL_EGL_SURFACE_TYPE,    LOCAL_EGL_PBUFFER_BIT,
     LOCAL_EGL_RENDERABLE_TYPE, LOCAL_EGL_OPENGL_ES2_BIT,
-    LOCAL_EGL_NONE
+    EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS
 };
 
 static const EGLint kEGLConfigAttribsRGB16[] = {
@@ -619,7 +631,7 @@ static const EGLint kEGLConfigAttribsRGB16[] = {
     LOCAL_EGL_GREEN_SIZE,      6,
     LOCAL_EGL_BLUE_SIZE,       5,
     LOCAL_EGL_ALPHA_SIZE,      0,
-    LOCAL_EGL_NONE
+    EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS
 };
 
 static const EGLint kEGLConfigAttribsRGB24[] = {
@@ -629,7 +641,7 @@ static const EGLint kEGLConfigAttribsRGB24[] = {
     LOCAL_EGL_GREEN_SIZE,      8,
     LOCAL_EGL_BLUE_SIZE,       8,
     LOCAL_EGL_ALPHA_SIZE,      0,
-    LOCAL_EGL_NONE
+    EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS
 };
 
 static const EGLint kEGLConfigAttribsRGBA32[] = {
@@ -642,7 +654,7 @@ static const EGLint kEGLConfigAttribsRGBA32[] = {
 #if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION >= 17
     LOCAL_EGL_FRAMEBUFFER_TARGET_ANDROID, LOCAL_EGL_TRUE,
 #endif
-    LOCAL_EGL_NONE
+    EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS
 };
 
 static bool
@@ -894,3 +906,4 @@ GLContextProviderEGL::Shutdown()
 } /* namespace gl */
 } /* namespace mozilla */
 
+#undef EGL_ATTRIBS_LIST_SAFE_TERMINATION_WORKING_AROUND_BUGS

From e56e44cd695867961623f70591d37e4655af2d55 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:46 -0800
Subject: [PATCH 095/459] Bug 949668 - SpiderMonkey: Rename MoveResolver::Move
 to MoveOp. r=jandem

---
 js/src/jit/CodeGenerator.cpp                  |   4 +-
 js/src/jit/MoveResolver.cpp                   |   2 +-
 js/src/jit/MoveResolver.h                     | 286 +++++++++---------
 js/src/jit/arm/CodeGenerator-arm.cpp          |   2 -
 js/src/jit/arm/CodeGenerator-arm.h            |   2 +-
 js/src/jit/arm/MacroAssembler-arm.cpp         |  12 +-
 js/src/jit/arm/MacroAssembler-arm.h           |   5 +-
 js/src/jit/arm/MoveEmitter-arm.cpp            |  12 +-
 js/src/jit/arm/MoveEmitter-arm.h              |   9 +-
 js/src/jit/arm/Trampoline-arm.cpp             |   2 -
 .../jit/shared/CodeGenerator-x86-shared.cpp   |   2 -
 js/src/jit/shared/CodeGenerator-x86-shared.h  |   2 +-
 js/src/jit/shared/MoveEmitter-x86-shared.cpp  |  16 +-
 js/src/jit/shared/MoveEmitter-x86-shared.h    |   7 +-
 js/src/jit/x64/MacroAssembler-x64.cpp         |   6 +-
 js/src/jit/x64/MacroAssembler-x64.h           |   3 -
 js/src/jit/x64/Trampoline-x64.cpp             |   2 -
 js/src/jit/x86/MacroAssembler-x86.cpp         |   4 +-
 js/src/jit/x86/MacroAssembler-x86.h           |   3 -
 js/src/jit/x86/Trampoline-x86.cpp             |   2 -
 20 files changed, 178 insertions(+), 205 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 09fa15507436..ba965f48f66a 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1191,9 +1191,7 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
         JS_ASSERT(!from->isConstant());
         JS_ASSERT(from->isDouble() == to->isDouble());
 
-        MoveResolver::Move::Kind kind = from->isDouble()
-                                        ? MoveResolver::Move::DOUBLE
-                                        : MoveResolver::Move::GENERAL;
+        MoveOp::Kind kind = from->isDouble() ? MoveOp::DOUBLE : MoveOp::GENERAL;
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), kind))
             return false;
diff --git a/js/src/jit/MoveResolver.cpp b/js/src/jit/MoveResolver.cpp
index 522bd3b17470..4354f24d8ef5 100644
--- a/js/src/jit/MoveResolver.cpp
+++ b/js/src/jit/MoveResolver.cpp
@@ -21,7 +21,7 @@ MoveResolver::resetState()
 }
 
 bool
-MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // Assert that we're not doing no-op moves.
     JS_ASSERT(!(from == to));
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index 601113b8ac01..bbe6f1201a32 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -14,156 +14,156 @@
 namespace js {
 namespace jit {
 
+// This is similar to Operand, but carries more information. We're also not
+// guaranteed that Operand looks like this on all ISAs.
+class MoveOperand
+{
+    enum Kind {
+        REG,
+        FLOAT_REG,
+        ADDRESS,
+        FLOAT_ADDRESS,
+        EFFECTIVE_ADDRESS
+    };
+
+    Kind kind_;
+    uint32_t code_;
+    int32_t disp_;
+
+  public:
+    enum AddressKind {
+        MEMORY = ADDRESS,
+        EFFECTIVE = EFFECTIVE_ADDRESS,
+        FLOAT = FLOAT_ADDRESS
+    };
+
+    MoveOperand()
+    { }
+    explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
+    { }
+    explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
+    { }
+    MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
+        : kind_((Kind) addrKind),
+        code_(reg.code()),
+        disp_(disp)
+    {
+        // With a zero offset, this is a plain reg-to-reg move.
+        if (disp == 0 && addrKind == EFFECTIVE)
+            kind_ = REG;
+    }
+    MoveOperand(const MoveOperand &other)
+      : kind_(other.kind_),
+        code_(other.code_),
+        disp_(other.disp_)
+    { }
+    bool isFloatReg() const {
+        return kind_ == FLOAT_REG;
+    }
+    bool isGeneralReg() const {
+        return kind_ == REG;
+    }
+    bool isDouble() const {
+        return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
+    }
+    bool isMemory() const {
+        return kind_ == ADDRESS;
+    }
+    bool isFloatAddress() const {
+        return kind_ == FLOAT_ADDRESS;
+    }
+    bool isEffectiveAddress() const {
+        return kind_ == EFFECTIVE_ADDRESS;
+    }
+    Register reg() const {
+        JS_ASSERT(isGeneralReg());
+        return Register::FromCode(code_);
+    }
+    FloatRegister floatReg() const {
+        JS_ASSERT(isFloatReg());
+        return FloatRegister::FromCode(code_);
+    }
+    Register base() const {
+        JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
+        return Register::FromCode(code_);
+    }
+    int32_t disp() const {
+        return disp_;
+    }
+
+    bool operator ==(const MoveOperand &other) const {
+        if (kind_ != other.kind_)
+            return false;
+        if (code_ != other.code_)
+            return false;
+        if (isMemory() || isEffectiveAddress())
+            return disp_ == other.disp_;
+        return true;
+    }
+    bool operator !=(const MoveOperand &other) const {
+        return !operator==(other);
+    }
+};
+
+// This represents a move operation.
+class MoveOp
+{
+  protected:
+    MoveOperand from_;
+    MoveOperand to_;
+    bool cycle_;
+
+  public:
+    enum Kind {
+        GENERAL,
+        DOUBLE
+    };
+
+  protected:
+    Kind kind_;
+
+  public:
+    MoveOp()
+    { }
+    MoveOp(const MoveOp &other)
+      : from_(other.from_),
+        to_(other.to_),
+        cycle_(other.cycle_),
+        kind_(other.kind_)
+    { }
+    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+      : from_(from),
+        to_(to),
+        cycle_(cycle),
+        kind_(kind)
+    { }
+
+    bool inCycle() const {
+        return cycle_;
+    }
+    const MoveOperand &from() const {
+        return from_;
+    }
+    const MoveOperand &to() const {
+        return to_;
+    }
+    Kind kind() const {
+        return kind_;
+    }
+};
+
 class MoveResolver
 {
-  public:
-    // This is similar to Operand, but carries more information. We're also not
-    // guaranteed that Operand looks like this on all ISAs.
-    class MoveOperand
-    {
-        enum Kind {
-            REG,
-            FLOAT_REG,
-            ADDRESS,
-            FLOAT_ADDRESS,
-            EFFECTIVE_ADDRESS
-        };
-
-        Kind kind_;
-        uint32_t code_;
-        int32_t disp_;
-
-      public:
-        enum AddressKind {
-            MEMORY = ADDRESS,
-            EFFECTIVE = EFFECTIVE_ADDRESS,
-            FLOAT = FLOAT_ADDRESS
-        };
-
-        MoveOperand()
-        { }
-        explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
-        { }
-        explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
-        { }
-        MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
-            : kind_((Kind) addrKind),
-            code_(reg.code()),
-            disp_(disp)
-        {
-            // With a zero offset, this is a plain reg-to-reg move.
-            if (disp == 0 && addrKind == EFFECTIVE)
-                kind_ = REG;
-        }
-        MoveOperand(const MoveOperand &other)
-          : kind_(other.kind_),
-            code_(other.code_),
-            disp_(other.disp_)
-        { }
-        bool isFloatReg() const {
-            return kind_ == FLOAT_REG;
-        }
-        bool isGeneralReg() const {
-            return kind_ == REG;
-        }
-        bool isDouble() const {
-            return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
-        }
-        bool isMemory() const {
-            return kind_ == ADDRESS;
-        }
-        bool isFloatAddress() const {
-            return kind_ == FLOAT_ADDRESS;
-        }
-        bool isEffectiveAddress() const {
-            return kind_ == EFFECTIVE_ADDRESS;
-        }
-        Register reg() const {
-            JS_ASSERT(isGeneralReg());
-            return Register::FromCode(code_);
-        }
-        FloatRegister floatReg() const {
-            JS_ASSERT(isFloatReg());
-            return FloatRegister::FromCode(code_);
-        }
-        Register base() const {
-            JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
-            return Register::FromCode(code_);
-        }
-        int32_t disp() const {
-            return disp_;
-        }
-
-        bool operator ==(const MoveOperand &other) const {
-            if (kind_ != other.kind_)
-                return false;
-            if (code_ != other.code_)
-                return false;
-            if (isMemory() || isEffectiveAddress())
-                return disp_ == other.disp_;
-            return true;
-        }
-        bool operator !=(const MoveOperand &other) const {
-            return !operator==(other);
-        }
-    };
-
-    class Move
-    {
-      protected:
-        MoveOperand from_;
-        MoveOperand to_;
-        bool cycle_;
-
-      public:
-        enum Kind {
-            GENERAL,
-            DOUBLE
-        };
-
-      protected:
-        Kind kind_;
-
-      public:
-        Move()
-        { }
-        Move(const Move &other)
-          : from_(other.from_),
-            to_(other.to_),
-            cycle_(other.cycle_),
-            kind_(other.kind_)
-        { }
-        Move(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
-          : from_(from),
-            to_(to),
-            cycle_(cycle),
-            kind_(kind)
-        { }
-
-        bool inCycle() const {
-            return cycle_;
-        }
-        const MoveOperand &from() const {
-            return from_;
-        }
-        const MoveOperand &to() const {
-            return to_;
-        }
-        Kind kind() const {
-            return kind_;
-        }
-    };
-
   private:
     struct PendingMove
-      : public Move,
+      : public MoveOp,
         public TempObject,
         public InlineListNode<PendingMove>
     {
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : Move(from, to, kind, false)
+          : MoveOp(from, to, kind, false)
         { }
         
         void setInCycle() {
@@ -178,7 +178,7 @@ class MoveResolver
   private:
     // Moves that are definitely unblocked (constants to registers). These are
     // emitted last.
-    js::Vector<Move, 16, SystemAllocPolicy> orderedMoves_;
+    js::Vector<MoveOp, 16, SystemAllocPolicy> orderedMoves_;
     bool hasCycles_;
 
     TempObjectPool<PendingMove> movePool_;
@@ -200,13 +200,13 @@ class MoveResolver
     //
     // After calling addMove() for each parallel move, resolve() performs the
     // cycle resolution algorithm. Calling addMove() again resets the resolver.
-    bool addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
+    bool addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
     bool resolve();
 
     size_t numMoves() const {
         return orderedMoves_.length();
     }
-    const Move &getMove(size_t i) const {
+    const MoveOp &getMove(size_t i) const {
         return orderedMoves_[i];
     }
     bool hasCycles() const {
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index ae1984e96efc..c53edb5bf8c8 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -1020,8 +1020,6 @@ CodeGeneratorARM::visitPowHalfD(LPowHalfD *ins)
     return true;
 }
 
-typedef MoveResolver::MoveOperand MoveOperand;
-
 MoveOperand
 CodeGeneratorARM::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/arm/CodeGenerator-arm.h b/js/src/jit/arm/CodeGenerator-arm.h
index a916315a485b..08c90dfd8920 100644
--- a/js/src/jit/arm/CodeGenerator-arm.h
+++ b/js/src/jit/arm/CodeGenerator-arm.h
@@ -43,7 +43,7 @@ class CodeGeneratorARM : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutFrom(Label *label, LSnapshot *snapshot);
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index fe039c5ec771..512aad71c061 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3518,26 +3518,26 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
             if (!from.isFloatReg() || from.floatReg() != fr) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), Move::DOUBLE);
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), MoveOp::DOUBLE);
             }
             // else nothing to do; the value is in the right register already
         } else {
             // If (and only if) the integer registers have started spilling, do we
             // need to take the double register's alignment into account
             uint32_t disp = GetFloatArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::DOUBLE);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::DOUBLE);
         }
         usedFloatSlots_++;
     } else {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
             if (!from.isGeneralReg() || from.reg() != r) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), Move::GENERAL);
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), MoveOp::GENERAL);
             }
             // else nothing to do; the value is in the right register already
         } else {
             uint32_t disp = GetIntArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::GENERAL);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::GENERAL);
         }
         usedIntSlots_++;
     }
@@ -3552,13 +3552,13 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
     uint32_t increment = 1;
     bool useResolver = true;
     ++passedArgs_;
-    Move::Kind kind = Move::GENERAL;
+    MoveOp::Kind kind = MoveOp::GENERAL;
     if (from.isDouble()) {
         // Double arguments need to be rounded up to the nearest doubleword
         // boundary, even if it is in a register!
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
-        kind = Move::DOUBLE;
+        kind = MoveOp::DOUBLE;
     }
 
     Register destReg;
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 9fb423cb43b1..ad0e79f2c58f 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -462,7 +462,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     // Used to work around the move resolver's lack of support for
     // moving into register pairs, which the softfp ABI needs.
-    mozilla::Array<MoveResolver::MoveOperand, 2> floatArgsInGPR;
+    mozilla::Array<MoveOperand, 2> floatArgsInGPR;
     mozilla::Array<bool, 2> floatArgsInGPRValid;
 
     // Compute space needed for the function call and set the properties of the
@@ -485,9 +485,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         setFramePushed(framePushed_ + value);
     }
   public:
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     enum Result {
         GENERAL,
         DOUBLE,
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index 72fabee9a4e1..f5ded1122b99 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -100,7 +100,7 @@ MoveEmitterARM::tempReg()
 }
 
 void
-MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -108,7 +108,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move:
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(toOperand(to, true), temp);
@@ -134,7 +134,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move:
 }
 
 void
-MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -142,7 +142,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(cycleSlot(), temp);
@@ -232,7 +232,7 @@ MoveEmitterARM::emitDoubleMove(const MoveOperand &from, const MoveOperand &to)
 }
 
 void
-MoveEmitterARM::emit(const Move &move)
+MoveEmitterARM::emit(const MoveOp &move)
 {
     const MoveOperand &from = move.from();
     const MoveOperand &to = move.to();
@@ -248,7 +248,7 @@ MoveEmitterARM::emit(const Move &move)
         inCycle_ = true;
     }
 
-    if (move.kind() == Move::DOUBLE)
+    if (move.kind() == MoveOp::DOUBLE)
         emitDoubleMove(from, to);
     else
         emitMove(from, to);
diff --git a/js/src/jit/arm/MoveEmitter-arm.h b/js/src/jit/arm/MoveEmitter-arm.h
index 049dc28fdf13..c1dca9f5f38f 100644
--- a/js/src/jit/arm/MoveEmitter-arm.h
+++ b/js/src/jit/arm/MoveEmitter-arm.h
@@ -17,9 +17,6 @@ class CodeGenerator;
 
 class MoveEmitterARM
 {
-    typedef MoveResolver::Move Move;
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     bool inCycle_;
     MacroAssemblerARMCompat &masm;
 
@@ -49,9 +46,9 @@ class MoveEmitterARM
 
     void emitMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
-    void completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
-    void emit(const Move &move);
+    void breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    void completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    void emit(const MoveOp &move);
 
   public:
     MoveEmitterARM(MacroAssemblerARMCompat &masm);
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 33478fb93f74..6a7291338d3f 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -654,8 +654,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
     VMWrapperMap::AddPtr p = functionWrappers_->lookupForAdd(&f);
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index e7a1fff0ccc7..2a563f422cac 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -1329,8 +1329,6 @@ CodeGeneratorX86Shared::visitUrshD(LUrshD *ins)
     return true;
 }
 
-typedef MoveResolver::MoveOperand MoveOperand;
-
 MoveOperand
 CodeGeneratorX86Shared::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.h b/js/src/jit/shared/CodeGenerator-x86-shared.h
index 8525a41ab8dd..5ec76b33da0a 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.h
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.h
@@ -49,7 +49,7 @@ class CodeGeneratorX86Shared : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutIf(Assembler::DoubleCondition condition, LSnapshot *snapshot);
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 55ce862e0c6d..51ef2b76b73e 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -27,7 +27,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     size_t swapCount = 0;
 
     for (size_t j = i; ; j++) {
-        const Move &move = moves.getMove(j);
+        const MoveOp &move = moves.getMove(j);
 
         // If it isn't a cycle of registers of the same kind, we won't be able
         // to optimize it.
@@ -56,7 +56,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     }
 
     // Check that the last move cycles back to the first move.
-    const Move &move = moves.getMove(i + swapCount);
+    const MoveOp &move = moves.getMove(i + swapCount);
     if (move.from() != moves.getMove(i).to()) {
         *allGeneralRegs = false;
         *allFloatRegs = false;
@@ -99,7 +99,7 @@ void
 MoveEmitterX86::emit(const MoveResolver &moves)
 {
     for (size_t i = 0; i < moves.numMoves(); i++) {
-        const Move &move = moves.getMove(i);
+        const MoveOp &move = moves.getMove(i);
         const MoveOperand &from = move.from();
         const MoveOperand &to = move.to();
 
@@ -128,7 +128,7 @@ MoveEmitterX86::emit(const MoveResolver &moves)
         }
 
         // A normal move which is not part of a cycle.
-        if (move.kind() == Move::DOUBLE)
+        if (move.kind() == MoveOp::DOUBLE)
             emitDoubleMove(from, to);
         else
             emitGeneralMove(from, to);
@@ -204,7 +204,7 @@ MoveEmitterX86::toPopOperand(const MoveOperand &operand) const
 }
 
 void
-MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
+MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -212,7 +212,7 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(toAddress(to), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, cycleSlot());
@@ -225,7 +225,7 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
 }
 
 void
-MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
+MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -233,7 +233,7 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.h b/js/src/jit/shared/MoveEmitter-x86-shared.h
index b7d8fe7446df..01636af4d063 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.h
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.h
@@ -23,9 +23,6 @@ class CodeGenerator;
 
 class MoveEmitterX86
 {
-    typedef MoveResolver::Move Move;
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     bool inCycle_;
     MacroAssemblerSpecific &masm;
 
@@ -48,8 +45,8 @@ class MoveEmitterX86
                                  bool allGeneralRegs, bool allFloatRegs, size_t swapCount);
     void emitGeneralMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &to, Move::Kind kind);
-    void completeCycle(const MoveOperand &to, Move::Kind kind);
+    void breakCycle(const MoveOperand &to, MoveOp::Kind kind);
+    void completeCycle(const MoveOperand &to, MoveOp::Kind kind);
 
   public:
     MoveEmitterX86(MacroAssemblerSpecific &masm);
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index 4586b3f01675..395a90955272 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -149,7 +149,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(double);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, Move::DOUBLE);
+        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::DOUBLE);
     } else {
         Register dest;
         if (GetIntArgReg(passedIntArgs_++, passedFloatArgs_, &dest)) {
@@ -162,7 +162,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(int64_t);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, Move::GENERAL);
+        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::GENERAL);
     }
 }
 
@@ -264,7 +264,7 @@ MacroAssemblerX64::callWithABI(Address fun, Result result)
     if (IsIntArgReg(fun.base)) {
         // Callee register may be clobbered for an argument. Move the callee to
         // r10, a volatile, non-argument register.
-        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), Move::GENERAL);
+        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), MoveOp::GENERAL);
         fun.base = r10;
     }
 
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index fc68f4ad9601..28f4eed9f6f8 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -85,9 +85,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
         FLOAT
     };
 
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     MacroAssemblerX64()
       : inCall_(false),
         enoughMemory_(true)
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index d41d42bea39d..14348720e429 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -503,8 +503,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index ace3e98d36af..c430c2778441 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -169,10 +169,10 @@ MacroAssemblerX86::passABIArg(const MoveOperand &from)
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
     if (from.isDouble()) {
         stackForCall_ += sizeof(double);
-        enoughMemory_ &= moveResolver_.addMove(from, to, Move::DOUBLE);
+        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::DOUBLE);
     } else {
         stackForCall_ += sizeof(int32_t);
-        enoughMemory_ &= moveResolver_.addMove(from, to, Move::GENERAL);
+        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::GENERAL);
     }
 }
 
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index 0d1395a08300..e7ee36481786 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -76,9 +76,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
         FLOAT
     };
 
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     MacroAssemblerX86()
       : inCall_(false),
         enoughMemory_(true)
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index a14d8e2c2dfc..2c6558ccee22 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -538,8 +538,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());

From 3a62ff8315859d72808c9bf379893c936615c4a8 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 096/459] Bug 949668 - SpiderMonkey: MoveOp cleanups. r=jandem

---
 js/src/jit/MoveResolver.h | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index bbe6f1201a32..3ae8a50fd053 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -125,16 +125,10 @@ class MoveOp
   public:
     MoveOp()
     { }
-    MoveOp(const MoveOp &other)
-      : from_(other.from_),
-        to_(other.to_),
-        cycle_(other.cycle_),
-        kind_(other.kind_)
-    { }
-    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind)
       : from_(from),
         to_(to),
-        cycle_(cycle),
+        cycle_(false),
         kind_(kind)
     { }
 
@@ -163,14 +157,13 @@ class MoveResolver
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : MoveOp(from, to, kind, false)
+          : MoveOp(from, to, kind)
         { }
-        
+
         void setInCycle() {
             JS_ASSERT(!inCycle());
             cycle_ = true;
         }
-
     };
 
     typedef InlineList<MoveResolver::PendingMove>::iterator PendingMoveIterator;

From 3a820e1318f9998d11e797fdd20d573ac5571e7c Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 097/459] Bug 949668 - SpiderMonkey: Add an
 LDefinition::Float32 r=jandem

---
 js/src/jit/BacktrackingAllocator.cpp      |  4 +++-
 js/src/jit/LIR.cpp                        |  5 +++--
 js/src/jit/LIR.h                          |  6 ++++--
 js/src/jit/LinearScan.cpp                 |  6 ++++--
 js/src/jit/LiveRangeAllocator.cpp         |  1 +
 js/src/jit/LiveRangeAllocator.h           |  6 +++---
 js/src/jit/Lowering.cpp                   | 26 +++++++++++------------
 js/src/jit/RegisterAllocator.h            |  2 +-
 js/src/jit/StupidAllocator.cpp            |  6 ++++--
 js/src/jit/arm/Lowering-arm.cpp           |  2 +-
 js/src/jit/shared/Lowering-shared-inl.h   | 12 +++++++++--
 js/src/jit/shared/Lowering-shared.h       |  3 ++-
 js/src/jit/shared/Lowering-x86-shared.cpp |  6 +++---
 13 files changed, 52 insertions(+), 33 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 64e46a4edfcc..b06c2f039fdf 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -1128,7 +1128,9 @@ BacktrackingAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL ||
+                             def->type() == LDefinition::FLOAT32 ||
+                             def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index fc672bdb356e..70bf0e01a659 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -197,10 +197,11 @@ static const char * const TypeChars[] =
 {
     "i",            // INTEGER
     "o",            // OBJECT
-    "f",            // DOUBLE
+    "f",            // FLOAT32
+    "d",            // DOUBLE
 #ifdef JS_NUNBOX32
     "t",            // TYPE
-    "d"             // PAYLOAD
+    "p"             // PAYLOAD
 #elif JS_PUNBOX64
     "x"             // BOX
 #endif
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 1f802ba79186..5e020fe01ba5 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -446,7 +446,8 @@ class LDefinition
         GENERAL,    // Generic, integer or pointer-width data (GPR).
         OBJECT,     // Pointer that may be collected as garbage (GPR).
         SLOTS,      // Slots/elements pointer that may be moved by minor GCs (GPR).
-        DOUBLE,     // 64-bit point value (FPU).
+        FLOAT32,    // 32-bit floating-point value (FPU).
+        DOUBLE,     // 64-bit floating-point value (FPU).
 #ifdef JS_NUNBOX32
         // A type virtual register must be followed by a payload virtual
         // register, as both will be tracked as a single gcthing.
@@ -540,8 +541,9 @@ class LDefinition
           case MIRType_Object:
             return LDefinition::OBJECT;
           case MIRType_Double:
-          case MIRType_Float32:
             return LDefinition::DOUBLE;
+          case MIRType_Float32:
+            return LDefinition::FLOAT32;
 #if defined(JS_PUNBOX64)
           case MIRType_Value:
             return LDefinition::BOX;
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index cd22f4d36818..86731c3ece01 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -515,7 +515,9 @@ LinearScanAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL ||
+                             def->type() == LDefinition::FLOAT32 ||
+                             def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
@@ -792,7 +794,7 @@ LinearScanAllocator::allocateSlotFor(const LiveInterval *interval)
     LinearScanVirtualRegister *reg = &vregs[interval->vreg()];
 
     SlotList *freed;
-    if (reg->type() == LDefinition::DOUBLE)
+    if (reg->type() == LDefinition::DOUBLE || reg->type() == LDefinition::FLOAT32)
         freed = &finishedDoubleSlots_;
 #ifdef JS_NUNBOX32
     else if (IsNunbox(reg))
diff --git a/js/src/jit/LiveRangeAllocator.cpp b/js/src/jit/LiveRangeAllocator.cpp
index 361fdb60ebcd..0d457286657e 100644
--- a/js/src/jit/LiveRangeAllocator.cpp
+++ b/js/src/jit/LiveRangeAllocator.cpp
@@ -468,6 +468,7 @@ AddRegisterToSafepoint(LSafepoint *safepoint, AnyRegister reg, const LDefinition
 
     JS_ASSERT(def.type() == LDefinition::GENERAL ||
               def.type() == LDefinition::DOUBLE ||
+              def.type() == LDefinition::FLOAT32 ||
               def.type() == LDefinition::OBJECT);
 
     if (def.type() == LDefinition::OBJECT)
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index a469ebda4aeb..cfff988c4163 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -136,7 +136,7 @@ static inline bool
 DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation alloc)
 {
     if (ins->isPhi()) {
-        if (def->type() == LDefinition::DOUBLE)
+        if (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
             return alloc.isFloatReg() || alloc.kind() == LAllocation::DOUBLE_SLOT;
         return alloc.isGeneralReg() || alloc.kind() == LAllocation::STACK_SLOT;
     }
@@ -145,7 +145,7 @@ DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation
       case LDefinition::DEFAULT:
         if (!alloc.isRegister())
             return false;
-        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE);
+        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32);
       case LDefinition::PRESET:
         return alloc == *def->output();
       case LDefinition::MUST_REUSE_INPUT:
@@ -473,7 +473,7 @@ class VirtualRegister
         return intervals_.insert(found, interval);
     }
     bool isDouble() const {
-        return def_->type() == LDefinition::DOUBLE;
+        return def_->type() == LDefinition::DOUBLE || def_->type() == LDefinition::FLOAT32;
     }
 
     LiveInterval *intervalFor(CodePosition pos);
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 480ca2ae611f..67d8af974949 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -660,7 +660,7 @@ LIRGenerator::visitTest(MTest *test)
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
-        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempFloat(), temp0, temp1);
+        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempDouble(), temp0, temp1);
         if (!useBox(lir, LTestVAndBranch::Input, opd))
             return false;
         return add(lir, test);
@@ -1027,7 +1027,7 @@ LIRGenerator::visitTypeOf(MTypeOf *ins)
 bool
 LIRGenerator::visitToId(MToId *ins)
 {
-    LToIdV *lir = new(alloc()) LToIdV(tempFloat());
+    LToIdV *lir = new(alloc()) LToIdV(tempDouble());
     if (!useBox(lir, LToIdV::Object, ins->lhs()))
         return false;
     if (!useBox(lir, LToIdV::Index, ins->rhs()))
@@ -1176,7 +1176,7 @@ bool
 LIRGenerator::visitRound(MRound *ins)
 {
     JS_ASSERT(ins->num()->type() == MIRType_Double);
-    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempFloat());
+    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempDouble());
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
@@ -1755,7 +1755,7 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::NORMAL);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::NORMAL);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert) && assignSafepoint(lir, convert);
@@ -1800,7 +1800,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::TRUNCATE);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::TRUNCATE);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, truncate) && assignSafepoint(lir, truncate);
@@ -2026,7 +2026,7 @@ LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
 
     LMaybeToDoubleElement *lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
                                                                     useRegisterAtStart(ins->value()),
-                                                                    tempFloat());
+                                                                    tempDouble());
     return defineBox(lir, ins);
 }
 
@@ -2343,7 +2343,7 @@ LIRGenerator::visitNot(MNot *ins)
             temp1 = LDefinition::BogusTemp();
         }
 
-        LNotV *lir = new(alloc()) LNotV(tempFloat(), temp0, temp1);
+        LNotV *lir = new(alloc()) LNotV(tempDouble(), temp0, temp1);
         if (!useBox(lir, LNotV::Input, op))
             return false;
         return define(lir, ins);
@@ -2626,7 +2626,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
 
       case MIRType_Value:
       {
-        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempFloat());
+        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempDouble());
         if (!useBox(lir, LClampVToUint8::Input, in))
             return false;
         return assignSnapshot(lir) && define(lir, ins) && assignSafepoint(lir, ins);
@@ -2913,15 +2913,15 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
         break;
 
       case MIRType_Double:
-        lir = new(alloc()) LAssertRangeD(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeD(useRegister(input), tempDouble());
         break;
 
       case MIRType_Float32:
-        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat32());
         break;
 
       case MIRType_Value:
-        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempFloat(), tempFloat());
+        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempDouble(), tempDouble());
         if (!useBox(lir, LAssertRangeV::Input, input))
             return false;
         break;
@@ -3027,7 +3027,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
         lir = new(alloc()) LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
-                                             temp(), tempFloat());
+                                             temp(), tempDouble());
 
         if (!useBox(lir, LSetElementCacheV::Index, ins->index()))
             return false;
@@ -3036,7 +3036,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     } else {
         lir = new(alloc()) LSetElementCacheT(useByteOpRegister(ins->object()),
                                              useRegisterOrConstant(ins->value()),
-                                             tempToUnbox(), temp(), tempFloat());
+                                             tempToUnbox(), temp(), tempDouble());
 
         if (!useBox(lir, LSetElementCacheT::Index, ins->index()))
             return false;
diff --git a/js/src/jit/RegisterAllocator.h b/js/src/jit/RegisterAllocator.h
index e6059eaef31d..f5f0d2770cfd 100644
--- a/js/src/jit/RegisterAllocator.h
+++ b/js/src/jit/RegisterAllocator.h
@@ -369,7 +369,7 @@ class RegisterAllocator
 static inline AnyRegister
 GetFixedRegister(const LDefinition *def, const LUse *use)
 {
-    return def->type() == LDefinition::DOUBLE
+    return (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
            ? AnyRegister(FloatRegister::FromCode(use->registerCode()))
            : AnyRegister(Register::FromCode(use->registerCode()));
 }
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 921bdf9d08d4..9c350555d9cc 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -28,7 +28,9 @@ StupidAllocator::stackLocation(uint32_t vreg)
     if (def->policy() == LDefinition::PRESET && def->output()->isArgument())
         return def->output();
 
-    return new(alloc()) LStackSlot(DefaultStackSlot(vreg), def->type() == LDefinition::DOUBLE);
+    return new(alloc()) LStackSlot(DefaultStackSlot(vreg),
+                                   def->type() == LDefinition::DOUBLE ||
+                                   def->type() == LDefinition::FLOAT32);
 }
 
 StupidAllocator::RegisterIndex
@@ -162,7 +164,7 @@ StupidAllocator::allocateRegister(LInstruction *ins, uint32_t vreg)
     for (size_t i = 0; i < registerCount; i++) {
         AnyRegister reg = registers[i].reg;
 
-        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE))
+        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32))
             continue;
 
         // Skip the register if it is in use for an allocated input or output.
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index 8f4ca0c78d19..b74971f3e3f6 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -362,7 +362,7 @@ LIRGeneratorARM::newLTableSwitch(const LAllocation &in, const LDefinition &input
 LTableSwitchV *
 LIRGeneratorARM::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempFloat(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempDouble(), tableswitch);
 }
 
 bool
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index 940d346cae9d..fcc6fdc68ca7 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -149,12 +149,14 @@ LIRGeneratorShared::defineReturn(LInstruction *lir, MDefinition *mir)
 #endif
         break;
       case MIRType_Float32:
+        lir->setDef(0, LDefinition(vreg, LDefinition::FLOAT32, LFloatReg(ReturnFloatReg)));
+        break;
       case MIRType_Double:
         lir->setDef(0, LDefinition(vreg, LDefinition::DOUBLE, LFloatReg(ReturnFloatReg)));
         break;
       default:
         LDefinition::Type type = LDefinition::TypeFrom(mir->type());
-        JS_ASSERT(type != LDefinition::DOUBLE);
+        JS_ASSERT(type != LDefinition::DOUBLE && type != LDefinition::FLOAT32);
         lir->setDef(0, LDefinition(vreg, type, LGeneralReg(ReturnReg)));
         break;
     }
@@ -421,7 +423,13 @@ LIRGeneratorShared::tempFixed(Register reg)
 }
 
 LDefinition
-LIRGeneratorShared::tempFloat()
+LIRGeneratorShared::tempFloat32()
+{
+    return temp(LDefinition::FLOAT32);
+}
+
+LDefinition
+LIRGeneratorShared::tempDouble()
 {
     return temp(LDefinition::DOUBLE);
 }
diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
index fdfb74276682..35075335af13 100644
--- a/js/src/jit/shared/Lowering-shared.h
+++ b/js/src/jit/shared/Lowering-shared.h
@@ -104,7 +104,8 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
     // These create temporary register requests.
     inline LDefinition temp(LDefinition::Type type = LDefinition::GENERAL,
                             LDefinition::Policy policy = LDefinition::DEFAULT);
-    inline LDefinition tempFloat();
+    inline LDefinition tempFloat32();
+    inline LDefinition tempDouble();
     inline LDefinition tempCopy(MDefinition *input, uint32_t reusedInput);
 
     // Note that the fixed register has a GENERAL type.
diff --git a/js/src/jit/shared/Lowering-x86-shared.cpp b/js/src/jit/shared/Lowering-x86-shared.cpp
index 8895dba562bc..71d687543dfa 100644
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -27,7 +27,7 @@ LIRGeneratorX86Shared::newLTableSwitch(const LAllocation &in, const LDefinition
 LTableSwitchV *
 LIRGeneratorX86Shared::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempFloat(), temp(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempDouble(), temp(), tableswitch);
 }
 
 bool
@@ -333,7 +333,7 @@ LIRGeneratorX86Shared::lowerTruncateDToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Double);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempDouble();
     return define(new(alloc()) LTruncateDToInt32(useRegister(opd), maybeTemp), ins);
 }
 
@@ -343,6 +343,6 @@ LIRGeneratorX86Shared::lowerTruncateFToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Float32);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat32();
     return define(new(alloc()) LTruncateFToInt32(useRegister(opd), maybeTemp), ins);
 }

From f53aa6bc3248a627ff17589fa4317ec5de1f442b Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 098/459] Bug 949668 - SpiderMonkey: Add a type to LMoveGroup.
 r=jandem

---
 js/src/jit/BacktrackingAllocator.cpp | 15 +++++++-------
 js/src/jit/LIR-Common.h              | 13 +++++++++----
 js/src/jit/LIR.cpp                   | 10 +++++-----
 js/src/jit/LinearScan.cpp            | 29 +++++++++++++++-------------
 js/src/jit/LinearScan.h              |  2 +-
 js/src/jit/LiveRangeAllocator.h      | 20 +++++++++----------
 js/src/jit/StupidAllocator.cpp       | 17 +++++++++-------
 js/src/jit/StupidAllocator.h         |  5 ++++-
 8 files changed, 63 insertions(+), 48 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index b06c2f039fdf..803079fc2879 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -918,10 +918,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                 LiveInterval *prevInterval = reg->intervalFor(start.previous());
                 if (start.subpos() == CodePosition::INPUT) {
-                    if (!moveInput(inputOf(data->ins()), prevInterval, interval))
+                    if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
                         return false;
                 } else {
-                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
+                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
                         return false;
                 }
             }
@@ -941,7 +941,8 @@ BacktrackingAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            VirtualRegister *vreg = &vregs[phi->getDef(0)];
+            LDefinition *def = phi->getDef(0);
+            VirtualRegister *vreg = &vregs[def];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -953,7 +954,7 @@ BacktrackingAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to))
+                if (!moveAtExit(predecessor, from, to, def->type()))
                     return false;
             }
         }
@@ -978,10 +979,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                     if (mSuccessor->numPredecessors() > 1) {
                         JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                        if (!moveAtExit(predecessor, from, to))
+                        if (!moveAtExit(predecessor, from, to, reg.type()))
                             return false;
                     } else {
-                        if (!moveAtEntry(successor, from, to))
+                        if (!moveAtEntry(successor, from, to, reg.type()))
                             return false;
                     }
                 }
@@ -1077,7 +1078,7 @@ BacktrackingAllocator::reifyAllocations()
 
                     if (*res != *alloc) {
                         LMoveGroup *group = getInputMoveGroup(inputOf(ins));
-                        if (!group->addAfter(sourceAlloc, res))
+                        if (!group->addAfter(sourceAlloc, res, def->type()))
                             return false;
                         *alloc = *res;
                     }
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 8f94028624a1..c4d11cee87e2 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -71,11 +71,13 @@ class LMove
 {
     LAllocation *from_;
     LAllocation *to_;
+    LDefinition::Type type_;
 
   public:
-    LMove(LAllocation *from, LAllocation *to)
+    LMove(LAllocation *from, LAllocation *to, LDefinition::Type type)
       : from_(from),
-        to_(to)
+        to_(to),
+        type_(type)
     { }
 
     LAllocation *from() {
@@ -90,6 +92,9 @@ class LMove
     const LAllocation *to() const {
         return to_;
     }
+    LDefinition::Type type() const {
+        return type_;
+    }
 };
 
 class LMoveGroup : public LInstructionHelper<0, 0, 0>
@@ -110,10 +115,10 @@ class LMoveGroup : public LInstructionHelper<0, 0, 0>
     void printOperands(FILE *fp);
 
     // Add a move which takes place simultaneously with all others in the group.
-    bool add(LAllocation *from, LAllocation *to);
+    bool add(LAllocation *from, LAllocation *to, LDefinition::Type type);
 
     // Add a move which takes place after existing moves in the group.
-    bool addAfter(LAllocation *from, LAllocation *to);
+    bool addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type);
 
     size_t numMoves() const {
         return moves_.length();
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 70bf0e01a659..7fef35f37b2f 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -364,18 +364,18 @@ LInstruction::initSafepoint(TempAllocator &alloc)
 }
 
 bool
-LMoveGroup::add(LAllocation *from, LAllocation *to)
+LMoveGroup::add(LAllocation *from, LAllocation *to, LDefinition::Type type)
 {
 #ifdef DEBUG
     JS_ASSERT(*from != *to);
     for (size_t i = 0; i < moves_.length(); i++)
         JS_ASSERT(*to != *moves_[i].to());
 #endif
-    return moves_.append(LMove(from, to));
+    return moves_.append(LMove(from, to, type));
 }
 
 bool
-LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
+LMoveGroup::addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type)
 {
     // Transform the operands to this move so that performing the result
     // simultaneously with existing moves in the group will have the same
@@ -393,12 +393,12 @@ LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
 
     for (size_t i = 0; i < moves_.length(); i++) {
         if (*to == *moves_[i].to()) {
-            moves_[i] = LMove(from, to);
+            moves_[i] = LMove(from, to, type);
             return true;
         }
     }
 
-    return add(from, to);
+    return add(from, to, type);
 }
 
 void
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index 86731c3ece01..6a46531ab37b 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -233,7 +233,8 @@ LinearScanAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            LinearScanVirtualRegister *vreg = &vregs[phi->getDef(0)];
+            LDefinition *def = phi->getDef(0);
+            LinearScanVirtualRegister *vreg = &vregs[def];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -245,14 +246,15 @@ LinearScanAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to))
+                if (!moveAtExit(predecessor, from, to, def->type()))
                     return false;
             }
 
             if (vreg->mustSpillAtDefinition() && !to->isSpill()) {
                 // Make sure this phi is spilled at the loop header.
                 LMoveGroup *moves = successor->getEntryMoveGroup(alloc());
-                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill()))
+                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill(),
+                                def->type()))
                     return false;
             }
         }
@@ -283,10 +285,10 @@ LinearScanAllocator::resolveControlFlow()
 
                 if (mSuccessor->numPredecessors() > 1) {
                     JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                    if (!moveAtExit(predecessor, from, to))
+                    if (!moveAtExit(predecessor, from, to, vreg->type()))
                         return false;
                 } else {
-                    if (!moveAtEntry(successor, from, to))
+                    if (!moveAtEntry(successor, from, to, vreg->type()))
                         return false;
                 }
             }
@@ -297,12 +299,13 @@ LinearScanAllocator::resolveControlFlow()
 }
 
 bool
-LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to)
+LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to,
+                                    LDefinition::Type type)
 {
     if (*from == *to)
         return true;
     LMoveGroup *moves = getInputMoveGroup(pos);
-    return moves->add(from, to);
+    return moves->add(from, to, type);
 }
 
 static inline void
@@ -350,7 +353,7 @@ LinearScanAllocator::reifyAllocations()
                 LiveInterval *to = fixedIntervals[GetFixedRegister(reg->def(), usePos->use).code()];
 
                 *static_cast<LAllocation *>(usePos->use) = *to->getAllocation();
-                if (!moveInput(usePos->pos, interval, to))
+                if (!moveInput(usePos->pos, interval, to, reg->type()))
                     return false;
             } else {
                 JS_ASSERT(UseCompatibleWith(usePos->use, *interval->getAllocation()));
@@ -376,7 +379,7 @@ LinearScanAllocator::reifyAllocations()
                 // it should use the fixed register instead.
                 SetOsiPointUses(interval, defEnd, LAllocation(fixedReg));
 
-                if (!moveAfter(defEnd, from, interval))
+                if (!moveAfter(defEnd, from, interval, def->type()))
                     return false;
                 spillFrom = from->getAllocation();
             } else {
@@ -387,7 +390,7 @@ LinearScanAllocator::reifyAllocations()
                     JS_ASSERT(!inputAlloc->isUse());
 
                     *inputAlloc = *interval->getAllocation();
-                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc))
+                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc, def->type()))
                         return false;
                 }
 
@@ -417,7 +420,7 @@ LinearScanAllocator::reifyAllocations()
                 // or Nop instructions). Note that we explicitly ignore phis,
                 // which should have been handled in resolveControlFlow().
                 LMoveGroup *moves = getMoveGroupAfter(defEnd);
-                if (!moves->add(spillFrom, reg->canonicalSpill()))
+                if (!moves->add(spillFrom, reg->canonicalSpill(), def->type()))
                     return false;
             }
         }
@@ -443,10 +446,10 @@ LinearScanAllocator::reifyAllocations()
             JS_ASSERT(start == inputOf(data->ins()) || start == outputOf(data->ins()));
 
             if (start.subpos() == CodePosition::INPUT) {
-                if (!moveInput(inputOf(data->ins()), prevInterval, interval))
+                if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
                     return false;
             } else {
-                if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
+                if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
                     return false;
             }
 
diff --git a/js/src/jit/LinearScan.h b/js/src/jit/LinearScan.h
index 64ce47d9191a..cf194b9e20b9 100644
--- a/js/src/jit/LinearScan.h
+++ b/js/src/jit/LinearScan.h
@@ -111,7 +111,7 @@ class LinearScanAllocator
     AnyRegister::Code findBestFreeRegister(CodePosition *freeUntil);
     AnyRegister::Code findBestBlockedRegister(CodePosition *nextUsed);
     bool canCoexist(LiveInterval *a, LiveInterval *b);
-    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to);
+    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to, LDefinition::Type type);
     void setIntervalRequirement(LiveInterval *interval);
     bool isSpilledAt(LiveInterval *interval, CodePosition pos);
 
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index cfff988c4163..993f1c495451 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -633,37 +633,37 @@ class LiveRangeAllocator : protected RegisterAllocator
     }
 #endif
 
-    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to) {
+    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         JS_ASSERT(*from->getAllocation() != *to->getAllocation());
-        return moves->add(from->getAllocation(), to->getAllocation());
+        return moves->add(from->getAllocation(), to->getAllocation(), type);
     }
 
-    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to) {
+    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getInputMoveGroup(pos);
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to) {
+    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getMoveGroupAfter(pos);
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to) {
+    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getExitMoveGroup(alloc());
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to) {
+    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getEntryMoveGroup(alloc());
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
     size_t findFirstNonCallSafepoint(CodePosition from) const
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 9c350555d9cc..8f9751faba72 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -143,7 +143,7 @@ StupidAllocator::ensureHasRegister(LInstruction *ins, uint32_t vreg)
     }
 
     RegisterIndex best = allocateRegister(ins, vreg);
-    loadRegister(ins, vreg, best);
+    loadRegister(ins, vreg, best, virtualRegisters[vreg]->type());
 
     return registers[best].reg;
 }
@@ -192,7 +192,7 @@ StupidAllocator::syncRegister(LInstruction *ins, RegisterIndex index)
 
         uint32_t existing = registers[index].vreg;
         LAllocation *dest = stackLocation(existing);
-        input->addAfter(source, dest);
+        input->addAfter(source, dest, registers[index].type);
 
         registers[index].dirty = false;
     }
@@ -206,14 +206,15 @@ StupidAllocator::evictRegister(LInstruction *ins, RegisterIndex index)
 }
 
 void
-StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index)
+StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type)
 {
     // Load a vreg from its stack location to a register.
     LMoveGroup *input = getInputMoveGroup(ins->id());
     LAllocation *source = stackLocation(vreg);
     LAllocation *dest = new(alloc()) LAllocation(registers[index].reg);
-    input->addAfter(source, dest);
+    input->addAfter(source, dest, type);
     registers[index].set(vreg, ins);
+    registers[index].type = type;
 }
 
 StupidAllocator::RegisterIndex
@@ -312,7 +313,7 @@ StupidAllocator::syncForBlockEnd(LBlock *block, LInstruction *ins)
                 }
             }
 
-            group->add(source, dest);
+            group->add(source, dest, phi->getDef(0)->type());
         }
     }
 }
@@ -336,14 +337,14 @@ StupidAllocator::allocateForInstruction(LInstruction *ins)
             AnyRegister reg = ensureHasRegister(ins, vreg);
             alloc.replace(LAllocation(reg));
         } else if (use->policy() == LUse::FIXED) {
-            AnyRegister reg = GetFixedRegister(virtualRegisters[use->virtualRegister()], use);
+            AnyRegister reg = GetFixedRegister(virtualRegisters[vreg], use);
             RegisterIndex index = registerIndex(reg);
             if (registers[index].vreg != vreg) {
                 evictRegister(ins, index);
                 RegisterIndex existing = findExistingRegister(vreg);
                 if (existing != UINT32_MAX)
                     evictRegister(ins, existing);
-                loadRegister(ins, vreg, index);
+                loadRegister(ins, vreg, index, virtualRegisters[vreg]->type());
             }
             alloc.replace(LAllocation(reg));
         } else {
@@ -409,6 +410,7 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
                           : ins->getOperand(def->getReusedInput())->toRegister());
         evictRegister(ins, index);
         registers[index].set(vreg, ins, true);
+        registers[index].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[index].reg));
     } else if (def->policy() == LDefinition::PRESET) {
         // The result must be a stack location.
@@ -417,6 +419,7 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
         // Find a register to hold the result of the instruction.
         RegisterIndex best = allocateRegister(ins, vreg);
         registers[best].set(vreg, ins, true);
+        registers[best].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[best].reg));
     }
 }
diff --git a/js/src/jit/StupidAllocator.h b/js/src/jit/StupidAllocator.h
index f48befa0ff8b..e7891b65a264 100644
--- a/js/src/jit/StupidAllocator.h
+++ b/js/src/jit/StupidAllocator.h
@@ -22,6 +22,9 @@ class StupidAllocator : public RegisterAllocator
     struct AllocatedRegister {
         AnyRegister reg;
 
+        // The type of the value in the register.
+        LDefinition::Type type;
+
         // Virtual register this physical reg backs, or MISSING_ALLOCATION.
         uint32_t vreg;
 
@@ -72,7 +75,7 @@ class StupidAllocator : public RegisterAllocator
 
     void syncRegister(LInstruction *ins, RegisterIndex index);
     void evictRegister(LInstruction *ins, RegisterIndex index);
-    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index);
+    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type);
 
     RegisterIndex findExistingRegister(uint32_t vreg);
 

From 9f39fe797e36149148e8c7313cb589d18a3806b1 Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Fri, 13 Dec 2013 16:33:13 -0500
Subject: [PATCH 099/459] Backout fa2130fc4f08 (bug 863872) due to xpcshell
 orange. r=bustage-fix for CLOSED TREE.

---
 .../components/telemetry/TelemetryFile.jsm    |  75 +----
 toolkit/components/telemetry/TelemetryPing.js |  26 +-
 .../tests/unit/test_TelemetryPing.js          |   4 +-
 .../tests/unit/test_TelemetrySendOldPings.js  | 265 ------------------
 .../telemetry/tests/unit/xpcshell.ini         |   2 -
 5 files changed, 19 insertions(+), 353 deletions(-)
 delete mode 100644 toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js

diff --git a/toolkit/components/telemetry/TelemetryFile.jsm b/toolkit/components/telemetry/TelemetryFile.jsm
index 8db9eb815b58..7a21d5c2fd4e 100644
--- a/toolkit/components/telemetry/TelemetryFile.jsm
+++ b/toolkit/components/telemetry/TelemetryFile.jsm
@@ -22,13 +22,8 @@ const PR_EXCL = 0x80;
 const RW_OWNER = parseInt("0600", 8);
 const RWX_OWNER = parseInt("0700", 8);
 
-// Files that have been lying around for longer than MAX_PING_FILE_AGE are
-// deleted without being loaded.
-const MAX_PING_FILE_AGE = 14 * 24 * 60 * 60 * 1000; // 2 weeks
-
-// Files that are older than OVERDUE_PING_FILE_AGE, but younger than
-// MAX_PING_FILE_AGE indicate that we need to send all of our pings ASAP.
-const OVERDUE_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
+// Delete ping files that have been lying around for longer than this.
+const MAX_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
 
 // The number of outstanding saved pings that we have issued loading
 // requests for.
@@ -37,14 +32,6 @@ let pingsLoaded = 0;
 // The number of those requests that have actually completed.
 let pingLoadsCompleted = 0;
 
-// The number of pings that we have destroyed due to being older
-// than MAX_PING_FILE_AGE.
-let pingsDiscarded = 0;
-
-// The number of pings that are older than OVERDUE_PING_FILE_AGE
-// but younger than MAX_PING_FILE_AGE.
-let pingsOverdue = 0;
-
 // If |true|, send notifications "telemetry-test-save-complete"
 // and "telemetry-test-load-complete" once save/load is complete.
 let shouldNotifyUponSave = false;
@@ -54,14 +41,6 @@ let pendingPings = [];
 
 this.TelemetryFile = {
 
-  get MAX_PING_FILE_AGE() {
-    return MAX_PING_FILE_AGE;
-  },
-
-  get OVERDUE_PING_FILE_AGE() {
-    return OVERDUE_PING_FILE_AGE;
-  },
-
   /**
    * Save a single ping to a file.
    *
@@ -163,7 +142,7 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadSavedPings: function(sync, onLoad = null, onDone = null) {
+  loadSavedPings: function(sync, onLoad = null) {
     let directory = ensurePingDirectory();
     let entries = directory.directoryEntries
                            .QueryInterface(Ci.nsIDirectoryEnumerator);
@@ -171,7 +150,7 @@ this.TelemetryFile = {
     pingLoadsCompleted = 0;
     try {
       while (entries.hasMoreElements()) {
-        this.loadHistograms(entries.nextFile, sync, onLoad, onDone);
+        this.loadHistograms(entries.nextFile, sync, onLoad);
       }
     } finally {
       entries.close();
@@ -190,26 +169,20 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadHistograms: function loadHistograms(file, sync, onLoad = null, onDone = null) {
-    let now = Date.now();
+  loadHistograms: function loadHistograms(file, sync, onLoad = null) {
+    let now = new Date();
     if (now - file.lastModifiedTime > MAX_PING_FILE_AGE) {
       // We haven't had much luck in sending this file; delete it.
       file.remove(true);
-      pingsDiscarded++;
       return;
     }
 
-    // This file is a bit stale, and overdue for sending.
-    if (now - file.lastModifiedTime > OVERDUE_PING_FILE_AGE) {
-      pingsOverdue++;
-    }
-
     pingsLoaded++;
     if (sync) {
       let stream = Cc["@mozilla.org/network/file-input-stream;1"]
                    .createInstance(Ci.nsIFileInputStream);
       stream.init(file, -1, -1, 0);
-      addToPendingPings(file, stream, onLoad, onDone);
+      addToPendingPings(file, stream, onLoad);
     } else {
       let channel = NetUtil.newChannel(file);
       channel.contentType = "application/json";
@@ -218,7 +191,7 @@ this.TelemetryFile = {
         if (!Components.isSuccessCode(result)) {
           return;
         }
-        addToPendingPings(file, stream, onLoad, onDone);
+        addToPendingPings(file, stream, onLoad);
       }).bind(this));
     }
   },
@@ -230,22 +203,6 @@ this.TelemetryFile = {
     return pingsLoaded;
   },
 
-  /**
-   * The number of pings loaded that are older than OVERDUE_PING_FILE_AGE
-   * but younger than MAX_PING_FILE_AGE.
-   */
-  get pingsOverdue() {
-    return pingsOverdue;
-  },
-
-  /**
-   * The number of pings that we just tossed out for being older than
-   * MAX_PING_FILE_AGE.
-   */
-  get pingsDiscarded() {
-    return pingsDiscarded;
-  },
-
   /**
    * Iterate destructively through the pending pings.
    *
@@ -292,7 +249,7 @@ function ensurePingDirectory() {
   return directory;
 };
 
-function addToPendingPings(file, stream, onLoad, onDone) {
+function addToPendingPings(file, stream, onLoad) {
   let success = false;
 
   try {
@@ -306,25 +263,19 @@ function addToPendingPings(file, stream, onLoad, onDone) {
     }
     pingLoadsCompleted++;
     pendingPings.push(ping);
+    if (shouldNotifyUponSave &&
+        pingLoadsCompleted == pingsLoaded) {
+      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
+    }
     success = true;
   } catch (e) {
     // An error reading the file, or an error parsing the contents.
     stream.close();           // close is idempotent.
     file.remove(true); // FIXME: Should be false, isn't it?
   }
-
   if (onLoad) {
     onLoad(success);
   }
-
-  if (pingLoadsCompleted == pingsLoaded) {
-    if (onDone) {
-      onDone();
-    }
-    if (shouldNotifyUponSave) {
-      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
-    }
-  }
 };
 
 function finishTelemetrySave(ok, stream) {
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index ed7cc2f26f01..b96bbde06be2 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -39,8 +39,6 @@ const PREF_PREVIOUS_BUILDID = PREF_BRANCH + "previousBuildID";
 const TELEMETRY_INTERVAL = 60000;
 // Delay before intializing telemetry (ms)
 const TELEMETRY_DELAY = 60000;
-// Delay before initializing telemetry if we're testing (ms)
-const TELEMETRY_TEST_DELAY = 100;
 
 // Seconds of idle time before pinging.
 // On idle-daily a gather-telemetry notification is fired, during it probes can
@@ -220,9 +218,6 @@ TelemetryPing.prototype = {
       ret.savedPings = TelemetryFile.pingsLoaded;
     }
 
-    ret.pingsOverdue = TelemetryFile.pingsOverdue;
-    ret.pingsDiscarded = TelemetryFile.pingsDiscarded;
-
     return ret;
   },
 
@@ -604,9 +599,7 @@ TelemetryPing.prototype = {
 
   popPayloads: function popPayloads(reason) {
     function payloadIter() {
-      if (reason != "overdue-flush") {
-        yield this.getSessionPayloadAndSlug(reason);
-      }
+      yield this.getSessionPayloadAndSlug(reason);
       let iterator = TelemetryFile.popPendingPings(reason);
       for (let data of iterator) {
         yield data;
@@ -768,7 +761,7 @@ TelemetryPing.prototype = {
   /**
    * Initializes telemetry within a timer. If there is no PREF_SERVER set, don't turn on telemetry.
    */
-  setup: function setup(aTesting) {
+  setup: function setup() {
     // Initialize some probes that are kept in their own modules
     this._thirdPartyCookies = new ThirdPartyCookieProbe();
     this._thirdPartyCookies.init();
@@ -831,17 +824,7 @@ TelemetryPing.prototype = {
         {
           let success_histogram = Telemetry.getHistogramById("READ_SAVED_PING_SUCCESS");
           success_histogram.add(success);
-        }), () =>
-        {
-          // If we have any TelemetryPings lying around, we'll be aggressive
-          // and try to send them all off ASAP.
-          if (TelemetryFile.pingsOverdue > 0) {
-            // It doesn't really matter what we pass to this.send as a reason,
-            // since it's never sent to the server. All that this.send does with
-            // the reason is check to make sure it's not a test-ping.
-            this.send("overdue-flush", this._server);
-          }
-        });
+        }));
       this.attachObservers();
       this.gatherMemory();
 
@@ -849,8 +832,7 @@ TelemetryPing.prototype = {
       });
       delete this._timer;
     }
-    this._timer.initWithCallback(timerCallback.bind(this),
-                                 aTesting ? TELEMETRY_TEST_DELAY : TELEMETRY_DELAY,
+    this._timer.initWithCallback(timerCallback.bind(this), TELEMETRY_DELAY,
                                  Ci.nsITimer.TYPE_ONE_SHOT);
   },
 
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
index 06d9292719cd..c859b779c947 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
@@ -142,7 +142,7 @@ function decodeRequestPayload(request) {
     let observer = {
       buffer: "",
       onStreamComplete: function(loader, context, status, length, result) {
-        this.buffer = String.fromCharCode.apply(this, result);
+	this.buffer = String.fromCharCode.apply(this, result);
       }
     };
 
@@ -363,7 +363,7 @@ function runOldPingFileTest() {
   do_check_true(histogramsFile.exists());
 
   let mtime = histogramsFile.lastModifiedTime;
-  histogramsFile.lastModifiedTime = mtime - 14 * 24 * 60 * 60 * 1000; // 14 days.
+  histogramsFile.lastModifiedTime = mtime - 8 * 24 * 60 * 60 * 1000; // 8 days.
   TelemetryPing.testLoadHistograms(histogramsFile, true);
   do_check_false(histogramsFile.exists());
 }
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js b/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
deleted file mode 100644
index 0ba9707d8f53..000000000000
--- a/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
+++ /dev/null
@@ -1,265 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
-   http://creativecommons.org/publicdomain/zero/1.0/
-
-/**
- * This test case populates the profile with some fake stored
- * pings, and checks that:
- *
- * 1) Pings that are considered "expired" are deleted and never sent.
- * 2) Pings that are considered "overdue" trigger a send of all
- *    overdue and recent pings.
- */
-
-Components.utils.import("resource://gre/modules/Services.jsm");
-
-// Get the TelemetryPing definitions directly so we can test it without going through xpcom.
-// That gives us Cc, Ci, Cr and Cu, as well as a number of consts like PREF_ENABLED,
-// and PREF_SERVER.
-Services.scriptloader.loadSubScript("resource://gre/components/TelemetryPing.js");
-
-Cu.import("resource://testing-common/httpd.js");
-Cu.import("resource://gre/modules/Promise.jsm");
-Cu.import("resource://gre/modules/TelemetryFile.jsm");
-
-// We increment TelemetryFile's MAX_PING_FILE_AGE and
-// OVERDUE_PING_FILE_AGE by 1ms so that our test pings exceed
-// those points in time.
-const EXPIRED_PING_FILE_AGE = TelemetryFile.MAX_PING_FILE_AGE + 1;
-const OVERDUE_PING_FILE_AGE = TelemetryFile.OVERDUE_PING_FILE_AGE + 1;
-
-const PING_SAVE_FOLDER = "saved-telemetry-pings";
-const PING_TIMEOUT_LENGTH = 1500;
-const EXPIRED_PINGS = 5;
-const OVERDUE_PINGS = 6;
-const RECENT_PINGS = 4;
-
-const TOTAL_EXPECTED_PINGS = OVERDUE_PINGS + RECENT_PINGS;
-
-let gHttpServer = new HttpServer();
-let gCreatedPings = 0;
-let gSeenPings = 0;
-
-/**
- * Creates some TelemetryPings for the current session and
- * saves them to disk. Each ping gets a unique ID slug based on
- * an incrementor.
- *
- * @param aNum the number of pings to create.
- * @param aAge the age in milliseconds to offset from now. A value
- *             of 10 would make the ping 10ms older than now, for
- *             example.
- * @returns an Array with the created pings.
- */
-function createSavedPings(aNum, aAge) {
-  // Create a TelemetryPing service that we can generate payloads from.
-  // Luckily, the TelemetryPing constructor does nothing that we need to
-  // clean up.
-  let pingService = new TelemetryPing();
-  let pings = [];
-  let age = Date.now() - aAge;
-  for (let i = 0; i < aNum; ++i) {
-    let payload = pingService.getPayload();
-    let ping = { slug: "test-ping-" + gCreatedPings, reason: "test", payload: payload };
-    TelemetryFile.savePing(ping);
-    if (aAge) {
-      // savePing writes to the file synchronously, so we're good to
-      // modify the lastModifedTime now.
-      let file = getSaveFileForPing(ping);
-      file.lastModifiedTime = age;
-    }
-    gCreatedPings++;
-    pings.push(ping);
-  }
-  return pings;
-}
-
-/**
- * Deletes locally saved pings in aPings if they
- * exist.
- *
- * @param aPings an Array of pings to delete.
- */
-function clearPings(aPings) {
-  for (let ping of aPings) {
-    let file = getSaveFileForPing(ping);
-    if (file.exists()) {
-      file.remove(false);
-    }
-  }
-}
-
-/**
- * Returns a handle for the file that aPing should be
- * stored in locally.
- *
- * @returns nsILocalFile
- */
-function getSaveFileForPing(aPing) {
-  let file = Services.dirsvc.get("ProfD", Ci.nsILocalFile).clone();
-  file.append(PING_SAVE_FOLDER);
-  file.append(aPing.slug);
-  return file;
-}
-
-/**
- * Wait for PING_TIMEOUT_LENGTH ms, and make sure we didn't receive
- * TelemetryPings in that time.
- *
- * @returns Promise
- */
-function assertReceivedNoPings() {
-  let deferred = Promise.defer();
-
-  do_timeout(PING_TIMEOUT_LENGTH, function() {
-    if (gSeenPings > 0) {
-      deferred.reject();
-    } else {
-      deferred.resolve();
-    }
-  });
-
-  return deferred.promise;
-}
-
-/**
- * Returns a Promise that rejects if the number of TelemetryPings
- * received by the HttpServer is not equal to aExpectedNum.
- *
- * @param aExpectedNum the number of pings we expect to receive.
- * @returns Promise
- */
-function assertReceivedPings(aExpectedNum) {
-  let deferred = Promise.defer();
-
-  do_timeout(PING_TIMEOUT_LENGTH, function() {
-    if (gSeenPings == aExpectedNum) {
-      deferred.resolve();
-    } else {
-      deferred.reject("Saw " + gSeenPings + " TelemetryPings, " +
-                      "but expected " + aExpectedNum);
-    }
-  })
-
-  return deferred.promise;
-}
-
-/**
- * Throws if any pings in aPings is saved locally.
- *
- * @param aPings an Array of pings to check.
- */
-function assertNotSaved(aPings) {
-  let saved = 0;
-  for (let ping of aPings) {
-    let file = getSaveFileForPing(ping);
-    if (file.exists()) {
-      saved++;
-    }
-  }
-  if (saved > 0) {
-    do_throw("Found " + saved + " unexpected saved pings.");
-  }
-}
-
-/**
- * Our handler function for the HttpServer that simply
- * increments the gSeenPings global when it successfully
- * receives and decodes a TelemetryPing payload.
- *
- * @param aRequest the HTTP request sent from HttpServer.
- */
-function pingHandler(aRequest) {
-  gSeenPings++;
-}
-
-/**
- * Returns a Promise that resolves when gHttpServer has been
- * successfully shut down.
- *
- * @returns Promise
- */
-function stopHttpServer() {
-  let deferred = Promise.defer();
-  gHttpServer.stop(function() {
-    deferred.resolve();
-  })
-  return deferred.promise;
-}
-
-/**
- * Teardown a TelemetryPing instance and clear out any pending
- * pings to put as back in the starting state.
- */
-function resetTelemetry(aPingService) {
-  aPingService.uninstall();
-  // Quick and dirty way to clear TelemetryFile's pendingPings
-  // collection, and put it back in its initial state.
-  let gen = TelemetryFile.popPendingPings();
-  for (let item of gen) {};
-}
-
-/**
- * Creates and returns a TelemetryPing instance in "testing"
- * mode.
- */
-function startTelemetry() {
-  let service = new TelemetryPing();
-  service.setup(true);
-  return service;
-}
-
-function run_test() {
-  gHttpServer.registerPrefixHandler("/submit/telemetry/", pingHandler);
-  gHttpServer.start(-1);
-  do_get_profile();
-  Services.prefs.setBoolPref(PREF_ENABLED, true);
-  Services.prefs.setCharPref(PREF_SERVER,
-                             "http://localhost:" + gHttpServer.identity.primaryPort);
-  run_next_test();
-}
-
-/**
- * Test that pings that are considered too old are just chucked out
- * immediately and never sent.
- */
-add_task(function test_expired_pings_are_deleted() {
-  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
-  let pingService = startTelemetry();
-  yield assertReceivedNoPings();
-  assertNotSaved(expiredPings);
-  resetTelemetry(pingService);
-})
-
-/**
- * Test that really recent pings are not sent on Telemetry initialization.
- */
-add_task(function test_recent_pings_not_sent() {
-  let recentPings = createSavedPings(RECENT_PINGS);
-  let pingService = startTelemetry();
-  yield assertReceivedNoPings();
-  resetTelemetry(pingService);
-  clearPings(recentPings);
-});
-
-/**
- * Create some recent, expired and overdue pings. The overdue pings should
- * trigger a send of all recent and overdue pings, but the expired pings
- * should just be deleted.
- */
-add_task(function test_overdue_pings_trigger_send() {
-  let recentPings = createSavedPings(RECENT_PINGS);
-  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
-  let overduePings = createSavedPings(OVERDUE_PINGS, OVERDUE_PING_FILE_AGE);
-
-  let pingService = startTelemetry();
-  yield assertReceivedPings(TOTAL_EXPECTED_PINGS);
-
-  assertNotSaved(recentPings);
-  assertNotSaved(expiredPings);
-  assertNotSaved(overduePings);
-  resetTelemetry(pingService);
-})
-
-add_task(function teardown() {
-  yield stopHttpServer();
-});
diff --git a/toolkit/components/telemetry/tests/unit/xpcshell.ini b/toolkit/components/telemetry/tests/unit/xpcshell.ini
index 5a0d1b138cd3..339219fedcdc 100644
--- a/toolkit/components/telemetry/tests/unit/xpcshell.ini
+++ b/toolkit/components/telemetry/tests/unit/xpcshell.ini
@@ -12,5 +12,3 @@ tail =
 [test_TelemetryStopwatch.js]
 [test_TelemetryPingBuildID.js]
 [test_ThirdPartyCookieProbe.js]
-[test_TelemetrySendOldPings.js]
-skip-if = debug == true

From 2e8aaf7ed5be77d4ed2f01e92d59b857f79093db Mon Sep 17 00:00:00 2001
From: Monica Chew <mmc@mozilla.com>
Date: Thu, 12 Dec 2013 11:20:11 -0800
Subject: [PATCH 100/459] Bug 837202: Add telemetry for application reputation
 check (r=paolo,yoric)

---
 .../downloads/ApplicationReputation.cpp       | 53 ++++++++++++++++++-
 toolkit/components/telemetry/Histograms.json  | 18 +++++++
 2 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/downloads/ApplicationReputation.cpp b/toolkit/components/downloads/ApplicationReputation.cpp
index d8fc7c633f29..b8c7bd7864dd 100644
--- a/toolkit/components/downloads/ApplicationReputation.cpp
+++ b/toolkit/components/downloads/ApplicationReputation.cpp
@@ -21,6 +21,7 @@
 
 #include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
+#include "mozilla/Telemetry.h"
 
 #include "nsCOMPtr.h"
 #include "nsDebug.h"
@@ -33,6 +34,7 @@
 #include "nsXPCOMStrings.h"
 
 using mozilla::Preferences;
+using mozilla::Telemetry::Accumulate;
 
 // Preferences that we need to initialize the query. We may need another
 // preference than browser.safebrowsing.malware.enabled, or simply use
@@ -61,6 +63,27 @@ public:
   ~PendingLookup();
 
 private:
+  /**
+   * Telemetry states.
+   */
+  /**
+   * The download appeared on the allowlist, blocklist, or no list (and thus
+   * could trigger a remote query).
+   */
+  enum LIST_TYPES {
+    ALLOW_LIST = 0,
+    BLOCK_LIST = 1,
+    NO_LIST = 2,
+  };
+  /**
+   * Status of the remote response (valid or not).
+   */
+  enum SERVER_RESPONSE_TYPES {
+    SERVER_RESPONSE_VALID = 0,
+    SERVER_RESPONSE_FAILED = 1,
+    SERVER_RESPONSE_INVALID = 2,
+  };
+
   nsCOMPtr<nsIApplicationReputationQuery> mQuery;
   nsCOMPtr<nsIApplicationReputationCallback> mCallback;
   /**
@@ -105,6 +128,8 @@ PendingLookup::~PendingLookup() {
 
 nsresult
 PendingLookup::OnComplete(bool shouldBlock, nsresult rv) {
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SHOULD_BLOCK,
+    shouldBlock);
   nsresult res = mCallback->OnComplete(shouldBlock, rv);
   return res;
 }
@@ -119,15 +144,18 @@ PendingLookup::HandleEvent(const nsACString& tables) {
   nsCString allow_list;
   Preferences::GetCString(PREF_DOWNLOAD_ALLOW_TABLE, &allow_list);
   if (FindInReadable(tables, allow_list)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, ALLOW_LIST);
     return OnComplete(false, NS_OK);
   }
 
   nsCString block_list;
   Preferences::GetCString(PREF_DOWNLOAD_BLOCK_TABLE, &block_list);
   if (FindInReadable(tables, block_list)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, BLOCK_LIST);
     return OnComplete(true, NS_OK);
   }
 
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_LOCAL, NO_LIST);
 #if 0
   nsresult rv = SendRemoteQuery();
   if (NS_FAILED(rv)) {
@@ -268,16 +296,32 @@ PendingLookup::OnStopRequestInternal(nsIRequest *aRequest,
                                      nsISupports *aContext,
                                      nsresult aResult,
                                      bool* aShouldBlock) {
+  if (NS_FAILED(aResult)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
+    return aResult;
+  }
+
   *aShouldBlock = false;
   nsresult rv;
   nsCOMPtr<nsIHttpChannel> channel = do_QueryInterface(aRequest, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_FAILED(rv)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
+    return rv;
+  }
 
   uint32_t status = 0;
   rv = channel->GetResponseStatus(&status);
-  NS_ENSURE_SUCCESS(rv, rv);
+  if (NS_FAILED(rv)) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
+    return rv;
+  }
 
   if (status != 200) {
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+      SERVER_RESPONSE_FAILED);
     return NS_ERROR_NOT_AVAILABLE;
   }
 
@@ -285,11 +329,15 @@ PendingLookup::OnStopRequestInternal(nsIRequest *aRequest,
   safe_browsing::ClientDownloadResponse response;
   if (!response.ParseFromString(buf)) {
     NS_WARNING("Could not parse protocol buffer");
+    Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+                                   SERVER_RESPONSE_INVALID);
     return NS_ERROR_CANNOT_CONVERT_DATA;
   }
 
   // There are several more verdicts, but we only respect one for now and treat
   // everything else as SAFE.
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_SERVER,
+    SERVER_RESPONSE_VALID);
   if (response.verdict() == safe_browsing::ClientDownloadResponse::DANGEROUS) {
     *aShouldBlock = true;
   }
@@ -335,6 +383,7 @@ ApplicationReputationService::QueryReputation(
   NS_ENSURE_ARG_POINTER(aQuery);
   NS_ENSURE_ARG_POINTER(aCallback);
 
+  Accumulate(mozilla::Telemetry::APPLICATION_REPUTATION_COUNT, true);
   nsresult rv = QueryReputationInternal(aQuery, aCallback);
   if (NS_FAILED(rv)) {
     aCallback->OnComplete(false, rv);
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index a8e5707d4a06..6a2cab5804b6 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -23,6 +23,24 @@
     "extended_statistics_ok": true,
     "description": "time spent updating accessibility (ms)"
   },
+  "APPLICATION_REPUTATION_SHOULD_BLOCK": {
+    "kind": "boolean",
+    "description": "Application reputation verdict (shouldBlock=false is OK)"
+  },
+  "APPLICATION_REPUTATION_LOCAL": {
+    "kind": "enumerated",
+    "n_values": 3,
+    "description": "Application reputation local results (0=ALLOW, 1=BLOCK, 2=NONE)"
+  },
+  "APPLICATION_REPUTATION_SERVER": {
+    "kind": "enumerated",
+    "n_values": 3,
+    "description": "Application reputation remote status (0 = OK, 1 = FAIL, 2 = INVALID)"
+  },
+  "APPLICATION_REPUTATION_COUNT": {
+    "kind": "flag",
+    "description": "Application reputation query count (both local and remote)"
+  },
   "BACKGROUNDFILESAVER_THREAD_COUNT": {
     "kind": "enumerated",
     "n_values": 21,

From f88abf8fd3685219f933ab32861b80d0246300f3 Mon Sep 17 00:00:00 2001
From: Stephen Pohl <spohl.mozilla.bugs@gmail.com>
Date: Fri, 13 Dec 2013 17:43:30 -0500
Subject: [PATCH 101/459] Bug 944362: Ensure that scroll updates get propagated
 to apz. r=jimm

---
 browser/metro/base/content/bindings/browser.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/metro/base/content/bindings/browser.js b/browser/metro/base/content/bindings/browser.js
index 4038ffa2ecdd..56017ef960bc 100644
--- a/browser/metro/base/content/bindings/browser.js
+++ b/browser/metro/base/content/bindings/browser.js
@@ -652,7 +652,7 @@ let ContentScroll =  {
         isRoot = true;
       }
     } else {
-      var window = target.currentDoc.defaultView;
+      var window = target.ownerDocument.defaultView;
       var scrollOffset = this.getScrollOffsetForElement(target);
       var element = target;
     }

From 724ee75bf2cde28e1d2140fe320dd78b456a5d67 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Tue, 12 Nov 2013 14:02:24 -0800
Subject: [PATCH 102/459] Bug 927685 - Enable --ion-parallel-compile=on by
 default in the shell; r=jandem,sr=jorendorff * * * Bug 927685 - Followup to
 fix bustage in --disable-threadsafe builds on a CLOSED TREE; r=bustage

--HG--
extra : rebase_source : b6f59f7f173e0e7c34b60cd0268cc9c36a0f485a
---
 js/src/jit-test/jit_test.py | 12 ++----------
 js/src/shell/js.cpp         | 23 ++++++-----------------
 js/src/tests/jstests.py     | 28 +++++++++++-----------------
 js/src/tests/lib/tests.py   | 11 +++++++++++
 4 files changed, 30 insertions(+), 44 deletions(-)

diff --git a/js/src/jit-test/jit_test.py b/js/src/jit-test/jit_test.py
index 37b47dca4286..48db63fb3fd4 100755
--- a/js/src/jit-test/jit_test.py
+++ b/js/src/jit-test/jit_test.py
@@ -15,6 +15,7 @@ def add_libdir_to_path():
 add_libdir_to_path()
 
 import jittests
+from tests import TBPL_FLAGS
 
 def main(argv):
 
@@ -161,17 +162,8 @@ def main(argv):
     job_list = []
     if options.tbpl:
         # Running all bits would take forever. Instead, we test a few interesting combinations.
-        flags = [
-            [], # no flags, normal baseline and ion
-            ['--ion-eager'], # implies --baseline-eager
-            ['--ion-eager', '--ion-check-range-analysis', '--no-sse3'],
-            ['--baseline-eager'],
-            ['--baseline-eager', '--no-ti', '--no-fpu'],
-            ['--no-baseline', '--no-ion'],
-            ['--no-baseline', '--no-ion', '--no-ti'],
-        ]
         for test in test_list:
-            for variant in flags:
+            for variant in TBPL_FLAGS:
                 new_test = test.copy()
                 new_test.jitflags.extend(variant)
                 job_list.append(new_test)
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 96d3553a7ebc..193620038e54 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -5567,25 +5567,16 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
     if (op->getBoolOption("ion-compile-try-catch"))
         jit::js_IonOptions.compileTryCatch = true;
 
-#ifdef JS_THREADSAFE
-    bool parallelCompilation = false;
+    bool parallelCompilation = true;
     if (const char *str = op->getStringOption("ion-parallel-compile")) {
-        if (strcmp(str, "on") == 0) {
-            if (cx->runtime()->workerThreadCount() == 0) {
-                fprintf(stderr, "Parallel compilation not available without helper threads");
-                return EXIT_FAILURE;
-            }
-            parallelCompilation = true;
-        } else if (strcmp(str, "off") != 0) {
+        if (strcmp(str, "off") == 0)
+            parallelCompilation = false;
+        else if (strcmp(str, "on") != 0)
             return OptionFailure("ion-parallel-compile", str);
-        }
     }
-    /*
-     * Note: In shell builds, parallel compilation is only enabled with an
-     * explicit option.
-     */
+#ifdef JS_THREADSAFE
     cx->runtime()->setParallelIonCompilationEnabled(parallelCompilation);
-#endif /* JS_THREADSAFE */
+#endif
 
 #endif /* JS_ION */
 
@@ -5838,10 +5829,8 @@ main(int argc, char **argv, char **envp)
                                "  stupid: Simple block local register allocation")
         || !op.addBoolOption('\0', "ion-eager", "Always ion-compile methods (implies --baseline-eager)")
         || !op.addBoolOption('\0', "ion-compile-try-catch", "Ion-compile try-catch statements")
-#ifdef JS_THREADSAFE
         || !op.addStringOption('\0', "ion-parallel-compile", "on/off",
                                "Compile scripts off thread (default: off)")
-#endif
         || !op.addBoolOption('\0', "baseline", "Enable baseline compiler (default)")
         || !op.addBoolOption('\0', "no-baseline", "Disable baseline compiler")
         || !op.addBoolOption('\0', "baseline-eager", "Always baseline-compile methods")
diff --git a/js/src/tests/jstests.py b/js/src/tests/jstests.py
index 229b4571dabe..aefcd2554c60 100755
--- a/js/src/tests/jstests.py
+++ b/js/src/tests/jstests.py
@@ -11,7 +11,7 @@ from copy import copy
 from subprocess import list2cmdline, call
 
 from lib.results import NullTestOutput
-from lib.tests import TestCase
+from lib.tests import TestCase, TBPL_FLAGS
 from lib.results import ResultsSink
 from lib.progressbar import ProgressBar
 
@@ -86,8 +86,9 @@ def parse_args():
                           help='Set maximum time a test is allows to run (in seconds).')
     harness_og.add_option('-a', '--args', dest='shell_args', default='',
                           help='Extra args to pass to the JS shell.')
-    harness_og.add_option('--jitflags', default='',
-                          help='Example: --jitflags=m,amd to run each test with -m, -a -m -d [default=%default]')
+    harness_og.add_option('--jitflags', default='', help="Obsolete. Does nothing.")
+    harness_og.add_option('--tbpl', action='store_true',
+                          help='Runs each test in all configurations tbpl tests.')
     harness_og.add_option('-g', '--debug', action='store_true', help='Run a test in debugger.')
     harness_og.add_option('--debugger', default='gdb -q --args', help='Debugger command.')
     harness_og.add_option('-J', '--jorendb', action='store_true', help='Run under JS debugger.')
@@ -206,16 +207,6 @@ def parse_args():
 
     return (options, requested_paths, excluded_paths)
 
-def parse_jitflags(op_jitflags):
-    jitflags = [ [ '-' + flag for flag in flags ]
-                 for flags in op_jitflags.split(',') ]
-    for flags in jitflags:
-        for flag in flags:
-            if flag not in ('-m', '-a', '-p', '-d', '-n'):
-                print('Invalid jit flag: "%s"'%flag)
-                sys.exit(1)
-    return jitflags
-
 def load_tests(options, requested_paths, excluded_paths):
     """
     Returns a tuple: (skipped_tests, test_list)
@@ -243,18 +234,21 @@ def load_tests(options, requested_paths, excluded_paths):
         manifest.make_manifests(options.make_manifests, test_list)
         sys.exit()
 
-    # Create a new test list. Apply each JIT configuration to every test.
-    if options.jitflags:
+    # Create a new test list. Apply each TBPL configuration to every test.
+    if options.tbpl:
         new_test_list = []
-        jitflags_list = parse_jitflags(options.jitflags)
+        flags_list = TBPL_FLAGS
         for test in test_list:
-            for jitflags in jitflags_list:
+            for jitflags in flags_list:
                 tmp_test = copy(test)
                 tmp_test.options = copy(test.options)
                 tmp_test.options.extend(jitflags)
                 new_test_list.append(tmp_test)
         test_list = new_test_list
 
+    if options.jitflags:
+        print("Warning: the --jitflags option is obsolete and does nothing now.")
+
     if options.test_file:
         paths = set()
         for test_file in options.test_file:
diff --git a/js/src/tests/lib/tests.py b/js/src/tests/lib/tests.py
index 4b66dcc3e908..92cee4394025 100644
--- a/js/src/tests/lib/tests.py
+++ b/js/src/tests/lib/tests.py
@@ -9,6 +9,17 @@ from threading import Thread
 
 from results import TestOutput
 
+# When run on tbpl, we run each test multiple times with the following arguments.
+TBPL_FLAGS = [
+    [], # no flags, normal baseline and ion
+    ['--ion-eager', '--ion-parallel-compile=off'], # implies --baseline-eager
+    ['--ion-eager', '--ion-parallel-compile=off', '--ion-check-range-analysis', '--no-sse3'],
+    ['--baseline-eager'],
+    ['--baseline-eager', '--no-ti', '--no-fpu'],
+    ['--no-baseline', '--no-ion'],
+    ['--no-baseline', '--no-ion', '--no-ti'],
+]
+
 def do_run_cmd(cmd):
     l = [ None, None ]
     th_run_cmd(cmd, l)

From 0dd4e7e1640e36ef2c265ec304c190c2bbd827f5 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Mon, 18 Nov 2013 13:02:11 -0800
Subject: [PATCH 103/459] Bug 928195 - Part 3: Consolidate all WebIDL Python
 logic into mozwebidl module; r=bz, froydnj

--HG--
extra : rebase_source : 050f1c3eb3bccdf369164be4e58c59fa71c19060
---
 build/virtualenv_packages.txt                 |   2 +
 dom/bindings/Makefile.in                      |   2 +
 dom/bindings/mozwebidlcodegen/__init__.py     | 523 ++++++++++++++++++
 .../mozwebidlcodegen/test/Child.webidl        |   3 +
 .../mozwebidlcodegen/test/DummyBinding.webidl |   2 +
 .../test/ExampleBinding.webidl                |   3 +
 .../mozwebidlcodegen/test/Parent.webidl       |   3 +
 .../mozwebidlcodegen/test/TestEvent.webidl    |  13 +
 .../test/test_mozwebidlcodegen.py             | 278 ++++++++++
 9 files changed, 829 insertions(+)
 create mode 100644 dom/bindings/mozwebidlcodegen/__init__.py
 create mode 100644 dom/bindings/mozwebidlcodegen/test/Child.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/Parent.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/TestEvent.webidl
 create mode 100644 dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py

diff --git a/build/virtualenv_packages.txt b/build/virtualenv_packages.txt
index aade8e7598e3..4fd374decd99 100644
--- a/build/virtualenv_packages.txt
+++ b/build/virtualenv_packages.txt
@@ -13,6 +13,8 @@ mock.pth:python/mock-1.0.0
 mozilla.pth:build
 mozilla.pth:config
 mozilla.pth:xpcom/typelib/xpt/tools
+mozilla.pth:dom/bindings
+mozilla.pth:dom/bindings/parser
 moztreedocs.pth:tools/docs
 copy:build/buildconfig.py
 packages.txt:testing/mozbase/packages.txt
diff --git a/dom/bindings/Makefile.in b/dom/bindings/Makefile.in
index 8bc94e224f03..a4a029ae5964 100644
--- a/dom/bindings/Makefile.in
+++ b/dom/bindings/Makefile.in
@@ -84,6 +84,8 @@ globalgen_headers_DEST = $(ABS_DIST)/include/mozilla/dom
 globalgen_headers_TARGET := export
 INSTALL_TARGETS += globalgen_headers
 
+PYTHON_UNIT_TESTS += $(srcdir)/mozwebidlcodegen/test/test_mozwebidlcodegen.py
+
 include $(topsrcdir)/config/rules.mk
 
 ifdef GNU_CC
diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
new file mode 100644
index 000000000000..4fc5d3bbd046
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -0,0 +1,523 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This module contains code for managing WebIDL files and bindings for
+# the build system.
+
+from __future__ import unicode_literals
+
+import errno
+import hashlib
+import json
+import logging
+import os
+
+from copy import deepcopy
+
+from mach.mixin.logging import LoggingMixin
+
+from mozbuild.makeutil import Makefile
+from mozbuild.pythonutil import iter_modules_in_path
+from mozbuild.util import FileAvoidWrite
+
+import mozpack.path as mozpath
+
+import WebIDL
+from Codegen import (
+    CGBindingRoot,
+    CGEventRoot,
+    CGExampleRoot,
+    GlobalGenRoots,
+)
+from Configuration import Configuration
+
+
+class BuildResult(object):
+    """Represents the result of processing WebIDL files.
+
+    This holds a summary of output file generation during code generation.
+    """
+
+    def __init__(self):
+        # The .webidl files that had their outputs regenerated.
+        self.inputs = set()
+
+        # The output files that were created.
+        self.created = set()
+
+        # The output files that changed.
+        self.updated = set()
+
+        # The output files that didn't change.
+        self.unchanged = set()
+
+
+class WebIDLCodegenManagerState(dict):
+    """Holds state for the WebIDL code generation manager.
+
+    State is currently just an extended dict. The internal implementation of
+    state should be considered a black box to everyone except
+    WebIDLCodegenManager. But we'll still document it.
+
+    Fields:
+
+    version
+       The integer version of the format. This is to detect incompatible
+       changes between state. It should be bumped whenever the format
+       changes or semantics change.
+
+    webidls
+       A dictionary holding information about every known WebIDL input.
+       Keys are the basenames of input WebIDL files. Values are dicts of
+       metadata. Keys in those dicts are:
+
+       * filename - The full path to the input filename.
+       * inputs - A set of full paths to other webidl files this webidl
+         depends on.
+       * outputs - Set of full output paths that are created/derived from
+         this file.
+       * sha1 - The hexidecimal SHA-1 of the input filename from the last
+         processing time.
+
+    global_inputs
+       A dictionary defining files that influence all processing. Keys
+       are full filenames. Values are hexidecimal SHA-1 from the last
+       processing time.
+    """
+
+    VERSION = 1
+
+    def __init__(self, fh=None):
+        self['version'] = self.VERSION
+        self['webidls'] = {}
+        self['global_depends'] = {}
+
+        if not fh:
+            return
+
+        state = json.load(fh)
+        if state['version'] != self.VERSION:
+            raise Exception('Unknown state version: %s' % state['version'])
+
+        self['version'] = state['version']
+        self['global_depends'] = state['global_depends']
+
+        for k, v in state['webidls'].items():
+            self['webidls'][k] = v
+
+            # Sets are converted to lists for serialization because JSON
+            # doesn't support sets.
+            self['webidls'][k]['inputs'] = set(v['inputs'])
+            self['webidls'][k]['outputs'] = set(v['outputs'])
+
+    def dump(self, fh):
+        """Dump serialized state to a file handle."""
+        normalized = deepcopy(self)
+
+        for k, v in self['webidls'].items():
+            # Convert sets to lists because JSON doesn't support sets.
+            normalized['webidls'][k]['outputs'] = sorted(v['outputs'])
+            normalized['webidls'][k]['inputs'] = sorted(v['inputs'])
+
+        json.dump(normalized, fh, sort_keys=True)
+
+
+class WebIDLCodegenManager(LoggingMixin):
+    """Manages all code generation around WebIDL.
+
+    To facilitate testing, this object is meant to be generic and reusable.
+    Paths, etc should be parameters and not hardcoded.
+    """
+
+    # Global parser derived declaration files.
+    GLOBAL_DECLARE_FILES = {
+        'GeneratedAtomList.h',
+        'PrototypeList.h',
+        'RegisterBindings.h',
+        'UnionConversions.h',
+        'UnionTypes.h',
+    }
+
+    # Global parser derived definition files.
+    GLOBAL_DEFINE_FILES = {
+        'RegisterBindings.cpp',
+        'UnionTypes.cpp',
+    }
+
+    # Example interfaces to build along with the tree. Other example
+    # interfaces will need to be generated manually.
+    BUILD_EXAMPLE_INTERFACES = {
+        'TestExampleInterface',
+        'TestExampleProxyInterface',
+    }
+
+    def __init__(self, config_path, inputs, exported_header_dir,
+        codegen_dir, state_path, cache_dir=None, make_deps_path=None,
+        make_deps_target=None):
+        """Create an instance that manages WebIDLs in the build system.
+
+        config_path refers to a WebIDL config file (e.g. Bindings.conf).
+        inputs is a 3-tuple describing the input .webidl files and how to
+        process them. Members are:
+            (set(.webidl files), set(basenames of exported files),
+                set(basenames of generated events files))
+
+        exported_header_dir and codegen_dir are directories where generated
+        files will be written to.
+        state_path is the path to a file that will receive JSON state from our
+        actions.
+        make_deps_path is the path to a make dependency file that we can
+        optionally write.
+        make_deps_target is the target that receives the make dependencies. It
+        must be defined if using make_deps_path.
+        """
+        self.populate_logger()
+
+        input_paths, exported_stems, generated_events_stems = inputs
+
+        self._config_path = config_path
+        self._input_paths = set(input_paths)
+        self._exported_stems = set(exported_stems)
+        self._generated_events_stems = set(generated_events_stems)
+        self._exported_header_dir = exported_header_dir
+        self._codegen_dir = codegen_dir
+        self._state_path = state_path
+        self._cache_dir = cache_dir
+        self._make_deps_path = make_deps_path
+        self._make_deps_target = make_deps_target
+
+        if (make_deps_path and not make_deps_target) or (not make_deps_path and
+            make_deps_target):
+            raise Exception('Must define both make_deps_path and make_deps_target '
+                'if one is defined.')
+
+        self._parser_results = None
+        self._config = None
+        self._state = WebIDLCodegenManagerState()
+
+        if os.path.exists(state_path):
+            with open(state_path, 'rb') as fh:
+                try:
+                    self._state = WebIDLCodegenManagerState(fh=fh)
+                except Exception as e:
+                    self.log(logging.WARN, 'webidl_bad_state', {'msg': str(e)},
+                        'Bad WebIDL state: {msg}')
+
+    @property
+    def config(self):
+        if not self._config:
+            self._parse_webidl()
+
+        return self._config
+
+    def generate_build_files(self):
+        """Generate files required for the build.
+
+        This function is in charge of generating all the .h/.cpp files derived
+        from input .webidl files. Please note that there are build actions
+        required to produce .webidl files and these build actions are
+        explicitly not captured here: this function assumes all .webidl files
+        are present and up to date.
+
+        This routine is called as part of the build to ensure files that need
+        to exist are present and up to date. This routine may not be called if
+        the build dependencies (generated as a result of calling this the first
+        time) say everything is up to date.
+
+        Because reprocessing outputs for every .webidl on every invocation
+        is expensive, we only regenerate the minimal set of files on every
+        invocation. The rules for deciding what needs done are roughly as
+        follows:
+
+        1. If any .webidl changes, reparse all .webidl files and regenerate
+           the global derived files. Only regenerate output files (.h/.cpp)
+           impacted by the modified .webidl files.
+        2. If an non-.webidl dependency (Python files, config file) changes,
+           assume everything is out of date and regenerate the world. This
+           is because changes in those could globally impact every output
+           file.
+        3. If an output file is missing, ensure it is present by performing
+           necessary regeneration.
+        """
+        # Despite #1 above, we assume the build system is smart enough to not
+        # invoke us if nothing has changed. Therefore, any invocation means
+        # something has changed. And, if anything has changed, we need to
+        # parse the WebIDL.
+        self._parse_webidl()
+
+        result = BuildResult()
+
+        # If we parse, we always update globals - they are cheap and it is
+        # easier that way.
+        created, updated, unchanged = self._write_global_derived()
+        result.created |= created
+        result.updated |= updated
+        result.unchanged |= unchanged
+
+        # If any of the extra dependencies changed, regenerate the world.
+        global_changed, global_hashes = self._global_dependencies_changed()
+        if global_changed:
+            # Make a copy because we may modify.
+            changed_inputs = set(self._input_paths)
+        else:
+            changed_inputs = self._compute_changed_inputs()
+
+        self._state['global_depends'] = global_hashes
+
+        # Generate bindings from .webidl files.
+        for filename in sorted(changed_inputs):
+            basename = mozpath.basename(filename)
+            result.inputs.add(filename)
+            written, deps = self._generate_build_files_for_webidl(filename)
+            result.created |= written[0]
+            result.updated |= written[1]
+            result.unchanged |= written[2]
+
+            self._state['webidls'][basename] = dict(
+                filename=filename,
+                outputs=written[0] | written[1] | written[2],
+                inputs=set(deps),
+                sha1=self._input_hashes[filename],
+            )
+
+        # Process some special interfaces required for testing.
+        for interface in self.BUILD_EXAMPLE_INTERFACES:
+            written = self.generate_example_files(interface)
+            result.created |= written[0]
+            result.updated |= written[1]
+            result.unchanged |= written[2]
+
+        # Generate a make dependency file.
+        if self._make_deps_path:
+            mk = Makefile()
+            codegen_rule = mk.create_rule([self._make_deps_target])
+            codegen_rule.add_dependencies(global_hashes.keys())
+            codegen_rule.add_dependencies(self._input_paths)
+
+            with FileAvoidWrite(self._make_deps_path) as fh:
+                mk.dump(fh)
+
+        self._save_state()
+
+        return result
+
+    def generate_example_files(self, interface):
+        """Generates example files for a given interface."""
+        root = CGExampleRoot(self.config, interface)
+
+        return self._maybe_write_codegen(root, *self._example_paths(interface))
+
+    def _parse_webidl(self):
+        self.log(logging.INFO, 'webidl_parse',
+            {'count': len(self._input_paths)},
+            'Parsing {count} WebIDL files.')
+
+        hashes = {}
+        parser = WebIDL.Parser(self._cache_dir)
+
+        for path in sorted(self._input_paths):
+            with open(path, 'rb') as fh:
+                data = fh.read()
+                hashes[path] = hashlib.sha1(data).hexdigest()
+                parser.parse(data, path)
+
+        self._parser_results = parser.finish()
+        self._config = Configuration(self._config_path, self._parser_results)
+        self._input_hashes = hashes
+
+    def _write_global_derived(self):
+        things = [('declare', f) for f in self.GLOBAL_DECLARE_FILES]
+        things.extend(('define', f) for f in self.GLOBAL_DEFINE_FILES)
+
+        result = (set(), set(), set())
+
+        for what, filename in things:
+            stem = mozpath.splitext(filename)[0]
+            root = getattr(GlobalGenRoots, stem)(self._config)
+
+            if what == 'declare':
+                code = root.declare()
+                output_root = self._exported_header_dir
+            elif what == 'define':
+                code = root.define()
+                output_root = self._codegen_dir
+            else:
+                raise Exception('Unknown global gen type: %s' % what)
+
+            output_path = mozpath.join(output_root, filename)
+            self._maybe_write_file(output_path, code, result)
+
+        return result
+
+    def _compute_changed_inputs(self):
+        """Compute the set of input files that need to be regenerated."""
+        changed_inputs = set()
+        expected_outputs = self.expected_build_output_files()
+
+        # Look for missing output files.
+        if any(not os.path.exists(f) for f in expected_outputs):
+            # FUTURE Bug 940469 Only regenerate minimum set.
+            changed_inputs |= self._input_paths
+
+        # That's it for examining output files. We /could/ examine SHA-1's of
+        # output files from a previous run to detect modifications. But that's
+        # a lot of extra work and most build systems don't do that anyway.
+
+        # Now we move on to the input files.
+        old_hashes = {v['filename']: v['sha1']
+            for v in self._state['webidls'].values()}
+
+        old_filenames = set(old_hashes.keys())
+        new_filenames = self._input_paths
+
+        # If an old file has disappeared or a new file has arrived, mark
+        # it.
+        changed_inputs |= old_filenames ^ new_filenames
+
+        # For the files in common between runs, compare content. If the file
+        # has changed, mark it. We don't need to perform mtime comparisons
+        # because content is a stronger validator.
+        for filename in old_filenames & new_filenames:
+            if old_hashes[filename] != self._input_hashes[filename]:
+                changed_inputs.add(filename)
+
+        # We've now populated the base set of inputs that have changed.
+
+        # Inherit dependencies from previous run. The full set of dependencies
+        # is associated with each record, so we don't need to perform any fancy
+        # graph traversal.
+        for v in self._state['webidls'].values():
+            if any(dep for dep in v['inputs'] if dep in changed_inputs):
+                changed_inputs.add(v['filename'])
+
+        # Ensure all changed inputs actually exist (some changed inputs could
+        # have been from deleted files).
+        return set(f for f in changed_inputs if os.path.exists(f))
+
+    def _binding_info(self, p):
+        """Compute binding metadata for an input path.
+
+        Returns a tuple of:
+
+          (stem, binding_stem, is_event, output_files)
+
+        output_files is itself a tuple. The first two items are the binding
+        header and C++ paths, respectively. The 2nd pair are the event header
+        and C++ paths or None if this isn't an event binding.
+        """
+        basename = mozpath.basename(p)
+        stem = mozpath.splitext(basename)[0]
+        binding_stem = '%sBinding' % stem
+
+        if stem in self._exported_stems:
+            header_dir = self._exported_header_dir
+        else:
+            header_dir = self._codegen_dir
+
+        is_event = stem in self._generated_events_stems
+
+        files = (
+            mozpath.join(header_dir, '%s.h' % binding_stem),
+            mozpath.join(self._codegen_dir, '%s.cpp' % binding_stem),
+            mozpath.join(header_dir, '%s.h' % stem) if is_event else None,
+            mozpath.join(self._codegen_dir, '%s.cpp' % stem) if is_event else None,
+        )
+
+        return stem, binding_stem, is_event, header_dir, files
+
+    def _example_paths(self, interface):
+        return (
+            mozpath.join(self._codegen_dir, '%s-example.h' % interface),
+            mozpath.join(self._codegen_dir, '%s-example.cpp' % interface))
+
+    def expected_build_output_files(self):
+        """Obtain the set of files generate_build_files() should write."""
+        paths = set()
+
+        # Account for global generation.
+        for p in self.GLOBAL_DECLARE_FILES:
+            paths.add(mozpath.join(self._exported_header_dir, p))
+        for p in self.GLOBAL_DEFINE_FILES:
+            paths.add(mozpath.join(self._codegen_dir, p))
+
+        for p in self._input_paths:
+            stem, binding_stem, is_event, header_dir, files = self._binding_info(p)
+            paths |= {f for f in files if f}
+
+        for interface in self.BUILD_EXAMPLE_INTERFACES:
+            for p in self._example_paths(interface):
+                paths.add(p)
+
+        return paths
+
+    def _generate_build_files_for_webidl(self, filename):
+        self.log(logging.INFO, 'webidl_generate_build_for_input',
+            {'filename': filename},
+            'Generating WebIDL files derived from {filename}')
+
+        stem, binding_stem, is_event, header_dir, files = self._binding_info(filename)
+        root = CGBindingRoot(self._config, binding_stem, filename)
+
+        result = self._maybe_write_codegen(root, files[0], files[1])
+
+        if is_event:
+            generated_event = CGEventRoot(self._config, stem)
+            result = self._maybe_write_codegen(generated_event, files[2],
+                files[3], result)
+
+        return result, root.deps()
+
+    def _global_dependencies_changed(self):
+        """Determine whether the global dependencies have changed."""
+        current_files = set(iter_modules_in_path(mozpath.dirname(__file__)))
+
+        # We need to catch other .py files from /dom/bindings. We assume these
+        # are in the same directory as the config file.
+        current_files |= set(iter_modules_in_path(mozpath.dirname(self._config_path)))
+
+        current_files.add(self._config_path)
+
+        current_hashes = {}
+        for f in current_files:
+            # This will fail if the file doesn't exist. If a current global
+            # dependency doesn't exist, something else is wrong.
+            with open(f, 'rb') as fh:
+                current_hashes[f] = hashlib.sha1(fh.read()).hexdigest()
+
+        # The set of files has changed.
+        if current_files ^ set(self._state['global_depends'].keys()):
+            return True, current_hashes
+
+        # Compare hashes.
+        for f, sha1 in current_hashes.items():
+            if sha1 != self._state['global_depends'][f]:
+                return True, current_hashes
+
+        return False, current_hashes
+
+    def _save_state(self):
+        with open(self._state_path, 'wb') as fh:
+            self._state.dump(fh)
+
+    def _maybe_write_codegen(self, obj, declare_path, define_path, result=None):
+        assert declare_path and define_path
+        if not result:
+            result = (set(), set(), set())
+
+        self._maybe_write_file(declare_path, obj.declare(), result)
+        self._maybe_write_file(define_path, obj.define(), result)
+
+        return result
+
+    def _maybe_write_file(self, path, content, result):
+        fh = FileAvoidWrite(path)
+        fh.write(content)
+        existed, updated = fh.close()
+
+        if not existed:
+            result[0].add(path)
+        elif updated:
+            result[1].add(path)
+        else:
+            result[2].add(path)
diff --git a/dom/bindings/mozwebidlcodegen/test/Child.webidl b/dom/bindings/mozwebidlcodegen/test/Child.webidl
new file mode 100644
index 000000000000..f7d0a76c9d3f
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/Child.webidl
@@ -0,0 +1,3 @@
+interface Child : Parent {
+  void ChildBaz();
+};
diff --git a/dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl b/dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl
new file mode 100644
index 000000000000..e2ccc4b69745
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/DummyBinding.webidl
@@ -0,0 +1,2 @@
+interface DummyInterface {};
+interface DummyInterfaceWorkers {};
diff --git a/dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl b/dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl
new file mode 100644
index 000000000000..34794993fe4a
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/ExampleBinding.webidl
@@ -0,0 +1,3 @@
+/* These interfaces are hard-coded and need to be defined. */
+interface TestExampleInterface {};
+interface TestExampleProxyInterface {};
diff --git a/dom/bindings/mozwebidlcodegen/test/Parent.webidl b/dom/bindings/mozwebidlcodegen/test/Parent.webidl
new file mode 100644
index 000000000000..423f364aea23
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/Parent.webidl
@@ -0,0 +1,3 @@
+interface Parent {
+  void MethodFoo();
+};
diff --git a/dom/bindings/mozwebidlcodegen/test/TestEvent.webidl b/dom/bindings/mozwebidlcodegen/test/TestEvent.webidl
new file mode 100644
index 000000000000..db085629186c
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/TestEvent.webidl
@@ -0,0 +1,13 @@
+interface EventTarget {
+  void addEventListener();
+};
+
+interface Event {};
+
+callback EventHandlerNonNull = any (Event event);
+typedef EventHandlerNonNull? EventHandler;
+
+[NoInterfaceObject]
+interface TestEvent : EventTarget {
+  attribute EventHandler onfoo;
+};
diff --git a/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py b/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py
new file mode 100644
index 000000000000..fd35e8c63485
--- /dev/null
+++ b/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py
@@ -0,0 +1,278 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import unicode_literals
+
+import imp
+import json
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+
+import mozpack.path as mozpath
+
+from mozwebidlcodegen import (
+    WebIDLCodegenManager,
+    WebIDLCodegenManagerState,
+)
+
+from mozfile import NamedTemporaryFile
+
+from mozunit import (
+    MockedOpen,
+    main,
+)
+
+
+OUR_DIR = mozpath.abspath(mozpath.dirname(__file__))
+TOPSRCDIR = mozpath.normpath(mozpath.join(OUR_DIR, '..', '..', '..', '..'))
+
+
+class TestWebIDLCodegenManager(unittest.TestCase):
+    TEST_STEMS = {
+        'Child',
+        'Parent',
+        'ExampleBinding',
+        'TestEvent',
+    }
+
+    @property
+    def _static_input_paths(self):
+        s = {mozpath.join(OUR_DIR, p) for p in os.listdir(OUR_DIR)
+            if p.endswith('.webidl')}
+
+        return s
+
+    @property
+    def _config_path(self):
+        config = mozpath.join(TOPSRCDIR, 'dom', 'bindings', 'Bindings.conf')
+        self.assertTrue(os.path.exists(config))
+
+        return config
+
+    def _get_manager_args(self):
+        tmp = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, tmp)
+
+        cache_dir = mozpath.join(tmp, 'cache')
+        os.mkdir(cache_dir)
+
+        ip = self._static_input_paths
+
+        inputs = (
+            ip,
+            {mozpath.splitext(mozpath.basename(p))[0] for p in ip},
+            set()
+        )
+
+        return dict(
+            config_path=self._config_path,
+            inputs=inputs,
+            exported_header_dir=mozpath.join(tmp, 'exports'),
+            codegen_dir=mozpath.join(tmp, 'codegen'),
+            state_path=mozpath.join(tmp, 'state.json'),
+            make_deps_path=mozpath.join(tmp, 'codegen.pp'),
+            make_deps_target='codegen.pp',
+            cache_dir=cache_dir,
+        )
+
+    def _get_manager(self):
+        return WebIDLCodegenManager(**self._get_manager_args())
+
+    def test_unknown_state_version(self):
+        """Loading a state file with a too new version resets state."""
+        args = self._get_manager_args()
+
+        p = args['state_path']
+
+        with open(p, 'wb') as fh:
+            json.dump({
+                'version': WebIDLCodegenManagerState.VERSION + 1,
+                'foobar': '1',
+            }, fh)
+
+        manager = WebIDLCodegenManager(**args)
+
+        self.assertEqual(manager._state['version'],
+            WebIDLCodegenManagerState.VERSION)
+        self.assertNotIn('foobar', manager._state)
+
+    def test_generate_build_files(self):
+        """generate_build_files() does the right thing from empty."""
+        manager = self._get_manager()
+        result = manager.generate_build_files()
+        self.assertEqual(len(result.inputs), 5)
+
+        output = manager.expected_build_output_files()
+        self.assertEqual(result.created, output)
+        self.assertEqual(len(result.updated), 0)
+        self.assertEqual(len(result.unchanged), 0)
+
+        for f in output:
+            self.assertTrue(os.path.isfile(f))
+
+        for f in manager.GLOBAL_DECLARE_FILES:
+            self.assertIn(mozpath.join(manager._exported_header_dir, f), output)
+
+        for f in manager.GLOBAL_DEFINE_FILES:
+            self.assertIn(mozpath.join(manager._codegen_dir, f), output)
+
+        for s in self.TEST_STEMS:
+            self.assertTrue(os.path.isfile(mozpath.join(
+                manager._exported_header_dir, '%sBinding.h' % s)))
+            self.assertTrue(os.path.isfile(mozpath.join(
+                manager._codegen_dir, '%sBinding.cpp' % s)))
+
+        self.assertTrue(os.path.isfile(manager._state_path))
+
+        with open(manager._state_path, 'rb') as fh:
+            state = json.load(fh)
+            self.assertEqual(state['version'], 1)
+            self.assertIn('webidls', state)
+
+            child = state['webidls']['Child.webidl']
+            self.assertEqual(len(child['inputs']), 2)
+            self.assertEqual(len(child['outputs']), 2)
+            self.assertEqual(child['sha1'], 'c41527cad3bc161fa6e7909e48fa11f9eca0468b')
+
+    def test_generate_build_files_load_state(self):
+        """State should be equivalent when instantiating a new instance."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        self.assertEqual(len(m1._state['webidls']), 0)
+        m1.generate_build_files()
+
+        m2 = WebIDLCodegenManager(**args)
+        self.assertGreater(len(m2._state['webidls']), 2)
+        self.assertEqual(m1._state, m2._state)
+
+    def test_no_change_no_writes(self):
+        """If nothing changes, no files should be updated."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        m2 = WebIDLCodegenManager(**args)
+        result = m2.generate_build_files()
+
+        self.assertEqual(len(result.inputs), 0)
+        self.assertEqual(len(result.created), 0)
+        self.assertEqual(len(result.updated), 0)
+
+    def test_output_file_regenerated(self):
+        """If an output file disappears, it is regenerated."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        rm_count = 0
+        for p in m1._state['webidls']['Child.webidl']['outputs']:
+            rm_count += 1
+            os.unlink(p)
+
+        for p in m1.GLOBAL_DECLARE_FILES:
+            rm_count += 1
+            os.unlink(mozpath.join(m1._exported_header_dir, p))
+
+        m2 = WebIDLCodegenManager(**args)
+        result = m2.generate_build_files()
+        self.assertEqual(len(result.created), rm_count)
+
+    def test_only_rebuild_self(self):
+        """If an input file changes, only rebuild that one file."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        child_path = None
+        for p in m1._input_paths:
+            if p.endswith('Child.webidl'):
+                child_path = p
+                break
+
+        self.assertIsNotNone(child_path)
+        child_content = open(child_path, 'rb').read()
+
+        with MockedOpen({child_path: child_content + '\n/* */'}):
+            m2 = WebIDLCodegenManager(**args)
+            result = m2.generate_build_files()
+            self.assertEqual(result.inputs, set([child_path]))
+            self.assertEqual(len(result.updated), 0)
+            self.assertEqual(len(result.created), 0)
+
+    def test_rebuild_dependencies(self):
+        """Ensure an input file used by others results in others rebuilding."""
+        args = self._get_manager_args()
+        m1 = WebIDLCodegenManager(**args)
+        m1.generate_build_files()
+
+        parent_path = None
+        child_path = None
+        for p in m1._input_paths:
+            if p.endswith('Parent.webidl'):
+                parent_path = p
+            elif p.endswith('Child.webidl'):
+                child_path = p
+
+        self.assertIsNotNone(parent_path)
+        parent_content = open(parent_path, 'rb').read()
+
+        with MockedOpen({parent_path: parent_content + '\n/* */'}):
+            m2 = WebIDLCodegenManager(**args)
+            result = m2.generate_build_files()
+            self.assertEqual(result.inputs, {child_path, parent_path})
+            self.assertEqual(len(result.updated), 0)
+            self.assertEqual(len(result.created), 0)
+
+    def test_python_change_regenerate_everything(self):
+        """If a Python file changes, we should attempt to rebuild everything."""
+
+        # We don't want to mutate files in the source directory because we want
+        # to be able to build from a read-only filesystem. So, we install a
+        # dummy module and rewrite the metadata to say it comes from the source
+        # directory.
+        #
+        # Hacking imp to accept a MockedFile doesn't appear possible. So for
+        # the first iteration we read from a temp file. The second iteration
+        # doesn't need to import, so we are fine with a mocked file.
+        fake_path = mozpath.join(OUR_DIR, 'fakemodule.py')
+        with NamedTemporaryFile('wt') as fh:
+            fh.write('# Original content')
+            fh.flush()
+            mod = imp.load_source('mozwebidlcodegen.fakemodule', fh.name)
+            mod.__file__ = fake_path
+
+            args = self._get_manager_args()
+            m1 = WebIDLCodegenManager(**args)
+            with MockedOpen({fake_path: '# Original content'}):
+                old_exists = os.path.exists
+                try:
+                    def exists(p):
+                        if p == fake_path:
+                            return True
+                        return old_exists(p)
+
+                    os.path.exists = exists
+
+                    result = m1.generate_build_files()
+                    l = len(result.inputs)
+
+                    with open(fake_path, 'wt') as fh:
+                        fh.write('# Modified content')
+
+                    m2 = WebIDLCodegenManager(**args)
+                    result = m2.generate_build_files()
+                    self.assertEqual(len(result.inputs), l)
+
+                    result = m2.generate_build_files()
+                    self.assertEqual(len(result.inputs), 0)
+                finally:
+                    os.path.exists = old_exists
+                    del sys.modules['mozwebidlcodegen.fakemodule']
+
+
+if __name__ == '__main__':
+    main()

From b47eeb6ab324dc64044dd09bb8b44abac4198ba0 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Thu, 12 Dec 2013 16:26:38 +0900
Subject: [PATCH 104/459] Bug 928195 - Part 4: Rewrite WebIDL build system
 integration; r=bz, r=glandium

WebIDL build system integration has been rewritten from the ground up.
Changes:

* GlobalGen.py, BindingGen.py, and ExampleGen.py have been removed in
  favor of mozwebidl.py.

* Static .webidl files are now processed directly in their original location
  and aren't copied to the object directory.

* Generated events <stem>.cpp files are now compiled into the unified
  sources. Previously, only the <stem>Binding.cpp files were compiled
  into unified sources.

* Exported .h files are now generated directly into their final location.
  Previously, they were generated into the local directory then
  installed in their final location.

* The list of globalgen-generated files now lives in Python and isn't
  duplicated in 3 places.

* The make dependencies are much simpler as a result of using a single
  command to perform all code generation. The auto-generated .pp file from
  code generation sets up all dependencies necessary to reinvoke code
  generation and Python takes care of dependency management.

--HG--
extra : rebase_source : e4918878274b22a412329c7cb18cc7138daf5dc6
---
 CLOBBER                                       |   7 +-
 dom/bindings/BindingGen.py                    |  98 -------
 dom/bindings/Codegen.py                       |  21 --
 dom/bindings/ExampleGen.py                    |  46 ---
 dom/bindings/GlobalGen.py                     |  81 -----
 dom/bindings/Makefile.in                      | 276 ++++--------------
 dom/bindings/moz.build                        |   2 +
 dom/bindings/mozwebidlcodegen/__init__.py     |  42 +++
 dom/bindings/test/Makefile.in                 |  80 +----
 dom/bindings/test/moz.build                   |  13 +-
 dom/moz.build                                 |   3 -
 dom/webidl/moz.build                          |  12 -
 python/mozbuild/mozbuild/action/webidl.py     |  17 ++
 python/mozbuild/mozbuild/backend/common.py    | 108 ++++++-
 .../mozbuild/backend/recursivemake.py         | 179 ++++++------
 python/mozbuild/mozbuild/base.py              |   4 +
 16 files changed, 351 insertions(+), 638 deletions(-)
 delete mode 100644 dom/bindings/BindingGen.py
 delete mode 100644 dom/bindings/ExampleGen.py
 delete mode 100644 dom/bindings/GlobalGen.py
 create mode 100644 python/mozbuild/mozbuild/action/webidl.py

diff --git a/CLOBBER b/CLOBBER
index 91acfa9390b2..f61ddd42af5e 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -18,4 +18,9 @@
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
 
-Bug 887836 - webidl changes require a Windows clobber.
+# Are you updating CLOBBER because you think it's needed for your WebIDL
+# changes to stick? As of bug 928195, this shouldn't be necessary! Please
+# don't change CLOBBER for WebIDL changes any more.
+Bug 928195 rewrote WebIDL build system integration from the ground up. This
+will hopefully be the last required clobber due to WebIDLs poorly interacting
+with the build system.
diff --git a/dom/bindings/BindingGen.py b/dom/bindings/BindingGen.py
deleted file mode 100644
index e064270513f5..000000000000
--- a/dom/bindings/BindingGen.py
+++ /dev/null
@@ -1,98 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-import os
-import cPickle
-from Configuration import Configuration
-from Codegen import CGBindingRoot, replaceFileIfChanged, CGEventRoot
-from mozbuild.makeutil import Makefile
-from mozbuild.pythonutil import iter_modules_in_path
-from buildconfig import topsrcdir
-
-
-def generate_binding_files(config, outputprefix, srcprefix, webidlfile,
-                           generatedEventsWebIDLFiles):
-    """
-    |config| Is the configuration object.
-    |outputprefix| is a prefix to use for the header guards and filename.
-    """
-
-    depsname = ".deps/" + outputprefix + ".pp"
-    root = CGBindingRoot(config, outputprefix, webidlfile)
-    replaceFileIfChanged(outputprefix + ".h", root.declare())
-    replaceFileIfChanged(outputprefix + ".cpp", root.define())
-
-    if webidlfile in generatedEventsWebIDLFiles:
-        eventName = webidlfile[:-len(".webidl")]
-        generatedEvent = CGEventRoot(config, eventName)
-        replaceFileIfChanged(eventName + ".h", generatedEvent.declare())
-        replaceFileIfChanged(eventName + ".cpp", generatedEvent.define())
-
-    mk = Makefile()
-    # NOTE: it's VERY important that we output dependencies for the FooBinding
-    # file here, not for the header or generated cpp file.  These dependencies
-    # are used later to properly determine changedDeps and prevent rebuilding
-    # too much.  See the comment explaining $(binding_dependency_trackers) in
-    # Makefile.in.
-    rule = mk.create_rule([outputprefix])
-    rule.add_dependencies(os.path.join(srcprefix, x) for x in sorted(root.deps()))
-    rule.add_dependencies(iter_modules_in_path(topsrcdir))
-    with open(depsname, 'w') as f:
-        mk.dump(f)
-
-def main():
-    # Parse arguments.
-    from optparse import OptionParser
-    usagestring = "usage: %prog [header|cpp] configFile outputPrefix srcPrefix webIDLFile"
-    o = OptionParser(usage=usagestring)
-    o.add_option("--verbose-errors", action='store_true', default=False,
-                 help="When an error happens, display the Python traceback.")
-    (options, args) = o.parse_args()
-
-    configFile = os.path.normpath(args[0])
-    srcPrefix = os.path.normpath(args[1])
-
-    # Load the configuration
-    f = open('ParserResults.pkl', 'rb')
-    config = cPickle.load(f)
-    f.close()
-
-    def readFile(f):
-        file = open(f, 'rb')
-        try:
-            contents = file.read()
-        finally:
-            file.close()
-        return contents
-    allWebIDLFiles = readFile(args[2]).split()
-    generatedEventsWebIDLFiles = readFile(args[3]).split()
-    changedDeps = readFile(args[4]).split()
-
-    if all(f.endswith("Binding") or f == "ParserResults.pkl" for f in changedDeps):
-        toRegenerate = filter(lambda f: f.endswith("Binding"), changedDeps)
-        if len(toRegenerate) == 0 and len(changedDeps) == 1:
-            # Work around build system bug 874923: if we get here that means
-            # that changedDeps contained only one entry and it was
-            # "ParserResults.pkl".  That should never happen: if the
-            # ParserResults.pkl changes then either one of the globalgen files
-            # changed (in which case we wouldn't be in this "only
-            # ParserResults.pkl and *Binding changed" code) or some .webidl
-            # files changed (and then the corresponding *Binding files should
-            # show up in changedDeps).  Since clearly the build system is
-            # confused, just regenerate everything to be safe.
-            toRegenerate = allWebIDLFiles
-        else:
-            toRegenerate = map(lambda f: f[:-len("Binding")] + ".webidl",
-                               toRegenerate)
-    else:
-        toRegenerate = allWebIDLFiles
-
-    for webIDLFile in toRegenerate:
-        assert webIDLFile.endswith(".webidl")
-        outputPrefix = webIDLFile[:-len(".webidl")] + "Binding"
-        generate_binding_files(config, outputPrefix, srcPrefix, webIDLFile,
-                               generatedEventsWebIDLFiles);
-
-if __name__ == '__main__':
-    main()
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index c32b821fa513..97272e5a1b22 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -29,27 +29,6 @@ INSTANCE_RESERVED_SLOTS = 3
 def memberReservedSlot(member):
     return "(DOM_INSTANCE_RESERVED_SLOTS + %d)" % member.slotIndex
 
-def replaceFileIfChanged(filename, newContents):
-    """
-    Read a copy of the old file, so that we don't touch it if it hasn't changed.
-    Returns True if the file was updated, false otherwise.
-    """
-    oldFileContents = ""
-    try:
-        oldFile = open(filename, 'rb')
-        oldFileContents = ''.join(oldFile.readlines())
-        oldFile.close()
-    except:
-        pass
-
-    if newContents == oldFileContents:
-        return False
-
-    f = open(filename, 'wb')
-    f.write(newContents)
-    f.close()
-    return True
-
 def toStringBool(arg):
     return str(not not arg).lower()
 
diff --git a/dom/bindings/ExampleGen.py b/dom/bindings/ExampleGen.py
deleted file mode 100644
index 60eebe221a38..000000000000
--- a/dom/bindings/ExampleGen.py
+++ /dev/null
@@ -1,46 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-import os
-import cPickle
-from Configuration import Configuration
-from Codegen import CGExampleRoot, replaceFileIfChanged
-
-def generate_interface_example(config, interfaceName):
-    """
-    |config| Is the configuration object.
-    |interfaceName| is the name of the interface we're generating an example for.
-    """
-
-    root = CGExampleRoot(config, interfaceName)
-    exampleHeader = interfaceName + "-example.h"
-    exampleImpl = interfaceName + "-example.cpp"
-    replaceFileIfChanged(exampleHeader, root.declare())
-    replaceFileIfChanged(exampleImpl, root.define())
-
-def main():
-
-    # Parse arguments.
-    from optparse import OptionParser
-    usagestring = "usage: %prog configFile interfaceName"
-    o = OptionParser(usage=usagestring)
-    o.add_option("--verbose-errors", action='store_true', default=False,
-                 help="When an error happens, display the Python traceback.")
-    (options, args) = o.parse_args()
-
-    if len(args) != 2:
-        o.error(usagestring)
-    configFile = os.path.normpath(args[0])
-    interfaceName = args[1]
-
-    # Load the configuration
-    f = open('ParserResults.pkl', 'rb')
-    config = cPickle.load(f)
-    f.close()
-
-    # Generate the example class.
-    generate_interface_example(config, interfaceName)
-
-if __name__ == '__main__':
-    main()
diff --git a/dom/bindings/GlobalGen.py b/dom/bindings/GlobalGen.py
deleted file mode 100644
index f3f02a4d1e48..000000000000
--- a/dom/bindings/GlobalGen.py
+++ /dev/null
@@ -1,81 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# We do one global pass over all the WebIDL to generate our prototype enum
-# and generate information for subsequent phases.
-
-import os
-import WebIDL
-import cPickle
-from Configuration import Configuration
-from Codegen import GlobalGenRoots, replaceFileIfChanged
-
-def generate_file(config, name, action):
-
-    root = getattr(GlobalGenRoots, name)(config)
-    if action is 'declare':
-        filename = name + '.h'
-        code = root.declare()
-    else:
-        assert action is 'define'
-        filename = name + '.cpp'
-        code = root.define()
-
-    if replaceFileIfChanged(filename, code):
-        print "Generating %s" % (filename)
-    else:
-        print "%s hasn't changed - not touching it" % (filename)
-
-def main():
-    # Parse arguments.
-    from optparse import OptionParser
-    usageString = "usage: %prog [options] webidldir [files]"
-    o = OptionParser(usage=usageString)
-    o.add_option("--cachedir", dest='cachedir', default=None,
-                 help="Directory in which to cache lex/parse tables.")
-    o.add_option("--verbose-errors", action='store_true', default=False,
-                 help="When an error happens, display the Python traceback.")
-    (options, args) = o.parse_args()
-
-    if len(args) < 2:
-        o.error(usageString)
-
-    configFile = args[0]
-    baseDir = args[1]
-    fileList = args[2:]
-
-    # Parse the WebIDL.
-    parser = WebIDL.Parser(options.cachedir)
-    for filename in fileList:
-        fullPath = os.path.normpath(os.path.join(baseDir, filename))
-        f = open(fullPath, 'rb')
-        lines = f.readlines()
-        f.close()
-        parser.parse(''.join(lines), fullPath)
-    parserResults = parser.finish()
-
-    # Load the configuration.
-    config = Configuration(configFile, parserResults)
-
-    # Write the configuration out to a pickle.
-    resultsFile = open('ParserResults.pkl', 'wb')
-    cPickle.dump(config, resultsFile, -1)
-    resultsFile.close()
-
-    # Generate the atom list.
-    generate_file(config, 'GeneratedAtomList', 'declare')
-
-    # Generate the prototype list.
-    generate_file(config, 'PrototypeList', 'declare')
-
-    # Generate the common code.
-    generate_file(config, 'RegisterBindings', 'declare')
-    generate_file(config, 'RegisterBindings', 'define')
-
-    generate_file(config, 'UnionTypes', 'declare')
-    generate_file(config, 'UnionTypes', 'define')
-    generate_file(config, 'UnionConversions', 'declare')
-
-if __name__ == '__main__':
-    main()
diff --git a/dom/bindings/Makefile.in b/dom/bindings/Makefile.in
index a4a029ae5964..418a39837eec 100644
--- a/dom/bindings/Makefile.in
+++ b/dom/bindings/Makefile.in
@@ -1,245 +1,85 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+abs_dist := $(abspath $(DIST))
+webidl_base := $(topsrcdir)/dom/webidl
 
-webidl_base = $(topsrcdir)/dom/webidl
 # Generated by moz.build
 include webidlsrcs.mk
 
-binding_include_path := mozilla/dom
-webidl_files += $(generated_events_webidl_files)
-all_webidl_files = $(webidl_files) $(generated_webidl_files) $(preprocessed_webidl_files)
-
-# Set exported_binding_headers before adding the test IDL to the mix
-exported_binding_headers := $(subst .webidl,Binding.h,$(all_webidl_files))
-exported_generated_events_headers := $(subst .webidl,.h,$(generated_events_webidl_files))
-
-# Set linked_binding_cpp_files before adding the test IDL to the mix
-linked_binding_cpp_files := $(subst .webidl,Binding.cpp,$(all_webidl_files))
-linked_generated_events_cpp_files := $(subst .webidl,.cpp,$(generated_events_webidl_files))
-
-all_webidl_files += $(test_webidl_files) $(preprocessed_test_webidl_files)
-
-generated_header_files := $(subst .webidl,Binding.h,$(all_webidl_files)) $(exported_generated_events_headers)
-generated_cpp_files := $(subst .webidl,Binding.cpp,$(all_webidl_files)) $(linked_generated_events_cpp_files)
-
-# We want to be able to only regenerate the .cpp and .h files that really need
-# to change when a .webidl file changes.  We do this by making the
-# binding_dependency_trackers targets have dependencies on the right .webidl
-# files via generated .pp files, having a .BindingGen target that depends on the
-# binding_dependency_trackers and which has all the generated binding .h/.cpp
-# depending on it, and then in the make commands for that target being able to
-# check which exact binding_dependency_trackers changed.
-binding_dependency_trackers := $(subst .webidl,Binding,$(all_webidl_files))
-
-globalgen_targets := \
-  GeneratedAtomList.h \
-  PrototypeList.h \
-  RegisterBindings.h \
-  RegisterBindings.cpp \
-  UnionTypes.h \
-  UnionTypes.cpp \
-  UnionConversions.h \
-  $(NULL)
-
-# Nasty hack: when the test/Makefile.in invokes us to do codegen, it
-# uses a target of
-# "export TestExampleInterface-example TestExampleProxyInterface-example".
-# We don't actually need to load our .o.pp files in that case, so just
-# pretend like we have no CPPSRCS if that's the target.  It makes the
-# test cycle much faster, which is why we're doing it.
-#
-# XXXbz We could try to cheat even more and only include our CPPSRCS
-# when $(MAKECMDGOALS) contains libs, so that we can skip loading all
-# those .o.pp when trying to make a single .cpp file too, but that
-# would break |make FooBinding.o(bj)|.  Ah, well.
-ifneq (export TestExampleInterface-example TestExampleProxyInterface-example,$(MAKECMDGOALS))
-CPPSRCS = \
-  $(unified_binding_cpp_files) \
-  $(linked_generated_events_cpp_files) \
-  $(filter %.cpp, $(globalgen_targets)) \
-  $(NULL)
+ifdef GNU_CC
+OS_CXXFLAGS += -Wno-uninitialized
 endif
 
-ABS_DIST := $(abspath $(DIST))
+# These come from webidlsrcs.mk.
+# TODO Write directly into backend.mk.
+CPPSRCS += $(globalgen_sources) $(unified_binding_cpp_files)
 
-EXTRA_EXPORT_MDDEPEND_FILES := $(addsuffix .pp,$(binding_dependency_trackers))
-
-EXPORTS_GENERATED_FILES := $(exported_binding_headers) $(exported_generated_events_headers)
-EXPORTS_GENERATED_DEST := $(ABS_DIST)/include/$(binding_include_path)
-EXPORTS_GENERATED_TARGET := export
-INSTALL_TARGETS += EXPORTS_GENERATED
-
-# Install auto-generated GlobalGen files. The rules for the install must
-# be in the same target/subtier as GlobalGen.py, otherwise the files will not
-# get installed into the appropriate location as they are generated.
-globalgen_headers_FILES := \
-  GeneratedAtomList.h \
-  PrototypeList.h \
-  RegisterBindings.h \
-  UnionConversions.h \
-  UnionTypes.h \
-  $(NULL)
-globalgen_headers_DEST = $(ABS_DIST)/include/mozilla/dom
-globalgen_headers_TARGET := export
-INSTALL_TARGETS += globalgen_headers
+# Generated bindings reference *Binding.h, not mozilla/dom/*Binding.h. And,
+# since we generate exported bindings directly to $(DIST)/include, we need
+# to add that path to the search list.
+#
+# Ideally, binding generation uses the prefixed header file names.
+# Bug 932092 tracks.
+LOCAL_INCLUDES += -I$(DIST)/include/mozilla/dom
 
 PYTHON_UNIT_TESTS += $(srcdir)/mozwebidlcodegen/test/test_mozwebidlcodegen.py
 
 include $(topsrcdir)/config/rules.mk
 
-ifdef GNU_CC
-CXXFLAGS += -Wno-uninitialized
-endif
-
-# If you change bindinggen_dependencies here, change it in
-# dom/bindings/test/Makefile.in too.
-bindinggen_dependencies := \
-  BindingGen.py \
-  Bindings.conf \
-  Configuration.py \
-  Codegen.py \
-  ParserResults.pkl \
-  parser/WebIDL.py \
+# TODO This list should be emitted to a .pp file via
+# GenerateCSS2PropertiesWebIDL.py.
+css2properties_dependencies = \
+  $(topsrcdir)/layout/style/nsCSSPropList.h \
+  $(topsrcdir)/layout/style/nsCSSPropAliasList.h \
+  $(webidl_base)/CSS2Properties.webidl.in \
+  $(webidl_base)/CSS2PropertiesProps.h \
+  $(srcdir)/GenerateCSS2PropertiesWebIDL.py \
   $(GLOBAL_DEPS) \
   $(NULL)
 
-CSS2Properties.webidl: $(topsrcdir)/layout/style/nsCSSPropList.h \
-                       $(topsrcdir)/layout/style/nsCSSPropAliasList.h \
-                       $(webidl_base)/CSS2Properties.webidl.in \
-                       $(webidl_base)/CSS2PropertiesProps.h \
-                       $(srcdir)/GenerateCSS2PropertiesWebIDL.py \
-                       $(GLOBAL_DEPS)
-	$(CPP) $(DEFINES) $(ACDEFINES) -I$(topsrcdir)/layout/style $(webidl_base)/CSS2PropertiesProps.h | \
-	  PYTHONDONTWRITEBYTECODE=1 $(PYTHON) \
-	  $(srcdir)/GenerateCSS2PropertiesWebIDL.py $(webidl_base)/CSS2Properties.webidl.in > CSS2Properties.webidl
+CSS2Properties.webidl: $(css2properties_dependencies)
+	$(CPP) $(DEFINES) $(ACDEFINES) -I$(topsrcdir)/layout/style \
+	  $(webidl_base)/CSS2PropertiesProps.h | \
+	    PYTHONDONTWRITEBYTECODE=1 $(PYTHON) \
+	      $(srcdir)/GenerateCSS2PropertiesWebIDL.py \
+	      $(webidl_base)/CSS2Properties.webidl.in > $@
 
-$(webidl_files): %: $(webidl_base)/%
-	$(INSTALL) $(IFLAGS1) $(webidl_base)/$* .
-
-$(test_webidl_files): %: $(srcdir)/test/%
-	$(INSTALL) $(IFLAGS1) $(srcdir)/test/$* .
-
-# We can't easily use PP_TARGETS here because it insists on outputting targets
-# that look like "$(CURDIR)/foo" whereas we want our target to just be "foo".
-# Make sure to include $(GLOBAL_DEPS) so we pick up changes to what symbols are
-# defined.  Also make sure to remove $@ before writing to it, because otherwise
-# if a file goes from non-preprocessed to preprocessed we can end up writing to
-# a symlink, which will clobber files in the srcdir, which is bad.
-$(preprocessed_webidl_files): %: $(webidl_base)/% $(GLOBAL_DEPS)
-	$(RM) $@
-	$(call py_action,preprocessor, \
-          $(DEFINES) $(ACDEFINES) $(XULPPFLAGS) $(webidl_base)/$* -o $@)
-
-# See the comment about PP_TARGETS for $(preprocessed_webidl_files)
-$(preprocessed_test_webidl_files): %: $(srcdir)/test/% $(GLOBAL_DEPS)
-	$(RM) $@
-	$(call py_action,preprocessor, \
-          $(DEFINES) $(ACDEFINES) $(XULPPFLAGS) $(srcdir)/test/$* -o $@)
-
-# Make is dumb and can get confused between "foo" and "$(CURDIR)/foo".  Make
-# sure that the latter depends on the former, since the latter gets used in .pp
-# files.
-all_webidl_files_absolute = $(addprefix $(CURDIR)/,$(all_webidl_files))
-$(all_webidl_files_absolute): $(CURDIR)/%: %
-
-$(generated_header_files): .BindingGen
-
-$(generated_cpp_files): .BindingGen
-
-# $(binding_dependency_trackers) pick up additional dependencies via .pp files
-# The rule: just brings the tracker up to date, if it's out of date, so that
-# we'll know that we have to redo binding generation and flag this prerequisite
-# there as being newer than the bindinggen target.
-$(binding_dependency_trackers):
-	@$(TOUCH) $@
-
-$(globalgen_targets): ParserResults.pkl
-
-%-example: .BindingGen
-	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
-	  $(PLY_INCLUDE) -I$(srcdir)/parser \
-	  $(srcdir)/ExampleGen.py \
-	  $(srcdir)/Bindings.conf $*
-
-CACHE_DIR = _cache
-
-globalgen_dependencies := \
-  GlobalGen.py \
-  Bindings.conf \
-  Configuration.py \
-  Codegen.py \
-  parser/WebIDL.py \
-  webidlsrcs.mk \
-  $(all_webidl_files) \
-  $(CACHE_DIR)/.done \
+# Most of the logic for dependencies lives inside Python so it can be
+# used by multiple build backends. We simply have rules to generate
+# and include the .pp file.
+#
+# The generated .pp file contains all the important dependencies such as
+# changes to .webidl or .py files should result in code generation being
+# performed.
+codegen_dependencies := \
+  $(nonstatic_webidl_files) \
   $(GLOBAL_DEPS) \
   $(NULL)
 
-$(CACHE_DIR)/.done:
-	$(MKDIR) -p $(CACHE_DIR)
+$(call include_deps,codegen.pp)
+
+codegen.pp: $(codegen_dependencies)
+	$(call py_action,webidl,$(srcdir))
 	@$(TOUCH) $@
 
-# Running GlobalGen.py updates ParserResults.pkl as a side-effect
-ParserResults.pkl: $(globalgen_dependencies)
-	$(info Generating global WebIDL files)
-	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
-	  $(PLY_INCLUDE) -I$(srcdir)/parser \
-	  $(srcdir)/GlobalGen.py $(srcdir)/Bindings.conf . \
-	  --cachedir=$(CACHE_DIR) \
-	  $(all_webidl_files)
-
-$(globalgen_headers_FILES): ParserResults.pkl
-
-# Make sure .deps actually exists, since we'll try to write to it from
-# BindingGen.py but we're typically running in the export phase, which is
-# before anyone has bothered creating .deps.
-# Then, pass our long lists through files to try to avoid blowing out the
-# command line.
-# Next, BindingGen.py will examine the changed dependency list to figure out
-# what it really needs to regenerate.
-# Finally, touch the .BindingGen file so that we don't have to keep redoing
-# all that until something else actually changes.
-.BindingGen: $(bindinggen_dependencies) $(binding_dependency_trackers)
-	$(info Generating WebIDL bindings)
-	$(MKDIR) -p .deps
-	echo $(all_webidl_files) > .all-webidl-file-list
-	echo $(generated_events_webidl_files) > .generated-events-webidl-files
-	echo $? > .changed-dependency-list
-	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
-	  $(PLY_INCLUDE) -I$(srcdir)/parser \
-	  $(srcdir)/BindingGen.py \
-	  $(srcdir)/Bindings.conf \
-	  $(CURDIR) \
-	  .all-webidl-file-list \
-	  .generated-events-webidl-files \
-	  .changed-dependency-list
-	@$(TOUCH) $@
+.PHONY: compiletests
+compiletests:
+	$(call SUBMAKE,libs,test)
 
 GARBAGE += \
-  webidlyacc.py \
+  codegen.pp \
+  codegen.json \
   parser.out \
-  $(wildcard *-example.h) \
-  $(wildcard *-example.cpp) \
-  .BindingGen \
-  .all-webidl-file-list \
-  .generated-events-webidl-files \
-  .changed-dependency-list \
-  $(binding_dependency_trackers) \
+  WebIDLGrammar.pkl \
+  $(wildcard *.h) \
+  $(wildcard *Binding.cpp) \
+  $(wildcard *Event.cpp) \
+  $(wildcard *-event.cpp) \
+  $(wildcard *.webidl) \
   $(NULL)
 
-# Make sure all binding header files are created during the export stage, so we
-# don't have issues with .cpp files being compiled before we've generated the
-# headers they depend on.  This is really only needed for the test files, since
-# the non-test headers are all exported above anyway.  Note that this means that
-# we do all of our codegen during export.
-export:: $(generated_header_files)
-
-distclean::
-	-$(RM) \
-        $(generated_header_files) \
-        $(generated_cpp_files) \
-        $(all_webidl_files) \
-        $(globalgen_targets) \
-        ParserResults.pkl \
-        $(NULL)
+DIST_GARBAGE += \
+  file-lists.json \
+  $(NULL)
diff --git a/dom/bindings/moz.build b/dom/bindings/moz.build
index bd46aa837b75..557d4a63e92f 100644
--- a/dom/bindings/moz.build
+++ b/dom/bindings/moz.build
@@ -4,6 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+TEST_DIRS += ['test']
+
 EXPORTS.mozilla += [
     'ErrorResult.h',
 ]
diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
index 4fc5d3bbd046..5516dbb3a1a0 100644
--- a/dom/bindings/mozwebidlcodegen/__init__.py
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -17,6 +17,7 @@ from copy import deepcopy
 
 from mach.mixin.logging import LoggingMixin
 
+from mozbuild.base import MozbuildObject
 from mozbuild.makeutil import Makefile
 from mozbuild.pythonutil import iter_modules_in_path
 from mozbuild.util import FileAvoidWrite
@@ -521,3 +522,44 @@ class WebIDLCodegenManager(LoggingMixin):
             result[1].add(path)
         else:
             result[2].add(path)
+
+
+def create_build_system_manager(topsrcdir, topobjdir, dist_dir):
+    """Create a WebIDLCodegenManager for use by the build system."""
+    src_dir = os.path.join(topsrcdir, 'dom', 'bindings')
+    obj_dir = os.path.join(topobjdir, 'dom', 'bindings')
+
+    with open(os.path.join(obj_dir, 'file-lists.json'), 'rb') as fh:
+        files = json.load(fh)
+
+    inputs = (files['webidls'], files['exported_stems'],
+        files['generated_events_stems'])
+
+    cache_dir = os.path.join(obj_dir, '_cache')
+    try:
+        os.makedirs(cache_dir)
+    except OSError as e:
+        if e.errno != errno.EEXIST:
+            raise
+
+    return WebIDLCodegenManager(
+        os.path.join(src_dir, 'Bindings.conf'),
+        inputs,
+        os.path.join(dist_dir, 'include', 'mozilla', 'dom'),
+        obj_dir,
+        os.path.join(obj_dir, 'codegen.json'),
+        cache_dir=cache_dir,
+        # The make rules include a codegen.pp file containing dependencies.
+        make_deps_path=os.path.join(obj_dir, 'codegen.pp'),
+        make_deps_target='codegen.pp',
+    )
+
+
+class BuildSystemWebIDL(MozbuildObject):
+    @property
+    def manager(self):
+        if not hasattr(self, '_webidl_manager'):
+            self._webidl_manager = create_build_system_manager(
+                self.topsrcdir, self.topobjdir, self.distdir)
+
+        return self._webidl_manager
diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in
index 78756bf35a03..78a3cafd020c 100644
--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -2,89 +2,23 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# Do NOT export this library.  We don't actually want our test code
-# being added to libxul or anything.
-
-# pymake can't handle descending into dom/bindings several times simultaneously
-ifdef .PYMAKE
-.NOTPARALLEL:
-endif
-
-# Need this for $(test_webidl_files)
 include ../webidlsrcs.mk
 
-# But the webidl actually lives in our parent dir
-test_webidl_files := $(addprefix ../,$(test_webidl_files))
-# Store the actual locations of our source preprocessed files, so we
-# can depend on them sanely.
-source_preprocessed_test_webidl_files := $(addprefix $(srcdir)/,$(preprocessed_test_webidl_files))
-preprocessed_test_webidl_files := $(addprefix ../,$(preprocessed_test_webidl_files))
-
-CPPSRCS += \
-  $(subst .webidl,Binding.cpp,$(test_webidl_files)) \
-  $(subst .webidl,Binding.cpp,$(preprocessed_test_webidl_files)) \
-  $(NULL)
-
-# If you change bindinggen_dependencies here, change it in
-# dom/bindings/Makefile.in too.  But note that we include ../Makefile
-# here manually, since $(GLOBAL_DEPS) won't cover it.
-bindinggen_dependencies := \
-  ../BindingGen.py \
-  ../Bindings.conf \
-  ../Configuration.py \
-  ../Codegen.py \
-  ../ParserResults.pkl \
-  ../parser/WebIDL.py \
-  ../Makefile \
-  $(GLOBAL_DEPS) \
-  $(NULL)
+# $(test_sources) comes from webidlsrcs.mk.
+# TODO Update this variable in backend.mk.
+CPPSRCS += $(addprefix ../,$(test_sources))
 
 ifdef GNU_CC
-CXXFLAGS += -Wno-uninitialized
+OS_CXXFLAGS += -Wno-uninitialized
 endif
 
+# Bug 932082 tracks having bindings use namespaced includes.
+LOCAL_INCLUDES += -I$(DIST)/include/mozilla/dom -I..
+
 # Include rules.mk before any of our targets so our first target is coming from
 # rules.mk and running make with no target in this dir does the right thing.
 include $(topsrcdir)/config/rules.mk
 
-$(CPPSRCS): .BindingGen
-
-.BindingGen: $(bindinggen_dependencies) \
-             $(test_webidl_files) \
-             $(source_preprocessed_test_webidl_files) \
-             $(NULL)
-	# The export phase in dom/bindings is what actually looks at
-	# dependencies and regenerates things as needed, so just go ahead and
-	# make that phase here.  Also make our example interface files.  If the
-	# target used here ever changes, change the conditional around
-	# $(CPPSRCS) in dom/bindings/Makefile.in.
-	$(MAKE) -C .. export TestExampleInterface-example TestExampleProxyInterface-example
-	@$(TOUCH) $@
-
 check::
 	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) $(topsrcdir)/config/pythonpath.py \
 	  $(PLY_INCLUDE) $(srcdir)/../parser/runtests.py
-
-# Since we define MOCHITEST_FILES, config/makefiles/mochitest.mk goes ahead and
-# sets up a rule with libs:: in itm which makes our .DEFAULT_TARGET be "libs".
-# Then ruls.mk does |.DEFAULT_TARGET ?= default| which leaves it as "libs".  So
-# if we make without an explicit target in this directory, we try to make
-# "libs", but with a $(MAKECMDGOALS) of empty string.  And then rules.mk
-# helpfully does not include our *.o.pp files, since it includes them only if
-# filtering some stuff out from $(MAKECMDGOALS) leaves it nonempty.  The upshot
-# is that if some headers change and we run make in this dir without an explicit
-# target things don't get rebuilt.
-#
-# On the other hand, if we set .DEFAULT_TARGET to "default" explicitly here,
-# then rules.mk will reinvoke make with "export" and "libs" but this time hey
-# will be passed as explicit targets, show up in $(MAKECMDGOALS), and things
-# will work.  Do this at the end of our Makefile so the rest of the build system
-# does not get a chance to muck with it after we set it.
-.DEFAULT_GOAL := default
-
-# Make sure to add .BindingGen to GARBAGE so we'll rebuild our example
-# files if someone goes through and deletes GARBAGE all over, which
-# will delete example files from our parent dir.
-GARBAGE += \
-  .BindingGen \
-  $(NULL)
diff --git a/dom/bindings/test/moz.build b/dom/bindings/test/moz.build
index 82db3c691cbc..5b129eee9e20 100644
--- a/dom/bindings/test/moz.build
+++ b/dom/bindings/test/moz.build
@@ -14,9 +14,20 @@ MOCHITEST_MANIFESTS += ['mochitest.ini']
 
 MOCHITEST_CHROME_MANIFESTS += ['chrome.ini']
 
+TEST_WEBIDL_FILES += [
+    'TestDictionary.webidl',
+    'TestJSImplInheritanceGen.webidl',
+    'TestTypedef.webidl',
+]
+
+PREPROCESSED_TEST_WEBIDL_FILES += [
+    'TestCodeGen.webidl',
+    'TestExampleGen.webidl',
+    'TestJSImplGen.webidl',
+]
+
 LOCAL_INCLUDES += [
     '/dom/bindings',
     '/js/xpconnect/src',
     '/js/xpconnect/wrappers',
 ]
-
diff --git a/dom/moz.build b/dom/moz.build
index 09bf93c46ed5..60aa95f2991f 100644
--- a/dom/moz.build
+++ b/dom/moz.build
@@ -107,12 +107,9 @@ if CONFIG['MOZ_NFC']:
 if CONFIG['MOZ_B2G']:
     PARALLEL_DIRS += ['downloads']
 
-# bindings/test is here, because it needs to build after bindings/, and
-# we build subdirectories before ourselves.
 TEST_DIRS += [
     'tests',
     'imptests',
-    'bindings/test',
 ]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'cocoa', 'windows', 'android', 'qt', 'os2'):
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index 108b38a1b3ec..e3f970284f36 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -553,18 +553,6 @@ if CONFIG['MOZ_B2G_FM']:
         'FMRadio.webidl',
     ]
 
-if CONFIG['ENABLE_TESTS']:
-    TEST_WEBIDL_FILES += [
-        'TestDictionary.webidl',
-        'TestJSImplInheritanceGen.webidl',
-        'TestTypedef.webidl',
-    ]
-    PREPROCESSED_TEST_WEBIDL_FILES += [
-        'TestCodeGen.webidl',
-        'TestExampleGen.webidl',
-        'TestJSImplGen.webidl',
-    ]
-
 GENERATED_EVENTS_WEBIDL_FILES = [
     'BlobEvent.webidl',
     'CallGroupErrorEvent.webidl',
diff --git a/python/mozbuild/mozbuild/action/webidl.py b/python/mozbuild/mozbuild/action/webidl.py
new file mode 100644
index 000000000000..6702701228e5
--- /dev/null
+++ b/python/mozbuild/mozbuild/action/webidl.py
@@ -0,0 +1,17 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import sys
+
+from mozwebidlcodegen import BuildSystemWebIDL
+
+
+def main(argv):
+    """Perform WebIDL code generation required by the build system."""
+    manager = BuildSystemWebIDL.from_environment().manager
+    manager.generate_build_files()
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/python/mozbuild/mozbuild/backend/common.py b/python/mozbuild/mozbuild/backend/common.py
index eec09f7eecb8..0a6fe8ad4049 100644
--- a/python/mozbuild/mozbuild/backend/common.py
+++ b/python/mozbuild/mozbuild/backend/common.py
@@ -10,15 +10,19 @@ import re
 
 import mozpack.path as mozpath
 
-from mozbuild.preprocessor import Preprocessor
-
 from .base import BuildBackend
 
 from ..frontend.data import (
     ConfigFileSubstitution,
     HeaderFileSubstitution,
+    GeneratedEventWebIDLFile,
+    GeneratedWebIDLFile,
+    PreprocessedTestWebIDLFile,
+    PreprocessedWebIDLFile,
     TestManifest,
+    TestWebIDLFile,
     XPIDLFile,
+    WebIDLFile,
 )
 
 from ..util import DefaultOnReadDict
@@ -56,6 +60,79 @@ class XPIDLManager(object):
         self.modules.setdefault(entry['module'], set()).add(entry['root'])
 
 
+class WebIDLCollection(object):
+    """Collects WebIDL info referenced during the build."""
+
+    def __init__(self):
+        self.sources = set()
+        self.generated_sources = set()
+        self.generated_events_sources = set()
+        self.preprocessed_sources = set()
+        self.test_sources = set()
+        self.preprocessed_test_sources = set()
+
+    def all_regular_sources(self):
+        return self.sources | self.generated_sources | \
+            self.generated_events_sources | self.preprocessed_sources
+
+    def all_regular_basenames(self):
+        return [os.path.basename(source) for source in self.all_regular_sources()]
+
+    def all_regular_stems(self):
+        return [os.path.splitext(b)[0] for b in self.all_regular_basenames()]
+
+    def all_regular_bindinggen_stems(self):
+        for stem in self.all_regular_stems():
+            yield '%sBinding' % stem
+
+        for source in self.generated_events_sources:
+            yield os.path.splitext(os.path.basename(source))[0]
+
+    def all_regular_cpp_basenames(self):
+        for stem in self.all_regular_bindinggen_stems():
+            yield '%s.cpp' % stem
+
+    def all_test_sources(self):
+        return self.test_sources | self.preprocessed_test_sources
+
+    def all_test_basenames(self):
+        return [os.path.basename(source) for source in self.all_test_sources()]
+
+    def all_test_stems(self):
+        return [os.path.splitext(b)[0] for b in self.all_test_basenames()]
+
+    def all_test_cpp_basenames(self):
+        return ['%sBinding.cpp' % s for s in self.all_test_stems()]
+
+    def all_static_sources(self):
+        return self.sources | self.generated_events_sources | \
+            self.test_sources
+
+    def all_non_static_sources(self):
+        return self.generated_sources | self.all_preprocessed_sources()
+
+    def all_non_static_basenames(self):
+        return [os.path.basename(s) for s in self.all_non_static_sources()]
+
+    def all_preprocessed_sources(self):
+        return self.preprocessed_sources | self.preprocessed_test_sources
+
+    def all_sources(self):
+        return set(self.all_regular_sources()) | set(self.all_test_sources())
+
+    def all_basenames(self):
+        return [os.path.basename(source) for source in self.all_sources()]
+
+    def all_stems(self):
+        return [os.path.splitext(b)[0] for b in self.all_basenames()]
+
+    def generated_events_basenames(self):
+        return [os.path.basename(s) for s in self.generated_events_sources]
+
+    def generated_events_stems(self):
+        return [os.path.splitext(b)[0] for b in self.generated_events_basenames()]
+
+
 class TestManager(object):
     """Helps hold state related to tests."""
 
@@ -90,6 +167,7 @@ class CommonBackend(BuildBackend):
     def _init(self):
         self._idl_manager = XPIDLManager(self.environment)
         self._test_manager = TestManager(self.environment)
+        self._webidls = WebIDLCollection()
 
     def consume_object(self, obj):
         if isinstance(obj, TestManifest):
@@ -113,6 +191,30 @@ class CommonBackend(BuildBackend):
             self._create_config_header(obj)
             self.backend_input_files.add(obj.input_path)
 
+        # We should consider aggregating WebIDL types in emitter.py.
+        elif isinstance(obj, WebIDLFile):
+            self._webidls.sources.add(mozpath.join(obj.srcdir, obj.basename))
+
+        elif isinstance(obj, GeneratedEventWebIDLFile):
+            self._webidls.generated_events_sources.add(mozpath.join(
+                obj.srcdir, obj.basename))
+
+        elif isinstance(obj, TestWebIDLFile):
+            self._webidls.test_sources.add(mozpath.join(obj.srcdir,
+                obj.basename))
+
+        elif isinstance(obj, PreprocessedTestWebIDLFile):
+            self._webidls.preprocessed_test_sources.add(mozpath.join(
+                obj.srcdir, obj.basename))
+
+        elif isinstance(obj, GeneratedWebIDLFile):
+            self._webidls.generated_sources.add(mozpath.join(obj.srcdir,
+                obj.basename))
+
+        elif isinstance(obj, PreprocessedWebIDLFile):
+            self._webidls.preprocessed_sources.add(mozpath.join(
+                obj.srcdir, obj.basename))
+
         else:
             return
 
@@ -122,6 +224,8 @@ class CommonBackend(BuildBackend):
         if len(self._idl_manager.idls):
             self._handle_idl_manager(self._idl_manager)
 
+        self._handle_webidl_collection(self._webidls)
+
         # Write out a machine-readable file describing every test.
         path = mozpath.join(self.environment.topobjdir, 'all-tests.json')
         with self._write_file(path) as fh:
diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index 3742ad4f340b..c9a4000dd46a 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -5,13 +5,15 @@
 from __future__ import unicode_literals
 
 import itertools
+import json
 import logging
 import os
-import re
 import types
 
 from collections import namedtuple
 
+import mozwebidlcodegen
+
 import mozbuild.makeutil as mozmakeutil
 from mozpack.copier import FilePurger
 from mozpack.manifests import (
@@ -25,9 +27,7 @@ from ..frontend.data import (
     Defines,
     DirectoryTraversal,
     Exports,
-    GeneratedEventWebIDLFile,
     GeneratedInclude,
-    GeneratedWebIDLFile,
     HostProgram,
     HostSimpleProgram,
     InstallationTarget,
@@ -35,17 +35,13 @@ from ..frontend.data import (
     JavaJarData,
     LibraryDefinition,
     LocalInclude,
-    PreprocessedTestWebIDLFile,
-    PreprocessedWebIDLFile,
     Program,
     SandboxDerived,
     SandboxWrapped,
     SimpleProgram,
-    TestWebIDLFile,
+    TestManifest,
     VariablePassthru,
     XPIDLFile,
-    TestManifest,
-    WebIDLFile,
 )
 from ..util import (
     ensureParentDir,
@@ -270,12 +266,6 @@ class RecursiveMakeBackend(CommonBackend):
 
         self._backend_files = {}
         self._ipdl_sources = set()
-        self._webidl_sources = set()
-        self._generated_events_webidl_sources = set()
-        self._test_webidl_sources = set()
-        self._preprocessed_test_webidl_sources = set()
-        self._preprocessed_webidl_sources = set()
-        self._generated_webidl_sources = set()
 
         def detailed(summary):
             s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
@@ -410,33 +400,6 @@ class RecursiveMakeBackend(CommonBackend):
         elif isinstance(obj, IPDLFile):
             self._ipdl_sources.add(mozpath.join(obj.srcdir, obj.basename))
 
-        elif isinstance(obj, WebIDLFile):
-            self._webidl_sources.add(mozpath.join(obj.srcdir, obj.basename))
-            self._process_webidl_basename(obj.basename)
-
-        elif isinstance(obj, GeneratedEventWebIDLFile):
-            self._generated_events_webidl_sources.add(mozpath.join(obj.srcdir, obj.basename))
-
-        elif isinstance(obj, TestWebIDLFile):
-            self._test_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                       obj.basename))
-            # Test WebIDL files are not exported.
-
-        elif isinstance(obj, PreprocessedTestWebIDLFile):
-            self._preprocessed_test_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                                    obj.basename))
-            # Test WebIDL files are not exported.
-
-        elif isinstance(obj, GeneratedWebIDLFile):
-            self._generated_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                            obj.basename))
-            self._process_webidl_basename(obj.basename)
-
-        elif isinstance(obj, PreprocessedWebIDLFile):
-            self._preprocessed_webidl_sources.add(mozpath.join(obj.srcdir,
-                                                               obj.basename))
-            self._process_webidl_basename(obj.basename)
-
         elif isinstance(obj, Program):
             self._process_program(obj.program, backend_file)
 
@@ -607,6 +570,9 @@ class RecursiveMakeBackend(CommonBackend):
                                  poison_windows_h=False,
                                  files_per_unified_file=16):
 
+        # In case it's a generator.
+        files = sorted(files)
+
         explanation = "\n" \
             "# We build files in 'unified' mode by including several files\n" \
             "# together into a single source file.  This cuts down on\n" \
@@ -632,7 +598,7 @@ class RecursiveMakeBackend(CommonBackend):
                 return itertools.izip_longest(fillvalue=dummy_fill_value, *args)
 
             for i, unified_group in enumerate(grouper(files_per_unified_file,
-                                                      sorted(files))):
+                                                      files)):
                 just_the_filenames = list(filter_out_dummy(unified_group))
                 yield '%s%d.%s' % (unified_prefix, i, unified_suffix), just_the_filenames
 
@@ -750,42 +716,12 @@ class RecursiveMakeBackend(CommonBackend):
         with self._write_file(mozpath.join(ipdl_dir, 'ipdlsrcs.mk')) as ipdls:
             mk.dump(ipdls, removal_guard=False)
 
-        self._may_skip['compile'] -= set(['ipc/ipdl'])
-
-        # Write out master lists of WebIDL source files.
-        bindings_dir = mozpath.join(self.environment.topobjdir, 'dom', 'bindings')
-
-        mk = mozmakeutil.Makefile()
-
-        def write_var(variable, sources):
-            files = [mozpath.basename(f) for f in sorted(sources)]
-            mk.add_statement('%s += %s' % (variable, ' '.join(files)))
-        write_var('webidl_files', self._webidl_sources)
-        write_var('generated_events_webidl_files', self._generated_events_webidl_sources)
-        write_var('test_webidl_files', self._test_webidl_sources)
-        write_var('preprocessed_test_webidl_files', self._preprocessed_test_webidl_sources)
-        write_var('generated_webidl_files', self._generated_webidl_sources)
-        write_var('preprocessed_webidl_files', self._preprocessed_webidl_sources)
-
-        all_webidl_files = itertools.chain(iter(self._webidl_sources),
-                                           iter(self._generated_events_webidl_sources),
-                                           iter(self._generated_webidl_sources),
-                                           iter(self._preprocessed_webidl_sources))
-        all_webidl_files = [mozpath.basename(x) for x in all_webidl_files]
-        all_webidl_sources = [re.sub(r'\.webidl$', 'Binding.cpp', x) for x in all_webidl_files]
-
-        self._add_unified_build_rules(mk, all_webidl_sources,
-                                      bindings_dir,
-                                      unified_prefix='UnifiedBindings',
-                                      unified_files_makefile_variable='unified_binding_cpp_files',
-                                      poison_windows_h=True)
-
-        # Assume that Somebody Else has responsibility for correctly
-        # specifying removal dependencies for |all_webidl_sources|.
-        with self._write_file(mozpath.join(bindings_dir, 'webidlsrcs.mk')) as webidls:
-            mk.dump(webidls, removal_guard=False)
-
-        self._may_skip['compile'] -= set(['dom/bindings', 'dom/bindings/test'])
+        # These contain autogenerated sources that the build config doesn't
+        # yet know about.
+        # TODO Emit GENERATED_SOURCES so these special cases are dealt with
+        # the proper way.
+        self._may_skip['compile'] -= {'ipc/ipdl'}
+        self._may_skip['compile'] -= {'dom/bindings', 'dom/bindings/test'}
 
         self._fill_root_mk()
 
@@ -1026,10 +962,6 @@ class RecursiveMakeBackend(CommonBackend):
     def _process_host_simple_program(self, program, backend_file):
         backend_file.write('HOST_SIMPLE_PROGRAMS += %s\n' % program)
 
-    def _process_webidl_basename(self, basename):
-        header = 'mozilla/dom/%sBinding.h' % mozpath.splitext(basename)[0]
-        self._install_manifests['dist_include'].add_optional_exists(header)
-
     def _process_test_manifest(self, obj, backend_file):
         # Much of the logic in this function could be moved to CommonBackend.
         self.backend_input_files.add(mozpath.join(obj.topsrcdir,
@@ -1171,3 +1103,86 @@ class RecursiveMakeBackend(CommonBackend):
             # Makefile.in files, the old file will get replaced with
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
+
+    def _handle_webidl_collection(self, webidls):
+        if not webidls.all_stems():
+            return
+
+        bindings_dir = mozpath.join(self.environment.topobjdir, 'dom',
+            'bindings')
+
+        all_inputs = set(webidls.all_static_sources())
+        for s in webidls.all_non_static_basenames():
+            all_inputs.add(mozpath.join(bindings_dir, s))
+
+        generated_events_stems = webidls.generated_events_stems()
+        exported_stems = webidls.all_regular_stems()
+
+        # The WebIDL manager reads configuration from a JSON file. So, we
+        # need to write this file early.
+        o = dict(
+            webidls=sorted(all_inputs),
+            generated_events_stems=sorted(generated_events_stems),
+            exported_stems=sorted(exported_stems),
+        )
+
+        file_lists = mozpath.join(bindings_dir, 'file-lists.json')
+        with self._write_file(file_lists) as fh:
+            json.dump(o, fh, sort_keys=True, indent=2)
+
+        manager = mozwebidlcodegen.create_build_system_manager(
+            self.environment.topsrcdir,
+            self.environment.topobjdir,
+            mozpath.join(self.environment.topobjdir, 'dist')
+        )
+
+        # The manager is the source of truth on what files are generated.
+        # Consult it for install manifests.
+        include_dir = mozpath.join(self.environment.topobjdir, 'dist',
+            'include')
+        for f in manager.expected_build_output_files():
+            if f.startswith(include_dir):
+                self._install_manifests['dist_include'].add_optional_exists(
+                    mozpath.relpath(f, include_dir))
+
+        # We pass WebIDL info to make via a completely generated make file.
+        mk = Makefile()
+        mk.add_statement('nonstatic_webidl_files := %s' % ' '.join(
+            sorted(webidls.all_non_static_basenames())))
+        mk.add_statement('globalgen_sources := %s' % ' '.join(
+            sorted(manager.GLOBAL_DEFINE_FILES)))
+        mk.add_statement('test_sources := %s' % ' '.join(
+            sorted('%sBinding.cpp' % s for s in webidls.all_test_stems())))
+
+        # Add rules to preprocess bindings.
+        # This should ideally be using PP_TARGETS. However, since the input
+        # filenames match the output filenames, the existing PP_TARGETS rules
+        # result in circular dependencies and other make weirdness. One
+        # solution is to rename the input or output files repsectively. See
+        # bug 928195 comment 129.
+        for source in sorted(webidls.all_preprocessed_sources()):
+            basename = os.path.basename(source)
+            rule = mk.create_rule([basename])
+            rule.add_dependencies([source, '$(GLOBAL_DEPS)'])
+            rule.add_commands([
+                # Remove the file before writing so bindings that go from
+                # static to preprocessed don't end up writing to a symlink,
+                # which would modify content in the source directory.
+                '$(RM) $@',
+                '$(call py_action,preprocessor,$(DEFINES) $(ACDEFINES) '
+                    '$(XULPPFLAGS) $< -o $@)'
+            ])
+
+        # Bindings are compiled in unified mode to speed up compilation and
+        # to reduce linker memory size. Note that test bindings are separated
+        # from regular ones so tests bindings aren't shipped.
+        self._add_unified_build_rules(mk,
+            webidls.all_regular_cpp_basenames(),
+            bindings_dir,
+            unified_prefix='UnifiedBindings',
+            unified_files_makefile_variable='unified_binding_cpp_files',
+            poison_windows_h=True)
+
+        webidls_mk = mozpath.join(bindings_dir, 'webidlsrcs.mk')
+        with self._write_file(webidls_mk) as fh:
+            mk.dump(fh, removal_guard=False)
diff --git a/python/mozbuild/mozbuild/base.py b/python/mozbuild/mozbuild/base.py
index 0c006855d0d4..6043c4e8f3e5 100644
--- a/python/mozbuild/mozbuild/base.py
+++ b/python/mozbuild/mozbuild/base.py
@@ -273,6 +273,10 @@ class MozbuildObject(ProcessExecutionMixin):
     def bindir(self):
         return os.path.join(self.topobjdir, 'dist', 'bin')
 
+    @property
+    def includedir(self):
+        return os.path.join(self.topobjdir, 'dist', 'include')
+
     @property
     def statedir(self):
         return os.path.join(self.topobjdir, '.mozbuild')

From faf292b942f8045390ec7af8d1b3116d36384a7f Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Thu, 14 Nov 2013 10:34:55 -0800
Subject: [PATCH 105/459] Bug 928195 - Part 5: mach command for generating
 WebIDL example files; r=froydnj

--HG--
extra : rebase_source : c74d5f9556ca866622b7fefd4711e96fe4e4e020
---
 dom/bindings/mach_commands.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/dom/bindings/mach_commands.py b/dom/bindings/mach_commands.py
index e176d91cd4e3..8b890c94b319 100644
--- a/dom/bindings/mach_commands.py
+++ b/dom/bindings/mach_commands.py
@@ -18,6 +18,17 @@ from mozbuild.base import MachCommandBase
 
 @CommandProvider
 class WebIDLProvider(MachCommandBase):
+    @Command('webidl-example', category='misc',
+        description='Generate example files for a WebIDL interface.')
+    @CommandArgument('interface', nargs='+',
+        help='Interface(s) whose examples to generate.')
+    def webidl_example(self, interface):
+        from mozwebidlcodegen import BuildSystemWebIDL
+
+        manager = self._spawn(BuildSystemWebIDL).manager
+        for i in interface:
+            manager.generate_example_files(i)
+
     @Command('webidl-parser-test', category='testing',
         description='Run WebIDL tests.')
     @CommandArgument('--verbose', '-v', action='store_true',

From 4190812d0a0f93dd62c1ba0644e5cb89408a49b4 Mon Sep 17 00:00:00 2001
From: Mark Hammond <mhammond@skippinet.com.au>
Date: Fri, 13 Dec 2013 14:24:36 +1100
Subject: [PATCH 106/459] Bug 935793 (part 1) - Add ownerIsBrowserOrApp to
 nsIFrameLoader. r=smaug

--HG--
extra : rebase_source : 189b45b39c04e4272d7b0cc188f35bb02bc19970
---
 content/base/public/nsIFrameLoader.idl | 7 ++++++-
 content/base/src/nsFrameLoader.cpp     | 8 ++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/content/base/public/nsIFrameLoader.idl b/content/base/public/nsIFrameLoader.idl
index a2f3e812d621..bcbc5fd93028 100644
--- a/content/base/public/nsIFrameLoader.idl
+++ b/content/base/public/nsIFrameLoader.idl
@@ -111,7 +111,7 @@ interface nsIContentViewManager : nsISupports
   readonly attribute nsIContentView rootContentView;
 };
 
-[scriptable, builtinclass, uuid(5b9949dc-56f1-47b6-b6d2-3785bb90ed6d)]
+[scriptable, builtinclass, uuid(a723673b-a26e-4cc6-ae23-ec70df9d97c9)]
 interface nsIFrameLoader : nsISupports
 {
   /**
@@ -272,6 +272,11 @@ interface nsIFrameLoader : nsISupports
    * have a notion of visibility in the parent process when frames are OOP.
    */
   [infallible] attribute boolean visible;
+
+  /**
+   * Find out whether the owner content really is a browser or app frame
+   */
+  readonly attribute boolean ownerIsBrowserOrAppFrame;
 };
 
 %{C++
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 1c4d99da8d62..306a90fedc4c 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -1409,6 +1409,14 @@ nsFrameLoader::OwnerIsBrowserOrAppFrame()
   return browserFrame ? browserFrame->GetReallyIsBrowserOrApp() : false;
 }
 
+// The xpcom getter version
+NS_IMETHODIMP
+nsFrameLoader::GetOwnerIsBrowserOrAppFrame(bool* aResult)
+{
+  *aResult = OwnerIsBrowserOrAppFrame();
+  return NS_OK;
+}
+
 bool
 nsFrameLoader::OwnerIsAppFrame()
 {

From 4834261c634406983a4a33278dc3139867b6b2db Mon Sep 17 00:00:00 2001
From: Mark Hammond <mhammond@skippinet.com.au>
Date: Fri, 13 Dec 2013 14:24:37 +1100
Subject: [PATCH 107/459] Bug 935793 (part 2) - rename browser-shown
 notifications and send them for all frames. r=smaug

--HG--
extra : rebase_source : 475b2cafc094117a2edf8ba95605e7f4d5f95410
---
 accessible/src/jsat/AccessFu.jsm            | 20 ++++++++++-------
 b2g/components/ErrorPage.jsm                |  8 +++++--
 content/base/src/nsFrameLoader.cpp          | 24 ++++++++++-----------
 dom/browser-element/BrowserElementParent.js | 16 ++++++++++----
 dom/inputmethod/Keyboard.jsm                |  8 +++++--
 dom/ipc/ProcessPriorityManager.cpp          | 11 ++++++++--
 6 files changed, 56 insertions(+), 31 deletions(-)

diff --git a/accessible/src/jsat/AccessFu.jsm b/accessible/src/jsat/AccessFu.jsm
index c0cf612968c5..fb7bcdbbd263 100644
--- a/accessible/src/jsat/AccessFu.jsm
+++ b/accessible/src/jsat/AccessFu.jsm
@@ -118,8 +118,8 @@ this.AccessFu = {
     Output.start();
     TouchAdapter.start();
 
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-shown', false);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
     Services.obs.addObserver(this, 'Accessibility:NextObject', false);
     Services.obs.addObserver(this, 'Accessibility:PreviousObject', false);
     Services.obs.addObserver(this, 'Accessibility:Focus', false);
@@ -162,8 +162,8 @@ this.AccessFu = {
     Utils.win.removeEventListener('TabClose', this);
     Utils.win.removeEventListener('TabSelect', this);
 
-    Services.obs.removeObserver(this, 'remote-browser-frame-shown');
-    Services.obs.removeObserver(this, 'in-process-browser-or-app-frame-shown');
+    Services.obs.removeObserver(this, 'remote-browser-shown');
+    Services.obs.removeObserver(this, 'inprocess-browser-shown');
     Services.obs.removeObserver(this, 'Accessibility:NextObject');
     Services.obs.removeObserver(this, 'Accessibility:PreviousObject');
     Services.obs.removeObserver(this, 'Accessibility:Focus');
@@ -304,11 +304,15 @@ this.AccessFu = {
       case 'Accessibility:MoveByGranularity':
         this.Input.moveByGranularity(JSON.parse(aData));
         break;
-      case 'remote-browser-frame-shown':
-      case 'in-process-browser-or-app-frame-shown':
+      case 'remote-browser-shown':
+      case 'inprocess-browser-shown':
       {
-        let mm = aSubject.QueryInterface(Ci.nsIFrameLoader).messageManager;
-        this._handleMessageManager(mm);
+        // Ignore notifications that aren't from a BrowserOrApp
+        let frameLoader = aSubject.QueryInterface(Ci.nsIFrameLoader);
+        if (!frameLoader.ownerIsBrowserOrAppFrame) {
+          return;
+        }
+        this._handleMessageManager(frameLoader.messageManager);
         break;
       }
     }
diff --git a/b2g/components/ErrorPage.jsm b/b2g/components/ErrorPage.jsm
index 8b6c2985e638..ba9cb3af03e0 100644
--- a/b2g/components/ErrorPage.jsm
+++ b/b2g/components/ErrorPage.jsm
@@ -150,12 +150,16 @@ let ErrorPage = {
   },
 
   init: function errorPageInit() {
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-shown', false);
   },
 
   observe: function errorPageObserve(aSubject, aTopic, aData) {
     let frameLoader = aSubject.QueryInterface(Ci.nsIFrameLoader);
+    // Ignore notifications that aren't from a BrowserOrApp
+    if (!frameLoader.ownerIsBrowserOrAppFrame) {
+      return;
+    }
     let mm = frameLoader.messageManager;
 
     // This won't happen from dom/ipc/preload.js in non-OOP builds.
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 306a90fedc4c..9c74e96b4ae9 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -948,9 +948,9 @@ nsFrameLoader::ShowRemoteFrame(const nsIntSize& size,
     EnsureMessageManager();
 
     nsCOMPtr<nsIObserverService> os = services::GetObserverService();
-    if (OwnerIsBrowserOrAppFrame() && os && !mRemoteBrowserInitialized) {
+    if (os && !mRemoteBrowserInitialized) {
       os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
-                          "remote-browser-frame-shown", nullptr);
+                          "remote-browser-shown", nullptr);
       mRemoteBrowserInitialized = true;
     }
   } else {
@@ -1685,18 +1685,16 @@ nsFrameLoader::MaybeCreateDocShell()
     mDocShell->SetIsBrowserInsideApp(containingAppId);
   }
 
-  if (OwnerIsBrowserOrAppFrame()) {
-    nsCOMPtr<nsIObserverService> os = services::GetObserverService();
-    if (os) {
-      os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
-                          "in-process-browser-or-app-frame-shown", nullptr);
-    }
+  nsCOMPtr<nsIObserverService> os = services::GetObserverService();
+  if (os) {
+    os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
+                        "inprocess-browser-shown", nullptr);
+  }
 
-    if (mMessageManager) {
-      mMessageManager->LoadFrameScript(
-        NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js"),
-        /* allowDelayedLoad = */ true);
-    }
+  if (OwnerIsBrowserOrAppFrame() && mMessageManager) {
+    mMessageManager->LoadFrameScript(
+      NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js"),
+      /* allowDelayedLoad = */ true);
   }
 
   return NS_OK;
diff --git a/dom/browser-element/BrowserElementParent.js b/dom/browser-element/BrowserElementParent.js
index 9bd9dd4280a3..b4741d477e0a 100644
--- a/dom/browser-element/BrowserElementParent.js
+++ b/dom/browser-element/BrowserElementParent.js
@@ -65,8 +65,8 @@ BrowserElementParentFactory.prototype = {
     // alive for as long as its frame element lives.
     this._bepMap = new WeakMap();
 
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', /* ownsWeak = */ true);
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', /* ownsWeak = */ true);
+    Services.obs.addObserver(this, 'remote-browser-shown', /* ownsWeak = */ true);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', /* ownsWeak = */ true);
   },
 
   _browserFramesPrefEnabled: function() {
@@ -79,11 +79,19 @@ BrowserElementParentFactory.prototype = {
   },
 
   _observeInProcessBrowserFrameShown: function(frameLoader) {
+    // Ignore notifications that aren't from a BrowserOrApp
+    if (!frameLoader.QueryInterface(Ci.nsIFrameLoader).ownerIsBrowserOrAppFrame) {
+      return;
+    }
     debug("In-process browser frame shown " + frameLoader);
     this._createBrowserElementParent(frameLoader, /* hasRemoteFrame = */ false);
   },
 
   _observeRemoteBrowserFrameShown: function(frameLoader) {
+    // Ignore notifications that aren't from a BrowserOrApp
+    if (!frameLoader.QueryInterface(Ci.nsIFrameLoader).ownerIsBrowserOrAppFrame) {
+      return;
+    }
     debug("Remote browser frame shown " + frameLoader);
     this._createBrowserElementParent(frameLoader, /* hasRemoteFrame = */ true);
   },
@@ -103,10 +111,10 @@ BrowserElementParentFactory.prototype = {
         this._init();
       }
       break;
-    case 'remote-browser-frame-shown':
+    case 'remote-browser-shown':
       this._observeRemoteBrowserFrameShown(subject);
       break;
-    case 'in-process-browser-or-app-frame-shown':
+    case 'inprocess-browser-shown':
       this._observeInProcessBrowserFrameShown(subject);
       break;
     case 'content-document-global-created':
diff --git a/dom/inputmethod/Keyboard.jsm b/dom/inputmethod/Keyboard.jsm
index 14b56041be66..94456ff8d510 100644
--- a/dom/inputmethod/Keyboard.jsm
+++ b/dom/inputmethod/Keyboard.jsm
@@ -44,8 +44,8 @@ this.Keyboard = {
   },
 
   init: function keyboardInit() {
-    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
-    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
+    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-shown', false);
     Services.obs.addObserver(this, 'oop-frameloader-crashed', false);
 
     for (let name of this._messageNames)
@@ -63,6 +63,10 @@ this.Keyboard = {
         ppmm.broadcastAsyncMessage('Keyboard:FocusChange', { 'type': 'blur' });
       }
     } else {
+      // Ignore notifications that aren't from a BrowserOrApp
+      if (!frameLoader.ownerIsBrowserOrAppFrame) {
+        return;
+      }
       this.initFormsFrameScript(mm);
     }
   },
diff --git a/dom/ipc/ProcessPriorityManager.cpp b/dom/ipc/ProcessPriorityManager.cpp
index d6bb96cd352c..b9c34d7801cc 100644
--- a/dom/ipc/ProcessPriorityManager.cpp
+++ b/dom/ipc/ProcessPriorityManager.cpp
@@ -602,7 +602,7 @@ ParticularProcessPriorityManager::Init()
   nsCOMPtr<nsIObserverService> os = services::GetObserverService();
   if (os) {
     os->AddObserver(this, "audio-channel-process-changed", /* ownsWeak */ true);
-    os->AddObserver(this, "remote-browser-frame-shown", /* ownsWeak */ true);
+    os->AddObserver(this, "remote-browser-shown", /* ownsWeak */ true);
     os->AddObserver(this, "ipc:browser-destroyed", /* ownsWeak */ true);
     os->AddObserver(this, "frameloader-visible-changed", /* ownsWeak */ true);
   }
@@ -674,7 +674,7 @@ ParticularProcessPriorityManager::Observe(nsISupports* aSubject,
 
   if (topic.EqualsLiteral("audio-channel-process-changed")) {
     OnAudioChannelProcessChanged(aSubject);
-  } else if (topic.EqualsLiteral("remote-browser-frame-shown")) {
+  } else if (topic.EqualsLiteral("remote-browser-shown")) {
     OnRemoteBrowserFrameShown(aSubject);
   } else if (topic.EqualsLiteral("ipc:browser-destroyed")) {
     OnTabParentDestroyed(aSubject);
@@ -747,6 +747,13 @@ ParticularProcessPriorityManager::OnRemoteBrowserFrameShown(nsISupports* aSubjec
   nsCOMPtr<nsIFrameLoader> fl = do_QueryInterface(aSubject);
   NS_ENSURE_TRUE_VOID(fl);
 
+  // Ignore notifications that aren't from a BrowserOrApp
+  bool isBrowserOrApp;
+  fl->GetOwnerIsBrowserOrAppFrame(&isBrowserOrApp);
+  if (!isBrowserOrApp) {
+    return;
+  }
+
   nsCOMPtr<nsITabParent> tp;
   fl->GetTabParent(getter_AddRefs(tp));
   NS_ENSURE_TRUE_VOID(tp);

From 59eb74b6f543a3a03d5707847cb8f138e35f9f7f Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Thu, 12 Dec 2013 19:38:49 -0800
Subject: [PATCH 108/459] Bug 944492, part 1 - Make XPCWrappedJS use the purple
 buffer. r=smaug

---
 js/xpconnect/src/XPCWrappedJS.cpp | 128 ++++++++++++++++++++----------
 js/xpconnect/src/xpcprivate.h     |  15 ++--
 2 files changed, 92 insertions(+), 51 deletions(-)

diff --git a/js/xpconnect/src/XPCWrappedJS.cpp b/js/xpconnect/src/XPCWrappedJS.cpp
index f97b28c84ca2..f0217a990cf2 100644
--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -16,6 +16,40 @@ using namespace mozilla;
 
 // NOTE: much of the fancy footwork is done in xpcstubs.cpp
 
+
+// nsXPCWrappedJS lifetime.
+//
+// An nsXPCWrappedJS is either rooting its JS object or is subject to finalization.
+// The subject-to-finalization state lets wrappers support
+// nsSupportsWeakReference in the case where the underlying JS object
+// is strongly owned, but the wrapper itself is only weakly owned.
+//
+// A wrapper is rooting its JS object whenever its refcount is greater than 1. In
+// this state, root wrappers are always added to the cycle collector graph. The
+// wrapper keeps around an extra refcount, added in the constructor, to support
+// the possibility of an eventual transition to the subject-to-finalization state.
+// This extra refcount is ignored by the cycle collector, which traverses the "self"
+// edge for this refcount.
+//
+// When the refcount of a rooting wrapper drops to 1, if there is no weak reference
+// to the wrapper (which can only happen for the root wrapper), it is immediately
+// Destroy()'d. Otherwise, it becomes subject to finalization.
+//
+// When a wrapper is subject to finalization, the wrapper has a refcount of 1. It is
+// now owned exclusively by its JS object. Either a weak reference will be turned into
+// a strong ref which will bring its refcount up to 2 and change the wrapper back to
+// the rooting state, or it will stay alive until the JS object dies. If the JS object
+// dies, then when XPCJSRuntime::FinalizeCallback calls FindDyingJSObjects
+// it will find the wrapper and call Release() in it, destroying the wrapper.
+// Otherwise, the wrapper will stay alive, even if it no longer has a weak reference
+// to it.
+//
+// When the wrapper is subject to finalization, it is kept alive by an implicit reference
+// from the JS object which is invisible to the cycle collector, so the cycle collector
+// does not traverse any children of wrappers that are subject to finalization. This will
+// result in a leak if a wrapper in the non-rooting state has an aggregated native that
+// keeps alive the wrapper's JS object.  See bug 947049.
+
 NS_IMETHODIMP
 NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
    (void *p, nsCycleCollectionTraversalCallback &cb)
@@ -37,14 +71,17 @@ NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
         NS_IMPL_CYCLE_COLLECTION_DESCRIBE(nsXPCWrappedJS, refcnt)
     }
 
-    // nsXPCWrappedJS keeps its own refcount artificially at or above 1, see the
-    // comment above nsXPCWrappedJS::AddRef.
+    // A wrapper that is subject to finalization will only die when its JS object dies.
+    if (tmp->IsSubjectToFinalization())
+        return NS_OK;
+
+    // Don't let the extra reference for nsSupportsWeakReference keep a wrapper that is
+    // not subject to finalization alive.
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "self");
     cb.NoteXPCOMChild(s);
 
-    if (refcnt > 1) {
-        // nsXPCWrappedJS roots its mJSObj when its refcount is > 1, see
-        // the comment above nsXPCWrappedJS::AddRef.
+    if (tmp->IsValid()) {
+        MOZ_ASSERT(refcnt > 1);
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mJSObj");
         cb.NoteJSChild(tmp->GetJSObjectPreserveColor());
     }
@@ -54,7 +91,7 @@ NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
         cb.NoteXPCOMChild(tmp->GetAggregatedNativeObject());
     } else {
         NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "root");
-        cb.NoteXPCOMChild(static_cast<nsIXPConnectWrappedJS*>(tmp->GetRootWrapper()));
+        cb.NoteXPCOMChild(ToSupports(tmp->GetRootWrapper()));
     }
 
     return NS_OK;
@@ -127,37 +164,22 @@ nsXPCWrappedJS::QueryInterface(REFNSIID aIID, void** aInstancePtr)
 }
 
 
-// Refcounting is now similar to that used in the chained (pre-flattening)
-// wrappednative system.
-//
-// We are now holding an extra refcount for nsISupportsWeakReference support.
-//
-// Non-root wrappers remove themselves from the chain in their destructors.
-// We root the JSObject as the refcount transitions from 1->2. And we unroot
-// the JSObject when the refcount transitions from 2->1.
-//
-// When the transition from 2->1 is made and no one holds a weak ref to the
-// (aggregated) object then we decrement the refcount again to 0 (and
-// destruct) . However, if a weak ref is held at the 2->1 transition, then we
-// leave the refcount at 1 to indicate that state. This leaves the JSObject
-// no longer rooted by us and (as far as we know) subject to possible
-// collection. Code in XPCJSRuntime watches for JS gc to happen and will do
-// the final release on wrappers whose JSObjects get finalized. Note that
-// even after tranistioning to this refcount-of-one state callers might do
-// an addref and cause us to re-root the JSObject and continue on more normally.
+// For a description of nsXPCWrappedJS lifetime and reference counting, see
+// the comment at the top of this file.
 
 nsrefcnt
 nsXPCWrappedJS::AddRef(void)
 {
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
-    nsrefcnt cnt = ++mRefCnt;
+
+    MOZ_ASSERT(int32_t(mRefCnt) >= 0, "illegal refcnt");
+    nsrefcnt cnt = mRefCnt.incr();
     NS_LOG_ADDREF(this, cnt, "nsXPCWrappedJS", sizeof(*this));
 
     if (2 == cnt && IsValid()) {
         GetJSObject(); // Unmark gray JSObject.
-        XPCJSRuntime* rt = mClass->GetRuntime();
-        rt->AddWrappedJSRoot(this);
+        mClass->GetRuntime()->AddWrappedJSRoot(this);
     }
 
     return cnt;
@@ -168,31 +190,44 @@ nsXPCWrappedJS::Release(void)
 {
     if (!MOZ_LIKELY(NS_IsMainThread()))
         MOZ_CRASH();
-    NS_PRECONDITION(0 != mRefCnt, "dup release");
+    MOZ_ASSERT(int32_t(mRefCnt) > 0, "dup release");
+    NS_ASSERT_OWNINGTHREAD(nsXPCWrappedJS);
 
-do_decrement:
-
-    nsrefcnt cnt = --mRefCnt;
+    bool shouldDelete = false;
+    nsISupports *base = NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Upcast(this);
+    nsrefcnt cnt = mRefCnt.decr(base, &shouldDelete);
     NS_LOG_RELEASE(this, cnt, "nsXPCWrappedJS");
 
     if (0 == cnt) {
-        delete this;   // also unlinks us from chain
-        return 0;
-    }
-    if (1 == cnt) {
+        if (MOZ_UNLIKELY(shouldDelete)) {
+            mRefCnt.stabilizeForDeletion();
+            DeleteCycleCollectable();
+        } else {
+            mRefCnt.incr();
+            Destroy();
+            mRefCnt.decr(base);
+        }
+    } else if (1 == cnt) {
         if (IsValid())
             RemoveFromRootSet();
 
-        // If we are not the root wrapper or if we are not being used from a
-        // weak reference, then this extra ref is not needed and we can let
-        // ourself be deleted.
-        // Note: HasWeakReferences() could only return true for the root.
+        // If we are not a root wrapper being used from a weak reference,
+        // then the extra ref is not needed and we can let outselves be
+        // deleted.
         if (!HasWeakReferences())
-            goto do_decrement;
+            return Release();
+
+        MOZ_ASSERT(IsRootWrapper(), "Only root wrappers should have weak references");
     }
     return cnt;
 }
 
+NS_IMETHODIMP_(void)
+nsXPCWrappedJS::DeleteCycleCollectable(void)
+{
+    delete this;
+}
+
 void
 nsXPCWrappedJS::TraceJS(JSTracer* trc)
 {
@@ -345,9 +380,12 @@ nsXPCWrappedJS::nsXPCWrappedJS(JSContext* cx,
 {
     InitStub(GetClass()->GetIID());
 
-    // intentionally do double addref - see Release().
+    // There is an extra AddRef to support weak references to wrappers
+    // that are subject to finalization. See the top of the file for more
+    // details.
     NS_ADDREF_THIS();
     NS_ADDREF_THIS();
+
     NS_ADDREF(aClass);
     NS_IF_ADDREF(mOuter);
 
@@ -358,7 +396,13 @@ nsXPCWrappedJS::nsXPCWrappedJS(JSContext* cx,
 
 nsXPCWrappedJS::~nsXPCWrappedJS()
 {
-    NS_PRECONDITION(0 == mRefCnt, "refcounting error");
+    Destroy();
+}
+
+void
+nsXPCWrappedJS::Destroy()
+{
+    MOZ_ASSERT(1 == int32_t(mRefCnt), "should be stabilized for deletion");
 
     if (IsRootWrapper()) {
         XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 99c2265a685b..2d9f539eba02 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2464,14 +2464,13 @@ class nsXPCWrappedJS : protected nsAutoXPTCStub,
                        public XPCRootSetElem
 {
 public:
-    NS_DECL_THREADSAFE_ISUPPORTS
+    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_NSIXPCONNECTJSOBJECTHOLDER
     NS_DECL_NSIXPCONNECTWRAPPEDJS
     NS_DECL_NSISUPPORTSWEAKREFERENCE
     NS_DECL_NSIPROPERTYBAG
 
     NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXPCWrappedJS, nsIXPConnectWrappedJS)
-    void DeleteCycleCollectable() {}
 
     NS_IMETHOD CallMethod(uint16_t methodIndex,
                           const XPTMethodDescriptor *info,
@@ -2513,12 +2512,9 @@ public:
     bool IsValid() const {return mJSObj != nullptr;}
     void SystemIsBeingShutDown();
 
-    // This is used by XPCJSRuntime::GCCallback to find wrappers that no
-    // longer root their JSObject and are only still alive because they
-    // were being used via nsSupportsWeakReference at the time when their
-    // last (outside) reference was released. Wrappers that fit into that
-    // category are only deleted when we see that their corresponding JSObject
-    // is to be finalized.
+    // These two methods are used by JSObject2WrappedJSMap::FindDyingJSObjects
+    // to find non-rooting wrappers for dying JS objects. See the top of
+    // XPCWrappedJS.cpp for more details.
     bool IsSubjectToFinalization() const {return IsValid() && mRefCnt == 1;}
     bool IsObjectAboutToBeFinalized() {return JS_IsAboutToBeFinalized(&mJSObj);}
 
@@ -2537,7 +2533,8 @@ protected:
                    nsXPCWrappedJS* root,
                    nsISupports* aOuter);
 
-   void Unlink();
+    void Destroy();
+    void Unlink();
 
 private:
     JS::Heap<JSObject*> mJSObj;

From a324b39e7f60e8757e93492f604ba8ab1d5449d0 Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Thu, 12 Dec 2013 19:38:50 -0800
Subject: [PATCH 109/459] Bug 944492, part 2 - Make XPCWrappedJS a proper
 skippable class. r=smaug

---
 js/xpconnect/src/XPCJSRuntime.cpp | 37 +---------------------
 js/xpconnect/src/XPCWrappedJS.cpp | 51 +++++++++++++++++++++++++++++++
 js/xpconnect/src/xpcprivate.h     |  3 +-
 3 files changed, 54 insertions(+), 37 deletions(-)

diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 1a12e11d83b3..2f33a01747fa 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -668,35 +668,6 @@ XPCJSRuntime::SuspectWrappedNative(XPCWrappedNative *wrapper,
         cb.NoteJSRoot(obj);
 }
 
-bool
-CanSkipWrappedJS(nsXPCWrappedJS *wrappedJS)
-{
-    JSObject *obj = wrappedJS->GetJSObjectPreserveColor();
-    // If traversing wrappedJS wouldn't release it, nor
-    // cause any other objects to be added to the graph, no
-    // need to add it to the graph at all.
-    bool isRootWrappedJS = wrappedJS->IsRootWrapper();
-    if (nsCCUncollectableMarker::sGeneration &&
-        (!obj || !xpc_IsGrayGCThing(obj)) &&
-        !wrappedJS->IsSubjectToFinalization() &&
-        (isRootWrappedJS || CanSkipWrappedJS(wrappedJS->GetRootWrapper()))) {
-        if (!wrappedJS->IsAggregatedToNative() || !isRootWrappedJS) {
-            return true;
-        } else {
-            nsISupports* agg = wrappedJS->GetAggregatedNativeObject();
-            nsXPCOMCycleCollectionParticipant* cp = nullptr;
-            CallQueryInterface(agg, &cp);
-            nsISupports* canonical = nullptr;
-            agg->QueryInterface(NS_GET_IID(nsCycleCollectionISupports),
-                                reinterpret_cast<void**>(&canonical));
-            if (cp && canonical && cp->CanSkipInCC(canonical)) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
 void
 XPCJSRuntime::TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback &cb)
 {
@@ -714,13 +685,7 @@ XPCJSRuntime::TraverseAdditionalNativeRoots(nsCycleCollectionNoteRootCallback &c
     }
 
     for (XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot()) {
-        nsXPCWrappedJS *wrappedJS = static_cast<nsXPCWrappedJS*>(e);
-        if (!cb.WantAllTraces() &&
-            CanSkipWrappedJS(wrappedJS)) {
-            continue;
-        }
-
-        cb.NoteXPCOMRoot(static_cast<nsIXPConnectWrappedJS *>(wrappedJS));
+        cb.NoteXPCOMRoot(ToSupports(static_cast<nsXPCWrappedJS*>(e)));
     }
 }
 
diff --git a/js/xpconnect/src/XPCWrappedJS.cpp b/js/xpconnect/src/XPCWrappedJS.cpp
index f0217a990cf2..3480ef0f099b 100644
--- a/js/xpconnect/src/XPCWrappedJS.cpp
+++ b/js/xpconnect/src/XPCWrappedJS.cpp
@@ -8,6 +8,7 @@
 
 #include "xpcprivate.h"
 #include "jsprf.h"
+#include "nsCCUncollectableMarker.h"
 #include "nsCxPusher.h"
 #include "nsContentUtils.h"
 #include "nsThreadUtils.h"
@@ -50,6 +51,42 @@ using namespace mozilla;
 // result in a leak if a wrapper in the non-rooting state has an aggregated native that
 // keeps alive the wrapper's JS object.  See bug 947049.
 
+
+// If traversing wrappedJS wouldn't release it, nor cause any other objects to be
+// added to the graph, there is no need to add it to the graph at all.
+bool
+nsXPCWrappedJS::CanSkip()
+{
+    if (!nsCCUncollectableMarker::sGeneration)
+        return false;
+
+    if (IsSubjectToFinalization())
+        return true;
+
+    // If this wrapper holds a gray object, need to trace it.
+    JSObject *obj = GetJSObjectPreserveColor();
+    if (obj && xpc_IsGrayGCThing(obj))
+        return false;
+
+    // For non-root wrappers, check if the root wrapper will be
+    // added to the CC graph.
+    if (!IsRootWrapper())
+        return mRoot->CanSkip();
+
+    // For the root wrapper, check if there is an aggregated
+    // native object that will be added to the CC graph.
+    if (!IsAggregatedToNative())
+        return true;
+
+    nsISupports* agg = GetAggregatedNativeObject();
+    nsXPCOMCycleCollectionParticipant* cp = nullptr;
+    CallQueryInterface(agg, &cp);
+    nsISupports* canonical = nullptr;
+    agg->QueryInterface(NS_GET_IID(nsCycleCollectionISupports),
+                        reinterpret_cast<void**>(&canonical));
+    return cp && canonical && cp->CanSkipThis(canonical);
+}
+
 NS_IMETHODIMP
 NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Traverse
    (void *p, nsCycleCollectionTraversalCallback &cb)
@@ -103,6 +140,20 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXPCWrappedJS)
     tmp->Unlink();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
+// XPCJSRuntime keeps a table of WJS, so we can remove them from
+// the purple buffer in between CCs.
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsXPCWrappedJS)
+    return true;
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsXPCWrappedJS)
+    return tmp->CanSkip();
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_BEGIN(nsXPCWrappedJS)
+    return tmp->CanSkip();
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_END
+
 NS_IMETHODIMP
 nsXPCWrappedJS::AggregatedQueryInterface(REFNSIID aIID, void** aInstancePtr)
 {
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 2d9f539eba02..249b21911746 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2470,7 +2470,7 @@ public:
     NS_DECL_NSISUPPORTSWEAKREFERENCE
     NS_DECL_NSIPROPERTYBAG
 
-    NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXPCWrappedJS, nsIXPConnectWrappedJS)
+    NS_DECL_CYCLE_COLLECTION_SKIPPABLE_CLASS_AMBIGUOUS(nsXPCWrappedJS, nsIXPConnectWrappedJS)
 
     NS_IMETHOD CallMethod(uint16_t methodIndex,
                           const XPTMethodDescriptor *info,
@@ -2533,6 +2533,7 @@ protected:
                    nsXPCWrappedJS* root,
                    nsISupports* aOuter);
 
+    bool CanSkip();
     void Destroy();
     void Unlink();
 

From f853c97cb8422c050ea8c3f5394552f35f7c3587 Mon Sep 17 00:00:00 2001
From: David Anderson <dvander@alliedmods.net>
Date: Thu, 12 Dec 2013 20:29:14 -0800
Subject: [PATCH 110/459] Ensure that the software compositor never uses
 deprecated textures (bug 947038, r=mattwoodrow).

---
 dom/ipc/TabChild.cpp                          |   5 +
 gfx/layers/basic/BasicCompositor.cpp          | 155 ------------------
 gfx/layers/client/ContentClient.cpp           |   5 +
 gfx/layers/composite/TextureHost.cpp          |   8 -
 gfx/layers/composite/ThebesLayerComposite.cpp |   1 +
 gfx/thebes/gfxPlatform.cpp                    |  20 +++
 gfx/thebes/gfxPlatform.h                      |   5 +-
 widget/xpwidgets/nsBaseWidget.cpp             |   2 +
 8 files changed, 37 insertions(+), 164 deletions(-)

diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 8306641297ff..7e88a30e1b88 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -72,6 +72,7 @@
 #include "APZCCallbackHelper.h"
 #include "nsILoadContext.h"
 #include "ipc/nsGUIEventIPC.h"
+#include "gfxPlatform.h"
 
 #ifdef DEBUG
 #include "PCOMContentPermissionRequestChild.h"
@@ -2281,6 +2282,10 @@ TabChild::InitRenderingState()
           NS_WARNING("failed to properly allocate layer transaction");
           return false;
         }
+
+        // Track which compositor backend is in use (see bug 947038). This can
+        // be removed when deprecated textures are removed.
+        gfxPlatform::GetPlatform()->SetCompositorBackend(mTextureFactoryIdentifier.mParentBackend);
     } else {
         // Pushing transactions to the parent content.
         shadowManager = remoteFrame->SendPLayerTransactionConstructor();
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index cc934831b3b8..0bc966af4163 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -63,161 +63,6 @@ public:
   RefPtr<gfx::DataSourceSurface> mSurface;
 };
 
-/**
- * Texture source and host implementaion for software compositing.
- */
-class DeprecatedTextureHostBasic : public DeprecatedTextureHost
-                                 , public TextureSourceBasic
-{
-public:
-  DeprecatedTextureHostBasic()
-  : mCompositor(nullptr)
-  {}
-
-  SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
-
-  virtual IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
-
-  virtual TextureSourceBasic* AsSourceBasic() MOZ_OVERRIDE { return this; }
-
-  SourceSurface *GetSurface() MOZ_OVERRIDE { return mSurface; }
-
-  virtual void SetCompositor(Compositor* aCompositor)
-  {
-    mCompositor = static_cast<BasicCompositor*>(aCompositor);
-  }
-
-  virtual const char *Name() { return "DeprecatedTextureHostBasic"; }
-
-protected:
-  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
-                          nsIntRegion *aRegion,
-                          nsIntPoint*) MOZ_OVERRIDE
-  {
-    AutoOpenSurface surf(OPEN_READ_ONLY, aImage);
-    nsRefPtr<gfxASurface> surface = ShadowLayerForwarder::OpenDescriptor(OPEN_READ_ONLY, aImage);
-    nsRefPtr<gfxImageSurface> image = surface->GetAsImageSurface();
-    mFormat = ImageFormatToSurfaceFormat(image->Format());
-    mSize = IntSize(image->Width(), image->Height());
-    mSurface = Factory::CreateWrappingDataSourceSurface(image->Data(),
-                                                        image->Stride(),
-                                                        mSize,
-                                                        mFormat);
-  }
-
-  virtual bool EnsureSurface() {
-    return true;
-  }
-
-  virtual bool Lock() MOZ_OVERRIDE {
-    return EnsureSurface();
-  }
-
-  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE {
-    if (!mSurface) {
-        return nullptr;
-    }
-    return mSurface->GetDataSurface();
-  }
-
-  BasicCompositor *mCompositor;
-  RefPtr<SourceSurface> mSurface;
-  IntSize mSize;
-  SurfaceFormat mFormat;
-};
-
-void
-DeserializerToPlanarYCbCrImageData(YCbCrImageDataDeserializer& aDeserializer, PlanarYCbCrData& aData)
-{
-  aData.mYChannel = aDeserializer.GetYData();
-  aData.mYStride = aDeserializer.GetYStride();
-  aData.mYSize = aDeserializer.GetYSize();
-  aData.mCbChannel = aDeserializer.GetCbData();
-  aData.mCrChannel = aDeserializer.GetCrData();
-  aData.mCbCrStride = aDeserializer.GetCbCrStride();
-  aData.mCbCrSize = aDeserializer.GetCbCrSize();
-  aData.mPicSize = aDeserializer.GetYSize();
-}
-
-class YCbCrDeprecatedTextureHostBasic : public DeprecatedTextureHostBasic
-{
-public:
-  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
-                          nsIntRegion *aRegion,
-                          nsIntPoint*) MOZ_OVERRIDE
-  {
-    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
-    mSurface = nullptr;
-    ConvertImageToRGB(aImage);
-  }
-
-  virtual void SwapTexturesImpl(const SurfaceDescriptor& aImage,
-                                nsIntRegion* aRegion) MOZ_OVERRIDE
-  {
-    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
-    mSurface = nullptr;
-  }
-
-  virtual bool EnsureSurface() MOZ_OVERRIDE
-  {
-    if (mSurface) {
-      return true;
-    }
-    if (!mBuffer) {
-      return false;
-    }
-    return ConvertImageToRGB(*mBuffer);
-  }
-
-  bool ConvertImageToRGB(const SurfaceDescriptor& aImage)
-  {
-    YCbCrImageDataDeserializer deserializer(aImage.get_YCbCrImage().data().get<uint8_t>());
-    PlanarYCbCrData data;
-    DeserializerToPlanarYCbCrImageData(deserializer, data);
-
-    gfxImageFormat format = gfxImageFormatRGB24;
-    gfxIntSize size;
-    gfxUtils::GetYCbCrToRGBDestFormatAndSize(data, format, size);
-    if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
-        size.height > PlanarYCbCrImage::MAX_DIMENSION) {
-      NS_ERROR("Illegal image dest width or height");
-      return false;
-    }
-
-    mSize = ToIntSize(size);
-    mFormat = (format == gfxImageFormatRGB24)
-              ? FORMAT_B8G8R8X8
-              : FORMAT_B8G8R8A8;
-
-    RefPtr<DataSourceSurface> surface = Factory::CreateDataSourceSurface(mSize, mFormat);
-    gfxUtils::ConvertYCbCrToRGB(data, format, size,
-                                surface->GetData(),
-                                surface->Stride());
-
-    mSurface = surface;
-    return true;
-  }
-};
-
-TemporaryRef<DeprecatedTextureHost>
-CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
-                             uint32_t aTextureHostFlags,
-                             uint32_t aTextureFlags)
-{
-  RefPtr<DeprecatedTextureHost> result = nullptr;
-  if (aDescriptorType == SurfaceDescriptor::TYCbCrImage) {
-    result = new YCbCrDeprecatedTextureHostBasic();
-  } else {
-    MOZ_ASSERT(aDescriptorType == SurfaceDescriptor::TShmem ||
-               aDescriptorType == SurfaceDescriptor::TMemoryImage,
-               "We can only support Shmem currently");
-    result = new DeprecatedTextureHostBasic();
-  }
-
-  result->SetFlags(aTextureFlags);
-  return result.forget();
-}
-
 BasicCompositor::BasicCompositor(nsIWidget *aWidget)
   : mWidget(aWidget)
 {
diff --git a/gfx/layers/client/ContentClient.cpp b/gfx/layers/client/ContentClient.cpp
index 544784812d91..157c01970fcf 100644
--- a/gfx/layers/client/ContentClient.cpp
+++ b/gfx/layers/client/ContentClient.cpp
@@ -58,6 +58,11 @@ ContentClient::CreateContentClient(CompositableForwarder* aForwarder)
   useDeprecatedTextures = gfxPlatform::GetPlatform()->UseDeprecatedTextures();
 #endif
 
+  // Always use new textures for the basic compositor.
+  if (backend == LAYERS_BASIC) {
+    useDeprecatedTextures = false;
+  }
+
 #ifdef XP_WIN
   if (backend == LAYERS_D3D11) {
     useDoubleBuffering = !!gfxWindowsPlatform::GetPlatform()->GetD2DDevice();
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 5e4da901d9ac..4caeb0b8030a 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -84,10 +84,6 @@ TextureHost::AsTextureHost(PTextureParent* actor)
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostOGL(SurfaceDescriptorType aDescriptorType,
                                                            uint32_t aDeprecatedTextureHostFlags,
                                                            uint32_t aTextureFlags);
-// implemented in BasicCompositor.cpp
-TemporaryRef<DeprecatedTextureHost> CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
-                                                             uint32_t aDeprecatedTextureHostFlags,
-                                                             uint32_t aTextureFlags);
 
 #ifdef XP_WIN
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostD3D9(SurfaceDescriptorType aDescriptorType,
@@ -127,10 +123,6 @@ DeprecatedTextureHost::CreateDeprecatedTextureHost(SurfaceDescriptorType aDescri
                                           aDeprecatedTextureHostFlags,
                                           aTextureFlags);
 #endif
-    case LAYERS_BASIC:
-      return CreateBasicDeprecatedTextureHost(aDescriptorType,
-                                          aDeprecatedTextureHostFlags,
-                                          aTextureFlags);
     default:
       MOZ_CRASH("Couldn't create texture host");
   }
diff --git a/gfx/layers/composite/ThebesLayerComposite.cpp b/gfx/layers/composite/ThebesLayerComposite.cpp
index 1f35533634d0..7a9cc3f00c45 100644
--- a/gfx/layers/composite/ThebesLayerComposite.cpp
+++ b/gfx/layers/composite/ThebesLayerComposite.cpp
@@ -138,6 +138,7 @@ ThebesLayerComposite::RenderLayer(const nsIntRect& aClipRect)
 
   mBuffer->SetPaintWillResample(MayResample());
 
+  mBuffer->SetCompositor(mCompositeManager->GetCompositor());
   mBuffer->Composite(effectChain,
                      GetEffectiveOpacity(),
                      transform,
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index b563f75429e4..89c74cc2c52e 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -281,6 +281,7 @@ gfxPlatform::gfxPlatform()
   , mDrawLayerBorders(false)
   , mDrawTileBorders(false)
   , mDrawBigImageBorders(false)
+  , mCompositorBackend(LAYERS_NONE)
 {
     mUseHarfBuzzScripts = UNINITIALIZED_VALUE;
     mAllowDownloadableFonts = UNINITIALIZED_VALUE;
@@ -2213,3 +2214,22 @@ gfxPlatform::ComponentAlphaEnabled()
   InitLayersAccelerationPrefs();
   return sComponentAlphaEnabled;
 }
+
+void
+gfxPlatform::SetCompositorBackend(mozilla::layers::LayersBackend backend)
+{
+  // The compositor backend should always be the same after one has been chosen.
+  MOZ_ASSERT(mCompositorBackend == LAYERS_NONE || mCompositorBackend == backend);
+  if (mCompositorBackend == LAYERS_NONE) {
+    mCompositorBackend = backend;
+  }
+}
+
+bool
+gfxPlatform::UseDeprecatedTextures() const
+{
+  if (mCompositorBackend == LAYERS_BASIC) {
+    return false;
+  }
+  return mLayersUseDeprecated;
+}
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index 27ff830fd51e..64d138698558 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -20,6 +20,7 @@
 #include "mozilla/RefPtr.h"
 #include "GfxInfoCollector.h"
 
+#include "mozilla/layers/LayersTypes.h"
 #include "mozilla/layers/CompositorTypes.h"
 
 #ifdef XP_OS2
@@ -619,7 +620,8 @@ public:
      * This method should not be called from the compositor thread.
      */
     bool PreferMemoryOverShmem() const;
-    bool UseDeprecatedTextures() const { return mLayersUseDeprecated; }
+    bool UseDeprecatedTextures() const;
+    void SetCompositorBackend(mozilla::layers::LayersBackend backend);
 
 protected:
     gfxPlatform();
@@ -736,6 +738,7 @@ private:
     bool mDrawLayerBorders;
     bool mDrawTileBorders;
     bool mDrawBigImageBorders;
+    mozilla::layers::LayersBackend mCompositorBackend;
 };
 
 #endif /* GFX_PLATFORM_H */
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index 1916ced3277d..f8f4ce68d058 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -988,6 +988,8 @@ void nsBaseWidget::CreateCompositor(int aWidth, int aHeight)
     ImageBridgeChild::IdentifyCompositorTextureHost(textureFactoryIdentifier);
     WindowUsesOMTC();
 
+    gfxPlatform::GetPlatform()->SetCompositorBackend(textureFactoryIdentifier.mParentBackend);
+
     mLayerManager = lm;
     return;
   }

From db3e8ca04248c1ddfbc4b8e63cc130b44fb7b67b Mon Sep 17 00:00:00 2001
From: Brian Birtles <birtles@gmail.com>
Date: Fri, 13 Dec 2013 13:41:47 +0900
Subject: [PATCH 111/459] Bug 948245 part 1 - Rework and test repeat duration
 calculation; r=dholbert

In order to implement the min attribute properly we need to distinguish between
cases where the repeat duration is less than the active duration so we can apply
the fill mode in the 'gap'. Currently the repeat duration calculation is mostly
contained in GetRepeatDuration (but is hard to make sense of) and partly
contained in the call site CalcActiveEnd. Furthermore, it does not have thorough
tests (there were some unit tests but they were never converted to mochitests).

This patch reworks the repeat duration calculation so it is contained in one
place, easier to read, and thoroughly tested.
---
 content/smil/nsSMILRepeatCount.h              |   6 +-
 content/smil/nsSMILTimedElement.cpp           |  42 +++---
 content/smil/test/mochitest.ini               |   1 +
 .../smil/test/test_smilRepeatDuration.html    | 139 ++++++++++++++++++
 4 files changed, 162 insertions(+), 26 deletions(-)
 create mode 100644 content/smil/test/test_smilRepeatDuration.html

diff --git a/content/smil/nsSMILRepeatCount.h b/content/smil/nsSMILRepeatCount.h
index 18c6d66db618..8561fe4d8bd4 100644
--- a/content/smil/nsSMILRepeatCount.h
+++ b/content/smil/nsSMILRepeatCount.h
@@ -27,7 +27,11 @@ public:
   explicit nsSMILRepeatCount(double aCount)
     : mCount(kNotSet) { SetCount(aCount); }
 
-  operator double() const { return mCount; }
+  operator double() const {
+    MOZ_ASSERT(IsDefinite(),
+      "Converting indefinite or unset repeat count to double");
+    return mCount;
+  }
   bool IsDefinite() const {
     return mCount != kNotSet && mCount != kIndefinite;
   }
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index 3538ca5d78b2..4ffde26796ed 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -1803,11 +1803,7 @@ nsSMILTimedElement::CalcActiveEnd(const nsSMILTimeValue& aBegin,
   NS_ABORT_IF_FALSE(aBegin.IsDefinite(),
     "Indefinite or unresolved begin time in CalcActiveEnd");
 
-  if (mRepeatDur.IsIndefinite()) {
-    result.SetIndefinite();
-  } else {
-    result = GetRepeatDuration();
-  }
+  result = GetRepeatDuration();
 
   if (aEnd.IsDefinite()) {
     nsSMILTime activeDur = aEnd.GetMillis() - aBegin.GetMillis();
@@ -1832,29 +1828,25 @@ nsSMILTimedElement::CalcActiveEnd(const nsSMILTimeValue& aBegin,
 nsSMILTimeValue
 nsSMILTimedElement::GetRepeatDuration() const
 {
-  nsSMILTimeValue result;
-
-  if (mRepeatCount.IsDefinite() && mRepeatDur.IsDefinite()) {
-    if (mSimpleDur.IsDefinite()) {
-      nsSMILTime activeDur =
-        nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis()));
-      result.SetMillis(std::min(activeDur, mRepeatDur.GetMillis()));
-    } else {
-      result = mRepeatDur;
-    }
-  } else if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
-    nsSMILTime activeDur =
-      nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis()));
-    result.SetMillis(activeDur);
-  } else if (mRepeatDur.IsDefinite()) {
-    result = mRepeatDur;
-  } else if (mRepeatCount.IsIndefinite()) {
-    result.SetIndefinite();
+  nsSMILTimeValue multipliedDuration;
+  if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
+    multipliedDuration.SetMillis(
+      nsSMILTime(mRepeatCount * double(mSimpleDur.GetMillis())));
   } else {
-    result = mSimpleDur;
+    multipliedDuration.SetIndefinite();
   }
 
-  return result;
+  nsSMILTimeValue repeatDuration;
+
+  if (mRepeatDur.IsResolved()) {
+    repeatDuration = std::min(multipliedDuration, mRepeatDur);
+  } else if (mRepeatCount.IsSet()) {
+    repeatDuration = multipliedDuration;
+  } else {
+    repeatDuration = mSimpleDur;
+  }
+
+  return repeatDuration;
 }
 
 nsSMILTimeValue
diff --git a/content/smil/test/mochitest.ini b/content/smil/test/mochitest.ini
index 75d43a4371d7..f208c0e7a81f 100644
--- a/content/smil/test/mochitest.ini
+++ b/content/smil/test/mochitest.ini
@@ -38,6 +38,7 @@ support-files =
 [test_smilMappedAttrFromBy.xhtml]
 [test_smilMappedAttrFromTo.xhtml]
 [test_smilMappedAttrPaced.xhtml]
+[test_smilRepeatDuration.html]
 [test_smilRepeatTiming.xhtml]
 [test_smilReset.xhtml]
 [test_smilRestart.xhtml]
diff --git a/content/smil/test/test_smilRepeatDuration.html b/content/smil/test/test_smilRepeatDuration.html
new file mode 100644
index 000000000000..99a95bb7b88e
--- /dev/null
+++ b/content/smil/test/test_smilRepeatDuration.html
@@ -0,0 +1,139 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=948245
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for repeat duration calculation (Bug 948245)</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank"
+href="https://bugzilla.mozilla.org/show_bug.cgi?id=948245">Mozilla Bug 948245</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<svg id="svg" onload="this.pauseAnimations()">
+  <rect>
+    <animate id="a"/>
+    <animate id="b" begin="a.end"/>
+  </rect>
+</svg>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+  // Tests the calculation of the repeat duration which is one of the steps
+  // towards determining the active duration.
+  //
+  // The repeat duration is determined by the following three attributes:
+  //
+  // dur:         may be definite (e.g. '2s') or 'indefinite' (the default)
+  // repeatCount: may be definite (e.g. '2.5'), 'indefinite', or not set
+  // repeatDur:   may be definite (e.g. '5s'), 'indefinite', or not set
+  //
+  // That leaves 18 combinations to test.
+  var testCases =
+    [
+      // 1. repeatDur: definite, repeatCount: definite, dur: definite
+      // (Two test cases here to ensure we get the minimum)
+      { repeatDur: 15, repeatCount: 2, dur: 10, result: 15 },
+      { repeatDur: 25, repeatCount: 2, dur: 10, result: 20 },
+      // 2. repeatDur: indefinite, repeatCount: definite, dur: definite
+      { repeatDur: 'indefinite', repeatCount: 2, dur: 10, result: 20 },
+      // 3. repeatDur: not set, repeatCount: definite, dur: definite
+      { repeatCount: 2, dur: 10, result: 20 },
+      // 4. repeatDur: definite, repeatCount: indefinite, dur: definite
+      { repeatDur: 15, repeatCount: 'indefinite', dur: 10, result: 15 },
+      // 5. repeatDur: indefinite, repeatCount: indefinite, dur: definite
+      { repeatDur: 'indefinite', repeatCount: 'indefinite', dur: 10,
+        result: 'indefinite' },
+      // 6. repeatDur: not set, repeatCount: indefinite, dur: definite
+      { repeatCount: 'indefinite', dur: 10, result: 'indefinite' },
+      // 7. repeatDur: definite, repeatCount: not set, dur: definite
+      { repeatDur: 15, dur: 10, result: 15 },
+      // 8. repeatDur: indefinite, repeatCount: not set, dur: definite
+      { repeatDur: 'indefinite', dur: 10, result: 'indefinite' },
+      // 9. repeatDur: not set, repeatCount: not set, dur: definite
+      { dur: 10, result: 10 },
+      // 10. repeatDur: definite, repeatCount: definite, dur: indefinite
+      { repeatDur: 15, repeatCount: 2, dur: 'indefinite', result: 15 },
+      // 11. repeatDur: indefinite, repeatCount: definite, dur: indefinite
+      { repeatDur: 'indefinite', repeatCount: 2, dur: 'indefinite',
+        result: 'indefinite' },
+      // 12. repeatDur: not set, repeatCount: definite, dur: indefinite
+      { repeatCount: 2, dur: 'indefinite', result: 'indefinite' },
+      // 13. repeatDur: definite, repeatCount: indefinite, dur: indefinite
+      { repeatDur: 15, repeatCount: 'indefinite', dur: 'indefinite',
+        result: 15 },
+      // 14. repeatDur: indefinite, repeatCount: indefinite, dur: indefinite
+      { repeatDur: 'indefinite', repeatCount: 'indefinite', dur: 'indefinite',
+        result: 'indefinite' },
+      // 15. repeatDur: not set, repeatCount: indefinite, dur: indefinite
+      { repeatCount: 'indefinite', dur: 'indefinite', result: 'indefinite' },
+      // 16. repeatDur: definite, repeatCount: not set, dur: indefinite
+      { repeatDur: 15, dur: 'indefinite', result: 15 },
+      // 17. repeatDur: indefinite, repeatCount: not set, dur: indefinite
+      { repeatDur: 'indefinite', dur: 'indefinite', result: 'indefinite' },
+      // 18. repeatDur: not set, repeatCount: not set, dur: indefinite
+      { dur: 'indefinite', result: 'indefinite' }
+    ];
+
+  // We can test the repeat duration by setting these attributes on animation
+  // 'a' and checking the start time of 'b' which is defined to start when 'a'
+  // finishes.
+  //
+  // Since 'a' has no end/min/max attributes the end of its active interval
+  // should coincide with the end of its repeat duration.
+  //
+  // Sometimes the repeat duration is defined to be 'indefinite'. In this case
+  // calling getStartTime on b will throw an exception so we need to catch that
+  // exception and translate it to 'indefinite' as follows:
+  function getRepeatDuration() {
+    try {
+      return $('b').getStartTime();
+    } catch(e) {
+      if (e.name == "InvalidStateError" &&
+          e.code == DOMException.INVALID_STATE_ERR) {
+        return 'indefinite';
+      } else {
+        ok(false, "Unexpected exception: " + e);
+        return null;
+      }
+    }
+  }
+
+  // Animation doesn't start until onload
+  SimpleTest.waitForExplicitFinish();
+  window.addEventListener("load", runTests, false);
+
+  // Run through each of the test cases
+  function runTests() {
+    ok($('svg').animationsPaused(), "should be paused by <svg> load handler");
+
+    testCases.forEach(function(test) {
+      var a = $('a');
+
+      // Set the attributes
+      var msgPieces = [];
+      [ 'repeatDur', 'repeatCount', 'dur' ].forEach(function(attr) {
+        if (typeof test[attr] != "undefined") {
+          a.setAttribute(attr, test[attr].toString());
+          msgPieces.push(attr + ': ' + test[attr].toString());
+        } else {
+          a.removeAttribute(attr);
+          msgPieces.push(attr + ': <not set>');
+        }
+      });
+      var msg = msgPieces.join(', ');
+
+      // Check the result
+      ise(getRepeatDuration(), test.result, msg);
+    });
+
+    SimpleTest.finish();
+  }
+</script>
+</pre>
+</body>
+</html>

From 11ce2f85048d55de49c7d7e49ff48f84ec0daece Mon Sep 17 00:00:00 2001
From: Brian Birtles <birtles@gmail.com>
Date: Fri, 13 Dec 2013 13:41:52 +0900
Subject: [PATCH 112/459] Bug 948245 part 2 - Allow the min attribute to extend
 the active duration; r=dholbert

The min attribute on an animation element can extend the active duration making
it longer than the "repeat duration" (the amount of the time the animation runs
including all repeats). For the remaining time after the repeat duration has
completed until the end of the active duration the animation should apply its
fill behavior.

Previously this was not implemented and min could not extend the active
duration. Allowing this effectively introduces an additional kind of state where
we are both within the active interval but not animating. In this case we
set the animation function (referred to as the "client" for historical reasons)
to inactive so that effectively the timing model is active but the animation
model is inactive.

(In the future we will come up with something a little easier to understand when
we rework this in terms of Web Animations components.)
---
 content/smil/nsSMILAnimationFunction.h    |   9 ++
 content/smil/nsSMILTimedElement.cpp       | 103 +++++++++++++++-------
 content/smil/nsSMILTimedElement.h         |   1 +
 content/smil/test/mochitest.ini           |   1 +
 content/smil/test/test_smilMinTiming.html |  93 +++++++++++++++++++
 layout/reftests/svg/smil/min-1.svg        |  24 +++++
 layout/reftests/svg/smil/reftest.list     |   2 +
 7 files changed, 202 insertions(+), 31 deletions(-)
 create mode 100644 content/smil/test/test_smilMinTiming.html
 create mode 100644 layout/reftests/svg/smil/min-1.svg

diff --git a/content/smil/nsSMILAnimationFunction.h b/content/smil/nsSMILAnimationFunction.h
index 3f233758ac0c..27f4e6f20cb3 100644
--- a/content/smil/nsSMILAnimationFunction.h
+++ b/content/smil/nsSMILAnimationFunction.h
@@ -164,6 +164,15 @@ public:
     return (mIsActive || mIsFrozen);
   }
 
+  /**
+   * Indicates if the animation is active.
+   *
+   * @return  true if the animation is active, false otherwise.
+   */
+  bool IsActive() const {
+    return mIsActive;
+  }
+
   /**
    * Indicates if this animation will replace the passed in result rather than
    * adding to it. Animations that replace the underlying value may be called
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index 4ffde26796ed..0da19cdbf412 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -667,19 +667,32 @@ nsSMILTimedElement::DoSampleAt(nsSMILTime aContainerTime, bool aEndOnly)
           NS_ASSERTION(aContainerTime >= beginTime,
                        "Sample time should not precede current interval");
           nsSMILTime activeTime = aContainerTime - beginTime;
-          SampleSimpleTime(activeTime);
-          // We register our repeat times as milestones (except when we're
-          // seeking) so we should get a sample at exactly the time we repeat.
-          // (And even when we are seeking we want to update
-          // mCurrentRepeatIteration so we do that first before testing the seek
-          // state.)
-          uint32_t prevRepeatIteration = mCurrentRepeatIteration;
-          if (ActiveTimeToSimpleTime(activeTime, mCurrentRepeatIteration)==0 &&
+
+          // The 'min' attribute can cause the active interval to be longer than
+          // the 'repeating interval'.
+          // In that extended period we apply the fill mode.
+          if (GetRepeatDuration() <= nsSMILTimeValue(activeTime)) {
+            if (mClient && mClient->IsActive()) {
+              mClient->Inactivate(mFillMode == FILL_FREEZE);
+            }
+            SampleFillValue();
+          } else {
+            SampleSimpleTime(activeTime);
+
+            // We register our repeat times as milestones (except when we're
+            // seeking) so we should get a sample at exactly the time we repeat.
+            // (And even when we are seeking we want to update
+            // mCurrentRepeatIteration so we do that first before testing the
+            // seek state.)
+            uint32_t prevRepeatIteration = mCurrentRepeatIteration;
+            if (
+              ActiveTimeToSimpleTime(activeTime, mCurrentRepeatIteration)==0 &&
               mCurrentRepeatIteration != prevRepeatIteration &&
               mCurrentRepeatIteration &&
               mSeekState == SEEK_NOT_SEEKING) {
-            FireTimeEventAsync(NS_SMIL_REPEAT,
-                          static_cast<int32_t>(mCurrentRepeatIteration));
+              FireTimeEventAsync(NS_SMIL_REPEAT,
+                            static_cast<int32_t>(mCurrentRepeatIteration));
+            }
           }
         }
       }
@@ -1084,12 +1097,8 @@ nsSMILTimedElement::SetFillMode(const nsAString& aFillModeSpec)
             ? nsSMILFillMode(temp.GetEnumValue())
             : FILL_REMOVE;
 
-  // Check if we're in a fill-able state: i.e. we've played at least one
-  // interval and are now between intervals or at the end of all intervals
-  bool isFillable = HasPlayed() &&
-    (mElementState == STATE_WAITING || mElementState == STATE_POSTACTIVE);
-
-  if (mClient && mFillMode != previousFillMode && isFillable) {
+  // Update fill mode of client
+  if (mFillMode != previousFillMode && HasClientInFillRange()) {
     mClient->Inactivate(mFillMode == FILL_FREEZE);
     SampleFillValue();
   }
@@ -1102,9 +1111,9 @@ nsSMILTimedElement::UnsetFillMode()
 {
   uint16_t previousFillMode = mFillMode;
   mFillMode = FILL_REMOVE;
-  if ((mElementState == STATE_WAITING || mElementState == STATE_POSTACTIVE) &&
-      previousFillMode == FILL_FREEZE && mClient && HasPlayed())
+  if (previousFillMode == FILL_FREEZE && HasClientInFillRange()) {
     mClient->Inactivate(false);
+  }
 }
 
 void
@@ -1865,8 +1874,7 @@ nsSMILTimedElement::ApplyMinAndMax(const nsSMILTimeValue& aDuration) const
   if (aDuration > mMax) {
     result = mMax;
   } else if (aDuration < mMin) {
-    nsSMILTimeValue repeatDur = GetRepeatDuration();
-    result = mMin > repeatDur ? repeatDur : mMin;
+    result = mMin;
   } else {
     result = aDuration;
   }
@@ -2060,16 +2068,35 @@ nsSMILTimedElement::SampleFillValue()
   if (mFillMode != FILL_FREEZE || !mClient)
     return;
 
-  const nsSMILInterval* prevInterval = GetPreviousInterval();
-  NS_ABORT_IF_FALSE(prevInterval,
-      "Attempting to sample fill value but there is no previous interval");
-  NS_ABORT_IF_FALSE(prevInterval->End()->Time().IsDefinite() &&
-      prevInterval->End()->IsFixedTime(),
-      "Attempting to sample fill value but the endpoint of the previous "
-      "interval is not resolved and fixed");
+  nsSMILTime activeTime;
 
-  nsSMILTime activeTime = prevInterval->End()->Time().GetMillis() -
-                          prevInterval->Begin()->Time().GetMillis();
+  if (mElementState == STATE_WAITING || mElementState == STATE_POSTACTIVE) {
+    const nsSMILInterval* prevInterval = GetPreviousInterval();
+    NS_ABORT_IF_FALSE(prevInterval,
+        "Attempting to sample fill value but there is no previous interval");
+    NS_ABORT_IF_FALSE(prevInterval->End()->Time().IsDefinite() &&
+        prevInterval->End()->IsFixedTime(),
+        "Attempting to sample fill value but the endpoint of the previous "
+        "interval is not resolved and fixed");
+
+    activeTime = prevInterval->End()->Time().GetMillis() -
+                 prevInterval->Begin()->Time().GetMillis();
+
+    // If the interval's repeat duration was shorter than its active duration,
+    // use the end of the repeat duration to determine the frozen animation's
+    // state.
+    nsSMILTimeValue repeatDuration = GetRepeatDuration();
+    if (repeatDuration.IsDefinite()) {
+      activeTime = std::min(repeatDuration.GetMillis(), activeTime);
+    }
+  } else if (mElementState == STATE_ACTIVE) {
+    // If we are being asked to sample the fill value while active we *must*
+    // have a repeat duration shorter than the active duration so use that.
+    MOZ_ASSERT(GetRepeatDuration().IsDefinite(),
+        "Attempting to sample fill value of an active animation with "
+        "an indefinite repeat duration");
+    activeTime = GetRepeatDuration().GetMillis();
+  }
 
   uint32_t repeatIteration;
   nsSMILTime simpleTime =
@@ -2165,8 +2192,13 @@ nsSMILTimedElement::GetNextMilestone(nsSMILMilestone& aNextMilestone) const
       // Work out what comes next: the interval end or the next repeat iteration
       nsSMILTimeValue nextRepeat;
       if (mSeekState == SEEK_NOT_SEEKING && mSimpleDur.IsDefinite()) {
-        nextRepeat.SetMillis(mCurrentInterval->Begin()->Time().GetMillis() +
-            (mCurrentRepeatIteration + 1) * mSimpleDur.GetMillis());
+        nsSMILTime nextRepeatActiveTime =
+          (mCurrentRepeatIteration + 1) * mSimpleDur.GetMillis();
+        // Check that the repeat fits within the repeat duration
+        if (nsSMILTimeValue(nextRepeatActiveTime) < GetRepeatDuration()) {
+          nextRepeat.SetMillis(mCurrentInterval->Begin()->Time().GetMillis() +
+                               nextRepeatActiveTime);
+        }
       }
       nsSMILTimeValue nextMilestone =
         std::min(mCurrentInterval->End()->Time(), nextRepeat);
@@ -2275,6 +2307,15 @@ nsSMILTimedElement::GetPreviousInterval() const
     : mOldIntervals[mOldIntervals.Length()-1].get();
 }
 
+bool
+nsSMILTimedElement::HasClientInFillRange() const
+{
+  // Returns true if we have a client that is in the range where it will fill
+  return mClient &&
+         ((mElementState != STATE_ACTIVE && HasPlayed()) ||
+          (mElementState == STATE_ACTIVE && !mClient->IsActive()));
+}
+
 bool
 nsSMILTimedElement::EndHasEventConditions() const
 {
diff --git a/content/smil/nsSMILTimedElement.h b/content/smil/nsSMILTimedElement.h
index c97ff7bd0b62..2b905499f96a 100644
--- a/content/smil/nsSMILTimedElement.h
+++ b/content/smil/nsSMILTimedElement.h
@@ -512,6 +512,7 @@ protected:
   const nsSMILInstanceTime* GetEffectiveBeginInstance() const;
   const nsSMILInterval* GetPreviousInterval() const;
   bool              HasPlayed() const { return !mOldIntervals.IsEmpty(); }
+  bool              HasClientInFillRange() const;
   bool              EndHasEventConditions() const;
   bool              AreEndTimesDependentOn(
                       const nsSMILInstanceTime* aBase) const;
diff --git a/content/smil/test/mochitest.ini b/content/smil/test/mochitest.ini
index f208c0e7a81f..02b724f0a50e 100644
--- a/content/smil/test/mochitest.ini
+++ b/content/smil/test/mochitest.ini
@@ -38,6 +38,7 @@ support-files =
 [test_smilMappedAttrFromBy.xhtml]
 [test_smilMappedAttrFromTo.xhtml]
 [test_smilMappedAttrPaced.xhtml]
+[test_smilMinTiming.html]
 [test_smilRepeatDuration.html]
 [test_smilRepeatTiming.xhtml]
 [test_smilReset.xhtml]
diff --git a/content/smil/test/test_smilMinTiming.html b/content/smil/test/test_smilMinTiming.html
new file mode 100644
index 000000000000..e336d0f9aca6
--- /dev/null
+++ b/content/smil/test/test_smilMinTiming.html
@@ -0,0 +1,93 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=948245
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 948245</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=948245">Mozilla Bug 948245</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<svg id="svg" onload="this.pauseAnimations()">
+  <rect fill="red" id="rect" x="0">
+    <animate attributeName="x" to="100" id="animation" dur="100s" min="200s"/>
+  </rect>
+</svg>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+  // The 'min' attribute introduces a kind of additional state into the SMIL
+  // model. If the 'min' attribute extends the active duration, the additional
+  // time between the amount of time the animation normally runs for (called the
+  // 'repeat duration') and the extended active duration is filled using the
+  // fill mode.
+  //
+  // Below we refer to this period of time between the end of the repeat
+  // duration and the end of the active duration as the 'extended period'.
+  //
+  // This test verifies that as we jump in and out of these states we produce
+  // the correct values.
+  //
+  // The test animation above produces an active interval that is longer than
+  // the 'repeating duration' of the animation.
+  var rect      = $('rect'),
+      animation = $('animation');
+
+  // Animation doesn't start until onload
+  SimpleTest.waitForExplicitFinish();
+  window.addEventListener("load", runTests, false);
+
+  function runTests() {
+    ok($('svg').animationsPaused(), "should be paused by <svg> load handler");
+
+    // In the extended period (t=150s) we should not be animating or filling
+    // since the default fill mode is "none".
+    animation.ownerSVGElement.setCurrentTime(150);
+    ise(rect.x.animVal.value, 0,
+        "Shouldn't fill in extended period with fill='none'");
+
+    // If we set the fill mode we should start filling.
+    animation.setAttribute("fill", "freeze");
+    ise(rect.x.animVal.value, 100,
+        "Should fill in extended period with fill='freeze'");
+
+    // If we unset the fill attribute we should stop filling.
+    animation.removeAttribute("fill");
+    ise(rect.x.animVal.value, 0, "Shouldn't fill after unsetting fill");
+
+    // If we jump back into the repeated interval (at t=50s) we should be
+    // animating.
+    animation.ownerSVGElement.setCurrentTime(50);
+    ise(rect.x.animVal.value, 50, "Should be active in repeating interval");
+
+    // If we jump to the boundary at the start of the extended period we should
+    // not be filling (since we removed the fill attribute above).
+    animation.ownerSVGElement.setCurrentTime(100);
+    ise(rect.x.animVal.value, 0,
+        "Shouldn't fill after seeking to boundary of extended period");
+
+    // If we apply a fill mode at this boundary point we should do regular fill
+    // behavior of using the last value in the interpolation range.
+    animation.setAttribute("fill", "freeze");
+    ise(rect.x.animVal.value, 100,
+        "Should fill at boundary to extended period");
+
+    // Check that if we seek past the interval we fill with the value at the end
+    // of the _repeat_duration_ not the value at the end of the
+    // _active_duration_.
+    animation.setAttribute("repeatCount", "1.5");
+    animation.ownerSVGElement.setCurrentTime(225);
+    ise(rect.x.animVal.value, 50,
+        "Should fill with the end of the repeat duration value");
+
+    SimpleTest.finish();
+  }
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/reftests/svg/smil/min-1.svg b/layout/reftests/svg/smil/min-1.svg
new file mode 100644
index 000000000000..6ba576d45213
--- /dev/null
+++ b/layout/reftests/svg/smil/min-1.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait"
+     onload="setTimeAndSnapshot(115, true)">
+  <script xlink:href="smil-util.js" type="text/javascript"/>
+  <!-- Test min behavior
+
+       Set up is as follows:
+       1. There is a rectangle with a lime fill.
+       2. A <set> animation (with default fill="none") sets the fill to
+          orange at t=100s.
+          It has a simple duration of 10s and a min duration of 20s.
+       3. A further <set> animation sets the fill to red when the first
+          animation finishes (using syncbase timing).
+
+       At time t=115s we should still be in the first animation's active
+       interval with its fill mode of 'none' applied which should mean the
+       original lime fill is used. -->
+  <rect width="100%" height="100%" fill="lime">
+    <set attributeName="fill" to="orange" dur="10s" min="20s" begin="100s"
+      id="a"/>
+    <set attributeName="fill" to="red" begin="a.end"/>
+  </rect>
+</svg>
diff --git a/layout/reftests/svg/smil/reftest.list b/layout/reftests/svg/smil/reftest.list
index e58d9273220a..9f1ba4e80c28 100644
--- a/layout/reftests/svg/smil/reftest.list
+++ b/layout/reftests/svg/smil/reftest.list
@@ -251,6 +251,8 @@ fuzzy-if(cocoaWidget&&layersGPUAccelerated,1,2) == anim-gradient-attr-presence-0
 # interaction between xml mapped attributes and their css equivalents
 == mapped-attr-vs-css-prop-1.svg lime.svg
 
+== min-1.svg lime.svg
+
 == smil-transitions-interaction-1a.svg lime.svg
 == smil-transitions-interaction-1b.svg lime.svg
 == smil-transitions-interaction-2a.svg lime.svg

From 0de483c99ecbe1cbbd1f72972227daf430142050 Mon Sep 17 00:00:00 2001
From: Brian Birtles <birtles@gmail.com>
Date: Fri, 13 Dec 2013 13:41:56 +0900
Subject: [PATCH 113/459] Bug 941315 - Update the timing model even when
 invalid values are set; r=longsonr

When an invalid dur, min, max, or repeatDur is set we were failing to call
UpdateCurrentInterval to update the timing model. This patch makes sure we
update the current interval in error cases too.

Mochitests test the interval is being updated in these cases and, for
completeness, the case of repeatCount as well.
---
 content/smil/nsSMILTimedElement.cpp           |  54 +++++++--
 content/smil/nsSMILTimedElement.h             |   3 +
 content/smil/test/mochitest.ini               |   1 +
 content/smil/test/test_smilInvalidValues.html | 113 ++++++++++++++++++
 4 files changed, 160 insertions(+), 11 deletions(-)
 create mode 100644 content/smil/test/test_smilInvalidValues.html

diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index 0da19cdbf412..db6f05975a9e 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -112,8 +112,9 @@ namespace
 //----------------------------------------------------------------------
 // Helper class: AutoIntervalUpdateBatcher
 
-// RAII helper to set the mDeferIntervalUpdates flag on an nsSMILTimedElement
-// and perform the UpdateCurrentInterval when the object is destroyed.
+// Stack-based helper class to set the mDeferIntervalUpdates flag on an
+// nsSMILTimedElement and perform the UpdateCurrentInterval when the object is
+// destroyed.
 //
 // If several of these objects are allocated on the stack, the update will not
 // be performed until the last object for a given nsSMILTimedElement is
@@ -146,6 +147,31 @@ private:
   bool mDidSetFlag;
 };
 
+//----------------------------------------------------------------------
+// Helper class: AutoIntervalUpdater
+
+// Stack-based helper class to call UpdateCurrentInterval when it is destroyed
+// which helps avoid bugs where we forget to call UpdateCurrentInterval in the
+// case of early returns (e.g. due to parse errors).
+//
+// This can be safely used in conjunction with AutoIntervalUpdateBatcher; any
+// calls to UpdateCurrentInterval made by this class will simply be deferred if
+// there is an AutoIntervalUpdateBatcher on the stack.
+class MOZ_STACK_CLASS nsSMILTimedElement::AutoIntervalUpdater
+{
+public:
+  AutoIntervalUpdater(nsSMILTimedElement& aTimedElement)
+    : mTimedElement(aTimedElement) { }
+
+  ~AutoIntervalUpdater()
+  {
+    mTimedElement.UpdateCurrentInterval();
+  }
+
+private:
+  nsSMILTimedElement& mTimedElement;
+};
+
 //----------------------------------------------------------------------
 // Templated helper functions
 
@@ -918,8 +944,10 @@ nsSMILTimedElement::UnsetEndSpec(RemovalTestFunction aRemove)
 nsresult
 nsSMILTimedElement::SetSimpleDuration(const nsAString& aDurSpec)
 {
-  nsSMILTimeValue duration;
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
 
+  nsSMILTimeValue duration;
   const nsAString& dur = nsSMILParserUtils::TrimWhitespace(aDurSpec);
 
   // SVG-specific: "For SVG's animation elements, if "media" is specified, the
@@ -939,7 +967,6 @@ nsSMILTimedElement::SetSimpleDuration(const nsAString& aDurSpec)
     "Setting unresolved simple duration");
 
   mSimpleDur = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
@@ -954,8 +981,10 @@ nsSMILTimedElement::UnsetSimpleDuration()
 nsresult
 nsSMILTimedElement::SetMin(const nsAString& aMinSpec)
 {
-  nsSMILTimeValue duration;
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
 
+  nsSMILTimeValue duration;
   const nsAString& min = nsSMILParserUtils::TrimWhitespace(aMinSpec);
 
   if (min.EqualsLiteral("media")) {
@@ -970,7 +999,6 @@ nsSMILTimedElement::SetMin(const nsAString& aMinSpec)
   NS_ABORT_IF_FALSE(duration.GetMillis() >= 0L, "Invalid duration");
 
   mMin = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
@@ -985,8 +1013,10 @@ nsSMILTimedElement::UnsetMin()
 nsresult
 nsSMILTimedElement::SetMax(const nsAString& aMaxSpec)
 {
-  nsSMILTimeValue duration;
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
 
+  nsSMILTimeValue duration;
   const nsAString& max = nsSMILParserUtils::TrimWhitespace(aMaxSpec);
 
   if (max.EqualsLiteral("media") || max.EqualsLiteral("indefinite")) {
@@ -1001,7 +1031,6 @@ nsSMILTimedElement::SetMax(const nsAString& aMaxSpec)
   }
 
   mMax = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
@@ -1036,15 +1065,16 @@ nsSMILTimedElement::UnsetRestart()
 nsresult
 nsSMILTimedElement::SetRepeatCount(const nsAString& aRepeatCountSpec)
 {
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
+
   nsSMILRepeatCount newRepeatCount;
 
   if (nsSMILParserUtils::ParseRepeatCount(aRepeatCountSpec, newRepeatCount)) {
     mRepeatCount = newRepeatCount;
-    UpdateCurrentInterval();
     return NS_OK;
   }
   mRepeatCount.Unset();
-  UpdateCurrentInterval();
   return NS_ERROR_FAILURE;
 }
 
@@ -1058,6 +1088,9 @@ nsSMILTimedElement::UnsetRepeatCount()
 nsresult
 nsSMILTimedElement::SetRepeatDur(const nsAString& aRepeatDurSpec)
 {
+  // Update the current interval before returning
+  AutoIntervalUpdater updater(*this);
+
   nsSMILTimeValue duration;
 
   const nsAString& repeatDur =
@@ -1073,7 +1106,6 @@ nsSMILTimedElement::SetRepeatDur(const nsAString& aRepeatDurSpec)
   }
 
   mRepeatDur = duration;
-  UpdateCurrentInterval();
 
   return NS_OK;
 }
diff --git a/content/smil/nsSMILTimedElement.h b/content/smil/nsSMILTimedElement.h
index 2b905499f96a..a8086acb8c52 100644
--- a/content/smil/nsSMILTimedElement.h
+++ b/content/smil/nsSMILTimedElement.h
@@ -616,6 +616,9 @@ protected:
   bool mDoDeferredUpdate; // Set if an update to the current interval was
                           // requested while mDeferIntervalUpdates was set
 
+  // Stack-based helper class to call UpdateCurrentInterval when it is destroyed
+  class AutoIntervalUpdater;
+
   // Recursion depth checking
   uint8_t              mDeleteCount;
   uint8_t              mUpdateIntervalRecursionDepth;
diff --git a/content/smil/test/mochitest.ini b/content/smil/test/mochitest.ini
index 02b724f0a50e..c48b6f4330c7 100644
--- a/content/smil/test/mochitest.ini
+++ b/content/smil/test/mochitest.ini
@@ -32,6 +32,7 @@ support-files =
 [test_smilGetSimpleDuration.xhtml]
 [test_smilGetStartTime.xhtml]
 [test_smilHyperlinking.xhtml]
+[test_smilInvalidValues.html]
 [test_smilKeySplines.xhtml]
 [test_smilKeyTimes.xhtml]
 [test_smilKeyTimesPacedMode.xhtml]
diff --git a/content/smil/test/test_smilInvalidValues.html b/content/smil/test/test_smilInvalidValues.html
new file mode 100644
index 000000000000..c24761c03efb
--- /dev/null
+++ b/content/smil/test/test_smilInvalidValues.html
@@ -0,0 +1,113 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=941315
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test invalid values cause the model to be updated (bug 941315)</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=941315">Mozilla Bug 941315</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+<svg width="100%" height="1" onload="this.pauseAnimations()">
+  <rect>
+    <animate id="a" dur="100s"/>
+    <animate id="b" dur="5s" begin="a.end"/>
+  </rect>
+  <circle cx="-100" cy="20" r="15" fill="blue" id="circle"/>
+</svg>
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+  var a = $('a'),
+      b = $('b');
+
+  // Animation doesn't start until onload
+  SimpleTest.waitForExplicitFinish();
+  window.addEventListener("load", runTests, false);
+
+  // Make testing getStartTime easier
+  SVGAnimationElement.prototype.safeGetStartTime = function() {
+    try {
+      return this.getStartTime();
+    } catch(e) {
+      if (e.name == "InvalidStateError" &&
+          e.code == DOMException.INVALID_STATE_ERR) {
+        return 'none';
+      } else {
+        ok(false, "Unexpected exception: " + e);
+        return null;
+      }
+    }
+  };
+
+  function runTests() {
+    [testSimpleDuration, testMin, testMax, testRepeatDur, testRepeatCount]
+      .forEach(function(test) {
+        ise(b.getStartTime(), 100, "initial state before running " + test.name);
+        test();
+        ise(b.getStartTime(), 100, "final state after running " + test.name);
+      });
+    SimpleTest.finish();
+  }
+
+  function testSimpleDuration() {
+    // Verify a valid value updates as expected
+    a.setAttribute("dur", "50s");
+    ise(b.safeGetStartTime(), 50, "valid simple duration");
+
+    // Check an invalid value also causes the model to be updated
+    a.setAttribute("dur", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), "none", "invalid simple duration");
+
+    // Restore state
+    a.setAttribute("dur", "100s");
+  }
+
+  function testMin() {
+    a.setAttribute("min", "200s");
+    ise(b.safeGetStartTime(), 200, "valid min duration");
+
+    a.setAttribute("min", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid min duration");
+
+    a.removeAttribute("min");
+  }
+
+  function testMax() {
+    a.setAttribute("max", "50s");
+    ise(b.safeGetStartTime(), 50, "valid max duration");
+
+    a.setAttribute("max", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid max duration");
+
+    a.removeAttribute("max");
+  }
+
+  function testRepeatDur() {
+    a.setAttribute("repeatDur", "200s");
+    ise(b.safeGetStartTime(), 200, "valid repeatDur duration");
+
+    a.setAttribute("repeatDur", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid repeatDur duration");
+
+    a.removeAttribute("repeatDur");
+  }
+
+  function testRepeatCount() {
+    a.setAttribute("repeatCount", "2");
+    ise(b.safeGetStartTime(), 200, "valid repeatCount duration");
+
+    a.setAttribute("repeatCount", "abc"); // -> indefinite
+    ise(b.safeGetStartTime(), 100, "invalid repeatCount duration");
+
+    a.removeAttribute("repeatCount");
+  }
+</script>
+</pre>
+</body>
+</html>

From c2a5a16255ef8a7293281f8b390e4162fe92b34b Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:16:14 -0800
Subject: [PATCH 114/459] Bug 940765 - preference service can GC, r=terrence

--HG--
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3-ref.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1-ref.xhtml
rename : layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-3.xhtml => layout/reftests/w3c-css/submitted/flexbox/flexbox-align-self-baseline-horiz-1.xhtml
extra : rebase_source : cad260c0819a3ced47e1ec612de2788e1e991670
---
 js/src/devtools/rootAnalysis/annotations.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 1803eb87f5a2..08267463757e 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -160,10 +160,6 @@ var ignoreFunctions = {
     // FIXME!
     "NS_DebugBreak": true,
 
-    // Bug 940765 - fetching preferences should not GC
-    "PrefHashEntry* pref_HashTableLookup(void*)": true,
-    "uint8 mozilla::Preferences::InitStaticMembers()": true, // Temporary, see bug 940765
-
     // These are a little overzealous -- these destructors *can* GC if they end
     // up wrapping a pending exception. See bug 898815 for the heavyweight fix.
     "void js::AutoCompartment::~AutoCompartment(int32)" : true,

From 6adc5e5233e69327afa3eb37610055ce53e63f03 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:16:47 -0800
Subject: [PATCH 115/459] Bug 948646 - AutoJSContext cannot GC, r=terrence

--HG--
extra : rebase_source : f015f6bce00faa2c8e77cb861ed0770710e718ed
---
 js/src/devtools/rootAnalysis/annotations.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 08267463757e..530e489bdf3d 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -165,6 +165,13 @@ var ignoreFunctions = {
     "void js::AutoCompartment::~AutoCompartment(int32)" : true,
     "void JSAutoCompartment::~JSAutoCompartment(int32)" : true,
 
+    // Bug 948646 - the only thing AutoJSContext's constructor calls
+    // is an Init() routine whose entire body is covered with an
+    // AutoAssertNoGC. AutoSafeJSContext is the same thing, just with
+    // a different value for the 'aSafe' parameter.
+    "void mozilla::AutoJSContext::AutoJSContext(mozilla::detail::GuardObjectNotifier*)" : true,
+    "void mozilla::AutoSafeJSContext::~AutoSafeJSContext(int32)" : true,
+
     // And these are workarounds to avoid even more analysis work,
     // which would sadly still be needed even with bug 898815.
     "void js::AutoCompartment::AutoCompartment(js::ExclusiveContext*, JSCompartment*)": true,

From 89d34ffe587efae024fd1b1306ffc4149508560c Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:17:14 -0800
Subject: [PATCH 116/459] Bug 948753 - Annotate sane nsISupports virtual
 methods, r=bhackett

--HG--
extra : rebase_source : 85695549d5d068bd393fc50e7190da00f95970ca
---
 js/src/devtools/rootAnalysis/annotations.js     | 14 ++++++++++++++
 .../devtools/rootAnalysis/computeCallgraph.js   | 17 ++++++++++-------
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
index 530e489bdf3d..d2e479eb018c 100644
--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -235,3 +235,17 @@ function isSuppressConstructor(name)
         || /::AutoEnterAnalysis/.test(name)
         || /::AutoAssertNoGC/.test(name);
 }
+
+// nsISupports subclasses' methods may be scriptable (or overridden
+// via binary XPCOM), and so may GC. But some fields just aren't going
+// to get overridden with something that can GC.
+function isOverridableField(csu, field)
+{
+    if (csu != 'nsISupports')
+        return false;
+    if (field == 'GetCurrentJSContext')
+        return false;
+    if (field == 'IsOnCurrentThread')
+        return false;
+    return true;
+}
diff --git a/js/src/devtools/rootAnalysis/computeCallgraph.js b/js/src/devtools/rootAnalysis/computeCallgraph.js
index 3b66de0a6045..493cb54e173a 100644
--- a/js/src/devtools/rootAnalysis/computeCallgraph.js
+++ b/js/src/devtools/rootAnalysis/computeCallgraph.js
@@ -61,13 +61,13 @@ function findVirtualFunctions(csu, field, suppressed)
     // which should never enter the JS engine (even when calling dtors).
     while (worklist.length) {
         var csu = worklist.pop();
-        if (csu == "nsISupports") {
-            if (field == "AddRef" || field == "Release") {
-                suppressed[0] = true;
-                return [];
-            }
-            return null;
+        if (csu == "nsISupports" && (field == "AddRef" || field == "Release")) {
+            suppressed[0] = true;
+            return [];
         }
+        if (isOverridableField(csu, field))
+            return null;
+
         if (csu in superclasses) {
             for (var superclass of superclasses[csu])
                 worklist.push(superclass);
@@ -258,6 +258,8 @@ for (var csuIndex = minStream; csuIndex <= maxStream; csuIndex++) {
 
 xdb.open("src_body.xdb");
 
+printErr("Finished loading data structures");
+
 var minStream = xdb.min_data_stream();
 var maxStream = xdb.max_data_stream();
 
@@ -275,8 +277,9 @@ for (var nameIndex = minStream; nameIndex <= maxStream; nameIndex++) {
     seenCallees = {};
     seenSuppressedCallees = {};
 
+    var functionName = name.readString();
     for (var body of functionBodies)
-        processBody(name.readString(), body);
+        processBody(functionName, body);
 
     xdb.free_string(name);
     xdb.free_string(data);

From 2a86d8d7e6d707e37347fe2bc1e850b75c827e71 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 17:17:17 -0800
Subject: [PATCH 117/459] No bug. Remove noisy debugging printout.

--HG--
extra : rebase_source : f5aa45dcb6c5d051f8888682d3aeab71b7df56d5
---
 js/src/devtools/rootAnalysis/loadCallgraph.js | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/loadCallgraph.js b/js/src/devtools/rootAnalysis/loadCallgraph.js
index 80216a1258b3..295d3f9ce7ce 100644
--- a/js/src/devtools/rootAnalysis/loadCallgraph.js
+++ b/js/src/devtools/rootAnalysis/loadCallgraph.js
@@ -148,9 +148,7 @@ function loadCallgraph(file)
     // Any field call that has been resolved to all possible callees can be
     // trusted to not GC if all of those callees are known to not GC.
     for (var name in resolvedFunctions) {
-        if (!(name in gcFunctions)) {
+        if (!(name in gcFunctions))
             suppressedFunctions[name] = true;
-            printErr("Adding " + name);
-        }
     }
 }

From 3e95adf082f60705ac613efdd57834f9af0acc6a Mon Sep 17 00:00:00 2001
From: Chris Peterson <cpeterson@mozilla.com>
Date: Wed, 11 Dec 2013 21:24:13 -0800
Subject: [PATCH 118/459] Bug 949324 - Fix -Wunused-function warnings in js/.
 r=luke

---
 js/src/jit/IonMacroAssembler.cpp | 2 +-
 js/src/shell/js.cpp              | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index c68c9de5ffa5..a0511b1c653c 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -1213,12 +1213,12 @@ IsCompilingAsmJS()
     IonContext *ictx = MaybeGetIonContext();
     return ictx && ictx->compartment == nullptr;
 }
-#endif
 
 static void
 AssumeUnreachable_(const char *output) {
     MOZ_ReportAssertionFailure(output, __FILE__, __LINE__);
 }
+#endif
 
 void
 MacroAssembler::assumeUnreachable(const char *output)
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 501bc02295ff..594de924ed93 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -3591,13 +3591,17 @@ EscapeForShell(AutoCStringVector &argv)
 }
 #endif
 
-Vector<const char*, 4, js::SystemAllocPolicy> sPropagatedFlags;
+static Vector<const char*, 4, js::SystemAllocPolicy> sPropagatedFlags;
 
+#ifdef DEBUG
+#if (defined(JS_CPU_X86) || defined(JS_CPU_X64)) && defined(JS_ION)
 static bool
 PropagateFlagToNestedShells(const char *flag)
 {
     return sPropagatedFlags.append(flag);
 }
+#endif
+#endif
 
 static bool
 NestedShell(JSContext *cx, unsigned argc, jsval *vp)

From 8c13061a4015001d2fd988359b8f2099e4191173 Mon Sep 17 00:00:00 2001
From: Chris Peterson <cpeterson@mozilla.com>
Date: Wed, 11 Dec 2013 21:13:24 -0800
Subject: [PATCH 119/459] Bug 949353 - Fix -Wsometimes-uninitialized warnings
 in dom/workers/WorkerPrivate.cpp. r=khuey

---
 dom/workers/WorkerPrivate.cpp | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 67a65c071ea7..f89f14a88165 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -1208,7 +1208,7 @@ public:
         JS::Rooted<JSObject*> target(aCx, JS::CurrentGlobalOrNull(aCx));
         NS_ASSERTION(target, "This should never be null!");
 
-        bool preventDefaultCalled;
+        nsEventStatus status = nsEventStatus_eIgnore;
         nsIScriptGlobalObject* sgo;
 
         if (aWorkerPrivate) {
@@ -1222,15 +1222,12 @@ public:
           event.fileName = aFilename.get();
           event.typeString = NS_LITERAL_STRING("error");
 
-          nsEventStatus status = nsEventStatus_eIgnore;
           nsIDOMEventTarget* target = static_cast<nsIDOMEventTarget*>(globalTarget);
           if (NS_FAILED(nsEventDispatcher::Dispatch(target, nullptr, &event,
                                                     nullptr, &status))) {
             NS_WARNING("Failed to dispatch worker thread error event!");
             status = nsEventStatus_eIgnore;
           }
-
-          preventDefaultCalled = status == nsEventStatus_eConsumeNoDefault;
         }
         else if ((sgo = nsJSUtils::GetStaticScriptGlobal(target))) {
           // Icky, we have to fire an InternalScriptErrorEvent...
@@ -1239,16 +1236,14 @@ public:
           event.errorMsg = aMessage.get();
           event.fileName = aFilename.get();
 
-          nsEventStatus status = nsEventStatus_eIgnore;
           if (NS_FAILED(sgo->HandleScriptError(&event, &status))) {
             NS_WARNING("Failed to dispatch main thread error event!");
             status = nsEventStatus_eIgnore;
           }
-
-          preventDefaultCalled = status == nsEventStatus_eConsumeNoDefault;
         }
 
-        if (preventDefaultCalled) {
+        // Was preventDefault() called?
+        if (status == nsEventStatus_eConsumeNoDefault) {
           return true;
         }
       }

From 41c9799518e68da8fd4c7af63db8f4ca914ff59d Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 12:15:16 -0800
Subject: [PATCH 120/459] Bug 940765 - Root before preference checking, r=bz

---
 dom/base/Navigator.cpp | 12 ++++++++----
 dom/base/Navigator.h   |  4 ++--
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index 908f1f936649..443deca78c45 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -1703,14 +1703,16 @@ Navigator::HasMobileMessageSupport(JSContext* /* unused */, JSObject* aGlobal)
 
 /* static */
 bool
-Navigator::HasTelephonySupport(JSContext* /* unused */, JSObject* aGlobal)
+Navigator::HasTelephonySupport(JSContext* cx, JSObject* aGlobal)
 {
+  JS::Rooted<JSObject*> global(cx, aGlobal);
+
   // First of all, the general pref has to be turned on.
   bool enabled = false;
   Preferences::GetBool("dom.telephony.enabled", &enabled);
   NS_ENSURE_TRUE(enabled, false);
 
-  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(aGlobal);
+  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(global);
   return win && CheckPermission(win, "telephony");
 }
 
@@ -1854,8 +1856,10 @@ bool Navigator::HasInputMethodSupport(JSContext* /* unused */,
 
 /* static */
 bool
-Navigator::HasDataStoreSupport(JSContext* /* unused */, JSObject* aGlobal)
+Navigator::HasDataStoreSupport(JSContext* cx, JSObject* aGlobal)
 {
+  JS::Rooted<JSObject*> global(cx, aGlobal);
+
   // First of all, the general pref has to be turned on.
   bool enabled = false;
   Preferences::GetBool("dom.datastore.enabled", &enabled);
@@ -1866,7 +1870,7 @@ Navigator::HasDataStoreSupport(JSContext* /* unused */, JSObject* aGlobal)
     return true;
   }
 
-  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(aGlobal);
+  nsCOMPtr<nsPIDOMWindow> win = GetWindowFromGlobal(global);
   if (!win) {
     return false;
   }
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index 607b7086a960..282b3c51bd60 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -250,7 +250,7 @@ public:
   }
   static bool HasMobileMessageSupport(JSContext* /* unused */,
                                       JSObject* aGlobal);
-  static bool HasTelephonySupport(JSContext* /* unused */,
+  static bool HasTelephonySupport(JSContext* cx,
                                   JSObject* aGlobal);
   static bool HasCameraSupport(JSContext* /* unused */,
                                JSObject* aGlobal);
@@ -286,7 +286,7 @@ public:
 
   static bool HasInputMethodSupport(JSContext* /* unused */, JSObject* aGlobal);
 
-  static bool HasDataStoreSupport(JSContext* /* unused */, JSObject* aGlobal);
+  static bool HasDataStoreSupport(JSContext* cx, JSObject* aGlobal);
 
   nsPIDOMWindow* GetParentObject() const
   {

From 6f9caffe805cdf8a8b881e5bf7f221af679d26a4 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 15:12:29 +0900
Subject: [PATCH 121/459] Bug 949875 - Delay import some WebIDL modules;
 r=glandium

This prevents excessive dependencies on config.status. Those extra
dependencies make WebIDL developer workflow inefficient.

--HG--
extra : rebase_source : 37ba82773fe6d873e25fc8b61fef44ec9f191ebe
extra : amend_source : 3fa0796f096efdbe6a74138ea0258f68cbcf4071
---
 dom/bindings/mozwebidlcodegen/__init__.py | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
index 5516dbb3a1a0..cbd6312b23d4 100644
--- a/dom/bindings/mozwebidlcodegen/__init__.py
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -24,14 +24,8 @@ from mozbuild.util import FileAvoidWrite
 
 import mozpack.path as mozpath
 
-import WebIDL
-from Codegen import (
-    CGBindingRoot,
-    CGEventRoot,
-    CGExampleRoot,
-    GlobalGenRoots,
-)
-from Configuration import Configuration
+# There are various imports in this file in functions to avoid adding
+# dependencies to config.status. See bug 949875.
 
 
 class BuildResult(object):
@@ -305,11 +299,16 @@ class WebIDLCodegenManager(LoggingMixin):
 
     def generate_example_files(self, interface):
         """Generates example files for a given interface."""
+        from Codegen import CGExampleRoot
+
         root = CGExampleRoot(self.config, interface)
 
         return self._maybe_write_codegen(root, *self._example_paths(interface))
 
     def _parse_webidl(self):
+        import WebIDL
+        from Configuration import Configuration
+
         self.log(logging.INFO, 'webidl_parse',
             {'count': len(self._input_paths)},
             'Parsing {count} WebIDL files.')
@@ -328,6 +327,8 @@ class WebIDLCodegenManager(LoggingMixin):
         self._input_hashes = hashes
 
     def _write_global_derived(self):
+        from Codegen import GlobalGenRoots
+
         things = [('declare', f) for f in self.GLOBAL_DECLARE_FILES]
         things.extend(('define', f) for f in self.GLOBAL_DEFINE_FILES)
 
@@ -453,6 +454,11 @@ class WebIDLCodegenManager(LoggingMixin):
         return paths
 
     def _generate_build_files_for_webidl(self, filename):
+        from Codegen import (
+            CGBindingRoot,
+            CGEventRoot,
+        )
+
         self.log(logging.INFO, 'webidl_generate_build_for_input',
             {'filename': filename},
             'Generating WebIDL files derived from {filename}')

From 09c13814b1ee01c76e530aab1795c285281cdb74 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 00:03:55 +0900
Subject: [PATCH 122/459] Bug 949304 - Print Makefile counts during
 config.status; r=glandium

We now capture and print the number of Makefile.in and the number of
generated Makefile as part of config.status. This should give us a nice,
easy to extract metric going forward.

--HG--
extra : rebase_source : 48a3e9f66975505dec76746703875b2364dedc87
---
 .../mozbuild/backend/recursivemake.py         | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index c9a4000dd46a..a909efff8ee4 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -268,17 +268,25 @@ class RecursiveMakeBackend(CommonBackend):
         self._ipdl_sources = set()
 
         def detailed(summary):
-            s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
+            s = '{:d} total backend files; ' \
+                '{:d} created; {:d} updated; {:d} unchanged; ' \
+                '{:d} deleted; {:d} -> {:d} Makefile'.format(
                 summary.created_count + summary.updated_count +
-                summary.unchanged_count, summary.created_count,
-                summary.updated_count, summary.unchanged_count)
-            if summary.deleted_count:
-                s+= '; {:d} deleted'.format(summary.deleted_count)
+                summary.unchanged_count,
+                summary.created_count,
+                summary.updated_count,
+                summary.unchanged_count,
+                summary.deleted_count,
+                summary.makefile_in_count,
+                summary.makefile_out_count)
+
             return s
 
         # This is a little kludgy and could be improved with a better API.
         self.summary.backend_detailed_summary = types.MethodType(detailed,
             self.summary)
+        self.summary.makefile_in_count = 0
+        self.summary.makefile_out_count = 0
 
         self._test_manifests = {}
 
@@ -664,6 +672,7 @@ class RecursiveMakeBackend(CommonBackend):
                 if not stub:
                     self.log(logging.DEBUG, 'substitute_makefile',
                         {'path': makefile}, 'Substituting makefile: {path}')
+                    self.summary.makefile_in_count += 1
 
                     for tier, skiplist in self._may_skip.items():
                         if tier in ('compile', 'binaries'):
@@ -1104,6 +1113,8 @@ class RecursiveMakeBackend(CommonBackend):
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
 
+        self.summary.makefile_out_count += 1
+
     def _handle_webidl_collection(self, webidls):
         if not webidls.all_stems():
             return

From d917ee6f02beb60e1e5f0a6d55fc209325656710 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Thu, 12 Dec 2013 23:18:43 -0800
Subject: [PATCH 123/459] Bug 944074 - Remove the ParallelArray constructor.
 (r=nmatsakis)

---
 .../mochitest/general/test_interfaces.html    |    1 -
 js/src/Makefile.in                            |    1 -
 js/src/builtin/Array.js                       |    4 +-
 js/src/builtin/ParallelArray.cpp              |  247 ----
 js/src/builtin/ParallelArray.h                |   56 -
 js/src/builtin/ParallelArray.js               | 1253 -----------------
 js/src/builtin/Utilities.js                   |   30 +
 js/src/jit-test/lib/parallelarray-helpers.js  |   98 +-
 .../jit-test/tests/auto-regress/bug755564.js  |    9 -
 .../jit-test/tests/auto-regress/bug783923.js  |    6 -
 .../jit-test/tests/auto-regress/bug784011.js  |    8 -
 .../jit-test/tests/auto-regress/bug786106.js  |    8 -
 .../jit-test/tests/auto-regress/bug789107.js  |    7 -
 .../jit-test/tests/auto-regress/bug791445.js  |    7 -
 js/src/jit-test/tests/baseline/bug846072.js   |    7 -
 js/src/jit-test/tests/baseline/bug857579.js   |   22 -
 js/src/jit-test/tests/basic/bug815652.js      |   12 -
 .../tests/parallel/binary-arith-numbers.js    |    5 +-
 js/src/jit-test/tests/parallel/bug783924.js   |    7 -
 js/src/jit-test/tests/parallel/bug787282.js   |   16 -
 js/src/jit-test/tests/parallel/bug853555.js   |   12 -
 js/src/jit-test/tests/parallel/bug853573.js   |   17 -
 js/src/jit-test/tests/parallel/bug854021.js   |    3 -
 js/src/jit-test/tests/parallel/bug854050.js   |   10 -
 js/src/jit-test/tests/parallel/bug854381.js   |   20 -
 js/src/jit-test/tests/parallel/bug857846.js   |    9 -
 js/src/jit-test/tests/parallel/bug858077.js   |    5 -
 js/src/jit-test/tests/parallel/bug858582.js   |   68 -
 js/src/jit-test/tests/parallel/bug890465.js   |    6 -
 js/src/jit-test/tests/parallel/bug894782.js   |    6 -
 js/src/jit-test/tests/parallel/bug895782.js   |   12 -
 js/src/jit-test/tests/parallel/bug908939.js   |   13 -
 js/src/jit-test/tests/parallel/bug909599.js   |    6 -
 .../jit-test/tests/parallel/compare-values.js |   16 +-
 .../tests/parallel/comprehension-2.js         |   13 -
 .../tests/parallel/comprehension-fn-args.js   |   16 -
 .../tests/parallel/comprehension-scale.js     |   22 -
 .../jit-test/tests/parallel/constructor-1.js  |   15 -
 .../jit-test/tests/parallel/constructor-2.js  |   15 -
 .../jit-test/tests/parallel/constructor-3.js  |   14 -
 .../jit-test/tests/parallel/constructor-4.js  |   16 -
 .../jit-test/tests/parallel/constructor-5.js  |   18 -
 .../tests/parallel/constructor-throws.js      |   10 -
 js/src/jit-test/tests/parallel/element-1.js   |   14 -
 js/src/jit-test/tests/parallel/element-2.js   |   26 -
 js/src/jit-test/tests/parallel/element-3.js   |   12 -
 js/src/jit-test/tests/parallel/flatten-1.js   |   14 -
 js/src/jit-test/tests/parallel/flatten-2.js   |   10 -
 js/src/jit-test/tests/parallel/flatten-3.js   |   25 -
 .../jit-test/tests/parallel/flatten-throws.js |   12 -
 js/src/jit-test/tests/parallel/get-1.js       |    9 -
 js/src/jit-test/tests/parallel/get-2.js       |   14 -
 js/src/jit-test/tests/parallel/get-3.js       |    9 -
 js/src/jit-test/tests/parallel/get-4.js       |    7 -
 js/src/jit-test/tests/parallel/get-6.js       |   14 -
 js/src/jit-test/tests/parallel/holes-1.js     |   31 -
 js/src/jit-test/tests/parallel/holes-2.js     |   25 -
 js/src/jit-test/tests/parallel/index-1.js     |    9 -
 js/src/jit-test/tests/parallel/index-2.js     |   18 -
 js/src/jit-test/tests/parallel/index-3.js     |   25 -
 js/src/jit-test/tests/parallel/index-4.js     |   27 -
 .../tests/parallel/inline-new-bad-type.js     |   18 -
 js/src/jit-test/tests/parallel/length-1.js    |   12 -
 js/src/jit-test/tests/parallel/length-2.js    |   13 -
 js/src/jit-test/tests/parallel/length-3.js    |   11 -
 js/src/jit-test/tests/parallel/mandelbrot.js  |    4 +-
 js/src/jit-test/tests/parallel/map-3.js       |   12 -
 .../tests/parallel/overflow-throws.js         |   12 -
 js/src/jit-test/tests/parallel/partition-1.js |   15 -
 .../tests/parallel/partition-throws.js        |   10 -
 .../tests/parallel/reduce-higher-dim.js       |   14 -
 .../jit-test/tests/parallel/reduce-throws.js  |   17 -
 js/src/jit-test/tests/parallel/scan-3.js      |   17 -
 js/src/jit-test/tests/parallel/scan-throws.js |   18 -
 js/src/jit-test/tests/parallel/scatter-1.js   |    8 -
 js/src/jit-test/tests/parallel/scatter-10.js  |   21 -
 js/src/jit-test/tests/parallel/scatter-11.js  |   21 -
 js/src/jit-test/tests/parallel/scatter-12.js  |   22 -
 js/src/jit-test/tests/parallel/scatter-13.js  |   24 -
 js/src/jit-test/tests/parallel/scatter-2.js   |   10 -
 js/src/jit-test/tests/parallel/scatter-3.js   |   12 -
 js/src/jit-test/tests/parallel/scatter-4.js   |   10 -
 js/src/jit-test/tests/parallel/scatter-5.js   |    9 -
 js/src/jit-test/tests/parallel/scatter-6.js   |   13 -
 js/src/jit-test/tests/parallel/scatter-7.js   |   15 -
 js/src/jit-test/tests/parallel/scatter-8.js   |   16 -
 js/src/jit-test/tests/parallel/scatter-9.js   |   12 -
 .../tests/parallel/scatter-regression-1.js    |   18 -
 .../jit-test/tests/parallel/scatter-throws.js |   31 -
 js/src/jit-test/tests/parallel/shape-1.js     |    8 -
 js/src/jit-test/tests/parallel/shape-2.js     |   15 -
 js/src/jit-test/tests/parallel/shape-3.js     |   16 -
 js/src/jit-test/tests/parallel/shape-4.js     |   13 -
 js/src/jit-test/tests/parallel/shape-5.js     |   13 -
 .../jit-test/tests/parallel/stack-overflow.js |    4 +-
 js/src/jit-test/tests/parallel/toString-1.js  |    6 -
 js/src/jit/BaselineIC.cpp                     |   13 -
 js/src/jit/CodeGenerator.cpp                  |   70 -
 js/src/jit/CodeGenerator.h                    |    4 -
 js/src/jit/IonBuilder.h                       |   10 -
 js/src/jit/LIR-Common.h                       |   10 -
 js/src/jit/LOpcodes.h                         |    1 -
 js/src/jit/Lowering.cpp                       |    7 -
 js/src/jit/Lowering.h                         |    1 -
 js/src/jit/MCallOptimize.cpp                  |  152 --
 js/src/jit/MIR.h                              |   26 -
 js/src/jit/MOpcodes.h                         |    1 -
 js/src/jit/ParallelSafetyAnalysis.cpp         |    7 -
 js/src/jit/VMFunctions.cpp                    |   16 -
 js/src/js.msg                                 |    8 +-
 js/src/jsapi.cpp                              |    1 -
 js/src/jsinferinlines.h                       |    4 -
 js/src/jsprototypes.h                         |    7 +-
 js/src/moz.build                              |    1 -
 js/src/vm/ForkJoin.cpp                        |    2 +-
 js/src/vm/GlobalObject.cpp                    |    3 -
 js/src/vm/SelfHosting.cpp                     |   23 -
 117 files changed, 58 insertions(+), 3246 deletions(-)
 delete mode 100644 js/src/builtin/ParallelArray.cpp
 delete mode 100644 js/src/builtin/ParallelArray.h
 delete mode 100644 js/src/builtin/ParallelArray.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug755564.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug783923.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug784011.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug786106.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug789107.js
 delete mode 100644 js/src/jit-test/tests/auto-regress/bug791445.js
 delete mode 100644 js/src/jit-test/tests/baseline/bug846072.js
 delete mode 100644 js/src/jit-test/tests/baseline/bug857579.js
 delete mode 100644 js/src/jit-test/tests/basic/bug815652.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug783924.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug787282.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug853555.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug853573.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug854021.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug854050.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug854381.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug857846.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug858077.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug858582.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug890465.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug894782.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug895782.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug908939.js
 delete mode 100644 js/src/jit-test/tests/parallel/bug909599.js
 delete mode 100644 js/src/jit-test/tests/parallel/comprehension-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/comprehension-fn-args.js
 delete mode 100644 js/src/jit-test/tests/parallel/comprehension-scale.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-5.js
 delete mode 100644 js/src/jit-test/tests/parallel/constructor-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/element-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/element-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/element-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/flatten-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/get-6.js
 delete mode 100644 js/src/jit-test/tests/parallel/holes-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/holes-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/index-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/inline-new-bad-type.js
 delete mode 100644 js/src/jit-test/tests/parallel/length-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/length-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/length-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/map-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/overflow-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/partition-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/partition-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/reduce-higher-dim.js
 delete mode 100644 js/src/jit-test/tests/parallel/reduce-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/scan-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/scan-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-10.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-11.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-12.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-13.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-5.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-6.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-7.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-8.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-9.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-regression-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/scatter-throws.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-1.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-2.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-3.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-4.js
 delete mode 100644 js/src/jit-test/tests/parallel/shape-5.js
 delete mode 100644 js/src/jit-test/tests/parallel/toString-1.js

diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 3b2363f47d9f..0ec83523aa00 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -69,7 +69,6 @@ var ecmaGlobals =
     {name: "NaN", xbl: false},
     "Number",
     "Object",
-    {name: "ParallelArray", nightly: true},
     "Proxy",
     "RangeError",
     "ReferenceError",
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 1a7008f5c4c6..6999747d6d3d 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -579,7 +579,6 @@ selfhosting_srcs := \
   $(srcdir)/builtin/Iterator.js \
   $(srcdir)/builtin/Map.js \
   $(srcdir)/builtin/Number.js \
-  $(srcdir)/builtin/ParallelArray.js \
   $(srcdir)/builtin/String.js \
   $(srcdir)/builtin/Set.js \
   $(srcdir)/builtin/TypedObject.js \
diff --git a/js/src/builtin/Array.js b/js/src/builtin/Array.js
index b61c6c6a3192..d27f159ac295 100644
--- a/js/src/builtin/Array.js
+++ b/js/src/builtin/Array.js
@@ -556,6 +556,8 @@ function ArrayKeys() {
     return CreateArrayIterator(this, ITEM_KIND_KEY);
 }
 
+#ifdef ENABLE_PARALLEL_JS
+
 /*
  * Strawman spec:
  *   http://wiki.ecmascript.org/doku.php?id=strawman:data_parallelism
@@ -649,8 +651,6 @@ function ComputeAllSliceBounds(numItems, numSlices) {
   return info;
 }
 
-#ifdef ENABLE_PARALLEL_JS
-
 /**
  * Creates a new array by applying |func(e, i, self)| for each element |e|
  * with index |i|.
diff --git a/js/src/builtin/ParallelArray.cpp b/js/src/builtin/ParallelArray.cpp
deleted file mode 100644
index a046819a9a2e..000000000000
--- a/js/src/builtin/ParallelArray.cpp
+++ /dev/null
@@ -1,247 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "builtin/ParallelArray.h"
-
-#include "jsobj.h"
-
-#include "vm/GlobalObject.h"
-#include "vm/String.h"
-
-#include "jsobjinlines.h"
-
-using namespace js;
-
-//
-// ParallelArrayObject
-//
-
-FixedHeapPtr<PropertyName> ParallelArrayObject::ctorNames[NumCtors];
-
-const JSFunctionSpec ParallelArrayObject::methods[] = {
-    JS_SELF_HOSTED_FN("map",       "ParallelArrayMap",       2, 0),
-    JS_SELF_HOSTED_FN("reduce",    "ParallelArrayReduce",    2, 0),
-    JS_SELF_HOSTED_FN("scan",      "ParallelArrayScan",      2, 0),
-    JS_SELF_HOSTED_FN("scatter",   "ParallelArrayScatter",   5, 0),
-    JS_SELF_HOSTED_FN("filter",    "ParallelArrayFilter",    2, 0),
-    JS_SELF_HOSTED_FN("partition", "ParallelArrayPartition", 1, 0),
-    JS_SELF_HOSTED_FN("flatten",   "ParallelArrayFlatten",   0, 0),
-
-    // FIXME #838906. Note that `get()` is not currently defined on this table but
-    // rather is assigned to each instance of ParallelArray as an own
-    // property.  This is a bit of a hack designed to supply a
-    // specialized version of get() based on the dimensionality of the
-    // receiver.  In the future we can improve this by (1) extending
-    // TI to track the dimensionality of the receiver and (2) using a
-    // hint to aggressively inline calls to get().
-    // JS_SELF_HOSTED_FN("get", "ParallelArrayGet", 1, 0),
-
-    JS_SELF_HOSTED_FN("toString",  "ParallelArrayToString",  0, 0),
-    JS_FS_END
-};
-
-const JSPropertySpec ParallelArrayObject::properties[] = {
-    JS_SELF_HOSTED_GET("length", "ParallelArrayLength", JSPROP_PERMANENT),
-    JS_PS_END
-};
-
-const Class ParallelArrayObject::protoClass = {
-    "ParallelArray",
-    JSCLASS_HAS_CACHED_PROTO(JSProto_ParallelArray),
-    JS_PropertyStub,         // addProperty
-    JS_DeletePropertyStub,   // delProperty
-    JS_PropertyStub,         // getProperty
-    JS_StrictPropertyStub,   // setProperty
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub
-};
-
-const Class ParallelArrayObject::class_ = {
-    "ParallelArray",
-    JSCLASS_HAS_CACHED_PROTO(JSProto_ParallelArray),
-    JS_PropertyStub,         // addProperty
-    JS_DeletePropertyStub,   // delProperty
-    JS_PropertyStub,         // getProperty
-    JS_StrictPropertyStub,   // setProperty
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub
-};
-
-/*static*/ bool
-ParallelArrayObject::initProps(JSContext *cx, HandleObject obj)
-{
-    RootedValue undef(cx, UndefinedValue());
-    RootedValue zero(cx, Int32Value(0));
-
-    if (!JSObject::defineProperty(cx, obj, cx->names().buffer, undef))
-        return false;
-    if (!JSObject::defineProperty(cx, obj, cx->names().offset, zero))
-        return false;
-    if (!JSObject::defineProperty(cx, obj, cx->names().shape, undef))
-        return false;
-    if (!JSObject::defineProperty(cx, obj, cx->names().get, undef))
-        return false;
-
-    return true;
-}
-
-/*static*/ bool
-ParallelArrayObject::construct(JSContext *cx, unsigned argc, Value *vp)
-{
-    RootedFunction ctor(cx, getConstructor(cx, argc));
-    if (!ctor)
-        return false;
-    CallArgs args = CallArgsFromVp(argc, vp);
-    return constructHelper(cx, &ctor, args);
-}
-
-/* static */ JSFunction *
-ParallelArrayObject::maybeGetConstructor(GlobalObject *global, unsigned argc)
-{
-    PropertyName *ctorName = ctorNames[js::Min(argc, NumCtors - 1)];
-    Value ctorValue;
-    if (!global->maybeGetIntrinsicValue(ctorName, &ctorValue))
-        return nullptr;
-    JS_ASSERT(ctorValue.isObject() && ctorValue.toObject().is<JSFunction>());
-    return &ctorValue.toObject().as<JSFunction>();
-}
-
-/* static */ JSFunction *
-ParallelArrayObject::getConstructor(JSContext *cx, unsigned argc)
-{
-    RootedPropertyName ctorName(cx, ctorNames[js::Min(argc, NumCtors - 1)]);
-    RootedValue ctorValue(cx);
-    if (!cx->global()->getIntrinsicValue(cx, ctorName, &ctorValue))
-        return nullptr;
-    JS_ASSERT(ctorValue.isObject() && ctorValue.toObject().is<JSFunction>());
-    return &ctorValue.toObject().as<JSFunction>();
-}
-
-/*static*/ JSObject *
-ParallelArrayObject::newInstance(JSContext *cx, NewObjectKind newKind /* = GenericObject */)
-{
-    gc::AllocKind kind = gc::GetGCObjectKind(NumFixedSlots);
-    RootedObject result(cx, NewBuiltinClassInstance(cx, &class_, kind, newKind));
-    if (!result)
-        return nullptr;
-
-    // Add in the basic PA properties now with default values:
-    if (!initProps(cx, result))
-        return nullptr;
-
-    return result;
-}
-
-/*static*/ bool
-ParallelArrayObject::constructHelper(JSContext *cx, MutableHandleFunction ctor, CallArgs &args0)
-{
-    RootedObject result(cx, newInstance(cx, TenuredObject));
-    if (!result)
-        return false;
-
-    if (cx->typeInferenceEnabled()) {
-        jsbytecode *pc;
-        RootedScript script(cx, cx->currentScript(&pc));
-        if (script) {
-            if (ctor->nonLazyScript()->shouldCloneAtCallsite()) {
-                ctor.set(CloneFunctionAtCallsite(cx, ctor, script, pc));
-                if (!ctor)
-                    return false;
-            }
-
-            // Create the type object for the PA.  Add in the current
-            // properties as definite properties if this type object is newly
-            // created.  To tell if it is newly created, we check whether it
-            // has any properties yet or not, since any returned type object
-            // must have been created by this same C++ code and hence would
-            // already have properties if it had been returned before.
-            types::TypeObject *paTypeObject =
-                types::TypeScript::InitObject(cx, script, pc, JSProto_ParallelArray);
-            if (!paTypeObject)
-                return false;
-            if (paTypeObject->getPropertyCount() == 0 && !paTypeObject->unknownProperties()) {
-                if (!paTypeObject->addDefiniteProperties(cx, result))
-                    return false;
-
-                // addDefiniteProperties() above should have added one
-                // property for each of the fixed slots:
-                JS_ASSERT(paTypeObject->getPropertyCount() == NumFixedSlots);
-            }
-            result->setType(paTypeObject);
-        }
-    }
-
-    InvokeArgs args(cx);
-    if (!args.init(args0.length()))
-        return false;
-
-    args.setCallee(ObjectValue(*ctor));
-    args.setThis(ObjectValue(*result));
-
-    for (uint32_t i = 0; i < args0.length(); i++)
-        args[i].set(args0[i]);
-
-    if (!Invoke(cx, args))
-        return false;
-
-    args0.rval().setObject(*result);
-    return true;
-}
-
-JSObject *
-ParallelArrayObject::initClass(JSContext *cx, HandleObject obj)
-{
-    JS_ASSERT(obj->isNative());
-
-    // Cache constructor names.
-    {
-        static const char *const ctorStrs[NumCtors] = {
-            "ParallelArrayConstructEmpty",
-            "ParallelArrayConstructFromArray",
-            "ParallelArrayConstructFromFunction",
-            "ParallelArrayConstructFromFunctionMode"
-        };
-        for (uint32_t i = 0; i < NumCtors; i++) {
-            JSAtom *atom = Atomize(cx, ctorStrs[i], strlen(ctorStrs[i]), InternAtom);
-            if (!atom)
-                return nullptr;
-            ctorNames[i].init(atom->asPropertyName());
-        }
-    }
-
-    Rooted<GlobalObject *> global(cx, &obj->as<GlobalObject>());
-
-    RootedObject proto(cx, global->createBlankPrototype(cx, &protoClass));
-    if (!proto)
-        return nullptr;
-
-    JSProtoKey key = JSProto_ParallelArray;
-    RootedFunction ctor(cx, global->createConstructor(cx, construct,
-                                                      cx->names().ParallelArray, 0));
-    if (!ctor ||
-        !LinkConstructorAndPrototype(cx, ctor, proto) ||
-        !DefinePropertiesAndBrand(cx, proto, properties, methods) ||
-        !DefineConstructorAndPrototype(cx, global, key, ctor, proto))
-    {
-        return nullptr;
-    }
-
-    return proto;
-}
-
-bool
-ParallelArrayObject::is(const Value &v)
-{
-    return v.isObject() && v.toObject().hasClass(&class_);
-}
-
-JSObject *
-js_InitParallelArrayClass(JSContext *cx, js::HandleObject obj)
-{
-    return ParallelArrayObject::initClass(cx, obj);
-}
diff --git a/js/src/builtin/ParallelArray.h b/js/src/builtin/ParallelArray.h
deleted file mode 100644
index 3232ae70b2d0..000000000000
--- a/js/src/builtin/ParallelArray.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sts=4 et sw=4 tw=99:
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef builtin_ParallelArray_h
-#define builtin_ParallelArray_h
-
-#include "jsobj.h"
-
-namespace js {
-
-class ParallelArrayObject : public JSObject
-{
-    static const Class protoClass;
-    static const JSFunctionSpec methods[];
-    static const JSPropertySpec properties[];
-    static const uint32_t NumFixedSlots = 4;
-    static const uint32_t NumCtors = 4;
-    static FixedHeapPtr<PropertyName> ctorNames[NumCtors];
-
-    static bool initProps(JSContext *cx, HandleObject obj);
-
-  public:
-    static const Class class_;
-
-    static bool construct(JSContext *cx, unsigned argc, Value *vp);
-    static bool constructHelper(JSContext *cx, MutableHandleFunction ctor, CallArgs &args);
-
-    // Creates a new ParallelArray instance with the correct number of slots
-    // and so forth.
-    //
-    // NOTE: This object will NOT have the correct type object! It is
-    // up to the caller to adjust the type object appropriately
-    // before releasing the object into the wild.  You probably want
-    // to be calling construct() above, which will adjust the type
-    // object for you, since ParallelArray type objects must be setup
-    // in a rather particular way to interact well with the
-    // self-hosted code.  See constructHelper() for details.
-    static JSObject *newInstance(JSContext *cx, NewObjectKind newKind = GenericObject);
-
-    // Get the constructor function for argc number of arguments.
-    static JSFunction *maybeGetConstructor(GlobalObject *global, unsigned argc);
-    static JSFunction *getConstructor(JSContext *cx, unsigned argc);
-
-    static JSObject *initClass(JSContext *cx, HandleObject obj);
-    static bool is(const Value &v);
-};
-
-} // namespace js
-
-extern JSObject *
-js_InitParallelArrayClass(JSContext *cx, js::HandleObject obj);
-
-#endif /* builtin_ParallelArray_h */
diff --git a/js/src/builtin/ParallelArray.js b/js/src/builtin/ParallelArray.js
deleted file mode 100644
index 4ae4c09c1850..000000000000
--- a/js/src/builtin/ParallelArray.js
+++ /dev/null
@@ -1,1253 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// FIXME(bug 844882): Parallel array properties should not be exposed.
-
-/**
- * Compute the partial products in reverse order.
- * e.g., if the shape is [A,B,C,D], then the
- * array |products| will be [1,D,CD,BCD].
- */
-function ComputeProducts(shape) {
-  var product = 1;
-  var products = [1];
-  var sdimensionality = shape.length;
-  for (var i = sdimensionality - 1; i > 0; i--) {
-    product *= shape[i];
-    ARRAY_PUSH(products, product);
-  }
-  return products;
-}
-
-/**
- * Given a shape and some index |index1d|, computes and returns an
- * array containing the N-dimensional index that maps to |index1d|.
- */
-function ComputeIndices(shape, index1d) {
-
-  var products = ComputeProducts(shape);
-  var l = shape.length;
-
-  var result = [];
-  for (var i = 0; i < l; i++) {
-    // Obtain product of all higher dimensions.
-    // So if i == 0 and shape is [A,B,C,D], yields BCD.
-    var stride = products[l - i - 1];
-
-    // Compute how many steps of width stride we could take.
-    var index = (index1d / stride) | 0;
-    ARRAY_PUSH(result, index);
-
-    // Adjust remaining indices for smaller dimensions.
-    index1d -= (index * stride);
-  }
-
-  return result;
-}
-
-function StepIndices(shape, indices) {
-  for (var i = shape.length - 1; i >= 0; i--) {
-    var indexi = indices[i] + 1;
-    if (indexi < shape[i]) {
-      indices[i] = indexi;
-      return;
-    }
-    indices[i] = 0;
-  }
-}
-
-// Constructor
-//
-// We split the 3 construction cases so that we don't case on arguments.
-
-/**
- * This is the function invoked for |new ParallelArray()|
- */
-function ParallelArrayConstructEmpty() {
-  this.buffer = [];
-  this.offset = 0;
-  this.shape = [0];
-  this.get = ParallelArrayGet1;
-}
-
-/**
- * This is the function invoked for |new ParallelArray(array)|.
- * It copies the data from its array-like argument |array|.
- */
-function ParallelArrayConstructFromArray(array) {
-  var buffer = ToObject(array);
-  var length = buffer.length >>> 0;
-  if (length !== buffer.length)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-
-  var buffer1 = [];
-  for (var i = 0; i < length; i++)
-    ARRAY_PUSH(buffer1, buffer[i]);
-
-  this.buffer = buffer1;
-  this.offset = 0;
-  this.shape = [length];
-  this.get = ParallelArrayGet1;
-}
-
-/**
- * Wrapper around |ParallelArrayConstructFromComprehension()| for the
- * case where 2 arguments are supplied. This is typically what users will
- * invoke. We provide an explicit two-argument version rather than
- * relying on JS's semantics for absent arguments because it simplifies
- * the ion code that does inlining of PA constructors.
- */
-function ParallelArrayConstructFromFunction(shape, func) {
-  return ParallelArrayConstructFromComprehension(this, shape, func, undefined);
-}
-
-/**
- * Wrapper around |ParallelArrayConstructFromComprehension()| for the
- * case where 3 arguments are supplied.
- */
-function ParallelArrayConstructFromFunctionMode(shape, func, mode) {
-  return ParallelArrayConstructFromComprehension(this, shape, func, mode);
-}
-
-/**
- * "Comprehension form": This is the function invoked for |new
- * ParallelArray(dim, fn)|. If |dim| is a number, then it creates a
- * new 1-dimensional parallel array with shape |[dim]| where index |i|
- * is equal to |fn(i)|. If |dim| is a vector, then it creates a new
- * N-dimensional parallel array where index |a, b, ... z| is equal to
- * |fn(a, b, ...z)|.
- *
- * The final |mode| argument is an internal argument used only
- * during our unit-testing.
- */
-function ParallelArrayConstructFromComprehension(self, shape, func, mode) {
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  if (typeof shape === "number") {
-    var length = shape >>> 0;
-    if (length !== shape)
-      ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-    ParallelArrayBuild(self, [length], func, mode);
-  } else if (!shape || typeof shape.length !== "number") {
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-  } else {
-    var shape1 = [];
-    for (var i = 0, l = shape.length; i < l; i++) {
-      var s0 = shape[i];
-      var s1 = s0 >>> 0;
-      if (s1 !== s0)
-        ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-      ARRAY_PUSH(shape1, s1);
-    }
-    ParallelArrayBuild(self, shape1, func, mode);
-  }
-}
-
-/**
- * Internal function used when constructing new parallel arrays. The
- * NewParallelArray() intrinsic takes a ctor function which it invokes
- * with the given shape, buffer, offset. The |this| parameter will be
- * the newly constructed parallel array.
- */
-function ParallelArrayView(shape, buffer, offset) {
-  this.shape = shape;
-  this.buffer = buffer;
-  this.offset = offset;
-
-  switch (shape.length) {
-    case 1: this.get = ParallelArrayGet1; break;
-    case 2: this.get = ParallelArrayGet2; break;
-    case 3: this.get = ParallelArrayGet3; break;
-    default: this.get = ParallelArrayGetN; break;
-  }
-
-  // Due to inlining of NewParallelArray, the return type of this function
-  // gets recorded as the return type of NewParallelArray at inlined sites, so
-  // we must take care to return the same thing.
-  return this;
-}
-
-/**
- * Helper for the comprehension form. Constructs an N-dimensional
- * array where |N == shape.length|. |shape| must be an array of
- * integers. The data for any given index vector |i| is determined by
- * |func(...i)|.
- */
-function ParallelArrayBuild(self, shape, func, mode) {
-  self.offset = 0;
-  self.shape = shape;
-
-  var length;
-  var xDimension, yDimension, zDimension;
-  var computefunc;
-
-  switch (shape.length) {
-  case 1:
-    length = shape[0];
-    self.get = ParallelArrayGet1;
-    computefunc = fill1;
-    break;
-  case 2:
-    xDimension = shape[0];
-    yDimension = shape[1];
-    length = xDimension * yDimension;
-    self.get = ParallelArrayGet2;
-    computefunc = fill2;
-    break;
-  case 3:
-    xDimension = shape[0];
-    yDimension = shape[1];
-    zDimension = shape[2];
-    length = xDimension * yDimension * zDimension;
-    self.get = ParallelArrayGet3;
-    computefunc = fill3;
-    break;
-  default:
-    length = 1;
-    for (var i = 0; i < shape.length; i++)
-      length *= shape[i];
-    self.get = ParallelArrayGetN;
-    computefunc = fillN;
-    break;
-  }
-
-  var buffer = self.buffer = NewDenseArray(length);
-
-  parallel: for (;;) {
-    // Avoid parallel compilation if we are already nested in another
-    // parallel section or the user told us not to parallelize. The
-    // use of a for (;;) loop is working around some ion limitations:
-    //
-    // - Breaking out of named blocks does not currently work (bug 684384);
-    // - Unreachable Code Elim. can't properly handle if (a && b) (bug 669796)
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-    if (computefunc === fillN)
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-    ForkJoin(constructSlice, ForkJoinMode(mode));
-    return;
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  computefunc(0, length);
-  return;
-
-  function constructSlice(sliceId, numSlices, warmup) {
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos)
-      chunkEnd = chunkPos + 1;
-
-    while (chunkPos < chunkEnd) {
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      computefunc(indexStart, indexEnd);
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  function fill1(indexStart, indexEnd) {
-    for (var i = indexStart; i < indexEnd; i++)
-      UnsafePutElements(buffer, i, func(i));
-  }
-
-  function fill2(indexStart, indexEnd) {
-    var x = (indexStart / yDimension) | 0;
-    var y = indexStart - x * yDimension;
-    for (var i = indexStart; i < indexEnd; i++) {
-      UnsafePutElements(buffer, i, func(x, y));
-      if (++y == yDimension) {
-        y = 0;
-        ++x;
-      }
-    }
-  }
-
-  function fill3(indexStart, indexEnd) {
-    var x = (indexStart / (yDimension * zDimension)) | 0;
-    var r = indexStart - x * yDimension * zDimension;
-    var y = (r / zDimension) | 0;
-    var z = r - y * zDimension;
-    for (var i = indexStart; i < indexEnd; i++) {
-      UnsafePutElements(buffer, i, func(x, y, z));
-      if (++z == zDimension) {
-        z = 0;
-        if (++y == yDimension) {
-          y = 0;
-          ++x;
-        }
-      }
-    }
-  }
-
-  function fillN(indexStart, indexEnd) {
-    var indices = ComputeIndices(shape, indexStart);
-    for (var i = indexStart; i < indexEnd; i++) {
-      var result = callFunction(std_Function_apply, func, null, indices);
-      UnsafePutElements(buffer, i, result);
-      StepIndices(shape, indices);
-    }
-  }
-}
-
-/**
- * Creates a new parallel array by applying |func(e, i, self)| for each
- * element |e| with index |i|. Note that
- * this always operates on the outermost dimension only.
- */
-function ParallelArrayMap(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-  var buffer = NewDenseArray(length);
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-    ForkJoin(mapSlice, ForkJoinMode(mode));
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  for (var i = 0; i < length; i++) {
-    // Note: Unlike JS arrays, parallel arrays cannot have holes.
-    var v = func(self.get(i), i, self);
-    UnsafePutElements(buffer, i, v);
-  }
-  return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-
-  function mapSlice(sliceId, numSlices, warmup) {
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos + 1)
-      chunkEnd = chunkPos + 1;
-
-    while (chunkPos < chunkEnd) {
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-
-      for (var i = indexStart; i < indexEnd; i++)
-        UnsafePutElements(buffer, i, func(self.get(i), i, self));
-
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  return undefined;
-}
-
-/**
- * Reduces the elements in a parallel array's outermost dimension
- * using the given reduction function.
- */
-function ParallelArrayReduce(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-
-  if (length === 0)
-    ThrowError(JSMSG_PAR_ARRAY_REDUCE_EMPTY);
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    if (chunks < numSlices)
-      break parallel;
-
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-    var subreductions = NewDenseArray(numSlices);
-    ForkJoin(reduceSlice, ForkJoinMode(mode));
-    var accumulator = subreductions[0];
-    for (var i = 1; i < numSlices; i++)
-      accumulator = func(accumulator, subreductions[i]);
-    return accumulator;
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  var accumulator = self.get(0);
-  for (var i = 1; i < length; i++)
-    accumulator = func(accumulator, self.get(i));
-  return accumulator;
-
-  function reduceSlice(sliceId, numSlices, warmup) {
-    var chunkStart = info[SLICE_START(sliceId)];
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    // (*) This function is carefully designed so that the warmup
-    // (which executes with chunkStart === chunkPos) will execute all
-    // potential loads and stores. In particular, the warmup run
-    // processes two chunks rather than one. Moreover, it stores
-    // accumulator into subreductions and then loads it again to
-    // ensure that the load is executed during the warmup, as it will
-    // certainly be executed during subsequent runs.
-
-    if (warmup && chunkEnd > chunkPos + 2)
-      chunkEnd = chunkPos + 2;
-
-    if (chunkStart === chunkPos) {
-      var indexPos = chunkStart << CHUNK_SHIFT;
-      var accumulator = reduceChunk(self.get(indexPos), indexPos + 1, indexPos + CHUNK_SIZE);
-
-      UnsafePutElements(subreductions, sliceId, accumulator, // see (*) above
-                        info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    var accumulator = subreductions[sliceId]; // see (*) above
-
-    while (chunkPos < chunkEnd) {
-      var indexPos = chunkPos << CHUNK_SHIFT;
-      accumulator = reduceChunk(accumulator, indexPos, indexPos + CHUNK_SIZE);
-      UnsafePutElements(subreductions, sliceId, accumulator, info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  function reduceChunk(accumulator, from, to) {
-    to = std_Math_min(to, length);
-    for (var i = from; i < to; i++)
-      accumulator = func(accumulator, self.get(i));
-    return accumulator;
-  }
-
-  return undefined;
-}
-
-/**
- * |scan()| returns an array [s_0, ..., s_N] where
- * |s_i| is equal to the reduction (as per |reduce()|)
- * of elements |0..i|. This is the generalization
- * of partial sum.
- */
-function ParallelArrayScan(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-
-  if (length === 0)
-    ThrowError(JSMSG_PAR_ARRAY_REDUCE_EMPTY);
-
-  var buffer = NewDenseArray(length);
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    if (chunks < numSlices)
-      break parallel;
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-
-    // Scan slices individually (see comment on phase1()).
-    ForkJoin(phase1, ForkJoinMode(mode));
-
-    // Compute intermediates array (see comment on phase2()).
-    var intermediates = [];
-    var accumulator = buffer[finalElement(0)];
-    ARRAY_PUSH(intermediates, accumulator);
-    for (var i = 1; i < numSlices - 1; i++) {
-      accumulator = func(accumulator, buffer[finalElement(i)]);
-      ARRAY_PUSH(intermediates, accumulator);
-    }
-
-    // Reset the current position information for each slice, but
-    // convert from chunks to indices (see comment on phase2()).
-    for (var i = 0; i < numSlices; i++) {
-      info[SLICE_POS(i)] = info[SLICE_START(i)] << CHUNK_SHIFT;
-      info[SLICE_END(i)] = info[SLICE_END(i)] << CHUNK_SHIFT;
-    }
-    info[SLICE_END(numSlices - 1)] = std_Math_min(info[SLICE_END(numSlices - 1)], length);
-
-    // Complete each slice using intermediates array (see comment on phase2()).
-    ForkJoin(phase2, ForkJoinMode(mode));
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  scan(self.get(0), 0, length);
-  return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-
-  function scan(accumulator, start, end) {
-    UnsafePutElements(buffer, start, accumulator);
-    for (var i = start + 1; i < end; i++) {
-      accumulator = func(accumulator, self.get(i));
-      UnsafePutElements(buffer, i, accumulator);
-    }
-    return accumulator;
-  }
-
-  /**
-   * In phase 1, we divide the source array into |numSlices| slices and
-   * compute scan on each slice sequentially as if it were the entire
-   * array. This function is responsible for computing one of those
-   * slices.
-   *
-   * So, if we have an array [A,B,C,D,E,F,G,H,I], |numSlices == 3|,
-   * and our function |func| is sum, then we would wind up computing a
-   * result array like:
-   *
-   *     [A, A+B, A+B+C, D, D+E, D+E+F, G, G+H, G+H+I]
-   *      ^~~~~~~~~~~~^  ^~~~~~~~~~~~^  ^~~~~~~~~~~~~^
-   *      Slice 0        Slice 1        Slice 2
-   *
-   * Read on in phase2 to see what we do next!
-   */
-  function phase1(sliceId, numSlices, warmup) {
-    var chunkStart = info[SLICE_START(sliceId)];
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos + 2)
-      chunkEnd = chunkPos + 2;
-
-    if (chunkPos == chunkStart) {
-      // For the first chunk, the accumulator begins as the value in
-      // the input at the start of the chunk.
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      scan(self.get(indexStart), indexStart, indexEnd);
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    while (chunkPos < chunkEnd) {
-      // For each subsequent chunk, the accumulator begins as the
-      // combination of the final value of prev chunk and the value in
-      // the input at the start of this chunk. Note that this loop is
-      // written as simple as possible, at the cost of an extra read
-      // from the buffer per iteration.
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      var accumulator = func(buffer[indexStart - 1], self.get(indexStart));
-      scan(accumulator, indexStart, indexEnd);
-      UnsafePutElements(info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  /**
-   * Computes the index of the final element computed by the slice |sliceId|.
-   */
-  function finalElement(sliceId) {
-    var chunkEnd = info[SLICE_END(sliceId)]; // last chunk written by |sliceId| is endChunk - 1
-    var indexStart = std_Math_min(chunkEnd << CHUNK_SHIFT, length);
-    return indexStart - 1;
-  }
-
-  /**
-   * After computing the phase1 results, we compute an
-   * |intermediates| array. |intermediates[i]| contains the result
-   * of reducing the final value from each preceding slice j<i with
-   * the final value of slice i. So, to continue our previous
-   * example, the intermediates array would contain:
-   *
-   *   [A+B+C, (A+B+C)+(D+E+F), ((A+B+C)+(D+E+F))+(G+H+I)]
-   *
-   * Here I have used parenthesization to make clear the order of
-   * evaluation in each case.
-   *
-   *   An aside: currently the intermediates array is computed
-   *   sequentially. In principle, we could compute it in parallel,
-   *   at the cost of doing duplicate work. This did not seem
-   *   particularly advantageous to me, particularly as the number
-   *   of slices is typically quite small (one per core), so I opted
-   *   to just compute it sequentially.
-   *
-   * Phase 2 combines the results of phase1 with the intermediates
-   * array to produce the final scan results. The idea is to
-   * reiterate over each element S[i] in the slice |sliceId|, which
-   * currently contains the result of reducing with S[0]...S[i]
-   * (where S0 is the first thing in the slice), and combine that
-   * with |intermediate[sliceId-1]|, which represents the result of
-   * reducing everything in the input array prior to the slice.
-   *
-   * To continue with our example, in phase 1 we computed slice 1 to
-   * be [D, D+E, D+E+F]. We will combine those results with
-   * |intermediates[1-1]|, which is |A+B+C|, so that the final
-   * result is [(A+B+C)+D, (A+B+C)+(D+E), (A+B+C)+(D+E+F)]. Again I
-   * am using parentheses to clarify how these results were reduced.
-   *
-   * SUBTLE: Because we are mutating |buffer| in place, we have to
-   * be very careful about bailouts!  We cannot checkpoint a chunk
-   * at a time as we do elsewhere because that assumes it is safe to
-   * replay the portion of a chunk which was already processed.
-   * Therefore, in this phase, we track the current position at an
-   * index granularity, although this requires two memory writes per
-   * index.
-   */
-  function phase2(sliceId, numSlices, warmup) {
-    if (sliceId == 0)
-      return true; // No work to do for the 0th slice.
-
-    var indexPos = info[SLICE_POS(sliceId)];
-    var indexEnd = info[SLICE_END(sliceId)];
-
-    if (warmup)
-      indexEnd = std_Math_min(indexEnd, indexPos + CHUNK_SIZE);
-
-    var intermediate = intermediates[sliceId - 1];
-    for (; indexPos < indexEnd; indexPos++) {
-      UnsafePutElements(buffer, indexPos, func(intermediate, buffer[indexPos]),
-                        info, SLICE_POS(sliceId), indexPos + 1);
-    }
-
-    return indexEnd == info[SLICE_END(sliceId)];
-  }
-
-  return undefined;
-}
-
-/**
- * |scatter()| redistributes the elements in the parallel array
- * into a new parallel array.
- *
- * - targets: The index targets[i] indicates where the ith element
- *   should appear in the result.
- *
- * - defaultValue: what value to use for indices in the output array that
- *   are never targeted.
- *
- * - conflictFunc: The conflict function. Used to resolve what
- *   happens if two indices i and j in the source array are targeted
- *   as the same destination (i.e., targets[i] == targets[j]), then
- *   the final result is determined by applying func(targets[i],
- *   targets[j]). If no conflict function is provided, it is an error
- *   if targets[i] == targets[j].
- *
- * - length: length of the output array (if not specified, uses the
- *   length of the input).
- *
- * - mode: internal debugging specification.
- */
-function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check targets is array-like
-  // FIXME(bug 844887): Check |IsCallable(conflictFunc)|
-
-  var self = this;
-
-  if (length === undefined)
-    length = self.shape[0];
-
-  // The Divide-Scatter-Vector strategy:
-  // 1. Slice |targets| array of indices ("scatter-vector") into N
-  //    parts.
-  // 2. Each of the N threads prepares an output buffer and a
-  //    write-log.
-  // 3. Each thread scatters according to one of the N parts into its
-  //    own output buffer, tracking written indices in the write-log
-  //    and resolving any resulting local collisions in parallel.
-  // 4. Merge the parts (either in parallel or sequentially), using
-  //    the write-logs as both the basis for finding merge-inputs and
-  //    for detecting collisions.
-
-  // The Divide-Output-Range strategy:
-  // 1. Slice the range of indices [0..|length|-1] into N parts.
-  //    Allocate a single shared output buffer of length |length|.
-  // 2. Each of the N threads scans (the entirety of) the |targets|
-  //    array, seeking occurrences of indices from that thread's part
-  //    of the range, and writing the results into the shared output
-  //    buffer.
-  // 3. Since each thread has its own portion of the output range,
-  //    every collision that occurs can be handled thread-locally.
-
-  // SO:
-  //
-  // If |targets.length| >> |length|, Divide-Scatter-Vector seems like
-  // a clear win over Divide-Output-Range, since for the latter, the
-  // expense of redundantly scanning the |targets| will diminish the
-  // gain from processing |length| in parallel, while for the former,
-  // the total expense of building separate output buffers and the
-  // merging post-process is small compared to the gain from
-  // processing |targets| in parallel.
-  //
-  // If |targets.length| << |length|, then Divide-Output-Range seems
-  // like it *could* win over Divide-Scatter-Vector. (But when is
-  // |targets.length| << |length| or even |targets.length| < |length|?
-  // Seems like an odd situation and an uncommon case at best.)
-  //
-  // The unanswered question is which strategy performs better when
-  // |targets.length| approximately equals |length|, especially for
-  // special cases like collision-free scatters and permutations.
-
-  var targetsLength = std_Math_min(targets.length, self.shape[0]);
-
-  if (targetsLength >>> 0 !== targetsLength)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, ".prototype.scatter length");
-
-  if (length >>> 0 !== length)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, ".prototype.scatter length");
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    if (forceDivideScatterVector())
-      return parDivideScatterVector();
-    else if (forceDivideOutputRange())
-      return parDivideOutputRange();
-    else if (conflictFunc === undefined && targetsLength < length)
-      return parDivideOutputRange();
-    return parDivideScatterVector();
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  return seq();
-
-  function forceDivideScatterVector() {
-    return mode && mode.strategy && mode.strategy == "divide-scatter-vector";
-  }
-
-  function forceDivideOutputRange() {
-    return mode && mode.strategy && mode.strategy == "divide-output-range";
-  }
-
-  function collide(elem1, elem2) {
-    if (conflictFunc === undefined)
-      ThrowError(JSMSG_PAR_ARRAY_SCATTER_CONFLICT);
-
-    return conflictFunc(elem1, elem2);
-  }
-
-
-  function parDivideOutputRange() {
-    var chunks = ComputeNumChunks(targetsLength);
-    var numSlices = ForkJoinSlices();
-    var checkpoints = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++)
-      UnsafePutElements(checkpoints, i, 0);
-
-    var buffer = NewDenseArray(length);
-    var conflicts = NewDenseArray(length);
-
-    for (var i = 0; i < length; i++) {
-      UnsafePutElements(buffer, i, defaultValue);
-      UnsafePutElements(conflicts, i, false);
-    }
-
-    ForkJoin(fill, ForkJoinMode(mode));
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-
-    function fill(sliceId, numSlices, warmup) {
-      var indexPos = checkpoints[sliceId];
-      var indexEnd = targetsLength;
-      if (warmup)
-        indexEnd = std_Math_min(indexEnd, indexPos + CHUNK_SIZE);
-
-      // Range in the output for which we are responsible:
-      var [outputStart, outputEnd] = ComputeSliceBounds(length, sliceId, numSlices);
-
-      for (; indexPos < indexEnd; indexPos++) {
-        var x = self.get(indexPos);
-        var t = checkTarget(indexPos, targets[indexPos]);
-        if (t < outputStart || t >= outputEnd)
-          continue;
-        if (conflicts[t])
-          x = collide(x, buffer[t]);
-        UnsafePutElements(buffer, t, x, conflicts, t, true, checkpoints, sliceId, indexPos + 1);
-      }
-
-      return indexEnd == targetsLength;
-    }
-
-    return undefined;
-  }
-
-  function parDivideScatterVector() {
-    // Subtle: because we will be mutating the localBuffers and
-    // conflict arrays in place, we can never replay an entry in the
-    // target array for fear of inducing a conflict where none existed
-    // before. Therefore, we must proceed not by chunks but rather by
-    // individual indices.
-    var numSlices = ForkJoinSlices();
-    var info = ComputeAllSliceBounds(targetsLength, numSlices);
-
-    // FIXME(bug 844890): Use typed arrays here.
-    var localBuffers = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++)
-      UnsafePutElements(localBuffers, i, NewDenseArray(length));
-    var localConflicts = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++) {
-      var conflicts_i = NewDenseArray(length);
-      for (var j = 0; j < length; j++)
-        UnsafePutElements(conflicts_i, j, false);
-      UnsafePutElements(localConflicts, i, conflicts_i);
-    }
-
-    // Initialize the 0th buffer, which will become the output. For
-    // the other buffers, we track which parts have been written to
-    // using the conflict buffer so they do not need to be
-    // initialized.
-    var outputBuffer = localBuffers[0];
-    for (var i = 0; i < length; i++)
-      UnsafePutElements(outputBuffer, i, defaultValue);
-
-    ForkJoin(fill, ForkJoinMode(mode));
-    mergeBuffers();
-    return NewParallelArray(ParallelArrayView, [length], outputBuffer, 0);
-
-    function fill(sliceId, numSlices, warmup) {
-      var indexPos = info[SLICE_POS(sliceId)];
-      var indexEnd = info[SLICE_END(sliceId)];
-      if (warmup)
-        indexEnd = std_Math_min(indexEnd, indexPos + CHUNK_SIZE);
-
-      var localbuffer = localBuffers[sliceId];
-      var conflicts = localConflicts[sliceId];
-      while (indexPos < indexEnd) {
-        var x = self.get(indexPos);
-        var t = checkTarget(indexPos, targets[indexPos]);
-        if (conflicts[t])
-          x = collide(x, localbuffer[t]);
-        UnsafePutElements(localbuffer, t, x, conflicts, t, true, 
-                          info, SLICE_POS(sliceId), ++indexPos);
-      }
-
-      return indexEnd == info[SLICE_END(sliceId)];
-    }
-
-    /**
-     * Merge buffers 1..NUMSLICES into buffer 0. In principle, we could
-     * parallelize the merge work as well. But for this first cut,
-     * just do the merge sequentially.
-     */
-    function mergeBuffers() {
-      var buffer = localBuffers[0];
-      var conflicts = localConflicts[0];
-      for (var i = 1; i < numSlices; i++) {
-        var otherbuffer = localBuffers[i];
-        var otherconflicts = localConflicts[i];
-        for (var j = 0; j < length; j++) {
-          if (otherconflicts[j]) {
-            if (conflicts[j]) {
-              buffer[j] = collide(otherbuffer[j], buffer[j]);
-            } else {
-              buffer[j] = otherbuffer[j];
-              conflicts[j] = true;
-            }
-          }
-        }
-      }
-    }
-
-    return undefined;
-  }
-
-  function seq() {
-    var buffer = NewDenseArray(length);
-    var conflicts = NewDenseArray(length);
-
-    for (var i = 0; i < length; i++) {
-      UnsafePutElements(buffer, i, defaultValue);
-      UnsafePutElements(conflicts, i, false);
-    }
-
-    for (var i = 0; i < targetsLength; i++) {
-      var x = self.get(i);
-      var t = checkTarget(i, targets[i]);
-      if (conflicts[t])
-        x = collide(x, buffer[t]);
-
-      UnsafePutElements(buffer, t, x, conflicts, t, true);
-    }
-
-    return NewParallelArray(ParallelArrayView, [length], buffer, 0);
-  }
-
-  function checkTarget(i, t) {
-    if (TO_INT32(t) !== t)
-      ThrowError(JSMSG_PAR_ARRAY_SCATTER_BAD_TARGET, i);
-
-    if (t < 0 || t >= length)
-      ThrowError(JSMSG_PAR_ARRAY_SCATTER_BOUNDS);
-
-    // It's not enough to return t, as -0 | 0 === -0.
-    return TO_INT32(t);
-  }
-
-  return undefined;
-}
-
-/**
- * The familiar filter() operation applied across the outermost
- * dimension.
- */
-function ParallelArrayFilter(func, mode) {
-  // FIXME(bug 844887): Check |this instanceof ParallelArray|
-  // FIXME(bug 844887): Check |IsCallable(func)|
-
-  var self = this;
-  var length = self.shape[0];
-
-  parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
-    if (ShouldForceSequential())
-      break parallel;
-    if (!TRY_PARALLEL(mode))
-      break parallel;
-
-    var chunks = ComputeNumChunks(length);
-    var numSlices = ForkJoinSlices();
-    if (chunks < numSlices * 2)
-      break parallel;
-
-    var info = ComputeAllSliceBounds(chunks, numSlices);
-
-    // Step 1. Compute which items from each slice of the result
-    // buffer should be preserved. When we're done, we have an array
-    // |survivors| containing a bitset for each chunk, indicating
-    // which members of the chunk survived. We also keep an array
-    // |counts| containing the total number of items that are being
-    // preserved from within one slice.
-    //
-    // FIXME(bug 844890): Use typed arrays here.
-    var counts = NewDenseArray(numSlices);
-    for (var i = 0; i < numSlices; i++)
-      UnsafePutElements(counts, i, 0);
-    var survivors = NewDenseArray(chunks);
-    ForkJoin(findSurvivorsInSlice, ForkJoinMode(mode));
-
-    // Step 2. Compress the slices into one contiguous set.
-    var count = 0;
-    for (var i = 0; i < numSlices; i++)
-      count += counts[i];
-    var buffer = NewDenseArray(count);
-    if (count > 0)
-      ForkJoin(copySurvivorsInSlice, ForkJoinMode(mode));
-
-    return NewParallelArray(ParallelArrayView, [count], buffer, 0);
-  }
-
-  // Sequential fallback:
-  ASSERT_SEQUENTIAL_IS_OK(mode);
-  var buffer = [];
-  for (var i = 0; i < length; i++) {
-    var elem = self.get(i);
-    if (func(elem, i, self))
-      ARRAY_PUSH(buffer, elem);
-  }
-  return NewParallelArray(ParallelArrayView, [buffer.length], buffer, 0);
-
-  /**
-   * As described above, our goal is to determine which items we
-   * will preserve from a given slice. We do this one chunk at a
-   * time. When we finish a chunk, we record our current count and
-   * the next chunk sliceId, lest we should bail.
-   */
-  function findSurvivorsInSlice(sliceId, numSlices, warmup) {
-    var chunkPos = info[SLICE_POS(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-
-    if (warmup && chunkEnd > chunkPos)
-      chunkEnd = chunkPos + 1;
-
-    var count = counts[sliceId];
-    while (chunkPos < chunkEnd) {
-      var indexStart = chunkPos << CHUNK_SHIFT;
-      var indexEnd = std_Math_min(indexStart + CHUNK_SIZE, length);
-      var chunkBits = 0;
-
-      for (var bit = 0; indexStart + bit < indexEnd; bit++) {
-        var keep = !!func(self.get(indexStart + bit), indexStart + bit, self);
-        chunkBits |= keep << bit;
-        count += keep;
-      }
-
-      UnsafePutElements(survivors, chunkPos, chunkBits,
-                        counts, sliceId, count,
-                        info, SLICE_POS(sliceId), ++chunkPos);
-    }
-
-    return chunkEnd == info[SLICE_END(sliceId)];
-  }
-
-  function copySurvivorsInSlice(sliceId, numSlices, warmup) {
-    // Copies the survivors from this slice into the correct position.
-    // Note that this is an idempotent operation that does not invoke
-    // user code. Therefore, we don't expect bailouts and make an
-    // effort to proceed chunk by chunk or avoid duplicating work.
-
-    // Total up the items preserved by previous slices.
-    var count = 0;
-    if (sliceId > 0) { // FIXME(#819219)---work around a bug in Ion's range checks
-      for (var i = 0; i < sliceId; i++)
-        count += counts[i];
-    }
-
-    // Compute the final index we expect to write.
-    var total = count + counts[sliceId];
-    if (count == total)
-      return true;
-
-    // Iterate over the chunks assigned to us. Read the bitset for
-    // each chunk. Copy values where a 1 appears until we have
-    // written all the values that we expect to. We can just iterate
-    // from 0...CHUNK_SIZE without fear of a truncated final chunk
-    // because we are already checking for when count==total.
-    var chunkStart = info[SLICE_START(sliceId)];
-    var chunkEnd = info[SLICE_END(sliceId)];
-    for (var chunk = chunkStart; chunk < chunkEnd; chunk++) {
-      var chunkBits = survivors[chunk];
-      if (!chunkBits)
-        continue;
-
-      var indexStart = chunk << CHUNK_SHIFT;
-      for (var i = 0; i < CHUNK_SIZE; i++) {
-        if (chunkBits & (1 << i)) {
-          UnsafePutElements(buffer, count++, self.get(indexStart + i));
-          if (count == total)
-            break;
-        }
-      }
-    }
-
-    return true;
-  }
-
-  return undefined;
-}
-
-/**
- * Divides the outermost dimension into two dimensions. Does not copy
- * or affect the underlying data, just how it is divided amongst
- * dimensions. So if we had a vector with shape [N, ...] and you
- * partition with amount=4, you get a [N/4, 4, ...] vector. Note that
- * N must be evenly divisible by 4 in that case.
- */
-function ParallelArrayPartition(amount) {
-  if (amount >>> 0 !== amount)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-
-  var length = this.shape[0];
-  var partitions = (length / amount) | 0;
-
-  if (partitions * amount !== length)
-    ThrowError(JSMSG_PAR_ARRAY_BAD_PARTITION);
-
-  var shape = [partitions, amount];
-  for (var i = 1; i < this.shape.length; i++)
-    ARRAY_PUSH(shape, this.shape[i]);
-  return NewParallelArray(ParallelArrayView, shape, this.buffer, this.offset);
-}
-
-/**
- * Collapses two outermost dimensions into one. So if you had
- * a [X, Y, ...] vector, you get a [X*Y, ...] vector.
- */
-function ParallelArrayFlatten() {
-  if (this.shape.length < 2)
-    ThrowError(JSMSG_PAR_ARRAY_ALREADY_FLAT);
-
-  var shape = [this.shape[0] * this.shape[1]];
-  for (var i = 2; i < this.shape.length; i++)
-    ARRAY_PUSH(shape, this.shape[i]);
-  return NewParallelArray(ParallelArrayView, shape, this.buffer, this.offset);
-}
-
-//
-// Accessors and utilities.
-//
-
-/**
- * Specialized variant of get() for one-dimensional case
- */
-function ParallelArrayGet1(i) {
-  if (i === undefined)
-    return undefined;
-  return this.buffer[this.offset + i];
-}
-
-/**
- * Specialized variant of get() for two-dimensional case
- */
-function ParallelArrayGet2(x, y) {
-  var xDimension = this.shape[0];
-  var yDimension = this.shape[1];
-  if (x === undefined)
-    return undefined;
-  if (x >= xDimension)
-    return undefined;
-  if (y === undefined)
-    return NewParallelArray(ParallelArrayView, [yDimension], this.buffer, this.offset + x * yDimension);
-  if (y >= yDimension)
-    return undefined;
-  var offset = y + x * yDimension;
-  return this.buffer[this.offset + offset];
-}
-
-/**
- * Specialized variant of get() for three-dimensional case
- */
-function ParallelArrayGet3(x, y, z) {
-  var xDimension = this.shape[0];
-  var yDimension = this.shape[1];
-  var zDimension = this.shape[2];
-  if (x === undefined)
-    return undefined;
-  if (x >= xDimension)
-    return undefined;
-  if (y === undefined)
-    return NewParallelArray(ParallelArrayView, [yDimension, zDimension],
-                            this.buffer, this.offset + x * yDimension * zDimension);
-  if (y >= yDimension)
-    return undefined;
-  if (z === undefined)
-    return NewParallelArray(ParallelArrayView, [zDimension],
-                            this.buffer, this.offset + y * zDimension + x * yDimension * zDimension);
-  if (z >= zDimension)
-    return undefined;
-  var offset = z + y*zDimension + x * yDimension * zDimension;
-  return this.buffer[this.offset + offset];
-}
-
-/**
- * Generalized version of get() for N-dimensional case
- */
-function ParallelArrayGetN(...coords) {
-  if (coords.length == 0)
-    return undefined;
-
-  var products = ComputeProducts(this.shape);
-
-  // Compute the offset of the given coordinates. Each index is
-  // multipled by its corresponding entry in the |products|
-  // array, counting in reverse. So if |coords| is [a,b,c,d],
-  // then you get |a*BCD + b*CD + c*D + d|.
-  var offset = this.offset;
-  var sDimensionality = this.shape.length;
-  var cDimensionality = coords.length;
-  for (var i = 0; i < cDimensionality; i++) {
-    if (coords[i] >= this.shape[i])
-      return undefined;
-    offset += coords[i] * products[sDimensionality - i - 1];
-  }
-
-  if (cDimensionality < sDimensionality) {
-    var shape = callFunction(std_Array_slice, this.shape, cDimensionality);
-    return NewParallelArray(ParallelArrayView, shape, this.buffer, offset);
-  }
-  return this.buffer[offset];
-}
-
-/** The length property yields the outermost dimension */
-function ParallelArrayLength() {
-  return this.shape[0];
-}
-
-function ParallelArrayToString() {
-  var l = this.length;
-  if (l == 0)
-    return "";
-
-  var open, close;
-  if (this.shape.length > 1) {
-    open = "<";
-    close = ">";
-  } else {
-    open = close = "";
-  }
-
-  var result = "";
-  for (var i = 0; i < l - 1; i++) {
-    result += open + String(this.get(i)) + close;
-    result += ",";
-  }
-  result += open + String(this.get(l - 1)) + close;
-  return result;
-}
-
-/**
- * Internal debugging tool: checks that the given `mode` permits
- * sequential execution
- */
-function AssertSequentialIsOK(mode) {
-  if (mode && mode.mode && mode.mode !== "seq" && ParallelTestsShouldPass())
-    ThrowError(JSMSG_WRONG_VALUE, "parallel execution", "sequential was forced");
-}
-
-function ForkJoinMode(mode) {
-  // WARNING: this must match the enum ForkJoinMode in ForkJoin.cpp
-  if (!mode || !mode.mode) {
-    return 0;
-  } else if (mode.mode === "compile") {
-    return 1;
-  } else if (mode.mode === "par") {
-    return 2;
-  } else if (mode.mode === "recover") {
-    return 3;
-  } else if (mode.mode === "bailout") {
-    return 4;
-  }
-  ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, "");
-  return undefined;
-}
-
-/*
- * Mark the main operations as clone-at-callsite for better precision.
- * This is slightly overkill, as all that we really need is to
- * specialize to the receiver and the elemental function, but in
- * practice this is likely not so different, since element functions
- * are often used in exactly one place.
- */
-SetScriptHints(ParallelArrayConstructEmpty, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromArray, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromFunction, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromFunctionMode, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayConstructFromComprehension, { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayView,       { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayBuild,      { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayMap,        { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayReduce,     { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayScan,       { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayScatter,    { cloneAtCallsite: true });
-SetScriptHints(ParallelArrayFilter,     { cloneAtCallsite: true });
-
-/*
- * Mark the common getters as clone-at-callsite and inline. This is
- * overkill as we should only clone per receiver, but we have no
- * mechanism for that right now. Bug 804767 might permit another
- * alternative by specializing the inlined gets.
- */
-SetScriptHints(ParallelArrayGet1,       { cloneAtCallsite: true, inline: true });
-SetScriptHints(ParallelArrayGet2,       { cloneAtCallsite: true, inline: true });
-SetScriptHints(ParallelArrayGet3,       { cloneAtCallsite: true, inline: true });
diff --git a/js/src/builtin/Utilities.js b/js/src/builtin/Utilities.js
index 77873cf58acf..8dceb836a257 100644
--- a/js/src/builtin/Utilities.js
+++ b/js/src/builtin/Utilities.js
@@ -161,3 +161,33 @@ function IsObject(v) {
            typeof v === "function" ||
            (typeof v === "undefined" && v !== undefined);
 }
+
+#ifdef ENABLE_PARALLEL_JS
+
+/**
+ * Internal debugging tool: checks that the given `mode` permits
+ * sequential execution
+ */
+function AssertSequentialIsOK(mode) {
+  if (mode && mode.mode && mode.mode !== "seq" && ParallelTestsShouldPass())
+    ThrowError(JSMSG_WRONG_VALUE, "parallel execution", "sequential was forced");
+}
+
+function ForkJoinMode(mode) {
+  // WARNING: this must match the enum ForkJoinMode in ForkJoin.cpp
+  if (!mode || !mode.mode) {
+    return 0;
+  } else if (mode.mode === "compile") {
+    return 1;
+  } else if (mode.mode === "par") {
+    return 2;
+  } else if (mode.mode === "recover") {
+    return 3;
+  } else if (mode.mode === "bailout") {
+    return 4;
+  }
+  ThrowError(JSMSG_PAR_ARRAY_BAD_ARG);
+  return undefined;
+}
+
+#endif
diff --git a/js/src/jit-test/lib/parallelarray-helpers.js b/js/src/jit-test/lib/parallelarray-helpers.js
index a6afc03b07ef..9fdc4cea0b1f 100644
--- a/js/src/jit-test/lib/parallelarray-helpers.js
+++ b/js/src/jit-test/lib/parallelarray-helpers.js
@@ -79,13 +79,7 @@ function assertAlmostEq(v1, v2) {
 }
 
 function assertStructuralEq(e1, e2) {
-    if (e1 instanceof ParallelArray && e2 instanceof ParallelArray) {
-      assertEqParallelArray(e1, e2);
-    } else if (e1 instanceof Array && e2 instanceof ParallelArray) {
-      assertEqParallelArrayArray(e2, e1);
-    } else if (e1 instanceof ParallelArray && e2 instanceof Array) {
-      assertEqParallelArrayArray(e1, e2);
-    } else if (e1 instanceof Array && e2 instanceof Array) {
+    if (e1 instanceof Array && e2 instanceof Array) {
       assertEqArray(e1, e2);
     } else if (e1 instanceof Object && e2 instanceof Object) {
       assertEq(e1.__proto__, e2.__proto__);
@@ -100,19 +94,6 @@ function assertStructuralEq(e1, e2) {
     }
 }
 
-function assertEqParallelArrayArray(a, b) {
-  assertEq(a.shape.length, 1);
-  assertEq(a.length, b.length);
-  for (var i = 0, l = a.length; i < l; i++) {
-    try {
-      assertStructuralEq(a.get(i), b[i]);
-    } catch (e) {
-      print("...in index ", i, " of ", l);
-      throw e;
-    }
-  }
-}
-
 function assertEqArray(a, b) {
     assertEq(a.length, b.length);
     for (var i = 0, l = a.length; i < l; i++) {
@@ -125,37 +106,6 @@ function assertEqArray(a, b) {
     }
 }
 
-function assertEqParallelArray(a, b) {
-  assertEq(a instanceof ParallelArray, true);
-  assertEq(b instanceof ParallelArray, true);
-
-  var shape = a.shape;
-  assertEqArray(shape, b.shape);
-
-  function bump(indices) {
-    var d = indices.length - 1;
-    while (d >= 0) {
-      if (++indices[d] < shape[d])
-        break;
-      indices[d] = 0;
-      d--;
-    }
-    return d >= 0;
-  }
-
-  var iv = shape.map(function () { return 0; });
-  do {
-    try {
-      var e1 = a.get.apply(a, iv);
-      var e2 = b.get.apply(b, iv);
-      assertStructuralEq(e1, e2);
-    } catch (e) {
-      print("...in indices ", iv, " of ", shape);
-      throw e;
-    }
-  } while (bump(iv));
-}
-
 // Checks that whenever we execute this in parallel mode,
 // it bails out. `opFunction` should be a closure that takes a
 // mode parameter and performs some parallel array operation.
@@ -164,10 +114,10 @@ function assertEqParallelArray(a, b) {
 // Here is an example of the expected usage:
 //
 //    assertParallelExecWillBail(function(m) {
-//        new ParallelArray(..., m)
+//        Array.buildPar(..., m)
 //    });
 //
-// where the `new ParallelArray(...)` is a stand-in
+// where the `Array.buildPar(...)` is a stand-in
 // for some parallel array operation.
 function assertParallelExecWillBail(opFunction) {
   opFunction({mode:"compile"}); // get the script compiled
@@ -236,30 +186,6 @@ function assertArraySeqParResultsEq(arr, op, func, cmpFunc) {
     function (r) { cmpFunc(expected, r); });
 }
 
-// Compares a ParallelArray function against its equivalent on the
-// `Array` prototype. `func` should be the closure to provide as
-// argument. For example:
-//
-//    compareAgainstArray([1, 2, 3], "map", i => i + 1)
-//
-// would check that `[1, 2, 3].map(i => i+1)` and `new
-// ParallelArray([1, 2, 3]).map(i => i+1)` yield the same result.
-//
-// Based on `assertParallelExecSucceeds`
-function compareAgainstArray(jsarray, opname, func, cmpFunction) {
-  if (!cmpFunction)
-    cmpFunction = assertStructuralEq;
-  var expected = jsarray[opname].apply(jsarray, [func]);
-  var parray = new ParallelArray(jsarray);
-  assertParallelExecSucceeds(
-    function(m) {
-      return parray[opname].apply(parray, [func, m]);
-    },
-    function(r) {
-      cmpFunction(expected, r);
-    });
-}
-
 // Similar to `compareAgainstArray`, but for the `scan` method which
 // does not appear on array.
 function testArrayScanPar(jsarray, func, cmpFunction) {
@@ -281,24 +207,6 @@ function testArrayScanPar(jsarray, func, cmpFunction) {
     });
 }
 
-// Similar to `compareAgainstArray`, but for the `scatter` method.
-// In this case, because scatter is so complex, we do not attempt
-// to compute the expected result and instead simply invoke
-// `cmpFunction(r)` with the result `r` of the scatter operation.
-function testScatter(opFunction, cmpFunction) {
-  var strategies = ["divide-scatter-version", "divide-output-range"];
-  for (var i in strategies) {
-    assertParallelExecSucceeds(
-      function(m) {
-        var m1 = {mode: m.mode,
-                  strategy: strategies[i]};
-        print(JSON.stringify(m1));
-        return opFunction(m1);
-      },
-      cmpFunction);
-  }
-}
-
 // Checks that `opFunction`, when run with each of the modes
 // in `modes`, returns the same value each time.
 function assertParallelModesCommute(modes, opFunction) {
diff --git a/js/src/jit-test/tests/auto-regress/bug755564.js b/js/src/jit-test/tests/auto-regress/bug755564.js
deleted file mode 100644
index e692508ce1b1..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug755564.js
+++ /dev/null
@@ -1,9 +0,0 @@
-// Binary: cache/js-dbg-64-50177d59c0e1-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; });
-  assertEq(r.toString( 5 ? r : 0, gc()) ,[4,2,9,4,5].join(","));
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug783923.js b/js/src/jit-test/tests/auto-regress/bug783923.js
deleted file mode 100644
index 661c77b47972..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug783923.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Binary: cache/js-dbg-64-35b8d6ef5d46-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS)
-  print(ParallelArray());
diff --git a/js/src/jit-test/tests/auto-regress/bug784011.js b/js/src/jit-test/tests/auto-regress/bug784011.js
deleted file mode 100644
index e419fcb9f6c6..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug784011.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Binary: cache/js-dbg-64-c676b554c7bb-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  var p2 = new ParallelArray([2,2], function(i,j) { return i+j; });
-  p2.get({ 0: 1, 1: 0, testGet: 2 })
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug786106.js b/js/src/jit-test/tests/auto-regress/bug786106.js
deleted file mode 100644
index ab0f84f18080..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug786106.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Binary: cache/js-dbg-64-92b9b2840a79-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  var p = new ParallelArray([2, 3,, 4, 5, 6]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; });
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug789107.js b/js/src/jit-test/tests/auto-regress/bug789107.js
deleted file mode 100644
index 9998513cd19e..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug789107.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Binary: cache/js-dbg-64-5d63594c05a9-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  ParallelArray().watch("shape", function() {})
-}
diff --git a/js/src/jit-test/tests/auto-regress/bug791445.js b/js/src/jit-test/tests/auto-regress/bug791445.js
deleted file mode 100644
index a7a3a3a10931..000000000000
--- a/js/src/jit-test/tests/auto-regress/bug791445.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Binary: cache/js-dbg-64-9fff2012b66c-linux
-// Flags:
-//
-
-if (getBuildConfiguration().parallelJS) {
-  ParallelArray(0, Proxy.createFunction(function(){}, function(){}))
-}
diff --git a/js/src/jit-test/tests/baseline/bug846072.js b/js/src/jit-test/tests/baseline/bug846072.js
deleted file mode 100644
index 368e0f03c6e3..000000000000
--- a/js/src/jit-test/tests/baseline/bug846072.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// |jit-test| error: TypeError
-if (getBuildConfiguration().parallelJS) {
-  toString = undefined;
-  if (!(this in ParallelArray)) {}
-} else {
-  throw new TypeError();
-}
diff --git a/js/src/jit-test/tests/baseline/bug857579.js b/js/src/jit-test/tests/baseline/bug857579.js
deleted file mode 100644
index 117e76c25747..000000000000
--- a/js/src/jit-test/tests/baseline/bug857579.js
+++ /dev/null
@@ -1,22 +0,0 @@
-// |jit-test| ion-eager; error: TypeError
-
-function testMonitorIntrinsic() {
-  var N = 2;
-  // Make an NxN array of zeros.
-  var p = new ParallelArray([N,N], function () 0);
-  // |i| will go out of bounds!
-  for (var i = 0; i < N+1; i++) {
-    for (var j = 0; j < 2; j++) {
-      // When |i| goes out of bounds, we will bail from Ion to BC on an
-      // 'undefined' result inside parallel array's .get, tripping a type
-      // barrier on GETINTRINSIC.
-      p.get(i).get(j);
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS) {
-  testMonitorIntrinsic();
-} else {
-  throw new TypeError();
-}
diff --git a/js/src/jit-test/tests/basic/bug815652.js b/js/src/jit-test/tests/basic/bug815652.js
deleted file mode 100644
index ad2b9ad86c65..000000000000
--- a/js/src/jit-test/tests/basic/bug815652.js
+++ /dev/null
@@ -1,12 +0,0 @@
-
-gczeal(9, 2)
-function testScatterConflict() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,(0)], 9, function (a,b) { return a+b; });
-  function assertEqParallelArray(a, b)
-    assertEq(a instanceof ParallelArray, true);
-  assertEqParallelArray(r, new ParallelArray([4,2,(false),4,5]));
-}
-if (getBuildConfiguration().parallelJS) {
-  testScatterConflict();
-}
diff --git a/js/src/jit-test/tests/parallel/binary-arith-numbers.js b/js/src/jit-test/tests/parallel/binary-arith-numbers.js
index 72d3a069f717..cc3a2e5a6397 100644
--- a/js/src/jit-test/tests/parallel/binary-arith-numbers.js
+++ b/js/src/jit-test/tests/parallel/binary-arith-numbers.js
@@ -18,12 +18,11 @@ function theTest() {
   jsarray0.map(op);
 
   // this version will never actually touch the strings:
-  var jsarray1 = range(0, 1024).map(i => i % 10);
-  compareAgainstArray(jsarray1, "map", op);
+  assertArraySeqParResultsEq(range(0, 1024), "map", function (i) { return i % 10; });
 
   // but if we try against the original we get bailouts:
   assertParallelExecWillBail(function (mode) {
-    new ParallelArray(jsarray0).map(op, mode);
+    jsarray0.mapPar(op, mode);
   });
 }
 
diff --git a/js/src/jit-test/tests/parallel/bug783924.js b/js/src/jit-test/tests/parallel/bug783924.js
deleted file mode 100644
index 2ca003d4a0c0..000000000000
--- a/js/src/jit-test/tests/parallel/bug783924.js
+++ /dev/null
@@ -1,7 +0,0 @@
-function bug783924() {
-  // Shouldn't throw.
-  Function("ParallelArray([])")();
-}
-
-if (getBuildConfiguration().parallelJS)
-  bug783924();
diff --git a/js/src/jit-test/tests/parallel/bug787282.js b/js/src/jit-test/tests/parallel/bug787282.js
deleted file mode 100644
index e8848c618501..000000000000
--- a/js/src/jit-test/tests/parallel/bug787282.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// |jit-test| error: TypeError
-
-var protoArr = Proxy.create({}, null);
-void (Array.prototype.__proto__ = protoArr);
-gczeal(2);
-function testCopyBigArray() {
-  var a = new Array(10000);
-  for (var cnt = 0; cnt < a.length; cnt+=2) {
-    var p = new ParallelArray(a);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testCopyBigArray();
-else
-  throw new TypeError();
diff --git a/js/src/jit-test/tests/parallel/bug853555.js b/js/src/jit-test/tests/parallel/bug853555.js
deleted file mode 100644
index 49338c2c3298..000000000000
--- a/js/src/jit-test/tests/parallel/bug853555.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function test() {
-  Object.prototype[0] = /a/;
-  function getterFunction(v) { return "getter"; }
-  Object.defineProperty(Array.prototype, 1, { get: getterFunction });
-  gczeal(4);
-  var p = new ParallelArray([1,2,3,4,5]);
-  p.scatter([0,1,0,3,01], 9, function (a,b) { return a+b; });
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
-
diff --git a/js/src/jit-test/tests/parallel/bug853573.js b/js/src/jit-test/tests/parallel/bug853573.js
deleted file mode 100644
index 8024a4269416..000000000000
--- a/js/src/jit-test/tests/parallel/bug853573.js
+++ /dev/null
@@ -1,17 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  var p = Proxy.create({
-    has : function(id) {}
-  });
-  Object.prototype.__proto__ = p;
-    var pa0 = new ParallelArray(range(0, 256));
-    var pa1 = new ParallelArray(256, function (x) {
-      return pa0.map(function(y) {});
-    });
-}
-
-function range(n, m) {
-  var result = [];
-  for (var i = n; i < m; i++)
-    result.push(i);
-  return result;
-}
diff --git a/js/src/jit-test/tests/parallel/bug854021.js b/js/src/jit-test/tests/parallel/bug854021.js
deleted file mode 100644
index 6b73e0bc9600..000000000000
--- a/js/src/jit-test/tests/parallel/bug854021.js
+++ /dev/null
@@ -1,3 +0,0 @@
-// Don't crash.
-if (getBuildConfiguration().parallelJS)
-  ParallelArray(7, function ([y]) {})
diff --git a/js/src/jit-test/tests/parallel/bug854050.js b/js/src/jit-test/tests/parallel/bug854050.js
deleted file mode 100644
index a839b3634b7a..000000000000
--- a/js/src/jit-test/tests/parallel/bug854050.js
+++ /dev/null
@@ -1,10 +0,0 @@
-function bug854050() {
-  // Shouldn't crash. Tests Ion's argumentsRectifier loading the right
-  // IonScript depending on execution mode.
-  for (z = 0; z < 1; z++)
-    function x(b, x) {}
-  ParallelArray(47, x);
-}
-
-if (getBuildConfiguration().parallelJS)
-  bug854050();
diff --git a/js/src/jit-test/tests/parallel/bug854381.js b/js/src/jit-test/tests/parallel/bug854381.js
deleted file mode 100644
index 99c0b1239820..000000000000
--- a/js/src/jit-test/tests/parallel/bug854381.js
+++ /dev/null
@@ -1,20 +0,0 @@
-function bug854381() {
-  // Don't crash.
-  function toString(r) {
-    var l = 2;
-    var result = "";
-    for (var i = 0; i < l; i++)
-      result += r.get(i);
-    return result;
-  }
-
-  var p = new ParallelArray(['x', 'x']);
-  var r = new ParallelArray([toString(p), 42]);
-
-  gc();
-  print(toString(r));
-}
-
-if (getBuildConfiguration().parallelJS) {
-  bug854381();
-}
diff --git a/js/src/jit-test/tests/parallel/bug857846.js b/js/src/jit-test/tests/parallel/bug857846.js
deleted file mode 100644
index 19ef69e25cd1..000000000000
--- a/js/src/jit-test/tests/parallel/bug857846.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function testNegativeZeroScatter() {
-  // Don't crash.
-  var p = new ParallelArray([0]);
-  var r = p.scatter([-0], 0, undefined, 1);
-}
-
-if (getBuildConfiguration().parallelJS) {
-  testNegativeZeroScatter();
-}
diff --git a/js/src/jit-test/tests/parallel/bug858077.js b/js/src/jit-test/tests/parallel/bug858077.js
deleted file mode 100644
index 4af7e467fb34..000000000000
--- a/js/src/jit-test/tests/parallel/bug858077.js
+++ /dev/null
@@ -1,5 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  var a = new ParallelArray([1,2,3,4]);
-  for (var i = 0; i < 9 && i > -1000; i-- )
-    a[i] += [0];
-}
diff --git a/js/src/jit-test/tests/parallel/bug858582.js b/js/src/jit-test/tests/parallel/bug858582.js
deleted file mode 100644
index da3f9df98a32..000000000000
--- a/js/src/jit-test/tests/parallel/bug858582.js
+++ /dev/null
@@ -1,68 +0,0 @@
-// |jit-test| error: TypeError
-// Don't crash.
-if (getBuildConfiguration().parallelJS) {
-gczeal(2);
-evaluate("\
-function assertAlmostEq(v1, v2) {\
-  print(\"v2 = \" + v2);\
-  print(\"% diff = \" + percent);\
-function assertStructuralEq(e1, e2) {}\
-function assertEqParallelArrayArray(a, b) {\
-    try {} catch (e) {\
-      print(\"...in index \", i, \" of \", l);\
-  }\
-}\
-    function assertEqArray(a, b) {\
-      try {} catch (e) {}\
-}\
-function assertEqParallelArray(a, b) {\
-  var shape = a.shape;\
-  function bump(indices) {\
-  var iv = shape.map(function () { return 0; });\
-      print(\"...in indices \", iv, \" of \", shape);\
-    }\
-  } while (bump(iv));\
-}\
-function assertParallelArrayModesEq(modes, acc, opFunction, cmpFunction) {\
-  modes.forEach(function (mode) {\
-    var result = opFunction({ mode: mode, expect: \"success\" });\
-    cmpFunction(acc, result);\
-  });\
-function assertParallelArrayModesCommute(modes, opFunction) {\
-    var acc = opFunction({ mode: modes[0], expect: \"success\" });\
-}\
-function comparePerformance(opts) {\
-        print(\"Option \" + opts[i].name + \" took \" + diff + \"ms\");\
-        print(\"Option \" + opts[i].name + \" relative to option \" +\
-              opts[0].name + \": \" + (rel|0) + \"%\");\
-    }\
-}\
-function compareAgainstArray(jsarray, opname, func, cmpFunction) {\
-  var expected = jsarray[opname].apply(jsarray, [func]);\
-  var parray = new ParallelArray(jsarray);\
-  assertParallelArrayModesEq([\"seq\", \"par\", \"par\"], expected, function(m) {\
-    var result = parray[opname].apply(parray, [func, m]);\
-  }, cmpFunction);\
-}\
-function testFilter(jsarray, func, cmpFunction) {}\
-", { noScriptRval : true });
-  compareAgainstArray([
-	"a", 
-	"b", 
-	('captures: 1,1; RegExp.leftContext: ""; RegExp.rightContext: "123456"'), 
-	"d", "e", 
-	"f", "g", "h",
-        "i", "j", "k", "l", 
-	"m", "n", "o", "p",
-        "q", "r", "s", "t", 
-	(.6  ), "v", "w", "x", "y", "z"
-	], "map", function(e) { 
-		return e != "u" 
-			&& 
-			(function b   (   )  { 
-			} )      
-			!= "x"; 
-	});
-} else {
-  throw new TypeError();
-}
diff --git a/js/src/jit-test/tests/parallel/bug890465.js b/js/src/jit-test/tests/parallel/bug890465.js
deleted file mode 100644
index e47a157c0102..000000000000
--- a/js/src/jit-test/tests/parallel/bug890465.js
+++ /dev/null
@@ -1,6 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  x = Uint8ClampedArray()
-  ParallelArray([320], function() {
-      return x[8]
-  })
-}
diff --git a/js/src/jit-test/tests/parallel/bug894782.js b/js/src/jit-test/tests/parallel/bug894782.js
deleted file mode 100644
index f25875b28320..000000000000
--- a/js/src/jit-test/tests/parallel/bug894782.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Don't crash
-
-if (getBuildConfiguration().parallelJS) {
-  print(ParallelArray())
-  String(Object.create(ParallelArray(8077, function() {})))
-}
diff --git a/js/src/jit-test/tests/parallel/bug895782.js b/js/src/jit-test/tests/parallel/bug895782.js
deleted file mode 100644
index f8538fa6a918..000000000000
--- a/js/src/jit-test/tests/parallel/bug895782.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// Don't crash
-
-if (getBuildConfiguration().parallelJS) {
-  Object.defineProperty(this, "y", {
-    get: function() {
-      return Object.create(x)
-    }
-  })
-  x = ParallelArray([1142], function() {})
-  x = x.partition(2)
-  y + y
-}
diff --git a/js/src/jit-test/tests/parallel/bug908939.js b/js/src/jit-test/tests/parallel/bug908939.js
deleted file mode 100644
index d70a27858ad7..000000000000
--- a/js/src/jit-test/tests/parallel/bug908939.js
+++ /dev/null
@@ -1,13 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  x = ParallelArray([9937], function() {
-      return /x/
-      })
-  Object.defineProperty(this, "y", {
-    get: function() {
-      return Object.create(x)
-    }
-  })
-  y + x
-  x = x.scatter([]);
-  + y
-}
diff --git a/js/src/jit-test/tests/parallel/bug909599.js b/js/src/jit-test/tests/parallel/bug909599.js
deleted file mode 100644
index 1dee7caaf61c..000000000000
--- a/js/src/jit-test/tests/parallel/bug909599.js
+++ /dev/null
@@ -1,6 +0,0 @@
-if (getBuildConfiguration().parallelJS) {
-  x = Math.tan(5) + []
-  ParallelArray([764], (function() {})).filter(function(e) {
-      return e << x
-  })
-}
diff --git a/js/src/jit-test/tests/parallel/compare-values.js b/js/src/jit-test/tests/parallel/compare-values.js
index 398df363b37a..0da90f4fd5e0 100644
--- a/js/src/jit-test/tests/parallel/compare-values.js
+++ b/js/src/jit-test/tests/parallel/compare-values.js
@@ -15,29 +15,29 @@ function theTest() {
     return doubles[i] == e;
   }
   print("doubles");
-  compareAgainstArray(doubles, "map", looselyCompareToDoubles)
+  assertArraySeqParResultsEq(doubles, "map", looselyCompareToDoubles);
   print("bools");
-  compareAgainstArray(bools, "map", looselyCompareToDoubles)
+  assertArraySeqParResultsEq(bools, "map", looselyCompareToDoubles);
   // ion bails out when converting a string to a double right now,
   // so par exec cannot proceed
   print("strings");
   assertParallelExecWillBail(function (mode) {
-    new ParallelArray(strings).map(looselyCompareToDoubles, mode)
+    strings.mapPar(looselyCompareToDoubles, mode)
   });
   print("ints");
-  compareAgainstArray(ints, "map", looselyCompareToDoubles)
+  assertArraySeqParResultsEq(ints, "map", looselyCompareToDoubles);
 
   function strictlyCompareToDoubles(e, i) {
     return doubles[i] === e;
   }
   print("doubles, strict");
-  compareAgainstArray(doubles, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(doubles, "map", strictlyCompareToDoubles);
   print("bools, strict");
-  compareAgainstArray(bools, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(bools, "map", strictlyCompareToDoubles);
   print("strings, strict");
-  compareAgainstArray(strings, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(strings, "map", strictlyCompareToDoubles);
   print("ints, strict");
-  compareAgainstArray(ints, "map", strictlyCompareToDoubles)
+  assertArraySeqParResultsEq(ints, "map", strictlyCompareToDoubles);
 }
 
 if (getBuildConfiguration().parallelJS)
diff --git a/js/src/jit-test/tests/parallel/comprehension-2.js b/js/src/jit-test/tests/parallel/comprehension-2.js
deleted file mode 100644
index 4c61faffb271..000000000000
--- a/js/src/jit-test/tests/parallel/comprehension-2.js
+++ /dev/null
@@ -1,13 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-load(libdir + "eqArrayHelper.js");
-
-function buildMultidim() {
-  // 2D comprehension
-  var p = new ParallelArray([2,2], function (i,j) { return i + j; });
-  var a = new ParallelArray([0,1,1,2]).partition(2);
-  assertEqArray(p.shape, [2,2]);
-  assertEqParallelArray(p, a);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildMultidim();
diff --git a/js/src/jit-test/tests/parallel/comprehension-fn-args.js b/js/src/jit-test/tests/parallel/comprehension-fn-args.js
deleted file mode 100644
index bb2004d6f46d..000000000000
--- a/js/src/jit-test/tests/parallel/comprehension-fn-args.js
+++ /dev/null
@@ -1,16 +0,0 @@
-
-function buildComprehension() {
-  // Test kernel function arguments
-  var shape = [];
-  for (var i = 0; i < 8; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () {
-      assertEq(arguments.length, shape.length);
-      for (var j = 0; j < shape.length; j++)
-        assertEq(arguments[j] >= 0 && arguments[j] < shape[j], true);
-    });
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildComprehension();
diff --git a/js/src/jit-test/tests/parallel/comprehension-scale.js b/js/src/jit-test/tests/parallel/comprehension-scale.js
deleted file mode 100644
index d10d01ea8552..000000000000
--- a/js/src/jit-test/tests/parallel/comprehension-scale.js
+++ /dev/null
@@ -1,22 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function buildComprehension() {
-  var H = 96;
-  var W = 96;
-  var d = 4;
-  // 3D 96x96x4 texture-like PA
-  var p = new ParallelArray([H,W,d], function (i,j,k) { return i + j + k; });
-  var a = [];
-  for (var i = 0; i < H; i++) {
-    for (var j = 0; j < W; j++) {
-      for (var k = 0; k < d; k++) {
-        a.push(i+j+k);
-      }
-    }
-  }
-  var p2 = new ParallelArray(a).partition(d).partition(W);
-  assertEqParallelArray(p, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildComprehension();
diff --git a/js/src/jit-test/tests/parallel/constructor-1.js b/js/src/jit-test/tests/parallel/constructor-1.js
deleted file mode 100644
index d5d5160344ad..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-1.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function buildSimple() {
-  // Simple constructor
-  var a = [1,2,3,4,5];
-  var p = new ParallelArray(a);
-  assertEqParallelArrayArray(p, a);
-  var a2 = a.slice();
-  a[0] = 9;
-  // No sharing
-  assertEqParallelArrayArray(p, a2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildSimple();
diff --git a/js/src/jit-test/tests/parallel/constructor-2.js b/js/src/jit-test/tests/parallel/constructor-2.js
deleted file mode 100644
index 38a69b51f2cf..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-2.js
+++ /dev/null
@@ -1,15 +0,0 @@
-
-function buildWithHoles() {
-  // Test holes
-  var a = new Array(5);
-  for (var cnt = 0; cnt < a.length; cnt+=2) {
-      a[cnt] = cnt;
-  }
-  var b = [0,1,2,3,4];
-  var p = new ParallelArray(a);
-  assertEq(Object.keys(p).join(","), Object.keys(b).join(","));
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   buildWithHoles();
diff --git a/js/src/jit-test/tests/parallel/constructor-3.js b/js/src/jit-test/tests/parallel/constructor-3.js
deleted file mode 100644
index 6fc501650a36..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-3.js
+++ /dev/null
@@ -1,14 +0,0 @@
-function bracket(s) {
-  return "<" + s + ">";
-}
-
-function buildArrayLike() {
-  // Construct copying from array-like
-  var a = { 0: 1, 1: 2, 2: 3, 3: 4, length: 4 };
-  var p = new ParallelArray(a);
-  var e = Array.prototype.join.call(a, ",");
-  assertEq(p.toString(), e);
-}
-
-if (getBuildConfiguration().parallelJS)
-  buildArrayLike();
diff --git a/js/src/jit-test/tests/parallel/constructor-4.js b/js/src/jit-test/tests/parallel/constructor-4.js
deleted file mode 100644
index 7b435c2eb9df..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-4.js
+++ /dev/null
@@ -1,16 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function buildPA() {
-  // Construct copying from PA
-  var p1 = new ParallelArray([1,2,3,4]);
-  var p2 = new ParallelArray(p1);
-  assertEqParallelArray(p1, p2);
-
-  var p1d = new ParallelArray([2,2], function(i,j) { return i + j; });
-  var p2d = new ParallelArray(p1d);
-  assertEq(p1d.toString(), p2d.toString());
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   buildPA();
diff --git a/js/src/jit-test/tests/parallel/constructor-5.js b/js/src/jit-test/tests/parallel/constructor-5.js
deleted file mode 100644
index 929c80fdabb4..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-5.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// |jit-test| slow;
-// ^^ This test is slow when --no-ion is used, specifically,
-//    as part of TBPL.
-
-function testCopyBigArray() {
-  // Don't crash
-  var a = new Array(1000 * 1000);
-  var p = new ParallelArray(a);
-  // Holes!
-  var a = new Array(10000);
-  for (var cnt = 0; cnt < a.length; cnt+=2) {
-    a[cnt] = cnt;
-    var p = new ParallelArray(a);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testCopyBigArray();
diff --git a/js/src/jit-test/tests/parallel/constructor-throws.js b/js/src/jit-test/tests/parallel/constructor-throws.js
deleted file mode 100644
index 20e760a8c0d8..000000000000
--- a/js/src/jit-test/tests/parallel/constructor-throws.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "asserts.js");
-
-function testThrows() {
-  assertThrowsInstanceOf(function () {
-    new ParallelArray({ length: 0xffffffff + 1 });
-  }, RangeError);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testThrows();
diff --git a/js/src/jit-test/tests/parallel/element-1.js b/js/src/jit-test/tests/parallel/element-1.js
deleted file mode 100644
index a26843aed7fc..000000000000
--- a/js/src/jit-test/tests/parallel/element-1.js
+++ /dev/null
@@ -1,14 +0,0 @@
-function testElement() {
-  // Test getting element from 1D
-  var a = [1,{},"a",false]
-  var p = new ParallelArray(a);
-  for (var i = 0; i < a.length; i++) {
-    assertEq(p.get(i), p.get(i));
-    assertEq(p.get(i), a[i]);
-  }
-  // Test out of bounds
-  assertEq(p.get(42), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testElement();
diff --git a/js/src/jit-test/tests/parallel/element-2.js b/js/src/jit-test/tests/parallel/element-2.js
deleted file mode 100644
index bb23b95f42eb..000000000000
--- a/js/src/jit-test/tests/parallel/element-2.js
+++ /dev/null
@@ -1,26 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testElement() {
-  // Test getting element from higher dimension
-  var p = new ParallelArray([2,2,2], function () { return 0; });
-  var p0 = new ParallelArray([2,2], function () { return 0; });
-  print("0");
-  assertEqParallelArray(p.get(0), p0);
-
-  // Should create new wrapper
-  print("1");
-  assertEq(p.get(0) !== p.get(0), true);
-
-  // Test out of bounds
-  print("2");
-  assertEq(p.get(42), undefined);
-
-  // Test getting element from 0-lengthed higher dimension
-  var pp = new ParallelArray([0,0], function() { return 0; });
-  assertEq(pp.get(2), undefined);
-  var pp2 = new ParallelArray([2,0], function() { return 0; });
-  assertEqParallelArray(pp2.get(0), new ParallelArray());
-}
-
-if (getBuildConfiguration().parallelJS)
-  testElement();
diff --git a/js/src/jit-test/tests/parallel/element-3.js b/js/src/jit-test/tests/parallel/element-3.js
deleted file mode 100644
index 7872d9d001c8..000000000000
--- a/js/src/jit-test/tests/parallel/element-3.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function testElement() {
-  var p = new ParallelArray([9]);
-  var desc = Object.getOwnPropertyDescriptor(p, "0");
-  assertEq(desc.enumerable, true);
-  assertEq(desc.configurable, false);
-  assertEq(desc.writable, false);
-  assertEq(desc.value, 9);
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   testElement();
diff --git a/js/src/jit-test/tests/parallel/flatten-1.js b/js/src/jit-test/tests/parallel/flatten-1.js
deleted file mode 100644
index d7d68923e802..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-1.js
+++ /dev/null
@@ -1,14 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testFlatten() {
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function(i,j) { return i+j; });
-    var flatShape = ([shape[0] * shape[1]]).concat(shape.slice(2));
-    assertEqArray(p.flatten().shape, flatShape);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testFlatten();
diff --git a/js/src/jit-test/tests/parallel/flatten-2.js b/js/src/jit-test/tests/parallel/flatten-2.js
deleted file mode 100644
index 7a7249b15e68..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-2.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testFlatten() {
-  var p = new ParallelArray([2,2], function(i,j) { return i+j; });
-  var p2 = new ParallelArray([0,1,1,2]);
-  assertEqParallelArray(p.flatten(), p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testFlatten();
diff --git a/js/src/jit-test/tests/parallel/flatten-3.js b/js/src/jit-test/tests/parallel/flatten-3.js
deleted file mode 100644
index 82967567c12b..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-3.js
+++ /dev/null
@@ -1,25 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testFlatten() {
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2,3]);
-  var p = new ParallelArray([p0, p1]);
-  var p2 = new ParallelArray([0,1,2,3]);
-  assertEqParallelArray(p.flatten(), p2);
-
-  // Test flatten crossing packed boundary with non-shape uniform elements
-  var blah = new ParallelArray([2,2], function() { return 0; });
-  var pp = new ParallelArray([p0, p1, blah]);
-  var p2 = new ParallelArray([0,1,2,3,blah[0],blah[1]]);
-  assertEqParallelArray(pp.flatten(), p2);
-
-  var p0 = new ParallelArray([2,2], function() { return 1; });
-  var p1 = new ParallelArray([2,2], function() { return 2; });
-  var p = new ParallelArray([p0, p1]);
-  var p2 = new ParallelArray([p0[0],p0[1],p1[0],p1[1]]);
-  assertEqParallelArray(p.flatten(), p2);
-}
-
-// FIXME(bug 844991) logical shape not implemented
-// if (getBuildConfiguration().parallelJS)
-//   testFlatten();
diff --git a/js/src/jit-test/tests/parallel/flatten-throws.js b/js/src/jit-test/tests/parallel/flatten-throws.js
deleted file mode 100644
index 47fd1ce3fc5f..000000000000
--- a/js/src/jit-test/tests/parallel/flatten-throws.js
+++ /dev/null
@@ -1,12 +0,0 @@
-// |jit-test| error: Error;
-
-function testFlattenFlat() {
-  // Throw on flattening flat array
-  var p = new ParallelArray([1]);
-  var f = p.flatten();
-}
-
-if (getBuildConfiguration().parallelJS)
-  testFlattenFlat();
-else
-  throw new Error();
diff --git a/js/src/jit-test/tests/parallel/get-1.js b/js/src/jit-test/tests/parallel/get-1.js
deleted file mode 100644
index 5a0c5cfc5146..000000000000
--- a/js/src/jit-test/tests/parallel/get-1.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function testGet() {
-  var a = [1,2,3,4,5];
-  var p = new ParallelArray(a);
-  for (var i = 0; i < a.length; i++)
-    assertEq(p.get(i), a[i]);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGet();
diff --git a/js/src/jit-test/tests/parallel/get-2.js b/js/src/jit-test/tests/parallel/get-2.js
deleted file mode 100644
index 2601f4e1d967..000000000000
--- a/js/src/jit-test/tests/parallel/get-2.js
+++ /dev/null
@@ -1,14 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testGet() {
-  var p = new ParallelArray([2,2,2], function(i,j,k) { return i+j+k; });
-  assertEq(p.get(1,1,1), 1+1+1);
-  var p2 = new ParallelArray([2], function(i) { return 1+1+i; });
-  assertEqParallelArray(p.get(1,1), p2);
-  var p3 = new ParallelArray([2,2], function(i,j) { return 1+i+j; });
-  assertEqParallelArray(p.get(1), p3);
-  assertEq(p.get(5,5), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGet();
diff --git a/js/src/jit-test/tests/parallel/get-3.js b/js/src/jit-test/tests/parallel/get-3.js
deleted file mode 100644
index f548db7fed80..000000000000
--- a/js/src/jit-test/tests/parallel/get-3.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function testGetNoCraziness() {
-  // .get shouldn't do prototype walks
-  ParallelArray.prototype[42] = "foo";
-  var p = new ParallelArray([1,2,3,4]);
-  assertEq(p.get(42), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGetNoCraziness();
diff --git a/js/src/jit-test/tests/parallel/get-4.js b/js/src/jit-test/tests/parallel/get-4.js
deleted file mode 100644
index 96568978e4bf..000000000000
--- a/js/src/jit-test/tests/parallel/get-4.js
+++ /dev/null
@@ -1,7 +0,0 @@
-function testGetBounds() {
-  var p = new ParallelArray([1,2,3,4]);
-  assertEq(p.get(42), undefined);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testGetBounds();
diff --git a/js/src/jit-test/tests/parallel/get-6.js b/js/src/jit-test/tests/parallel/get-6.js
deleted file mode 100644
index 8d652193612c..000000000000
--- a/js/src/jit-test/tests/parallel/get-6.js
+++ /dev/null
@@ -1,14 +0,0 @@
-function testGet() {
-  // Test getting higher dimension inferred shape
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2,3]);
-  var p = new ParallelArray([p0, p1]);
-  assertEq(p.get(0,0), 0);
-  assertEq(p.get(0,1), 1);
-  assertEq(p.get(1,0), 2);
-  assertEq(p.get(1,1), 3);
-}
-
-// FIXME(bug 844991) logical shape not implemented
-// if (getBuildConfiguration().parallelJS)
-//   testGet();
diff --git a/js/src/jit-test/tests/parallel/holes-1.js b/js/src/jit-test/tests/parallel/holes-1.js
deleted file mode 100644
index d6b21e71ea9b..000000000000
--- a/js/src/jit-test/tests/parallel/holes-1.js
+++ /dev/null
@@ -1,31 +0,0 @@
-function testHoles() {
-  function f1(a) { return a * 42; }
-  function f2(a,b) { return a * b; }
-  // Don't crash when getting holes out.
-  //
-  // We do the multiplications below instead of asserting against undefined to
-  // force the VM to call a conversion function, which will crash if the value
-  // we got out is a JS_ARRAY_HOLE.
-  var p = new ParallelArray([,1]);
-  assertEq(p.get(0) * 42, NaN);
-  var m = p.map(f1);
-  assertEq(m.get(0), NaN);
-  assertEq(m.get(1), 42);
-  var r = p.reduce(f2);
-  assertEq(r, NaN);
-  var s = p.scan(f2);
-  assertEq(s.get(0) * 42, NaN);
-  assertEq(s.get(1), NaN);
-  var k = p.scatter([1,0]);
-  assertEq(k.get(0), 1);
-  assertEq(k[1] * 42, NaN);
-  var l = p.filter(function (e, i) { return i == 0; });
-  assertEq(l.get(0) * 42, NaN);
-  var p2 = p.partition(1);
-  assertEq(p2.get(0).get(0) * 42, NaN);
-  var g = p.get(0);
-  assertEq(g * 42, NaN);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testHoles();
diff --git a/js/src/jit-test/tests/parallel/holes-2.js b/js/src/jit-test/tests/parallel/holes-2.js
deleted file mode 100644
index 161a0001e948..000000000000
--- a/js/src/jit-test/tests/parallel/holes-2.js
+++ /dev/null
@@ -1,25 +0,0 @@
-function testElement() {
-  // No crazy prototype walking for indexed properties
-  ParallelArray.prototype[42] = "foo";
-  ParallelArray.prototype.bar = "bar";
-  var p = new ParallelArray([1,2,3,4]);
-  assertEq(p[42], undefined);
-  assertEq(42 in p, false);
-  assertEq("bar" in p, true);
-  // Don't inherit any indexed properties
-  for (var i in p)
-    assertEq(i !== 42, true);
-  for (var i in p) {
-    if (i % 1 !== 0)
-      assertEq(i, "bar");
-  }
-  ParallelArray.prototype[0] = "foo";
-  var p2 = new ParallelArray([,2]);
-  // ParallelArrays have no holes, so 0 must be 'in' p2
-  assertEq(0 in p2, true);
-  assertEq(p2[0], undefined);
-}
-
-// FIXME(bug 844882) self-hosted object not array-like, exposes internal properties
-// if (getBuildConfiguration().parallelJS)
-//   testElement();
diff --git a/js/src/jit-test/tests/parallel/index-1.js b/js/src/jit-test/tests/parallel/index-1.js
deleted file mode 100644
index c264c7b68dff..000000000000
--- a/js/src/jit-test/tests/parallel/index-1.js
+++ /dev/null
@@ -1,9 +0,0 @@
-function test() {
-  var N = 22;
-  var p = new ParallelArray([N], function(i) { return i; });
-  for (var i = 0; i < N; i++)
-    assertEq(p.get(i), i);
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/index-2.js b/js/src/jit-test/tests/parallel/index-2.js
deleted file mode 100644
index 385f07157353..000000000000
--- a/js/src/jit-test/tests/parallel/index-2.js
+++ /dev/null
@@ -1,18 +0,0 @@
-function test() {
-  function mk(i, j) { return i*100+j; }
-
-  var N = 22;
-  var M = 44;
-
-  var p = new ParallelArray([N,M], mk);
-  for (var i = 0; i < N; i++) {
-    for (var j = 0; j < M; j++) {
-      print([i, j]);
-      assertEq(p.get(i, j), mk(i, j));
-      assertEq(p.get(i).get(j), mk(i, j));
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/index-3.js b/js/src/jit-test/tests/parallel/index-3.js
deleted file mode 100644
index 9606c24a3831..000000000000
--- a/js/src/jit-test/tests/parallel/index-3.js
+++ /dev/null
@@ -1,25 +0,0 @@
-function test() {
-  function mk(i, j, k) { return i*10000+j*100+k; }
-
-  var N = 10;
-  var M = 20;
-  var O = 30;
-
-  print("Computing");
-  var p = new ParallelArray([N,M,O], mk);
-
-  print("Checking");
-  for (var i = 0; i < N; i++) {
-    for (var j = 0; j < M; j++) {
-      for (var k = 0; k < O; k++) {
-        assertEq(p.get(i, j, k), mk(i, j, k));
-        assertEq(p.get(i, j).get(k), mk(i, j, k));
-        assertEq(p.get(i).get(j).get(k), mk(i, j, k));
-        assertEq(p.get(i).get(j, k), mk(i, j, k));
-      }
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/index-4.js b/js/src/jit-test/tests/parallel/index-4.js
deleted file mode 100644
index 6a1696483139..000000000000
--- a/js/src/jit-test/tests/parallel/index-4.js
+++ /dev/null
@@ -1,27 +0,0 @@
-function test() {
-  function mk(i, j, k, l) { return i*1000000+j*10000+k*100+l; }
-
-  var N = 2;
-  var M = 4;
-  var O = 6;
-  var P = 8;
-
-  print("Computing");
-  var p = new ParallelArray([N,M,O,P], mk);
-
-  print("Checking");
-  for (var i = 0; i < N; i++) {
-    for (var j = 0; j < M; j++) {
-      for (var k = 0; k < O; k++) {
-        for (var l = 0; l < P; l++) {
-          assertEq(p.get(i, j, k, l), mk(i, j, k, l));
-          assertEq(p.get(i, j).get(k, l), mk(i, j, k, l));
-          assertEq(p.get(i).get(j).get(k).get(l), mk(i, j, k, l));
-        }
-      }
-    }
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
diff --git a/js/src/jit-test/tests/parallel/inline-new-bad-type.js b/js/src/jit-test/tests/parallel/inline-new-bad-type.js
deleted file mode 100644
index df9d1cbc62f7..000000000000
--- a/js/src/jit-test/tests/parallel/inline-new-bad-type.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// |jit-test| error: RangeError
-//
-// Run with --ion-eager.
-if (getBuildConfiguration().parallelJS) {
-  function TestCase(n, d, e, a) {};
-  function reportCompare() {
-    var testcase = new TestCase("x", 0);
-  }
-  reportCompare();
-  TestCase = ParallelArray;
-  gczeal(6);
-  try {
-    reportCompare();
-  } catch(exc1) {}
-  reportCompare();
-} else {
-  throw new RangeError();
-}
diff --git a/js/src/jit-test/tests/parallel/length-1.js b/js/src/jit-test/tests/parallel/length-1.js
deleted file mode 100644
index 20d0656b808f..000000000000
--- a/js/src/jit-test/tests/parallel/length-1.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function testLength() {
-  var a = [1,2,3];
-  var p = new ParallelArray(a);
-  assertEq(p.length, a.length);
-  // Test holes
-  var a = [1,,3];
-  var p = new ParallelArray(a);
-  assertEq(p.length, a.length);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testLength();
diff --git a/js/src/jit-test/tests/parallel/length-2.js b/js/src/jit-test/tests/parallel/length-2.js
deleted file mode 100644
index 8e569abaebc0..000000000000
--- a/js/src/jit-test/tests/parallel/length-2.js
+++ /dev/null
@@ -1,13 +0,0 @@
-function testLength() {
-  // Test higher dimension shape up to 8D
-  var shape = [];
-  for (var i = 0; i < 8; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return 0; });
-    // Length should be outermost dimension
-    assertEq(p.length, shape[0]);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testLength();
diff --git a/js/src/jit-test/tests/parallel/length-3.js b/js/src/jit-test/tests/parallel/length-3.js
deleted file mode 100644
index cb9d9ce519dc..000000000000
--- a/js/src/jit-test/tests/parallel/length-3.js
+++ /dev/null
@@ -1,11 +0,0 @@
-function testLength() {
-  // Test length immutability.
-  var p = new ParallelArray([1,2,3,4]);
-  p.length = 0;
-  assertEq(p[0], 1);
-  assertEq(p.length, 4);
-}
-
-// FIXME(bug 844988) immutability not enforced
-// if (getBuildConfiguration().parallelJS)
-//   testLength();
diff --git a/js/src/jit-test/tests/parallel/mandelbrot.js b/js/src/jit-test/tests/parallel/mandelbrot.js
index 04306bb3dad3..8764399dfb88 100644
--- a/js/src/jit-test/tests/parallel/mandelbrot.js
+++ b/js/src/jit-test/tests/parallel/mandelbrot.js
@@ -46,6 +46,8 @@ var cols = 4;
 if (getBuildConfiguration().parallelJS) {
   var expected = computeSequentially();
   assertParallelExecSucceeds(
-    function (m) new ParallelArray([rows, cols], computeSetByRow, m).flatten(),
+    function (m) Array.buildPar(rows * cols, function (xy) {
+      return computeSetByRow((xy/cols)|0,(xy%cols))
+    }, m),
     function (r) assertStructuralEq(expected, r));
 }
diff --git a/js/src/jit-test/tests/parallel/map-3.js b/js/src/jit-test/tests/parallel/map-3.js
deleted file mode 100644
index f92817fb7706..000000000000
--- a/js/src/jit-test/tests/parallel/map-3.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testMap() {
-  // Test mapping higher dimensional
-  var p = new ParallelArray([2,2], function (i,j) { return i+j; });
-  var m = p.map(function(x) { return x; });
-  var p2 = new ParallelArray(p.shape[0], function (i) { return p.get(i); });
-  assertEqParallelArray(m, p2);
-}
-
-if (getBuildConfiguration().parallelJS) testMap();
-
diff --git a/js/src/jit-test/tests/parallel/overflow-throws.js b/js/src/jit-test/tests/parallel/overflow-throws.js
deleted file mode 100644
index 60f5e4264951..000000000000
--- a/js/src/jit-test/tests/parallel/overflow-throws.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "asserts.js");
-
-function testOverflow() {
-  assertThrowsInstanceOf(function () {
-    new ParallelArray([0xffffffff + 1], function() { return 0; });
-  }, RangeError);
-  assertThrowsInstanceOf(function () {
-    new ParallelArray({ length: 0xffffffff + 1 });
-  }, RangeError);
-}
-
-if (getBuildConfiguration().parallelJS) testOverflow();
diff --git a/js/src/jit-test/tests/parallel/partition-1.js b/js/src/jit-test/tests/parallel/partition-1.js
deleted file mode 100644
index 56b5a64d3af9..000000000000
--- a/js/src/jit-test/tests/parallel/partition-1.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testPartition() {
-  var p = new ParallelArray([1,2,3,4,5,6,7,8]);
-  var pp = p.partition(2);
-  var ppp = pp.partition(2);
-  var ppShape = [p.shape[0] / 2, 2].concat(p.shape.slice(1));
-  var pppShape = [pp.shape[0] / 2, 2].concat(pp.shape.slice(1));
-  assertEqArray(pp.shape, ppShape);
-  assertEq(pp.toString(), "<1,2>,<3,4>,<5,6>,<7,8>");
-  assertEqArray(ppp.shape, pppShape);
-  assertEq(ppp.toString(), "<<1,2>,<3,4>>,<<5,6>,<7,8>>");
-}
-
-if (getBuildConfiguration().parallelJS) testPartition();
diff --git a/js/src/jit-test/tests/parallel/partition-throws.js b/js/src/jit-test/tests/parallel/partition-throws.js
deleted file mode 100644
index 7126b3a39002..000000000000
--- a/js/src/jit-test/tests/parallel/partition-throws.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "asserts.js");
-
-function testPartitionDivisible() {
-  var p = new ParallelArray([1,2,3,4]);
-  var pp;
-  assertThrowsInstanceOf(function () { pp = p.partition(3); }, Error);
-  assertThrowsInstanceOf(function () { pp = p.partition(.34); }, Error);
-}
-
-if (getBuildConfiguration().parallelJS) testPartitionDivisible();
diff --git a/js/src/jit-test/tests/parallel/reduce-higher-dim.js b/js/src/jit-test/tests/parallel/reduce-higher-dim.js
deleted file mode 100644
index efe8d60fbab2..000000000000
--- a/js/src/jit-test/tests/parallel/reduce-higher-dim.js
+++ /dev/null
@@ -1,14 +0,0 @@
-
-function testReduce() {
-  // Test reduce on higher dimensional
-  // XXX Can we test this better?
-  var shape = [2];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return i+1; });
-    var r = p.reduce(function (a, b) { return a; });
-    assertEq(r.shape.length, i + 1);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testReduce();
diff --git a/js/src/jit-test/tests/parallel/reduce-throws.js b/js/src/jit-test/tests/parallel/reduce-throws.js
deleted file mode 100644
index bc2b45546281..000000000000
--- a/js/src/jit-test/tests/parallel/reduce-throws.js
+++ /dev/null
@@ -1,17 +0,0 @@
-load(libdir + "asserts.js");
-
-function testReduceThrows() {
-  // Throw on empty
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([]);
-    p.reduce(function (v, p) { return v*p; });
-  }, Error);
-  // Throw on not function
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([1]);
-    p.reduce(42);
-  }, TypeError);
-}
-
-// FIXME(bug 844886) sanity check argument types
-// if (getBuildConfiguration().parallelJS) testReduceThrows();
diff --git a/js/src/jit-test/tests/parallel/scan-3.js b/js/src/jit-test/tests/parallel/scan-3.js
deleted file mode 100644
index 9d2f812c97f4..000000000000
--- a/js/src/jit-test/tests/parallel/scan-3.js
+++ /dev/null
@@ -1,17 +0,0 @@
-function testScan() {
-  // Test reduce on higher dimensional
-  // XXX Can we test this better?
-  function f(a, b) { return a; }
-  var shape = [2];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return i+1; });
-    var r = p.reduce(f);
-    var s = p.scan(f)
-    for (var j = 0; j < s.length; j++)
-      assertEq(s.get(j).shape.length, i + 1);
-    assertEq(r.shape.length, i + 1);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testScan();
diff --git a/js/src/jit-test/tests/parallel/scan-throws.js b/js/src/jit-test/tests/parallel/scan-throws.js
deleted file mode 100644
index 4cdcceb095b5..000000000000
--- a/js/src/jit-test/tests/parallel/scan-throws.js
+++ /dev/null
@@ -1,18 +0,0 @@
-load(libdir + "asserts.js");
-
-function testScanThrows() {
-  // Throw on empty
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([]);
-    p.scan(function (v, p) { return v*p; });
-  }, Error);
-
-  // Throw on not function
-  assertThrowsInstanceOf(function () {
-    var p = new ParallelArray([1]);
-    p.scan(42);
-  }, TypeError);
-}
-
-// FIXME(bug 844886) sanity check argument types
-// if (getBuildConfiguration().parallelJS) testScanThrows();
diff --git a/js/src/jit-test/tests/parallel/scatter-1.js b/js/src/jit-test/tests/parallel/scatter-1.js
deleted file mode 100644
index 69e963982a06..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-1.js
+++ /dev/null
@@ -1,8 +0,0 @@
-
-function testScatter() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, 10);
-  assertEq(r.length, 10);
-}
-
-if (getBuildConfiguration().parallelJS) testScatter();
diff --git a/js/src/jit-test/tests/parallel/scatter-10.js b/js/src/jit-test/tests/parallel/scatter-10.js
deleted file mode 100644
index 01f3bacbec9c..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-10.js
+++ /dev/null
@@ -1,21 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is just a simple reverse permutation of the input:
-// [A, B, ..., Y, Z] ==> [Z, Y, ..., B, A]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var revidx = build(len, id).reverse();
-  var p2 = new ParallelArray(revidx.map(add1));
-  testScatter(
-    m => p.scatter(revidx, 0, undefined, len, m),
-    r => assertEqParallelArray(r, p2));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-11.js b/js/src/jit-test/tests/parallel/scatter-11.js
deleted file mode 100644
index e7b443bdd735..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-11.js
+++ /dev/null
@@ -1,21 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is a reverse permutation that has a gap at the end.
-// [A, B, ..., Y, Z] ==> [Z, Y, ..., B, A, 0]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var revidx = build(len, id).reverse();
-  var p2 = new ParallelArray(revidx.map(add1).concat([0]));
-  testScatter(
-    m => p.scatter(revidx, 0, undefined, len+1, m),
-    r => assertEqParallelArray(r, p2));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-12.js b/js/src/jit-test/tests/parallel/scatter-12.js
deleted file mode 100644
index 1cf9bd90e7d4..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-12.js
+++ /dev/null
@@ -1,22 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is a reverse permutation that has a gap at the start and at the end.
-// [A, B, ..., Y, Z] ==> [0, Z, Y, ..., B, A, 0]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var revidx = build(len, add1).reverse();
-  var p2 = new ParallelArray([0].concat(revidx).concat([0]));
-
-  testScatter(
-    m => p.scatter(revidx, 0, undefined, len+2, m),
-    r => assertEqParallelArray(r, p2));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-13.js b/js/src/jit-test/tests/parallel/scatter-13.js
deleted file mode 100644
index 20d0c19c2d9d..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-13.js
+++ /dev/null
@@ -1,24 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// Test specific scatter implementation strategies, and compare them
-// each against the sequential version.
-//
-// This is a reverse permutation of the input with collisions at front and end
-// [A, B, C, D, ..., W, X, Y, Z] ==> [Z+Y, X, W, ..., D, C, B+A]
-
-function testDivideScatterVector() {
-  var len = 1024;
-  function add1(x) { return x+1; }
-  function add3(x) { return x+3; }
-  function id(x) { return x; }
-  var p = new ParallelArray(len, add1);
-  var idx = [0,0].concat(build(len-4, add1)).concat([len-3,len-3]);
-  var revidx = idx.reverse();
-  var p2 = [3].concat(build(len-4, add3)).concat([2*len-1]);
-  var expect = new ParallelArray(p2.reverse());
-  testScatter(
-    m => p.scatter(revidx, 0, function (x,y) { return x+y; }, len-2, m),
-    r => assertEqParallelArray(r, expect));
-}
-
-if (getBuildConfiguration().parallelJS) testDivideScatterVector();
diff --git a/js/src/jit-test/tests/parallel/scatter-2.js b/js/src/jit-test/tests/parallel/scatter-2.js
deleted file mode 100644
index 07cfb5006a04..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-2.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterIdentity() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,2,3,4]);
-  assertEqParallelArray(p, r);
-}
-
-if (getBuildConfiguration().parallelJS) testScatterIdentity();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-3.js b/js/src/jit-test/tests/parallel/scatter-3.js
deleted file mode 100644
index 06a4a22ce8de..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-3.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatter3() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([1,0,3,2,4]);
-  var p2 = new ParallelArray([2,1,4,3,5]);
-  assertStructuralEq(r, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testScatter3();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-4.js b/js/src/jit-test/tests/parallel/scatter-4.js
deleted file mode 100644
index 6180397b92a1..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-4.js
+++ /dev/null
@@ -1,10 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterDefault() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,2,4], 9);
-  assertEqParallelArray(r, new ParallelArray([1,9,2,9,3]));
-}
-
-if (getBuildConfiguration().parallelJS) testScatterDefault();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-5.js b/js/src/jit-test/tests/parallel/scatter-5.js
deleted file mode 100644
index ccb88684f45b..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-5.js
+++ /dev/null
@@ -1,9 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterConflict() {
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; });
-  assertEqParallelArray(r, new ParallelArray([4,2,9,4,5]));
-}
-
-if (getBuildConfiguration().parallelJS) testScatterConflict();
diff --git a/js/src/jit-test/tests/parallel/scatter-6.js b/js/src/jit-test/tests/parallel/scatter-6.js
deleted file mode 100644
index 35996d791f36..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-6.js
+++ /dev/null
@@ -1,13 +0,0 @@
-
-function testScatter() {
-  // Test scatter on higher dimension
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function(k) { return k; });
-    var r = p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, 10);
-    assertEq(r.length, 10);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testScatter();
diff --git a/js/src/jit-test/tests/parallel/scatter-7.js b/js/src/jit-test/tests/parallel/scatter-7.js
deleted file mode 100644
index f266fe2e2d24..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-7.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatterIdentity() {
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(2);
-    var p = new ParallelArray(shape, function(k) { return k; });
-    var r = p.scatter([0,1,2,3,4]);
-    var p2 = new ParallelArray([p.get(0), p.get(1), p.get(2), p.get(3), p.get(4)]);
-    assertEqParallelArray(p2, r);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testScatterIdentity();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-8.js b/js/src/jit-test/tests/parallel/scatter-8.js
deleted file mode 100644
index d735df6af2c3..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-8.js
+++ /dev/null
@@ -1,16 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatter8() {
-  var shape = [5];
-  for (var i = 0; i < 7; i++) {
-    shape.push(2);
-    var p = new ParallelArray(shape, function(k) { return k; });
-    var r = p.scatter([1,0,3,2,4]);
-    var p2 = new ParallelArray([p.get(1), p.get(0), p.get(3), p.get(2), p.get(4)]);
-    assertEqParallelArray(p2, r);
-  }
-}
-
-if (getBuildConfiguration().parallelJS)
-  testScatter8();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-9.js b/js/src/jit-test/tests/parallel/scatter-9.js
deleted file mode 100644
index 22be34e50056..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-9.js
+++ /dev/null
@@ -1,12 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-function testScatter9() {
-  // Ignore the rest of the scatter vector if longer than source
-  var p = new ParallelArray([1,2,3,4,5]);
-  var r = p.scatter([1,0,3,2,4,1,2,3]);
-  var p2 = new ParallelArray([2,1,4,3,5]);
-  assertEqParallelArray(r, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  testScatter9();
diff --git a/js/src/jit-test/tests/parallel/scatter-regression-1.js b/js/src/jit-test/tests/parallel/scatter-regression-1.js
deleted file mode 100644
index 4a6fc5173a20..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-regression-1.js
+++ /dev/null
@@ -1,18 +0,0 @@
-load(libdir + "parallelarray-helpers.js");
-
-// The bug this is testing for:
-// the input p and the scatter vector have length 4
-// and the output p2 has length 3.  Even though p2
-// is shorter than the input lengths, we still need
-// to scan the entirety of the scatter vector, because
-// it may hold valid targets at distant indices.
-function test() {
-  var p = new ParallelArray([2,3,5,17]);
-  var r = p.scatter([0,0,2,1], 9, function (x,y) { return x * y; }, 3);
-  var p2 = new ParallelArray([6,17,5]);
-  assertEqParallelArray(r, p2);
-}
-
-if (getBuildConfiguration().parallelJS)
-  test();
-
diff --git a/js/src/jit-test/tests/parallel/scatter-throws.js b/js/src/jit-test/tests/parallel/scatter-throws.js
deleted file mode 100644
index 61c37b9a0f24..000000000000
--- a/js/src/jit-test/tests/parallel/scatter-throws.js
+++ /dev/null
@@ -1,31 +0,0 @@
-load(libdir + "asserts.js");
-
-function testScatterThrows() {
-  var p = new ParallelArray([1,2,3,4,5]);
-
-  // Throw on conflict with no resolution function
-  assertThrowsInstanceOf(function () {
-    var r = p.scatter([0,1,0,3,4]);
-  }, Error);
-  // Throw on out of bounds
-  assertThrowsInstanceOf(function () {
-    var r = p.scatter([0,1,0,3,11]);
-  }, Error);
-
-  assertThrowsInstanceOf(function () {
-    p.scatter([-1,1,0,3,4], 9, function (a,b) { return a+b; }, 10);
-  }, TypeError);
-  assertThrowsInstanceOf(function () {
-    p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, -1);
-  }, RangeError);
-  assertThrowsInstanceOf(function () {
-    p.scatter([0,1,0,3,4], 9, function (a,b) { return a+b; }, 0xffffffff + 1);
-  }, RangeError);
-  assertThrowsInstanceOf(function () {
-    p.scatter({ length: 0xffffffff + 1 }, 9, function (a,b) { return a+b; }, 10);
-  }, RangeError);
-
-}
-
-// FIXME(bug 844886) sanity check argument types
-// if (getBuildConfiguration().parallelJS) testScatterThrows();
diff --git a/js/src/jit-test/tests/parallel/shape-1.js b/js/src/jit-test/tests/parallel/shape-1.js
deleted file mode 100644
index bb455da812b1..000000000000
--- a/js/src/jit-test/tests/parallel/shape-1.js
+++ /dev/null
@@ -1,8 +0,0 @@
-function testShape() {
-  var a = [1,2,3];
-  var p = new ParallelArray(a);
-  assertEq(p.shape.length, 1);
-  assertEq(p.shape[0], a.length);
-}
-
-if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/shape-2.js b/js/src/jit-test/tests/parallel/shape-2.js
deleted file mode 100644
index 8ab7efada68b..000000000000
--- a/js/src/jit-test/tests/parallel/shape-2.js
+++ /dev/null
@@ -1,15 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testShape() {
-  // Test higher dimension shape up to 8D
-  var shape = [];
-  for (var i = 0; i < 8; i++) {
-    shape.push(i+1);
-    var p = new ParallelArray(shape, function () { return 0; });
-    // Test shape identity and shape
-    assertEqArray(p.shape, shape);
-    assertEq(p.shape !== shape, true);
-  }
-}
-
-if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/shape-3.js b/js/src/jit-test/tests/parallel/shape-3.js
deleted file mode 100644
index e8af4033b67d..000000000000
--- a/js/src/jit-test/tests/parallel/shape-3.js
+++ /dev/null
@@ -1,16 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testInfer() {
-  // Test that shapes are inferred
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2,3]);
-  var p = new ParallelArray([p0, p1]);
-  assertEqArray(p.shape, [2,2]);
-  var p0 = new ParallelArray([0,1]);
-  var p1 = new ParallelArray([2]);
-  var p = new ParallelArray([p0, p1]);
-  assertEqArray(p.shape, [2]);
-}
-
-// FIXME(bug 844991) logical shape not implemented
-// if (parallelEnabled) testInfer();
diff --git a/js/src/jit-test/tests/parallel/shape-4.js b/js/src/jit-test/tests/parallel/shape-4.js
deleted file mode 100644
index ddd47bb9c12f..000000000000
--- a/js/src/jit-test/tests/parallel/shape-4.js
+++ /dev/null
@@ -1,13 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testShape() {
-  // Test shape immutability.
-  var p = new ParallelArray([1,2,3,4]);
-  p.shape[0] = 0;
-  p.shape[1] = 42;
-  assertEq(p[0], 1);
-  assertEqArray(p.shape, [4]);
-}
-
-// FIXME(bug 844988) immutability not enforced
-// if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/shape-5.js b/js/src/jit-test/tests/parallel/shape-5.js
deleted file mode 100644
index ddd47bb9c12f..000000000000
--- a/js/src/jit-test/tests/parallel/shape-5.js
+++ /dev/null
@@ -1,13 +0,0 @@
-load(libdir + "eqArrayHelper.js");
-
-function testShape() {
-  // Test shape immutability.
-  var p = new ParallelArray([1,2,3,4]);
-  p.shape[0] = 0;
-  p.shape[1] = 42;
-  assertEq(p[0], 1);
-  assertEqArray(p.shape, [4]);
-}
-
-// FIXME(bug 844988) immutability not enforced
-// if (getBuildConfiguration().parallelJS) testShape();
diff --git a/js/src/jit-test/tests/parallel/stack-overflow.js b/js/src/jit-test/tests/parallel/stack-overflow.js
index 8993ff5703d9..c62f1de071c7 100644
--- a/js/src/jit-test/tests/parallel/stack-overflow.js
+++ b/js/src/jit-test/tests/parallel/stack-overflow.js
@@ -9,9 +9,9 @@ function kernel(n) {
 }
 
 function testMap() {
-  var p = new ParallelArray(range(0, 2048));
+  var p = range(0, 2048);
   assertParallelExecWillBail(
-    m => p.map(kernel, m));
+    m => p.mapPar(kernel, m));
 }
 
 if (getBuildConfiguration().parallelJS)
diff --git a/js/src/jit-test/tests/parallel/toString-1.js b/js/src/jit-test/tests/parallel/toString-1.js
deleted file mode 100644
index 96514373e399..000000000000
--- a/js/src/jit-test/tests/parallel/toString-1.js
+++ /dev/null
@@ -1,6 +0,0 @@
-function testToString() {
-  var p = new ParallelArray();
-  assertEq(p.toString(), "");
-}
-
-if (getBuildConfiguration().parallelJS) testToString();
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index dc8b1231cd60..e12f63ccfe7c 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -7868,19 +7868,6 @@ GetTemplateObjectForNative(JSContext *cx, HandleScript script, jsbytecode *pc,
         return true;
     }
 
-    if (native == intrinsic_NewParallelArray || native == ParallelArrayObject::construct) {
-        res.set(ParallelArrayObject::newInstance(cx, TenuredObject));
-        if (!res)
-            return false;
-
-        types::TypeObject *type =
-            types::TypeScript::InitObject(cx, script, pc, JSProto_ParallelArray);
-        if (!type)
-            return false;
-        res->setType(type);
-        return true;
-    }
-
     return true;
 }
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 7cbe48d16495..b9c2d6bd1525 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -2937,50 +2937,6 @@ CodeGenerator::generateBody()
     return true;
 }
 
-// Out-of-line object allocation for LNewParallelArray.
-class OutOfLineNewParallelArray : public OutOfLineCodeBase<CodeGenerator>
-{
-    LNewParallelArray *lir_;
-
-  public:
-    OutOfLineNewParallelArray(LNewParallelArray *lir)
-      : lir_(lir)
-    { }
-
-    bool accept(CodeGenerator *codegen) {
-        return codegen->visitOutOfLineNewParallelArray(this);
-    }
-
-    LNewParallelArray *lir() const {
-        return lir_;
-    }
-};
-
-typedef JSObject *(*NewInitParallelArrayFn)(JSContext *, HandleObject);
-static const VMFunction NewInitParallelArrayInfo =
-    FunctionInfo<NewInitParallelArrayFn>(NewInitParallelArray);
-
-bool
-CodeGenerator::visitNewParallelArrayVMCall(LNewParallelArray *lir)
-{
-    JS_ASSERT(gen->info().executionMode() == SequentialExecution);
-
-    Register objReg = ToRegister(lir->output());
-
-    JS_ASSERT(!lir->isCall());
-    saveLive(lir);
-
-    pushArg(ImmGCPtr(lir->mir()->templateObject()));
-    if (!callVM(NewInitParallelArrayInfo, lir))
-        return false;
-
-    if (ReturnReg != objReg)
-        masm.movePtr(ReturnReg, objReg);
-
-    restoreLive(lir);
-    return true;
-}
-
 // Out-of-line object allocation for LNewArray.
 class OutOfLineNewArray : public OutOfLineCodeBase<CodeGenerator>
 {
@@ -3104,32 +3060,6 @@ bool CodeGenerator::visitHypot(LHypot *lir)
     return true;
 }
 
-bool
-CodeGenerator::visitNewParallelArray(LNewParallelArray *lir)
-{
-    Register objReg = ToRegister(lir->output());
-    JSObject *templateObject = lir->mir()->templateObject();
-
-    OutOfLineNewParallelArray *ool = new(alloc()) OutOfLineNewParallelArray(lir);
-    if (!addOutOfLineCode(ool))
-        return false;
-
-    masm.newGCThing(objReg, templateObject, ool->entry(), gc::DefaultHeap);
-    masm.initGCThing(objReg, templateObject);
-
-    masm.bind(ool->rejoin());
-    return true;
-}
-
-bool
-CodeGenerator::visitOutOfLineNewParallelArray(OutOfLineNewParallelArray *ool)
-{
-    if (!visitNewParallelArrayVMCall(ool->lir()))
-        return false;
-    masm.jump(ool->rejoin());
-    return true;
-}
-
 bool
 CodeGenerator::visitNewArray(LNewArray *lir)
 {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index e522f27da234..7f264c981c8c 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -25,7 +25,6 @@
 namespace js {
 namespace jit {
 
-class OutOfLineNewParallelArray;
 class OutOfLineTestObject;
 class OutOfLineNewArray;
 class OutOfLineNewObject;
@@ -127,9 +126,6 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitDoubleToInt32(LDoubleToInt32 *lir);
     bool visitFloat32ToInt32(LFloat32ToInt32 *lir);
     bool visitNewSlots(LNewSlots *lir);
-    bool visitNewParallelArrayVMCall(LNewParallelArray *lir);
-    bool visitNewParallelArray(LNewParallelArray *lir);
-    bool visitOutOfLineNewParallelArray(OutOfLineNewParallelArray *ool);
     bool visitNewArrayCallVM(LNewArray *lir);
     bool visitNewArray(LNewArray *lir);
     bool visitOutOfLineNewArray(OutOfLineNewArray *ool);
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 2404e147d2df..b3094b74e461 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -645,16 +645,6 @@ class IonBuilder : public MIRGenerator
     InliningStatus inlineUnsafeSetReservedSlot(CallInfo &callInfo);
     InliningStatus inlineUnsafeGetReservedSlot(CallInfo &callInfo);
 
-    // Parallel intrinsics.
-    InliningStatus inlineNewParallelArray(CallInfo &callInfo);
-    InliningStatus inlineParallelArray(CallInfo &callInfo);
-    InliningStatus inlineParallelArrayTail(CallInfo &callInfo,
-                                           JSFunction *target,
-                                           MDefinition *ctor,
-                                           types::TemporaryTypeSet *ctorTypes,
-                                           uint32_t discards,
-                                           Native native);
-
     // Utility intrinsics.
     InliningStatus inlineIsCallable(CallInfo &callInfo);
     InliningStatus inlineHaveSameClass(CallInfo &callInfo);
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 13c803502d6c..8f94028624a1 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -302,16 +302,6 @@ class LNewSlots : public LCallInstructionHelper<1, 0, 3>
     }
 };
 
-class LNewParallelArray : public LInstructionHelper<1, 0, 0>
-{
-  public:
-    LIR_HEADER(NewParallelArray);
-
-    MNewParallelArray *mir() const {
-        return mir_->toNewParallelArray();
-    }
-};
-
 class LNewArray : public LInstructionHelper<1, 0, 0>
 {
   public:
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 44d9db360964..9e731b593006 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -22,7 +22,6 @@
     _(TableSwitch)                  \
     _(TableSwitchV)                 \
     _(Goto)                         \
-    _(NewParallelArray)             \
     _(NewArray)                     \
     _(NewObject)                    \
     _(NewSlots)                     \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 92ceb8941332..54b3a02c0a76 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -160,13 +160,6 @@ LIRGenerator::visitNewSlots(MNewSlots *ins)
     return defineReturn(lir, ins);
 }
 
-bool
-LIRGenerator::visitNewParallelArray(MNewParallelArray *ins)
-{
-    LNewParallelArray *lir = new(alloc()) LNewParallelArray();
-    return define(lir, ins) && assignSafepoint(lir, ins);
-}
-
 bool
 LIRGenerator::visitNewArray(MNewArray *ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index 8302b9f16d68..9e772343fd30 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -81,7 +81,6 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitGoto(MGoto *ins);
     bool visitTableSwitch(MTableSwitch *tableswitch);
     bool visitNewSlots(MNewSlots *ins);
-    bool visitNewParallelArray(MNewParallelArray *ins);
     bool visitNewArray(MNewArray *ins);
     bool visitNewObject(MNewObject *ins);
     bool visitNewDeclEnvObject(MNewDeclEnvObject *ins);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 6292fc1ab510..4b010bb50650 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -6,7 +6,6 @@
 
 #include "jsmath.h"
 
-#include "builtin/ParallelArray.h"
 #include "builtin/TestingFunctions.h"
 #include "jit/BaselineInspector.h"
 #include "jit/IonBuilder.h"
@@ -137,10 +136,6 @@ IonBuilder::inlineNativeCall(CallInfo &callInfo, JSNative native)
     // Parallel intrinsics.
     if (native == intrinsic_ShouldForceSequential)
         return inlineForceSequentialOrInParallelSection(callInfo);
-    if (native == intrinsic_NewParallelArray)
-        return inlineNewParallelArray(callInfo);
-    if (native == ParallelArrayObject::construct)
-        return inlineParallelArray(callInfo);
 
     // Utility intrinsics.
     if (native == intrinsic_IsCallable)
@@ -1244,153 +1239,6 @@ IonBuilder::inlineForceSequentialOrInParallelSection(CallInfo &callInfo)
     MOZ_ASSUME_UNREACHABLE("Invalid execution mode");
 }
 
-IonBuilder::InliningStatus
-IonBuilder::inlineNewParallelArray(CallInfo &callInfo)
-{
-    // Rewrites a call like
-    //
-    //    NewParallelArray(ParallelArrayView, arg0, ..., argN)
-    //
-    // to
-    //
-    //    x = MNewParallelArray()
-    //    ParallelArrayView(x, arg0, ..., argN)
-
-    uint32_t argc = callInfo.argc();
-    if (argc < 1 || callInfo.constructing())
-        return InliningStatus_NotInlined;
-
-    types::TemporaryTypeSet *ctorTypes = callInfo.getArg(0)->resultTypeSet();
-    JSObject *targetObj = ctorTypes ? ctorTypes->getSingleton() : nullptr;
-    JSFunction *target = nullptr;
-    if (targetObj && targetObj->is<JSFunction>())
-        target = &targetObj->as<JSFunction>();
-    if (target && target->isInterpreted() && target->nonLazyScript()->shouldCloneAtCallsite()) {
-        if (JSFunction *clone = ExistingCloneFunctionAtCallsite(compartment->callsiteClones(), target, script(), pc))
-            target = clone;
-    }
-    MDefinition *ctor = makeCallsiteClone(
-        target,
-        callInfo.getArg(0)->toPassArg()->getArgument());
-
-    // Discard the function.
-    return inlineParallelArrayTail(callInfo, target, ctor,
-                                   target ? nullptr : ctorTypes, 1,
-                                   intrinsic_NewParallelArray);
-}
-
-IonBuilder::InliningStatus
-IonBuilder::inlineParallelArray(CallInfo &callInfo)
-{
-    if (!callInfo.constructing())
-        return InliningStatus_NotInlined;
-
-    uint32_t argc = callInfo.argc();
-    JSFunction *target = ParallelArrayObject::maybeGetConstructor(&script()->global(), argc);
-    if (!target)
-        return InliningStatus_NotInlined;
-
-    JS_ASSERT(target->nonLazyScript()->shouldCloneAtCallsite());
-    if (JSFunction *clone = ExistingCloneFunctionAtCallsite(compartment->callsiteClones(), target, script(), pc))
-        target = clone;
-
-    MConstant *ctor = MConstant::New(alloc(), ObjectValue(*target));
-    current->add(ctor);
-
-    return inlineParallelArrayTail(callInfo, target, ctor, nullptr, 0,
-                                   ParallelArrayObject::construct);
-}
-
-IonBuilder::InliningStatus
-IonBuilder::inlineParallelArrayTail(CallInfo &callInfo,
-                                    JSFunction *target,
-                                    MDefinition *ctor,
-                                    types::TemporaryTypeSet *ctorTypes,
-                                    uint32_t discards,
-                                    Native native)
-{
-    // Rewrites either NewParallelArray(...) or new ParallelArray(...) from a
-    // call to a native ctor into a call to the relevant function in the
-    // self-hosted code.
-
-    uint32_t argc = callInfo.argc() - discards;
-
-    // Create the new parallel array object.  Parallel arrays have specially
-    // constructed type objects, so we can only perform the inlining if we
-    // already have one of these type objects.
-    types::TemporaryTypeSet *returnTypes = getInlineReturnTypeSet();
-    if (returnTypes->getKnownTypeTag() != JSVAL_TYPE_OBJECT)
-        return InliningStatus_NotInlined;
-    if (returnTypes->unknownObject() || returnTypes->getObjectCount() != 1)
-        return InliningStatus_NotInlined;
-    types::TypeObject *typeObject = returnTypes->getTypeObject(0);
-    if (!typeObject || typeObject->clasp != &ParallelArrayObject::class_)
-        return InliningStatus_NotInlined;
-
-    JSObject *templateObject = inspector->getTemplateObjectForNative(pc, native);
-    if (!templateObject || templateObject->type() != typeObject)
-        return InliningStatus_NotInlined;
-
-    // Create the call and add in the non-this arguments.
-    uint32_t targetArgs = argc;
-    if (target && !target->isNative())
-        targetArgs = Max<uint32_t>(target->nargs, argc);
-
-    MCall *call = MCall::New(alloc(), target, targetArgs + 1, argc, false);
-    if (!call)
-        return InliningStatus_Error;
-
-    callInfo.unwrapArgs();
-
-    // Explicitly pad any missing arguments with |undefined|.
-    // This permits skipping the argumentsRectifier.
-    for (uint32_t i = targetArgs; i > argc; i--) {
-        JS_ASSERT_IF(target, !target->isNative());
-        MConstant *undef = MConstant::New(alloc(), UndefinedValue());
-        current->add(undef);
-        MPassArg *pass = MPassArg::New(alloc(), undef);
-        current->add(pass);
-        call->addArg(i, pass);
-    }
-
-    MPassArg *oldThis = MPassArg::New(alloc(), callInfo.thisArg());
-    current->add(oldThis);
-
-    // Add explicit arguments.
-    // Skip addArg(0) because it is reserved for this
-    for (uint32_t i = 0; i < argc; i++) {
-        MDefinition *arg = callInfo.getArg(i + discards);
-        MPassArg *passArg = MPassArg::New(alloc(), arg);
-        current->add(passArg);
-        call->addArg(i + 1, passArg);
-    }
-
-    // Place an MPrepareCall before the first passed argument, before we
-    // potentially perform rearrangement.
-    MPrepareCall *start = MPrepareCall::New(alloc());
-    oldThis->block()->insertBefore(oldThis, start);
-    call->initPrepareCall(start);
-
-    // Create the MIR to allocate the new parallel array.  Take the type
-    // object is taken from the prediction set.
-    MNewParallelArray *newObject = MNewParallelArray::New(alloc(), templateObject);
-    current->add(newObject);
-    MPassArg *newThis = MPassArg::New(alloc(), newObject);
-    current->add(newThis);
-    call->addArg(0, newThis);
-
-    // Set the new callee.
-    call->initFunction(ctor);
-
-    current->add(call);
-    current->push(newObject);
-
-    if (!resumeAfter(call))
-        return InliningStatus_Error;
-
-    return InliningStatus_Inlined;
-}
-
 IonBuilder::InliningStatus
 IonBuilder::inlineNewDenseArray(CallInfo &callInfo)
 {
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 23713460447c..97207eed77b7 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -1363,32 +1363,6 @@ class MThrow
     }
 };
 
-class MNewParallelArray : public MNullaryInstruction
-{
-    CompilerRootObject templateObject_;
-
-    MNewParallelArray(JSObject *templateObject)
-      : templateObject_(templateObject)
-    {
-        setResultType(MIRType_Object);
-    }
-
-  public:
-    INSTRUCTION_HEADER(NewParallelArray);
-
-    static MNewParallelArray *New(TempAllocator &alloc, JSObject *templateObject) {
-        return new(alloc) MNewParallelArray(templateObject);
-    }
-
-    AliasSet getAliasSet() const {
-        return AliasSet::None();
-    }
-
-    JSObject *templateObject() const {
-        return templateObject_;
-    }
-};
-
 // Fabricate a type set containing only the type of the specified object.
 types::TemporaryTypeSet *
 MakeSingletonTypeSet(JSObject *obj);
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 12cee893cefa..e2d348dc6a28 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -87,7 +87,6 @@ namespace jit {
     _(TruncateToInt32)                                                      \
     _(ToString)                                                             \
     _(NewSlots)                                                             \
-    _(NewParallelArray)                                                     \
     _(NewArray)                                                             \
     _(NewObject)                                                            \
     _(NewDeclEnvObject)                                                     \
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index 446e0f159f6c..40494356146c 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -184,7 +184,6 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     CUSTOM_OP(NewArray)
     CUSTOM_OP(NewObject)
     CUSTOM_OP(NewCallObject)
-    CUSTOM_OP(NewParallelArray)
     UNSAFE_OP(NewDerivedTypedObject)
     UNSAFE_OP(InitElem)
     UNSAFE_OP(InitElemGetterSetter)
@@ -517,12 +516,6 @@ ParallelSafetyVisitor::visitCreateThisWithTemplate(MCreateThisWithTemplate *ins)
     return replaceWithNewPar(ins, ins->templateObject());
 }
 
-bool
-ParallelSafetyVisitor::visitNewParallelArray(MNewParallelArray *ins)
-{
-    return replaceWithNewPar(ins, ins->templateObject());
-}
-
 bool
 ParallelSafetyVisitor::visitNewCallObject(MNewCallObject *ins)
 {
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 7e76e8857473..8c8ad1c9c753 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -6,7 +6,6 @@
 
 #include "jit/VMFunctions.h"
 
-#include "builtin/ParallelArray.h"
 #include "builtin/TypedObject.h"
 #include "frontend/BytecodeCompiler.h"
 #include "jit/BaselineIC.h"
@@ -277,21 +276,6 @@ IteratorMore(JSContext *cx, HandleObject obj, bool *res)
     return true;
 }
 
-JSObject *
-NewInitParallelArray(JSContext *cx, HandleObject templateObject)
-{
-    JS_ASSERT(templateObject->getClass() == &ParallelArrayObject::class_);
-    JS_ASSERT(!templateObject->hasSingletonType());
-
-    RootedObject obj(cx, ParallelArrayObject::newInstance(cx, TenuredObject));
-    if (!obj)
-        return nullptr;
-
-    obj->setType(templateObject->type());
-
-    return obj;
-}
-
 JSObject*
 NewInitArray(JSContext *cx, uint32_t count, types::TypeObject *typeArg)
 {
diff --git a/js/src/js.msg b/js/src/js.msg
index 5a8344163bab..072f28a8a3e6 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -354,10 +354,10 @@ MSG_DEF(JSMSG_NONDEFAULT_FORMAL_AFTER_DEFAULT, 300, 0, JSEXN_SYNTAXERR, "paramet
 MSG_DEF(JSMSG_YIELD_IN_DEFAULT,       301, 0, JSEXN_SYNTAXERR, "yield in default expression")
 MSG_DEF(JSMSG_INTRINSIC_NOT_DEFINED,  302, 1, JSEXN_REFERENCEERR, "no intrinsic function {0}")
 MSG_DEF(JSMSG_ALREADY_HAS_PRAGMA, 303, 2, JSEXN_ERR,      "{0} is being assigned a {1}, but already has one")
-MSG_DEF(JSMSG_PAR_ARRAY_BAD_ARG,      304, 1, JSEXN_RANGEERR, "invalid ParallelArray{0} argument")
-MSG_DEF(JSMSG_PAR_ARRAY_BAD_PARTITION, 305, 0, JSEXN_ERR, "argument must be divisible by outermost dimension")
-MSG_DEF(JSMSG_PAR_ARRAY_REDUCE_EMPTY, 306, 0, JSEXN_ERR, "cannot reduce ParallelArray object whose outermost dimension is empty")
-MSG_DEF(JSMSG_PAR_ARRAY_ALREADY_FLAT, 307, 0, JSEXN_ERR, "cannot flatten 1-dimensional ParallelArray object")
+MSG_DEF(JSMSG_PAR_ARRAY_BAD_ARG,      304, 0, JSEXN_RANGEERR, "invalid parallel method argument")
+MSG_DEF(JSMSG_UNUSED305,              305, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED306,              306, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_UNUSED307,              307, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_PAR_ARRAY_SCATTER_CONFLICT, 308, 0, JSEXN_ERR, "no conflict resolution function provided")
 MSG_DEF(JSMSG_PAR_ARRAY_SCATTER_BOUNDS, 309, 0, JSEXN_ERR, "index in scatter vector out of bounds")
 MSG_DEF(JSMSG_CANT_REPORT_NC_AS_NE,   310, 0, JSEXN_TYPEERR, "proxy can't report a non-configurable own property as non-existent")
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 38996d6f9ae1..882c65b08b8e 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -52,7 +52,6 @@
 #include "builtin/Eval.h"
 #include "builtin/Intl.h"
 #include "builtin/MapObject.h"
-#include "builtin/ParallelArray.h"
 #include "builtin/RegExp.h"
 #include "builtin/TypedObject.h"
 #include "frontend/BytecodeCompiler.h"
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index c4e07abd3271..0166b368d659 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -15,7 +15,6 @@
 
 #include "jsanalyze.h"
 
-#include "builtin/ParallelArray.h"
 #include "jit/ExecutionModeInlines.h"
 #include "vm/ArrayObject.h"
 #include "vm/BooleanObject.h"
@@ -354,9 +353,6 @@ GetClassForProtoKey(JSProtoKey key)
       case JSProto_DataView:
         return &DataViewObject::class_;
 
-      case JSProto_ParallelArray:
-        return &ParallelArrayObject::class_;
-
       default:
         MOZ_ASSUME_UNREACHABLE("Bad proto key");
     }
diff --git a/js/src/jsprototypes.h b/js/src/jsprototypes.h
index bc4a767033de..447e080ca5fa 100644
--- a/js/src/jsprototypes.h
+++ b/js/src/jsprototypes.h
@@ -91,10 +91,9 @@
     real(Map,                   33,     js_InitMapClass,           OCLASP(Map)) \
     real(Set,                   34,     js_InitSetClass,           OCLASP(Set)) \
     real(DataView,              35,     js_InitTypedArrayClasses,  OCLASP(DataView)) \
-IF_PJS(real,imaginary)  (ParallelArray,         36,     js_InitParallelArrayClass, OCLASP(ParallelArray)) \
-IF_INTL(real,imaginary) (Intl,                  37,     js_InitIntlClass,          CLASP(Intl)) \
-IF_BDATA(real,imaginary)(TypedObject,           38,     js_InitTypedObjectModuleObject,   OCLASP(TypedObjectModule)) \
-    imaginary(GeneratorFunction,     39,     js_InitIteratorClasses, dummy) \
+IF_INTL(real,imaginary) (Intl,                  36,     js_InitIntlClass,          CLASP(Intl)) \
+IF_BDATA(real,imaginary)(TypedObject,           37,     js_InitTypedObjectModuleObject,   OCLASP(TypedObjectModule)) \
+    imaginary(GeneratorFunction,     38,     js_InitIteratorClasses, dummy) \
 
 #define JS_FOR_EACH_PROTOTYPE(macro) JS_FOR_PROTOTYPES(macro,macro)
 
diff --git a/js/src/moz.build b/js/src/moz.build
index 31769c7439b5..73d1083e9a30 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -96,7 +96,6 @@ UNIFIED_SOURCES += [
     'builtin/Intl.cpp',
     'builtin/MapObject.cpp',
     'builtin/Object.cpp',
-    'builtin/ParallelArray.cpp',
     'builtin/Profilers.cpp',
     'builtin/TestingFunctions.cpp',
     'builtin/TypedObject.cpp',
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index 1f2e41df78fe..c60745b0cd1d 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -191,7 +191,7 @@ namespace js {
 // of operation.
 enum ForkJoinMode {
     // WARNING: If you change this enum, you MUST update
-    // ForkJoinMode() in ParallelArray.js
+    // ForkJoinMode() in Utilities.js
 
     // The "normal" behavior: attempt parallel, fallback to
     // sequential.  If compilation is ongoing in a helper thread, then
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index 6ec8721d960a..51948545ca95 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -516,9 +516,6 @@ GlobalObject::initStandardClasses(JSContext *cx, Handle<GlobalObject*> global)
            GlobalObject::initSetIteratorProto(cx, global) &&
 #if EXPOSE_INTL_API
            js_InitIntlClass(cx, global) &&
-#endif
-#if ENABLE_PARALLEL_JS
-           js_InitParallelArrayClass(cx, global) &&
 #endif
            true;
 }
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 62f86a4795d6..55335eacfa05 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -12,7 +12,6 @@
 #include "selfhosted.out.h"
 
 #include "builtin/Intl.h"
-#include "builtin/ParallelArray.h"
 #include "builtin/TypedObject.h"
 #include "gc/Marking.h"
 #include "vm/ForkJoin.h"
@@ -311,27 +310,6 @@ intrinsic_ForkJoinSlices(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
-/*
- * NewParallelArray(init, ...args): Creates a new parallel array using
- * an initialization function |init|. All subsequent arguments are
- * passed to |init|. The new instance will be passed as the |this|
- * argument.
- */
-bool
-js::intrinsic_NewParallelArray(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    JS_ASSERT(args[0].isObject() && args[0].toObject().is<JSFunction>());
-
-    RootedFunction init(cx, &args[0].toObject().as<JSFunction>());
-    CallArgs args0 = CallArgsFromVp(argc - 1, vp + 1);
-    if (!js::ParallelArrayObject::constructHelper(cx, &init, args0))
-        return false;
-    args.rval().set(args0.rval());
-    return true;
-}
-
 /*
  * NewDenseArray(length): Allocates and returns a new dense array with
  * the given length where all values are initialized to holes.
@@ -640,7 +618,6 @@ static const JSFunctionSpec intrinsic_functions[] = {
 
     JS_FN("ForkJoin",                intrinsic_ForkJoin,                2,0),
     JS_FN("ForkJoinSlices",          intrinsic_ForkJoinSlices,          0,0),
-    JS_FN("NewParallelArray",        intrinsic_NewParallelArray,        3,0),
     JS_FN("NewDenseArray",           intrinsic_NewDenseArray,           1,0),
     JS_FN("ShouldForceSequential",   intrinsic_ShouldForceSequential,   0,0),
     JS_FN("ParallelTestsShouldPass", intrinsic_ParallelTestsShouldPass, 0,0),

From 36b2bcec465709fcbdbb7b8bbc30f3e3f42402ac Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Thu, 12 Dec 2013 23:19:55 -0800
Subject: [PATCH 124/459] Bug 944074 - Followup: undefined min and max from
 <windows.h> to prevent conflicts. (r=jandem)

---
 js/src/jswin.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/js/src/jswin.h b/js/src/jswin.h
index acab9e74a821..7cff6c84cb2d 100644
--- a/js/src/jswin.h
+++ b/js/src/jswin.h
@@ -14,6 +14,8 @@
 
 #ifdef XP_WIN
 # include <windows.h>
+# undef min
+# undef max
 # undef GetProp
 # undef SetProp
 # undef CONST

From 86b703757e390287ad38146b8ec63c97a6ba98b4 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Thu, 12 Dec 2013 23:23:57 -0800
Subject: [PATCH 125/459] Bug 949916 - Fix race between
 off-main-thread-compilation and PJS. (r=bhackett)

---
 js/src/jit/Ion.cpp     | 10 +++++-----
 js/src/jit/Ion.h       |  1 +
 js/src/jsworkers.cpp   |  6 +++---
 js/src/vm/ForkJoin.cpp | 13 ++++++++++++-
 4 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index ba3ee46a154d..3ca40db2aad5 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2454,8 +2454,8 @@ InvalidateActivation(FreeOp *fop, uint8_t *ionTop, bool invalidateAll)
     IonSpew(IonSpew_Invalidate, "END invalidating activation");
 }
 
-static void
-StopOffThreadCompilation(JSCompartment *comp)
+void
+jit::StopAllOffThreadCompilations(JSCompartment *comp)
 {
     if (!comp->jitCompartment())
         return;
@@ -2467,7 +2467,7 @@ void
 jit::InvalidateAll(FreeOp *fop, Zone *zone)
 {
     for (CompartmentsInZoneIter comp(zone); !comp.done(); comp.next())
-        StopOffThreadCompilation(comp);
+        StopAllOffThreadCompilations(comp);
 
     for (JitActivationIterator iter(fop->runtime()); !iter.done(); ++iter) {
         if (iter.activation()->compartment()->zone() == zone) {
@@ -2845,10 +2845,10 @@ AutoDebugModeInvalidation::~AutoDebugModeInvalidation()
     FreeOp *fop = rt->defaultFreeOp();
 
     if (comp_) {
-        StopOffThreadCompilation(comp_);
+        StopAllOffThreadCompilations(comp_);
     } else {
         for (CompartmentsInZoneIter comp(zone_); !comp.done(); comp.next())
-            StopOffThreadCompilation(comp);
+            StopAllOffThreadCompilations(comp);
     }
 
     if (invalidateStack) {
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index 37ad4e778387..bf495ccf0e43 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -391,6 +391,7 @@ CodeGenerator *CompileBackEnd(MIRGenerator *mir, MacroAssembler *maybeMasm = nul
 
 void AttachFinishedCompilations(JSContext *cx);
 void FinishOffThreadBuilder(IonBuilder *builder);
+void StopAllOffThreadCompilations(JSCompartment *comp);
 
 static inline bool
 IsIonEnabled(JSContext *cx)
diff --git a/js/src/jsworkers.cpp b/js/src/jsworkers.cpp
index 61cf70e8eca8..0136601f6a2e 100644
--- a/js/src/jsworkers.cpp
+++ b/js/src/jsworkers.cpp
@@ -767,14 +767,14 @@ WorkerThread::handleIonWorkload(WorkerThreadState &state)
     FinishOffThreadIonCompile(ionBuilder);
     ionBuilder = nullptr;
 
-    // Notify the main thread in case it is waiting for the compilation to finish.
-    state.notifyAll(WorkerThreadState::CONSUMER);
-
     // Ping the main thread so that the compiled code can be incorporated
     // at the next operation callback. Don't interrupt Ion code for this, as
     // this incorporation can be delayed indefinitely without affecting
     // performance as long as the main thread is actually executing Ion code.
     runtime->triggerOperationCallback(JSRuntime::TriggerCallbackAnyThreadDontStopIon);
+
+    // Notify the main thread in case it is waiting for the compilation to finish.
+    state.notifyAll(WorkerThreadState::CONSUMER);
 }
 
 void
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index c60745b0cd1d..007d729c9218 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -867,8 +867,19 @@ js::ParallelDo::compileForParallelExecution(ExecutionStatus *status)
                 }
             }
         }
-        if (allScriptsPresent)
+
+        if (allScriptsPresent) {
+            // For testing modes, we want to make sure that all off thread
+            // compilation tasks are finished, so we don't race with
+            // off-main-thread-compilation setting an interrupt flag while we
+            // are in the middle of a test, causing unexpected bailouts.
+            if (mode_ != ForkJoinModeNormal) {
+                StopAllOffThreadCompilations(cx_->compartment());
+                if (!js_HandleExecutionInterrupt(cx_))
+                    return fatalError(status);
+            }
             break;
+        }
     }
 
     Spew(SpewCompile, "Compilation complete (final worklist length %d)",

From ef063fb0d4a6eecae13ecd2b915d1137bb60f4db Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Thu, 12 Dec 2013 23:33:50 -0800
Subject: [PATCH 126/459] Back out b6f9dbc91dc4 (bug 947038) for Cipc crashes

---
 dom/ipc/TabChild.cpp                          |   5 -
 gfx/layers/basic/BasicCompositor.cpp          | 155 ++++++++++++++++++
 gfx/layers/client/ContentClient.cpp           |   5 -
 gfx/layers/composite/TextureHost.cpp          |   8 +
 gfx/layers/composite/ThebesLayerComposite.cpp |   1 -
 gfx/thebes/gfxPlatform.cpp                    |  20 ---
 gfx/thebes/gfxPlatform.h                      |   5 +-
 widget/xpwidgets/nsBaseWidget.cpp             |   2 -
 8 files changed, 164 insertions(+), 37 deletions(-)

diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 7e88a30e1b88..8306641297ff 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -72,7 +72,6 @@
 #include "APZCCallbackHelper.h"
 #include "nsILoadContext.h"
 #include "ipc/nsGUIEventIPC.h"
-#include "gfxPlatform.h"
 
 #ifdef DEBUG
 #include "PCOMContentPermissionRequestChild.h"
@@ -2282,10 +2281,6 @@ TabChild::InitRenderingState()
           NS_WARNING("failed to properly allocate layer transaction");
           return false;
         }
-
-        // Track which compositor backend is in use (see bug 947038). This can
-        // be removed when deprecated textures are removed.
-        gfxPlatform::GetPlatform()->SetCompositorBackend(mTextureFactoryIdentifier.mParentBackend);
     } else {
         // Pushing transactions to the parent content.
         shadowManager = remoteFrame->SendPLayerTransactionConstructor();
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index 0bc966af4163..cc934831b3b8 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -63,6 +63,161 @@ public:
   RefPtr<gfx::DataSourceSurface> mSurface;
 };
 
+/**
+ * Texture source and host implementaion for software compositing.
+ */
+class DeprecatedTextureHostBasic : public DeprecatedTextureHost
+                                 , public TextureSourceBasic
+{
+public:
+  DeprecatedTextureHostBasic()
+  : mCompositor(nullptr)
+  {}
+
+  SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
+
+  virtual IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
+
+  virtual TextureSourceBasic* AsSourceBasic() MOZ_OVERRIDE { return this; }
+
+  SourceSurface *GetSurface() MOZ_OVERRIDE { return mSurface; }
+
+  virtual void SetCompositor(Compositor* aCompositor)
+  {
+    mCompositor = static_cast<BasicCompositor*>(aCompositor);
+  }
+
+  virtual const char *Name() { return "DeprecatedTextureHostBasic"; }
+
+protected:
+  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
+                          nsIntRegion *aRegion,
+                          nsIntPoint*) MOZ_OVERRIDE
+  {
+    AutoOpenSurface surf(OPEN_READ_ONLY, aImage);
+    nsRefPtr<gfxASurface> surface = ShadowLayerForwarder::OpenDescriptor(OPEN_READ_ONLY, aImage);
+    nsRefPtr<gfxImageSurface> image = surface->GetAsImageSurface();
+    mFormat = ImageFormatToSurfaceFormat(image->Format());
+    mSize = IntSize(image->Width(), image->Height());
+    mSurface = Factory::CreateWrappingDataSourceSurface(image->Data(),
+                                                        image->Stride(),
+                                                        mSize,
+                                                        mFormat);
+  }
+
+  virtual bool EnsureSurface() {
+    return true;
+  }
+
+  virtual bool Lock() MOZ_OVERRIDE {
+    return EnsureSurface();
+  }
+
+  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE {
+    if (!mSurface) {
+        return nullptr;
+    }
+    return mSurface->GetDataSurface();
+  }
+
+  BasicCompositor *mCompositor;
+  RefPtr<SourceSurface> mSurface;
+  IntSize mSize;
+  SurfaceFormat mFormat;
+};
+
+void
+DeserializerToPlanarYCbCrImageData(YCbCrImageDataDeserializer& aDeserializer, PlanarYCbCrData& aData)
+{
+  aData.mYChannel = aDeserializer.GetYData();
+  aData.mYStride = aDeserializer.GetYStride();
+  aData.mYSize = aDeserializer.GetYSize();
+  aData.mCbChannel = aDeserializer.GetCbData();
+  aData.mCrChannel = aDeserializer.GetCrData();
+  aData.mCbCrStride = aDeserializer.GetCbCrStride();
+  aData.mCbCrSize = aDeserializer.GetCbCrSize();
+  aData.mPicSize = aDeserializer.GetYSize();
+}
+
+class YCbCrDeprecatedTextureHostBasic : public DeprecatedTextureHostBasic
+{
+public:
+  virtual void UpdateImpl(const SurfaceDescriptor& aImage,
+                          nsIntRegion *aRegion,
+                          nsIntPoint*) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
+    mSurface = nullptr;
+    ConvertImageToRGB(aImage);
+  }
+
+  virtual void SwapTexturesImpl(const SurfaceDescriptor& aImage,
+                                nsIntRegion* aRegion) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(aImage.type() == SurfaceDescriptor::TYCbCrImage);
+    mSurface = nullptr;
+  }
+
+  virtual bool EnsureSurface() MOZ_OVERRIDE
+  {
+    if (mSurface) {
+      return true;
+    }
+    if (!mBuffer) {
+      return false;
+    }
+    return ConvertImageToRGB(*mBuffer);
+  }
+
+  bool ConvertImageToRGB(const SurfaceDescriptor& aImage)
+  {
+    YCbCrImageDataDeserializer deserializer(aImage.get_YCbCrImage().data().get<uint8_t>());
+    PlanarYCbCrData data;
+    DeserializerToPlanarYCbCrImageData(deserializer, data);
+
+    gfxImageFormat format = gfxImageFormatRGB24;
+    gfxIntSize size;
+    gfxUtils::GetYCbCrToRGBDestFormatAndSize(data, format, size);
+    if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
+        size.height > PlanarYCbCrImage::MAX_DIMENSION) {
+      NS_ERROR("Illegal image dest width or height");
+      return false;
+    }
+
+    mSize = ToIntSize(size);
+    mFormat = (format == gfxImageFormatRGB24)
+              ? FORMAT_B8G8R8X8
+              : FORMAT_B8G8R8A8;
+
+    RefPtr<DataSourceSurface> surface = Factory::CreateDataSourceSurface(mSize, mFormat);
+    gfxUtils::ConvertYCbCrToRGB(data, format, size,
+                                surface->GetData(),
+                                surface->Stride());
+
+    mSurface = surface;
+    return true;
+  }
+};
+
+TemporaryRef<DeprecatedTextureHost>
+CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
+                             uint32_t aTextureHostFlags,
+                             uint32_t aTextureFlags)
+{
+  RefPtr<DeprecatedTextureHost> result = nullptr;
+  if (aDescriptorType == SurfaceDescriptor::TYCbCrImage) {
+    result = new YCbCrDeprecatedTextureHostBasic();
+  } else {
+    MOZ_ASSERT(aDescriptorType == SurfaceDescriptor::TShmem ||
+               aDescriptorType == SurfaceDescriptor::TMemoryImage,
+               "We can only support Shmem currently");
+    result = new DeprecatedTextureHostBasic();
+  }
+
+  result->SetFlags(aTextureFlags);
+  return result.forget();
+}
+
 BasicCompositor::BasicCompositor(nsIWidget *aWidget)
   : mWidget(aWidget)
 {
diff --git a/gfx/layers/client/ContentClient.cpp b/gfx/layers/client/ContentClient.cpp
index 157c01970fcf..544784812d91 100644
--- a/gfx/layers/client/ContentClient.cpp
+++ b/gfx/layers/client/ContentClient.cpp
@@ -58,11 +58,6 @@ ContentClient::CreateContentClient(CompositableForwarder* aForwarder)
   useDeprecatedTextures = gfxPlatform::GetPlatform()->UseDeprecatedTextures();
 #endif
 
-  // Always use new textures for the basic compositor.
-  if (backend == LAYERS_BASIC) {
-    useDeprecatedTextures = false;
-  }
-
 #ifdef XP_WIN
   if (backend == LAYERS_D3D11) {
     useDoubleBuffering = !!gfxWindowsPlatform::GetPlatform()->GetD2DDevice();
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index 4caeb0b8030a..5e4da901d9ac 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -84,6 +84,10 @@ TextureHost::AsTextureHost(PTextureParent* actor)
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostOGL(SurfaceDescriptorType aDescriptorType,
                                                            uint32_t aDeprecatedTextureHostFlags,
                                                            uint32_t aTextureFlags);
+// implemented in BasicCompositor.cpp
+TemporaryRef<DeprecatedTextureHost> CreateBasicDeprecatedTextureHost(SurfaceDescriptorType aDescriptorType,
+                                                             uint32_t aDeprecatedTextureHostFlags,
+                                                             uint32_t aTextureFlags);
 
 #ifdef XP_WIN
 TemporaryRef<DeprecatedTextureHost> CreateDeprecatedTextureHostD3D9(SurfaceDescriptorType aDescriptorType,
@@ -123,6 +127,10 @@ DeprecatedTextureHost::CreateDeprecatedTextureHost(SurfaceDescriptorType aDescri
                                           aDeprecatedTextureHostFlags,
                                           aTextureFlags);
 #endif
+    case LAYERS_BASIC:
+      return CreateBasicDeprecatedTextureHost(aDescriptorType,
+                                          aDeprecatedTextureHostFlags,
+                                          aTextureFlags);
     default:
       MOZ_CRASH("Couldn't create texture host");
   }
diff --git a/gfx/layers/composite/ThebesLayerComposite.cpp b/gfx/layers/composite/ThebesLayerComposite.cpp
index 7a9cc3f00c45..1f35533634d0 100644
--- a/gfx/layers/composite/ThebesLayerComposite.cpp
+++ b/gfx/layers/composite/ThebesLayerComposite.cpp
@@ -138,7 +138,6 @@ ThebesLayerComposite::RenderLayer(const nsIntRect& aClipRect)
 
   mBuffer->SetPaintWillResample(MayResample());
 
-  mBuffer->SetCompositor(mCompositeManager->GetCompositor());
   mBuffer->Composite(effectChain,
                      GetEffectiveOpacity(),
                      transform,
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 89c74cc2c52e..b563f75429e4 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -281,7 +281,6 @@ gfxPlatform::gfxPlatform()
   , mDrawLayerBorders(false)
   , mDrawTileBorders(false)
   , mDrawBigImageBorders(false)
-  , mCompositorBackend(LAYERS_NONE)
 {
     mUseHarfBuzzScripts = UNINITIALIZED_VALUE;
     mAllowDownloadableFonts = UNINITIALIZED_VALUE;
@@ -2214,22 +2213,3 @@ gfxPlatform::ComponentAlphaEnabled()
   InitLayersAccelerationPrefs();
   return sComponentAlphaEnabled;
 }
-
-void
-gfxPlatform::SetCompositorBackend(mozilla::layers::LayersBackend backend)
-{
-  // The compositor backend should always be the same after one has been chosen.
-  MOZ_ASSERT(mCompositorBackend == LAYERS_NONE || mCompositorBackend == backend);
-  if (mCompositorBackend == LAYERS_NONE) {
-    mCompositorBackend = backend;
-  }
-}
-
-bool
-gfxPlatform::UseDeprecatedTextures() const
-{
-  if (mCompositorBackend == LAYERS_BASIC) {
-    return false;
-  }
-  return mLayersUseDeprecated;
-}
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index 64d138698558..27ff830fd51e 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -20,7 +20,6 @@
 #include "mozilla/RefPtr.h"
 #include "GfxInfoCollector.h"
 
-#include "mozilla/layers/LayersTypes.h"
 #include "mozilla/layers/CompositorTypes.h"
 
 #ifdef XP_OS2
@@ -620,8 +619,7 @@ public:
      * This method should not be called from the compositor thread.
      */
     bool PreferMemoryOverShmem() const;
-    bool UseDeprecatedTextures() const;
-    void SetCompositorBackend(mozilla::layers::LayersBackend backend);
+    bool UseDeprecatedTextures() const { return mLayersUseDeprecated; }
 
 protected:
     gfxPlatform();
@@ -738,7 +736,6 @@ private:
     bool mDrawLayerBorders;
     bool mDrawTileBorders;
     bool mDrawBigImageBorders;
-    mozilla::layers::LayersBackend mCompositorBackend;
 };
 
 #endif /* GFX_PLATFORM_H */
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index f8f4ce68d058..1916ced3277d 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -988,8 +988,6 @@ void nsBaseWidget::CreateCompositor(int aWidth, int aHeight)
     ImageBridgeChild::IdentifyCompositorTextureHost(textureFactoryIdentifier);
     WindowUsesOMTC();
 
-    gfxPlatform::GetPlatform()->SetCompositorBackend(textureFactoryIdentifier.mParentBackend);
-
     mLayerManager = lm;
     return;
   }

From abf326e01b4a344e13d26de7437c41495404ac64 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 16:06:53 +0900
Subject: [PATCH 127/459] Bug 949906 - Add a callback to modify evaluated
 moz.build sandboxes, fix Sphinx docs; r=glandium

--HG--
extra : rebase_source : 9ef2219145fb754a9cbe9e7e30b6f2841910f13f
---
 python/mozbuild/mozbuild/frontend/reader.py   | 16 ++++++++++++++-
 .../mozbuild/test/frontend/test_reader.py     | 20 +++++++++++++++++--
 tools/docs/mach_commands.py                   |  9 ++++++++-
 3 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/python/mozbuild/mozbuild/frontend/reader.py b/python/mozbuild/mozbuild/frontend/reader.py
index 76ee9d0c866e..da87965ea099 100644
--- a/python/mozbuild/mozbuild/frontend/reader.py
+++ b/python/mozbuild/mozbuild/frontend/reader.py
@@ -592,13 +592,20 @@ class BuildReader(object):
     This is where the build system starts. You give it a tree configuration
     (the output of configuration) and it executes the moz.build files and
     collects the data they define.
+
+    The reader can optionally call a callable after each sandbox is evaluated
+    but before its evaluated content is processed. This gives callers the
+    opportunity to modify sandboxes before side-effects occur from their
+    content. This callback receives the ``Sandbox`` that was evaluated. The
+    return value is ignored.
     """
 
-    def __init__(self, config):
+    def __init__(self, config, sandbox_post_eval_cb=None):
         self.config = config
         self.topsrcdir = config.topsrcdir
         self.topobjdir = config.topobjdir
 
+        self._sandbox_post_eval_cb = sandbox_post_eval_cb
         self._log = logging.getLogger(__name__)
         self._read_files = set()
         self._execution_stack = []
@@ -719,6 +726,10 @@ class BuildReader(object):
         sandbox = MozbuildSandbox(self.config, path, metadata=metadata)
         sandbox.exec_file(path, filesystem_absolute=filesystem_absolute)
         sandbox.execution_time = time.time() - time_start
+
+        if self._sandbox_post_eval_cb:
+            self._sandbox_post_eval_cb(sandbox)
+
         var = metadata.get('var', None)
         forbidden = {
             'TOOL_DIRS': ['DIRS', 'PARALLEL_DIRS', 'TEST_DIRS'],
@@ -770,6 +781,9 @@ class BuildReader(object):
         # so until the library linking operations are moved out of it, at which
         # point PARALLEL_DIRS will be irrelevant anyways.
         for gyp_sandbox in gyp_sandboxes:
+            if self._sandbox_post_eval_cb:
+                self._sandbox_post_eval_cb(gyp_sandbox)
+
             sandbox['DIRS'].append(mozpath.relpath(gyp_sandbox['OBJDIR'], sandbox['OBJDIR']))
 
         yield sandbox
diff --git a/python/mozbuild/mozbuild/test/frontend/test_reader.py b/python/mozbuild/mozbuild/test/frontend/test_reader.py
index 2d2bf672e38c..d057ef8335bc 100644
--- a/python/mozbuild/mozbuild/test/frontend/test_reader.py
+++ b/python/mozbuild/mozbuild/test/frontend/test_reader.py
@@ -33,13 +33,13 @@ class TestBuildReader(unittest.TestCase):
 
         return MockConfig(path, **kwargs)
 
-    def reader(self, name, enable_tests=False):
+    def reader(self, name, enable_tests=False, **kwargs):
         extra = {}
         if enable_tests:
             extra['ENABLE_TESTS'] = '1'
         config = self.config(name, extra_substs=extra)
 
-        return BuildReader(config)
+        return BuildReader(config, **kwargs)
 
     def file_path(self, name, *args):
         return mozpath.join(data_path, name, *args)
@@ -266,5 +266,21 @@ class TestBuildReader(unittest.TestCase):
         self.assertEqual([sandbox['XPIDL_MODULE'] for sandbox in sandboxes],
             ['foobar', 'foobar', 'foobar', 'foobar'])
 
+    def test_process_eval_callback(self):
+        def strip_dirs(sandbox):
+            sandbox['DIRS'][:] = []
+            count[0] += 1
+
+        reader = self.reader('traversal-simple',
+            sandbox_post_eval_cb=strip_dirs)
+
+        count = [0]
+
+        sandboxes = list(reader.read_topsrcdir())
+
+        self.assertEqual(len(sandboxes), 1)
+        self.assertEqual(len(count), 1)
+
+
 if __name__ == '__main__':
     main()
diff --git a/tools/docs/mach_commands.py b/tools/docs/mach_commands.py
index b1bbb4b923b4..7948f2490de6 100644
--- a/tools/docs/mach_commands.py
+++ b/tools/docs/mach_commands.py
@@ -38,7 +38,14 @@ class Documentation(MachCommandBase):
         manager = SphinxManager(self.topsrcdir, os.path.join(self.topsrcdir,
             'tools', 'docs'), outdir)
 
-        reader = BuildReader(self.config_environment)
+        # We don't care about GYP projects, so don't process them. This makes
+        # scanning faster and may even prevent an exception.
+        def remove_gyp_dirs(sandbox):
+            sandbox['GYP_DIRS'][:] = []
+
+        reader = BuildReader(self.config_environment,
+            sandbox_post_eval_cb=remove_gyp_dirs)
+
         for sandbox in reader.walk_topsrcdir():
             for dest_dir, source_dir in sandbox['SPHINX_TREES'].items():
                 manager.add_tree(os.path.join(sandbox['RELATIVEDIR'],

From 3ec0b0a106095e0d914f72026429806ae675cfb3 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Wed, 13 Nov 2013 15:41:22 -0800
Subject: [PATCH 128/459] Bug 928195 - Part 6: Add docs for WebIDL and the
 build system; r=froydnj

--HG--
extra : rebase_source : cee29c0bf5c050d73ef02d6ad933802b8fad21e0
---
 dom/bindings/docs/index.rst | 122 ++++++++++++++++++++++++++++++++++++
 dom/bindings/moz.build      |   3 +
 2 files changed, 125 insertions(+)
 create mode 100644 dom/bindings/docs/index.rst

diff --git a/dom/bindings/docs/index.rst b/dom/bindings/docs/index.rst
new file mode 100644
index 000000000000..16a92b64dba9
--- /dev/null
+++ b/dom/bindings/docs/index.rst
@@ -0,0 +1,122 @@
+.. _webidl:
+
+======
+WebIDL
+======
+
+WebIDL describes interfaces web browsers are supposed to implement.
+
+The interaction between WebIDL and the build system is somewhat complex.
+This document will attempt to explain how it all works.
+
+Overview
+========
+
+``.webidl`` files throughout the tree define interfaces the browser
+implements. Since Gecko/Firefox is implemented in C++, there is a
+mechanism to convert these interfaces and associated metadata to
+C++ code. That's where the build system comes into play.
+
+All the code for interacting with ``.webidl`` files lives under
+``dom/bindings``. There is code in the build system to deal with
+WebIDLs explicitly.
+
+WebIDL source file flavors
+==========================
+
+Not all ``.webidl`` files are created equal! There are several flavors,
+each represented by a separate symbol from :ref:`mozbuild_symbols`.
+
+WEBIDL_FILES
+   Refers to regular/static ``.webidl`` files. Most WebIDL interfaces
+   are defined this way.
+
+GENERATED_EVENTS_WEBIDL_FILES
+   In addition to generating a binding, these ``.webidl`` files also
+   generate a source file implementing the event object in C++
+
+PREPROCESSED_WEBIDL_FILES
+   The ``.webidl`` files are generated by preprocessing an input file.
+   They otherwise behave like *WEBIDL_FILES*.
+
+TEST_WEBIDL_FILES
+   Like *WEBIDL_FILES* but the interfaces are for testing only and
+   aren't shipped with the browser.
+
+PREPROCESSED_TEST_WEBIDL_FILES
+   Like *TEST_WEBIDL_FILES* except the ``.webidl`` is obtained via
+   preprocessing, much like *PREPROCESSED_WEBIDL_FILES*.
+
+GENERATED_WEBIDL_FILES
+   The ``.webidl`` for these is obtained through an *external*
+   mechanism. Typically there are custom build rules for producing these
+   files.
+
+Producing C++ code
+==================
+
+The most complicated part about WebIDLs is the process by which
+``.webidl`` files are converted into C++.
+
+This process is handled by code in the :py:mod:`mozwebidlcodegen`
+package. :py:class:`mozwebidlcodegen.WebIDLCodegenManager` is
+specifically where you want to look for how code generation is
+performed. This includes complex dependency management.
+
+Requirements
+============
+
+This section aims to document the build and developer workflow requirements
+for WebIDL.
+
+Parser unit tests
+   There are parser tests provided by ``dom/bindings/parser/runtests.py``
+   that should run as part of ``make check``. There must be a mechanism
+   to run the tests in *human* mode so they output friendly error
+   messages.
+
+   The current mechanism for this is ``mach webidl-parser-test``.
+
+Mochitests
+   There are various mochitests under ``dom/bindings/test``. They should
+   be runnable through the standard mechanisms.
+
+Working with test interfaces
+   ``TestExampleGenBinding.cpp`` calls into methods from the
+   ``TestExampleInterface`` and ``TestExampleProxyInterface`` interfaces.
+   These interfaces need to be generated as part of the build. These
+   interfaces should not be exported or packaged.
+
+   There is a ``compiletests`` make target in ``dom/bindings`` that
+   isn't part of the build that facilitates turnkey code generation
+   and test file compilation.
+
+Minimal rebuilds
+   Reprocessing every output for every change is expensive. So we don't
+   inconvenience people changing ``.webidl`` files, the build system
+   should only perform a minimal rebuild when sources change.
+
+   This logic is mostly all handled in
+   :py:class:`mozwebidlcodegen.WebIDLCodegenManager`. The unit tests for
+   that Python code should adequately test typical rebuild scenarios.
+
+   Bug 940469 tracks making the existing implementation better.
+
+Explicit method for performing codegen
+   There needs to be an explicit method for invoking code generation.
+   It needs to cover regular and test files.
+
+   This is implemented via ``make export`` in ``dom/bindings``.
+
+No-op binding generation should be fast
+   So developers touching ``.webidl`` files are not inconvenienced,
+   no-op binding generation should be fast. Watch out for the build system
+   processing large dependency files it doesn't need in order to perform
+   code generation.
+
+Ability to generate example files
+   *Any* interface can have example ``.h``/``.cpp`` files generated.
+   There must be a mechanism to facilitate this.
+
+   This is currently facilitated through ``mach webidl-example``. e.g.
+   ``mach webidl-example HTMLStyleElement``.
diff --git a/dom/bindings/moz.build b/dom/bindings/moz.build
index 557d4a63e92f..acb65bedc69d 100644
--- a/dom/bindings/moz.build
+++ b/dom/bindings/moz.build
@@ -87,3 +87,6 @@ if CONFIG['MOZ_AUDIO_CHANNEL_MANAGER']:
     ]
 
 FINAL_LIBRARY = 'xul'
+
+SPHINX_TREES['webidl'] = 'docs'
+SPHINX_PYTHON_PACKAGE_DIRS += ['mozwebidlcodegen']

From 0e77c986f05b800ac29edd7d5bb029f2e9beb190 Mon Sep 17 00:00:00 2001
From: Patrick Brosset <pbrosset@mozilla.com>
Date: Thu, 12 Dec 2013 09:31:23 +0100
Subject: [PATCH 129/459] Bug 945068 - Image preview tooltip displays correct
 image dimensions, r=harth

---
 browser/devtools/markupview/markup-view.js    |  7 ++--
 ...browser_inspector_markup_765105_tooltip.js | 20 ++++++-----
 browser/devtools/shared/widgets/Tooltip.js    | 35 ++++++++++---------
 3 files changed, 35 insertions(+), 27 deletions(-)

diff --git a/browser/devtools/markupview/markup-view.js b/browser/devtools/markupview/markup-view.js
index 7ad9cfe50f3e..b2240b0cfa2e 100644
--- a/browser/devtools/markupview/markup-view.js
+++ b/browser/devtools/markupview/markup-view.js
@@ -1173,10 +1173,11 @@ MarkupContainer.prototype = {
         this.node.getImageData(IMAGE_PREVIEW_MAX_DIM).then(data => {
           if (data) {
             data.data.string().then(str => {
+              let res = {data: str, size: data.size};
               // Resolving the data promise and, to always keep tooltipData.data
               // as a promise, create a new one that resolves immediately
-              def.resolve(str, data.size);
-              this.tooltipData.data = promise.resolve(str, data.size);
+              def.resolve(res);
+              this.tooltipData.data = promise.resolve(res);
             });
           }
         });
@@ -1186,7 +1187,7 @@ MarkupContainer.prototype = {
 
   _buildTooltipContent: function(target, tooltip) {
     if (this.tooltipData && target === this.tooltipData.target) {
-      this.tooltipData.data.then((data, size) => {
+      this.tooltipData.data.then(({data, size}) => {
         tooltip.setImageContent(data, size);
       });
       return true;
diff --git a/browser/devtools/markupview/test/browser_inspector_markup_765105_tooltip.js b/browser/devtools/markupview/test/browser_inspector_markup_765105_tooltip.js
index a3d3dfc50817..5c5487c89d3c 100644
--- a/browser/devtools/markupview/test/browser_inspector_markup_765105_tooltip.js
+++ b/browser/devtools/markupview/test/browser_inspector_markup_765105_tooltip.js
@@ -16,10 +16,10 @@ const PAGE_CONTENT = [
 ].join("\n");
 
 const TEST_NODES = [
-  "img.local",
-  "img.data",
-  "img.remote",
-  ".canvas"
+  {selector: "img.local", size: "192 x 192"},
+  {selector: "img.data", size: "64 x 64"},
+  {selector: "img.remote", size: "22 x 23"},
+  {selector: ".canvas", size: "600 x 600"}
 ];
 
 function test() {
@@ -77,8 +77,8 @@ function testImageTooltip(index) {
     return endTests();
   }
 
-  let node = contentDoc.querySelector(TEST_NODES[index]);
-  ok(node, "We have the [" + TEST_NODES[index] + "] image node to test for tooltip");
+  let node = contentDoc.querySelector(TEST_NODES[index].selector);
+  ok(node, "We have the [" + TEST_NODES[index].selector + "] image node to test for tooltip");
   let isImg = node.tagName.toLowerCase() === "img";
 
   let container = getContainerForRawNode(markup, node);
@@ -90,10 +90,14 @@ function testImageTooltip(index) {
 
   assertTooltipShownOn(target, () => {
     let images = markup.tooltip.panel.getElementsByTagName("image");
-    is(images.length, 1, "Tooltip for [" + TEST_NODES[index] + "] contains an image");
+    is(images.length, 1,
+      "Tooltip for [" + TEST_NODES[index].selector + "] contains an image");
+
+    let label = markup.tooltip.panel.querySelector(".devtools-tooltip-caption");
+    is(label.textContent, TEST_NODES[index].size,
+      "Tooltip label for [" + TEST_NODES[index].selector + "] displays the right image size")
 
     markup.tooltip.hide();
-
     testImageTooltip(index + 1);
   });
 }
diff --git a/browser/devtools/shared/widgets/Tooltip.js b/browser/devtools/shared/widgets/Tooltip.js
index 3b554d55b188..1d5ceb9dd1ce 100644
--- a/browser/devtools/shared/widgets/Tooltip.js
+++ b/browser/devtools/shared/widgets/Tooltip.js
@@ -518,30 +518,33 @@ Tooltip.prototype = {
     }
     vbox.appendChild(image);
 
-    // Temporary label during image load
+    // Dimension label
     let label = this.doc.createElement("label");
     label.classList.add("devtools-tooltip-caption");
     label.classList.add("theme-comment");
-    label.textContent = l10n.strings.GetStringFromName("previewTooltip.image.brokenImage");
+    if (options.naturalWidth && options.naturalHeight) {
+      label.textContent = this._getImageDimensionLabel(options.naturalWidth,
+        options.naturalHeight);
+      this.setSize(vbox.width, vbox.height);
+    } else {
+      // If no dimensions were provided, load the image to get them
+      label.textContent = l10n.strings.GetStringFromName("previewTooltip.image.brokenImage");
+      let imgObj = new this.doc.defaultView.Image();
+      imgObj.src = imageUrl;
+      imgObj.onload = () => {
+        imgObj.onload = null;
+        label.textContent = this._getImageDimensionLabel(imgObj.naturalWidth,
+          imgObj.naturalHeight);
+        this.setSize(vbox.width, vbox.height);
+      }
+    }
     vbox.appendChild(label);
 
     this.content = vbox;
-
-    // Load the image to get dimensions and display it when done
-    let imgObj = new this.doc.defaultView.Image();
-    imgObj.src = imageUrl;
-    imgObj.onload = () => {
-      imgObj.onload = null;
-
-      // Display dimensions
-      let w = options.naturalWidth || imgObj.naturalWidth;
-      let h = options.naturalHeight || imgObj.naturalHeight;
-      label.textContent = w + " x " + h;
-
-      this.setSize(vbox.width, vbox.height);
-    }
   },
 
+  _getImageDimensionLabel: (w, h) => w + " x " + h,
+
   /**
    * Exactly the same as the `image` function but takes a css background image
    * value instead : url(....)

From e5f11e0c79994d97b7740a58eb77b34a72fe50d9 Mon Sep 17 00:00:00 2001
From: Christian Ascheberg <c.ascheberg@gmx.de>
Date: Thu, 12 Dec 2013 09:56:57 +0100
Subject: [PATCH 130/459] Bug 735607 - [Australis] Add hover effect in URL and
 search bars when using personas. r=dao

---
 browser/themes/windows/browser.css | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css
index f5f78c7b5ba6..33eb69e814e2 100644
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@@ -841,6 +841,16 @@ menuitem.bookmark-item {
   color: black;
 }
 
+#urlbar:-moz-lwtheme:hover:not([focused]):not([readonly]),
+.searchbar-textbox:-moz-lwtheme:hover:not([focused]) {
+  background-color: rgba(255,255,255,.9);
+}
+
+#urlbar:-moz-lwtheme[focused],
+.searchbar-textbox:-moz-lwtheme[focused] {
+  background-color: white;
+}
+
 @conditionalForwardWithUrlbar@ > #urlbar-wrapper {
   padding-left: @conditionalForwardWithUrlbarWidth@px;
   -moz-margin-start: -@conditionalForwardWithUrlbarWidth@px;
@@ -898,11 +908,6 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
   color: #777;
 }
 
-#urlbar:-moz-lwtheme[focused="true"],
-.searchbar-textbox:-moz-lwtheme[focused="true"] {
-  background-color: white;
-}
-
 #urlbar-container {
   -moz-box-align: center;
 }

From 3ebe27ab184162a90421ab0720e034a7182b04f7 Mon Sep 17 00:00:00 2001
From: Katie Thomas <katiemthom@gmail.com>
Date: Thu, 12 Dec 2013 09:58:28 +0100
Subject: [PATCH 131/459] Bug 891194 - Changed BROKEN_WM_Z_ORDER to not be
 defined for mac. r=dao

---
 browser/components/sessionstore/src/SessionStore.jsm | 4 +++-
 browser/modules/RecentWindow.jsm                     | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index c809c36b6074..519d359ba980 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -86,9 +86,11 @@ const BROWSER_EVENTS = [
 // The number of milliseconds in a day
 const MS_PER_DAY = 1000.0 * 60.0 * 60.0 * 24.0;
 
-#ifndef XP_WIN
+#ifdef XP_UNIX 
+#ifndef XP_MACOSX
 #define BROKEN_WM_Z_ORDER
 #endif
+#endif 
 
 Cu.import("resource://gre/modules/Services.jsm", this);
 Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
diff --git a/browser/modules/RecentWindow.jsm b/browser/modules/RecentWindow.jsm
index 0018b502c70e..c328b6e44d50 100644
--- a/browser/modules/RecentWindow.jsm
+++ b/browser/modules/RecentWindow.jsm
@@ -11,9 +11,11 @@ const Cu = Components.utils;
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/PrivateBrowsingUtils.jsm");
 
-#ifndef XP_WIN
+#ifdef XP_UNIX
+#ifndef XP_MACOSX
 #define BROKEN_WM_Z_ORDER
 #endif
+#endif
 
 this.RecentWindow = {
   /*

From 99b582a0b8ba3172b133dee8515593186311e5c3 Mon Sep 17 00:00:00 2001
From: Tim Taubert <ttaubert@mozilla.com>
Date: Sat, 7 Dec 2013 09:50:19 +0100
Subject: [PATCH 132/459] Bug 947583 - Fix "this.updateProviderURLs is not a
 function" when toggling "Block reported attack sites" preference r=dolske

From 8ba7cef13d00454ddcdec7e4f8eb32bcb6bee5ac Mon Sep 17 00:00:00 2001
---
 toolkit/components/url-classifier/SafeBrowsing.jsm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/components/url-classifier/SafeBrowsing.jsm b/toolkit/components/url-classifier/SafeBrowsing.jsm
index f6ef132303f2..9f39b97cfa4b 100644
--- a/toolkit/components/url-classifier/SafeBrowsing.jsm
+++ b/toolkit/components/url-classifier/SafeBrowsing.jsm
@@ -35,7 +35,7 @@ this.SafeBrowsing = {
       return;
     }
 
-    Services.prefs.addObserver("browser.safebrowsing", this.readPrefs, false);
+    Services.prefs.addObserver("browser.safebrowsing", this.readPrefs.bind(this), false);
     this.readPrefs();
 
     // Register our two types of tables, and add custom Mozilla entries

From 59409361e01d51e3a19c5fe6ab00fff01a5b359b Mon Sep 17 00:00:00 2001
From: Steven MacLeod <smacleod@mozilla.com>
Date: Thu, 12 Dec 2013 10:18:02 +0100
Subject: [PATCH 133/459] Bug 907129 - Merge closed tabs data when
 restoreWindow() is called with overwriteTabs=false. r=ttaubert

X-Git-Commit-ID: d51bff1ffaa80d4f441863eb864e7cfd7f8e6a00
---
 .../sessionstore/src/SessionStore.jsm         | 18 ++++-
 .../components/sessionstore/test/browser.ini  |  1 +
 .../test/browser_merge_closed_tabs.js         | 71 +++++++++++++++++++
 browser/components/sessionstore/test/head.js  |  5 ++
 4 files changed, 94 insertions(+), 1 deletion(-)
 create mode 100644 browser/components/sessionstore/test/browser_merge_closed_tabs.js

diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 519d359ba980..20055129ae6c 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -2480,8 +2480,24 @@ let SessionStoreInternal = {
         this._windows[aWindow.__SSi].extData[key] = winData.extData[key];
       }
     }
+
+    let newClosedTabsData = winData._closedTabs || [];
+
     if (overwriteTabs || firstWindow) {
-      this._windows[aWindow.__SSi]._closedTabs = winData._closedTabs || [];
+      // Overwrite existing closed tabs data when overwriteTabs=true
+      // or we're the first window to be restored.
+      this._windows[aWindow.__SSi]._closedTabs = newClosedTabsData;
+    } else if (this._max_tabs_undo > 0) {
+      // If we merge tabs, we also want to merge closed tabs data. We'll assume
+      // the restored tabs were closed more recently and append the current list
+      // of closed tabs to the new one...
+      newClosedTabsData =
+        newClosedTabsData.concat(this._windows[aWindow.__SSi]._closedTabs);
+
+      // ... and make sure that we don't exceed the max number of closed tabs
+      // we can restore.
+      this._windows[aWindow.__SSi]._closedTabs =
+        newClosedTabsData.slice(0, this._max_tabs_undo);
     }
 
     this.restoreTabs(aWindow, tabs, winData.tabs,
diff --git a/browser/components/sessionstore/test/browser.ini b/browser/components/sessionstore/test/browser.ini
index 6ed3b4915046..8f0c479efa72 100644
--- a/browser/components/sessionstore/test/browser.ini
+++ b/browser/components/sessionstore/test/browser.ini
@@ -56,6 +56,7 @@ support-files =
 [browser_formdata_format.js]
 [browser_global_store.js]
 [browser_input.js]
+[browser_merge_closed_tabs.js]
 [browser_pageshow.js]
 [browser_pageStyle.js]
 [browser_sessionStorage.js]
diff --git a/browser/components/sessionstore/test/browser_merge_closed_tabs.js b/browser/components/sessionstore/test/browser_merge_closed_tabs.js
new file mode 100644
index 000000000000..08a161784904
--- /dev/null
+++ b/browser/components/sessionstore/test/browser_merge_closed_tabs.js
@@ -0,0 +1,71 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * This test ensures that closed tabs are merged when restoring
+ * a window state without overwriting tabs.
+ */
+add_task(function () {
+  const initialState = {
+    windows: [{
+      tabs: [
+        { entries: [{ url: "about:blank" }] }
+      ],
+      _closedTabs: [
+        { state: { entries: [{ ID: 1000, url: "about:blank" }]} },
+        { state: { entries: [{ ID: 1001, url: "about:blank" }]} }
+      ]
+    }]
+  }
+
+  const restoreState = {
+    windows: [{
+      tabs: [
+        { entries: [{ url: "about:robots" }] }
+      ],
+      _closedTabs: [
+        { state: { entries: [{ ID: 1002, url: "about:robots" }]} },
+        { state: { entries: [{ ID: 1003, url: "about:robots" }]} },
+        { state: { entries: [{ ID: 1004, url: "about:robots" }]} }
+      ]
+    }]
+  }
+
+  const maxTabsUndo = 4;
+  gPrefService.setIntPref("browser.sessionstore.max_tabs_undo", maxTabsUndo);
+
+  // Open a new window and restore it to an initial state.
+  let win = yield promiseNewWindowLoaded({private: false});
+  SessionStore.setWindowState(win, JSON.stringify(initialState), true);
+  is(SessionStore.getClosedTabCount(win), 2, "2 closed tabs after restoring initial state");
+
+  // Restore the new state but do not overwrite existing tabs (this should
+  // cause the closed tabs to be merged).
+  SessionStore.setWindowState(win, JSON.stringify(restoreState), false);
+
+  // Verify the windows closed tab data is correct.
+  let iClosed = initialState.windows[0]._closedTabs;
+  let rClosed = restoreState.windows[0]._closedTabs;
+  let cData = JSON.parse(SessionStore.getClosedTabData(win));
+
+  is(cData.length, Math.min(iClosed.length + rClosed.length, maxTabsUndo),
+     "Number of closed tabs is correct");
+
+  // When the closed tabs are merged the restored tabs are considered to be
+  // closed more recently.
+  for (let i = 0; i < cData.length; i++) {
+    if (i < rClosed.length) {
+      is(cData[i].state.entries[0].ID, rClosed[i].state.entries[0].ID,
+         "Closed tab entry matches");
+    } else {
+      is(cData[i].state.entries[0].ID, iClosed[i - rClosed.length].state.entries[0].ID,
+         "Closed tab entry matches");
+    }
+  }
+
+  // Clean up.
+  gPrefService.clearUserPref("browser.sessionstore.max_tabs_undo");
+  win.close();
+});
+
+
diff --git a/browser/components/sessionstore/test/head.js b/browser/components/sessionstore/test/head.js
index 8739e69c5be4..fee33a150aa5 100644
--- a/browser/components/sessionstore/test/head.js
+++ b/browser/components/sessionstore/test/head.js
@@ -412,6 +412,11 @@ function whenNewWindowLoaded(aOptions, aCallback) {
   whenDelayedStartupFinished(win, () => aCallback(win));
   return win;
 }
+function promiseNewWindowLoaded(aOptions) {
+  let deferred = Promise.defer();
+  whenNewWindowLoaded(aOptions, deferred.resolve);
+  return deferred.promise;
+}
 
 /**
  * This waits for the browser-delayed-startup-finished notification of a given

From 75b19143b4be51ea169d71324f91bf2b31a245ae Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 10:55:35 +0000
Subject: [PATCH 134/459] Bug 942231 - Remove unused member from HomePager
 (r=margaret)

---
 mobile/android/base/home/HomePager.java | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index b0dae21f4f5c..0db739c235f5 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -30,9 +30,6 @@ import java.util.EnumMap;
 import java.util.EnumSet;
 
 public class HomePager extends ViewPager {
-    // Subpage fragment tag
-    public static final String SUBPAGE_TAG = "home_pager_subpage";
-
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;

From 9fa395445ce094b77632f35f9992b0250589fd97 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 10:55:35 +0000
Subject: [PATCH 135/459] Bug 942231 - Factor out HomePager's adapter into a
 separate file (r=margaret)

---
 mobile/android/base/home/HomeAdapter.java | 139 +++++++++++++++++++
 mobile/android/base/home/HomePager.java   | 157 +++++-----------------
 mobile/android/base/moz.build             |   1 +
 3 files changed, 172 insertions(+), 125 deletions(-)
 create mode 100644 mobile/android/base/home/HomeAdapter.java

diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
new file mode 100644
index 000000000000..caaab89a79b9
--- /dev/null
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -0,0 +1,139 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.home.HomePager;
+import org.mozilla.gecko.home.HomePager.Page;
+
+import android.content.Context;
+import android.os.Bundle;
+import android.support.v4.app.Fragment;
+import android.support.v4.app.FragmentManager;
+import android.support.v4.app.FragmentStatePagerAdapter;
+import android.view.ViewGroup;
+
+import java.util.ArrayList;
+import java.util.EnumMap;
+
+class HomeAdapter extends FragmentStatePagerAdapter {
+
+    private final Context mContext;
+    private final ArrayList<TabInfo> mTabs;
+    private final EnumMap<Page, Fragment> mPages;
+
+    private OnAddTabListener mAddTabListener;
+
+    interface OnAddTabListener {
+        public void onAddTab(String title);
+    }
+
+    final class TabInfo {
+        private final Page page;
+        private final Class<?> clss;
+        private final Bundle args;
+        private final String title;
+
+        TabInfo(Page page, Class<?> clss, Bundle args, String title) {
+            this.page = page;
+            this.clss = clss;
+            this.args = args;
+            this.title = title;
+        }
+    }
+
+    public HomeAdapter(Context context, FragmentManager fm) {
+        super(fm);
+
+        mContext = context;
+
+        mTabs = new ArrayList<TabInfo>();
+        mPages = new EnumMap<Page, Fragment>(Page.class);
+    }
+
+    @Override
+    public int getCount() {
+        return mTabs.size();
+    }
+
+    @Override
+    public Fragment getItem(int position) {
+        TabInfo info = mTabs.get(position);
+        return Fragment.instantiate(mContext, info.clss.getName(), info.args);
+    }
+
+    @Override
+    public CharSequence getPageTitle(int position) {
+        TabInfo info = mTabs.get(position);
+        return info.title.toUpperCase();
+    }
+
+    @Override
+    public Object instantiateItem(ViewGroup container, int position) {
+        Fragment fragment = (Fragment) super.instantiateItem(container, position);
+        mPages.put(mTabs.get(position).page, fragment);
+
+        return fragment;
+    }
+
+    @Override
+    public void destroyItem(ViewGroup container, int position, Object object) {
+        super.destroyItem(container, position, object);
+        mPages.remove(mTabs.get(position).page);
+    }
+
+    public void setOnAddTabListener(OnAddTabListener listener) {
+        mAddTabListener = listener;
+    }
+
+    public void addTab(Page page, Class<?> clss, Bundle args, String title) {
+        addTab(-1, page, clss, args, title);
+    }
+
+    public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
+        TabInfo info = new TabInfo(page, clss, args, title);
+
+        if (index >= 0) {
+            mTabs.add(index, info);
+        } else {
+            mTabs.add(info);
+        }
+
+        notifyDataSetChanged();
+
+        if (mAddTabListener != null) {
+            mAddTabListener.onAddTab(title);
+        }
+    }
+
+    public int getItemPosition(Page page) {
+        for (int i = 0; i < mTabs.size(); i++) {
+            TabInfo info = mTabs.get(i);
+            if (info.page == page) {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+
+    public Page getPageAtPosition(int position) {
+        TabInfo info = mTabs.get(position);
+        return info.page;
+    }
+
+    public void setCanLoadHint(boolean canLoadHint) {
+        // Update fragment arguments for future instances
+        for (TabInfo info : mTabs) {
+            info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
+        }
+
+        // Enable/disable loading on all existing pages
+        for (Fragment page : mPages.values()) {
+            final HomeFragment homePage = (HomeFragment) page;
+            homePage.setCanLoadHint(canLoadHint);
+        }
+    }
+}
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 0db739c235f5..f1d42dd4aa69 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -8,6 +8,7 @@ package org.mozilla.gecko.home;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
+import org.mozilla.gecko.home.HomeAdapter.OnAddTabListener;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -16,8 +17,6 @@ import android.os.Build;
 import android.os.Bundle;
 import android.support.v4.app.Fragment;
 import android.support.v4.app.FragmentManager;
-import android.support.v4.app.FragmentStatePagerAdapter;
-import android.support.v4.view.PagerAdapter;
 import android.support.v4.view.ViewPager;
 import android.view.ViewGroup.LayoutParams;
 import android.util.AttributeSet;
@@ -25,15 +24,16 @@ import android.view.MotionEvent;
 import android.view.ViewGroup;
 import android.view.View;
 
-import java.util.ArrayList;
-import java.util.EnumMap;
 import java.util.EnumSet;
 
 public class HomePager extends ViewPager {
+
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;
 
+    private final OnAddTabListener mAddTabListener;
+
     // List of pages in order.
     @RobocopTarget
     public enum Page {
@@ -53,8 +53,6 @@ public class HomePager extends ViewPager {
     static final String LIST_TAG_LAST_TABS = "last_tabs";
     static final String LIST_TAG_BROWSER_SEARCH = "browser_search";
 
-    private EnumMap<Page, Fragment> mPages = new EnumMap<Page, Fragment>(Page.class);
-
     public interface OnUrlOpenListener {
         public enum Flags {
             ALLOW_SWITCH_TO_TAB
@@ -92,6 +90,15 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
+        mAddTabListener = new OnAddTabListener() {
+            @Override
+            public void onAddTab(String title) {
+                if (mDecor != null) {
+                    mDecor.onAddPagerView(title);
+                }
+            }
+        };
+
         // This is to keep all 4 pages in memory after they are
         // selected in the pager.
         setOffscreenPageLimit(3);
@@ -109,6 +116,14 @@ public class HomePager extends ViewPager {
         if (child instanceof Decor) {
             ((ViewPager.LayoutParams) params).isDecor = true;
             mDecor = (Decor) child;
+
+            mDecor.setOnTitleClickListener(new OnTitleClickListener() {
+                @Override
+                public void onTitleClicked(int index) {
+                    setCurrentItem(index, true);
+                }
+            });
+
             setOnPageChangeListener(new ViewPager.OnPageChangeListener() {
                 @Override
                 public void onPageSelected(int position) {
@@ -129,8 +144,10 @@ public class HomePager extends ViewPager {
     }
 
     public void redisplay(FragmentManager fm) {
-        final TabsAdapter adapter = (TabsAdapter) getAdapter();
-        show(fm, adapter.getCurrentPage(), null);
+        final HomeAdapter adapter = (HomeAdapter) getAdapter();
+        final Page currentPage = adapter.getPageAtPosition(getCurrentItem());
+
+        show(fm, currentPage, null);
     }
 
     /**
@@ -140,7 +157,13 @@ public class HomePager extends ViewPager {
      */
     public void show(FragmentManager fm, Page page, PropertyAnimator animator) {
         mLoaded = true;
-        final TabsAdapter adapter = new TabsAdapter(fm);
+
+        if (mDecor != null) {
+            mDecor.removeAllPagerViews();
+        }
+
+        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
+        adapter.setOnAddTabListener(mAddTabListener);
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
@@ -222,122 +245,6 @@ public class HomePager extends ViewPager {
         }
     }
 
-    class TabsAdapter extends FragmentStatePagerAdapter
-                      implements OnTitleClickListener {
-        private final ArrayList<TabInfo> mTabs = new ArrayList<TabInfo>();
-
-        final class TabInfo {
-            private final Page page;
-            private final Class<?> clss;
-            private final Bundle args;
-            private final String title;
-
-            TabInfo(Page page, Class<?> clss, Bundle args, String title) {
-                this.page = page;
-                this.clss = clss;
-                this.args = args;
-                this.title = title;
-            }
-        }
-
-        public TabsAdapter(FragmentManager fm) {
-            super(fm);
-
-            if (mDecor != null) {
-                mDecor.removeAllPagerViews();
-                mDecor.setOnTitleClickListener(this);
-            }
-        }
-
-        public void addTab(Page page, Class<?> clss, Bundle args, String title) {
-            addTab(-1, page, clss, args, title);
-        }
-
-        public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
-            TabInfo info = new TabInfo(page, clss, args, title);
-
-            if (index >= 0) {
-                mTabs.add(index, info);
-            } else {
-                mTabs.add(info);
-            }
-
-            notifyDataSetChanged();
-
-            if (mDecor != null) {
-                mDecor.onAddPagerView(title);
-            }
-        }
-
-        @Override
-        public void onTitleClicked(int index) {
-            setCurrentItem(index, true);
-        }
-
-        public int getItemPosition(Page page) {
-            for (int i = 0; i < mTabs.size(); i++) {
-                TabInfo info = mTabs.get(i);
-                if (info.page == page) {
-                    return i;
-                }
-            }
-
-            return -1;
-        }
-
-        public Page getCurrentPage() {
-            int currentItem = getCurrentItem();
-            TabInfo info = mTabs.get(currentItem);
-            return info.page;
-        }
-
-        @Override
-        public int getCount() {
-            return mTabs.size();
-        }
-
-        @Override
-        public Fragment getItem(int position) {
-            TabInfo info = mTabs.get(position);
-            return Fragment.instantiate(mContext, info.clss.getName(), info.args);
-        }
-
-        @Override
-        public CharSequence getPageTitle(int position) {
-            TabInfo info = mTabs.get(position);
-            return info.title.toUpperCase();
-        }
-
-        @Override
-        public Object instantiateItem(ViewGroup container, int position) {
-            Fragment fragment = (Fragment) super.instantiateItem(container, position);
-
-            mPages.put(mTabs.get(position).page, fragment);
-
-            return fragment;
-        }
-
-        @Override
-        public void destroyItem(ViewGroup container, int position, Object object) {
-            super.destroyItem(container, position, object);
-
-            mPages.remove(mTabs.get(position).page);
-        }
-
-        public void setCanLoadHint(boolean canLoadHint) {
-            // Update fragment arguments for future instances
-            for (TabInfo info : mTabs) {
-                info.args.putBoolean(CAN_LOAD_ARG, canLoadHint);
-            }
-
-            // Enable/disable loading on all existing pages
-            for (Fragment page : mPages.values()) {
-                final HomeFragment homePage = (HomeFragment) page;
-                homePage.setCanLoadHint(canLoadHint);
-            }
-        }
-    }
-
     @Override
     public boolean onInterceptTouchEvent(MotionEvent event) {
         if (event.getActionMasked() == MotionEvent.ACTION_DOWN) {
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 2eaf5ce6262a..476cb6c4855d 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -208,6 +208,7 @@ gbjar.sources += [
     'home/BrowserSearch.java',
     'home/FadedTextView.java',
     'home/HistoryPage.java',
+    'home/HomeAdapter.java',
     'home/HomeBanner.java',
     'home/HomeFragment.java',
     'home/HomeListView.java',

From ec75db4e9ba11edffab9e05c78e3e0597bbadbf1 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 10:55:36 +0000
Subject: [PATCH 136/459] Bug 942231 - Use 'page' terminology in HomePager
 instead of 'tab' (r=margaret)

---
 mobile/android/base/home/HomeAdapter.java | 52 +++++++++++------------
 mobile/android/base/home/HomePager.java   | 22 +++++-----
 2 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
index caaab89a79b9..2d424face292 100644
--- a/mobile/android/base/home/HomeAdapter.java
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -21,22 +21,22 @@ import java.util.EnumMap;
 class HomeAdapter extends FragmentStatePagerAdapter {
 
     private final Context mContext;
-    private final ArrayList<TabInfo> mTabs;
+    private final ArrayList<PageInfo> mPageInfos;
     private final EnumMap<Page, Fragment> mPages;
 
-    private OnAddTabListener mAddTabListener;
+    private OnAddPageListener mAddPageListener;
 
-    interface OnAddTabListener {
-        public void onAddTab(String title);
+    interface OnAddPageListener {
+        public void onAddPage(String title);
     }
 
-    final class TabInfo {
+    final class PageInfo {
         private final Page page;
         private final Class<?> clss;
         private final Bundle args;
         private final String title;
 
-        TabInfo(Page page, Class<?> clss, Bundle args, String title) {
+        PageInfo(Page page, Class<?> clss, Bundle args, String title) {
             this.page = page;
             this.clss = clss;
             this.args = args;
@@ -49,31 +49,31 @@ class HomeAdapter extends FragmentStatePagerAdapter {
 
         mContext = context;
 
-        mTabs = new ArrayList<TabInfo>();
+        mPageInfos = new ArrayList<PageInfo>();
         mPages = new EnumMap<Page, Fragment>(Page.class);
     }
 
     @Override
     public int getCount() {
-        return mTabs.size();
+        return mPageInfos.size();
     }
 
     @Override
     public Fragment getItem(int position) {
-        TabInfo info = mTabs.get(position);
+        PageInfo info = mPageInfos.get(position);
         return Fragment.instantiate(mContext, info.clss.getName(), info.args);
     }
 
     @Override
     public CharSequence getPageTitle(int position) {
-        TabInfo info = mTabs.get(position);
+        PageInfo info = mPageInfos.get(position);
         return info.title.toUpperCase();
     }
 
     @Override
     public Object instantiateItem(ViewGroup container, int position) {
         Fragment fragment = (Fragment) super.instantiateItem(container, position);
-        mPages.put(mTabs.get(position).page, fragment);
+        mPages.put(mPageInfos.get(position).page, fragment);
 
         return fragment;
     }
@@ -81,36 +81,36 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public void destroyItem(ViewGroup container, int position, Object object) {
         super.destroyItem(container, position, object);
-        mPages.remove(mTabs.get(position).page);
+        mPages.remove(mPageInfos.get(position).page);
     }
 
-    public void setOnAddTabListener(OnAddTabListener listener) {
-        mAddTabListener = listener;
+    public void setOnAddPageListener(OnAddPageListener listener) {
+        mAddPageListener = listener;
     }
 
-    public void addTab(Page page, Class<?> clss, Bundle args, String title) {
-        addTab(-1, page, clss, args, title);
+    public void addPage(Page page, Class<?> clss, Bundle args, String title) {
+        addPage(-1, page, clss, args, title);
     }
 
-    public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
-        TabInfo info = new TabInfo(page, clss, args, title);
+    public void addPage(int index, Page page, Class<?> clss, Bundle args, String title) {
+        PageInfo info = new PageInfo(page, clss, args, title);
 
         if (index >= 0) {
-            mTabs.add(index, info);
+            mPageInfos.add(index, info);
         } else {
-            mTabs.add(info);
+            mPageInfos.add(info);
         }
 
         notifyDataSetChanged();
 
-        if (mAddTabListener != null) {
-            mAddTabListener.onAddTab(title);
+        if (mAddPageListener != null) {
+            mAddPageListener.onAddPage(title);
         }
     }
 
     public int getItemPosition(Page page) {
-        for (int i = 0; i < mTabs.size(); i++) {
-            TabInfo info = mTabs.get(i);
+        for (int i = 0; i < mPageInfos.size(); i++) {
+            PageInfo info = mPageInfos.get(i);
             if (info.page == page) {
                 return i;
             }
@@ -120,13 +120,13 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     }
 
     public Page getPageAtPosition(int position) {
-        TabInfo info = mTabs.get(position);
+        PageInfo info = mPageInfos.get(position);
         return info.page;
     }
 
     public void setCanLoadHint(boolean canLoadHint) {
         // Update fragment arguments for future instances
-        for (TabInfo info : mTabs) {
+        for (PageInfo info : mPageInfos) {
             info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
         }
 
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index f1d42dd4aa69..66253b1be0f6 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -8,7 +8,7 @@ package org.mozilla.gecko.home;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
-import org.mozilla.gecko.home.HomeAdapter.OnAddTabListener;
+import org.mozilla.gecko.home.HomeAdapter.OnAddPageListener;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -32,7 +32,7 @@ public class HomePager extends ViewPager {
     private volatile boolean mLoaded;
     private Decor mDecor;
 
-    private final OnAddTabListener mAddTabListener;
+    private final OnAddPageListener mAddPageListener;
 
     // List of pages in order.
     @RobocopTarget
@@ -90,9 +90,9 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
-        mAddTabListener = new OnAddTabListener() {
+        mAddPageListener = new OnAddPageListener() {
             @Override
-            public void onAddTab(String title) {
+            public void onAddPage(String title) {
                 if (mDecor != null) {
                     mDecor.onAddPagerView(title);
                 }
@@ -163,26 +163,26 @@ public class HomePager extends ViewPager {
         }
 
         final HomeAdapter adapter = new HomeAdapter(mContext, fm);
-        adapter.setOnAddTabListener(mAddTabListener);
+        adapter.setOnAddPageListener(mAddPageListener);
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
 
-        adapter.addTab(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
+        adapter.addPage(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
                 getContext().getString(R.string.home_top_sites_title));
-        adapter.addTab(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
+        adapter.addPage(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
                 getContext().getString(R.string.bookmarks_title));
 
         // We disable reader mode support on low memory devices. Hence the
         // reading list page should not show up on such devices.
         if (!HardwareUtils.isLowMemoryPlatform()) {
-            adapter.addTab(Page.READING_LIST, ReadingListPage.class, new Bundle(),
+            adapter.addPage(Page.READING_LIST, ReadingListPage.class, new Bundle(),
                     getContext().getString(R.string.reading_list_title));
         }
 
-        // On phones, the history tab is the first tab. On tablets, the
-        // history tab is the last tab.
-        adapter.addTab(HardwareUtils.isTablet() ? -1 : 0,
+        // On phones, the history page is the first one. On tablets, the
+        // history page is the last.
+        adapter.addPage(HardwareUtils.isTablet() ? -1 : 0,
                 Page.HISTORY, HistoryPage.class, new Bundle(),
                 getContext().getString(R.string.home_history_title));
 

From ce83ada3cbb52713975e540333783b99db64b885 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 10:55:36 +0000
Subject: [PATCH 137/459] Bug 942231 - Keep showHomePager* method together in
 BrowserApp (r=margaret)

---
 mobile/android/base/BrowserApp.java | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index c6be146ff1cc..87d29f055f6b 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1618,10 +1618,6 @@ abstract public class BrowserApp extends GeckoApp
         }
     }
 
-    private void showHomePager(HomePager.Page page) {
-        showHomePagerWithAnimator(page, null);
-    }
-
     @Override
     public void onLocaleReady(final String locale) {
         super.onLocaleReady(locale);
@@ -1636,6 +1632,10 @@ abstract public class BrowserApp extends GeckoApp
         }
     }
 
+    private void showHomePager(HomePager.Page page) {
+        showHomePagerWithAnimator(page, null);
+    }
+
     private void showHomePagerWithAnimator(HomePager.Page page, PropertyAnimator animator) {
         if (isHomePagerVisible()) {
             return;

From 84a2b7ae8f66d08163008d077a46933ef7b59bea Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 10:55:36 +0000
Subject: [PATCH 138/459] Bug 942231 - Define constant with default value for
 'can load' hint (r=margaret)

---
 mobile/android/base/home/HomeFragment.java | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mobile/android/base/home/HomeFragment.java b/mobile/android/base/home/HomeFragment.java
index 48b976ba74fa..45e1ee26f015 100644
--- a/mobile/android/base/home/HomeFragment.java
+++ b/mobile/android/base/home/HomeFragment.java
@@ -44,6 +44,9 @@ abstract class HomeFragment extends Fragment {
     // Share MIME type.
     private static final String SHARE_MIME_TYPE = "text/plain";
 
+    // Default value for "can load" hint
+    static final boolean DEFAULT_CAN_LOAD_HINT = false;
+
     // Whether the fragment can load its content or not
     // This is used to defer data loading until the editing
     // mode animation ends.
@@ -58,9 +61,9 @@ abstract class HomeFragment extends Fragment {
 
         final Bundle args = getArguments();
         if (args != null) {
-            mCanLoadHint = args.getBoolean(HomePager.CAN_LOAD_ARG, false);
+            mCanLoadHint = args.getBoolean(HomePager.CAN_LOAD_ARG, DEFAULT_CAN_LOAD_HINT);
         } else {
-            mCanLoadHint = false;
+            mCanLoadHint = DEFAULT_CAN_LOAD_HINT;
         }
 
         mIsLoaded = false;

From 6cfc2fd5ae31e69b368a7deab041e109f22e714e Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 10:55:36 +0000
Subject: [PATCH 139/459] Bug 942231 - Change HomePager to be backed by
 HomeConfig (r=margaret)

---
 mobile/android/base/BrowserApp.java           |  14 +-
 mobile/android/base/Tab.java                  |   5 +-
 mobile/android/base/home/HomeAdapter.java     | 144 +++++++----
 mobile/android/base/home/HomeConfig.java      | 224 ++++++++++++++++++
 .../android/base/home/HomeConfigLoader.java   |  83 +++++++
 .../base/home/HomeConfigMemBackend.java       |  67 ++++++
 mobile/android/base/home/HomePager.java       | 154 +++++++++---
 mobile/android/base/home/ListPage.java        | 185 +++++++++++++++
 mobile/android/base/moz.build                 |   4 +
 9 files changed, 794 insertions(+), 86 deletions(-)
 create mode 100644 mobile/android/base/home/HomeConfig.java
 create mode 100644 mobile/android/base/home/HomeConfigLoader.java
 create mode 100644 mobile/android/base/home/HomeConfigMemBackend.java
 create mode 100644 mobile/android/base/home/ListPage.java

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 87d29f055f6b..3fcfa90c5427 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1467,7 +1467,7 @@ abstract public class BrowserApp extends GeckoApp
         animator.setUseHardwareLayer(false);
 
         mBrowserToolbar.startEditing(url, animator);
-        showHomePagerWithAnimator(HomePager.Page.TOP_SITES, animator);
+        showHomePagerWithAnimator(animator);
 
         animator.start();
     }
@@ -1623,7 +1623,7 @@ abstract public class BrowserApp extends GeckoApp
         super.onLocaleReady(locale);
         if (mHomePager != null) {
             // Blow it away and rebuild it with the right strings.
-            mHomePager.redisplay(getSupportFragmentManager());
+            mHomePager.redisplay(getSupportLoaderManager(), getSupportFragmentManager());
         }
 
         if (mMenu != null) {
@@ -1636,6 +1636,12 @@ abstract public class BrowserApp extends GeckoApp
         showHomePagerWithAnimator(page, null);
     }
 
+    private void showHomePagerWithAnimator(PropertyAnimator animator) {
+        // Passing null here means the default page will be defined
+        // by the HomePager's configuration.
+        showHomePagerWithAnimator(null, animator);
+    }
+
     private void showHomePagerWithAnimator(HomePager.Page page, PropertyAnimator animator) {
         if (isHomePagerVisible()) {
             return;
@@ -1655,7 +1661,9 @@ abstract public class BrowserApp extends GeckoApp
             mHomePager = (HomePager) homePagerStub.inflate();
         }
 
-        mHomePager.show(getSupportFragmentManager(), page, animator);
+        mHomePager.show(getSupportLoaderManager(),
+                        getSupportFragmentManager(),
+                        page, animator);
 
         // Hide the web content so it cannot be focused by screen readers.
         hideWebContentOnPropertyAnimationEnd(animator);
diff --git a/mobile/android/base/Tab.java b/mobile/android/base/Tab.java
index 09171f428372..0f1a02d10a7c 100644
--- a/mobile/android/base/Tab.java
+++ b/mobile/android/base/Tab.java
@@ -95,7 +95,7 @@ public class Tab {
         mUserSearch = "";
         mExternal = external;
         mParentId = parentId;
-        mAboutHomePage = HomePager.Page.TOP_SITES;
+        mAboutHomePage = null;
         mTitle = title == null ? "" : title;
         mFavicon = null;
         mFaviconUrl = null;
@@ -155,7 +155,6 @@ public class Tab {
         mAboutHomePage = page;
     }
 
-
     // may be null if user-entered query hasn't yet been resolved to a URI
     public synchronized String getURL() {
         return mUrl;
@@ -660,6 +659,8 @@ public class Tab {
         final String homePage = message.getString("aboutHomePage");
         if (!TextUtils.isEmpty(homePage)) {
             setAboutHomePage(HomePager.Page.valueOf(homePage));
+        } else {
+            setAboutHomePage(null);
         }
 
         Tabs.getInstance().notifyListeners(this, Tabs.TabEvents.LOCATION_CHANGE, oldUrl);
diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
index 2d424face292..7cbdc06283a2 100644
--- a/mobile/android/base/home/HomeAdapter.java
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -5,6 +5,8 @@
 
 package org.mozilla.gecko.home;
 
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.PageType;
 import org.mozilla.gecko.home.HomePager;
 import org.mozilla.gecko.home.HomePager.Page;
 
@@ -16,13 +18,16 @@ import android.support.v4.app.FragmentStatePagerAdapter;
 import android.view.ViewGroup;
 
 import java.util.ArrayList;
-import java.util.EnumMap;
+import java.util.HashMap;
+import java.util.List;
 
 class HomeAdapter extends FragmentStatePagerAdapter {
 
     private final Context mContext;
     private final ArrayList<PageInfo> mPageInfos;
-    private final EnumMap<Page, Fragment> mPages;
+    private final HashMap<String, Fragment> mPages;
+
+    private boolean mCanLoadHint;
 
     private OnAddPageListener mAddPageListener;
 
@@ -30,27 +35,14 @@ class HomeAdapter extends FragmentStatePagerAdapter {
         public void onAddPage(String title);
     }
 
-    final class PageInfo {
-        private final Page page;
-        private final Class<?> clss;
-        private final Bundle args;
-        private final String title;
-
-        PageInfo(Page page, Class<?> clss, Bundle args, String title) {
-            this.page = page;
-            this.clss = clss;
-            this.args = args;
-            this.title = title;
-        }
-    }
-
     public HomeAdapter(Context context, FragmentManager fm) {
         super(fm);
 
         mContext = context;
+        mCanLoadHint = HomeFragment.DEFAULT_CAN_LOAD_HINT;
 
         mPageInfos = new ArrayList<PageInfo>();
-        mPages = new EnumMap<Page, Fragment>(Page.class);
+        mPages = new HashMap<String, Fragment>();
     }
 
     @Override
@@ -61,19 +53,23 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public Fragment getItem(int position) {
         PageInfo info = mPageInfos.get(position);
-        return Fragment.instantiate(mContext, info.clss.getName(), info.args);
+        return Fragment.instantiate(mContext, info.getClassName(), info.getArgs());
     }
 
     @Override
     public CharSequence getPageTitle(int position) {
-        PageInfo info = mPageInfos.get(position);
-        return info.title.toUpperCase();
+        if (mPageInfos.size() > 0) {
+            PageInfo info = mPageInfos.get(position);
+            return info.getTitle().toUpperCase();
+        }
+
+        return null;
     }
 
     @Override
     public Object instantiateItem(ViewGroup container, int position) {
         Fragment fragment = (Fragment) super.instantiateItem(container, position);
-        mPages.put(mPageInfos.get(position).page, fragment);
+        mPages.put(mPageInfos.get(position).getId(), fragment);
 
         return fragment;
     }
@@ -81,37 +77,17 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public void destroyItem(ViewGroup container, int position, Object object) {
         super.destroyItem(container, position, object);
-        mPages.remove(mPageInfos.get(position).page);
+        mPages.remove(mPageInfos.get(position).getId());
     }
 
     public void setOnAddPageListener(OnAddPageListener listener) {
         mAddPageListener = listener;
     }
 
-    public void addPage(Page page, Class<?> clss, Bundle args, String title) {
-        addPage(-1, page, clss, args, title);
-    }
-
-    public void addPage(int index, Page page, Class<?> clss, Bundle args, String title) {
-        PageInfo info = new PageInfo(page, clss, args, title);
-
-        if (index >= 0) {
-            mPageInfos.add(index, info);
-        } else {
-            mPageInfos.add(info);
-        }
-
-        notifyDataSetChanged();
-
-        if (mAddPageListener != null) {
-            mAddPageListener.onAddPage(title);
-        }
-    }
-
     public int getItemPosition(Page page) {
         for (int i = 0; i < mPageInfos.size(); i++) {
-            PageInfo info = mPageInfos.get(i);
-            if (info.page == page) {
+            final Page infoPage = mPageInfos.get(i).toPage();
+            if (infoPage == page) {
                 return i;
             }
         }
@@ -121,14 +97,39 @@ class HomeAdapter extends FragmentStatePagerAdapter {
 
     public Page getPageAtPosition(int position) {
         PageInfo info = mPageInfos.get(position);
-        return info.page;
+        return info.toPage();
+    }
+
+    private void addPage(PageInfo info) {
+        mPageInfos.add(info);
+
+        if (mAddPageListener != null) {
+            mAddPageListener.onAddPage(info.getTitle());
+        }
+    }
+
+    public void update(List<PageEntry> pageEntries) {
+        mPages.clear();
+        mPageInfos.clear();
+
+        if (pageEntries != null) {
+            for (PageEntry pageEntry : pageEntries) {
+                final PageInfo info = new PageInfo(pageEntry);
+                addPage(info);
+            }
+        }
+
+        notifyDataSetChanged();
+    }
+
+    public boolean getCanLoadHint() {
+        return mCanLoadHint;
     }
 
     public void setCanLoadHint(boolean canLoadHint) {
-        // Update fragment arguments for future instances
-        for (PageInfo info : mPageInfos) {
-            info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
-        }
+        // We cache the last hint value so that we can use it when
+        // creating new pages. See PageInfo.getArgs().
+        mCanLoadHint = canLoadHint;
 
         // Enable/disable loading on all existing pages
         for (Fragment page : mPages.values()) {
@@ -136,4 +137,49 @@ class HomeAdapter extends FragmentStatePagerAdapter {
             homePage.setCanLoadHint(canLoadHint);
         }
     }
+
+    private final class PageInfo {
+        private final String mId;
+        private final PageEntry mPageEntry;
+
+        PageInfo(PageEntry pageEntry) {
+            mId = pageEntry.getType() + "-" + pageEntry.getId();
+            mPageEntry = pageEntry;
+        }
+
+        public String getId() {
+            return mId;
+        }
+
+        public String getTitle() {
+            return mPageEntry.getTitle();
+        }
+
+        public String getClassName() {
+            final PageType type = mPageEntry.getType();
+            return type.getPageClass().getName();
+        }
+
+        public Bundle getArgs() {
+            final Bundle args = new Bundle();
+
+            args.putBoolean(HomePager.CAN_LOAD_ARG, mCanLoadHint);
+
+            // Only list pages need the page entry
+            if (mPageEntry.getType() == PageType.LIST) {
+                args.putParcelable(HomePager.PAGE_ENTRY_ARG, mPageEntry);
+            }
+
+            return args;
+        }
+
+        public Page toPage() {
+            final PageType type = mPageEntry.getType();
+            if (type == PageType.LIST) {
+                return null;
+            }
+
+            return Page.valueOf(type);
+        }
+    }
 }
diff --git a/mobile/android/base/home/HomeConfig.java b/mobile/android/base/home/HomeConfig.java
new file mode 100644
index 000000000000..636fd617f7d8
--- /dev/null
+++ b/mobile/android/base/home/HomeConfig.java
@@ -0,0 +1,224 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.home.HomePager.Page;
+
+import android.content.Context;
+import android.os.Parcel;
+import android.os.Parcelable;
+import android.text.TextUtils;
+
+import java.util.EnumSet;
+import java.util.List;
+
+final class HomeConfig {
+    public static enum PageType implements Parcelable {
+        TOP_SITES("top_sites", TopSitesPage.class),
+        BOOKMARKS("bookmarks", BookmarksPage.class),
+        HISTORY("history", HistoryPage.class),
+        READING_LIST("reading_list", ReadingListPage.class),
+        LIST("list", ListPage.class);
+
+        private final String mId;
+        private final Class<?> mPageClass;
+
+        PageType(String id, Class<?> pageClass) {
+            mId = id;
+            mPageClass = pageClass;
+        }
+
+        public static PageType valueOf(Page page) {
+            switch(page) {
+                case TOP_SITES:
+                    return PageType.TOP_SITES;
+
+                case BOOKMARKS:
+                    return PageType.BOOKMARKS;
+
+                case HISTORY:
+                    return PageType.HISTORY;
+
+                case READING_LIST:
+                    return PageType.READING_LIST;
+
+                default:
+                    throw new IllegalArgumentException("Could not convert unrecognized Page");
+            }
+        }
+
+        public static PageType fromId(String id) {
+            if (id == null) {
+                throw new IllegalArgumentException("Could not convert null String to PageType");
+            }
+
+            for (PageType page : PageType.values()) {
+                if (TextUtils.equals(page.mId, id.toLowerCase())) {
+                    return page;
+                }
+            }
+
+            throw new IllegalArgumentException("Could not convert String id to PageType");
+        }
+
+        @Override
+        public String toString() {
+            return mId;
+        }
+
+        public Class<?> getPageClass() {
+            return mPageClass;
+        }
+
+        @Override
+        public int describeContents() {
+            return 0;
+        }
+
+        @Override
+        public void writeToParcel(Parcel dest, int flags) {
+            dest.writeInt(ordinal());
+        }
+
+        public static final Creator<PageType> CREATOR = new Creator<PageType>() {
+            @Override
+            public PageType createFromParcel(final Parcel source) {
+                return PageType.values()[source.readInt()];
+            }
+
+            @Override
+            public PageType[] newArray(final int size) {
+                return new PageType[size];
+            }
+        };
+    }
+
+    public static class PageEntry implements Parcelable {
+        private final PageType mType;
+        private final String mTitle;
+        private final String mId;
+        private final EnumSet<Flags> mFlags;
+
+        public enum Flags {
+            DEFAULT_PAGE
+        }
+
+        @SuppressWarnings("unchecked")
+        public PageEntry(Parcel in) {
+            mType = (PageType) in.readParcelable(getClass().getClassLoader());
+            mTitle = in.readString();
+            mId = in.readString();
+            mFlags = (EnumSet<Flags>) in.readSerializable();
+        }
+
+        public PageEntry(PageType type, String title) {
+            this(type, title, EnumSet.noneOf(Flags.class));
+        }
+
+        public PageEntry(PageType type, String title, EnumSet<Flags> flags) {
+            this(type, title, type.toString(), flags);
+        }
+
+        public PageEntry(PageType type, String title, String id) {
+            this(type, title, id, EnumSet.noneOf(Flags.class));
+        }
+
+        public PageEntry(PageType type, String title, String id, EnumSet<Flags> flags) {
+            if (type == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null type");
+            }
+            mType = type;
+
+            if (title == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null title");
+            }
+            mTitle = title;
+
+            if (id == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null id");
+            }
+            mId = id;
+
+            if (flags == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null flags");
+            }
+            mFlags = flags;
+        }
+
+        public PageType getType() {
+            return mType;
+        }
+
+        public String getTitle() {
+            return mTitle;
+        }
+
+        public String getId() {
+            return mId;
+        }
+
+        public boolean isDefault() {
+            return mFlags.contains(Flags.DEFAULT_PAGE);
+        }
+
+        @Override
+        public int describeContents() {
+            return 0;
+        }
+
+        @Override
+        public void writeToParcel(Parcel dest, int flags) {
+            dest.writeParcelable(mType, 0);
+            dest.writeString(mTitle);
+            dest.writeString(mId);
+            dest.writeSerializable(mFlags);
+        }
+
+        public static final Creator<PageEntry> CREATOR = new Creator<PageEntry>() {
+            @Override
+            public PageEntry createFromParcel(final Parcel in) {
+                return new PageEntry(in);
+            }
+
+            @Override
+            public PageEntry[] newArray(final int size) {
+                return new PageEntry[size];
+            }
+        };
+    }
+
+    public interface OnChangeListener {
+        public void onChange();
+    }
+
+    public interface HomeConfigBackend {
+        public List<PageEntry> load();
+        public void save(List<PageEntry> entries);
+        public void setOnChangeListener(OnChangeListener listener);
+    }
+
+    private final HomeConfigBackend mBackend;
+
+    public HomeConfig(HomeConfigBackend backend) {
+        mBackend = backend;
+    }
+
+    public List<PageEntry> load() {
+        return mBackend.load();
+    }
+
+    public void save(List<PageEntry> entries) {
+        mBackend.save(entries);
+    }
+
+    public void setOnChangeListener(OnChangeListener listener) {
+        mBackend.setOnChangeListener(listener);
+    }
+
+    public static HomeConfig getDefault(Context context) {
+        return new HomeConfig(new HomeConfigMemBackend(context));
+    }
+}
\ No newline at end of file
diff --git a/mobile/android/base/home/HomeConfigLoader.java b/mobile/android/base/home/HomeConfigLoader.java
new file mode 100644
index 000000000000..df27c8c7e961
--- /dev/null
+++ b/mobile/android/base/home/HomeConfigLoader.java
@@ -0,0 +1,83 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.OnChangeListener;
+
+import android.content.Context;
+import android.support.v4.content.AsyncTaskLoader;
+
+import java.util.List;
+
+public class HomeConfigLoader extends AsyncTaskLoader<List<PageEntry>> {
+    private final HomeConfig mConfig;
+    private List<PageEntry> mPageEntries;
+
+    public HomeConfigLoader(Context context, HomeConfig homeConfig) {
+        super(context);
+        mConfig = homeConfig;
+    }
+
+    @Override
+    public List<PageEntry> loadInBackground() {
+        return mConfig.load();
+    }
+
+    @Override
+    public void deliverResult(List<PageEntry> pageEntries) {
+        if (isReset()) {
+            mPageEntries = null;
+            return;
+        }
+
+        mPageEntries = pageEntries;
+        mConfig.setOnChangeListener(new ForceLoadChangeListener());
+
+        if (isStarted()) {
+            super.deliverResult(pageEntries);
+        }
+    }
+
+    @Override
+    protected void onStartLoading() {
+        if (mPageEntries != null) {
+            deliverResult(mPageEntries);
+        }
+
+        if (takeContentChanged() || mPageEntries == null) {
+            forceLoad();
+        }
+    }
+
+    @Override
+    protected void onStopLoading() {
+        cancelLoad();
+    }
+
+    @Override
+    public void onCanceled(List<PageEntry> pageEntries) {
+        mPageEntries = null;
+    }
+
+    @Override
+    protected void onReset() {
+        super.onReset();
+
+        // Ensure the loader is stopped.
+        onStopLoading();
+
+        mPageEntries = null;
+        mConfig.setOnChangeListener(null);
+    }
+
+    private class ForceLoadChangeListener implements OnChangeListener {
+        @Override
+        public void onChange() {
+            onContentChanged();
+        }
+    }
+}
diff --git a/mobile/android/base/home/HomeConfigMemBackend.java b/mobile/android/base/home/HomeConfigMemBackend.java
new file mode 100644
index 000000000000..03d038b1f2c5
--- /dev/null
+++ b/mobile/android/base/home/HomeConfigMemBackend.java
@@ -0,0 +1,67 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.home.HomeConfig.HomeConfigBackend;
+import org.mozilla.gecko.home.HomeConfig.OnChangeListener;
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.PageType;
+import org.mozilla.gecko.util.HardwareUtils;
+
+import android.content.Context;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.List;
+
+class HomeConfigMemBackend implements HomeConfigBackend {
+    private final Context mContext;
+
+    public HomeConfigMemBackend(Context context) {
+        mContext = context;
+    }
+
+    public List<PageEntry> load() {
+        final ArrayList<PageEntry> pageEntries = new ArrayList<PageEntry>();
+
+        pageEntries.add(new PageEntry(PageType.TOP_SITES,
+                                      mContext.getString(R.string.home_top_sites_title),
+                                      EnumSet.of(PageEntry.Flags.DEFAULT_PAGE)));
+
+        pageEntries.add(new PageEntry(PageType.BOOKMARKS,
+                                      mContext.getString(R.string.bookmarks_title)));
+
+        // We disable reader mode support on low memory devices. Hence the
+        // reading list page should not show up on such devices.
+        if (!HardwareUtils.isLowMemoryPlatform()) {
+            pageEntries.add(new PageEntry(PageType.READING_LIST,
+                                          mContext.getString(R.string.reading_list_title)));
+        }
+
+        final PageEntry historyEntry = new PageEntry(PageType.HISTORY,
+                                                     mContext.getString(R.string.home_history_title));
+
+        // On tablets, the history page is the last.
+        // On phones, the history page is the first one.
+        if (HardwareUtils.isTablet()) {
+            pageEntries.add(historyEntry);
+        } else {
+            pageEntries.add(0, historyEntry);
+        }
+
+        return Collections.unmodifiableList(pageEntries);
+    }
+
+    public void save(List<PageEntry> entries) {
+        // This is a static backend, do nothing.
+    }
+
+    public void setOnChangeListener(OnChangeListener listener) {
+        // This is a static backend, do nothing.
+    }
+}
\ No newline at end of file
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 66253b1be0f6..3849bf4aa38d 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -9,6 +9,8 @@ import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
 import org.mozilla.gecko.home.HomeAdapter.OnAddPageListener;
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.PageType;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -17,6 +19,9 @@ import android.os.Build;
 import android.os.Bundle;
 import android.support.v4.app.Fragment;
 import android.support.v4.app.FragmentManager;
+import android.support.v4.app.LoaderManager;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
+import android.support.v4.content.Loader;
 import android.support.v4.view.ViewPager;
 import android.view.ViewGroup.LayoutParams;
 import android.util.AttributeSet;
@@ -25,22 +30,50 @@ import android.view.ViewGroup;
 import android.view.View;
 
 import java.util.EnumSet;
+import java.util.List;
 
 public class HomePager extends ViewPager {
 
+    private static final int LOADER_ID_CONFIG = 0;
+
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;
+    private View mTabStrip;
 
     private final OnAddPageListener mAddPageListener;
 
+    private final HomeConfig mConfig;
+    private ConfigLoaderCallbacks mConfigLoaderCallbacks;
+
+    private Page mInitialPage;
+
     // List of pages in order.
     @RobocopTarget
     public enum Page {
         HISTORY,
         TOP_SITES,
         BOOKMARKS,
-        READING_LIST
+        READING_LIST;
+
+        static Page valueOf(PageType page) {
+            switch(page) {
+                case TOP_SITES:
+                    return Page.TOP_SITES;
+
+                case BOOKMARKS:
+                    return Page.BOOKMARKS;
+
+                case HISTORY:
+                    return Page.HISTORY;
+
+                case READING_LIST:
+                    return Page.READING_LIST;
+
+                default:
+                    throw new IllegalArgumentException("Could not convert unrecognized PageType");
+            }
+        }
     }
 
     // This is mostly used by UI tests to easily fetch
@@ -81,6 +114,7 @@ public class HomePager extends ViewPager {
     }
 
     static final String CAN_LOAD_ARG = "canLoad";
+    static final String PAGE_ENTRY_ARG = "pageEntry";
 
     public HomePager(Context context) {
         this(context, null);
@@ -90,6 +124,9 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
+        mConfig = HomeConfig.getDefault(mContext);
+        mConfigLoaderCallbacks = new ConfigLoaderCallbacks();
+
         mAddPageListener = new OnAddPageListener() {
             @Override
             public void onAddPage(String title) {
@@ -116,6 +153,7 @@ public class HomePager extends ViewPager {
         if (child instanceof Decor) {
             ((ViewPager.LayoutParams) params).isDecor = true;
             mDecor = (Decor) child;
+            mTabStrip = child;
 
             mDecor.setOnTitleClickListener(new OnTitleClickListener() {
                 @Override
@@ -138,16 +176,18 @@ public class HomePager extends ViewPager {
                 @Override
                 public void onPageScrollStateChanged(int state) { }
             });
+        } else if (child instanceof HomePagerTabStrip) {
+            mTabStrip = child;
         }
 
         super.addView(child, index, params);
     }
 
-    public void redisplay(FragmentManager fm) {
+    public void redisplay(LoaderManager lm, FragmentManager fm) {
         final HomeAdapter adapter = (HomeAdapter) getAdapter();
-        final Page currentPage = adapter.getPageAtPosition(getCurrentItem());
 
-        show(fm, currentPage, null);
+        Page currentPage = adapter.getPageAtPosition(getCurrentItem());
+        show(lm, fm, currentPage, null);
     }
 
     /**
@@ -155,44 +195,29 @@ public class HomePager extends ViewPager {
      *
      * @param fm FragmentManager for the adapter
      */
-    public void show(FragmentManager fm, Page page, PropertyAnimator animator) {
+    public void show(LoaderManager lm, FragmentManager fm, Page page, PropertyAnimator animator) {
         mLoaded = true;
-
-        if (mDecor != null) {
-            mDecor.removeAllPagerViews();
-        }
-
-        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
-        adapter.setOnAddPageListener(mAddPageListener);
+        mInitialPage = page;
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
 
-        adapter.addPage(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
-                getContext().getString(R.string.home_top_sites_title));
-        adapter.addPage(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
-                getContext().getString(R.string.bookmarks_title));
-
-        // We disable reader mode support on low memory devices. Hence the
-        // reading list page should not show up on such devices.
-        if (!HardwareUtils.isLowMemoryPlatform()) {
-            adapter.addPage(Page.READING_LIST, ReadingListPage.class, new Bundle(),
-                    getContext().getString(R.string.reading_list_title));
-        }
-
-        // On phones, the history page is the first one. On tablets, the
-        // history page is the last.
-        adapter.addPage(HardwareUtils.isTablet() ? -1 : 0,
-                Page.HISTORY, HistoryPage.class, new Bundle(),
-                getContext().getString(R.string.home_history_title));
-
+        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
+        adapter.setOnAddPageListener(mAddPageListener);
         adapter.setCanLoadHint(!shouldAnimate);
-
         setAdapter(adapter);
 
-        setCurrentItem(adapter.getItemPosition(page), false);
         setVisibility(VISIBLE);
 
+        // Don't show the tabs strip until we have the
+        // list of pages in place.
+        if (mTabStrip != null) {
+            mTabStrip.setVisibility(View.INVISIBLE);
+        }
+
+        // Load list of pages from configuration
+        lm.initLoader(LOADER_ID_CONFIG, null, mConfigLoaderCallbacks);
+
         if (shouldAnimate) {
             animator.addPropertyAnimationListener(new PropertyAnimator.PropertyAnimationListener() {
                 @Override
@@ -254,4 +279,69 @@ public class HomePager extends ViewPager {
 
         return super.onInterceptTouchEvent(event);
     }
+
+    private void updateUiFromPageEntries(List<PageEntry> pageEntries) {
+        // We only care about the adapter if HomePager is currently
+        // loaded, which means it's visible in the activity.
+        if (!mLoaded) {
+            return;
+        }
+
+        if (mDecor != null) {
+            mDecor.removeAllPagerViews();
+        }
+
+        final HomeAdapter adapter = (HomeAdapter) getAdapter();
+
+        // Disable loading until the final current item is defined
+        // after loading the page entries. This is to stop any temporary
+        // active item from loading.
+        boolean originalCanLoadHint = adapter.getCanLoadHint();
+        adapter.setCanLoadHint(false);
+
+        // Update the adapter with the new page entries
+        adapter.update(pageEntries);
+
+        final int count = (pageEntries != null ? pageEntries.size() : 0);
+
+        if (mTabStrip != null) {
+            mTabStrip.setVisibility(count > 0 ? View.VISIBLE : View.INVISIBLE);
+        }
+
+        // Use the default page as defined in the HomePager's configuration
+        // if the initial page wasn't explicitly set by the show() caller.
+        if (mInitialPage != null) {
+            setCurrentItem(adapter.getItemPosition(mInitialPage), false);
+            mInitialPage = null;
+        } else {
+            for (int i = 0; i < count; i++) {
+                final PageEntry pageEntry = pageEntries.get(i);
+                if (pageEntry.isDefault()) {
+                    setCurrentItem(i, false);
+                    break;
+                }
+            }
+        }
+
+        // Restore canLoadHint now that we have the final
+        // state in HomePager.
+        adapter.setCanLoadHint(originalCanLoadHint);
+    }
+
+    private class ConfigLoaderCallbacks implements LoaderCallbacks<List<PageEntry>> {
+        @Override
+        public Loader<List<PageEntry>> onCreateLoader(int id, Bundle args) {
+            return new HomeConfigLoader(mContext, mConfig);
+        }
+
+        @Override
+        public void onLoadFinished(Loader<List<PageEntry>> loader, List<PageEntry> pageEntries) {
+            updateUiFromPageEntries(pageEntries);
+        }
+
+        @Override
+        public void onLoaderReset(Loader<List<PageEntry>> loader) {
+            updateUiFromPageEntries(null);
+        }
+    }
 }
diff --git a/mobile/android/base/home/ListPage.java b/mobile/android/base/home/ListPage.java
new file mode 100644
index 000000000000..f3c911095b84
--- /dev/null
+++ b/mobile/android/base/home/ListPage.java
@@ -0,0 +1,185 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.home.HomePager.OnUrlOpenListener;
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+
+import android.app.Activity;
+import android.content.Context;
+import android.content.res.Configuration;
+import android.database.Cursor;
+import android.os.Bundle;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
+import android.support.v4.content.Loader;
+import android.support.v4.widget.CursorAdapter;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.ViewGroup;
+import android.widget.ListView;
+
+import java.util.EnumSet;
+
+/**
+ * Fragment that displays custom lists.
+ */
+public class ListPage extends HomeFragment {
+    // Cursor loader ID for the lists
+    private static final int LOADER_ID_LIST = 0;
+
+    // The page entry associated with this page
+    private PageEntry mPageEntry;
+
+    // Adapter for the list
+    private HomeListAdapter mAdapter;
+
+    // The view shown by the fragment
+    private ListView mList;
+
+    // Callbacks used for the list loader
+    private CursorLoaderCallbacks mCursorLoaderCallbacks;
+
+    // On URL open listener
+    private OnUrlOpenListener mUrlOpenListener;
+
+    @Override
+    public void onAttach(Activity activity) {
+        super.onAttach(activity);
+
+        try {
+            mUrlOpenListener = (OnUrlOpenListener) activity;
+        } catch (ClassCastException e) {
+            throw new ClassCastException(activity.toString()
+                    + " must implement HomePager.OnUrlOpenListener");
+        }
+    }
+
+    @Override
+    public void onDetach() {
+        super.onDetach();
+
+        mUrlOpenListener = null;
+    }
+
+    @Override
+    public void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        final Bundle args = getArguments();
+        if (args != null) {
+            mPageEntry = (PageEntry) args.getParcelable(HomePager.PAGE_ENTRY_ARG);
+        }
+
+        if (mPageEntry == null) {
+            throw new IllegalStateException("Can't create a ListPage without a PageEntry");
+        }
+    }
+
+    @Override
+    public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
+        mList = new HomeListView(getActivity());
+        return mList;
+    }
+
+    @Override
+    public void onViewCreated(View view, Bundle savedInstanceState) {
+        super.onViewCreated(view, savedInstanceState);
+
+        registerForContextMenu(mList);
+    }
+
+    @Override
+    public void onDestroyView() {
+        super.onDestroyView();
+        mList = null;
+    }
+
+    @Override
+    public void onConfigurationChanged(Configuration newConfig) {
+        super.onConfigurationChanged(newConfig);
+
+        // Detach and reattach the fragment as the layout changes.
+        if (isVisible()) {
+            getFragmentManager().beginTransaction()
+                                .detach(this)
+                                .attach(this)
+                                .commitAllowingStateLoss();
+        }
+    }
+
+    @Override
+    public void onActivityCreated(Bundle savedInstanceState) {
+        super.onActivityCreated(savedInstanceState);
+
+        mAdapter = new HomeListAdapter(getActivity(), null);
+        mList.setAdapter(mAdapter);
+
+        // Create callbacks before the initial loader is started.
+        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
+        loadIfVisible();
+    }
+
+    @Override
+    protected void load() {
+        getLoaderManager().initLoader(LOADER_ID_LIST, null, mCursorLoaderCallbacks);
+    }
+
+    /**
+     * Cursor loader for the lists.
+     */
+    private static class HomeListLoader extends SimpleCursorLoader {
+        public HomeListLoader(Context context) {
+            super(context);
+        }
+
+        @Override
+        public Cursor loadCursor() {
+            // Do nothing
+            return null;
+        }
+    }
+
+    /**
+     * Cursor adapter for the list.
+     */
+    private class HomeListAdapter extends CursorAdapter {
+        public HomeListAdapter(Context context, Cursor cursor) {
+            super(context, cursor, 0);
+        }
+
+        @Override
+        public void bindView(View view, Context context, Cursor cursor) {
+            final TwoLinePageRow row = (TwoLinePageRow) view;
+            row.updateFromCursor(cursor);
+        }
+
+        @Override
+        public View newView(Context context, Cursor cursor, ViewGroup parent) {
+            return LayoutInflater.from(parent.getContext()).inflate(R.layout.bookmark_item_row, parent, false);
+        }
+    }
+
+    /**
+     * LoaderCallbacks implementation that interacts with the LoaderManager.
+     */
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
+        @Override
+        public Loader<Cursor> onCreateLoader(int id, Bundle args) {
+            return new HomeListLoader(getActivity());
+        }
+
+        @Override
+        public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
+            mAdapter.swapCursor(c);
+        }
+
+        @Override
+        public void onLoaderReset(Loader<Cursor> loader) {
+            mAdapter.swapCursor(null);
+        }
+    }
+}
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 476cb6c4855d..2bb5769946ea 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -210,11 +210,15 @@ gbjar.sources += [
     'home/HistoryPage.java',
     'home/HomeAdapter.java',
     'home/HomeBanner.java',
+    'home/HomeConfig.java',
+    'home/HomeConfigLoader.java',
+    'home/HomeConfigMemBackend.java',
     'home/HomeFragment.java',
     'home/HomeListView.java',
     'home/HomePager.java',
     'home/HomePagerTabStrip.java',
     'home/LastTabsPage.java',
+    'home/ListPage.java',
     'home/MostRecentPage.java',
     'home/MultiTypeCursorAdapter.java',
     'home/PinSiteDialog.java',

From 2430f71df6b93e17580319f380181c9f81d2d26d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Thu, 12 Dec 2013 12:38:34 +0100
Subject: [PATCH 140/459] Backed out changeset 9f7da731bf06 (CLOSED TREE)

---
 browser/components/sessionstore/src/SessionStore.jsm | 4 +---
 browser/modules/RecentWindow.jsm                     | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 20055129ae6c..8cd1649d111d 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -86,11 +86,9 @@ const BROWSER_EVENTS = [
 // The number of milliseconds in a day
 const MS_PER_DAY = 1000.0 * 60.0 * 60.0 * 24.0;
 
-#ifdef XP_UNIX 
-#ifndef XP_MACOSX
+#ifndef XP_WIN
 #define BROKEN_WM_Z_ORDER
 #endif
-#endif 
 
 Cu.import("resource://gre/modules/Services.jsm", this);
 Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
diff --git a/browser/modules/RecentWindow.jsm b/browser/modules/RecentWindow.jsm
index c328b6e44d50..0018b502c70e 100644
--- a/browser/modules/RecentWindow.jsm
+++ b/browser/modules/RecentWindow.jsm
@@ -11,11 +11,9 @@ const Cu = Components.utils;
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/PrivateBrowsingUtils.jsm");
 
-#ifdef XP_UNIX
-#ifndef XP_MACOSX
+#ifndef XP_WIN
 #define BROKEN_WM_Z_ORDER
 #endif
-#endif
 
 this.RecentWindow = {
   /*

From 56e72953a6d338b0956f66061e540322d93423c0 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Thu, 12 Dec 2013 12:44:11 +0100
Subject: [PATCH 141/459] Backed out changeset 64376a7a08df (bug 942231) for
 Android Bustage on a CLOSED TREE

---
 mobile/android/base/BrowserApp.java           |  14 +-
 mobile/android/base/Tab.java                  |   5 +-
 mobile/android/base/home/HomeAdapter.java     | 144 ++++-------
 mobile/android/base/home/HomeConfig.java      | 224 ------------------
 .../android/base/home/HomeConfigLoader.java   |  83 -------
 .../base/home/HomeConfigMemBackend.java       |  67 ------
 mobile/android/base/home/HomePager.java       | 156 +++---------
 mobile/android/base/home/ListPage.java        | 185 ---------------
 mobile/android/base/moz.build                 |   4 -
 9 files changed, 87 insertions(+), 795 deletions(-)
 delete mode 100644 mobile/android/base/home/HomeConfig.java
 delete mode 100644 mobile/android/base/home/HomeConfigLoader.java
 delete mode 100644 mobile/android/base/home/HomeConfigMemBackend.java
 delete mode 100644 mobile/android/base/home/ListPage.java

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 3fcfa90c5427..87d29f055f6b 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1467,7 +1467,7 @@ abstract public class BrowserApp extends GeckoApp
         animator.setUseHardwareLayer(false);
 
         mBrowserToolbar.startEditing(url, animator);
-        showHomePagerWithAnimator(animator);
+        showHomePagerWithAnimator(HomePager.Page.TOP_SITES, animator);
 
         animator.start();
     }
@@ -1623,7 +1623,7 @@ abstract public class BrowserApp extends GeckoApp
         super.onLocaleReady(locale);
         if (mHomePager != null) {
             // Blow it away and rebuild it with the right strings.
-            mHomePager.redisplay(getSupportLoaderManager(), getSupportFragmentManager());
+            mHomePager.redisplay(getSupportFragmentManager());
         }
 
         if (mMenu != null) {
@@ -1636,12 +1636,6 @@ abstract public class BrowserApp extends GeckoApp
         showHomePagerWithAnimator(page, null);
     }
 
-    private void showHomePagerWithAnimator(PropertyAnimator animator) {
-        // Passing null here means the default page will be defined
-        // by the HomePager's configuration.
-        showHomePagerWithAnimator(null, animator);
-    }
-
     private void showHomePagerWithAnimator(HomePager.Page page, PropertyAnimator animator) {
         if (isHomePagerVisible()) {
             return;
@@ -1661,9 +1655,7 @@ abstract public class BrowserApp extends GeckoApp
             mHomePager = (HomePager) homePagerStub.inflate();
         }
 
-        mHomePager.show(getSupportLoaderManager(),
-                        getSupportFragmentManager(),
-                        page, animator);
+        mHomePager.show(getSupportFragmentManager(), page, animator);
 
         // Hide the web content so it cannot be focused by screen readers.
         hideWebContentOnPropertyAnimationEnd(animator);
diff --git a/mobile/android/base/Tab.java b/mobile/android/base/Tab.java
index 0f1a02d10a7c..09171f428372 100644
--- a/mobile/android/base/Tab.java
+++ b/mobile/android/base/Tab.java
@@ -95,7 +95,7 @@ public class Tab {
         mUserSearch = "";
         mExternal = external;
         mParentId = parentId;
-        mAboutHomePage = null;
+        mAboutHomePage = HomePager.Page.TOP_SITES;
         mTitle = title == null ? "" : title;
         mFavicon = null;
         mFaviconUrl = null;
@@ -155,6 +155,7 @@ public class Tab {
         mAboutHomePage = page;
     }
 
+
     // may be null if user-entered query hasn't yet been resolved to a URI
     public synchronized String getURL() {
         return mUrl;
@@ -659,8 +660,6 @@ public class Tab {
         final String homePage = message.getString("aboutHomePage");
         if (!TextUtils.isEmpty(homePage)) {
             setAboutHomePage(HomePager.Page.valueOf(homePage));
-        } else {
-            setAboutHomePage(null);
         }
 
         Tabs.getInstance().notifyListeners(this, Tabs.TabEvents.LOCATION_CHANGE, oldUrl);
diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
index 7cbdc06283a2..2d424face292 100644
--- a/mobile/android/base/home/HomeAdapter.java
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -5,8 +5,6 @@
 
 package org.mozilla.gecko.home;
 
-import org.mozilla.gecko.home.HomeConfig.PageEntry;
-import org.mozilla.gecko.home.HomeConfig.PageType;
 import org.mozilla.gecko.home.HomePager;
 import org.mozilla.gecko.home.HomePager.Page;
 
@@ -18,16 +16,13 @@ import android.support.v4.app.FragmentStatePagerAdapter;
 import android.view.ViewGroup;
 
 import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
+import java.util.EnumMap;
 
 class HomeAdapter extends FragmentStatePagerAdapter {
 
     private final Context mContext;
     private final ArrayList<PageInfo> mPageInfos;
-    private final HashMap<String, Fragment> mPages;
-
-    private boolean mCanLoadHint;
+    private final EnumMap<Page, Fragment> mPages;
 
     private OnAddPageListener mAddPageListener;
 
@@ -35,14 +30,27 @@ class HomeAdapter extends FragmentStatePagerAdapter {
         public void onAddPage(String title);
     }
 
+    final class PageInfo {
+        private final Page page;
+        private final Class<?> clss;
+        private final Bundle args;
+        private final String title;
+
+        PageInfo(Page page, Class<?> clss, Bundle args, String title) {
+            this.page = page;
+            this.clss = clss;
+            this.args = args;
+            this.title = title;
+        }
+    }
+
     public HomeAdapter(Context context, FragmentManager fm) {
         super(fm);
 
         mContext = context;
-        mCanLoadHint = HomeFragment.DEFAULT_CAN_LOAD_HINT;
 
         mPageInfos = new ArrayList<PageInfo>();
-        mPages = new HashMap<String, Fragment>();
+        mPages = new EnumMap<Page, Fragment>(Page.class);
     }
 
     @Override
@@ -53,23 +61,19 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public Fragment getItem(int position) {
         PageInfo info = mPageInfos.get(position);
-        return Fragment.instantiate(mContext, info.getClassName(), info.getArgs());
+        return Fragment.instantiate(mContext, info.clss.getName(), info.args);
     }
 
     @Override
     public CharSequence getPageTitle(int position) {
-        if (mPageInfos.size() > 0) {
-            PageInfo info = mPageInfos.get(position);
-            return info.getTitle().toUpperCase();
-        }
-
-        return null;
+        PageInfo info = mPageInfos.get(position);
+        return info.title.toUpperCase();
     }
 
     @Override
     public Object instantiateItem(ViewGroup container, int position) {
         Fragment fragment = (Fragment) super.instantiateItem(container, position);
-        mPages.put(mPageInfos.get(position).getId(), fragment);
+        mPages.put(mPageInfos.get(position).page, fragment);
 
         return fragment;
     }
@@ -77,17 +81,37 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public void destroyItem(ViewGroup container, int position, Object object) {
         super.destroyItem(container, position, object);
-        mPages.remove(mPageInfos.get(position).getId());
+        mPages.remove(mPageInfos.get(position).page);
     }
 
     public void setOnAddPageListener(OnAddPageListener listener) {
         mAddPageListener = listener;
     }
 
+    public void addPage(Page page, Class<?> clss, Bundle args, String title) {
+        addPage(-1, page, clss, args, title);
+    }
+
+    public void addPage(int index, Page page, Class<?> clss, Bundle args, String title) {
+        PageInfo info = new PageInfo(page, clss, args, title);
+
+        if (index >= 0) {
+            mPageInfos.add(index, info);
+        } else {
+            mPageInfos.add(info);
+        }
+
+        notifyDataSetChanged();
+
+        if (mAddPageListener != null) {
+            mAddPageListener.onAddPage(title);
+        }
+    }
+
     public int getItemPosition(Page page) {
         for (int i = 0; i < mPageInfos.size(); i++) {
-            final Page infoPage = mPageInfos.get(i).toPage();
-            if (infoPage == page) {
+            PageInfo info = mPageInfos.get(i);
+            if (info.page == page) {
                 return i;
             }
         }
@@ -97,39 +121,14 @@ class HomeAdapter extends FragmentStatePagerAdapter {
 
     public Page getPageAtPosition(int position) {
         PageInfo info = mPageInfos.get(position);
-        return info.toPage();
-    }
-
-    private void addPage(PageInfo info) {
-        mPageInfos.add(info);
-
-        if (mAddPageListener != null) {
-            mAddPageListener.onAddPage(info.getTitle());
-        }
-    }
-
-    public void update(List<PageEntry> pageEntries) {
-        mPages.clear();
-        mPageInfos.clear();
-
-        if (pageEntries != null) {
-            for (PageEntry pageEntry : pageEntries) {
-                final PageInfo info = new PageInfo(pageEntry);
-                addPage(info);
-            }
-        }
-
-        notifyDataSetChanged();
-    }
-
-    public boolean getCanLoadHint() {
-        return mCanLoadHint;
+        return info.page;
     }
 
     public void setCanLoadHint(boolean canLoadHint) {
-        // We cache the last hint value so that we can use it when
-        // creating new pages. See PageInfo.getArgs().
-        mCanLoadHint = canLoadHint;
+        // Update fragment arguments for future instances
+        for (PageInfo info : mPageInfos) {
+            info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
+        }
 
         // Enable/disable loading on all existing pages
         for (Fragment page : mPages.values()) {
@@ -137,49 +136,4 @@ class HomeAdapter extends FragmentStatePagerAdapter {
             homePage.setCanLoadHint(canLoadHint);
         }
     }
-
-    private final class PageInfo {
-        private final String mId;
-        private final PageEntry mPageEntry;
-
-        PageInfo(PageEntry pageEntry) {
-            mId = pageEntry.getType() + "-" + pageEntry.getId();
-            mPageEntry = pageEntry;
-        }
-
-        public String getId() {
-            return mId;
-        }
-
-        public String getTitle() {
-            return mPageEntry.getTitle();
-        }
-
-        public String getClassName() {
-            final PageType type = mPageEntry.getType();
-            return type.getPageClass().getName();
-        }
-
-        public Bundle getArgs() {
-            final Bundle args = new Bundle();
-
-            args.putBoolean(HomePager.CAN_LOAD_ARG, mCanLoadHint);
-
-            // Only list pages need the page entry
-            if (mPageEntry.getType() == PageType.LIST) {
-                args.putParcelable(HomePager.PAGE_ENTRY_ARG, mPageEntry);
-            }
-
-            return args;
-        }
-
-        public Page toPage() {
-            final PageType type = mPageEntry.getType();
-            if (type == PageType.LIST) {
-                return null;
-            }
-
-            return Page.valueOf(type);
-        }
-    }
 }
diff --git a/mobile/android/base/home/HomeConfig.java b/mobile/android/base/home/HomeConfig.java
deleted file mode 100644
index 636fd617f7d8..000000000000
--- a/mobile/android/base/home/HomeConfig.java
+++ /dev/null
@@ -1,224 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.home;
-
-import org.mozilla.gecko.home.HomePager.Page;
-
-import android.content.Context;
-import android.os.Parcel;
-import android.os.Parcelable;
-import android.text.TextUtils;
-
-import java.util.EnumSet;
-import java.util.List;
-
-final class HomeConfig {
-    public static enum PageType implements Parcelable {
-        TOP_SITES("top_sites", TopSitesPage.class),
-        BOOKMARKS("bookmarks", BookmarksPage.class),
-        HISTORY("history", HistoryPage.class),
-        READING_LIST("reading_list", ReadingListPage.class),
-        LIST("list", ListPage.class);
-
-        private final String mId;
-        private final Class<?> mPageClass;
-
-        PageType(String id, Class<?> pageClass) {
-            mId = id;
-            mPageClass = pageClass;
-        }
-
-        public static PageType valueOf(Page page) {
-            switch(page) {
-                case TOP_SITES:
-                    return PageType.TOP_SITES;
-
-                case BOOKMARKS:
-                    return PageType.BOOKMARKS;
-
-                case HISTORY:
-                    return PageType.HISTORY;
-
-                case READING_LIST:
-                    return PageType.READING_LIST;
-
-                default:
-                    throw new IllegalArgumentException("Could not convert unrecognized Page");
-            }
-        }
-
-        public static PageType fromId(String id) {
-            if (id == null) {
-                throw new IllegalArgumentException("Could not convert null String to PageType");
-            }
-
-            for (PageType page : PageType.values()) {
-                if (TextUtils.equals(page.mId, id.toLowerCase())) {
-                    return page;
-                }
-            }
-
-            throw new IllegalArgumentException("Could not convert String id to PageType");
-        }
-
-        @Override
-        public String toString() {
-            return mId;
-        }
-
-        public Class<?> getPageClass() {
-            return mPageClass;
-        }
-
-        @Override
-        public int describeContents() {
-            return 0;
-        }
-
-        @Override
-        public void writeToParcel(Parcel dest, int flags) {
-            dest.writeInt(ordinal());
-        }
-
-        public static final Creator<PageType> CREATOR = new Creator<PageType>() {
-            @Override
-            public PageType createFromParcel(final Parcel source) {
-                return PageType.values()[source.readInt()];
-            }
-
-            @Override
-            public PageType[] newArray(final int size) {
-                return new PageType[size];
-            }
-        };
-    }
-
-    public static class PageEntry implements Parcelable {
-        private final PageType mType;
-        private final String mTitle;
-        private final String mId;
-        private final EnumSet<Flags> mFlags;
-
-        public enum Flags {
-            DEFAULT_PAGE
-        }
-
-        @SuppressWarnings("unchecked")
-        public PageEntry(Parcel in) {
-            mType = (PageType) in.readParcelable(getClass().getClassLoader());
-            mTitle = in.readString();
-            mId = in.readString();
-            mFlags = (EnumSet<Flags>) in.readSerializable();
-        }
-
-        public PageEntry(PageType type, String title) {
-            this(type, title, EnumSet.noneOf(Flags.class));
-        }
-
-        public PageEntry(PageType type, String title, EnumSet<Flags> flags) {
-            this(type, title, type.toString(), flags);
-        }
-
-        public PageEntry(PageType type, String title, String id) {
-            this(type, title, id, EnumSet.noneOf(Flags.class));
-        }
-
-        public PageEntry(PageType type, String title, String id, EnumSet<Flags> flags) {
-            if (type == null) {
-                throw new IllegalArgumentException("Can't create PageEntry with null type");
-            }
-            mType = type;
-
-            if (title == null) {
-                throw new IllegalArgumentException("Can't create PageEntry with null title");
-            }
-            mTitle = title;
-
-            if (id == null) {
-                throw new IllegalArgumentException("Can't create PageEntry with null id");
-            }
-            mId = id;
-
-            if (flags == null) {
-                throw new IllegalArgumentException("Can't create PageEntry with null flags");
-            }
-            mFlags = flags;
-        }
-
-        public PageType getType() {
-            return mType;
-        }
-
-        public String getTitle() {
-            return mTitle;
-        }
-
-        public String getId() {
-            return mId;
-        }
-
-        public boolean isDefault() {
-            return mFlags.contains(Flags.DEFAULT_PAGE);
-        }
-
-        @Override
-        public int describeContents() {
-            return 0;
-        }
-
-        @Override
-        public void writeToParcel(Parcel dest, int flags) {
-            dest.writeParcelable(mType, 0);
-            dest.writeString(mTitle);
-            dest.writeString(mId);
-            dest.writeSerializable(mFlags);
-        }
-
-        public static final Creator<PageEntry> CREATOR = new Creator<PageEntry>() {
-            @Override
-            public PageEntry createFromParcel(final Parcel in) {
-                return new PageEntry(in);
-            }
-
-            @Override
-            public PageEntry[] newArray(final int size) {
-                return new PageEntry[size];
-            }
-        };
-    }
-
-    public interface OnChangeListener {
-        public void onChange();
-    }
-
-    public interface HomeConfigBackend {
-        public List<PageEntry> load();
-        public void save(List<PageEntry> entries);
-        public void setOnChangeListener(OnChangeListener listener);
-    }
-
-    private final HomeConfigBackend mBackend;
-
-    public HomeConfig(HomeConfigBackend backend) {
-        mBackend = backend;
-    }
-
-    public List<PageEntry> load() {
-        return mBackend.load();
-    }
-
-    public void save(List<PageEntry> entries) {
-        mBackend.save(entries);
-    }
-
-    public void setOnChangeListener(OnChangeListener listener) {
-        mBackend.setOnChangeListener(listener);
-    }
-
-    public static HomeConfig getDefault(Context context) {
-        return new HomeConfig(new HomeConfigMemBackend(context));
-    }
-}
\ No newline at end of file
diff --git a/mobile/android/base/home/HomeConfigLoader.java b/mobile/android/base/home/HomeConfigLoader.java
deleted file mode 100644
index df27c8c7e961..000000000000
--- a/mobile/android/base/home/HomeConfigLoader.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.home;
-
-import org.mozilla.gecko.home.HomeConfig.PageEntry;
-import org.mozilla.gecko.home.HomeConfig.OnChangeListener;
-
-import android.content.Context;
-import android.support.v4.content.AsyncTaskLoader;
-
-import java.util.List;
-
-public class HomeConfigLoader extends AsyncTaskLoader<List<PageEntry>> {
-    private final HomeConfig mConfig;
-    private List<PageEntry> mPageEntries;
-
-    public HomeConfigLoader(Context context, HomeConfig homeConfig) {
-        super(context);
-        mConfig = homeConfig;
-    }
-
-    @Override
-    public List<PageEntry> loadInBackground() {
-        return mConfig.load();
-    }
-
-    @Override
-    public void deliverResult(List<PageEntry> pageEntries) {
-        if (isReset()) {
-            mPageEntries = null;
-            return;
-        }
-
-        mPageEntries = pageEntries;
-        mConfig.setOnChangeListener(new ForceLoadChangeListener());
-
-        if (isStarted()) {
-            super.deliverResult(pageEntries);
-        }
-    }
-
-    @Override
-    protected void onStartLoading() {
-        if (mPageEntries != null) {
-            deliverResult(mPageEntries);
-        }
-
-        if (takeContentChanged() || mPageEntries == null) {
-            forceLoad();
-        }
-    }
-
-    @Override
-    protected void onStopLoading() {
-        cancelLoad();
-    }
-
-    @Override
-    public void onCanceled(List<PageEntry> pageEntries) {
-        mPageEntries = null;
-    }
-
-    @Override
-    protected void onReset() {
-        super.onReset();
-
-        // Ensure the loader is stopped.
-        onStopLoading();
-
-        mPageEntries = null;
-        mConfig.setOnChangeListener(null);
-    }
-
-    private class ForceLoadChangeListener implements OnChangeListener {
-        @Override
-        public void onChange() {
-            onContentChanged();
-        }
-    }
-}
diff --git a/mobile/android/base/home/HomeConfigMemBackend.java b/mobile/android/base/home/HomeConfigMemBackend.java
deleted file mode 100644
index 03d038b1f2c5..000000000000
--- a/mobile/android/base/home/HomeConfigMemBackend.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.home;
-
-import org.mozilla.gecko.R;
-import org.mozilla.gecko.home.HomeConfig.HomeConfigBackend;
-import org.mozilla.gecko.home.HomeConfig.OnChangeListener;
-import org.mozilla.gecko.home.HomeConfig.PageEntry;
-import org.mozilla.gecko.home.HomeConfig.PageType;
-import org.mozilla.gecko.util.HardwareUtils;
-
-import android.content.Context;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.EnumSet;
-import java.util.List;
-
-class HomeConfigMemBackend implements HomeConfigBackend {
-    private final Context mContext;
-
-    public HomeConfigMemBackend(Context context) {
-        mContext = context;
-    }
-
-    public List<PageEntry> load() {
-        final ArrayList<PageEntry> pageEntries = new ArrayList<PageEntry>();
-
-        pageEntries.add(new PageEntry(PageType.TOP_SITES,
-                                      mContext.getString(R.string.home_top_sites_title),
-                                      EnumSet.of(PageEntry.Flags.DEFAULT_PAGE)));
-
-        pageEntries.add(new PageEntry(PageType.BOOKMARKS,
-                                      mContext.getString(R.string.bookmarks_title)));
-
-        // We disable reader mode support on low memory devices. Hence the
-        // reading list page should not show up on such devices.
-        if (!HardwareUtils.isLowMemoryPlatform()) {
-            pageEntries.add(new PageEntry(PageType.READING_LIST,
-                                          mContext.getString(R.string.reading_list_title)));
-        }
-
-        final PageEntry historyEntry = new PageEntry(PageType.HISTORY,
-                                                     mContext.getString(R.string.home_history_title));
-
-        // On tablets, the history page is the last.
-        // On phones, the history page is the first one.
-        if (HardwareUtils.isTablet()) {
-            pageEntries.add(historyEntry);
-        } else {
-            pageEntries.add(0, historyEntry);
-        }
-
-        return Collections.unmodifiableList(pageEntries);
-    }
-
-    public void save(List<PageEntry> entries) {
-        // This is a static backend, do nothing.
-    }
-
-    public void setOnChangeListener(OnChangeListener listener) {
-        // This is a static backend, do nothing.
-    }
-}
\ No newline at end of file
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 3849bf4aa38d..66253b1be0f6 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -9,8 +9,6 @@ import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
 import org.mozilla.gecko.home.HomeAdapter.OnAddPageListener;
-import org.mozilla.gecko.home.HomeConfig.PageEntry;
-import org.mozilla.gecko.home.HomeConfig.PageType;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -19,9 +17,6 @@ import android.os.Build;
 import android.os.Bundle;
 import android.support.v4.app.Fragment;
 import android.support.v4.app.FragmentManager;
-import android.support.v4.app.LoaderManager;
-import android.support.v4.app.LoaderManager.LoaderCallbacks;
-import android.support.v4.content.Loader;
 import android.support.v4.view.ViewPager;
 import android.view.ViewGroup.LayoutParams;
 import android.util.AttributeSet;
@@ -30,50 +25,22 @@ import android.view.ViewGroup;
 import android.view.View;
 
 import java.util.EnumSet;
-import java.util.List;
 
 public class HomePager extends ViewPager {
 
-    private static final int LOADER_ID_CONFIG = 0;
-
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;
-    private View mTabStrip;
 
     private final OnAddPageListener mAddPageListener;
 
-    private final HomeConfig mConfig;
-    private ConfigLoaderCallbacks mConfigLoaderCallbacks;
-
-    private Page mInitialPage;
-
     // List of pages in order.
     @RobocopTarget
     public enum Page {
         HISTORY,
         TOP_SITES,
         BOOKMARKS,
-        READING_LIST;
-
-        static Page valueOf(PageType page) {
-            switch(page) {
-                case TOP_SITES:
-                    return Page.TOP_SITES;
-
-                case BOOKMARKS:
-                    return Page.BOOKMARKS;
-
-                case HISTORY:
-                    return Page.HISTORY;
-
-                case READING_LIST:
-                    return Page.READING_LIST;
-
-                default:
-                    throw new IllegalArgumentException("Could not convert unrecognized PageType");
-            }
-        }
+        READING_LIST
     }
 
     // This is mostly used by UI tests to easily fetch
@@ -114,7 +81,6 @@ public class HomePager extends ViewPager {
     }
 
     static final String CAN_LOAD_ARG = "canLoad";
-    static final String PAGE_ENTRY_ARG = "pageEntry";
 
     public HomePager(Context context) {
         this(context, null);
@@ -124,9 +90,6 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
-        mConfig = HomeConfig.getDefault(mContext);
-        mConfigLoaderCallbacks = new ConfigLoaderCallbacks();
-
         mAddPageListener = new OnAddPageListener() {
             @Override
             public void onAddPage(String title) {
@@ -153,7 +116,6 @@ public class HomePager extends ViewPager {
         if (child instanceof Decor) {
             ((ViewPager.LayoutParams) params).isDecor = true;
             mDecor = (Decor) child;
-            mTabStrip = child;
 
             mDecor.setOnTitleClickListener(new OnTitleClickListener() {
                 @Override
@@ -176,18 +138,16 @@ public class HomePager extends ViewPager {
                 @Override
                 public void onPageScrollStateChanged(int state) { }
             });
-        } else if (child instanceof HomePagerTabStrip) {
-            mTabStrip = child;
         }
 
         super.addView(child, index, params);
     }
 
-    public void redisplay(LoaderManager lm, FragmentManager fm) {
+    public void redisplay(FragmentManager fm) {
         final HomeAdapter adapter = (HomeAdapter) getAdapter();
+        final Page currentPage = adapter.getPageAtPosition(getCurrentItem());
 
-        Page currentPage = adapter.getPageAtPosition(getCurrentItem());
-        show(lm, fm, currentPage, null);
+        show(fm, currentPage, null);
     }
 
     /**
@@ -195,28 +155,43 @@ public class HomePager extends ViewPager {
      *
      * @param fm FragmentManager for the adapter
      */
-    public void show(LoaderManager lm, FragmentManager fm, Page page, PropertyAnimator animator) {
+    public void show(FragmentManager fm, Page page, PropertyAnimator animator) {
         mLoaded = true;
-        mInitialPage = page;
+
+        if (mDecor != null) {
+            mDecor.removeAllPagerViews();
+        }
+
+        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
+        adapter.setOnAddPageListener(mAddPageListener);
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
 
-        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
-        adapter.setOnAddPageListener(mAddPageListener);
-        adapter.setCanLoadHint(!shouldAnimate);
-        setAdapter(adapter);
+        adapter.addPage(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
+                getContext().getString(R.string.home_top_sites_title));
+        adapter.addPage(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
+                getContext().getString(R.string.bookmarks_title));
 
-        setVisibility(VISIBLE);
-
-        // Don't show the tabs strip until we have the
-        // list of pages in place.
-        if (mTabStrip != null) {
-            mTabStrip.setVisibility(View.INVISIBLE);
+        // We disable reader mode support on low memory devices. Hence the
+        // reading list page should not show up on such devices.
+        if (!HardwareUtils.isLowMemoryPlatform()) {
+            adapter.addPage(Page.READING_LIST, ReadingListPage.class, new Bundle(),
+                    getContext().getString(R.string.reading_list_title));
         }
 
-        // Load list of pages from configuration
-        lm.initLoader(LOADER_ID_CONFIG, null, mConfigLoaderCallbacks);
+        // On phones, the history page is the first one. On tablets, the
+        // history page is the last.
+        adapter.addPage(HardwareUtils.isTablet() ? -1 : 0,
+                Page.HISTORY, HistoryPage.class, new Bundle(),
+                getContext().getString(R.string.home_history_title));
+
+        adapter.setCanLoadHint(!shouldAnimate);
+
+        setAdapter(adapter);
+
+        setCurrentItem(adapter.getItemPosition(page), false);
+        setVisibility(VISIBLE);
 
         if (shouldAnimate) {
             animator.addPropertyAnimationListener(new PropertyAnimator.PropertyAnimationListener() {
@@ -279,69 +254,4 @@ public class HomePager extends ViewPager {
 
         return super.onInterceptTouchEvent(event);
     }
-
-    private void updateUiFromPageEntries(List<PageEntry> pageEntries) {
-        // We only care about the adapter if HomePager is currently
-        // loaded, which means it's visible in the activity.
-        if (!mLoaded) {
-            return;
-        }
-
-        if (mDecor != null) {
-            mDecor.removeAllPagerViews();
-        }
-
-        final HomeAdapter adapter = (HomeAdapter) getAdapter();
-
-        // Disable loading until the final current item is defined
-        // after loading the page entries. This is to stop any temporary
-        // active item from loading.
-        boolean originalCanLoadHint = adapter.getCanLoadHint();
-        adapter.setCanLoadHint(false);
-
-        // Update the adapter with the new page entries
-        adapter.update(pageEntries);
-
-        final int count = (pageEntries != null ? pageEntries.size() : 0);
-
-        if (mTabStrip != null) {
-            mTabStrip.setVisibility(count > 0 ? View.VISIBLE : View.INVISIBLE);
-        }
-
-        // Use the default page as defined in the HomePager's configuration
-        // if the initial page wasn't explicitly set by the show() caller.
-        if (mInitialPage != null) {
-            setCurrentItem(adapter.getItemPosition(mInitialPage), false);
-            mInitialPage = null;
-        } else {
-            for (int i = 0; i < count; i++) {
-                final PageEntry pageEntry = pageEntries.get(i);
-                if (pageEntry.isDefault()) {
-                    setCurrentItem(i, false);
-                    break;
-                }
-            }
-        }
-
-        // Restore canLoadHint now that we have the final
-        // state in HomePager.
-        adapter.setCanLoadHint(originalCanLoadHint);
-    }
-
-    private class ConfigLoaderCallbacks implements LoaderCallbacks<List<PageEntry>> {
-        @Override
-        public Loader<List<PageEntry>> onCreateLoader(int id, Bundle args) {
-            return new HomeConfigLoader(mContext, mConfig);
-        }
-
-        @Override
-        public void onLoadFinished(Loader<List<PageEntry>> loader, List<PageEntry> pageEntries) {
-            updateUiFromPageEntries(pageEntries);
-        }
-
-        @Override
-        public void onLoaderReset(Loader<List<PageEntry>> loader) {
-            updateUiFromPageEntries(null);
-        }
-    }
 }
diff --git a/mobile/android/base/home/ListPage.java b/mobile/android/base/home/ListPage.java
deleted file mode 100644
index f3c911095b84..000000000000
--- a/mobile/android/base/home/ListPage.java
+++ /dev/null
@@ -1,185 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.home;
-
-import org.mozilla.gecko.R;
-import org.mozilla.gecko.home.HomePager.OnUrlOpenListener;
-import org.mozilla.gecko.home.HomeConfig.PageEntry;
-
-import android.app.Activity;
-import android.content.Context;
-import android.content.res.Configuration;
-import android.database.Cursor;
-import android.os.Bundle;
-import android.support.v4.app.LoaderManager.LoaderCallbacks;
-import android.support.v4.content.Loader;
-import android.support.v4.widget.CursorAdapter;
-import android.view.LayoutInflater;
-import android.view.View;
-import android.view.ViewGroup;
-import android.widget.ListView;
-
-import java.util.EnumSet;
-
-/**
- * Fragment that displays custom lists.
- */
-public class ListPage extends HomeFragment {
-    // Cursor loader ID for the lists
-    private static final int LOADER_ID_LIST = 0;
-
-    // The page entry associated with this page
-    private PageEntry mPageEntry;
-
-    // Adapter for the list
-    private HomeListAdapter mAdapter;
-
-    // The view shown by the fragment
-    private ListView mList;
-
-    // Callbacks used for the list loader
-    private CursorLoaderCallbacks mCursorLoaderCallbacks;
-
-    // On URL open listener
-    private OnUrlOpenListener mUrlOpenListener;
-
-    @Override
-    public void onAttach(Activity activity) {
-        super.onAttach(activity);
-
-        try {
-            mUrlOpenListener = (OnUrlOpenListener) activity;
-        } catch (ClassCastException e) {
-            throw new ClassCastException(activity.toString()
-                    + " must implement HomePager.OnUrlOpenListener");
-        }
-    }
-
-    @Override
-    public void onDetach() {
-        super.onDetach();
-
-        mUrlOpenListener = null;
-    }
-
-    @Override
-    public void onCreate(Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-
-        final Bundle args = getArguments();
-        if (args != null) {
-            mPageEntry = (PageEntry) args.getParcelable(HomePager.PAGE_ENTRY_ARG);
-        }
-
-        if (mPageEntry == null) {
-            throw new IllegalStateException("Can't create a ListPage without a PageEntry");
-        }
-    }
-
-    @Override
-    public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
-        mList = new HomeListView(getActivity());
-        return mList;
-    }
-
-    @Override
-    public void onViewCreated(View view, Bundle savedInstanceState) {
-        super.onViewCreated(view, savedInstanceState);
-
-        registerForContextMenu(mList);
-    }
-
-    @Override
-    public void onDestroyView() {
-        super.onDestroyView();
-        mList = null;
-    }
-
-    @Override
-    public void onConfigurationChanged(Configuration newConfig) {
-        super.onConfigurationChanged(newConfig);
-
-        // Detach and reattach the fragment as the layout changes.
-        if (isVisible()) {
-            getFragmentManager().beginTransaction()
-                                .detach(this)
-                                .attach(this)
-                                .commitAllowingStateLoss();
-        }
-    }
-
-    @Override
-    public void onActivityCreated(Bundle savedInstanceState) {
-        super.onActivityCreated(savedInstanceState);
-
-        mAdapter = new HomeListAdapter(getActivity(), null);
-        mList.setAdapter(mAdapter);
-
-        // Create callbacks before the initial loader is started.
-        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
-        loadIfVisible();
-    }
-
-    @Override
-    protected void load() {
-        getLoaderManager().initLoader(LOADER_ID_LIST, null, mCursorLoaderCallbacks);
-    }
-
-    /**
-     * Cursor loader for the lists.
-     */
-    private static class HomeListLoader extends SimpleCursorLoader {
-        public HomeListLoader(Context context) {
-            super(context);
-        }
-
-        @Override
-        public Cursor loadCursor() {
-            // Do nothing
-            return null;
-        }
-    }
-
-    /**
-     * Cursor adapter for the list.
-     */
-    private class HomeListAdapter extends CursorAdapter {
-        public HomeListAdapter(Context context, Cursor cursor) {
-            super(context, cursor, 0);
-        }
-
-        @Override
-        public void bindView(View view, Context context, Cursor cursor) {
-            final TwoLinePageRow row = (TwoLinePageRow) view;
-            row.updateFromCursor(cursor);
-        }
-
-        @Override
-        public View newView(Context context, Cursor cursor, ViewGroup parent) {
-            return LayoutInflater.from(parent.getContext()).inflate(R.layout.bookmark_item_row, parent, false);
-        }
-    }
-
-    /**
-     * LoaderCallbacks implementation that interacts with the LoaderManager.
-     */
-    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
-        @Override
-        public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-            return new HomeListLoader(getActivity());
-        }
-
-        @Override
-        public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-            mAdapter.swapCursor(c);
-        }
-
-        @Override
-        public void onLoaderReset(Loader<Cursor> loader) {
-            mAdapter.swapCursor(null);
-        }
-    }
-}
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 2bb5769946ea..476cb6c4855d 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -210,15 +210,11 @@ gbjar.sources += [
     'home/HistoryPage.java',
     'home/HomeAdapter.java',
     'home/HomeBanner.java',
-    'home/HomeConfig.java',
-    'home/HomeConfigLoader.java',
-    'home/HomeConfigMemBackend.java',
     'home/HomeFragment.java',
     'home/HomeListView.java',
     'home/HomePager.java',
     'home/HomePagerTabStrip.java',
     'home/LastTabsPage.java',
-    'home/ListPage.java',
     'home/MostRecentPage.java',
     'home/MultiTypeCursorAdapter.java',
     'home/PinSiteDialog.java',

From 496ef3f0bd299b827716e3fd6326846474c46ced Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Thu, 12 Dec 2013 12:44:23 +0100
Subject: [PATCH 142/459] Backed out changeset 7744ed51864c (bug 942231) for
 Android Bustage on a CLOSED TREE

---
 mobile/android/base/home/HomeFragment.java | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/mobile/android/base/home/HomeFragment.java b/mobile/android/base/home/HomeFragment.java
index 45e1ee26f015..48b976ba74fa 100644
--- a/mobile/android/base/home/HomeFragment.java
+++ b/mobile/android/base/home/HomeFragment.java
@@ -44,9 +44,6 @@ abstract class HomeFragment extends Fragment {
     // Share MIME type.
     private static final String SHARE_MIME_TYPE = "text/plain";
 
-    // Default value for "can load" hint
-    static final boolean DEFAULT_CAN_LOAD_HINT = false;
-
     // Whether the fragment can load its content or not
     // This is used to defer data loading until the editing
     // mode animation ends.
@@ -61,9 +58,9 @@ abstract class HomeFragment extends Fragment {
 
         final Bundle args = getArguments();
         if (args != null) {
-            mCanLoadHint = args.getBoolean(HomePager.CAN_LOAD_ARG, DEFAULT_CAN_LOAD_HINT);
+            mCanLoadHint = args.getBoolean(HomePager.CAN_LOAD_ARG, false);
         } else {
-            mCanLoadHint = DEFAULT_CAN_LOAD_HINT;
+            mCanLoadHint = false;
         }
 
         mIsLoaded = false;

From 17610f17b4d63c275e7036b828ae7e581eeb6146 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Thu, 12 Dec 2013 12:44:32 +0100
Subject: [PATCH 143/459] Backed out changeset c521a1683852 (bug 942231) for
 Android Bustage on a CLOSED TREE

---
 mobile/android/base/BrowserApp.java | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 87d29f055f6b..c6be146ff1cc 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1618,6 +1618,10 @@ abstract public class BrowserApp extends GeckoApp
         }
     }
 
+    private void showHomePager(HomePager.Page page) {
+        showHomePagerWithAnimator(page, null);
+    }
+
     @Override
     public void onLocaleReady(final String locale) {
         super.onLocaleReady(locale);
@@ -1632,10 +1636,6 @@ abstract public class BrowserApp extends GeckoApp
         }
     }
 
-    private void showHomePager(HomePager.Page page) {
-        showHomePagerWithAnimator(page, null);
-    }
-
     private void showHomePagerWithAnimator(HomePager.Page page, PropertyAnimator animator) {
         if (isHomePagerVisible()) {
             return;

From 3c90185a806ca7d2227b85d6f86a4e63b9da2373 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Thu, 12 Dec 2013 12:44:48 +0100
Subject: [PATCH 144/459] Backed out changeset f279d53c2d4d (bug 942231) for
 Android Bustage on a CLOSED TREE

---
 mobile/android/base/home/HomeAdapter.java | 52 +++++++++++------------
 mobile/android/base/home/HomePager.java   | 22 +++++-----
 2 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
index 2d424face292..caaab89a79b9 100644
--- a/mobile/android/base/home/HomeAdapter.java
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -21,22 +21,22 @@ import java.util.EnumMap;
 class HomeAdapter extends FragmentStatePagerAdapter {
 
     private final Context mContext;
-    private final ArrayList<PageInfo> mPageInfos;
+    private final ArrayList<TabInfo> mTabs;
     private final EnumMap<Page, Fragment> mPages;
 
-    private OnAddPageListener mAddPageListener;
+    private OnAddTabListener mAddTabListener;
 
-    interface OnAddPageListener {
-        public void onAddPage(String title);
+    interface OnAddTabListener {
+        public void onAddTab(String title);
     }
 
-    final class PageInfo {
+    final class TabInfo {
         private final Page page;
         private final Class<?> clss;
         private final Bundle args;
         private final String title;
 
-        PageInfo(Page page, Class<?> clss, Bundle args, String title) {
+        TabInfo(Page page, Class<?> clss, Bundle args, String title) {
             this.page = page;
             this.clss = clss;
             this.args = args;
@@ -49,31 +49,31 @@ class HomeAdapter extends FragmentStatePagerAdapter {
 
         mContext = context;
 
-        mPageInfos = new ArrayList<PageInfo>();
+        mTabs = new ArrayList<TabInfo>();
         mPages = new EnumMap<Page, Fragment>(Page.class);
     }
 
     @Override
     public int getCount() {
-        return mPageInfos.size();
+        return mTabs.size();
     }
 
     @Override
     public Fragment getItem(int position) {
-        PageInfo info = mPageInfos.get(position);
+        TabInfo info = mTabs.get(position);
         return Fragment.instantiate(mContext, info.clss.getName(), info.args);
     }
 
     @Override
     public CharSequence getPageTitle(int position) {
-        PageInfo info = mPageInfos.get(position);
+        TabInfo info = mTabs.get(position);
         return info.title.toUpperCase();
     }
 
     @Override
     public Object instantiateItem(ViewGroup container, int position) {
         Fragment fragment = (Fragment) super.instantiateItem(container, position);
-        mPages.put(mPageInfos.get(position).page, fragment);
+        mPages.put(mTabs.get(position).page, fragment);
 
         return fragment;
     }
@@ -81,36 +81,36 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public void destroyItem(ViewGroup container, int position, Object object) {
         super.destroyItem(container, position, object);
-        mPages.remove(mPageInfos.get(position).page);
+        mPages.remove(mTabs.get(position).page);
     }
 
-    public void setOnAddPageListener(OnAddPageListener listener) {
-        mAddPageListener = listener;
+    public void setOnAddTabListener(OnAddTabListener listener) {
+        mAddTabListener = listener;
     }
 
-    public void addPage(Page page, Class<?> clss, Bundle args, String title) {
-        addPage(-1, page, clss, args, title);
+    public void addTab(Page page, Class<?> clss, Bundle args, String title) {
+        addTab(-1, page, clss, args, title);
     }
 
-    public void addPage(int index, Page page, Class<?> clss, Bundle args, String title) {
-        PageInfo info = new PageInfo(page, clss, args, title);
+    public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
+        TabInfo info = new TabInfo(page, clss, args, title);
 
         if (index >= 0) {
-            mPageInfos.add(index, info);
+            mTabs.add(index, info);
         } else {
-            mPageInfos.add(info);
+            mTabs.add(info);
         }
 
         notifyDataSetChanged();
 
-        if (mAddPageListener != null) {
-            mAddPageListener.onAddPage(title);
+        if (mAddTabListener != null) {
+            mAddTabListener.onAddTab(title);
         }
     }
 
     public int getItemPosition(Page page) {
-        for (int i = 0; i < mPageInfos.size(); i++) {
-            PageInfo info = mPageInfos.get(i);
+        for (int i = 0; i < mTabs.size(); i++) {
+            TabInfo info = mTabs.get(i);
             if (info.page == page) {
                 return i;
             }
@@ -120,13 +120,13 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     }
 
     public Page getPageAtPosition(int position) {
-        PageInfo info = mPageInfos.get(position);
+        TabInfo info = mTabs.get(position);
         return info.page;
     }
 
     public void setCanLoadHint(boolean canLoadHint) {
         // Update fragment arguments for future instances
-        for (PageInfo info : mPageInfos) {
+        for (TabInfo info : mTabs) {
             info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
         }
 
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 66253b1be0f6..f1d42dd4aa69 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -8,7 +8,7 @@ package org.mozilla.gecko.home;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
-import org.mozilla.gecko.home.HomeAdapter.OnAddPageListener;
+import org.mozilla.gecko.home.HomeAdapter.OnAddTabListener;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -32,7 +32,7 @@ public class HomePager extends ViewPager {
     private volatile boolean mLoaded;
     private Decor mDecor;
 
-    private final OnAddPageListener mAddPageListener;
+    private final OnAddTabListener mAddTabListener;
 
     // List of pages in order.
     @RobocopTarget
@@ -90,9 +90,9 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
-        mAddPageListener = new OnAddPageListener() {
+        mAddTabListener = new OnAddTabListener() {
             @Override
-            public void onAddPage(String title) {
+            public void onAddTab(String title) {
                 if (mDecor != null) {
                     mDecor.onAddPagerView(title);
                 }
@@ -163,26 +163,26 @@ public class HomePager extends ViewPager {
         }
 
         final HomeAdapter adapter = new HomeAdapter(mContext, fm);
-        adapter.setOnAddPageListener(mAddPageListener);
+        adapter.setOnAddTabListener(mAddTabListener);
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
 
-        adapter.addPage(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
+        adapter.addTab(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
                 getContext().getString(R.string.home_top_sites_title));
-        adapter.addPage(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
+        adapter.addTab(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
                 getContext().getString(R.string.bookmarks_title));
 
         // We disable reader mode support on low memory devices. Hence the
         // reading list page should not show up on such devices.
         if (!HardwareUtils.isLowMemoryPlatform()) {
-            adapter.addPage(Page.READING_LIST, ReadingListPage.class, new Bundle(),
+            adapter.addTab(Page.READING_LIST, ReadingListPage.class, new Bundle(),
                     getContext().getString(R.string.reading_list_title));
         }
 
-        // On phones, the history page is the first one. On tablets, the
-        // history page is the last.
-        adapter.addPage(HardwareUtils.isTablet() ? -1 : 0,
+        // On phones, the history tab is the first tab. On tablets, the
+        // history tab is the last tab.
+        adapter.addTab(HardwareUtils.isTablet() ? -1 : 0,
                 Page.HISTORY, HistoryPage.class, new Bundle(),
                 getContext().getString(R.string.home_history_title));
 

From 248253386a14b0ba457bddfe22c40a0551ebde35 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Thu, 12 Dec 2013 12:44:58 +0100
Subject: [PATCH 145/459] Backed out changeset c4e1151b6a7e (bug 942231) for
 Android Bustage on a CLOSED TREE

---
 mobile/android/base/home/HomeAdapter.java | 139 -------------------
 mobile/android/base/home/HomePager.java   | 157 +++++++++++++++++-----
 mobile/android/base/moz.build             |   1 -
 3 files changed, 125 insertions(+), 172 deletions(-)
 delete mode 100644 mobile/android/base/home/HomeAdapter.java

diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
deleted file mode 100644
index caaab89a79b9..000000000000
--- a/mobile/android/base/home/HomeAdapter.java
+++ /dev/null
@@ -1,139 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.home;
-
-import org.mozilla.gecko.home.HomePager;
-import org.mozilla.gecko.home.HomePager.Page;
-
-import android.content.Context;
-import android.os.Bundle;
-import android.support.v4.app.Fragment;
-import android.support.v4.app.FragmentManager;
-import android.support.v4.app.FragmentStatePagerAdapter;
-import android.view.ViewGroup;
-
-import java.util.ArrayList;
-import java.util.EnumMap;
-
-class HomeAdapter extends FragmentStatePagerAdapter {
-
-    private final Context mContext;
-    private final ArrayList<TabInfo> mTabs;
-    private final EnumMap<Page, Fragment> mPages;
-
-    private OnAddTabListener mAddTabListener;
-
-    interface OnAddTabListener {
-        public void onAddTab(String title);
-    }
-
-    final class TabInfo {
-        private final Page page;
-        private final Class<?> clss;
-        private final Bundle args;
-        private final String title;
-
-        TabInfo(Page page, Class<?> clss, Bundle args, String title) {
-            this.page = page;
-            this.clss = clss;
-            this.args = args;
-            this.title = title;
-        }
-    }
-
-    public HomeAdapter(Context context, FragmentManager fm) {
-        super(fm);
-
-        mContext = context;
-
-        mTabs = new ArrayList<TabInfo>();
-        mPages = new EnumMap<Page, Fragment>(Page.class);
-    }
-
-    @Override
-    public int getCount() {
-        return mTabs.size();
-    }
-
-    @Override
-    public Fragment getItem(int position) {
-        TabInfo info = mTabs.get(position);
-        return Fragment.instantiate(mContext, info.clss.getName(), info.args);
-    }
-
-    @Override
-    public CharSequence getPageTitle(int position) {
-        TabInfo info = mTabs.get(position);
-        return info.title.toUpperCase();
-    }
-
-    @Override
-    public Object instantiateItem(ViewGroup container, int position) {
-        Fragment fragment = (Fragment) super.instantiateItem(container, position);
-        mPages.put(mTabs.get(position).page, fragment);
-
-        return fragment;
-    }
-
-    @Override
-    public void destroyItem(ViewGroup container, int position, Object object) {
-        super.destroyItem(container, position, object);
-        mPages.remove(mTabs.get(position).page);
-    }
-
-    public void setOnAddTabListener(OnAddTabListener listener) {
-        mAddTabListener = listener;
-    }
-
-    public void addTab(Page page, Class<?> clss, Bundle args, String title) {
-        addTab(-1, page, clss, args, title);
-    }
-
-    public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
-        TabInfo info = new TabInfo(page, clss, args, title);
-
-        if (index >= 0) {
-            mTabs.add(index, info);
-        } else {
-            mTabs.add(info);
-        }
-
-        notifyDataSetChanged();
-
-        if (mAddTabListener != null) {
-            mAddTabListener.onAddTab(title);
-        }
-    }
-
-    public int getItemPosition(Page page) {
-        for (int i = 0; i < mTabs.size(); i++) {
-            TabInfo info = mTabs.get(i);
-            if (info.page == page) {
-                return i;
-            }
-        }
-
-        return -1;
-    }
-
-    public Page getPageAtPosition(int position) {
-        TabInfo info = mTabs.get(position);
-        return info.page;
-    }
-
-    public void setCanLoadHint(boolean canLoadHint) {
-        // Update fragment arguments for future instances
-        for (TabInfo info : mTabs) {
-            info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
-        }
-
-        // Enable/disable loading on all existing pages
-        for (Fragment page : mPages.values()) {
-            final HomeFragment homePage = (HomeFragment) page;
-            homePage.setCanLoadHint(canLoadHint);
-        }
-    }
-}
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index f1d42dd4aa69..0db739c235f5 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -8,7 +8,6 @@ package org.mozilla.gecko.home;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
-import org.mozilla.gecko.home.HomeAdapter.OnAddTabListener;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -17,6 +16,8 @@ import android.os.Build;
 import android.os.Bundle;
 import android.support.v4.app.Fragment;
 import android.support.v4.app.FragmentManager;
+import android.support.v4.app.FragmentStatePagerAdapter;
+import android.support.v4.view.PagerAdapter;
 import android.support.v4.view.ViewPager;
 import android.view.ViewGroup.LayoutParams;
 import android.util.AttributeSet;
@@ -24,16 +25,15 @@ import android.view.MotionEvent;
 import android.view.ViewGroup;
 import android.view.View;
 
+import java.util.ArrayList;
+import java.util.EnumMap;
 import java.util.EnumSet;
 
 public class HomePager extends ViewPager {
-
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;
 
-    private final OnAddTabListener mAddTabListener;
-
     // List of pages in order.
     @RobocopTarget
     public enum Page {
@@ -53,6 +53,8 @@ public class HomePager extends ViewPager {
     static final String LIST_TAG_LAST_TABS = "last_tabs";
     static final String LIST_TAG_BROWSER_SEARCH = "browser_search";
 
+    private EnumMap<Page, Fragment> mPages = new EnumMap<Page, Fragment>(Page.class);
+
     public interface OnUrlOpenListener {
         public enum Flags {
             ALLOW_SWITCH_TO_TAB
@@ -90,15 +92,6 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
-        mAddTabListener = new OnAddTabListener() {
-            @Override
-            public void onAddTab(String title) {
-                if (mDecor != null) {
-                    mDecor.onAddPagerView(title);
-                }
-            }
-        };
-
         // This is to keep all 4 pages in memory after they are
         // selected in the pager.
         setOffscreenPageLimit(3);
@@ -116,14 +109,6 @@ public class HomePager extends ViewPager {
         if (child instanceof Decor) {
             ((ViewPager.LayoutParams) params).isDecor = true;
             mDecor = (Decor) child;
-
-            mDecor.setOnTitleClickListener(new OnTitleClickListener() {
-                @Override
-                public void onTitleClicked(int index) {
-                    setCurrentItem(index, true);
-                }
-            });
-
             setOnPageChangeListener(new ViewPager.OnPageChangeListener() {
                 @Override
                 public void onPageSelected(int position) {
@@ -144,10 +129,8 @@ public class HomePager extends ViewPager {
     }
 
     public void redisplay(FragmentManager fm) {
-        final HomeAdapter adapter = (HomeAdapter) getAdapter();
-        final Page currentPage = adapter.getPageAtPosition(getCurrentItem());
-
-        show(fm, currentPage, null);
+        final TabsAdapter adapter = (TabsAdapter) getAdapter();
+        show(fm, adapter.getCurrentPage(), null);
     }
 
     /**
@@ -157,13 +140,7 @@ public class HomePager extends ViewPager {
      */
     public void show(FragmentManager fm, Page page, PropertyAnimator animator) {
         mLoaded = true;
-
-        if (mDecor != null) {
-            mDecor.removeAllPagerViews();
-        }
-
-        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
-        adapter.setOnAddTabListener(mAddTabListener);
+        final TabsAdapter adapter = new TabsAdapter(fm);
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
@@ -245,6 +222,122 @@ public class HomePager extends ViewPager {
         }
     }
 
+    class TabsAdapter extends FragmentStatePagerAdapter
+                      implements OnTitleClickListener {
+        private final ArrayList<TabInfo> mTabs = new ArrayList<TabInfo>();
+
+        final class TabInfo {
+            private final Page page;
+            private final Class<?> clss;
+            private final Bundle args;
+            private final String title;
+
+            TabInfo(Page page, Class<?> clss, Bundle args, String title) {
+                this.page = page;
+                this.clss = clss;
+                this.args = args;
+                this.title = title;
+            }
+        }
+
+        public TabsAdapter(FragmentManager fm) {
+            super(fm);
+
+            if (mDecor != null) {
+                mDecor.removeAllPagerViews();
+                mDecor.setOnTitleClickListener(this);
+            }
+        }
+
+        public void addTab(Page page, Class<?> clss, Bundle args, String title) {
+            addTab(-1, page, clss, args, title);
+        }
+
+        public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
+            TabInfo info = new TabInfo(page, clss, args, title);
+
+            if (index >= 0) {
+                mTabs.add(index, info);
+            } else {
+                mTabs.add(info);
+            }
+
+            notifyDataSetChanged();
+
+            if (mDecor != null) {
+                mDecor.onAddPagerView(title);
+            }
+        }
+
+        @Override
+        public void onTitleClicked(int index) {
+            setCurrentItem(index, true);
+        }
+
+        public int getItemPosition(Page page) {
+            for (int i = 0; i < mTabs.size(); i++) {
+                TabInfo info = mTabs.get(i);
+                if (info.page == page) {
+                    return i;
+                }
+            }
+
+            return -1;
+        }
+
+        public Page getCurrentPage() {
+            int currentItem = getCurrentItem();
+            TabInfo info = mTabs.get(currentItem);
+            return info.page;
+        }
+
+        @Override
+        public int getCount() {
+            return mTabs.size();
+        }
+
+        @Override
+        public Fragment getItem(int position) {
+            TabInfo info = mTabs.get(position);
+            return Fragment.instantiate(mContext, info.clss.getName(), info.args);
+        }
+
+        @Override
+        public CharSequence getPageTitle(int position) {
+            TabInfo info = mTabs.get(position);
+            return info.title.toUpperCase();
+        }
+
+        @Override
+        public Object instantiateItem(ViewGroup container, int position) {
+            Fragment fragment = (Fragment) super.instantiateItem(container, position);
+
+            mPages.put(mTabs.get(position).page, fragment);
+
+            return fragment;
+        }
+
+        @Override
+        public void destroyItem(ViewGroup container, int position, Object object) {
+            super.destroyItem(container, position, object);
+
+            mPages.remove(mTabs.get(position).page);
+        }
+
+        public void setCanLoadHint(boolean canLoadHint) {
+            // Update fragment arguments for future instances
+            for (TabInfo info : mTabs) {
+                info.args.putBoolean(CAN_LOAD_ARG, canLoadHint);
+            }
+
+            // Enable/disable loading on all existing pages
+            for (Fragment page : mPages.values()) {
+                final HomeFragment homePage = (HomeFragment) page;
+                homePage.setCanLoadHint(canLoadHint);
+            }
+        }
+    }
+
     @Override
     public boolean onInterceptTouchEvent(MotionEvent event) {
         if (event.getActionMasked() == MotionEvent.ACTION_DOWN) {
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 476cb6c4855d..2eaf5ce6262a 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -208,7 +208,6 @@ gbjar.sources += [
     'home/BrowserSearch.java',
     'home/FadedTextView.java',
     'home/HistoryPage.java',
-    'home/HomeAdapter.java',
     'home/HomeBanner.java',
     'home/HomeFragment.java',
     'home/HomeListView.java',

From 1c9bad3196732b1e04a606f0aa0d52a8a44d74d6 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Thu, 12 Dec 2013 12:45:09 +0100
Subject: [PATCH 146/459] Backed out changeset f1769583f43b (bug 942231) for
 Android Bustage on a CLOSED TREE

---
 mobile/android/base/home/HomePager.java | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 0db739c235f5..b0dae21f4f5c 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -30,6 +30,9 @@ import java.util.EnumMap;
 import java.util.EnumSet;
 
 public class HomePager extends ViewPager {
+    // Subpage fragment tag
+    public static final String SUBPAGE_TAG = "home_pager_subpage";
+
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;

From 29dddfe9663ff451df462c8ea48c4b098bd51b5a Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:02:49 +0000
Subject: [PATCH 147/459] Bug 942231 - Remove unused member from HomePager
 (r=margaret)

---
 mobile/android/base/home/HomePager.java | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index b0dae21f4f5c..0db739c235f5 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -30,9 +30,6 @@ import java.util.EnumMap;
 import java.util.EnumSet;
 
 public class HomePager extends ViewPager {
-    // Subpage fragment tag
-    public static final String SUBPAGE_TAG = "home_pager_subpage";
-
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;

From 620a1b0cd6b050c76647748b5383a61610aa3ce2 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:02:50 +0000
Subject: [PATCH 148/459] Bug 942231 - Factor out HomePager's adapter into a
 separate file (r=margaret)

---
 mobile/android/base/home/HomeAdapter.java | 139 +++++++++++++++++++
 mobile/android/base/home/HomePager.java   | 157 +++++-----------------
 mobile/android/base/moz.build             |   1 +
 3 files changed, 172 insertions(+), 125 deletions(-)
 create mode 100644 mobile/android/base/home/HomeAdapter.java

diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
new file mode 100644
index 000000000000..caaab89a79b9
--- /dev/null
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -0,0 +1,139 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.home.HomePager;
+import org.mozilla.gecko.home.HomePager.Page;
+
+import android.content.Context;
+import android.os.Bundle;
+import android.support.v4.app.Fragment;
+import android.support.v4.app.FragmentManager;
+import android.support.v4.app.FragmentStatePagerAdapter;
+import android.view.ViewGroup;
+
+import java.util.ArrayList;
+import java.util.EnumMap;
+
+class HomeAdapter extends FragmentStatePagerAdapter {
+
+    private final Context mContext;
+    private final ArrayList<TabInfo> mTabs;
+    private final EnumMap<Page, Fragment> mPages;
+
+    private OnAddTabListener mAddTabListener;
+
+    interface OnAddTabListener {
+        public void onAddTab(String title);
+    }
+
+    final class TabInfo {
+        private final Page page;
+        private final Class<?> clss;
+        private final Bundle args;
+        private final String title;
+
+        TabInfo(Page page, Class<?> clss, Bundle args, String title) {
+            this.page = page;
+            this.clss = clss;
+            this.args = args;
+            this.title = title;
+        }
+    }
+
+    public HomeAdapter(Context context, FragmentManager fm) {
+        super(fm);
+
+        mContext = context;
+
+        mTabs = new ArrayList<TabInfo>();
+        mPages = new EnumMap<Page, Fragment>(Page.class);
+    }
+
+    @Override
+    public int getCount() {
+        return mTabs.size();
+    }
+
+    @Override
+    public Fragment getItem(int position) {
+        TabInfo info = mTabs.get(position);
+        return Fragment.instantiate(mContext, info.clss.getName(), info.args);
+    }
+
+    @Override
+    public CharSequence getPageTitle(int position) {
+        TabInfo info = mTabs.get(position);
+        return info.title.toUpperCase();
+    }
+
+    @Override
+    public Object instantiateItem(ViewGroup container, int position) {
+        Fragment fragment = (Fragment) super.instantiateItem(container, position);
+        mPages.put(mTabs.get(position).page, fragment);
+
+        return fragment;
+    }
+
+    @Override
+    public void destroyItem(ViewGroup container, int position, Object object) {
+        super.destroyItem(container, position, object);
+        mPages.remove(mTabs.get(position).page);
+    }
+
+    public void setOnAddTabListener(OnAddTabListener listener) {
+        mAddTabListener = listener;
+    }
+
+    public void addTab(Page page, Class<?> clss, Bundle args, String title) {
+        addTab(-1, page, clss, args, title);
+    }
+
+    public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
+        TabInfo info = new TabInfo(page, clss, args, title);
+
+        if (index >= 0) {
+            mTabs.add(index, info);
+        } else {
+            mTabs.add(info);
+        }
+
+        notifyDataSetChanged();
+
+        if (mAddTabListener != null) {
+            mAddTabListener.onAddTab(title);
+        }
+    }
+
+    public int getItemPosition(Page page) {
+        for (int i = 0; i < mTabs.size(); i++) {
+            TabInfo info = mTabs.get(i);
+            if (info.page == page) {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+
+    public Page getPageAtPosition(int position) {
+        TabInfo info = mTabs.get(position);
+        return info.page;
+    }
+
+    public void setCanLoadHint(boolean canLoadHint) {
+        // Update fragment arguments for future instances
+        for (TabInfo info : mTabs) {
+            info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
+        }
+
+        // Enable/disable loading on all existing pages
+        for (Fragment page : mPages.values()) {
+            final HomeFragment homePage = (HomeFragment) page;
+            homePage.setCanLoadHint(canLoadHint);
+        }
+    }
+}
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 0db739c235f5..f1d42dd4aa69 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -8,6 +8,7 @@ package org.mozilla.gecko.home;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
+import org.mozilla.gecko.home.HomeAdapter.OnAddTabListener;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -16,8 +17,6 @@ import android.os.Build;
 import android.os.Bundle;
 import android.support.v4.app.Fragment;
 import android.support.v4.app.FragmentManager;
-import android.support.v4.app.FragmentStatePagerAdapter;
-import android.support.v4.view.PagerAdapter;
 import android.support.v4.view.ViewPager;
 import android.view.ViewGroup.LayoutParams;
 import android.util.AttributeSet;
@@ -25,15 +24,16 @@ import android.view.MotionEvent;
 import android.view.ViewGroup;
 import android.view.View;
 
-import java.util.ArrayList;
-import java.util.EnumMap;
 import java.util.EnumSet;
 
 public class HomePager extends ViewPager {
+
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;
 
+    private final OnAddTabListener mAddTabListener;
+
     // List of pages in order.
     @RobocopTarget
     public enum Page {
@@ -53,8 +53,6 @@ public class HomePager extends ViewPager {
     static final String LIST_TAG_LAST_TABS = "last_tabs";
     static final String LIST_TAG_BROWSER_SEARCH = "browser_search";
 
-    private EnumMap<Page, Fragment> mPages = new EnumMap<Page, Fragment>(Page.class);
-
     public interface OnUrlOpenListener {
         public enum Flags {
             ALLOW_SWITCH_TO_TAB
@@ -92,6 +90,15 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
+        mAddTabListener = new OnAddTabListener() {
+            @Override
+            public void onAddTab(String title) {
+                if (mDecor != null) {
+                    mDecor.onAddPagerView(title);
+                }
+            }
+        };
+
         // This is to keep all 4 pages in memory after they are
         // selected in the pager.
         setOffscreenPageLimit(3);
@@ -109,6 +116,14 @@ public class HomePager extends ViewPager {
         if (child instanceof Decor) {
             ((ViewPager.LayoutParams) params).isDecor = true;
             mDecor = (Decor) child;
+
+            mDecor.setOnTitleClickListener(new OnTitleClickListener() {
+                @Override
+                public void onTitleClicked(int index) {
+                    setCurrentItem(index, true);
+                }
+            });
+
             setOnPageChangeListener(new ViewPager.OnPageChangeListener() {
                 @Override
                 public void onPageSelected(int position) {
@@ -129,8 +144,10 @@ public class HomePager extends ViewPager {
     }
 
     public void redisplay(FragmentManager fm) {
-        final TabsAdapter adapter = (TabsAdapter) getAdapter();
-        show(fm, adapter.getCurrentPage(), null);
+        final HomeAdapter adapter = (HomeAdapter) getAdapter();
+        final Page currentPage = adapter.getPageAtPosition(getCurrentItem());
+
+        show(fm, currentPage, null);
     }
 
     /**
@@ -140,7 +157,13 @@ public class HomePager extends ViewPager {
      */
     public void show(FragmentManager fm, Page page, PropertyAnimator animator) {
         mLoaded = true;
-        final TabsAdapter adapter = new TabsAdapter(fm);
+
+        if (mDecor != null) {
+            mDecor.removeAllPagerViews();
+        }
+
+        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
+        adapter.setOnAddTabListener(mAddTabListener);
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
@@ -222,122 +245,6 @@ public class HomePager extends ViewPager {
         }
     }
 
-    class TabsAdapter extends FragmentStatePagerAdapter
-                      implements OnTitleClickListener {
-        private final ArrayList<TabInfo> mTabs = new ArrayList<TabInfo>();
-
-        final class TabInfo {
-            private final Page page;
-            private final Class<?> clss;
-            private final Bundle args;
-            private final String title;
-
-            TabInfo(Page page, Class<?> clss, Bundle args, String title) {
-                this.page = page;
-                this.clss = clss;
-                this.args = args;
-                this.title = title;
-            }
-        }
-
-        public TabsAdapter(FragmentManager fm) {
-            super(fm);
-
-            if (mDecor != null) {
-                mDecor.removeAllPagerViews();
-                mDecor.setOnTitleClickListener(this);
-            }
-        }
-
-        public void addTab(Page page, Class<?> clss, Bundle args, String title) {
-            addTab(-1, page, clss, args, title);
-        }
-
-        public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
-            TabInfo info = new TabInfo(page, clss, args, title);
-
-            if (index >= 0) {
-                mTabs.add(index, info);
-            } else {
-                mTabs.add(info);
-            }
-
-            notifyDataSetChanged();
-
-            if (mDecor != null) {
-                mDecor.onAddPagerView(title);
-            }
-        }
-
-        @Override
-        public void onTitleClicked(int index) {
-            setCurrentItem(index, true);
-        }
-
-        public int getItemPosition(Page page) {
-            for (int i = 0; i < mTabs.size(); i++) {
-                TabInfo info = mTabs.get(i);
-                if (info.page == page) {
-                    return i;
-                }
-            }
-
-            return -1;
-        }
-
-        public Page getCurrentPage() {
-            int currentItem = getCurrentItem();
-            TabInfo info = mTabs.get(currentItem);
-            return info.page;
-        }
-
-        @Override
-        public int getCount() {
-            return mTabs.size();
-        }
-
-        @Override
-        public Fragment getItem(int position) {
-            TabInfo info = mTabs.get(position);
-            return Fragment.instantiate(mContext, info.clss.getName(), info.args);
-        }
-
-        @Override
-        public CharSequence getPageTitle(int position) {
-            TabInfo info = mTabs.get(position);
-            return info.title.toUpperCase();
-        }
-
-        @Override
-        public Object instantiateItem(ViewGroup container, int position) {
-            Fragment fragment = (Fragment) super.instantiateItem(container, position);
-
-            mPages.put(mTabs.get(position).page, fragment);
-
-            return fragment;
-        }
-
-        @Override
-        public void destroyItem(ViewGroup container, int position, Object object) {
-            super.destroyItem(container, position, object);
-
-            mPages.remove(mTabs.get(position).page);
-        }
-
-        public void setCanLoadHint(boolean canLoadHint) {
-            // Update fragment arguments for future instances
-            for (TabInfo info : mTabs) {
-                info.args.putBoolean(CAN_LOAD_ARG, canLoadHint);
-            }
-
-            // Enable/disable loading on all existing pages
-            for (Fragment page : mPages.values()) {
-                final HomeFragment homePage = (HomeFragment) page;
-                homePage.setCanLoadHint(canLoadHint);
-            }
-        }
-    }
-
     @Override
     public boolean onInterceptTouchEvent(MotionEvent event) {
         if (event.getActionMasked() == MotionEvent.ACTION_DOWN) {
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 2eaf5ce6262a..476cb6c4855d 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -208,6 +208,7 @@ gbjar.sources += [
     'home/BrowserSearch.java',
     'home/FadedTextView.java',
     'home/HistoryPage.java',
+    'home/HomeAdapter.java',
     'home/HomeBanner.java',
     'home/HomeFragment.java',
     'home/HomeListView.java',

From 4711082bdb7d6cb52facfa746f014419c018c2bb Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:02:51 +0000
Subject: [PATCH 149/459] Bug 942231 - Use 'page' terminology in HomePager
 instead of 'tab' (r=margaret)

---
 mobile/android/base/home/HomeAdapter.java | 52 +++++++++++------------
 mobile/android/base/home/HomePager.java   | 22 +++++-----
 2 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
index caaab89a79b9..2d424face292 100644
--- a/mobile/android/base/home/HomeAdapter.java
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -21,22 +21,22 @@ import java.util.EnumMap;
 class HomeAdapter extends FragmentStatePagerAdapter {
 
     private final Context mContext;
-    private final ArrayList<TabInfo> mTabs;
+    private final ArrayList<PageInfo> mPageInfos;
     private final EnumMap<Page, Fragment> mPages;
 
-    private OnAddTabListener mAddTabListener;
+    private OnAddPageListener mAddPageListener;
 
-    interface OnAddTabListener {
-        public void onAddTab(String title);
+    interface OnAddPageListener {
+        public void onAddPage(String title);
     }
 
-    final class TabInfo {
+    final class PageInfo {
         private final Page page;
         private final Class<?> clss;
         private final Bundle args;
         private final String title;
 
-        TabInfo(Page page, Class<?> clss, Bundle args, String title) {
+        PageInfo(Page page, Class<?> clss, Bundle args, String title) {
             this.page = page;
             this.clss = clss;
             this.args = args;
@@ -49,31 +49,31 @@ class HomeAdapter extends FragmentStatePagerAdapter {
 
         mContext = context;
 
-        mTabs = new ArrayList<TabInfo>();
+        mPageInfos = new ArrayList<PageInfo>();
         mPages = new EnumMap<Page, Fragment>(Page.class);
     }
 
     @Override
     public int getCount() {
-        return mTabs.size();
+        return mPageInfos.size();
     }
 
     @Override
     public Fragment getItem(int position) {
-        TabInfo info = mTabs.get(position);
+        PageInfo info = mPageInfos.get(position);
         return Fragment.instantiate(mContext, info.clss.getName(), info.args);
     }
 
     @Override
     public CharSequence getPageTitle(int position) {
-        TabInfo info = mTabs.get(position);
+        PageInfo info = mPageInfos.get(position);
         return info.title.toUpperCase();
     }
 
     @Override
     public Object instantiateItem(ViewGroup container, int position) {
         Fragment fragment = (Fragment) super.instantiateItem(container, position);
-        mPages.put(mTabs.get(position).page, fragment);
+        mPages.put(mPageInfos.get(position).page, fragment);
 
         return fragment;
     }
@@ -81,36 +81,36 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public void destroyItem(ViewGroup container, int position, Object object) {
         super.destroyItem(container, position, object);
-        mPages.remove(mTabs.get(position).page);
+        mPages.remove(mPageInfos.get(position).page);
     }
 
-    public void setOnAddTabListener(OnAddTabListener listener) {
-        mAddTabListener = listener;
+    public void setOnAddPageListener(OnAddPageListener listener) {
+        mAddPageListener = listener;
     }
 
-    public void addTab(Page page, Class<?> clss, Bundle args, String title) {
-        addTab(-1, page, clss, args, title);
+    public void addPage(Page page, Class<?> clss, Bundle args, String title) {
+        addPage(-1, page, clss, args, title);
     }
 
-    public void addTab(int index, Page page, Class<?> clss, Bundle args, String title) {
-        TabInfo info = new TabInfo(page, clss, args, title);
+    public void addPage(int index, Page page, Class<?> clss, Bundle args, String title) {
+        PageInfo info = new PageInfo(page, clss, args, title);
 
         if (index >= 0) {
-            mTabs.add(index, info);
+            mPageInfos.add(index, info);
         } else {
-            mTabs.add(info);
+            mPageInfos.add(info);
         }
 
         notifyDataSetChanged();
 
-        if (mAddTabListener != null) {
-            mAddTabListener.onAddTab(title);
+        if (mAddPageListener != null) {
+            mAddPageListener.onAddPage(title);
         }
     }
 
     public int getItemPosition(Page page) {
-        for (int i = 0; i < mTabs.size(); i++) {
-            TabInfo info = mTabs.get(i);
+        for (int i = 0; i < mPageInfos.size(); i++) {
+            PageInfo info = mPageInfos.get(i);
             if (info.page == page) {
                 return i;
             }
@@ -120,13 +120,13 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     }
 
     public Page getPageAtPosition(int position) {
-        TabInfo info = mTabs.get(position);
+        PageInfo info = mPageInfos.get(position);
         return info.page;
     }
 
     public void setCanLoadHint(boolean canLoadHint) {
         // Update fragment arguments for future instances
-        for (TabInfo info : mTabs) {
+        for (PageInfo info : mPageInfos) {
             info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
         }
 
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index f1d42dd4aa69..66253b1be0f6 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -8,7 +8,7 @@ package org.mozilla.gecko.home;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
-import org.mozilla.gecko.home.HomeAdapter.OnAddTabListener;
+import org.mozilla.gecko.home.HomeAdapter.OnAddPageListener;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -32,7 +32,7 @@ public class HomePager extends ViewPager {
     private volatile boolean mLoaded;
     private Decor mDecor;
 
-    private final OnAddTabListener mAddTabListener;
+    private final OnAddPageListener mAddPageListener;
 
     // List of pages in order.
     @RobocopTarget
@@ -90,9 +90,9 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
-        mAddTabListener = new OnAddTabListener() {
+        mAddPageListener = new OnAddPageListener() {
             @Override
-            public void onAddTab(String title) {
+            public void onAddPage(String title) {
                 if (mDecor != null) {
                     mDecor.onAddPagerView(title);
                 }
@@ -163,26 +163,26 @@ public class HomePager extends ViewPager {
         }
 
         final HomeAdapter adapter = new HomeAdapter(mContext, fm);
-        adapter.setOnAddTabListener(mAddTabListener);
+        adapter.setOnAddPageListener(mAddPageListener);
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
 
-        adapter.addTab(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
+        adapter.addPage(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
                 getContext().getString(R.string.home_top_sites_title));
-        adapter.addTab(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
+        adapter.addPage(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
                 getContext().getString(R.string.bookmarks_title));
 
         // We disable reader mode support on low memory devices. Hence the
         // reading list page should not show up on such devices.
         if (!HardwareUtils.isLowMemoryPlatform()) {
-            adapter.addTab(Page.READING_LIST, ReadingListPage.class, new Bundle(),
+            adapter.addPage(Page.READING_LIST, ReadingListPage.class, new Bundle(),
                     getContext().getString(R.string.reading_list_title));
         }
 
-        // On phones, the history tab is the first tab. On tablets, the
-        // history tab is the last tab.
-        adapter.addTab(HardwareUtils.isTablet() ? -1 : 0,
+        // On phones, the history page is the first one. On tablets, the
+        // history page is the last.
+        adapter.addPage(HardwareUtils.isTablet() ? -1 : 0,
                 Page.HISTORY, HistoryPage.class, new Bundle(),
                 getContext().getString(R.string.home_history_title));
 

From f339fade7477617aa9c7b3f2ea36de72e817eb3e Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:02:51 +0000
Subject: [PATCH 150/459] Bug 942231 - Keep showHomePager* method together in
 BrowserApp (r=margaret)

---
 mobile/android/base/BrowserApp.java | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index c6be146ff1cc..87d29f055f6b 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1618,10 +1618,6 @@ abstract public class BrowserApp extends GeckoApp
         }
     }
 
-    private void showHomePager(HomePager.Page page) {
-        showHomePagerWithAnimator(page, null);
-    }
-
     @Override
     public void onLocaleReady(final String locale) {
         super.onLocaleReady(locale);
@@ -1636,6 +1632,10 @@ abstract public class BrowserApp extends GeckoApp
         }
     }
 
+    private void showHomePager(HomePager.Page page) {
+        showHomePagerWithAnimator(page, null);
+    }
+
     private void showHomePagerWithAnimator(HomePager.Page page, PropertyAnimator animator) {
         if (isHomePagerVisible()) {
             return;

From c5f8fff541c751e85d170a79d73b7dedb52b0bb2 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:02:52 +0000
Subject: [PATCH 151/459] Bug 942231 - Define constant with default value for
 'can load' hint (r=margaret)

---
 mobile/android/base/home/HomeFragment.java | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mobile/android/base/home/HomeFragment.java b/mobile/android/base/home/HomeFragment.java
index 48b976ba74fa..45e1ee26f015 100644
--- a/mobile/android/base/home/HomeFragment.java
+++ b/mobile/android/base/home/HomeFragment.java
@@ -44,6 +44,9 @@ abstract class HomeFragment extends Fragment {
     // Share MIME type.
     private static final String SHARE_MIME_TYPE = "text/plain";
 
+    // Default value for "can load" hint
+    static final boolean DEFAULT_CAN_LOAD_HINT = false;
+
     // Whether the fragment can load its content or not
     // This is used to defer data loading until the editing
     // mode animation ends.
@@ -58,9 +61,9 @@ abstract class HomeFragment extends Fragment {
 
         final Bundle args = getArguments();
         if (args != null) {
-            mCanLoadHint = args.getBoolean(HomePager.CAN_LOAD_ARG, false);
+            mCanLoadHint = args.getBoolean(HomePager.CAN_LOAD_ARG, DEFAULT_CAN_LOAD_HINT);
         } else {
-            mCanLoadHint = false;
+            mCanLoadHint = DEFAULT_CAN_LOAD_HINT;
         }
 
         mIsLoaded = false;

From c1e1d383354849d95269c92da5ff3683381e27b2 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:04:31 +0000
Subject: [PATCH 152/459] Bug 942231 - Change HomePager to be backed by
 HomeConfig (r=margaret)

---
 CLOBBER                                       |   2 +-
 mobile/android/base/BrowserApp.java           |  14 +-
 mobile/android/base/Tab.java                  |   5 +-
 mobile/android/base/home/HomeAdapter.java     | 144 +++++++----
 mobile/android/base/home/HomeConfig.java      | 224 ++++++++++++++++++
 .../android/base/home/HomeConfigLoader.java   |  83 +++++++
 .../base/home/HomeConfigMemBackend.java       |  67 ++++++
 mobile/android/base/home/HomePager.java       | 149 +++++++++---
 mobile/android/base/home/ListPage.java        | 185 +++++++++++++++
 mobile/android/base/moz.build                 |   4 +
 10 files changed, 790 insertions(+), 87 deletions(-)
 create mode 100644 mobile/android/base/home/HomeConfig.java
 create mode 100644 mobile/android/base/home/HomeConfigLoader.java
 create mode 100644 mobile/android/base/home/HomeConfigMemBackend.java
 create mode 100644 mobile/android/base/home/ListPage.java

diff --git a/CLOBBER b/CLOBBER
index c8fd7d31d7bc..d71a89884b10 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -18,4 +18,4 @@
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
 
-Bug 946067 required a clobber on Windows because bug 928195
+Bug 942231 needs a clobber -- JNI wrappers need to be re-generated.
diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 87d29f055f6b..3fcfa90c5427 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1467,7 +1467,7 @@ abstract public class BrowserApp extends GeckoApp
         animator.setUseHardwareLayer(false);
 
         mBrowserToolbar.startEditing(url, animator);
-        showHomePagerWithAnimator(HomePager.Page.TOP_SITES, animator);
+        showHomePagerWithAnimator(animator);
 
         animator.start();
     }
@@ -1623,7 +1623,7 @@ abstract public class BrowserApp extends GeckoApp
         super.onLocaleReady(locale);
         if (mHomePager != null) {
             // Blow it away and rebuild it with the right strings.
-            mHomePager.redisplay(getSupportFragmentManager());
+            mHomePager.redisplay(getSupportLoaderManager(), getSupportFragmentManager());
         }
 
         if (mMenu != null) {
@@ -1636,6 +1636,12 @@ abstract public class BrowserApp extends GeckoApp
         showHomePagerWithAnimator(page, null);
     }
 
+    private void showHomePagerWithAnimator(PropertyAnimator animator) {
+        // Passing null here means the default page will be defined
+        // by the HomePager's configuration.
+        showHomePagerWithAnimator(null, animator);
+    }
+
     private void showHomePagerWithAnimator(HomePager.Page page, PropertyAnimator animator) {
         if (isHomePagerVisible()) {
             return;
@@ -1655,7 +1661,9 @@ abstract public class BrowserApp extends GeckoApp
             mHomePager = (HomePager) homePagerStub.inflate();
         }
 
-        mHomePager.show(getSupportFragmentManager(), page, animator);
+        mHomePager.show(getSupportLoaderManager(),
+                        getSupportFragmentManager(),
+                        page, animator);
 
         // Hide the web content so it cannot be focused by screen readers.
         hideWebContentOnPropertyAnimationEnd(animator);
diff --git a/mobile/android/base/Tab.java b/mobile/android/base/Tab.java
index 09171f428372..0f1a02d10a7c 100644
--- a/mobile/android/base/Tab.java
+++ b/mobile/android/base/Tab.java
@@ -95,7 +95,7 @@ public class Tab {
         mUserSearch = "";
         mExternal = external;
         mParentId = parentId;
-        mAboutHomePage = HomePager.Page.TOP_SITES;
+        mAboutHomePage = null;
         mTitle = title == null ? "" : title;
         mFavicon = null;
         mFaviconUrl = null;
@@ -155,7 +155,6 @@ public class Tab {
         mAboutHomePage = page;
     }
 
-
     // may be null if user-entered query hasn't yet been resolved to a URI
     public synchronized String getURL() {
         return mUrl;
@@ -660,6 +659,8 @@ public class Tab {
         final String homePage = message.getString("aboutHomePage");
         if (!TextUtils.isEmpty(homePage)) {
             setAboutHomePage(HomePager.Page.valueOf(homePage));
+        } else {
+            setAboutHomePage(null);
         }
 
         Tabs.getInstance().notifyListeners(this, Tabs.TabEvents.LOCATION_CHANGE, oldUrl);
diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
index 2d424face292..7cbdc06283a2 100644
--- a/mobile/android/base/home/HomeAdapter.java
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -5,6 +5,8 @@
 
 package org.mozilla.gecko.home;
 
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.PageType;
 import org.mozilla.gecko.home.HomePager;
 import org.mozilla.gecko.home.HomePager.Page;
 
@@ -16,13 +18,16 @@ import android.support.v4.app.FragmentStatePagerAdapter;
 import android.view.ViewGroup;
 
 import java.util.ArrayList;
-import java.util.EnumMap;
+import java.util.HashMap;
+import java.util.List;
 
 class HomeAdapter extends FragmentStatePagerAdapter {
 
     private final Context mContext;
     private final ArrayList<PageInfo> mPageInfos;
-    private final EnumMap<Page, Fragment> mPages;
+    private final HashMap<String, Fragment> mPages;
+
+    private boolean mCanLoadHint;
 
     private OnAddPageListener mAddPageListener;
 
@@ -30,27 +35,14 @@ class HomeAdapter extends FragmentStatePagerAdapter {
         public void onAddPage(String title);
     }
 
-    final class PageInfo {
-        private final Page page;
-        private final Class<?> clss;
-        private final Bundle args;
-        private final String title;
-
-        PageInfo(Page page, Class<?> clss, Bundle args, String title) {
-            this.page = page;
-            this.clss = clss;
-            this.args = args;
-            this.title = title;
-        }
-    }
-
     public HomeAdapter(Context context, FragmentManager fm) {
         super(fm);
 
         mContext = context;
+        mCanLoadHint = HomeFragment.DEFAULT_CAN_LOAD_HINT;
 
         mPageInfos = new ArrayList<PageInfo>();
-        mPages = new EnumMap<Page, Fragment>(Page.class);
+        mPages = new HashMap<String, Fragment>();
     }
 
     @Override
@@ -61,19 +53,23 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public Fragment getItem(int position) {
         PageInfo info = mPageInfos.get(position);
-        return Fragment.instantiate(mContext, info.clss.getName(), info.args);
+        return Fragment.instantiate(mContext, info.getClassName(), info.getArgs());
     }
 
     @Override
     public CharSequence getPageTitle(int position) {
-        PageInfo info = mPageInfos.get(position);
-        return info.title.toUpperCase();
+        if (mPageInfos.size() > 0) {
+            PageInfo info = mPageInfos.get(position);
+            return info.getTitle().toUpperCase();
+        }
+
+        return null;
     }
 
     @Override
     public Object instantiateItem(ViewGroup container, int position) {
         Fragment fragment = (Fragment) super.instantiateItem(container, position);
-        mPages.put(mPageInfos.get(position).page, fragment);
+        mPages.put(mPageInfos.get(position).getId(), fragment);
 
         return fragment;
     }
@@ -81,37 +77,17 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     @Override
     public void destroyItem(ViewGroup container, int position, Object object) {
         super.destroyItem(container, position, object);
-        mPages.remove(mPageInfos.get(position).page);
+        mPages.remove(mPageInfos.get(position).getId());
     }
 
     public void setOnAddPageListener(OnAddPageListener listener) {
         mAddPageListener = listener;
     }
 
-    public void addPage(Page page, Class<?> clss, Bundle args, String title) {
-        addPage(-1, page, clss, args, title);
-    }
-
-    public void addPage(int index, Page page, Class<?> clss, Bundle args, String title) {
-        PageInfo info = new PageInfo(page, clss, args, title);
-
-        if (index >= 0) {
-            mPageInfos.add(index, info);
-        } else {
-            mPageInfos.add(info);
-        }
-
-        notifyDataSetChanged();
-
-        if (mAddPageListener != null) {
-            mAddPageListener.onAddPage(title);
-        }
-    }
-
     public int getItemPosition(Page page) {
         for (int i = 0; i < mPageInfos.size(); i++) {
-            PageInfo info = mPageInfos.get(i);
-            if (info.page == page) {
+            final Page infoPage = mPageInfos.get(i).toPage();
+            if (infoPage == page) {
                 return i;
             }
         }
@@ -121,14 +97,39 @@ class HomeAdapter extends FragmentStatePagerAdapter {
 
     public Page getPageAtPosition(int position) {
         PageInfo info = mPageInfos.get(position);
-        return info.page;
+        return info.toPage();
+    }
+
+    private void addPage(PageInfo info) {
+        mPageInfos.add(info);
+
+        if (mAddPageListener != null) {
+            mAddPageListener.onAddPage(info.getTitle());
+        }
+    }
+
+    public void update(List<PageEntry> pageEntries) {
+        mPages.clear();
+        mPageInfos.clear();
+
+        if (pageEntries != null) {
+            for (PageEntry pageEntry : pageEntries) {
+                final PageInfo info = new PageInfo(pageEntry);
+                addPage(info);
+            }
+        }
+
+        notifyDataSetChanged();
+    }
+
+    public boolean getCanLoadHint() {
+        return mCanLoadHint;
     }
 
     public void setCanLoadHint(boolean canLoadHint) {
-        // Update fragment arguments for future instances
-        for (PageInfo info : mPageInfos) {
-            info.args.putBoolean(HomePager.CAN_LOAD_ARG, canLoadHint);
-        }
+        // We cache the last hint value so that we can use it when
+        // creating new pages. See PageInfo.getArgs().
+        mCanLoadHint = canLoadHint;
 
         // Enable/disable loading on all existing pages
         for (Fragment page : mPages.values()) {
@@ -136,4 +137,49 @@ class HomeAdapter extends FragmentStatePagerAdapter {
             homePage.setCanLoadHint(canLoadHint);
         }
     }
+
+    private final class PageInfo {
+        private final String mId;
+        private final PageEntry mPageEntry;
+
+        PageInfo(PageEntry pageEntry) {
+            mId = pageEntry.getType() + "-" + pageEntry.getId();
+            mPageEntry = pageEntry;
+        }
+
+        public String getId() {
+            return mId;
+        }
+
+        public String getTitle() {
+            return mPageEntry.getTitle();
+        }
+
+        public String getClassName() {
+            final PageType type = mPageEntry.getType();
+            return type.getPageClass().getName();
+        }
+
+        public Bundle getArgs() {
+            final Bundle args = new Bundle();
+
+            args.putBoolean(HomePager.CAN_LOAD_ARG, mCanLoadHint);
+
+            // Only list pages need the page entry
+            if (mPageEntry.getType() == PageType.LIST) {
+                args.putParcelable(HomePager.PAGE_ENTRY_ARG, mPageEntry);
+            }
+
+            return args;
+        }
+
+        public Page toPage() {
+            final PageType type = mPageEntry.getType();
+            if (type == PageType.LIST) {
+                return null;
+            }
+
+            return Page.valueOf(type);
+        }
+    }
 }
diff --git a/mobile/android/base/home/HomeConfig.java b/mobile/android/base/home/HomeConfig.java
new file mode 100644
index 000000000000..636fd617f7d8
--- /dev/null
+++ b/mobile/android/base/home/HomeConfig.java
@@ -0,0 +1,224 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.home.HomePager.Page;
+
+import android.content.Context;
+import android.os.Parcel;
+import android.os.Parcelable;
+import android.text.TextUtils;
+
+import java.util.EnumSet;
+import java.util.List;
+
+final class HomeConfig {
+    public static enum PageType implements Parcelable {
+        TOP_SITES("top_sites", TopSitesPage.class),
+        BOOKMARKS("bookmarks", BookmarksPage.class),
+        HISTORY("history", HistoryPage.class),
+        READING_LIST("reading_list", ReadingListPage.class),
+        LIST("list", ListPage.class);
+
+        private final String mId;
+        private final Class<?> mPageClass;
+
+        PageType(String id, Class<?> pageClass) {
+            mId = id;
+            mPageClass = pageClass;
+        }
+
+        public static PageType valueOf(Page page) {
+            switch(page) {
+                case TOP_SITES:
+                    return PageType.TOP_SITES;
+
+                case BOOKMARKS:
+                    return PageType.BOOKMARKS;
+
+                case HISTORY:
+                    return PageType.HISTORY;
+
+                case READING_LIST:
+                    return PageType.READING_LIST;
+
+                default:
+                    throw new IllegalArgumentException("Could not convert unrecognized Page");
+            }
+        }
+
+        public static PageType fromId(String id) {
+            if (id == null) {
+                throw new IllegalArgumentException("Could not convert null String to PageType");
+            }
+
+            for (PageType page : PageType.values()) {
+                if (TextUtils.equals(page.mId, id.toLowerCase())) {
+                    return page;
+                }
+            }
+
+            throw new IllegalArgumentException("Could not convert String id to PageType");
+        }
+
+        @Override
+        public String toString() {
+            return mId;
+        }
+
+        public Class<?> getPageClass() {
+            return mPageClass;
+        }
+
+        @Override
+        public int describeContents() {
+            return 0;
+        }
+
+        @Override
+        public void writeToParcel(Parcel dest, int flags) {
+            dest.writeInt(ordinal());
+        }
+
+        public static final Creator<PageType> CREATOR = new Creator<PageType>() {
+            @Override
+            public PageType createFromParcel(final Parcel source) {
+                return PageType.values()[source.readInt()];
+            }
+
+            @Override
+            public PageType[] newArray(final int size) {
+                return new PageType[size];
+            }
+        };
+    }
+
+    public static class PageEntry implements Parcelable {
+        private final PageType mType;
+        private final String mTitle;
+        private final String mId;
+        private final EnumSet<Flags> mFlags;
+
+        public enum Flags {
+            DEFAULT_PAGE
+        }
+
+        @SuppressWarnings("unchecked")
+        public PageEntry(Parcel in) {
+            mType = (PageType) in.readParcelable(getClass().getClassLoader());
+            mTitle = in.readString();
+            mId = in.readString();
+            mFlags = (EnumSet<Flags>) in.readSerializable();
+        }
+
+        public PageEntry(PageType type, String title) {
+            this(type, title, EnumSet.noneOf(Flags.class));
+        }
+
+        public PageEntry(PageType type, String title, EnumSet<Flags> flags) {
+            this(type, title, type.toString(), flags);
+        }
+
+        public PageEntry(PageType type, String title, String id) {
+            this(type, title, id, EnumSet.noneOf(Flags.class));
+        }
+
+        public PageEntry(PageType type, String title, String id, EnumSet<Flags> flags) {
+            if (type == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null type");
+            }
+            mType = type;
+
+            if (title == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null title");
+            }
+            mTitle = title;
+
+            if (id == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null id");
+            }
+            mId = id;
+
+            if (flags == null) {
+                throw new IllegalArgumentException("Can't create PageEntry with null flags");
+            }
+            mFlags = flags;
+        }
+
+        public PageType getType() {
+            return mType;
+        }
+
+        public String getTitle() {
+            return mTitle;
+        }
+
+        public String getId() {
+            return mId;
+        }
+
+        public boolean isDefault() {
+            return mFlags.contains(Flags.DEFAULT_PAGE);
+        }
+
+        @Override
+        public int describeContents() {
+            return 0;
+        }
+
+        @Override
+        public void writeToParcel(Parcel dest, int flags) {
+            dest.writeParcelable(mType, 0);
+            dest.writeString(mTitle);
+            dest.writeString(mId);
+            dest.writeSerializable(mFlags);
+        }
+
+        public static final Creator<PageEntry> CREATOR = new Creator<PageEntry>() {
+            @Override
+            public PageEntry createFromParcel(final Parcel in) {
+                return new PageEntry(in);
+            }
+
+            @Override
+            public PageEntry[] newArray(final int size) {
+                return new PageEntry[size];
+            }
+        };
+    }
+
+    public interface OnChangeListener {
+        public void onChange();
+    }
+
+    public interface HomeConfigBackend {
+        public List<PageEntry> load();
+        public void save(List<PageEntry> entries);
+        public void setOnChangeListener(OnChangeListener listener);
+    }
+
+    private final HomeConfigBackend mBackend;
+
+    public HomeConfig(HomeConfigBackend backend) {
+        mBackend = backend;
+    }
+
+    public List<PageEntry> load() {
+        return mBackend.load();
+    }
+
+    public void save(List<PageEntry> entries) {
+        mBackend.save(entries);
+    }
+
+    public void setOnChangeListener(OnChangeListener listener) {
+        mBackend.setOnChangeListener(listener);
+    }
+
+    public static HomeConfig getDefault(Context context) {
+        return new HomeConfig(new HomeConfigMemBackend(context));
+    }
+}
\ No newline at end of file
diff --git a/mobile/android/base/home/HomeConfigLoader.java b/mobile/android/base/home/HomeConfigLoader.java
new file mode 100644
index 000000000000..df27c8c7e961
--- /dev/null
+++ b/mobile/android/base/home/HomeConfigLoader.java
@@ -0,0 +1,83 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.OnChangeListener;
+
+import android.content.Context;
+import android.support.v4.content.AsyncTaskLoader;
+
+import java.util.List;
+
+public class HomeConfigLoader extends AsyncTaskLoader<List<PageEntry>> {
+    private final HomeConfig mConfig;
+    private List<PageEntry> mPageEntries;
+
+    public HomeConfigLoader(Context context, HomeConfig homeConfig) {
+        super(context);
+        mConfig = homeConfig;
+    }
+
+    @Override
+    public List<PageEntry> loadInBackground() {
+        return mConfig.load();
+    }
+
+    @Override
+    public void deliverResult(List<PageEntry> pageEntries) {
+        if (isReset()) {
+            mPageEntries = null;
+            return;
+        }
+
+        mPageEntries = pageEntries;
+        mConfig.setOnChangeListener(new ForceLoadChangeListener());
+
+        if (isStarted()) {
+            super.deliverResult(pageEntries);
+        }
+    }
+
+    @Override
+    protected void onStartLoading() {
+        if (mPageEntries != null) {
+            deliverResult(mPageEntries);
+        }
+
+        if (takeContentChanged() || mPageEntries == null) {
+            forceLoad();
+        }
+    }
+
+    @Override
+    protected void onStopLoading() {
+        cancelLoad();
+    }
+
+    @Override
+    public void onCanceled(List<PageEntry> pageEntries) {
+        mPageEntries = null;
+    }
+
+    @Override
+    protected void onReset() {
+        super.onReset();
+
+        // Ensure the loader is stopped.
+        onStopLoading();
+
+        mPageEntries = null;
+        mConfig.setOnChangeListener(null);
+    }
+
+    private class ForceLoadChangeListener implements OnChangeListener {
+        @Override
+        public void onChange() {
+            onContentChanged();
+        }
+    }
+}
diff --git a/mobile/android/base/home/HomeConfigMemBackend.java b/mobile/android/base/home/HomeConfigMemBackend.java
new file mode 100644
index 000000000000..03d038b1f2c5
--- /dev/null
+++ b/mobile/android/base/home/HomeConfigMemBackend.java
@@ -0,0 +1,67 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.home.HomeConfig.HomeConfigBackend;
+import org.mozilla.gecko.home.HomeConfig.OnChangeListener;
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.PageType;
+import org.mozilla.gecko.util.HardwareUtils;
+
+import android.content.Context;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.List;
+
+class HomeConfigMemBackend implements HomeConfigBackend {
+    private final Context mContext;
+
+    public HomeConfigMemBackend(Context context) {
+        mContext = context;
+    }
+
+    public List<PageEntry> load() {
+        final ArrayList<PageEntry> pageEntries = new ArrayList<PageEntry>();
+
+        pageEntries.add(new PageEntry(PageType.TOP_SITES,
+                                      mContext.getString(R.string.home_top_sites_title),
+                                      EnumSet.of(PageEntry.Flags.DEFAULT_PAGE)));
+
+        pageEntries.add(new PageEntry(PageType.BOOKMARKS,
+                                      mContext.getString(R.string.bookmarks_title)));
+
+        // We disable reader mode support on low memory devices. Hence the
+        // reading list page should not show up on such devices.
+        if (!HardwareUtils.isLowMemoryPlatform()) {
+            pageEntries.add(new PageEntry(PageType.READING_LIST,
+                                          mContext.getString(R.string.reading_list_title)));
+        }
+
+        final PageEntry historyEntry = new PageEntry(PageType.HISTORY,
+                                                     mContext.getString(R.string.home_history_title));
+
+        // On tablets, the history page is the last.
+        // On phones, the history page is the first one.
+        if (HardwareUtils.isTablet()) {
+            pageEntries.add(historyEntry);
+        } else {
+            pageEntries.add(0, historyEntry);
+        }
+
+        return Collections.unmodifiableList(pageEntries);
+    }
+
+    public void save(List<PageEntry> entries) {
+        // This is a static backend, do nothing.
+    }
+
+    public void setOnChangeListener(OnChangeListener listener) {
+        // This is a static backend, do nothing.
+    }
+}
\ No newline at end of file
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 66253b1be0f6..55b149b7f06d 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -9,6 +9,8 @@ import org.mozilla.gecko.R;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
 import org.mozilla.gecko.home.HomeAdapter.OnAddPageListener;
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+import org.mozilla.gecko.home.HomeConfig.PageType;
 import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.util.HardwareUtils;
 
@@ -17,6 +19,9 @@ import android.os.Build;
 import android.os.Bundle;
 import android.support.v4.app.Fragment;
 import android.support.v4.app.FragmentManager;
+import android.support.v4.app.LoaderManager;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
+import android.support.v4.content.Loader;
 import android.support.v4.view.ViewPager;
 import android.view.ViewGroup.LayoutParams;
 import android.util.AttributeSet;
@@ -25,22 +30,50 @@ import android.view.ViewGroup;
 import android.view.View;
 
 import java.util.EnumSet;
+import java.util.List;
 
 public class HomePager extends ViewPager {
 
+    private static final int LOADER_ID_CONFIG = 0;
+
     private final Context mContext;
     private volatile boolean mLoaded;
     private Decor mDecor;
+    private View mTabStrip;
 
     private final OnAddPageListener mAddPageListener;
 
+    private final HomeConfig mConfig;
+    private ConfigLoaderCallbacks mConfigLoaderCallbacks;
+
+    private Page mInitialPage;
+
     // List of pages in order.
     @RobocopTarget
     public enum Page {
         HISTORY,
         TOP_SITES,
         BOOKMARKS,
-        READING_LIST
+        READING_LIST;
+
+        static Page valueOf(PageType page) {
+            switch(page) {
+                case TOP_SITES:
+                    return Page.TOP_SITES;
+
+                case BOOKMARKS:
+                    return Page.BOOKMARKS;
+
+                case HISTORY:
+                    return Page.HISTORY;
+
+                case READING_LIST:
+                    return Page.READING_LIST;
+
+                default:
+                    throw new IllegalArgumentException("Could not convert unrecognized PageType");
+            }
+        }
     }
 
     // This is mostly used by UI tests to easily fetch
@@ -81,6 +114,7 @@ public class HomePager extends ViewPager {
     }
 
     static final String CAN_LOAD_ARG = "canLoad";
+    static final String PAGE_ENTRY_ARG = "pageEntry";
 
     public HomePager(Context context) {
         this(context, null);
@@ -90,6 +124,9 @@ public class HomePager extends ViewPager {
         super(context, attrs);
         mContext = context;
 
+        mConfig = HomeConfig.getDefault(mContext);
+        mConfigLoaderCallbacks = new ConfigLoaderCallbacks();
+
         mAddPageListener = new OnAddPageListener() {
             @Override
             public void onAddPage(String title) {
@@ -116,6 +153,7 @@ public class HomePager extends ViewPager {
         if (child instanceof Decor) {
             ((ViewPager.LayoutParams) params).isDecor = true;
             mDecor = (Decor) child;
+            mTabStrip = child;
 
             mDecor.setOnTitleClickListener(new OnTitleClickListener() {
                 @Override
@@ -138,16 +176,18 @@ public class HomePager extends ViewPager {
                 @Override
                 public void onPageScrollStateChanged(int state) { }
             });
+        } else if (child instanceof HomePagerTabStrip) {
+            mTabStrip = child;
         }
 
         super.addView(child, index, params);
     }
 
-    public void redisplay(FragmentManager fm) {
+    public void redisplay(LoaderManager lm, FragmentManager fm) {
         final HomeAdapter adapter = (HomeAdapter) getAdapter();
-        final Page currentPage = adapter.getPageAtPosition(getCurrentItem());
 
-        show(fm, currentPage, null);
+        Page currentPage = adapter.getPageAtPosition(getCurrentItem());
+        show(lm, fm, currentPage, null);
     }
 
     /**
@@ -155,44 +195,27 @@ public class HomePager extends ViewPager {
      *
      * @param fm FragmentManager for the adapter
      */
-    public void show(FragmentManager fm, Page page, PropertyAnimator animator) {
+    public void show(LoaderManager lm, FragmentManager fm, Page page, PropertyAnimator animator) {
         mLoaded = true;
-
-        if (mDecor != null) {
-            mDecor.removeAllPagerViews();
-        }
-
-        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
-        adapter.setOnAddPageListener(mAddPageListener);
+        mInitialPage = page;
 
         // Only animate on post-HC devices, when a non-null animator is given
         final boolean shouldAnimate = (animator != null && Build.VERSION.SDK_INT >= 11);
 
-        adapter.addPage(Page.TOP_SITES, TopSitesPage.class, new Bundle(),
-                getContext().getString(R.string.home_top_sites_title));
-        adapter.addPage(Page.BOOKMARKS, BookmarksPage.class, new Bundle(),
-                getContext().getString(R.string.bookmarks_title));
-
-        // We disable reader mode support on low memory devices. Hence the
-        // reading list page should not show up on such devices.
-        if (!HardwareUtils.isLowMemoryPlatform()) {
-            adapter.addPage(Page.READING_LIST, ReadingListPage.class, new Bundle(),
-                    getContext().getString(R.string.reading_list_title));
-        }
-
-        // On phones, the history page is the first one. On tablets, the
-        // history page is the last.
-        adapter.addPage(HardwareUtils.isTablet() ? -1 : 0,
-                Page.HISTORY, HistoryPage.class, new Bundle(),
-                getContext().getString(R.string.home_history_title));
-
+        final HomeAdapter adapter = new HomeAdapter(mContext, fm);
+        adapter.setOnAddPageListener(mAddPageListener);
         adapter.setCanLoadHint(!shouldAnimate);
-
         setAdapter(adapter);
 
-        setCurrentItem(adapter.getItemPosition(page), false);
         setVisibility(VISIBLE);
 
+        // Don't show the tabs strip until we have the
+        // list of pages in place.
+        mTabStrip.setVisibility(View.INVISIBLE);
+
+        // Load list of pages from configuration
+        lm.initLoader(LOADER_ID_CONFIG, null, mConfigLoaderCallbacks);
+
         if (shouldAnimate) {
             animator.addPropertyAnimationListener(new PropertyAnimator.PropertyAnimationListener() {
                 @Override
@@ -254,4 +277,66 @@ public class HomePager extends ViewPager {
 
         return super.onInterceptTouchEvent(event);
     }
+
+    private void updateUiFromPageEntries(List<PageEntry> pageEntries) {
+        // We only care about the adapter if HomePager is currently
+        // loaded, which means it's visible in the activity.
+        if (!mLoaded) {
+            return;
+        }
+
+        if (mDecor != null) {
+            mDecor.removeAllPagerViews();
+        }
+
+        final HomeAdapter adapter = (HomeAdapter) getAdapter();
+
+        // Disable loading until the final current item is defined
+        // after loading the page entries. This is to stop any temporary
+        // active item from loading.
+        boolean originalCanLoadHint = adapter.getCanLoadHint();
+        adapter.setCanLoadHint(false);
+
+        // Update the adapter with the new page entries
+        adapter.update(pageEntries);
+
+        final int count = (pageEntries != null ? pageEntries.size() : 0);
+        mTabStrip.setVisibility(count > 0 ? View.VISIBLE : View.INVISIBLE);
+
+        // Use the default page as defined in the HomePager's configuration
+        // if the initial page wasn't explicitly set by the show() caller.
+        if (mInitialPage != null) {
+            setCurrentItem(adapter.getItemPosition(mInitialPage), false);
+            mInitialPage = null;
+        } else {
+            for (int i = 0; i < count; i++) {
+                final PageEntry pageEntry = pageEntries.get(i);
+                if (pageEntry.isDefault()) {
+                    setCurrentItem(i, false);
+                    break;
+                }
+            }
+        }
+
+        // Restore canLoadHint now that we have the final
+        // state in HomePager.
+        adapter.setCanLoadHint(originalCanLoadHint);
+    }
+
+    private class ConfigLoaderCallbacks implements LoaderCallbacks<List<PageEntry>> {
+        @Override
+        public Loader<List<PageEntry>> onCreateLoader(int id, Bundle args) {
+            return new HomeConfigLoader(mContext, mConfig);
+        }
+
+        @Override
+        public void onLoadFinished(Loader<List<PageEntry>> loader, List<PageEntry> pageEntries) {
+            updateUiFromPageEntries(pageEntries);
+        }
+
+        @Override
+        public void onLoaderReset(Loader<List<PageEntry>> loader) {
+            updateUiFromPageEntries(null);
+        }
+    }
 }
diff --git a/mobile/android/base/home/ListPage.java b/mobile/android/base/home/ListPage.java
new file mode 100644
index 000000000000..f3c911095b84
--- /dev/null
+++ b/mobile/android/base/home/ListPage.java
@@ -0,0 +1,185 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.home.HomePager.OnUrlOpenListener;
+import org.mozilla.gecko.home.HomeConfig.PageEntry;
+
+import android.app.Activity;
+import android.content.Context;
+import android.content.res.Configuration;
+import android.database.Cursor;
+import android.os.Bundle;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
+import android.support.v4.content.Loader;
+import android.support.v4.widget.CursorAdapter;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.ViewGroup;
+import android.widget.ListView;
+
+import java.util.EnumSet;
+
+/**
+ * Fragment that displays custom lists.
+ */
+public class ListPage extends HomeFragment {
+    // Cursor loader ID for the lists
+    private static final int LOADER_ID_LIST = 0;
+
+    // The page entry associated with this page
+    private PageEntry mPageEntry;
+
+    // Adapter for the list
+    private HomeListAdapter mAdapter;
+
+    // The view shown by the fragment
+    private ListView mList;
+
+    // Callbacks used for the list loader
+    private CursorLoaderCallbacks mCursorLoaderCallbacks;
+
+    // On URL open listener
+    private OnUrlOpenListener mUrlOpenListener;
+
+    @Override
+    public void onAttach(Activity activity) {
+        super.onAttach(activity);
+
+        try {
+            mUrlOpenListener = (OnUrlOpenListener) activity;
+        } catch (ClassCastException e) {
+            throw new ClassCastException(activity.toString()
+                    + " must implement HomePager.OnUrlOpenListener");
+        }
+    }
+
+    @Override
+    public void onDetach() {
+        super.onDetach();
+
+        mUrlOpenListener = null;
+    }
+
+    @Override
+    public void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        final Bundle args = getArguments();
+        if (args != null) {
+            mPageEntry = (PageEntry) args.getParcelable(HomePager.PAGE_ENTRY_ARG);
+        }
+
+        if (mPageEntry == null) {
+            throw new IllegalStateException("Can't create a ListPage without a PageEntry");
+        }
+    }
+
+    @Override
+    public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
+        mList = new HomeListView(getActivity());
+        return mList;
+    }
+
+    @Override
+    public void onViewCreated(View view, Bundle savedInstanceState) {
+        super.onViewCreated(view, savedInstanceState);
+
+        registerForContextMenu(mList);
+    }
+
+    @Override
+    public void onDestroyView() {
+        super.onDestroyView();
+        mList = null;
+    }
+
+    @Override
+    public void onConfigurationChanged(Configuration newConfig) {
+        super.onConfigurationChanged(newConfig);
+
+        // Detach and reattach the fragment as the layout changes.
+        if (isVisible()) {
+            getFragmentManager().beginTransaction()
+                                .detach(this)
+                                .attach(this)
+                                .commitAllowingStateLoss();
+        }
+    }
+
+    @Override
+    public void onActivityCreated(Bundle savedInstanceState) {
+        super.onActivityCreated(savedInstanceState);
+
+        mAdapter = new HomeListAdapter(getActivity(), null);
+        mList.setAdapter(mAdapter);
+
+        // Create callbacks before the initial loader is started.
+        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
+        loadIfVisible();
+    }
+
+    @Override
+    protected void load() {
+        getLoaderManager().initLoader(LOADER_ID_LIST, null, mCursorLoaderCallbacks);
+    }
+
+    /**
+     * Cursor loader for the lists.
+     */
+    private static class HomeListLoader extends SimpleCursorLoader {
+        public HomeListLoader(Context context) {
+            super(context);
+        }
+
+        @Override
+        public Cursor loadCursor() {
+            // Do nothing
+            return null;
+        }
+    }
+
+    /**
+     * Cursor adapter for the list.
+     */
+    private class HomeListAdapter extends CursorAdapter {
+        public HomeListAdapter(Context context, Cursor cursor) {
+            super(context, cursor, 0);
+        }
+
+        @Override
+        public void bindView(View view, Context context, Cursor cursor) {
+            final TwoLinePageRow row = (TwoLinePageRow) view;
+            row.updateFromCursor(cursor);
+        }
+
+        @Override
+        public View newView(Context context, Cursor cursor, ViewGroup parent) {
+            return LayoutInflater.from(parent.getContext()).inflate(R.layout.bookmark_item_row, parent, false);
+        }
+    }
+
+    /**
+     * LoaderCallbacks implementation that interacts with the LoaderManager.
+     */
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
+        @Override
+        public Loader<Cursor> onCreateLoader(int id, Bundle args) {
+            return new HomeListLoader(getActivity());
+        }
+
+        @Override
+        public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
+            mAdapter.swapCursor(c);
+        }
+
+        @Override
+        public void onLoaderReset(Loader<Cursor> loader) {
+            mAdapter.swapCursor(null);
+        }
+    }
+}
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 476cb6c4855d..2bb5769946ea 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -210,11 +210,15 @@ gbjar.sources += [
     'home/HistoryPage.java',
     'home/HomeAdapter.java',
     'home/HomeBanner.java',
+    'home/HomeConfig.java',
+    'home/HomeConfigLoader.java',
+    'home/HomeConfigMemBackend.java',
     'home/HomeFragment.java',
     'home/HomeListView.java',
     'home/HomePager.java',
     'home/HomePagerTabStrip.java',
     'home/LastTabsPage.java',
+    'home/ListPage.java',
     'home/MostRecentPage.java',
     'home/MultiTypeCursorAdapter.java',
     'home/PinSiteDialog.java',

From e7993891403a4678d179a0c1926b72a045b69811 Mon Sep 17 00:00:00 2001
From: Katie Thomas <katiemthom@gmail.com>
Date: Thu, 12 Dec 2013 12:48:41 +0100
Subject: [PATCH 153/459] Bug 891194 - Changed BROKEN_WM_Z_ORDER to not be
 defined for mac. r=dao

--HG--
extra : rebase_source : 0947d2d97f3aa4d4707215f0d9bf90ba6f508b59
---
 browser/components/sessionstore/src/SessionStore.jsm | 4 +++-
 browser/modules/RecentWindow.jsm                     | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 8cd1649d111d..c983129091f1 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -86,9 +86,11 @@ const BROWSER_EVENTS = [
 // The number of milliseconds in a day
 const MS_PER_DAY = 1000.0 * 60.0 * 60.0 * 24.0;
 
-#ifndef XP_WIN
+#ifdef XP_UNIX
+#ifndef XP_MACOSX
 #define BROKEN_WM_Z_ORDER
 #endif
+#endif
 
 Cu.import("resource://gre/modules/Services.jsm", this);
 Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
diff --git a/browser/modules/RecentWindow.jsm b/browser/modules/RecentWindow.jsm
index 0018b502c70e..c328b6e44d50 100644
--- a/browser/modules/RecentWindow.jsm
+++ b/browser/modules/RecentWindow.jsm
@@ -11,9 +11,11 @@ const Cu = Components.utils;
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/PrivateBrowsingUtils.jsm");
 
-#ifndef XP_WIN
+#ifdef XP_UNIX
+#ifndef XP_MACOSX
 #define BROKEN_WM_Z_ORDER
 #endif
+#endif
 
 this.RecentWindow = {
   /*

From aaf58d52c30f37b9eb017a0e984a34a2ce2addc8 Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Thu, 12 Dec 2013 14:59:09 +0200
Subject: [PATCH 154/459] Bug 949249 - Conditional breakpoint should be kept
 after to toggle breakpoint checkbox, r=past

---
 .../devtools/debugger/debugger-controller.js  |  8 +-
 browser/devtools/debugger/test/browser.ini    |  1 +
 .../browser_dbg_conditional-breakpoints-03.js | 82 +++++++++++++++++++
 3 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 browser/devtools/debugger/test/browser_dbg_conditional-breakpoints-03.js

diff --git a/browser/devtools/debugger/debugger-controller.js b/browser/devtools/debugger/debugger-controller.js
index 7d91b658e3b2..ea42fb5ecd64 100644
--- a/browser/devtools/debugger/debugger-controller.js
+++ b/browser/devtools/debugger/debugger-controller.js
@@ -1698,7 +1698,13 @@ Breakpoints.prototype = {
       // By default, new breakpoints are always enabled. Disabled breakpoints
       // are, in fact, removed from the server but preserved in the frontend,
       // so that they may not be forgotten across target navigations.
-      this._disabled.delete(identifier);
+      let disabledPromise = this._disabled.get(identifier);
+      if (disabledPromise) {
+        disabledPromise.then(({ conditionalExpression: previousValue }) => {
+          aBreakpointClient.conditionalExpression = previousValue;
+        });
+        this._disabled.delete(identifier);
+      }
 
       // Preserve information about the breakpoint's line text, to display it
       // in the sources pane without requiring fetching the source (for example,
diff --git a/browser/devtools/debugger/test/browser.ini b/browser/devtools/debugger/test/browser.ini
index 1f8fc4bdd843..e1da1f0de68c 100644
--- a/browser/devtools/debugger/test/browser.ini
+++ b/browser/devtools/debugger/test/browser.ini
@@ -94,6 +94,7 @@ support-files =
 [browser_dbg_cmd-dbg.js]
 [browser_dbg_conditional-breakpoints-01.js]
 [browser_dbg_conditional-breakpoints-02.js]
+[browser_dbg_conditional-breakpoints-03.js]
 [browser_dbg_controller-evaluate-01.js]
 [browser_dbg_controller-evaluate-02.js]
 [browser_dbg_debugger-statement.js]
diff --git a/browser/devtools/debugger/test/browser_dbg_conditional-breakpoints-03.js b/browser/devtools/debugger/test/browser_dbg_conditional-breakpoints-03.js
new file mode 100644
index 000000000000..b7c080c02a76
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_conditional-breakpoints-03.js
@@ -0,0 +1,82 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Tests that conditional breakpoint expressions survive disabled breakpoints.
+ */
+
+const TAB_URL = EXAMPLE_URL + "doc_conditional-breakpoints.html";
+
+function test() {
+  let gTab, gDebuggee, gPanel, gDebugger;
+  let gSources, gBreakpoints, gLocation;
+
+  initDebugger(TAB_URL).then(([aTab, aDebuggee, aPanel]) => {
+    gTab = aTab;
+    gDebuggee = aDebuggee;
+    gPanel = aPanel;
+    gDebugger = gPanel.panelWin;
+    gSources = gDebugger.DebuggerView.Sources;
+    gBreakpoints = gDebugger.DebuggerController.Breakpoints;
+
+    gLocation = { url: gSources.selectedValue, line: 18 };
+
+    waitForSourceAndCaretAndScopes(gPanel, ".html", 17)
+      .then(addBreakpoint)
+      .then(setConditional)
+      .then(() => {
+        let finished = waitForDebuggerEvents(gPanel, gDebugger.EVENTS.BREAKPOINT_REMOVED);
+        toggleBreakpoint();
+        return finished;
+      })
+      .then(() => {
+        let finished = waitForDebuggerEvents(gPanel, gDebugger.EVENTS.BREAKPOINT_ADDED);
+        toggleBreakpoint();
+        return finished;
+      })
+      .then(testConditionalExpressionOnClient)
+      .then(() => {
+        let finished = waitForDebuggerEvents(gPanel, gDebugger.EVENTS.CONDITIONAL_BREAKPOINT_POPUP_SHOWING);
+        openConditionalPopup();
+        return finished;
+      })
+      .then(testConditionalExpressionInPopup)
+      .then(() => resumeDebuggerThenCloseAndFinish(gPanel))
+      .then(null, aError => {
+        ok(false, "Got an error: " + aError.message + "\n" + aError.stack);
+      });
+
+    gDebuggee.ermahgerd();
+  });
+
+  function addBreakpoint() {
+    return gPanel.addBreakpoint(gLocation);
+  }
+
+  function setConditional(aClient) {
+    aClient.conditionalExpression = "hello";
+  }
+
+  function toggleBreakpoint() {
+    EventUtils.sendMouseEvent({ type: "click" },
+      gDebugger.document.querySelector(".dbg-breakpoint-checkbox"),
+      gDebugger);
+  }
+
+  function openConditionalPopup() {
+    EventUtils.sendMouseEvent({ type: "click" },
+      gDebugger.document.querySelector(".dbg-breakpoint"),
+      gDebugger);
+  }
+
+  function testConditionalExpressionOnClient() {
+    return gBreakpoints._getAdded(gLocation).then(aClient => {
+      is(aClient.conditionalExpression, "hello", "The expression is correct (1).");
+    });
+  }
+
+  function testConditionalExpressionInPopup() {
+    let textbox = gDebugger.document.getElementById("conditional-breakpoint-panel-textbox");
+    is(textbox.value, "hello", "The expression is correct (2).")
+  }
+}

From 0e20438b6203c52393b42b82e7d5d70335d66a53 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A3o=20Gottwald?= <dao@mozilla.com>
Date: Thu, 12 Dec 2013 14:07:55 +0100
Subject: [PATCH 155/459] Bug 847955 - Let _getMostRecentBrowserWindow utilize
 RecentWindow.getMostRecentBrowserWindow. r=ttaubert

---
 .../sessionstore/src/SessionStore.jsm         | 39 +++----------------
 1 file changed, 5 insertions(+), 34 deletions(-)

diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index c983129091f1..218eb3eadf64 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -86,12 +86,6 @@ const BROWSER_EVENTS = [
 // The number of milliseconds in a day
 const MS_PER_DAY = 1000.0 * 60.0 * 60.0 * 24.0;
 
-#ifdef XP_UNIX
-#ifndef XP_MACOSX
-#define BROKEN_WM_Z_ORDER
-#endif
-#endif
-
 Cu.import("resource://gre/modules/Services.jsm", this);
 Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
 Cu.import("resource://gre/modules/TelemetryTimestamps.jsm", this);
@@ -106,14 +100,16 @@ XPCOMUtils.defineLazyServiceGetter(this, "gSessionStartup",
 XPCOMUtils.defineLazyServiceGetter(this, "gScreenManager",
   "@mozilla.org/gfx/screenmanager;1", "nsIScreenManager");
 
-XPCOMUtils.defineLazyModuleGetter(this, "ScratchpadManager",
-  "resource:///modules/devtools/scratchpad-manager.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "DocShellCapabilities",
   "resource:///modules/sessionstore/DocShellCapabilities.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "Messenger",
   "resource:///modules/sessionstore/Messenger.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "PageStyle",
   "resource:///modules/sessionstore/PageStyle.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "RecentWindow",
+  "resource:///modules/RecentWindow.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "ScratchpadManager",
+  "resource:///modules/devtools/scratchpad-manager.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "SessionSaver",
   "resource:///modules/sessionstore/SessionSaver.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "SessionStorage",
@@ -3217,32 +3213,7 @@ let SessionStoreInternal = {
    * @returns Window reference
    */
   _getMostRecentBrowserWindow: function ssi_getMostRecentBrowserWindow() {
-    var win = Services.wm.getMostRecentWindow("navigator:browser");
-    if (!win)
-      return null;
-    if (!win.closed)
-      return win;
-
-#ifdef BROKEN_WM_Z_ORDER
-    win = null;
-    var windowsEnum = Services.wm.getEnumerator("navigator:browser");
-    // this is oldest to newest, so this gets a bit ugly
-    while (windowsEnum.hasMoreElements()) {
-      let nextWin = windowsEnum.getNext();
-      if (!nextWin.closed)
-        win = nextWin;
-    }
-    return win;
-#else
-    var windowsEnum =
-      Services.wm.getZOrderDOMWindowEnumerator("navigator:browser", true);
-    while (windowsEnum.hasMoreElements()) {
-      win = windowsEnum.getNext();
-      if (!win.closed)
-        return win;
-    }
-    return null;
-#endif
+    return RecentWindow.getMostRecentBrowserWindow({ allowPopups: true });
   },
 
   /**

From 84e2a2de14af60feeb5988e06d496c4b96477002 Mon Sep 17 00:00:00 2001
From: Brian Grinstead <bgrinstead@mozilla.com>
Date: Wed, 11 Dec 2013 10:22:21 -0600
Subject: [PATCH 156/459] Bug 947346: Theme updates for Windows

---
 browser/themes/linux/devtools/splitview.css     |  6 ++----
 browser/themes/osx/devtools/splitview.css       |  6 ++----
 browser/themes/shared/devtools/common.css       |  5 +++--
 browser/themes/shared/devtools/toolbars.inc.css | 10 ++++++++++
 browser/themes/windows/devtools/splitview.css   |  7 ++-----
 5 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/browser/themes/linux/devtools/splitview.css b/browser/themes/linux/devtools/splitview.css
index a24d099ee22f..0eb870c9fb10 100644
--- a/browser/themes/linux/devtools/splitview.css
+++ b/browser/themes/linux/devtools/splitview.css
@@ -68,12 +68,10 @@
 
 /* Toolbars */
 
-.devtools-toolbar {
-  height: 26px;
+.splitview-main > .devtools-toolbar {
   background-origin: border-box;
   background-clip: border-box;
   border-bottom: 1px solid hsla(210,8%,5%,.65);
-  padding: 3px;
 }
 
 .splitview-main > toolbar:-moz-locale-dir(ltr) {
@@ -84,7 +82,7 @@
   border-left: 1px solid hsla(210,8%,5%,.5);
 }
 
-.devtools-toolbarbutton {
+.splitview-main > .devtools-toolbarbutton {
   font-size: 11px;
   padding: 0 8px;
   width: auto;
diff --git a/browser/themes/osx/devtools/splitview.css b/browser/themes/osx/devtools/splitview.css
index a24d099ee22f..0eb870c9fb10 100644
--- a/browser/themes/osx/devtools/splitview.css
+++ b/browser/themes/osx/devtools/splitview.css
@@ -68,12 +68,10 @@
 
 /* Toolbars */
 
-.devtools-toolbar {
-  height: 26px;
+.splitview-main > .devtools-toolbar {
   background-origin: border-box;
   background-clip: border-box;
   border-bottom: 1px solid hsla(210,8%,5%,.65);
-  padding: 3px;
 }
 
 .splitview-main > toolbar:-moz-locale-dir(ltr) {
@@ -84,7 +82,7 @@
   border-left: 1px solid hsla(210,8%,5%,.5);
 }
 
-.devtools-toolbarbutton {
+.splitview-main > .devtools-toolbarbutton {
   font-size: 11px;
   padding: 0 8px;
   width: auto;
diff --git a/browser/themes/shared/devtools/common.css b/browser/themes/shared/devtools/common.css
index 9bd0e1abc6c0..a8208dc9fe1e 100644
--- a/browser/themes/shared/devtools/common.css
+++ b/browser/themes/shared/devtools/common.css
@@ -25,8 +25,9 @@
 .devtools-horizontal-splitter {
   -moz-appearance: none;
   background-image: none;
-  border-top: 1px solid black;
-  border-bottom-width: 0;
+  background-color: transparent;
+  border: 1px solid black;
+  border-width: 1px 0 0 0;
   min-height: 3px;
   height: 3px;
   margin-bottom: -3px;
diff --git a/browser/themes/shared/devtools/toolbars.inc.css b/browser/themes/shared/devtools/toolbars.inc.css
index aca52970aab7..fed04f63c5dd 100644
--- a/browser/themes/shared/devtools/toolbars.inc.css
+++ b/browser/themes/shared/devtools/toolbars.inc.css
@@ -39,6 +39,10 @@
   outline-offset: -4px;
 }
 
+.devtools-toolbarbutton > .toolbarbutton-icon {
+  margin: 0;
+}
+
 .devtools-toolbarbutton:not([label]) {
   min-width: 32px;
 }
@@ -130,7 +134,11 @@
   margin: 0 3px;
   min-height: 22px;
   border: 1px solid hsla(210,8%,5%,.6);
+%ifdef XP_MACOSX
   border-radius: 20px;
+%else
+  border-radius: 2px;
+%endif
   background-color: transparent;
   background-image: linear-gradient(hsla(210,16%,76%,.15), hsla(210,16%,76%,.35));
   padding: 3px;
@@ -322,6 +330,7 @@
 #toolbox-controls > toolbarbutton,
 #toolbox-dock-buttons > toolbarbutton {
   -moz-appearance: none;
+  border: none;
   margin: 0 4px;
   min-width: 16px;
   width: 16px;
@@ -372,6 +381,7 @@
 
 .command-button {
   -moz-appearance: none;
+  border: none;
   padding: 0 8px;
   margin: 0;
   width: 16px;
diff --git a/browser/themes/windows/devtools/splitview.css b/browser/themes/windows/devtools/splitview.css
index 549f4cdaa302..2688558b189f 100644
--- a/browser/themes/windows/devtools/splitview.css
+++ b/browser/themes/windows/devtools/splitview.css
@@ -68,13 +68,10 @@
 
 /* Toolbars */
 
-.devtools-toolbar {
-  height: 26px;
+.splitview-main > .devtools-toolbar {
   background-origin: border-box;
   background-clip: border-box;
-  border-top-width: 0;
   border-bottom: 1px solid hsla(210,8%,5%,.65);
-  padding: 3px;
 }
 
 .splitview-main > toolbar:-moz-locale-dir(ltr) {
@@ -85,7 +82,7 @@
   border-left: 1px solid hsla(210,8%,5%,.5);
 }
 
-.devtools-toolbarbutton {
+.splitview-main > .devtools-toolbarbutton {
   font-size: 11px;
   padding: 0 8px;
   width: auto;

From 48eded32c87edcac585fbff61866007568594877 Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Thu, 12 Dec 2013 09:14:12 -0800
Subject: [PATCH 157/459] Bug 898843 - Update logos and colors in Metro About
 flyout [r=rsilveira,dolske]

---
 browser/branding/aurora/content/jar.mn        |   5 ++++
 .../aurora/content/metro-about-footer.png     | Bin 0 -> 103796 bytes
 .../aurora/content/metro-about-wordmark.png   | Bin 0 -> 5832 bytes
 .../branding/aurora/content/metro-about.css   |  14 +++++++++++
 browser/branding/nightly/content/jar.mn       |   5 ++++
 .../nightly/content/metro-about-footer.png    | Bin 0 -> 95994 bytes
 .../nightly/content/metro-about-wordmark.png  | Bin 0 -> 5770 bytes
 .../branding/nightly/content/metro-about.css  |  14 +++++++++++
 browser/branding/official/content/jar.mn      |   5 ++++
 .../official/content/metro-about-footer.png   | Bin 0 -> 72541 bytes
 .../official/content/metro-about-wordmark.png | Bin 0 -> 3751 bytes
 .../branding/official/content/metro-about.css |  14 +++++++++++
 browser/branding/unofficial/content/jar.mn    |   5 ++++
 .../unofficial/content/metro-about-footer.png | Bin 0 -> 95994 bytes
 .../content/metro-about-wordmark.png          | Bin 0 -> 5770 bytes
 .../unofficial/content/metro-about.css        |  14 +++++++++++
 browser/metro/base/content/browser.xul        |   5 +++-
 browser/metro/theme/browser.css               |  23 ++++++++++++------
 browser/metro/theme/flyoutpanel.css           |   2 +-
 browser/metro/theme/images/about-footer.png   | Bin 129698 -> 0 bytes
 browser/metro/theme/jar.mn                    |   1 -
 21 files changed, 97 insertions(+), 10 deletions(-)
 create mode 100644 browser/branding/aurora/content/metro-about-footer.png
 create mode 100644 browser/branding/aurora/content/metro-about-wordmark.png
 create mode 100644 browser/branding/aurora/content/metro-about.css
 create mode 100644 browser/branding/nightly/content/metro-about-footer.png
 create mode 100644 browser/branding/nightly/content/metro-about-wordmark.png
 create mode 100644 browser/branding/nightly/content/metro-about.css
 create mode 100644 browser/branding/official/content/metro-about-footer.png
 create mode 100644 browser/branding/official/content/metro-about-wordmark.png
 create mode 100644 browser/branding/official/content/metro-about.css
 create mode 100644 browser/branding/unofficial/content/metro-about-footer.png
 create mode 100644 browser/branding/unofficial/content/metro-about-wordmark.png
 create mode 100644 browser/branding/unofficial/content/metro-about.css
 delete mode 100644 browser/metro/theme/images/about-footer.png

diff --git a/browser/branding/aurora/content/jar.mn b/browser/branding/aurora/content/jar.mn
index e22cb11c088d..3946423387f3 100644
--- a/browser/branding/aurora/content/jar.mn
+++ b/browser/branding/aurora/content/jar.mn
@@ -17,3 +17,8 @@ browser.jar:
   content/branding/identity-icons-brand.png      (identity-icons-brand.png)
   content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
+#ifdef MOZ_METRO
+  content/branding/metro-about.css               (metro-about.css)
+  content/branding/metro-about-footer.png        (metro-about-footer.png)
+  content/branding/metro-about-wordmark.png      (metro-about-wordmark.png)
+#endif
diff --git a/browser/branding/aurora/content/metro-about-footer.png b/browser/branding/aurora/content/metro-about-footer.png
new file mode 100644
index 0000000000000000000000000000000000000000..309912c1aace89e84bfa71cc7c503c36bc569fdf
GIT binary patch
literal 103796
zcmbTc1ymf*w=N2U4i?;HaCe8`?(XjH5G**s9cGZ=PH=bE0KtP>aEG7)0$hIobN=VO
zyUw}yt@UR0tnRA4zpr*}sqWR)(W=Tas7QoJP*6~)a<Y=@P*BkN|NIf*-+N5dz@Oev
z1fEj5o*FLJp5A8eR#0M=F6LGsIVUq4D|IU~OJBF|Rv)3DU~KI)bv<>J6a_3?oLJ2M
z(P8m%a(zcbL46eQaW%7Wu<`_%TiMt-3sGEl_ELcCEQKg^xRuzHTqUe*?PUGjtu*|U
zH7)!cEch)cM1(;feFWYKoUA;}Kt4{6&K?3jLKOev6?nh?r<;`m^e+`p2O*08FiKZR
z6(r%}ZUy3I;bgX8V`m5P@UXCRar5x7Gl4kR*g06)-VYvTb}j*K9sv$s(0~3Y-bZt{
zv=&g8l>X1L-djQxww|7@0<5gw-rg+UoGdQxHmvOY{QUoLaBwicYcPBGI(wS=Fgtrt
z{+mJ4%EQ9l&ehY-#ToPuqnWvjm!}ZLyQTjz1t(V}rT-#!_V`any}OLn$IO+LorR6n
z$?2bY{Y%@!Q{C$SG2?&K_R#cowPIDb@^JBTw|I|-HRZp-@4oxL5A=`XyEOtT?so4%
zF>{o3vG8)Ta`u#y6ry;Suvpqz3P?-vvvKfq^KeRXu<`J*v-5Fqh)GCrN{aFDh;#Gu
za{Qa)f5dW2@=39=OSALxNV2m_af*qti}OkFOYpIA@ba>=i~k!d=j`EW=4@g0?{V$^
z8TUW1QvX-1fP}l1nWu}pri+W?zcWD9*2UAs!`8(WB%#3rqEj-nuyg*WgZ`fY{l|PI
zt=#QCSy@WEyEuXV<zWH4|G@$-9!WM%c4;Y2HV&?T&s<zWoS%n}OH4{iN|NF~v6laT
zyvF)&4C_DX@&8Jfe|Np-;6IoDmHh9G|0*9V=l7a%e=m+4;!{;9=;T5<Nij{I)w6D3
z@Se6W%To?z#r=ts-+jQy?uHMvqqd;q0p_+9xhTsoXx{H(XL~GEzH*zWtUz*T_d$1{
zf;eWMtAsP60;oR$i0>!?#mRHOY>{}Ld92sz?^k)TN}cnZCpDM+&F^Ex^5n9BP?may
zCIeXhP;l$<H6BQw)Y`Sr?BeTxMmWtXws{SCZ;F2XS0De(!Mk9>VADPShrvG*V%wX4
z#LNh*|AI^ypf&v?zJ|a!{ck|ui4dOu4fx+E{|)?al>Z6*Z<PN>TU`Dv`8VaiZTT-N
z|G#YcKTdBgll#GuFM1#BaBZ>!6wc=4FXrUC<sBzhoO{A|A}F!?0J}&zRF0@tc86K5
zbEL)s2c33YulNkM1rof_?qLw<H?3NsI6Wdhj_GRD#=^ro%mmWf9Y%tN075Kt4rNDf
z(U7aN(`e5Y;jlJv&k2Q5RpHp>*UQHEze76jK3~IXVuvY36Y^UYhw|ZfS`{~F`666{
z-Lo7eyclB@hd`o+5#UD+nmL=068&>a7ebR1i3u~h7|h&fXO?~3j$b{Pe5x44v+-ln
z>WO$S=ltj;qo{S(FBZbDpE`k|e^HnyAU~0&CzAV?^sk87e5mnj!p0skl2^$SPx6Ki
zIq(={`2_1>?%zhiS52u~TGEexi$6dbLhpp^ZwUQuKv{Y(MKu!(UBFp1-!_4@KLr^z
zP0<!q^5GO2^_!oWJ=p;w>IlY+$4wxwen!u{kaocxQngFT9piRGI_GFtVt?7_AZ!c5
z@ru)JTOLHvE+FXD;qafh2?;m8h3bF8v^0`asYMlN8_Me^4Z>J^ZiFpmge_#wN}Uhy
zY27aBM#n^70``i-6=F{EK^N|RsZRqzYr1^E=|lyTLd|<g{DB=2JEDVUgx2jrM@mTA
zEDz=dXu>qj+Sn#>L!H|OAJhc0pb#lTWwiJz0@zTAZzl(x0XrK_m&n`}+9ogP&=)UA
zJ|PCSj|pajhke8_?XOAi=`}S@gF=T{CqPPLNBD-a>e;<zsne>mowX^KFQPDcjlIo^
zF6i|2IA~jf&roRznW)vmaauaN?XL4G25z7>c&tdpM|zuR2J_@YiiY3pX;Jff7)TW|
z37KW@3WZ%&RRAEB?=NhrL7ig5hKDAphA=&}0j5R&*o)BQO}rd)O7#Mb8Ros+xQ^ue
zye5q<Ww(_q;mmYdHToD=1m;g!*2K2#5R6js<~uhP%b4GKq)y+YC-Cf66eiB}puVlx
zIGR3hyD&%mefn3>6A9YJEBy6#V%i|N#%nGO4%%o9hu(>e@<F6Wq($v_#Lx~hwj^2{
z>l9`wwA;^4u*Nv}Ir--}O$VzBgEnduu3pF6Xd#TWrYN6rA3itZ-u6i^<@@x1YC==N
z2%QfJ0Ibl2T+7Botwc&%k?#XmS*Gh-m#HI8@T(#CO|TY^{FFtA`lyJ#z*fa=eU`#5
zE8Y&;OPS>|54sMdJve0SzH4(ayDoQE)w5;Z;5E*~<SB)%#90cmlKz-`D=sKQ2{J!a
zlCve-<dL?oC|8@(6HBBzu2wLn<Lal5bZIAVzD$v^K5txq4*I^nhb~an6)aF`fQhM7
zLyPZkX9MYOa$8>6@WVe+#BiX_r73{|+GpQmH3f-IPN()jy|C1;^5`q0lCtY!E9mlb
z#TGWg@}A`f6vofdk+)vXr{!(Z#x2_Ci`GQupqKmx*r!r2oEXd+9ThyzNWembrFmRr
z9v0-%TF*la-0EGQowl3Vqnydi?QkuogM_oyF>ZK+psUowG^+ChXK}9Z%4U6!NcR`E
zF*CIDZsfUo0w|sG;E2e+Xb_czgu+LT08y7qFzfZ4gTb!!d*iKQLh|$yghx+`4x=?)
z@F@iI!P|47KA3jd#3(Y#z87{%%q^9-7c6EI4yeDn!Ih}xdVN-LsAlbh?X~E7ft3Y1
zC?TuFo<T`u%28ymcM}_(q$UR^T9P5s%cqD8#_J!)f*L&H&K)<VXN2jfp-VgRV71XL
zP@|RP3s-L1{d&`&S8o{cxA>!<rcn7lZ2>~OfX@CH${rZtj_gE@JXGJm1*N+mpqMS@
z=oY^maj6+{mKKNBDKRa9-J$BI*@6vf8D5%u>l9(aV9G=<e|KIjR#WEhap7k}G2#M)
zkMX~@%=wetS|?V>2smJS8<+R-o;61g`we+c47m!@Ij<;+8i^eqg$)gm2q>83q-#{z
zs%i<a&ToCutu-J>rc8hk?LE%=&P0hn&pv09b|1{Mciegjj{C>a&)kvb<Gs$xqL>IV
z>k2ja;}JpWc1r;mCmhMpD$DRbm<Qtw0M=}UR&J^g)*ENL84*@#qYqBBzoe1YQrP~<
zJYavFSMa`3`Vn9l;!wxLt-M+f7+!uF+S}8}BYj?YlrZ-xP`RYFR#*=IZetR25KX<X
zw7~x6@{oVjs&)(D7Wxp1sEKNlGJlJ`Oh~EQl<2E8Lj)$?=FifULtXq8voZeS`<?R{
z39inpwK`X@nd6*{4pj#|L!Q5{0&>R=yppViQ+7<pGlI*Kj{&KAjgF}5_5wFDu@DIx
z>CTs>piT;VeK5OJRp($Rr6*&xhW%cK2VrZdug3Y3b<X$uKCX_Y&I4+24`5-(xm@Y+
zwyd6z7(IakehE`Zkw;W-xtn*qO=ep~Q2LNLLo8LLjLK$aXx(HuD>FG5NI_gQ(~N!}
z!w_3O4#DDkRiQPhSO<gQtHssg<{R^DS?iW~?)j$;{<6q8i0HsqC$UjbK|xrmH=qbj
zsmmkaQ^Voq9##Bc(?%;Z*16$X&oD*vB-w<*o}Ms%?ut7VaKvea(KhxkR80tf`v`sZ
zqI)eYNAbnC<|9%Qq}(l(DF0y5pV<Xw$QW^?7UH1&4b|BCiIt3+4T;Q5bn?>;&u|j;
z{C=~5A1#@7-?)O570S&Bul%npe0Jzh$t~%$peN=()v2&UDKD78{wyS^ETtOx4{122
z$iq<v;hL~*=D85+juwtwiu@avH^%Pc-P^r+q+}fgeIm(%1v7sGBvZJ?{V;MApJub=
z*R5bWtm8uoF&*7F-96E-Fz2bU-SQH?N@IF&jke;?dARoiwOMbaoDJ@*GMC|Kh=?b!
zRSW3`J!!D{!9UsCu)R6y)GMI0Pf$|Vr28Qd)q{ZB1H!9sQp3VU&yfU{2~c1w>M(o&
zSH|jE=1XA2AHKSTRALFL8na1wUEK?#rwKY87MPmxULG{lZNiV8N((hzF)YD}2Laxg
zH`SO#H8g>3Cw!}*!#HQ{h7eC!Nd9<nF8NC9C#ce0enQ90YZVP?u>;6Y0DTynd3&MQ
z(i0W)yyu2xKB0+emAvWc=ZxU{wWImg7sB(c{0|Js5UYB{S~p}v-@ksipPhbuYKu$y
zX>&)`xX2wBaZp{bqM{58uY-PIO2v79d<nU)@7IybEw9C!7_YlaWsE&bKXCRouDfDJ
zVD!fF2RAwbbhe7*n4xVNKX4Bx0xBt9&0SG)O3>Ejp@&1mI*9W15!I4<YUVsZ=t$)a
zqFJ_e7;H2R!OS?z0?dhhm_Szwn5qg3nZ60;^K_YQ;>bsue4>y_BB^TXGu(vCi%1e?
z9c+31^pbP+tnC_ji{U6CosjCefQ?XJPcXX@yZ)$}NHE~uJ;#`JrsRa)PAsHO2h<=a
z_v{0oPRO-QB7;sU4oaA%G4F8xO@q5AOy^t?2tRu4<JGZAU68+7r|X=bA|cr3R_EjY
zHybq-Q+LFbXUuZmT@1Dyx9;Rn@qNXm<sgr!-y*hc99KotIOOS@bHv#%#4qT4!#lX=
zul?Hjv)$5-b#z<;CE&@cliR#nD_`ZdWodEF2pfgkUlLSBif=F9xZ7c5EAkQ9ru~Z=
zz~;NpGlO-ogDUcEAjTi5LX(AfDR@;W$;u30B{KQD<*5D`{HUS_S_X>-W-$PS4lK8Y
zhMFG{-9=A<GdH^i7a+4g%GjIc8R;6spbL0WwNX!63;#RiE`rs;SkX;r*k(y%Pv$#W
zN4esJXk5dPgf=M5{-QQ8kMtB9X&V{(2?M#rthNMNuRS$BSkM45thVsH4AHgBb|okv
zigGE|X7bXCmPRBx4BXoXFfoVA3e%JXs{PHftOxc<Z)X7vIQiuifU_NSAYRlsijFSD
zx2}R@<b|K=qKsx*6>{zi>>>n9ASTy)Xy^CG`R5R5?I~GCXFln!<6gzBUw?Ndl`i(8
z*Z3iL<p^<zf4nGBxwxrgP>#h|MQgG0RX;^H<JNO@hu6{O;cdrjf}Wd~jw^+!pVeEZ
zcZG|BrxuMVlPqwRQhqft)wfFKSNLSq9n=qSEDgnOngmd^GVu`dq%n(F_b?^nR?)FY
zjK-mu_v!rZP15sJ&dY;UB5#TeUZv4ZnNsd9?bjALd2E1aBkDaF@$G)~tdsOmgOl!~
z@6XHAj!U2I7(WE{n~+l4I`Ak`7P<PNUlguJ-kigB;0+?@DVRR9h0b0YAFHeflq|dL
z@vba9y@g0vkoA2uf&Iatic3i!Z1tO0XHAlVi0T@ERWHB^0<oQ@V00nj!dTft@p3i7
zR|JH6I>2WALPG5lPv}zjT-@|y$FhcTe3aXAKi)P3EYCny;W@iR{#BYcaogm2wzAnd
z;^l`#RYzcn+trR=vp(!MJOJ;6qg_+F{lZ&z*GB6&mWJnGIDJk|Yo&d=;)=F}5>^CD
z>&zx$T$<Is`Px5KiPBhY6LNs3l^-qm`%^F`KTTCt^pt#;9$}aC*iWM&A{fS`)En|F
z@|wb&!gHunYsi%4iK6JoX0@bo)R_QA_s2OrFz-wCffdq~H3z*svjA$5!Hr?pQq$@f
zZW|KMeGWzXonB4W6WHY)3|-1Z;}l_;>oTmag@;Y7wX-rx3@FH<2pD|c{ocLNb-uUQ
zf(;j8j`r6Qux&DG6vT|NsMbwUP!LLh5o(oQgy1?~DKr?B-Iacmr2t|Vj&7e_q#@A<
zc*z17!E{ZoyGi%P@4>(PbwgM;6c}53_+e_t6Vrf|fEo5u8|i!<cyna4F>q^~Al1>`
zxeMqnOya?78_Fe){Q-BoURHz06HsNayVJ4d1GK&u4v%#CjHs1Z&@rP5U(>v<^Q)Sh
zz)6b{LkL4PL~rt>glU!lcAiusTWT$JiE?oQH8$RJSymuQk43>4x#%Gy+U2isdr*1e
zkI5oLN`A581R{-nS?@8XdgdJJCGKl+i40lntLD%7mhdvgl2b=81eN&#Ti)@pI!28;
zFmg--HBB$ZA|K8@Qo`rekh6np9*NIYLr;x?i9(UOHxsk08v-l6S0;hH>wyoojTOz8
zyOBIy2nthjX@d=P(RT;3x13RkjwH*{oTaGNj%|42XJ^#ryLg;`wK+7%C)K!oI1c7N
zwZk&pNy4_IoQ}(|HE*En0~^+3xc$`|*Rp4GVF(?Y@gV}+y*}3yQ<ub#U7ZJ4PH0c0
zA*XzGnD%mgR<ge0<7gM&5@}1|dba?a?f_2w3IY5T{^<6XMsy=GDf5OOneYR-iQ>({
zJGRlwnzrn7L(9XIJQEx}bx4j<ld5Ly`cq7oP!q$9)`d~{^-&uw8D@2re#E+?dur-g
zwuO#{9oQ09z*wmv=iS4R=is$z)UR64V_zJEz%q^ygArD=GHvz>l4CxpX-D2FEk6=E
zn$wX<@I1xdX@Ye}%I^W@io<bcMPYf1Oo_f~j?J0p6~ZTH2Ml<Pqeh}xZ)fSc&zJO{
zY|qK+v4}*XOEav&rpU7;9qoPaws5T<vH2RD&A+?a)yCL1Vd|Is^wyx52){aJ70rVe
zKy4Ya{1S7kYI-`#gg2=Z(+l{O_WR5Y`s?~B2w{~IUYGx_T5DnB@kYkQ>+M;Bx6L5&
z^SoH<levxfbB{Yt#h0o|-^oqw1B14+;X{juwnzk##t)9gp_}Rmq#@sSsT-ggtKQf%
z$ccu*J_yB|7D6h;Fhrn6P&9c@Bg6ntVFI(B$&_rVSS1cBSLV?U^-6v_t^^j(t!H(p
z7cxu=#FUjn88|T&h(_hjuiOi>73{816`j$Qd@P*6F1<@6fv#ON&sP#%Z0u{v7vqDV
zP>o^ccMQW?+Wj&VInlIh>K&IlX6UnW6nZgkJgT3bbB75nK}h6}Z22oJ*m7TV5?K{~
zIPXP2lnabupge!2Hm4W6q^vrY`+QR$emriVwkiUCQc(R>gwPH<iFb{Qo$|e*$FiLR
zNiw8nmBvIvv`X~PZwRLQF~}t`xb6w9Y7zW(ku%}aWApd+==ve)YeOuY-J^*LlXk-r
z$gECm)j2ztMdOeKqmG4{tHPt>YVX;ey4hiyHljinKI#A*Dr3kwtD%uPm1Y)eH-twp
zsQov4m`SHj5>0e`+e%mgzc%EI``6<0k2C|j=>e)>b`GG=P9g4hJP1<e$)-5U6cl_=
zf~P7(AodeciP0gYE!K{rP!+{wxQnk5?5u_7wj?hGMt$0nARE&v)sj{CUvcXypiz8k
zSLj%(!qYYqyVP@B!PsV;_#dQOX_5MN??+k@Y{#~nyU+H|f{*Keet25M6=6Gbmemx)
zI<a9Lgu%9^IZh}N*znDy_ajY~c)Mxgg~>rj&Yq82X1k?-fj6{Ty-#{%!WN>Lhf{C`
z2a__?#s3YWG{RHSrYA>OZ5*4?DhH;uEwcp;_&x}c{WcExtAM6WDC&{Zhcw@FlK`zL
zvIxVeUkr`9pD9Yxsv^2}0@p!_06ey0f+=;+A)rGyhcf)~lN)&?1{2<TmDCzKo!S|$
zK0O%P1H(UrCKrKXT*YC%(vf)yUJXkb#lQg-Lm^fX1z?ZMb^g20*({uIa;Uz3uSmVd
zAtwFH70n{K<0nv-QkJ$WVcX{?G-#h_J8i-&n6VpVl<K&q^FB#!SegYT{e7xFX;Vg9
zqk|aLz*a-rwqzzeqo=<`w~JnMJG{T5--x>Jf*z|jvl0VGMBHxYFOr2Wt$qvy&><Z5
zV_4lh6P)vKq38%$)(`p6Q1lw^%1}&dE%8PW&l+|l8}4Gvm2A~X)p|?PJz*+lTGlGw
z9{Ky;8vC*MT`M4#Hkr34{w2;N`hk}WeIa)QPEtUy2~q3=D}v|&&)|T(>(`@;-m4Q1
zX7Vj6S9u!E<5Oddl^}j4n@&cqu+yjVIItGax2PCfnAlC7izU4?bB|<;m#EkpGJ;Rx
zI6PcT8K7&xm@J%i$L1LyT?hI2mzh5U_H_sJ{9;2IfzAk&k{NML5739l!LTFZH@*-_
zQ%jhU6k$R*=5jAQx8p1-aTK@hkX>m3=ha=&c-(|!5b?QFUz|13Y18`bT6bXzTFjdF
zpg|+<`SWF%pa4*tVP0LLZapa?2xsK04=J|!is(3;;?srnT!<f&oztSFj*YZH(uKKx
z<K5&J4l8B~dPw|<nE07Y<O{~r4_42|<fqQ{Op-j+IWhWma%}s`i5iOy-D3Sg_Tb9e
z6w{B~TWrP+lQ@{xu}HQso>8qlKxKoWb)YKF@*Jg7llUTa0|-m#Hfm#zvfd=qidNH<
zkvcp#84tjSzr#N3<ndnEcDPcl240e5+0{BCpF5u~y2%(mdc3X?-vL9W&_XEZtS0J~
z*`oPm%2o!msx8VB@YtIlV39al8RirI#9(9QKXEmK`_R*nPjt|pM*Q+Je;ROFFt!C(
z_>wj*GuaT<3Irr*pnf=&_A4KwS~uG%As{5v=S1eVwi(=Ms|f}DmJrH9LOf~z&RjXi
zJ~C_EBK-9eTr50{L4@j8;$i@C!)ew_mO~%bX_EEzN3XgjlU{xZF?`gBU=bD~t}?k{
zR+vU*#hFQ0-?nmGVVf16!1HCqRnbi<Oy2L$JF7rZq4Q@3=(=k@#CR!{BgwYw1XCnc
zuTSpez!LRcBbd6}e)+87`A<_Ul5k`ay?!3`{{49`$}T^2OipswU(&nS-58Mq?3jpD
z7&>OB%SkkdGi7qn&h$ejo{*542V_@*+i%TklJxwD{gl0_3`!qZ=It<|7}(C`W=fU>
zZgKYKaOSe`5O4UaiddX8;toUUDfO-_&0F|qUXygInxYpJ$g`YYTWWjDuGSuc<}`dI
zV+`OD)X5C>qs2eNLef|1v|?P1WZH@00{32rz|)TC((r7@_+*8u_o|uYg$g9kp-S9s
z2-dUC2w9l~e`GTlV&j!VOZs_{NN3axQ3CUuEF8Zc(W#!@>4lqE+gG73r3`()W=}Bu
z_)<QxeB{ovj$h+r_+j$?CwJ9XYID*=UEWp{Po6gp7Ng`=u{}XX-JN7mm8)5QJHIie
z9l0b;;!pJH*FEm!KO^HeXH6JQYlsF;KB>$D)1k^(^aO6(VJcNxM$C>ibgJp!?Xr`b
z5%rar+4=N^wOYRMeGjFF!?6FWA<bnCj*L=}qB=bI_2p_Ac~<XviqVfU=v5>PYgG97
zhw&faqPKFid7Fd-W@&hdyHl`3Kt_=awA7i_6HkXQ+PPX`iMRtPyFS6BQQFUFt)FJV
zhLmB<qd5n-4s5uNDH6X0`Z+jMX7SU(`UFxr1H;iQA-z5xgjF&?Y<1!o3w2HRrS#>-
zR-nnR@saK!^VUe)nOb&<02OUFdbaaXdcB>;>DB0Cgu@yAvw`GxH3d>-;ilm2O+E8w
zoMw|+9CQcNU+$TLKl@8W+@Sro1f!=&Xt6KV&~ZTbEa;Ol>l`3@W?D5QQ74hvJl3K@
zOP}6iQOpJE3AAGVtd2wlqj3$+&7>)2&1vd3`TYF|+TVzvc#kSXsn5*Vq8w`<Q*S>y
zmnjo)=t{wJoF`aK`rh}9+m7z6nkRRrf6O}yXi0S0OHTUD6(3Q$+-7A%yFf~zCQg7B
zWKF0Tu_x~WbKJhokLYjI5fP9REN!IYrz9X9+mh_ZwSukYC1>V3opz(8F1{y@(Wsa3
z6Vn5Hh3hk%UeNfGXfjXqILX<asg$?<1J%3#hIigTCeF~*w!xL@TU7ung$rB<*w!K1
zv{|~>0z+NEw6KpW-kCn>r$S_pUvh>(JYSPHC{bw?HO>bMbK9L$2AB#2cJIW}0+$a&
zpCwG|Cs1D_TVLgly)Ry{XTQXVTB$@?EF2yPtQu8{=4@QrZ!>8NVKYem1eTNqXB8?~
z>$yg^<IWl$nf^M${AARPGu#k1_<W$ctT*&M$QRv0MrXzWSxbfyRT;<`7X}}m+t1OD
z34`0@_Dyw9H`B?Yow_bi=8Nc3qy~zX6Kkuft^?ObqR@8cI9{Jb2A}c|f!!;8YjFc#
zh6vEFB)4&TM$Ts0P>PJ^T)=SEiA|$c>IAv<S=6`v1}Yd`8Zjl}RibIwq&rciF0A4`
zy{n`w(wRik76T+j-%Pdytj6<CAZ1bjV}gC&${4#SzUvpDd2nSjuF(MRptZ^tv0*sF
zGo2q6>*`8%&x`lqac9pFv+-xn@HHIcHZ?#MK+y}3AQKjPE8=mimfpP(O@cBLBj8gz
zDKU$aQXMl>qVpBeC;dwmv-l#0A$BILp7LaR53B}=F(pl;z<f+#owv!I!ZyszcHemH
zeY<T-B(^$!%&xWVD5Tc^@?~``hBdoA((H#Xxu0i|P*>qizaRWoM>iBW8M7V}FP0Ya
zJ7@Y*rlPb22G}qeu1?bHLg=5{jGEr{7xUI%_>)m1+$O4jea+a6zbVGV%rKHvM*RZq
zj%7;u7h2pPoJFjopMd0w5p#r>*r~zQW-d134x;_p6qZkj=jJ8ygMTJd$R#J0CDvrp
zsf}UWurt6B0u6_m?GB0x&Aqkw0;!2SYrfcLx;0dnVgkwF^A0PS2&qGS1P;j>+z}mb
zQB_j{1k^9}AE)f-{78IGTSL-EW(5846BKjk^uBS0vsXKnLw_&UiF4F;>-N-LGtU>g
z(e88jg<C6OGjZ9~Wb%ACvEF`Xvh&hR`{mH3*a89^0~&S%%&OdvsPnn`K_$aUq$Jvw
zHTVU|O;sm|6^02ye$^V9zyO#upsV0*F2x2C9Kb+tPTiN}ND|DDpfj5L#k19Q*B^6e
ziX?f>c<&F!!TXM_%n$Q@W*!0YV8VvC!;vl4fIl^f{&ZNe8=u{xq(AV@6&mP>0u3jS
znc-@#U+>4^(!RmnqA?ffF69cSf7O~lSM}dCye^DQQ@m<A_1@Vey6BrF>WM8gu7iJe
zX+s!RDiWyrsp79M<%p>l4T}1#kV&ETB_&v4%%tLrE+2;J4Gy>A=Ym*&kr|m@6ZK&f
z%3dAZLjml1A`NT;8lRMPllTwtntPhYAYgU8(UcF3+PA1sY$mP*=$}{LUA_M5ai8AV
zbDL*cL1EdsXq0y0P|P&%L}_%i7|8?V)zO`@)Vw{hW7rgV?`y6l_$Z6yF;(HYXu-R)
zlF=)s&qqX~+M0hxXY&5+wHQBs*rc<*?9Jq5-5mW`D|x6xEv^7nxlZ;`D<%|7?DUJ#
z?>4z9Q6sXm5~*I)dtR)R!S=c|(loPY*&R=;c90mLzeOM3gJMVNv$(LnjxpC)s{Tio
zKt9xo&U1>@Nze4R3aNRWsO9?$DnX%GW=vs7S5ltO%wu1AVCC&d#Ts$d22P>)nt@S7
z5lJSQHuyli@#iq7$s=~Qk11MY4{!WR1@*oVsL@^ycLF%;N0QeE5umBh4{VLkd#gO$
zJ~}LQoo5vJf+{$Q!E)!i^@2?2oRj|m&(4c({jC}m^MI7+u8zyq!4*tZsR>l0c4c0|
zSI)LCYNV(O@FwZ5-3sY+A@AUjABB`Vc41luh+D%UN&0>;j}|Ysxn@6&ZJGwn={08A
z0z7A5>uHGUZ}?(NP}0#naiNgEIu+q6JYqG5jKwuYN+Z3jpw}s<T+uYZP#l};X*sw`
z(~t|~#90r{Ck+3#;fuy4YFs0$^7TQ@zMh}mxP{<FAp5s={)oM_tfFzD)2odvec=Wy
zXN|T^(rLOAF#5U<q%f_IAiovB&*r;bBa6cY-WWr_NGn`D((HQVnoczJUb>r)75pZs
zH%!!$RxY_m7E2}0vT!TCS&Oiz!uhSj#KG_3@xCoifZxUPGBS!B6m%*Wi^ruM+>947
z-nh+Izl>!h<fy<Ii9|thl`Y&RS=CZ0NLH_ZTzm0w_p*3?t5((4b|%%y=IsL)@aNC?
zR=|fG1LcBk@C@V*+CeJwE36r-A~4$Bp0yjp(oDivq0(op$GXKhvo9OJMMj~Ws`?mk
zLxS+*nXv5yFE?Z^3qa~KovxOR|1*wj{EKOyKEZThF{@iQAqM9Fv=G=z<N51CWQ(eU
zInR6vv?LN$sw{kQFjoQtDi&ZYX*ML2n@>0ETvaA)*+MMxZe%OgW_>rDndPf2N0E|;
z9dlZSK{YwzB-GJKswq;`*OQJxO-s`+-=4Z1BZFmX8huL7K7AO!u$g^dU;GEIWq2{z
zH%99!QOk_Yr)-md&r<w}8r21tYJ&ke;?PspSp!ui8oCp{zg9c?pgZti3b$jKF(%W$
zh|I!@)HD4hFmEujtBLO_!zfX)q`^)Hf?YZC-y{l*OgvYmM#Le@3WKzSmG7_gxAYi-
zlaT;*I-l>oCxX0}OmKbN0;1}x8zgzJL{&^@RTg-**w`YiogOxMN{YkGS2P^8qcVsv
z!*DXzwTH*e@o3Rl%ss0@*Mc4b<L>>J8``CZ!tRrM8h-*pd*qar#<rhQ3g#SZ#%43l
zE2b{T^mSpYr1Y*!8A3qeT-3bLR+n2_Qe~QAs9LwB2jmB~9SWMfTvBF5N!n)BoXGu>
z8Is_7bVyJQ^H8bf4s4~P_$a22rFijd;!58{%HS%eFJm_29RWny;Tc$lVoX3lF0biK
z%SJ}Cu=;49`C_#fjO_{LY~<`gdp(mw1ZY@K868NdLSrz=p?|H@6Q*K$L~tPu1e%>U
z*sK1z`dRo>Xl(ck^Ff?ehM;i-r<&>KZ09UBdg__zpQ$cqh8GPxSpuO_fbC3*zsH4y
zzrcH{+o3u6F60yUW65C(`?RJVm|<Lra>@nQlrwNh#i<cVJKFi{Qv-ZN5*bK)Q}4G@
zyCm>y(NFg%3xsU%p!;6%*2g!JgzG7&SkGP`k_h+>Yev|HTyUAFZU`cEYNTlWvZ_O9
zw{z5m`v=NY9O6HVa^_8xKEG>)NgCf=@dzhStGXR22}zz%0Bv(wm;&C@`3)`K7Oetw
zgKiKnzS^61%b2d%74k?Qw$<mWQ^@CNYL^3nrX}Ia=YN*(u+sBywo#-ZgnX~fk!i4M
z#v+9&>m$&JNS>)zM*Uc^Y4JdcpE{BPDn7TbwzwdsX(pcHL?FaRL9#YNyJscNjj0m0
z&Jm6|Llg;uYpW-XhHjUFghDzZZXs9;on~NYxmiHa+(6<sGnxOfuqyt$Zc_M8OcMM=
zpbmtYr*GnIWBCl!8NlN6i{sDK;itkS6Kh9@#C9S^*F`+Lp@Yh9<j+J(tu2}vjk0kM
zu4;T<DxMQ_?TOCF>5)58o{cyRdTmMeJxHpm(YBfZLKaKqaM6+qGbYtvDB{xgY-S&N
z++g+I7xmcUP)zp0LdxZyTHm*;-Yv~nH<vF^UOG{cYpXL<hf0`<dvJJW6yW!5Dl-bn
zdq_aqDcqUQIK1M9P<4tLo;`}pL+((E1J8Cxt6^mA-`ap7S$=CYF4sq^)a9$}czKs|
z61$x~UX@>>y>cYcW(QZqHNF>opA-c$UN`B7?TU$3<U!M4e=XCKU9`A;yu8LB&dCyw
zT~05D{6x{wHZ}d|w2f6SpEOxkG_xEY9cibx&?SfeGht;r1Je{ENK})ZEddcLx_T)0
zsmycDmTe3kwCtE}6)wsH`ej{ssLOCDhSaA4`WoPjS*w8V#LQSaz8>Qa!8Hxr?@HTs
zqr!1@c&WFyaLrkgNPGB+fvK?Fxttl0|FIQ__r)*gcb4WK{zQ)GSkjG)QAF<-VdRZm
z^SXkhepDfH3HNrS(euiVUTA1G8=A7}6!dWF?~SxELGK&HZ_a*9EKlhlu-`5q-q@@p
z%(F&KltW=kFCEvxTxZ;4RH3Ah9n}tAZan{SsQZQV+(^_;+N%vBvVj|8fBM|JaUq{K
zBA0>h6HA5NZlvBDoQcuRR*vgDp(`tBxJzknCp833_sj*ma%9V-_t`pwlLfe|L!Z}>
z=lnzZi&C>_cWzZvEhsULy|m2NZ&&<9Zk@27VLK?Pg(xKFuT`nwSteYmnIPY|zO#Kh
zw^~W2R6#KN2%B=km-$fE?%Jg?`B@Js)}kSO96PnIw$5X1$j>#Ry}|M;YBt1)5!}H3
zBdL+HnBa4pk>eZ{BQLdwkJQtgHiqY6#JUpG&G51XO2a*^35Cf0^9-Hk>&DHvUw&#s
zB~#Mk9r=+pR$~CHnNGN}ige;EKBWiw*rbWnp#3u!kvmY|s6b&Syh6T9%{+k?s_cFF
zMSxwI#qf$0+TDF?zy8@x_B)0sdYA<am%wtW%p%59r{`cxpa~zWO=JjB_Nx0dfw<^c
zV|J;8P|xM@fuRV8xW@)<lvG#Lp&;_5HG61tnncp6D(<-RP?dl_fBtq>@7T<;FuY!g
zbmT<w%dsLE$dlQRkNao143~@h!XU@*=s~B5K+)8X`n8FIbj(b2S^f6Z`=5$$@S?^%
z7&CEY?wZ=jleB%^aqYnC1KlCx@W75zb2JnNjtTA%)NMuSS{zvf^eC!4vArptI4oel
z`mC{Ci-YePA=xTyak6CMif}7|VUx#Wsd1_r?Rw%1By%j(aipAPdG|}R2)g3nno)!;
zLN*i+N>%^{kN>0-<_r(eR)S!8CRxr7W&2Zc7L8NAIIUZfl;~&hZ{&frndr*j!sK1(
z?)fi)V%oMvI*s4oc2RqEANM3oJnLTzp=gi4q$(8*TBOx0P-!wZp$O~I5S=8fJHuVc
zqp|qE@&J~3*jK_bmQ^DSw)p~0F}hn4pRyX{yLG-{YtlZ93+Ov~Dq(!}##XC7!Vk)n
zEyZHfA_$&8y@8e)wpx}vl>IEB)dK!@#W#B%sM42S|2%g@`Qnv{gHJsNPf2h-T$C1J
z9q0_^Q>4<i9@UN++P1Q*UU^MTLD1!Zk_y3bjEbk)WQoXBoooL@24t;T6%sfKwuz!{
zU2&9dvZBb*=Ab;1FVb1I4_-nRu+%|xSjG>fJTrt^k(4*xyl+6n3&3T$*KL!G^D3Ag
zaL$Vi8Q&X*JDsbRI8`h)I8)fd1Ml)+_i)91H<Nu4lS5pei<<If4JWqk{ZN#SBwikw
zA-vPI&l=eAH=+HR&)y$EoWE91GDfa%Fusq@-0;24!n7GvZ$jUMWpqaoIlctv@A_Je
z4nOMa>vT`_kF}*aC%i(H))Ea*HI@zm0Yw>Z2Ht9OjB*t=O@=H-IXwOS9%@Y9s(bYh
zIXubHURnW%?gXIOe!6&gEG#LoqWr`+isA8aIQKy)@-*Q#<$+1b@g%CgvoY2|Pv4O-
zoXDT0P3wF5D=6OiLv82Obx8bi@fr~PiMbw&!LsAuG?fbpIfd--X30EBdY207oirxW
zw;kJHfgg30a=(Cc%jJVzUN}(|!NB7=?UKCKo#1A~FED1I!s3M4FnVg~{F8XXQFr6n
z2(T^W0P=W?9{Q?5ua^zFkU#B{_8$2GX&}bROif1e(tE+)ho#zzE-$|rQHR#V%ocdX
z4+2^A3tkc$1tkMKfqGC>E58;(d=39J#ru4}VHs`h^$ae3WYldm%NFI7lqOx!udRZJ
z9;%bU*?V<gJYaQmnin#9INj<8I0hZy{#~dQ!WtF1R;pU(jZKx&u6u;@cU^&C;=1@j
zUHH&zBTzzNGs)QvGZTQgZrq(|x2$okIV$JGLV4*UzNIpPzzU*6!M2AJ%}?n@nr`@O
z7L`I~VK>vurs?p@REPXTu!e$DAPsvVIalW}d(0lP(?v}F4#umKQ&7||_;_j~U(Og9
z<(z%~D8{K40Ma?e$X`G<wLb2+tDk!6{*V<3IA3j`OlA87tH>(p$;m|42Q@s7S96N*
z8%JgWp~j~BVTb<vXE8<4db>Sdhw0tDuY1$!TQgMBb1N4`KjkqO;b;yk#)2I`MT_ci
zEFBjq@LhhpYrE}m;&V5}cnI<*EOCe4&ngqwcA`syVyv&wrwpz>HiUIIXr-K1p@F?D
zTstbSGm<{@9!)$GcX1=o>D>W1-gf%9z7elZ2pK+($Fem9pmcX@Ahs37dATj&5>(HM
zLdDLl6If{D<7k=6p0<fkAPpqo$D-(=6V!&p{Y0Wz^hOYBhzNGJJm9E7PYzPG{M(S@
zk*Z$DbpD$SHgA3aN+G07SSDHiBbKlEGK%g4OJy!WVV3o6=e>@tB@;zLO_VbddDXt*
z89ff$p?o5Ly8pnNKKovtNB?Dd{YXy|4*rpLN$pzk#BAZ^QlVD|{@gBm%+yS&q(U?j
z=SkvN$UP9HL0!EvP5i9;`}3H|i{c~dOG@8(2h>Y~GCXD3a=|gNnn<)?)mVqCo-soF
z7hINr3+=z-{>CxAua_pn>B7%K*{xPZDabpp9JsN}ep$nii4IBm+R7L1lBOB^+q#>b
zX5FA!{f~dZVHsC^xgHzVOdGxcnXLyUMeb)$qE6RuaI&o5_t(%Yo^lBmS`%jKLklvS
z!uL7A4967IFu7C((MCO!&?)Lh-`{vrTR+3Z>EJdVTZZ~cS4O*&qMTc+)%^`NVZw|C
zp*hy2PFP}1n#!`Qn#qTgd<QW>zADmcZcC3MFt&9l*4KPRo4pjvq8nU9${;EqN6|M2
z{)or4mbMJ>&@f2y(OdZCHehL1{8hhHic1;4lr&|W<AVoKSMxJWGIde~6W#!dT7Ubv
zokzY9OcEF)ZQne~<#WfCH}7BfV=yCZ+Xk@1!f(}SA`#Vy>AYo_3zQ?!68@wMxBpGX
zlwLhRR@kK10+Z}-JdxW2v&M40n^64@NQ+D#P&LWT!BOa?OK<W=C?IZ8o-9D5Z|@0d
z5kYuy#))5fV&Ch7c|pAYmK)J$^G)ZHV$9ukE17m{(w@g8r0>;Eq~xDUE?upq0@$M@
z8M)^j&+U@nCCy6T%%mGk>w~mx^|mo|7@|7SFgG;ns4&`PAA_v`Xc_yy=u7M0ZHuiX
zsHBRGdUZMIhLCEEz=Hl*%Z-n5Cb=(}$p&~!4YJF{WHs|&IK?;Oti=`i`2^87N+&5`
zd9)E&WoN*~h=jIUCpdTbXaoh*U}a9$@E{$P+unARpiIa>!_l+59>z<ZR96dQvz{M{
zq8riidI>a-rbH2Cn|v<5{u7e|;{*SUFuB<MX&&9*U71bIKt2EUND<tD<jkFLv;wUF
z)~4&ytXGT-cbeKiKOJ1Bc@uW70&eKEy3&LVzLxKl67`fF{MvP>lw0q8{Jc+~ng*&|
zsoFxFJslG;A1XcOY`x6vdrYqyzW1Ugem;ZYlSkqHGo=<c>lOy^IuTFq0~5R%)?Aa)
zZEYr}aAbeaZvE&MGov01P#)CPATVWuIGkCtUm$%w)*C5+j&VGNrl^jWj%cW2`N|z!
zugE3F(}7HI9QHfpMLh)m6Mz8n(`#ksbNc|iox#`mVi>((vq^A4IRjbT&Uw!VW8#u6
z(@g6*qjQ?2bBqa8MT#pnJ#63k3aF`iV~MiB;ty}OseMh+`E7tLr^0E2E8j=~#Sc9w
zo!q&wW+yra;x?~HlVhXt2mpm+N&cdM(9p9thR@ewy{dkCsiKgHu7&_1tve@v<|cuB
zz0k2*E~IOo*ti0_$yTl3Lr=CCchNEA-V`*k?6K7fLJ;~E-?KjAk(R_FRj+!d4Zaqa
z>Y_zki?oc>dKa=mcflb`qXSs_Zw-5MB?^zh5yx|DYRV_e5bB+U@~Em0Fqyh2ucHMG
z6|yV}q;;^$W}QAOIBrfuR?#C_#ha~eT*!44u~C(ZSMwM;Et>+O_2-(A1GwC}0s>49
z#6<W)lB@WoNW=I^Wn1KqwKF$_F`X>ZE+-&K3+RkxMDNdr;C{8A9wjQdmOX{#&E#6*
z-uMf7)k-u!%mOg9{SdoZejGg^mh9G1dJw}7P|0u!e_pq(XJUwFF&!^PhU@q!kLqk6
zpVK&N&OehYoeBo|pKjs4-oJ<#_}z_XK{*?hHwBwvixbh@$2u0LTiX&QiTtivQzfg-
zS7+^`g<mmr-c7M_))uahy#JA}PG2l+5OF3?xkMMjgrV+f5W+Fk{cD4Du)u{>`eu!`
zuHvVJmpzd7Qt-=efg+m3q!!I%1SwR8Y#Dakc$aR9!|Gk0)tvpxR;<jiPUN4u7)fi@
zV3MqXSbSrCa^xwP8GH=MTnM70N_YW;17g*SKM<8n9|K7yWJ1SfatIehtwP44Beo$+
zZ%{`z)E?QF5?cHHybZ=Q%Ek>nkmGY$3Wnog3ooVJ?<oD`PDbD7k$BZC6Uks-W+jNT
zqPOMS0b4AT=WK2Qd=o#?Pn2VS(8bZP=z!OiIchlimYX=U>22tw2HEFJF6Glf{l{S=
zS6<I$$Yg$7(_rHbLfZUPvzDGk3k%Bnv0$bMn2VtZ3^?LyYZIjx3GtKJ?;NY~xq!_K
zWc&lYYQS9<Ja486RUCjM%P5Y_0AA#0!B2FBTXC~46kc>YJlz71b$K1m?~c!A>VcXe
z;>EQ3>!^cq>v5<8bI21}(@gk^T4GTYjp0^tggfI&@~PC?R&kDFJ&tr^4MUB=)F>G%
zc5U#=AU%8{YgnQbK{b>-b_H)f@_@6yfUbB!oNai8vZKuktWV=0tn+vbu2P`t((DJx
zwmI^hB|Sj8*N9~%>TX@7efIagBMP?bettmHFQkyl$%b|E`_&H|a99~uj20t#eSg1G
zcwW<@8zN5Rg$?s}OP=sxzWZe!#E7ai(z$(p`Pu1rJR>Eve9?m5GrT1;O{HNr6Qx@%
z5gi`mRO&U|EGot=Kx_VVr_4pvqacwr=)`!zUMjApqTE%78i!Av!L%Iv&Mlxh9s>%w
z=^)_qNzPVZiONR!oTS{U_JU1C)!zfdy+e3rGA+MpVy|V18zV<jM)R-<P21|aIb3^l
zGlH(2Y*>OTZfOp^IIv9}2RLr6?q_)ifGtBz0cEg5tV=;Ae8pMQ?d2<zsSRhhB`HGk
zMzDK}y!gPw%CS3Yu^}CYu)i3>MHaKG{pqZ)kH`QG`(j^MqZ^h{EzJx3kUsK|slQWr
zgQ{48H5E=KeNS**x9DCofTndKG{L!l>RTY>0YsqAr$RX@ZxYUBlu8+C-pnAVvr~s_
zK&}VdkQ^yC^ojB@IJym~l)yao`wxD&=8us&3dXwv_`f#Sy5Fwvb-;lR$&0aA3>KwX
z35?%C3j&pXC|t3cryL!XN974b%g<uZ<D`Pk!DS!)1p{xrbhc++?c$U*)oO6IHEdFM
zdvr|k$*kzqdQ;T&IjD>`GdY69>?}xh3^}4JPo&}|y%)Zh?{SIkU=*X+kdW;XeY2el
ze3pn9n6DVbBR;96SWGfQg%U?0bA-qB&+3+U6efaC8(dAwhN`!5kQZ#m>|`r$>{{jw
z$W>wq*6bLda#%uF(B*M!H6^GEOk1WwC}Kd(HYYuQb_o*^tn^$m9hQ0MgMR8Z1Z)c!
zy(Of;wlz@M6RYc2dBQNZGbENK={w0by8JpdY}s+-jror4#c71WaxYo89+}h=o}&um
zRDQYO_`8(~G$MOD@aZM0?ZTemlP+4*A<a~wG3xK_oQvt#O$CJ@zm$vEae<twwGUWq
z;0s-`CTGzWrLfjrx4+kG#!*V0BeS|k{qEv@<MIeguVatjXqKPfwpa)6KKe-2Bpy$I
z5F_f<s-5niqu)PR)s8)Q<p!MGd}Ben<$sN~YQvml2E{#?oSAQM@|gK85dvI7@Va(B
zD{32p=XtIVwT7_~`qEJ0mgk{Qp+e$P?P9gW&GklJ#^FcE$*{thi2g9)!f_WD!$9hc
zcwm28KphaYI0WEZNMx`LqHnPm7Z}h1wE*8#dIRbfw6x5!J1VUiS8?+C^IT?xm9COI
zI8uPV9`rDsF49Vz0}Z0jTO7M4m4P4Mm@dVb2Nqy%!3WxsvUniJTRYJLse?6?&xC9M
zrvTY6XUifQ*JZRSOmH28hacYyRY56qM^<QP((Q0n<f&p#M!5-&fyk>JkKZYMR!^);
z()6q2A=j77JBiN+wfE*v%N#LQ)nl?WYlatQ9rfWkc(oD%g>e=d$aLs8U`O3edv%5+
zzp5@c>Qq!z5Qq2%?nc=L822QSC}YDL$*daj7k|B>Sy-Xswoz{RcAm%^I@*St_~Xdy
z>D!xDIBZYX+0m}`H8Y|HFC)Xa?LPfy&v?|#{tp{T7>1Evnb?SpX=p^fL+6tQpH!MN
znaRpulZY1&W<N?KM@EmGCHIPK;J><yF6CI$dvMLPOwe7diwDb}j(m~yBY|y14WDp=
zE9R&&iQgNa|E^PFhI15=0^1U`(s6)r^P_3s(YjeHYffvtplvCvcNyJ$MP~UlcII++
zjyC@ebtZymnFhmq;7LuAf_zA%sxAb7kR;b5{{9S3FZIN=y`S|@Sh}V&KL@qyCQkXY
zNR-|-sBUH2Y80HT=e-$--Ru_<yr8vrvT)0h`?OxI+xZKye*3+1*6yL+cb@N@@$?r)
zEQwrkD4oow;!KuY``u6no?oNJ&)8?ry9Sy#;ox>i3c|@(>F7VO6(=ooTK7;n_nLx|
z$@g~ijCb<TQh>AlKg-%b@K}08j$P=ClmLK2-C9oJJ^NqAjyQd!2S$Bo<A|U8M0pSw
zGr1xwf)P&PEE$PWXf+h=w~?K&c`i!(+Y>iucgL+1a4j`QWHJl2;0xN|yhQF)Ci_dC
zCyY9kopk1c&tk+I^-x<HEPcxra-WUP9q>ETb91uef0xb2`&>TN`Oh=m&{}KhUFR?1
znAMh5h0BYZ(s01|MRR{8hm7wn$|9KMh53H?lS*PKqbaPHw)J{)z4Q?9few8vh7{Ac
z4}v-%mc!$x)RO!glXyw(;v)&5)2VZb&Q;LemDB-9j7*(1GOwu)iAwRS$|jj(E-!nP
zecqFYFlj$6t0>+l3=2DN1R?EYRWCnwOw4AuoUHvkW2{ukDK_|1@F_n=#5v#zzH6sf
z80PB|c-9t<od8p0rkb7<2a&TSroaKG&w2$47BU4pqI;h}a<OhtyKe26aXNr5qQAz5
zTXIB*7-b4c_(<p2C=T4%oj=MGfYWB^cbP2kKSTUM6VoAXW*P`v6Y%wA#n-$?p~*N{
zgGfgVbut+<fk}8qBbewD1lVTqB={vj0)E=LdeJQ?qJXDe=Fh`(A=zYXokCjAlEpZQ
zL;^^BG-RcRp9vh}l&?LE4*ZopZ<p63${2LuF7-BY`MQ6t#2Xl0JA5Imv~<^<4X>9B
zZ)j%MwD?<GLs)F(YcXvI*7lr@qlR=M!iQ|hdP7w(>WFmPoQ3}jSDUmcUHYml#>19S
z?1$H1@wRc=+lH;E=jTP+soZ`R=$8h?E^HE~-tw*NCUkW!v){RU-B5-hiNQBo8_5ks
zQ}~f9l!L$R#Ds|Gt-Y9&=QNY8vp#1$hysRyx~r><)37us^o&#RE8m!v>a@I8ZHLhM
zDy@X_zb9+#-|oW}b3}TTi|0~m6A|<ldv51tg#_)vhOQ9on-3@yxiVP5b|lC>RW=(O
zYY?5bA-PUp$Tb)|y~+P7f4;4IFxB`IC}E8K^csL+M>!DQBjqhfB*16m;FvofFQO-=
z-7p@?c=h3ux#!X%=;C8p*H0Z^U<R}rFv|@6xIy5-fp`OlhKZ{~f(m}}2eXB5y@Z0!
zY(2uo*O8$P%v`?>w5I0}&#yza@eUtC0<(rAtkvkDh!Y;M7&%;sjc<rp2dMo=t|FEU
zW9D=|>`b)=g5jeYkZRq4lDLO!ZDn%vT7Z>vyo7>JzhH5lMWPR!M(gGv7uJc_EI5hb
z36=Yf!zTpw+NVqspAA-2gLF{RzR7{hl)gi2*W&2rm~*aChS<be6T>81j8sMeI~l^h
zmw{-9pnq_5(S3Vg31uIq)K$P}=^Vj`sptma={^r&n84K`-nL3!XwY9!=ojB8X$5|f
ziM{P#NIxt;=Y(m%lK7dB*>u`q4N|Q?366w4t<TTq2+QS2*;5K@tjZ4Aq6*p2PxP}r
znl8tCPZ9ht07*c$zr>!DKr0zWr5xhc&lZ06Pu^Vk6>qIiAShHG0NdylfouF|7;ToV
ztu(qASyRTJ|Ksa$%?q|+Y_fvtSOu3}vKfE>!SCW@fBFsV**1ZZ8dC-|KhTjxx=5pl
z0X9k?IDK>(JFeY<H@*FOj2)OkVebsS^9Nr?;Zzr88MeD~45eZL1>eVoZ@2`7i7Gv3
zxccX>K>1V)mzO<M#)`yd8HU6g4DF`^>`_m~9&rx0im^+G;eeg4HajGOYoHq%pVw?|
zT6^jrfgv)oz<?H;7{^%ZHM``uB{M`HC>dsP0)DHcy#-8(8llsvnh-tX^&z4WI@ER{
ziO^PHLfCE+Fi#^`Ca~?aWw{MikdqgSI)W^qZBoxwxOH|n2baQI_XigR^#cU9{UdZC
z`Z7(T_E%FtYc9Y*TKp#_=9~>DA$9)8Ymq?#wMvMi54z{Q_4S31w8}n8H6dLVb+y{i
z0#^%c75IwG^x6ao$c}g7$PzyPvAtMa=;I3yydJwRcJQK~z7#+D+NYq?ZxgT^Z-u~S
zu_6h8FzXV8OSK}l76j@C=5Xvw52Hk#y0_q?u%U*l-}XEl9xLI_rjNV30@DW@=t-%d
zBXIBod$E1Gg=)=3_e?PJ3~q1nNZaj9Wm(W1YWNxg!Yl*!V#xbaRTEb+gjuoyv)#!C
zh6FwoVC~3=LAd}Ka%Dthr3-YmYuB<dIGXPu%nuz3<0l)hhcV75IYGK~$s3S`=Hp}x
zw$%Ey|7_T6Dy>$fi&H7qd|g80EN>or75Jt%zR)k+vyFB65fkF(n=g=fA4Fjc;tUJ|
zEC<@}|0MY1v&eo_DGMylI)&ePW$|B+HbRVT2#p(80<e*>OAWh<gc#PD?Xt2Q%u*LU
zVl}_^htI}yU$PUN`MCGH_v4kn@Kk*3U#D>Bp5xd|4A=M5ARB3{p-4bht}i$GxP+$v
z|M8cfiEn-WJ}lR&I7-vV>T|bYijH$wxVZ0*6L?^;jb-{$C;#;ric1|lrR<{iPy?-Y
zfWEVu?+bgx`&T@YR4|0Gt`@o~R<(R(uzt152w9_;CEAIhAU-&)ACL-!y-fqIh?uGc
z!U7p>cfbq50Deg4(q2SyV;N4hN_goTGfy;#ig+N6Bm?DX5E>~#YOoS;rMszQ$HwRt
zEY2cqE)dIIglH{lCaa?TyGlY(tX2`iv%8htcYtkq?rQ_~KmmPs+6c|QIe9H&XIX7}
z?FrG&3iqym`uO8;8ist7N&;W_u=km7-6^)N*&e9!aIwQbED%K6l`A4ra`^Qe5A&y%
z(Fj^tU!B0FEmgemC(lF3T|D#pjoA0C8SJ`XBO0@JVE?Vt*t}z0MS#gkX|L-m|5_PZ
z3oDU+6qQ&mJ2-fxfscP`9}d+jIC-j}T+Qa2JuFT&@QoY4h{^TiSW_)vkIX&0rie8{
z1rwoLb?q#LXGBd0yt_nt#?Gzn@xEdZEZO(*dkkd#O64pNk8rM8cFR(-K+26PwSNM#
zb`7zlwsnTliY&NVo(d9+r9UhIY;Sr6;c`IJe8-B=4Ry^mB^B^kMu_swDwi*n8&YGB
z0$WD!mp5v_)w)xyfY(M9nHBAZs>CS+AVkE%dCAhL&r-0heze}&aP=FULo>e(Z*o$J
z)<Wfh3=k=1B4)SgP#H0#5@!yy-(UN{fA=0Ql^!L|-gs&${L#@Za>~ZyOk8#}l$^eI
zT0V+p4-OwRq#c`?$Mau&A;u;u7#(GJ!7DDnpZw>WsiXP$Z|}Soydm(hcYOoTx_&#3
zY_H+2uOC$<z<d1wYqyM|-RPpV+(Ut;hmF}LyrPS0y{Jw^p3e$RLvQ-XUQ|_>t_LnF
z>wa$*g_45}TPD#a&|XjHHAZ0FH3?&a(<I_Q6Cg}-%07zso(Xu1;T5x!>g8+|zgyer
zB{F0;EfJ*8XIRj|FlLGrv$cUaVYV2uzd2``q4@0{yiM!D$2OvW-yP6te5?y<-V=5^
z1jt1i=$$yRw+v!nksr1MPMMyq-%-w`jx?xARxLbT6{tz9RwkQZ9#}}P@vZ`HA*&WB
zv@f33b83!B6xaXhm7V3+z1p1_{V<ArixRYT%ET}>jG0_>!U9=w&O_{31hk9ukNsza
ziuJLb-HP~-UkjA=IIyPi(fmcaNXc;8joU}CG}lqjd0YvAfK7I;BEwbB*n;a`dOp7X
z<$LkjPu_!V6Qk(OE#ZSdb0aSL$!(}i7I5IZ(`YXBRQd2wS2RRxr3b$ks?S<H)x?Wm
ze+5n+T*Td9n^L(C>JvJxo@BkQqm#zSw-&2joJ?GH(r3K#Lb%_WM(gmhs+w>{-OSQb
zQ_K*9C@oS&3E03~F3FxH(#Kf^FVj_Mhv_gw&e6^h%g;c~u(FB8S@~eIT)w)b5N8~-
znJ*s-)?9|ub_-}8?ZTNo241D9edsE~Ra9j|SFRCCSFK)l1^V-|@TX_NN>zm^tU$++
zncO9K${J#w7M%LH`pmH31~2G91%GiC+$+&iq25|n`4UtzE7wRIQ667@c7v^lpMbyP
zO>gj<AO5zxa@D_yg1=G82Exb(!v16FY(0aXhvyvVo)vSBa$P*OOHH6k%h;s2$*%;7
z;a3c5v(087qvI9)?3<sB+DHN2jvxQBbIU8Z^4UA^bH98o-v7R@;LHDX4>~KrH~;!R
ztgE=#|DEI5|Ii{9`~W+4jp4k@w&L#Z96_<-Y2cs^+L-U?V@j7W*Tu|K1C0ghSe|s%
zYU1htVHYla&Q>ffwBkFAnVMORxdvuWF5ua(dkXgKp1{fd)Cmjx(cO6>L%4>Z)gX%%
z!}Z)O(G;s0pV&~Nn62T)$!i|T`GIBXfMqq=A#PmE7`d#J;;V$v^H{fykv;XC8z2On
zqQJ=0FNHg~0lnEJ1Tt|?KTHLNM1xVVD7DtEE}x|nS*ctrVW*?OmPzO8sD!bU6apEx
zE46~2@`RESLnuEq=;<i3=uvc3f*Nf!JNu1eCHIfPc3k?qA*LAm&b$Fp#byn&O;R3-
z0o^uhy3G@RKiVc9<4Yz1v{GPy(`3PUZR!v*%W!}MY=u>hMn-SVpK9Sl@48i0i<RuQ
z-SSZ`yTphcY}{JIy?Y5z=jQOhzD2z8O;5wzjR$b!2k${;a~W5?WEVdAuJ7WKD<;uv
z3#{KXuIq%E88A0mgbJ9b7xA5&4-!Lmlyo2^gxf#=usW%ciAoH3-L_9mw}99F-jCvA
z@3<Y)Uzx(u@gk8ZSAq8#$)QMVtadR)AqE}8MFvn~@@iF2U@R@B+3$-rPnDB)ND|SZ
zOm~<~jIAEhn@Kt&QcN3z!3K=QA@w4T9OG%gPJu8_>9<LF3a*MQdVB%yd28TSLj{_$
zSa#SUK&5+3;vkb!L8*Yw!G{S<i?nX?U(ysw=EdfrgWk+E4Y)<{QU$^CBE6?T`<9Ge
z%VTc{832(~-8Rvw%<}7vSUfMBwP3>tZpx#7v9Y=7d2ewKc79!yisx&Cn34?)yVYRJ
z1_Ae+mJrSgpnWWZ3MG&h9rm2Q7ruVk*9k6trIWGP+8+U~qWCiZD>0Lq6DvwXt<*eJ
zXxhGXs!bisfk#ue`|du8YqoB~mAgjqr9ZnJ58k_oi8Tc{CE&JyegMyV`Gr`VY2x_9
zv#Lf|oVQh`J*5A71l;watGY~etfX~eX)GfUURms_{x0=ceNsYCRXYLpfA177fA&_4
z?VHAtI~Gw~Q#Q`<!}U~gI<UnV3c6M~niwwaVu`}iMpIyWI$7Zn!p2x8Ujk#R<XFIv
zslC08r$CZf8NSjW%QMG}O4-_ZOjrzb>iuqsKyscK=@JUEwENmR^`;VnrFmtr5}`|=
z>%(t!Wi@SZSxvL!=tvovca!cVX&+N*6Qyma*H=a`5w_KHR^$q3m40mee^uge^;{R1
zWikZ7WoFQ{)atVsY#m$zZ~HI2sz3kkFFEs1`y$Hzc?Mt&v(3l|G1waYHVwPy4CtN}
z(t&u47Ku}iRKq;+xrV%%gCsve7>ZOr13N9Cbla*{3plyhz!-tqFaGwAsNdP6Y2N!j
z^i=}KBL3{7KLsrH@GoE3r*u`$eQe)3foorK0h%jaoH(|E9x)f0u25>SDxD&I{yORv
z*X$WXsp_KJ5B0Der#lp?GOa2}V~}5JwSLdXk)tcP^&j@(sT&FylObkwej<2uLljF{
z7KVreVs*h_b%17%sGbc*`?5zoOiDM+?#9?@blR+}z+<@~jsRnWfeOL~T~&8|P%?-#
z(MUw*o~-NTsbuTHQWL@ADey`KPQ8Qz4ZNitqbTp5L}7gu)hn-tx4sT{jSF{O5ze@)
z){DD0!P_!Q;Ik3#mI)Mg?*LyjM!?&G=yrAZttA(zqK@i$Tf2Grk-Jx0gLG(Izs_O|
zD)Zk1KmUq%h2Ehx=(;C`23lFJF-RD$@u(E5LIiLQdDT9lr2~mWG;{lShlLYeBN>FY
z0nC~<Ckgf$`n>=P^DSI`)plHQ%_h9(_ik1UxY20i%1d_Ox@Yac7vFjdW{xzlaoxBI
zMhF`MEdpX*E8;6R9l-W=BiK~-(3E%0SOLomUDW9VFCY-T_T_u<u`fN0Q{S6It>$VM
zAbQR9bRos%g$}AC1$ZSF3$rVj+`Sf0xqbqdtSjK~KORD3wu|D3XIJAMV5~zcw_=DZ
zS7yVifGRT6{8fIml!w7--M}oPm^jTTvF!I^nPUvol(P(%oo3+{!_Ahp$p$sRs%)9a
z2#GdKEVbQ%phe-ily*uU0WA&0)egLM^jj+$>nizxF=+%lLDLtS^*A~;CMy#F*G3SO
z0*F}x*Jc}GRqM==T!0`k`U$XDT(RdAI%n_MY9Mn^s{fCP=JxB~%J+3&jjDT@?Sa5j
zsT3_^m>9~>a-jWTN(Z4zR?mLC?}o2x$hdLiWnd@Oj-q&Mhx@)Cph(mDJ=;d`wC8Tc
z3^B<gQ;S$PS;y`RCsarI+Ls?jsT*KDb;R)zoe~kmVs8EVAzVbi{q;}X1~$Enngs1~
z0p*=zm}<^qonk=_-us?AFzbgHBe0bD6kLa)P$7of?876lecFq6;^=*In4MVxn=IqH
zSDugEOI_Uinf>rNb;PRs1KeV!Tb_|CS6VWFh&0zBOf?ZmE$84taE&E_IGK!y!-7|n
zK!)4ZRtW$$#}#&%JR8(u)1aDRw_;GIO@^4XC&B<At9oC$q_8T^DZNC(9)gtz!HN}d
z0$DW^QObm`KU<g*9^8T7nUbYC!0T1o-_u|#!Mh+m70h?DjE;6%N|mg}IA^QhNhK;S
z;B2fn=Hh86Zu{j|bx(faZ=CrnZbqrU+tO(x`5<Dqc3~(xn(UluPgv<d-Ttn)K}rT;
zloTeG3<kq#qxUT~n|R^>bv~|n_IBLxSKq?tK7AJ^ChF?O?b6);_~9kA2&Mnid#=aE
z^J@wmW$yS60q364GWO7CP0&<dCVc5g&w{p({#`TJM$Ze>@s^rB)VGXaY+VK2t{)rV
z)@>ctMl<?F)@`NFBj&r@@8Jb6*o|HEc*~!C18te!Q|6&{*dWNA!8KmBsG#jFkVz0O
zR-fAs-$x7wVKFS4>ogO<LBgB~5nD}aU@RjoSngJAcz%Q7ESDRA;u$SB<C$QpuV{wL
z6Q(O*8P=pbRwWsz5^)Oy)jYW#M5UJkTmsH5Ww23V#$2-Do{|ovG!RJ$N;Z(mX5?eP
zt8*eK387{5-p*NDouTNw1?<Af|0y6-*D5cBkcF{qkbtcjjfFV(0QLzDv=Xn1E_-i_
zCS4t0v#Yowg2-gvviiHU?q9fPqYBCX!vDSpPT#}2H6th#wVd$4!}B=riVfJcbpjuL
z^B1suas^)5Q^%7a>e7Mk{Mup6FVc;#d@6OZlCHxEoP`Q5=q`70-Sc+PaW-OUsig`m
zc3OQLd0-A+fkT#x`rKdKi6aj!;-`M}0<1qchktwjU8rrJRKAsr4+pa|Hp_}(^R89O
z9GpSAkJEXS5BM4g#8Z8UL2%A$28o?5n^@*_)o9aozgS%EcbGIVJj9k+Kq}(b98>b!
z(r>emmH{nVk3csr;u;mn6gJo<8NCoEwhCl{0+lbDO%}k{7F6ag(Kotns6loBY<=^n
z641!<GA*Ow_RhMQHp2)?<8Rp&?3ns}wAl>Pkz%2+S?%e&dJeQdETEM`q087+p%eaU
z!w*evS#9|8&H6z0Jo;sq7TP*@L8FVW{mUWveSr#1(R~8g3ocua@y#`C-B1S}UPNVT
z5!-~LYH<ZDsoNz%ygXV`^`OE~#I?BWP}@?ah$FWj!S0LKU~*j@t(88VlMY~T9EZ-M
zgEk%O(hW6K?w!ZXu@-o>pvzC632S|{7km{!UCpN^9lA5fiUpX(h!Ykn#46`1k{q-`
zoZ)vETKzU<ElYvzu=-zOX#N9kW$!ZDt+3dw7E%r98rLhNLDpUuf(_AlMM|3%10_2m
zur*0%R6fnFs<go54eT2Om}Iu{QAU&bZJi`sCZCZ@x223}n$1eX8EvBle(Nk^xB5F5
z@N;l4c-C))V-H_~rhDAH6skW3ys2ohb5b@qdw|wxO8*{<91aVv_}eCdm(0;Bto*Uz
z5c(DQxIX*&yRe3)^AhMJ=(+{nkxnhI;Gx5__=6Aq7=G?GS0I>O0_Op|imO2-%vOwz
zYH_ht@|dV~>6|9Y4%UqpvD^v>oCEX;;G4^R+<){WE`0u0yzbQ(V9QDuOUpe~i%bP2
zi0^*@I~`t$A;5>#SZek)k)+61#~XN`7|wvjY9mA9MwNP=WwQbUhAuHE;#$m?SuA-l
z{8p@zGBHVyIAn=HS6Cn%v0xDaw#{m7Ku0>}+X7etD+|2D8BTcP(>)>+gtwPfaDwQ!
zb-D6RgVvj>Ob3%S>OI<Dme?o@{YW!0CX31WD=MHt&97wn5S$G;Z6)CAbdM$X*THso
z-%hMX=GW;AFxiCR0=XaU58oIj*=*TiZ|*X&XQ>ye+deP=tL|Gi=pq{3@0+%bVETAN
zJ@E>zN`H9x)Er*=<Co+0ue%Jlf8ci9d;3X@Z>lS;PwKJ^tAK{c<_%1y(WTJ>rth1_
zx9++HYtJ9UFa74Vxbq`-;@|eo;^{wj6|UJ*L+w-t-=Om^)|obAh}Df&*;%*1V5Dj`
z_yEkd;1737WW%)FVIBoym{eenD+e5A3~zC1C}CO3SMl$)m~F~vXGN5yf+^DJZ-!dW
zhIuO_^~F}n(iK;~Hrc#lZj$k6NCD_DjTRbw1!AVl;`_r0kCE|8&TgzaW^&3T<Um`Z
z8@R`5b~8c)Z$X9Zx@)$9m20$q3T(uj8`C{XsM=$a!OHxga(gc+gs2i{xq6W`bRKul
z1V5HXgpgI8Uj%Ra%U<3)`h^$pqnCUcwf>l4v!U@uNP5{h3btp5d)L34=0m@kgFkG@
z@J8bTqo?qz1COdeKpQ^wH+xa96;W0J20|ICHgBE4nCIc<_kJ5+`|ADJxoJ|lV@X+o
zWtbh$u&yY{{s6Gk`7AE`c-D({;_BC5fO~Ja6YP7__^r1+4@HOL({KDDW{LG4-%!J5
z8YT9)jtX*kq(Fl+b@58=FHW;l=756P=?@KTJ%V3eHorj%JhS_V)3~GwOQ&V4>$2%c
zx6=hQq%(G<!IKZj2qM;PGZKUtCQV=vbglDXk(?BLpD@CEoot4&<aHK-k}TXXPJmgX
zVOJ)oFNSa?M+ju;UiBL~ad^LB+_^$iUDv0N_EZ`Hrna|rbp`@n=~gBe-Tgfyg*+aB
zD`1yb*VQ5<tF5DeSD|;oKffQ-?F-TKnsjO&Fp$;joJ}nAgaKNq090M}{*DN1O=5#G
z%}NlvaIsY*qar`rv9Yqc$)$!{a5;|8H}I6Lo3V1>6z;k6ICk$`j{@D$vf6Eyg0qZ9
z$xfrm$lb;!OIX~03OBuV4tL$ZgrMqS|GRDjKiS5`6IC4R`Iu^SP$b~rX1G+=OMAe6
zbf&oq1%^`5B-+bVZe<Z58djRsa#>mmh{Jg85M3n4&8AqinKgz?22%U3I&cih+_jpa
zOr(u$c8bJw9$J<zZIc3CJCAKrEi!R^WAQbM?+f`D>XeF6#bnrnLHxrCwV#NRe~0EZ
z>0uK3D)9`f$PFD;q#*EVX&g|QyBIHnM>io4jhk0eEk@gzbQN7yQb!g!Adpjlt3c0Y
zw~rOzMg<k3vSERakW;xIj?&ls5fmn0c0q5~=YNUsyZFyB>T~r{8f<gv;D;(5X!f{^
zbMeL%KTtQknwS{$<3qq`HP0d`8OR*4S6;Oh8@Yp%ch6w`)-maduH3|g$V_pqT(!(h
zW7)9yd$V4q*E+Q00}DOO%j7Zyx_tuHZ{2+q7mZ9{Qz688mrP=1v4e$!OK6RiFv7H(
z<s)J0s#EbH>@gx-Y^Y+JFjrX2S7(Y6LnMd{s1AF4Bq5olAH`~5Yv)~HXEI_BbKe?d
zp(2Ld444Yb&?WQ4W^0HID@AUzSS6nzHBjkmVqHAzLaFM;a$sX&+&LI?6xhn7HF8}8
zv33Ph`-z^KU(0p%`!JmlOIPzY6~5KtCb9u@6Tp?^k;!9OV9Oi~4{d(5eKX2}=%;{I
z8|8crwo*4{9mQ(<dv1OQjx_%g?NV11WuC}Ya~}L3_TB^Bvh1u5T>G4x)61c9PF>Zx
zTT)A{mbxWcpkR=&2+{{O<3TVs3?BwO9uJr?gV4Y?48upV$AbY683rUHkc_03P)n_j
z>Qo&n=c<?AyE&e{=ilj^eeS*Qy()FvZt+z~x8Duto_pfj|6c$4*MBn^cH_yg*Y@aX
zIoIzs=;Et)b@UZDl!2S3lt5aqbtp15)3m;Asn<K$b#Myb@xh}g$dEYg>u3QiZa~wY
z%K(Pza_w{Fxj=ub-2l%Lz+RD2M~-fwMi*Nq^Z1#6^FEAk&Ed-{ZM?AD1ZxNA(3e)r
z9jT(Y?%BW%cz%bxsc;63^%GTtIh=Sz%p7iYXrG$!v#@8_I_p|@yTu@fJ4la<co&7C
zC&e8I2Z2}!2Vk9OH%xF@eXXmg;3AsYSX&ffR0~F5%N(7pq7b+NWuqJo3pcpw#1OW?
zu^qa#lb5i7Wz530D|nmUZ)+zn^^jCSOFgv9moCp0q8Yk=slP%lr!}`+ekYK;ZbQAV
z6bp8J!gS#c>jpL$HRZBA+Ah5w?M5d5a@AzAW1`%y78&r1@cA7`<sZ)T-4}mcG!t-&
z6~5^^ExbXf1M!+bnr2t``yRW$*3ol~9$l!)=fDLh0$3^4TBy`<?;Sf(S*3_^v8lAH
z!U19VZ|Q0skN)|~sGVNH$W)eqjw>2M#W12z2P!s5AUXf!t(lONgmeR|v{5v_rPk|v
z%2Pqz!vyS$m#RvOmMkSPb7&m=bS13(yq<*ErX22&XtbXbb)((E&I(c3Df;<impT|m
zNgy8W0!}f77@n{kq<%K?S73d-5F02}4mo1M`l{CAl!82K!l4!<0DJIae6s4n=vj(D
zL{y96VpVqqsYnRHU%)Mei%~9So~)<_`OM=6;B|ZXu<}<}t%sRWOOW@3nTFfwHP8_)
z(~S&N)T*M}q)C)f1S@RxDnV58w+Uq?E=0oUj}yAv12>e4Rbcda`04||qc&iwZxlCe
z(v6COIfI58Z){(uKyAAMURI;6d_Ow-zxcD_T<up_J=;N+v%e2*ZNBNf4z!;E`=u6v
zYlB|&C{mS@t*k60kS<8(#%?ux7$3{v9q-<Yg}Ev%!w1fs^oboIz`O5(y}0njb4ce?
znliB2VWB(7F}DKBB)wu9{~_h1DO$-2f#}HYQLH?3RnPpGv`S23Wxj@A{E<&$a&i>;
zT!MlDuA1}R^7b9rQAptGtE-T`%CFZ+<3^SnmJkb70m4au+0t7P$1s<-4ZAdKGOZ8!
zTLZqVKk;U#*iO>O{XH>kkP!VyKb(snJ}maRc7<iQfZNVSDhI;EDjPm^Q5_UGgX=}9
z+SW+bf#qI(<5FOX`(x7{&m<eU*+-8Xdq-PpYaHiTbg-EPTNb$uG8z3!fb(>6Ot2^_
zhM@?A1X~FKN}6U9Vx9q99k~nP>t*Eq!u&|?#`-7)&x@IeDBlK^@G^ZERWCHAfIn)v
z-qmHuM#{#;Rd~T6B(wKs+eg0iZ`h*;|7XRC{5|N^{Y}l$3O$&93q`Z{m1#=eq=;2U
zjrYBE2j;F+aQe&&3h88cr^yba5=@UjH&53y3l#>;nRa&Rf;zl^48g05n7g>Dva+T$
z-4WqCH&!3W4!i&Ibn~nbc)qw$hriO4ogTvFq}PE*+dMThrhr%4CAMfk{IN7f>pfil
z;w7+5VrVowG_iL*y}TT$RsZxq?A6t8k7xl<-Si@s&=O+!Ht8w22$zc@R%WL7eKiMt
zk}<bm+qxsP?UyA?lF~$cY~9eG4Gt9OJFgD#hKVu3;?n`E7I1-|3n$rSl3O90E9~{E
z3&E7B44r$cU9t$Sr(&U3fm(<B0pEbQFwv{<Bj7caWtNLo2`>w*fdpA;V$;*0Mv*HM
z$r#uwkGmMyI)xd5iRz_tL79z1^SAv`EjQ9K<Ek&B&NK#SdunjdiMp<CN3DRrqu)~l
zgiO%2kl=4ach{r;5(|w_U?o*Sn%@N4|CSN0ye4x=_G=wlL5+Y+R%-3uIgV}HNAToh
z7m-Qo-CL`*aoepkxbvRv_;<hk7`7Bj3Xs)}fyj_amcuSDH}S{6{xxh(CQ%qksn#*^
zGExCozBLTsqCklzY`p+0G^n4Xi>yPh(}7Tp8HIBz_qu`Z`<0}LX@cR%p&4Wr>!^O|
zB1Xrvnl2PWrugek{jc|R*cg(9DRQyF;1N3nE+qgF0ktK9%sN?2p0G}YYc<YnePu`#
z)v|bhvtbR&ggbCxlUikm%Vm*di^X{6@Jy?OsOLKog6I5Y2Je`z3RD*;b0`Em1vk1b
zB^&el=mbQOtzNIW{sL_nuD-{$nYz~Z3eEkpNRO+*HqZ@bCE!YmK!U5ML06!sz?M0Q
zFJXa}`zqlUmKz&BS}7Mew_I1eA*KR<3I>uX!qbK})8Rn`vQFKBj<^F2w(`Nuv5*Za
z70odRKR5=T--_PdFaEq2O#hF=yN%ui+HWW_{YJh+=ktRJj~!YgplTC<<+4d!xm?Cy
z{K={+XO*s4GJ>t}ReaC)e;dx7UQrwyvk`-v6yegjOW;lSZo^gr+{IJN3S?ayMb;n5
zV&mx1BarQlr199*GT!x_w_=Jerp3oD<HZvzI7iXJ*6A@MI$hOGp)DIXQZ#$ZfeGZR
z9l9q38U(UErlgZML={|*MPffsJMeumoC0w<SL*^M`a9&hAZQ}maN2C$x-7OkQMBvg
zC5A=28xhaL_E_}s45AN=*F9i;w1VYZ%>fWbuGJrXGrN969SBWTM*Oeb_Yioa?Hec?
z;fAVWR&`)$P;R^~m{A!>fYX2t;ZO%cn})07%5>zYw6&_Sqlsiyw%=74_~y0eRJqwG
zmzjvwj4+)*mmvGT!|5}v(e-4$s~MR#8sLxhUzD_l-1c-@ncskGnuGb$lD0?pb%D0(
z&FBTs|0p5uzo3O%H-YxQ70}WNOeEMZcj>P*)Na%}ND_b+a%nkUtDB%gk?fJfllY16
zc>tgP>?xdlWeFqFJQjmhP>p662WZ)Myl+1~`>Ri2Ea~fjq(2xFgSTP~SAbB^-;taz
zt#e=6N8{1+Kp}<HTpf45dmr9)+caMNlNYd>OX2W4c423=jjR9p3{n@$s46~8c0*;M
zhL&9ipst4<n|joKBRs7by5j>pt-GFBqDw@y#L#W%YxOQ-VCD=IA()CjSyhy1?e`dn
zug5JS?mswe5U80$5x57HN5QZCTv!SrRCfr|X50%yVjI;C1zTn~TN$Bp7O7-x#|1@~
zSU?q;PZiv@)is)2nPrg58KYYbjEu|Ei7%D#veB&JYlVqoRb8U1zA&M@^x2hV!Lkfk
zMZ-3fmr}7rih#JGsFCPE8-Ezat*k;Hb6NF<4!!K@0fT8ynX?7Dw+~Zfy9c~G|6`05
zfAJ>Jz8)Oy4RQxY$NdmRvwNx(1+Fz4xb3!CblL&VU06mop?TRPfn|-N!xx`fz!yGu
zl6Ka|*l3n!Kzz``lrHF2yNeUgUD3Q5V<FH&V4#bX7-~4(r-mq`Q6q5QCHs1HIp)e8
zv^pHO<&!uxo>6VhU!@EF$`{XJDn(m2l0l8OO?Fk-2qZU3c3sbM5wJxOCc93aHm0W)
zgFJ12^xMBqH<@IqhJk{IzJV>iPtoLiaPWwt#JJu$u09B}``6(IC7hXz#jx->8?Lkn
zDTKa(SJMo_WZ9XCb}iU?ef4t=KV}-khW)_|04tw{Fww^8E$)=JM7#!5YJ?z+Zmq&V
zCAmBetm?UAo+E4`%p|{*mbcl}^hGL5Kr2DJ7ix>uISCs2URGgkeAHFPz$Wlagv;9m
z)P7)^-trKTnJ-lk6BKCNM)&Gp{R~k0KffuuPyT(1XzdM5=lg$?W=4&!%vJ^{l`?43
zg&@@gYOkd6cRGQE`8xjWlh0zhn5PrxDW|M~asr{VyNtl@@{7yJNiT!`WXWd6)Q+$|
z0xqFjP|K$&UtPu{#R5)z@hqPI)XSLMK921a8Ay6+wbO-{WV)1hsA=|fDh#f-LacuU
zZeS<|R9taT6a5ujQF04T0*tXf{?>^;Lz*C*b`FbrF<52RA4R(}R3J<u>1faJ>3&3U
zuuymA7-kEnY=PV8a8S7rDwRC@J1mN3edluvhBg7fodJSr8Ccj{F^p_kJhBZrD|1{u
zQ>|wT8ti)(cqQ0!c@4vhHqt01wA9NtiUUsrD}kg4=>k8Df+LNv<z{WgoNPr_P_&5X
zR>50c$8^VV;he7JY#uB_!OYrX>;__%LuNKf7O2Qt-XGF^EHw2n#TH;?x?lI8$42rr
zF#I6h)W3NXX#XoK6zF=qJHgmn8-%oN0?tw<kFS2^EJe8<ip7l9(n@}m21eN}VM<;g
zOh?Xaz+A)>JrF?Oe&-e>uGVmh9_eI4&SDG~%+&g%>`FFkls9X)r4<fdf^A%<k1!do
z{slBJq-Yz{^ytwIk@Q%o!*mNDZZz@Lk3YC!o;Hduqe#vvzYY0Hr#x50J0`@mvqPd&
zcgl`ofY}G)7*f{jMyQbw!jO_b3-)~@NTf)JKsB;i^Ax@6h1{|MZNvwjaC-uwyAU%c
zfJ7g~AYXdU;3I*`6Hb&IfmB2zh)^#Z9u|`Tv+L4d3LF&(SL@Ole9zcBGBdTeWU=*Z
z2txT5lkzKO=>kI;2*byU$XG|No2!a7y1yDNdX!bi2pi&CsUD~Mf=S!PPMtnV82<({
zn6L;;waUQqzwOvarUnwfL&20(;%uYf==9GrHgXeaUk~uSkpPUa?dN60*$A|AOh6ZD
zv5+y(wT`xsPa!K?hp#k{^1XE;=;#j4<#MQAE+aT!Mmm>5d9jX>$pV_S7Fv}S4jr9E
zzL>-UeJ+!1*^#6&m*KP_9vg-o(G<5YH{^E14nerTEu!cX>0b{|JEW2o81i1fo-{U%
zX3<nXChKy)-&Z0l&_^G{B1~o?Ftg4fkti&v>u#FSwqVdR!6xKcA8o;09c@e^71!aq
ziKy5<#1d4lXRH`(ug*2qr1ncywn|-Ipn*2!M^ZBr`Re3YeEy-1xr|a}v=}fmt9LkC
zJD3>9BIfeREY87Lb983Cb`6D~UmH5XM4q~Zx#eJk@H6Igju2sig{2bA`?96F+^>!Y
ze`E~2z7|#1S!cCc7m3L&@Jb~FOV{XTwN<n*1q(er%VSze!AvBt06CPYnP{D532b-M
zVL35P?|ctE{`i{}Xuqk9zfFE%H*NH{w&)~vxi<EmnJplb)%~~R^(Xs&O;6`BF_lNB
z*Bj1H*!JSmd!W^W#NvzR*KpxtnWjHUyyJtn(1q2*eec?fkNi*fV}&l*!r>`gtF>{p
z+{8ORb`N&lF{?ZY)}uj$xW4_y2I?bmouAz(H6!{~BGx-0Zsb3ZC~_mne#7s+;yGKU
z+xK1J0HMq23J2!~wpYY4wSVI*jS+p{HP+VR{!kHNIZy{=h4X_#00V6)3`i(k5Ymp5
z!!M@6k_0N9Ao{*dw%eVtCP%tai^i02n{3p<RiqqJ7iM`I9qaF!FRSZ6YVE9eSbELW
zqpOPrWTHtvw~wH!TjJP<(0{oqjg^088LuhP<+f7;J>>LWc5{%Ww5hK4yOjfHyKc<L
z>GN(&wbJ38n)1n29U$m^X-+OZbY=AKWpk=iu%?fDDxs#@?*z6rPe*n9<&xSE6}m6C
z5QdLQUirsvMzpULXm21HM(65Z1$35VC71$A8Vy%hT8f*MNhHbBj!$HfN_jZ(@&a<{
zR9}P_FXC+Vx|rQoq7&Z5^u9@?w~gYfPoBqt=>uq_J)ECwV1aI;$6sB<vuDZ#=n49b
zHa`8xIc#YLNO)GHE{5~87~af)t&>0tovyBvYZdG8w1QoynU{#B=pxj<#{FOiWL_eq
zV#AP<u|fI(u>=|h+GDxj(Fy_+!C4(^2z)H0DkJT$L)hD>*_{O_vA<StFu`KR6v9+x
z!Qpfj@L3u~Mpwd%=!39gi-3Z_%1ijBJeJ}?nm#wKts!&xAW}0Nt>e#tmBu1&)mD7z
zQC(~FJrTE@v=ywv%ElZ{Clpjz4x2~i*i6K|dSwFF@WSeUVR9^LA}PYEF3;FM_P1Eq
zQLpBf9j{$s`7Ih&x>~`&2sHW18dxf&)duEz=w3OcXakncs!k8G#M~b(>7Pwf99>yd
z>t>k@0c%gU-;qev(=!^iPjZa#I<#4%bdPVP`}@RO7)$P>PtM$oX#WdFv^)e8_7MrP
zJ)sHIYQ0SnX;=Bqc4)NTxoZ^r4vgdU*%hUwUC$%MuD9H5;f{N@V$04FvIMN}|E{CR
zPG|6&zxHKZX!h{PQ<v~(|M6)|j^>fi`0_eYdd3z_k+$D5g;YMN3JwHr%+O`ME;7R$
zj)wvDX2)@(h*?|@YCE=%7!qyvSIM~%s4H0wKO3mJig%>w@0Ak{zJd+-m<-JBo$tlm
z+=UZCx}E*PWEnTljX{*H*B5St%R^b4C)#xL=TN@f1)DhpZ|f0M=euYJ<5>LM)95uA
za<|<DUaPt~eJ8qgB3o`FTNACik*$c9wXd0QzpuX|OeCwLTNBMnI!#7{6fJUD6~^^*
z31~8!Wy<WuM72T3n9_80Bq<`}7r0TcdbCxfDfv`MIq+tM0P_-(Gt(+cm9M#sV(F2X
znpP#_vb~Osa=|E4?W`fF&ZD<<UPZ`)*XTQ|Y8DW*>2vvz+ae?GUdQ}aM;$EBo3W?<
zCvH*){}q6i0)mgwrIT+;V{a~0GHUOhair1-bx$<g9c<q*q6q&=y%kkwVturoEadUk
zM^5AA7Z>s5SI(eZspAKK=ze6GuVh{Yie_iVii-QSLDuw037`Awi+J>rQ`mcGRsk(G
z0J(wZVna4#c+&=K><)(OpdiG$^Z|=6BO-u}Q3C^1Kp%)2N2<`3N+9OcW$6WB-K}C9
z=X~ZA3G}<9*(o;=uNbqS8gI!XOzE`+U~T{wajJl00AS;wt84XpB8MiQKz+@_^7B`*
zc6=VqYYp^jbyc|<tSqW&dy=jXRsNb_%5y*#3wTlyz<UaKn5p^_hC+~L$_i|yB1Y+K
zb&?F$i$z3W%tC<X25@-<xZIew2u&ZzskxG1S+G^$+f@%0NeWFT@W6s@^x%e8(7>x5
zytuMsl+$|Cg;&}vvKqW%QboAD)6z6VqoODU*+^1S5zM3CXw@{3%KejnRcPNrZ}qBf
zIN9xJu<goTXtcb1t=30i%_is=j!6382k1YUo7BO7!DN`3;QaHZnT9nQT^v0&ji3AY
zx8O(rhfiT~p^0K9hcErz8DvvQlq3(-H=Q4*#gq<Twr^NApT{5k@yl4cTE=Lx5W0DV
zqmps}<9K%EB7WqD-i7x+ID_B%!T*eOF27E8fBiZ9y2S;3g-h2{Qj6D0AHdD<N9|`~
z$)X|NwUNd&DrOKv05C>1h)B&4dLM|s&)lS#OG(6hX(L|&7~ON&#?P!&YgM%dHS!@a
z8^o<Pl{=>0jya2}zVg&yEA^?}P7>8hngC;wW=iyWWmU#?NaWH4I$9biK`!7KwA*PU
zMrU+m(E1v@L;^vr2ERC>c*@@DJbj+mQK_O1ETv%B0!0sap^TYvI~M6}*Ga{w7$9_P
z99jw<b%9_*no-(P+OU&EEV<={gJ*aXIdp=&i+YtMc(PNt+!hr{3kpg*%F94;u3fsn
zl7a4f$IbSttfpz%BNKuFN2HW9ccv$cEHVV@4O&-L@wA*@$}pDvURvyTZUXH$#L;dJ
z1T<#eO6T})Y37}gde}??%Zm;C#;-o6{AHWH7C!JDx1&<-;BP<wDv~K5{f2t6EIgBR
zk&n5x737e@^kfO;wHB^jt*TPqblMAVW_6Jh7|Vi)(r6m*zULO~oTljJYFl~6rrC{6
z<A+JHhDx&5=`gTqi<))z85@8ySYL%!Y*_<Bj+cR3da1z7kAtBQmMaua)GYc;(^)8=
z3VC8U;Or9DJkDP$EOxkGw{$nG7_&PTf~utgnB#b5-s4*IFM)*1iaeWak}D-3tt}_e
zl>kDKS|XD+6<E4ek{o~;OQU>}0O!>eCE-hs_0%+2+6+pg6e;j$b4w`Qe;-Znvk2DC
z!XGW@=+!C-5Y>pNN+}+9>9V?7VMYJ;U<A=;oH+$2;qi3M&AmvW;2NK^sBMo6%8DxD
z28?;c1&2M+<oW9vo?Ld{r6|`gN>J>ocIQl*IthLM*y4+b{5RX!Y3uUflm&1C=0ujT
zmevzoBG66J@ffFNF3QD!^d`{02I^q5&*|d%XC0&bND$Cw(<xk<U%~nL%b3c~(uwGy
zP{?BIwsCy+^Dod+x%B}|PF(2XsI<!Xg-`qgoO*c)zxn?@ikU<aV`I8<Eam`3&l;_^
zyl*hIy@((E;kV-t|HY^A=jWHPcjp#k#vD&*tq*<cEjJ9LBazoIklsk<g$+I*{)09O
zbgP?KC@mVgH?Ez4QwFOdHT#mANX?OAapR8?D?oFjTI=qGc$6BKXvKTA2|EzjeXvn2
zH_0Z!jn@K;h1@#v#SGY*uCZKKSIOt<`?)OqQUSrGDw5e$q{kN8WJYd;N}_l4dOXQH
zmMa?2<Y%4+V_6ARd-i#x$1_NzQW|{hEW+0^Fs-3wVSXzXfZ81olVG;A)d02W${?7C
zNeErlh&FbK49{6#$B4*Shp8l%uw6xrAr5c0R561}e#z;*pMaOi63AANIeJ({u)W1A
z6wqcMC|L1J@>r}Y?{6jTakHeR^wP@}=-3fROA1aN3rS0$OIun8%g}H6vazI$YGpef
zaVLH07(F?D6KG#Ypyg^KRZjAwvRzlgOfi-!%lOHkcn?NKGWeN){YezkMSSrKr!YQ|
zLoQhu_yM<ikr^T8T2RH+D-~Q`Si^ny?!kB_hbNvmkCB|Fff5vrEUnbgrj!0NpLie6
zeBmsffAk`L{fGV%qjbaV*fymS4r~ZWvQ3^}k6*z?1I5rNeG~d%z38^z3`Rt5u>(;p
z5G}*p%$MjduZ{TDr~=DKmK@a8;1-Gbb;M?7n7&mUuz^Td-=|ie8-Y4=t!3SenGxK3
zw$rR1?GG~`s{k%w@DoBwjsyXx1QCy3=VtS$U9M{Fr<@kEs6iz+MF_rU3Irq&%dET2
z5qP@LfF;rhDh(vIq-Z-lMWIR!t{PMV4cKATGmHqpHIJ~K1_n@>DQnfbSp&4@WOAqN
zPz1Vc2q9-vH7s`UREat5KT8_bh7_^2Wi{9s?L!s3zJ$colmcVf6q0xKwgs&^f|}%2
z>#~%L_Rmap<hfK*OA!)Jp>l$vUM)ZCsZ!+R_*M#PRuo^$k_jC#C(}w-s}Vc#-8X^u
z8{%l!hgz9tN<(}%-J}Iur6uWuY$}7N9>0iIt3&50jU-+Cjd~Z=%9@e3uz|*m7Bo6E
za;8%re(Hzci$D6^r*W~if(LIujMYXH3E$V?PT#+_TE_hk9>BJ31w8wg$B}OeY$>J{
z5Oj^~yTA5+sH$L?3)VWc0_*2#htLNb0_HbJAH<^Iz9bl2p8^(1r6M_0ByVF315xcT
zF9Q)X%XT?jBNq!jYt0ch;49c*R2zaXv(8#V7d9ByPq+FunR=!<Q5jA883Kl8hXPn1
z$%3BANZ<?V4Yd3zniP$qJ-3D_zYf0evH}?yjr*Q1Gf}~;GhhTVat*B<O)&!jI`46n
za7yHI$Zj8}ZK+WNCx!d8ZCzi7<pj*3uHS8jX{iE4{48K)UeN&v-8YyM;kq*;#x}`-
zIL#)LK7zF-y4QM0jHi*9P8;=yG>xI{PI@|F)@%Uv0KJ7pWl~dr_Uqt{8j`cy6+m__
zT|#F*fz-Aw$nD>a)~in$vm0NZ7i%q9UebW9SPhDTb4Bp#ic%j4*_uk$sQYR9j3QrA
zm%a?&Mc@3Ho2rA?QFh?#o9IIw*dC>xQOYFo(u>#dw)=Nr>(m%(%{Eq7n%J_nsC2Zl
zWOm(bz8Uy;?i<7YLo=93jpEf;=J1u5PNPd;Dou{gt}Y=zlEOm|?nbHH#n~sX;PO=(
zspV8A>GfU6(Ze?-oMLn3)X@G|ViTpnMl*rU3K}+-b~!z;oabUl)QUa{m#Z9zaql8b
z-aG5->l?<M-{OvJi#uup!{x>jZ8jqxuSam&!t}|-RP?DgCP6oEd#!`AzZ+G52fDSE
zwtMY1v2v-0U}`_QK?)t@(9UjyKTflkPFoel$j%+MHyL*&aGZtp36|=Rno~bVQE?`N
zPK^fg0)g1_Wu$iOLQjmNa;65BE-0mdEo88Ygh-WOq+L>-5Qwm-L3zU}k65i((16c%
zF@^a|7cX$FK8QVn=)nW$J;|-M2w*35WS$z=9yE;=8KNLDQGi#-E0sWRZG{G<nwE~q
z>3-1DMH^DNK(D35OWqLO#U<2UJPv<qn;IZwd9G4H^twigAar4cJO=b$>*7-?iKyF;
zX}On@ttr8QI=Bbvap%p5_H|Svq<}n~orik@VUt360n|DT+;;nJ{L=sRK0NdE1&U6R
z7#~SvX|+PvOyn*gM{?O^Rz||9l%Ce<L>I$P{nRHhn$9Veg3KWQ_{ZLj%83QMdVB%z
z`M!4|xzxmGe)Vy*D_zWPpHMUb=OPw$x)Gt=zOLbR6X=U5hLz*4ljQ1mq!N+4=caVQ
zMt%ku!t?fbv5h5_1|r`6q?k#KaXrE?1A1=Rtm0#x&up|etf&EfMGuIJ2+RtjuCkGZ
zL1as)^{`e!U}z%Y`WiriZBli!@UXm?MzPpIDa}<f#~+(Q=8nDSm6uUJHK&C9izj-T
z7BH5D%KY0l$~8tY;jvN4G$*p9*S&fhxt%j8Y}o-(If=rX-ifuB7SW!sBE9PXS_`X4
zC93d>CEY02_C{inS$02tpd7iv_YB;J5pNXb#@Zf3^qC{|_g<rYpqU=85Qq}cN!p-&
z<s9<2-v)oAfX>Ae6nWAtfB=@a8c0k|Dmp<v_tI%K?U%<QsI2Pqs$^_|DhBE<YT6|=
zIRU@9Oy6mRE?**aRMZLwS)!|eUzIg`reSWIW(OJ7BHdgR-%tN}_GU!;It98u6Ca>I
zA?Yd;VOJ}3($K=#Xd1u%D__I>TnDGl&SPPrhRYYKsMR{st5z-F?)5M}naAi@R+Z+4
z0(nRcZBc1(I|R(tdKdTJI)(f0nZ|?fJ%Ib~*oxZORi#8IOy%gD2kY|5@`6s$)mxzp
z>Fccy7U*}<Y*2T)QB*qcSM=*zuRnqn*jSUhZd4p{s__*?rL!AE)54wl4=HruZnPQK
z%nB0?hSFEgqR5x`MXL}o9jzmGbqXXzyoA;*w>8?+PKO~s$}sJpMyYp^ru8(~Hd+XB
z6G%=^V(DuqwCF&(OV#S=)fz^@prctC)yfCla^E45t(+1EjW!yW7LeOLi{y?2SUpik
zm#(+mf$hj_86|+7qUd%^MU=Km4NgG=OoXbUTpQH}T2sqRL>rdw%H>pK%Jt`AWXmJ%
ztyxzrstt5UT3%hH+5I>HAw~7&HSi{FD-8t9&%>ukw)yHa2x@Cc@7;^!<d}|rC&tu3
z%PI1d2|q8JQF1p~daH<N8C4VLb{DRpTW%s~26Q|n_0TbZ+B1a;-LTj~wcwEt`JVh-
z6)|`St@(fte=|k2OuUxPh_BPXnbKR={Vc=8U$q5$zc8ahyW7RLJbVCW&aGl%B8RVj
z`J4jP|Ndk5;17TQMb(5ck&MQVCXJ>C_Ufe7g$rxQ5wQBqWvBE_F(GXXmue^#vnbJe
zm#&mmW!d;-L47xDJk6X2)XX-b268kypP<qGEJe@v=2F-~H(19+x3*a|bC!44!TR0{
z|1zi1HS71p9sJAIdCk~5?_;nrxGe#-5gYS_ksF!nC}a4+Or~A_$1|Lu=PqmBSD*Xl
zSotFC?I%C;%yO!CmZy_nRz0NFVZLYI_q@>aT5+FN>gk!kzBwWK`%F^->baqM^cQJx
zrRjW9Vo^%DuSscBuj?Z>>Z8oI<LYx&TE>GfuL;lC7pnDX_bcVtC0{db0OR?_6^ljr
zdjR3S$<pv%wGKbWkUMw)YmYvGZ9ni2k)EEw<$wD-DBOAk>FvAdx}*SN^-S2u&_=SV
zjf^_R0b(ZFj*&LA?qs3gE5gq$e?6$<i}Yl23h(DL1cEuVFIH4E8?>Z9K~nLq`P+}s
zv8t(}41Z)7-4j_fPricuZS;ORgU0a_s^CDD<NC!MfpI;Ik|jsY%=IsUm`S4<x+o+q
z?WObpmB^c$K^|Mx_(AC}p@asq@FSOy$r|v~MOv<D>>VM2<7@qxQ7k-hlRCJOXqJv~
ziT-?xoH-b8cdXHr<Mz8|@a-QuhL8T^-^U?}5~e0I*t(;rB{V!faOBe|oR#Ic5)7rL
z&-Fs3bJ-+d-nyfNAO61E@!8*f9#>Xd=q|O8Bfw2%e8u&8Y_OF}e>5pu%uN%xj?hgt
zMmJ=eivb>YsHI__5Px`bYtYSWm`m5Xbiz8nfz6hUMTv1oFSoEEifSVRTT3n2DLnkX
z?hCO7jZyN*`np;y5uQ~b#G_Vg<K?OlLbom}_cASK!nQ?<Kkr~=K821~z}R?8-n%+O
zPmx(Wm_V)W(^QwPxNKVUxw^r)p|ZFJ??5+gRQ|7lK3LlS+M<5ctWnt-QUvMcGDyvg
zqxRAnmF%g%bQ0yqYjg(|P<!zdf@*^z=`HYj1tb$y#Rc2eFD#@GOfoO*y%kXig7Fw-
z5CJQ9<Tfyk6Wuc}r|(Urr06Vq=&sOjH>!GYkv;diZTJ+SijMqj4arghLFFoH#~0vb
zlC;gU^m>^hRB6UkP+DYOt!Uo@FU*!I<$yYu3DXc&$VxIp1<6eyFqQouZTedK^Lm<}
zmc<)gu2dV~viDiTUUDBA2DCS+gB#>$De8GY{SE5@<UN$9gZ&4;_X3`H{2adRp(A+j
z`;TIFYaZjWYwTziogiLkCM7`9U?!3B!%hy|nTpHErM%k2C;#|3&eq$Yi4(0Sfn>(h
zQ!&T$e!c0v{3q2d1saWaBz>)n7)U;eK}V}~5?~mzeu(wI^SUL(+@zR81-K=*=ub8Q
zVYdlaNziYZ$ax<XfIjCgdxH63i7$rG1EG(Bvt8Uxj>QsXx(wGx7eOM21@ACUo|?q9
zt3`@}_0%;xk-^%shs76`kSru=YTr@*!%}Cfbk!y~C7*K<P0s*bK%&2eNw8^O0X^O2
zVJWaSW>K?ynptIcZ9(DCE|pBGzI*}gxmA@Yla_<ci}PrlJc;I&8d`HTm2g#bfLf=X
z`s*Z@2q^^E?FuY?V2T&ycJ;WS5iG4>6JL(wm;7Fjrt;MmlH2d5b*0dqyR7uCs<&CM
zr}vMxz46j<T1Q%Q$UTa1Z`qCfo%g6Jx8&>=_?Zm4SFR$pZ3ZdY&w#*MecvXzcn~Gq
ztoMREZp}IkR&AxBRof`(J(IALQ8rhv={w!7mWTB`H)8nCn;h+H{AYaLKiCto7K#*T
zByslq5@xrI;hpc;hgP$RYNdmxp1gwjg_@eCZHOU#fMpvEUa5C6U+Z8LJ^aYWAH>l&
zZ^!CNV*v2hQwOM;8d}-qRu>m5Eu^HGxEzHU!$uub#0J8P`1@k$avSlpSP!%};c>+f
zi^Dj$vIvBSsS;x9fw&E#=;MAv0Ob)^+izZ@fZXM3d0chisv&rk_J`vOqa$nrpCk?2
z+xK^|b$SJ3r5d_D+o6^w=(4?w;u-^FXA3l~^$8$(2(TeX$~ACv3xt9j&Nk4Gp8gxr
za&%25GMNADSCHO5i{jD!I=WA1w1Pnbsq9K1ThEV<BC~57M5FE)&+w3!6%L5PC?G=5
z1G6shzK3~Fah_I@AQMeNM{9)dc#xu50{FA1;pGeFvmoSq_4cLEtM<^5gMcTHC?*x>
z+B$PeA}<mXMWkjYkQg7=-UXIxmEb6h*MbCI%e@BL8zC_>13#bDz6L$Bj0M}C<!^(C
z%k44^_8JuS(BsHWpnVOrK|+^yJ>2V??#e!3EwP42|L!an7aDl_nTt4eW*JjcMLhKG
zU3ATLhnDo(7Dj4zN>dW)l^{Fh%J;I_1oj@9K!(<xNu=<p|L_9Ny|RRSDLot%#qj7+
za#8I9U68YRFuF-gBWb!e_|SM$3|ZgxCdzOffVrWO%qEd=EGZUCfUz)vKhQlP>{h|T
z=(OJu#+s$X<X$jQtmu<&!2#bsfbD<JCcVPQ){S<#FoU4%ubP6WRgk>!JSHZZNOsqN
zP6w@qz`64!1o;V_lp*lk_V8h3rV2W;H3=wNF=!J~QF4lh<}TKZMkwGVFj2`Mt^g!8
zHI3ToOQ@c_K-2N8DNQw<8YII|YofDML9b;vS0{lb|8fhO4(KwQ9P8<U#QhwO%qx7)
zuEX?rZ=CO-`s^vxo_>ZtN}B!SPEsvU%kpYXCAYXYf^IoLlcI0FHV-dXR35yUeS45S
zx<hfa^%q~I0V}1BqxO~U>CU$XWJ5(kPj`0+S^~X>PI~DG-hOVJ$P7TMgqVzIdokF0
z^G%?=-i%z|LwOr8@c>;4B^LnXHBzZJ@uNTVUL1dJ4yR8p;urq+_bKIoH2(hHkKCpb
z6mf9VoR2gB@2P1Yu-a^4?~zH&?i|Hxt%doyD!%fCbLi2<U8M~;{=_w`%-7X=BaU<(
zFmvexn*MAV%VOItQ^2ut9DLIjG|H_w@QKaU0b)H+7wa2=<2on=u?bZ%5Y>u4-76mi
z-J!<a-1&>aW%}s=(N9xw$M`!m&t`F*t%%bSp{rL6kZp2}fb?VrCr^$L)+BLxaRw(&
zj-h?vZAgxllpkv0*g@s!r@(=GIR6*Vp>}zVro;&o(MDj)4XASGVJQY4M1ZTl7s!qu
z1h{nlc`_=jx6oayYL-NOH_(4&!YG?YcV!7nPh3E&B02H4j_yKB#K;~oqy;2M8ycfO
z;#It;ie4RX?&%0sCIOpg=V_Ir^gCVj$~BeL6DBH`ehpG4DYr{~heCfZn<601tMw#D
zd?X49_{9RMPd!f2?E-y1ipGo2g4bJ`6Yg2MK#PGbaEFQw3V2$lPNBQBs;C3rXz7zF
ze^1T|OmwTFYfB+W?zhVjbxy?xZt7@X1Mt#eyfYANU?h;#z_lw?bSOUAzI_Da<2k(T
zz8xs934HwL9#i=UX`dKT0}PARI^J^YR*cZ-dFJ$r(#?+0&0KHxaM!I{P;GUvc(tmo
z2dRH7j#4BlM5vkV*Ub(~Tq!A<#}KqBa!D~fPhj0nCQ%yA4s_?n4eDv*^Z^?H(P0TO
z413QlMcyPSX0@?lo13tWOP~M2kmDi{wUH6JL@PRmA#g`p+E{bOC}(57=Qe({%?abB
zxG=`pOfXXs22;T$p9g4EJ*4iv2aOXeSh!NB*-R3?=+NMsKo@DGSQXpu&Exo78@+ab
zWI>=^?ka9lDi4x{w2mlEtr_!d%Ek-J+PGk*w3}%MDyFNPtY3jFRc$S<D9M#ifU8Tl
z9Wxl?Gpl?O+AW%G<&fK30$ZI!&}{49W8tV{jKD?sI#eLQarJUK&?1%`qu;AHkllBP
z?xG3wmai%E8^wXL_(c=?$fVL}p1FX;_!!a?MWA&F-pB~D$L>XH<r-RN&!GC`^GJ-2
zATc>XpxMx6$d0uH)PNP4mMcmpnN-VWj~-Ou-9G&aSRo%teB=NmlVVbhpr*G{mn(F+
zwpMyQcr&8?1|r%B{n@wn(+2Vc<<e<<>eI)uuu`W;w1QvxKOV(1PhG~hzHg7Z(A#u#
zgtgstp)Xe(IJ{#F2WCoGnX6$mo50S3G;bzgEw|yVHt^sB`|txl{x+2Bb!0uZZUnfl
z&ei-|tG2N9*bK(UayWBs4c8hyBonL;ko7mD?$&4VNOwbB?IzRy>rH}P@A}Y}kP?Co
z`3=^W)M5iwS`jxJk7~Ia#m1uMKI*}x9h|6k7=;jd&1yVR!BLMPlL;`|y9hsMAmR5^
z0!&WN8*^oqS!WbYEr0zSs@JMkDyx!LrTtULZ5>6o+E&}&Uag^9*PzFPNRKL<iYyhy
z_PB|D1ND&a^_p!x=ty0y;c&x<I53ohiu7dH1_GS<RaCC}=<t%BGE0*csfMs&zD;`d
zCBb43mrCflp9!Vy&F$L?UaL?<`m*7Rbq_pChq&JnDk9git;X3Ubn1D1-g{-$@~QdC
z8MIHGCIGK%`Bu*)2f2<$6?GsL5?!;u?)K1q8mz9Ox3a9|C5kq%zi;^NkiQkG@whC_
zHUDIvo44Q8(O$>DSw}~!lmJW=l0c;*nCY?Ex6w>4<D*(@pfr-jm6a+|6uFF)ii-Y$
zGWhT@S6RfZhj-)cN4MhXC(om@(nda)q>pvPAtTTZ-9)9?0)k=+jf-m-p=g&6=veJ*
zwyp*?MX0$zH)`RwS&Zx`;q#w)6>pv>VO!Eio%3)&k%LH97G20`8SU*3ioUJO-7rn9
z=V)PlM~~aDoAuVw(GJzlvf=L!8}wXltJTTE=xaTr&y4A9S=6jD)X7?1t!LWQggROy
zi}Lh$Lfx(T4y?Y`YIU98k>86nx$);(<BG6Di!7s;z#^X%w`Otn>^QDmNF$k{yL7aT
z!}}J{Xn9ylAI0)Zt26+%=(7|?_Dw0iuzqn>?bnuf?nh_2f$}R0NEXw2+gPNtwOZZi
zH4EF$rzZ+Zpf96jyKLB&+#W|el~9r}0+nu8?L;!iF?O^BKN%?bl?v6v2-a$4O>;xX
zDnF8V*$5ZmU&&e5&&{J%Ehy!K&M-w&pK#{G9Ag@#L<k5F*HF0Y7)IWH7wXSFg~qFw
zRWX6A4ii#EK*w2fwNdYNeZC}B8?=RU5!%!$eb<*>5cFJHP<q;rSfr%HOh(i6H!WM=
zc<MdjH{g}%cols+h5Bjw@5kTBI@&ixM9ZB=PjA$Ff=xWDb@`!(g|#Z~ymcFHzhgHl
z&4vO76<s!}c<7x+@t$|=!=qn5jpc<Va`}{rl8nrYB7qFuFtw#78mCt=l1`!Lstm>Y
zd~AP2DD}Aej!fX_-COYF6PIy_qUKS$A+B_zVh7(S9A0d7@m#a3KsVW6LAFV<i#vSr
zM$2uaV%Uhc9gJ$@jTB?5fsLYC4060-%bLFE)N-<XfbV57wL)xN9D`M3+$QRxt_ng2
zMewp|I{q}cr3%=&w}CBFD`8Tr8!+Uv9gO1wwmx_O`Mo>PTy0_b!~*7@x=5SnE8aF}
z2g<vEn+R4#fQpATm10iEgD_)n6J$!`%_&muh0ExOHd>c3ueqsUWQm00Qrl&L)stQH
zYLdL@s*={IVoaDSut<UyO3}>r2}cH|@U%;S&vIZ}-=y?C+H*kkt<!S4(O*v2t<>8V
z?mCLZn5+_`;N@$tBD?<({IL>(dXomTlroLsO0FeBE}8fA9j@eJJsn|3>kf>+FH>Bw
zt_Y*oU9LIVz(m3}3YJl=1nfwC@GUo~gX@%Xxeo%M`vS0aH%=7@(8<XYa2_CV`}tpZ
z7(4fjpxy0-H>F2IXlt#5SD(3pg_R}>rHpa3j{{6V?<HxfmdPh+n#K))hz&FU1J5Ns
z^t6wtGy<2s?R#`%U8L=KfiBJ~QdVT5o2Ke_1{|c{q;Vfjx`1p!!~n2wqN&}8+Q5zI
zbvOF{KwmDz+TVmDWuLCrO@a+}x$RGa4YvCVwY*`XYcLrmh9%Uvm3SfSc56MnMKVp%
z>57WT_Ux(PmP2#cxot&#-fE}dug+mh;uTD670B<NQla&p?|Cb7GX+&rdj7L#aqY2l
z@YB8#0z`?i2*`wS>oO0cRH$EEB%toVFQkq9%L1~d5D+HPgemdWgN1ya$S2TVtP<$2
zB1n%THI_AC%N;GPEy)#;rj}cJ0g+NdZj+Q9QlyyMp44^&T|~fa)D)3Q0g+mPz%wyg
zq*>b$)W7}`R{!P^+Mf~BUwj$e#Wii27?YDZ6h|-Od?e8FFlonB+Z%s`BH%<?>uGzD
zF^=fjq@FOq%XK#jMInS&;9amaO*fNa8*{YwUrPUZuq)ONX=T!5zIF}2{D}|aJ3o9I
zKK8Lc#NR%00n>ES<%B#zS5KqU#Jz9cfkvf+m1j>A!lf{qNvg`em|?Zckq)sVWJ8lZ
z@y{f3&Q51B*9q{|Prr%;T_9^Rkwh1Uq!bou8>GFWv}R1w1vp0URp`5C>n-de06tR6
z%AD+=UE(^gh11Em-w=E=u<fsI+bjvkY$pUe{5YAY&?G-JpzZ6xV3Nb0h&tSIRZeV{
zF&?q1vPzgv2%hfPpy(Sj#g>5M#SCv8*Bje;fk!-vZ9V`meqt5>DHE1Fq1s^OGi|j!
zK~H<f`XeROUpj-4nH7`{PM~&W4YONU&`EUBoNJ*n-+_1F4lF-?0iNV6liGe!0x~mJ
zgxc68tc%lqzSMNaSA4LSPNG|(sc*syDHfe{5+Rjf|H|VfuM5>nEaM}n_E4QqVsx7{
za-k`DDyvIXMU)_8hDI2uE^&ugFG+*VD!jEhq)Q1j<^=qFGMwrQ5g)=;bz4vJx=ncH
zIu`!)uavoqKR%%WQNoCF+HyPeM#evgb&n7l_|3Y5auvmUjv;@`PE<bkSx7#I86#h=
z=ps-3wkms;pd1(nnyz^$4`UQ*bq~;2zIZdD-9(Bcpl1R;6GeJ{SFqj&(@B`GuHfN^
zZdJ9?pZNIa(P}AwJ9K;6rAt<!9N0O7xw#6y^3-{x5;-($Ep*#G?M3QdMAsSl2@LA1
zlnjm5H&^fA9Q|yCZai7?tNPbN_ap1IdN^>~Bywqna=C@X(P^Bf?YLTQWBbk$-u+K*
zRnoH{5Sun`9BiPtaZ>DhqT1_;im^^q>qe}0Iqu58Y*H&qmdCzlqf*|N?BaqARH9i8
zE)NrFk>pGS?lS$lU4(`*R!1#NS#YN#6H}h)zMvyfRxF`iX`y%Zl5+K0{>+!qJaZ1o
zpp2QxGWOgiFnafXG%H;rw?Y^RS}K5BgBSX()@mKe@gf0P8XW?u=G>~DBKJ`TLbwt#
zJLNa8O(g0UQmCD{gq4>Y$R5~_Bt?O~Cw&`)oUsG#hEALb#HRmIWGf;w8R-kllSpqH
zSKT9IL>lRHjqp5x>7m$D*Yx;%-li26P2=cb*BKsPhq{RAj71pnGu6>Tgj9vRAA@R}
zj`1bk#$0KO-6UL~qgRt)M9<L;cg+daKz_$f>fi<dmp16_8#QYzH|luXz5DUgKm9O%
z_Fw-kMXmesiJ$ub?!0}6l4S|y#MQ>JqqF$XcOApUD`f(*4*t7;bPw*la~mp^_NG->
zE`6{O_nA!ixN@1MOjB8`(Ahrq$}*~}EgAs)7+7^zn>g_1?b!33x8SQUTvf@iMyrN<
z9y)|Ok8VSCtrjL9`hSOGIAzekO&l8+ENrOH#U{lO1A19D;3^g=4*IIaOvuJ#u3T_R
zZJEQZI`j#L!|V2S&+TtFK7>*T_t7b^u>P(g_&V*qx#R97M{wb%&}q@r;;8B;)@jl7
zzXDXBeh%BVEF+m^bgm8O3K3@PL(nCV=++vTdec56i&?Z5%b_C<xBRXJ=Wxm%mGp)H
z>vZas1A$T`G!v**#?b1Fpmvp_+{*%MX9-|OcZ21|z@!(fEmR0c7an%e6~^yYCZ@bZ
zfb?`8xmyl`(~OLF%x`xM*vsu{=-y|Ztl;VzF15b^!YKo`AS!IPUQ1c@oc%F?$<leW
zPMt*Kxo6;Ii>A=SaJmLiBOS1z6nc6Pkm>{VT>pDRD-YgK)B)2(%Ujw*be?j`C+!cV
zj&^aOhL8W;moPg!j!*y93;3h?7V3)v%S#Q+<Z?&}51;?SDSY&!ci^G7@5kpp{}Ns~
zK9BQP%gT(n-#`U@n$Us%Trv6}@|Im$t>NJh--=7!9v=C-)5z2G%cqgQMqr-J(es2%
zvLsPCTfw9G3`Gw`^eB==fu=`NX12YEl~Zfz1PCMT>*=ZxsUz6{^|D#_1>pL8a0lMA
zdRIiWLCC{mxUQBf9khs17I4aH!^VtUuY<#OMKFdjA%zeb&sY#;w&hMJoQ?LIvq*`+
zx%t?$`dY1I;6|fu{dCp(jbpprBfWjxnAdPsaL|~mA+`7fw(l6n65or)LQ@IuGt%Xa
z>sC3syQ_z8y@}*#7QK3pp10tolG@vaMbru$rG_xHhubkhgo*_79t{H0|8?PWPb+P!
zvbT~Fs#X`NBQxmC(@ou2Kz2MJAeA2{qmVyTVVma^2KSbh(OJxb=Vla;N@axNQw>9;
zqI{_YNT#s#$uB8z^K)r6keJ+Vq@HkTg0P39+gLJUQq^xrdW{AuX|j_TWy<}_(oh19
zw5F%JnQKs$Epg;|lJ9kOR4Ww;wA|egH-UE3NH(O@fZGEx*xjf_)9pitCl$!fFRkIe
zx9-Manuh=CZ+r&QdHwzGx((ZRkK(20E)lq;k?o}LQy=>zc*4U-x`2}x*1(HNl-C+4
zrE|_*&xQgSbMib%BfT<Rup=;`i*0;+31=^^p|aM(>{wBK=kV<_Sh!k6i>6#%dW;s+
zxORF4XTN?0J7$V#HUsS0HjUGN^*p}%_#7s-PH1=fbwG8%oSO}I{u*WoJ`7yZH-N0i
zmk)BauFIE!Bg2ha^J~~b1&BV!u&9VZ+xf+RfH{$;@AA3awh}kz%4q=U*lKAh7mu`Q
zAs|~*X&$xn)~|J6EzgT+A;t}~nWl;&QbU=`B~Su;f;76~s@Q+Hg2f%PSa^;G*UR(B
z(==Rewe)h8)8OouDRiq%tRBBeV3Jdjs^@C#?6ktORHKNF7mJ2c5otTj_Q`fH8GWqf
z@kmJDgdA4C_yhr<r)&#H-f{?h@jO~rSETkZ=J*q)F(qf6Oe2x$qIT}I@|zVMGo_a;
zeOfg8Yj-gA@Lh_JuK%aY%7a!$yOxKJX$BFw#XF61W3R0QkOwdn0v%JoM4#!_IMM-3
zsVG8yq8@a4*Hhc1nrF&ZLV;)K19RSeY^9Zq%lPLeb+Ac9n_>$1@9z$YXyt*IC9aKD
z2geTYP=NVszwsz$i(BbSKHmF*LwL)Zwqv!~R5xv2Hg%)-DXv6{PS*Hj4*RDH823Ea
zJZ^oi($EKr{iWwEsZNkx8t9};cYZnjpO_lKFaOF{@tObcC2SiX4R7uYMXNFbZ_$)%
zY-=9-Z<|D(M(_MsPL&5=s;uFGckjTVJ#-^Vu{Q7BkR&VGM6s#K3}VtStgEKjNG9g$
z@M2C~PE;#g30O=`zy{R?oW*2a!bHD_%KBse2g9UXk!M2O4}k~Hcl%Wdyw8-z@S@Rr
zBV%yEqb#X4YO%5``C;H?QG4Me#+%RKmX97r>Gu6-5U5E`J~duIc6JoK21T*b(|{$k
z(xAr`7aursu#h_F@i61h1rK>z_hF~}n#Z-}#~QSht)idNWxllr=AT?fw?Uxm@wf`X
z<xi#Dti_Qo3QXLRMDf^8WRLEr=)0<>`N`R7_|hz9dJ@gEi*$o#4c%c3z;qpgey$9+
zSnM-*84)gPt{`E|Vd(zst*juke?O8_Q>tPuDkC-&gH>lJ)q&xS1H&PA&0iff?tP<1
zv~P%lg>9v`DiFvrvB#6`x&#{twIy)XYi*=6N%RPCn>6JZDP(D?PH-xGRH`(kOZX_|
zb1JIv?SM$&nDu?E($r0Q%kH3?;DW4*A>f-JFgCWPLk+j(-wXlaLYHnH+4*#(fn_>g
zQ{#DARDmj85UVnB@x9o<Uaz#3W>;QMrRgk=Oy$sec@-xK@YiU=4$S0n_ZUqnDY9L-
zSfPDN3^ns!&lG&U0)~x@z<~`48QAdUhZQq`MTG~RV+g)s5d+{Dg-0ggQGtOm8V|oG
zHTltVH8grr0R$Wqa$Qg%!U6@)v)2pMG*cH8IELY&vAFwQWFpSothp&Va1R1AEp6lv
zc)o06xQf!DE%5Go2+#fd<7k{bk8STdtd?uet-+`0p}E*Vx@02Iu&^PDT*IGW(J{7i
z3T8$DFDxA3uIrAD_Grp24QbLeqYCPE0?d8NP#agDMPWxtIgkw<LPP3C_BBg^<www{
zWRW|t8;hU*GP1j8&|N4i?p790geAic?Sa^PW{Sn4(sf&|9UW7>T&J#qR?#?gUyk0p
zpU!!m0R197x{tl2?rtGuWGzn&Mbt@Iq@dpCy1`Y>S49inINb#~6*B)*di>T+<L?b3
zT5~dXuP5u0BX>5Z#b46wMH{~88gY5?<)p8tn%?tpYHcqmX(rR56Xw&jZ>7`4niOc$
zu8$=nmUCG2$kgB|P@&PaP8aZp-+v2UU25RTC(mOflTpf=v==W;mDOfGT_DmKY-A*h
zwYdg9f3b>hJu-n?SKGKm7wzp7+0LI@MT?#nN+~@;Z_p)|N3=?82C$LT3mec6!y?&@
zI_kzg7mf+Ih~!?8=Riaug!}+==oUjOgnhjby%*}i)ILZ2E|-;F#>g8iq9#OmaFqSE
zno(L#R}G-tPz`nuyog^9!+X!n4NTWuVF4RD^B&2Sn4u(Whgz;>XQN}NoV<oy?QgL4
z=s~n@y${tFPb)JTKb26fRDN3f+m0NZM6cRLYpG73d1fjdwO9`U2@$ATa*Hz&<HGG#
z$D0&<%#I;{??J3Ra{|IkpmDj3{0xwrN~72AlVSkzd63ZjN>Fc8AaMz`3(~+Wf%NvR
zswrYX-|s9`mEu9#M(Q#~5w<nc9g3Yk^L-qxOCwnt$1_oojDqD&Bxjy$Po2Q%?KEJ~
zF_X!!PR&<F;C_~#H)&o<6N6-)o6f_Av$ZOTj;ttC>wLp158g19VMbB1j}PfSzo|4#
z&YEOv6Q2#J1!VA1qiKhP)_^YhMY^Dp6oKY_Pu*C2gQ>Q?4&^~w>q;7+q?*x{J2m8J
z)J>X>4&8R3rh{Dq&MQk5>^(ezJx3?7Kv4##kvLOGqC%e+34jmC^4ph}(4%cl=aZ4F
zYXj<F=#+kgo?-$U7bgr;AZ$ii07IO;23E+1NWeCt5L{o`zV5Lil6|4y7BS}LWxZ<I
zK*0icC1qBMWz_~QwZLr@%n6)(s=~EbsX#Ov$k2_RPIZw=_B4me5miyiDXon3iY1C(
zE11AZWW6<rR9+dcw9735jE;^>X{C+1D%usD@Cmrx1|G_~`YXGHTP<ciyX}4$gBEFm
z<57^2+cTpbu~-7FMd{<Qs(@Zk!4Vc8M4feo(_NSAK`iKE>Vcz3PEMhHZ4uc$+iBL-
zL2{y`Y#oDEVD>+v2oxP4DFcT>-~lu5n`Nv3f=92_WfJJ`Nw5xr6dI>46M%NqOs`!_
zqE)6xC854xDG;f82%60ZG<rsvp!xajH-UB|urwhpZOmIaa6>?Axl}O(Anh9snS`Jd
zbjxkCC`u^{o#2sVLOFB^L;~%YR@4c4WIwSZg)#izZ+#8N?%jg#de`kJ*V?+OOu9Q|
zn6knfpDy6;x9vuP0CZ+Nhe_I@J#?`jqlku4WV=ciP(x1nvq?P#b)!--1Q^BUKq;=1
ztG!<1acscd#y4V6?iB(T9JB7&Y{BuY<^57H$EVh;o7>V{9zBovUAG*Ug&JGeg3+$S
zwNaD+AnB$g>mVTr^coah1}&tM0V>z%ocd|St)}1h4pe6E!Ano4asJXMR#r1KXa~ro
zx`wxPG^)}BC6_~|(m?lxr?L9#736nLA~Ri51~SraQ0{w2c9%6C$Qp<Y*BZoSVPR>n
z5D`E*CBK0JUk#elG`oK0D$f1(=V-ktbxkHlk|-S-qo9C?U>Xh(eSEFvYz>D>vpl{!
zheVcU5VGRy%tdVZ@Po)5-bEP9wdBhJrvXVGf~W(wfip1lak*NiX83X4Wjy5CI}M7O
z(-gYqCk&`l@Y3{@5l}KIOOIt3M)%vq4m~jRBA!-t$_4H*x$B$M!EmBjZwL+gdpZBc
zR15vUgUF&oC9qob*2QJ*&Q+2lz0;y<Bf#m>$(DR>UJk736yEcm14#eFH2(J8XVIwj
zaPPg_@vYx}n4(#MNB+|**gI3g*Z=0EGS;}0q8hD@lwQUDx(a~xD!{li5(*6O?<Lr9
zNtjb8HB^nTQLnI#XotA^!BHNBvJn<l7KNo@(Jz~szR}hSJ-v5jRqhTj-OtN23Ikzi
z3MI|5ZQt$GpBqa>FFs;fx|17KLMp}4uF~rq%}x?o_*+L+b<*moCNleXp+?IspSX<i
z@idyN9P{%<q}v(z34xJP8{22sP@=!xAgO=TPI-jvtP70nEn(lWBk0h~snckpzEH!+
z9s&-TN%!mkViXxh&c(vkS|X$lnB&hGYirNqN)W}_GG94sapPS(ecu7v&#S1PYpTu-
zG4qL72oWFAWu;mB+&PNoGsxevAB~fz(O#It+S4b%TO5g8N>|spbd0q;H0L`MRD_(M
zFuL17x99O-B^G)R4x+2E+hVA#=HV4-n>o!WdYTVc=T*wgq*q0dr?DanK{HEbTw}Dh
zOzCOaG%dQ7o?N(@3>)%qYw4{DXwyubsR(xCnL}ne#lq=KYn--JFFmPm%=*ZTrO~=t
zM=_N|kKXGvyU1n|s*A35^y*KFSu+^fl|j~8uap}o?i@j_+)+bzmLlUldq))=asH(R
z2%0Kxohi`ykKjJ+g1b(#D|*d_yLYkSE?o@qPQ0$W*k&$X>vqJw0cS7U&33cI7@SVG
z>T4`=`eIJEUC-Q@EKF)eNj1+Ts(j!1o|AMN+PPOZy$zR3Qe;#v`*``)QB2bSnaHOx
zet;s+5g#x7`{%I#+je8=#YL3Q*Wm?qBr<f(jAxB;HAP%qil%79otdaAQyQkIBikXD
zsqA@n=LAMR`u%w1hyDW7ckMuawty>-yoz)w8##?3N({xRO%c5ZG3fB+)IHnh%n>N6
zfmgP=pB=}<mMZ+_0zqnWFq9DC+yb$x59Q@7u<-l}dZj%WzjqHNAGil|fBkou|C?u#
znJOv{m5InlH@g4qHQ^-3Op{2}u{dGC7W$mX#AdtZYk5|}o+GAYaWefSlXH@mN$nU%
zX>T5#Q!hef(m*za?2&uvvpI^`FTfwmg5`a%F&b<})DOS8n1ABQn-T3gKuL#uH=Uxr
z0loou2w_K6HjvSg^gxT|EGZftchN|>mg!+(sfJ9#!!37i!PTo3_>G=6QZ|?DK;p<4
zh{*c%F<J*-XkuG21!)T-N9TFEIVBiRl+xgIA+)%Nfi<wcnRh?eyjh`w8>#k3^sLX=
zd%fR6U$i`I`C$pm0V8oa<@1fdL4RV*cCdw`ffXVuG>Ece;f~p&0!tT2@Y0ei!@YaP
ziAw>S!|&MWD69dFEcn#a($mvtnV@P+?8W5U$FchC1yuz#|CKYyO=cl={U`tAC8X%Q
zW=m4!pHrYGGxpY~I)N6F#Tm3^7#1vqw~wR%Wbdu~t^3fab#d~yzl=12((IdeqPbY5
zNUe*cEK;$h`8L63_utZIuw8tefh4A@jT1S{Xm6QwQshi(@$s|hZ1J)4O=*h!f{+t+
z`vk?DHSBwIAMlA3cK`G5#idW3gr7~T41ewP0+M4z)i*3?^<v5idoA!V0%zegRVDfe
z_>-eKj6Zk>R=@NNdes*Ev=`2Xf`Azjho*s~JDALtaYJQ@N)^5H*O1w@8_l4I=DC-V
z-Ph1}swojxQLXho@NtyhdBXwi8-k-%5<n*QZrY)B6RZUWn;9zVfKFbTPRNO8=JEA~
zi+JGOJMpgXID)xOLq($V?H-z3gf3d^@tSg~E2lrnTvD|Ymw+m5N#xC$D5SJ=mk{fe
zy^5g;t<ChS8zsBMCW)+#Y!HF#Gc@1yFCU&56aD<F7}UI4gb6{KuWyyeonB*ZdG4@=
zj)KR_ebsZRW6czhm>k2}%UAUjIOQoYX_qCBDv%z{!b|#^j|_FI`q5r(D;t4sqlNL2
z8j@a5fxZOrbh3-9=L0kjybFo9ybl+@d=9hs%;MT(r}4_~K920<h@*!^^gIw@qA2{#
zYH1yPERQA0B9n8`--nR~g&s|*_y6!in0m(nv?-tni^9U}BBHWf!`oWUJ7_kLnw-Jf
ziMnzNlYsZi|N6UFedauNeBV1U_3k^-TC9Y;w@!K)e%x}keY#nxf{@CK)vq3>^=mzs
z-3Nw<zYThQx?2?qB+y;1qjhNsm^z5m%vP|}1Vz0~^p?&M;Af*mUoX_tz9E}6zH#JT
zf=valC81{8nW&pBvOQJCE>ay(S!+r?H-7OaK7?(%OZeGe`V8hy)G%EvV2;jml1mF9
zPwAoEq!?p^?Pi8$;lVcdePtWSrz{i;L&EjTyZjCK-Kccfv{hj`BOtptbc9$p!L^<g
zY#5ikZb|PjcP|^WnutyGY37*iY#Ww^8hMtf025qSX6dMQu>6)Ap3gHaWwa#BMzK+u
zFr2nKNdndKLK`PvKCcomshk&{H!tZ{qD8Avp0<IOBW<~FJIZI*(5?qqxzt2qN|#bA
z{+*tVOeP_!Yp7Scc<(3w5$3+OfTd^WDFV(@R2*nZz?`E<&nw_6qih+g=u=C%`r7!+
z!!hNSNi+gknP{zDTtl8OB9-+OMHWBNwnMNpS5j7ul3vTx{nEkOBVSYgxAFv}CbuEE
z9AN&l&#Oe8Uo4r#84JsY8KS9MWE9TSj7FX#-l3r6%9@h7saEDZD!5R}19=W867MXR
z6|In#1Cum9Z#0m<Z6BSlow)YbkI{i{Ah%~5va?&zs9jL{UO(`{#F+9<0Gqn0I#>^A
z^@X=b+^FJUlL*aTOl^u-cO9I-)Xq^X)9CtpzyAWxo><0#sc}^4?k&>EACsC#eq%;6
z>jIZp&j>~gRHflMqFN*A+%$4k7|{)olK!Xk{H%=Pu(5q&KcKrglk1gx#VW?QV>)A_
zCPYets8x;D%DPo%{f!z29l4^YHl{={3I_!M{gJbYwtB4qxyc*^o$H`y`evELR4BEw
znQ*7+qg4c?Mlwhch*i%nV&tv2WBmSO;LVm+3COlYgtq0Euc6nJ#?@)eJ#`+drxq0t
z%v~2QBQJBK+OYD=$;?|PEH0u*SU3@Gw48K^>q>_sly2FEPQ8mxxry{d$+XWg(l((r
zxx6jg#B?=)6PQWmMIxI(B9}p`;G=x1Odyt4oa*Sk2T;0whx$(a+!`8}ssx0|xZ<Es
zU7%mbE5sBfkW8ufVLuO|8Ic_L+RIf;yz@47T;+3pE}5!aldXgjnJfy&?m%X?gxd38
zMz1DYR{5dVu9kYKRgT|`Xg8n^=*-{BU*mej5Ux|-vrL(MtS&b3OTYYSnRdheu~}qj
znW87<Bc7rHWHgmzUYv(?))mXvJMXJ#%tX@IL|)YodM;PWHi&B3I?=2fSxO0fFp))?
zZj6()Hck-;?2w&H`@#LXRRs<Qhp1>`=<<Dju%YLG^^RpxwCi%YR`4Eq%o>9k%hC2l
zr!c;?jM;tCg$>MhstCKIIy|jfqZH+LvE#m7xcHT;QZlM|RlA2OVag)zH`H^RDb49m
zo=`uy>z&(BJhB6;l>`bCXV6+{fwkJoHS5~(GQ_jXC~Yrc&-;(y(ibl%fS1)_+$uC|
z9?7#NJyA3ptJGt0S%`4e2t106WfYs=TB3m<jq-^FjNY;pUa5%rr_W<*+6(Oq^)*Y|
zl20hzt91Bc(g?lAkQo_6x<J?dp1rv62PaUzR7PQY0gbD3Sb5?+MX@6k)ytOPZPhbP
zg0fW8FfJT(95ahCm3RV9aS4l(qPAybtQVXFTUlP4OsTnzd@ct_DfOzoa)~12F0wnP
zk(wC6><1r0<x78#>Ps)cE7E{Kpzpg}tzi3ZMzrhvOKW$c$(~@ZZG*&+Rxc7flRhq-
zUO}ze!c=hz6ZrzFy$-ImI!H<_EdBaIr)#qQLQxHpyKTs(bM)|xKZ01tJ`oNFJCs-5
zAgb+;AcqYcn{l<0TyEEBUnrW&9UQ~yToQ?L8wY7`5;7aU33tnJeg3o?Hh^@k6cKTx
zgDr3dJqq|RzBVj4U{O@dqjhsfFU##~m2exz(=v2>9#S+dp4l%m*J)M89dWQG$`m@f
zbqfRRBU#GA&m_^V1~~Ei&tu`0D#~mJR@SoU6sB?TUwt>WJ+K|gT!3wFzXi)LEfWZu
zb8RBgP(N#h`#s06HO9@lZD<BL+)x6mDhfT7fU94tp;Kw2F;5ZcrK=P;6jfGV@fvC{
z^U%6@8L7i}pu77WxN<s)dhP&fnS(g{$QsUkzKk<}eGRP&M|L_(gUL25J$VhXk(WF+
zopKAsgIiEKwhQgmhS?9MEF^V=%FJt~fLuqK%!z(kbWXVDcCB7QE|VA=#oVW##{6f#
zuAXxPzATkdT^yQMm(eX>L+$auLF2?Zc)4Pf4C6*CtS|K4H-UDYf7-Z^jq=xNeKB5?
zfJRnqEp{5Jl#?0WcCFFE$j%Y`;7`5{O`5xOI-CGjhh);f;AFXu&U6k_v`nYf9S&5Y
z&kt6t4`kQ?tOosO#n2?zfHAnFrs!sEUan%~mMNUwTErK>a2}7JS;6?eF}!&uk9s$_
zF5{V@QTPp3jA6j!C87}24e0JeU)30QzQY~R=FYO#ct*H1f(y2xQH=w(L6ptzEZ5L@
z^#WL0SLDUC`>_O*Gi^6?f_z`<NSBT;p>bu6uBkL$cru6L2mb;1JrCnkKlC`dt2Ny9
zV-KQwVF|~7=SijWRFO7!%wNKOUNE3;jlCT~zd$@`W~qXhQH$AM&qq`Cyjy6hDzwbh
zD0Y3|b~Wu!9XW!eq%LTN)16<y<U8)f>Ouyu{M#=fck6BN#>cSo)t4dsG}_%f79TyU
z=#ZI*Zb4_QscaUx@U*&(ey6k6rfGds`So(QNJO0j1Gx5KtG<G$0!$^(cvSFUqxL{G
zZ48hoNQ3mE_V~5mXR;%(^jn}o^4s2x_PLAbE|!&Dqy<>}JElS`e-mgopbqH&W3QE?
zg&Q>*kZ3jO1m+U>XaDr=$Y&A+s2X^(sU)smUc$M{W!!Q9ZmhNHn5SvjHF{ibb}&yD
z+|)=GQ)4-_y1h8K3f&S#Mn$b^8`*>xP5b*)1ukfD3|4XtTb5&Z<jkX>P~D`xu0YD;
z*!j+_DBiaX^@$ATsvYFhK4#yu2VL2WvdcGZVZIUXyII8;-$1n>VjQijE{ZC{VjUS`
zpc=I(=Y3UZ_CRnr)o3<Sv^=n@IxwKrZUmS;ID(OFIaKHBVQX>W^c8c#HP-1s2tzqD
zG}n4~`9Hp(_|5v&CA|25e+``#8pwGPg&iY!{@*=G;O48|V!e(~iiW5YgA?I~gM<hx
zy%Y#{^z@mV#*#8a)S~q_7G%5gE_(G2y(VC#S&RH`YCKDi3<`TDQM+8n<-a|N;_fkY
za#OV39=c~wqjdK{)Qbm^+dYY7I>74l7g2uUifSDrk7e`93JUusaP(ik4|!T<@v$?i
ztF3MUB)ib2QNL0~{lc<pO)ebe0XN52gen9l+7%8M8?fb0nY1!Ox5@=!)*}lQXuErj
z4sF*03WxV#>-T&J3xE2TXwpELpaBB5<AN#06}Gc0#~bqB8-k<tnUKBNx4j-f>za4V
zN4eF+cYNe1N~3A4)f)s%+L$Jtph%$6#h?D+OSF7IQMIScV<f;enr(dhLx<40QpML_
zn8Wx)UMl+3#>sBC?HWbHg$(j^Q%&z4#q)o64zmPm9tL}nu?<uQ0-Km`Tb~v4o}@FR
zj&XIaiV2EVecIkT|M9K3G?K=D_=T^akVs&1B1e&whZE0S!|Y;1l?bm#39P5J?dNLk
zHh4qSA{(j@3`fhXPLn&lDeLpDMPw|_4B0JART;A;G!UUS*Yde~m4+*{Ni$E+l7wS*
zDHrrJX)Hf`8PkXEKx1wzY8Td20fJ^<oC7VNdU`uT{*nH6Xv)0v!JTMQRJVE}f#R+_
zQiUw`e%oPOdF&$El@6Zz#V_IXCr=_bRRn8D$%5_%8_;!=8cFFsXp)+e62Y~)QX~{+
zOSG?n8IS~RQ&J(3jPfMkSzjt+_xq0_J(g7dw#|i>@=gfqEwq-)7(X@(pMnXQH0o4(
zXe}(O=z4*s{^K*-u=NLy(A~8YXMg`Jn&+Oy*7qDk`IQwcJaGldVoL4j<Xd(TSm#kb
zIgfLH@EDSl6Z&u%Q+7G9Bazhnd0^Oa;c(2t76wLqxia@LoobmaXfcDTXObLD*eKY#
zd})v17H$9J+YV{-o?d{7`wrmh<DZ5nsf<8-2g86n>ywq;1lo1}rI^@Ghb^ZonO{fh
zfc}%oB(Zd@hA)2pj4nw}S<@1MEKMQjt8@5Ye(D3tr2ChD?Q?2){Pu_M!tPQAkAD3c
za`ac;$mKw46nogaC5H$9$sPE!KRS++i*>9f8P0dRNCpW^(8=%7g(3ZDm0SjcM%_`u
zEHWKe`3)Xf=(&Xn^7@ty9_3B6RBmF|k!jrhormF<Qh4E+tN4FDbpq8&7g?H0WeDu0
zbJ#LX@lHK*9y@o9q33%s!ES$9?|Ml#3<2BgO{D2!1xNDb$gC9D`c~G&LNImgx8=Ya
z*X4#k=yp^vNi@$XK{hROR8o)`O3E|IN_nwo)0jK8hFWilW;w}_?om;csa#{W`!bI*
zp4{wzha$;|V^gSJC}a7RWqRL7^=cKD9=VM2S&9g^7P0ig0@C9-Ox-<$<~)JL(JAC+
zGX$z#luxg!Xw^?M<%=+V&ralMz&!ugFC$5St@Qmg_)pw6gKnjbl~)!BbW=K7Gld?N
z^Q&mDbg|`uJrw!%u>9v&=sTCx2Fj+7vRzVVwT|T%2xO0rgJmX=e&9`b>L-62nXwY~
ze&l}It~GROSCkSVw{r|0U0+E8*`=p0p!w;Sm102+k|s;d!pg6B6d|lxxv6NhwIa5d
z!Il~;;AOTLB|6VxSL(o11wl+$hcCL<Y8|9!CXl26sq*qgEdKQ);N=>;se+08HPA9w
z58Q)8_}>KDfqy;0iV23-uM>q+{9nvw@Y&CtR0*wOKBGQvwL0o`5NL&JyVJqNi)Cap
z8NBDABl!Q>dk;9d&iY*VIcIt=+xxCo-RhQP$xW_UE?~ew5=;xBC6I6-?eZnRgmCXA
zgfD<eNJwZVKp-~oVK6q}Zp)G^$?CmsZ?ii)JH4Ot{onVLIcIieC11;l?)Pc@8*6sz
zDermS=lz%Gu|#v&dt`>!AO>jp#}Z|ubdfC$II-<r*Wf5!FhjJgVZz?=ND_W}ew_Yp
zYxTlUz&01l!)6uhF4K)5W))QJU5i2in3k=Lz}w@t!>WpnXXtnQ8(L|}CL-suqr9>S
z|M9I?F*`}i$!G>{n+1*SUMySFiUThVBHZS|8h;oPEsx7qL3djf>eS-aJbbt`DMh(n
zRf0ha0aaaNe3>Z9m2OP~FvIj+^R*ISw6B3;cf(y;1=W&9RF}FcbLOqjqB61N(q(k6
z3gPG|f#Z=hg3S)yl3a@iEA70hhOKO9_oe?_O@6%k)&0b1li2*no3Q-t%Q16&3a4mQ
z)OBkw?Xv|Inq*gfXf-kuX*h!}#LmwlmvADytPz4O&Kn;r1%Z~~88ohO!PV&D<z^x=
z+hQ_Dtkr|)(Fg}5i$eifM?(Muzc|kO{Vh&A-?nrAae%X0tH+CCuB^&7S`pbd4o`ak
zQ#%I{KkGu{1{nwc>PMK~JB6l=0s(#o6FY|C?F*s(_C8F!ILK0_h#ol21<M^x0aY}o
za>ixDq{E4SQ8`PZMX1!%>NT{=d8||$R5XIsvSh^)9Tm2#oM)x(R_4wWK2ADfuMW`h
z%%l14>royVfy8npY=W&$YG`*YId%o!t_ZDzYeHMzl#_(tFv0K3CcUHTA8?%lw&bUQ
zoX!$B$^~4rl$MPQC<_^U`<oBqp)b9F$*Ck(Ebo9*F5=vQNsQ6O*xcYkiB9-9E1@CA
z+uj>O-fP351H%ZrU2rlN2X;ZwXc~;q;uG(=4vT|s{OB8d5ej+v^P+me8g&gU>SG3?
ztg2-&k;S$*Ekf#a6hWVp$9_i%`14kgFWG!OL1c-6`Mh=<cwvB77_gEwAF*w_UF6Jx
z={0z~4xBzajt4(=E4Hp|#1kKX9D&w=Qnn=2*E%phMxEERC1O2|1faG^xF+;0s7py*
z2wD^VMn#K2(<?CgXhEpbHZT_Zi)st1D&no_q?+^=*fv|#?<d6Y((?P*xF17ji}3j@
z%J1l<T$R!)i!S`Fl$kMkLy=9QG|4W$w-49<)mCD$aUA;EPV~Qd6_1S${bm4xK0g7S
z2U7%iR)<Xy6=ESNsRX;vK}%mnGLbQ`Vlo2@O{zAp2kvGUI<|FT=*iP4WhHJMBZ>yC
z1EY?MAnS~q>j-G&bM#y>S)d7l`IO}e?327w!s4*fHaW27({IA5Z|%n9&H?nk^%~@6
z5{T27v(Q9sby)QpUt{7xn=7?O1m=FgavnUlk}c}TNIN&WT@AF5i_B#wd34*NiMK0v
zrU_HX(WEnL<)S^>Sg|-Q9EJ0dS+s6nkI>eBjQ!Jh(9j!z;Il!XRjI%f#@zI;o6eq>
zsg2RyLlaM{1^$k`!d0NHaqACky`PTEW3`+WURS11V2n{DP|ZUk1ix-$5By;}rYBNx
z(BK+48^NY)I}!G~;R-wP@b~v%QGf}=2;3ndM@#TH8?Xe@%}pM7x&t_VWRk~89WIN?
zcm&KOQ@Hbv<yg@b#0!reCMGJNwb{=H?F23Le0~Q!#Cq8v)quc3;FzEb<0ygbs?A+|
zCO@}-6t~^gkN8XuhYwEBK(cX`#S9*Eu^bA-Y=gvr7+_db9RQ2!4!}E<m_J#ohYNqK
zWl0jc=t>r$B5EUCTx{l|!ZQoFF#s14p5e^h0H6l(7hdUF2W*XTQti7;U~3SknFqGI
zNDZ5ez_Zt}_GK74RY0DW&^CufcWZ#*7-`?fqZFkwT2{9pJ~W5b?_LaFe;ZCd{0iEZ
zdl25d8iP-r!RSjPJZ!_0q*)ptL3>4P$LLDH^b=^}4iKYcyOJD^aR7JHq~5ru8B=>l
zcqbL>Rx{SvLazEAHD{n7XH|>CzbK6OnHdg-jq6%ztQIk~dl-(ehX*hjIEGiXVD?x9
z#drbski)2LsmF<-|3pR5hKDw2jCs3#{D;%SNiMttRGmi{guew9SlM|o0xi>yu*)bD
zyHCy9`15R^OYsz3?P1vcHWU+SczQzoI%rtlgyNB%N*g>Ak#W+vb}8U0c<H!%>9;u0
ziU@S=yW)WMO7RTyyb*BE?d@p*251m>bp#O%Ix#(*!iiVMd9p~z2>8X5C$O8AQb%@=
z!e?{vdczE{-5YP~MMr-Fh7vi<luAg^jDO<jByz-xne~j8U1w!NA-@O3R0+>Mdmhv5
zYVHoA(Bi=u4W`ZSUW>jJEr?B}=|Z<4&a%Y>;LQY>Nw&--bV-aQFg*}QwkYGLzc`75
zM<TEjJ7q1jZsvPW7l)I;Hqhwid&NQtJ<Gz_NDL^M%quZQdZkDQ(%a%hJArm`EX^4)
zswy4oRTW&U>Y$#sg0w&-gR$gG*LyM6*Bb4|QK_MoYL$Iy+O*Z>V|u-8#fMCby+W$!
z*J|ZPWyyjJ&2UU7wxVI7Rldl2cNqVzlFXOod77|%1TJrS=vMUIvji`GZWqMCv*>$M
z9|j0ur;o*uV`^^fc(ZsXt$Hen8Ctbu%P6KxJeJ9xW3IUF7B5`QG;T5_2sG*EqFG${
z`Dw1Fz-Ao1^Gl6A8b!198ec<67%P!t`w}ETveCqzi{|-j-rg`rdqx_v(E|7N%EgGC
ztL?B%G)JjxHR}viI`9P3oqaAno<U|T!yOkS38s=Rt$F~Gq5449Dheuhy`I*fWl>Dh
z%5iZk{41O2?=lvB_(pWTa~rHaKV37EoaO7<4YJv*&J;el8ak+bTNB#yyGcp-PU12%
zS|tu7;l`W#aPIUpMh0hLr)ibNRJjimBUm)pa_J&p-mE2dd;U}ec>*?H&;}c^*cIzL
z5E-At&X<NTn@J;VbMyEq?~Gw(R<tY(hrI|jIC1pw1lrpDaMSBkv}`L7bNR@h-HgcD
z8ANuEAQemF#ygi_n!s_6M&X6Q1Y$E8-d~@}=WzR7%V=9l*tcttS2dW~W5s!b?UR=-
zCKfhG(nXUc*22n#T=e$`K6O1x`^NCg=LWHofY~EfTq1a)=OQ5lEWmO_LkOW3<3&~Y
z!NhdMs-?du8+@c{gaiaxXK<RVqA`pxkJ)Nr3ZDKp{$2S_CIOgB6)|M(K{hKOI}wA8
zCQbdf4dD?8iu57-x^yH#6POF_*S2C{_Y799m(gHPVc)BEtpD(OTzKL<N*Rgw-g8E$
zt|E9mlYq?I>7k{$1qqr=t!yP^5qXytd!5y}vgD7+t4vE5nHa43H6xqVm+fp-L*Hv-
z{$I?@G^w-*v$(H@NZh@fh=hee(%t4G0L$^e8LOU$1%l#Kt7}wLOSl`JGj6NCFRIj~
zsIpp7le<(OTWm_XTPkW(5}QP5+#La4UBQxJR@&@hEDL9|18ujhgfMXd$s@;LrPZS7
zWZ?s1vmO>U5Mg1A)-Ax&Y(cR9%44)wL^4cbe&KIa=@_w$T{{MOIKUrpDf+Z3$SRCi
zhQnp$1Lx$?32upFrO{BbSurp?3!4kL=bn{tdo37Xq9RENN6wDHN1M!IrdDDjb8~6T
zOeYbd?@ti}PDC@@MABt*;!B_ZH9DHZxOqt<=BDT1=?`Nfmch@zvk%>2znU}?;E-*I
zMlxJEigmI9<~CRuyumEQj8pMEf1J$bv1MBimJ#C}cxI3%H!=j?%L9xNs}@gsc~+H_
zB<2f**Gq!Qmr(MxP_nFMa!lJAV~LkB0VXQ|$%Vd+uN&U2|FV|N76jb_U2De`)C@Oc
za~_`!)~Q)UC++aMEGE4P#+b6S;$Xnz@Hn}CamzJ9-1wO-7}+_B{f`Xb#<vEr$axND
zM?+ZmM>oJ9wjfX7-FsUPW@tH{7)&vxc_qtE+fpK+WuY9VC%_*&EXp$9u4E(FM6Gux
z8<yWXaEUPb9~wkljK{j-+huV$^eP2rNp9iHTrwp>MVpO30Bb;$zt^y?712YJ$WCWr
z^I1%x1HlNXaz!|XOGgsRXVnpokW)VcqWV8=Z1Bmhtj(~B&AOz<l`YJpEMGt=k%lc0
zP?@PxewU_eE;S_a@;6pQEEh_gdHa_2B6?t#8ki8&vO%rl0J;dfe3j8I5Tgxl{WKlH
zFU`FHj8;>NVx>N!Xcow>2!&VJBCCGjA~dU;adtR{rX~i?7K}_x<L&ovz{F@AW05#)
zl86HbN8q&B`9*9a@bh|Xm68@s=$rl+or~ck@7V$d=l}47m(XhS6JvF=u5O)ST8U{V
z38Wd&`@9Yw@(>M4r3yn7bOy;L3DzKU$Ko(%vn7b*X$%q*aM4A*mKblUBvlxy08^~?
zl7+yrut>P@I+A0$NH<^-3x|Q(>ap88%ywRatSY8k9S3&Um737~6JewiWjJU#VYMr?
zKTng_qFXxAxGan_PhNnZmiLRdcOjFKxYf3e*}S~^GOb`NxG)`r{if@1;ipGYNDymn
zbE0!=E2a+2AUl&I1}iGZnX%WjVt?cCD`Q14fvS<o%I3cX^9ll0AX}~KrR&rhrXq8l
zv*GiM{bmaY(8SLGbL`pkaJL7!IJYqtBp7BQc6?cvnX|<MUrzwhgX5~paHZZ@tlD;M
z#UdK+QlSX{q7cGsJ23IoF~ldW${R~r^uKo_GNTDZUOodygG)be{o6utg$2Y<j?yxK
z#=6_0Cc~6Ctw_w);uE+dZfM0-Mq3XHU2hoNR}0K2vx^chtEz3)z>K-(mZ8j;uO2>+
zMo%M(MFIcv&E077dGMi+ZYE|V;<_7p@bYs5JY!nSNjP~Xf*`R7)+C@<IV%aPX0H#s
zUK!!w+3ukMW3@sOB$H2AiPlhVud?JTtA0MU1!WW`SGKI3Cg!@~`c8Q0@5hfs(ADb2
zx<)s0vf|t;pjJ~trSzuyFx9J(l`riaF4%mbmtksNHiBk>qu9@AkF~NdjoGq`n1hq3
zI^)V_W~-GG$wp=?8lE*YNia~z7icms=WyfwAsl$Mgy``ZzKURA%l@^qx@oHoz799+
zAs2T4+c~(439PtAz_KkK4A6v_ljuCrie>*dj=)1J9%rKyu?q>l9B02*%#}DhQ|dhx
z7R$DWb%}{$r4&^c-Z27`0XSvDOr<RdjBdGl)f`}O`>kD)CmTqI{?mdLbLZyJd0QWP
z-@Y1WesB=31}_(=VTs#{3Z0;a00i!;%Z>|M;*URnK~1t5>YfeZ58d@vmBG{t_*lHQ
z#1d;t85t8~mswmoTgLROW4w%u=>+pqE~~OKnRxj;I__ElD*-G^$SEag0&iT<4Ll`W
zv7KR81fyLN-1>PsmY;b;7_FhytJ><uXb+?RtzMUrToyOnu?$TO9(?<|yAk$y73og8
z7_<32+%!0D-nJO0Pfp_gx39vnBa;{zpW~f5@mQ8G|20O-Dg#&?l|6Plt*X<2U}Bq^
z?Ya5y+U$|-OS)Ksr^$m}Vy@j&86@a=mPcu3C1J8$GuA2!wQX~Z@2zKJBUZ&->&0tp
z#b>Mko>z$=%6dGtn%Rn)6^>TMB~&ut3o=_&$A2p}J2cJFdCbB2uDfyMxd>uMhT-$u
zctR^Roko!^{yRT^8?7>A4F2=4aozeNo_$tCfLQB>HATz}#Nd1Py*T!43^RL))zKBc
z?Cncv37$q`D8Wmv^0RqvDb6QFS|*igl~hdS;3gmw)L4pWQtvXbTEVQ~Rf)?AmDf#7
zR&9V0%oCenfJt-f9`r7(Tr`8$>$_m{DFWT4bQv>;COFs{LlzpNWrL^~&%)Eel6hXl
zPDEgJ+6+3hmDPl{1EL{5%VV=l%`9JloKJIc;n2++xJ}NPZ|#81?V#@ydDR3j^|JDs
zGNdPy=)Pw;I@Vb+{me_Sw>2>lK4P^Bn`Ko8ti;RGU_p4*)vAL9!nAMTO|GRwAlDFc
zQG4v!fTg8)PrC>AzvCKowb3#&pX2Ya+C=!=%n{X!Cw_ARleAp__Sg4d&(1*z#Cii^
z7aC~*jwWUiOJo$5#+IxOE9}H<%C($#<@qiQa(!}+0uwTi$MCLgUHH)Z*Wu-{8DeQb
zD{Wg&?a8mHQy|x_9=Oy>gj(V_at-(1>VM}+G*(w4s4=>VhOMfBV9++uv=C%X$9A5R
zgHUl}FsOyeRoQRu;=qH6c1%5a2;%Svg6(ch&&qK2gy8KCV)gbOtXW<}!-<_(w<w7*
zp&QPdHX`6rLI9m_*@)r&NyLc_iY!Dx$2~EgL2NLAW$##t#%r39p3UkSw=Bya><?h`
zpKRtGP>dDInwEkrSM0_O`UfU$TFI!zD^zqD)c2IDs}RZ+?T703R<sC|iWx_v2NQcn
zarV&@uzH+)xy~vf%6Wx@nj9RsGMCIt4ZH7Ih32ij$VSo?J8`*6q06MMCg|rbPsfIh
zWIM}I1YDTeKZ3ER&+vL;i_1<kp+(oRWmORtuL})p+Y!GIMNSCA)!l(|wqOz_(i}Rj
zY90I+-)gxbn3l$}xs}jru^>yc{hqxS;PTSN6g7aIsI&?<_&ll|hs<NE!$Y%hGYP&@
z5nuV@130j61dsgqAlm$X^U|<J;>py6s&&=CEFjLlg8^wFlE5F{yB^CHh4I<{@f>1d
zFLHJn?s8?xS*xWMRUrgiB!qx@+g3YKrZ;cZS+*LJZbtoD*3re1T>Le5VOgLT-fPQb
zZTTwb_PMh9miY-XgH(a?x?bq7FhNb@mH`Y?`wu0i(GnIhmyXjpwxZctM0i;N_EH2#
z|K~Bprpp+JH=_G39k~CU7F_tJ6yi|_r0x|MdF%vcPt9P(+ZS_9f`MlT;UpG#<Oj#l
zcUuoUtv;k88F*XVJeiYE5EDK<r^+R&2|HD<)wpWWkB>3dSygRdszgwksTLB0p=kix
zgkuT-(B{~z$V?^pws_k79AKHo?8tM2=)AQDoo`x#=;0~8M7LN)BWLC}d(eaNmj^gY
zw+DTSL8VZ&#1Sgj858feJDCj>J7*GtYdcY#NurcY^RPi~GRx~}9RVw^z^Ih?Dd9V|
zoy-d@J3Nb-gA)k(Y-;AsAP%ot8eO44dxbDsSrq;gkXF;GEtMrjBtw?#N(ZvI+S#+S
zuoa2H1{I-WCbu|~O7e>}p2{PaD=QAD7Ug1bx$Ok9Wx7i^a&#OUHh19qExnjdr1kKj
zS%y$Hu}#x9$hG~sSUdNM#Z4GW7xDdF6F53EgTMH@JF)%Ut1&qlzc@pctK=Agn#^9V
zvD~PoUAvH^;zCl4I<qy{!b39X*=o#7XS^`UF!Hw>Yi=d8&Mjnv1A|d^QGE|n)GFKU
zD3mN{^vPJ#Ey0ybVrr_4!$UsoIupiF+qEb*wxHqcUY!5tODJ015LYe7^ItuP#D!`2
zd;N%>pF?aY0e6#|0L#V!b?}8@w5)GN>xO1z=kmNQH$Ile$w$v9HKwA%CN(KUw#wlq
z0aB%=SJGLh*}0%1Gia2E)Z`TfU5!jKNJwe`r2U;7OJdOj*I>m5)*wBR(48rm^xzn6
zyOZ|C)9L4$4kex03OcK0)eN)8qbMX&v~LzgrK@bLm90oU77H@`9WE|0$vWPoQVCse
zUJqAS1B!GFNz7EyVuR?ks9L*%y1i=bmC0Ks^GFQDxWT0*8$&sjQ!R073|w3V+J!=>
z>HjQN%LagxmhsGYD$8UJGl~|iR*0y9QOM)QzQaS<|Ll3(u(2DNQh@{YZ8t9AA%P7W
z+R@zNL9S3z%Wy<w(ghTXCHQ@AeDnLy;Dx6Lu<e$`@HN;_)C%O~g+UNC0I-rUBL*Uf
zxc265ymD+D&p&Ypy}@Q2{`ccJOBaYc<gSE2>Wsm8y18{Go9fS9Oh;F~1hB0cUML&Q
z6%9=cr~rfpwvs#_OpU->-N2wfXEbp%05Xf9771|ooO9s0<37B6A%KI!ejGhkKxk_p
zZvJpTwscOw$qMsDHxgMJ4xb=U5Nxor#1|8XpQQ;mS>(+Myu`>RB1#i9tDW`t_;{lN
z19jGv;B0g&Kq^&)yLCfD$tXOontW;!jYhE5M751zTh(Y_)UGu?SFxUv4UGl{A#yID
zW5Ma~9V5_{vFWqhc&xUNRE#J!pl5lCd^}5Fy$)S>FGp%DuK!NCtjHrWRkGw9krY=3
z{nybdz~SRz6Irn1_(M-4c6=N*zlX~>YLkTCydWDx5xjH*f|JNjE(>dRMzz7wCf_Qt
z_|jFNT_8X!WEWI9xm>?PGv*8}SMI!fDVD8h;(>H;*rvqIN@m^GJOO5BC`=dK6k;QB
z+_Gsg-tk-OaMyh+5DGi-!0)U_YX>nJI`I}72y>YXHf`y~=B?etdQ<4}cjK9-PUF{)
zpTu?Rdl92qm?b}oG)R;2yuS96t6Xz|`I@?HX~+iO*jyZinG{N+G5pbIZ^3={uff^5
zag6Ps!sz)J9ITN7HMDSR0p2CVYcC~s3oOtThWZ+~)!`iDMP_2QCa^WfDkWVEMnJ`b
z(Cn~)DiLyHM_DeCLfftVXt;M3W{KsoGm;pJVB`CjWBdQL3DWbsAVuRSigsd|BHXOn
zdv=aDiLjbmzNEGA%$@>P>OT3qf;jY@V>tcG3ve~NtKyu7t}7WP_E%x1Reu`*R|n0K
z8B8k<v=wJsS*r5!Qo+{M9KhK}PT=^rj&O%wV@#DdYS`?&`-^ELr0BS?>HrRGhTmgV
z0aLF=5Iq(pw(8)Y%gqsKA=b)-yTwolp?*JFLU9Z{JC5{Jf>w!ketwEsb;1D5@pWUD
zpP?&|{dPW@f`8p2cow&#z&yoN**4ka+HvKw+A9KRU4opE<TvgZF(8a2Q%I%rSl-`+
z9Xkeb_H-1{cmkh)=x+S=7jDK#a*m%+rcs+r<hg4u3l&(cR_uOZ1ol)3Elw-`<J-IO
zws)?@SHJo^THCyM-@E9u@d#|R?3#(P#)UM0EDI8RwA49$W(Fezadfo$5SdFM)ab&p
zRZUzuOfn!%b#e)Y5JH~0eOiG({mVC@d07*thmt7IW_XFspZ?KZywpr4#>7G*7fWW<
z5<b#=xn#Vyd-ck#RtTY1GOVUWk7RaLn9pqI1EnS$ZgggVWNzK977dpTfL*rGa&}|}
zo9}8vXmJ=RTIM%g+k@n68RtIt6C@6gLuhE^Nvc9ofWs<bQA<wgt}4T1<R}~58rXT@
zaZjh6ZyytfXLqHbU#=|e4JMFA(AB}V>aLkO8l5GK2{2;|t)3{Wa%Et57E`tdJiKG9
zR4`cjsIRjY;>2JEhrhNDD?YfM>ov1lVPm3;x%-YjGk}R*7hv@{kew^Tv#1FxHx+0F
zkVhsip*J+l6~*$+i?RH{l_+J4e1Z_HqRO7DCm-Xgr2@JvF(<fOa0h6A5-INRP}9D?
zJU{1f6=;n>2suA5d-8gBjMYr$%7`X2n21l{_a5AYx4vx!R<3R2fEy=PS)>);-+%r&
zG<62CX>~VZ%u}q*gZ^t8@sU5i3EjOxeo?X-%i+-kzWdErP>SR*ux|qG#8m$9)9Wxh
zn}px(;RAf|+#CmRm(|9Xhdh2OikMC%@dtmr4IRXE*gih+;5rm&*5`(R^qwpYz?oQD
zsTnoIa#<!oi{-J~EHSW9R|rdQU4$dQ89?+*4A&7ru>K~agKy0cK`n-9vf`0nlb4u$
zkxGPGA&ZMLTdCrzU|bgJ?z)m0D9uYp^+H9(byt$->mz9XV(hVv03v>74ky087jtR)
z+XmeEU>ABylPC|(LJS7Epp2w4E*c12y(>MHB6emqRSifoOb)$T5<DHvqUY95bY0($
z%v?dW&#8Q_Y^*#mxGcz;Usx50%hfKulG)-$W4lJ{7*q9uWCUcvU^7!;#S$(3SzWj!
z+t9VW4{JZU0m-o_0j1K+&5mJqDvhS~?YQ+@zXf}Pn<f_vmaHkDxgo{18k*fRa26(!
zYw1BQR>CNaSElM?1W;KvXe1b&7)*Y0i~*Nm5BpHOFof*TGz6!s5<1Z8XVuRLSAn+v
zEhC9Js~}%aoaL;-?X_b29n0|c`!`~IdKS@W2EY8pNdn*!vT_oi`uHul@uubY_BRjk
z&aO<kgixmopZVLnaB6TCFB~7iY`Op&F=88mZF8faW@8%;92msv)<(Sa+!zK&;`sC@
zZ^fGR&6q7^6akNX0SN+l7RzPTw1ZPq`1zxU@!)&bqqn~iM-NRPk;@}REN6t4qD`${
zY`MM%=b{me&n9?nVPY<aS=wH!O@Q4Y604Q*ci;FK+Pb~)d8|0Sa{%R6hVk&Hf6aO-
zVX=udg<d4NMhRP02tlff*GhHbu~H4ttjD0GODOwV2yC@&*MZakw$(y2Mo`r*UQ-NL
zs>Etdaa$H5BE}^TMzAKB#O9?E3cuJ1PkIivCLgy7k`2inCOzoAwimu-Ehx~WESngo
z0Wb}q%R&oDnw))I0XPB<l#49!B^Xu{=I>w=blDh7HQ13Wi8JVNUUn~O@7I!N)nKZH
z63S*50%IANToOzrVN8Ig>DpFUX{rDCy+0wKlX1(}?;-FlAREo=(q;@G$6p-6+(;2U
z8{BXw2N6A+MyB9~oQb3H?RO$$X~W#%5hR9_+>(b?NK1yQ0_|K$hOmL8O^&SjBb7z-
z?W+)8<O8BJEaR*+Q%HvLKZ8dc#48hNuME3!AZx#zNiRC!GwB4r{<rVqVD|VENAc3G
z)3mcLp5$VH;<mf+{EO#s_dUzdzbK3s&tE`e$W1`lj4hj+@r$3>aNX8U^fdeM^v}<r
zvoXLg1a=;S#9+^yh~U<@_2F#~te};Q4R*T&F42m+?pw-5XPTPa7#@t`{Mi`py5<_Z
zvhy@<yse!Wa2hLDHFM#bQ^%&!zdVc{V$Kiz&T6dtaXaF%B7XJc5p2Gx7wK#sZ5=)y
zBm2#-PU54#b1yvE0`|N(fX1dEugjHW7s^n&sWf>y)Tp0@uyC1{?&?rwuU=iMRjcc(
zp3TidWncBm+w^{QQR(03-_3=>)usbUt5Gpnn5&uyda;*KLmxqs4V@nqYaRCeu7Dkl
z_7c|yP8IC@_e8N`?F~WcGGpPSEuUG2_@gt}x$_)4mp7@lF3N?jXwWFrgeC-J_u3IT
z8b$0}T+vw-1%vYd%-wrc0`0mrxm+oo5@e$<2lTGEN`s4FKDL@Wh9<mjd`^x3voc0j
zF~Rf&IEb-aLaNB0E2ab-e&`6U`S5CDwwrMFN2ho*Mj=(^pgZ*JAiMz?fx-opQYA!l
zjhLBsqOnavVwTm7+jw`E$QpIZhLSyP)uT=df(0h0WXQ@&u28hG!UK2<Gbp)iT(81n
zRoSa7m<M!O)rPnNZ<fz~_Ot)x8}Y3#eyfX)(|gme*KS;Avt?Ss_~?YE@RJ`O#>w-O
zX!VETuvzumM2F3Rb0ZUo(O`*8#PA<Ky&ru`!g&1gvxrP3@TR-kaNoVlapZWM$FZVQ
zNdi+VAIJq-PBt}ru;IoI%%uuEuz%>_5MF-eL)doPVtoA{_98l+q4x{KqO%BwT^Kw+
zhcl-Lcu&vJdxr^-mtpCO2275nu!q>`<X8-M-n)V$*5HL{1OguPFK)yOPoIU`Wk)dR
z;jO)WUI#Aho!}zU)fcB=Xblpo0Zf=5nGve~5Db@Z_4h0k*%9izUJW1@`;6&1^@G)b
zp|z0;rZy-8^r#4;18n65!{nhKEd@kr+!a{tl8ryXs0tt$K0z0_!-bibkHfK~73rdn
zyW!d#R>MXM=Fh2dRleHLW-`?xhKqZPVx^VVF#FBR=?I3T532S>5cJ<QPohGlDMmIL
zi&iFI25`kp5sTlsTv5@Yu_)5YPNeH38_6I)$3(>4TpxGzxk0pU>EN2OGY6;P>GGlf
zZ9V9Ja07C?_M){ZgG9!QV<(!>*pMYklf-1K5q<YALiFGmchqHivx3^5$i>wyN>VJF
z5_vZr#7ajTW4;y}i2URrj1WnZQZyralrBQ{URIN90k6&FkJ)##LXfZkcgu(W<|?DD
z6*`cGj0=}9bikOW-{-`I^D)GU(YE*kx_*GpqG@CWoIV<8WgI&<i|>5%IQRQ{;2o>+
z<Nr8;9WR~0AAI5#e!^3^GMrAkGDvAKB=Q+7TD}+~6D6MTx|;wwoyp;E{`y%&#&QIx
z5oDzT9b6F}yA3DLPNBi=#i3UxIbFN!%`5RQ5AEhL<cZl7mUJ^f9l?(tJ;EoNR$mBX
z=LRv-;pJ*!vDqxL#S&~05x4&NI=u3eLrBb65NvTOYejuI&zP+;kZW1X7!w8aGzsKN
zTv5~v5{3EowBmx*BXz*Gj_c-v%ofI_pn{y-qQ-)X<AA1PASmocF%y(^l`!4#QI<_?
zPY+Iuf~tD~y%WCz!5Si|%_FM#O?DPo+GWS|wGJFRGYNZH(PI!{DCy^)seB*Q-C%L>
zQnG;Fn|o+Ep2yUY8CY0wNt1K5irmS8i)%M~IJ=Z#)F-Gk9%!bPFlZmZbR1=~>X&*R
z1Y>AOR*p|Pl2!F`MI|4=_DLlbtd3T6S>d$$@#_EDg8;4m{QW+x`J+wfx}yUlFOKmf
zVW}))V8~Bn+JfHJN!S)I!NC`^NPc-IoioO2OO?cxR54K1wQ02^p%(I?b8RgZ(7xIR
zDdR_Owg{oD<TMmETd|$j%{(uQyX*glW3)7e<1hfj>%A3ACA7AA(6=Z6Mq;HpdJaw+
zOcUctT8>!oFJIq}FF&*kbF&5X_lK}|4~xA%g^AG_tiP@ul0&f{$>+;x^mws+btj$l
zEUv#kh=;!NB0?b-&Y#KQ@#l`h>!+ot*NdRf#anM1{a(!GQ`mZQFaG-PwxhkvOUqON
z)3gM0)3pBKPhN*jH+0kfThS5-au)(8vDoRUEZklj#)jv3UE=I)0!NR};eDUK7jD0W
zm_V^+8JCe6Nj2(Ru|T|5M*YTwOTFVY)Yx81%vSFJs+ANoB+RN?a-|xNO`kE;Z&p5Q
zV2!fbvYdwph*eGeY(HAUMU?Fh-J-m#3WjSeR@N=c4GAnB_ON2+d=$&y){D?00+2*e
zf1NcqG_GvIl6w}><D987!T258Z&u3Ks<QWz`FHgu2=!m>F`t;6HVi&BfW%0GcWEh~
zGk_isBb1PuOv2H~JjI*{t!l=hukFFpAA1SoPYof|QbsJ{#n`wHeLXP*8U<QSvJgxW
z>B$@yPnSib$b02nmx@9qkD!&{X<;Y2b_*#9g{(GVn#;jpYPD9Mw_F9<`oJg)V|1Ld
zmt$ktgl4zeaPDlBmf$fsZ1tnR+-u7&qNCjpugA&7+5hi{p25x?=ZS$>h;7EOabpi>
z2hnT>WAQj5$s}?m8GUQQc;|!bVYN7rPL{ag<Jj~lKK7xTv1v;uqM5V_z}$8_CdT4;
z{^|4h(wAQ#K+n>$$OVtbjjw(2W$fQQjHZCsB>usQ;#pSOMzckL7&>e7{n2+%0_`4b
z+TM#qG*?j}GgJ>O2$J$el3DWnI^KFEUG+d!dIP}LRHh{v6Je+%tg32lt5x_Vqho^!
zhz;FS^U8)Q;LF(;6N=A>u%8)1bB_aYItSblK?mGQ#fLsQ7=X><upl*+!z*7qjs#7l
z3>fm9O=<usDR(`=R;S{i8a%6$VTQ-Nc9p=cKqNsD3{3&DVjXS|Iyr-7pvs(n<HK?K
zx2)(i%oX4vVzBZ<s}Ww)fJG1VWA<DO-p(*OZ|vaK<~B<i;}ae@TudKi7Lh3zq7mA$
zVh&a!9olc|ZWczMEh*bsUHQU@h(*q$JRL`g+qP@xPB7G78^a+2|6+Pvyb84Sl2-y^
zv>{`{Wnr@t_xB1gXIf&bteRk<TdtT#Uw;ESdi_|jG{`%@8k*g7&WZ>+{CMc0m(bhO
zh}&*nir@b24S37lYj7bG#g3QHp|hhIk3W6^H{H~S_q=}-ZoY9DUfDZ<p}{!3P6v{y
zJmSe5ujBPOT-bAL0GVtNH*Q+W2Nl<xWub_<A_2AXxE260FQ}1`IPF&ey^Fl~+818H
z#B>VnJszdeLaqiYdEpMUi-4zOEcudaHz8aMR4+H!qN;nySb?C05lj^c5DbjaY>y*j
zepP}b&o3*gZgS9oGglBHCNfxadplg+4a7?GhR?|rfW&-8$~~{>e9oRv@`iw>YeKMj
zt;i?K1bB8#9h<?aCkA2nJM`}>>)$EQtF0~9e6F$`?DbrtKui80f=hzP(_?Kr*d)#B
zY_stqx9j1IdQA(qer_AWt3zBbg6)H^-w%t2nE3G-?D+GYT<Co5$F^eAAHM~Gb_+&M
zlrcKxLsv@-zBU&MZ9Rz4e(-KN!x&Qag3J~|lA$_AJx^?#n4xBPSpzIyx85bDD?aFB
zNHEzTaRP1?#;yYG0<k^XkXf6WWq!S7T}*SJvn#}75*L$!^bi0Zcy$ze_MgX}{PEpb
zzM>7M&yV8^U$_s8mo#$V-o0ytx9heO7;m|w8`rMwz!$%CH!hq#jlce%Ki~u5@yCu4
z$d2RCkr5m`HOQMCmalBZ)*E^e&t)*p3><G-iR*9f#nB_9#I$Yd0Fz;NTDX*+Bvn@n
zRHWz9`8;O^x8AiB*KF#-p|LF1-PwoeWQ@0hYUNZF&|Cm)F9yQZ^|kWCz`Rh6ZOzwS
z2iO|RzqC49z1c-F)ZXeHLx$!CBj~}*ZYxa=f{EQ$dz67Y0ay{6$ifwwMnj7Q`J(#M
zriKHhM%K7gH+F>C12)W@iJ^0IC)R&p6;d+^6o|PotDQWtO6JBO3xWZFgh~mR3Zh1E
zmumpB_Bv||W+0lK&2x~Kl$ZdD#9E8FB3d>yqiKCBpD_4-&^5$D7hHR`!NEcL`1emC
zpOMjaV<$1$MmSomc;+)dM121UCbMm{GAp8|GefI35t9Q&xcsW0n6?@~?T*B<Bvj(H
z+H))xYa_yR<6>G0x*!z{@m&}~2i1u|W+CLkxvM~1H*~=NNmwpJjMi?mAU2!fp#!_^
z(sF%_Nrqg0{P~~$9H&o>WApk&c;t~on3_y*=Y!{7K1#qHK$-^STq22o`~Lgz4_|%}
z|L~RLxOe-V#72uaa(D{IPaVgmRZH;SKlLW$N_n{5Rvv3D(-p>mb$DPFFFt!t{Y^vM
z(WtQ`SJ$H|uR0ty*sWH4{fj&C-EZzhl$f!jFO1tCScTc~1SGjuvw>`?lQng6T?A~+
zubaQ87OP#T##XwVU|XZ8T@#?uzqeN0RxfI=7N`+SQhSxItct9n8R(SX7hP@?1}CtZ
zvDy}|Qs58s@?JK^YqjH~Jx?I&2)eN2p?z?LthnQIHzG?bpjE%U47dE%7Cyl-;H~I4
z7#V$4y{R4sF~^n5>hmltkeSKxq?cf~@Yf2tGVe}Y`JNS6^yWSSW0{w8O&y%Xj=$c4
z#7GV@P5y;!8Arc=l3VX2CejElcH*|L-Ulf^johmz5bkngYQ~1fP!^^59GbRoMsUp{
zWTq2!x)2SeU0mEp54TnfPwARtrC`&)*vVUOS?jK@kZuYc7^^!}#||qZSL<l&)tCu9
z^BWN_Lne%s=dc#qbsJh~W-cKzmEi^d3&wTnGt9dyoi1YEo^jY|FwUgX=xGVT>$hS3
zl79F+F8uJ3eTdH#@aRv@<Lt=@7yh1@OyZxu`U+BMCcEw9#*78Igb#i2dUSM#@E4!^
z9y+}J$mMgmVOt+}++}sIOnz=AmV%oA*y~l*_)%4?s%ML3_-SU}yK{(Vf}7j{SW0EQ
za%u*p@f4by-Mr+bP_Ed%m@?4v!u7TFDhjmMjg<%swK(clT{RM$M$a*!#(o-~5-(DX
zpmzfahI(2_(07(UTNYF$J-JeGs@cehLY38vx#B=DRuGtk7zI5vW4FpkNiMwl-7{QR
z#uKpX=TI=zz*hd2RryN2fQ}er8CI8*K##}<Jr;>1u=ZDGu2{?#ctwoY<s(2USI(oU
zdcyb{vgwe@dX251)W%wsy_3qyhOv^xhNWQw-vW+2{0f&mbT@f9n`PyMfa*6VD<xRD
zOdgB2_aiwi<JpfthTfHaB+kx3Zgp|XaaPh*6#Y2%L<Gr{2pdfzvOy|QRO_F0U1&jx
z&obu{lT92G>WO5~&_zVTMiW9w<aM~*E6-3lVH%@`>JWNU^eUsR7o$~X=Mzjn^mQ9P
zFwNF-0fC?s%`I+ZN;%FRSuB$Yx(Ic8^cZtwUR%r=fo+3}mRoDqwIkqlVb8vE*tc&G
zzxB?I=;{s8Af-XKID{vkKZvo>ID7#oR;+5lpM7#WPG1<smmm5yV#zcyhB7v;S%b0E
zESz-l3=b#x?^u|{csh&icdtPI(k7&65Sv(S4K`P#?_$5>3pj`+TQNld`~C0l#;Hge
zw|?d(q%FiqO0r_ccM&N>)6%|1B|^P6UTJ}F1n}Bgb!*Eu&S%A_6Z17QTftnBV5m@l
ziQNjd*{zIuY*04Ed<C;Lx~y0UMaMJfxV{%%*R~=Z%bQ~5lHvH7;<f7eV1Sm1XR+eV
zi!nEn#Mx(u;SM|T+?V#^;ZObqeYf@ErvJVL@v%8`<$@tpAnV}+xr#*_jw}0}*&MQT
zXR2FTIKt|&BQ_Yv>7Sn^mP@OpuoCY#Ryv>(_at^*gs0tsZC|+yLCj&#-#iaTYXEt{
zf!4+}nnHQZW`j7hBZ~OxNt!Sm=0u)QHSPq(B3%iWRaQ*dWC2UxvKalF1N699siKi!
zR%tUP8;$kO77Shm+In$SHhV%iXT#;`Rn8OJOQ*{C;76{9oj{GrAlg_ft6fmzQwy<M
z<?gaN@$^%t@ZJw>#J1~K<Hg;_F*%XoPPeQIpvcu3a_|SNa5;(fu4_ZSP{8y|3XPr?
z{OtcZiXZ><AinT-_uzpyuR(9Wk48ihCq@Q&NQ0U7v5*5B+!d`_xdJpbv}=tH5ba$7
zEDkjyM@;(b|N1Hp(x4ooCBfVrO)QKZi9$_)lom*A)%sfks=^O)UC_ow09aZeOo3Xz
zi}`iDHCuM8)VXxsRzoPkBmkpUDa>!_t*%TkI5Zf+n0G7*@H=EIUg1HiOy@FN;*70C
zV3wFnE90yx@l#RkQiQDS#Ddp9xD4))gXaReZ|=nUcPz&p@4X4mup1{IAK)HlTF9Z+
zy{v{MSUk8`P{J3irZGO5!W>P;GW|}^ZQba)wHr3SL#aHFRaXYOHkjT6tb(rBAk|pz
zv*$g{UQ8UB!cXu2cS6Gwx>mW-+LS{}IE${fG}0LxCZ_H58+KT|c3llm#{5ZNJ9#WV
zTPiDI6fMSGE)>zXwE?cS0Iz(2v2|JvH)yL6ZSv&TN<p!*5j{9~6=>@&_xXv4T5x&l
zjeSlRjvkr7ju!_I4tWvF#qhwp*5G5GxE`@|;*y!Mg}{(?jzyzs`qPDf|M7mFI6F;C
z_LD;c`2F9#8+YHk3Wtsj;Kz>~!B@ZjA{xD64st%b2S-nx#b18rDWp<G3=T%ov#1dp
zS1#qtSr%`7;rX)|yby)Q<={o{tb8n$%EM|AYsPCe7Q?oyvBk?fj&j5_#?M6gI`8Cc
z1}omP7Nrmk`r#<=gsYbvlP;1RlWN3NE4}&hg4GMsMZmTupv&{)y_d?GVYGWOGFu7e
zssy<PyOrn1YE8*8m}UI51W!>G;iu*C<Uc)yK%OSxwQZP7(6YP9g;j6sM~;{oXKcoO
zV18Q!bn%HavU9}T?plN_t&U{31Kw6YY%T#?et!co-2&gKTq=VS({^R`+bmI*Ea{ng
z4w!1Ff@SGhl8YtS*lTm+acus?2CRMmYKVlR3}Brh7uUp9#I>uAcP)Ue0`&Og9QyBB
zfsG%z4p{<Pms5gOl!!FYO3)!;a>|Big4s1mkWf$IO{kO?GQlJspB4G!#Pk(P1V_Fm
zHzvOGD@@R};b`!gSS*a^uZqdCW)_Q^%YKYs1=<B_UkfrWK#Rk?&hK+OY#17e;WxiL
zt+f2nDSYMS5j^pWlkmCRmlij+2=KU_c<AeoVfl&%+<n^$wy=T6<KV*K7FcoJ4PCq~
zmnF%fGdVPQ1I+f159U-ci{E?i?N~z>V1mH&AOH2ec>jksqp#nO(fAy(-x7iWHykc2
zmqE<ui}>j8-hfrajAQ9+U9DI_wL?F8aDp>+7VC8pgJ4~WUb>K;-**n1KYj!5{OI)<
z9gI{Z$ErkRUPE$BuJJvW%50_A0Je2Q1(%W}(?rBkC9kNfff*Pq%pn4kOrNnDL8?(x
ztIh`LoQzOs5UafzZ0#kM*I~odSQ=d$JF)V<ex%}AHO?&{LqL*@WO)pB*>)zy7>B>x
zjphzN62~Ucds8P`SNrkfKlmk5lQ~Qroo11I`b-K=Vzs_@Hv+vL<ruNv|8_4=Y%vfn
zWJ>h62g~2Sh{j%-`+Bi8v`Aw!pDyC$&(7l5qo<IX&TzMfy7kq@T3zF74C9FX&JHEf
zwA_b4hYRV1OsrMpI=!r&IA!rew%PP<wt5q<WcW_TW|?C!^C@fE(#2VDz?p-?OZ#b6
zop`IlOFHPn9Kh#-ICO#1p&q>wf%b~fI(X;{-)2WX<`Co$6l5V-ex1ygu|6k(Z8Dd_
zwrxw%)7FGt`_E#0Itj6)EcGwN{g<;x!O1HJSOQ}8s!p6f89|~L$6L2=#*<GR!(&e#
zM2oM9DZud?13w0aMVhWVI(@k9j>Wu?de5FwEL+xqx4q*UxGYw@yn7G=4OG#pv>%pf
z)P3j^H(+u!K}>iYUWa4;Y-D(7wJNQf>_W@Z#bk3>xE8{x^OIQ8(}X!2UEEVCglH};
z$Of$grb5MRudPD$*H*cu&imP#Pt=Qf3suRlOX-f(lV3vp*Ny+y6uwb2`dV+QmOL`O
zPc~`=XrD8gaG740%_<Pkv<2AXG65PZ$#Q4YXmb@Xov~n=RzWVe70pY-1Ws|Dx$oQB
z1{;mLzU$ku<@Z*=686I$Pa^fmi^%Lbk5oQ~{`)s0b}kKTm?l$VwT(*}2y|RXMB`Zd
zu4{-XFURDGF$B8;+}gZI-^&ta>@ka>&Yn-u(woM9(2a9XoyWwXNm!juSY0$WTsB39
zQ=T6-s!m4Mngks_7lsc+P&jl9fm|FVn^O@9FA)0<g;3~QgydihGINu#3MQ*`McY77
z+L%Q}K!)8jNfD_zpkuKei?0je)ZRIS>^TI31md!&j4iREzQa!|E8(&#8V76)vwsD<
zGI=`tvDev(f3@MmSAn+H?aP1rZJsoC3-SYW+Iot(JmNBQH25EQ>ss9V)|GhV$9r+z
z+J3aP`!Gt&Ae-gVdi7XY*2#eh*aRE4-?t30XcjkaU53G-X$%j<;iQ?Dop{C~Vwo%)
zbn@BKK9kSz_r3W1Iiykr3}1-h2S0ojZEb#Z5*xX2F2+SgEIc_O6En8q$B*pC=)fGp
zG^5M<rCb{Tp~keFPAe8IZQ!mAtX!wr=f?{#ox;Ge8LYUW4~2;&^0dwDBJ&axC(?^R
z$bkZZ1N)4_ZJP(;mkPGkLN*Iway{Xhx}Uj3u&w#L0VOrj7VXNf2-B!yEGEe;!Enrl
zdEZ?Na0R7o2KllG8y$ad$col?T#NHB4PoN&6pall0c`>6-?fsTgW-cym_9$pWdk?d
z-UewV4jMSf#7mei`Ec#K`#5k8?VH5%JA2W2Z3qV+IfYClhj9YV<WwHHSb;n4%4G%A
zxLR3J=9V)Y<Y-{9WR%TgS92ahO)xda?pPH9(|xr%t@9Gnyn~BYQU2Z#t)6VKOh;g$
zNrUYha(PTjVN8tCgg+kVHsOZBQL$0iKvq=BDcN>0pyjb{KhPw^xW8C<Q2=5(MR;JT
zfU5{q%?-S|MzkpjI=Upem<$(`u>+oK@Pajf$F2fxo!eKw@GV|S;u5fpPRF_ogv-*h
zY$G<xngiGg8#<dtz;EXb4J=`lAqK#ffUNFTz6h)J5i3Y13wZLG=W*XX*J1lT%kZ^t
zJWJp2Aa-m;nt+ro;otYZ4fyECw<1o<L|L+7*Us~pnoMJsfR1&E&CStwJiQ06z8u93
zH}+uBl13y5>}J@KPGk!Hc4DPgKA;K(rBTshu^0uYOyyB*+w26M!3H;<0H7AD`&};D
zHW4RIPa{g-bMO6&IiQ>(c2%ThXwNM@$kI0V^aZ#uHOt3|g7BKa*5tyv0N7T4b|Gdv
zul(y0mNg54xm-0X7!km@$(n$UV4|`5du0eU0N1$T3L?lNG0R92>6sL^|NVBH+BJc(
zGc*~~WOnYwA<Pmu4qcdpSY(}GMRYXKL`f^3^lYA%;<PI15AfRB0%7m?!C4IL8Nsy=
zE=J@;64CQ1WSE7HRa7jv9TtN~n5v3JfK*7AcmoT!*ulkXlzEJozR%O>MrcuxfIO{#
z)_AtkGZ`$qXAwH@UV`*Q96`SYrRg|?o(_l`S7Y?KbFk7_R78IS?U3llm4mAamdq`L
zJxI(*$kF)sEpJBmx-gvM!>~I=z5-D8M=-kpi>hLm0b~UgbVULW_cHv%;>1ff@yY{Q
zL6+tJ@{Q;YYy}G|g+%%H=@9>OgxP6ahO8J%N->e|SUwG}-Hs)To6*q`z_Tx$#EK;y
zNT&;k&|tBO^~;G_`|M02g%XO`wsk2Q!cM%r>jJVF2`*L$PBVQ^XAte3e&kC<UJiEV
z^bD`%&14Fk-75N{0xkDN&ZL-AE(;a-15TynhF*6%E%cnECo394F7Cp>taVs9n9-8j
z_}C&_FfbQ^A5OG31_?Av20c>&nL-iQZ|lMINCIci&Cx|~MS__3y>DHOcRjcc-+BL|
z@Y@~A;57i9SoK@te3HUn7xmYLYNzRWcd-f#Yu#aZFRJz#)z8-eTd@v17F0c3(|3xf
zXteSVn{{H93tTqaerxa7ZNFucRk*`O%i)nIdT13T_BG@AuO7gh!;k(OJ1~A=42!mO
z!yU3fU@f*6X5cz<hBqd(Z)t(^&71Iz-~KgHnK|75XSXXMB_am<e{h^8U>kQ^Hck-L
z%3SPqPlF3NwX2H*+d?Z7^~S7i0-Zj7A9-br17`JSN;!H@mj|BS06MyD=tz$sa&!i#
z3$1YVHe&9?Bxl&7RXet-?4hWzS+;<*T9khsE*ZI`glxe@*QmsjDp<Q(gnV`oW$uV;
zRT;3XhZz`9v$kB8+!LKd#9ZLuYH>69O1d`z;k)EJEN(pOvF*9yfcA=LSTJZpoU%Z!
z8~1yyHwJK=@xg;sK8rjpjV8tu$QJYX-4AcV;e+FN_<K8PsUE2N9f?c|x8B@OAX-9e
zy9>t-P9s7~y;fT9Fs%X`3ln6E7#W%)#u(u{;<q_?(}TvAMbT`;$iSC@rvjo%Y0V;<
z1lYC>4afL%x8JoCBLlNIc5ED8m$N1%WEWQ?HHSa>Z+CK$nt%V{UcOyMR_dcc{QQ&W
z;UZQQ@Y#5XBVe&(|8p0xd*>h;X%u@?MS7!+CIW+%H!33F`rkE9oUFfIk!Y-YKB^h3
zVVA_JIIU!2?iB%XsRoO!79pP(7uFJGIzv(_Fho^gT<b0nw02NIHh{a~U<(>sla-GM
zl`<oZ`{rrlbhL#r{L}z^{$bqpwobS=_G91v1en?K?Vs9=i4%kP{(pNJPFhuLTW;ai
z{31>0qX#3{^5G50&!q9x-|xiQw=Cx&o_xB@n;0b7*tB3ykTM{2H`sCOUu?n7e|(id
zJql;QrZ;04CBmzZKTD9!jU_R2J_c9NS+fMv>aij|n#9mCS`~E^(7Ymtky02_<Fsu<
zgK!Z6VUx84!(=6x8&DY2&L*=wWHvXE#mWcQqj|X(Pyde>G3xfB-DcyK=UVlLfQlrd
zxh(@QQeCE{%aYfELq5fOJ8V~8GVF?Av|WMg`32&Hyx1$sXQ#?yO>NWvom;V3MoWti
zU7cY(z4H*CTUvc#nza@7n9rNLsm#k#0nt<(?|AD5-YxU+kDiCu5{B2~(DiKv?rf{H
zGdeFZ$)*i<(GU)>sM@HDmo(wT@kt&t3kF>Ldm$){QR`tcvb@M#0)Oy{o4FIi=l=3n
zX!QA@t^ACgP7o?!#=->b`%^SQbhLPJ--Z^9&_!M#5VjeZZ8fW{#cby@--|QbdQ4WV
z!BkCu3-uXrEtV(LW4CI|(8z8fQ~;t9U8t~Go#6_y;X0R1uj$(;D5?7rO{5OLjX)^`
zxg(4tqXKsS^f<Qu_HvAz$)P(wjebuK85-|_pbclD7DO8waLfCyL7qVPr=NV5uS&wb
ze$G1e&bC?%RaRJ^r`gG4xD0qX1HMR1yLzgsEAB3^Zbl0d(L7c(C*f-H;n=W)R&{00
zQngqrXZU(7R?y?K>^*X^fX+>Akh57_*cF2<<cD0!qW9)LZro@&d=yP>4zM+u!eUje
zUyH(QMXSPSEyQR=xAL#W18#5b*?{Trtx`)l1=;7l%4lmZUDR1R4`I*?IYt{5%3mg+
zWhaW2Lk)~a@Uh>!1;c~0c<#lsuxIUjAliBFw>&T8P{^~8LmanmS%uT5r*Y`y00DG6
zZEM*iBF;X`LIUi5>64aRVM6K{X9er*x=7}8xbB7?OpGOP>eLiMUKgLOWu2SIrWVYQ
z%Zp$A>=>@y+KDi+0<Anp)J3~h79*=V*-+|WSq-k2rhZmP7He_A<`t2jE<$Gd5VBc&
z!PE|1gQc47Z<JPDQK-*a>&0578X$_Q<*~uMKnLcUqT%(b9t`SUf-!TZv2jt`2UHSe
zCc79T!_{KDvMDYstBB3qVOhL!Xx9{au9eY|0j}HBj1_$Wtmz|KF<8X-OCxa7az8bd
zf<M%ReY+>XtOq;Sws9LACY2fL^I`gIf*VC@BH{BYQADM_cIJEvHkXCly=cT#s1k5D
zA2W0GR-OmO>I6?GbZ#Pz?lnQQUDu6gzdHzTSmGyN(kB0^(V>aavlU!1U*NUHmVldx
zNr{(*6<BV90QCGzgYX2cSk&mH=Szxcx?FMRkPTAovN_kO9Dmkf9F$LqsteMUc)Ma6
z78uBsh-lGK-0c(<1G~#{V={?zb6K1lnBk!VmSkcjQMpnPHrsruagj!BERluB>%jI~
z*I;-!ig+wXfEM5&dpQFp#u`RZEn_)!Y>fMyu?wZ8&Bv`$N@dv~KBFwpv}OheT~z6K
z2@n5d59X2?T}a2=Z6()iZ)F#8Y&?Z$pBlpbf3pou?G9clR#VMOUbwb)-tSd4H30v6
z+P3qWCk*1z66$xGq3ZjpAH!sEZKx&HY`2Z#Gm>CZ-m0#t)oXDLU1d<cutXL@qLs<u
zfobHAk7KzdgTzl?Mf8zFh#s4Pm4K&QR*=%(;6&%@7VP-V0sQ8RJBbYwQ0Gc~T(qtX
zBSS#NyTH`_E>}C^(h#zHtvoX?$+gTMs~mL=$FSD1l+=(A3%O+D1z733uYLbYOwB6O
zB4e8RxDe*o&MJ*9tbMltdwT=c-_nNCj{TTC5`k=IRS_2C(pdync4EWbi-35XJ2hyQ
z^N_0S#Er`agG3?=6<EA@5m)f-%8Aix14qOGyDZ;xx%}DL1<&*g+8seW{KLJp!&dat
zN$>3T;rQ{0BFU!GFP8Y4Ow1zS@M7`eCWIQ?n4Qh=_gs2d;I;3!@zx#)V&C2oSZOdV
zS=Pj>37FW8(_!JITx=Tz6>M2dl!5ScHi5tTll!=N;CCM0g;sySWR55s0;+<+=7wDe
z9-keFcm}%;O~KtxlL;{*SuN3#tC*-{2p801sG5t6CM+Y=FlVe4k3}7}Rg3M42Jjay
zu`1zW?6xK|tqLgfRfPVWDi9;rj^P?3ipqA%yxd9<9GH!=;zcX>HWv!Yl9&N>K9+|s
z=){T*9awyABaS|CjyD^yI8bUf&nHE}BGj#W)lC<x!X$E?st=<@PQ7EV9bYDX;|Mv?
zv7rgWhoU(C#CdodU8<E%B?2rOCPU*7=V(9s8wD(ClMs!Hyo;<rtV+n|kr%D#=@Q@=
z8--+XsN+&)u(W|<S^ajaCP-6hE$913hsfGQgrfxqS*O{Rdb?se!!&iCyo|k8{`m5O
zT1irBOg%J{GWXaeOPdwIlC)SI4S>Wr?tRk=eDxpi$Kewr_|Z@H@x}lR;NFNSrn&>H
zNZaZ2ISBwAIB{wU4xflS?pjO?yo8y#G*6<Lm@S(vX@Z!JBoUoS^T$RuIiG2oFHn8~
z(?S2yw~k;sk%z})o7bN{Pu|XeMfEz2^v}xk#lx%F)1^Gd0_;|<!^m(6Y+0X!ssw7J
zd0k_uVz@$0h705S4VF0-J8Y46St&_1fh$;93CMhX4LCEJ!;Y`N$~6mE`4)S--D^X1
zFo6qu#(1qL)b{Lp?a)TXJCDK23p;F7Gh6L*jLkN!X~x=ny0QN|2Vi0Tc|x^}rclwI
z)k@{mh6ASSAfF$?%wYmkmlwr6>y*pF-WJ5x2l^o%Jc%*dKdaAO30SB!c_wc`K?C0E
zdSF(AUZB@#Q6ReI7v<trpuH%w(}+b*7I&~Pf*p9>BH*=d3^XSvQ~2KZXut?oq;fe-
zr=p0YhOu->J8rvWB_?N>sbdxm?m%URegpU3q)25L<UWrRk?Ay2r5rx?$s4e8O)DaE
z6~PiMD%R`^;QQa(ho3!m7)?I^Jhog5Z1vw^RyhtUR|Fdyk0X;V&?;6mTtq@$wXJ&K
zHBTF%hEqc=9ot$!DWSgp0SvzdTwJdK7Xe~OMg=efkm`Ud)BxOC8ngz0mV_!{aRcbe
zB5b0JXrh3_1rL_K`&w*%>k`C9<GgpD*SMA>WKucY@`vlNa{D60BPnw$vmji=C1d{M
zY8``W)vxN~<On-4d3XXR|8*DqU15lJQ4tqc&#g9!83Q%9bu*2I0zy4O1bf0LF)PY)
z8CD__X<E8ov%MRgjtnx90>pqvX&;u9vP8QeA)Csg{kLvFcuhA7v5Yxvpsqrg{kWq|
zK4rBcdc_84ub9w*Tw%5aV2)1LA*Ud(%Uve>@#;_lOI-QAP6F5&eEg$#qN&vhw>OVl
zZeEEGe(=XQbo?YOzkB%LVbY4}Y@UN2x0;dPD6kdu#F7>^VaYm+WW%qYIgN&Z4`CXN
z;bu2%CDu_x!&Xq(ZLU~E6TN=zmM*T78=o!meKfAEW!ab%kt@j`HVEjw7lx+rkuTp1
zA5B7!eq}EjTl}VFzp1=Si;)WEn%7!0sHFc)B}rDjoL#8GM5qE?p=t>%RPA5&68W`+
z6Er5JC*7)(VRBXJgO-?-4EZ!et?s<Af}!JtePbb(!_wP3;aJ;;$3OWJE*$$6R^Ph_
ziRmm-^qNg&wHCV-)2zLgB~0xW1>7W=H!pOqZN=oN8E!Ab#!J2Ckow86`Nu+%&AGNb
zox~<<iCCzNSdM^Arm^R?>R}hDMj}ij4J`W6<`&^`3P{IUCyt0_A&=bJ76ffsM0O8B
z40-hlijgdfC}BKfN1m9kCo%^int-5+e{1nztu~tdwlyF;BV4vRrT-r=THfl%?y~Tb
zOOPw#5pP7eg2m7+R-8OHjz#?q_|%_l$M^niFM;e?G<kY>WdSSOVoT}kHh1&Pf4MBb
z!AGG=B2iZ2RNa9FJo?jv*tz2Z`Z~f~(;!V37GtA~fhLkU4q|6d&TwTVt*l22A=GAm
z6_%Mw=h55Mh#TK}4d&u`_4jLA*hqEQt+YTW!4!sg4PIuK;<Q^UlprmTbOSCf6KM)3
zNY!3q2A5gMkPurStRTsP`Mv7<EG`=&Cu6{wDQvu_m%z(`SAKX3kqdFIPax?c*&;F7
zJnU|Jg)ytv;1g$}v=lEXBIh-XIi-svA*DL(SAQR`z>(k;3MjIcaoXl!k6%sD%JaOy
zw9m5!q#|u+Fl2{&d>onaIr^*}nVbkGG2-RUBw{ZPAYZoV41gzSiD`_dZ8$Sa0Cqr$
zzt1-WkUuzp+)$K<E2_&;cziYp#%NzEOII$)UNJyh%{J&#e@SU?eq(EVL+%isdiG^}
z@8P{{0gkn6gDkk9E86RTY#0BNCY;)qHbtq7CZCUYk{v%biCJ1kEm__O$tL64tzFo9
za}UlXBDgRdK`Ae*4gxTNty~9eSxh&QO>;TP$Nu6OJo$|SXlxIdmi*PWHW!mvTnKEX
zOLW(j7I<F5e4+4q+az5gU|%$TD+x8k!3}_0C#)dV0$uganCjeQ4&|2y5n$Q(r6Dvg
z3-e@!CV|M$5wS-WGB~?)9Jy>+UpBMvWU64grmL)-A6W%yxhD87s10288uPw$2kmHL
z?YYSktae(~2ON6npz<q*P@kx1Ew@?I*w|b^Q^<m%#m0$Bi5PKFut1JwAtmw<X!3x;
z{IbNHT8maBN1|wMv7xQo&24u~0^e$Fb2&@LFoc4=L4HQc<0{ZzYBEd}=RsZ;pT692
zT0U^)>I7K{9(y|`Xtw>=fBG4I^{ZjnMY~>wz!G6h5N5~AgM5%MR?8DlsW_sk^n$Is
zmxJBc0xY}J%9X)byfz&6a0YwF-OKRlKfDcp^}p`HWHQFfifW05*8<x}B8A)TSb<yC
zG~tyW9YsS&hz7f4imz&MUSrI5Az-V?ZfiL;$P33~rAq|Hn#@$LAG>`m?6y9`73Mn{
zR42|f&oQ0Nnm@zNlilZ_^C{r?%VXSHre#SOX{ME7V2JE0P0!}wX>wu11B+2Am2^hQ
zMPyK^4K{g-sX7g{z_;?8xdgEKJQj))TH6U&SrD{9fSJf)^iYKB-_DcGR1endbQZl^
zJ8|88eaOtDQBZA#SUk0qSFWuRT|3OnOfFY`msQ%tbIg4tkDESzJpy!jP3#|o#pg1d
z%Szi>xhTNdCGRH|oVb$XvsWaeWid)3WeNIc2MZs(-s8s^TQbR)$IKV3`o>Ovp=3ce
zQ=sK{83idx;HBsbXd>GIuTv?DqEQt~C-I4o+>8g_vIg;Nf;U4XQaRq)^+r`9R0AZ_
z$^GTej$>vlgWazV;>pKOV$-@_96dM*yTw{l$5u8pAsAmzl_hl21ky=t+2V0>#s2C#
zRms3w>atFGVIgp-2D6n=Uk7&~#<dUwoA>tul?l?NRyWiET&XI_H7{{iU9F(IJ5)r;
z*#s`p7~8Ncfa5<oh12^+(0@a_Vk=|VhhkAipv{A>b&VWoS?++lBnb0arBq!3Vls3z
z0x+rocm97l`rVFBJ9m&^ws=gMkTGn%+CesJ%(BG4&22$bhOW8M6iQ5^R#rrBN;xL-
zttzU?6*V+X)SE%~R8~ZkSZ{m37rq9XgbIfD8W@?(QV_(%9L;zP{|DTzh-BFO-gkl3
z)ILQ(dsFOn#A(?HiV^dC&%4%P&FT*P-4|a#G?_wsfYuu&rFp?0u%oZH0i9i8B;q-|
z>GqA-vtxi})f{{t$GpDp648*>HXk48nPLtr`<fAMbmQo;38k(EiWaW)y0T^!>p-Ki
zqMl%4-8ME0=CUb#`qQ^zY<L!b{@)+N@bnydy$w7`P+iL?s99i5M}jjYI><M4gfUA1
z{piyJXzB{`?jv4*YdAT^x?54ra%<X9T31lDHbSjLm$9~1OQ7g=lfuPQ8K%DZOGuto
zj|D-fok+XXBvEzEsutd<B*+ZCc*gEC0Va_G!2ldA2A`vY(JYqH*KEbIKez#7yN7V@
zl}UKR6^#pb*n#u=CNOer3a)^g_DAAiT{74f!DKjTPRN-~jqXxVtx5*H1y2J*R)6LT
zyD*fZ-zddtdoAV!sk-ah7|jxUUD9lUXKDtMqu^l%4&!XH$SL+UqIxd)c#<m#xFWsQ
z=4D2tR-F6Crx6U=;b`=NUs!?xY}sbA>I5f&epudl1*i!8pTTJ7cc;+cgK*G6gV2iC
z=eWSWi!HHt?mdS!>sxTgP0P3-IIC4m7xQRu_F>Ih0vIVvqe8;^)m`}KZ@!DGTxD~m
zc?q;eZxDa^H&5VO55IzdBM1jA<^6sqa)kn#TfAs%3vd;$%f)P~{lhB7`U3BIJ92Ck
zYc{l@vpt9gn}-+(G4rxuUP9LiBb16|G&Q>s>h>cq6-{hfs>ATi#*ac>v&V~CnalHS
z(HDvrN|z9GU8p|S7*4pP#99@=OACZ4YQ=G-dC9Y?5;1Ls!jd?2zVdYVdx_P?#^RVB
zO7Q9e<L@%|$~wr}R<>|(ZeP`aFgtIV(nS(o)uDoF&RQ!Bq%dC=FAe#vm>o{y+^HxW
z4pA>BGnJT$0#~8SaD4?JXd$+3x52`acVz{%*)qRKjF#yaNQO=?<+oH<VER25G3Jn*
zLjz4FaJsm;q_IJPA8y)=VnTqUU5>lj<O3}3dlhJ3V~kc%X?9i?o~Oqt_v;8BuoE2i
zdhw6{vI{?d{1vV%+t}bmGCzh}Ztup=e)<8-#?rX`j&_U;CGpaZ2^z!&M5A%otzu1t
zXKlERo&Z7~4_pqKdCyMcnP*SKVYQ;M$%7^W+hXZ*wW!nwTXviRE)Rb5)M<R-ub;=c
z(=+($zq|z>{Mbf}G1+?jzwEsSd|cI;HvZf@y-TBBt!i8D4PzS{u<1@9B!turA%tX;
z<^NC5Zn9qro6T-^ll@Y5Lpr<JR3P+bstwo}Y}{qbmespPn%?WZ-+Ru?NHe1uNiML4
z_0?~FlBV3b<(%g{Z+qVSZD-P8%Wk|{r@~{0MsPAB;fjx~=B2;+fGZnprn|3ZE{wV5
zxbw;$$aN*;@!Ot>8)4p!A?GM`kmix)FsC0kPw*@YbQ9U2%er2$_`s1TyWn?4rhqo{
zJ2fUX`VO(K32KaYc`@GOhKd!K2;2gMYs|-kS5OFN;9kiFVJSDbMZ1fVrFZ$K*FZzo
zAKQQKwPD#g3MMp8gr-hS3|PTBQHxXO&Md50h@B&*E9c~FU$&BtdB7v%m6JgXl~y29
zS_B~)PrWxo4opb7A((%5fxLsxJ|xF+5opgAcxl|xS}i=!fc9JhV$9SxYc*KEd=-uz
z9m9Q(?#6e%bsMg`p$!KQ_2UOWx&ghtVH|IFVMSXl#>f2l+?O8Y=~Jxzcp(7itF)9<
z>|z?UI<*=d?c+FlcmzhRZu$b#pa`cl7R0lXf6SkWz^(~vL0)b)AwuB4XmKSLFD)fD
z9pNcCnHdcEz?PY9Os3JO7xCjizYi-uxCr~4<IpI?nJh3b&}4Sj74ovyc`?%5^e@OW
zK08|y{%k2r(i{LhlUdKvpmM&!I5|)7Ov)ELn`XKJR}{5NiqUvUCC2*P5LM!gYAz|I
zPg}9D7+NyPSqmLDgBj2<5$r9WSOasV5#d05*7Kk1I!*h~WnT8{B*r*Gj5Z-<WV9$!
z3UKxyJdQ9bR#xDqo9j^#^OJRi>9*ymdmIgm)BV`eK4N*QM+X<*N$9nx+tP>x0qn_%
z80_vCG%CdmM#kMw2EfoPJuKz(JzfOb`MD0#kDw$x%mQNP+HHY>t))nfmW8Ffl}lNP
z9xuMogMav^2T)N}45dng_V!`i^xmcT-F^FD5-rdZYnZDwdDc0kx*cdV$}InEh-|`!
zrXrMAkXau+yQNnyP(7CZpA{T9y#d_)wU_Y7gQsDXG*e1nxnP@>7DeY*W;SBi6Q}UX
zGefxRGgrgq^d~hZ@|gOwgY8Uqn+sx60l<_p!DJR!f;<oK%vX6<h|K{r8&gV{n^9vH
zK%R@`rgLhuK$N|iOl^O=9eQSVE5*FcFxmSUo9#O^My%JLVy*&L?P7n|tgsTpRdOY`
zxpHRba=XYW|ErHsGh)y}NW>6gIo2t*%s^IS(x7>3GZHjMm#is)&f}%Irc4P!B_E7v
zuz)iwyPXPxN!iz4tx&+{3c=h|f|5!-Z0(~^TMQ__qybTHC_|||>7$MLx!WMBtCb&5
zXE9s^+Ote)Vh84zg{Rqqtv|=?1D#4sKst_79X1%%mH6!EAH>s7oIsJL4p(mb5nkTa
zi^|Gk{P5pi;$^p5z2Y2$S()rtNJfwo^A|K{?+b^MELfNlDVYhj>1$`uXmGrD7{%op
z-1qRu(7eP72OFSlLJ;faZE=L@&oa}CO-6Slh^`Skc0JqAlio!+hD3%=SiTn2Gbd(l
z8*`zcnLa0A=5ZyQi*I%=_L*DkkpKMh1M6&l+}V7&$OF1uz0IITd^80Ao)K<o2ufw%
zYsDBX3&dXWiM6O&RDuA3pHjmbHA?v7SDuHh*A1OnJ$oj`ETEhD92XQP(D%6_@Qw$e
zBnvM{EHmU!5Ce~3!G>zA`am0&FE*iQ(uMv56A;sRv1uPPYp)X`u#E^)0WI#sPJIyz
zhPfO;=&oE$Y_=ZVJG-EuMaNvBhrU?L;|N)eHVNosArbm!`3bF3j!02l1lqIp(WV7v
zqO#zmA@_noI5*kE1Y@)oGVgUN0-gwgsTq2GvI~M$TS6>$KY?uzZoYX%l6gkXUs9e{
zt;EQX7Y;`#+YHKeMbMAWABNu_p+P9}9%MZAM=H#0)02e>=G2+W@W=!0_}r%-ra=t^
z<S2o)#M_~(H6jnBq(2)B#!*tH$7epf1*JwKCTw1O<DWON8NnG$reKIPN3g391Dz4z
zJOjUNHe=3TO(x9|{F2WCT;>AY`Btl)4d}9T!u}3BmTj!Vb)Q}X`-CU&Lc<v)>;LxZ
z2)xcP2ibI*m$AeQQJHK(p090qVK+hHYpc;K;U4v)>opt8?Lyf?Ei6?Eh$<EOj!)u^
ze|#2;ifN3$F%IvD9}2B9dEBW=EjE6mK{2DfdqzIC4BoQJNn<W-HDl<t0ff8}n5)eg
z*gt@iFPw(nYMRdMNDJC)Wf&JpzkR#74K7$8?bP)nfDKB*pIP?7xm1ZUjn)a9pASf_
zO3iOGPl;i9vMkD}H4+fBiZF@$Q_o*cY|=bunF%VDSdb;NiIETz*sx&%manLWJurwr
z-hV4T_r**3-wLj!mmh4WzK5=l#i+*{Cq}sT!MnG$A*>2w)0NHmt2@_X)aT&c50WOK
zfHArrvY5cn|M+hFpC4R>llw-nZ%02&CjE>A_S`D0{Ggi8+?VG8(#V^+Ajz|_=E6WH
zVQ%%Vxxlj!;LgW&F_)#54|K&;&FX7W38#n=a_x0V&bA0r$HN$1g5G=lrG5mxVXpEu
zwJ$MGwniS|n7J0NECx+)X5YcAGE=1rpZv|W*!I~~7@V{r<__VCTNXiGY9e!g5;|JE
zd9h526bVZ30)<#8*)c($7J5jr-lXfpRBpzh`wpXL?+}5kh2{fm-J?NRspkIYbpJ8-
z*|=YTzDf2P8>Ahvw~5=}f(BYS#cKVs@DTm>8P36dz`&0AG3yr;p{CB1r2)V;_8K$C
zo_^vKyfk=|g5Yo6#)4{kV%v;;CTAU)^qph)r|)gU>Xi$5+w@>4I^{FYlE#xW6q#t;
z6=`*F2EDlH))n~ZhcCrn9)As&UD1knU9%iEua8%{NldU=n?Qe;1CgkbyH)<>OS=&E
z$WZH(LMB3<MEF8}&D@HwX(lG*6$sC(C^bi*OiD>Eo(a2^aApM%(i{wTw)f7*#Zidq
zD(J~DE%>ePUxK}VYR7XwKZKGBOaAmLiM8pDV96B=P}y37fH!)^ng+RI;Q181q#QwS
zK`Fu3>q7VIZdmK9(6XuyTW(zlqfv#CBQ^qA1785r`P*q>o+tsM6ravop3-Va_XA_B
znb6r#tb^L5<*pGXo}<!=XxqLRN|wtWPqlMW(f)h_3xYkMRmzFCi`(FW_R*$On8FZ(
zw5IJc5zxlZlGJkf#Yh5UqXDc~Rl{#&F8yFl7?&-p!j>yr;0p)d((`AGI~+*hxmS)s
zM+5B1$G?N${^t?gb=Ok_kZYjTC~?&_tthtYk{X=>CochJ4gGQhWIDA9At&&SuRVp+
zWZErUP=jCmY%g5)Fz<V|Y-J^e{Db)WuV00wtE%ytPv3_n%Nwv^b1hh&3}aFnAvp;W
zbNN*ZF<WG(f6b^YljrYBkmQ*;*0Zr&X`Wzurl2U#k)bdjcLEA9YYi>*<KZ|CztRt*
zNk^u+kr&itre9@#Mr+hypxp*rpPNj3RTenTH`8Fg&&MK68&|~p?!E$bE2?mM?;v(R
z*p5qXS_aP}?Kt?e!#uH7)TpM#ba?x7aKCIcDDa+P(iFf>Ur*N9ly#68_s4iiuaKe2
z#jLzw*Es9(1VNSRsLKG$2<Tg+N8e6vgA1C`rmrIpib=wQTBcGjoPF^E11lzs-P>(P
zNvS^B^f2>vl?J1u9t`$7XyB{g+Jz>yv=?cM(AVq1eZPMLZg&)qK6DcI{^oT8J~ajh
zTyVLA(3wTt^P`X8x~mq$74S|CT;^VI`hsv1Be#(G@Aib@aYuM6%p*H?<LKcrlv)f}
ze|arFcjt}J8+AB&+=frwxdFO3u_7`9<1}FyD;^_rtvwh+oQXDv6NpFS+<eQcAuAVR
zbeVuCWCh9c<@XlSPtBkATA1C=1%x;QkSXL+D5Mg0rs`wq3Fr&O;49W+>xY+f(H3T1
z<+T>lkgE`QTc!vrs1audAM>@Xk#Ghj&MCn2+C!X_Fj1G2y9bFumtmyKjZjcVbu@yw
zBMQ;1Cm<9vGz*fGl(`KU$nva!RLhMi{fCql=^giCSf_=wybe(sw^LPLVp1v3Lkybt
zNmC|)n-wV#$W9iuNl!(iZzGhw(1AATK48KJ!k_6tBb?Qq!!pLA@AV5TuoP)|)ID<x
z#v)kUR)K4-U(Ch8|0l}&G-@Sm6Mp>ZFNbi~=Qd;O)>hcuG}!2;o6P(~REFIiBy&H8
zb(hp6Q)g1XJXVhTuI)>(ZbLmB#LlfoJr125#CvXCg&Q_+gdZXJh&lYrkDtMfH!nfJ
z6NA&~$NCNBc<2xNU>hQUX1?sGgx7sxL>Q2T60lh{a1$euV~M<e+k9>WY1SZ_oL7W;
zUTkxQETdeIY0k%;FrP}axfuOS#y$6bGP4wnMB~P3NDmR%y8Au+er7IedB2|rhg01v
z#OeIwSr?Q7zS?|1%mSw@Ua|H)&Ah|I@Sp?Li%MWBSF;os;K&Gif3Xkxs^X*zAR$Zv
zY}#eOo{I*u>vQF}JSAEm_l96zQG=?RmLoLg;@Y}XLOO!LJ2~qNO2~@jJ`^ef0KWj!
zGU;BeKr<qOi$Ht6SuGhB@sKS1$t+4|O=+1~!m<t?efT7?Mi&ga?B?&RDyOg4POR6D
zVv~`V{=L;38-&bPTV^)kxo1w}!2Thaw0iy;J9d_*Yt-oQrN8?Ne*Ax5fkkgjijnj4
z6S@DDrG@c!;(X{Uc&gC44OP$)h)(*vSi5i$1_xdE@jWl1w9JIs+B#hJu9X-k&}A1}
zO_QOP%)l0{3MU+1l&!1AyYIRbPGZxNjI0Sg8`$Os$)s6|8)lPRoRMEG&r|}FFgv@Q
zFW>@m7e>t1FmgUDSHb$v(QkHFi|9VNyb*NK3t@i*2cGUGGLWIjRp9udVF{*E9oB4b
z;^36XkW`#mZku17t6&4pl+X<ekkqX#$C4`>v1m;_ER`CREGR<b$}(L0S4$Cc`w<`u
zQDl+397~h=Qh6m<m?tXmg@Fy!M3g;AR+d76L?n(ljc1)%3)i3%Dy?#A!pG<!boBjt
zG3mbI0^d<URVt%+b>inSS$JEy4c<0D%UG>P5`M%CdhNNC<njdSWP6a@JC%@<K-bi4
z<tbS_9ZJTz2`!w(rc@-;x^}(NgRxN`v?^7Wi-Ap_QiGLDFD1{BO;0~ojrJ0K=Gc)j
z4#w>C8mg@L{(n40rf3AWf9w(@6cK#$J6GfNJ%i{T8X`s;!ld1WiD56=d&V)Sql;r!
zVv9-3{o!M@kHN#^*z@WT90cG>A+7u;&xrCP4+!R(y;43#nhT<syRs`Qn3Knya3&?Y
zbAhT<fT3azmRksPePkW<kacj_9YQa?(Y?A7egYXC-7sT`Zc1l%Hg?Q%XX}@hqG@e8
ze9qt;<;0mj-ogOPm<W?zWLY;cvY5Q~2zLGV5iGxY0k(gB1AhCZ7qIi*qd4(Q7ot`X
zA9&_dsK2%efiZW607okGK~4t2(g?%+{z01ySNvc*7Jgzqd_8uQH5NlvXU2{n?u5o<
zNcI*JlR4+?QAU%UwfT|6q#GhMDZ;!`dakHa8e}esx7&8X18q9{ASes%G2nz*JbR$^
zl6igAwTp1s<xN~zCUY|ogBu!j<LM_)^5{S7Vqgz=;0=U$cigvPV}4e<pO``*j8bCN
z8m%&KN*H733PtWhk>I7k2BR9`XaezA9Pj<$Qf$9^9gZD!z~=U0%ep1F|AB+pN|WbL
zzqt#MNQACMH8f<3Dd;C`QgJ`w2$`|3+8k(WF2^{5@QcrNVa?X&r0-0UGnix^u$>h!
zb6p9-43k%yM}fm^T^?quDmxqZ0L~(ihCHqX1ruGN`x(Br8N&oH)(@?~J~GdPWqMdN
z$=p{7^UH`ZlxWepe;iNz`yps)Q4}(?4KVKjVYVgUbp&||R#~GNwFKg9p9?Q-z|P+u
z!k+sNqn?@ht>svE^CG<R(kM=nEk82sA!aT@DJQseBWpUzrV3-T?7;w1AmR|GMOqb;
zv1ivHjvtvosa1>KU>u{~IILD9cZ0AqNW>EmiQ$$NYf(hAJep#&JOhS+w`4=&2O{Kb
zNws{B3vg4uT~-7Zr144OKNpG8A04S4xo3J!MY?N|NR-U8IC8s@rQ3L0ON_)M{cr}n
z_}1UwfD^}Tc;e}!+)RIS17d)KzVqu}-HNW$4m|pJJBkd3GhUW>o-7L<$O=4k{|Tsw
z`9@<=l$7bPWlIzO@Q3|azN`vsFR3B6yBUX%4C7D#br_Xu9psRNJ%2s{R2s3q)r_%|
zF5d2EVVfE6x^oR4_~uT;Xo84Z#nks@$|Pov^NjwHQ<FcXKFZsq1L?M9!j$A<cAt{z
zf75?TdFE1Dk}&;UY5B$EbHY@bngF3-pR#;osnGb!+qOLCwHcpHp`Anvc!<t6LZD{v
znB;DnHy$|!gINQGTAW%SgbZs=&T~mvX9oMIm#i}pMdd~gQ2Ba;<sL$2pq?$7OkY4^
zBI2|t*R3c+!?Fs{?Z)YSBQTd6aPaBVe9o|(GKEUu`K_IM<LK$?Lpi;-c5O9|9T-5x
zss_}OH8ilZANq0)_syoO!Xn-X>Xum%uCB-Let7^bWm=Th7}4j6!TfwDtfe|cH3BD3
zK~D(Fw=`g}Hi5C1JE5l67;r~D0xM7$w5~|J5Q>U3BZ?Op?fKi70qvEA`=*0pXTF7E
zVQkpgfW{^(0<pl9$O|iT<^8wFWEvasCMQ1)uu)pEJ#_PxZxN$aD;4PNabeOH;D4W!
z9YE*A0%tu#<EU@2@~*0<Pfg%h$Jfw#a*SS%!)&g^tv5ad&u9?EWVV*mYUUhpp{!1a
z$9CKXqeX>I&m`QAFdl!jg9}u%eq@q7)BG=Js>_AhR5lwG^7>=v!}1CTr_$}th56-{
z&f!{^&5t`5i)8pvlAyC3aAMLKLg#@IKIV+YI?npCTEypGKY7}XB`Opc9+<@CA6|kD
zH!p@W)fIQXdBd3!nQEN^i#ONf+E1_MjUamtjpMb4yI||}5(vlWITbHfQ0bE5-5P@m
z6|F_MWa~1#a&J3<rw-mL8gPi1YGRDWtXauiu$;{@3dd5mSWyEj?DjVn!DQ9Y<kjM&
zKaOg(fQlk5E#v~XSQ*fYMS94`1`s$t1ks}7=*0ZJVU|0)NcydcHB0p|Nk+{2xDYqR
z-FM&pKYkGZ_Pu-O8x)hZg4|#f<uz_uamHdZN<oEzekV#x4KzSgfg>>qvO2wr7Y;01
zR1P(<3x_>~*AMk!c+i7lqw&0H9~27Iv11TqB@WOa8yoh)Vl+&3ML6r5t4wyut*fyj
z6pWy|&kozT2aU~@czsU~UfR`#fSaxhovTD6`jBH1MjG7%qX8T^Wy2>vwGOs{AWn3T
zqN3P{YKs<=BR($Sm&sN$ec<_6U-}%8hjj@Ma)|7d<astT6y|m@Wih`zseqZ^CFl99
zoO8_b9N%*$uSJMGmQ)+C=%!}0ADe_6W8&@NET2vLIGK)XN{pS}@1ezW^|l6Vd`}y8
zKX{UBRK#O)#{JGdo_smHY+qi7AMgL#78r_jIJC1514kzjCIDnXDOPryE_oGF50(|+
znFyk?sTfrYi!eDjfu>6vvHbd0n7VARw@*S#3^e2-u!{;DAS0d#7GGTl)g`sK{|B$5
zxYURc?W<7@)agZph{;C@@EuaJ31qcaK&?_jOiBVQcRjH4wm@pWJ^o&m2I2VtsaF4~
zi;VW1fP;pKOA`Nu1;vblbjGZfvBVJqF;?quGER3-@I`{SY;yzFt*#?RImy$%5^{`}
z=0@p<rBjLGo9Fytf-`Dj4i!}fl$(sawK?;-o(~VVUZuxNd%Lh<Qv>$_zwrDZ7Bm|1
z*Pp)<cmMPCxbgZ%^h<7tRWkn1&#%WdA6t!<A`|}nz)rY5UR-ze0z}}((lym6A#;)~
zPK9)5GkZ|Y(6W_h@fGG&ljY{z=B9zoOTR##Jsqr2Fl#P(#`(6_$^Ffkp_j~P#}i%9
zc!}dNz1dj<cgZjnOX#<fsckCNB1)jD)G81OOL+K4uVc8=0i{}rs@7td$Rc6si@Dc`
z1x;NxKOEz<K&FIh7=|0I2E6!(quBY!V;Jgiz*wq>+Mt|P*h=F(0c_A8<?32`0_8WJ
zJWb4Z6yJT})3l!`5=TZ*WFq!yR3Z|TlLZRO<T%i&1cdxCbUC8X(VPkqktrweT&^Jy
zru`ad;hAK8)9AaZRWe#N63-D%q<qfIXB={fsJtq1Z+UIpEofwDi|2k^WVGkNXw$1g
z1cK8b%A53p+<d02maWXeXcR_+z}twA+I+lAftm*3#CQM`6UojCETH6=2&1T2i}&5U
z5+frX_ybYiKkUueSc1CMs>7w5YSG*6N-BMwCtzp!kXogR&PfBOEeNF%*tD?{p+FpO
z92&u@C1$+w(lEaK4{LDyotL1htq~_*?L&Md0w=LuHyxYHLEst|;O}>XHNg`VGpKAH
z!YSlue8L=di;&+dn#peS=?l%}o6IP&PdzV8xmafN$IkZmeAsRJoJExa&Q3c7wFd4g
zBkZ=oj8gA>=M|!H*SM^V2WKaTeDD)XWLYyyHrB#58KBo=s99LT1-X6BaO&Pn@5t%&
z;@aESVbS^;9DB7FnpE3vk;XE6KO1X$lP1;XDB~8SR0;j=FqUko!{UuK=sGY0J(=_@
zGv?U-VXWLzkI;@zoP1#bmPRvzPL|P=j9wd=wgEBYm-@Uo@!AknRy`_oBGwUs>4-?g
zYz5fH{4kUCxSGafDIFHeFyMV0Q<(-TZSpzGI_YL9A$Z;W3Is;QIUhwepS&0hJ9i2$
z!zqd1s1f7W>ez~(%1W5e7LO-|lmGf}F2}AHyYbq=0q8Yqo>k!UMK~j<tTbZnC3QG<
zc${m?UU$Pnyt=!Wzou5bIlfxPAXsY6!bKI>_v$dl#(dB!&d;r36OSoF?by}9t^jIb
zMR7?bc0J#L-~8$o9PRoPe*AA&VCU`$T=CvGzWLQh(X($9i>+nYvG+9IeajmB;77OM
z(I4(b|7klat1U@42c`v;(hM=(Ix9E0m6p8}GJ<4c2KWgXfwIgXR$3NXNCmT|f?;wt
zc;*X`i8(<jIZwbWGYHB+PM3NuoJjUY6Y}goH{ez1cjnrWpv7B73;eQ=t-u~f7~`kx
z&?sgCwvdvrWI)OoB&*0%YgK4}b%--ly;X~rwUuaIRRLo$W4JMBi4+{)GsHim(J7Ox
zmq1yeNCwxUu{g|R(kqEwGBZ8hw~d{5I(L;9NeCIm1{vqV06D}Nt;pFe%ZpVN88Nu4
z57E^YfXsg*G1IV@v02ubk**stcY82`-U<^Obo_b(ToYNKEi{KFT1udbC*T-xb0BWg
zBs*WnQdePWok-n4WhEY%III{RdtEv2;P-;{7and2@&(Y@tirtM%ordY@&aXIUrZL(
z4<{7R%v0Hm54?B`*In0!zCH&|b&m4V+gx91B%I*&+3eaxSaUjkaut8G{Io2!M@xgg
zrL`12J$7DXa6Z{{geKd9+ERD|et11W{MYY3iqGHm7f8fDUfOpXnwu-}({H|l2~Plj
z{>>pY>uDnS{U}{ii4T2z9bSK+9kv5DGA-2^0GOf2oG~|Myq=NYA?8HXXTCT4bJ?%U
z5HkG0`HlfOpvaa*U8;D40lW&yme%R!kj#{2$7D=_(m1;h^tXy>`4U)Z4H{zb(hQEC
zn@LpYHy?AfPcxya$4I8~tt;^IeJ3#4F$qh#K5N{`QWEePU@|vS+og4=Two#~6|nEA
zew-q6on6W8pInY5m)78WpMDrs73J&;priX@tv2z7jpcPl^c{1;Ga2N7t5PW7uzC1c
zF0Cxe$i2=!PBFz`A!OV~dMJr?GnFvb6RfC0k8mJ@qQ+v>>lJ7rcw|0f=4%cR5Qp6a
z<Srk|mX{;2t_CkYbrO0aCuBTgfkuEY9D~qY3^gN2!*0}Dl#p0TnI<_nM5WBL4A?_!
zk;&2%Fg~Pg5mj=JEMeYhMz_7N^CF`?Kg$CctNmKFDD7k&7-I8ewag?jXtj9Yu{Y@b
zDxRy#yNPB1G26K>;m5cCZaYSXz4*=Vb`k*A^1Rif?W4qiHRt~(C<WfO{I&i4FzdAR
zzXIoT0b~orxO)Qk{_5lS;g5IX@kfr~+jnor&Rxf`Z_fm}P6yGrsswxgxf4=20Ix!a
z;$`Ld?vJm-Prm#D#$UJbtOQxeW{f$+b&4%zNQVL`zik#H&A8rTp7f<@b}M86sgMP@
zS>0XbX|PS_UF*eUiqQxGrJi2YGBcQ-h!LPU=sD(dUx=iCaFE8pFagORG0(~%E9$r$
z-Nz<y{E;pg%k=Y3^UB9+MW$#~tHTJ{#>f8eZY*6=37<v7m9BhbmK%#S{C>xY<*{Iv
z+Zn>*b=6pVT@$*G4&vltJ1uZpT=%h+*tg>(+Sb*h<Mkm}3>JRQtdh(`mY1IP8S+Ok
z*y$po5KHCO()p4tZz@Tq3C0rf0`46->#AlnNZ=MAW6eV9Z>BHHJRYWnCGfTnLn%u1
zy-K)xgD9<5Lw{K<iaxj$dX{4N&{1fWT3!Li0$x^=8m>MkhUg1!s7iK<9+!FBDrm(F
z_YRR9wNb`IhjP!z8;TyaUWOpxZN0s%e6%^f+J3Vr|20h%lUovb)zW-6UpRvI+^~|&
zoG1qE4j45CWQr#8VgP~lpQp(;<c8N3LySg(*Aq$hr+<^~INPsQtvYYM+4Sb|hsjJ;
z!eCay=ZT}f#){wm{taAqc|A65Y{Jo_b_4@q-1ezWD6XN2BAM~>;ZrC!S<qH%#i7SL
zIU7`H71It!A&)0kK;A5YY~T@Q=84Yk*3IL)6*7FRGr^AqN@JlI>~uZ5$W%VYOlbzN
z#O@}D^>y0=7@_AUiP>LueJlLcW;}Ly7*UmygDx8YWi*&Vqkdv?(Wxehg?zK}9R6Fj
zKu_BIsJXTk31W9A4i2GVVL4W8spDBLOuTz=(t&l?Eg|5IAQp*X&GpT=|0l0v!Ln+M
zb-FR>a$?=KCVb-Cn-L0x@aR29xD~`1E6dF#(|)Ae1=mCfAzzGJWuj8Z_KO$rYp1Ki
zgtS#Cr2n60xM@>_{m)z(6N6p|QWPKfKbsI44&&GhJ*a53VBJ?QgOdRG)PW)F`q@5c
zj7B=gI8=!!stBxobX-niJ1paX0jo0=bhD_yyW{c|lAhNZSo)cW{v*l{2`UV$baXy+
zW9R$W@P*qhx(?2V>ws;{H)|2(TZq*@*q>0$+gHmP8nV^$n_s^U?Z?LP%m3Pi3R78@
zTY&jA-QEboU^%r~lo?FC?-*mAZ^q@4Qa-YC1##YbBrb6i(;o`cVid(yo7!-?%Z4kr
zF2a+KAA`ZDqRFqofNd0OmM%nzRRf(?jjw+FQta6`f+rq7jq;F$#8?oA={;=~)yV*h
zB+p{jpNT6WlbvR#y@&<e0ENCc(;dOCoe)hR!c?S|mSJDV1UGjzbnIrvz=$>4S+08|
z!9T<DNQ<gWywuodW2Mf?lr=wdOVKr4rB@R;i&N)~)OVwR+n~_%Y`m!HyGqwop@YdG
z`oicvG)62_i_iY!Re1f`E)-jd=^Y@eq1b@s*VH3A<imkK97k=d73=R>i(Sv0f~HtU
zz*~mBPjq3lCxGED7mOD5jEI~tTS!vK{~j>~wEXx*VfsFZ(=G+BH^6+?yo5cDKp=`s
zR+XY8B4WX|R+Mb4#dD9Iz`h4MAo*jklp8QP;>A^;T7_HJmf=s|eF;YmdbH>SG-*LI
zi)8^3%cWD$vMdD!Ta=P+19Jsg7bjJ(47Dq+&|Bm)o^xO9d*LFZJs*rV?SBhFI7zJb
zcA5`GZb_IIt7XLpc2@v;TA9_X9Y>Fo%rA*oP)+-CWrX8FeEJiYV+FB_JqJ#~q%*uJ
zAj`lb7E7eq&$;<!nQ5mdfQTf*xZ#F2Ty^C_oa`Rqd5!yC@8=zReZ<UJ-laipME|H0
zVSfSx!!8^-I02s{f@gQVhPq`<xMV{uEHM>^20XkiIfR_N*fg>iAfU4+69@%O@Y$K|
zG%L<6y<)ypgINs^F{@5{5CQ=K*#~?~Fw-=^gi`1}r!5900jtjuLX6C9c3sk*SRZ|E
z!&UXDHmEQ;?B^9*GcpVWVb-n+$T=68zH4yb5LPZM#g;Ag7~9pyTZ#upy=bE2T0rJ^
zTU#-j78Jqx+A#W_>VYOg)<~}%3s+PUQ;owRBrx7H0lmS>b4=}{zNF|kYYM7WO}Uy1
z9Z#X>1To_tr5F2*)h*3x8OZ8rk&Z><xZ(p#VJg<*^_NEQzMtMeR)PnA_}4cuc61c0
zFK>oz*bA8!hArD_ur3@$*Kh#)NBrFPyddR|Wi<^YbRGuQg+WNBatU0qix#`EfWBkO
zn^X$Hb~Xv98!s~2^T%j8JEez7kguy&NY4xqtBuI>b2>Ay9rcXh`mL+5W=$RL`NeK1
zB;^#)u}k6$`|$o-*1}2y=AlOqA><W!K<s>P-cS%9{J>g_(%{^)x0?W6cV-I?0Y`+G
zoQrEW1h8$>8kAM)iN#Lx0NA5D4xvb6f=ZRl+swp9#$>`|TKl76EN!hpFc85Yf$yy!
zUJA3xi1wEWoPAMZinQ?1VxTvuQbC(c2Aj=JGnp;&JXeU><_4I=jD5@&EK9$xrnM?!
zRKQlDMfbr;9$d`LeHL>-Ki}^#U8Fkt>~iKeP4(gu@&>|$DJw$AvxMaSX3_f?u~}Nd
zQBq;zl~9feKXgP9L!me<&1QrM_#^HZ3}prac=`q+51s)B?2AibSyzu0tIP2Eiya6%
zlWAY(Vm)^o40Su8)v0D@vjv`?Vyvl$IQ3h|dX8l?R5e+k(J6Qe7b}<57F$qUt;666
zI|k@cR%s+FDw)}{(xk$rZACbE%!XsW7-XFiO=?<HN;McKOM^|N7CjSDVuM)b*$j*=
zn@S~gcPO8lIIVoQ!7QH@x%u)1$Y|eI1q-=bvMg78HX;j$%LFoa=NXn{Zh&HK1rEM3
z%yllC>MOVqOB#G6iFK`2;g1jO!s$~E+;Q6$xI(U+YWefC>C_q=Jv4&BekZi*GZP$V
zK;j{AbcKn1-@Xy|{^FAu8}nf2^SwCUZo^|c+EHmP;UJrjfbtgUY6UD>J#02N+Lo1*
z8K;Ipp~KTp9*3dEj1PTdE5-r=lvuPZKRtPUkXiOB=P3-B*+M*DfkSSqoI>I>`6Uz6
z<+Z7Xlc5+&s?BIwU5A)B{rn7{q&$1?GL}R%M!@HdOFY#mS3EoG`==Dc<`yAm;3MkP
z5D6UJv}gtBp`%4ywrHTMG9ct)T?SMz(BI5l;|&%Q2^2M#Lc73>csPu)UJssm@&t@U
zS~M&vfvH5zg@HoBIA8E)w4=cs;y1!fA2aWeOmo38?oGPW#ANE5TF)514@0M2bR2e^
zIADX!JLJaDys8GJ)kgT~x~b_xY%nNLDoc2B-#CuSA~9|S8rn+Hx}*$IvLG068wpr-
zsl3_rap(wm-97>K5ye-uIuyL7^A%OU2(;(b^p;_lgfAP({9?I!^DT8&tJ%O*;GUnn
zj)6W0bed#UOfVcnDKUz_{pwaMsA#~x1A}<tvEx{?w3)XTIp3Q`sYFkggMiM@|DNy0
zSh>yXK`0T$Pk!)zY`eMzCpv8KkvYja=@y&xC^Z`9Rbj^b)|Mh2TFJCsxvC1k`ok^^
zjM~uBV#e-Q`*8PfKMd=VQXIBVB18b;a|E;cNlB@0wexCsBj@WACePX1s&IFNRAre;
zM8X|`rq>ChS_!5Az(lb<t`N`Y5Jh2zvX(5*)GuI+td15RGi$RV=Wl0|U*ucP?re|`
z1TsK{y`IQePz1Heb!aoM4{P<(G3r8beF^l$viH8wf!2yToY+5tmmWEd0U`l6eQG@_
z>&*xTV>5wO&i}{)Fd_T8vI2;*Ix{}-)y+I_mihcyTXe^m4<2U#Dq^Jytr{z?TEv5e
z`*(EX#XlcKC?Y{afVx^Ma=-U3`hSv+*~|iq!6=rum7u)YiV3oi7{FGlS(_?w->{rw
z&Co~~?o;eY1cg(AN<QcA6&KQ`e7gfJW3@h6+~t?$*DFM6LvKQvk*rd9<BK&<4i|XI
zZ8RF=MG4G(z*>Z~9~*;2BgPvDbGFddR)LeJY;cDIG<fvTb8UpPyRB)HotfcG(3|Nj
zq#5RXKR@AhVe|SHtX@@3i%ST1eflXlf_7N7Wn}hGmlw}xV`AeIwg7(k)16q{RE0bK
zY8#$^>NM{8)h<*T%K0SHS~bM1N-z<WaqG=Xuzz<yFS20Qa7tN=R~JpEab>1}$(gQ$
zbkRbVvR8J2Lr&g$5{!hIg#+nNu+mhn!_ecxrNvrwMPld=MzH#-26%@37#s5N0+g)l
zNR*WUOC%IUajAh13YNa)nhYXdZiLJfwIn&~`_k!TQ%5UgAIH?+^0aG2777<U<UW^W
z+Ot9yjS3@UUZ^7poIXkBd67BkCLlYTiN1JUK`v34>o*qi_+;}H-3dZQMVgT8vddD<
zT=pP*9zR0fI7~$vTyxt>w5%#4FxB9ZUmb-?tKvDdS{iFwU6Q1*{Mc?f6bJogSq03!
z&GubXVZ!OBPjNSarrd-grNn_JDx?Y&*cdbdHaoG|A;leLee!<4lQ!|4aS}2n6XKm3
zc2gOvmFI8bvl7)+tE;)A-X8EnPlK0Li9PY`32u&-n~mrvv;Hp+9wnBj!zVtnk(cOB
zdIMah?rgRwG04(VJt|ofzQmcaWCm<DpO=>qUvYUOoSq=Q^3~rX9%H`lN}h`;o#7~D
z?`P$pr3MQ+dnYk6?8c3^EJI~c4L1iLc<>cou32Ad##k^2H(lr$U*rT{Lmwd!n9@Ye
zt1&POyOn2};|0~a^0Zx<VwNnWNkb#SqUM0VM5V$Sl@c4<%AvDpc~z8*Y|Ymofo#=+
zB5b^-l{3OvELjn@?!AklE7S49m3&=#^RisIfO{jeznMIHf3)1ceZ&MWSz8OUL5&^H
zw&SCJvkA>B%J}#+S+(dqHjbzN`!H%+N)hmfr*da!{^Yk7AY>?mrT&f)$d2}T@aWH9
z!-xNF3$FU;GF<tg71(%VEBcR*;raVdV6fYRLpyshLe_(p#^ID7m-(G}b5HOfBnxi2
z{V`bO1j<cnIF%}x$nvx((`+{Ry{t(?h`xNNSMejYB#g5z%`=qT&fswoXx~Iy9s*7{
zCE?d)BJ-`u^S<DW<?MW^3$=AtT)kx>Mm=_JE~y}LcE)lYnU7PWRPiCZYF#<reN!81
zs)`T@g{J}rY@)MPGK|A`{2^{GDGC6wFBHJW%?-Hv+C}h&=HGFb@7o)~w#ycASH^$b
zvm1ZB{|!_a8~H+UrU1*1kLB4ip%@laW9MPf=&<|c9yBzXuw+RIqICX6>T(=>V+5P8
zXh3O^0ssDoeQ5WFF+uyd_Jd0~NJqnRwxYi*=LM#`qTn;YbEfY$AK<b?0yQ19Iz@HU
z?_uqv+{E<CG-^EbtApqu>%?f*q>FB|ewa^EsY(`zq%R*Ubp<!$<$1O6mXIxElkXfE
z%qOP&%JRGf&e^fC``vSL0*#d=un{Zwdy<+PY>b+UbqIwdx_>d$wiI)Ao?qxD=O@!$
zkcw71Cj#7$yl8C=$`_cibVCjLI~+WpyzB5Ne)O5g@#rs)V(+tqJT=ZhESD8B$myEu
z6l+%r)5>Wq)o#(+GAt|8@O`s<*$O6mm<IOLJ<}OvjE)H&|D^IuYJKv)o~_&9qL211
z09(5xex7v}FBK(TraNC=%hIb@rA}p)8Cx%JMs<xDTP|xNhU<ctfQYG%vwCf&n)LZE
z{SlXLYQnp2SOR}+98O<|k5&f83mOP~qY=FCeJikv2COF-%KLpqWGC%>z8jA{ava5a
z)7$_nB!eUVV3>~4gln&FB>;>NNJoh&6hS)6o)f-M1XpcqL34|hm}@lUyH@b#ct8E|
zZd`p`D=a*vN8(^SH0Xtfm}0Toz$5ZUT@GA%`&w+>-h_U~L{e8Z3qa-kj7`qd0awn~
z!bP4{UsXjwG~f>7Rc{1?1PDg@pS6Th(WG8@T{GHEDhvzB?io^IrVm+5OmVo+iCs^f
z;$^H#vUP)Wo;!Yd5Z<vMR61orHLgPXulYbX_j8H7!L%IaDJL^Z^rbpz2+%(ImCJB=
z&oKH=C0QifH_L|(_@Z#wf>7(!vswewAT%wyE~my-oEFo|Zd!y20@$V%<-CP?I4EQ1
z{l~HQ$u5lbxgjc*(3KVuz-oChgp~53WToWgJlKL)LyLfx6=u*Abty|oO8ctm^GxH$
z6O}POtoYkxs+XL<SKLKLdtq!Wt{#UFnv}(_m5MSK2$^qStjK7<fx|<1^0AXVzm$yv
zm0G~R|Jw&~>7})p3_5wwdIb$ItF8*4z3WdH9d+U1`@e+NRx2j_gD9`i<NH5)7iw!v
z=<0UxN-|Y}bTE;p^u!Pd#IoEEg;MR<WMDpFQ?VLtZB_XFZx7)01O2Elna`<ImrZ1L
zoXkW{D{`^@vBs57cNEV&-Gy)c<MlKl;&28c_``z->Abzr5pZc3AjjhP*?+u>+rG6G
z8`d|%kq(k&u}`^hls}&-ofmB7yeycBvx^O8^u(g@(PVWH*q(^QFiHz&v`mkLmMoDB
z(eJc)wlvj*P~yTW7ORf?+gaxgCg-=P(VFaEm5>XzQ=b)N^PFcswwuT~C$@Nr%=D&5
zVAKOWvBn-&Io9pMW4}4Vk5z9`Cy$GLo_5GOHea^A8Ot_Q!$XUHZs3c7vBw$WrM>KL
zIg|JC{8)+W7qG4eY(;<c7yB_W<mDA>)+!^+C3@&gN+J*fEw&ObDB$}L<ZLbBREaLT
zZV?*Sle7TT7!-&M`_SWy)8Z^}O_F$q%Yc2JRekjih@DZ7;#Ugo>}`nN&W!eLTd+`Q
z)d<SsK9eBbVH9PHOHw5B0_O~jvF@|X3<5e%Pw+Cvj@}6vObXojsf}oAD8q{{pWylk
zEcJ`!q)a${*tEG3+qSh55Q#W(WD;-e8-|wvs;A%1%P9>yO+g@JzSi8nU&%bznMWIn
z#?Y|9isj2{@bq&X2>IhM>-AZs!)LQGHL|{bCxU?}2ha4Oaxrw8%=XCuHyy9o+Kho-
zJK|*X8T1;O=n@YInTXjQ=s1mNT!{v&8HeBKhfb%>ituNPe+z|=SeVaq*-uQ^Jox0-
zF2j~})p+gMQy4br(CY}m5sIVZ;23XW$O4VrhsXec*eVM`vPH$_B94_1x$B4txk&W7
zD;UMiH#DP$_H7#pKvd@u<`!neljili;B)DKAU&y5iU`wjI0(#Ezh@z=*EFGH$PdSm
z8y;5}Q6AY>W_{l8i{R?_xADIZ>>hyLkgdhRTo3E7YDQga3A#_(pw%d+7^lRekP?<}
zs>4eUo#eW+MvE?~_@+vxb*bogm=-Z#K;~_3GKJiEu5Bvd6{azvv1oX{ZTUhgTIx+G
zo%A72RsmzPjIFXNJ?5$qQ|<~2Vf(00!q92ub;TNSEODN)C$G2w3l`o{K%1V_A&9S(
z3-VvH)ic1VgXZ($WJhG^G%9XB8#P+IaikND(F8GqC<i3wm$lLg?<R9K5|r@pllx#B
z4q@}gRy_6M3D{_oYeXflI!g<~$f-y}y6T28SvEj3tH9FgUF$d0W0Jrvno38S%B-M$
zc|62y23))=F8}O#7?kYLG-@Rst2iSuoVh|+7DoH&abC3Xxi4MLkNrgF82qs?6f|SB
z8U+Ea3a3xmd3sV~nT03PM_EF;LYUnbk`oP|RjXFWzYorKLj?M^5d3s~;>7ruuc<{%
zixnL`b{LHs?m}XgO^6i=)S6LLW*{)p;LfjZ<`sgYV?L;vR<AvP_gveGb!0vtda4Ub
zlV&RKcs78XOaEZb%CXenEdMk{mPCKK9v!TWcbyeGpXou6##Ccl8RC%yY6!eMH1;x?
zByoD!ZGPzJ97ej_1cr*N>*WiCv1ZEx80ef&930`5gXxTm$x$CJCqU;elx{b7pNQhL
zk5#2ivU;~y&JyimW7|u|6=#A>w2&$3$p%_^*VLM5ZiKM>idt-IG2{4a!-z4(H!)di
z%M|g_T^ls?e^i-3=PAW6G-2g$M74b0Dlf0NSQ(aoJKM^zLUS@qv!GIu_?1<ZKh+&q
zBo*#4PqfXL*-WR_=1KMtv*>lGt~T>FH{L*yOsfdOp#;M57@`F2pZm-<yt=y&hfj>b
zO3X?S)8L&<Bxe(1+~-D1Z7EonB)i?u0WJ-A446!24Se1R2VV9$25c<Q#0EBF(&?16
zw`_2ve0Ywa2iIM>l&hKb4NT%+zkeehe(*T<yw;BrI#(727syP%{lhCUxqq0qF^|Qk
zQ@`@+9SA~Ui9{jWua%h!miZjJE}n^GFtMV-gh_7@)k`X%vuZIg?!=N6wFuJneD*Q2
zM${TCZ74=LU1QgzADgdl!Jb{c(3R>@UZ%&9N4v0;SRd<)#wxbb+QVtZFl3ag%+NFt
zX6m*G^ZcEhgn*s~=}{?xUb@d(8doewS^+hTX1cy~Ue~U#L*v?VJaXSD?vfHyrW#wc
zSwPB9=gES422;`>Jr%o9DByDV`1e^$O*D>@DU4oc5Vg%kSbJpyj_eu4#Gr>hJ1v9B
zbq5&B_p<iisR}M6T@k&bquBnTOSoR?#LjN4t<=Lp%$H>>Fln!Z6hmi}7%s8vQbJ+Y
z8Hf8{324)L21P|OP7ccf+iA7YO3XGc%jc~e=<fa(F9PkG4YZi{c?m6w1o0ff#L9Cu
z^ER{d>+Q2a$5Mbou^8U_o+Z2};LxE_0^1l^O~94g8o8<6acY8VfU@0$>Ai~=mhsj(
zoqeOY;i}~*t1#f9hYuqW7Rk(0PuHlkoXL2CgGX8%rlGMIE&?sDH~gk`cbJz;Mr3)r
z#Ma3+u+U_D|A$uMsV7ciXxxJ`b5d%OyBdN4TzlyPsO(_`=)tOqm@HvoahYkr1!fnh
z5i&q6Ti15_^E$dlL1I+Q?_E)2;-){#g?7_@VVz?ox>rmSK}F`XW84ojfv%PA2Lq}o
zF~$%vc%~oAf<fu~lE3`6Fn9`igj;3>Tb4CJ*UuG-;*ccpWPdq9?7Pl_h7to*jvyAT
zsKD;0yU;@*Y}Be}?3?+PD~PSL@3xI3yM|01M=EWLbxL4B%1UVct}vaq9`F6sT0HgJ
z!x-*yp{m}({k2@ZPGpN1;PuM@Wk8z02t`sLo6<XQ+I_hCV=J+BV+~H-dl<?IA6$f_
zV^Xr%qlf@EASHdcwR({QY_W<kS!DZ_xuyYg8BEai?l`9WkQIviW##$BpzmCOK>Lmf
zhUEsv*mxb26t}ay+G2V{aVFOG%p1>Ar<i%qa%mrb>?BG`ji{-%z#R_r=O2Ie1W&X1
z@lW2veV&tkAFowsJ<9C%0EhmjmJ;rZi_0<8EyxjJri0UJR0PUVo*u@)n&o+NHLm|*
zF-~^wrA9r>G*Ouj_C3Ge#WNL_wN@Yyi6n~&2#kxhdK^0CgrTJZJ<%vS$J{Welv&+y
zXLh=k3-`^+Q~D~;$fceB39&L)GWi*W8n*{AJm|wX0V)%9;aaLp@{r8)7#*vbfLJiA
z;qXP_^2d^Soy5kN9AqM8Jrv4&oh|q!$us+#&6c$grh9B4R=xdSu7R>h3%k>WZ~Xjb
z{Qq~ZMT0MhdU}&?#1B91P+|$EIjLIAed6%=aMLGNVcRWBV0ZbZ+%U{1&AN&(ch2$+
zwY(_9M<A;s*1L3l4IcW%0rYjdVW}}A5R<r82y=-rUn~tl1S3giE2rFBd{HRTVR^L?
zwimiFbj*f>G-h88N_4*^jM8@v#gi3zl^OxeU}G(9A}QL=OL<kSBe0CqJ>oOksN#O+
zcgVbE=i_l9ZtqA&o8HKvMU9wv#3IT!cf}P`qR?~uE*ZFqv*K`&7)S{hR8C-&R&}$U
zwT+gsal-<XmYdMq<G}c+7j{R0=c_XDIlIqG?~Y=_%7tidEykmd9p|ld*ezgXqM>*c
zYgg96NPxC)e?J{-(tpa_3i1UqfEcTZku7=G=QiWHXHMbxDH|6nPiMR{;hmx?9V)Ae
zQKVO6U{4P!4SIw##b^q!Tg>84z&vCbvzezbD-+G#FA6f(jQz|IxtZxwKq2=+0k$i}
znXtAB)l19KMZgvGhH&ZS4e$<m(S6j$mAR@H7GtnXhuu2|P?X_2o?=ThR%0}F0^SJB
zL>F1x8ZQBAX{C_|`bvnswk#{do@cwEruSC06vIs@I@;yL%6bzIu5tw}T7X#T^5hsR
zwbgQsf^;=Qn7~?JrN`|bUV-O+^ePXeEoro%ou21yfH-p%z&tK)y4Pj`)OxMJ*)R`)
zDUxmjvl%!xBt@Nl%JMS3=!v}vc>@15aFNlzr5h_T7?;FbX_0kSixM$OVP3a&R*+4z
z1v2mI8qN6GuiuZwtz~cohX_dhIDBx7M|N4d7xS5wl<1++D2TnrQEV`v%utN(?g{L8
z>J*GR4Z@+Mwr4|Q5t^Hec_1v2^0Bd?T-wKb!3-EBu^OT!|MBD9e6nc;B@dd3DP)Ne
zb3EBO0t;OOmUB5o=QlFx=cS@7P*bRAA)R-dFZXte5zmqiHj`<}d5a5X6dM!}nVDIw
zCg<s_D-^8m%Fo_sR=2UHjjT~-$8)_f5-Y4WkyWsxmzbstrb;s{Y%yH^g*Ci%H5!g4
z*(L3OF;(V&WrYR<HV0}NN^$cY>xck^xL$|3REt%Y*Krjv)?civ-3F)2kFq8c>*s{<
z!6AI&155DPzu$zG1TkJ3YpZnvmT5$6zHTw}RvjOU%$i~)$=XT-K6>YB^grGKwV6P;
zOiwI0juko)ZCVjc#9;LVq>Opfu24ze%Q`W{Q#IG@e2qF_#4EuzsCaL&M&XG<KIc@f
zi&_U4hzo&?^Y~~&@!=+A{MiyFjv<Kz4)QtQ5DSf(Lx+ZN-+hO0%LkU>`fwwjf3hD(
zI*0M||9k;!mNXM!#(14NW3A~R78|&+lv0?}8{}C8*Im1i*9{#%I)RftHa;k=W<57y
zFSIRr>;f05X8oj?3xrj~*&RW?z%aH|WiG|j&z=O6InmMiwOrqd;%E%Jp6ftkbtQpE
zVya1FzH}*pgRPKP?l#?IQOXF8rJu`Ww`u(ZIfLQKdDv~*rw=*jd10n5!E{5%jQ!<w
zmJqU>PjZ&xTVA~cIa!^iC6k=FFK9*PMGD})*91(oP*1pH=p^<ji%Nte^tw^a7q+1h
z7p{I+8#;~;W9v=L*l^7v^mW?t)JsS4#gAQ!@@g|4`TYS*4EtcQs`2@|uSUY8#l(}R
zu$U~4$PpV}9dJRQ1z%u(R03}+S$@U^CbCo}`GU_Zx5_1@s3j{ayrUaYcN89`z9q6!
zTLFWNk(0&ci_v@OjG72|%hgFgFLN0vQiTzE0^T59>8?Iuhe=jEEh(jUoSwn|TA<}A
zD)jI}cy2-xe_NwS+#aI4&IYvl99KW)4lt+<`2C;vp|ZFb_doa%RFxN_^P7_hMg3U4
zwjN8DmE%i)_ZMiC)>OAu5zep+7PXOp%7~gG3qE<rC2%+c_`$!v47I3&*`(v|oegBu
z*#Inn!vsC%eLduC6ZTAkVeI?t0XwRS%el&!n@rrHV|Hx6Y8eIx+;GwVtOEsOT5%~(
zCayl&SvVGhBM`vy&CR%(nALsvzlMgQN-nm|+N`q_A~^>nr|us2847vzYBK>h6TI@d
z6p}s8@{87Fn)z9PDQAP|%+I76md^^h*-|;Vpo^UE%N3Vl)`Qy>!RhA*u((tYdx;u4
zvjG8j2(?WmaK$62U2MT^U$}&~?*8Uy9)V*xh)dcUaBS}|>^2|DN-exK6ANN#igbvL
z_>r)Ap{O=;|24)4G_7jB*tiEH7$<~0^wa&^MWHgNFyZi{p-hJrDkXYe?uSrgfR$Kp
zr7~IN#al2Ds20)xcG`)T#)*M$ib;{t?2*QgN-N_)pX8F<>YH@NWP{cJP1`%#N1HjQ
zV|2%x74bp3?{z&1C72O=KKv%$U<3^{R($+Zt5H*<LuZE<9j6EJ>h56z(M=d0b>dHd
zKFm#QL$Lz4+_D-aRs$Y*@BkWX%XvHKeXk7=@Mz}UDu)H9m^;E+V!(vW&r`qV3YaPA
z`^SAwKJqI~#Yo8W7qej<DAZ&ce*TM>qo>D#9mH0{zW7uo1Y1xVo2_`^xo+4TT%eE^
zI0c%Tti03islg#slvdz9SGVBOWo6j)@JS31L(`j5RZeu$iWD-=)e#rSFBC2m66l^w
zxO)~qE--s0L4Mz^Fk>+*oOO`x<IVRS$!3T$7Yw(qs6>pO^!h?D)tWJB3u43j7Gc5i
zDt!F<-(c<11=w<93p$UCW8dz6h;;4E77a)75FwkHtfrNzWk*w@<KNGFb<q}Z#j)o4
zg?OrC5=Yy|d0`6crcg%Tv(!wMN~a52V%mZ%!JtSgZw=AC^U}Rz47O1#V1)iR(Yjwk
z>@_YXSuM+*Einr?<%nb8v~qKePVs6~knv`QcfWtpM>~tt^G$h7pCn^6g9*hp)_|{C
zOmN^mFD3!8g>Wo_76O{q))JVD)Tpm3gI=q^ORt>dN&O%D$ZGuK_pZQYm(?L0ND#0N
zqK^RU)jj>#y_Z!}Y0ju08Oua47}Qw5A=#aGPB9sJ*&dk0x4ym|fB%*1_}^!AcT!-*
zIsqI#JjzqfnE#mRL+EsBELmQT&QoKUbOf-ZwG3BmYC&C{5ug9^Ce+jwL8mmpW_RH~
z?>mfvu!uK?Tu|1SvGILv=(bIA9R(IdW2PwU+%?mOn<=g>7Zh}n@@d5uQ2df|l&$jl
zSmhi)u2i6uIM=6}E<Mhx>5%nX$gA9y`F@rT#k@5!wGxg~c6bOx%Mv2gy&kMC(c{ol
zr_p<I41e?G%dzv=N#1tIRBV8kEDVEL!^?D8`k~RF#K5E%#?@8We8&p->0YHX0YU)+
zdjjH6gAqZE3IVc|)Wkwp88m1ktD`h5LCG^tq-2|RIVpjtOJx<5sRUk5TuQ%rK5c5u
zFl)o46JQG`&_5u4t5i)OE2elm%U}?d&?%VEy!O04F1ij1p}n9w|IjUnyf7f`g<}jh
zB*nW&68KDmBL0g2jWE}F@YgcI@PRQ0PIXRV{l*mpM#u1h53J^CJ107au%O<EW&+?p
z{jnXpUmAit+zB$uP+nAm3AYzog^FhuoQd)l138x~j7J|j&J)Pz%&}#%b)pI*!ycaI
zq!iEWwlnt3TnGR3gQs8+O)zP+oaJ(}offUKG7<muy?5b>$2xKR#5gLeb*QOr#IsMI
z!i%pSg+?@D>&9ki36#I{-Ty{OQ6o$y6`npkj9b6B70OXR9)ILGQ-7h!s^Dr|Qika+
zPMPj<%A}t*!)LVp&T%Oq*R3!^8&=L~6)xm&vY38d&iF1NzxJyzCEt?zPo8G3nV-vL
zxifWXW!`x?E!rBR{fK%Mh6X)|(W2*cMhM^%m^eNLeS?+8ks5>D4tShF=vn!9>fD%X
zYQ-hhxc-hc2p<|o*WMwhjmbW6!Jt5ZsYH7ujQ{-h^QbE;!tzQpS$|~yiy{w**@H1C
zwPNzR3&{$~egbAUvD;QcTfLa9zGK0!1d_!i>>OATT1+9Mvs-z%PB#3bncm1m#A9-T
zKfLh}f>I1IDS>zTc0mBGGjQbmgSV(A(?!Dza1{hHqM(LKVS*2uUpk<@rd}Djh4sOT
z&@?_5e=RFzv}la@=07~lT>_u`!sXb%Zv;zM)MKE}kNf|80$=(1HiT)gy2CD5byif@
zSa7;~0#|HqMt{EpJ;P2^m`!IC{7RPe&fg#@))(R4-|ykmx5{kge$@GH=`OuxMl0{w
zkTgdH^o~xV(OQ9<-@5{T_vPnMSyjY?HG5z0LshjI-y{Y-Fzmy@qet=mAKrndpX|nt
zoqk+*Z7a5Is>L6FeE`L>i0)x8JTw8vf)UheRai_Qk!FN~fGHvIZ1-)tEHoQ%vw~(q
zb`P>lz(v8dFd3OL<Z>P#uAJ$|%>d7QL9b~saCyp6Fn{0`vRw*Hwv)M8XyH@plyFV>
z(X^rzPdwCx=JmC>@v`Ok!*BPaRHsLAQ7V{93nUXr5{+ssvg*-3;zRFgJFN94M8XP0
z93i~y9fNL7D{gOV!RGZ<ICRe;1UzwgG!hpcN(v553(>?<!rn`X*3zNyn1><_vZ?p5
z>MtF=cys_>zcYS~M>$FsPmq8$3TG?`e<A`$%#SdQL-{=C3jEhaA8jGfcxw{!6#}cf
zW}+tsEH%{j=tN!9$!IjGJ#Y^DWg;tV8Q;Er5$uz0-1hNhG|*J|!WW){OoP3?*22qI
zYZqAHm<(~>m)5Mn_17;V<||?EzCQH#xS%`3o?-tJn?D@Fm0K3U;|XE!p_BONt(!UH
zee{ubeD!a)!Rc_}-d`SsGvXrvUWKKLYO&+lgShRsOX#%-cD>RIX(SANm>8KoOu!t0
zhM4RC6WO7$*h(}=D+-Y0{AIZ_!BLpORPzF;F#BtT%4_HH<reh83iGWFn}%>9XCW=*
zw`Ci%Oc0CXs!yyz+sE24&@q8u{>y&!oS1;MSkD7tEGvZd;aa`55nsOhYCQVcN6>Y6
z0u`;r2>4`pC&O5=tpSeaV%YW!V3|b=w<iqeM2L@R=FVb1TrtIB(`=UI#A+C#rgLP4
zbjfZKVA*FXi&W^hD{#+&_6@GY<i3y`d&|bCEMIt$ws&+MZSIzkqcniLLNqpp<Gzzu
zi-IgQsFZvqK9^g=e6&rCR$_5RZX`VP@DVbfO=u)@PQ`jC5qVs(x(d-Snc3wAj86KX
zl2!QWJ$tbG<vtV{3|SM2jT4sI!=myR+L$qFb$E4eFPX0{wAR<-+Ux4k*rdj{zOxlI
z4Hk6oA4fUOwsmFI1ipJ=A9iC|TPwc%?N`v(>BR@%wHoDm4TeU7(9*;%Dl@}qP{T^B
zsYauOiGH)PT`AWWo2PR_x-x9ahl~7Lrt++xFI>qb&*IBXU=E$yc~^(Y+1(hXa(3lx
zP1}rPXY`S|4wzcjZ|?8F04>rx9%#qD!~HOs_2{%s;C**2$4Bm3jaxpy4qy1{X1w~N
z-5i8Vnu_5gkd4N`Ti_^*wYYIpJ*4B~IQ-fuhWorpxkkofQ<OceU7HGaB+o&}NTU;{
zUt`B;F^KR7wfJ3o=iiRTN7EoH;D7P<zlzc3T9+nu*-h&$D;^t-1~HOg$@gcwf&#99
z7hn0}HVhB@@#Hf{&|F^*k2`|l5f3WLO{l6e@(4TAV$|r=ICa8?Krjw94d_53iXxpZ
z>8nlG*b5T$#PpnGZZZET^UJDIodEu)!j)3WmiGojxaO*bIDB{rwRKwj;ZGmIv(NS7
z+uwQ?^*Re8p&0jFvnnK3PV6TJUtVP7uEqfU&m!8a{Wj$3YB3gkVIY%`Gg_1j)74pG
zE~CsNGLu!!RiIUQKE^p)6<R))iyS|0{`Z_2+m+{Fz0-a01P-!Qw5XM@C`X6Gfe(H5
z5<GnGDYPFR!D~II@#*(nhP!`v6TbhIXAwN=#KtA1c;eoDsB5c6C?wMYo;3AY+oOOx
zh=?zY;_Bj5XN;7HPnyXpl8lvW*reF1KIJZ8CAalD0a|71oM@k{-<MWl!mkhXKk%Bf
z{e$`D-9<+G4qsGq=Y=mi`FMxF_q)|99jr8fB4>Gj7ywy~CNBQ++_NWe%X`*9qf&F<
zYcY*HCT(}{$S7EQFqUWf#V=ou#cic1F4ckwYP8gspxCNIm;i}&I$&KCzVp59Sih+T
z3m2DT!GdC*WiaXUPx&6x0G~N*<(z;T%U@*01gyxQkm?s(<XF!y7Ww!2BbfBNxOfhm
z+)Ox!Gi!Qy=x;TFXCx9sRQ6%()@J<v&woYWsNq4GJueSp)5d0OxV#EuUJsd|5jg!}
z=$L{NEf}oEohe6Yv})eLLCUEBi%K%rQGh%%lR(btC6?RHe6CjHc`L`{{46)0UP1n<
zGkJ=Q7Glu_GZXT$)LA~0$YSbroyan>RA`|q(%|Y<rMU9?h3IG>#k)VU3_Evz7TYhW
z!uQ|v7rgSTqllb#;HAGDN8QpITG*3JR!p(dSX_dd?v1gcD4Crg=g3uN{uYx?X_mFa
z*nCGsf}e@RE2kN*MlExV;wMhpkH6+T{=p24DU`u>k<q?`7_Cs?e<5W7qRH6yr$%kn
zhfhTV2*@HdXSnP#psFHpyk>hV9=h)sPru?mE`=iN9Bp17RxPZ?$e05yE#>&oM^@vD
zUwssH<;DDU2Gs0(8K~CP7vtoqF}(NY6)>9BJR!Y*c#_O-H{1kZTBQoUco1r+5JemY
zK?9v$4S#?|q9v4=jR;4gShBPNJ>7OVy&-zeFeBiWNU-3Rj;B}E)myNB!vehUTqpYa
zU0AfR91eScH?TCARlF0!nl&{rnso5^0$9GZ7QNk0xZNH)_8>N2u?VeAMflI3>`PWW
z(N~=~J_dzZi~o<z*Tc{B;LsbRWZtT?a%1Q6n~IqMzzlDuI4>WpkoR?9Zn?v`{Jbc@
zba94kH)}t_>;sqO8#`&?cIxPUtu04WZ7EFEI*bk4;0q}5t?yippMC66^t@q1-NItT
z=_b%{q=l5}R0v65>l{H=&Sq1-S5chy&ze*+CTPa=#Uw6$xHzTGmEdAAGRkON?CFUH
z?>)U|0WF<&OiPQ*CC~egXSDBhpq*=6v$+~$|E{pCJ7HBBmvlrzJjeD-G7-3GuTh}B
z(So+cr8r1n($nvRiFa7Yb}@uvQM`Nm5{!<x(K|4KupjUTBWNQ~o3#5e?(lI<1W$lW
zY^{cKm`E&+MT^RD%dN}tyZ<`K%U_*NAGY7P1mj~K`d^Rk(@qG)juWxu^?ZF_FP)qc
zE7z8ywyG4TyBz2|Jr2D(slXp0_RREk89;vUBWpMtK5}dX@7lf$&+h2J@#8d6Ym4D_
zg?Od`1L4!1cAhcO)L4SQJh7i&zB_N*glC@a#LIjC3jKXyJo$7#{NpYxUQ~*~K_4D^
zupRIJ_*(4UKZql5^k7+WDObrtT4Y8L<_uyLHtmI3!7^`=!dzgQ19-C)F%%M`K~|t^
zu3*?a7(wd0f&{QS`e#@zV(pzv@##C);@98UjhH3@b#)PT{QG{aV>$%7Wa<|0h#)c1
z^JL+JI1jyeg*XkaQ!WFMfh^#mdv+o!p+PI4ny9T>nba~+DP&a8_nsI9?rDGh(g-~J
zF`dygTeFEb1#B+@?OO}9^OXeUlAeN~E?Q$*byTa+)t`z+xJOJi&ry)>oFEeuxMW>5
z%F0bR(LRa(K__oto;jqv!7%Q)V?BC%?09BZ2g*$r9zl*1554i-O9;#+ar}ghKvq5F
zmSCS_Oq3~nm6jUO&}4<(?!)RebsT6bDow;%ofsQ;V?lihSJ8iUZ#RrO9kFOH)-0*x
znH8Pg6I@#%Js6qKmrXzuXRC1x+r402opkiW0#uA0tJO+=e&I+AM!kmDz6a$fDvT!h
zh$d~kw4N_AEPG&lJb;oi9e(g{@5Xok{#m$u;s3|pnSjZ0mUsSN)%Q6)J-4nI-G?R1
zk}S*k#s=SDW0DX^a7@@uI06e{Lx9a@NtWF;*+58^U4p}rhlB)-ZLp2OiSZ>cvSnG8
ztot5m?z^Y&qq=Ip_v`AJo}TJDdPdS%u1`;^d;0FGuYUD@|M$WJf3OM9{bCSz-?IUS
z_VwfYU){wMG^j$EGNYoGU_J9om>n4)m;mk!ja4v!t}u5f&&F=;=kaYKPCu8&q)G~J
zz}RuqGDMd)pm%Q{KJ=+gxZ(X*;*Ra#!A5p+&!_Sj{N)+6H3UHYzA2=OoUqy4^!pg<
zh!qyBL!5@JpMjJz!FFegSmqJ2DIieSX&!Mv&ue4z=k%zEZ|r~VzPLR4W0W%A1<Y<X
zaY0~fgZ9FKR?m{Hbv$Q9(Yx&G$o7+z^?1C%^IJ^AmOz$b5OTYmXm1aow>Qo$SU<Ba
z<ce)f)^D*WVa?hm9DHLGPFLx*v3wf$-hMgGoEgJ`V*_j%7M$_AQuV4*bt{6M%jrZy
z%Ba#o0e-<#s%M)mO9vrtiSm}>@eJ2!LqYEh>44W?Ac$s5t#ha-Oi_)QHM^N}*#bML
z9T-cOIvqp<er&&L5q7?E9RK*xdvW`nUHIx(_u;l%*Wr8Lc^!>@7k>HlNsJAr;q^LZ
zS)7`Zfx*&U5VT7p0=3I10<%+Q1sGegF!>x~3s&GDBh5aaV%tzq5D0pZ$>rhnl-j@0
zK6l9i*f|dk>x0-iP(btIFuGcO*tpsU7kk~eAMZnOEQNM9CxUH3WQ#=(KZ0yNhjJ2@
zv7RPOTd-3OFlIQAlakVC_mVEmRwA1jWF<8Uft0b9kOQ%#A79_Q_cMcqzOSNGMnr^m
zQLPICTN||JAGCsz1FQyQ%a^p**>J;E4OhIFVURk>mh1#Urv=NFx+GA=`)Jh5vwEnz
zLZu^$ek!&3rqYVhCLdnk--BpF2mxk=9y->CEtfCjkp>j4&=B%+*wXv*@`*B~yt)?D
zL@J*Ecn1mwiA@{ZxfXcz^cig4xC&QnU4*VB0sP>HNAT+Yqqz5mEtu#}Vwl>+xE-?~
zD3+~1JqbXVt^dHt!ZpxoYeg$)O9JMgt0hxZzJ^km1AZskmW3gET{zYg$F1*KkAn{%
zL~JsT5StTwy9W_vE0!-m`P+E*sZ)6Ag<hN)h~W=^YZYF9t{1;PI*Dr<JaAB9b7u*V
z<nSsKW`ECGo~Wt#*y?KrSgLDqFh|WRfgM4STeh<Lcr+j)mG$GhZyfpB>CCB5tCp-A
zs9DS12)6SATs!LEJo9>vkflo?D^2cvEq?IcfapXQRpwXJ7Re@eFhMaXrSYXN--Y*m
zU<<}lu~{&7Gm~NO;X}CPoon&g&%F~_If-z@%cTbjp?UB7E=TL40PlWFqrfcS=GFj~
zE{pJ@+Y4%=3)6kfNK>Y^?Ia~!y>$b#>PPXD$M)mU;c<50GmF|E<*lemQgKqd@>=x?
zps3b+jrs%1?E17b>l$dcD3>*A+G^EQP&7I_)T*JN7uir<`F}=xaRL@w?o*i7#^2qD
zS4NXKG@Qbt&z{EFbb(usBO@`~_2H|r<AdAq-T(7zD2E5o%pRLOHjWqn?hp>{AH!0%
zly|UIO3_*RjC7Xt_vslut7`=+qZ!oRYpT_&%s4_6-XURv=Rhl1=M#CC5=ni$kwG?-
z_v4=rocN9kS+YlbCXO*d$3F;MqEQK#l0|DI7nlL9sLsJ;*wylT+ZrzW$MIqTXC;}t
zPt97k1je;%T6kzxU;iXrj_FKiN<s)XxUu7!r8s?J9OIK|I4Q3@;KlJ1qe$g5xbN;Q
zIKmF9L#KPt9&SM_oy3jTtwKvn5RW|eIzp80vj7LpC9=5V@f`0!d;f>F;p~}l+;-PG
zeC?|{v7#%2=CBV>J$ew~ps%78yimKRn1&OpR`-HhmAe4#jtdaX^#S9ZAC!`%M@#9V
zQfekB>R7Q_??sUv@rewZ1TrrOFNB<k`5icPZW6gzp0~V@Gx#<}d}vo>?2irOJ->Y|
zuHD{>-}(K`_~GB|!Z-f%7udXf2`GJ>=8a3FrF<zgj;z?q@INDh(VR}HfwMmLUO`tW
zURM!HQ3nKCf-7|>r`TCZwPYLp)Ezf~A09gM<Qwrr?^fR`tg>6tv1qldS|ewfEgdW%
z&{}bP)dFn!wpuS7lZ~E^Pi_sZ|JzY1i*BlDFPMWZH3ys^fU@gQ$TOp0426O<H~a8`
z`>(*azquQO6G=1${5%}2l#l?7B**ZHKfD>;r^oT{&mTd9H>mcpQg{)Wg;YnLG~kJN
zns@niF-!K^>z3i<i7}3~4VSgzsizO&f%`Y%6Q5p>eY*?z^UprZi;+@7!|aBO`iTaj
zAQ+xGA?QgBf+=lP%haMmH(d5%2+7B@2(Ul=jed4gE$TbTiX{t~^zv*Xhi%t&!54Jn
zr_Z0nn9Iq(Q6Z6s&+nXi{dgjSt=BBajW@5v|Ne_-;6)1e+;bI1;&~KaKZ|H2P^x(#
z3Th)yYA-Z%`&AztO2rbE<}uZSr38`*S>{%1z)@;LL$bL~%?cx^Qh*3eIazJm7*Qen
zqeEw(IgmJTt9radRby8+0a`uC&I@d9>EQfJ2K7L;8n{q(rpAffz~Ajl9Q$08(}QJB
z)siu>wxRm4q_0vuY;{#GpO0BFu`K@kgTLTq2V26W^joUHRd#mK+@;8c>uy|uoFq*b
zP!R+yv}PTNOa|98cx>6$!Q1t`zGncv1EaWV$5KR_g6x1ki_0%>!KTd{uySn&R;+Af
zugT9WUs$o^uS_(U6~M1<AHB9QTB)zoQbT2$>+EHIwN$~iNVZ>M!%3d7aW-GX?uj@e
zS9HL?p%rIFCQGfq%Wc0^xcZ$gq?qMO-FJOKFPw~Ct2eeGy0ICKl}%WA?`1d;k3(W7
zU4dDq-hgw)@AWVMPxQsneRLR`FYjOwZoo^sdypGV!0#$0d<bHxjSkhB%}M1nS!Gr#
zZ)I`?0hZ?P0JEs`swLaZNV?d~3<CCGUMV|5l_@70X|qN3=m`4=vVJ^v<lKuYWa*Js
zOeeO98iq@~vcV-KA-vfwTD@ch=<HyzhD9q@+$Ix)R!(D4PseArgx3G{STTogHc1_V
zc^N^^iA2r@^7s>&Y1vqgGLU(Id7dXNj1H$DEa1~&wvflh4IMl#_vFb@E|ZXS($N;-
z?a~h%JA*4XFURlv-j#U%=ZEqAe|jAq4UJs)s~L_Zn2bWGvVb+k_*#h!Gw!dEXh8dj
znTprFdp({#Fo4|$`XCiD_@htXiY=G5;9tM^G%~|QC=8?|mAJS8tKeijfm?51&ucb3
z{oHY$DB`3rIgbm+j}P;zR<xbODy;C(F80M-Y|WlXWcjyRyflmx=f-gT^~><!mv6yC
zpL_;~b`PL+Sp%|pxx_@FhLfwpH1x3#%dz(#kz~FdTivA-MA;GM;PJ2mhc#5|bvmY2
zK_nm|UkKpIW9N46kH2xFdVF-K$B15&V6Af|a2}%(7NSLaDYdfEZ)Q5%iWhXw!sX|X
z7%GnE2EMWnqIYv>^_Qru@foRTDbBW*6DiN2-PRU@haITr&Q0*pu#%Q1!0B}0Z1*_A
zYUIH}9RZIQufN{UGnPUjHGHffB9+b|&>-TzyLX^(U>qw}xp88tmp$a*;b*0~vK4J=
zD(VDI_W)Dt&#FL`F}sIX`Ef<4QP!}kl;Mn4HRS_SP&E6Bkz8<aB7rR}0R$R--09RD
zisGTKy@+iaS`ZHU;cIdu$)5Yl(IIpMygZfo471n=iX{!Te=>t~zEq7&Wd8-(36(n2
zQVHgn70N^m$75_xIk9qi6W;s5%kh(cJ%GM*lL!cI^!Fw)$mYo9*Dk@(XcpsR86M6j
zRBW%xBcXCzIN6i>nKd3O%INYqdBJW;s3`BKI>Jcn<(7speLtNL!+r-+IUjy{toyk`
z$%A*0(akQ4RLGY78kNV5TycLb_6t=Yt+iZRc+0rAm_<7m$w1VxW~(n{%eJq<-TIL$
zLhHYgl8ZRaMX|ZTmULNie7Ko)F)$Qo7KNkc_Te2#srQo0!I!BN8%v`h?3>pnj^*SF
za@<gStkwBJ1;Hs!_`$E-iNE{WFR`ej30G`w$BwHb*z>DieEnMouqYI$C>$ebYqGN}
zT>Wy0)lM})KfypxrzP!EVaxiH<4JT~y9@{S^rFE2ZfXedbY#l5ic=j3#*s~zw{r>L
zZ1)7)H%`89{LES%jwSeewM9aZ%7v|K6qBJA?x{=$U;Ogj*!6rj{_UAVShKtZ6Ju%q
z7^O)s>5L+kNa2nfRv_YW<Hz6KgO;}NjLA2v%%Y^QlY@e^OT=lmPdgc8o7n9spjM^X
z&WNK`oneuH1IdgRj~_ev_{q$%d)doE?9#3t6IzAL^cqH75WUuRhRq*n^&|tcx~ymt
zv}M@RhB_5;wS07Ic*Fn8GPs?R3MiUR*HvbH^>RmC9v|y<a$r)ZR3@G0*B*9Ylr>A5
z_#`vXYh*#jWgFW0LB0QA-&9)dd<=;l)Qc8H_;;9yWjJuP_7{C`DmX(KUS%Cx6dV{z
zOkl;LC^lTS7_YwEgK-827kmElu11XXW#Fe$Pojo?qtaC?Nns`+g;^jLXYG9Rz^$G<
z1e$a_kJgS5mfX~dmv?m|F_z<vCTU4u`FwH&QsEuiH<U?NtkUDPQgAWjL{f^oE;ZvU
z;y2#E1*eXVV$a@l@KT!>pOd#LqWzpm6fnXp<wYS6wlsM`O}VJGd#yvqMVd3))&taE
zj_u24cS))s#owtJGduIP)1e^Zb73Oo#?MZj`swM+vEQHtj0)LY6=d}y;jB8x=3E!S
zc7|OT$)J{yZnfc9C1}eIvbBlA$lvdt-2b}{W)-Y;Q(hKT{Sr)m&6%qpnh;c+nF?o5
zB_>D`x>is%FF#KJpfR4Bz^DJ@CVcMCZh`D#2YoI(RjGfzJqFoA0qZujqP0DQoTOc>
zxlkw~67^#3`X(MlQHIt?VhkUA-*$ZL6W8IzohQ)R7UYX@DnfJjJsZ)~8es1)O&tic
zV_dbXbWJ(86inBht%|eNs@^4QIL<U{)Ry00DD_1nH`C>}EJxo!0*8(abLS<G2&tlm
z#7>M}zY8Af=v$oa#8YPcs}d{Oo20UNbSw$;mhB?5g1`OUU3hJG51N?8Pf-Y@&C~l*
z4=<6;lK@-s_}Di5#5e9m)1m<4lX?DT9<@aSy>F3x2<$a|6KS|NHshZ6Z2+4vTsx-D
z2%_GaPb_T%r-K|{F7(D6c;wijZ!*aKCVRA*U6x?Fk%C$0m!6DgW_4;i!!D9VTaN=w
zPc{&%CX7SFqIIYjweltoyB)zhwuCo5;uSsa6ZtGs)LGQ@Nmr>kmr~g*uHLbnTNSVE
z?cql?Sv$+R8gSk9t1vN<#A~ni;N;mD`#dKi=RrE4Qix=&IcwCvrRro<){(N`PM#R&
z5F*`Cc1Za6$8W&?*ZYu4<@gEX@hA6TNn114uW!REFP-Bx6-c`@tZ`8D{+UaCGjX<N
ztX#fV=ywG@ShA%J;nj`!r+?UsECVk&uV!1LCMY3H*YV{iRi`-Jo?LAyPifI2uhX03
zx_sHPBzb}gaF=ylk~3lqn9CzR+_-fS&YT!SAuX|OE?_V(p^3dV!d4#{N9hF89nYb&
z(StU25*Ur;c((+H>hvmqMrAz%hgzYFJsm;zU(dJ$Pj?^u+fk|aPuRzIq7)}vZOK+z
zv}Pm(Bg=MPtXf+-n19d;7Ni3`T~?@qs;KdIC2Z+(+#!0e+!WgQy{Id+=u|#~m@M#m
zopU)Ai)_}9#Z%aJ#UhN4rZF&_;00zVR+Uu2?VCCgY4qaxohO+k<AQ@7U?e-tr^9Tj
zr<G89f8|x_AXFh81Q|4P%nI+Hm_(C5h_Unp?z?k4uDQMw=gv;xpT4sPZkLN6^nwOh
zHP4cQiDUyE-~#$-wwU($AeYKx<IP>@W!KNWa0C%|fLW_fl+R;AO$k7If;t5UM&k+2
zhxVp0-(K_}72~;TTc=uOts4zKs@FTcxa75ARV0<aYnrVDR(CdHC9`U~504_sEZZPE
z0d!~b=w>Iz4So-fjmGc?AGwBq&Qt&R8kR;v$Vf$I9XqC+T$Kf592JrQ4@>h>LI!)E
z;XHQsANoRE9{zjwvZd_eRW;e724sshWCWuIzvnHH!3OPx1FczYR!g5X0&N+#Bqf|=
z4=r66+W4&{p61Oxg$#y@m~;3SWsfy7m|nK24ZnKv47Y^JM|C=#=MC;Y{fQfRLc_1w
zftr}e@va3Ia$j<twop_vkpwg~`_SGV#GXBU%t|YL7XmPW%1u?mlu`j2Q7B<ktcIl_
za0T7!TGd)_b%{mIvoKFWVAdu39b~0<Y-&Z$E8<xS$@2Ntri8Pno~~9UOt&K%OpfEW
z>o3DCx2?g;yH4ZZpFYNx<bLi@3x}B{OU2bwSssg9E_hy4b&|@)lQbqXS?qXQCsr`f
zp4u~jB3s(07>$Rh9*11|EiOUEvbHc4?}EVQgv7o-NnE_aqA=5nbyU=urP~1?)%5UT
ze}6*WIkfM?5)zNIk6okAchZogDySNP)(Ey%lNoH#UO>>!#R+C5(!il18)(6n&h)(m
z-Oj+8udMPdxoxzVMUN!&@UMEi>k^=7*}iIZ6qB(uvj!)50T!qSFnOUnmId*)tGjq4
z!lRGvhmsfJb~-Lt91Pb-WqGO_FF9@KLQw~FA5|$M=TRzMK&~k9a*88EDGUyli^&Mn
zjx3=zSW%~iTgI(X)|beB2$hu_XC|#9;=y=d0;yDi|CZVFv~&{W&L%aBue7XpU?4sL
zKRmpnMxMcsLiRTAXhp#7=c|;RzdQ*kC-ZDUI@!o<AM%1lB)gEbAS*LM(5k!oI@o)}
z(>X-g^L;+H!l9D`+s1jSo)&bYneF=)M$8HJ-CNoAEme&xIaeJO5d~$yI#kJk^w=OH
zbH3oiYkkALdt-+_BO~)`_K~YqxRwE14`{VuTW^Z4Y1rDJonO!j7GY~8%Al4dTaG}e
zge|%JC)g#{>|OewHwIVyAw?vdE-=7Qw+2C}V|$biXkOJm>_IY-<KAgrkVbXN#1mOw
z!*&N-f_8Q_;*lTkgCIN55b~UthK{7!QV@Mkk<b(hVkj|!kNwA6(AgQq=l|?cL<5a#
zim<?!z0~-RGU+JVfNDO_a+Y*Qa-NCe^b%jJ?3Pf6g*!_c5Ng%2on7>sVt+>yDXhPG
z8G=oIJo4xZ%%*GO&agDHYFqZA+HSpsKYqfa80cJSe~<y1$z}1t13Pf!&@f(pwVQ#<
z%eTXdt|$&17(hbFqSY5>P%TC3mK{>ud8H>yRNN^4omb0P3T)%bjGB=q4=!ICfh#59
z%!vs!G3b)?z@1t`byR^cm54y^L8X!d?Dxb|ZoJfYcK6BjVbWuV*k!pY6;y(@@*-7f
zvs#cXUM%^*jykxoQ3!zc95(W38db=vzQ3q?WS5O*d%p7O<bnT6_S|~67h$%h%PG^*
z+*YhbmrLXaaw4AR7Ec>nmNz!~kVxhDL<%#YhJ8Nl-g}0ZWxVg6O<21jI@SA26z9)r
zOYcPu8A%4X_UaWFPbRUdvjfR^8vpVydq5?3_!5*I!8vBN<?{vn&iz}^)zyTN(F~-5
z!cG<i4kt$iWw>>&`s9nKRgr5t?Y8><QdEIbqk`A$ieBZ;vNKb31$cZO96vaOyWe>Q
z7A^K-`;O)K=!b7WER*0*8cQd6(e+d=jd$L*4p%WSkESO0$!E&?B#~E8)Cz8;cHsLD
z46^rjp)C~Vv8m<n$_v2IrHHAMVy%i|iZZjmnVWqkIqisaE$k$G!*VwD`cjAurV#eK
z*nBHNR;)5FrV>Dea(^#&ak$YlF5;Q9$DUx2{iF)lwV0V`pe1>0^#Kzs7)4s|dr6N=
zwK=0u2Vjk?XF&(NG%+cQY+b4_{>1Ls-v2OGm^{12?L&v7L}II5?Mtz<rR6wXXEP;B
zkb09*^F*>5$*Dx`zjwWK4o8oSpdk=IbBiBWZC}FslaVDU6=Z(U&!uh;^&6vu|Lfnp
z2OBmtW5tRVyyNZb&^HjrvBM*{`I>e7dBce~GEx@TUbh^BgK3_GkxmwnX3JR$VI!Gi
zmaS0%!eRv+XO}osG)w)-$~1JVTZk)_^$VtMm)nz<y!t-2c22~YrOr+UAN`}Nv2kNN
z4j&t2D~243lEAx6{Fl$(f|gbv`)x9Q@$6AvM|R`tWemJIzFiyqe*E8ueuZ7X?nWfw
zFX5D&O93a}XXVhb(r5BK0>~ABRce%P)LL_A7@adN1-HLz9kwox;NZ@47-c8poK)I=
zg2oz7sJu-b6Fh8ADP9~JO5>THy$|;1PyYpbG=fq}t)z1d85uEx3B$*%fpkd?C*C?k
z(1Ed0wLCLcucFEc>ts25@?iY+k0k<YKD)}d_{JbFwJ0%jL4>;w6_uJiQtR?S(1p&f
z2!oajqa!J<ky57xa*&-okwLa7p_3halq7KTHLH+f_YV#wxwDL<2(mcM0++0{7y~Rh
zYF2bcv3y08FQIquIfrON0H@E4;?Ut?EL{@iwR9bB0r%du3BiyHXU<IEm%lp0-^1&5
zO@T!J%u=%Wie*VbnNCcY29i=C5zI`N71Xnnf|-t_avJW`{pH(g`|gH-56|s7jOEMP
zao|uIo3^x|x!sGOJ#iR$w&cHT)e?O4<2%?1rU`%i$Nz@Dkr*~)JK$$la5>V0!n9g~
z;i=oxlVm!}R8}f=S7DauNEu+F>a>z8WRR(o5lYDhBq42E)q=)M0k0n)g(vFc=BrY}
zG^k9mr4zG{t&}oZHx7@C4j-62_&<xtzRaGnQvDi*It>)P+RsKQwnmR#8t}OUHCn6j
zvu5;JEk{`Ob>)SeWRqloL_F=ku|BZ!BQC*-vxOWc*^IYR+qP1-C99S)v2J<iDm?L%
zgB+aXEvKji?!4itx<$ltDcpI>dW;Mwv3ylCk6nHK*^`Lp69_qiJS41aE!P^Ed>)%F
z>);t+qp=i+Mm}A{vK39(^V&Jyg_nD?*?UZ8atQjIc-P$<IrN`+>L5a1FR$I8%;B^s
zR+lw2q2U5GA`ogg&nT7oitWqr(LcQwzkK>Qj-Kts=f7|#2Kp2DZ(sU3{LUc4Y>9sL
z+m_<7A05Woo*1%h+fecL>efIrzrLUf1^TNN(ynR$<+6EreQthIEgzGmOf?4v5-~Pk
zL@bUpV5wW=OQ#gYBU6^0FkK6RJGy`w&abjY>vL1>T6Tg?DA+%8=DFV7see#?3vH@o
zP^i#kwVYtJblO_Zuv!}Jd5=7>ondbs(3Zo$Xi^P2ME|x8p>>~XcSSk|*wVVcSX$<~
z>)2KV)?m<$_C-M)KRUu2Gp3SxUZ0?>%aRv-G@j(Q7qx`&_IIqp8~X-$$A?EB-p{Pj
zalUp<FetJ`CmOwB#IspARX=@>9YYisaO=%$xdZIiuXZEk_VVry6h;;b`w*MVmfEH;
zP<VI)M_??G=0J#q{p|P2^JAk_IL&H?bX5UYQ&`k+p7HI;mg1dDBfO>iPhUBT?|t{Z
z?02T{KOTGyt)VE!ClfewW|*@m;%VT8T<S>>;hi^9d3an7-hm>==0Gepj^<Dknj3xi
z;O}q4_rJFnXV1mpr&WOJ_)26__}GW9fh%3WGmpN(YbO-Sx<h%}s7@}i8nE1or6dHl
z^@<+!uoLDR<43<cSsZzUy)1}Q-GZzJU~7T460SCAZP3=05vCQ^RSj6Puys{jyH!ta
z(_-K9_pS6Vy_HOd9%kJpWDzc*^kVa^&1D{rL`e%&-Rm8<uENp7Bk1X!<jobU2Z1n~
zFQC0Ggty($g)D>e4L7gk+Ul=%p2GGWo%pw(9mTp0?MN_qQt|HgjxgTX+mF)&qg>G>
z4VF?upZdkCxM9a8baqAY@FV-s81(ZDv5E0459bojr^+TwM<~orRKN^L!Ki(C*~)b>
zGEsTQA$Ecg7^zyjLio<NZbv8-#7#GShu5GDIlMf@*6ME~*@Uv=5=C|*3kD%Gps!sS
z#ZWAZLAKHevz5S~eEvpIlJeKT`3jo5nsM^z5Jo35@CQ9~U?RZ2lV2|2J$G(GhCzDg
z3nvf=_+}gcGvi~08L;)Z$cl9$lNE7vtnb*V)T!^Y*>F&G-U?NgY(WFC)sU^WYOO>a
zm<{i`BtiRD(rBwg6O|hG)p~8M`)WO=R7|+V?2_)woOx)xFmY@{aP^1QxkJIeLI#7}
zIYJp_<|YR%GiiA~$qrZ_vo2qJzMFrP7G!BqI1)WJF_ys(ezc42a6evqwI6~@!GjOp
z$=@R<6>;UZ#XO2&_wE5KU*3pQCx+o2aU$sT;K<=228blC+_V;BqiGyIG{QresFOr%
zE9Knhc$NS23R=~Xh00pB%531GhK@T0TBY=69=1g98Jk47DF}ay4?`mpxb3nvh>c75
z;lCV2XL~bFpBshO?Xu*+RMgG~lj$s0tZKr>P3?H$r$@QdjZS(Lx4YQmMu*pdb&DJD
z{fFPc@qri)4~(O&r4j2^HzVGcK-A|!fbDCy=*Qy^AK(SZn_Ggs=+BfjTfT^uKThBs
z5h&A4WLE4Tn<qzNr=A|p_dKk^bZG@(tHD-1e^KLc)Of5GD9s*AwnqCVvuJ_(lNGA1
zS+iDc<!zUSb?a6iA7SQG=Q96_dzO1UcI4US?<MP&Jwy?*4vX6^ohx9?szxp;oH#Xx
zkl!<<{Y9JnxbB8dJjD)lH-qh>wlFqqYQv!egE)9(2s^efVOH@Z66`(Ju881$@866s
z{OQwdEtzA><S>^6as>(DkQ>{t?nEzJ*7o*HBAG1kR^c*_i<L?d1;Pb(8dtR#*DIko
ztGg|w+ZOUzzhx1p&2V2Fcip!h#|{p1=iQH<*aIKJXb5{v%LJsQ#u7<JFt*);lx~~D
zwsq~;wz&h(JboB?szZ>K(CT&ZFu6oV!v0tfsDwZy7=VYZRF<>`(at_|tT)aR846|R
zp2kEMHEI^n-)^S>r{IK?cj9zxp!an0^pCSjaxY4?3TPhYs;t*ai?(QB)z-3T%~tZ#
zD+Yc^$I-r(Gs9{Dw_f?68nlio388#VjxrKZvq4wWO=|)x?u|M_p+Si)DcQkB)~(Az
zy#(@nyW9ez5g!HylU!Qxd0af9fvP9o|Do-8?2&`;`kZVj>4NA{@UFWy;2Z<yKmTAC
z0zv~nr~?5PLSZ+vSW`2=L~vNTG=$&(gSX*t{%R*C*wU8LM;Fp$E`L|CGGk28mJR51
zHX2JHj!As+3-{spv0)xqcFi>_@cGaE49P+YEy2iCL2a`#!C-s@_ujP)TemI3|N6^+
z$GVngNSOj+$qcjl!+f6>7_{SsB7;0*OW1{#8`^MmcP~Qh^-;FZC>1!%9`pEJYLbNZ
zq@PNot<YkrW;|u$krg|ZOylHa_wz%Ao}a5u*(MdF1xzO*Xh{Zhl@0XLaLpE%sbwkK
zpj{xKovTAkm;-3F9AdRV>#DGB$JpC1UgBSVTbH-vDuG!deGIr%oJQfmRZMLVTBhD~
z!%A*N?R~wUr@=1n2;<|QyoOn?!#H+q6uVwIiGbUORK5T|vs7D|^)xY&<;(wa-2#eO
zAmC=Qc^=U~X{KDrV~<T{vxo-#Q@zc!cgMw^Naeur*;cNgR>Y!I*$@Bj)fk)1;n62|
zBjOHY)8@t4^=dbKE_W$)Rkn6akOm%Y_u_&3--iCfLwNS*M-lY<)X*}8$K7Vx7aPgv
z(d2f)!K1Dn*tEI@Jx51*L7O6!8Hp{k;|nVy3o4ymVkvCP$)*)E(s3?6*wdXl{d7)A
zzo9z2T&lyXPzBe5juXrXvPSysTx!!oM}Dwt9b6#L)+-+v^$4ps`asK?t#zq}ZP~h|
zRtZ^;BXq^e!17x=+)az(asdNu$(~e7ag|0wI!{WFi}><a@4`<WJ%Fd5KZ4HIC~muR
zJ)U~vFec+UUg4{}tqH0GlX8sf3}>56t+0JO!;Ferm$RSJ=_2=*lhw4~1vR0nRXLyN
zBD3-nxcQEiSiHCyd-j~e!2|v9d%Q@dbL`s9^=z|M(8~23=p;ucpQ|=5#o}fke)jAk
zbTv2g;I2H|h7QtMo4q*P8)J}l@|v>r;s6ztVcRzl_Groj<=e^(r<X8Qr$A&UVcrFU
z_K)PkNNO_Qojmj0xHP;=1#76nf-TgrU<)u8Z7>(m>Or=w%gFO38`z*dzo4CO`9QC@
zjM?Y|J-yadW!=(!adrtbc@|y2(!cb&pu_JPk@6TSGE0*|f>&YEaTHOSE;aItPiB!|
zV5Pz{u^iQ`4Wdz_W-agJkdb)#y{53AzX?qRO11sK`?uoMi4nZaU=;S1WCC8CoLSlg
z7v2?uUHb#pt-p%}-0@@_?|t`HeC$)#;yv&B7Df|Ew1=bo1XZ7NPDCt~!lsSwh>zrv
zA5SyOpINreA-<nRDVvU2nw_hgkd-8ior@#jbRt!hc{G8ST`Hoqrr@n;OzP^8Eo!3Z
zq_#$i2T8Wl=u7n<?#Xn&AVca^0gDPPwx9!ABgh(Av-N1R=T$baK|6n-olmP)t7M|X
zqGQa7nZ;(bqysI`Rs+|gPQo+<=i<fQB|AEOi?_N&H--yYjIyJWfa_BGJ!x53R2P9f
z^BXT~!<r4v*!3&69A-=5zWzzLoipv?9J6XW+C%7C9>Jd7eeCt6qSK110hWtZ6Q9$W
z9KQaI`|$Ipj<V(UKCEOGq0jF|Pfwf|xp^~;bUup>YumAAT`PY0@Lt}9HWcvGb)uk@
zli}nL?zm+$ZhZSH{PkZwi$=CM5qMd`QkrZ`k#OzxU5NE0aO%(qnxlSR?8Tw(EV-gP
zhEVZeb>FXP9kvurKvIEQaiLgH(4QLU>B*dXDJ!Q=sqf%b0h_Oq2+V?33$9Wfx@^7e
zZ04nJm|axn{0^-!6KLG0X#A~r(V8%_!9=T`l*KA1gQRg^UOiYEp-8d5O!rS;o!s|>
z{_IdstJ8(GZVy@<B`<WI*O#iET;N$_0S3U4krZCub&hw~rG$n;akkY)ZE9Ltg1F|o
z<x^0FYCRPSCBTw?OUq(PH~rQ_yYa^U0ff9hwT|nXYjWhJB5$qJxh#S;tDBK2&P?(!
zI~)Q*wg)?|T!Fv%(j9p9<+DgqqfAE$p456KnaSgiKXn6^Gz4(`;4q?%eqL9BHnF7E
zSeVs@r?O^4#lGNHIn}#xf){#sN^JioCMMsQc;mSfsUwdt$euwd`M`_W5d~)T)_Sbd
zdSYXZ0DH-fOT7!OR%>yfcF!Xtz1CsUL00V~bLr@|wd4dBw{F?-<#$F_FZC_j(&27d
zOyOX|#T;U4{H;@%dA6iYNugfkfZ^hoObHH@mtUN5rWbja1PR%kgiy$*>t(0sQehdN
z%gK`^ve^Rf;2Q|I7q)azF$xT{bmH*_1yx;nIMmx4XE0(&S;i7lh+$^3CtJu?S%$_i
zGiWT0X~v!?+<V6`xpz>FohZ@RX2v%5qCukUVl1gdmWY(4wEm|1JikBg`RntX^PKm5
z&hnn~{p0g}UyIH77b6OiZw!CE6Z31TQ%)MVt#)k7!nhSVd}S%TG;`RyP5yA)9GG>X
zRaokec&(u;H%oPA(kMQKv;|Gi+h55=mWG{TwnI9|i4pd@mqll9%bkS`9X&WMnET!u
zYEIuc_j%(GOhUy0@&~U50KdTKQ99W!UJLfe@d_Ge#N@X^2WQ4Qse+*}Hh3gVEm*Dr
z&k!!%_DM-hLv#$6{s}xe@coF_^RE{>>~ovjN(Q5ml4msMz_N6~NoR@bk}hO^!L7yp
zVvGF@vwc3u9jIU4<M57n-LOX_p`YKk+|=pXiP^5M0IWU>Gu`E;@k1zc)AU>|qu1ko
z2YL9P_&-T1n6C7xy;-q`Q5A=Dm2L+Mv=;6!Jo|QhLwbH(ECj!H$RD*RXC(-!;<{5<
zcU^=|ylDPsHt61|m+?65Q(OUNT7Vf*lc_E>Uiwt&<Rgt8CaN2ixK}M6l`eM?);Ck!
z-dAi)n!reYmUcFMQl);da0D*l2PCprgw-9<3@R2FR?+#gK89W%8k%Z8bJh~;$gr3n
zs2`|sH7pmK%hA$M*`QJ$%P7yP%71>C8-LxGmeeraF{Pkg4_{qFmTFh@Q$P#<Xl(qN
zi{Xn1K29xs8&$r6GXgKaSQ|1osa?-<T&_o1{CMkMsFKgEC#VmP7o2>9L^DcW=Z@OJ
z4hsQdqXcad1u>CocMiGT#HYAPEQz{3qm5sPoS%q_o}lSyYaLb4)NnF>TODT(8J96M
z4<_+|>wALhKK`U8|3F0+py71KWAXAlR05k$#e$kJ8I)p-K_XeVEvhnh^kV1+0W{4C
z>`{I)one)f;gzZ!?0_}7Gc>>Z!fQ+6d9L5;6G8$&as&9~A-pfQI0{uI_ol0CaDA#d
zRv<~H^h@c@*#Ru;*F@4Vj-cIhx}#8{uMP=_ebu2_#83YCdFS%VhoQNkUk6Gy4!roH
z+K24Kj@*r&aDg{=H4|d5*^5$2Kyd0zYOlxX>BP*Wy~M!pX^5H6NAcH5XXO5p*XO8H
z&?&j-b3EF0Qdwr#wIr703`mGCo9Pm0Ks{K%&=00%94Z8}e1fUebE3JgKcq#+Tz%oy
z+;%ke<^IC~J%D30=`kAjickB9-WaCa{X}&~6-d2166%kb-kCosA$jcFAu7!OW!NO8
z@Zk={<Un*_Kd)zs^FaPgOv$^|kon%|*v|?=A(do_T%{<*kk$ajn_hqXIT?u;Oeur@
zX#-341`BS_+!`kG6FWJ3rb_;O)b^+$a#7i1Z|X}#SVg?XDQ9<K{VRWgl)f@^b_!~0
zeb!uTZy_FNd0R><q|ZzYFoSSOyWc7NNXTp;G}@Z<q~2I)<}Aod_j`X872E%eEeyws
zd^5vXvUSa-G~Y|K8AQ?1Eh2DT#4m$_<{LW8iYLk1gC?itIxv7QT+!xvt(z*`ryK4e
zK9h+FuJhTQ86nf}WoC0e{gR(AZgnVF3o=V`;`W*pBsKp$QtoH^c2QEYUsQMEdb$h#
zDi3x3G%jX<jmVaDw|rOSLFhLM(00u0>bKM4&<ykXZthAh0o}Cjn?4nSI4@Vcy)sA4
zx{83v%aZy;>cz^v+)w9b>uwmHb*d1qntq(zc7!jt<<AWol9)d#iVqUzxEdHj9>hga
z<k0-Ye+V-LVMkKtgGT1d=k=^nMcO`zTVm+>k-=NpOgN^<6HyG8SjZPXdPgl>!^vIb
zEj>0)goU1<-AmNi-B`PLYNV5G0f1Zfs^*Q_)s0Pi9+O-5d9-4k)IB(KLt5O!z&z*h
zy2>-jyMs^jZRBXx;?@O`A@AhYc$@%DmA-<fUkqq)JxT~{YDlr(gfM)H!0y|Jx}V%i
zXvTo6?_}Xj7?T$T=00^we=?(l4sPTyLN``2$c8INCS6!gLx!!wzV<Lg$(zD^o5yLT
z*(%ajzglDGvc1|q&VqXDqR@xj78tUxl0<>@pbwL;4lLaZ3g2-rOSvEBcIrjT!O=lY
zN`QX)RsRH>(Wx<W_rE1;gP)A&o+NrR@naWBC!2_8gz;+F8l>Lj{^rZq|2_6It;8mW
zHg^8keRz_Ff+s-c-eIM(>}x1VA9qV{Cp|)1%k3Pa2e-i|9vod)9ql*Y_VA^eVx@x>
zqf=LnYI5WWJ%vu?^g!Kd^H+Z=Hu<#f`}TR~UaRrn?KQiB>uo5Dt?kH`30F|KeM{8Q
zN-bE8bsICaGn>|4>uKj76~)ryohmrIHr(HO&{H}BsW%NpkbHwuZ@?8f*z5gDQHkhs
zuXbv{k_vw@k1G=fyPCiRQfIU3Iu9Cczv8HqR~P3y;`Re}cwDu7B@|@d?cyFA=$NTH
zwgmnoAknfQV8q3sDnkZVV-{-H=l~B_b+UI+o|6P{rjLGlzjxaN+SRrLySn;RefH8W
zN)T2~_n2{z?S3B&CgpWboLlEEDo2e4g_P)-9LSU|g+R_kxF84q2`ECaFSZt>t5q;M
z3)mfu#T5+VR-;Y4zYS9qYsm!b#blx1S)yRDJeYR1=5bRA>$Q>EghrNc-Td6<-;@WC
z`LK}GHYGEqBFRCklwk-bH$xr94^RjZZ%)v>^87$V<@Viv$fiU^^s$@CS*PPquefAt
zqHgw>+2=!;o;a{B2O}bC0bmT`Z_zU(s%4TEs8hJIypmcLl4_*Z-GV{E(kGn9$?k*R
zx}V5k!dfL3SB4mPXv@FEsiJJpDZtWv=%9w_zS=uzJn$h#Ajb2lgoA4n(KJ`eL`pa~
zaB6ylHz&c@TAsh<`@l{r9${BtbD~=lNcAmy81`KO^2?en`4d0keQrlo8`$*LDEe}(
z*_=#Km5lx{ix*_p4dvPC_XwDuEX?J|==e}+p(J31{YtE{-uYzgSe^Hdk~S|YVnSDj
zfUcI8_`S3H3ClW~0!v+7R`jG?anUB?_|+mX3s+i^QvcApS;%$tkl4v?_Cc=}$lJ{m
zBFc%yN$AL+k4tj-iC*}Ti<^vR0p}gdF-A6d?f1Y+&cQxeQKG=J+Xv<ra;o|m0<SVr
zkYcsqtxFJn@bP0$7N}pGs`3gDnu3)9r=FRCD}n%bF4Kj!R}bb@9>ONaKto_D^0*Gb
z<TX*ghonl)#NkLmZvanvF0G15a>h8$x{H%e-;Cq$A|fNkUfVQxAO2_#aL2Ekh^pMV
z<+u%;Ety=FeW_fVVS9;d5GBDCiGfv`l_4XAPm4reNvq_2D)A!|3(nJuyB=l1dR^kG
z)^+|qFAvbQ@kD9JE;=VB8s}$jRkmamI)TrS1|Lr!&qr#KpIyUc3E*NX!%b|t;>c7p
zL}Nw-&NzFQf~hkh$nPhx1t$B(<cwLqy6+z1p%)y}AEm273zEaGwAEH@CDe6^B7rq2
zKcI(`!UIR%gm2RBAVw5JKBcOj5~_Kv8E2;hsVJ7UMFDEM{GDAyLE70O(B=qwcD`f0
zrFpd3lj`yOl7#hSZtl;ZN;6>^po~Bs(~`@wNFu^Bb3xOxLPV5nuSZWv2Aa7*^UzQ%
z_VE(%L^0_n9uYnsz5N|K9B0gIEnvGKTFrw%5uR`$E_4JA9Vtj;(=UR?<)u+>(#c?-
zK|*_+fgStN&ODj<=0edX5^k|BC*s9j+h-JKpF2DVw{ldQmw73eJGW^nQjV1^OuNQt
zzEApEzK>yb$w0Q-mO)$E5BV&1KHd10O;d6ty3B4Nz%PU0gMtLr_lyVm4V821vxa1!
zf20%!_WwmC7r5JqI0pwqJi*0im2s$Dx?eaC!*0%Dp+R7<im$u~|7^<h{f90?JR`QV
z(n7huH6XZfOJB5sq^BS_#k%OTW|{6Pko{8+Nv^b*UF{L-d=rxeSJhH>ZNu|whM$rL
zaz4Pd?8>zf48hLMCF+cs$ARqCz{>Go_xgV3Di%&lqBF8ekO&$YI27$pk9z;XmVV)W
zA*=7&Zhh2CUV?~Iq37#%Fl)dxYXEb{US`v%l%sP@8ROu}#$=E~q^spUkJZ|ITM`I`
zor!>RjX}Pp2z}0?(%QsdYd^3bN<M!RSlB*S_hgs(>Ud)gC#q*lcD&j}VkLH{B1S^7
z)9XV=$<yUkOTQQoor>cy-q{nviac?yHb|rvq}bp(b($I5<Pq3d)l7jU*;Za<Nh>UV
z3(8By=#_pHSL)x3^AFhxxNpC9MyJu$qlZTF-b{y>S?QN<BVbYw+`pB?!F$Z^kamS}
zO<>mO>x!|9YxI3^ogn$uS{u^-7Ru1uO5w0NalYu;5l%>KPEgAi%tJrzT+wINOn!q?
zhC*SECB+K~4dT<7Nr%Y04oZv=Kntzs+m6LAJPT=PK%Q0-#s}a+xiiJS5ny<94tt`Q
z?E~*u%3&+6H510Fj6euO+{6Quz)l`!40P<RvN{Z*e`&g)F+whh(UScF|K^fNRsGY~
zfXsTb=RaH^-`lss-spJpAjH}7;87yFy<QCD&RUpR{R0I>saF(GSzx4yjA*lg<D63G
z<cig_@GZIV>IEHaayxyIxE;R(MR8v458)GP*Uq4L2$hJZoqkO84f2kyM_-x@6prA0
zxFk|d?kGJAYM>3h#zSj~WQEQ?!aJB(`%OCIQW>7>lL5>!;}V|`8wL5FIVA$}dFwxT
z&%<`0KKx*7T6xKL(b^c16(1JL5W~XZdJ3jb;1kUc=Tysqo<mJ9g6@WH|6p?`azsN$
zIx35qTIvLJOEv}u^=_}XUqK6&?^{st*UccyxuEh=egp`=+9OxX>2myfv*=VJ<4UY$
zKGwu1bfg2q5V4f>s-~o84;XQHk($=_DqMbyhCQnh`u>5{dc14G$fz<Y5xgbfW2r!V
z3P$DZp_IK*ivlm=`0wDEbD+2pPh7_?0D5-+<v(WkRXMy?1hddg{RVtamjl9pQY3Ks
zT_v9FW;l03=M<rP0=SM<ZNucS{jTN(*!CJ>BL~t{LwHK;<t9&+CRMS{_n#(NH%PlN
z?Zr*RY)rPm0I~XCo{YC5Fc+`>8P6pFKXq*^wQ*vYOnq^=k>D?Fg<^Hb9jWk6c(m7m
z3}sFL*`e=N`G36Wx1yjIIFqO&nBg5;(a`ouyedZ=!8s_1FZB9tb7qb$DA(@XK<v{o
zn==ryymw>r_O*1mR_o61CjN-x!z8TKz-pqu<#1yFV<v+viHRTJG%{Dn_f@~#sp(~V
zS35)$rP`B#uBh$VJ-`+Aw=}E%idWYyLq=u-Rk>J6cgt46k)g6K3+pkOP`~pafQc&t
zT^)q7+1&6BsJpH-S<>@R!)}Wcs)jy`SPN%bTfHu3FJF76eAnwZVOe}24i*(ZRovJM
zsEZryl2<ZF^3Z|~r$8gDnxFd!URt!`a2xIslX$A(0bf=Vky2e4wQ7;T(&3`xpqLKU
zY^!(1vui&?{<WY9#2MC(CsiN3$_5}!Z$5JW@OfZa`W3M9H`#@UNp|{z%c)|Otzfr0
z8=};2QY&iUr7vHpKfk^Amm>8yP^a|ARCjArEa8kJGq<__LVnlo-+;d`Q~v=rB&pvu
zCWLkW{{SG{l5g!dp_Kms{&;-L{HFf{{+xc-{C@yT=NrF{a|L`Yo+Ek{t33qx<&3?n
JU9~Na@;@)F_rm}H

literal 0
HcmV?d00001

diff --git a/browser/branding/aurora/content/metro-about-wordmark.png b/browser/branding/aurora/content/metro-about-wordmark.png
new file mode 100644
index 0000000000000000000000000000000000000000..06c12f2f72689f28a45dacb1d52a3d2b80059791
GIT binary patch
literal 5832
zcmbVQX*iVa-?meh$iBp2Mr55C`x<6svTvb~F$NQ3m>I?l$~txl*|RT6NFiEe358?}
z5t5WFA!~$J&-3)W?}z{K|M1?&ecbnTUH5sOzx~S{XK8+c{iM)I8X6jQgfYyThK5%B
zcrC-ibo``f6to||1c`75q7BZ2NJ8S#H2Us1H#7i&MS7yG(MWf)|7)~14Gp~)#@2!8
zU}ma`!eJGVzcC6ySifU74UM*5kRKA|jV1!z(4H7y9f{SaFC+jMcO40P6*DC>KSQ(^
z#+ZUf+fdAHQ50{KhP#BGE<ig-^H>0jCL#erSRY@4W{{4=U%Hyd>)*$U5`e!TL~k95
zznyY0vjiC8@MwUF0#qKQ1O@|CRTaR>DyphrIRHcn3{g}%zE$PH%9<*wnh-U>KbOR@
zHN3lrrZvpyA6v&e9SJWY(N9xRkwhXXke~`Uyr&{qLqp@Y1_UC1jF2ageTm2*d0&F$
z9|ahifWl+^h!~tN;I|^u4HrPvkvR7B?+~zlW@i5i`x5?1)N#rbgOGlTU<D;bEcSO?
zf1wFPYxMuR@gLCyTe2To(Hc#_1>jM~_3)7VLq5*ke>e0Sc<ha)1s-!;6r>LfhYG-=
zeTfK|j>Pd71$T_QrjenB5=28q6$*nWsj7p)>JW&&p&=Beuc~UGqNWD<qwycPDlm1p
z5(ElXQ-y)SaHzgM*g)M-!%$rbqNWB08~ouSd<jIPFADv~F6Ou0zqyeA%GET)qme`$
z-WG@R`O^WGUN|C-;Dz%87}}@;q|J~hjPLIQncoHaJ6;$Xj|oJ(8{u(Sz+V~G#QX;j
zlvQC$P_PjkssvH~6S;w*frhHOvOXLRhe`ayb^rflP4U<n#oz7mf7<2G(Qyy{UjEzs
z$D4o02km=2Gx+1-Ft?aJp48LZ2$;TY(8RJca~3cB^mlf-2S8eTT1HyOPvNdKutWxZ
z23}6azS(rGt-kP&abfG53_A3rnAv{rQzzUE7~!8S_1nUXQwsscE^)mI`!!3`N6FLE
zi~0F#8>6AU`!8x+rqqU~hKFrzoSp5Q)A-_Gu!zCSL*&$JCYOPj)Y9k0ApkRL9OA3V
zHQ8@|2wvdIt$O_-0|X9{1FEzvO))qLx?0S@TI3B%x^3&Iu^m^+3aYmFQ72in;fe56
zPX{514W)`Ua+$}#=mE(exHl;iSLDCZ{<=|I`g4Gf_>6W%I<<6e)O;v-AjIi`$q)`$
zZB{3eQ2sG9wj7<h=8_|n|3fkA$LE<v@rDb%$u+x2`UsM6&)`sLcBvgg-QzYeRH`!R
zrlvB-sfzJ8v17n3RI)|Jh@Oh}yl{4EAXPdlL;6T;#eb?J&6Z{B5lbNs^d<!s@%(lv
z6jWv+RN$r}nVdq*nEikm7<ybmtqfr;QmVUnB_}&Yv6wpP{u0o!E|}FolI>m$w^qC*
zs3Z3!Oaw6nJkU}xo#+21{`j%=&m%kJcEoe(Z{0wVS|6^hZGVHUKr<Sy>#3XM_&3@r
zy#f+_0xnrX#fJ9Wdzq!Yx)bqUiX!r6OePe*b0juy(A04P>{wr7!e+|GU#m&`lsx*e
z&x}ws5xOU`6j8RHG2(ZIVz8irAka1H*};;U?f~u5HqBDKnH(c_whtsKr8~`A2F<t^
z31G~Wc=7rrIun)Cw!_vP0ShOJ?uk1`W&mq%r>#Sxc}mM1WE2)msvp;xRuqnIPo&C&
zqIzV8Yz#lL?t{)4vl~j^mF1ukIJc#9c9t%`e*_Pz^N|7Gl1gVui8q@r#!3hYee5j7
z43rW_ZjCruvm<gr@?EK~q<p?T(QvT7B~DH&!V14CdCYHO!mH0{qq=9$y<>`cWW}&?
zuPm}>F^~)2TU8{!0j%yg!d(=qT=OLVNVV&PPJ=!~1bh>`)HZWaOl;KV((~9|D4Cv#
zEuh5l8JNM8%c-%?F3JN{Qbufsx+n1EO#L=KuLLc-U!1n;a9^e_ng}UW)=G<3Ycn)5
zoFTsHZEH>9ndJ%}km%4_S)m}tQ5mn2LQXO`z`y(gry2<^e&-ylmVKgB7!y)cng9xj
za;=UcFmjFnohlL*u0LfLZNJl{Xb&rCwxGH7cu01<7W!SWz5ZuQEK{L%-`MM*6S_t-
z5ucn^c5LTw;IGMLj#z7qPF8RhXU-aPvBzVXU7GB<h%T|~?xFRA0@~ZGgfr(z+PjIn
z`xi}#;1raH()XehiyzK@!%@AtaXak<O!!Rp03YV*Fx^_`g=EEGp`aJ+(`P5}#D;B=
zZ=wqAPv5aUJ4`Gc%m~Eb)e+Xr+Eo<JEO5(JI#J4nA>Bu}Bu_i?&-!z$$g&y}*s-M1
z9yDSvOU52hsnKJ3V-$+smPNbSIuAipw~anLFdULb@Urc!+XAnfrlyxSjKPOO#IV2Q
zzPTW>O=pHcW-0ZZmZX&VpYA4?k#`?ou~z7D631kfJ_R|uEyRfR+^V;GItsp=eYXDa
zem5cDxshaIZhX1!qFSd4tJP!UAuiKqRv>nuX4pzY@8w!@fZIe*t9mWrbAkmZfYg*}
zZkl^=dxIWS?LM)J`uKPQXol<>i|S0JWbb8q<)&1X!=cNksC&&>(P#CC77N+y77vR{
z0HL+^%B+ebVN{hV*I<@nI=#v_m(<)m)L&l^zTirRus^yPFX6?~z#gy~LwSQ_@$ldn
zGqfpn43f>@n)G{KXwEt%YZT136&f(yFtfRAvD3V1-|b$o_O<PPl()x6QojC@18tHC
zocY(8v)?dlrSb44Pv?CyeNMMka%kz2Wy-SBP5ca0D#~V!6ctOI6REmW;W|fZK&8vO
zDeSJ%S!r)}Q7_#cJ{nUp-6t;;2qfEdUu}41JY3KGvt0VS<9ej11D`vTP4HAk`zTk(
zYFifXC!bn=m;Q4T{%$Xs*#csleLa$gSt*%C97(f!Ye#Qg8|SllBt*B>_}N_d-mZ5D
z-K40(=q5TOk{fj?UA^_FdSI{sH%ClneTyBV*v?4LEo_SFMVm%y3_$J@)TDYa<EvOO
zm9+r{RL6A#JCX4ZOG_U@*M0N)(x;-gE5dMIsZ;IJJaZbf-ov&RwZ7iO#Qa2yZrNgV
zM3<a7hKs~k!Ul5%_F&~AZyF7Y1UuKnyUq!#=E+s}2YOw5GH_stRDJkd8@V7XSag*t
zAGNH{4jvYHo4&%bvUqM~S76++DHKbJ2p{vhY{_Ah@qM0Yo}`;q#r_>##KOm2#w^Wu
ze!>5j8oiJs+Z5;w)zjgUB}?0YlSW`%IVeSGUnrR~XF$pun`oz;CJ<|%AHi2rEaanB
zqQbr`>VzsTDv*V(*F&cS-h39mZ+y?d@}72~_r(6%hjQ0q=U%Uxjy6y5$jjB)8r7m(
zsgz(#G3-Iru=a)Al=E6H;|%+Kpa(XItwMIK+il`v^Ngq%%BZDhW+~P5&b`z|==_Uy
zhcx>K<6(Tp*IGv^7mx{yz5*Q~hCeHA<J~96eWZ6{IDNuZg$kW<x+tj4io7O8-6dw(
zaX+2nF6Q&8q@bEN*plI`PPgSYV=sXMA6m}{UhW%deqD59CCjtPYUmdA$Ig|#UA|=_
z!Hgx9m=%RUi*AkNIro*z1+uHlN5;EK5!q`<V}rZAY=cs!X|^+NuFjadq^D&!lm!TK
z1`di>nT>qT%v?^KfJL&8y&@=O^w%Y7b&sRu+MDEiK6pw)Z9G#L2D~R!R=1I@QokD5
zPKx_J1Q>3!bBvJ-W(i}u+nzOAU6$LTVj;f8RY2#(4KnFn&4q|Z9^=$+q2iSd`-M5V
z%W(Q=^6*l2BGRnz*HvwwOXUqj3oaMnW&m~WD5|=X3Z~9g2q#Y39<qK3;!8|<_c4Dy
zL+^3?OJBW8dj2}i!&QeK8@6$um2nM;XCqK#IMm_hOMDMi^`kTIT!<41((Yi(RzGeL
zFfe*wZ?9>Zq4Uy0d{PcpUO2hX8fv<);&y?}`}-9gAKL@AZcnZ8M&nkjTe8{~^5Ah%
zQQI~T^pG6Be6fnHPAu;+@>G;dQQMk%;>&r85M!=^guj%JCOAc(6nEiHCGB(f7fi3V
zH?j<yYvOn0J<hv)wAuaU^3v#mFa`NI2COBwJQj4zr;4|O&*1jy5N<t4Mkp^Y8(%PT
zfQ9(^gl@DnVyR1fvw$u6Hha5U^PJ(Y5x?)Yk&Q+>2LOWhB%p~;vqf2dFxQ`tCuk(Q
zGia_~cFtfyHYoAgfaCr_!`d{W5S6Sy9*m6s*x}Yrt%w=?az@hR=cO3X>t75rQT%B`
zedDcuzUcFBoeYs2XZ)gNoWklA$2NJSuti)MQe>t#<rQ#No9GWoySc_ARFcV^PG{9J
z-!MzNtM?T+m(g2Q@(Nt@_1eCjEKDyPPS{ZIvDFjuLb&7DB8zQGS*3D0i$Mc@khSx}
z+6+jYUZJc{cnW#sCJW)C>lEkS%!pq|!p%&tlGz~nP4HX5vm0lNC*{svo+uYcCzq{>
z1jl~zovxJ=%1@5V;Vga~-njGZicxe*f^$+=F^8nzftzepzR;^+wy5(MpT=_UK|b-5
zNv}I~?D&~G9ERZQO-=NBQJLTB`VdSb5A&7;AFK$8vkZvz=6v8KXL!2re`0>m|4QH>
z7TzIbckwOa@nm(3t3UX#n~vFTA8`bci*m9|%ho1!4RT=gwUoteS+T38mNQkzUy2dU
zZ59j%w4niM-`43s^bfhm1LwoGpz;Tkt7(I#Yi=}?=D*@C=SZ3DtfYH^_xYt=@*;z0
zK&jmC`}X-QqDZtQR-SY3r3_eZ=_D7o<qG!m$4AQGAcb7$YnR>X_T^6fj5;kN_sC%3
ziV@3!0^T8*P<UtV=9PZ2C4XHxBG>mBF9PG6Un^-@xM4%5P#z`hSqVcX@^CqZE|!4<
zZaxDn=6YW*Cwax*<k#~&F6-!;9LtA*8N4sNH5+f%+H&TBm-clACnJ#^i-3F{keb3`
zAr}0(EGMtkGySgnR(;WrNZ|bBfrCf+&w*>$Ub_R*xENnqwcd_b_jI@aWM=eDcZTvu
zNKHrA4cM<s>1=@;C7leRDazwg!REYTV|U#&Jg*g~Ry^q%PV7*}nze3-OD)%&36|ra
zwLrmz73?g$#6EnT27aErsuX_Lr8-Z2@?NW{=}+<Ph9qf08)e?Kgv@oVeM?S*CGbby
z(3WS{Ju`!l@jq(VnTX_Y(@L|~86D()V~{9vu<snyB)41eod#P<d<~Pd_4#Q_uB*o9
z4Y{@^y3XedK2&+085LqOZ3U685`D<ze-hvvIdQJNVPmQoGw1I8#H@)tb56<N?kjKS
z93KZy@?dUy_+fT&%4;L*-tOM+aE27o6|)HJvyYL+h|reNhjL4~Vf(8k2Z!fhiluE*
z4fkJ1+(}doy5BvNOW)kF_3E&pU8|*^S2=uvgCYLY)iV_tmkhYioicdEXZ4|(ZF5zR
zI%g-}4v&%f=m#zd9CiUHe2?=Go3J;MG1P_B?=U=~o}wGt?jKDyJ25aFVg=FhRzu#5
zjOS-O@rCt3D>SOB*nK&LA1`P|){i~tLubS#gp9n^<cZ>(4d_@O4)qd_Yv*@>;Qdb2
z)}HNaOQ(qDn@`~3j38=m!qF=4v+n8^ma!|NW;~}XOVRDiG%G8}C{4!5Cqb`=Lazxn
zm#tmzL-sMRgf!~sUzi#e@<{Q=M)G})SMCB@e$PPFp_x2|UvnJ>p5SIm@SA%5RNmmn
z$=T;S$r%=TF$pdU7$JHK&Szsu%jP?nzN3g)N+e9V=(2!7t5>xCi_#wKmfv~{I_^`W
zjIgmusBLgKguBo`v^6p2>eCPKiPf@pozqi{PRpqUfN73C_moSb(U$pWri$I@Ns$RJ
zYT3!Mu_npShe@4s3If8d#wI#Byg1c7;ac#T0Fnc+pC;Yx7+9(lJSxoyACQ-I3j36p
z;^L(9NCKPqE@|Z{3^8eQ<$`e6Om^M<Wy9F!2&vNt3Bo*V<L~Np(RX~R&*TEyr<ixs
zq%mRNKRWENSwT9nTc^3v5ic5N&sI80f(W_s^RFNa0o4~%Tk3)EVBz<GCB(f5xwy?6
zYVHnw!>7X<PJt`4<=+b+@0WIYMV`L>E`<o*;AP(G<zCDbqc}{sBm~dzDfd~gc80xe
zsU4km`G69L8!Xofc^(1rR2c4&YlGH<ta5z>)2>q~7T4xoe*B!jWp??X0C?w%QcG|)
zsq6{L`qBI3gA#wId+*BJ{m%xCEXD4}DuoO@P=3*9l~Y*FZhw++h@7}!q)(oSTga~j
z?G}7^Iu`dS?%_kFlBn!*_e8g}*?N^9#e?PM7pwG}%ddh3WD*`ECXhQhxVJw$c0_5o
zZulqC#`Fr<>Aix?LXk&}xnh2C1N~#yS3P|s<sa}oXKQRU_0mmpHIa<;y^0mAa&x8I
z4TP4+kHBYS-V#o2Hat<!;z_RGLI~YRZNw+B9CFdMCC)LdIKb}<nIn6|qRWotB2}Fc
z3*@=pTT(nFkK}%)IoFBhm|Tj@;k0r_TxD3`$9Ro-VRdmbN4|M724+H;1@A+1M@Qd?
zm&anmJxkpLJI*%eP=yDF8WgC3^$8k!PD7|Z(i&6r{S%!F3cZ9^k(cVG+H378^<uSB
zz`|@rkD4p7${iLcwrP)+8#{MP?XwR#><Fef$cOP}aiv~5!^ymR?;U!-33mt;7)WQ-
zQhf6i_s;U!HPy^U#><LCb6Uv*PwphVGsW-IX8d5hXpT{&3=j3Y-(*-2aqg)fJ_i#|
z_u%~E%>MKFsa=t!!Ml^GT!A~#u>rj-C2;@#lXeL&pI&SxDS)Bl>-D`+2D-_&Fwx%C
z>5SK6dg7z1l_fLKMM@5fC+WxKpd5+BDm$fh`d$J0IiXoSN_Ga+Q$Mskq~}a@C;=eo
zr5BN-WtT;Q^0&8E1y^0#Uzk(fOu&C;3t#X565vR^p2Xit&+ToPq?Yt{qrIi#LgyW&
zRKkHeS7_cm>X(c$u}-~7Z86yD$E1@!XWIc<X2*O?BiS+HIUD_9B*%B$r|=ja`n}WY
zDsJS0Zt-W~bA*HIbF^f+ui=W)c3p!R4`0S?3RZlL(wIq)XTL1=V&lEq#e5@i#mBB1
z=)LnO-HhH-vMx^)k@%pK{SV&014+M;zRmceMC&SpMLf*(4)Vba4>+Rs^l+vGmv*-9
z$`_pzs^KF3Yfq<_01vz@uM-o=EKhH~5eHr=#tAx%)f&9uW4Z2qfsdh4=B}@W@!NA|
zCsh348C_a&7i(^}HQiv93zgWvsFp~!Gd-7!Ovsh#3onygA96;i*FL=?DY45;f6a}~
zE6Llw3tE_dKfzUNb0cwB85fkIYrX6oyjd+86cZH47<CuXx)rvP)S|V0lz9J$*OkW9
XlzRSMwGHd<f6EBCIjqLOHR68&S7e6>

literal 0
HcmV?d00001

diff --git a/browser/branding/aurora/content/metro-about.css b/browser/branding/aurora/content/metro-about.css
new file mode 100644
index 000000000000..678e2fd74680
--- /dev/null
+++ b/browser/branding/aurora/content/metro-about.css
@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#about-flyoutpanel {
+  background-color: #331e54;
+  color: white;
+}
+
+#about-policy-label:hover,
+#about-policy-label:active {
+  background: #181327;
+}
+
diff --git a/browser/branding/nightly/content/jar.mn b/browser/branding/nightly/content/jar.mn
index e22cb11c088d..3946423387f3 100644
--- a/browser/branding/nightly/content/jar.mn
+++ b/browser/branding/nightly/content/jar.mn
@@ -17,3 +17,8 @@ browser.jar:
   content/branding/identity-icons-brand.png      (identity-icons-brand.png)
   content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
+#ifdef MOZ_METRO
+  content/branding/metro-about.css               (metro-about.css)
+  content/branding/metro-about-footer.png        (metro-about-footer.png)
+  content/branding/metro-about-wordmark.png      (metro-about-wordmark.png)
+#endif
diff --git a/browser/branding/nightly/content/metro-about-footer.png b/browser/branding/nightly/content/metro-about-footer.png
new file mode 100644
index 0000000000000000000000000000000000000000..8e507f174085347b918c8ac422374613713593be
GIT binary patch
literal 95994
zcmbTdbzEG{wk?Xg26sy!xI2wQ2p-(M@y6X95<EDB;O^FV0|^$~U7Fwy!Tpkb_P5`A
z=bd~1xczHctE$GRF{@@(^;$L8XI147m}sPEFfcHfALXRgU|?YN{(ex9UQ>)erFgvl
zkhsa{xT!l@x_O$q0AVC79L<2#A3>&8KsBJLg}3uBpa={MytR#nj+>5>qL8^Gh|TnG
z88$DF(<>SVMnufZ$<*8q=tgY@w6bvk(4Mw;(Nf!30BE&&l{l1~q=42oay~9VbsuF7
zb00f%K?_<jQECw{p;rPB(9M+E3uN!$D&z&A{THv$>+#=Yc3SFx6>+lz(EgVw9VJz2
zDMuF|H7^@Ct2qZJCp8}*8z&DhA0H<RH5Ugb7dyx6n~#-~M~IhCh>M^4-!IzN+FUFw
zh18^F|6SMX8GzQ>&CN-Oo!!&Zlg*Qx&C$h*ol{Uy@Gl1!7wc;YR#$HaH&ZWG2Uog(
z7^H!&<}Nl)ZZ?h%)PEUG%^cm`0JN`4|H}lBlakVZh#g%2-B7Ph#_nb6#Lmga!43lb
zwd-G{UES1x|BsCSv9zm(w-b<E4e09V?qdGhAC`3gfM470|6I}Eg0E_XR9tLcJH^yq
z+R@w{1axrwC=H-}&0({!u@I7#66D|#<mKa*=HlQJ;N%qG;*yY(;+B@+<CEm&=jZx|
z<A1{POGxqaa0v)-^7Bb^a>{T^NN`FDNC`>_aB%VSb8<@lgZ=2>>SpR-4*aKHo7Z~(
zjphG8Vuhq!fTnJaE*g%G_WyW*s<oq=qpP)}6Sb5&AN6}BQ*#@KzX^<gJLtdcl?J-l
zcmOSAT^vEw|7u|&oBu%pkDxRMH>a!&HwPEbKbA{MNec1_@JPtW$Vk)v8*A}@(`xLm
zV%Yz>$N$S+{z-cE!M}(9asJnn{|q0X!|RxFc^w>an>qj(Sl9O-r6n}HmX116Ti(uV
z(%-H}t=u%v`8GK+eJuK_@%5bo*uF!qpSXc|iTHM*f8vRkM*)5mx)Yk0u}^8q;guU~
zx+HF%S{K>pV9!TpZ?CZSR)6l~tGwFr@Uk)F#$`MvN_cl=!9jY*R}=WQ)!>W1v6e$3
z?j0BH^X+Nivuj*}8ZF5$Ia#i+=f5%O?ohub##p?igI#+4dQA@E`>(u27!cRLa>TR#
zW|N>!(ErVr<$9B=^a@RkL9kBx{{Us-8vjN5AK-td{0C_9_P<g71N{F{{_nK>N98}1
z|7iJ-%6};TG2*{#`T8G~|4qw(%&RaftOm1R3ahw%?Q}VgkHJYN#6hOvU<=B`$+smg
zg)#g3-LYi8qR}9nGL2fgM_6n6&7kk0^_1^d(fQp0zk(Z5w=T(M!M0hN?Myo0wDVSd
zvQCPc=;7+}FSeHJ0hP6{DzE0TqjLc4QJev*jtt@*aXEM`%DB|ZI55hBZ;)WA?C-}(
z1#0cd;#eh4gS!)*zMkfN|LHrrLF9!}z!C;4<)yN3<aLA8X^mrh;V%TF&gL^EJ-9Mr
z0<vTk*GZnTPu)|MEHmo8$Sj?3E`xIlKmxz275;Wp%M#M&a%`9lGK$6xy3~p?J2{Q@
zijA;~k2usC&utMQA$2=sKi9E<zt&`$3=FLB9nRn0lfo#jwEn19B{j?xv#m4%zrV0%
zuD70xT(-75PXVVRt7nYr8l2IUp23A`k7}*X81U^~!fN7hk>?f{y_(G?#Em{yk-n%q
z-AF7)fsDvnGoA}&`o?Ds{B4(YSTy@+=U;A-=AwubL_zD}#U6b439dyLb=pH8!NU-4
z3KrHf{uGtN7oqgn!x)wxJ_ox}txin}mKMG!fz5zS7Hve0pnGbRLmjFMSp~HZ7uB;h
z9J^CLP#|{1l!eH>hp$Jki<#>%`oOweQo_0)+T7#VQ-_qGr4rl#2jvL{L82sETN+eH
zPDcn`JT;kQwk~Y8&`I#+@64qWs8Zq{f18;2&yg;uOd*;kkfZ&}0oiAui+2<V@{Yy(
zH_ZFzWKrIPtdf-w<Z}PED<r;qo+qp8rDJRpob)$}w009Np|DGa3QD`-rf-6ZXUUBd
zwN(gB3Y$=1vg{5K>IwZ*#b-t)l5=3%mOoLC<^WZjj)UPWEGtKn3EofN<F{+(9@gs;
zMZH5IH)Z<Vqm}!83_pl`730QtVU<4futKMOupZG6X78bhi=@!i8*UM<eD?Q-UzwAa
zeg3t7kvvwP<c=A=onNZf3ry8R0Nh#$+{b^9_B25coHj^Y_n}gll;c~IRS+JNhmTsF
z7Lm@XFOvA2CaM%c76s0r7E0GtMCf_P=M?a9y_{La^Ni7yRr+ij@uAwM$aIJJZifM{
zxYThI_bSAn4tOvgg1^Jbl}=G{C#|mtOiB>AE#OooUwG=KluM+b^2^OSGw%}kZB`Kq
zJD%kkE7GsJx$p<0kJ90emD`ol<%2R=r)TpJr%!OH@o2HzOqf<2(cB1w5%m}vHr&1k
zHS0-%Y;Apk9glJ6=Rbs*QsDmdt<<T}JTNXDt-A|{vg^Uy@d}3hYmm#v3Zocw{o?6e
z-aG&FgRlW$A{f-|4t)<phLfuY9w4Uhv>mIt5)6{5JcmjX5>k8`CPUD$!5e3L)AA8Z
z(V0Wu>uB29U8hep!@c~MsC~3Jw{}<(YyPS|t#P%PM}AOAoN@1r&L`M|zCNUC;g(pK
z`p_gR?F4xu)v}a2|KcwUIT=!2^8*loc_SAY!*~sCPDQD^%E%mtj&1%rNw;b4F>lZu
z7kz~c&%vQiHNPrL+I~Bxfd{Li_J!t`+QMigF)+2TA&;<9<>=_N&!0g;g+ZeF_bCmL
z49&3=-_y&VZx=M0bgOr|#Hn5m9R}`oy7&bURY*Vf4|}5Id@^9AtMlwE+(a^~T9+Wc
z#uCDat0$jmGBi2HDm1H1Jr2&_tW#Z{)w%1G9rzKahczqtB?yFBl&l0z>o@p`gq)G?
z%>>XAa&lgrS9v0X;}1r+lV)j8^(iEWw<pLYQs+56y<&0m<pbm1UZbe;XTrl7tHaW;
zTP*uEd}6blv6{;=OgB=kR3Qq+uTlX?<+WqBulH?9lRRA`Magge$cRSxM$k8MY?SpJ
zSIO)sz{ip*DdHQN@e7yPquCChfkyouhL53M@rOXyFF{>l`-{$sj#L9%U}uei=ojhv
z3~YDdvGq%#&N~D*<2GmB#r8M3{&%tdVI+=kBkll=ho^_WF^%To&~oCE0Ue5Wm;z|M
z#1?|-eLi;KFvk;auw=1pTA6^EWkMFSny<v>sSA~QYl$?z+kwg`wOl4mYon;a^MTnt
zN#{!Y4VUrmb8N6|NlHk@+mf|_T&-)iIdek>$sryQZ%Lm&VQz^AZ5WwFp&liXl4W6V
z%TDvk=FX#%0X|}X=$`<)IqF1F_7FL!F3rx#^V{Pcq&jbYEP6G;^l;9$@oqWbtOrsj
ztdGC;RH+7f`XX;QNSJ|>6EI1!u62*%KaTB@ImhtXzoxBH@b4NY?#mkM_)hD_-_0SA
zpL>2R$g!G-!-N`G`v)eqCplDDbg(?D-U`<oC|)qI?Wb2afENwI>CaCef6toQvv4l4
zgsiSYiQ=ZqfUpMhXlBCvM4hoI76&<LLxXZ!k|1gXKJ{3UUpe0%eu`g(5(ExdRzxp5
zE=9!bZT7B+2cNFE4$QR4Z!UARyOJslW0DJY;FYKtbq@^*DYl2s`B3anwU|MWf~!=k
zQS-<#zX0iCjXb+$d6VUBMow1avXMPZAHIXgwrvmKLn)tIR*yutZm%2v&i^pS^V{jP
zvbUkVMuF)b7p7PiO@N?dT}abV3L<%*RyK|a1^*y{NHYs?p0r{sp@{L1?XpCtIWDw#
zM#x^J{R#-T{opBLBW`Oymq<BwH!?>8n@=N-j$Qb3-XB%6N(8~WSF|Ef7JgNrL34dx
zA*SVSkW%Dj1<~HVF_C>s^K1-^#MC{|rP7+LUc+f;X`u0Jczf75vtGnvd)d+q$%WxF
ze2<5+%W3VH+f-N0COh5kX*M1k>2$Vp$kEjKs5{*oXy>RCsJvW<XF~(Kgkaqj*QgCQ
zPsNbnUjiI9ixh8~_4KbEu?+w7U7pCG)1GB{PJGS-Hi`F>5k2U=IsWLpx)X+!ZVNFd
zM%-h2=>gDL#(m!O)gB>MNob0mlVaPU>%Qfn_)|2T8!Fr+h(iwvCYqT0T4D~~yZd5A
zUfTuQ)iryNm!Q(_V-ItX2Z|;EbOCV|{v0}VD8flVW9BSwpcwb>Q|oJ&4)^S5X73l^
zzl~X_Qj$rPEJ}7Q7og9>JjAU;g*H?4$N9I9B@e{hTrJ&(dK9>Rdg??SRtn;SU8->D
zU<F3ySSS!Gz_G#&fwzU=i47L&$4zVp-onmF7G0;GKKP?Ig=C4>&VUofEUCloeojfK
z`$({TfL9`cU!ozAkiF8m&199txo&9xu@8C4NPw*X{g~WBBw6UA#Yj)Z6|J>9#CilL
zj^F2y)E&cIJ-N522SA8XmtYulN}<aKg2~bJ<cYHFi@`L4Ha{ilv-&Q_3=e+ylb&QG
z?V`l!Gnty1&0`$_{80E;yzK%lRj$~P0gvmWO(&tBD-&QqaE;pIUc#_PD%1O3*vL(p
zy+#>5^+hxIY+j5w!1W5ty84bwZLz(+nr0tDMf#-67PYY{G{twgg=)paUgq{1h#fq0
zrDE7r?J)bHE*eNqi%sZ0dEXC#++i8!q^<;97`1}1x3=~qnY}>?tRK>=t|2q?!A^pK
z0I6Z$24B-cQ+}evgPQmKOLVEWmeDxMRGo8e^-V?7jBVm1u({YifSZOgo<G~9!KJ9}
z^R%h$5k@8P2bVlptIlNAf!m*sL^z)2FB5Ng4m!tMO}@i8z%`;yKrV&jNh%qi>5hN2
z>rgK2y$PidK=V^$3wND1I_9Vg>QQrX>F(D0<d>9cgV*xMlp{Cku78nhjGgz>>7+|W
zqdXxL1yZH>@Tp3(e}TC}4{>VR%D?y!z90v+*aE$YBjR!q=I9#^zI&~E$UtU6ch2v4
zlgg-0?ARXJblU{YVtB3ylKOtzaMRpng8}<i?DqAZm2er02Agebn02?-l+Y+r)$$K<
zh>2qo=_J?5jJo;bMyppy^4z}oP)f)q(ovhkwIfQ!i$cNL%U3||I58@e{_l*Sz!^Xd
z`V#n|{lp=ybBSrNk2=|<fQQYu$q?yq!J#|aoV9!oriwa8iSf90x?ysgIA+S|9XMsW
zl>fmR*XaWF*wWd1+Ku&Wt3lUL6eXho4^@@s&BT|FNQu6JzX4QU*+B$f(ko!}4vul0
z=!&O()I!D!vr&G!Hv)f~RD48z_B1n`8~LFJKwQ)dOB|#7QoW?Uv5t=ECxfGCZh6=>
zAi=|iJ$W(}P#$M`gZbdRNfGJ12M!IiDn1LWV!aXVd!r23@^{L9_#NY`9&rm4qUs7R
z3XZKVAZEdyRyw&sYi{viT?I@WVbnH!mHYy8z1S9R%N7m+RcwVNZ}@0tNP|%u7gxrw
z&_Ps+8_Ew9j`!GAF?quV*?Y<QabSyBiyGL7U*eKy#@KHWu@T^}_rqpe-GX9afLqSQ
z(&$0j=A&`!`qr>uRaq4G4eDE@8{VYimnya=WxHKfH?6%A4qg~cd4X<*dfeQr;4~@g
zXLNEN^()7f=y!Gpl}C-sSW|sy*A#+b`o^yK$d0Qo5=&KGjdfFk-w{S%ufKw>!^s{L
zr5;Ix_dV-g+^g)E35V&nWd=84D$*;r5qj9!lys^sI62g;U9M9uFSWd;{f)-3IX)7F
zeUnQVMr2u@Bq_3-p9;}%jwpw(nRpv!isK>a8g%^~WsYbyBC1l~c6jjpdnsc!gwYB5
zi1(p$jSJ9=%+%rTe%St2?%gw1$5x7n=>f68Eh<%t8q8maiAhRnSRzgY&xb;rS8JQp
zx)qDX(WRjVY>}}M;TqLpWG5}CH7%zOW^LT3`%UM=u|6fo^}i9E@c!CTL2?xOBnUVC
zGSO7nsthx%1{-R;l*K0m&XR*#I<_jR>w>>c)X&oMwFj05NzjMlF;i?QA|N(p=jMVj
zcr-sm?AJeYL1vlW+=i5l{|Vme<^5!M5p(c;0%VBNLz)Rt?5)xzZNKVKK}h95fFZMO
zzPA&taEEI(9|YpO1gN#AQ!{<4eN-#g<opD8?>atlx;*gXkqNEO4{C8XwBs|zjw#2>
z#|)o~Y3vqif6{)eMdZ1DgH&17e70g9U!XHGRX$~Hf2mqJ>qG~80;=gc{4pkl*ELzX
z*}N3%k-+pVrtqgE7uzlxN(VRS%X%ZZ?lzhZM*UH6(R?x%8K#Sk;+!i!0z_wgw{50Q
zl`faH7_%<|(T|ZDt$Hd6&JQne&k>XEOxc783Pw~zoQG4L5+C-oM+KA;z?5Ua&L-mS
zi`&+GI2i43oZIW<E*w3`tUZxFW2Y4z6iVEd3c{>1Yy+`;gDq6EG0?Hu7@RzuwBf4-
z*XMr~8cKP?b=Q%FTJj4?O=<~+*iKOk;Azm?bnlOm>3#(8LNWH)BcaZcYD$(Yk|&xE
zz%zbacoKNtt~qLXy7GM9VLoZ!{ZQ<I|LpHy_wwtli3h>=anyp&gZ@uuwWr0?TS~Ez
zEdM@T1Do0JeSlx9;%W2Oea?q?r5McP$aV_rbcd}NdyusQx+EnUb++!W8;5Z_SWXrr
zRAk5{QT!<mouX;0AtM$c+vF-#n0^)Hy;BD8)$kGsZ4TY?{@tj>k2Hgyb*4g?KOE*(
zc-wTYOB~!hKO`<82MgeE=rSPfz2Wl7LrvXwiQ(g$BU`95f8%>I`g=I%nf&^wa&i;o
zb&zPT195`&Hfss#Y{C^Hvjyjgk|B-IX0oop2`nyQocKK1IiFk#iu{3^+h*CLnx8t<
zSQX6fnR>iXu3Uf|yGLtU_pxo#9tW<r$A*RtyE-$8tL~V){xECL#$WUy9s<2p<@gX#
zAJvBN11FoeVJ+(_Kwv{u3pEJV;q{!FxLs@RP#-u2-=v+_jKVmpsdJk(E&GI}gkbp~
z)4tI2eDM0-opWo^xi%c>8wxO795okjK~Fb)`WUw8tJ%!N94<?R)2yA+&z*qKX2()r
zVDRq>WPb*m`|;H*)f%!5t~Hk)^J<L#@m4R4nk4jzKR#+5)%e=kc>|0oqs0!kWY1RN
z5$17BiksT+lDN>S+b(*rJI=#n#J-R3CbPKy=_MaA!z}tm5_7x|t2J=_7We+x*HF(h
z$5%La+O{H^YJNQBdvt!&B#O_saG!c#X%1Pv)bMw3$JxRRb*B>n_pIt(&x_N81oGtq
zg2MQJ!tv(_3C}Nya(agz?~i9cp9caO9PKCT)Z?A+&xQ%?PnS}ai9tWC={84g)F1h>
zts)O7wCSBhGQ^e60gT=Cl0*{kaTk~fQhgmTS%fj{1s$OBoZ6Z4luMubenGm0f~)f0
z;UUCgUrmKmy1ITNK1}}9#gc}DZ)6q9!AbMBh|&N73+@F-S8LlE%=k0<{wHcPAemq%
z3>9-NxMIJiJHeAsEy)1rB{;1fkW#YXBFtI)m=_?n407KjsyLUBH%#E*+6Xq@%(W<)
zmT8}rXf;qJ=xVE?hXp0gtx7f5MXdT-aqM|;1YW~&wZ`0!Vy!q)5bo|w>MZ9TN(|9;
zNxCu<m#Z!6nl<>=EJu1iE_<2*t3p-$ZmA}1z@I3o26CsR<#n8p0F^aOi8V1B)y*B0
zHFt5oVu`;tK4|Z@GZgyW0n^{b@R>Hk?o9|@8l$KNc5x@*DJY?n0rYKZ{aniE!!T;g
zr7Fb;Jlav-CtMZxk68FCX}PDkufVN-i&D+KvS?rwSuJ*VqR<=wwzU21#`4RXNUy|T
zk&oM<&_sj~8=$UG#Fud$YN0~bTxV~FU84@BL7q#e)ZjXl+#jFk=+3fHB;j3drx5aM
zJ}T8<79z^5W+(hm7)at4soiyGeQd`W{OqQ;is3U-)8iO#9_jA2`Z}?&sY;z@T<Y)E
zJ5+@Q4A5a5RgESG*%Ro(&0j^A*aYe|21xl2`~oF0N#xC+AW3ilU<S^{9`gCLe*SrU
z6DM|!P;6CfVxdrusA6SKF#F49f!rbQYP<e&`9|OCdU(L;`gZ@RscfHW+5Ks&15`q_
z@g|O)p;qayH+ipogn2N!zjHJvY@c(6mly4pH;#5E@6*sllJhlMB(wtA2(hpa8v;q3
zxG(QyJ#$m5ELZ0^v&~>ZnMSU#b{{0ob4@wq*niOSLZ_nLxTk+xMs`{v%fLB)&liT}
zu$^NLQ+k6aDV&xE3(f<^pyuQWxePv#VtR#ZvFF|C`;YRyhoO@iKdOyo`QD3T+tWkP
z4NtdEu(ol6yD~7cu^vytVTH$mPMG&m>lO=nqh@+iN96Pa{I(l%LlTL|#jSG@p0jhN
zWx;0ynn<@LP&*zp7cDLvj_u_dV+;docjbO0=!b_k%UM}d`Fl)zHD;je76D25i+Bfe
zmX2HE_1(b~sT#syjsJtb(|GgxgZ4g4Kt5!`(66<2xp(b~3t3O7Kadd=^)m7csj|;y
zQIdb*ok393&o%@WqOGXPTEgMsj{~T-SOP{jp-o!Y=6x986mGABBT}sKR8{8PiJ}`)
z9*NsOYD9O*XSVQiH9n?|athEKcL1U(XdzcEHBZN7@xVN!xUA%%7Y^MUQ3S@!gC!dj
z!N;-zYmYNC<zU1!q_3^ht|eV*NV9wuYBpg<wfFf=9NtGZ@sU(|b4EyTZ>})@WoGz@
z!z{)Rt#J2m0aPv=s$8Ka{guxG?9&SHZX4cCt#aen6nO88mb?yn*lCU5OXr)EHGZD$
zBQTq$@2BtAu%n`|4z1*@_E%^QsFC9Sg8yZ6Sp$Svp&2<6Yi{Nt?BdpKAmIIGG3I0U
zid4bkz<08mfh@=iC|1hz<YDqY|0$TVGoVVp=Z)|Du;)l2#`!?yuWFat3iC2`UBvdF
z?(aa~U{;#d{1uU>-2sfYFE&eY{A3>O<8x>>N0mTLRr^zW#PB*1WiZRP)xC-<Lhc`k
zmI&|603_5iN(AJ$l!e`~&@P+OG!R?nlwCnbAmJQWcIh{yF9|*O(PY6Eq^W#i{pq1M
z)CHo;I!~dc?!yc*aRZi|$urRP!kDE2+1a*OqQpd(7UI~LSz#2eP85vR{>sJ%m|#|7
zxBX(u3m?o4SaTiY;Nc;jD1W1uFNOlzWx2D~xXX&jmSHKgLMQ&q{CUeK&<m<As#(3+
z*+{8x+T-CwQ9SA-v*jgSkX*J942W`b8MrsAQ3$gT;YKfsxT47UIm7&R`sK>)4s-nh
zbQ-wox$djo!}R!YFRAa(Ru=erA<^{Hto3Iw<Fkdya2*g%LRka~^Tjs$-BWMq1h)Pt
zOl<Wsf^+LWmkt$=kbeytQ73rqWV5Y|>DqyLqpS}r)mndmt#SXY1xXLIc$IQ6LVT~=
zyh#%KEo$2AlIQ};6(mvFbmDj#bv3ul7IoMXZFfiSy>p@-&DB-~bccGRQq4dos}DUs
zH~f~F&K*&@&?yF^(hPz@^9`pkoRB#B!GR__5f$5+(aeG-lO_Q(EwN6+0Lc(%?~Q-h
znS^I|u3hUeBXv?W=Ggnm=fOM;Mw0@_j+XQVCJwm2O>p6teFmO7SH?sHy>tQsZmnUw
z%musIj~~CwHkrhS^f+&1%x{p`b@LXLYu0~$c!7?ixT!qP@Ix-zPZq(=*YM1)oh3;_
zCZFA$lrV&d0#d}Ui1>UEG7;**r|+HAmv}z}=gi8eU&iERQn|3g@fUB})*HZBb|grq
zDo+{cL2vtzz$sJd)jMYyeUyI;S~5coDc=ixXMuW!Ys{E$;C{fKA&I41sw8^*W<@h^
z^`|{=e3=<(Jc}oR7y5^au<ct^jLBpjLr(%DXHdYZ6aFsRLh(fXgtW-<9JZ*;7Lv3m
zbBH)u2a{PGa)R<(cqJcQ)3yjQ+qMnI0tKo7%dB1${?L<#D;Qq6q9){CCsemZD@AB=
zh$AC>)in&>yR2&vvWlo5#`JPYiuBf;27g_BV?L>})&NtlN5deFmm|(JFMwY%cl91$
z8{S}}B;8v=l<g;R;T<XD2pVwHl!BSeV08|9If?wXyzVzFJWsft<3UPMM8+`H6CDQo
zt7%7uLU0=AMY`G8B*@SjV+NH>9`Pu;Nz*QwdV07*skWBWNn-9Cj%)3q+S0CctoqRH
zH{_%rb>b~$j_`*V?oC48I_Xj@CRYF`2|c)>c?JrMD%bNrIXNiBVu{m=m1hcMq97z=
z9Yhp5CrX>3m2H<!qMDu;2B7|sWhtY%Bnb=V2~$R*x#Hh=$2OQ-Xx1Sb0?r>i(vn7X
z6GxEAE&T(Q-orr=Vzj3EGDt$>s@av9P-n7Ii**D(a1J@GIWi3m{)#iBl1!7!Oh7#(
z6J?;qIR`fix3iNa;I#}A@EK6j5fR>%X9q9aH0!YzNavU$OQwp0b(l<Z=XMb^XCB|i
zKzX+#oY=<>S}&i`PSZb~dJ{QzRsOuyK<w;)^Zcm&QgM#`a_sn0s7iQR24Zf>41C>b
zdlDk!$F=kShIPU}ifdip5L5&=+o{<`Jq%-K1GQbOZVy`LriOp1H2#()OkWzp!PBBW
zZ~v|!=EP7aG3yRajl`_YU_VD$uR2h5_nNmcPH(KY`dmcMj%WK6Ga>&f13|juf}s8C
zQVe*lJ;xr5m3=ft+MQ1RGc)nWehPgZ8+$GiiFHSC;X$1R15&-I>c@Fa|I`Bndv#Ch
zTPl3D93R6mmFmcvMhq~H)=x@f;#B%@WHs1QB#4ppl+S7rPFXOF3YAC6GnkpeDL0|Y
z{2PsyX|y(}WwAI>CoL8wAphX;TA#vmX~P}U@*I$&Z0a6>YLx@X`|_(crdDzsG#Bh2
z*nnKi2EC`?I)VwKsIjZNL~DB>vUBe#j&`U^{=mk5rgHiK^L$AZ_+YiaaJzT8Cdu{{
zF)fD3{;lW|(TDh_ycovkGHxgOov6NYd_CaqdGQ}3I_YIkY-wA(7V*Qb-Fa9YNBsrv
z4DD^q!zx(PUd#DC@C-S$x>GZz$mXe6M17SqZVX>z__PzxTT|PEDW^Z#-1OuJDbg`z
z;w;<Ans5Z+MvvaOTB5_i@YmmXoa)9uXWR%z%}_n+pr7yZ@NunDf;~v&5Jbg4!*u)I
z!N@nHm{Mr%l{K51Ne#;WJf=bM3dfj75m!I(B0E26>t^Et@X1Hg)#kGo0FC!_m}x1O
z1W*S2z$|3%wc(Db;Fipqf<90QMVy1C1^hNWzKMF!rY{{HZkqQMM!)y8fL3?hK%Vq#
z-JB`2V~ew72<@8aBA7}rJsYBmRTcEQ#3AW@i&o!%avOU+LXRNuVzs-2mrtvy-*%6F
z)OfC5+y0rPkGV!9H)5PLeyjRqK6YY8KkQ@QKMh$CLIe-}t|u4U?^a?v<JC#wtI%z+
zXQv4c_5o+gymS2hL!L|+RhnT~SH#r;6WbpMd+mc4S>p2k4OCRDIXL`+d2g(yr<(tK
z##P~VCh6im4mux7koT8|83R1BOMniU#;%D!g-d{Lo&MGohu6@@Y2$%IhYFQ73bC*v
z_fxFFY&>~H;y*tky3`Q{9_OXq{O{|ze(0K0mrZJMnt9`{+9JqB9_~e)qDo)s;y#$s
zLNAC<T#>9vxmFm(>I@*=bC&&eEpr1~m>&{YiA+3ws*j)yG8}Z^f?tH+nvjH(F+%1;
z=cJc>+d81SQwH8WSgf`ZtQcgQZl4VGJEFvV=3gMY7gUc&ba=vC>nW@|aPe+jUriP?
z5$kyxo&i5`#QN73gg8~{DOrf*#9({i)s~Sp$MXrmw;qRhE&FvFu3#snRIY`+%etjK
zTr5(r?H*?yVM0nlP3_YQA^D@z{Bhnk9uNV2oi4JsCZ%}kNs~WsireB<P;nuBwqoV7
z9zuO7KlMVG7;hY`l52afpKB(&1}%nxpwUw0X%~T>p?=<ehHUM(2VFWRw3bS~J(mh@
z?t$04#t5lMQnCu~Wus?I!cvCeGjt*m%Lpnaqen2BnBxoSh4WrKEKWH;Bmv&$!q!fR
z9wH+w`WjSgCNNt#Z~S7X;kEurQwwygE|0P#H9Z=}VG?hvYl~B>D%7E$7eE0S!|7G^
zO}LWHv=DqzMrAM2mR`Go2dd3Njy)(E_d@*FZ@S>uAMw`j9GA#$fA-5Oypw<1QyaJ_
zcVx(pF_>v1^+*Tk@XXsNp1hw0`yHlM^!QMh&(fl_jr(B1?9YGR9=Znrk-ITC7iA;2
z;e;ewx#3{<cH?SF$58wftT2HC2b@u^4t{(kZZj@R>><BHBr@G~rc>Brw9wyM?78bn
zG}pl7<qW&TlM&lvbIFu8$eMqc^h!1MW=?=N3$H2C%8<vhW0~MtJo5*c;`%c4jotv^
z%g{-<hKx2nxBv_EjbbB{7C|QdYV+m=#)4l-$!o0y@x!K9(SDc@X*DYlwTYmmF!_)H
z(pyPmD1$*21&um3Ehg_f4Wi_$V(f#{*iAt;eTZ@?Xn=1sFe<J$*{BWxgN;#Q11EQ5
zE)lC7)szJ;o@LGf=G)$!XF)CYv8NtS$l-t^>AKNl#w<FBxUBa%MGo0mKY{g4si-v6
z>$ER67*0184KAU{pd@IUSN2lhhk3`=h86OZzq-b?3aPqWIJAl;W-r#DVz<o47z}`A
zGFrQIGuEUUl55qh;*o+FfmL~5Hva@1!)6*7$Rc)iKvA=;Wh@mJE6L<gLoC*ml#;`-
z-$^{Bp*ZyO07#J4%jPX)(!Fw#YxCg_YL&_0ZD}@7!(n;5YCSCG2oqu5%BT?xJ3EyP
zuqL9XP|9BKbw9RFn(c0^4-i)G$f7Hm#p@<r^8$A8CI@#DNGoVHJu)i3qIbA2bi#5%
z;ViFD=&31N5S@7DgEJ`?O*vQ+2;o|LuqcHk5=P=QST}RYnq{e$`Qq69FE?+0<~(ob
zI8=efI9eH;-@X-pXrfqdDE9i+eM&%tVzF#g1$+CfGkk7<Xi5Y>oP;IGoQA>VaA%}!
zS<jn!F+NwHUU74FWT5bl?>0QIXns4j<hQ?N{Yt%1Zh!;6*juj?^JlE#Shgzu*!G(l
zrvV7+Ws3u>|878gqzGq`@O4~)nZTYP&1DN49JU3o2x<tw*-YODYpsd}*j)uU3E^NR
z_%ECX<Vg9C@u<BlI#F<*GY8uZI=F`HW@YVBhA2F_gg))(G!>b6e0kCfaTMno=8nb{
zaNJjzn&g(Y5!W&$=!?xWyCZ6_`{$%1lA<ubct-i=h*HmH;IYf8b)g!yt7d{z3MS_u
z6Zy2*(5muDyT~SQikc;Tm>;TK;j513wl^5cqUUb|UKn1|P7T{z&gZ$2(Tr$rw+dB)
zu8Sy|aY{v(nzmq(7DXwJblLabb@sx)Bf8y2J5Km@Z)gKjN^0tqH}s=SZYZAeh#%*z
zo!Tq2H6*8*6Nas21uL{WLW>O0I@1*rOtvf&&p#&9S+qFh2d!=*DuOEV!Bw)Ai)s`^
zClDKCuJ)4i#iDBcg#OF)iZf={*4r)W%c1*^*w0yQ;X}<nGG-=}+#U$D>#i5ML_aKo
zT0SyQJuoZh743*8(1A>yyBy{0vWfL&3L7NPI8`1nzrw@agq27Lo6?32?Qn6I*Xy2j
zc2fP~Q6JQ>qMkx1eNq-^hgu-dneG2htJXw`;Wko2-JoZ`jai*!iuS%aa}X65Hi9Z5
z-Aw6^1&(4J8BaB&pI=C{2Y+5f9my8`y#6rh*?D|fU?m1<5Hr?#;H(RLC;spzRv$G6
zvOqFugQSZz9YYgh#sX#_&<SABQ^{$1D$`eGo;#G-zByJi(nS~UcR{1h09kfw%;%~z
zXOjVhKDJM(n)Dk?PhjRSC5e~kzctwNEl!vCtaB81%&TEJaNYreI*#$3|KcWlUyPCR
zSo?k4{4<~#p#z@e6I;RiVnjpQ+ylE1acX8ccEg#(pR7N>;gZ%sGNQ2gv3~!2%a4|;
z*Hs^trqCSm%gL6ShbT1p{0En^g*n%Ry-drw+_1Z~1c$@CLmSMJj$5eNirTjuVq-UC
z|3V-UGto}%6n*Zfinrn{sI9CJmW@S<I;&js^ETmX&YG{-pClQbvH=s;uH`TaSgkT|
zP|>*k@k9nrWvHm=9+;EQP|DvK>t#H?^Uz&I?Cg@L`FPwaEO1ipHGYcycS~scp%g;c
zVl<h*``1<sRaZi5mN{fi(esRqHpZqr11N$_qoJ<px&_v*mhi$JM#4KBH<7tsGGd&3
zcYz9pwnVc$pnhFU_oC5Zm1yQSfEFvX`jGzo;3xN>@~qPj`Hc)rbi(XMJPZf|ls>!F
z9qyW8C(C5O^vkqEIPNS9BHuV+6s%(|%AnIT+a|~W=Vm~5rNv0-u$GT(2!<>F6iv{c
zDmrPU7Qu|i7o>AG@pgL<ky^1F$L01E2iH#f{RbGPKPYy02uQn>q0`lP?V~iTEa_F~
z*5iQ4>+q7-JEjgRmj~K;v-Wp_(=@l(EA=s!b-9=NbXo4f>S+><?8gl32)Q-`_C~M`
zO>~RqZSE{HUagki*t4IRDB3AHPIm*gBdjRBt`)eET?J445;>L;tc@$r%U>5c`rspj
z>8g&D>mz*$A_Rs;$GdA5ePHm%Ez}iyv|>2@fr<ozw=5H^S#J&i9t0?$gW+AnwA5pt
z$|2SYid&CKT2&*^^(Q9a`2kspb8>f+%=E0xKsN(X+YtM3(Z?3F^nIJEGaZIdJ4SPa
zBF%7OSt*j#hnoVUp6j2|2v2mJ7FXSK3}2<%DlOZHguJor^*`YdWFZbThSQ>AP4F6F
z@S0%g7e%5RIvV%xxmm-zn#tI@P23nY_~K;Hsx3Q&eagtoPEljw%_4ligOGVhrlW7v
zufrQzhGuxVLuBBahP|YB?sC0|HvQH^|I?8c=JMKBCXE!5o#3bLSvV7)K;AThcEC_R
zltnXX(4|Uxzytf`$trL^mErju)eOAI$rkrL=y*G}_k(YECQEQ7=Q{EGm5+DR=12--
zmtP_6-2iLQzFlpv<vv7Qe8@zoc}+V*iv^j3!!;C89oWr1z^30e)Akw()}Ue1eqU<T
zJbPUneMH$}XN>uzfu_Q1zapY8o+IjJUxzsD20K&nj`A(304Z!Ez$#>!-(Fx*9BH<m
zW5!fm$Vc{TOi@9EkuLntHNB0&4ZQ}gHQWB-M;Dy)Uv0;ZKO{G0S<dkHuL$<xcQCwx
z6#LTOv3c`n4t`^KyA<K=H<HcdhcEZ^%-e)#cogAR)KqFdUC9tvd9Qd4jOvI6!j6+0
z_iv3Iw>Sh63_$!8-MvsM?E(nX0}?k+Fup-n?U_zNg_~7l)mPEjR45UrRlEjYw(o30
zLwF)4{8}U0jn<L+2R;o+yH-ieV<U^*20oWG)ZAVRJL(859+&0|YMT=3s%h*TI+D{S
z_*-))Xu1Sr!0V$~0Qe4Xw#~YAPW4)9=hWA<sVoHd`pTNBuZBJmBoh;BQb)sp?IL-N
zq@+6ZnN4pra35}zO<0pclZHz{A^~}yOVWf(x73DU6Q}l!SC%O=-201fX_{t@-~62F
zp`SkMwtQz1rrW<_lsMobHy+DNJslV-cYjD|3?F3x6LGmJhZ_26jz!63qFvJZ%2B4$
zE>y*cJX7qF^=B2GJ+?-fbk<YD9g{SOeGd8E%G2?Bu<)s9X-GC^MP>KWfycz@l?|Z<
z<J>T!RZF<QI&=1Skg=Qi<zhwls82Ab)kRJZd*R72QXB=BehoAxCvj(9S-ds|LvPL%
z{kvHa0v+8M!|A<Bd(Qo>I`#<V2qU#}`fDh}%T!(HcF1-2FXt;((MdYRIghM&NPKKm
z7XIL^FbbQyLJJdj5i%TKAW8bLAYC^Gl7T{SrA9C#U4&Ifwa7f@f^LrsQ-z*?PN}D}
zUtO$PzciyA6GJfT&$glv=8u!CBjg+r-5%Us<qH@Yb*=Vfe%ifgV+diIk}v%7#sqY4
z;S9CTu2xHDs0#p{m%GkNyuY1ih1Zcxn>dgJl8wmp_6q6G_ozo6gn3KN^B1Hh?JJZq
zR>UfoJ=^iKGDOBi#Ny*$o_^w_WTVB5e>V!zT@1F*3!3-4ICR3}T<hc~7cbNL1fxw+
zV=4|a@&~@Tr}gT)c0LC$Y(awdh_(a$JMnp^D|{o8NgzcPe`buY6F{FBSvOh}Zn?4d
z;rS=~s`F9Oc!2GW_!#gP>cZ<jzGj@-5<WH<xqhh66o$QsP)~)u3MOXr7oygL0OyP`
zh(U<e5QM4GubpZ6*;u5rI!I`{ZYgfNxQ&b}jAdPHi1cL2hbUxWR1qn?V4%rfJ_XwF
zB)Jd}6Gn#p=KV665(eQR&I)c1Pk}07p>0GiTXQDT7t<wTep5j%1g#p1%^jGkdBTYv
zN1aVlpVO};R|F%L1tx4}_TJL(>cnf@&BTw{1_e^NK}Y1C3H$7M{@2V-ndrBPIrmsc
zOI`3+MVec#^h<W`e%q6H9IgbK#yS=XgEN-rM@bBySO{uw+B$V09FZ<fA!XSOdme2k
z;04VoTW0zZ<U~h!S9o9x4^)V&G$%K`68J%Z-Ih99?xXC7D^=#%^4=DGuhaOak;8cZ
zgA5f1x>|ROuK@6(T)8L6`PoY8+-dyl{Aig_y%7{WuU%Z}1(+TK^-`Q;w>WOI>+tjL
zGEUpnYjIfB)S4@gJ_Ibq4RZ(^EG#!E&}!@y&bzDtCwv)P#A(p8m`|r8+rS0e`H><C
zS50if_*(oXBULT;rcGNOrLiq=`RZQ2=+x*(T6)rJs58N(jC`daoV|L{^kJBZ0#qcS
z^j|1vcZ`i@cqSO3CtQEL@Y9Ds1sWC>sgM_Jqi9O^r#oxRD+BAT?cFAlyjgOD<C~&)
zHM|uo>SB_QOqSQO_b?P$40Tkmu<A3CcWd0)6;eUDi}Vq`f8Y)-b~Uj%A=ZGa@W@YP
zshWmx%1+P#lMFvBvSH?fwcO)!tppa%!39N&8K;P7sPv6#rFHzXtJA=$8fsNP>G#K8
zt80pYV}D<;vGJ3fIS^+yrYnN3Y|T9ddtB*kT$<9+Qc0@`|8sEV_b4d0wo&zBLtVkQ
zACNi>QiM{laa7+q8MVCTR`@(vvJ!l%x!^eMzwQCAEi1i?@hO%$5R}DY>R0}yjkR{c
zH8}>#e~jm|JEKU7>;iW!Nztw|45-C4G>x126QX4rP~9PVd_!DTaOj`bC~vC1!+8GV
z9noi{@541NIb9qd;(}wty;rWvLj|0y2|HIjE@eL2e7EF_R|&XPzx@&UjLd|H_u)iH
z{$V+&$R{>jf>%nQT&9D^rRC23CSQl`_wO=pfj{NKnz<u8nJB46D=?eWo27B_JqK;s
zuRFcCjCyOM%5LE2^5>MXL{ksl+)bgxwr1ttz{7)%Z}q}_4VYDy6kRU`Vi#jY>W5wZ
z`)vlNe6N9#Mp%Q-1QfoGTT6&Xgec-#_pIGNN$aOjd37PcJ!p2xcy`sz>RY553bZuQ
ztskq8xA!1Kg2v2sCuZj+4Ok~4i|~oof`^2>#$~$hk}Cj2s9U}v^38E;<;FYKTUG@>
z)FAH9d%YDo#`$=2z1~Y>cg5j;Lnt#L6CwLV^tg1EOSH1ivQl3=VyG8^**=o?g6nB7
zZ$QwB=iZdc6;<&Tzei3C!kl0Ofe5!l5y(Z!Gw&BXb>c?hQYB>*kTU@hWgtqsXFQ$e
z`&N<lc|~~S@K7_x&<~<7Z*7+?&kmY9V8zZ)jC+sP4EK2S)7P2|S-E+I;gi_P$yr?A
z!Jx~sMdNcCYd5>IU37ceIhHEpdJv<aSDFUw=t9Tcr~O)C#(J-HM{)qc>kk__cXx9x
zH-VJvy1D2QaA4F42TnD~N4V8af5<Py_SGdsi4DJDSE9YL28aO^xx;$VWBt>}9P8un
z5SGxB@8{&@uY2fAsXk*ZKdxDTpm}w5TvpZ5Ve$p7-Yewdy|+W9%E(y!h+7bIG{IOH
z3*DN{vMlbdFRgt@_bW^T9GtmH<4)gH^(NAfiV{BdRycK~L$7GZg|?$xb?L(Uf0M7B
zo4=qDDYHX20-wpzbc4gg`Apv%vK3`nt5(iU*f~Ji*PpV|S%d}d4+?bB^);2@f6jjt
zxwGl!#o+=T3A&_vc&g|way7C$c3iwCJ;Z#xFn(qwWp*&;B)M2AW+s?5xcDkjkFqwD
z8z9-p5gP+jIqbAL-!eElb7Cmq`N;Tqlk?c;N%rO@wdAWL&*#@rLvPx%>tvd>_CZ5i
zUuD(W<*FaR$dOrdN-zV_ZA!BR3w1u0bPI{`H~HZVBl63G>DVeGc&p^K_q>29Lk4(W
ze&ekm#Q6gEsMTVSLXo{tF-ZtQaE)9EXS#84=bS3caE8p{IogPABCZ%5-}ya4qU1{3
zuraMg$Fn(2!7D$HjYP96$UWM+k+hw3%4EA1PonqIV9<2+N}gBGnNcUMdFOLwBAZtz
zeX%XQP!(I-F?a|;*xeQ}f1NtF5n#HaG``J7oSou5GCu3P?%9>%k@I;oUhGiIuz}(f
zj-l4?goRIwkf1wmd<44Ez;L#bmeV@|G5j)XX`OQ_)Pjw^%f=M(t5VPAaRr!RH}4`6
zJnhY{Egaj*C0#kNl<@tq(}=X<_m+8lzIrp{W~{mM&r>L*RKK&vFmkoxW5H|WD0y><
z(m5*IQs-P<0d+;mERv{hjchOlQV*2i4;Z)*65&XZDXZy1A7{^QmLmRmD;cd*wn0{9
z7NHyq^o|;qXy8_0{bp=WJAFu_0?jDK8`_~pYi{*0Fiy|Kv#+iF!dAD4ly|#)vJ`3{
z8tW>nWfLIpdr@*vtJlNsf+vNw6qURIzo~%PD0@VP2`sc(Hx(eJ=idd>g_!EYR;@8f
zvYSj7MDONhd2HSxi$yk!XG^)ed}DK?D9k1tk(_Pvs#6+*r{qqN?Q+aBWWbTpR(f&t
z9;HZM5-lP}W>MnZ3;7ieF}};xKVPtd#L(C2Jo7Af+BQCKU%0x}HKz<*K_|14SA_OF
z40CtZ6Wu+9WbwUR6BPG^wT;x2qf)(l&(2X<trZSOwTEtpp0Lv+$RAFYA$L1BV15f@
zn?7UsTBQ(E?Hsl&dXp#OW_V+eel@V4EY5gr!js7QBT5`0Lg+d{umX{u0q-ytcURQM
zF)eN=QsX##bE0X&6}sAhPlp_)S0PcWqdQ13g{#G11#{LGw(J+$)}?^GXz*UIrcAEQ
zmjz=`ZkOtZcu|1vsJTsRuuS0|bQ~|MNwS#9qA^EN)yUa3!QaLstb>-lxPx5RB+A_=
zqp<c$QjazqI;7_&A<}@wpef#@rO~6HDc66{vzCrs?!7<lX8Eni1yyC`g?bEd2fR!h
z&u#Z3EINW&e>7YVDyV5g{b1}WjMk`_m;TektZu~J>gH6-H=@eeZ{yUSha+%D1aj`X
z9`VF)SOb%8i28j)e^y=<Nc0rb#=Q6ra;jAkiUS_6>zs<N#!j<4o&&3F(w*L2WsG;e
zTu^1L<>XyZ2WO-K3bxJT#IH923Y4aXTJPR^iB}Ls)$yvj=g{p%K&|5b9FmJvSYpEU
z^N^B1{+{wcIt246S6%mj2GB{IZ8|65%^cK|@-aL1Q%SZ46m*d4s56;7_Moh|3Zr;F
zH(|kkaah)7V$so<D*;Y$(|!1q>4%caa|yhSMn+4Q{AZozVQ|hLKXhAC*gBKM@HvPt
zFRg_u6@@CT&l9I&n@Jth@P!&M@=HwPzI%h4E&IT(4;JU;53*+qAzLoS97d$sp5<ou
z#@IoXYt`8JJn+5$@iTYJ+2cn8uM_V}J+hYbL8EU%0dU)&oqe8ouGhS9ZUXmC6Ils3
z>->?JiFP@gd`sXqb}9Ye7~k(AJ6!-gnfRp&AhIm9$899_4pU#uz;$+|9fip_**0Mh
zQqt{KwNjDM19-!t*Zbo~ko_jd{*kNM2eM)KZSY6p<Kd)VT&2(2ZNy#9b^AU*b)&Q4
z^LENX4iXv`$5QQW$qAC4ci7cP!y{g8-}+gFzno~q!#I~sGC1KEj31(?{>q&({vz%+
zA4jTugXw1qDUpBs=en9~*rak^CeVSP%5|8yvXWUa1k0JF+LI%P+4K+8!$L{h_}Y3t
zYF#`=gTCf%3=NwEYacp}*PApiB_l@RPJ?@&4CYOLGmDEsLH9zRVTV6aIBDnF4?dy~
zc}g1e{i+${A6m8g?smsaTy~X3&akm_*N+RD>dVs)f<T7qcrCm75L{3HX|j~p2Vc2S
zL&2V_Rs6UWPaa!Cz>eRsH8c~$@4+@V_d}mdEM4UYF48!CiR;wOGk{!1=fkLYq)eNe
zdyV{OAH=RMx~2?{UMlL2*-xPh!=%=z>g&p4-72hLq&+<@>%zT~IixEzdjMn4q(~j4
z5{i&xZquB}ZQ~zj%RM$ypQ>USqaTo_CNE2@CHo<$nyKQw^FtnE%xKJp!L)29M13(i
zof@1#bKO?gn5P#Nz0KRG4{$@mVw#21GdH)MKut+K`G|ucv1N@AGgckh7&_cd>J7Xl
zsPS|`q+0az{qtwS8_$Rtf~G4O82fSa7vAuK|4paYadRi-p~7%h0IWBO-LAGRLUBos
zK*Zc1w3C<Nu0AW#KPoLxka@F#;Lbs!KevbLcT#@$?4p%yg;sHZNaW}H0&D)vmW}HI
zH}d3!vF$S@u}dso?#&uA&IOk)0kdzGH2nEmy}+Xnom}a3O=iC*l{-Av)xb6CDk34+
z9f#Uta`U-{tuAv<inJ6Rm4%^ZLhm3NrwcoS(6rs?D~Z`zi_ZHxHKdPdA`4@E=B<kZ
z?&^Z%nQXa|7^!pdi}G5W%M81E@-^E)-3p4*6L4Jl67PWt|4evy_itHjf{pGYH|O)$
zNZL@*eiVBuAxMZQs~$C>T{8NhBUPkahMdx@$<AKosjfV`$HTfb5cWgZI0fdQJxzoV
z6-Mx66yxJW@_LpTDK5^1QPR0kbwJ~bd?CCbK5?|NT>(*zX^n)U88K|9nYt{QCwa>#
z)}7fmHjPPL<DM05N_Rk00BBude=O^9Ey6Unb5fi>tp~HF1u^mzLLun$xZicJKSPv?
zI>F+m4{C~Ub+E5f>sQAPAQ_<YhV!iv6OXyYN9%(-7_NBr&@S9@z%{;}9oZmW0Z?f@
z1^3<|8;*wEu{v)U^O<FYogDuoiF0U2UmeqT|1%mPqT)55W&QX^2iL2j!^or-EJ(lj
z;eP#1^ZnTOqExcSH?PkTYW#LF;BY_IafnE*nvK7j);YYq0~Iw6oh|7W?TgfDJKT(x
z)vHup&ibgZfi)98_cT?6Scr$GE-MdLfVYeaWE42fy7F>Wmo4?jrsT;m%_?Q!fLJlk
z{-N?TMZ{hu!a;(cB*0%iKXdpSeMB_kBnCt(So4~0@_z_(FPG)wsL_#sbi=26u>U2;
z`Ax2!NRU(@Tx^=MsLx?82saNxX1xCXNi$BmX><XIuey22xBp|s)&rp1-`(qm`5|uP
zcLuU(_?R9=h9qab1J)a7fB5f+z|TtMZ<0D{P*?=5Q^s0YZ3VL1rtO(6(`h*xLEj_h
zozC`5$pdduMJ^{*UW0aMvc{RqUYE}MjNr#vw4x3dc9Ex|fk{2%0oQnu@F5E&3RiwS
zRc_*(`yuD8KZ4t8pOmNtxsTBhvrGF}wLa^F<+Cy<71ooGKU_ZHJvewP*{oA=Q#rD9
z^4PSYP6WgTr@|b}qbPPo>W2z{XFEjh3Sn!)@LMShTCn=Q=IEnqNHZw!<a6@9j^$)Q
zS7X?9UXShGr4E^A?{Qf;Rid4{`-x#L<)!_2HXBGUY&c{x??q{)wMt9#`d{;n)Bvk!
z#etZsowFEl-d(bV2w`?In2h<2b^N4Hv1g2F6}u+pj92uT*T51=i<v-^2hYfts1z&w
z33+RR#@`Z5Il)7dnyn#MF$r%lFs1u&4tt}ZBU)g#7yW*cD)Oq!A*Jp#*+@1&WJjT(
z%IWTvP3-Qy>OALX?@N8m%zC1$=bZyi&(6-%2Z*84-ME-%W)N>di1D2oZj!Lo#M|Ps
zkQ{_IUo7KDj9_(hccoblYks}gu<a6!KazQBg;)OzRY0o0XEdfBx41#oA!gQU7^Vt@
zb(<|b|L7BRJlnYQ&2PZU+&nSw4RqUG<+Wwtw>U9E)y_4qoN&s~d4>K<nOu&TcM~Tc
ze)QEx-}0>wmM8NkI*k_}Y?ENv*KiO}y_)v#&$C~)ucg;IzBg9$%Cb$XkQSKCn@U^t
zL6+|u9UF(I^Efn_#pg~n6v&=m>tWRq>Og<+Y!gqMZ(=~8%Iub>_<qd;?zC`mt&97g
zT~!So`J80wVyu|<5)|C;wSQYtbwE(;2VqAAUT3%GrbKde{&e1J5iW<hmp8c$Oyk3y
zU*wjhU8TnQh9;LoY*t<}kR>iN?h;n65t}9vT&{L3wvZb)Q)n-xqWbN*r}pet^#+zs
zpTOMd^Im3`9r?A?BYJ}i!LSp+2N-K$69X+O&DHT5KJtFzQiPm&rPwCVatQoN+^CT~
z(?Z00y^Cnka)gD<{W6(+norKo;QX^E@QL?-NPX{Kr-S`RZorQHyJ?oyS82QI0<zxl
zzN2wPNGm;ySD@QEVc?8sWn2^C+%w1U!C!vQhw>HVGlk5{s)p^$j?ogJJ+j`l3-z`g
zwg%Tr9ct15pAYK<s9cAZnP|{1T)F|V0|c_C>wQ)7keQcR$bueXtxX3m9e4(T^S;SE
z78`x65wlgy**my6LhSWjQ~|Uuopj6VeZ^M!5a(?z5g79cXlQ48pFoy9vJ>Tu^2y4v
z3cAFOIK9>pA~s3Z*{#&9Tv4VgN5!aOI_F5Rlrh_uwgO#?HMI9d(4|%eUSWNip>28J
zd#Fd3)_Q!?pjxCeaI_nw+)_618SQ3l7s%z(xOiqBYqXClI}hS5-}lXEHG5dAx6r4l
zz0>c)WYDt*>ThFa`pm<RV|}@fQmw3jh^2wnMw0;OgkrF~34U#LVTo918`*p=EDR$q
zS!Xg9HH>QB{2OEmOq;891*H7e*wmzAxff5I!qGR}LrnU5mCcsP=Fn+0RQB4HF<Ti_
z4HNOeD!o^rzx%l_Jd`Po?R({s`wsnCbJ>1T^B5B8;A;f5#1j9YYs=RxHe64i;rUDL
zz`Er!+aSHxk)FrgZTG^qEk0?|JT)Vf+~_)}6S7`EQ$V?#!v;;|&#bgz5-4+jt_*!{
zqidr<H_M3!aNPDcYP#lC-BPXxM{23KQ7zJM>d4&_8m&HxRhoA0nIfQfbL1m=Ix<?v
zAgII@^Uy|vV$n29jGE3zTDE9yZR7|Kt(4m1s8)+nL9`gq#yzqDz{Ub>`gfEgf?#4)
z9a}jp3FtglT!L-!e#&OKm`hJ(clDhtjKUZu_Uy;hzWu07ZNo;#fXEb-mTGm|a0uWW
zRn`)&%;Q)d1E!gj)mJ4GRrg|In><@lRo=WdGFKLX(B~d9@_R6l^F^Mg^9yIs6Y#E~
zRIR9>+Un9W?)la?qkeG#i>J;ipYG7bNM3sTenz8+5pPZz7c{eb`qK{_xZ$2Rot?dL
z{IS;RizgvmO+fpy=@~}*^0jn;J-`*YI$pFtC=|ne>;tc?X6w@Yu^Szl{^U*UAJ2k;
z`V?!cG!D{po(7%Vu&~kSs`YY^fjx_zW(U=LT4}Quoj7dw;@`WNG1N9qj{NdA22KcG
z0ZR)XORpn?^m<?|6PWMYUdHTAyK#ZoGFSEze&9<wLE&xq{lWO}^m>B%wQ+4<Z|2AF
zE9E)S+N$32aQs&1(Y{=YxjNxv5%dvr`*``_Xv*+&`eS%LWVM{vn@jcB(wZ^~55x^8
z>=7nnEoJl~Eb4Fes$a=q8}4&Q>WvlM-^%TSCW8`|0gKf>r}r6yR&Q8(eZf@kwv84_
z<-B61waE%vbS&(@ewSiwU%LM>Y#TR`vFge}aPGu;nwh|DU$eS`+g^7UG06@VFDzna
z*Q^5D>D@c<nGb&yrrlE=7o^Iraw6KXjP&8bCjG+1kSOjJ>6BsBHzE#$UQaD;(M4ls
z=XPS`JuIHR80f+AS_hXZk*OpL23BS>rrUpvx5I_#mrk9>t@nLn|HnV@?uo{--R!k{
zFG@XxtEp$$%Z1UJG$ns{t!o$7yP=g!Z#$zWBIxn~A5L7}knLKNg%r-M^>LA=_<YFc
z2~-aen_cPyi}j9*L<`fM1RHenSv^bj2jhxy+?r-bIgJTg#{w;z%4e~A-z0WcGPtnN
zRO~tk8X;_0$bfHnwk!UAdHU)T;{|L#xDD%sklg*&Z+9NZ1wsV&B*&8rh5}(Ss?9o^
zoH|mU65<k$1C5ay5!t|#OJw+&D4Ug$!X?AjuFcwy57#-6Lx7{J(Ie*Aa)cKl7HEoV
zv!g&QlXU}^+}EqVRLA<tnvxAzD(KL3Tx9aZbPpgmK8^JzR7I{-p{8y!T_8rBMziJ6
zv66zBE2B=w*z3OI%}8a^ID70_&JmBag1>^<d_>Y2sh@jAZcNpELn2+wtCEgZm;08v
z{mS@zY$<qe4!ODsLH$OBS_LN`e#9)*cHesITdw~=W9h|_5UwUho4VFTXl3Ox#CyAz
zoZxINKfP8ue(=i)N*;#kwV`j;@=|I!34uYA176op<<TQXT5k`qu-?O|6|R^hJe!zn
zxtdHlsE*}vwn-pe&Y;BB8)C$Q4%}>|fXYNkS+<r}n(8|#koD4ddAs}?Yq|wGftwvm
zy_O?5tZo}aVP*_xh*kIceI;So9uT?UDFR*7kx@Jd+ib^V2E<8GRNK6~09FWWBZF6R
zi#;SaOB|3R0(7InFABK&+T`XTG<k{enjFS!fl)R%8L&7(`z%YWHcuDQ<@r?=AWG-b
zsuscH4=$?UP_dMEI}<yWVz~9iRkhE!c5tWFQfafjb{FMh8jVg0rS1D6+RFsuU35Er
zRrde}F54X-N7~=S(BIC#A_v?W%d2h>ix~T!BR8l5<MYp-R;3uP809%g3zyNl@~z9v
z%hMD1+jsx^Tle2_<oovCvFH6ur`oD9>9snpdDj8$-|MBokF2yU#qLb+0JWWH3mQk0
z3mi?K<>h9Gi84q(exZ#roeb@PjlN~8^_^PkASWERowRpsWeEJ5B85&WjaoIYij5SA
zk<9lbE;_`Frz<L5wnqTEy4F#Y!{n+<ba2<`<eDXbX6qIMHv_FjQ^{^;fL*&M;EYvp
zhS(0D2%KIkJ+|q@fXa!SR&vPV1w<1Tu!TMw1z<U(tIEsrzG|oTr7}Nd)Y2uk6bR+!
zfuTzvk-W?jGa~+pt#nJjBRl~Ndt=ktw7Q71-pT-5s^pdCFTK_^yj+SCP3WfdTbkOi
z{7@aQ;MvEYQSHcc)p3~B?a0^0aMN8kE9NQfD@zeZAU*kshg>9l5G{h?rP#8UmuFmD
zc9V7GUDqG<91zYGpMMge3qiROEZ2#UD;3agtmAL~kKcNqw3x(a-3yf`H@pzHt7%;G
zj5ckE57j$1T79pGx7zQHR=2<penn*iwsX~p$#UT9$+?bl2yg>LzRIr<lWh=4-oB%#
zin=^_u1U-?v`?{#oDazktt0KF^|B6{HQb0SS9MYc0x^VIDXR)654`kUPH5mrFl)UX
z`p%7JQ=RF%56z%nD5@eeStSpIC%hA5r%tRc*w9UCtXB8WZWZ^CdWErQLV$>4TfFeh
zkjGVOty{KeK{F~rLIY!Q89=icTiu)~$A610TJ~tI#fL9pv2_cKEKD<W5s|*m%*h7@
z_1x}vAW|8c($B&+bDH;8TsFW$YTY~dSj%LYY!X{-!&LScBVwfE+Q+$S33I2;;o`HW
zVA2JH57}<BqY@@c6E$^_xDv2+i-IyKp;=gOfbrei@zke2mHx~h|Ko4H<>%h~lk1D-
z6<<8QUdA;Iw5AY0+qdOSYh9Ne@?jLV1a~3<FE=LQdRRH>AjOV>o}0kHDYJaxH-uEh
zVc5>aQ}$=-eFd1Ad^*$&g)2)KT4t8}x~rWU{^Z(mQ(pJ&sG`2GhI4COWC@^qJz}qL
zBecElKm{kZUpGTjtuZXDwS%-@73_fv;Civ{z*Qha_T~4YipvHgsx8E(n=)dDGGh9y
z9Kr13bz;Scdb6W|Q^ty%h#^@bI(;9_IO7^?{PR+iRpX9>k<@x~$wFQ#!wf^UYp-1N
z(*8oCeXVsH`)=Hi_Ua-ooH(Ph!{Y0gk*>UMM-Ao4Wssxei;t^jy^e0Lfg4_RHyx)o
z&OG@foeO<+ys`tqQMD1=dLL=dG~;q)+&Hw;!}f!FQK*!0><eE)X{>eyEZ6JY;DIe$
zFSzYaZmfg{{@*|Q2{UECZ}q~$BdYz*3lyOL!FT^p3DCX-qe5i#H&&XqN`1|;%fPd5
z#k(Z99hKb@hpfYHFQ>539C$6m5tzT(-o=b^TP2NkTcBaNEHouT-79E5sufsvvm;%Q
z^&k6Ya+|&+r|)tB8G|)D-VVLrrz?K7m<D!EB2z14z0pz9g6Ubn0w(JLkE1=01ioa<
zBP)j)?ocP!n5}E8M1=r=N9wbi0FB%V&_)E}wpeHUyG1g+<Z!TSBx@e}k*)v(F(e0X
zH7&SujMX-fri=UeCm%&)Wktycy-r(oWnjzJ+R`dr@H5C23&cFr?u^NBJ3ZX^%2%MX
zv4-Pce3&lYJ>2~2J1~3QAw2o{$COmD@0MFoEa$Lv?kr9}{VZxzlV0%)I!D+kzzH$!
zp1O+nI~~j(+=sF4+t6BFQza3vNJ#L(mgP1}sFdKP^Jnq-|L?;euv)DfR?eTNza#&`
zfNcV_FM(uWia%`i9kJ2#Tn2s}13&l`(_{TWSen2ur;-!k*@WC%-veuAuj@n|`_hS+
z?ESE*Ucg>xmGXoLN~d^HScwcB<m_1JI09pYu-S4RjlM*s-^G9q;M;EAjuj(|=a)N3
zNhhc-rlyu61l&M_9l>TDM1x?CUgTSDJ~5V~0$tivS!h9)VJ0f0-3Ro(j`DH?VWZgV
zCf`)QP;9Bu#yGs(r1tDrGk2AnNEC4$B=&nrZ3ZwZA5Cf(umMfyEjo@0#jHB8ij^YT
z8!dF&UA*plz71=Ob()dUF?C_dYhA;!ff800*U@V<vE%w1FtKe+^(HHgjjIAP9B{3h
zT(o=!(|h-z-|wS7zo@`Y4X))tOqgrg=IDT*KXndkD|J*R#?dx5+!(<XSq6Nt6{;pW
zmsI3<MXR}X{f_+yf5MT@?{Yi!YfV46CV`d%V1z;6wc4=*@C&S5F<{jn^8w%NJE{s-
zhP{7&7X`R-K$#BkKCy(AdPjjVPs4PzOpNFTD}(moBFLCgK2X=Gu96;ZJ2;7QTHukE
zi3}ZtH<W-jf$w8$4n$)aPQ3xlPAGPv{Gbf7G77R%W28YLnHW)XFx)R}OSgfPqk~!+
z3ycKBVu7r1sz0n0M{Gx<0%1~)ge-A6fi)S0Eje0V-I`+#3){ipEVpW)E-%66V><Pg
zfZ|KL-ZnW%CGu4a8aC49GQQy*Z^fD8r*Ztzr%{}k#oXC-<yi2OO1Qcga|~v{ECXbV
z<1o@CoPPXq`pokLx)VxX;4HLfAAVfb!9DbfTj>0GQUNOWD9dnH2HOQ&zGnv79}pPN
zEg+q96D-7t(wdh9TgUcf1cR7*8XHRs$QMe#oh=kTur@!x$|WAJrEyIrED)Rh{94C;
z6<6l+B?AsHu~myJVg;QO?681L7$Eb@AiB@t1*q7o%F`>ZU7HQM&-!dNEcoKT>}R|9
z0POc_3Z5$)78H0Eiy7rrTwZP<!_6Goxlqc(A|PKsejaACh1~vGq$jH?aOPJI^BJmp
zA@Cl{FuB1`P;k7&1=|A)B{O(Q49*DIKzas#!`F8mC#aC6^k;2(;k~bl-}uP~-ebdy
zXd5ak&RgCI17X5TPVn1nk4jYFL<XTJD!~6f2$Bkf#<r!FtPosyv}6bgKLF}zH3Gu=
z0DdxpUlTZ#72?Y{(F6xg8};-i4V)c~d3(#j3A5}R_qm=Fp|3NnUEm(O3{EN_RV%CF
zL(Eni#7;9AQ#lsgN?y_L$G;bQe0#l~3bHBilrmt=iZK(@<;S^F7Nu$d>&vSI(yL07
z^^0_I8++*`@i1fFf9p+{d;SzQXxV|P0tWhC)yoQ$sqe|nMR}&i5?m&S$(il%-B?`u
zQI3uLOOqI$JNe;+(Y}am_Fl`8uVTp{Xh{=u8Tf@^Y`@Q!d)@@uLDKWG^1;;MseH!3
zST&F5*ZN9Y&>I^D(tysiydanekv3!~hJc?=AXH&m3k%#Kq1A;+C&5a`qLZkP@dGrK
z+c%BsY#FDXZ6V$6(aw^Q`UH-~W*tp3kRGr)a;SkrENNjh(~{8GtQOr5&H7p+NhxE2
zuwgd0m29vjs~e@y#;E8}&`fs?M5gI-MCeNnNhib3TVDacLJeW0lpsfo+#{DC_W!C3
zIS)j$xis4A>q?SJ5hE<uO4@#rBZGtNhRLV$kpPy|f@mqPHTlZLWxV3e@4$|OyYRu^
z_&v;>KaK6X_P7^c+Lqnx1&I#xC(oeOXrMG+!|eV&O7lJT(8I{(3ztFj1bQ1ynxRP)
zs$~ND4xJ8zf1AnW|MTjF3m0B6tu_JL7vT>w#2>55Tto}~LNF{FSh`=<W3zmqu*1O3
zYZpNcTE7n%f2Kg|s8w>P^KyKZO&jjPDWuD4{h9(o3v@-~0TFQ|s3<TWumrOGb{EYH
zG_C7fikWn1T{~yWN>e_$)KHyn(=;_RGHKQ2G&Qh2MbEofjF1cvu-gzuoEQ-M&jXEA
z(-?dbWMDXJK9CLKSfSN6fL7mNST+a&1EcELYO;g841HF=AV?XX(94mqI?@BH-K5+y
za<@sDGkN&{90T<zIA1y%7bHw@Z!S76)O=+`<X^@=<is`iP1aAxY;~fF&wTLjluU5<
zTi(Re3VitY--lXlOm(^CX+LYLJect^lihjU0b<qbs`^(tomC|oTN@k7Kg=n_?#bcR
z@}>7S*49*Un|()aM7CJOiN~H&)s<SMbz<D*Kh5L|_j0Y?tIZFa0Ik}A;@|WvxpUpK
zbGh9TWZ1#hakE`~TNg+BrwS>w`Zm_PR?w!}aY8`iU_q0Xo8K6qnD$E232)jT0IY-_
zB2xd0P&#mefPrv}$fUS4s)N?tDjl%g$0?=OJLn8hDWp*(w({)RHLUe%n#QS-DMR&q
zQb7bZt2<gS%b)5aOs#da=zEYMCZh=ojvN*I@u!jDi7&M2C1ez6#U|Nck-D@p);v*T
zq5_*#(HbfOGh9e~Q?M8jY#PZTrJi-RMMK6-m@!5Lxi-~q<rW}~Xdp}u{|;g+)-5+D
z%dv>th`(dA4|7(cfrXQ2ac*`BIRe6)?z)?f&n7NBcS;4q{61kExZ-x`#~*nNM_>0E
z^jaOPtuMkv2DiNWRcJLESU7VI&GkBprK+k(wy{yi;k)m^Isx%5ue}F5_U}U~m!oy|
z@!Vs_klvGdBQe}puP-irKE<wvYk<{WTR<!DpH_ReVy24C+Af${w%-oi1zUJoSo~hv
zOsR`4f5rp?+n0n_zL1t{apzjE2#s(0)}cj6Urvx-6)h1B*!a-p*~HkdAZWT}a&}qD
z3{Lt=K8>f(t}CD~molEz0cHE*X`PDIN;}Y4WxNuX-;q}flDU7bXM)#c27OA2u#Spr
z*V2>$y+oss!>rIF_wHx(HZXFOY#>KE8Ah@^Ef^;vUNyPpbX{%<gyC;?X|NmS$HTF=
z%?gD_6_(NX9J{EEkVvF{KZ1r|9{lL-<TrC|jF4<-ip2%VPZ036n@t?L<5uL#6=JV_
z^t)YE`@rt@ycraoOM@<Mf79#G>-O=$M?Q>Ry@m60r|=Em^i~wA6=aA!ESx;2Qj8D2
z;ughJw{4%nvtNE3_y5J;;l{geqhocTw%uvAP$-sup8);{7rVI@SnV~Ff}1kL_qPXf
zhtg)foayzBh4BnfRV}o9YZny2as{n%VzbXJcT@sGN(e7V5*~LO9qyoz!&uJ5z=7We
zDV87ZB@M_hD@#ula5UDYPONMOR;!KWxjI(q`}q~109Vpr*&vs8<ps-<1oB<f(gt?#
zp9UY+ik<5q8?ad!RPB<Qeand~69RJFX%I5guxghfqe%;~j!@BRV+cV}L|Ch~-e5B_
zVmlor8*Dl4mND5N4vrDJ9|xw*N+S+un#oZ~3o!@6Fk9X#(P1-<_7at_Vifz5IboYz
z#4ZPq^^LNlAYUqAiUIMVM^POc#}EH+@1k?acC#B(DfsMTtTKT=`{iH9>f#di-*7YT
z`IfiPIcehW{^(DzNQ`#R4Tn@W2?o*T;u@ZK;0t*A^N*;G6T-3a=qEmd$3OKTYU2|s
zkk;?_ZW5;P+G|Cly=H)x_VsTz6q|Ls5HveB_7sKk{?)sx5Ma>FmeXfhGGMTES*Y;3
z*~&mVX!R`Iy0e5ft#65dn4MJ)Mij~Rs@gk3j;QY%vReh5#9liaEi9c{R0q?Y2ggvz
zr4*nliNg-jtlg$<(g8SK%VVuv!UecRZ5(G5$cDPCUj{K~BI)b0zBVgIOk<^%{2)iW
zPxW$yLh6hwYSS|G_9{{i`^kVPi<6^+UGe^4TiUvOwl*TT7J*Y4p|#Nj4d}@ZmnaB+
z*?}-@39@1+C>UK<VDm`k=9z5rim-LFSfl<XAFHKW1uGZkR0|)L5(dO-)p4OLhf?(g
zTkXxGSjZ8WHt?B`eGCV$KcWDc+vfa_-}wVvJb4<~Tn=lC%c`xqMKiU<GjmAi^T_10
zC{`+}fQ?X9&{XBH-!`rhjrN-OD~Qeh05R4{?l8+XEXQ$A<`&`WLYwQr+Af$V0JX8J
zmcjY;9?sOe1jKH!3?GzSJyog<F!t1PmX;koKfThYdZ89EQX+J`57{dCl|sQ9z`nSG
zUF9?m@0-B>1KYq2bh$a7_odP64Y1MZsnpz8-nJ9ivkjOYQ!HGybsh<_(qq+O6y4D@
zNC&#iAcs<3<Gxurg3U$)<KYhxltBz^St0m}I4Z~(u*9a$qhtff5e#)xuc{m^1&jca
zOBMx_Bd@9>rrq-LRuKE%V$08r=G<b$UpOkVC@%+5x3~z%5f>L`w)1B$-~+$<yKv|n
znw*_gjV0U7w#rgtNv>9y#8aPn2zw77!t&V*c<7^_z{JEf46f-xOqKhj@v)`qFw^Rr
zjWyiz`d8vjKlFB0cwGARkO|n;ab%iDr7+%*0PWTCM+p3Cqvr%&3{+8VIx3gjE?BZG
zV0onwcU02qF?(ZOhXK4wU7<CKWrm4jTGcaHXJ%=NK-UZoYY~lfM<>X`4G<M8YqXKe
zrf}meJJBVE@b}NHK@Kd4Y#KKon#R%HRix=4Ebg6#Jv)KZMh5Gg=1WsJ*iy^z8U|V4
zFYDS`!@tGWBm`#@$v}^^52dvF0j(hkK@MeZ#o4T0=ODs>fnf{Q<;n)ZcZ$mf@iMeg
zKo2i~a%+uM#&yxl&}T=0|HxW1n=oEE$`ZDT?JevqaRq^}k&=SkLbi~x<)P$)OeU?8
z90u%w$>#9Nx7>@JhYq0CZmZ?W#W5WJ(xdp~`#*%KsaX`OWjfcaI2Q><rC7t`pZ+XP
zJ@t%oCb)ic!;PnKB7{&8?)O{^>cQ82FpRa?j^*rRpiOyfmjC1Fj^P>92VRl_pPW00
z%|3atrEFb1>#;RMzn`AUH4oTfzzlh{%SjK07UdP5%RoeqU)Q<in#mo6jPCzu?@gd2
zJI^Y?`(EsO<epjkzNr?ev|ExTOR|tH*_Ib<w{2*{F-uPa1Jm^BrVm4N=%JZ&=Jdds
z)4%}30S{n<0dH8AEm^xtDydW|)t<Fw<-SM8zDK-&{_lTF{BMb@lq~m@&Z&fSr7|NU
zA|u|r?|%2Y-~G&yTiSw93<MDvh~l-yy7-+62lRVx8bQtH$7rsO5NErQksc_0Ni3FY
zLQ0?wylu@sTHC>o4#-+eR?{_O$W8>TA{j_S0!}t7Pk%9o9KcLAE6WLRvRSzISiy0!
z%K*YWa#NX?Y{1;I0hlYW+r0x#);XC?+hxqF6VE)s$F0vgym9biz|7U0>I!t8Kav;6
zUt^-pgH?A=Aj2Ba+LY(?>aSWTVB%Z_{p*JX(=~03ZLKAS6)M>x%H@){uik-y4%j-I
z*BrPD%USXJJ;MXY&o6TT4_II;22)h^7ERS2QJD7hyGR|s!D!z@Hv2mSvTcLSR(Z+4
zE}|kqYrWgBys?Ur%=PNkg3w?627qZsXTLL5)JgbSs<n-c2@>Ivv{()9Eh3uZWYE{f
z7%BX;7KDQ~T>yOieiD%YE>xk1cyrLr_oUF|<yE6n7hQZBxDe0Z1+vE2uv0G3Iu{Gs
znV>l%4kgJz4q?%xDJ!|T#k`Vf9ObWSHm4vhO_YF@F}I$pcoIFYVTm=!2A<li$5*x>
z@3rI`bOX+JqJUn*8nz09S3DBHlvO)fYioqDYsn@azd+NAit5M1ywu;kXB%F7>W3J6
z`yArQl%>^*CUPx@hrje`eEi@3JQi2xyIb05{I_1iosT_)tq1m^Tq@XqP7OCY9#r-B
z-|wXMeGRleMLAS&v7MAPtFu|MXfaHeTgcVhf|)tPz5RxBz_f8`%-pl3!&QraUE%<H
z%f<vY^hd;YT3d6ANzMW|w#q6>XXTXDeCnJ}y6Zu+z)}?lS`*bqOXSvuk`Zy`Xq#HB
zv_@J($5EiM4olT6kn|c#(8p{o;AhN{E8AHk!yJ=cOtxm(*sOkkDuajp3Y{SZkKT-8
zdmeVMQyBA%K=jgB71t(Pc^ZtlK07#k4L5*CcrWX^i@lpZ+uf<)R`k8tc6V7}O%}6v
zrOm=~pv<LN7zag|m-&IPAN_+v!kHk(r^PNN{Vxmf%B_%D!PJE-!ur_Fo+Xx6wwgHc
z?8}^7R5`=-yPqCqA}GpjOi^!D-p4^R?{A=0@xK)tdWM0n&FbsGY58KKZOpK@_35vc
zrWpeZ=7=qmCczALM}gl>hW>Z}lf?!`m#ZS|yT$Z`{2~YR62C9Tziu%_e2?Dxx@OGK
zo7N}+ikii4HG|b^5^$QV)Tqhy|K^OLZQPeRf3JgOhjF(>W`QIZ7@5kN1jubkF0iaz
z8gobn%q1BpPRW1)UOrT3khdynhH6(fD=kuleaoz86AW^5O=7mr@NgTRF>emZ?5OGD
zz7BbVd9XwqnP*+HZe<HwH^$nnRQJ?p?XQvIk{($1yYVEw%;R}os}a^|mQoXoGGxE=
z$A68P%aho5&uvHz_G4*w4t~F12ULE$RICTDeg7E_$Pw&4bc<+onSTVy1m%1I#g!}y
zD><YRX*~P&Z{g&NN0CbRNiVCOl|bjOAOni}o9u>k@c)Zsu&$}G$4N(}DKK;LE9_$(
zCd-cxVx)<XDjH(eE-*7lMAJGf&;YR-{~y|RTjBqbEljKy5BZVfk8{gN3<rmzP<Tm`
z4geJjn^7pgHfRk8SUy&1F{@R=JNiGJ3|Y-;TxrszSLf$OD2%1YYL<mdWb48n7Nbc(
zY}|bpknMP86$d+09G!kyQcxuZsyZ-10lKhR*x4+w`p7NwMi9jdub7v+*$x|w*?qjS
z6u~^kggvQr7mqAma4C9_$ekJt8*y<OR;9_^ro>hW&SmeI(J{M*y{c~PxVU(Dahc(n
z?He9My;Q~0<O06(2fu|)dv_qSFb|c6Z>aICwK!<@pjIrRl+Rnc#wbCol+9!3ZHI8@
z#~;B1pMOF~X~XN+AruaBqSWeW!GdUL`T#ra9aEIgb5`5?er2`qTcG9O`oC10dQPmW
zbasF-iK)`wEn2EbKufIF2zKi11Y@#%p#Mvr+N+rwvV|I={Kmy>1))Y$Bu!BmcQaQ(
zHB&};xrBDMg!*y;l}wTUzGAHWHcNNK26`Gg>HeCPy2Y#suC}y1QI-ihESA}w1x&JV
z$sh}dPAtxM%|oM=bXlnx#aPE>z~J_sDh6wnGiU8=mPtCR%x0Nwq}0^}li8uoJKJH%
z_F(c(1B<yNgHF@RbHsNQ*?`&b(4iGe5{O84^M&{;>qEKH#PF6)NT)(*WamXVwus$S
zeoPIQIe~c%8Zx_f{37e7a;!<v)&D!)--pX5&f?^AN3nI^J`u6ltm;!-bRLi_aO}Ak
zkX>97af|vCoPyzPTXEkfAH(3rjaZtQ!Nxs1Ft}wMmY3&56ReZirEi8XGZIv>0!R6G
z?^p5Q{Th?ViKbGRFE+yjwxr88o3v|7<AB=I2NU?!ldM@cjYP!mt&=k)Ap@A<-zMWV
zn?WQGlo|}{Q(@s!*xDaPG#tRGi5%u~RbCDSk)wQD%H$0Bj5Xl=_bBLvA0Y8{y<k3L
zmy8vm*l|Eg0bVW-m3sifuJg)Wa+3+SrEFA9X2?wT${HXmF*j2}P^9TH*=3;E8ej&P
z8VxzIYl?O3T5=SkVz?DLx~<j$XU&)dbHpLS46iYom5LNeC|k-D2{>($h{jcmIpPF0
zW{*l_MpPms`Nm><8neY4nsJKq{W1CHq6+efNWyku5rIe)b<SoF-n<#rrD+`b?$g-u
z!AH>YB~Vyg6dqHhqt6(xoz_`3!(8aziB@Etix!i7$M!WtnoUZuM>k50mUaJc`Fo5x
zr3pFe(Plvqq-1Vx8tXT0fuEOlb7K?e;cU0rXo$Z%J<!X6HY0qobpOF%3|sc^!T7n0
zC}y(4hfAw-Vtom0-nR><o_`I&P*i|4t=4I^8vK64`Whbos<(ZCvZ858m9@3C$Osej
zKfJ+cf1Hnis(gVn)NrlEjA<!7XO;#N%#)G;wKwX+rG+XkFIB}9m}X>%b{J-7f{Iw9
zj~_TS%B|&KeP*$WI{)6Lo-inGroq8F%7HXOAS>byb*@F(u_MV4`XYW1=-b&Uq}W19
zwvfn&JT|MbPP}1DD*w$mM9mm}XiFzYCtDUGFvm8KAcL$4Dqyyi*{YW=>y!*kV1<1+
zL6zhPRUW;Sc5`)-yqKlC+GPgj(hn7n(N@OnBe%>35cV-=ch&FA25<zyu+;)qI<E&4
zOAW&UJi^Td3`BWlGky}W#vG1*^IJIc+S^DD4r1>uyAe-B&{k-hYy^cu6-C;FP_Bvf
zGIWuy^3q$=9NP(29i5eITF%>b%NJ+xc1(Ebvka>k$GoK!I-iC|)+4{LjA$y2TOa+9
zkP7H8qOHD^Z%gc+Sgz^|h^KJ==yA?`YaCz`NO4w7CsLVLhSf?HeVc|+Dd#xA*7Zyh
z;w`NvTJ^el@s5#%a6>xyAI8J+>*Z!=nybl~EXPr#LyGvCP6z_bLak+3tDI}ZrL`_F
zx8Evasw`V+V7}Bq+y}fpwt^#9b4YV$E8cX4*_u%FKQw8U4Exa&^`mY%3S6YX(rM*&
zGa?HYorYZ7rmt!iV4Fh~ZDwzJX*RckCgFyCB8y2(MX|_|N0x!3<W^jgLFc4YCGV=$
z3`3U;MOPEaIiSF7+ih(w1TQVq0UC19jSRTVvEGJt(<9NvZ6H0CkcAW<CNGWSzI!&}
z0B5ilPLGKTdS*U@P&6jMA(~8Kd@_eZzJx=!?M5oxz{8K<jt3sU7hCsk78`Ao=_qy{
z+J$f=EH3I^&rU%Xv3srMy{zjxbA+!2s7!7gUc)9v`5g3jG}@e{7K9#4z*@`~1iPjE
zV%2Kd*r>q7PBRLmF&n^QV>CZ!ubw!k+Zqiv%UH{}umzAB>IWl9LNH_H-?R52Y`yQE
zF=w5-8*O%T#hCaqod$HW(_%y6I^b{mrgR8#%6x5VdU+|aSq6u7$^ffEy(NydIA^W%
z`5MX`s1uY$AT`abq$>j)2?%zN#C4$M;LfDH1e3wGnKadf4x?@x<Gm(J)xEKr#9&Q;
zWs-*50ob;*C7~<GY7UT<<pOjxPNy!bXm%@>3K?V_qqeT589EyjoNN|uHmf>Vt>OU}
zifuo-qs;Bn1ha?0z~<+*<Bkj}_8XYM-E1@wj>quCXYWEiJCCU=b0XxLA_4=Upa70w
zIE+f6h~=}#!IrP!;>*usVe}*xE}TX)Gl`LYA8HF%z>0Gi9t@&UTtJ()5_pKY%qywA
z3(Iv6Ok4|`+1dsb)~G5{^kHUt7SrdiAQn#`x3q|Sc?G-gJdA;j>p4p;86I5sx+nTO
zL(vFlzfFE0Ga?H?3@q@YpkA(^cikW!`T5W50NkWr3A?$izW=OV@4Lw`er$iHQq|BD
zo>)b&2!2h(N~MJ+2UT(bv}pGi2T5YLKxd<ZT)u0@3KhCV)0i{eI~c=asg9Xk711E2
z(fb6*%29$1+LqgBaR#j*!hh#WcW=a7B@NT_1<ri^_IzbW$6b?tpxKN>%%<O3Sp^c~
zlLsWs?Fw?_AJbr`V$6fd+9tmwkcAw9*s*V!QiBh6y;NqiiewRU+PUmWSN4XN;u!t4
z$p&&Nm?L*q*07zvS>{+N&YT^0nK^njn!HA3P4MRj9<33gwJjHq97na*M(=RH01z3J
zDU7?EnYUKGP|1Aar8mXnQPgEL8pimUQTTazaNlG1<450pLy!Ok-k~;%7pOWn{bKFQ
zcD>{i)-}t)<Gw@|GebU;MKlo?AWMl{RSt^HHsy3=anC0{&e>@NPyX58aK_%i?t_O>
zEmnlLme{ZJgVyq-2l{x$kV0-TBQ9Q~>(W}D<*6C`@UOmRW#5X*P4WFaKRS-zV6;Cm
z#XvB*pQ|*D1Jm%u(o_|#n@N(pfHc+?t+7#s<|+mROxD_FohU@3SwbGvma)oaI2jb>
z{H>c(SeFc=!~xZ0k8~x@h(s+7H*r8lG=z36f>(1*%v2?b!Yu0*dvn9IZi(#<Hpc<8
z*}&Qs19rO*<RJuG(@SG(23f@hvXYNh23gt4Wr3n388ElYz<E+Ck`~;3B1~e|%wzeY
zD-Ka+n#{prnZpLfY&i<dHag23!x+pKm}3Gq1+G{51$!k^=C3<1iTwc-@)eOZMd?$*
ztnc)k(n^?6L}UT@0{Z^0L{AFIbP5q(Hk0|A77vogG|#Ihrs$0xub4&~qhA97_4+;c
z$nqL21s>;}C1y}Fng5NqfAj$)2a+h}Gw9#44j=xx&*F>!@mI0)@Ief3-GtOYFE;Pp
zDHv+KR>qFQ`$fZ=0NU@j^E=wK5KE;v*bZ@W)X*1@iZvg8AuD8O7Ogl&Ra8mru{Qr1
zy>_d8-T>NnZ|S<7gX;D=1+6Hst)@|oZZTyX`1y;xQf{Ek%MtnmHO=fgYnF&FdsBUi
z4j|87SjKXxiT+p+L4J}o4Pd52Y`#$E02{@j^$9HV14T{8pz+UH4!&gK4yf`F0qfYv
zWEO4gA=6}F)jAC>+wCQQm4_5GX<;C<xdZHr6}y3~!a9opMcJ>x(=Y3^aw(Q%Amz@&
z*#KkK<d))<(B)jbXgjx=s}bkgq98ZB9HBAJU~ne+W0{AQ%PBj+N8`~!qm1Xr7YD?}
z`7G9rB=Oi2hmj5xkey#ZuxD5}4aCF}R_QM}zgBgdQk$xwPym@s0q5VoA{;Yxu`icu
zD09~5H-g}ubaPc)bx8*9MwwePfw$~prn2$pOU<m6g#}JrYADg_nR?R#yuOXYA{vn<
zyP}CG%K0pE%S-4V9>DQup2d@2`+qqQ_ha+^J(#|H1;<}~5f6Ro6Zp{QK7q-ZF;Jkl
z8G#t$7ohp^DNLOoLo(TiN}+<A?zsz}{Ec7cx6=>|N1UtVH*+9;NPH=@bMMa^(!slB
zv<iNKoCannwV6pk2WyU(a@AT>7(r@6E7h<*6~b)3jz+!R*=j2@J_Gb<wRkcdK-1W~
z`Q+Ip1o-hD_v<GIG1-Bzihb*nm|_Yp&y+9}(X9ai;|<lMU~s2?#H3g%&5`&8M{<@c
z84&hB85>YAH+V4FtExFITux0Ew({B8{PIapluilL%4M-x6NEK+O3S;HcdsFLWE!}_
zW4f_fxxvM39M*zX5ABx8y0vpeSPh`PGJ$rrh~VIMy%Sz-WBvMG9NHZNYb>I%cnRx<
zcA?q|qF8Jo5@20RZssLbZ~_n@Q$9a7M>cN4@UGoB_R1&{=_J33Rxmu6Mldyq%O^(>
zjs%U1SLZIQU?1i&0P&7ARd$W5L#Lc40KEIY!#MNuYq;s&TQPfOTI>Y#`vQ3Vd(ZLP
zRA>_dE+0RMGe@dug4R975eS9QmmCz6WYuDcvs%vH=a#TEJ;m88uLy5BjB=(ZmO6^)
zL``1|X}<f>cnXW-vqEmrxBANG60ut9WT;=!6!lrWPqbR~eFU-uW}mJ$H4CuJ22z2S
z?%R7q*gX&tg9+4_if~3co2!W&SD6XP9!oQ4n|!mxfHkq=hH*ygM_<^7b~uC*f8b5A
z03O;uj92qbJU3C~AnUh+!Y#`c?4z%33a#O2-Bx5<7F=VvHfaEM=Rw<aCODd1E-g=D
zvevMG25Yp~au-0egRITg#Vl{9A~nC5#6mk(t}ZSE!*gpJsfD`%W;q&UZ5C@~v&=iV
zTh29*Tn@}@=a>BY`TS_{(l$`MirrgiZxuCd0;rYB=#ADeb?FNJ{P+GGlb7eQZCe^6
zv7#P&t*BUA8jEQ+Yzw(y)2?mEEG}biHj8*qKMD)eXqOhT_uv*Jq6%`EoXB`}mj7&(
zSj5!>Vpw;57TxvPJbxZ{Kk-wz<FSWPDi#EDz5jEMi=2Zhe|`^s{t5K28$vOg=O7tG
zB9%se@32@+PHZ@qNFvJr-Xgyr%03tzT#sW<y?|GK^gZ12@CR}0V-JY|2iFQt{yZpr
zDKj&ROUK?8tl8NtRP~0$#~Z$2m?VU5pVt+By<Y|v{HpRG2ia#AN-cpPP10gH*wt$-
zRI5!4#(db)8^*Em0_waxqcEWyXQK2L=|c)kByTmEdL#_x6*P$p%gzAOi}-C*0R_E%
z2`u{kSmr0huAT^1IOr}E>qr<|a23TdcOV}O{K1t<4ZcDd&0fw}$j+i^-J_vx4Q6H=
z8FjHZr+3oSD>c~G#hCl3I@=J8+el2d^F0%|^oy8J(q&a9C36|K^}$POfHZU<8SG_y
z7&@5?s*TN>K&#n@6EtSC!<nOf%rQ*Bq>BWzeNVIL@#ZiDvwQ9IFALN9sui_IG&|E#
zhMqtMCtp3u%h`mO(JvKBf=xvd2~kOz?M>%<!<=1xb10_KM1y~R^vj<C3&il`U;jNu
zhSPZXb03E<62;itXYlsX^XOT(9{KqNy-B7h9zzQ91xJ$}U+X@UAV)!3m5K5CK(pPJ
z8hrGZedH^j#oN!njM3w7as~n%df;9Tv~i5S_Lhh~Z14-z$kt5=a`0UkpEQ_hKuBaH
z3(&M!fdj4BW@}b{wAGn|=eC14Ve<4PVf#{4A3TPuR|73*{CDd9@D~(lU+?xS^V8qC
z!D!zFqy3p`OOsN!blD)Jcg3(!sN>{RNu*#6CWB&K4Qa2!)@7VnG&z>!Y?Sh4o0_~q
z)|}yIV#C2Qr>0~42Bj)55tCt@Z)jL5)rFMMHgw&#bPVhNZH&rN1CGFGE(3KbZ~R=b
zn5wC_wydw2^r_i`V9Z7rbB&kUhalv{Ec5n?W1>n2;*Pt3Nx*3~alkqt3kS%WK-vvt
zy}JL3^sfq7W@1$us!-r?7kD`UoM7RR&;{EdNauOjnqbTUHuT6sm*rokHle7cz*-F`
zJ|C*NWi-lV&dlO^^};Xg<a;&!vfcDfmuw(iFbRYj)f)24SyY$jk)0Y9qr1Lf2(Nti
z8R60W{I7iuAN<(;$naywZiTv*Y_P^zT2~IP<ZuvqvkbYVj95AT!q>lv(WA%En;sGp
z!NS!EPHbv|(I$J+_|$LwlJL#a^2Yl<|4FRhy`5i-^5TLLjE1rGz#d(i)|e!P2hrk8
z_SAE)Z~|24WT`F!WHhZM{#DkXt&)5|Yo7Q;?~5Hzt>W={L!*7ivH=I!$EgXXpwk4S
zEQ8&>0Sw1fjAv@%#4pubxM^Jq)0wKiML{|^>32dt+P0vBp=!==87E+kGnof=4`57F
zaXDW@gic1zPQ%1vX+60VXid7S&nS8sbA(d!A2#DrijYT(#NKwxt=e_l#>yOwh`AT}
z$wqvYIaw?usQ|W#FU7W7%L$aQ#%q~m<C4Q;Y#VW9D;GMfl*u+NFUi1lA8tDrbF9^2
z3|)P*HkI~T6JF95H-4I;UMeG`Hlaq6{Qad1v$67sgKGa!8k29Hg{B1c)hh<OwAUhQ
zXo5LD1~&}j$-nxBn2g$S(_u`GUcu=jZz9ZD9s%$Vn{^Cv@csGU{zW|h&(C0aa$2|?
z)+8Iao(JoW!ydLSs{BYZeeg?9VCvi`W-eXefZHzuy~*o3J2A<@bO-j_bqnUMOmN_x
z#<{b{5JDWk`X~Pfvhzzg`NqrW4G&}6%?B`Zc^su;9udxht%oJn%PYKiFlB|t=wUMY
zl$<Kq?b@_vm1z&v{h=fW-NFrx_PuZ$=tBzq^|o=67{dqj<j0n(xV%_JrQXKf+tUI}
z$CfHcgndE=fZ+fT6D<7lx{#|PUn6NjwOFBL=izt0P->vm<m{zX1xhunaIn@hWEFe1
zhr~#2&Vsh?E@<!*wa}ju>&oFA!F2$h#Y8o^ME168X|@3b)~N(#SAoU;+#t(rAlqpi
z$skLh>VtjVw^v{cB*%emE3VeXGrLLy44xMs=imVx*#mGaS6qe7N^F=mA%{8R+K{TF
ze&q-nGiUUxxk8hL3PuJ3s4h(iCj#k>og^;1zPWl6%p3i(oGsq@Q}^S;UwlI3uP#r`
z>Jgv3r0yB)#rfAyV&cpwN(<Ax9G^fa5?Q<3fH}r=oo)jUq-ItEnJPwOeF085iUpBZ
zKus<4gO2G~B7wqk1{Ka)tHm;Y_>F(S-UGMc7yrv|i4disty}p8tcekRp@^l^Sejoz
zz#qJZVN*})(gS5wqgq%StM#{AG~Mt>(;q^MKXK>h4WNDJjP_HMBOn5?rA%3Jhh$1k
zM0iQRcO-^fl^?7zKQ7G{ktx=NjKDM|d1jf2RHQeQS(_C)CvT9m&r_3GEKg(*;^j>&
z7Q#n1rG>MgrFB9@7;|Ky!XAMr;u$$W4|BvC4yq`(nCpCCnj`Q89`oyFb}nN!2|)mx
zCT&mP&r5YMLIPj9jVh1TIwrZy#+OgCgRBbsazw+s=t{^kn_9{$g9)kx3aZV=>Hud3
zPxph3&05+bbFo?5L>zM)yJSt48auIA82fL(NvzD)+8sBAKbjC*Tvw)N`0?dOu~6cr
zaaoLtuF`SpQl`6aLia-k|4O-vX03rRuY72-OdmaMbH+P@<+(+?_|5NQgtK4rp5nc7
z8!+$5IeP5;(hB<4^<!ZD0G|8KKVyDu0+D#!b`POo7_*nIiUw_zS8I_#9NP~bLLe5!
ziI<OI6KAozcie_kr=CKpzXu2Jz60e-@tP+$9f#y{FjV|C@>!A(IALnHKiF1$hVW<q
zydfRD6Oa`QmVKnw(yY-}GaI17nQ2c%#ckVCn9S60X}%=n1R^0pPEX5?meeHBJy-%V
zlukF7PHM`mrL{3MLc6&)f&f49#wz?|3~^>tZyM5obfu*e*~}bO6v)Y=raUC{<Jk<5
zPNK-mPn9#4kWcM|eWOcfOlqb$mnbSSxpS_KVa&AxT(McMq&;R*scr_vSndJ`$od=;
zTJ{lJcWRVk+q3|yqHtx+N({9lEqK|vv<@ScnV9S}u)QW)=XG<kUV6XO07Co%y0VnV
zvkN(dw%m!9KOrup3V)A$m2vF5YdhYWNn`rT6h83_pTo++3XVSY0+PL{YrCUXNp_*H
zh!tKuaTd8uRxCSIRn?XG+Tfrwyk!Fius+OAF9|!<nq-4(8@fC-aPr3{dXpI3JR*R!
zH#wv?wc2eLV<(oInOhL$Tz~HXUi`*)aplZe^bYo;RViTCorf{9cQYc9FfPA+8j)~p
z)#padu}C6@^*grV>giGbAgai<Wox{6__fw2`4_)-z1zI5dq&G~EY083`^1SLjnlR@
zon`ez19)?~j3eWDkv&T}2e)iZWAi`^rE1FxkTHRP8dG#%BDzg{YS@?zA<AEgA_v!M
zy)9C^A{4n;sN(tgG8)uHwUuhHV&gicKBV**z0{_LTXAj$pIaBfww@@8&30GY0h5}1
z9SK3R<N!t5|7FSqsw*}S9#TQ4>16|1dXAdiUEq`bwz6E{0kV+TwR`%@$dk1O6PU}R
zt2hvY!EM1}GUzg|5?umc&1vpu4v657%gfkyC6C6`X)?BgRaQ`+yNF<ELWH~1$abi?
zjOjC{!~g;5k}C_#DCG)<&$C;Ab~nkx4Ghb(3;6ICK7m_5^Z`s>9J4~P<=;v7_u}lU
z$8q|F7m!HBpb*e9kLDM1=Nx#u6Wp?aWg+H|pIw~Cmc3h%9_Sat1;Jpb>-k6{w)^hB
z6&v^OLN>Q7&YwFTc?h>Wd_OL}_9kkTG9Lf(m$7O0PGsg6Iq6Zaaek{JSZ9UbmbeQI
zM$~Anjqlo8Em`dR?dAp_YahDaw=Z1xK+8-0pQ0vMv)x%iV@Ceb_Jf5=8?&@Q)~||A
z{_f$p2!okgEQvt`D>uOKz0wRqfc&jwxuTPY-=<0b&A<M@)*e)<4U8|B1@H!Fg>t}W
zOp~#WbgD5+7wwd+n(d&c{DgQ<41KKz#>SVB=RXdh6IaOODKJgWSCzn3avo^X&s2|G
zR@1hnYIfjNG)XEj#?e%ZscJ5Ffy`u8>7?}v^0u^BP1?}VO_zn2%fK-~CPz9tV$c}6
zWyabw4Vc3p+-aie8<Ktb39#jhXcw2jaucX7&mbMFA{7O)D^=|O@JF$2|6b8~Pjd$Q
z`VU^h+1F1XmW=CZ|1LJmuGxr^v5wf=#JNkDIDZN8bkdNG?7vSE0$I%hK3;8Q=Qy)$
z>baaAEP3tW-QL?2h&}gh7((y*A<nc<itGZ-nLR6iwDgrrcRluDk%Cdyig@xb{#J|`
zf8l@qb)0<Z4gB*T{&#%qPyQ0^W&?q6Xmy~a<}_#2OH(sqIpe_(-7Uhv%f-?)|0IpS
zCO+083E>mh+a%cg(RJ_;HNo0#DR|jvZqXzc4JZVC<bT!kWGi)j(P6o!dueq|RX@=3
zoZ;@=l!O`$;q+n|G0tKLz$WV&eBmILRUh_@Bv39laAmOwr6=CeAf1DphLM(eoOE>X
z5Kt{;is0uju3qKkAOAlxV$)_%^FAy9;vlckI`nqicE25SzZv8LyPLov6PVw(euueN
zWSapoOxnq1S+<N4UzOOeeYnBHVc;0C_0(nI_Vt3<Hz#=I8NfASY@asM0EgvE23@!q
zXr)}n;k#}}c2vX3i<1b2d<aIOBFCUnts_VbcBO>*6K`7XmRK?&R%(llt)+@!wqges
zf1d;>8KKr|DB8sZ$<LYE<b^BZN3m2wl+NA>WDrcYUMwJ<iX)U7LUv)rNJOJ6hHp)l
zF5Ao@b4#`5d>$YC^y9)_b>Z|0j0|iRE`x3#(O3fGXD@IDx`6Em_h84N1Gw<kDb8M3
z_}_I2Xw*^XuVtdIM;r*(^yxEwj~Gc3O@7|_Ih*zcnrq%TtdfhN-TFww7y3P{c7eD7
zwAa*U@2BZ5MPilul11GgOKZDH4j_&7!c2jeHZ?@~38X-tgkoYmHysNhtNBpi%q3z3
zhSROWs-6ONV!4i+lL6sQXe6T|GXZV4XHqfNYj~E9<fG;P)bbTPuyYX0*%BsBOdv!v
z?P7eeqpdQ2vJlAnb4C8O3N0A41{+LpR~;bEY~6m?^iA9MnbUsN$tvjBz&ar@%o?+0
zws3FP{g~Sl<QxOXP(nwSbzTe{>uH!*PA!vyx|zMn@3M2*6R((u1}qOML?Z!QnW>{#
z8N?kQ-G@MR7DvDJZ4o*>vL%2_fdGC$fxlt&#6|2F8Q}oPFm-uSgraOeuuJR&yZrW9
zv|9lTZdxw@c6oMQ*r8m4tryD`n_?C8j0~cj)xD-#tKD5lHU66dXezn97-eM$!XHbD
zoCS^I6>T88nrz@P5)6ISPCS*y^rbOmXQwfc8rIjxtnxvPyHYlX*~xKi*s>M#)06n(
zZ~q3ao*Tp8{I_36Pv8KiF6vnZv~1Db1Gbircp`-pProdj7IcAYx7%w2F|BzQKW=--
z)Nw;PcsEZ@Rkm=#x{IU(Fh_8=<r?51%317CGK7&-NLacy4aP)>w`SP8Xv8)h3nCl~
zi;cC7X4?vzu~M-3*XyGEL@c*(jvpH#UiJ$hX=`?efKkGGHG$;7l!1sJxm+1%uPh?6
zg`c?mimgy6xuWX%xW>Q1iCF}%ObV@w8Nnl}#s18aU+Zj0u<TYH&@^2J)(EULA*C=$
zDlqj}=$={CoYU2G$-(X}=mN41eb%MBS|F=QjWOnE+QGv=>yQkXysKT74CGL6&BM+m
zH_x0tU50wOhKiQJ#%=4d{g%UM271u06vP@DrBy|p*B~sh0Yf8cY}~O)bmS*Sui(nb
z^P)jit5&go=T_0Is+Fs2Vzc_zY)#zP{tw(H7&65NUNbY6E{v*Aq|s6AU~Xm{hwnRx
z-M1b@F<-hS>tkKN(Ep{2N6%0X(!Ft1@&)nyt`+o6goNaPL@b5b@hS8U4dHA5_5Z}5
z{`UWbyFd74Y}~g?uw#l)d?z65<9{a&K2Q`QxgFLDvO+%KkE62oN3Uo3;JRkC9Cz*~
zkZrXc`=2B~su>hRKH4b%x+fk)k(VG8Z)cux^;!c%eQB%&!pIk^A_t*udOfvHi=0Bk
zLjj-eN}v#Mqd-<HJAs!~T`~LIhT%Zp^3bAvN-IT_Ds^BTXCjL$@D<CbuOEa)4G=#s
zTW1##Sj?cYZV-%@p{kiM2E{dktH9C8cSsA0&E5sOt3YBm-uA7|v{uKVpxGFwZFJX`
z7A7Zo$;~g=Hq_d5SxL^2B?H+lAm{MfCc3=5wO&(M9wFF*wey2&pf`YL{^bZXHHZy&
zK7`WDWvq->kl^nF@zaxUUBzH;1bqX3%#DqsRV!jAFO!#fd0elQaPs+=`SGJ5*_(Fg
znXK!|7<yca1AO(nPm9|GM8l~|aJfV46=S$QzwoA>e&J>6wIfOcG2~bv1}f+7x>k@o
zY;V%f>ZJ;2=Nqu+&VxAd{1E|m!c4vzAoAytUtSi?s?YxBuOO02;FW*+7bJp%oXEuZ
z>r=zK8S5`si`cMpI|t|##?G8aI2>7<qrwQ8@oB9Ow0)t!)9cCWusXk<vko{b{qv=A
z>lao^O|cZwT)-&)<={(K`nIu7hH_$~{Opbg6^za1MPrPP8M17p!hSS3qg-xi2)9}y
z?4=b9cEYvgU~P2PDr+4zwWDP?x|^C@j`1Hg6;-4(9S$+foSj6bT!%mC=WLKOJYJ%f
zHjE%J*o#870ahrZU*#}es*28QYyA)uF-fMm<N?Oq`<-kFT(FP6S`%Whm-UJV$SROB
z3E%~?c5t*cv0!KNvR_tC4O3*0)$A5CS7w3fSvE@U4%5|aD{ADWj7~OdU%aR}womBG
zJ4Iz8R<8tf2THT5dy+YbkTbBfw19i=+sVt~%Lw=MV<WFjrg)h>e(E$55yQP=Mz-02
z*6yaDC5AM*N?RI&`~urEJRq84)4ar{bSj&z&lPbf+50%K(he^A+<NE$fBYb_bMxZ<
z#c`u)j&Ws&gy6_FPz<I`AJxJNFZXLm^!9XRlVnB9XEPYtvIXmRZAT~`#*uG5jc|~&
z&{!O~OhyEsM>w0++V2eT3i&MVd*b85yL{w3-$ydtvvxMjFE-^+e6$jb@AXOga_;Ki
z-(a+BuyyeR33oRn*}&SfWt?EdN{h9Y0Ez=6F>LIQ;<fV&pk=iYpOMbR-}t(bJsW5=
zMAwYAGmsvtII=#8?NMO2*$7b~Z9<SztX(tc2L4iqKiFy@RIYHaRm4;n>2iv(;)cRB
zhGIcnsx@)jx)jn$A6|QP6fu5|r1({#%1ftmZ?Cv$KyH@VG+H}|+UNH>I;*9_d9YZw
z9t$ahfO&!}bI1j9>|r;MRU8W*oormbU*@%*hPfxgI%|mR@{N<tI@hW*$Cg<!*Dv<e
zx4>G>&V@{Ppj)6_8Ogq0kQG`<Z^Grv)2O#Y2*!pG*~l<B5XAWLR|P2h10f0I-E6i}
zC}A6C#6z3b<H&cP5&umMwLl=SI-7Os^BhoU`v6(OGBZ<912KM_MZ_=Z!7Zw>(6Hrx
zB904n=eVLKUlp77?dA8a;M~zSk>JeP>!Z=ABQ?;E-FM%P*~?=%{{81LoZ2AD{Z_jv
zTomFu+J5J(G9F7}a`ZCFyb4Sv)9)O}wALO@5Jvcyb2l{Fcl5-R5zZL)n~g9_lQs0&
zR*TAf6+@{I_N|Mf$eH8mE6e;U8$mP{LYqo|vTpGcD$Z|5TWV>Tff`VuL{zW<>j1YF
z9y0q9QrieC+~cyEyg@-hfFHDnRDP1qF5;zAlc+Xy2Lv<NF#%a36-A$4MT$Izi&??$
zG@3l)jGOV&i$ED3$yDaZna$dz*%_t}ouF=JOpnRqv`k{LK0}YS0jOplMo^^mtu=!z
zIv}gaAj|B{FFBXiD=0?Za_a_PdE8XWY3(whX1AL<;u4t$^RskAhJ~pa6nLpTFc8Pe
z!V>1MPLk?_d_8~z4}Dk!b+;Nd&owmiYI$aa&(npM8e#QnO}JCKW*oBBEK!`<@{4t5
zasr!oj^M7x?ng0~=K$M))~s<5FI$220`%k&WVl%}X{zyb3L`tWAvM$|7_(FVr3(`U
z#%w=u02?@)J@eY@Sl_!v_;BBgs@TUF`O?Is*mz5S-#hsbI<3|c*$3CFpZ59%S{1vR
z?T$WcWds-=))xOCD%}G7;LT^N!bkhoWC7FpI=1zN#d;eS4vCVG0A$ztl<s5YC&oj2
z`qAr$xQ#sBq%r5vfIEj(b>z94(SsB?-fA+8&t?UvrV|nI{Z`8ybJb7}g>hl7i1frX
zPP{#imoCil+vyjDjU#EK(lIpZO<RMf)8LXAp=05q5B6r484#lnAawkuW>d@uN8W&~
zp(L02okpQ88(}q&l>pib@^&`AEY_<ztXy#Dv(ndHJhQe7k;BGh*?qd?_j)r&nbm6u
z2K{2&0?AatkY9Wf18!H#sA~LzoftvDuL$>x94s$80)qTFoVhZAtLHB9-wz3}6&VW5
zZRv8+Vy}QMu>rw{Xexn;^XGBm=^r7eG|(umpjuqPBR}&o3~wAjDOVISo6>E8rSbQY
zTyW;d8+h&8PhrpD!|30z&d40-e2|>bKQw~e(lWmHr+<as-hMsM{yjV2`2~wVSMtxU
zWmv&!Pom@8$J)1DuMM&5*>$ju*sRDmumD!GMp$W6ZLLtj^jsc;i2&OC&FLRZ3jgd$
z&TRes=LqVNi1Xzp-k7T(9Mcc-A03-SW_%HGUJA7p)hcCGv*WKZ&umrk9N-br$Dd<^
zfA&QKyyVm~Z%O;2bvTirU$6>ds-z3k)w-N7^XC^3P6(QJuk+_{;J_9{_;aH;KE(i6
zl}XzRO!t8%I|(`f3n|)A3>z>_8Ym#3XO2lP^KaB_+YuDj8JJ)iy1EP21hST9=xBby
z)CoKL&h*k->lFHqp#^5eJKBNynvwx?+QwkdZFNmp!3s%tFKlETMp<v*%BfMb0|}&e
z+>G>KAHQH$tjDlf&G^Z`W$$)j(OPwX7hBCc;Qk?{U{(0BM8PyZ4)(-OsabXDt&_YA
zKZo77?!u>j^~<PL>qa^69Ue~ZfOsm&*|3I7Z=b@3{d@EQ3G=w)ze`p$v5JX*T`LsV
z6leHOK61GX4&Hw!?t1)TWEL0S(f!j=O~)-~wL5MA?K}M7@9*u6wtfOy3l&X!7d6Vr
zrd4fX(_mbb-p9tWD3t30jCOA7Lr-s9utU+|kA|^W;3XA55Ob9Vwx)yFyQLR-k`feo
zv=yFZtYTQYnA!a@S8<aahNjOrOQ!9+m8nHu5;hD5)IuT>L{B2jfwv{tcS37pkY5a%
z6e2>}Aiu9Bzx}N@Z^5zU8b)VwViL^;u0{jMv{v~nX59fvOF9sefK=jZ9Tuw^APP;=
zO|{Ot8*%>{vkxZ_=xX+TU#b&iZC+Ws&8x#^-O-0~b4t!Dg(Ezs)4-9!cPuXKB^kh>
z?>fVJoB=d&YnZSzWZPy3<6k1Ak!Vn`*<zWq)`4w^_x19>v1Mq$5CPiM0HaR)mYa5C
zVEqU$`D^IDBHg12whHhHA2~n1X|t@3=c-_X=Z~Hcx+{&d&R(5>>eG|4*eY4J^qdo^
z9!yV9h&+Z3ySHI>MIR9^mn#_Bya59n*Wt?PGqzN(_m0u3{B^3LXK0{nGi^2S)vLz#
z{_8dJ;JR#vsiG0aZYRI1!p!_x%?i1u|6bw;k}n)Up1&XS3uTeKWx5Qi6nDo<5vAP#
z<8PosRw~j_>0sk!T#NR|(_leVL$p{C<G5{A?J!njAi+NUq)%}9vjyQ=XmWNMs8;#?
z`=AkX&g9S*Kl2Olq3-fZUS~LAetQZOPx0rIjs&n6i6UGqqQzNJJsd$|xF3@X1?%LI
z8zZ(DV`g6yWB%L(J9+7$A`cKqoovO~@akf_vYZ9*7)Ee0Sr|+h?(tfO#>(JelA66q
z)d`7_G+5gj3fWJqd0Lokn-1W?Fs-WGYoVb#|JN0b=+t>zH7qZ*5bocONNfQYkDuUR
zk;3qn^<u$cg9FHO|M;XBGD!5KMfpwZUC4Q0X0fi;1hea_=o(z3+a248CHcj?M(%_L
zf6rP%M;4l`Gfr1-BJ!_uD;eDT@JG-)Jcv*{E<l!I5kL6(PvH5leG{=*j5FWVPvo3W
zCVDXX`U&JSMWlOrQ7#lZx&X`(YBLyI@stnvF~6A~-+TFgoxj0o*W@@L>kKwG+m8KO
zRuif%EK^i|QxHs@mpr2BL{WzvZRb}i{QC_Ni71zb1U^a5Le7pYVf5+}QfMQP%|qoU
zf>>p2Hf=QKBrt+CE3_hq-`+<jOudfq^a4V&3kXlnLe2AXN`Ne+a2ZV>9^e;=P|%0@
z<s#0$eFd=%gDA%n2&5DE++&AvY&y@`Lm4q+1FB+atQ~2<Ea`0$fxHh)>%<_chD@M#
z!fGw8S7x#1Ya)-_G6zV)17wx8f~;w=g1xC`OWuP0d(7sYbq^-k#%x(P$-urV%#sW=
zJD9_B9k;#NrfJNj-O7y9JndDjE-I|$q933C&3}V!d$(d`Zb|5~8}{x%-%!7(ic0wc
z4&8qjHgd*TvCZ?pGdAn`iD0)r!8WZbh+YTk5vab7O9QLO75sdm5##em-UOp{K7)fe
zKY9#F4zB$p!&sb|<)HnO$$4!Ph?3UL&tDpaCcC5lKDKo?1<1}>mB7|5ACRAx|INFv
z$A;K-3AFtE-rv%+fp%NcM&%$Dt#fdxhHc3FIa$64Y|VA#%-jbiE{ZB;D<agWi)Msc
zsu*qq#U>l5vR-Qf2mvu?C$xqm$;-h9b`A);7Bxva83o2laoSNv790LG#Vi&}HKCD`
zzSWz{qK}uCbzX+mHf+GDr7HZi*Pfpwic$Kj4*k>_z%6UAW;U((UCsXcvP_`JAuOgV
zK*$A}EpSG0Wy88b*3wxuW&>HL$Ch~n$Jhg5WYE(j4c6(Gl^T|^%fJSVvKA}pta5qm
z9Q1dBt;A>*!xm8}R3Hp2!7v54n&LBDp#kJ9;mnruZ7VE+t+yP2)~JcKICnkz0P3~6
zK2qLlBH7o2a4e!9BiFEWt;%Ml9}sg+5B6j8zFlZ=HcR?#F;~E;SC1Q0X{zUiME*O7
zNxuEUtGICVZT#b3{GrGz_=W%Udsvv963@HT%DEOLzNh6i2l0BPj9R54BoI26Xx&Yl
zSAzPg8~xHoK&u(Lu?f27dK><E>-DJ9UZ0E>xT$T(1x(tIATQywMsaOpnNqZ#)OEJ5
za1=0{FQI23g$+G1H1cJ%B4M=o6_f@dnC$U%FiDlXu;C!ocobEBwOuUMQLWU4E=>B8
z7zM8BO@}5wfnrg8jq;(*eR%ke?PANWFPT8TuU~9&h|y#5+nt-vaz@@pQ0V}Wyum;Q
zS09rbWau~^7&As{4M0U_kC>&)I#_JSRnW!01t~K@b1q-Bhs1OiFgidMUgNd)VF<70
zmu$geuv@v{;WDu6>h^M<Im2lHdzHg4zKup3wOUgEDPt7CP1AiqL-XO|UwQ;PxA!1F
zJE;#e(1{)h8EIM$EuS9;(U2d{{KF40JypPlUE8qlwgY(f>)%C%w#D+}hjwkf^v_S>
z!dquV;?=v+W?kRs|4)Mt*~MiM_(J==GRq5M>+anj`zbN*%i7wiWR^atuRs|C@!mB0
z;v2<(ha({@%r4^2&wd7veCB7+B)Lrc$%MC1jsnRl)k2ZK9}Rwfl|{^=4z#@b3`B%G
zL68EPic=LyCQ=0X;Gc(a9WvVMQln)GMrcq$Ggy`;Z#UK8UR9#m8yuZ6T|?bb%<j8}
z20!3p;Q;!48YcOh7UTz(@bPJylO!0rPv@JoMOWij`2q*i@ueajyL%g^Gi4k<J0<c=
zhf@*wIdj;#sUMfdm!O0K$ofOj;z=l**Q1q)h>Qb;Ggu0lro(|ezLpLO@8A_VoJHQZ
zr8;+S!M>=`Dzy~=urEurfJ>8x7M#z+HqI+~Vd1oJbpcuFg6A5qHMLeS*VpFrV2-7X
zp3`5>F<W>@2F%MdOV=Ksuxj=8#S!9Hy3E3gaEb){O@6W$5Q@c67(a*XrBh(JISyDc
z&RE0zeT{NdNFor8@)EmhV}|tXd;62Pa^?zuZ>u<T&#hvp;d^hLLhs0caFrw|9ufKq
z^7n$xnq?q0-v|WDl>+X3_#tdQxQ_$xMLk^H%R<JOr<_359s%>%iBlpQciVw|Vj<)B
z=sDeb^%G)@LjK_QpUW-diC_68%w4{Wqfh-1y}bj-F0UXIiXqwCgQdkeJp6@EBN&O`
z$^YkX`TN&z{aqYrH!ua)T@Ltl$7qek1vfXEQmL!St^mzGswrjEx=$#{PH9F1#wnFc
z!Sq}X3WX}uLD*=b($Kq{vTUGgav86)T8gKmF~cR!dM28R(285s?d8n){`+o%5{u&8
zQU!Cq5OO^|xT*zk?CJ^<<g2AHn?}R(#41uijLcY7b2W`-cMzD`sLvyK2G;FO2HV*@
z&~X%)ELQ7e-@+bRZV#-H*?otZs+t_1sJY|<IjFp|-NK$FD+8-011{i@3^coc)=QUV
z9+H90WuUpXzpA`URZ4U4<;QUA&4c*xqx%tQEh45ZW8DyEp5X?H6X)=wzxxj6W|k36
zCG}~<Y94BJ2~jnV`pUeaA1YQ;$s7`h#KMAw{qJA-4??RQ;1^obOMhIafft*#E|4T|
zk;4Fb2cO>G-r)gj5XW}$T?L8gzC;}2nG49yF9<m#8Rf@$wSsEB_O7g5exF}x(%H<?
zsy<nIJxM2?I>#??bBhQD!&u?Kd+(<|iklz47t8Z=h(=-<JADq*mo6ibOxniPeOhY|
z|8n34qrJ9lK*z!!a{(i>HG4WuG0l~zWe<swGg_^~ipqZus)2SB{zMF{&RIaciC83v
z%@O|Qa&}5~FqM3-URNVAX4{6J8qIzmUY#lmcG|Oj6B_(y|8ij&%|KKPLWKGP;_>~Y
zBLx)ETu`Nx5l*%WZ_;6v=MI(&hpozf(n;)APR)WmaA04TBl~0R`@rlw%w&gyyduZB
zG|}XY?l5k7y$<WBsFJ;|b1~H<7Z!6k51c7rPR9XUg9#>36O#?Ki`cR;jLWAc@X|M*
z5*J)5iwpd?TbP;?U`d)`YM@WQG!aNrHR2DVrEw_J8VIrmT8)^#CBb-n5edXWrMEYU
zXef=Iz7!@eUcs#o-Gk@8_Fa)J+qHIgFjcn79D_F&>p$q}>Bs1?xAFR`&mbMyfS$nt
zBgsx%GqYrz7T)pbLpc8Ii`akPz4+pP_%*!zjqe~=Tja-p`i^1@=_8lV;LyDvz~GjR
z{NnXb!olFlj48S?p1|>^Ul5Hwa!|A=hoMqOv#ue+s{!()S91m2|I;5sW@-`ng(Z<F
z#`M93ASWRNwo5k{?X?^SjP<r`(TJUxz|P6onc|W|G&FR!5x9<6eqhA>3f`V8;ZmWA
zC@&MqtE-ZnKn*eil6u1yx*{{rjw3;5w>@DW(#eQ;gXw4F+ojP~$}aG8=1T4apTSO5
z>tAMLn4OJ|9nds~6@0d)oSnVe7%b~(uuS@yJfOh5Mrlp9>+r|wzFp0+x<>OHtF<v%
zFlp_&ravbQt_s6eb!g7!m*z?bgM*RE@_^gQW#4=Y=9U=5g2e1H2iZ|*YCvpsrHojs
z*+TioV#SQ&Vt(TItk*?`ZQCC=wj;N#)2W)z;=nDN@vndVb7EWU;P$QPUpIu~KX_3O
z5cjZUd9&GTuTAgf_M&w%!yM2K9{PX?zc;H1&viFWK%ilaY7I-7dF;C5X59P4M{(=@
zcj6Cz=9h8)!ZG~ofA^oT_wL(J$YtL(k-DY>fuE-|trq6hA-NHf@idM+`2)Q5+$;F$
z-}ohLKClD%><V7~r>FR9Tom~a=Di!o=D_vlJh<){t*Ri}Y-#HnZCR_6z*S=|>A(&!
zutrDC72y`R@RO%SadTk>sc29%K<?a>!uiuz@fPzT8RJ()esxra2BA=cjHY2+gtOx>
zbu!X`&^_4d)gL5X6|i|_o!@tN$ECC`*Xk-sgLN`kpPn8j_H0A3c}Xo63wRD8z^TVN
zJhonOhb{{jV;(xK6!5*O!$5Pn3ZOZyT+FS@S_2OD*Pj41m(8NNIFD3Vf4`_h-|?y`
zI?-}Ya4CB4B{QEvfS0!Y!@byX*ByBKjmyxQRiT5b<g*U=@T0H(9hRpj@zB5e6oS0`
zIr{x)u`n@<fsG?Ztm2R1oAulrF7+q)-$Myo{p&|?=)rs8kDbKa#R)M=yecC$KIo#e
ze)l%qxqCbQ@^}6#hWP!=Ubuqd@-jbXhOn}*Xt@I3$wxZXhf^=Vj>dB@pnq_9RW?jo
zGwIqifhU@H{B_;BcOUZ089ejVuVHb17Pmh5AT-W!$4;L`s<+R$fGDOLXV3NKJh=W`
z2a2+Xh^N-J2d6Mc$h92kBJYoKPW;&N0?72tzwVC)@PUm<1WN@>UziXlSDe_!;xZU9
z89MRWn$-kS!KBWAM=Q0lQ%!a%$o8p@*6VZ+n7ISp7^~g=0Bd5*PDrH3lE;Qkp@9y#
zS`~~lb}D_D<S4MQSgqr!buM63z3f|%rq;TGtkxZ5!93gs+UgDiR{)H|*UCJy3><8B
zc`=KJKYkBB@X%pQjn8z}h%@FIYLMA1fi~qDKm57Jg$K5nD~hcI?WX>^((6MFw1G{V
z@YBEfD_B}s!KS@Cv2EWDoO}IkB>OzFYu}YN>&<3K11)e?Ug8Yz_76WI;vB#GCtt<x
zTMh_Ef~IL57YDrAEZNOSGAZ%<DP*$fO$}gj<`T{yJBdV3Kcayse)PBhfU76ZA(nV&
zgA1*8OYB|i=^MDF<Uo^ds$UPrr&KaplDXsdgZz66atj%>%S|lu_ikxs9<g|$^S21;
zKv=vE++eiVE-f~;#a=MY##TF4F1SizS*tTgbS-<7qO(L@Qh>-J7zn9&>5VHW<V$FB
z)*2ofKrj|TD?s+GnD9O_as~*7DkajINla!l%UKFtJ22n-8;;sfVeV#!lf63Gs2rn6
zKWLK#qWbyY6-8z2Jbe7b2n=lk>UB>RYg+~>?FCb$K?0{#0Qr94<&%Xi7Ez8mw2#a(
zBRqW#4g**4i@eGORv3(TG8YqzImbD}``~@IV}5cT<L5330AQ}Vg}GQGfh|P=((X6P
z+s@9;V#l7HSjp6pnVT1nHFNnY26|L{@z=kCiPNVsb!8F<@3|ds{NQ;6BB39X&9bg+
zc4>JYkACU%2q&VLxO5u34j;hK=Jm+(3XPgejaJjNp9nTuHa04dc3UnL5l<vUm`swN
z3lwO6>V=n4sLta44?m8*_uhr?|JC1c?$JcLrw`fevZw+mAV+%-tzN<#%m01wOP|5n
zS6;`&*-;TDP8ktz{L9nAv9bHkTLjD9uzMF?`KKrKu=38CV{Qo<y6!6V>(JfR)6(RX
z+m6XF*OZuJ8!V)TnFL&B$`u`Iqci-9UD3_t6gs0+Yn<^l;Op<z=MH#@;v<$KX4(}I
z1xL44q)oKw!a(22r=5xFQ)C_1${aVh|BlxtTxM=)Q2dA|6NuJUP~l~=rucYS8y0JM
zRB3xHGX@q^D;u^0x~j237qTSdvTxZvs`l!_*x3e0IvO0BtgNZCZXoNtsM^PLR}YMl
zSs+6)6~*b}m+|_Gr+F0<bnk!bk||5gvM^^_-~O||!^PuguwmC$3~$?r+0nC{rNvRo
z7s2?2?e34<FGj1s{ilD8i*KFA*oiX&?CjfMe@v%=$4`QRka(QM@oBvB)c1r3c4Yfz
zoPG5e%ADourM~V=DCP1TRELr1OJXNyil6wmU&gN6_aoV#!r1u}IC%f<*naa~G_^Vg
zH*LiD$+MUrALsWG5If8s`NC&KlaQhw-%~K6P#pgG=2OpMWo|*(x8#cq<?JqAoy6TA
zf0SP&`~rX}B+5nB80)>kXs>lu1JVs6C>w^Y3!1&Ww0E3M$<Ds(O0zohkU$t>3arTw
z5I>#R6#h(05zA$?`N5|Q59t;z3hX9<ohEl^2_7#As~nj9Jt@5mYqyPU1@FeM$GSUp
z6fbSoo^!yQY*b>mB)3pDXRDY)H0DD)yT}<_6w#ggQ7x7E-_o#^)v6=m%E@9OJucvA
zrop2;cV)>sbXo_<!q&KS#vn>BgWL>rMjtx-vP|;bx-=xFm&g4>eVDvF!(X4Pi14y>
zHOWB!eJcHX26}~w{>;%6SifU4w%@c1`TQd8eBc1K9@vYW`*+}be>sj5M~>=C9C-zC
zfrIS;2R1PY##Uph?^2uPAE{Iijz9CFV0$s&hycj=KtFEh!2jf5{ylory$Hp5b;B<R
zRF?0#>kt+vXHct_MLjV)HZFjRCLh24`+q3N#a$1460dys2UuR3#mL}BRQY)l=InpZ
zori@#H#0pah78_IZzmmV%QJI=h5O8`TapC$g@P77(qDV=*hw7ymuHbkr@V%diLk8W
zze7)~af8uzgCWNH_0e0e^nG{$u52-aZO&VtLGJ(vIdoJGHoXCT`+^yct>=3xNNT*?
zu9U^zdI7%K9GbK9$c;^5fWK{e5|^HDYvl$Q_uXcSSf8Vs45`a!*B?Q;KZ&)v^jnSD
zJf`N)8jY4P*bgKE7-%hH?$im)%x5v2@FU@GqYa-`5vUF=)}{kH60h9jw2tX2?b;x#
zIY(<P;OYXhHs&hF6*`7W9HA&ob2iQ(vD}UXQ7e_O<=}oq;t3RUIo(U$O)~H(*{R&7
z{a^d;xEZ;XJjPF*1>udK)$z}N^cOhtou~1{FZ`^CFI?isPtRb#D0@9O(ylogk%?3|
zYE}^-s!}+1jlM@K&?&$u7Dciz1&x;^epO$#c<aL-L?{tMex6@=Ljm-T42e%-!RL;?
zg;&1yeGYE3;*uT;N3gQEfKW7w?9u`n{C)@eMuf&n+G&kH_8<Sof5yW26r#qk&wKqr
z`4D1Jq;Wh^lqj*?^w0pdA3lKD%M)T(n%7IG=Y(hj{4CshgVC-Av>LXWjWBt1(>4Vr
zS%!3mr@@|NrwJdR&<Y?W{PTl-M;|ZYS}GPYC4~K|)dZrGE!1iv%bBZ4I%@E%C#}6{
zG%>hk1Oq!aB3r794l|<;uK8Sy0y*K+@1wxcmdYQP`3KI!fq7V67;{@+9DY#QebCX1
z6~m~`pL;Zf9YYbQ**P4YUFIi6RIE{_@~$vFgJ60cXs%ST-4(O>beYo|>tL(0hU@7p
zkhM}x_R#7e>2?=5K$bZd32GiAwNj%EUTy=pwOrY9#y_IbATFG~jJ<pJh{woh3W7m-
zNd~SBvh<Hn!TPP6@T0GPN4zHMw{7IdNehz~u3~Ot3cGH(3B_z4nb`%gD~uK~QgRms
zag)AFnXw@PEe>MzNg6SMiy#>0Km|XBD1e4G?}qu$=%Q39mjr88{XSeeaf*LGEC6ZC
z!M$QV4n-MGoVy4=|K1x<K8+}U+yf7N5O;hmjn}{V1HAIo_i_894`OihI%MV-aO(Bf
zu>a0mkfFhVP()ljNE6+6_g(xVF~b?_jMzxa<h)`2yb}ERs$w&P_LC-E`rjXkAeUXi
zfBfp7V18@@-+1Z&mMmRfU@MNBLH^~18;rKQbTHi3oXhn*oCj8(s`KQ9)xffsj2b`i
zeAu+U7ZVFb34@J;h_jT5nH64ghj|$m)i>GlQZJB*BQiXMOEY;aE*JSp8Wt>>a%4&G
zit>Z5oXKOouZfL;Ci0iZbq^}VGisXMl^}KYolMoHw`z{RQ4WxyzlDl^UqCn6H`>D2
zxgp%d=#kfO{Mb1WtRuq4`R%jWlF)2bNA7@P`Fh>9EycFgK;9b$M<9$QISXWOtY&Dh
zu-0BOn=8ZvWTC+xye%<PjkzbmBzFm8tZVZNaOcsIeTZT;H}Bc5do@WO>LwXD{H|@S
zC7M7R_iPgkdSu5|9Jv2(EKJVg*wZfw03wIMi66a!<@qJy2aP3TNc8vNgP-~cw(j4J
z{`JHB*lJ?K?(MkeiAT}H*`-tOq-NF44}1U{cbO?)45eZbJ8nIMZ5&u5oK2GMJG^ZR
zHtpXd_I7Q%`6k4BQdpdx6`2aed|&_mGx&>t|2tT?I)+dE>Mvt%auOHbIF6GqzJ{HL
z4`OK3X5^MK;&r0|fz)81&_c;eOByNj^xFD<qTw>SilA%BV#+R+6t53$$ECIJIhW=w
zy=&&UIau;~!ZqLT{_gKyS3vvvLi68bi;WEgAR;`bZG384XL!MCmT6YGX$>#HC`V~D
zQZ%rP{*a>o?$za*7*8Y#K`{)@1c;ObRH`)al`q~W)_<HIo#Y2|96Ju|K(0g)cy(S@
z1<)=OQJI-TyuSxY4$6UQ5mkPmE-mE*OAZ*GN{-lq)v5-mb-EPnM2VT*0HI4&Ds`!}
z*F?!EqV5!*$V!MS4WO`s{PYxV+cShntAt}Oz9B$_q>Xj!2N8=!kYCA(b?4!M^@16g
z;H$#EU00D-k=wOSNW%@xKECNn-h#~#&m@qPHzRZ`PEIBZ8^|)vYx4o%j6r0pZA*Yh
zN)`S6wB@2yMRw{c_*=?L<Q#ma&-5ByermoD5G_nhi}BWv{@iC#;`f#20GFGa#}Yp_
zYK1Zf*c9&g=!0Thn}FTVL9Az>58F8y5>Q?`ep>wgPF@OAkjm2ZJio2qvXaqjMxihS
zmNkC7QZp+Si{r|va~L~$4sp&r>Aa|NCVTn#NtF0|efH>a)JtU{gY}IJWAx-n^!D{)
zBM0NLbE5*_*Kga5=fD1KJowp<p;~I-hu{7q9K8KO?7H=!SPnXK=?cHEym*b&Yj|bN
zvEQEnl@%7SeRtoEd47!VJhUJC?z$bvpFe`DCr<O%A=P#AK^)WkJZbpD-}|lq`O{}^
zNC#a$I2(($+ZyafcKbdlok(fMzyfTu&h||Sj)oB>0W}+<jH3@q-=f^h1f6aC{`PF{
z$B`rFacXo1n>P;N-Uklh)zL*>-c`j((B=nmd2Ag10e*trvjcCubP}geT}3h#6ESUc
zA3<KytjsT?C!Rz!5<-n^R$bj)9f0xi6Oo#9#assa4{QUiSZ|9_U`3qB?RpJ8i4a&Z
zi;<)snN|U%MoH|UB0F3x9usDK1ub!6(qmFNyMNy%ltMm~H~{;lVG7%HmjrThdKtP&
z1z5f5)%kB{c7f&&iE)<q1lk&GAZbhIattWIv0u#wl1@fzWz6zwg_r5;ckV>6mBr}W
zqX_Yfrh9F;qsve7J87-74S*jLbdznIl?KDQcE30=A=qcKzZb=otY{WZUA!WKzv*wk
z{FV-`J`stj;mV1#IP=OIygZK~mWo>uo1%p0AWKPH1h64~9ElNHF*IRJww24K*HB+s
zPHXPzc;U~Dg1%??<1$(<IX;b2wtxV?pBKLNE!^@`58(F4K8zC_w6^Tsg<t&7e}osm
z@k9Q6bAky+;|cEzjfX>k7D5L2@lMb6y_ONkwnc*xT0=veR|UH`lfU!vhw*p6|KBlp
z;WB@{QrBoWv&8j;Yu6vpwpl~~trc{l*)nOJ`<!G(YhTo7Ke+{P(AI?-2eXwT!W>+;
zZ|p@R=)>4#hBJ^}^la?s%rq~`u<hGNFp;SslPQP|2^J$A9KxRcn{np#v$!}qjRXbL
zh;At{B?U{%CER*wGX{6B!;7cq5ab7YDCoC3=8DGwN!GE($_j$j9D2y0U0jC0)IzJ?
z6n}qxX$4B7ih@t<N5S%xNt1n8Sj>s%6(MgYMalV9lsL;FbN#w?eF$=9-K;AjolJ4E
zRSEFrlrH<Qhk4OcJO)GD9e*ZStU6ezbx-1gy@PJ*@9rI5UQ=MsTv*M~{DOD>s@O&x
z$K3c7Dsxx#`~kK~d*3WL`1@SuuPcpxQpK?I@P1r4eI93y9K*Il2XOHI58&*P<7hM*
zf(@Q~{VhadQET$7ZzwEeo^}m_L5HGYp{<L<oP#7u7<3$N*}n_tUVW2SP+^@x8^?@h
zEM>GkFP*~aU#hA#-IgHx6(<IbN{v5O0J%(7Fma6^|Fq(!$p1Sv*pJCmlbAR^idZC$
zFbDiKMIiFWC>09$@XvmhGvG0tfBj86K>zqYFOjLcJT)h_JzO~U7IKTrxc$-l(X7?^
zg(h%qV-G{@2GFji(P}KHX(sc4l$Q$2`{~JWG!35dZ{}o}m{D(FWpM=`x??Lcxhgho
z8bqC`7%%dYn}h4yW1KAxrSYkcZNyt=Ca|zj#bBD3;MJCp0jQZl`=7#<0xnD}3Sbo*
zqYc2QRU7CVNMif$O}I2RiA1e}!J!`HiZ!v!uf`vXm}}Ut2pyH46RpBg{XsM{3kYa+
zq=p7?<i)pybP(bv2r(ExMJaN|Qg4~9FikK26&+xyRBRb6T{Fr#9|v5@VOXvNP(zUa
zU&ChCvakD=8is&_xuPQvc&+i4r@JKk7Mvi9E+A_$Y0aokRvAc;^A4m@RwlDANt&<$
zu7jj8enAT-gD5MCN5hM`K$b3IC4PZ^{1-ltO1^}-iD{&Ic`1MPD)v9{A=EN+91t#X
zkmX<*kBZ-+CYSkuWC^QRtHR<H<$y-uS?7$6bXq#ziGh;#ORK(TFJIN)C#6e6&LJVo
z%X;Yd2R3iOgFpKjeDlBknHUM)ynm0VdX^`r@angpLKy`-@R3gn>H7!Y`WtK**ltL2
zYiFgzWNA2~u)HGH^1QbVaZN~QiM}-Eu1<)@8s5BB*wlvB523P>m!^ok8c%{S+yL5Z
zTr7i{=1hF*G*v9!Phv?5b4-oV0i&u`dCZKJB(!;9<A#1@o4o8%LU{Jnyy)~MA^}kn
zCW9)L=CdfRk8wbZpqVeD#D8zyKmz&6X>3XQIE&eiA3l2;;Yd)dr-8{7p=+P%cnHtG
za1xVavpBeKJ=&QDv_ch!_HGm&-m3-9dJA>L`R`N1&8P66=U2pD`Z6z*a{TvtdXm_^
zXCubP=1?O4tIuZvq$>M5Y11wT+E^lr48MRV;$*I&U8jr409v6GmSzh`M9WZ8gJ7gf
zJBI)ur<~a@QqJ`;tFu_gNG;r3gBiMjEc4oS(B(1V&K`C-3|#-+$<46tkH2q4UQ)vb
zwBEWb`A&;VIjm&Ig?|6ZU;TM}_4oe}XI?#tu`4UMhl9;cx9-M?=Ux#Elqxd6aI|#p
zir$yL4I`q=o*um{Tn5y9TA5#hxsqHoH#y^7nw-`BsfzqmJZx(oz)MXcY9hV(^>6d)
z#*gfB21ma6BtJ$tV~xcTibRoC`*G@}qx|ChGKSNeglrJz7YC8oVA!gz<##2veeTE`
z;%|7br331hQ202#Hg`PwASOqzpj=<Vmc2VU0EbY1?KtAeWEV24nAKYJ2GFkdA~P0p
zCgy9FbO2i{p5S&29$K6%gBn204}Ka>@I~XeI9nFj6(OeR(^t%xAF+^%AHFdmB!wgg
z;Du}j{ec!Dtck<7?h_-NgZ&B2%w&*G$E@||^k^aev!#WsIOsNWwmi335;`mGE*rf#
zgJjsxfz^-RzKud34p)}Y6IL*{v?yE=q^<dkQjuozTjm(B&BH1U67ZkZX~CmdlcJzm
zDPi4)Vbpv{lsKq1n?WR!iU_AxB#)^rD$!+$LKiL8WVP@HSy_)oXIEHfi!E%?hpw?&
zXT#0&JvHSct&5GT8|cdSr&)}wu#kgRD)5VH)TPVPYfIi&AAe7$E>GZtpZo}hHvY6&
zsQ8b6^ye5qHHuO_j9mwJptLZ9*(*`R(h2O?vKLbqt_WS9*3~d0eZJM;)k<Fv(gVFB
zD}Z!Wl8l<Qn$cuatt}0<Apqu~=}T0WIc`KiN%8~*!G!qZlXHMHWRofC>|7I%PsD)M
z>g>7mR$M%OQb-He1X-){)DSZ=dfzR`lFhA{)l<L{Jw3*vO5N3vonI6eA9@|>H9GUc
z5Ad6R_*E461+QE!bOl;-)sVup$n}J4%35F8|4|=*aI}ygpUEfnra%jA&LD_I&~C04
z|Ca!Xu6P7s#6~rvldYK}o(8CD{(#t8%ghxuOg}h?1&VUtS_h+9%_>>eqwm!lEo@wu
zMx<WA*rgft52l6onc^k+^mGQrVg=z)K&;&eg><(-G#U~<TDe@Nla@+K`dupZ*X`bc
zg}Dr(t&$j=C|C7Gl2Yv?w&v0%U6FPVN4H-FTVvRwz*)?|x^>un_#md{tEiM~Xe?eq
zY~3!AdC+du9E~tX*~#4Tf;KJI%T-_w5!l$O$7Te01FG%uGzUv{FkyMo<El0;kLH)x
zx^QxFP^RqC=$m5MXYXLYwGhx`RRpRl3(MGZct7s_#3RUM^T^K4;rP=pBHXh9H7$t6
zOQ-ShXCLOQ>#A@AY(Kb1Xrh^!1(b6+OHZWth}<qhI!MOEacqARoMX8%Ven?NjCuUN
z4TM)ew?!kkHzllRH{E+DCeMuG?dM(+mb7b4JgQ;^P+h#Xp-|Wnn6tKz3MU48ZaXZ_
zkMqZl^K(b{?9xS$8j1wABu$WZOs*Nq)y*#Dh2)azNs9<YH_qxQUd3?gk5|UO@hjI0
zu3djVT7AEw)$`Ik!kuNQP_c!bz!+$7Sc0rPRq~oE5^K_I$F-TYsv3!1&8CKR=`a#O
z1@lV<Wcbx|YH|@%)5}PuBIxf=imjbnwhZ!8Du|nI+9dp$6@Eey(^M351+*qi<gs`}
zl$MjH&w}NbkT2FyF4y5VcOQuiR~@*B9Ydt}X;M?qzR}iXxaCp>yLNBHfxB<ViMOs`
z;lztjTU7+3X>p;^nhgtJ-EIP{3&=WB(X0lSeUpK;GRP5q=(2Ayuk8qM`C^@Nfh~Xr
zYw*f;X?{6xPb+M)xhfv|*?)z*9=#Xy6SGE6h7K5{sT14l8SF#<`XO9CaSGr3zy1v8
z-n@YL`rTMrDWO`-WB2VhqqLkwW_F&l!~l--lANqkeIo-X7fOcxN%u7qQx#=)Tl1o;
zwoXo0hYB2k>t$zIBX^?bQ(Vd8?3=G)`urvAyzLObxFm$Vi`egK)~#~6h|M?c!PbNO
zP%Px$mCcJ7EIl4gn2|r3hBxQ}CyslAB`12*;(3zY?Ba!!xSL<_?)lV5#5$X9k7;Zk
z30zOOb{*~vV<Ag}g*0-ib+h$Ifhsb4F;7s)W4fk;!H5SmvunE?nCV0q$4*Tl-YQ@q
z6+$joLXv-v>{E-?I^waAV4}mrJt!2a{NFyTEEfdJB><l0fE<g3Z4+Shc+~WuC*)T<
zjUAhr-vS2(R(Ok(@kq{rcB6rKggVQ4&Zgq<$J4@*5bWQCcCDm`)z~CRH)FN?V=W%#
z;f;lDDvL>gDmS1khATNl?DnjV9AOQZbkl(~&2zD$>tE+KTV`MGX#ba2HmZh9wuJ+?
z-+{5y7qK`!&lzY??0q9gz}V?g&UE`wSXse|myTomEq4eRArz@0%GoY8w+4oLarMMo
zLQm`&>c^pNoACPgek8_Ki8ag7;kpJ(KJL1(bGa>PUWNznz#G;Ts6Bpfm8KI-#0~VW
z!`YXQBD=7NZHM;r@_d=I$)#0g1Y(^ze)|Y7;R!6YYXGz7`IYX+ThF{8-j8Ie2b=cq
z7GukK{`lnV5R!+v<(A(j7D`~|(nWp|TPHGTsXAE2>w5!euh9(iSq(5vDmwuw<3O{m
z#AdEA4rx=XbFH-mE~>uQ#C9@R42qmojkfSO_9v2vh3Cb#+S!?m08)AmrD8>tghyXJ
zC$!t=pL<K##)b#e;s6;OOrgq4c#=ItbHv$nlD7qb!5#7~mzVC47xACX8V76@V{=Ue
z%Q-~(<Extw@bA~5Rg1QfTg3%p-etTU^w80vZ3+Fb+v;FnW24!&A~;zo+}jbno(r>I
zI9H$ga<2?$SpD`%4tA$reH*!nOPo!W@aWHeN|eNJy>Jwjd>*|6Dct+%kDy%9kh)sN
z;&KHcEf0m4+^u#LI}Yyo|JZvE@VL(NO!PfdF*BHgLGJ(yz}`hkBt?l5MagQmWjpH<
zJ5Jd+&N^jNH}~%I?DgI!cQ=pkZZ>heX|`j>RkAJ1lB{CU5-EuyDfUhRAbRh>3<khp
zaL)a|@0^)AZBQsF5A<A)3=;r{)6W0D|5x7cebIUK3i{f6;Pd;DoS8vEaS?_^bo-gV
z_&uC_<p^H=&W})0Tg7EAq9#R(3sF#3j8>7RyDT7Kqcv;S09z!QRhFrA#N1l}oPEu0
zaEkS_>%jwPcV0(tORHf7*8m(YH->xqaqxlt%=K-*e3kFJ+=!Meany-BRR?!YqsCcA
zY{hGcmXzV@v6CpNs}oVM*jwY{3kK{f3D;JhOrnBmyEN8Z4v=*btt9J>3gt``tfw#;
znkohx85u^0Sd~4%hKZW4YfDcY#nlyPTw9L9XpqxNx*tWe^c;B}Cr77wZU-chB6hU(
zp}%Jsb+x4o%H&B#!WfhmIn++V0wcC^MpQ;qBGRd9X*}07V9d`U<;X+L&OKPQZ3m`$
zn$dIRER)mCJY$YREm?tVaIDBu<+3BtvPph0eW;}^gEBxU>whnsy7y)yMcLwEW(HYB
zC$(s{3%5kDP%P$)`r(LNKui%)VNnSEz2lg16f&K!zpD?Cl49hSRw7Wo2E${(krz%N
zH9durkcfWozYnrE%yh5WsYy&vPH<{lT3;=IpcrRfdyBOLNC)BIuYL@*>l@gdk+lIx
zn8oiyL;x)}XBA~Zwu5cRtK^Dim0JvKG@&68#S>$JCeb>sHFK0o*O~=v9QH6lg4`Fx
z`=y#`9!)|ji$9kN>=J+WlcVEWy<B3j?rUkoOngf9U^CrFb7a-l4dRe0K~Y%|9{RN>
zc}T?0M*UrVApbuq9XPTPsBGMLvW^}k8?{ai9#rPdt$~zcY6Pj=TS*;nrH-ePVSr~g
zEdg$Ro(tWBGbr}Xve1Xu?cin{i(a^#*$7$tr+xvf1X5>DT|;qkgsC%>S`qJ-MnBW`
z&yxCrj2lhS`)<JkSlKBzh=_U$tMAx@HLDBp{I{M)V?!zKKCl~SuF`9ijFF%&(l<6z
z6cZ2CG(xN6%37k>OfyVhDlj`A$VPCtlqz7E_{v^4IR}NyCXxk^HG|Aiqcs6E3&M*H
zpI;DRSKJ$y$uVIDZgEXLJ};!$G=BN*@4@Xzi4@t3iLp{7yC%6QySA|&W#s`h9UoV(
zCj$n!1{*CZ#5*s&hB1)>*RET`lZc6!NQFhz+uz=Wj_b|r-l`ZRA7O2P<z{i^G-zB-
zG)t*I*@zQGkcKK~%?3pZfAhjc)NE+Po)15Y%g0Y(dLqsdtX=v^b=AtsRXk9j1~=C7
z0ewCsu0sq05*42lfl63>M!O!qALm~`#-%TcVyWC>Sg(4Z60fiM%mr1wOgs*aFw<x{
z91=bVw-sn*gZb=93yVs>qD5iGu5>oKlJrd<lOuzq6BB2LTBm~t5T-{*ktA`JIn`PQ
zvZ-q=KscTdK<o>ls3?fBk#TrMr0Nr!ktkR*;xRHT25phdh%}KNpUMlZE#0W8D;1y{
z=KE%wQnJ<lM%SP+ybj$=KQw^w<oV%BP2uEAud<DbFH`_IuYk=0Gdd8mjf=3(X2vMU
zB4<XJ4Zo9h#+QZ&SWf#wYE3({t@mOeo2FaICXki0wcf>Qve47EY(Q4Y1+qGTm(_;h
zY-|+Hxk<R?7*b<h7;U+LUHdlRp-&#dtdfU$R|u0sLn70WG1=FS<aB}on!uG*r3O2D
z`FoNSEUhlbrFV|8#=(w5`w<fdG}S~&`+(dG6ib&rN6Emp$z>DGE;D|k*D^Pk!hN6q
zC`xOpM0B3eXj}7K|LkbG&LxhAf9=y4n;5nQziAQW*KTTLM$Pa@za<i-D0O0F1fxR(
zs9v`gk9^^C9GP;*TdZH2PQw!Q5}3I&J;Pk_`1mCH+Pc-fF69(GkZuF*!ndSZ7BDkw
z57|%(NDIlxCSb5^Hd(Pq4btCFPp42-5kZk}9>qQx`93Ez4br6pNpl$>M<`jGx?@wo
zUH9$e?s6oQhpMVV3=NKBbwd?LtVyzo5&tMDK(?l?3<U-GTyx6L&qHf-Hzvm82>8A9
zXeyvm`lt!L=*u3^M|1{5LM?q4|Axr+cOBfzl(JwXgnbX}#HCAJc;{pr{CO^21S=c;
zxC|@<<7cLqAT$ef>l=<nZC$;F0SvWOquQ2@_={pE5F;B?&86^U%|hslfUF_9*D|H#
z><soC*o49Y7ve*`0(2*N(vMPyaMfx!g2fyIP?M9y!ig74HswU?qr;4%F}8NmIN9`P
zwTSetzWokPyl@y1G7z*&^A{@_*iC>b_9cVmMzhpkAhrSNGtk(1_U{}B1q$%`4}Xet
zN8T2ZdyOVqZhU;N*N67YH?V&9b~J9;#%VtZ=ujg|VOhrn_I>nGtl6>|lOi~w=SqnK
zjXtZXi5Skm_LjQ-muU1zQ7`eD={7MqoHf<799djQOx*_B1p`_n6_ZlFWkN|YMOK;U
zM;8I>r52IVsAPFW(z}hvX9e&j5D_3nVBJ`gkNtO4V`?g?9ft~Uw3+Ey21FWQAS%qj
z*gUq~vls3_hym@RAG-$wy(4gm7hYHx5^2#KZ?a&%Po(cEkC&Qm#Gxb(ZT;#B3=fQI
z6JEyX(w3?uE4n(eI%-U{VRi`>e;#`B0c_p95k2iaJn|U~`I&nRIa`0t+Wi=#SbYR*
zmOYepAZqxm<*ax&N3l8pO~2N3X(xMV$QDD%4Cu-*s&K(1CcYp~R<<8-fMQ`f=p$K4
zF-tYd%y&(uB({tveF&1~yXV6Xz?m1szy819MJVLUM9#7zAy`tu)GwwZ<<K0aCeyr#
z;O50+QY1?vEMo)1nw9x-N(Rb%S~Aeklq1fTvlqpoJ#GRm8vFJj8Bd_&;uY*XcrQXC
z)hCw@eFRCPw<J2=df^Jj2S@n21qwo_+q|9`GgKldT~&+X>RNQPUPssUW;J@AnPFiZ
zl5~XGN@$T9FYP10CJ|{nGR$Nh2HLsXK)diso3#2wnQX=lLNanjicf!E!wkQ;meXRf
zlMG@)fM>qngB@FIabVwCv|PT9!M<U<a`+-zuC!ovi35rFG--sRv?PT3x)RnbO^E21
z0Czx$zdo$D-n@aqp*Vbn<tT6501*HqHIu*{dp5H`^I*TqO1N^q8U5mMNm>zFnPQ-O
zfQK*k+_wXL-GgY@P>;J0?Bqx{TP~1|?zcLZTb7R#FU;%ppscb8V?!hG=7(_k)MZxs
zuUx%`XWcX96_bo4WSbI!DeX3@Z7HTyK0BCTU=`@t9EzPYt)&E@b6S96kUE6C09(L3
zDP}T;gu%*N_p@bEEc<&!(-fcqg07oANG7J>5Bl-MZ+}W0#z{=X6qHt%sag{0F=&ys
zblm8~%+!opC$yyc*@hfNYb4Y?K01tD2lwNShwc>z?Vt{@mcf~|gtyAOYWdK6_XYD+
z%NSWP{hiFsuC%7@-H$$m+Kr7E8t&nVuJq@gQs%fmOM*HRGh>LBm*C)Me?=TJZgJ=b
z@$CQl2F|~J0wI5t>$9rj*sZ-*`W(v}R%2Z3F;Y*H9FCmfngH9|5$z&CJCi9GSd{l|
zQqS}zmW?9R`sj^7wzi@G>+7PZEpnkWUq;lIf^&9Uq=|!=73t2JH5Ito+K=A0cH}wL
zM%TS}R-?#2hmp=!u}~bmsfwckzQ`@tx^en+I}-CA9QxQpWId0u(Mjyyvq{r^l{3){
zH5_JmDrg>ko&8*2t*tA^jf>5=bm}TovgmgXE#)Nf8%{wLbwY{ix<rMcni|c_ha&kX
zDh?wV8^^OhI)<D5KuO~cOeMvp77JgoSpCSRTDGo4AZJT3>c^O+&}FS*6l8VQO|@7(
zpvyM(WOF@M&bnb(Y;dp)kcCOVz|2CBWtb<dBtx_-8`f2FdWsuBWoy=mgKrwIJ%1A2
zofE7to9A;QJ4LT<<mq^f%MI%2tPTVf`;e13w-gmV`G;TNS~u}-vyrVnZdGzLz)U3r
zvkt=haHGhxVfPNETAldCi-=a1qhZT-Oo&5+$_wcdNpW>0i`IBuK6pHNc<QhIo}0vy
z)4{K8`~7#}V}JAoG+n)nq3#}bm$-#Ym)9dH+EKKfyEL2mG-huD?Lsd|Lc%UW%4UH!
zQ%6vA0gP^=X%Wbjh-Cd<mjGE0{H}SNJ$)TN`{|qb#mlGQ6bMPWt<^Qf*mKWjY}(#{
z__P4Gu@SVlbco1PM4=NyxNB=6=BDFF$r6v)1_K@u$<E-$jS<Yji<Ec_niSi-t$}O1
zc|I@d*VgdFSXFH~s>K&I0?Nvw{1Qv6O0eyY^{hcl3<m1V_KW9=mPAomU&#w~YAV5?
zR#jil1bUh*BQ+-S2P6BG#%&u>63s(?k%+k50(fT<76yZoDFv8IEwTY%6-5uQ##*jy
zuEpBw!^)<bsBCj68ZE&sqTRB*ILPY6g$&WQ{yrv<%~1c$bz)rvNphDLj-5wWcLJgE
zdQ6VSn9T3Z^JEUav=b{`$H#vCNj6-Z7#`<Zrxj%N29ZEfNhw}`>Sy@+fB7qX>W{yO
zyB>W2BSQl=W43r-IkUOS2nu_tO=)I`Ql?=>bTk@=?YMD`ooVYfZ)6RHxaPG+yyMm@
z*SIut?}r~lPje^cM5Ip*S*pj<*eunvPdxWB!l5V+AuLxLfj)nacuo>CAMY9BhTTFA
z4_Y2LeVg935YRfLX<D}_vx=0y93UIh!puB<hA*1kP_wfsG}acPe>jE{Z#E%MWE4IT
zp^);HB&!=J-|xk-w=QG<z1vV)8pUJvt8wY<Rg_m2WA&y+0f-xzs*{Y5!5z-ijwgjx
zni3*fot>FuP9JNEipaCJu@;RRSK;b~8`yT|MzP7FSht}L|NOU4Gq4i_fmDxX1jugM
zv5q5Dvc&0b>xEOGbk*u=9RKAhln78Rt1d;TAcUhYAIBa0wxZ>F8`d;bi-i})+ouP_
z#!tfMR(Nnhf-#*|EE`ra=)~$HLbHOF{_hRq+%|M9i(s}6Q1zBI7TTTNw3m$rtzA>g
z8p)b#vd9YO*haF(=U}TN(uS2JP1jd~f~?Azq%(q4<T<im!`_cPino69f{4=kSa;S6
zviiCq5C{fv>FqaAR2b!JH7QbU=eP@D0c5Jo<uW+4?_m&2eFTbH%eQXCP)D}_#-wVm
z?)T&Bn<rJCaPewfIr9$N<?MO<5u7{v24=>mSgV5~i$K1gEuV&;c?E@}8<CpkH%%GY
z`h9oc;_Gjt^I9|9?&Z%B@I>A8EaFOx4M-P#^QsQ$%u2$w6=!Ah&S2{Ck<qF3Y-J;-
zZETc`jSX9B%d#OtGt_R=%`g&n5m8}0K7$RbOHmkfqy1(Vr|B6EZCVtZd>qAMX}Z>q
z#H@^MyBZ+RO!2f&TU(!qUh{CXxd)rqSD>?N4B~uc=758V*D_}3#3uF1%tWBmlz6lQ
zeZv?L>0#TAE)4Vxh_tDVbxdzwZ%21WKSxl{KYbYfeClA&iPzSH{7?YxP3`Dx=|W#u
zAM%5K3=fW=`AVyJ-5y*!e*<gRui}A;$&m@fW*rzCnL>WPM<+>WpK2<m&b$F&VaybA
z1FVq+Vo}`!tfRe423c6W!g5V~**3oPhi~?=B)hVcr4eOxa*$wj*Ohdig@eiU4!m>t
zI6~nd3JL?be)gico?#o1HBI`7g%*tz;pT-axOwd=e)SK3pChxISFf@fRp#K5km*TC
z4#}o&``(reIARp(JlX2d2rRK@9GWl^fh;wyDElCB@a7Ab5H2pljzbUN*lRE1SHAe$
z*!}Q>xF`Vm@KevCtfEo`8?zj6&@^0OWhq>wM&^*w+tSXXyUVN1lBykPM1;7xwipwP
zuHC%DMOHRH|BFBP*zwyyo8xwBXnyzb@YJ5<tSZ??i$G=?lqPjZKWjj1wj|F+wCZA&
z9ZqHj5KE`EwHF>ap*A5ht_|7p0$bw{Up6+4w&re;){U}g_b;A3!exMx;xMasxm~h&
ztYHDdc_LL$GGOkyqZV$5O8sfR+=ix$O=6MFAsh)}pmzX?SOUZS!%S!=b4PmNq>1qG
z<NL7t-tGALk6%YmO9z(@Xdw;{40CifIylC{B-C$Vp=fG!F_%?BRZSsw?rua+Ukvfd
z1Pgr|fdkpd(g3t(AjHxDR<f~?ft}iy3A_vgBs#HfTkTlI9&B@I7Z`>k%r)8UP(oUn
zNKwpUF0$z`Pz=H{W{}n7Vbm;0L~vAI2#Rc^On?d57pWj1S))%Km5Z(;S<?_(oJ7CZ
z-@Ow(H`_2h5z920GH5I5+=y+PW6Q5}Dw>+Uo;^V913K(UeT<&dZZa$5xGeVJ&FfcC
z)6mG2uIp#cV%LNBi-_2ZYvc+c0DFEuDb{hGSg%R8S|97{$JwJt5iKmia@7J=H7_sx
z!61(~Fa8c?q?~R6wBBa~(4M(nqs>{PmHN}CDJ(+=imgtmVws{+*b#vhhy>V{h-||(
zJ87sj>UpKy9Tp4B<s}Nv7)A&BFflTYAARQ~{`=0>E*v|09=-kJP-ds#n2WLFK_Zbv
zX;~QSS4R*DIQeI<0QREtLRR`3ADx89<K{Xa)mPIew49m~k?Jr!0(4tMv??j{2o(eo
z43hXVw7Q_of6^Cw+lzFL0H64WlcN*3cCi(5VghR$%P~4OWf*i&GUKz*HMsPYIN8WF
zkh4qz#oX0T4<@8N+Uyjv%nSxuXDtrh=WW9#$*sU8FA-!F3&>`e8qg0`m}LoNliyex
zWQ{yq1zGK5{W_y4Z){))$&>>-58cNgknP-C8(KyWG6~^m0iONFw{Yp`NqC%IOiYZy
z<y4z))akEmT!n21_F^g?!@K3o>iQq5^r#3Z(#@<im=W-jey$3@65Hy`F)!SqH4?RF
z7w<dIm4~^RX{_IKCyHw8k&?;(?6O#&Gy$37$B>f>%4(}ckTHq2i&s%vT*bYJTPP)R
z6M1rYWNAl<lBpfUZa2dg{$M9)R8>|KQ!t=QH|4Bzf`0Q!`e`azVUMSoWD4icUd0?u
z@uWSKOpyxRmlhy_$-NKU0l!#ql(MhiScjtG2)bH(keZ$5sMIea8M<F$YL@G)FaGf7
z_?NFfh5J5q7iQyelvkIr+i2s4dhES_Cnm-wGx`K+cT-{~eC*Q?F%#jNfAd4QY0g{#
zGS%rO$Hub&sINC`wW`>7Ttwb;TvmAV@JSREc(HLyJ@Y?hS;rpG0bG`WU^Yk802Z=^
z$zd67HvCQpnzCZ$#_GXE-|&*n^;p?B%m90*1jSB;%XS#SzT}`-YMZi2)JG4p*^zBY
zi(Vz0S}{$NMT!eB&^3rxpL$WGx5RCB!Ky0@+qv140G*2R8od7EvnXFvhdqxxjLyDh
z_5>rbZc5=>&s`DV<+BNBZ!M%9n;5~~k3NDe_w5nDKB8y(@OzpXpWuN5k}RaL<brat
zMOTM5CMQQxzN!{?eCU2S#Cxq--@w<ta&;Y#;STo=z)wIsPh#~hxXJI#3D%MI2lH*U
zW0$}{QU`%%l8ZX>8cHE_I7qk+w2J`k7>i)bIv|Bj6T~!LtLR5ewfoUY7z%iJctF-i
zd|G6grW&QAF8bM*=SEFkIqFwep|@**PvN>X)gpzT;^`Jr?|SgiRumQmv2Wj6{P|xz
ziLJZ0;Jg2F7^jY1L}gtii_vtq_u}+h=h^axUQ47f%uE7m4p3y;-qIx&=Mc&(3)RIT
ztHgJwW?Q2NMg6b>jsA{{*P)t1I`H;$FQB?2gvqHnj)pTf?CGddwoZh}a#kl-F;TH#
z8qZZsQ)#e>zL=uebeSOSK_x2-h``vWd6}dPm0V-DIY8E0la+0!0`-T7WNNNS83zYs
z>a~hur(vjICKf|+WjU%E*NTI4$_lc^0=HrMi>`Ul7iNv*Rh!pi%bj;&q<@f8<+0uY
zR?p(*ktDq*4KQC`0Bx7Aq3>pg_}-rZGb$TQ3$Wa{?=A!j3lJL{MdiA+Sa<g>5l~Dq
z(<0BGkInbog^7V-ju@Z++Bfj(w|^iG3|Z`pQ7(N<lUf{0LlV%snEuvxvpwVRu-w}`
zKW_k44Xc*SRG_9K0j>C`CT;`mLPcYTqmP_iWmz$gv73Cv>^jl9Zmn3v6y;TvMi2}I
zm=cwNZUco$W-1B|6ws!6_Q$VbXkY|h0gx3{#SCmTR$E?Gg3+Ndv|MWwi`0pId+M-m
zZ4?#tRSaB5pZg^~^V=U`dBU5QoA|y>mv6E_$w2QAR<El=l>l&xVoA;G%!x}P<x)@(
z4RN|<7fI^5su_BfCW=gSGOG7pJ97nH%}pYD-YyP-QPtK)f(2Zaj1{|VN#%{BxVq2A
z0<dO%1mhrs!L!Yz(51+h3u$=_Gd)bn)f7|g!P^#Ob!7lGlGWAa6@5+CSd&)tO)*0`
zK{iC&Qxg*?sj0!*JGQB5zGAJ*nn702myH&b;LR6b#NqG%7<WDRAR8<8^|zvS(|Xix
z*`SISY3!JH+W^ZG;7Vh#1MQvgYCucZg_>Whc5cD_pZz!j1z~txUbLLKfHN;07JDbm
zVC)g#-y?v(_2N|&mXsks9K`kq4xsUlo$P@Yjz$FN&WS+5t$L4%JxnDKpJqgP%ZvyX
zsawwM0SzmVUm!+S60WT{E1R!3rwZHJM|+!_`#r=2AV6UY8~QV)S~Ab2G)4l?{cE*F
zjhVnBk`ztReSCS4y?(go5||n8)qKb1ReKwfSJM=@xalBgyUK~FX~aYX`{~a=hR)U=
zoH>4xpPST&cJJGYsx>tj?CL{%b0=n!^X!nY^X|=TxpDI78H^1M^Tyb@e-{&kW<}If
zR8oi&M^Ce19;t2}{Kx@Jj85X*+vh~o;^OE#PrTl&>x12Nkh(!x4QYB7vs6P9zoF8B
zvrwdPju2bcP$cfrMk=i~IIu)kM!|37kRyae<;wuDuwxX!zR_iFg4x_J+x3@i?!Sac
z7UoD+wpimxHbU`IMx4lo_GVX879d1}By({Z!#2TSt`S?)RM*_x3=3#)+Itt)-LVC4
zKKnBfJ?=;C`bK>9i+>7PM4Ys?ZpAKUvD?V_06zXZUtsCRZ~o<9A?OWp6fJ9e!y(pd
z`cR6EP4FR}oS#8m<9a;t2VX?{r5kwu@BabeaG|&_>D2mE`N`^1#K*?D9AVpBTVf;3
zA-R}oWbjd2C~_2^Q7kV!nRI$8CtJTCUn#h@0%a00A|l#;aXo8{eC@2!pOguDtQIH+
z(P;7+bEHsPQH;*<L5z=%BR?P(f;lypvk}a^)`TKD)sMgT5^K8>1?#?t?-rnV0UfQq
zD6S}BAf{St<Hpr0-RIZ^RMwPXbwdqK^$)T6-B3@zNT-t6xn~QyTe~pSH-y6C0z`_`
zC}E(xpHJ&ZG|cxO9~skWf7%Igt3R`8poka(E<ZPAuAFNT(bOe8@|h<vD7!K5@M`W9
zsZ6)nQY*A^RIr_JQp^I>X6Z$kL}hGrW^<Y*TGM*P7L;WJxSJUV#u}<@5fX>xkWq~M
zS`)({1G2DEzzk(9+CTzCrpCq)A09?wSxL6xvlz&xfkCXDQE@QewS6o5cU?VkMjYIJ
z{P=(UBO;Lk_{4g37ZmV-fWzf{R~w6Y-U0;O?C_!9f`JIGynTvw3_P-v-w%HV<RWci
zuDHD}tlF{>;gVtu^z`A)r+<d#(`OM1Mp*2H*0dx!#hO&m+jNul6R1YJ++a@9*6hUS
z7{ZYv9tD<{&`9HhQ$(|}<mePX##a)kt+>(wT@wK!Ba&gQn$?-Ish*;kQquGUPrB(P
zz@~R7j)ryhC@l(NHkrgY*OO+{i5{I)Uq)j<R_kY>pr3UMhyg$~S{fYa>+D1Gr6%05
zcPrKkkd2lUpsTHibu#aJcn{OU!eYaa1$eKx@5Jy3UjE5p^z{s4*S_ss)UT*2<%N9x
zViPZ*H5*ppz+?AdN<_?RBq3*PVAAg|tMHYj8WEk0eW}D_mRA+ymp^_1H;%jl|J*Q0
zS0<jA(*VWT$V%67A=@(uEOl7ftmviZEz1`6fnujVW?>Y__Dwh2(n5B`S|6FFH<wY+
zMlpKKnHUR-E|OL3B3Ye9y~WcECOuz@@<ztdDAMkOzxt%eBszGy%Ajiub7|Lj=p|>S
zQD47SWM2VHjKxq=S&mKn??N~~AN}2}@P)&0<+*REW1j^eiPLy`%5Z6kv78_>J{lw#
z>gq)>9JR6~Opin(;6)XsoW)I#Pa-KYt32^qsfp)ssH_R5cjbAPW?i16HcRjKqrdmt
zsAyP)>B*(_wdmT-t3W#<tt{Q|6$rHA%j0&oI(SZ6wg^)jh7zEd_JJwwoKNwB7#^8K
zQF$3pXi*fpSAZmG4aDOKtv)9k<OEec*L0dLvC`Hres&afYiqG_M<bdpx8O(L{27Kt
zMEb_d$1v1CjC&65#)+e6F(#gC!}dl@j7-2QPIO9nXaVGj?~6(c5sCy+P!vJ?jW*Um
z^#}6MbnymW`N^xQgd%&Wt9)U-Dwfe*R(-9L<1wt+v<B<8t;4uj^ub639+9KOS}!4r
zA#B)GkNC8#MYXcgbWyekSbbyBd<a<v59F+wq)`FP1}JkzwPs<Mg+_06rGiY;N;?27
zjWa#FAe{v*5XtIT2=*Wgqvg7iE;WILsHb9c*uH-+J1uY{mh^2C(-~P*V^KlnvyveA
z=-3c~rNwyS3!g=>Aj~516a532P0iww&;J@W?!5yoH!dwnAAk;T)<>R7s1d28IvI?Q
z4P)zpz1a7$$FS?c{hSeH<QzpnL83|YB`?AZ2n2&@zIYMWMbu4}J>4zsh!hs9-g_d&
zr{*m68&tZa^sX>~fSdGZsZ=N}L)@DpT1ApZRv6B%JfNjXt303k9O-<@^EOjFrc6%K
zMYf8mL#z%s$ZR!prKum4B9bJR+9Hv@=hH;ioEGtAu*BMw;YNf+O^YDT9XrR&fv5mV
z+C(X;MHPk_h<m#Sk(!-_oSa4LwN~~JOAB;Iq9JAqoPOgpa~aEO%DEiz$R|I<C4)F|
zW5wSS9WBjuq=;M6OZmY_)uJydS<nbD>4~cTQvx)cZln|kymB1ts~so_Lqxp^ZpSLQ
z#KdK*O}L@arK5sn*aVglY1#B|jqCy2rWX{WRxaeFfou*guQ3{vP19;wkX3SkZ1&&T
zfvj<QEd6V;B=5S>g0sIofrdSM@$hebmYF7`O|fSC7V+7~RJ~V+6FNgRF8R!f^;g%h
z5rvf%IQsqXGj-6FA4W%08+IJH7Xxjb=n;>-rg0NTk_4J_JQX;GsfkGz+os1S4lfO}
z&{`wsf|?Bt>`ykGm_k$p7`q>NP(;OfxbVg?9DnW=E>|pvE|uAv0-U{McOzcQo{v6^
z)mt~R1FpV{NML;{Z69LW%p?-*U_y;Ix7&+XzVQ_LTRS;oUTQk5NhDrfX%X#;YleO8
zGO4IbpF4lP^V=gs6Pn9wN^6SEsf25>p!8$8Dmh;T04C+j+3zKP0MxVeiVL~6A`czS
zH__bG&7J>1o&fWdoVB<yHFFH~AW{Jn;7UB%a5x|1!{g}d>gT)FuB}E&913kBN)3@7
ztawba2cg$RjkVQ{bqI(^HZ~FGCRVhp2=^S?gQ0<8JoR_qN1oV}Bw)f_?8zyt-@YEJ
zMWp)T4_?$*4-)L8@o2-$u<(q+v-X(=2Bmf6<RHl?D-A=5uEFSxh?bKHJ^&Pp<v1+O
zFXP#!*o?~Nn(l&q)N1pyf?Q1|o4TmU6~Q8EV`<(k(D>5Z8>JZwfJIo|u5oAA9Fw%j
za4MESVR;E=$bMU%;d+05B*gluSC5}Uw6v4~GM*U2x~)60`|*Rg^42Moud0Dl9JqZQ
zeR$~epT>A^4}SVLe~)#$ccA0S4UF{li}X2;qRMg}XC)w=C&o%)6x~fN+@vC)>bQOb
zrPbBQk4Dgay_wasXrd}F5MV(VlF+1--sQeE-$L3`vjXT3e(n?Kz0r=F=dQrzQ6pLU
znoo)SIX}w*z;a<_W;%iTjq4FAD!@r%JLE?-cip9zOq}Ar32#28Jb_P&@1GiP`{C_~
zcA*-r%jIbGh$xh5qXzjrz$zYM@u|{rY_+jkqF7B#PNS=Doa>qaznk4^DPmR>tNfyp
zgGxl!H8;**=LW?CA34BvV2WORBK@zZE>X=INq^L#)=o(@hMxQSrDkRp-23Q$6qgs{
z=Edtc_x4$g4UVFwp_U^N;xSU1=@tu@nqqBNTi7`_9fe7<*?>^9v+;U3%Af-%5u4(L
zDQkRNC8c0|Jb}{iJW7l51lUJ-!c1*AI53x@K@C~8av{$&==CC?tLe(N7VoyHK1@-u
z0c2$ps~}gYz^ce)2eL{oo~=#eOEDQ8O1jrzp87KKUKa*gq_ug)VMt}5*zkx*bv+{6
z5kHH=m6X0H{jJ}!fg4V%w{67k2M$6J>#(e@2K8GvplnS&rs7F-UunYs{^B3u#ee!1
zimEEmCn8!(>B&;2xTcE#B&S)5Mq?wRSi5sGixE-aL5DH%Z%G@r{o+*~7$Bc7s?Cn{
z^m6)5fWHvPQX`hAUX-ml98TLN6*bGct~F!0tA_&#x*z?X4t&4J`UogV{C?R$L`<5*
z9LD-bQL(lj6^*M{rg2%=LAt^czwV)xhHER(Zk*GqGXcLhE+W!=r$e$XdKi7JvXXx~
zp=<2~mbB&)*~yHPuhx8$sZRxBQOr)wh$u5=91_Ujm~3)~B?_2~Xki%LZQaaF2#SqV
zx2h7?1dx)3Y*;)dMKv^#P%8kG7zHHAz4P8(e9Axj&1b}hO7O;b^XErVy}Aaal_g9w
zBdS(kdmr*ev^?BDgkJF+!EjLHAS#A~Mlmr1=zUTu+PGr_dns{kP&^;a)TacPp84f5
z)Ng8p%U=h{6QmqLEaGVt6$L~X;6^MyCqAbXTW+(`zLFz?HFW;1v@?4~0Tvd7Sps#-
zHX7DboeZjDO2&wDK?;{n3qdh68f>2rFrD;PKxeR{0Tls!E-#Oyx<d}MoWCM~c9Uiw
z<KXmvu(K0C|A%kG>GNUjj&1OXOry7>4f%QbEK67??jIW*!kJf(h;<gm#=X07;^(h&
zNq|fWX_D~LTPNZ5cvSk7cz&M1VkItj#(jW5Ib9}LEPJIjQBqwgvN12ZTUt4VHzBP!
zIA*wB91#0ppre=XOKUV34KeqeBIjFSN6gL5qM)J}lOvN@yJ;(msw>cP=`spDMaydY
zDUviVu5Z(Apj}!ud^*qP?hvQ&MnkA;SnG-|h|SjR6rB}{q864^GdS|@3WZTAfb7EX
zMNaEfRU(CJT$H*ywNXULT(8v4uv6`gYOv&%P`9QASI=GJh>}E);}daIuc|`*x_bWe
z=+EDTM?7v<a|Z@``gvF(Uqm3Z5j^6#iHm#n^c8&OOP^#LnqNMD1asm(RMVsT(QBYO
zFqIpK#h@%e#iHnfqGGy#=671tC?MW<%h^jPUptG6x<<5~JrAb<gGAiLYGn;OHep7J
z;ATq#PJMUV;9y`^E6-IjP;4X%6%)NFmsR+}{8($LK*vN$%NgqatpanoK-LM!U{Q8~
zof?_pwdg@w-z*ci(f%=1iZxQTb`3f&U*o}-{*G>b{gcC^XxzCIg|$_<{`N^s434v2
zYk9qz`rkNx8j)xbKK!NMM6<Ydt~?d=NY0SxPRtmPwWgEScp{Lc$d$@$u?g{b1yL?9
zEwwyIYlj>c{K0_ue$EQCP={WqL`7~QtG2DjXwMMl#JcnN+?=(|h(N+il95Y%PI~>M
zso?SEp{J=uJcbV!j-2E%-)KS6k}It$<G@K@%`}*~(jaZc)o8zZaayG49t;dj{NU{A
z)=yIUPaaq)PQlW3TD5DcUUYRpL6&9R_^Ap!G+#~I$q@)>K<vQu_y7iPUd2Z~eh7-d
zl%GHI8rC+}A~qRgKud!yRc<BO$jz0sI_;VbtGUxWHZ;nqp+mDXq4d2#q)xQh33RE+
zMX5c#Rt9ncc9ZZ34=RY1lTvx2ijk;zq&SK*M^7<GM#SSqOA681)XtA9=}sHPAcH9L
zXC!OtOjO>;2v$QCm~lB3CUjF{g^1{>lv-LzO;2IdJ$Ix2?)&lLkKTaK>rj~rmIxO1
zwNxn9`{@PQvD7FQ3)W*TQ(Bq(%etC+8f0Zt(<=*t2A-_hq1Q&cH&^4$RxVO^U04%i
zatalzs#*NHyQvw`%3}QHfBkcGTyNn4m^%;c#~*&^<0uN3aaObI;R9H`wGsdFU;n!}
ztXJdl-~Jqqzx+CnvQ7*PaLsk0JxgVZ{Ad9-?70IMUVn=__e*VjQ5j&GMsCHrA=ySd
zeFC)y;7~okA_e08QIl>~tf@HnM92krIg?=gTm=y}bSx+>W{TKgM~^1Y=vwk2LF;<X
z=|L<n^h@#4AEax%l4`UoGNPpm=JmMVcDbCNoSU78Mex|J`Jp4xD2kqWFt0|nbg~Oj
z34{w#vSth3eDe|l&Ur*40o}-I_TQUzR~gLbRGk8HLFj1eU?BDBPH#HV34CQO(qI7^
zE`?~eAM|_0NcJHX18qhEi;=!T6qXipH=1P_#U`Otk?XC@rF9soLi){35xU!rUHf)2
z?WVV_M^paFWPMsaR))jlQ+>?b3cYBi#Pr;_fuWd3q`WScbCh*rHWq+20qH`Gu-s9s
zUBfFIX)X<9vlcy>Ar^KRHkDUwTypgz!&VAcj!1Svkd=+kp((<V#&GwI78KT0;;}FN
zdyMyV;+d~~1FJS~#6<yweJw3`=rf<j#n(>oWA?PP;qu8-SifyMm%?8D_EQ)i7-EeK
zvT&h8axpMdG$)AVHr}bepQe%J5`iJmCNLiv78zQ6mK#>Yo2A#59uHqiJ(ig=V!tHk
zlGwfX5N=+$gh*ilN^9%TDLyZX+LsdqQV^tS97q=&kXIb0twg(V9(VQmJuMX3Qq*PG
z>#)fhGrU@z?rMf(D{GuViTSbPlL_2?&n~RnwhaS=6C%o!SY(@`Sx2TGY~+~|I1wPy
zDIN^x<NVv_(A(b4Kx*(Q)9y#*0yjsma%R{-&q>vDR9Vg6?c^o}JvKG8uAjb)lJa8Q
z|FJ`uok`-z&tBt5R}Hr9?8sSOk||=5q6lgl>Y4UsI51=tfOzsumJI_39+8grb`FWC
zO2)>m^%x(YGNtk6VFB4*&d}U2)6=^k=WclE>ZOwY?_@Lm%c%Tic1LC#cg3tHi%gx?
zI98iO*aiy>Pw0<xbFJD0ve`3-m<JJV9!(Am!tKk)mE&h{?Zhbos_mGHPvfq~4vEiv
zgzK)uBAP2IFG0Ah5C=Z_5ghn;A7)uYqH2}aRii`zHg)K8MouCUq_Nl6pMI88@>?B$
z%?ZZTcoS>r?hkzk(ehHU&c>0^kz8UAhG<-?wr)VQtW@k156-=M6kSbC@Q1@H1ITe}
z99&uD(4JU{n6@G#TB@H4pl#02_hP7D9XB<o-UEi|9tC#hjoGOoiewc<o!O>R!}L@f
z9+!yhpq3z<8dD%W;;W}GNxU#-xY0%2+rgee?!5W~#<4)7<p{F2)@GicO+i}GrM*;!
z2p2|}Dn^vBt$Vhiw5A-bS6Y}lW{nWD&q{pVUp)09n?lm-)i-}E<p$lKB$Mb5hcI-r
z34sLJk_5ztnpI08xk>_tQ%|-nXDmLba4S))QAB33rdOtsY1gnbmn>lC!eA^7C^<?e
zb|9NsPXg^pfA-CvzQpC7+BJ<LJCd;Nz<#XRwFS@o^*_SNW3OuCDqlp29oL#LF*wTW
zl{)%fpN|jjiIFibSE<^svJC}GVQ`HU7A~m)w(KA%nM6Rmm%AQ&5HEe>dzkB(U6yMC
zyO}uMB2!Cp9oWI5<4H`<PQxwM9eqBxBAmmF1C=Rp^ES{fkM7Ybz_wQ`lnOnB>7$Zt
z{mi^)bdIm|<6H_3uevA;qG7y!M5JlS8F8XkVs3JXX;s<1uce;i&+*|gj`k|+D!5EA
zGB~29<1%bK<rV8smPM{u8s(DN`b0a?^ThL9c=I%;S5N%r#|3bP@b*hbQCeAwc^hqk
zG+;Xv)jot8d=wqiAz~FWQ7i&6)ZFN9?L)Q8i^B4a;(((OW&0^E+sQ7wvVv_b*2+?l
z6zi~nJ)ptL!?lq)OxM%RAgkDdtj(ydxin&D;R8F6RjeSJmh2RVeJB#*k`mQHr^Y5Y
zf_>-t!)Uv94ds<pS|d}z_`om<OH0vvvxC_z`D~LT3Gi*ky`TIrhC6%Fbmkm<f&72#
zJ&E{K40T&K;mm7qq3Qg2v7d^U4CW*wxn|c6%+Ji@=GpV`1U&HM`NTdO!urkI5iKdk
zD_?&a;ZVWy8cnp<sS)OI4T|-DaYf?UN(EYRGRxs`;7zy3X%#4eO<fQ=#(`n8i_0Ju
zFbT}4N=tJr{T3`NMch$<s?EFb$j1({qix3GTl`68i~AnCA9ozMlQ#{Wv}v&m=xlQ`
zDYXsvR)J#BbyZA`uae&KT0ilmrOd=cAl~cIXAg6&ucomcBmKjc$*k<C?mTy%Yu2q6
zn=_<F2RYJY$@Dwo(bB&e>FGnm+9-+zSd$^1c?=hdY;n?6%%ub<MtuVP)EJBsijqOo
z7CKQFBgolJt7RD?My(4;_t{(YWEZT-nsp(dV;5M5S*($)Vggx{g*Y_Iq4<yZrUM<_
zTv8~lsLZlO#3?@~B0U-m*m%!faFaDmN*!w@`qn^8y8vQUv-aQmM)l#Eh6bi8UOIA2
zWLS}<N6gd{5RvvsXTONlhq(bpkuYgPghYf~xpo!W&s=3KXXr}@8l!?VZ)rVeMVE|^
zEvp&_=b2k~8)%nPrxgn;;C+W0K{N%E)##9n8_+CP0$811iJ?FXnQAzs0PhKiFCRQk
z1tT#Tr>~3X!XHF35mQH6C*vZLbz$AM^~^@-zS)(%$aVt_vNpzRdM()@15>S5whEo7
zP6sdnvy4zd7z15>ICJDA%Bsq+dG8K&5JNVJttcv)%jfsu<jY6V)!fF+1K12?Ko9Ub
zkfcbOq#N_|Bs7vvLTpM0u*hvKV-b+Cuc_)81*%AnX%GTdCkVSquWUV5);ZN`^;q5e
zlmHt&S#x7cww4P_uYGZlH97=mf3(j$(h6+ELCw=9`sffRo1#QKhSgg)pke1$#K$K%
z07!!iMZo=?-R!!nA3R{IquJ!YMfk%*5Xr<WreiTUUG8Q4OR9^xFe~;KO{fv;g(fKJ
zBGql$0AHj4myey|&%{`G1>2Tye_#&^%1Ug97$}P)Lq-wR-dt&;w;uqYO(78QzLp>K
zF>NaAd#4zh4;E+Y^k$W1!$u(i4=s;WMPugG+HZV(3|(DANcziBwSFV&*HkhOkj7?z
z@HhX0%O}orWJyBC*^x`x0FYT9GX2kbS`&=-&kR(U8#7j)th9_`GBJajmu_&qZq=r>
z%&VoQ0wfp|v!-HkmB+ifhD!%V?<=E;rDfz;+-L~n#7jqTS^ztNfCG{xQnfa^Y@%63
zwjGI;VCP~hTMZ%gRyT@lTPiTnw*cs679~B<DawKZF^ZC7Ds0IhYrMueK~|&QnYq2`
zGFaWF2DtN_tX5UGaa~5XGkv&>4G-h-FaA0n{o>~_F*1^QK5EhyR+MHeY2L3JIpvbd
zSLd}B1Vr|uERn`V%$YzWjF11x?;^iAs=C=KsuCEPQ#zb(y!_1{aFnmNxn(OGfddY=
z3mf*|$vulyj;S*OTJeyVR%|JBrM@ttczN>NS3@EH2%Y|_Wt^1lGyz6VDfCgSu|cM=
z*<4DEY9VF8j;KyfC%i6obZ=JjBU)O32R{BVN73VhqpY^2XmwknwQvamlBvmRBamVv
zDQJi)W!V~y%ho6p8f(Jq_wws+zuJU$vCu=&2nx%Jd1O+{mziUnOiZJoxR4d^)hH+Z
znq*yyuGsTq`MwfT(=j~q_%0L_MzjdR4y0w+4j!1x1g0ofjqJ^8X$v_g$XShTz796(
zTRML<2|6&h^*J-A`PSxQy1}<xkhLvqS*GjkImgo?(%b&feyrQIou|S6=}-PITz&H$
zrdz2xuM%^z&-~&DD}#A`{tT!S2b(Bg8SeA@a7$a>5RHol8j=D$$@bnhl{bToI0$A%
zP;lY3w>e;Nx>e0vr^|!<NEFHVGy;CV<@sp9qi6Ic8g_3**R@s=^qhh}oNukql4_aL
zMeFO;m5OI8wi%|?X_Jv?;5C=q^@;S9lav8i#ne&PZ8|8rAWDm3Nr;BrKb<Z^beHxf
z_jw%X?H<B#b3Y!cuEOZR2wO>~Q*>HX(PDMdW{7RUT^7Zt>^74vlop#-7;Jr@^bx4x
z<Wcy!{rLgRPEBK+`MRo<B8}X7yl#XG!U&1z`^3vfd2tt(78z4Y)4adAPRWj^@*G>P
zPsV28b~~~)*d;W?>~sPoedpWsI7-e@UR`6%6akw##FD=5ykM!ozLAzoAlx#nu@K1W
z*PJ<$wb8^iN1YP8KFer6brG?#Nvykb2Wu9PN|(L{njem!<=iD)J8>G}!f1wdKnHAh
zbE{Yb-ghNWxF8cq>>tufa5_C0>FY)9rgg{{>+Q;0CvrCB=(WT~$Hc!2iOcE0_2Xx_
z&YT`ZprMF!hmSE>(_?4ft0w$CIgHKQ?iBCKhf7C~vk-cA;0Ku+e@aBNB2elP|ElG7
zM0+dcgSmNx!v3RqJ~yXOwv`{fb1BTtb-g32hzyfS1HdRcaceo1<T`DzxB}JH#XOWi
zr*;~URr{D3p5}2n9oaH~Sz=I;bK7Q{nn?yjNz>zDfiIR;9G}1xY0!p)sBWld9&m_C
z4B|ajuC77-`qeC<XEa`uVHtBxr`itkc$$PqL>6oI-jApM^>vI64l#h+3WFm@lxQOa
zBblOf#m3efFmr6P*T-JoP_}J)Egxj%+!J4>&nRaktLQ-%)|%`BAe#lzpa8AYXuot_
zTniVQ9>yle#9GV7LX_F~^8M_LO9D0NXp*B{GC+KvK$aN;GYLe>N>Er`!OpnEni%aJ
zfGbB+F3q&qdjCBlODv~8EtebALq*ZDR+;P0=}~xn|BHf%+2k~~i+>*~h_I--oynt=
zt<SzDDawk)vK1ZCCPliRAN0K#E(oyAw%aLbQLU2Eq0OjUX{ny1m)|qV`%#_N>33jm
zUSi!?ueiYTvc9t{vCF~Oz;LFMod$9OSJDzl3%IZ}<Gd=37Z9lwS)`j!TiekbJKruS
zunmnZ(Oz~D6KzY@gq=x?l!hLf&Rs#nuFWW^D#Jwo5IV%ckoFE+$oiV=XyP$K(Ga#A
zdKB&5aYUnj9_CQw`K3j(Pz?IOcHCJ73klM|mbPV(Qv`DGW9@8ta)GRQx)8`Y@s*Rp
zWd&eG$0as^t(mHpt5i0xvI<f@7uv61MO9rrD(kCp^~`zryjja}ax^HaspR^3*R`fw
zc9>o6&F2e<J(I#<UnkSe$T@_j5xu#l)U?1MP*8yJzEPF0?y^?|v)dwMTV7aDf(x&o
zz+gu&%1WzpPMxKkG~I|duyS#BWk<9;itBZ?MGJ%1<aC`@%GPG3Oyk3b%x<ubR!#J1
zVN8z=qcG%Rw}t7MWcsf#ok$`W$iwCx>oDu^WJH#;o?^19yGhY3=_v4+tPguXw4YC9
zO6_AJ!X)7smFO?$uy8TgB2CmV**^L;i)vH!L;(#o#|AsPxl}+KbJhAae4xDk%*(91
zkkdKVkP(Q*Iy;TYqz8$VNDaGt;7n6&Y$;pD2sv%DBOzB)Pqt2X*+#KC+LoQ1qE30s
z!jDyQODyU~b&V5XM%hNoSnVR^0^@*&$>Ypca&wW*NKVX(6GLN7sNK9C_1iXQEzHyR
z5f`2I0*TYmS~D;v-p3m;Qg|>ytEm&~!L2EG<-ET;5AQs8nDul$zU3SUiZ;%xptq%i
zgB-ibGqpbJ<kEpy7cZ`4EL+h)D>3^(L9{6Jk~+7qWd4F1takNA1Lrag$l2yc$TNr4
zB?`(*f*6~e0qJcdre>jt6fH5>3CzY3E-t}@NR6lipP&@YDH%7LmKGCdl_qsKvYm`$
z=e@g8+gK+aVv0p)2&f(DPOz+4J-X73DcO$FB-^CqSs6%Z!Z{9J&}w>LzPcJGUwR!w
z-Tm12#6bprz@{#%V@9x+Xgr2Mc^#ho{V(9+$x8yfr_{x52e2@X{u=772K`whGs9XY
zFjKqCW3)z)l}xH?27as=*bSLO4rYO2xWyQOX0;0zE*B^YOtog4XkP)ADmp-%QcBN1
z{u_S=rvR}xe*6ORy~g?{DZh2M+{EsO4q(Rv_lT@-&XRh+Kg}=^X<xp<^fP@qV?l5c
z07&*cY|yw2p&43}Uh%$XVzd0wIdd31X6myJ*Hwq2^xg*AcX68&=}Lac|GYooH5t^U
z8)L>1Q_0XYld~lTttlp_BpiO_I10Q;Jo%Bm=<Xfkan(ZyH{!uVTQN4!2Wck8g8^%|
zZ^Xu(n^_e<y_wVAQ?$6LBY)+@Im{<#Il7cI#V?v7+qQ2fss!+nc!vE@gPc36wXt?d
ztCATbOgY1UB_O<T^d!bbN;llwug;WDYtgj{T=h$qCdkOWb;tf4=(%_rA-}|aP&DSb
z5Q_jxmgWXM8^ENaU@N6)24hR9Aol=5`WhRWPB}{(ve9}*Q5J4cDMnyitXu$t@Hi}V
zImOh}TSD`fuh*(w+i>y7+i()|Cf_KoLV)G<`!OAlqqnUSI}YwgsHl)9$lkZ6w5GKi
z&?eh*VLDHai2#Mx6fp`Uy#w>oQC6(IS;S&v*mnOO)NN`MfsnnSEd#C7O@j(AVI|iM
zJ_tZd0yBX?-W!p^;0%FoT7FY4BV<BWBj74VK@|QwN#TK$>G(8er;}*Da!r6O)oB$3
zFo}>e0f*azo%`;<kr!S=Wo<d?1W*q34{9P8da%({u*9zep#cAVAm5MEuN_DG^_%R1
zJ0|{Jf<(nL{9Dz-jL6z*-P7zko8G{(4KLT8lbVfCHDD5tTfbo~9{ALUv1Z#Q)Hc*}
z7u%Y(W*>uUy>lrUmyW)LU;gkJeDpK>QCA<u#OS!`J!c03(o`*j*`cA)C0m_|%~N4I
zL&r>GOV{v{^iix{bOv@4Tz2(XIftOPzWibYe5;j@l?s+Utjr)QTdt!mt7L&&UciU8
z%hwSXS<?DlTaaH7Wn#Yp*~H>^iXWTKT*NLB)!saRnb#VL$uRGfr5R%y+vdG%j!_?A
z)wYc&t*v6`Uc167$vkd3um{CeRU-J1Zz0N-RIS^5uUL~asNS#&MU^G|+_nb*^(a&?
zw&zwlj;(m0r8<q<<B*F=Bd^JPvLX|)+Ba2nsV34h4q6&0r$nly;E@kMh**3E&wTf%
z_=7Kf2m$vT4nKbs;Yg4nB{4O_Q&>lzJB;q;b^-K$W9QsvGK{#s!~h@}MY5pjYHGvS
z(1=KZJnD060}_Q5C8`*+Y*oTi6dQFcJHD-DC_tm&%+G5RY!XW)4)+c+L%|BLnF=k}
zb`!CfxPK?s?cA!4AIFAR6If5Hl5`~kMKO&GD_I_^aY`yjnZR5EFh#MFiJc(nro1c@
zT$XyQc?!->o-sGGU_pTx*bO7V5=kqHP2+PZYn>P+d3l%=z&SoJg64A<Ss+L<aaHM+
zP(zBc4pMBBH7gtHD-iFtarX|DLiH{z%FU_#9BIxb5(t+Ti|>=Vy0Yq4OY3fGauRcM
zGW`DFEtfK=_Yo;BL}^78e)8A<gk#UWj9{ohr5+lhS(&--a}M{ULy_OO4Ycq2B8&8P
zRz^`t!4LC;ex&B-bsaIqs>&p#Bi-yKlyngiMF=qwF$DATxEXfl*cpU*?%It@C(q;6
zpS&zCauKK913d#MEG`hwnKDF>k`@I?7V4DxeAGeqGT=Hj{RD-lWBlUv-}A%+yctNs
zPSG~6HEM-T)N0f4F##9RXS#28;5+}%-=TI@C01=&FAj}Fwoa_$e5OHz(!I&i3I1z;
zAb=nI&#&|S8@8@vzOH0bgS8GE$T@_(WkW+sF*Uo4S`XQ41XC279lFp2ycddM%{5mW
z?OSC*_5iYxw;p75lZUp(lLo^|`IaWM2+)GT0ABviGZ-BjML{rX&j85JN9*OwXgPBM
zwd>cien+~jK=sh#n#xSm_Px6K1L8R^UP1He3nF_9Wqwa3jM|Os;1CD;#yxk6U?YO-
z7cMNx9^G!QyF5-2+_Z^IY#dIH0~_}2LcLgvQ?W@SaA{=&5z#)gl4)JKGRMkuSg>1w
zzJNFI)-TSCw_fXT<$2wz(*n6Jh)8l?GbChJ+<A55Q*@_jj<^~31^QEQA~o7A7UUch
zw-1wp!=T6W<#{pOKg<S<%<pr%_<I^uFwlW)j0%l_C_z*AHmY(dDp!>{w*<0jad6uW
znNG_k)rL7HfY9M~@~{Fs-7Z{E<AY?&eRtzifBHN4%J2Lq#D+(ihQpRU;`!NlPkRoM
zfZY4xgXp+?LoDzc*nZ$%<d@ar+==Uu<ay22LCH;nGB<%>t;y;mJjv|3koi3f%z!1)
zwoG8B*m{h?2(acuY%ylRLfQqETJQ2|vi5aavG%-qh>DDApraKjaX?EpMv1h(gCann
z2#`6oPNx>t&hyV?+URgN-qR)-vkjasOpcFZYHkumkur9uE~qa@d36o$dGc}m;#)t$
z&GQ!#2!@sy&5PIVFUUuJK@i>7Z*tR*__~qeV)2|_9?(&pqSc#InMceU#*91fvrc*b
zyLOLx+XZ*oi%${2Cry=<M_;7xGd4+*zA2`CFDb^^cT)r-mLi<~0u)5T0$?2o6@-|S
zPrzMJ7-m;nibU6mQ`8^u^Y4w3t73gzeN7em(OaWZ6@g?zq*sb9$f}P^b>H}8j2min
zKXTGty=@(rB_>D5IZ{E6dTaXef`t*BdHro1d;V1vmzQ9qe~6Wn%Ij))qtG}qeLz&g
zpoSg|KGbbqhiP$eZQQj94}JQ>Y!GP>eSyyS(onKcatgrc=~_^1*aYb))|Bp>qu3>Z
zEOIs7bmo@1l(`lKS>@jZWYej5Z+9DN)~!P0u5F0LCvERXkt=aoM|%7D08clb=$ZyX
z!CPxYEg|9_pBTo@gZJW-|M8Ewrx8z#qpzhMo9^9@>+hV$g}2{ENJO>Ee&1rxkz?<0
zcOQ@F(#_+^<M%hzMQ$N^h9(#dDTs(xaVYZP4+4gLAb^%YVRlAFNk!4O^27d&q+AwY
z(|5Dm^e~ECrzn#3qH^690X`m{KvCzak=a<1PRrIx&X=wAKTFM4lLmybVIyf9#9DjR
zKur9OTzQF__3_{TH8y?hYQ2b!d+)@<pZ^3~%)~~<c{Gy_1L`!(n*5^y{Ke0tU;D$a
z{3A!O2R`vATkMptu0y0G%G50a{n@Dm>Ka#Jd|&{V-a3P#(rWR1U3luN-{DbSF2iW0
z0mWPswsm^YF%B{xyPRoMX6mpSg-bFq6f(^&OD$HftpF46R<WUOnbLVn(+gN|5Wy13
z<`y7VEG3F}x6mmgt6j4SSKmG%()5eS&kyH_08^}Qu>P)H?5{<UtbV_|A2qzRA6<J>
z6H2Nouy*@qG~Tfdzw!sai<UE&@%-1njk3}TRWEs2hl_*7zsazYN^I$gHwtos(E^mz
zR<eRuwrn6%Z5Anq^N3hS{kMVkJ-m^nOSCxjv$Cq<2^u$L>t?N1Yn&D{x-jT}Pk*wL
zf;@*y=WdF}OffAh3zu@{!na*(VIC?)f^w#oY7(tcU>%{=fs9qrOV-L4+1jRFR7E9%
zyTmCzfTq)z;1(O{iO>HQPP}{sRcq=v(hLiryz4{viS%s(P7#Sq%%PMG179k?)}`8&
zQx{i6=41tZ>}Ri_P(--V@?r*QD!tI>_xQj61WIbkv3^Gb>l|D=eN{yJPW8c<x8|^K
zI@zdW=?@{v0K6un#D$t&ITg2Z$uz>&Kr#0af{r6=7MU?evbhcyy}%BX_e3>|g<C|r
z><fojd5zcu&K$;yDyhK1MvNIJjQ2CEoL6NXODd`nDU9N|zx!v53=U%3y$5jZ_*tCz
z$#W<vDoYdGm$$bQ(<rX4!nXVG;UFqK1d-NPh*nmxv#*|QkaT%z&3yZVf?ppPprsF=
zrcTSMi@&d=4{b>&Fr$koB=fYG>3ag7P%sb05x=U&m6?J9GZQFvsTZjmu>|I|W|lQI
z&ej<fOH?Zxxv=J+a|nggt01R?Ym|b$agrZ3FPIO)yi>0oL+gz;RIaXNSJkoMF?{Ne
ze+wISZ5HX)fZCPS1`v2od^&+pQH1@e&L25}QfiQh*U)t468c*^QPoh7`pu0P9~!}P
z-+T^N#r+gl9yaXXFTl8%bsi+Ai1?G!kY{2%f6suc_y009xs0j5S=3xVbf8zp$~w}@
zM)zC8um&uQ0*iN=S+3AxBW`Yb>8WclP_zu?0?PmdY;1Pkn>9|+9F={x+_#4_k%iKK
z;&GEG{OOl}sp@aI-@j>k)-52nX1`w?0zs_XwFCdhzkUt(JoyOD{_-tcJ$4$wqNsN0
zE6YAyXs{=loI#N|>@lDHtO?jjPoYIb_UXwoie_m@A?0u<MMm_@ZJ>S6GZ#rjpb83$
zqu&d%@4S&yYbYP+K-D_bK(^Zs%nE=dcTtIiz@5%)>P<>rV!@YISFkH5k*6&iG1IV;
z7i0t2MqB17SW}Ib8hg~ppba<F(S=uk_%qaQ*??lwFA(Yf`8VFdGk^a*l#A5u^`~FN
z*x)EuZE5627ytYD6fe;7RW)2z2t~qd))yA<<&KB%;}ne|pxEd*TFzhL%|l*eME6~_
zzK(HcVswH_6Z5e_%nsdzl1y+Na4r$oDk6HS7jy?j7GM>fYlLJPsa15p%l>Q>?KWsL
zEEL5q$|_i(9-E#X%+R-x(GgY@t7d_be~Sf0Vs52uz%}#fX>?w`&e5E;9&ZFcx+bKL
zKoQ|`EWVcv4kSM)_Q}}jFlSmMWE2}10GdE$zr>NBzKGYJ`8hf+-M~OoyNIg88BzRY
z2T&w7BHrh=gL~0+wF$HH(-}IOEUSY-)Id&aNifi=Y=alX`ib2J+FQJZihMc0ya5TT
zw}jqawXwdJQY)^l>T0!_L57T7i#goLmJg^2G%7$!A|R#upcd6~=T<DP-p)R@6OnX8
z`|N%-Yb@9_r4-pvTU`7<(<_xpnsE*feBv=gN{jK6zx@^l+q+o5fNX6j+HMv=Ni**}
zJmFBAYxLU5op-~X+t?CBmI-)0tjfQ3D*<*nH^YWHd(p6C3+{gOehi4m{mftd9#(B$
zhoQDMm6bq)43qtA)$a6#F*DSLeD@4IUKdn#M%f6kupgU+sdSR7OrY3;tj#Fz0=02#
zsX(!o3T*4KX8M+FEmvgz-sI--9tIMUOA^s(9A{oR!qhswi-P^;RmHQ*YOBR{$$QV6
zUo_Q7b^Xu%pMS!E4aqQWI(PsFKK?jAZ)_xniK!7@tI`s5Y10D~(_-(ktAzMBV<Usu
zx_>wJJ#h$QLqpsQw7g55wGCO;%!y1(thax_2k5rq)Vq%V^sU^dxcG9rMa(35{xMV-
z`SQGo&a%TV#u7nR3&A*^o8Bnoxs()N(_?)I27;_pE6vSiy6W-K5!5x*VW6v96XZrl
zAxxhy8Z57un?o*g_lN-1lP@1(IvANmIyAk9ba{YmZU{6<ZH#!p^mo)4A^nA;KY5WY
z$|(h<`!t`ujMbYO*(QaC8RoeO2<9x(dryf4ee8wT(b3Y6nRpzelj90iu)2L}dIB@!
z!?^p<V`ys`LeFRnzJSNr5YpGiEsdxwJH%`ZDJdphT0>LG>`Dt*=wqguxxL#iattBp
zqg-UCx%AJaEa0|qi;Z0ZrkQvGJ`s(w?&|OeuT5Xb$5t`H!h-DDTHqFoPhiJ^{is}1
zhnN5L2XH$)@7Xk%TIYALwgC;a5IvAwYfEaYaO|hgqhaeNj=&3w%Gv)bE;6LWtj%dM
zlA`pwE$cAWKg2A9NKpxf`Udb<zy1dp7rzTfqr5h=QFRu09U`DexjY24UE=#!Zv*YS
zxLrDWdeOpp?Z(yLjFyyqxv#yK8)A}_EfH8G2i0D#ZiB18BUPlL@<Pb@5{3mZ`HG9O
z-Fs!8<pt9`L`Cy>$|zbH=KXb1oRls3-NMq&zFzS>WZA)G01-tvNYL4);lYz#PKl!c
zMHgXZYoX$Ois+$SY{a7K3Z7Kka?ft{!i!CjNA}KQ@ou{3PVBsQJIZUyFgErYS}$Hj
zNp%=XsE+A1@y=#M#OHJTh1cMVmWl|w1c|XxO-CV{UQ0RvwFlU2%AFZ%wvk!{jP^Tb
z(6ne0SOyRlU=`SctYYEy8tc8V(QLTYrjo+-)U~@dq4Rn(H@oit)hBr<=JJuZ7<`=W
zrFn79&P}6ceS=8p$1yoMj-qJUdlFeww8=HufL|P}*Rd(K7aR86iNWqJ{Pcf(4O{l#
z$sa?1ZzrDkozJ2BdJB#|^8!3BF9PA9wjLFmGQm6xAl>oE0UZC?FEG&EDGrMJuzv4$
zeD}-$1Hnj$r{1V+5}%l4%X9|`^=oAj+Q&)i8%T~9oGa6V@q+`jk<#d5m3hof&vfU>
zsl(!wJ(!xF(yV0^T_Y@8LdbeLs-v=eKaqYUMKlmB3c?vIM|W#CyrF!Ny3yF8MjaC%
zLK8Ps=XB&b;LZ1P?N*tW4Zxsi;0(Qg<WfV{95({le6i?!0tkn?dsQ9JMf6OKPbYCC
zkS#yTOzEPjxYLJ^p}ek&50QzHQ8b9?VxX%R6ET@>u4$aoA)*GCNJU2mdr=Tju<aus
zLd&Ha813qUFC2lAN;3V;p$Aw4INC?B*`WlOqF5`CT6AM`4Nbtl;bn|stu{5#)ng51
z0JG7eEw$_20olBW3<CxEJgQAm;{1G)4MBO5YZ(z~akLyi{-1x(HO$hYN<$>L?AJsk
zB8jF1$M`+p|LKpT^}=NqiD|!dm80&ub!*Y<%VVd9_}CccMW%J(=$mLca}9;1<yf_C
zgShWCm7--T0dV>+{zp9WXaDw}MbP3xC=x~Ijq4a2>}QoPdgtW494RZp?nfTLh1cIv
z$BT(4OaSa~GuyzS$p3^7*looD?O=P)qN&$xEP=9_<X`4jS05amitB2#I@W>RMwYU(
z>NHi;e!YoBUYG_Y0LB>#@<R9d{ph~gDN>q2gfx$$hV7fsboLTQ94gN*9l@G~yzRul
zrDbhYYHUTzR-s~btw{6R;3qd*Y4NgyK7~);ot$v{Zg!}1@cuk_0s#@NR-mG;5-)x0
zX(pS0>8t-87v4IFZ~o^mi_~xnifijJAV7F}d>HqB<{^YiN^s<vmv}tX<xs??Qt3yM
z7HKFZAhZKm#T*$Lt_@)2r6OlEtC(xzu!~}KHD2>`*iCxb0QP$gvV4dplPD1f9g+J-
z`uarbU4p~kdm2vhAEn@~9Fl-`0SDDh>o=|w5$z;PTRL)3!4~cMi`PV%)9l;~Hs5<U
zN^2@G(A$e4@#PnLqxJkH)?hgG%Ilm3O^dAZ#yjUQK0X3T1Rf1{Y~diJVs$mIH7bkf
zUkick^yC!6#ZmaG{OE1IDIU+q9iqhe3}Qp0B9IBFgFFs!11>%qV<wFZRfpP1VmY2X
zVjP@t%Bk}oG@xB^%`npBT<}Y5aEdgC+PaP?$=Po5y-!C0lA;rv$uJVMW{s2;3a4&P
zB9X+Mk3Ejn8yYZ`NI(|grcljSERaMz&gxY=_w7dg`n8x8r~0)s7gRGkT0q9pv@C8&
z<}UR@-DxG~7il7NHMQdS&tF48EI@<Bx;X<jx6|})tZXMT50B3ap8!c>C_MP@9upD4
zJWK8U+JE_D)NWXV_G>p#T2g?GyLOA`4zatgBF^B#QjxleXz9Z7^Qdd6XKpT$<jMGv
z07LJFE9skJx<;2|+r$El(t@(J*`?SRKibI}8h}_2va%6mmBl8#>_8THuQ;;0q9bcd
zY`A+jYS%ZiMNC0qF+zpW<&DgW^*1fRb^YEu#KBm}&8aj;dpS2cfSqn9>Nc;()&uuo
zRsiN;SD%O`kBNg+1!B_BpxQrqgb`@YCTGNb_wv~7#K;6YM0<U1Tt0RNqrLqW%W%rj
z0?`ngEbb!aOKP5*v@Q{$PA6uNB-2NSn?Gx($Hlhm7ml1@l{<&V2qHI;q?5R_@>lQy
zysbQXm$LX5HGXKGf2^bXzmbQMq5)|JTqSdJOozT&#N`mt?Z7|`4!1W`+npCcPC(nZ
zZ4-C*FQ2)Lq5dIWICEklGdn?&O!ePfQRZTABv<M$F-D{XT}*~5Kn`HF0vRlkn%nE<
zGC`;)isLUFM)Sq%2ox1_lZ;9f{hfp2P#MQWPdh>(ao|kLc<Jj;!Ru7;=of!ofUXn$
z?OkZQe1lcWGW0Dy+~*o#$T6a8@$gdYILYQwYT4FnK9{s1bOR@5dm}r67{yHgdJk{3
zb_ct=QCeMv)tfh9dM3U!T-B&n^O{l@eNT<4i${;6?c!CYdChB+TXy9Kr^CtR33BAn
zH<(g$DSj<u14C#&c^*ygoW-R#P9PdBw$xhbd8x*F^6)F@5t&w)RJK;vp{TM9jk|Yo
z*~yOkO9Mum_TGtM5g|YOwQsQR8R<7nOibYZPd$nIKJ^g{kM?kH1d0IdJU{Xy;mmcR
zXqG^B&gB_($nw)4M4(-9r2|?BOG?4!<}uvX`A@;h^1pMs-4aD^#wjo(<tsf}n_dDW
z8Z$OH2x)3e^<5Gdex5{EW@q6G<#Q?&iH3QUmD2b8P`=i1lC0Rhn3BG-^fQJUZc`#^
zFRm`f+)R?AmJD@fNz8`aqo96&9<HCdfQmKsNK8!Pyog$U^*{YS!Vw?(JGxM^b}foU
zWc$Qt4`E*N;2;0<S262}3UD4k*NtZWO!D$v$S38qY0XAOf(>AqYOApMj0|;H)4^yF
zgTWFR1&Vz+!cH2|GM@e3HoX?Q#)ZYjc=?-8iM2D2f^hMY*eb+436~Zz(8h+xxOPb#
z)LE+SlC-7BF!p`)5s~I!L3h(lW(nwTiJ2*^-MNMB>B*tN>rn>)NM)-}9G<GavV>5y
zKpjvp)qB~AL+niwd#Nm~$F)nRarc3Tu<p+7_{DdhfzKbpz|A(MBFZLt#y}*9GrxFU
zM6$DRlkE(#VVph@)Xb{dABxPb4dk%v5RomF4D`)i+GA9k6}$Q?0F)0R(5|?MR&_;K
z{L7u^AyukWVrcj~R7X-ps3mKZnXcJNilKfOn~bq=%$*PH!(=R;X@I5TahyMPN<<pu
zJW#}zHq=NW>Wa(bu~LzAj|n~V!Dc@zHtD`O^`}9ChMk*n*Q58di>)Fr60O=g1lZT~
zsGFTkOr!PeMW%=CeRx0mnr`5$fBb)=eC-<SdGvtT%%w=pOSpLCO>xNhkQWSNax#gg
zlc!No62+PwTM&<t{^(5h1hcc~v5R2SfR;{iO%bWlG*Kt!m@|sSBF?ntQh{u`AZ9-?
z`F#ah-f#l2#zsa_yKyZ$c*LhBmzLs-$de*Qo*s)t5G;(MyS0VKVMElN7Z;;hTvyV;
zpbU(LR0y2Yx&c#(7~7ari6D`P>6V2m{!X=Fhh_tA3-kiWS8d<SZVoh55zLFQa@W<9
zXR-OfepEHC;Sz!wWYtF7oLFzF<qkcE%bCY(ARG+g_;as_ua{92trV}rtL`8j$f}cI
zZi;4Qhdlqk@d3R#KBzC8qf@cbhg&<oOf^Ru|AS;6UQlfGHPl^3BHvfeUBl5Ak025b
zsDyD6TM-M&Cr)jOYWv!|F(IM{y3yjLbcTSC6}_|ttmq?KDGT#@K(#Nh+FOa!gbyhd
z-Mny(DK19mP{qCmyg<W5Uwfqb8f`vO!l&QVZ(5J)hE>QH8#P*8iD;4P?{xa;DZC>h
zknWZ)1VVny#$#NYEff*eQ2zuZw@<UNk#jf{0J+4t6+6{0MaiKfu&_>nZK=Rw+hbQM
zFgDT5l8>yTK?55C)Y$jU@$R<?9n{pc>gsF7{hxdS)$8hT?ZR33M4FtlR3O$F(HWUx
zP+h@bOMKN7=CI@816aLz3nZ_DUms0wwO+b{(Sbo;Lz@rWgQBX+j5`52%D(iC@8j)f
zUqV!TzwG@+oLaFSsWwmR$m8*%y|sz|^oaoE+Nsm5lbfy|(`QJv*8cu3@jhlWj;$oX
zRBiSZR7QCsjOxCT;u5B}DK^0bm8NE0c_i}vZLyyxZv*XnmRl)H{vzv-@t(fc$)5h_
z{1Kz7yQCYx&7}8IwqZk)R8;309iHHZkvi_E7I@`Ef(Z&lf1*e@7>#hvbhLjEoA&HN
zSVR#7Shke`$!LR~^DD<KTvUJyM~~y;8z)g%QlxWYFw>ou@VS`*UPPYch4#c3K8r)Y
z@;JWrmw$`bpF50mM~<NV++`G(MsU}`odRIQ=ix3uAX<$0a6d{a3($DicDQ^&40Mko
zJ~F~Q+?>yq3t)48WdS><u#7HZH2|z(j5bFUE5V=zL4rDZv%q;x+t{Ir=a8_=RBVFz
z$D|xJlbC+j%Q`kOj%^3_VCTMjaOItoXg+fZ)8lc?5kuXE#7m|zS1QraYoZ2O-G)XC
zj|^g<rw@<(=BIJzqYt9Lw+lVjTd+n%r&rINVP^v><!sq|7q%bV4-Yj^B~|1;&5EJ_
zr?G06(|Jp|H(l?6_D+@OE54r*8BJBgT5LJ658XGK5gQ!Rw2mE^nT)f_+|~nk;Wxhg
z=kWMcEo9ZyQQ_!zQUoxm<g9pHuU0CsQq$7owzKX$YT$kaAK;r~<>9Qd<S(`G@4#q#
z=bt)g6D@(>lJQ0*aq!d}w(Z|1QsNSkQctNTF$rUcMedkOip4aCaj{?uOG}t`LL~0>
zyS552%mQsr)|Iq`S78Gt6t$4RcYZjSk%L?ku-Z1@j6d?>A|CU|k6yr;x8A|skKB(3
zKJh5N@Rk3D&g)J1>X-gZq@$f8x~)NX`yg+e$-!Ri|Hy*^D3Un$#yLcaBK$atoWl`f
zp|M)U9*EPhs3=&p*_D=Fv_`R62M3iRl;miXH@A4L^Ro%a0zl`*bq$vkhzQUj4wN`%
zrYE_pULX#&8S!%}HN!w4i3LT`B&F+4=eyq~v$HcOTUCQf@ioxdgSf~N8n^90rN}7y
zhPoMW31GL}w-=?g)fgD>;`bAqj^V(QAHjiN`7lnrd>EHcoWh~cd<KvI?r(^LFan<|
zUyZ;W4rU&V_6>;jo5J~5k7BUB1Kxl?bA4DG{1!C{6wPKQ-5?`f<HX1WPfL>CF^vGz
z<4#W{P$J&r+Pk-*aqo6!9LOn|`wetG==rG`N7IMU6v&kH2(;-4AfTmaHYGV<7m@9?
z4>HiMIERIXoxiv2=E7Wj3N?4`c*R#zbSOSJtj035xyWrnd{JSazn3-F1^)d!>mBSn
zv|ps@7twa+B)mR9Z%Ty#jsz{l2Bd{CulaEChDpqDI`2wbg(%jU{dC<jZ43UcBm6~=
zjoiPc*GeMdRED5f{*ljr442<Jg@W1|eEQG+1D^iMU;lsXy$5()=XoW3?({zBod8I%
z_g*B5k|>d)tY%BHY`H{MT;kYXC(gg?IBo4D{?pdkI2$Kx$32#dWc6b8Mir70doLhS
zNc1uQrq{dQ``&v8gTXX_pahW^KJ(0QFc{3tz2EuH+s=W>R>Yz;#C7JaSc-RFdmHZZ
za&(^U#5=!x74udtLM)-<_PViAbb5gcNFTAyIB<~ixC}XOF-;!#duf6%X%k)qT9ivP
z8ujRFZ-*iS5m%fFWC_kvm(nUIfHWKmV(!WnTnRt)=3B7aT`IdIFi=<+iTsSwd!0<`
zKy@adFuFv5x<4Agk~M3Xb-Kz+aAwZ|oIZ94o3`%|4DqZ0;Mr(gwHz%+j=&%puyDgV
z0cc(9$XwIZ#1x4NVvm3KhcFtHQESpBV5@E_gk^K@m=e^GIB**n=)l^o+qq5crJp~{
z!x#3_B3ymv4){Goc;QzMiM1Dl)8fRe1#`u55uhwK0!f$PRzbRIT_BRASAD_cB*>ES
z;)u1F9$71ZYTrcP=5%scn08$U6SpS@_a^q8IrpWyB6qW%EHEOG<d3v*0hXavmm-hs
ziU&xN@Wsbo!2G2P;4H6%udiExt(`j%i2Wpd0Rgs71}o~JCG7wj%~gn&giJjEqmyV#
z7GWZvhFBsoS{4(L3T#`Dv*pwzW=I3wLs+nOIX2z4joCS!z%;PX(|#V``^ul;^zr?e
zH*bjuJJ&Kmo!WZ<XAd5M(`Dl-@Rqx8!GYKJ!l)y6QX4M_IobA<X%rR{2iR<uI5Nf#
zC*<oWNMXzISeTDhR4`e}d239LZb^EN6#Xd#wmF<=KXHoBI}+K}&Ogd+mey2?Q^AB`
zv3XOq{bDXOPHlHkH;V!Gq9Ux_cmtmQ*{{Vu9LHT>{Q|%LrUgsT+un%^u?g19n}>n+
z9+a0=<CR}O4sZW38rQ7A^`HC%9{B5jKyi67dv)>Tl*z)x!eX}-xIte;2u!H~u|ZK^
zZFzMA+E1UtJQ3xU%&Hcfm66jJ-Dg{v!5YP8RqQUofTvHK)8ZIN6h%hFcWF>t%+z+v
zG>}z*R)*hTrQGZ*`b2CWKHwMqx4!kQY4wKw?FY|He76vbAmkbH=**_;?B%76G0mPh
zE$=5|d}vE;Ua|-$i$zH69T-R|OHl_yf<hfKSQIBrO+y{`A(CvOCg3tYLm+1czyeNs
zuKtR@MLn+cHx#>@!a#NO$FkaQ8DTFl%J()do+lXFVqP5mB4mB}H&39yqnjB$v7?I0
zT9%`uiuKNipAlho8Okcl@y2scp{$$)Lu_ytJH>Zk;+{(>ZCq7O|BRDnuozQF%h$3s
z_E*OOKW$V7!J0^Bk~dB%^=-tNMW(7vv0g@6!Hd#L&f;PvL>}>_6(uKK!DWD_P?|z~
zDhv_8^orvW3&$C73??(53;SQ#iMB(>aZX&xWq=A%KEcA9mMwtEKpuK_v>rW)uCuK?
z)kO{j#xY$nm*zsIr4_SkQMaH8OE+)8u9u&K9MSPc-hAL7F0?gc@wyER`lk;b5bx84
z`~LFlXgPdJM2?3PFEhc=dFm?>QwwB<G>}cORZYO`q_6Bw36pbC_{JaKJp;7aF5mn9
zGh?L>3%Ej6w2JurC++1WpCciPIOjLh99-p5E!5Ozc`87xziuPv;yRkoawS!Dgh7<F
zKE)kk%5`(<l`vd9pTaXaT`Es5Bs-ktrzE&xHKSqie0aKhIaHN$&b^Ok(*y=oWFS@g
z;>t1x5bBnoanD`PzQjQ5EOv1Rfo2rRSq|~HX>5|@6}>ci>-8fzBo<U{HMZROA;E-u
zam}qaa6#nATl-l2L(Ve(Iu10)s9)s**i43&iL|dS2a8SlWh!Fcc;DSTF4}VBm|(Ql
zl;=yCL*caVn!X!ql?wSo>am_00OM4YW~eB>PkL|uAulsh%3)GpDfP(`P*DUyS1Kfx
z*VnNK(sMs~0Ire}aXg>L>?MofDlLX@WEhq8voO%ps}w1xGP+dPR_cW;?0udQv>iJI
ztI@$Z@qvymu_+l59Q5<3ddtxhC@Zao-e~4&ul|k;OaN$IQp$ks&{Z2LU7GnM87~G*
z4(gqKK_|z*Guih)oq+ZO-F1+9B}JsD*Slxve8<xUi+PMztk&+8N<pP0o1sEQjP+-0
zXEz`gS9@b6CERm39Vo9TMXxxKiUiwSuxcq6!^mbN{k00BotbJ@vXT=dL5*W?z02u?
z(Uzj@UAO6lHPV%>n>QQt)+}Str713AJ=CUD+gQ)cNSxMcZW*Jdi3G?3<Y{t@e8i}K
zcf-v$iV)Y0-M@PowM}#3=@hSZ<S+}02YtcO_nt^~i$KPa+02~;$k47OXYMA@id~6x
z_k%>n+%5sZ{+HiiOCY1gJnkDS<U+tlI=&Pw$x|t+t)?$1r>cxdD;gBsW2#pkCpUpq
za2xgxV#((9xa&{8h^pC*JR&{R-^U(Xnp?8PscHpG;rrzN+BB9-?Pwk6TG4*)47Zx~
z40ebJEXw*L^uCC(yTnFJW5qgyQLy*0h?E{@6*xM_OKWRkce}acfLJYoZtCl^ADD=q
zLQ1E>S8<tKrd=^?-ij|yIxLfEhFX^Et5+{0PjUtgTAb9JPpnNTkSPT*(mNo@IxdjO
zij4?8?CWlaF%c51&yKKQdBhkj77I%$dIh^(x^5*JMA-D&BhPT!L36W}Q;ilA$l{}w
zpPR}V7(`YOmq&BKo<R@hEM17kg>!N4$O*KaIK!26%}_7rMv&G+I@sHX8$R}7PMbXT
zlfOoJ(K@bP-}a@?i16<i4!-mz9D-FvV>({sX0s{f?-ZIMNE<jvEp%l~6Uf<Z&QorQ
zEqO_WN`$6Xr<K8sG<t0g2Twv3;zq!ZvN}CmUCZzDFcN7C)XZssS$q~M<PP`rp}(^W
z5!E}77_LcxwGx^53lrhab0PLwQeDYHHzb>BR`m<IJm+xLwYPGM<Jl7@ar6E6;+>~o
z!rq;)!fh|*O@qd0DJ?>iU|fWhG_%DRimNJl(1Dn{-e6Qz=2DKQUaUv2#U+5&_M$!!
z+kP>hVa9HJqI9p2D=iGle}yCM!{<AGM7yU>8l4nNCA3MlD<zw~)UE;v*W7-y2#wvG
zBA}3w<l#C_pM_q8Jf-C&Xg_lno#)#5#N&YiwWUl-QI?UUwCY$6Zc0TfFZE8UQ#_+u
z3YmS%#`Tp7&=?TF_|ZT5EUvx#7QFNPYXW4OQNp8;i8Nr#(uy?(U=rNU_Tq0ILuYdf
zw%+<>9s{P)U>c*O&E?Dg@>j6g^k`Z(4~sUe=0<#CQ?#Kahi2u83>?Urr?%uwhM4J^
zvKaIF+;tF*u&B13BpqcPlkUxTeh6iC)yW3_Ou$N^duq{#a<kzSSJwBfVl68|E0uM%
zXgPQcedjv`Yq#<M4Yj6`2oe>iYUj=2qU}YqFEwXPER-~JS+IuImteQI-uHQ|+`1Vi
zy9Hj)02d0WPu60#ahghrI;a;p$j6$%lzxABV1R9tMtTR~AMz-ZXc<5@VlXLvvx)c@
zaT#4MAD~s85h%~;@9zDhfM7I=vRBfvaWsXHHbJIH)KbezOt3T=3)ZiJ-C<$yqg)*s
zB*w)3IL~^UaB$}?l-5*X)pb|F)7Q^xVq;mvsK||+xjL2v7%Eb&-F_{qs4<>&9&$D7
zr@n@ySW^=?G%TElo|f}?`uo3NMpIl-IwnV*$$~qb;nH`PQ0Lo;_0uL*EWmpGhqm$t
zM*XCFUw=ihSP_f7`+OJr+s>h<`83<=P?)HM+3}nJJAU9G(<YJ_JK2Rq1~=M7+9X*b
zWlu>Fk|CjOok@J2?DB)ONl-zF3OvgHWfs!je*ZmKv}v{22tDuXiipOd>^wldr$gQW
zael61{Z`8L(uG($i7Zjh)U28qUR1$LoQI@^TvA<yqKa~S`Cq?{&3E0(uFO`070>+V
zFYxp)9)KK7;DPV_ZybF24c2TJ7ix(s3G9>H=eiv?2$mdAj^Q%&WH=sz$<pfiz925=
zE+?R!eq9Iu_sNUgIwTsS71$TmIV#Jql{r<A7#oVFc}~emMK7TFSTm0V>g6bUJ34se
zmVC2_F(e33N&G_GFBYMbq*ofni46yaePXd16&X1Jo>a`DvB+?;;ay5`AQ)w31Zrhf
z72FoX_R{&P+p<zniK;BaE*2b3kezt<0RKKsu_cnuy#*BKWUX64&p9*#Z`vemb{pDH
zHFJ@Sm_4zm^71P9JVV&`;_J+$>ArWMUo4rJ2w#ifEH8tnt5<1(%TOR2+p0C@!EuGI
zLem7vqKz7vAXWHBJWNGQI!>qG*~ddBW^0zhmZZ$sQwm87LTFR<4h|zY;>&B(a>;Ug
zbgaeurkrNb??ZKC14jA=IghRts${iBLC3yOQKoUrh8R3)eo&iRaS@OFk`!XcnHJV;
zK6CIWhP%3PWX~Qzkdflza{ij_HWxG5L>3P<zi$Nd*Q{g-#)Gf!rm0(To~iC7sX#=|
z&4S4WO!k1de;pJ*+>5$Qr()Rj%h4|T+{J$=aV7DT;zjcY+%=UYK@r-LBY@0#+Bky=
zhd9am+AxD)b<r5Y;RNa%E8w<EsA!nY!Wqr`4#G;7GE^xpE#mem67FbRG>=CmJI<U#
zK>Qs7tMb|^1_=VEvg%5<^iHViVsc_EyVdCwReKJ<QuBvd4hw-d6}d_TIB&l5X0)Ab
z#_>1b;hAwm4pETt;5vGts&>`vdUka<z3;Hnl>mwJbiIAu_~ifiBVL40|L6gfloWHn
zE#+*rA`#``C?CFX(<bq~#L#uNg^O!r|4yb>EnuvDdrEdUeePY()OV|lS5v!`Z+KXM
zsGdVrgFyk)VUGv5ed#`QpCfJGXW=d?%bAm<C_pnrBmkq-fyL_J&zdfl@}9+as?V0S
z$jPJ6Yj56)cYpU1>mX<aHE!t>kxfuAUINK%!wP)7GIUrlYZk|vh6*T+MJb3*0kA_N
zTBG0bd57V!JNX=)u$?%)c9fzk150aa!wKmgbM(Ant2noG`mgKcsnMLB$<gMic3$k2
z<p!zMsqOqHDdbIdAxJ4XR85mW8Y|za3^M3(p|uOXpg4hLBNlAjh!1_?K4wM<v71Ln
z0z7q8T3vzGQ)l^inwBr-5Zlw+r?9&sw_=H|)1|zAO8z#fL7sra?Pl{uy024b@d^Bt
zym2b~PH^ke)py*4H8);^Lpyh)?Z`>)g3xF5X-d}{NUzB$KPR?6)Z35F=2oTXp*q%5
zDu9eD-}&9kSbf7aSbp_-4EFYNRa{PtDs)k?g8**ee4Ai^{pvzbWw05Pvyj?ymnOoK
z?n0Z?dq|A26z9BZFbuofA&$?zN{S~E6Cf1kQCh3bjDs(|E<);)ushr-%vDxKsMCso
zqpq_u0}thR>9f9<Agf~r8&M_@bq4hH_u|G+e-w*1u0%)waqN8XNu~c=1z843!NO^}
zY~3x}l<zUi`<0S4fV8kyL^FQx2)DzLGT5P4-{dww+HC3XPzQn0Qh>{@`rT6dBfU3|
zh;}HyZ?!pKG8$Bn)nWXoEwyvm5Y-#I1jznxT!xqFmpb^5C#EFNOQ09?`I}=2d4s*8
zbY4QRFpLv^PIXyTAES^aBEVUITyM7rN8WrFJ?))hjSJ@4*9X1DE<n*PSZKcpm=h=x
zOtSstSze3_*RJ4UhBF6_VWfY6o63g;o29lLDZL3yvn)>&5~oF0R9OahX)%WT2b0A%
z4YP=GP|=IP{k12a5`VvBd=5BkgF|Nj8y?PJL%!HJI~1!;@hxjRdWt9GD(Y&uK&a`L
zvSy1;$L}*748U1lieMn3ZeZ!Xw#cY4J3gh5IZZI`dD^X5y!5BM14>cOY&Y@(r_ExZ
zqm!%il!N8(T6K3NP-ZPu%0~;J@p^`od499fTkI$*=5gKkI^v^gJ}TN3SCygbLM!I3
zT7k;OYM5w>%~gu?XU=fGoQ{jOYm={?&Fw;2eJ#!&IKq)ldJ2j{_{E#nu{BM1Yr6u}
z>IUQW4q@){WgL06pFG7IKl{#2P~(BlAxg0<+OP%#-96a$$-7~7xY*vtU^b|KZ+y=z
zwR8E*E^6(%Lwuqs%gxU8(OzOkt7)E6F)Yy4{prBq5KJtDtSWj*(x?-Sl-6UbhGH~=
zYqgmKuvBthspaTN7#+oe<ykN^<im|0zZ+NGbgf_lUT)w&Cs-3P+?Cf|B|<H)!urHQ
z=Mb6-ZQ?aNf;E!90-eC*UQ3H%tUA|dC&BpMO@)zH)KucP|MEjT`_l)}&@g9AZZjKW
z9al&jW3Mv`__|cVk)#z)j3>-Go6n)UrHz5WT~^ABJt9KFg!*0yko+RluBa}>@BPIe
ziZC{yY9r_}I~|O1O~_&^lT$WPc|I*{V*f|qct^>v3eYUBtit>?D>%I}YtcN|id?)g
zQ9hiCGvo~L;jera^Ea*)Ot4hEh=eU4y$y3$F6B-VqsfZexlNq+OiX1DZGjd4M4XDU
zA>ODGp#XmQzy1aLUU>_KgaI{k8nN}>kBXnilFXIPbFz?m`_X5xY|AF@sg0)z5?QTw
z)==nc>kuKlGQdF-Swn1fE^+%9>m+FD0jZGp8CPW-m2-%CVvR;C%4%w1ve-mqLFt%8
zvc*el^GZ!C(60ssagin6(_&kD6_@E{`sHYsd}b=oTJ{3dxn19^ShDb2G*U}>#{{<`
zDS27G)$+7z;f%hLc+jitzErJ_MU&#z)T<lx2QhcqLX_8*WAE!b1-l(UX+=3gp$Kda
zE0zf6aQOANG1Sw?EjaYL<dd}N=B;QIfJ{~}l?`>Q($#VLoCw{`$rGD^iNK6!*Tv?L
zQ2Tt94M5o$v`|*DAkV{CQ<!5xn_LbCOy3i=a?M`8h!^OBwX1kkb?=L>!De^x=x~t$
zu5!W10=}sDE+zDLbSWdtDKvZBL|3jtSC&!UTo>xsEE1tK0cE*hd9rG`b3lZ|WV}gW
zVsp7sHLsC-Qi;hm(nOxPPhe!R+PJtQNz!`^vO3l-2>3^M^C#9x28d3lo7=X65igdl
zyBduv7h~r`k8^~P)J0AtIA>cW0JHmCo2nbD8v~4#Tc`6(Gk^?;b9~9Vb!;WSf9Fnw
zN5ZfPkj}fgP$VPH1)f-Itb?zAh@BA#XlbmLq60ENC1PPT>&5*Nwa7X)ZD0`Rc2EGb
z*W!xm6LIoNADqhXb2{Z{rybDFU3}lvQg*W75X{Oxr}1=I<E(k1;bEod6<7N{HPDTZ
z7Q}dvAs%57a2++QlPGaQ%@tA}Rh+<H&oBbsAXZ(!9y+TYCw9Hd=?2PcQV%Pg)a0eK
z>zS9uLa{+_GUJ*%ZsLaj_7i7dvD;Yz%+ou-zhfsBqUF}q?ieLKnSj-9;~DY(j-Jdy
z;FAT`alj?#%{FjXg$P}#tD;P>Ym(|4?CM6y8(=`C+~VMH57u3Kz4)pmv>!j0oOF_t
zW{J4~HcL8T0_Q1@W2^nI1iDlxRMfcqs@6c9L4wW!`tB*zrYb&7k<sSILoGQ6M=s5U
zj<wD05Z|v)oLj>vDytCZP_@{w2gPj-&YwJo&aSgCiGP%rA2ZU-;HQuP#gj`K+YP9C
zjtvicP*haHAl}p4j_W>rCl^7V{@Kq_URG0B9+t_54{LAQDk6jk&h9%3gW1R+OYBvf
zRwLmhV$Gv$b~H^!6JQDP*s!gHJX1a+{{Qo-{yt}lVL8{mJf&AMtTWJTcKd}psY}49
zc`2nhB8(Z)<%g)!YZBlZMLg_N<n>Z66qeD>Z*y4qq|-|x+|rqntdu$sJU#tvnD?=-
zeF0?+vsilZ(eM2P9cSBEi-16VKs@K#kKT$!8&>h;QZgbY_8|a5$(ic7Fhd0fN;hOq
z1<3gg8go83Q)&TY7^qf!B5)!=B^&br0kC>9>@%2{@$=8bcU@D}fYa|D#JK~9KtF;U
zVb-sK-#BOBwDH|+X@ZHIL-am~(bA++I1u30Hyuk`CK!aMWsRJH>3Nc>^iMsg+Gh7&
zgDhPFUN07IT!Z>W^Whg@YZt70*5XBQm6zkxz5}Riti`5n+hMeu$7)Te-yzx6Y`T5B
zh&UE=aVs@<8WkH0^~T=*h0kyfwx{<zYO3ep)Sg3l>}Nkhk-b#i+!Gm{4m7YP$<SfJ
zvMu5@7Hn9f7H)$)pb(Eo`1h66oI$NGXk8A{xK4wB*+J@DCoToZPPfanlS#Z3$WJX<
zhy;%gx3vF*dFjG$P{VX08exc)r9}GJ7?e3L!CXyZ;RXGQ%8;5+lC|3e^&7fy>cBC?
zqj6NvsYE2=7h$M}ds|6izWKlr)XtsF4xkrKo<?~?9eP^Y#0hC&Fr~r^xi%1pQrnhh
zHABUYQo&>h6lfwy)+;CY*i?Z$5#%YTC^r5fIV(dZR%jF~om>b=1&mS%G`K)t6oHjl
zFm_sW@kkiei{@e3>_%KT(SlA9nw#yG(JqP9sjt+(HHDFuR^Xd%(Ode(?sDPCtGoDp
zmX|c3r>zU^Cm-fc5E9gGTD1gLw;k`i{0gjQYmyx(zFcuwEq0vTy^qrjCZmN#Uix~w
zV0XA+7RQQMFipm_w4KE2Ypy}lvSoPliAT{idof(4Wo+umMMIr3Xb@q4GIuhSKsj)#
zIqbOm(^z`ddi?xb-{DCw8dFcO6^)i2ATjS)(sWT-)u}0i7=lI{LIx}JiP(p61ze^b
zqm7A!I@Q-G^{@(13k?kZndd@hyUAu|kd>15<dQlqru~B=wjx-q-r^WNNs^X0%I-|y
zM~YWArwsv*j|H7eYbwxtzEklt>+Hd+zkL!hvEz4~ZRK_?T}rzbwIv;W^BtU5T}w#>
zg=WZS2}VOqf!~R&2!$x2U>>{jY{jHJ&I_5CtDKD?tN&G$@^yISfk)Yq*y41GO=eJ0
zWlEY>D&gyelV`<7qNmPWI7^F^K@Fa2O0yA{(+Xo(*hQxfC-8S8$s9S5`!X@{@|s#c
zmtXwFZ{e`mldV*o`l6yMjfDG#Q8}jp8*aIg(^&&U-MIel4`bV>??xyQMAwCObf0a<
z&7Zm#!Jz=o>^+RWjvka$)xus>EdHd9HHc%OIO^uk!<y~aa`(n)?I6Vc<5s&9FZ}Gc
zhy{Wi*>GA73X4_D72|xXIohU6AjVh%(Ls`%UlR|Vo&nnT;Sv=G?NVIBG7FW$)6#w$
z$<kSpT?i?92xB@C=uVv5y|}25GRiypa|Ia4i)pBT1aeqL{rovtux14ou3jd>H=l@_
zBg_P7CY>~2IaH-ZB7U6;WDaUX_YCu68$Yxa?(z~;&7Q@D1h2=FTW~t77g=Gznhvhx
zTxm0;5_GD}AGNR1!lR90ptl=yRxHNmdv53O)h|BJumD}2nxob>@g2SNlV9W9frF@M
zsKA2tD|z&oCa#j54zhg30&Hr^L$jNaQ*y7gc~O3K-}A3>-5^eFYXd!sOEOiE#C@{K
zS#{&}SaJPkWs{Ce2u1=tEk;pONC0MV*ay!*FBYs=$;X@~wC2uVi<U#jadOvQ)`wtL
zs#glKB)O@*A1ZKF)YoGB{rBRTAN&%hcJ1TWFsN;FO3ER@T`H-L336HufKmp2vy)N=
z?+VcU?v-+Er(Np6BwfPAX3|3+j2`Yk)AEhl<qQ9T3If{5rL3{ql!UD+|IMJNJO`t>
zCTSGxXa_GUFG9<)bFj3v<MaRPuLLWIpi3~@?v{2=1I%B!gnMd<UCSbz*7FIhhu`PN
z_TRf3oy~1L;6Njf%?FOcRqR$fBXSpmIBbk5Gw=G;$uK#0L4!g_MFua644|C(flx3Y
zK5IFaUb6um&8_IYZ~?<3gP6B+F>fZ%KlDp%+<XJ4RSvzrn>QgUo>9St3VE%Ej-kA%
z5%bn8=h4pdr<=uoCUfTnx4T{8V4LkiIoEkjO9Tj3!&X*;%DO6e`})QA-wo-cj)jDZ
zD$B8d_*Hh#C>F<P<Bn~3{6Bvp7P%3n6;%v`XHOl&zL#Fd{8cN&v5eqs-x1#Y={!gd
zW{6|Zci}v1eb6zDghQ-*QBqYYNP(B-LZc!|Bl~)ePRL`8^RjyGNhW)7rKM{uyik_`
z>CBQ3m_8A^=Sn($(++4yVwbjWQ8Jnk92ovbsk!Zj`USJMQTVUqmXf&vr6{2G+Kw|@
zOqT*vflz7I*27&=irr5>kHfq7Vg0si5m>cM0Psmf1QS_u^*U75RpXhTKZx3<*(efW
zv`n@+#JC0M9DZ{*$|@_k@;!bUDKh{m1t>+rj#y8oB95Fk_DZck#7?LOlJp9abNq4+
zv{eZ&jegQdYH@W1ZzA+Q%iNWC_Q$_Q?Sdw3zvH7YJFMK5F)-4Ns?s{lS+<x3xT7J(
z4dd{>XK~BNzQR@MvxkqOanVBbU+Cfi4SGEi?1|?xrn~|#H2l)r-o+b{I}kx-O*KXa
zMqm)3{)XE>#M4#OVe|G=FQBvU1h(G#N$8AvPT9DfMTo_t41y*0a=h{U@8B|)akN1l
z3Py`5>3>I?e^paG3w7(b&pXb=*xGqb;{PT*{lL#rThYi&7Af}eRL4-#VmkG9{9r=F
zU>0oFLGSf`@lflPbo{1Wdsori-=ErWj1eN9RCrSKV&lX(t+SWT9W1FRv2ejjZM;vY
z{j`bHzFM`dYxGtfDj*p`wOOCpDfQD<6|v7&Bpk;B|MXpK`{X@Xd*c?g9zTO>0dB|k
z9z^}ZdF&1K@&ms?<*YjKv(s?8ovf;#h{jNWXU*uwG~~hNkKD@d?ae2ifxD<=9I&SU
zhlFC5U4Jz@Igo9&S?k2e0IumTqq(h;sy}&P5dhHN>+k7A)vN~G`Um%+{nQz@Jn3ui
zzy<NSmv7rF7PJ$mckhLNXarRav(S9>1b>&&Xc#N5-HcEm%m7Oj@i!iMioLvm8Fo7+
za$&s;i8}~rD2BfG>iT-Dzjd2nvn4on@EEpz;x0V*<Da3bu>mhW@Cf^M>C~1$)|joW
zLKO+zi}Ul;I|sRSaFk0(TnjK*4e$*P@;ObqvIYULRA8g?+-y!4kdakO8eP(CF}=e;
zr#^qkRzmsNM+KX`OA8-Kh#qPIP5GQUV2V0E2G9IthS6rbBtqR&e1;lCxMfy%TBG={
zL%G$3f?aK%PuLueN6l8VqI#sJ4w%gXV-C3Xn37@`o3CZZTgpvA4~Jm1R2&Ni266qJ
zcZeTJc<A4LjJv-4S-}Pqn7w!bn*qM^;G?K%Y~&(_yQGL00SU8E7?-c!m3px|1%SPC
zfEOKAm*p{e+RPwLxwvC*?B>(~f%_Oso{X7?(P0B(oJNyDgr;S@d6Do4y@t)^z`9#+
z0zpAVLmjsqFI>L{Zwb)!3UFPzWi$4_@G5^+5_<XWm;Q`<Mi*Um9fo=b;3#&oC<+Zc
zkbz%39_GT#%q1m%s}3O0lw*mw5+kK?=x2ZYD_sA{k8m&cnM23W+t~w$)6FVsI!W=6
z>-Y8uni0c-S!;36*S~_FeB<xAH8B;)>0BP@?czyCS7|AHLtX}2wih=jAeyeymFoMI
z>D;6K9b(&FOEKaGTZec@_eg34MeUQxtE@yYay&F@VKkFExO5k9$Foz<26QGRIj<-G
zqGIUHrDB&iBOEn8)_z+4r>14|ziu=|dDl)Yipko4G;ozP*G`Ph+p1veE-exv@>v{z
z=Mc8tcNgyX%I9!qp8&x`7*>}X&4&)7PO#dp<`#IpgK(Fx7GYUTfN}sE1uLP}Co)c?
z5KkHhb#g{l%WeW9{HIH*X=JX912K9N7ulpy1+GkpoMY;Y*gh3W*6z3ttw&Dc-1$S8
zy<`E7zV!|lUI<W6?s->zojBT$9v5uYft5RM#L+#6;0d(|mb(NC)~?2$XI??;fs+{O
z_uzoMlO0|)ZQOKrG;<l7HX^&B*3MHboB8o?d<Dn$>_bGHPf!2$r>HBR&sw@>s||PD
zcR#0Q4!yYxk9_9`815NJy5{mQhuGw4P-4mEbt2+uWFIq<!!)=|DXFvZZlOwNL3T|D
zy&xa~iwj|E33L(f_Gn}%F30?cM}`Ee?iZ&<nAZn^tp>g`se|_@M0#)kpaa#5Z+&~t
z@(r8(o(^&Hj+Ia3>9JTMsXs6#ji61G#g)hC#G^ji)!VMYP50l8R~~o>B{kK!<^DVH
z(Dxn^C$k8f1<=0z^b2qo7vuE4Ls+-{S~dZs+$V`~?0)h&Hb>M7Ls~b0G)DHTu(U$1
zd}~J5nj_sX<{?P|Yg(WSHmt^l6V0d>Ap7c*PoSc#3Sap@e}@-;@i5+a_GuJZOW_TA
zP*G9C0|LvpZRJr{r`w8-lWjP-dlyPw6+B!(#mPt{z=af}(KZ9J1zaedU?+hbzYkyj
z-ao=<v*B;={ymszID^svb`x&=_{XvRzI*UrfBVm9IUpEs%XzWMmnD0dNpz=bHjOG%
zip{_sA=KNg*B9#ioB25D1>5Dkth))pzFl974jun)A|8BCqktJkI}I>hIT}8>>)69P
z9K|&q6}1%(?_e)9IYYHOFooTYve@LQB`GN;#Y8|703o6Od>eY(&ZFh<aU6dAEf~!f
z9DMOj1VSO~xbJRUd-omK{q%F(Q%a5AG_gh+vov#01ueZArctO!OoNy<g@p<`*A)P&
zg#haWz%}(}>IdiQawsYo?7KX9w_?i%L_{cRC5vv08LqN2l)3A85QApj1A^ra^qvDb
z6kq%CkDy(EbHpD)iK9#r-hncLs-z3#oGfYPg5<g2>l+lC-746M?D*+l{}Z;}a|brx
zeiL4L=plp=#OAfPAsi0l%_m=gr=wS#n_b*JAg2_vc=|9LW#@yAGtF!{LmOW<UEA@?
zC^3%h>WHL>-w(RxAmVL)Bs{S1yH|3Ea-}lbaWRn2RIzF44PSlRW{JW-qUdQRv|?C%
zRDfn|Q7ob6XO+Sk3vWduf+6_Ouxts9PYHJFMPHW(MgzGmgkcnbNi49xtra~j=XkLM
zNQ=SYP@2_aaRybIydnTzx_KiSmoC7|zj}<d5u%|87c5v+pIL7PaLn1^l}$rYnRe51
zb>p5dNl8Y}&k^r|3Su<%<{R;e&l<s>{O9+?XYI$M-}^q6tY3}hcMsvv&Rv4N7Acyw
zf+3Oh54~p|-4%dLcG_b*EYwYI24wT64k9tJsfkVQ#?4rF+YU7EJAmN}=dt*jtMKoC
z`b})O{(3YYI)VVPQ=^q9&-_C}<D@Xz#UT_{id_YoS1M~&mmIq_7|h9IMt#$C^}8Dp
zjQRKb+kU%7tpi8}?&y~tqt#u3=V!WgB3~1c-d(5O{?%8aahu}1q=|}1qh@1LvQjFI
zRjSu~a9A)pj+&-M!3xYQI%Bq2*-e*DW}2dr1ehLu?Jal)y=Yjnkf+7!=Qpvn_1qOp
zu=&F`qra=0!ITPPB=p^K<RlB!klY_n42j37C5P3RRDjg_{Rya96h-w=OEO~t=41~o
zK^iwLMjwMZ5j=zatSL(^Z&cZ)7Aw-nB_IrXeLQMQl6;C68xV{JF>CQceD&Y{9&z#i
z*B^cyzxnn*qIuW5=sMGa1F!5tA{^s_Ohmly@X(;xIM!kDhLzA+^vq;4wXw~BY+;vB
zC<s?o1<GbsVW6cAD>rXKaYF;_6&1MSbDu**97h7cu%85yqT={_6s9^ZXRnCs7&SNJ
zf|igZo*QML)um{GXvMF9qY5FNAr`ps^i~yQby?Ql6>%|K;UJs3;UvPt$N&BGyU#3L
zyy@028e=4u5lz+r<dmtg<mk49aecKEDu=|0Z7+_()7>YSX%sf6RSAVjEL*S%Bi#yc
zTz|_B!2r9NEt9NVcl!mH1sKnoKNmwi{jds_+jX`TZAVYCv|Y{IM$|2w$5MsVoZfQy
zm;m-DU#TCG<i%qu(<R`f3bE7WMj+rr{ld9$l(=zX_x@24Y-QVLCf%@X0j|C0cI<iP
zC3K6wX>~dooN4jV7-n%z1(t5v#I`%f-+GsG*jsM9jpyT^`N7XoKX)OX{pqj8@7Zw2
zAAJ_J^B2P8aN_*2)7(Q_SznLdp7U^36d@XjA`}R4r@{=VPA=+;iBNwa*o*)6NB@Z7
z{(ijv$m3{iUM7xp0N(yVoIQA4L==a4P{dVMn%vNm127l+_hTW>rBkYh+PbvkNO{?S
zwG?4X8A9!k-Ij>?hw0(58U8VB_KHX)7_LBo&Bki!yNG(bcK%_@(ekBpmaf~Jh<6Fr
zm{5loq?C!VvEZ88rJyrN7!UwkTv>#>zxI3RJ>QR~zW)o9R8}U>HOj$8hlj=Ezr^()
zyB)9p<`Gu!q8DyI*^K$CmgC^STP*HuvRM=xX8~+9ma7wsi1M}s+ND*M+|#;f<7ym#
zdoO&x5nOZUhuA8eD*vPl`^?WC;G!KlyjISsM?gHEJk<KzE^z3sh&)RS^gXTTxiDgN
zIhiffq?*;`fcPc;IgQpH+4(l2{xCD6^T$r{c;{PzleqoU|DClSX0KR*n?83h{`s?i
zitEICS$fSzy#CwAVKy7Z@5nf@Yd`ejerZ`Hk84Ug-3)S0ASbJY_z50zsh>3uI;$0D
z4xeVB?S*TX;irH3cj)iyLWzr98p>5k(D)RByiNt#1bee7+6JQ_8#Xx*vR5P6_0pH4
z{`1eNAe){tNU!W(_F#J@<Y=>jY^GT+TJ>RZHP<e?|IDnpb7lpGyAh8j#^}}}Im{rB
z?LJWN2S)@0EH6b}Qw=-<K+hdMi=vVumTXMs*I2qPj7=Z88OQhS#f1|m1?!u|RyCD%
zH5lyaRV+*Fb{2!?vofZ<2buuVoDImrq`0ySJpwqX`M<iM9zg+&c9${$adO{&*ewo(
zBVo2hFR!WQ(N}tH4df_IL1_Vh#0!VnrHocW@m(XiMq=qS`%dl<t|B)VO<005s>nFT
z1S79*tY<^a!QKI}LB!!Ma$xaQ>tS)Zc#5cI?rc2ro&ONbxCHn8&;NnfAN(C&78^`y
zS;Y*3j$HtJZbeur%c2}3b&b+vWF;>P=-T@6JMij*PhsIz8*uGi+wt7b9%2XL{+15b
zq-EpADaI}>CrejyQlOSetp}SxmMv+D=Ofs^=byrTd;U}fSv|&fhNpLl%a<x|JDsrY
zatGQ%Ko)69079Q2V42mp?z1N=Yszf?p<cD^OJxTt=%yFOwEK$Kcn}?3XK~fm>tS=a
zap1Mxu)CcpZ$z;rH;Bcw;<^n2pt{g}@E9BA4GGq|`PQ36SbhfGE$5Z)gqS+rmXODY
zJ<}u^EkKLi%DJ+D&&Ne4VvCfobrlz@&cAB0E}@8qur})y9ed5Hn$jDTb0!d{{!UVx
z3V4Q4HMbGlKmS>b^mO6v$Da_N(Zr4Lo}K}<5q{<YPBO90qMiHH+GiE#NlA4DJe@t9
zCzn(WUpijIQoGw*xYJ<MZ9CA{(XZsS1^DfJ@ELgfhhTHrryOM1x<-I$EEdiHvT<^+
zg<pVd$anU|z=dbGt82-O%yLF@9)OiEH=w<o&+<Z<Y^ML)fzbKZeZRa`Z@B-RlG0)+
zFfssH?Pt|e33AFL8B%h&adG02;(S?gHIEpQ8a*4`$z$ET%yu(dz4!;ca0)Q?^?A^+
zatW&E&O!J2c9hSm;m|xR7>bEpNTFyl5bGsN7Aj!ScqLWtm8qS$s!9eJp){Hk;A&x~
zqS!R`+N^B5lQPOl43<(0RNN!W9&*_2Idw#ULLcXD-+1ORSm6-Ny`EY2m42aP5*YUK
zv1(X6A8|Q`rCZkF?MI*IVx(EH)4|?8!Ej9scGP}#{#3JwUXF|CLBdl%{UKbIA~@V7
zuwDX?)y@}UvIc`?9LUDSN$D?Y62#%cyTOj<wyVEFCq$;oS|O=}%Py6mn*rHzY*xGP
zL}F;~xxK%<Wq2qqLU`AxHMukz=4o9C6n;x7xm@n8Wx*E<npQ4SG)B`+5d}awoK_rt
za}PStw2QwU!^Z8`VgBl+II`~*4&kr=#9iD6nbaN?zqexRHE@;{k6LESa>lV;Iqlzj
zbs<kKa+o;q(oVekt4E<1U&cLO|0?QNEW^4Rx1hSJ5lc305KKIB#TUaU`k;-7{LALA
zUydOWJ$ZV1@WM}iC4kG%`TW7YK5V{g2R7b%BNl90g&MJ0=><o6;)g%S{%2o7O=Tl%
z#HxsR5lcqO`ZJ1(6ko7WkfrW|g!mPI(Hum=14jerpWLV(PgkCGmW}A-TEjCy`vC`8
z<N#fl9PNF!dEY~y_xknhPp=7uE5M3TA=?bEYAbT$LUS8-KlvgoX2a+kV>2*Wgo#1a
z&2Pf>_v{eNwNorABZfP>(Rtzw+|FvW3f8h{<66vJy&S`X1I$X3on&L)zWlxdYx-qq
zs2^)?x(?TV><;t{x1sBN2fqKOe-F?33+Ou6hIO}WM`>L(eBR;r#WH59@|Bv~av>rp
zlA2ei3uzAw2r#8FS8`EauyGaUuUm!@5jAl^G7w6J>d{!3bMNPmpM=LVjNkwEH!yqA
zT%2t?fvV~TRk4j!x-L!^Lh<^_=9MNhz-qb&3dkn-4D-2XBN7h|`r9AdEGzTe#d$zh
z%9FyoJel8RmZP0W;VU1brTY|TQ|vu#a4h(fd22rW&sI~IhY%8K;Y+(s=4!_j$z;Sr
zVeU&c8VyL5VWhJ(7Kx#_x(s%=70vsP2zKj2Z*MnDf;kjdl%uD&7n?tN8(c0Yc0KhR
z7sH6*P(LIU$tWk9P<v+I_v5Bk#A$q!vKFha-NHUxuRi(&c6{ny?0Vukwz<|@Ex7u_
zx1e_J9Q?=E{sMN3J*h4=-7kvYm|h)*iVFaY@t$e6m@_hSMJqU#jB=<yo2LB88F}fJ
z4XkUi=eg(6v}7UYxVu_fQBqNrO!xRkhFIBb{@NAz%|HAb=tz@cqtQV5DZT27d@)NU
zC6$#X<dSX;K8BsiiVB|3-H5ORU!e8jb@AxPN%5mHuv$J6>We2b<Y=?yY%|?nRK9km
z81~)(Z6SrPTp+965<*7A)njxl{Hvx_cl?db6hOe|Ra{q8+j31lQBIjAOX?%UQ)CrW
zu$I9o97RaHmc?#Lp8VRdmtHKS-u^zpYS+Up7U$8o_OQX8!iZH4n`%4rK3*u7SXx`f
zIoUJs9_Fbr(m<s)u8P^SaC-kC=q)B}5g<#zI@~vc(|h)F@$7@p;zjRsL@-bi<1w1_
z7#!@zrdw`CWqlnU{@#D0w77~lK}Ew==I2xE9UU)vd}LsNt<R}INy8@VZ`q1-M^0e>
zi?71Kw)PS`BWq$hv<||dAcN_3AG?!s40!5CKg6m{*B}y#;oRY4aF>=%s&z|Y%W(!*
zMcNQ!qN7pouPh)dPClQrUVyAT9B6xNlK|Nh;=#%cAX^B~Ub1e48KAv1KzlJDn+a&s
z!8RnWg9gW<zinE1+h5v^0&M+W6<pH=XHsm-8H8o^|M9HjuZehsSq&ADXrLf@T*U8D
zTbRyl;({1;AIO@omfC!-0qy&FEJ+lnsGL00DslGEaduXqcS9f(iHET6#;vfp9VjX-
z6`&l)lmF+(JQAuW6|w1@r)7KX82b8q@$s*JRYV>KaQL-1VG``TqP7~&l2Z7*LGDea
zsX85}mGnH2QC44#@>#Vwf8rGUo*~s1M$ftRA>RP3dYb^t(j<dT1qeD{Xkf)?F=D8f
zl-^3wcJ4Sn@`XRZqN_LIKmPbHkO<IVOi^Zsj2z2E@$}MszI1un?kLDAoi9Fj1HvNe
z3ba1BIvyE5AbwP*Mt<=uAe#!l$Z%iI!)hl5wlgERmp(6>E89O&W~+Ti<kDCk^PTvs
zvj?C08(-K6i_I=hRC%-@rfL9;DUzk+Z%2K`#$F|vdM9;gTD<};vI(Ig*C>@zbV#Fd
z#3K=YS^mGIs55C6&}>bvd;daka(SSl&hg#*#C>COM45_!4wswL3M3*^)6|4mAOv4*
zggY~)yHA+R&KX8**tQjY?QIwo;XZv<i^Yb{=2o;EJ%LqQH{piQ+>Pbetw;Z02W#m{
zx&*?0A6kzbgLhz1*-%t(Et<9~FRkVjLORG&d!LVbn#HDT78`5bf_WUK4|VszZ7ai`
zXI{kK=U>69>$ae%s)E1Qi7b&sB9dgX=`IMlFpWS~%gKgmgr)7V>r{|!z-T9dF3UPf
zeXI~NblK%=FBe9ekIkkJCFBBFU55MGbc;!4wjFx=yuX;e{I+j9OhJUif=VRhl$1d{
z$z~OntKFAbY?&0hbZI9!jm$2*YAtH#H{zvVJjiJSVn3-CJ6fSa$04eLM{LQ6&s|o^
zfG|P}TAxK|W->Wf5&E)kRFNy^=%!W>N<DV;`y^yeeV;UKMr~>(wH4TW*N4&D(t*9t
zy~wIwAA~(T9139VP1lGpe<uPXJ~-K4do*N^tM)rImOR+q&Aq`qL8Z2?Q7%2#I-}=C
z!y(>u{NW(({_^M1ccBxnJn|Uq78lGmOG?O}fOl{Rb@S&T7K*Z1x}Js;vb?_Lh(X7Q
zUMJ3$HWM3WpcXDt;^LfaA~GCkf9(21)Jq^cm$F7F3^vnMo<PoaO7pcdjP}y8*?cV`
zQVy1z33$^%myR6i6*k8GXa4_|!%zR!NI<X~yAzydlypjgLZ{qHD)WT;7=w}Ka+-)C
zwWW|W4q8RXefZVguv(okm?%vk7T&Ng3AP%L(WF>lc$l@wgCbm=vwA68lm`NS<vnN)
z5f_zn4Z~eohNe}^xM-Kl95O6e6@iTQ{v;mQ@bf4yX(o`isZ+4GwhJfu6IailBMABj
zz!QwZWD)YuUcLZF-h2l^v2i#`ipJ$d=~MT#v|~Vkqse53HkL|hlQD*wSuV8knjH?9
z#dl@Y8`yrH3T0NSDsYqn9Nc$U>|#KtoVU?p&6zr&V^dmJiSmXjp6t`>%@YRMIJw{!
zH6fA+4F_5uzD@<%MHsL6ak1B_h+L;<jvtrjC7Vi6p{-rnKv(-6YQ~-y_n-cD%aJGk
z#4{p*(&h#i&n3m6PO~XzuvI}<yRS2lrH(;iz_Oy{Nz8*7>R?Bg!d#*<DjOQGa_bf@
zn6aHRsVoV0R6B1rsv7Gt(%T2S&5olx_u$mtg96NolkI1?NbjX!z{g{=SKWRSFVI8=
zu%P!tT?RXT|6bHDnumbbt1j*k%Iaza_|IiFwQ&6^j0_FI3@f)bb)G&4v&lM5Q?iQq
z4~67I14AegAVm{=<X%Ccd?rw%+$;I6k#<C40{K!UwGu<0rxQCq^D(|sKKq^Dz09KU
z4o6W2Y9MihP*zukn?HB2s^S(IbK2`T4;<mwCR-p%<=C8VWx8<!HZe3-8xz3qE1HW)
zbg0wc`pEV~JaAn6Xc<ODXmvTF#9Zqx-`c&bQV1XP)IqLxu0nIMx-6*!U0UiO{Z@0L
zI}T&TCu$dd_`gbv%_7|Pus0Y~t8h*k#8by~Wi`E^IyuCmswrN2D#4G&6^jL%T7;K=
z{-9VadKS&5*RVM3n6q+;SV(c4*!3>UFgnUgm@R913yO^F#TUsG%XK*`<BN;W(jY*V
z^0Pzz1MHGOz+`hfIsaHayAibu=HTS+ePSah5?~zQ{!w<V&`rZNL^{Oek!7{wru*-~
z@wfNj(91iyBOvJ(JIUA8(hTfez-EgvIK+1njYin{nAmUMg$_1D%%0MbxX;!sHdtqI
zF{d)L&J$&F%gkaxq<=yA@sYtn-n3=*inABorJzql5iwX1pq#9)b$_tq*-r?N?h!v~
zf}#f!Pq`*iZnLEhG8M-rnnsvV3Sp+};L-qXAw9D?<S%>`3bY#7(*I9ESA0{&yxab(
zvZB};4-E(gpxWEWqjopkfiNbQs{(N>uC_QyDJ+TH6@n~*ShsKvdRkkRmM=k@i6zqb
z?aCXkVW)z)U|$2B-E0F+ItI*S6Qjj8Wg$*1#ihBf(!w<4$N|#x{3BlOlpsbIjfA<9
zPIlzyPn=;L22Y?5S6zP-cT@y@A)d!4Q$d3&UNddNJ8=y9y1KCRs`Y{`ejK}>dl}8|
z9AxXAu};AgV8@hq^$d%!I|_Gk3AcNZ76d&`QN!Go%lWt;+qDN)tDQRyM*Y&pUt$83
zORB3GJjv9OU2Lf!8Vjio6-EpX58$d>cCb*;@m>32ce)Bb_N*t%DqKzkT>@l>PrM!I
zeBt9Nkj}~gvgrUDp8~K2rl8$x256@SXs3eB76P)F05%<L2{BF!&akRv&aMAdQ#-3t
z4)-Avj*VKAv#^WIg|bms2Bl3)yUoUeOjaB0MK&JIq>zw8RqDs=9y*I#KK5D6Tek{7
z`t!emE+(^kDKS|FTutOVp@fW6Q6$TE8SxHb<4xNbRChi5JnWQjHW*pQmZqGRU40cs
zdWV$4opBmTZIJl+h#%z*b(p_?nF!tYqxtADIBjl@ASTnVO20$LYWC`7Xk5Gi2VQs;
zHS?R$yzdAPz0gKO?2}HwLUOsBJC8(AQC}z6sw_4vk2ubXl?<I<UIFN|$(B}BA`}Yo
z-zIikXu3eh&IoaYEF}m!Y7rhh_;j#m=O3$UqzXzQIG%&e#wS@6OJo4pi!O@I0PXYv
z+H9Q$T9<)72hbW)Zs{?qGPH=hb<Ub?->s=%w8kiVIA56r+mwFWQARsD+>q_`VYgEe
ziU+*I%xDzmqE}BO3GV80%wDz#ou|&>)WHJ`Zp55qHK!-3-cOqH*HlfCY3`{${|HJ;
z%hmQJrQMA|CPf&6^3P=1v*ANG!qYv-TDImCA)5C+W582iIxN0s9eP??adO{2l$2H|
zf<c+`)0%Bd%K1u`+q9t&BP}W`<Gxyp(}C+h{ZR~e^$4JSjTOzb<37fdtHAS~-7*3}
z24;$CsE|hQh4e6%Y+NhA+l<3+?tx8g&Xj5@_*km#TS0r3V6!d=fc@9V&@uA)azh!b
zB_<oY2%w#4`T$t~w_vcH0otht+CoQdbp?R!MA>ZWeFEDq`lIHO4d1Srz2SC;(J#Q(
z&m9D*PP%eR&NkImHy7AaeJe)x%v3z13bamXAtH~n1?$$Ze-vrW_O*9mpr;$9CFMv+
zvfBNS3b={MpM+|$h;qpE8Z~nov1s#py!M;Nd1{LD#47vKCcZqLUflGlPr^}JjNkst
zf1skgR$<)J=G>E*5t5*_tGpEFPoIIyUCdKnq$NOouk=|Hs$ZI<ZZb$6u?01kda-!@
zdKPLwxbqFzZ7%-3fY*;mBnT(Hrf#f={6%aHT=XLM3s0aQn{T=WvzIPK$EmZ}`||5>
zxrz&pUa065Cz(TM10v%6g*spSX4KdEQz$*MbWTT95X}X&@k^XO_&@{g<t}fZt=c&e
zHk=E%(|@Mrv5LZjd%n?j>c#JSf@Tr=7lC9~<+SbtNo@mzUTp=-F^Wn#TPl9poo?Lz
z#rqHyVAkK?4YS!Q*i$(>?jG2=liP$o^*{dvn{M6)U)aY$KvijFG*}tj(cZ&EdzR_>
zf#DH^10mFk5SW0-XfyLfn5(=5y`BzkhvI3la0I;rov3W6MctfvIQ{NXoP29Pirr=E
z;L$YN;Kh5PzT}#DbJ?1wX~i<`m8FGB6It<?BDO-4c?7VOzHyWkb8#s+;#CGnD6ALJ
zhP$E+CAC$2Ut8$p6<1VR#`$$^)4SLU<zoB#I#5wxi;w-`f5V02t$6kazr^0>UPDQ7
zc|jm6QPD3EMbu!1uV@~^ao=E|_2DlFko}GL@nR^gjQLu)P+%mPiy-BTR&zb~g8@XB
zIitOp)Il~zt4~WAWMj5bX1AuA+e+)N{nLulQahppY~HBlXcMW$v6R6Ey3H2evPzRh
z!qvBJXGQ&2AA1}{uF_;!+0}OeTXuYit!J8#pTJ0GADi@fhdn4MDI2ZyCq2VPyAyI<
zh&g*k2C#713eGc@R8+Du*_xZS;KA?w8&++;N_=u1hWiGv@8ws}w0H>?Zdi@CpLhv2
zyIlbAFar;DBTS{W%9NdVG=XQ<!EU$Vs=IH)ei7y$+_e+6b#oB)g+(Nx<VL&N&LbKO
z!|rmRn1>YN80hGP(PV~RXW%wAV!lNsB_dF{biKlU{|M$RTY@>um!h|=6Q_0`gvo4#
z&RE#AohA$uvJ@js`Ph+D`-7b?{jDs=+f*hSQ5kG31CxzSg3;#6(<X2Uh8Jdpzu$kB
zn+vdW0eB%hv1W8no#t~9>3nXW`QdZn;I?m8)y$h`whSmej<QajfQTnCo`t;`_7WMv
zmcsH_EQ-N%eHiK)<i1tvSkS^-THv)6_1OK~i`=J5F0<~665RaJkD%jh3wA&IJTD(=
z!J_=0oSYt(l6A98=WjR|6fCV8+duzlL`10CC0@%(jLz=B+mAgD|KJeL>^+KQ*I$j0
zHH@{}u17^}tzdgW!G6i#ECRFL&Yy8Qf~>}BhkN?qvx>+e97a`R9qw5AC5#9L|Kda6
z!~CXA2!?{V@l$uBue}pHfA<6`X4fb4(HzbQU?r<~?f#{Dp9;m)!Cg{;{tJEB{n87l
zt)8v)@D>0rlq#S}uYj|Ty9>g-Z$2Cz*#Gb9xjRoSdgWU)`J%*3YeOz@eO`7V#aAMu
z%_SaFXj@nM)sVt!4QW>b+-?fPOr;yYQdztDMyEM~L}(b%n4IjjO)rdT3^(KMD8k%c
z!J^33wtis~`p$Q75rzb|$qGD~gB90MIEcErbFgm5jd=IPmj&Y-gi(Z@Lw)^9wU6y*
zbi7EZjVrZa#;sf45zJq`QZaTEz<%KQ*WrtJarc-05Qkpfjg}KfQC?Y%NI1&<vD6$-
zy}#6^bY|}n@tR7SM6WYW@0CEUb0z~M!D?-05_8ex-ar2ueEuMI{`Nt%96E!T0N~k6
z7jnzm*&|0G#g)@7Rds8!J3mdG1wuZQl~*cSL22vKAU4^7-d-MtDXXl4PH%$OGsG=;
z?y?e25fzY$W{`~-EC@Oq5s3$)p{`f{B^o&YwD@tk8i|E7Fxgm^{Om-EVsaK{n|>dd
zqRxYvV%U`hv|1{`FRot6+IV|u?N#@e6ct(ZluC%kxzMF_CdAVQ8q{9gENKL4;UU$1
zN&JO(UU-S^YrG<Kb+}x~2_-6+P}4e9plP~k>nHDIb*=8UHqPw^y*>n~uqFQXz+jJf
zvqtgzMSLF9;t$6|nA0S{B^E(@+iA>Qu#7bfx-Yb&u4%4df67MD*V!dPR|{MM{DZzA
zvutwE)pK%M{y;b>kkE>rdTDz*QNMf%*4(&7fN4a0e?!>!;!apC7POu@1&hhX!x!;M
zj1lWqz@*%|!{rovX`GK06%`wnEWn$OJqx2j&j3o`Np2Mc;v?Q+?D+I28Gm2?^&@b*
zizoJX6N+we$XbGstqM_p>zQEJtN%9<^B;nuzLm(3E=UL48K9j>9ZZC~<g`D|bTA94
zc*;3`pH4jL8h6XV)@S;gyUqlwulr(I<=h1}^N0Ye02Ji|a!^Pxrpr=-!$W?74BZHn
zMlhSrIP%&a1Op?e5({;~#?{#K)UyaMvou5b)i~#C3HS({-+c6UZ0IP9ZG$BCh>cl%
zKFnXgn!f~Z{{RNMdf*f+$?0^Uw7L?%{@3rJ$WemQqAJ)39K`RJRn~A3tgo#bL!Log
z`|;Zl90}pj>u<wObNgz8|HLHx-oMSAC#zy1boX_jzG)8b{Nq1>&Edq)|NL7xabhp3
zis}&>@v*+HGKCc@^u_r*pv}x8q7A?Ju5bSRPoeu<3l6`z3ndlRu(^w1wYy;}QZ_hZ
z%p{sl*S_<eFdEG;nd}G$!ipf#1oV5A0R%EnGzb=3hlq$Q!aX}53wsVfsDkHQmBl9V
zteHa3^+I1G*YhsB)PW9H_C?MBxKf_y6xw={{=9_xea{x>b+5nc`M<w#Zs(H&0V5<!
zDNIHkxBh6tG+dod?M9Hs=jw<pQeUmfXvKvSEf{F;LU~OMH^HY~h%u9OwY{W>I}k>O
zJj{CgTHA4S_gnn#20Q!UC@RIGP3zEc_8eM|oa9kjn&6@te}ma17QB%~z2$@+ZV}=(
z?>mNQB*e;PRdZ&exU!u8|AATn+#(l4ScL7=hIZ90H)F;1*WvJsui~FS{RMQKK8L!p
zChj(%u7QcNBmzcavGZ0h7n_d*IuU+^1lZDMWwtoPVKu-%FoXlIzlMj!hDIj{bv!gI
zStM>nG%pL5tv8`q9Gf?O`xM@O>^T${mlgKe1Y4#luaMczHsGPSpOm-0D?s)a^k>Ai
zLIvAQOj6EsULy}V$+g}t1whZ_Xy3=w0dR4BwCUXk=~@Tr>4R*k1MO-|$=gy_!XOMK
z>s>WlK3Q5^Q(=~e5s&y0<G?GW8zD7~kmYcZCauM7hskC__t{q11RK>3EscDZ)m5`d
z%>I|&K+VDi)HadKUI=Fn9fBOu2{!8I@7^08!PPr%;O>D#`}V*DGs*?)BDVwr^<v5o
zijUyw>xR)};hZ7o5Bn7Ba5u5%4}db4W-~+Qztw5uprg6<2tM=w{W<5YUw`Nccsjeq
z_i3GQ8ywpU@kXfU<7Kkg(6D$RE(p+$hJtJ-Pg=$fw+o?QKtv}ps%OtaPum6Y^C;|Y
zH@kQEhDOA3v`<K=W(<qf3sAS!AY!y2;yJn})cf{tWhA;(fQ_bHV=1@UQU~!YDTJ9m
z+A9cX3jx`Qw0Gre@zP}h*i89aqk7+%^8eJUhf)f9_wwzfm8-YAtw!jg1A>(%M0l#Y
zD5MNJa2g?zee<_EtQZlY{Lr9B0AwYD9%&;qELq6Jm=^nv-~R;Oe(HIIML0We)iQK8
zx5Lvz+5-mGR+zP*3BKV$CGTo7Ctsb$KTB(>#WIovSoCrCf~2aIX<+a{F<YefOF99b
z!Cov}yF!3&g8O9Y4A}e9tKxv^S(tkwHE=~TGQ{Z>mtds>=X=C!T6x0@jChl_Hlztl
zW3j|)^=7?@BGzK=%4K-@7mva>Fw7$1l=s%G;U|@gwG<(2uMxoAI~3}D^Wj*abGKS6
zptgum3b>{MY&1gwEcO4196&oW88!p71^a^)Ivtje*`{ChDZpw-16-}=b_9mv6^_cy
zA1N-btG2=`nC1wxTcuDYk4}=QEI0i^ZDR(j0Xy!$7w6A3<Bi9kgw<$+v!WbpwqHlh
zusFGAKU$8T;$n{0mPE`{nTeM<l%^sWS<ytJA%2cU08&C78I4EcJm#r4XyBS)8|n{Q
zx}dkK18Z-*UVO$NPQ0^^^PqKt@%x9p=<n?0*0qVQ4HDsQTDcS@H8nW0bB|#9#?jdX
zHsg#!GSGxsRD8b{K9<z!Kzha_10L1DbCRElbqW%Q7|h%k8`0?z892B*)W7Fh@ncfm
zDp7$jlEz~5G1;jC+CsGs5?Rs=Gg=4l6VOg3eV{|(t_qXwKG5d?+H{cB?wi!xValE9
z-OIMPOP5^Zw!6$m!EO_=2x18-nMN2L*_FqAca(o!x_OfbKkeA{?6WY7g=e<eINwSW
zP6V37q;#s~4q2xR3-)U=+2ATE5llLg41e9_CGhn12zEQn%2Pa39}Ge#8ToZ&S#y3!
zd?1)CX%Wz8p`7gEtJb2w;{rxR7|+%&f<4lAL^*Mb%{rlQou>8z0-)(=R5sKLz_hSK
z0`)OdK~u3AlHe?JW3ao6Hzq9-AUhe7GgO>2^pjb@oQtIq+OV}8VZmgh{*JD2|DKm)
z!R~j(Q>++m+tNTal7Yoew%cGvz3U1C+KXki69HOX7J$uk-<TzhkSUd5R!>wPBvYNa
zZ2h*P(uGSL`Z)BQPLP#uuf(X{ZF)xn<w+?ANI!Fz6hm(j%qAQXq3Z}s8Kzs#(1g*l
zt2PR@6~~zahv9G*@d-LO(2H%K_$XFx-Gm>1^Y7s8BgSPCU|h_q{v*AEoP&&pV+>BL
z2QbY$3`iGX?yBVswq^B|Yy)(FbOB0AFKQ&10J?tZLWI123|{Evab7Au(s2p;yfE3#
zoJye70Znm%4_Sgi_F^_DZSWv$awFoXMkG2Mi}b(ya%A|_9zKVZf>$bwjpksnQH<}I
z%>}lT&CO2K8Fx}?gXspeAM~yRd6GW^viI%fx@NOb&b6awIx#a{HKsv8Tn;%h9PWGb
zq2AWtJ={Ii+v_(}LuYcrq*tu0H3tXi$95!8$AP2B1!svHVF9p|9awksHmu#gl~uMf
z>}>oAY%V)wNlpq|7ZsOb=OfRcv-JWNtzIKoU>rUX8n3?LTHNr7yWsH*!Z+eURZ}f$
z<~Fd%%=9mS=~&#wXpwN@t#{G9{|FCONRxUkWg?7nuOyJ8Y%)3?`cO6<nL7>~r4H^Q
zFx#AHIdob)L(i>wdQK}$4rKL$!RqB0!bTf>?l}n9%MtV(Iqq+L_(uX{UsE^mV)eX=
zVqyaanbH9AMKIJvj_^NUm&0V%_4GXVE(3GMT!Iz3SZ%&ELZK-H9kO>IOeT$BOi3ru
zV_r@txE614mM&f6w79J1xB$$kPq14_wI|7(x8>rD2=(3NW!$3G-_^zEJ=slbHq$hp
z?;Y}>a(1J@c9~h9q$*62wYksh<51cnSS<C98Yvtmg(qKtyAWKZF7aF=YZ>rx!Zc4E
zj0_G4Ff_311LbPZ9XgIkD2S4Zih{c(=)0l9Aa!%hU$+wF^>sM>(p#)QY;`F4Y(?!W
zj#W2agR=*YVc<eHi_l!mdZSJP>L{Seu86IYZ==4p&d9*tU9nK_arIoZq@)R=S@N-k
zbQom1pUA^#FV>uKN^QqyQU_BDw1wtsQ~$3+eiz(A^=WlEa<zrDeHk;{rh=_WJwZc|
z3>60V;uX%4rE48#ht3oo5KAVY0Isa$ZpVQwx!H!oe9~!CMr3)C;9309G=id+U|}m1
zE$_;=DGs;E*AlN`ve{T8L9<3zv=gR3*-)Hh72B8P+pdPw<;I2Mr*LfFJ~(Wy)Kxml
z_*2+FjXC%Cb#rC^w$J_^bVd^nyznN%{vd1ajy-=B<%)~VUQ-U1a<NqCidxGNF**<l
zT<DJu9^4!Cw-dkyp>z|(GNcJ&6G#_i1KNoczv4Ln_KJ1Ey&QoyAJ}HI9naTSTL{qR
zQ}xOQy1BqM^{Rw|dh0Ax(TWw0qPdIhCNoT70l2Y{0=OCSwwb<PVy6VQW7YR%&KpvL
zyiT>&QO=LcY*2^0C!!b}?7?++-_FIX*B*NUE_;zOwZdtEgwh8KMUpTa^t0f0LP}um
z4cDTgVHW#}?Rw;Sc>4!gl`P|8S2b)WBaNs5Y*ZYNh_wt6vm3E+pD!|S;6P;L%n>!(
zv8o411K7v}8SG>VUxl`FWlAd~GJtDhszG)JXfF-WUQ7yMqOJ@11{w0P+tl=dJ_Fzy
z3rHzM`Q$V>XPHY@u5!5M%(3b9Fh+*NPyAZzZN?U`)O@94Z!>z;+#8bpvEn09HJ-rt
zasylz(h-|YNAEciYuiv-UIAIBX!Vk71Pyo4X4HN5ykPoPIEoxFyDfsrTd?ikkKx?G
z6L{!{KR|7X09><i@}`aBPGVV=FqBy*mH;+tav>7x3&e(w9t{s2Ck8v9rU;Ou&=oBZ
zV6%a2tbkNOJV)+!qUnMuOBu`n?WG0ULQ@EZ<ZLs6Z7!fKr1fheLk)%;3|AAWF{-&Z
zfw0AOCfD4#4)?r8R)bA4Mu(t_jPT-*%Tmr$R8s9`NY1dTX%@@^NKPL($T?XpwIHzu
zgPtd*CSq4T-7oZ68kfyyFdgpqprWysC+a$yTToO{0`I^uskJln-SUxJP}x|IS08*F
z;gK-B9uLZ^D@7EMn5u=y3^pM)xTwL3n6*^gS_G5s9*zy4I2j!|(=6U^uX^ltc>uN$
z7Mm>(n<*cg3tZzF0CuuD*^6rDngQDP2WSh)*Xq(9&(-pknmQ;{AUxY(L;5sXHlWQ0
zxQ4WXnbQ1faMT*zi{@LMv*+4PE|V$hg<h~+a#u*mQqF84g~|jnWSH3B*(E~bYUm6)
zbT_xL%wa4Rhu!WJ4A-byUCAGGl;v=~q^6Qh4oS#Gv!@}ZOTET4DVJb%t*H2!St&fm
z;+$%js+_boXh40iQKJn}OF5!C1ERrBPju+$$*A|-87TeL#tZ<PFGY|k2b&JAh2&ym
zS%5Ylz)sdy{Gvg2252uW&`t(y^Re1&`P#`8$#PAS6{?evEuX8U6a+OgmKhjuo0_cV
z61zDOfj%?{DH>$3O-TBT-#gF#3l>c7ta=8SD7rh^u;s(IVa0V<<NN>puVFD;SR93%
zZI!0}4>sTuz><6<fh<qnso#ZCG)r(En?Gw@aS|@ntu{Y<RsL2?Y+NyO5u)Z|aqwb@
z`dYhVLnlv11Lxb+9IPoVMUV?zqdA!CWVB@q$;HMoG3SK$1Y~D`_R<6GM8S5drpI&>
z1l(*a*O(){V90SlHNBv*kYb&)sord_ueaH1YRx(m^x+Y~a)%)ih)|wZ(q$!lbRku%
z>NyQ?mK4ERRt#VNAes*yOQsWO+Ke=9$y+OF*>D+M6bZ$PUh}HZi;`ww_G+*qZYe=j
zFy%;OAQbntwa0ud=VPJ1b|_i|X7xBuHZ_oK=wKp~UipBwP>tC_bqp>#FFOOY?=8??
zEVG?RpKUgFo2^imno207OCcBF<^x`+3(^czQMJ+8)L?NmHdu^qn<*X@pzDD?8szht
zSgxGmyVnagM^k0wv`{;L4yqbw!PDK1wv(q&T3royX&GiMT!6jLzs9|^?y_PoG=1Px
z3sZE_QUkQ9#RRBE%`U`EZban>qJggdxc6*p)Z5%D*z%wXETi2eg)!E2V2$Ph*2zqH
z#ZlPc!o~E-PASOF0PTARwE4g`9e8zF0Jl)JuXJXc4RmvLDdfuI=4uVg2EwWTS9C`u
zU9sNLSZ8!J&azl41<SR<7z+uOI|5xSpq!wj#+Al&sTxlW`kLhn>G+xL7L?c5V8Pl|
zc=v_ZvE`$;;>DjmjNs5P3}*8c39OVBAn|s(rSCAVHz8(niK`PaDs)8#gE3!QN6g#Y
z77q`0ieCw+$4Sb=R`aC=G68C=!1Tam+P0>07-7mmb_QtQTcDi^W}A!Q7BWqiukTi$
z=W3i}PB&YgS5_CGQ8GFz^p4rHjMkb;v(a5{G1zs6SQxsfk3pB17_nRe-ee(7O%D)j
zCABarlKDo4P&c=cr=*VT+|8P*#Dp(Hq5K@IRZgY_2wW3J2VzDiqLM7Y)f0$^dI#dZ
z*7LDIN2g$~9`#oZDd~Yih6%Ez1Y#+#6EE<Z3bZovPkG6hn42x|9(5PY0PXYu+FW3Z
z93Y#@a&?nTDd=-BUHv3;xrJ!p=96pG?rRIn0)xHOV4qcOwAI#_%;l9P0lLO`ltEV?
z^|MmH!geL)n(`IWF(XAR@8A#{1yWW1a!wtLvR38$AaIRQ&Q*YG+-OHkjv*Eq3d90k
zJ#oKauYnGleI8MP(4d|Jh2~fD<yuqQu?k_Z6Df3M8$OuGq*o!s2vZKSGeG<P0Btsa
z%>}mE^0vspXbaU!$miaWkMSA`Og9t)zUj}=7OGh?*vj;_x=OvZs@h~OD>E5gBu5T?
zEXYh(N31sy9R*%0^+=iav&#ikl`B$!HK8{nZm<bp6<3`J(Rcvy=+JQ7-`O1xT<D4g
zyL(k|jip2q@hl;Kww9}W+5?3$*7SU9DvK>7MUeh~U}CLX`8o<N2?)&q?fVC``M@?G
z&`xx!EF1V{%i&Hmy`Y;Q0B5^R1zlYV=$atuTzYGDrOr}bYP43>7z{3#QD-t3bw=ok
z@luK*9)ctouf(D!NP=!U^PSd!ssbs$V|7g=w6uxNfQ0zG#8wkDOh61i5k@=~2*$$$
zgNb050N3u`cyyR1w*2b%rzz~ja{y<)LRI?n6UaSOFwx>xA^F!t8n{lz86g*_UNQih
z0owN$XbVXtOeA-ktN&J?1Ax;f&2shQ>QX>37XTN+fG6@ZjlpZOR(45mc1lLKTd>^<
zy}6{sXmXbt3{IO~GKyc4po@ng#X@|`td|S|Q_eAEP)+@MlK0;`ARWCw`j?ZeT&EN4
z)X1PJQ!0R55F`U)a+HS_ViAug9`Ot$f<1%raDQJSG9nnOOueq*l<!W?!8)@s(QK{-
zG31xo%mu3XM7d>*pX|DrLf3oNx-|o|9}J+K2)iv5bag0voHre4bEOsXX)6@k(NJjd
zEt@Br_TEz$9*H72b*5ssxR&ZHWhFX;-Dwc_4LXZiFF;Bs*dX~>5$GzcHzw{!#4AL(
z*p>vnwDVAw^6ib8*Q=CvI;XO0?UsR5g!{x)Wn!v&6<o!?m^uk2*y%_jGCU-%Bk@pA
zj~w-R6EWWq6hZAo+A&T{AcT)k@VSYLV5`}LxZ^q4>qLhRrWK2w0ov&av=c3qO(dN#
zQP<t{R6;t#&6aA&m2SwE|1C5xoPIyk|5F#PP61!NTW54SV6Zv#=F&28Uoc^dO{ce5
zbvly(V3Sp^w@5k`u91`%BG65+K^ni5qzbD5T18*Z0kaxImec_Zg`LvdlqsJ|fXc5V
zD{odX)Ob7;lM~@kA|46J@nBGn1^tQ0kN{SXM~(#oiI{&_O#^6bUi<7Qu(%YTz~hBz
zy-vi{AXi#oA~J@PHBgk_Pk@~P+UW_j`2bfcfaT_!F3SeAh30kj1s2r`vEC_UicMDl
zsAv1zQij}~)>=lY;YLYkwn-+pTY#@s62L3z%_ecR=nM|0__0}%3`R-Pu@!;DHWE5<
z%UXlFjO&RJS!N?OS&qkL63mt3F~Lj)K@Ix_6ZInz35)v?IS~<{>i5Y}uTM@yDdeXq
zEN${Cp69dV(_qaNzF+Kf^8M{xMXW;GveHcw3+;u?<eY%_6J%$AcKQNsw)j-a!E`ef
z&~$k~H(y$zkYd_oKzB0#&-Hpzp2u_<K5y#cOt&-8VeEi~vN15ws!oO(=X+(<VgjmT
zrJUO8l-iRjr@V*MC_&1?;?e<YBFr&f01y`f+HwKU&j+yCY?!7pJ@CG#31)!yg9Wsc
z1>9^5Hy`LqSpcb!3ABj-a3O#^k>Abr-tuiAxl%1CVBt<C=MLodfy;NBizQynH9pDT
zlMDENzMj{qE^tj7fSry&JH1Vw-p6B<VX?|-tSprYNomi~uJN@0%Nf8$P6<&jCe3iM
zU@T4GXHt&)`8E%!0I-#EY;O6E8S*f&d|;C(fZgVk2+WleohW$5a{#_Pf!kb$iTS|w
z0|l_t@iGIn69Zg13yaEhvgHC-q<~K%0}v(B04!c0_)eA$OBZ=R8@Lt<u*d_n`M@?C
z$YulG)M=$e0U%r`>&^9ep`t9gs{a!ifxQ^kS_rVt0PGCVzGn<K+jFHHV2dn|X9DCz
z8X#u_-E2UoRmt@Qq$MT-+Ec+?a}9`K5<n{z2(rNVq7U)_R4&k!3k=zFS#@j77Z|Va
zDo+qx3)LN%Z1=znz|H{ev;f@n1)mP2z{G|j($fl30pO<nKb8kTbGb_VKlaXO$59vv
zf}Z^UFCTMHE1h!K(>;b=HmZ^$vV?@iN-FI!F-}r-<@yrjs!F!1>&~S6F51H=F(@hW
z*bt_ZQV%hqIupE9r)eQrMEm2y&2c^u6DLbmx?ge{<NtXVW|Dg~#O#Vx8QkiW3S7xL
zvR!qP-J2r4V?)|*_rE$ON3Nt-MEf}5j!7*y#5ZRO(tVfnF-g0#d39G(bP}msb5+U&
zvq7&oX~$V_B8EPBNe+F$Z0B~E>t~PsTTdQCn<+~v1*n&gL9mGSapDc(O&jC<EQT}b
zj-gHEsC3n@xGDRZeQ79y?WWl(g(=G{MCPQ)ZW46{sycO6Wnc@rBHCY{a%W=BlLV(+
zGW{@;r1O~C^;Z+C@=LpwV8dv0w`QxB6~;za-FcpJ7C==FP>&zEBHE7=Z-{T`Sxq+!
zafO&BRVi1Zt@c0rUn|je)2vcktb~-C_p`Z;BKS^ft>lVe5iQa^DJ{&>t}5X7<!kYL
zMcmH5+%iF2(9Yd->!jbRYropAlDAt1Slvggh?Ww=$p<8glsg28Rr34O5Tz<pSFTs2
z+D;jvBQ;mTL+tABq|`Lq1rRN1SLo_Rk$Tnc`i?N2Z91~O>Wi#e=brME7jC<gP$>r>
zTDUOnIv<`K>r>6t9|)+4R28Wr)wsDW9dS7WN;~V6^@tVG!b8NHi<FzD2s^TLO97Qs
zud2~HDR<VUxhdt2L@5OzT6mCnRr#)j?21uIqi$l2Z)`6|Zh7<HiZ~G~qJ>{3-|97H
z63(Vb?@F#$$#zGwo$fqI716?n%eN!kS@O*ddB(%rCO038flvX_B4I&*N+PQ+PaBK!
z#nakCnVZ7t9UxOcw9pnw7~7{I=bt{#yrHcC5G~v$<CRqN1C9$o{}4Rw;*0<QpT>(O
z002O=004*<000mz005!|06??=0Dx!#01zzz0HOr|07MG_fM@{#0MP;fd?SAa7ywWp
VSUM=f!r=e_002ovPDHLkV1hxMcQ60|

literal 0
HcmV?d00001

diff --git a/browser/branding/nightly/content/metro-about-wordmark.png b/browser/branding/nightly/content/metro-about-wordmark.png
new file mode 100644
index 0000000000000000000000000000000000000000..94569858eeede9c42297637af3396b39b13587c9
GIT binary patch
literal 5770
zcmbVQX*`r|-zM82+Ypi%W0z&dGM4N!gRx8)qU_7W#4H#YvSrCy6osKg)|8@d`;vVt
zOWAix*|$g$Ufs{#^S&RR-}B+Ue%J53&gD3c|9XD8;>^*8Y%BsSG&D49C?kX=4GpdM
z$y^D*crp%T3n5QFXURxgGKP4K9N^-MrO|UIx?({nyo(3c66@j~=+lMOq@khn#97&r
zZOu$I+=zI2m){t93Z8VrrlHZ)p^#kMys%`DE7k)?&;oDNHiAJocP+4uiW$U=1jl;f
zjDmczm>{&3TacHVx;t1$8>C6mI1#{O$u1xY-kad3LD2&Lt*db||GljM2K@~oduf6H
z<&>?NIS5Yl#e!7imE_zYP$&onlZPs+z+g~WkRk-Cr~o;6VRBGq4HcM%qAKX02Yh19
z*ZrD?CBonzTPG_muqT;J(oj$c2ndi5P?9J5dMH5E)zyD%C@RXGAmsc431k<F9KlcY
zj{*Yg=jMwek#R%<=(nPaE76~<1wQfgUm@U0W@i5uCiwl6sFRc_P+Uj~P<e;~9{)S8
zztMhVOYHx;@gLECR)Hj}f+g0E=<n-xQjcq*f5<1f`|pN+15dosxa5mFDT<3Xg6QUt
z#}ddWgckVZMBW|eu3-RIhbXG6z?2Y*5SSVis-~!@2Zt*m^k6W36;)NmKN|mutEvZA
zRaR6}hN{94P$*JKPY<fE23LoxK@?S0p-}xlTol2N>_TwE{;`WYvHK5K>A!L{;J#QF
zGSSzHNc8^G0p^}WGSSbINCLqzFp!j)iyMycdqetnf&LXQ0_%&rfps_VCE`JUXIKOG
zA3RW2M?jRI21q4{qVk`}_2K&JFg0a8Boc`L|HF0v|71<!#2JO(?eTxw<<Hhh5B{G1
zyZKKR|Gqw0!pWWSJ-Hl*pKsXE&;YAY2t6yx_^JbIl?{ehXRq6AqhCyBD78OQYAEkB
z*V!|w#V*Ogra&OH<wrbKuer@xY#tLwR;bRsmyvs|b0R?crTvb9LV$77#7gh}u2a~J
zgZ278?XO|I$AQCpFE)N1AFQ6NPloSTy<Yxx!_nIMK}uTM*C^(l#E(msMz%4Vbj`&(
z@7B<~H1&3JHK)Y|bw{ILam~?2O#phBXGDYJNJ91B2$B(5bONGsOCJ(8>D!G3SUn1H
zcHfphJlsSOR?yd1@LdGN=&p{f^?7YcO<7h(yRc?|>l^0iQ4MM?>Zg2klnJ1c`ytok
zluzF$#qLBKH`9H5vmt@PABv3OJKb`v1e_mbb7SitIBnX00a`&4wjI)&=)yQ1;+en6
zB?OyMOiM{7gE}pXA1saKpYAE_UU3SjS?zEzcL<Q$-p%Q0B-t5Fn~Y{|H)iBEEb66I
z=6xO>d`$eXS<BWmnR=fir{XBx3SBH?OSxKfpbl?%6vc#HjPla28gpwr-2)|Hb8<Ok
z0O$6f6W`cpNX%%O9qVK_H~e^zt5ul46mZdEU>M!y4G#tQhl>9qxOOsq-|avB$Zv#u
z_~YaSQNc?9!WKib!>kZ<p<%>>kKvnNlCuZwQ$i`v9H~`_yX3JKiwSv4ahedC5*{2|
z%9xXievx0s=DGOkX=-pLb6978mx^wRb|i_Pty!x%JbZl>VmxtfAdg?KP&+Vu-wkfG
zt03ZCXmqUBwoz{lM)>QC>4S7f?IT73WtA7^bekD?+bX?yQ}W8a^b&}YEdBu!lTW);
zwc%~|_o;hh3^1)+b%QNAcBDu=(UAK{3VV3>Rbc#q8?wAL@Y#VoGFx~)r|vZTLmY-`
zP&MiH$ce>!C1yuI?PFgDz>76df*al0|FeJ_rGtfOoeHR;wzt&}I?Y6bWI|B>ZWj)&
zHp65!j^z?P0`t$Hf*%@NIi%=@{Pi(Ts_C((OGKo*2HSm`B}tx}3{e}F<2GkCbI8I)
z;9M00TeH!`FnAq5(<h$xyn?Oh=$!(=^%a8;#}0#%c8d91Kf5RZH9)g#^VzfLWbh_O
zpV9HlCvD3{91F*M{y8dwvWGM2s5^a04cQ)}y#BWo!p(YJ=Z<fkm2LJAu-KOd8xw*l
z*48GOa>f-Ko(0t->6@|@(`(INwg|iDX){^*Kb7eZ_FevZH+esgan2%2a_d0wOw^FV
zvRO*m?ekd&d2dXLLhxV#pc;?Sapi5zY`VYD93gLA@2f+Fsq=uOuU;X|m+$5wI(m5>
z&?1^GaZ68<h4+j6qBPGhDt5(P*^9qi%g3!<LeXA6haR;N@tW7>`SwbZYMQ$s({j^Z
zFYRuWiprJoxA_KsMDZbqydv(2<}_e)c|DUK$HCGmDURT;*DgX2rzO%FZUc|R+Itg;
zoQ|I@+50w1s}BXW_Re$qNLIW*jo!LqJh9*-HR$g;eCWj49uP4r`okvl7}R0UC*%iV
zQyY%Ea(~A43NL=SZJxs*a?~PP$cHs)<X8i$)Bb?EZ8(q*oeJwQtWA2ts>u)ptZ@Ex
zisA48{f_RFpPBlb4Ox-m`Z|#F*0APx6Nh@<D8M%|WKNeq(o#$Kpor<4t-JZNNz+qk
zHs^3F&t-!2CG+phmiWI^XEj@t17+p|#Yz{?a1@;0OcCgbwA>ZSXHG{=<`iv!r=L|Y
z?9B6@F$9#RY;wcL9^c;hm_^Dgm{csSm6*Qeqc-QyJL3Rjra;h>`8)MdYjVryuDJo<
z2KMAV$H*<m^bBF6dgK~AI->TR12Q;Me8pU#H)XutB*|q*3mPdj`&02G#yLWo2e?l}
zpsPh;$8ykP$6&VlFUM}bT8{DlsK!RXMj@NUr@93HHS^QgxEvoYFBw%0e>DucWAhjk
zXL-&?Tq0QcR?Sf{Zl>+FqVRI7ovAIndOE96C85g?5XQuW5k@Sb^i1W_)*lqym&(y$
z_F(dUSt;yd$(gTb3Lwrh4Ddb#!dPOZLJF2RZ1|*&5A?e+Um{^eUv}h{3KoxaQ`iSq
zec;uubI7^4<C^)I7c}0a;=69!v_x(@JNaK>u_X6XyNA54$+8_El^*--^!7nKt=VK_
zRpBbw0`o@+KU7;E5`M9Pf_|2@>V!{JXCh%-y^%Ti_?=8ozF(ghWe6Lt3|e(Ob?ZlZ
zNgqd%*{o%CMnI=Y8vBJAx}Za8=2W?RN5U^%mF=H2mQO3sryA@(`Tih+Vv{m<otuv=
zidl@4pB&^b#y?FjNq^ea7`M?g+IK&5O!o(54$xfkV~^wZuRYJvxjWQfoM%>ye<r8|
zj!3o6)kH-y*Io$?$iT?lOWjwjRPM`f=xLr!U7X&f5}~G_jWSA>o|Rc0-zL$DkckSL
zYNadSh8H$!MQ(LjaEe;1@{Y=!d)v3~<wsp*pF<0SvR=coEH5G(2815ps@_j|H_$<(
z#(qE?sSzkax`^Wb2!P86Ed)hcL^hJh)jd-x{TeRDt{*BzbBynw8?;GX%Ik9avdtwR
z!{{mq>F2ndT1?ywiaE-8Y6vA{DHnaezI}%A6~CNvoTrS>>2<E#`z(<X#(@3~dL!Q2
z@eH22{+m)ek2|V%Vo)|JX|JMlR`0|sMq*H@YBNCT88AoRVhM1{JNCX@DkCBl?SJzw
z;av6y4r}viwM599m$&rhG&OZ|l`mu1L$AgNbPp+!$ZbLow(UM01(F}}UW?^m&7~(S
zDP^chW=K7HNjZ*@oi?*xhh`&|F3mREcMG-7l<w1`<t*-Z><C?%!BW~=;=jJR+w<2F
zeJ0x;#F=SfVZoYz2QAa*<^4@3rzCYbvUJw*{hA*g^~s{gd6(d<@mB-=4RW`?vwc8p
zw!VhpDi)y0SAD{|!gU=-Ztvh(^Y$VLsOhpLGyFx-xcL`pV0<Z3{mj<t%KT5!V&QcW
z<(mHfkkR%o<0Wz|5{Ai<Jm-Ana&KkS^tTnVm~p|T&`7+9o)x!MiuOc)mN8BeeIIlx
z-Oa?YknYu->9w<|`Cl(EZtaoJ=1bE>>>Al`$u{xJpJN;xuB(0LGM&-7RRGMepL#Ot
z_}tQ%u;lZc$3iP9u(J`pKLZ&`d7w(tzJH(Ts_cigGa*i3_GQy>>>zEnfFrPElc-#&
zQ@%K99iJrhRrV@<f9TY5qXSghdd+U7HIdz#R8x>hP-U;Z@hp8P_Ae!su1EpF2*FgL
z?kQT-^@#Y_)3_^_9T&Hiqa2w`G%NfsQG3k-^>kA1MAVZ|2SfAM2H055&TZ`Fi!@eE
zbV+t-486#ie>J{+HvPvlIs4A)9&YbOLha4!nDnV!@i%5uKBWL~w+Qdy#YwY7KpdoL
zeHo9l$e?K%5qo3Uc1FLkvK^cM^6Bg^*q23|%4Tkr9q@ukcP}jUp6a8AmNOwPCaDIJ
z0ySbN=WUp96BB>cEqPtLd7AN&%P9@b@bfjGZ?72TpKQFrh_^STHpL-Zm77L+n97b{
zbNj`_(M?{IPrf_{31*-1e>Q<@a^B%i^Of{k?p6=4WxE5dyQzwb%6uWR2-?@m`+NxV
zzV42iNe6Vy(ytJBbPvcD92c|(%f=QCZB|;<R(aJ~rnu?6;X<ZcZ`;vR!TV!|MnW8!
z!Xk+zegw0I9KS;RQQ}C`e%52Jc*Y#x*BJ|+<=@?pwbV&Rd;Sv5(de`Zj>#6W(@z^@
zEn5f4*7{!*cYGdY7C4pqc;)oovINdYhBQCS1O6#4!VTX^@IFNoGtS2qtzXv7$Ek0%
z^m5iUyT>P2EPnh|^~E+za>*A?!8VL<%vF(L2hr6a&gr&+Oi`NILmheML)(dH-MV=z
zn|Ddv`Y*lNiya^)wzBy-eV1R=k2tKx{-Wm=9@7S7O+Jv>QjbBXExIif0ixr}0QE0}
z6-g-D6!4I<WfUA&eKD_wn?XVHYI;RxB@O^oE0UC3zD+xmpj@SGv=u;KNiN+ieUV{D
zrOv7<n-!f8j*yq=$N&c16ne_8n|#~yJQ3lwr=2Md6<|noFhpgZ>2K?je9Gf-!9p?m
zVAV@e(g>()YQ9u|J*cRK{O->Bj%BRGds(EFEp0$S!!uKB$${5%6*LyJ`f<)^j(eDK
z58WQ0kW#X%1Pjb1NW}N_rJ>?l9H5_7OV-GVKVbAMFJBEU%fJgN4p9+HykJk3C}won
zR8#0UT0~on<!B(I4@bycG*&E~-%-GM?<(;D38rhDqwkqj@-AE$bfIpRM_g#htqiX&
zuFXov+s4F#)<(i?DSXCVifLmrX5=1;+&6;*c9Fu5B-Su`CLI26hV#Onfs7!;{^)$&
z)c4>>{t@xE$lA$bLaX{XGZdzgm6HLFlzyucL4PYYDfaYu>iAF$2{4D}9La4#J^&@S
zda#BhvPD&}tjk=C1F|KrX@*<%i?UIR>?~GB1%aInej1`E>rv~hlEU)ZQ%t8aK~=uN
zM9%r^xBHnGgtpPiRn?E{s#e)=fpQ#T8^wjHs^X3V=D8^{qCsv9FO7~bvi5%2E}c-V
z*{mLWa{x0;VNY7WDor@|DRJd_O5Yo)q#t8UUhD54NSqbK`@>MABZqc$L*@1DDDn0y
z!k(R5FBf#Lsfo%bzTVXh)<EIR9n<ofo3&ap=)7g(2o8b03f&u_uw1(eu6!Kz0gqsd
zu-5aeKtcDl@Nk{s;P-1>ymzxkJU@(RH2>VRx`e6GeAZ<r!j-wixURV1Do7hK8dpfN
zUyOQ9H)3&bSh{l~+ikOar%|$bLv3j7VR^RHR_jPL=I!*t9xr{d95+X-&eKzbPa)Ku
z8+YgOY_D^xNl)R#kXrzN>FCkiV!%>+f{3N9q;I_hG2Jz5ZLd{YC<%b#A2rjbq+Yk-
zm<v+%JuSx7qkj40M8BSoW)3?}?Y#TfseNfN<4xSEXxs+pl(w>2E14x`<w7{s{0PEs
zQWE)<`M}5p?Nc$y5T&FZ;Vc+xiKH{lyCdjg&H%WpqW1>;<)cHXk2)@|AUUi`TDNZ9
zTV7iP&J-ZAIkf;H_Jj-$^g}`;SYjq_9q8nMVhDwYRJ2mrYJ%m^5`<cp@|jdGlr6s3
zF(lOe1*OMaDHG9aMlKQaiUp29-})w7lkDBO-?64kou2~+oLf8M^%%h2y$_sM4>+@o
z$HvxNSpb$+NplD~bWX_^gN^O`Mj>&)ufo!DMxoA+WHf!^V?XdC500L6+L&NMBf<8>
zhM0<8^F$l28fv%4qfF+qXlG#;`mYsOR%i#gT$1tdQ+PyO+XUlz&I(kRaxe$yO2ysK
zN|sv7QEF%sldks4NAmETlJv%kyz9mkigTVN_~FgB&~qJ(TMkdGI^?D7(awrxu|7H6
zej&6CUs`WyH2M!_^7cFQV%n}=qLnqzGn;!_QQ#}(Zkw}$kWyznD?8m(rsMqcSM-N4
zpT{p07ZqQpV1UcZErq^6XtQ1n!7)V6$;pBEp-IN!&KU%^l{R~(kK%3Q&Fjz@-gN%L
z*;E-IKU_7cOZunhCDE+Oro#&@Q^j9W)s6*wp!pgqHQ5pyEIkz!P|c0d%IzyF$tEQ;
z!I!~F0fR7gnQ%7=o=+VXKifnq*bJj1qw8;x@{wF5mawLS*sT|%?Mw3T>Wj86tHVO0
zff+ZX4p-ZA`fLDIinruj+Tj^i*|>=354Q2741}6W!3&CKkx3XHL~mjKvyE+l$4>6A
zu9E0|jpAPtX}=)*!2{wPH&m0X>SpYxgU4j1uJ;-w6AtO<MpdYx3O;g43^6i3<!323
z`D$riW#|^Rv(?D_q;q?#;A$Z;hHq)6xtNEs^-eI1Yb`Zb=k7lKT+SC18{*XNYG<z*
zU3r`$v=VM4={Lkcwbd`C7z!e;cCsp0<+3<}IMeZ^b0GE@<N&5xuzfzW!Y>MWM37}n
z$hBj&IZ&YE6V#(0GflRNkskhL(dT~do|NGMC3jFE#k(81l?v{(PJXX-qddRX#vK39
zJE<l>xYNQZ`);fyJr}<fUwJ21<Ln5HB<gqs=rbYUgF1k@hsuf7=d)mdaYQb}W>1yQ
zWsw{2cU({9j^$H%ch?&l0^fg6--?w&ayBWrg~de_)gdTZCe^{sIRZ~Vu3I!-c97le
zGIWd$L9aF-Id5Ito>j{qQMrCPD>dQKr7T0<nH+t}NkN*@N{Vye@lZ`{7AV=^8ZlQ)
z+lw}r*2xKsZe1)U9@HT@;LOK&-cD+6)U<j$Ns?2WJNDQekqV9lV607=3jvh}AOp3;
zt!>cMJ;hhYRL@|h?Cl{1E{k|jME2KHU?q^0GuK>6loMAeA6UieRc&W*^8w(}w@*dX
zg%DK?$N;pidLS|QHy&^bWIUDORhRwh3fTY9DV&yu_JXVRU`yQn-+zZuNHn5U-#Oxc
E02&EnSpWb4

literal 0
HcmV?d00001

diff --git a/browser/branding/nightly/content/metro-about.css b/browser/branding/nightly/content/metro-about.css
new file mode 100644
index 000000000000..ae59ca779e3c
--- /dev/null
+++ b/browser/branding/nightly/content/metro-about.css
@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#about-flyoutpanel {
+  background-color: #002147;
+  color: white;
+}
+
+#about-policy-label:hover,
+#about-policy-label:active {
+  background: #0a111c;
+}
+
diff --git a/browser/branding/official/content/jar.mn b/browser/branding/official/content/jar.mn
index ae7a189dcd95..e8e152bdfe11 100644
--- a/browser/branding/official/content/jar.mn
+++ b/browser/branding/official/content/jar.mn
@@ -16,3 +16,8 @@ browser.jar:
   content/branding/identity-icons-brand.png      (identity-icons-brand.png)
   content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
+#ifdef MOZ_METRO
+  content/branding/metro-about.css               (metro-about.css)
+  content/branding/metro-about-footer.png        (metro-about-footer.png)
+  content/branding/metro-about-wordmark.png      (metro-about-wordmark.png)
+#endif
diff --git a/browser/branding/official/content/metro-about-footer.png b/browser/branding/official/content/metro-about-footer.png
new file mode 100644
index 0000000000000000000000000000000000000000..00df16c62c4ed329a008af9fa041bb8ebebf625e
GIT binary patch
literal 72541
zcmaI71AL@S^DZ1a8*QxFa5r`~wrx8T+qR93ZQHhOYhx!H`(&T<f8O)y{pL65ySwV@
ztE;N3d+zB8m6aAjgu{UY0Rcf26BU#P0RdJ2`+|Y`tkIE6aQghfb`Vl^P_Q;~aMrT}
zg76ty>jME|mU_lOd7z%5tL+Go69fdD#8gq$K~+kU-N4$CM(?i-jf<ttr#1)(Cy$Gb
zo`E^g0iX{wHnrj+x@_wr0+<?d5veds(Mj0|08LCq-Ryu0ZqkYdZsrDThD1Ev08SV7
zPXJ4xgC4-e(!$D~-Gz(jA6)j&^51G&BEUZ)4(41$|C^Mmlq^8N+71X{reUNuprfY;
zu&~h3GcmKU&{F{z=;#?}={}z<)bvd3%q;8-tbqS{5PkM$XK2JOFDU#!eSKbW5t%qR
z*s#;mIy*blI5W~%+Zof+v$3)L#b98d{*<7$ceQfRbD_4fC;k^f5NK~;XKLeMYHbDh
zi>Rk>?dZTo^vU#p55dyrKd@Hz|6`_4gVDO^+0fF{(ET0Kzk*Uy|No+vmj98qcaR7E
zAHM&e!1ju+Hb7c=puM%Dox!K$jEMhsWy3CD2h?-0wo|mWw)oeIvL@CJ*7hdWHUI$y
z7QlBYJp)s#zZF0J(U6j27qhZ=(6cfCiV1QNePYm<ni{gRva$*Y|D>a5q-PPLrx#*m
z6BcA;6B1-*r4wcmW)KkkS69&5z|j(D<?yer;s4QP_^-NugTd0~vu8n|ov9PhP}t7e
z67bKU*-if&7gk~6|BClNx`zLq3*CR!rTrvB``5Mq7gzsV^%*~Zi~kAS&x`+rKG5nj
z-t9gEJI7#35d;)-N=%SX(Pj0l13DXD#FgcB{Gy~uOr>Kb5vWm1{Q$)>FbIVJh1MMq
zO;Q+45_1J9`Ym6czmtUbo#zSc^&4zH?{`ozEEp0dg@{P^o<Xfz>ax>&_tlH>59y5*
zF89jHh%=bw8j-`yTKD_23(lMI8y2zv-jz}1#@dAQYjZhQxPOWj5UaHb6&65B-^R~3
zjn8&4%l|FJtMMsWVL>{b__tYOMLe7OZ*wE6$=F|v|0rs}*8krX|I_k6kpC*yCj37j
z|5f~dLH;)`|6%zr<iA}0!}4Fqe+Tg|mzNQ<1mb<(`;T+658^G#fOISU{IV$a{B!Px
z{W|#0spORhuqyheH^@tLD|2r1tub%1+(XUVE}dKa@F(r3rdK@Htl$sri<Y-`jw~1+
zV?q-hDK}MdPc|+c;pnoXNc2B!ceZYpuv}52(rwteLntS9X;62m&dcd;;cjWq2zRcl
zPK&QxVuY!2O<(Uk>j$)-SUboFi;jL8zirWeTulYK%NQQ6bs9}k+Fh<4{v6)2dl}AT
zy<~RZ%zJGZ(=lJ{vNo!0TU~tNc0RZ366-3`k<5dmd47vus8sH#4qTv36=Fb_i<aYI
zhm<kVB)RoyB;rAs3IBG)94mh*B+7A%&$VjV8#BAI^{|4m*zt;OLckGqkT_<V7SNhK
zMUKqrs*k;Qwg2hu^P*NUT}=T`;=A4UPG6`uGq4DBR6$q>iu6oTx@oQNbUVF%sa`ak
z?I&sD7RL9nC0+Xr)L|r#&4+&PnFU?s#}!)h&azv=Z`^ZD3f>Sn<)7j5=_e;a=1^<g
zV(UULxI1H%I`$M^Ij|GtSnT{;8F3lZ-`TKl8@o7~fuJj#@E9!_v~EE8`V4SgI<Qr_
zXZL#4n!Hka4py?;f-V$B$YHK$1+Xjs`7Y@<;S*;C?+~}9_VIsWL&i`;pZ88|eu~(J
zJ(AZBZRgO$jF%~vi&Qp&_k?#r<GR)h8F*IXONjwH`sW4B|A32q@=4o?Di&(hj0*H;
zuN*|DOcnC8GS=#Cs$pvr_Vyd--C6>k+-JOh#%|yGWUd$e9X#x>Ns?xDTHpFKyAyuU
zB*U_GjT6Rbsa}oM!=5Q`qCfLY$QYQQ6;GE}(`ipK_E~iRsuic9H6Jf?e_m$^rTgSJ
zkI3#Mf`{ogp8R*M6P*Gt{JZ>ip?{_x0lYa^^s^AEE^PKBsbpkZC|&m`dUIhrVe{8)
zb*%-zqN+L!5Mu!D9uq`Qn9q`5;SsoY7JV7Gt;~5>3Uj!t?zk$C)tEqRm&&^pkhb6f
z)<gy6s<KpRnGwe2Bg9A5?_vSUfpm96X_NaOi}|mzpG;+Y{Qw;m3ZNAc^Ev)*!`w~5
zpKYILW86QA%uJ_?eRW&0iIqKa-$5p8fryr~j_lE`z8Lu7*_(#kOKU6#GmA1-k7!if
z{6+!aZm)&dZrk6uNLedl4M66W)q5oHJPV)i5_{YH(@60*Rm9UM$mG1kL*UT<1{)&@
zsW-f|)h{P9NZVx47EJ*m0#Vy}!n<pe+V^onE<Vtq)~)qV0C%F(%h6Gfc~$<v5|lH%
zQpHN~2WFdtEHUUF4hn0T&2~g}TLeqc1_L9-9bD^hw4^PX&>0~cy+z(Q=E+Cb{w9Gp
ziw1H9?{B`RQz+8u-_^`D94j5fV+F(yjrO_hE*X0(+JvN`j*L@?4#6of?CbS+medHw
zZ+K5%(x11iy$P9cjeV^txG)jYv9}u{mO*I3skUpoy<IxT=w;%+`dY-RUH~CllTeN>
zvJZ6%qdnrDnWx{o{;@Dmpk?|qt^5ZmSkO(wJ{PzO{;wEN%0moQPc>dcO4mUK6SSO0
z_2Rx!sq*bn=rKreF6iaopsEOfHt7^}$Sem*7Q@RFl*p8aKqw6>?kX&rn?@jwY&ZDE
z9YkvtZmDopnM$$)_6x*aSMdEl^<NXe{4kkCKiwDXt|Z~ySiUe-;{_{cGNSL}547t;
zRh#y?9{EiW0w=H$z=!(aCVlhO6XwSkeku3@jXE}t<-)*Jh$$2m%$0pl>5jr=^I~d~
z?s<`Z&bMBqu<GCg|8k?YaY*rH7%KSIKkX_8je#H!GB^uIcj!S=b4G-PUY4$DiJx;N
zYuxF_-O`+kH%86Uw*hVU)nd|!nJ{=O5M}U+E1$(0HCX1LMK!0>nMLGHL9b&Py)bBH
z@15g(ub-#9ER_8Q+@QfU5?5Yqy@Bm;ckbm){=gO#H0=0-n~~&5VS{J-+UVz-)#OB?
zll(HAxc$Xkoywsz+}ndL`46VMmOqQspG$~{S6jsM<?M2&tlvqwp}dy)GDAihFW3h&
zCRiB|oD@yeCK9<>EtC(CCL%G$P=PWsXV%gbfk`Bh55R~)SpGe71_D42@79<}5(kKW
z*+H==)DLpaa>xc@`9lhcSTC2~v*<@#gl3ixDa`9WVnf}TF9)<P(0cuGH<je0@woy;
zwUc!~Ym2@umGCIxG#;>*sF&Ks|MancYl?@#^JlieV9QJLph1JMIatq2zo$q(+)8ES
zQLDgQaRT30+Irl3p{{;M3KQ6`aD^4X`%RFp-yM70O2pZzh&6#Rsley=V|RQ6j%Eq0
zLl0Ed-)b+}iaaNitk`K;tgqq7V8ZM+53UayVJw5n`tmdX-t%l#=3hUz-MXA;Mq^oU
z6!?yzSF0bC61IRVLDo;FmQBMOL8hOyR0DwBQls#>gpm-Kp!<d}85VCYU@S3FMiMqf
zGeHn`dh8lLzl;)ebi;7VMIW^>h^jEm`Pd&gVhhH96HJe8W#B|Z03g;xzjtXs*GH6z
zY!Kfq=YgkKz>YgSh4w8RS;IJN@%y|W)t5c+8ULXC8?WwuYxc!mDTC*A8mPLY{^y0;
zKUl{;WQlBQefon$ud4xu%2!kd80k9YM+QOfsP5eqJT6%&#unYdfy22CuRc&a)Ek(C
zY6l3K<Dz)EAW{PW-N_L^?gu!Xxa0O>S(oG(v=4It_Vj)yeDXA}ImmMD^6-)kDU67X
zPulF_+$d#$HA(f`T#nhTKG^!hEDeu8Lyy#7Ui_<&^WM>eNBi<P$)@fgr{HD!^~0R7
zRPh!4H~~9FBwwS1>~Mcg553zdQw8WX_1L?(+LI2i%4(jHEkOVB2f_8#9fh({gpT7z
znW#CZ`l^aWoMAJrvPbrnGJ_7uMaaqtxuc%Ya6*KLgU^OXDz9i?IK`O1+iKqck1bK+
zhMerUb<#1f4#wsq@)@yyrOos*i!zw+FEfu-ij&KH`bWwQ#p;nKh?|UlUkVv}gv1w+
zF|8;SY4BuRfUT>JJqV-hECQ3-6c{aosQr^(IPxq6n2pZZ1Znl8>bcL^>id{bydNaz
zWs?v;1m3zdl@|e2*2*fx)}LV5owPso0ojwLw6@wXPNg=Xv*2ACl!QkjDRK0Lo|8^T
z*8CH0r1H_~O$Af7l_{1~hAvgHUrDw{t9864Rf*rDbKv3!Yk7R6trY%Q{jpLdbKh`q
zth?4E24>=VChJiXmW4zYQ{jw{?6SuyXsM?DbdD~W2ud7``EqBYgAq6z<ZPP?v}(p-
zB!W^go=wY4f=!$}gDipJ!ebs)stcgh0n2SxE*T9msZbyk4YT&86NgEH5EO-EYrl#5
z<xS!*0nT3##%@fR)pPO&)4eN_WO~5LUpW}cmHn<l%^_H*!7tVbci&-skG~-HsusWr
z;F%}Y6pL?tTcKv11v@Vj@g|J%(TMc2swdEzEw1j$$&e7sLAd;zS$Krqp%AAZW>mTD
zOB3|%I)k-oXX1EA8GRabDQ~xW;hB)V_WelYBsS}nm9l%~#&!EZAQp>8)T!lLGG@8+
z)B}0@+l}ym=npqHP}w@#FdMmcG)mPHSDaUFL*`nO>%{P0P2Y)rv#t0Zu9Wv#AXfLz
zm65hN9tL^UP26Q8=nGc?O}~@d;MQmRC^J5$Ih(NUV@hLUS@t*ELfeexfjM7@O<S5L
zYV6WeKs1gYHNq7G<LtmTFg!(yFe4Eba<_D5L%eHxuV{|Cga6st2$<9cEndzvKSwG@
zFBM4AEs@1Y%0pM0nmMZO5|7nYt7YDVqc2+JC94JqS{>3i`&Jf?`<3gJ`$3*5<d@vw
zi7udO%?*e?&id&!4KiHbN+`=h_6#`%G*qh2<a~pVcAWE{39KmB%^<dD!P`GEf+@X1
zjcc1C9&*BdCfa78TfC&?0(mAW?kZ>XOUWhzZ(k?DPBOl3Tk~nV&v!X@Mak@F5$o`K
zc_?Z&6$#^Ty1$xMM6#y_+YpAlGdtt_`Z@XRh?4hXBd*qdDo20VHe+agFCaa6Na`#4
zT>J6cJCX<IbjURESm~2=Q&la9>MYR0#XK>}lBtjowOF251P^%N<BNRWMJa1e)*mPC
zL8*K3DrgqB3~H-=D0ckr2O=br7XgrZU+gjNzE3HuMI{i0nA@ZlP1U{-4XJho$bRiK
zN3^YRWxih@rb1H!I(;Q$U{<rGEOOyBix$|+hlTDSx{U$Jh_@ilVO|Pw8{H5jCOmbp
zD?IRh@QB}SJ?~C9jM!=3@0<6flm<3C>mV)htPfU1J5`$(`ipn?L4ndFxmEtcZ2pCP
z%T>)2>x*<v8M4utt*ytfz4H;6`SQ=+(N0P^z!Rw^acLaYeS>vFs7QiJ*{|fdgxM_=
zEH4Qe)PJ8KKB1~$0q#!K`qB^_qgi0zUdOmnt(R^IfsI;MR6rWR{OtNc4|Sn<T2UlQ
zs@QB;oRRJZuSc_8fadzlrx`rceG|G9av`KaZxqCM9B+GcK3E<!#!9&a{R@O$`J!3h
zI5_Yn6>&NH-1Jyyr$pVA&c3suN3z)dJ9%N%7FRUk#o6x(%!=-k)1dj5^;$c@J4)&O
zW}`K#&bw_+f)uHF#{_k&1olH=<!sL>3AUWEq$p;}OMG)d%sCn_@YZ*=zu!XBOs9yT
z9$7nnWx41!h99?78dZs%)GyCBTNiYCmjmm3Fpm=?OkvJVr-=o>a^7%HgPf}EzG&7b
zho6ilCpV@_;L9^CHsfG#Ddq4|NR;P3AhRh`Am6bW*KkV#z83=8+hK&hbqU=q-%LOl
zJz}>6h`~&PgR5YWd<$n*-ecfdj8CAVFg?w_b1~v|_)vf9_N7Bwu5`H87Zynpt}ORp
zQy3!CF`tH6=a}nT`>@B<b~|8bKf0Bh|E-8PK_(TGluj2E9)&v)eeVQgb7-?x$x;}y
z|Ao1<cu~J-W7J*GZ)}hG8Yq#LK*&^fhLm%&llZxT%{nF%Fy4{?-@jwL5vzA@jkID_
zQnx6*Rn^-A+o@N*FkXSvY-aFW6o>M|vLGq|i$@;x4d}tT0DjZmMBSvRO_}*>0ADRn
zY~i>7;gjP=MjkRAt!NrY=3O@LPwl=h{RjP9?hD`)k~~CnmL{lr)>mp_7z0KeS(*a*
z>1#b(_1V;pE~vU+r6RaXIcXe?Rxr&Hsb`$-t}NV0lw5edtqgdrW`gK;Bqck93iee*
z)S3ju`*kW;v+WDsrrn5LIreF41{17k*>Y=Z&T}5b=$5B0##Xa4ltRF}z#ZI?JSES1
zGMS<!m4r$JbJ@q%tdR$-gUS7-U2_8OOWm?`w(q?&M8woG&w{UEZ3#lgIq7XOmO&D|
zON!k_uN%grov+SUIqqm!)%{v|GMZTKy3Jb7IZQ;5n(9BGj6P&a!ux%p<G|2U+SzPL
zNpYG6$5bK2@=+ah7D`nk$7m`%c)j%d$UkX1Yq++HE#q#-s8kw;kZc%GLLR`bGQjI%
z5||+O_iyf7E)zzO<i{QhM?=abtOg3{ai{V;p;_^)L*2y0`+^58>4I$)QTn+``sFC!
zS|CK9=2FpvGzc;W2(=gbaA`H8=78Uv>G?QJW}|}k5_(!^D74+4f71Lk!qVyT#$e?X
zM{s8Oc2D_G^nhMKPj>8eLbi~l!=lO7fl<fGn<Pj3xm)_kt1ulLL_<+{H^VXX=H8N4
zK2I^rTS!C&tx<)n9o$a%(@o2Qz>AzxRgP2}*D>3@A4a;u6ij5Vpf4PsP$>}s8H9&h
z@HJ(>T=qF%uknw7gQlb(pVk)54@_TZzXf|@ojymG623%SF`pV)b}U(M`Z2X`&V%#A
zsEIstK7NfPfu)<AeQXEloWb=Wpz$M|*0#rb<=j)TSfd1*hKTZXf~35k)tBwSc}0#^
zh?vx5GxP>_Q4`1Mj5LMLI(n@p@rp1w(1LkgXS}2B2c9N0S`OnMl^*gL(mhOC;3qRM
zcl37#tW*^{3C6U2Kn>K_2d=rt%|<m+4#YX;QbogGY7uI!-m4o9H;<xslm?NHGA4aI
zv@!K#%3$Ycvx&$)o<yk`Zj5hlc|+IkB=7CfAm>sF{kqQh$x8(WsNl7WSNmfSG$4F!
z4o}>*z69pJDT$})!d=y-Uvdy>F)W%<xC4XjYOXutUc^&=oDxOIn2^hLrejr_#e9V!
z0So7iSdrBzOr~a?s-Q;@mJacAqnGxeE6`W12{@&GyP4^BJthV>l}jFsJybQv!pC3$
z5*mWLW>>|e@(MuW^)nF)B^Qa62rbnc-#TdUv9ee>!r2sHaB8Z2YuadGiL=7pSZQ?A
zHlLR*paGZU_L%TGOCjj{=yZWufV1^6<avVuTX$hQHx$Jm7>$MVx-JL0EFQ>tJTJn&
zZtu8;eCd<*&+9dCv_6xV6?bmFzt|^UxH*>97D_v(4fcesmpQw{d?eX;OA0Igvp8UN
zJHpuIR=j18=R2-LuE}YAxyMOX$bqBi8KWc|uZXLMP+Z7j%(vOrJqKLaCT01hd>6Ob
zK?b)62FuK%QtC?UcwG+l75LMHR)}+MQI$b)X$1^%&9O$W@{iwL4v=CUJ*q`LG!Bxv
zB_E=jb7uayj)olUCYiFmm>vVF0-b8ka+iwn;E6;vBz;YJbAjrksj4Zgog@8HB~8f;
zt5Vnml`<i&moq~|NvK&H@_<7;E3(~FsGr+h4h^=W2$=V^BE{9gNWI_20BoJ2)4@DU
zgv`z5hB4Uo)~=P%4b_J5TQvb`cLL3l5_q#x`}>cwt6ME<kK@T7>n&{+$(908zos9g
z?Gj$!o+w4kx2zOXAl6Ph6v&)!#ZNvI{jOx#rteqJLf>|nnX5m<^P3f^(G_Y!wL8yk
zA4?^Ehj{)<v@v%&OY2*g6gjP!1xkQXKWH^mbq6tkJ}}s^RX6DJNeJfTb{vUKHKWcD
z7x9(mL+oM$pfws6W}vW+FG#mAd#S4|zbnrlmxyeZi!*YnDj_KjxJg0q_EY_IEB~sU
zDzIw`0R7ppQ~X6WGT3jpQ7@Bwtla=^A1pj+V0#p~kQ3rLQh_GRKS8M(x|_fR4h5$v
zplC0QpL&@C1ea5oyhNIpqH4b#Le^F5fIZ|bgsn2KtCSd`(ZP~ryYxuA<Zbq5(*u`Y
zYwNV|@aljo?=cUPW(ZqkhVQ}6;Y_|QBmX>fW3X)f+Cpni@$EVI;A$idNf%Qpnb?84
zOsO(zcShUoPZ;T4RWvht&7&@9N<x~{<#Tj_wdrN?>)>;e%m=oER9!9pAV$~Qxit^b
z7sLD12cDcQ%z<WAlCw7o+YpFqGfR$*9i2Ih!k)LStoom6em!AH!YD6IDNmb!MDEA+
zG82Qt1`1c}c)3dtVV!4vBi4V1-lsVN$|LkShk@HFHVNQJ88p)c1)aBD`(&jfAbI-o
zsD^075~8vy1hBENLj{{BrCUYyqfa!TmXX8q13vP~cMH+H)odzngb0S{P*e~Mc^eEE
zuBc`7T{TpUev_8ne*N2%S>L{!kM$xm>^^jZ{cOzA^Ndh*nKATyB7hiMwyH*ao)Zr9
za2t_zs_wyy{K=m|CQvXjdlwrQt56;IK2U=I5(_onFPZ36o8wNBd&(h3nRB_Z(HjIL
zUT#))a~K}xTq!!fWHT+u*LECg^b$inB;YE)D6@oKE&U}&I{P44Mt*X8)ozqGdf9pF
z+{xv9n{vFm#(i_vVmV=NbXls?xpy{sok04Vy(bSl<u${Z*puI|Kj4gklCz_-Q+tE+
zmUV;s#+ek0>rGX0D6P11`S<?T-hsc2ra=QWX&x7tI`eUDS2eNFrU!&<k-<W0AB(Tt
z2Rx2ySA%nHBv-#7nts^mQG!u6j<7p0sH#&OM%zqarfD8H%E(tEi?&(Ho41k2mw9x}
zcS#z=b<)2T`(8OL3JOtfg4R5W^<G1kY{%mlP881BR3+M7fOFfRiaVNcoTXNqLY2~#
zRXFzBm^;*^>+!^0cn@7Z(Z1${)|iHqZD8tofIoCV)@(<-*j>!bBGVrX<ieV$n9ImB
zbsv$QL4JrXV;qBi2}6sJtweb9DK@CqY+W##%<vnz6i4jzhf?l+{7d20VprC{X=WWx
z*K2xEYbh!WB)vv{zt!#nQ|{8rKI~vHh0A~|rEO15-edp7%XJ<XJ_0L6@r>gJZ3mg#
zYsQ!|EmtP@GZg>R8il}dLB%;b=T*|KN~QPtcpz~RnYYDWK<!&Sh-E5gj?P1QNT~gK
za}0RN90&buX9Z8?A)h1&G2?ER*+Zx6*$Pi^{o2@`FOwr64T=Ctdp=2JZ48pI8rjfa
zcAD3Jes`QER;!VQF<Ys;3&95fMJb$iVoi-{sDzo!r`%!@E!ED$stwuuOS68=`yyWI
z8z)&Bskh!Rq-b)6`Oq8HEW-C{r~Ra3HoQjeR%xT*r^TRJAFil$P9IL>U<)Oe)&L@7
zD(H)Mi{G$qlLcdvFp^L-(<Ch760XPibc{<vX&@@2l=Kcvshr*mu~2br>TlETR&lvQ
zVPP;5*Y9Oc$fA`!xZ1qBX{g`JY6O;;Tt&gHEaMpyN1R?qp}a0rPOqNU$gZ-SrSz4b
zw^-N;TQvEk+WFIMu3Hhwxp$uvnml3kO<?0vV36L<m*vc>(qD#`pE~ADFuNjWHFk=?
zO;*r;%)q7goM+2R2tEIiw)RiXNUD3m_h)&zZP8(0&Q$qK1Z^byv~Gq=RE32H88s4M
z>bc!4O0oQKhEl2(ms&C2U)j2SpwqAVOt^NV?p=Y{kG1J?lF8x-a5l~H(1LlTDd@ps
zeng%wmYZONSQWd8db2^rtAb1Fv%`&OR43r#2d;RkQi(t;k1JFbZlo{bVH)C>zD2up
zi6chSgypCRqR+6?fm~T$5Xr+y-Fn|riElivI*6EL?a_WfQIQ6%k#=X~iB-*snKX27
zlmZfkhrjcS`%rTBWkUSkVZYj`y6B%j6K~%SBRfgJ5R`$vpC=DxTIVNrC$5lO1cGOD
zUWG9x?#w$%dE7pGx@_}8=Lvw>->$LiKd0OozfR6gZhZiPoHir#>2teZX1odbR?RwG
zN9N)xJhTJvHZ}MU41Q5~LwVoW5)IS|j^5Ue9Z9wiQMM;(cNcs!<>e9OAd6aNZR@xd
zLbAx}_Vr{GW!FNiuSfXx;|tn?!cFmqGAJAw4%K;zRfJ&)eZ;Yq<C>(hsMLtfPBQIM
zXs2s(%NT2J53uGlw8e)K(0s>La7EOl=qF;+gUms{>xOpT|4`iuh`|o$l<1P+qya;M
zwc`4rOAcaqHwxvDlrnCSHx<ri&HwUJ*eg6|`+(2V&VsIHL~E71FYk_U(Lj}v+tqPi
zGV*qMIhBC;=LU4m;Od@~e48TUrXUZI>Kg{-46B%ebB0=lU-D+W4{pBquTWDngsf&a
zR<Dn~xqcLwUzGQvq_(1fR_BsT^4v5P=4<Gr%As&+t*|Fo{rMaGTO%VIBn_3WXCPtE
z{6SI9YAR^_R}R$WyHGN+P9=9I&7r2Fgd2(BS6J4d3D1u=?VPruA`x^PQLXl{i^Z{Z
z-UDo`8S;Z8f{zF$oc)(Boj+Rr9@(8WvAp;2H|MwW=h2e7PN`T>G7WO!yo}d~x|3JH
zR~-e*^xDBnIzCB^xdh<)D81HR83dj6@hNo_*Wf@Iy;~fH(4al9A6N|~N)14?d$M1%
zAZmuTDAzBuI1gIiU>;4b;E;Jip@lc@Tif=e%OEH9BK=akK=~nXyH1EF*7@7wbN7}C
z>9?1=b$Gr5WWHJZFDO{`>9*5rw5%wW_pdj)8i|a_q1+F3fGWS+?ijuCbs1F}#ayi8
zFjAg{cql1%|4}7=rI$V;DNlO<y;@KkVM<?RC|qW3gRgi&*`>it$1LNw48XJ|2G%G^
z8<*<@@?wON?NXk7vK47D>Q5P^#O>}yWBmo+w$PPL|9tr(_c*=hC^(8d3x`M5b|2@J
zJBK_A%1FHedJDeA5wv@pLBZ}22XfIAQ!ZkhDw=_u1Xpg_sN86&DaWX-Mo*sAK{xA2
z?GoEvyAni&J`2qZ+RS}goADXKZfu`0&PSJ^45}ZE*y&_y4fqKRoUA#%>57gJDVmdG
zmnyE(A}1?$OTvjL{bUfCc5JQf456;{{6k6uqobgB3R}LBcOuobP9Ord8b2cJJ-)WN
zmtEUDnA|1L8WYFckonEnP0S{zsq3?xB|Smns~r@jQ7Q!GhE#j#4REd<_`VYP;plk+
zEdsKrg4m`5vf41H?2+nnsSQ@H#Vr>PUK?Ot&#akAJ@y=9j?s2W99L<AzZ_u^8)+1s
zGBU1#RYawG;m`DojyeCZg&gdOH432BYC=MrlejXjA{dOzacyC@pUW40;IFR~n*Zsa
z83oOH@iY{rzgx@B?bN5eUYi%F$DSD+By!bo_`#fs(Sf+j`avG|{C%UW``)_@)un(k
zDV?k{eX{HomhgwG8En1K`JNS}8~KLo5WM&CNXI^njEacnFj$C=_8zxP`0mjdV_n8R
z5@$2!Mx)W!MaMCQB`UzTd7zd)77UW+3;37rR}V<-Sl+xDsFD%{0m)LO{SOKO!8N;>
zL9!l6LtjZ+#ump$RuD=x)3iC=XjBW!b^juS4-jHo_%-*TZByc<oxL3Q>Rfg)i&Eou
zlw`XHxgThhuttvz?UyrK{j6lP{NVWK9lEvdLY;CWg|Y!EaD&jK+0j}LYftup=$^_y
zrlG5~<pLzjgiT)UPC+hY?7wLU=|Bdb{hYu2CX6E?pd2~bf}k7&Sd~`PRxh!JXWa3<
zh#&q%1wBTVgwxSvaZFceq@J90+6=*CQCt{Zu`z--9}w|F@9`cV?J?dPbn}I>-(pt{
zGU_=b--;tx(f3?!m9fX%JZb()BdL6-OS=hIr^6ghihWSa17geT-Q9+}%-|S_JGh=c
ztR9;4aRy7{oz<FUsoGo8EiB?y1U839k9UmlP;sFC<U?UoLI-fHqWxiCo*4Bl<@_DY
zd=Y(Gd3DZg?Na+OTBwaPp7*{qH1uhIjc_$O$`EHTk5>Y6ag29Qe9Gm$x)P4JQ0BQa
z`ARbenNFQ{r0nXIzhF?@qIfBWfj2)nAwv8&88U$G7xomGl?NB8bLydhs&Yy%(BLC-
zOt>pZ0mpgQN0m=PDhjb7<5qM`-A{&wBH5Z19T-mlH=&Mc$r4~q=t9Bmz3u9f-2toQ
zuu-e!N{JPY$0*iYSFK?r9tTU#8gPd#lml8W3jL)6{uKng3Qz#Ek4a!M<hqTKla`$1
z&5{){D1}4zQPqfSw2hqxabac`!2~b-d3ecAEzZHYprFR0J`_i5?l{FYwcSz8E@fWi
z+`03754L5BUcYgx)e-FSdD-suIzg%*)dEc=7uC*kigbBV2D;4Zj3cYcW!9`5yKHBU
zb*9w945w}2d*{tM&p^BhD*ng2@i!O?4TbIw!qDm`N8JRyd%4wP^!j5JaV%==3d=(>
z{B{_EZuR5g%J%@<o8NWkn96B)XkYa8JlTEEijeS<HC#Wy-M{*yv&@dQ*n|SS`3|&@
z#UY>0)H$KQK6U9usIvFZV~FGfy*h$6Wd*S7&uUraK%s3QA^n*GDm~yq%T01o?yhQU
zrhboJdk?`jK>u=>HtJK=St)^oa1zQ$tc{fl$<FJ-sh`5>dpMXJD!T8&Vx7nod;K9q
zd?7BQMU6t|Uaoc`m~<xrb2t$Li5JpYANj<v-}5wFHwNZ|s8$X$#Y#Kf@p2M!O;=mq
zJ&pN;aF+_2rm10`s*Qyb>pTdkdE7j#N%bdXH1eZvoI|4|Lf_2ni&pBm(tu{c{;VPU
z(wE+?pd&Yr3-=e3T%9QAj#|E~3}(`(Gr1Yhm3QB-fiM=)mu)3kp0hurbXNL5-VVN;
zr6uRPJ0UD--%F=2Nzgl;AHrA+(LI46Mnr>>cM2oSaPuhmoy%ZNb7!i%Hce>fW;`=u
zoLWHfH=6+N+{8}{L!VgxIQ{9O+zo77Q!f!D%t}tzdD`}Ok8yAprlDhlw@_61E#$!F
zOj9vs<fGni7|VD9C=1-D$AZ^1t&94_o2Ww3I?s$b8LdnnGULnHSu_4l+7pk_;<9?x
z@VKx~IKUQ}78{0Te~c`LF`}H~k4w@_Mh8;Xldu5GWDunOE4%M>c|}c#RRMG1yX^q#
zd5=Z~!yIEB>d)SmsN>V^Hu_Ls$cbkNh@z=nz;0qU0ORy&LH(uun&4_{%)FWRNcaG^
zQ!_mkX6}+KGL^<u;DK*lLaCZhybN)_?`*v_AgMTA?E_xX<j*hpUJ_r+vIXX#4XkYQ
z=)}n!-Dt@|xcA<N2fdBjgvUF~1s|uec(w66lP%tOesvSN)%slDEw4o=$VMcTWw;s$
zR_*sM>0;!-y%!yjkd=!LM64H<>UUGD-<C>Pe@f;Fzwg`{r_Fpp8GergR!Dc*PZm&V
z$Wt8fO&zwXpc-gNTy{o2dv10{6)kl&TW^iCj~Jp47p}XY8m5*@VHuPWH!B8Ds_v5h
z7M|3d8(N<x3?+HfFlWy16A&#xYoikaO`&JMMmQ3LP^sj7?iarVfepH8_no-2eB1{T
z4graE1jZG{ozvpJ0|zSdnb~Gw@|O!V8^mKOOscw#=6la?injaObb>NA5{m0GLCdLn
zB9JcN00`kq1=<kssMALPsGk)qlvdj5HI!W*4+&5glW9j&Bd6qhu-!}cV}I7iUAUnu
zhe1?p?8h9A-BembV}(=1wT?$$=w38&i3<*Wf4LEXZ8vWy0W6$N9G%PhMr}0Mt|Mr%
z<+C{$=VnhKQ^NU!#HUVQv7OR(g1Un{+cC$6l(&IXXTD<(frrK9-U_GCI2Nbm4~WTk
z5~nU}_ECd8T6OSCmRbFI9tg0Xx&Hi1D(fp|%^k}62dVE2;_c_DfYtm+nOP&uR9Y9%
zJDG%OoJQio4)ZOQ%_@k8zK!Ge=Yst3B=`&ST1naxmqH{Bq_51?ZYEBLk0V4ol&+Xr
zuDAV|`c5u=&u;x)oXpJLy<E<h4l~+nlVE-Nq}`}(h-RK_P1IfE5irp059`uUIc4$C
z-wWfi4MlS0ujL8dvW=jcJhWrIy2S!$%C^M>nsmL{qYfi9BOfYU$tTM<qnw(2wH0&t
zjCqx5WJvX$Cx{sl8Y^!WM?0dGHJT0H1>5(1c?O9ym?3KMJ2Eh%!igLc_M5-MYt8zJ
z1>MQ8douXK@Ug%je7EsO>s(8Vbn$2OY5|KR7%pu5lE(1$<iV0%tjW0!EkQxQF<cdj
zP_&zw@#oDRj(OErl$){eZ+SDFjR`==I$Gus$TD#_hFY1;>KYcC(Ext#zC;4TrS+8_
zvC|}j-5|DvC`MLKfm?z?r7^4u$>$`iNV5QPe2y@#IsElD104L{h82vogJIBB&}(nV
z>>W7jFTP4eqO7!yQOc|mWo48)%P+?-JRN7h(P%&KSp3OykdL43IE4XU4YlT^5d*T2
za(Vo!y#5{$3>r}RC5B!Ty#D_Ez~<ez!!=!<(8wLe<nlPe@^N(icK!Hay#u^Mns(06
z@)$b_K(;WVVNp!|5NCs1J+U4oxP`iu*kQ!o{Jbl3!7C0aAT<yIsB?D32H&RDHHBE(
zo3)EG_+fOlcKQxlh5hnXx^ydgiRulal%Y&<7Q~FdPD!H64Wcv@R265q{9Bz1eUiRy
z@oLW<wDiE`#;fpI2A*&SS4E!?N9gnU>}5QC;=ZSC_GOOo7aO6Ngz&rI{sVSQy=@5E
zStEOpaIokv9M=VzUZ=eYLf=_!;v>hM2kc>i$*^FtR0}@ZRFvCJ4!MNKZD$7<dWTq3
zy8@YvBeG~0qY1$^P`#m}%qeJmZt<eDn6T3fKR7m^8O+n@I?K%X;>aE+&+*fnfIpP0
zVsy>%hw9RFZX3&fg^w<=ASu_!*F_NwY8HjN6Qm4sPV{%w(GJcATM5-)>Peng<nqT~
zJ__R~+%mWOzZ`h?x6ZL{{8_D0SUXfowCV`!%+&%rM}eq!51kS3<`{oNhe+k2mHb1^
zp)a4=;-uEG2(4yX(J&J0rm#_T$#MP%^Q^Lx=X8^UKo*uy(Jq<9R!%EyAQcXF^@ev0
zhGu?241=i5E5@Mds&v^XA~8_dnbblU*?>4~L_CRF$Gt9*<`jdJk0r(Mr{%3xyZhYd
z?}~j(lzoe^3zkPthCZN(lR?v9@`gT*Wu)N8ZxlUBe&w&yT1}L_q79L_U()?pw;nZ;
z&!Tcs93{7deMQyyc%P5Kz6d@afM6Yy4QUE}aS6|l_b^O_c^6O>@9^n4@aGJ;G6bLE
z@O^=#IXCB)U;zfKL!Qhsq*u1x-iw;kQ=IpUA;dN|{}}N}v9w^ogKlLhiG+|E3j&wO
zGJehL0%GH(ph)^vl<tygq3$(O_{mw5>%{GJG_7Oq%-RRhDP}1>Fum?)q_ejop$=D(
zRBO$$(iB)<ridWrU=%bTcZ!WK4#uRrq6}WP<LI056y7UVn=w|T?g?t@VdgV7SH0=p
zoh>%5MdNzgJ$NW@JpXv^)P}7WftkK|`U5RVmfN><%<TrPwY9quU?#xAwY3uB`d%Mu
z2R^4eCZ%fHq!LYjU*18+4LMiW|0R@^gvMe~9I{Zq0#ps(ZlnX0(r+6E0(>J0R&X#z
zaM&=NV|5yNLr{qtcaQ4NqFoh&^6Z3#{I*|>##NNm2j(e``!8qTZIrmoL|j#cqtvxT
zL$Yz8=?oMtF(ek*TDe1wrxlmiL*Z8c`-MD{AxT^b$7Ik+ND_kS1M%TTcP%Fbq|d1_
zz@B#uieyJS+dgX_ih(~_gyqtB%rnpM+i)0vOdt>2=%GU;<(wsCC3?%MUTeS9x)g(y
z8iVIitJPI}AcvEAgH2(IkJgFC!N^S@86*YMintS{zoB6*wi2R%cA56?{CJ8AQKt)Q
z12ZqIsh<*?nABCN0Ug-K$?^ChX1I>61D%64Kq;vopiSI#fh{?};*4r^gQizZb?8+J
z-={FCSUeu$fVDI?ccHwxG^^~}sK`8H7HM#v3wSsSiEJ)Zrd1@o3$4nWwm-DTo5gJ=
z!tQHV>z;$3Cn;m30_LpI%YaG<m#s+c%;7JIS+JYuCWwoBWH!9!d*B*^a<p76;4&Ac
zRYZ>*jFkb{Z$gu*lK%N>A|#~X)c^@)j9;esAErOpV}GaQEp5xNc!KmLV6e}Ql9Cg;
zwhhTjDi73YY}6lOcl=sQG-71&YS9*>=i7efVC{f?n8b_B5huSHB8@@si!7HXhDTu*
zwLda`IJv<awj;ws&<yXj1s?$r#-%~420S;9NyIS5p!<~<-4(;3Syqgd>QHjY=JPOu
zS_-*-HH=UK&DPvh`7JpXl;j}nq7A)~sbMvCSvJ%vKcLAW$K9YDSvB3sw0y#pPGKi_
zu?Eucx@o4g-3YB-tdzKWh6W4_(q<826Byv^==86AsgcFxX>MY=*=X&Q4krX#dm*Rm
z@IXr)!VAygs2selgea4V*`L}^)|=SOb4WPWPHt-o8yr1tWMci21$eB<;wpX-g{_bF
z=D4~;D)#lpdO<hE{0MiqnBJUDe+eQ}YYI2*Q!^t09}83Zjcxi`tl!tkF%yQ{?0rj8
zExiU}uJ2(o2l&y%oVm;i*Aq8avnbi*=#PorhWM@=$5)QjUX+x7<Z$~=T=BLNp^iTv
zGY+Gv*o9%ubK&1_g4#P>Djb=~#_E^>NJz0;7SEQ9^Z+30qvK<luUM4FO$$H1rEP_r
zK4kgrn2oVBn0U(`D=3C`h!Kt1Zo_)DwAWJ6Ie`jw_W9p*-gl4-`tqFjfGWGVl{;Sk
zvB#%^s8yD!LLD|sqOR-s11waSm3a2@(KHn#yKbG(JHTz9=O#g8DWOc@Ve<4^P{p@)
z+q_<G)sw_7H6*$`e#)fk3{h|JgQ_4|9en{TJcQ}bg!YN4MZLDRt^Rbru`AbM{2^vh
zn8YUM?02#6*)J<IuGLNj-Y<4qT3qv$=W&MQfF;v+21wlP+!ZxygILBY%#Z}r+7__d
z<p7`F<^6T{aHEmgih!6o>Jny#9-;81`M%ie@4W}h_f@29@!dNc$KGz|`_<(*LQlTs
z3i>G9vN19YL&UL$=uyason%jET^&z!0#iK5MN2k}vOd!m363KMqo*nA?p}i$&Z-Hc
z-rQkgge5VPdBEpM-d#Cf)hdqPGpLB^{TDr<#~m(X^dDh0CwO{gu<D{r@sTGfn%x%s
zO9YI7vPk{P%4E>h9WzYA*2BZ=m2*sk0NzE?Te8K(i0I<mu&cTWjQOV%a7{v{j(i58
z+8)5RR`O0*w!<U9XQKP7FHgk{_poW6c8MmYCQ%2wVG|E4nNLDa!w>3xgEZ&vH5LXo
zAE1{y`Py(P+$NiR#G;4qI4mdq(m>yfhRX^h?v?#vWnZ0)M&MkunqQ3(I<ygcvQ^P&
zQ{&QN3(LGPoP|OK+8npL7^XA#*WH%G(fKfi%z*5vm{OC(3nkv+{0QW9&on-=fka1i
zU{>>SrdWM65B%;3iTYL-N*OCsjxc=Mq*d$2!R_1P%9Jd&M&L|*rF$!~OlP2W`(fx6
z1+}jeZ(8efwKz0!hU>MlDYOCddp~u37S%&7b3rRV=w%IvA!Ej3VS@n^uRLDYB@5>)
zCtUR6BH$$DS!X>7rq-hhrgV}2oEV+yR3hUSfqObskjK|rztYNF3J%Q05}q-0T>+Ck
zaY&0|*oZF@I)uye^mQIsGL>5qJX-fEKb=RAY6@#~7}Xes=d<&o>%u_0hhs7-6X3_)
z8#yCC9ixuBbjF6}?fOz?dYp0u7C9=zB<#FW9OeVZ;BiO-KBLmQXk1?Y)7huO!DnC?
zrZL~`h<wc6X9c=?xYn&_YM8W_%2Zh$&hwlByy#6Wu0uF8Rsxco<SB#!H#z5_pdD>5
zV1=b1ge1HH7~dM27LY(7acKA;h^y1$O1>DyYV-S<zFcFm-*qT@H>Ieu*S0K}ehGb<
zex_&LLPCi(F%!ng`_E6(P%lFn_zVZ^OsB-xizhq-=EK^ijEg#S2cGgH;|3$2bT@~H
zl$9@5tHNb%b6H_IZPr2tb{xu<X1N{FPFyA4mg3+g4dw`xnex%OqYFvIt=kd~ByAGe
zZ-i!yTkc(9g6xu>=H{qf187|G)c#5|B9q|0rZLQ4o=o*OB@l7<jjrsbs3Sn=$&_u*
z`ZJc-R0A_mE#@-8mD3)S*nc}8*WqjDh^S>pmy9bRF7|v+8~9^_YEA)N-C2uyYF>M(
z;3@S6qO4d%r<@`}d{Vlf$r&Xr{t_BAjjtAz&qi^YX4)r`kN>ik8)Z<+adiQ_>?=L-
zVxq(+2}p(GMJrPqi6zUHa5z4q2fm^T(_F2$QB5lwsAt{_Uq_|sM0;k~x@De(kRPj)
z@GUNUt;+;YIZd?AM(ZpHN1QcQL-wWU*H1BrD$fPc^nKquZqJs#0+eLaF610y6KPZ|
zC<xOYQ_Iq?G^@&b`KD=pA%pREA1z7=NRjHa%Kw%Ku4aVQBx$`&eARg%@=~ogfE-0?
zlTe`@X>(Spr)f7TZlTT*6uLq~u+CP1P>+7hGFVq1p`<>sehor>w>W1Uol5uKu)fd8
z@(ksBF5sYJk^2H%<`6I)v^ZugBE;Y6HiT|E3zOyA$3xh%MPw;Y;fqt8-ZYr}wo!Ec
zR%b%s$s!!xRYK;*SVY8qm*<jB$%1FfI~IT}((h~GJ@g~k-nlAmy@%&lVUBS`rGLSk
z8#}GPqKbu-TjD_2_`(>*$xU)a>4)Gph2t76{*At7)9c7d%X$@rvg-$xp1mqMes`-0
zZB*%5PpS)H;?SHb>XhD3tCDJ^l8iw)@qSsHf_go1EMjqfR%6t;3GpM*rtf5PC}*L{
z1}d#MNY0DfJNN8omXQW#Vcc_()fOfMmm7~C+rJJvl9T3{7@%mw*_pxXV{KqF7A!OA
zs4?deuY?ce4oG6Op&B4ATc4J$T7qc?MLP<5e4(t&SFqyT1_T`gw@WEE%@Xkgjo2|k
zjTFAQr5R<7w2<AJcH}TZg(;8)wZJ{s=IpPxziKw<$0+Ldq-jKhD#%2t9#1=rQ8rA%
z6OjZYB}l#m2_8Vx<yEzDBJnp{yt4341!W5!kR^tO?VWZ#`Jvf9xt_w^oqn|Lpm-cf
zIPXMRLemNIYMz_&10EKR3su|n5eVIJ^W2R&Vk3rqDvU`FEcNTlWU;*qQbIX|KhBOt
zh6`fK-4nMvbW;27pa*S#@8Lh{xNn8U;tXZtrf8s$^)C-ebE6b>xl>!-(>fr%t*)V1
zdIVSE-TkB=u2~|K<8|*3*mgp)Zn<XMpD+=yd{b91xvrUb1x}!<kg14QfR<tDo_j8%
zDeW^py}I-G9*lc=I8O+v3Ip8u_rImfwLoi7BI$Fcl0liPmV`Y-H!P+J)2P|u49MPx
zEo0^Ct0{;V;_ekIuhv^wqX=XOa*m@cT?#5nn3haVhovSTMQv}s;a*MP8}CxBM^@aq
z|9Vl5F`!%US#wSZyyuo}$u1i}t1uj3J>x>xaeV|sK<i^^u$;!h6_yXr=={zp`jx7z
z20f)*|BI%Sp2&`*o(*qCU`ZHWq52h$PrcB%i*Dr#UfTpH6&OZZi}h1BC0?=-l%!IE
zA6eG&7#gLZa@Tl54vHFT228I6!Y_O-#*|4-eH<6H9^KL7={FokEw10RJZ}Q~hBhl~
zr++f-n{U$*o3H8{9<Nlq0=%E9-03z>^ncC{DU{K1HXEQ4KAo_?-j4+xX(z)^Md+8K
z_s)yNOnSjz9~BJbMVPbwUdmD%AoMx_xxnGTcaHAFlks}=7sLrl@Ku{Tq9FU+56?a5
z1Qet-0Wv=J)}~!fi;go0e;eoH)6e$oE%D@M>>&wUIzDM|)cq9R$mEOwnFld{19m)o
znrhfVeQJX8GMEw^n*<(k@2bAf&1rd@(d@B@qbc74IwZsq;_tNJg{t4obrSjuDPUfk
zI6-&)q-u33sU=tY{`0>-d!kS66kM#4Gg77V=1ka%CUk{Z=Ht7~2^=;%SJXerHbPlW
zY!cdt`-~P=G1Tb%qS!un+HaQ0<tpd6iv|+N&mRL7RXxP^=D+G%J*pZUu(VQ!`^9SY
zeqmAujimdQcNb9VW|dEu>Bd}IbkSD8fMdXcVgF&b_^uWp&j(ZMRhxXav|y-Q!8Gxz
z4@%dC2h@?Cv>>E99EfT04^$#ucuO|oB@}5TTWjE14VE$&wz)0c@xl=L?s1W*<nnBK
zT5Vq&=uVI-8=+yPkt6n2dCtWNJe4me*eXJUb`7E*lQc}WQq+(k(M>R_VMk_j&*zi3
zwn?u|+%0@LuvPJ3XF=O3=5gRzJugl1U@k*%4^oohfX}@_<i8#v|Hl1hFj#YC8}nt7
zy1+lz>0@p3r$tcpqQ&J!3v3My-Mu;zhO4y$m$Es6j{F}<H==Oqy(c&XVJCo3;=A9j
z!xpugK-q;}@w^Wl9<`aPOCJ|V9Tc$1%4h{=hWgk5JSZqsTn1mbT%lHGf)}V}=C-*f
z?tOj{ad$|(yRe&}t&~-zrq+E%$c~n@o|zIt_j82T`$M!Lyo$?>d-L9ZOR%oAPRKE2
zq!HHSjT35;5p>g<|2uhi5?r@m)<p)!<*%9{<zfW@=3v@Gj*#psnW!)$j4sy$$AN3a
zcO=l1z;GWKoF20b0y{OoX`NnTMl(AZ@sM%h*deQgUojjae`beQ?HQ84g*i^b9t%+J
zRBD%PYgKWAAEsA(^eEg0UUG#zyxue{JL@VZ;AfeWx(u$EU-@pO0|4u$sMPyVAUlBY
zAY@v1=8e3()h%T)XfA5v;kd)wbS1R)2OCW9s{yFR2w2VQiY>q9Lp~Cvb97>RU%@-}
z%-5bJJ(H*4p0%dA4v&GgV_}b>-Cn@Z$8iYQDsj=zyzSt!sshq6I2|HnFIAciT)UP`
zGVHp9IKI?w?7n7D-Ipehs-+p$S2({*0~ttVYZ8RA)3-af8vV?tlK>io29pI!Xbj9j
z(YOWeKkX)80i_0KC?U=%@q>F?9#P3J7tPBfzxs~rhl_9|V?Zso>dT;A(~^gb30w-V
zulGie7O+jfEAL0JUxCpB>?%#Md0R*u&$V~@6b)a8o7`UpkOuhNs<+lVUwgw##NiC)
z6y3aPI1S1?sS*!)7xyX?DmC*Is1YXWWmO8o1-FAR{ValR7mEkh-z|+;FW{_N`O`R;
zfP>Fw`KT2VTb3!-dDIed&aKG>yDm#2)&uuk_V8b7Fgf>CU;79(!|EE#mF1!ki4eA0
zO=&xACVo;d%%>jmEmp4@^2{DreaYPU^$^y5EkfV^yw0}Hy3+5=(v^5ow_Je$6rZ~9
z$GhKZ_piPyNfpXh=?Z=S`E1O`{?l%j<WJvVdGv*&kd%m{t5@B+XcCmg9pc%`Xc%1&
z0xLLEZ0e6{JFc4Lg?@q{h9}<Yo?G$9F|$*e6lZUJa0D(+gzC`~9r_`UxE0Z`0UXJh
z%Rqni9vrTk<1bI$cWv`VJWX$?>(z&bcTKmpmekmb1;+WfxCWV`F@Y6E5E*yJMHh49
zAc%qhrs{3$udQ1I0pnk!K`yYnUReW?UCY$7FmOd77dxb%hm?sNaFpgv*v2h_D!OsM
zLDwr2ZL1Bs8g(YE<sVIA3od^@8n-!s&}dz6P}Oo)OHgYONy`oqamMQ=^g2?1Jx|LF
zA|-C{Jv1AmAG_M&X+ik7YSFmPnOYY`bHycmeWl9u8nug9a6&!~;f!fWRYPxgWOOk=
z%N;bmRfi7DAz?b?Jd}*eh<Cqkd711vQP7EyTJi?l7>$u&Z8_y|-Y!1Wk>)X^?x?o@
z;imIy|BT-CIHw)+67uAzk8%c#eM_!Sa>e|9V3uM!RjZnlQa)tHTsOhJ7C)Y3mA*r-
zU#;QG+^<`PcwP`gTcRb3_`d*hK#jk>f!!Y^wb*l#$zf{ZP{&DZw#D?lJ^-Xq2;e4J
zZABDE13*g$?X-q3ZF{<^kRZXKGdhHxOccYprzhswo?(|f7de$<xON-ir6RPYz*V_!
z!#d^Pi7gp!dcaQmx?!uZ<;6|eb&-qe;$dVS3Rt&q@M7LJSt1zyJ?(lGv!e~PnsxfS
zf<$Ifi<kpd#zk1xm*>jg_}Rxzi6iYM$Q|1i+WFdqb!WvqBbgyAj@<c_`;ZlJZ@YUp
z-uLmF4tifnso~dOdN%&g8!yICvx3|2J%G<&GfYeSI0v$RonSi8(_g2jGg{~J+})f<
zvq^*Y>I-`~YsCS4^SGB{ZsjI08Mdx`uPZok=fi025r}GMn`K-23(|J?)6Qs*plL)L
zuD(G6WZ+$33}9)Jfp2PoE43a6=5?uic64;vQConGCu<g)ra@59f*>mjFiv0)0On5t
zD?TmOMqws}K`u|~b8*4<C;Dm&HW=yaaSyle-;BE^HlZGMkP?7&hZ@THJ_Ml9r&Jo=
zm{~gbd3W=GTLiku)$!tiEWlk)z0Pypmk_eNzTUpAJRo>qW*=7|lY4Gh&dWsa#ObFN
zh&fDE1BNa!%r>pT=SJ$79cj>G6LZ52V!SoY%((_#KN^tn(Ctguyu6;2AUqj?n;AwW
zDl)GtuvJOlvsrUwh$hMJZo`MKTAVTevZo%8zyG7>W9z0R`1`A7Fgdvtah!x8E3%tP
z^mZYg`KG5y_0QPCB%pu8g)^v+RB-i^-UwbB(ovK$|G~alOx&>zta$-_Zi$sAWRBF)
z5@?@**6kj)zAo)$-UVrzB>_*mLdgc)f6p>mdQ3Vx-^L1B)f{&!uyiF{&_cG#^d0aA
zDOTYb7C(;X8VhA?XFB(n!Fg>q9~5B6Lo60N*q9LWYmYn`owTZcWqV{OW90#0iGblc
zz=d_n=MEt9dTju@UPPVXqJPz0Aaxe(rVvyuEA+zq`t(=s2L<E-*8R?Kf?$5|fiSsa
zEqF?PMqnb@tpwV(1l(o~ouN9q1j0Q6;gnuWsHekC2s*!<Rt#cf7#JId7;5TD#oU`f
z45L-Axf1pI_+<ic*?pE?t1*1w)3@S#w?4Y4+w1I;*Wu%Teg#&HFT=n77b8~7JdpL0
zGYbv2>CCqw+IJeq?7YNaPH|6Q<#LW+KYurVwDc6*aoS4|_gd;wNQ3k48}Fz4bUF3o
zt<%AA)ZbVF?Gw->z#XQ(+LsHQEMVk<L_Ycen`SJwQU#7ZiJ0v1T9>u%G>ex%a_&tm
zhnHFUe;hQCkvPQX3tdr;%=K%Km6kwue|rgT+H<msU`q)ol3FzbDxT#|^)2*yIUxXC
zh(1sYKo{t9>j=O%$AE)g@R<Nq`^q(lfW2CV%e=5z;VtKx$Q;dtS>7`b<wb!jmN1i#
zWWcd3V-)G4nJJw|nXyY(DXuENQqb~U27f??R9CeBouJQRROcENDR=TgaQ=8EAy^qf
zMhQChZI1e{K7J#nX1j~JZ<j4;;_v?GIe2(t10LQHBaRXSvYu&C*yx|su-a~J7WedN
zd7@}Moqb#zFW#~XKREVzm|VG8S(K%`vhRnxz~{U4yMyF45@?r~K>IkiURxZNPWRqw
zB^@MQNgHCa8LKr~t!1?|!%C(*zEa?X(}~5d(A#EU^4RHUkkokreU|wpOBQ0b3=3vk
z5ew<R(Zbj+WrJJyZNZM&l`3MbLyRl*<>c--``GOuz~!FQz<EFD@;uuu0N+FEA?5W!
ziWeL&<2h*o;cu~^W`A=~T+ZMRb3o5c{V<p)F%7uVcor*nFujdT0v-wbT(1mZ*}SbA
zHcTwH(J;)_XR|)YX1^~c1|3C_n<(l8;P*c?iN7YWU2I#uYzV*e+DmD&J&pF=&Vj7=
zH>-fR?+2f|(fALFP}fD4nNI1o7wpB!$1!~Ov{$O29ckH{+;#x7kM5(*H_<-EEc;kP
z{mmuN{$#W&UE?Kz>sC)>MlUNPq?+OOy86BKbR!&hGNWae(PBN+%H`i)*l@Lw4l4>U
z+b&IQRMo+ltyn-;C<0k~|FeSE3clz@Vzbh5z1OUxSMd#C8IxswZfOMo=1U4Z3pLH&
z3nhcVm5b+%RpOwD4hr490@)%zAt1;L+&5VOp8qTYqaQrKS_WU+)ga3Pi9sk(wa2S~
z7vXni5ox(|*Qi4@8-d$brr&a-*V^*+TxITJEc;DEjS4=0^?ms7>$WX=@T^=~!x?8>
zPE4DYbz(jPS&_m|C?l_CI`bWRc{Vru=hFSi`-D!)ub%fX_HR4`4{o{$aneC+s)fl1
z_JGyKY4f#kS&x8Ul?1y4+Q$<i8;7OSor$FiOcS9&wwD>XQj^<2dL2l=See}D_){6y
z9&O6o<j^d?`aJ0JegK=a!C$Pvm?oD}f*lM{7pVs?1f~mwWy!%mos8ht{hL(|hJ=8Y
z<@HORg`K+aRE|Qx4L}3v(_nq3%RD1h0KT@1K|SYt8hk%50R9|%<=*?&(8YOXunM%;
z%m@bmHD@f-<{|sKjsek()`GRG{_6)ocrIaT@(K)Y^kp>ji)Pbghw}|&+(--AZ-<f*
zVt2k(x<<OU-t*7bW9PoPLoy0f$6rQlbAv3E>w&Du{+2!|-CaoMuGg$q6vgV<0+7JE
z<@31moSnGl)R$v=+0hW~4tC$VL+e@5F}|KA(}n$U3AB%6>&zUMK12XJtN_+Z1g1Oi
zl{uAL+HGs=ISk_~H30W#j4G%Eu#f?aE$l?ViuS?SApz@SLtl2#i6Wx0(%Qz6?&u&H
zs(}-mjk)j~>pgJrvtomLz>zJlivZX9k>-tGq5ydF+Y|<-SR+)?c06Ys<Cz;(roZw&
zqZ|{+CJ)aD7O+@PLzci9TdBZ+w3QB6a9%W%WqFXbcUm4~oo_CESEn0JJlvGD7nx3L
z10G~}V?{>MFlNfwMA)@|7JvK68xIi`hEZAeDqS5{`4L)H>lM~xG1BSp0==D{yH^nC
z4C@*udJNCsx)WQs)^PoaFI7>PJFkD3fVxGSZh%gL?AotT-}uu8v`0+9!q}R_l2m4R
zdY`D-WERe7Ds)yZRcw&}Sc2>3)1jq;#K#@6Ff}~{Rw;^>?`#pf7lWmTJ_+Cu8So(4
zK(gxI{cW86==X5Xv1dB=70bK}O4hI%rU{P~{zR0;{0l#1!CJ-SzFcT-&QrqtrofAX
zvAzYuLi)Andm{SfnL>@nlLx%bn3qB^^SH>2JvK){B(j7rE||epw(SSm&~TQM3yMJ2
zdXcCc3U*S`LEfgGxXL#h6R<|g`yi&5w0~_hKacM0jG91(>oNZO2M^(jOLpU|6IU;u
z*H%`bviz6O+w-?{936K+!UC>@4nBu;_C~}@FY)wQU)Rm_T3HnI4Hw*p-+lN@?EK*=
zs6YB3I#Y9KjxVEkWuAsP%ln$tUq$`xC8K>D+VmcAIQkGzP)j`)n|Km}^ekAl9yswV
zY4~M|;bu`+A~Y&3q<an=^dcC`tOz97A)xlbP&}V?Wf99lpMtwhX|kEzS;x6EH{j^@
zLrA6Tjsp~F&@pKeyybP^l%Mlcbs8=YS+4NB0<6ZF*L7ixLq0QJC_u$ARn7|~1D5w{
zunavga^)lf3zS?0GJ(~o<D3+rQbZU%)*8L6_d%g1n+w4%1X(jdMGaY2K2|yxBWA#w
zO(L8lh(|_Ip+}iNfJt{5rmdY)Qm8f>sw*I-_aw>qn@`-Na@j6^M()w~ZANAMMJ}g-
zGIBt;92YFAgSYOafwkLwe@;H|{1GLgS-Wf&S3Y$wu0Q4y%*_bQ?V6-xAJ(p3nNBO)
zFH>Jq0`23_8l#7$HzX00UIaeCO1Cd57py%7*m5RRLJrOc8M)Y^*<z7HLSeCig553_
zWb-6#p&UTsV6hx|;%7o<lNLjJBF1Pmi|1|okBpshxWv<u0hmxu2sKbEDFntWjzC)Q
zU9<A;Sj-1t@PTqdU(bEE4_JLq2;abEffRfIz#;%xUlwpx5{$;}8x14Jcn4^*3&{n}
z>p~~5LA8Qtbd-RVz;$>SOaW^}<qTHa%7UQABf)wp$Ze|x&@wNAWWJ4Bj9c#BjgNoj
z&P9$!8;&?fpng7m_xbc4I+Y@Gh33p7Z_)pE<bbv~x0>igc=pykSb54gZmVrUZ}$PH
zyr66Ya(Tds4&m|=Xdj1GZ?ePDYsyQ;u~{t*blL*zHvuP{YAYzf<*LmRJZt1!(6H|<
z|N8^DSg>?HB#>P!0ROmJZo&3)eDtQ6s`1pTH*xNPYw?ubSEC&d82~{5gc;z9!GP;W
z6u1hN-g4Ua$>m|~G{>5GfnRJ<x1p*cWWYt=7rJP15Ae~?V6DrR1JjVjs+>In!S7}s
z5Hl~WqN||bm@F0qS-T&*T5xxk4ap6F)%+Gek}TDw$1C-w(Vu15ZH#~Z;vLwvZ*~zk
zi3yifEVhMs`~`@I&M;ZK{Jffx3S3Cr_tC0o!VHSc9Za}KeIG~zCSwVH?YXnKdCl3_
zIoE_vj4T}u^5KklZ3(oGhgjS=EL~kK9k`(LclPM<=*>)NvRUp~Pf{Ah9>t+p|5@h3
z)MxN|ECMe(92i>sdj5CO9ng_uq$f2$&46C@z=v?k<gF^fcr5dmdWln*TRw}xoyh?%
z&&vu3^GtfneU@Lod+ZlEARg2M7c3s`2cA(2`4HS3xH8Y<K$zo?MCKQ3-)G!=%>Z#;
zDqx;80K+ha2g(+#L&F!m$w7E!Zu~$AZggRUfg4-|!40yf1jcc#Muf4dD&xvBIC~Gw
z;h(O${oo*LQ^%?Er2`Wx%U*=2x+aU|wh=JW5SGqDwC?d(t*6oEa<io!fz!8gJomCD
zZkUytvE2WtF&71Q>(i*8T>|Z4Zu67kaP+ELQJHW^3ApPwNswh3z<Lg=q0xga3aJL<
zW3i<O7h`)0KOq*$U>7P0o69S`C^qaF>ADjcyG`Q?hD8g%w*3Rx(0T+d)^rA)$g3RS
z^jn1fqkdsZme+FgA-K+BDFOiYGIM)wR>eIm6js1?3uFxVffU}7K9C4<4AuoB*xUym
z$VbRneqN8YN&pktehQf^Y<}A8JUJ%o6@qk$#JzLHJ-09I5|;%xNC`oEA#gP7F~0KM
z`>|us%mR`@;<<F0ya&=47LOoa`W&5Ollj(Nrd+(Z1X@1j?T7b)tn)-5u>Iwq1CBjf
zW&}@7shnE=CY7Y=jU~_?=2mU6!_m`<spKj_cJ<K=C!VRR+y-oRa007CBC|sHAiLO&
z7Kyuy1WYl|ugw3Oh5Bx8f1OEFa)#*)UfoI!>$*Gf2iyM-Hn;A@92+tY_q-2qnTmAE
zB!$SZMB%wj<(aN;L<<<N$gxlE^}w~O=snR7*dk=MnT{J4(*!q@hRFP1SzuW6U(a+`
z`&z{FzPr2+yx~gPSU=r<xxjaU3z@74(lPpgoep5O3UH-<OBYp32)Zi6fvI`?>s7ZE
z+<d8C#w&2OhA*%47FhFm#A8n}K<t&}U^4IQjEWeuMR-El!1qSbE6wFgI4(I?GF-W@
zssY=+!SMp>t4g3fj4iGmmYzy&U5>pa%Yl>5*6fw%HQ78;3f9jQ4+4~eFRToRg?w(s
zAp-Cr>jR75hx{GA8NULq{!N{@j`h7Ac-JHE#B-<q8(mRDOWGP$PF(JQDK9Au1YN=V
zlC=bkm-mBXpFM@6*e^a;2&~V)mh&J|%@0_x?3Lw!lzFm20I-G)$37s#_cQiN)mS~&
zH=uFha?wKg-VY+ED;6+W4_NzHv6*ay?^EmNjF1%>WYuJu#*toYHY&L4>U(hCLk9|s
zUume%BF$K>0^2sC(I+EnY}TF#e(4a%(A<aU^|qHfkq_+h7@5;}q9R5s+c@=0ej0%G
zi1DLsPahVq{f@luqf3F)o)W3t9nu3K2*-9nDEh%~5k@Qjv+PhXPhj!xx%sT$gTBc3
z(e<PQwvfbNKJ46FWul#VrtKOzS-BI{(GV@XY2OEMLHBxGHS%2CRojf2XqbQ|rL`Sb
z3|I)3o1=oNjX@p;mu}JXd-JQ{>J06V!KXSmgNcIIn8^J`;T1a1x#Tgcwfa7=*0_~>
zkM-38TZB{~g!g@-08|eGvOHVQaFHFCmI=%;+HyEiL?onvUazYlZF;tik9__Xy!(w8
zXL5l9Rtv5cY&FOV3%=5ojaaQn_RulRWyUedYSU@L-`#{ND+5*=M3?m$%Pc#t4!W{0
zq5km_Xb)5Cwhzm0W}_Irlg^8(4Vgo>;~TzMFaR?^Vuv)C6|M~g+1wrl4!u-B0m!<N
zI4m2Zj2*&$2FMCBdq0;haP1Hqefc6Wn%o7g>+s~{Mr^AegPZDS;D*|1*cUBBM=tr8
zg{!P;giQCB8cTA@l;A+mBP1eLy_-ZTX}7F@B}=qGg(B+(mX;$DV{Gz{i4C&u<vb}w
z|D?f0UTEnD*Q`2kSarcx@I@iOqEL&qU@Lr(%)4(PW3rY}XV)k*d=-N%53`AxoW9Id
z61J6y)pbqj%*Rzkl^Qq=v}V16Z(jERw!h>I9J6*wCKre#1X;syg#$_h#IbZYI~U2+
zH~Vfx-g$(+$NI%CtkwE*LV+>Nwu_*%dhIWP_Hbwzho{>3BQ=Jpk#Ve$A-L9c$Jb^3
zG=HLKxxc`1@CDyz#o+3J^C2-^KRLp|7_QG|MR5=r8zg}wx>#j!4su=?GCEAk1`-I4
zO}Ar9_W`^_d=ahc5Ryt2tin`}s!XN)WAc%}GnG#E)kxJG<FTwlK%Lc;46%12#)A)X
zY~RN4=)MZ(FbpxW1f8*!m>pY(`QeplHOF;S5l{NPIZ!O!upE<R0}PM-;F<$pKLRX&
zLUMq*FpCWtvk$mF$g)EM*-XDRh0FWvp4qbHh7`!8+i|@~6Kh*NpPFgo3*Wd4Z~Ubv
zWuV#zvNjUTN(xp&=z=viBI+Ci-rlBTxOH{~+W!HXC})i=D;K&O$O-w7-GM5m^!>Vk
z`c);+9)`Aj`Hv?Z$eX#>WiO}uX-N>4od>}}-vD+{rfJ=&t<h-E%9TA9)q9~s7zDDu
zr-7<6TaW=KkPVn)K7LtjSsF(rN=L4wx@4O?UjmDvE6b;&rgYE-r$H;)>T`?}z;dbI
z(y<8oTj=8N>QR_S=wK0LU0+4ptN_}l06TYb+;Urrn{Q9i=}6;E4QYKC)60*;ZKwSL
z=7yIe@?)h7fHpfd#fC}d*l7lw0l4|^I}3m4|HlIVVDFlXP(oM?i?#Z=AF>NC(v0=(
zqo2tNaE~}-MI6;V>PODVo(d%)MAbU2VCI!y?H8}U2d{X+W-J-4=uk>{%ocfLSenyu
zIkDQa=;<VVd?s`E;vI<YF0lIg?6W?*6+USD3Bwm0IG6vV1MN>!n#9eO3f@E4uBxw}
zU#_H|%^r$9i3iK=!P~NYW|~DAr275G26+b@7Q<Pd=h-pjK$ZnAr+I_FwvWg`%~a*z
zl*dS9Pa`BrgkDc}hNMf6rgz&BI_((kR*cqsjQLgtvvXC<P*0L7R<Ek#`Oj?P$}5I3
zyrPM=1nl-K)^7VgPPy$9&Lxj65MJvWv6u@UFcsWABVA;ZeS3bs%v-ugK?0aCTFhk`
zgJ<lr-Ui4AODrrED9-~E(dJ+HLM96@qAU-xJj^8KCkMAxF1Sm0E=$bUb*6%t;gMZ4
z`1TFk&G+|%tPn|ok<9*0z#KIY51o{|wdhxMcIsp_!n?`(jALo;?*(tzryfb9@F$wl
z{+Nx%68j(l#t;h1o7iNqo}8Akpo1iEaTD$!ChHY8)H)|Ss4Sb;To=V&55j5-!)+H6
zj_VTd$N|Z;m7HrfD*-q%Rj8Q-Tf>eN8>4X;$uUx6G83@(dzg*_k}OvzdXgDTl?0*P
zGleQo%{xMsJ&`)Gd~H=l;F-t9_|&a6^kkTHZ3N36y%j6=-HQXuPoVGW4m_iMy0{qZ
zcE>!oyg<9nMX&T}us(yeG5`>S)*@%j3N&LsIt-!vmWv|GgKUtLd@z&sYXI4TluEB<
z**W3HFs4{-XI@>~&wc$qJpaP=Dq>3)qbmT}JTrB`n}F5UAgZsWYq>)T?lMD>%4I7O
zna5x$ecv+rd#4A~zERA|6GGh|3#=?RQ<sQ-dkM5ZW@A4Fx2Eg#N|B0-Rh3uEW_?-6
z0j4-OLG%VH4=3tApmnP=XQX0}Ei>05<bp#nh!p{O;EmujXV1k^GM^}ADw`KqOHB>7
z%tTw-ydQFaG9$t9dHSa<Wx7Zw+>dEH<=e&FK<{&<Oof+ITDZqq>Koz|%bOMKZAGZj
z_tbhFj7~m`iRGJh679vX_}s;{tdIq(k}z1nN7B4r8)&e;M(Z}|4?f5|6*3kJk(UaL
z9vc9-AMNIOD<A_|;U_)!Kvv{{HZsZPBa=l<N=&N4Lq!5@3w63?*WbPy*WUav&Odv#
zlLv&)VDoG?V6~|_(5SJACd)ngH66A_;Cg`Wg9d#$fp{!|cbCU%b8J@qpkzTJMg58r
zX#Z#1D!N|pfUnEu>;iUtiUP0`gEAwEkjV~WzJv7IJi|Jur$FJxxx9jd3}T|dAm*q4
zbCX9-r$rVwpvtUB89{=m0av7+e{JL)k=?O$NT@Q!aCt{o-eW3}iDvhnK4`T<|GIGD
z$q^aYR_OyP8z~;0k5y&#R9SM8gC;X)d4}63^@sp;^Wu7#l-=_pKrXPrGE@KN@yiwY
zGQmPDwn!?-v0Up@3lC($5dv%OZ-Ff0j++Tr@{h<+YYFR-Vzo8JYGp>RtG@LR0qqI}
zoWeJT<)s7UKo+JRl+24!U#|^gOo!)+bVkbue43c;F|?~k5xRO=Q0JKeZsB%eDIFY!
zmf+Cc4l2rr6Ca>!wIM4-FZy&&A&Lgq0;YM-?~@hD3wcihagg)`2V=5>j>q?rWhnHU
z%@{8Wt=k9vUZ$PpBcsJ8hN(s-LzA|sXrMD6k3Dc!`X|?=1r*rI))gAdBfDN^)@!$q
zMQ1BW;d%OKz!;6V8`9E<mJ&0Pb+;le1}M#;gdk9mb0Q}r1cok=yY8MrEbpq7&xgTe
z<|3)BR4Sn?QN&__g^gY)0NGsW_CPN13Sc^Y)><`9*>@ZKpxCT&uTT;Zv09nZu0gE!
zdpGaFzP(dev7)9!Dg__RU_G}l1<VF0S$zYYi~R(s(<YX?MQ_j3p9g4Jaw2`-YKWfI
zgMH(eeC(Q3j0<AGY4{0t^ZH3=v=`EKx&lFwJ%lb@1sZ{13nQWL=EVxYnCIB(An9T8
zGD4na8}F{g$_)j<3w?}sfKKaxHr4gg!tY|C6|i6*tfT8fNu8FZo<?Ez!v`HJ&)A-e
ztTq1e((q*Xjtci{53L}eO)@{zgUnd{)ht8~c>5<Lk(U!ZLzH_zB|g|Q5mEB}UZU#T
zOAy1zuu5IXe3vg#<d>U)ZgI3%_?beG_3~jlxd7R=S?vZB?kgo6p=oVo7y?sC!mG;1
zcF+D6uDxw9o`1<&FZ4Fate*~C!$%=JJy-tr+8P4dscac3lg-4#(t8@HZYC_<=7Fm(
zQAm(ID9}nbuPxNCDS`G0K6bjN{tRYt+e!)$d6y&{Qi!TQmKp13oSE@!0qNmjhOWgJ
z#0r8JoNKKwM=aJgtcd9eZNE?nn0iKcwN9ljLV&qtvQ0A}zc*Ing=s@qLIb%gjLgCY
zq%jMDHb|(Inv|BQ&broZrCM$$aBYvQ#r)U?M9K&4;IYfBD4;<MFkr$jj~*J;L|z_{
zp{(=sga-*S;W>Ld5}_6zM0j~D839x7mkKg17@p>ez|d7F7dVjRnLWY+u+-j}_7vg9
z^-IbJtU?U7*HYj0wQF|a`4_LGV@r&&&9crU3&ZuKgv`G-dyQ4bsE?@Jwdx26Xqlkr
ze2QM*sOpf3?!9nRuuBZyT@295c6JH0KW3Zh#fS9yD&sF2j>H8pC2IVn?t!~wLH4bI
zX$<pnC@YXdb!n!4kR6DekHH{T<XONDgHCJxX<1edTmr4s1kxT;IhX_U0~0#h%WS7h
zXY0Q?*V2Kiz7R7F*uBAia3W`f6Wp?Brg8?$Bu;6U(+x>XYr|1U?%qcqO)xvY5j<`Z
z(6$dQz2G3%+PCa`thFCpLx5HhYIE~?CSWWlO=<sBwI_K}i17+yx#}j7`2~C<nbby2
zC4{{Dmk3xaLRlaHTpofjLb<>mdscyhXE}C^aWZ21Sec6Yi&3v|+;rz8_U)O)iWL<-
znIQ8l$Q#3imkU8;K7V?mtu2R`pD__>Eom*Kw~6Ies)*`m(S7!y&WFH#*4!~bd(d`P
zsnI^MEw0Dn_mE?;f@8tNFblFzJ9r|Gu`Xb_H&vGlHAC@O3}OSzm3hem*Z|g>*J+Db
zb74wF8O=ptS<_|Nqbdu*(D<NACZt}Anajs5K{=w=V;PYty%Q8Oru`)*Q&xe8hGoPl
z&!mdf`0*y46y3Qlw*Jm*@T1)w^lrHdNi)XOs?$98sRCmp`qC;C7{9_BfaREO-mn!&
z2=a$?Ocr@CFRiARjZ6NBnVBrXOD+IGxX%(n7#>Dkt-53M4P_q6=41n(y?X362eOXe
z=0Mg~E>^z9OxJ+pO0$(Kk{aQE7kei<xbcS*xb))Xgn4Ngw9p5#dG7=Z#suE+h#Z|N
z0gd{6I<Fb6T0X5NR(mYHb&I)SwN}NX+lt!fLCMxh7!Zhkq_-m{V8N8#SWK@*;#aE>
zXDNd~8Yc7>=#Lo?1zPQ(=L5k|gzxp00%HX%>X2>+QMkNDet(0486HC!8wEskZ&#YS
z{JJa8ZYxyubTLa+8c01tRTox?)#YPHNtCLiBNQ=7gmNO#EY)n^Y3ou#ZR)Lg8dgMd
zTC#i&^-fD*embGo1&({utFhrFFUGEi_9)$MZs{?YU49}MeUVMC81#H;bCan{_uT7V
z7e)rj>W5`P46HBEz^mZP^R>ThcpX<jY^xcBAet4c6t++$_x8uL<l%nB2S3wUR(T=^
zvOKF4!GSP4nc#tDYxga)W~Dr<psT}YBjwI_^$q(B%gjfK>GX-dT+j!yj@8P^d)$V-
z>8LS&z?x8LQa{sZREekH&n<SaY=X|{RWjNqpbh{3?7az)EZ21%cwc7L*6ZJQ;D6u)
zAT}-_L6DRvF5)Ii)W$KX#ac#VO^mDvj~!No>{&E&*byGj*q)h?6f^cX%&^0vyo^LG
zv@8#$p+r$4NQw)%0VMY21OEem>EBCrZJF=RyKl+7@8!#^Y5<M^XS&G3@2;+{uFB=)
zdFP&cZa<a3h=m_R>S?lE2EdjTJ7bz0MPoqA3t)&ar~18^L{Kv1JvbKT`e_%D4+Kx}
z63|^k4T_1)htT?~>kum~b5<sxt}WZpK&xP~gcXTlyVP@JuYDeaHPgXG6(Osctoobd
zT!T9%Dct?v|Cey~2j2&iVjC`9xUAp&^)qi(uiH~VJ8tq#1l!VhMMW){4WrX?MO4>_
z=)LOwVX5f`@&aIR%wbdt(Azc56njh?tXqLRP%C~xS>=@wNDEAUKwuyXX5hD1OtS}r
zw5{8eQL896bg~(I`JrtXT_3?<$pq2(nyj1yvd-=$?Z8DE@HtX%WvYI(VPh2)(@jsQ
zpWg^L`ML=a*PrRyqUS!j4rsvGwSAy{kvFkmG+tN8AIkvG$^xt2eCf*uZCS8x3FmyF
z4y=V}?i33rVIu?RM6lKU0ycq#z_q5$iux6!!Rl4ZJ(#2C(rs|ao_sWpodA)Bu4+A2
zy;5pq0crKzG)1GwCN{SqHPV3)$St0w!~hm#O&GP64yF>OyHi-X^&G68I083*=v{F7
zoo`mZI)N+CJP((id>Y0lUk}6MZ!jR+);7%<WC*I*=0u28KV1XLltw1c3>fzNR+KkW
z3cUC?2;vx7kc<OhWDJ13s~$`Cv{vw^PcWSpBF+L1veIi@@Z|!o+m^O4QC(~$b?+&l
zrIy^spW22`fAI>u_qz{Ssid$>mV>PH-3K+FZEl(vI!hoYySfly=837VlNEhHB)vDN
zW8mv{n-hE9Ty$}rSXTSheW3kMEHHG0{Q1y^S7WjmVV)r<K?6H&DvpV2mFN|w1T<Q@
zFm{6P(N9}4);5h+K<j855k3ZdIHCbsk-7^Hs-?eUpTxpUv5NrLfi9qlG3=!DbD_Pq
zI_aNYSFtu-1k%h^oyfUCXzliyNtkR;AYB^3*`N4+SikFLIQ+WXVCBpS$mK*c;>Z8w
z&*6D-8pe10n635~dpkm~X%k~j>ZYQP7>xi3Os#Gz@&Y6kzSyA1WH2aOk0E5CP-#^d
zWL<DCEdA9qOHIDZYzC9vA!OYybb9@2)P30D71d)y&nz4D&cM9}vTUv!pF)E=d^^#0
zuh}$*`@g&a?|s*rmJ9Td%utVwdTS%Bmb${MI|JpGzKis<X1StstNQw+ZOtXu!x;9E
zCwhKgI(R8>L@cDyd{+kY9?gz;0Zi8F2yrmAEQ=L>eNb#EREdZLFTxHp@e&;dUdTf5
zSz;hNrybV;s%PusmI}*a`v)j73(Iy}w01dZWq~AhfJ<K20@hBg!_m9Wz|yH>&^vkv
zQUz4`cnZ7Ez5tg$_jTBQ@{&&U?;cu*?BFtNJ#h(U!zpwRAAlP^{B}6^Bi{|#>Js!0
ztU`Bn0QqdJh2G-nN8tV^`>^q<pM-uk&~HHOH9vFCa;9`0=sD{OK-68Z&MrBg*n`A2
zZ760ZsnCTnfUPvp+Ru60tldH6Wt}NtpN@7lh)pHs#Ae!wfaP+(9b~JV17N=sfUM;6
znj+p?*D@x|3J9!gB1;PR+P8*KsC|`+!bUJQfh=oW;Q0q7t5x8gkWY7J+y^8d=!==!
zzG47L|IJWr|F-&i+d2*wb{(DD2ili#lga$0Ll5$w6GgQo^$K7R>jsNyu@z`y(C(^R
zM_o4q3zcy)18+>yord!=Vi#y!Xmy1(1j~BB8j}xDR3`ZbPj2~Kbx!ox0lI2cH{LME
zyI%S$_Ssp=w1z7b6YH+^V6ruWv)}z{IQPDLpnv=bh+Yqd&uystRhVv#)jsUO`s?n3
zL*MZR=p8u#JI`H%7e4zStlWMJoP77aaQc1s!TL=%DE2!wY)P@z?azGyvb7Z$j5p!;
z9_+zyZF~pxmJ?ldL$}mkw3Zn7p6hM7q69Hr6zg{M1))sNq5E_ei2K}~;5Qzi7jz6I
zpa}-J$SSns?M*Ys%Q*zp*OTEk^ad;T3g>6bB1WVF44egE3u~<476n-^c!tSedT_0J
zPqUF)p#VJo%m^+#w+m;_DrlJcvOy!TV#E$c&Aw?*dueraVsS-%M7t~^&u#A>5WAmM
zUw$KIer~(nv=6lZX>T_xHv7HEd*s8=_O^a_^rxiw-JGJG9EoO^fv3~W^V3Frx(gN2
z$^nbmEE}{Wde!6urWMmR=_~;(9|PFEV&j`T0#4j|5Z2EegzJ|^uySHu1Je50BXHu4
z=Rv9yCRfXAF)I`+Rm}9znp$4>AW^_osK>_Fc3|V7ry)^5{F=Y@<8b_KuZ2u8)Iu?r
zT%FM5J0(qi__YTCwyr~Wx&^=c<YD+nUpxc30=tf4RumL2_G;qcO>7uz$MuV1`t|Jv
z-u;fbiesQS%m-MW)KzK4{?fgW=yjpdEuX0i3T{JxX~k!;i0pa(_sHZ0_nAsfmi<kP
zN7*rUn`p3?>LMr9g^gAZo7*{j^NAsxy?JGhTp*i4);*UlVnSG(*HycfZ90)yRbYD?
z;O@VHy^SG(<M3^0@p{DoEzT*1bus_>MB<uc?X~>E?bV7Rz3WgNTRtFL5KR({7p@}g
zSBQp{Y6K+rI?cxKzXiV|Y_DBnP40v8b!^^&ItmV+7jWq-64nl+aO-{RuzY+Su3aqP
z$oYeC<hGLvjl0l4yb81Jky`fkY(IMeX_t)XT@A8Qw{{9xI(`5S+;IbR)>qAl8nry1
zk#SvEU{mj5_iNvP^y(!TD;E5#4;+Vo^Ub6BB|C{UO%gPn0pn?FqN%_bQCvbsteNb1
zY<mB@J$A~f$0t*-g_X+#Py<f@2=Wpz_}2qHFS3(QUl5ACPt}5Y8@hvKn;PePYLN|Y
z#Gw7LdR+SN7b75B${rSQ^C=YL>w5Jd(!}V;Il@;S8p8YD-8V~mSNsZtyBmi&vai9!
zGSYxZ1GLspXgiEV?{*NQVy|b&5q0ldad#hRU*_9DoyPwe4<HGh2IX-n8-~m>wj<?y
zBt(`4Fjt#}Ik~p;<bx(B!h#xYEPqzZ2f~l~({+y&YK;yQu1|ddPkvIsx!W>WT^F!@
zWeEM1B{*<y-E@9+6RpE0-LA3zkhYnU#+fVjIn#_+bTY+`d-`8Gxn|o#EjuKn%~2DQ
z0%Lmq_$yz9?v;!1z~({tl`o%xhpr8vpUIM8V>e^KFu!IfLJ&rbgEE=*ClioV03(Rg
zZK$0x>_Lvl^&R7}K&TZ1FaoqbNOA`N_$~rxGb1T@GS=AxDRU+udrpnT1|C_jD976)
zp`MkX9TaM1A&1xO5Jyo;3#lR;4?a555{hZZ<x+uMpcrO5#-#P(lCZCTyk)i6tYp6;
zJFkwFI{>Gj)w=B-fR=nR&+-R%F5cxmY5mwf&_-`5v}TRIH9<Uwk`G(-kENPyz}xkq
z>g2)*o1K@=6=k!y;M(OS=(iEtAD0iHMLKA4EEu+H1~e|I1M}<~6;+r>-J#X#^r3$+
z1F3)s^jxq^0~4`WbRcWLruHz*at*eUG6B@mUugfAG=&zj!KvS;q7r`NtFUuv3qJPr
z8Ti)^ABEv8g{7>hwyD)jz2KESFOM2_0?7&LeI&iU1{aZ}c0vMOY;q5v>+%42!{-p{
zj5P+Zm9~o!;AUgUk;@mHRR?<PJZFIyF%|<^!b5d&9B&(KmL258u4(f>^{nF8n-f@F
zq1~Ocla7OFvrb!rEM@X(FCdM|*-_6?D+aM-mX-Qg9;l1&yVS#fzL&jA9<j3=Xs><g
zHt3$*XS6TFo0LB$3KQ?f6S@LPs<CSdgNXv7);i1bM@5yi&D{xtvsnjL5~5iNl>jIj
zjRo!PxNP22I7YlhQm8j4`1!M*RvTGspMIlavY%Eb$~1?prx@OpK(-5FrdVvJr$GvB
z->fNSDaKP|x)X~StgyBPEC|G?BA%F~<7@`Sg{NTl<P-3Rk1fMTAHN+Qxvp4jDq%o9
zyyZnv{ce`Egaj{)tbt}EjD>>0B&F1<wCV<<rMtSA<fC2Nz#IeD7?{>20*w9}0&F=i
z*lS#%3V%KwLzbo<xW;_5v7(p%x5A4;;Kv<OoZ-Z77ik?4pab94;ssu~lEX6>CvfNO
zsR^MdK{i$xEBK5fJDI_Cl^N?8CBmbm<^{El(^aVaWr{U--=V(zHJyL3hxGsB`^B)A
z|F)b-`5w>8C4=KP0A1IV;H1tnm_G!$1}`i>&$!GW#N5;S<(Cft>b5Mz=A7E_HL<SO
z`V9^igel4Hs3NB;R3uhRq^Is3b>ieR4V0P%O;9n@W!+mVhcm@~4rl-?hCBM_v<x>1
zVAe83p43YhK|K2uJoVgI0qhz0_fH?wGr5*i6E~=H6tqM`Aln5mBJD-gJEEas>HsK)
zL(?AG>p{M=W4yrX>(0`$ALiY}R3X%ABN{CDBW-xVi_?es07vt^EHRO$9_ZCwe<{jh
z&7YP`DhP{S?lH;sIZOL8)i;n1WW5Z9YK+HlR47(Eg*)%+2J%3Qbbv(!WF29!!yhUC
zAaiUsF$Z0Gllt+!fRj%e`9L(<M)>UjXS4f2yN6qgUGl97$}_Id+q82=D(f{|vU9?)
zdHIgv<ODQ<8?Gn4<}4CXnQo6>**$>k9N_e7uaRbi^7o~&@rW4MYTecr#d-k!n*oMj
zQ77}vf~*Ew#rQTZL%O<dXWM`_@yp321;!o74jfV|!etG%Fjm03Jq5YF1D)XpT;H0)
zZ$Eh)e)pO4aAn+qC6X9e^kTVmAjV9RfkcQ+1Zvq8EUY{7Y+-Cv#cXP%f+VRlOq-dI
zW;6ypv58V)5w(fYvi91V_Z2*Etq3aqF~D`uU5tl%J0|^QyYB*5LD^dy1kZ$wHURyS
z4GRZyMLFtRODBm*W1}Bad-NkuP2m0Zc?LYOK{k*EU@>PBg7gX}B2jD7Vplypv_%4*
znWk1u{U1^o{3-puYLkpbbm-LDKBIlHu7f0QSWb)C4}ffFvt1->7Uxt_;;Te+EJ|q4
zdTnqhEF>QQ%xQ4olsr-x!$3=JYRN_6_tb|#E2=^nog=+l6jna27P2FCvMW|gk$*GA
z0F$K^C`LoG?Cte5c%{oL&^dApX2oTgUAbJI=rrpqQ_SW5Ylq;Ue(Pp<cxxH@DY4k1
z{vN5?t*ifT85^@zidsq+-_W9MiJ@aH6X*<<HISOD0SiRL(q&O~$%W&`xgLwYW?B{a
zvCee8T-geEMJW?N6?6ktE`kG6-MU(+Wp#f=SLsoYn1PxsfHj#Q(1fG9t*|QzWQGf@
zE^vAj5x^7AOx6DAFm@`V1u*nR-sBK#%|vVULAhi0r0aLr??7DuI}|i?Og*-t9?pCQ
zfr62ta>uM{Hv7OW?)#2LY?Ds25411h)=Q;)kK1=L43Uv>r%e<*7sXo?@k*BnmfCwR
zWX)&43pX#6Z=$`}<$<qr96+Q~%%OE*Snbl?06U+T>V#Lz%-w6|x<l5d1hwlxOeYE)
zyXt2<FnM;YPL!^`cY0k|Uh2Tp<Ad<)Pu&E6eDSbu=Uqv2yDwbdr!><D$c>P8EXd;A
zjVEA_7gcs(m}tU|X{k+9-3D7IFiSf#-3m)KHR_0RnHyNU@^bbHK{r_7Oz_5pGX~3?
z47M+?9Cco0)Y|+4ic`xi*pd@L%K0E0>cT8R%#5~CuQA!t-C81G!)Wztliz{x?4?5Q
z{{(3ESfIt)5OA#7x*{OU^mdfnepT6YZK$0?@ric>jz4K+hG3b8HRCyIi^8-2dzmfs
zhLb<NcAxt9S4!8xYxjY6FK5a76O^|icbCYT1Xe48m1>)W#c~Kjw?R^WQgn1po4IoV
z>0lxGAS{4|`f}*04cT=h?At4%1;sYX_~_mY(7!5S^soX^nvmE@wJl4~zb>AT3ShdY
z-TdAl$zfRZ;om)R6MX#Qjc{esgF#kkNv;HP+h(Wp5VEdX#Uxb%js1`UU#6poxfVPI
zsoqC-umpKJ1xY}rB?AemdOw|kgnT?U@qrK&xj+QVae%O0mJfn-%W?r6$ovTlf;AZ!
zz?D85l?u#uHx=DjR@=T`Mk4ybHt5gAi&((QZJ}Oow6m$$3;5Cvo5nyR7&3K1y>z*N
zot+u1t=IrzPb%Q<gFF~F%`Z&opH$?fj<!2?)P?&kY8CZKBOiEG-Pk!K`V}cMI5B=|
z^1(yjyYwsjjCO7nBZ<id?-y)*N_lL^h{K?%<rbPXS`Mhlubiwu-Fx05v4^#gnHM1+
zcvT%y|D3U*jV;Bon%e*)7bpjYHs^3~r&`oqAPE69lhv*QDp-+~iv+zQ)%LAUmP23d
zkO#L<!vFc)>)?T%Be0~Nvy@KlPN=R11hAshvtu2wsx<PhEg@c18LV`LM3yk#CbrC(
zSgdA>fHpjZ9_wjoAy<rD7AELh*c^g_{K9l$Vcs~mdj$kKE(h4K2v)MzDvTT0_hI*q
z2DRPmYKN?;_uCIzgJTU6KKMJ<I+^6~<KKT5eDl#GaR2>ZhvgnXI9JG|+M%wOT)v9%
z%yToi>kh1(2N>oagi=8aWXr5co75HCv*bRY*^4W7J0#KNDciRix5z<a|JK{5mvVK)
z0#(KyekB5J0<YW~$p-J_F^FZ-Kh^_eYK3Y!Up8p8X3as=h1&01T7lc1zp#@5McmRB
z2K6J88<<N&N{F`V>ZejB$TGn48(b0Fgvgqpbz|kC@B1);&1nX|_Ut|Iw;y>cd}HST
ztR@q67TD1jItbgcSOVCtNpwOUxyD1t83Pl0yvJV8OTsEcvCVrz>F&%*RTP@>c6tMy
zKhRUmx7#0R2Ham-hEAuWbzbzM4rSSyW!S!NjS=?XMOl51_IHE}?gsOo1Pl8vx1C#p
zkG9Jx4|R~OP7;iOtOnX?4u{s4;Gg~d55cSNz8QwYaaE)%x4ZoeK+XdRPhKEbfMKmz
zTDN8fFq=TO*1g7080k48s^fX4N0LK&gVxRIJU4mBiN05}>k@MpNf#?(c7w>^-suaN
z$nDt=sXNepA7~rFLx%S|L?LhC0|7(u@TMu0s}!vCz*x9ULmq<H;nNiC9e|mD26os2
zkhK76oCDm5b!S0@jbhVe1!jkfve@u5xQm%0q+NCF_s^TJu|V5OY5cM)unS)w9)(|g
z<~{J6S6&4(b%OR`#{8cK$tmkpt;qqCOoNSHmUD1(z*pX}-a@*-9c`px?6r^q7e+wW
zh3A%!%Yp&2@eFIpp}(YK4fS)wZY>6O!i|=(z*Wiw=l~YHt}X|#2p9x-v(HDJYr_qN
zN#kmIaCxry7gzHcq&MP*{Nc|$x23`MpZ`xk3g^!qgWb`Dt+lXx&pMYu?eFKW6ky^K
zEx49r!3&6W4Ph-;7lJN0H@+s61#I>~=S~CQ7|4WDc=yt^pl9CWI~3+F=Zf@Cp3UEu
ztR+DAeV}c6BNUA6-@i*8oZ16l`D76=>~e%Sc%qE3yFE$7qMoA|f^4fs$lurA7Q(IX
z7Xwxc4S)%;i;Sofjfg$0yeOz+e)%4R4i$u_hLv^bq*Gw~>znt&FTe0!cy_u5D`KKM
z`_M5q+G!*YP+CpeEg4#M(gjSC-!0RWj&07lOUc+N%LDKLRWbl~V`NYUfa@k0axiAW
z-1cvDdOgU9*%mB54h*;oiw-5@Enm+v)^b^IpI-tY`x{}{H@9XLGu<{Tcdn{`)qUrR
zVsBS;!BXZ%swu%2m;@$G-G5_iS3i8_<U#mn|M;)K;e#tMnapaSXqG$xm#?u=;F`r2
zQ1?{U3xT1AEyJm97&%}GH+y%PbT9pG?HvWXSB@Z)O+$?_@BxR_(-#UVfi3S#2Q4?L
z4qkpwq<nW6>>bO>D6f8H6?HL&*%%BHND-n*HV`kuPCw6*hI4*z4ui#}zZFVov2pA%
zR!c;qCt&#vsCDXYK7p;g2mj;N`{5&7Z&55ZfgVgN2CHpI>fl!lR#2X-t~ASFxz1)<
zm9uRs0Q8spa_-$<BKxm}oW)9?@m7D20V@Qr#hIxd|AIOUJ?jrN;2QQ?RPulYHQ_)L
z9K)>`ttjOL7TE1Ax24Cvfq}4NjT%(VkT=aXaXK>HUen!xMOMH`b;r%EQ3;5*-+BuE
zm%sZH#`_@sG16K-Pz?AA0j->Q(T8RA6;lX<%Bztl6~mR@<kT!UY5Bo9Q^(D1MzbnO
zf$%{W3<#^$#q7bKTc_W;NgZMzaOdOnc{~jwry+CuK)c{=SxEVMlyP|{dQtV-Y(=A|
z60w0j;ykot7heI*!x7tTMzJ3^$p_eiz)h^SCHEn!$D+^t{cUQtp;YH|b`+q0Lc+#$
z3I6Bt_rd+sn-y&ssl&doCz{n{vz`LxWj!Ld1jE|MYzrikGd2#!)quf9){DW<Im-<|
zm@`;!DGpedDkK9|H_XtjqNESLX|JyUcgg-tmM(+pZ~FjiST6&12pMZQj1lS+aM8E=
zBdfe?iDNRXjU#ujO9ig&oe4~))x?T-z3p!JD}VVNu(h@82h>=0etiq=gbQ|%Na_GQ
zqV6XQ$cIa#^1Vi6prqG)KoV<C)oY5wYB%Je8pEywLaiv&`pO(eZ&!~lxmtR@fkG6;
z-D0m(IsX3yw1QeVtNW`(Ay0cV!O8=^4r<usK)?kFW8?EhHHrimXP~$UgT)1u3~XSv
z0F4<BwIZPmFH9mXF|^!CQ|#X*;D1X$01xCh!U~SqQdjEEALuH8&H4;DIe1mTB|LD&
z`bceeX346ER59P`UTTn1vO<uoFS!Heiwx|c#+<PnE5n($S7@@VR{L=~UEMD0bVjT#
zzbb$&F9K1Sp!!VwF@CY~3TrjiZ<p^g#aO31^?75qjI_Nogwfb96#e2~`$71gcfA&d
zyQA`8a0Rh#>Qv5=)gn+cTg^Nb(1N?bLPRewqx9Im6<x-f(EpdxypmP*lsin}6$QIj
zyPl?fJp9;-{Jm$7k>B?N+|-b7QD>cey}IuMZQ~nJS0Q$Pi;yUgH6<WMMtSpnECO(W
zmI6|%<6w^cifh0xs_56?NWghoGPW>i(Olf(Kq@0zEzgi(&qMY+nG4No&)&2F360eT
z!(#Qxqrg>zEOjtBXMzO)iS?qFj1-T;!WAM$K{$N8?J*9HF+lYhYZEZb+Vi9ZO!}9m
zB~ZRY+8b0zU;(j|2V}))y^9mnLEJG>4!Fkqi~-|h7mOgZrkpGb{!*T#0Gj5oz2nEY
z_WK?92fzFiaOmJN<kMNnMz!-`*Nlr7g0WPf7|gQ@6c2!FJ_)6QIzzW7u>)Ex>hBRu
z4sp_dO`yx#F%b6N=}GvF-#Ja`UEMU5Z_Nv#NVhT5=`P=qyfa(cmkt)vXw`xBmQtT}
zYb6=c8@)<?)w0(rh4TE^n6|kPRh_TD#-#vUl+ebDVz>Ysk6n<Uf%PIZw=}cw`{@im
z`RHx%z_X{+*LDmIbt?2$0JFXYAqJLgpc`M>146y>A6fF(tN9DM4#L-vKA^hdQ1v(~
z0!SZN`FNy?$?}VWEOTtB`63xC*YwxAwTw3y@W-J9vTDd8w~$riXb^qi_F8RqG-c+m
zx7`F@^&J(yLZGGF>63@xum4vcP;7U~4qyqR5yC9zooJ+^-l&%Nht%$0H{-*-&s#63
zAWP~O^!(5c<E2E+)GFaLIXfd(J@;$WtJb+;C7Zo{R*2)2Zb_~;0^1plCfm_7#d`Zd
zJO4IN2kU*V8w}IrBA@acbrdwX4Hm-A7Hv~-*FZ3(U?C^N90uEHGs6Y^VPQQ1MeFh(
zYu}5I^fdgAI)L*O?m2z|MzhRFc3BT(cNL__N)}r(K4N<iv2OteOtD^sLeI8ji%*&b
zOZzpy^T+E<6$1-doH<uO>JfVNA@j*D6x6toPj$ww*JV}vTT*Wm@(H7q48XY;mVtBd
zI5MBDFB9;eN#F7%{d6$RLR~v^%yOpwM?gyjvDocr{_=OjoA139M!S<zqop~Ovl$D;
zp~SP!P1ahaE-VUg$y*y^u^`!yNN{n9J*YAhe4sUZfCA*z(kWSIEys1c;tZBgt0V7c
zrxs*qg}sjj<U4RG?aq$v11&VW0POufQQ%ptCw^JI!-qX@bP#l3(;(-!%=>CU+w;YI
z*H>FnEb8HHD~j#a>eW=xYh$&tr7+e2wt11j@#QVJ<M1VzB*bC|C7Y`>Pak;vB{@Ww
z`d-1x1BQTY23l$T@qppVW~l(m<*n4+Uy>|S>fb^EYreaqb7}M4Ewv2YhGMv>PTWoP
z?{$!qVa0SkmdgrYX%<{GTJ+0s6#(2476#V%4h26jhP}Q>BRjM@z-VUKb!+hoZ&{YY
z-}tLP;5i(oQ&jt&SEFfC#&PRHAa}{}st_8v2zgEh?NaFY4hFBe!&=ESfFHIOEMW<O
zut|JE|LQ~zP9_3>&@frkxJFa$iQUe&VJS(AQ~N;MglUx8Z|-lWa1(tFcawjm_R~!u
z>p&XjI+v&@TL5rA2G^JQ^YZ!@)n)f!^=kLgHn3V~V6`&PU7^lu+av||yhNQ8rw)!F
zPnV)#S=zVCWxMp2=u%o;GjI}cW;)kpfb(4lobkrASPGLN@SN>j_wL1LN2g}V@s5s$
z<Vz&&U!|W9H}rEV@Mflc$(G5yitBl4vBs>+wp@uG!wtQ@5CE`1Prq>@AjB?27{5Si
zpas~tzSDS^zVmIbhM)Y=cfxRYte>Cf<}U2=QWvX|gVs}Pmia;fqYG6pSuEFG?S7|J
zE}>lqJZ91Pj#<`iqMoP0T>7~tW&A?|*TyTIYjV(&>b=cO4!yan@25lE)NtcI&^F;m
zzo+l&fV<Z=CVU1uVjE_7W2i@BM5{$>>q3mLv;m;GWwpr`<*C2e{=0hu-FB<jp0(Nr
z4>&IJSvd&HYLt5oY-IwkI(SJPFnJBc>bhzGzEb)!f{cKww1CS1SxSsZ2J9|_dkFTW
zLjcPrh+?#@ld*JmuB^JkYP0J3sAUI$l+8;(E78+-D_tq6Qs+x4K-RWXShN$Kgitj#
z)V!%d2U*yQj?<w|{E9{=T8(+Lfzi6#U;DZ5gF^?Fb+&`vW`#pI#e4{4bwO)p05cgV
zusv>UUNIKybZLsBq}<uW{Vt1L#DZ<-!o+ZDrtHGVEAl|8VmqS_T-sWNtD>*F*GfiP
z7)G1xkGBuB^KP{D?lM8u$^W6=-Q76DihV_Z$;;S~&4AUIptnc|mi<?>yT{t)gBRPV
zu!vR*fmYj63~SPA8=0*=&u2vfH>_NPrF3F3L`J=?QpPIzkp=)SZy*NTk>`Z>Nc(Qs
zVdl9A++(2?qm>Z`_A}B!J-ZW4&mDo>xn`2KWYzY{JI}(`5xi5()2oBr0|4Lq%loO_
zGzE9y%X$&4WXN_1V>{3yoIZ6FKKT7_g3<0+?@MB|rdgxVOL}t>xL}zak}ge^No!%z
zJ`*Q4Jg|kjyq;$Zh4-4|(>1T@hW?n01CkcEc6+d~(}zt3v@;8|{GRJU#^U5Y&^Fo*
zG@ZIht#8h$3*a-@OFyo*`MWB87UQ-q8L7ZGkjRC*aGOR@32ZNJ?Nv``>F8=~tcblw
zIfvC^OlGJT(%K4RQZd@K&IkqyXx+4nSjE4|n<`tD{9eT!=d=Sx?_u#t)-_@JE5!C>
z;r|^O0<4T!&zRGI>C&FpR-NHAzPr??T~Q3`?^Oh?zrKGM?P11>N+pYp%y23vE|`qp
zGL91J?hX3U=H{^B$aiDK3;5Zec_$oHtTv}nMC?K#vV&Ei4E-x7>ai8YY7f}Qc>A<u
zpi7d#im{&YA&!xeI7rTh^dRYmRZ^dHj8?t>ogPf4DO^{;O_t!CE(Q*0DbaDJqaOEx
zc8*4S2NZhf%11CuQkcnGA*_|u6WMC<oY5(<P-mvFNZ<^#FWYee{S|SKe`BG)jV;|@
z4H*ak@g|1I*D~^)j>y%0#=NjH=wyOu!OPD!h<I5gdd>w5ZD4cn4wIT#b;Op17zNn6
z6as!)78y&6!mqAVCmeten!$3vW`hF1ZI$QDBKRF_^)WR;D6?cSivW=XEo-k*|J~Zz
zWmjjPNt#@PT{w64IK1l}cfxoy*5k*`>(ii3iZPs;<-bevQooz_57$>P%qL9F6p^~=
zGb|_^>to7IlGl=noYk*qn--+dV6{2y!ek;~nD$_#J+x@RRvP)hY-Vxfl?Jr0oIF~C
zMsHR?JH;gZCu*y{38%6b!x_Zr{Jruy)Yq+ZhKtDZSwxn|u|RP2BVk$ea|LALC4cCu
zg;LZn0O2U~+60EkG+UcWSaTqFIm#k7xUt>^$6rfm@D-Xhl;g1NiwflPXGGnm0nUa5
z(Li1S{-l+~qR^TSAwCEN{nzG!E8fK#;~F|fY#hXBXCs~GQ2PC}o>^4Zs^E7q?6#>*
zsP!N7hd*MhiWz^*F-Z|<L@py&y}uppqjjtjgKm~Wx7ZSO{HY&%BmCK)eMx;ewbrtZ
zX`!WQwVKsBz#W6=E-7$aRs?sOjj8eNT?w&ah)v54SgoL_N*V`0P~VQd!-)>X%hw0G
z=(Vff%dT2wtw^j!5z*T>$MO0;&^D^G>Iyd8eXH6Rzpl2_CAGYIvzK+jh=Pa|fH-K1
z1R94jzSzmNVvZ3&)N!R|39HW(YyNw+*N%ZJpDV^M3K|&g3t9`KH|MU&_LZ>l<lqN}
z({gurrr1QDnUpGawL@>97utO!${mFkOe5<UU{F)x&0a?Yi3nC!FvpfMi9ezy*5`~d
ze;gZOLx4pyz4T}ala-22-;&|zoBCK60kN=d2FNu)<?ln*Mv42&5K2~?7*8)hLGp>h
z!%am-B@DL}2I0^@No;Fv$t)GvzU3`v;eGGA4JP9+s%r}kP3)-SH?u%HG0YYzP{;so
zXK59tG$u!4ZDyI?^qoWCCNdzC4}ee31)C72wyj8)6`o(K9SqNJ40M5Rl5}9FNMVr7
z^l@tnp6a=&J|~v<fwuWJ5V<_Aw(Bnxt3432{54PnE2dZhjO&z+0gAxpCF18M$oMk7
zHib1vd8@zB%faa5tTy`IF#_nZA&&7$haR!&r-e?{pI}x2tDTygITlJm9+`woJL|AB
z?Lw9mY`9)Xm8*X^_`1O|BFbuC;_{%uEmFH+=`rY;Nxl*y&R9KSi-C4;m*`Yw-`(JL
zmxTaUgwtvHYle@-KsUmCeby=s+s?Xy8(~N5$JBi=8V(_!?LyY=c<r+uvy`-a7x0rm
zau;;7FIbJWYv&+MEt_R`9I4GJAzjK~wmk`$kh#(ueRpan4LhkKuYWCPc3l0yY}SOW
z>eLBx>6&SG&XW{|>X<z&r?yBb^uI}0f9AnH&^8ytUIj(*xLWsrR==;AyaOfo`HRSb
z?@M7CW0Qtrm4Ig5(ydEc#^O}pii&nM<t6Ni)y^Mg7G<>nwQ)DXN+u$$4$!LGsgeSE
zS)ooK2{d}|cOJh5Zdl!c*B`$G9rf5)rh55Bzx3SpDjXb);Na3&=gofZxwDGVrjT{=
zYH2Qnze7X~Wdpz!4YR{zlvFgrFfOuA3BcDdYf&xpL*`p6OvWr50gH@+arJtFjjKWL
zpbc1UbRt0mzy|Zeyn~tgP-)~%(lJ|Yx@*G1!A!WNu<w}y-mKdX#CqugAB~%T-Rn-m
z<oQET%$`>O<{SegJ&ZN8MI2j(tG<>By!#W7<6J#Ig({b~(4Z-@b@iM{sq0o6uhWJN
zlh&>SeLgOmbJ~W=&||YafoHEQsiU@lLKvXcc0kQ&4MwB`ZS(B!18vhS&tIjs>?ic5
z6>t=DJPj_1UWzCPVnfSnV}-s&Mi2?hHEvqcV;~a*BfVY{xs9>uHdbrdyKZk!P=n)C
z9rKeR!gxoW3TkzmkIA5~V@oyAk}@zzb9khG0v<VZ2Htb-DGdU@@MrIUH!7h0?i-$l
zH=lYAjx7&?c0wi!_}Ig@!|By+c+X9b!?&)iE5OaYP+p8&P5fb#?4pDXSENQ_ySHqJ
zMFM$H2ya|CECj4!@iEj_nMmP{8fUY!qQ4gd&jx_?Bo7SoLy>)}z8`IZ=&kCVE=e-5
zjGH#?WIR)++Ab?>1R5=x%D)Cdb#NuU8`N=iLH%x8vR5M=Obp=CT@RKU=|Wnzv;+C(
zp;AvGHk_m@#@?kFaPG?mnAaa8oK5@Qs)>SaMw1L)*yyR_SbZ+FA9o38(KKSX?bb14
z$FhB(ZN44BO#I)nqXQ+*!3<ZWH<LaBa_rbD>q;Viu87#V?S7U*v+p)Cw6ly)6e7-+
zTlCkG)doxJpyC$SU7Z>rbhoE2es5m}xPA#?>xw!MH&Oct-9Skia*(PeRbsP7Xj1JT
zrRU+_j$RMD>VW;&lefTY4qt)8y<Paz3uoZZo;wYvSBCJmGta=g&prkBoVWxZzU@Ky
z`=9+z_;(N80T)NB&`oCLXzIA$A$-l&K2J1_9ez2agC<u-gP@MF9_mKDmIGw{`5w4>
zdaHjBBDAs97FHXc06}^?#vapFv#YhRVcNpe=}g^+P$q8yvyOSo_?h<X63_yE-oC`h
zFj$}f@sasnPqrNz-B*2`WG_H>c@rkv=PXI0AetjON)zR{`Wu|dI=h&g<e;U4o;kLp
zIWE!^;o43QUbx<cR214*JA{sID=rdKprvEIx2~IOI{QG|$Y_fVwS^zDr`vg1V9ixf
z9dp9FiX%_tf`;k0oE-+schQhvfRR;gTS2Cg)izAwt+O{#$1Y9^h4IT1bG`T|!V8Zh
z>|943V`wLMt7W|b*u(*BYFrq^WFLeR@NdQI^$V?vu{t&r`10kW&`BjMXJd`dFAV$e
z(FgB<k3Di5yz9oN;cwpedHCh;{8RYw@BA=a9rvNPg!Lj*=^bdeGL@%!>?xvTW+Ez(
z?{P)Yc;$1~g%qms-!V`Pfi);t1)wZqlV71pi-pD<0-xPBGg$;a!aM|S8Sy$+uSG@7
zJkJ%Y-O&>gkmt#Q3_x(I0Wcw-Y`SXqj{;Z?vJ@1)Yd{tq$Wj)>wg%#~vjd%e7pB9L
zTBb2g4aj7J8F-d5<iI;KN0aDOU10>YYSs3<A_v!ZGIcylYL!r2Ix|*2OL{u$*zB)~
zYAo44&_-^B{32~-H0yx#dfP)dU{Tlutxg7Nq!62n^ZfYcBgdl{(Fl-x&}u`;a-IVr
z^82Z+;XL;+!o^1rcDKxUnXDs#CTAOPB~TS5xH?wbQEXsW^x!v(S5u4xbisszP~coI
zWtxRLQ8Tq6I~}Q|h=2e1&G6MLN8y*g<Imwkw?72`>zCdNT@2Z&2!I!ud?4!8zFJX{
z%MbzR378xD6aTqv1Y#FFF2V~zqet0ity~u1S}btzixt=~a1MmeX_O5D-8aT!vB`oH
zjv=Q!fCBQ_(46|7bijSB&H*r0yHK&(?ja3=1h78H?y$Q8S=h2HwgYMRDx|Xx<f9e!
z^>HgT%$R4^F<JMwxMr&<teJpoj~SA^E?geKcp_kFV3N!xBGZzXwB)>_t_P%;>;rB4
z?OXaFHca+B22+W>If>rfd$!sZfgC2FaqKs?ND;LnRA?c>y2rKEh_Hx&8`uflx59$v
zCB<Mbd{Y7DChEtsuApO41F&JP24D$XQx3H1zLXa52l=bu2|NHxmNArn07dmdEVXxK
zqZP$+FK#cvfAgug!L0|cK`-OI_Lj#AWDW;*K@<=T<rSq2vOrqTJa#J=Rd4xZ<cM?-
zf~qG6a7n;6C8!N8)ZG-BgwO87*ffNeLRa|Q_;Vb<3O;2PBJP8xVjVhxfLd0iE{4_H
zW?A-tTf$r5OZx|)n7mMdY6-H$U=_H^E%gf5bf*}lbWtt_7PQJzztc-0=^e3B!?XhO
z5^y=l+OGwgE;k0Wbi6$J?5df#j%M{kBSCXFfKvVH@-bqyDS_{7A86Z7hpsIaj;3cY
z$kd3Pk4;|L2yXe{h%k48LR3BwA!>>`Q+u%vgb4d3rHQgn9{;k0=N`dQIv`NZQXgQG
z@_Y7mV%Y3uT!BB$&q5Dor6wnw;h3H*EsN0K3x+)cddU=qlMKFi@dR`Sru$0p<#A*K
zi*mkI2$cSB!W^<{*jw{P6@ZHu%1Ur9e9bhX&kB!4)^$~(s1xRP(4mNFyfF_fMADGj
zMiK{7LCt&Hz=9(n>k4MV0WC3FnFZ~CjM0_=NL_%WvGyP-I_g|hz$$kPqa}bPpjD3{
zY*_a}!p4FpI=Cn8sii)3dP&A;JzLkT2Dr!y5^m8*lN27mIMAyw(~U>2nbdrQ)V%E4
z8R5>Ed>?3=a4jwM>kbxp0wa-#oV_-#=3{a}lLWw*pDj!Ns8);q-`y*LZIm<Z)q$Am
zjyirH{epz;s|Y63nXy<a6QmJ<6;47RZ8j_5)8k`sMfP<u%nZrvYF4HJHtne`zN}Uf
z6KhY9Ru5Ju3I%(s=Oya#MC59TmYD7%5d%e5Y_jYaOYbP#5utTU%=HOG{)$`-U_*PC
zW9+O7j~D_rMrDMORd!bl0FaK;RNQJ}t~iIuMv{L7g0KHJYQ2#hTAuXfzSoIdL(3N9
zt^)^r#(hBY!B_zp6{a>TO}1pR8&;!DEVvprYwi-#mDia<Sg{iTc^+u9u9;z`<q8ue
zXVTE<INlj%@Pq=|G^s+^bK8KT4{3FN9J@`Jmy|Hs2iiFtM%~sh$72}L^U+oO%N}%5
zod_acUy9b8_80==*k{F{16GSz2aZKpE!10MwI16+7^>s<!9Q0=%&ujz4pcMdBuK4H
zz`-{03t_}iA1)5s{zMY8mW+@^A4ocbxH@1J*s4pM0^BM2!pyW&ZM^NPmBtDPnFku9
zU?+2Zi7$dunE%-YggKXj7tErH0k-2QLOaW4T8z;1&1Qit#pI~irJO=rsMWN)3`nh}
zo);IJTX!Q`YY3)|&Vv|O*4V7uCy`FG8t8(_2FQnz_h5jwYK^t>0a>}I%~p)P!WRLp
zmJ77=z%p1V*w>)7+N6K0dTd<D24OcC``UDwv2-sR_)U(3XE%Cq@rrdESP7`0R4+7q
z;lOEtqqindOz1tpcpqpR&z7=)akDJ&U`^+bt*juhOR@8*Nh`%jD}J=GNWemF1B}#s
zS{(>&tQHMh-Bo1ao1a4svROvhAoRbbUCRP$$!4=kDoDJaBTTUa&lW3cM;CV7$_h*5
zrziC*jfUQL+SQC#5C9Y4&UVeFaKGnO5=G;NZEB@$S86bjO&6&$#`$mTYKd-V(Zy!G
zQO=iZo=xxAGffldtNT)De~B>HP!ed84=_G1*&S0+Jr?7CCjeoLbeQoRTq%caASCY$
zlZ<7$4zP)p1xAd`?x^3mZb3FFL6+F8v}~5f0YP$5G0mf<fTlgTA)_rkChNc*Depjo
zzS;g%pndYv05*py^m|e}Cg}Ya_Bf!0*ipr1d#eIwCbN8ZA84Ch2kxu0SYQ&i-eMyL
zT9bUz0KiT{h!nIM2~(uiwicqzSuHa2tB4fS7G$*qkOZy|eMV}qB}ai{t*NzaIR;xY
z*$9hupxaeIdquH|Yq??;RJ_q(DJ!`H87p^%F}vZA)?(d`Vz}za%}1sMQ`-||#7Ad8
zf7rf;bx_1TYb!Bh2kuRn4cR6w5wd~8k=+QE2bL)HTpb`o5{uqpMb&0k>ovxv>TUcv
z(Xk;|YTS)(gr+QnFcchE+@cpXx?`Ct|NAm<98`G*;5@TH7OpM(`?+xi*uocqtpQp4
z{j7j=`K&q~d+KK+@KeI<l!Y?)fOm+w7{+O79#KaweCd%DJ-@8qtJ2k+@IlA?4foLB
zMe`@L{b3(y=Lu>@_(}*Pqqwp3(N;pNhofPGL!_m3Awd-vSiLToQP9?L<}M0!f9f0L
zEC^f$mdSb`o0xb{1F9k-As}Q5XvcX56Jh|w#_Y-gS=+4NJi#>*TaF^e>i|a2eQNlS
zwazd0!lFU=ZsoWQPk-^p75ko;eAiaZMMDKtSgByu1hV845WO`czmT3?(_BNK1(-X?
zEds{qNeFYk#)gK7fW>-$PhV5FjsEFe8+tV(D~3rRN0SufmMMHW?<{Ovc1ypKmW40s
z7?364T185I-R<9G8S4b9@ikQ>qAyc0OIgWsX@nBO&Tb0#Kez@N>9f*~KesCs`a5eU
z0gm00nB8K)d1D`F8_$RGfInJVyJTEulMu=Ug4MHqg3xHs!UmT@=nQ~}j3!#NT2Ws@
zi+R8c22d|Q1MtGrs6ke{3OYW(a(3%=euWyX0$KW(<OY3w6C0x!(+7G0r0mTI!Pop)
z0jz7Z;hsCeS$qsQ7ihf=flx#=ohB@<<weZZ4%nB4$!O3Fzc4l}8w4S=@pzz^Y|p#}
zvO*P8)6(h&QWkjx_@H5SPz$>a3R_qM<R*aii(jS0;Q4tYS}&qLcCus>N&{+{bHEs_
z0%Fm*SFLK+6tVq;1!2p8(Q2@03tm<-F#nn;P2*!-fpqDNdft!~yFwk9YqU0c(LNW^
z1k6*T!ZTNT@YM5tbxuh3v88!6^{eOZOQFA}V;$V>@;=Zu-OBJ-IONT^6TXBcfsX;N
z0w<aP(X)%ru?9qgrDF5Mu)&!i0=;s<!We-j<w-yNO{v*wmc^w4PcC4t19BOp8fdZ7
zYORJl=t#9v?m*$RMea=Vv{h@R;%{9r${nuZ!ye_BU#+|<wt=hg%>*%H^P;0MqD^Vo
zD2!`KfWFFXz>14L)Zn{o0$PaK_Segcj?NB{xmOH~z7cGSUyL(cZ1T~D(gM>}F;Zy5
zhAJ{I@Cn?|7Y`3;OMRBy2G_MrAiCeF2<%7I<4eZ6#q3-3yOI~cEQ{4T?JS3Ma6(<5
zS8NV~%}{_A*Fh;85SupB8>qV`%Mc!ZW(hX75*Q3*d93NrseV3C*S}ldl9Y=K`!QeG
z2inG3MR|rCjE-i3cp<Dhep%fbBe4Not3^ggdDXiqYoN)+P-`-<j)*<ly$CcfJd7|>
z7yn+*0%{h3YzE9}AUsP~39_yTW}6jgg}l}+ps#*5DXixcBS|^6q89osv$2Z^XRH$I
zear%bNe=-%6)_zLBGt-0$^@;`D;f;hIxu@?s^bMk`Q<i+Cxc|^U|AHyiDI|5Ng<lC
z+0?8Mbsk`#H^($sfO>Qy)?yohkG_Ej@UoMJ>`_^IMK>L2jnx~I>{?{WS#VWdfZm|K
zKB|+s4A2VZlV$D#D;c<A7;V1Z(phcOqQowQU@jO2c?TS1%Vvp*eoG`)edVzwo$Fx=
zcu6^Ht(Zu-`8yLha7w_;H*{Ux2iitPTOPOv$_XGW;XfQx!<W1@*A*YXt^Jb$(ZL1>
zLQG4=mUC4^><nUWO$-E#)O!B>Q)(sK6;_iK9)nFS!!^t`kP;H~q=S^T-qM2yk_jB^
z4B_gmuTQcX$U=mLdW{&YtBUC`q6Ve`kYbBI+bRv<%XQ^u(nX6kY&ta4V=<V4ME>Ey
zx?MHdF*L+*W7ZdFDR!YBnOLnJ8kp~#Zn97&z^3jnkHup7BRU4U*`{eckV*ZZENf$g
zayP2`Ye7!`R6W?KfEFtjYa|0<B?AMpfCI=@&!}^FXbNhcN4G8Gz!u+VszWi>hu7{X
zg)cq4WR6{|B#?ZDuy#zqJwK2s1}(zt-ZT3^J71$+#b7K;?NCH^qN1<W@?{n$UqUo!
zv1R69T-S}U>L&l|!c7d^cB?+$#`DIaLXB}8WF3pGfK^!b>X<E-4AyH{uy^|W%gGF0
z)xQc~8y<n4ccp3>>%g^Fh*`LTj<7PyE+R_DYz8F@emPid>($$rBQRF6<Qf%JT5WGl
zy{)7QYN5@Mb&XR2n!piiY*Lh4if1ZdJj=7CO&4RDZbNq&HjT}pU~CPvgm<P@Ha!0f
z$hu`w2cYvt!0k`zv@9qYEihIK)@fiKld}RktEV98FWFXI88{A#AR2L2-L(!(lEzds
zVR9Qhd!+-9UF<<u1Ff*fjRD#ZeP|ojjtdy>f<M0q;L<+O&Jo(wj$VRbzFX6((90;n
z2obe&k^s;@|HI4zY|>jBv|4ClV(qQDwZfP%a^J@Ds8hGnh<&U2*DrddRw_t&wt@ZE
zT{v`4f_mU>>lfhT*Up<04Y=#74RqVsF5e-QwM*-D^#Ndv{X$S^TZF}mg^ru~?AHHC
z<vB_EEP-d)kfGRmZ^gDIv;J?|m)hbrEPbx=zrkY(W8fNIwXs!pz=$6gBgtIRS!2Pl
zM%q7J3VkOV>MYd^)G&76sz?BwP>U{-)8h4NGpySoi;mG&Ot$>Da5`-Yy~F3#t4(!5
z%P?69ej`HF3Fb=%Qv<e&(PA-C;EM3oM+b0iD}|+HJN83;rr|h+@44qP{G~TN52IZ>
zlBZ&{+v<<+O9yjq>XL|kKA_YK?T=s@pKoQbO|aQbepi<e!SOBvNfBCfS!`gat*o}8
zd%<NHsAFVz8(=&%5r;_w$R-hxO~a;zYJ^n@vh@8_@q*W{J`Zm@@C^LX)w8gi&Z_MI
z+)j%DyNreBM#33HFuMkWpSgX4b9B^3XvH|*;$9%Psjz0>dtwamqPJ|XR+(j9VZpD^
zGJ-(=YVF#1osd-<`nV{-wk-SG#@%3(wu?R}(_F27x1gynY6X?(<$jrQfmN-97^>*@
z^ip1Ar`7hj5#;zW9T)>vI&g9UluiSZ4J4%91JGGnwJo=~&uGhx1C~PzQ#S0;&LM+|
z`u&-@XYkpFmW;*TevZ*Jfm4UZ@V7qjxPGZ37vZU;)`xgyA84Cy13gcz1H)ktWY7^N
z<`l)C8uKS?w+}La))QU@`k)ITyMg$`gy6AO7l8+?B9c1pV;B89+_c&mmkdH@fm_Kj
zkWB+imjl^yW?JGC>K{M;P59jP6EIV(Aa&hNoTxhKMPS`c&<eaT2Yf?~ls_j9v51QS
z>%t7TH4q$iTWvW$8PWF@df+B4lf_!tOoeUpz!e%A7~=EB>d}j_SjM>h3j+@=0pg%n
zKqd$jQv;OY`J|h~Xy5fT7>cA1N%wY`Z9iNdR8;}2(q`$pL`H_e(PQd&$O1R@*(~@Y
z#Veh5T1p3|1$V4={VoXgx*OXE-~q*GY3vgH-HCeI+ENaG_b)vLCl5?ucap~T=mm8y
zO!tAd>6YtcvlI&KNvzGgtJff;54NtLE*OHAOhbrDUI@Fz=A5tPpOw%&C=u!cY&i_D
zMM9u|320*=o2Ee{LTa1^<?~n!Vhm(URx3=L+?^{M@KdKBgkO8|HL#qSsjVVtP7t=Z
zh0sv&3xPMPvxGWH<cd@l?L~7T>}9Hnc|F-pJGdO^S=2$1>%F?yxub~Kq~W!&c}djd
zKEQ~*t5z@zU#D4z^$TV`&=NCT8RXDO&@kG_xusu;A`Wq2S^W%>!K)Q8|3`CdutJz*
zt^=9V@zjI<;e$5e%Ykb+xq%nLW(;KQXdE=T2pwF4Z#~(A$1Zgs>r0ra3qz-a@DG0U
z33$it*I{dvHtq3mp%kzWv`y#3%mA&Fiq(2U86#t|8|2e!c(w3YD_V~zXSIzd^Bh)N
zJGVr<$kkRDb2l<uPsYA=D=EP<Xha~8b%ihHESLwfU~OJBbn(L{9)+)L9f40>Jq2so
z%)j!mmR!Ew=&{;lni#0Y@+h&f9M~cwyhM9f+rv$ouxx7q4A{7p8R~&DagDXHMYqN{
zTL8AH&=oiongG`Q4!!M_r9z+d<C%!OZL`m`9~S!>Aj#U5F5Rk*v*S>VuWI*!w1W_h
zeBkgHp?`E8(g8g_Y;YRne!zDbB;!EV1<xQP3dBGAP#?zA1bQ8_+WMsrU4VDry#ZUp
zwCy1H7Q6y)ue9_ol8-u}MvDp5{I1cgTJSRvkc}Hb=JXMD_fi}RVo{2sy<QY8jK$Ku
zgvo3nu+6f1o@|;{ZUVA!rAa-hONanunIz%;%pUd~wITl7TfeBk{`0FR46{XM*9tzg
z2=|Vt7aaj0k|8PLazVIE5Mpt#e9_p83xaa|KoSAyQd_Q6I}T|DCSrf5sT&Mx6LRN{
zy@?gMg2$U23A_ka>9qn5t<7}HEHT>J=XEceQ~cnv1;>dZ@_k5p=U}>Z*;ZI9fCW2_
zo`yFLj<4Drgu(||EIj$343Ggk<Pn_(4D5wn!1e1HeBz5sYJn?Yr6=Kk_|Vhv{r4&+
zyPLJS_2~AEeV}c-6@?S*h3gE{<DCj$Dhq8=TsGiObmIf70yoABV=;UTSHMj!D1dtI
zEkHxqxDU2^NpF&dN}p^JD}LE_S`M=Gbyf6Yeo+yCEGv%Ddz`8NtYs7Udv|;ue(9k%
z!k=C_39E|Pin1$=&HoBJy@Z=^%SM2UYV`mR2|Q~YUm@mz;EQFoxc8qSUkUl2L)6}*
z>nQ8%0f_NrE{Hyk5NEjc0+;`N9bnrnUp0Vb?}yH-!)t{pV9kQdD0hkFncBBYrZ{DN
zu<76|$mth!>}E-D>=IqhBn*zOLU)aR*8wfJb-B*4JOJ370jy=ow0#o^4?o$12cGD|
z=~FrU>d!t0Z@P8I$_1?`OJ~$0`#{@vqrq3C(at6v=MV1=)P;8!GHkF`A=bgxtXM@=
z?T)e9Ch`f<xPsQY&mx5}bR%DabDomAgs3EdG9V_YK$d442*K=ICD1W8E7%M);j?Eq
zpPXC>y|jS8bLSV~A3yRM_{7CC&`s5eBxL2K^t!hAGy@Uc08DTw6$k-stBrYh`ZBWG
zV0|nap&f$`WsI|8Du|^$b<YggLOZL)2&=^y^PLN@5s9D%zCnjr_}SI*a&$dcCsnGz
zF^Q`<S`wfu`V#ZC=FnL>re3ydh$#xMJD8@=EuZMv2t^07k$l^->#K+YEU?!4Kl+Om
zc+I&9{KKDp0d7AthRvO{A*a~8J+1D~?E`I_a4?yadYL_jE_9b+sDSqNrnD_=SgADu
zCZ7|=jRArCwY{#>P;~c-Yx5)o`-f=tS%NB`T$|K2TbC~@?1w7Zs(roCpDO~8<zr>0
zGJ!!lQ(*fAc=ds+@T=dt8z$<pULqqKntNpV#M}6&as7W8Pts`$@e<9PcP`{MUGM4(
zkS1Fh&j4tU6k?;sh4tA6T5XiMVts0GV@qyhSWQfy4FEQHEPNj%K^;3#Kt2higIX~x
zRUdE3Mk7x3nDBJ4s;A*fYC{H5<qJ`C;gJ-wwTZTOc`VjzN+{UpVxC<Nu(l98QJ{Ly
z4O953zxkZjly^o+eLzQpZ175S9K5m^Emj8_n%2~>QxvFr=yttR6JMhhO+H%i^n!AH
z36EUmoueWwTFLm}#WohaCkeqm5lv`+PyplqR=TYFp4-Ao#+<OC7sT1DVA6v7{TvfL
zs`*E5d>l>=cHvjPc^5n}T-Add6Oa-18l2Q@c93A2c(sipV}2t^UQCGCvtU4S2Wfax
zw`}_o2C=t<-D`1>5x_+TwtSj$-L-%^hz6%4yCiPXgquc=$K-<$U;}pBG8zY)if`!q
z$-5m1N7iPLPlX<=5xwT<bEO9fb<mIlfWloA;3k;@)BXV%4>#@LL@OPrf0s@XwvB=U
zm}9kJzk9;6Nf^L7w+lU<3;2#(CK_;Q>aAE@S$g1=I05&S1+<i=LN{_Bn6&>ds8#f7
zJ*KK)VK97d7?TpqaH>e~HV^*hxd;o*oNA*?FGfND_5m!=3g(w}S+Y)(6-=isqYOn5
zi0uI|`_lqS2J8{*@|q%GC(q!!j$VR0*RR9Be)4Ac_=Ou`RAdUAB*a|>OdkklZSn3f
z(X_!DtQewUZ+Mf!)Zfe%^PUyvs<Paj!TLbm`%_rz&7hab(qS@E%j4~F7q&(n*i!$_
z@<hk%b+k<4`(FiPl6AiUHjF-!Wd?$eu}uNr(Cm!`m;<m_D^y@(jG}2wpdpM|R$YDR
zqQ1IZz|plr1FiPTHUO>22xz;ug?4PD&m@Oz`5?fhr*z3$6QY@b!LbQ+4{R&qigj(R
zd?=|v6!^&t6~M~sz?9QO0eVuVdM>!kp+`Rrun)BDx9Q9ty)xH~R=`&jMhqN?hM5O^
z!<YO^GL4esoF0E2Xtm6bTQb}b5B6FZgLZE%2Oa12tFc*Om~0}PE^EH`jQ$?FHX~CF
zWW)DqA0H~PUGGfczqsXL%?^M4@$*3EXxB*zwGGjLh{zawY<bRXUm^fC(eOs;9gv4|
zrnc8oH-{S!?7(fuHsRhIF2n67HsHwW2$p*}bQD|bkg+{6Ae2kRh7`CG$Ub>x6+ZXa
zad`0A1Muhz>u`Oyt3#v-m}@RHz_|?$`rQ|fxk1oS&`=<Yf@>T|F(Mmy5=5Ajz+?zo
zrL3(D;P|n1_~y5sRof-iKb|RIJ+hv|K?Sx&J%ok%#VHSYpvNca)GlqiGFol6yi(;O
z*Z}V38*H9I$XLCV4R{tZ*F*$fW=XXok&~n>*6ks0i1gX}_knh?ngt3`9;#ng`|oyb
zTMTnQ!i~<_2fZ=Tp3+!F7<#_j7WYp~LRh3QHdjKhItBruVXeXg+wyB+G+g&4IAis`
zZ_sF&_aexlt=}e!CDPyffiutOr~J{ylkn{B67+}#CV`X?o0E<)x*ri|5gXx)KT49o
zc$UFHf$JT|uEBTRd<ous_IWsWcpKK1rke57a|&VP6FpUh!eI3FMD@NA`ig}eN^`j7
zh9SK7o{KOXXYj=HEAY8Tj=(1$JOy8Q`mkol^fyF%zGB@E>wptOnI!<tw!ZGh&=~Nm
zzcF?j)p?1zN(Hoi_=R715B$}i|5qA#={Te7!nqSOSm{a_O<GujV#3MlvN|rM89}2N
z?MR2bWJ_K3Ni*x4O<?8bUFazAmU-fXY6N7Ffoxe!vrHEG`Ahq8oN8%Tq%hCQ#cy9y
zyMMe7wDZeh`uwtmmZ3T}o={(2b2Wz~ZK#+qUDcBh>~hy*uUwZEl~bYC#1tI^zIb6Q
zE-`Qk!M=6Zm>|I3kvR?mT^0hW+{$Eq<*|*~^7l?`_Vm&a{`wsc!iUd20iSs86#Ujx
zXW_zdS%WRP69fl>TF`gw>H@LR6pf5{TBPcpz@eoH{P3Mm!uQ<v47^G)*p=Q)w-3{O
zG|B1>8oDvV&W@u_K=-fu*_6Pyqb?-f6mGwH2Cq4P0e<YQPs3k4yavB<|9SY-H&5wp
z-|G|&mDReeptEZGYamD0!CT{Ur$H;YM*Orf*8(=gGB#+<BpEC(b>O}4yAAHS=L~%2
zGmpbyU?L7*f9o!7A{!>tKrUzkeRtJF6{2CZdW;Q@Anh4hq1aKNtC;cf4I>S>9>4}{
z76YlEe7uwbMO9q0O+^LSxQcnLo3-1g!-*{WKpVx`#GdPVYh55QL2c%%+Dj|z9D{=$
zG94;GQF%+9=3~!C7o+Hwi_)B%6*$N8U$CVx)-r0PHt8lJAtcPQRo<BwHW3UpMI<*t
z)Vo}Th~XSYOHDB;gg|blmWKzsQ~2py9)tIudJg{N(h2xO1-eh{tmvPSep{{(c*$Oh
zxOX-hg;u@ELie$!8tl#=+Jg6<e-_?(^K)>^ku5#xl-M?Dt);ciGFZWxyf7CnVzU}>
zEz>O<T&4v`bwuTg3QsycNEJJK`x|n2^X(77AAIo{_@{q-J3Mk}UF*Jyz-Xb&&$l7a
z>3|rltJfW=rS2FS!#KjuFTU}^Uh`N^f%iJ?4H$VY;mFY?==2i!-tT!8eCkt=Lcd3?
zw*|cMmJ!S*qV%RmUxk3SPt6Jw!(`oHMjWb()mVXT2GeU3SiWNnNe4Zfm`~nCu)7(!
za=F0iv+m<jvgK}4)zan{z})S#0Q*3@KryUu80~CGyz~(oxTbDTCPrcs7?aUNIeEmi
z4)QP>S199OvsH^XrNt(&i3Xh&BLiMxf$!rILZx9kkTuK}y)0Q`vtE%4>V<)tT+mWY
zYU+Ax(xP+4D0XB92YXZa@tYrq*B;t{-+t-_1-K_+q*y0K*o6ZzO^dUL5PjB$C#rN-
z(hZ5h9vV#G9XCD)@4ERSyz%rEIH=ex0shW7t6UYLa#NM{K$o27z_+lvGy$${TLxQf
zB+bz*Va%ACd^&+)wxmGiIDGK!6L`yQpM`(%CpW@JKXYEcFVcH4Y-T7wBUA!EF<Y`e
zDW;cec3UroVFWDG!I~~O72|CU)V1PUqYW$~xFBb=2<OhO0Hp=K|9v;YKm11n*xDxf
zq<}LAbC^z&`b+VECbiwu!IJ)cGw+KcB+Z!dB;8hQS3pm_&fvrZ3R)^OHQ0G<HUQTM
z5F@jA<wKLhASA>c2lYh}>9b$m2iiq$BYm)u!<k6TBZYCpJ*t5An%W76W38V8OYOZP
zRnk=OV+BxA9suYKd*ubOl4LZ=0(+DYutCz)*g#-VKq(!F@{Weh)+WhTh`Q(AsiwJU
zO<-%kG=STI8<%(B!#6z%gEWUvUOWNMkNVmLkkPc=#8{{hqYLH|JLvhuh>5|H_IuO%
zHhjmK7vKZ8UVxhp?&!}=nGD;Cy@D+Sf~*RaLU<F=>)TcMHJQRn2b$&TVV6P!1^r7J
z4f#W7J0sXiSK-jnWAL{>_ypW>Y7_p>$6gC#1tKIRU~q*GK}xt_aK&y3Y~^HV#<kaq
zVNkMwL^0~5)7P(;_LddUj*Wu>nmw@d0JdsM5b)Z&X)?qn+<0>j?t9}&`0bBB1-G4^
zz*?_>-Eq=hD8W<#ZC7oZ9UBg_Ya0>h>n-RWm_hHz*re?iqD9gcH6~jFS6ftbg)yh!
z%2Aaui%ltR{$}~SA}7Orpk4e%?&e*!5g)O{XG?+6^J*g=#xV3hSef$4xn3igy)r@)
zMkiJc3sU+v)Y{S?=Xh)9jTo<iwRwQX(i9F@OV<HZAS)W;0GgIla|&M3_c_mH!OoEz
zmxu5-?s^D*{QQ&f)r|x2#Vd#5>l^EEX?LJ)V!0H-tTDrG34}@CC3bw%`VQQ6WE0+S
z;ws#6^tw9vXBvD*)70y5Gbb6dvxz$3LgK35b@{~2Ow)|kdK^ePkQ1}xX?Q@|@2ER<
zB+g(m+Jvb%03Wz_0}d?x1^m))z7}5C>_fj(unT!Z*mo%<s5Sa@<lDYN@38JH%gj5H
zvU<Z(HoWd)0BfW(gw^E?UiX?6Gb&u2JRkbtS@^BreF|Q8)7T8Nm2DtvE&|yS$qSnd
zWVbcY%GnkSPH!p}F0}<KcJLuK$OobF;jCTg7gFVffL4?%mIY;lKYS(Yv#%_mbxxur
z-CSDBpP;~%tPi<5RxYUH@J_uf%!FrsalTZ+oCM^#bs#Dku==(xWB1~nrfvu-ie`{(
zl@MB{X*YF^Q72d_AFu+M(;`KK)>*^XMd>Xz<hjgaw)W=)h;%0_*t<_&f_I;~qyV-9
zFO2(eakmebMg!QGcD1xX?3KWEwL62OOJg{`Jcg4iBRIS?(Y7jLwbY?DoMe6rF$dcc
zT&?cz9&_4j0bW`eZ&)j>euX*8Nje~K)tTP(w3&o_TODNEQ^nvExU4MeU)WWj;XBS>
zfq(L!e;$7RU)&4NE3oZlMWme=J^!uHW5yJKE+5i^9;rQ7GgUjeq4I8{T5^wcP>b6U
zG~yg-x?oGl4q}@l!hBui2**$L;q*zWDsE}N>wRxnhI2P`;I30vpUqnik3uo*6~(r@
z6uLdKAUm|oc3b_$YwEp{1EF6n{~^jSBlSH2(J4My`Dtkb6}xI%Ohx@1Y`#s^bN(1$
zA7~c@fpTkJ>93k`!8Aup0q|24x<cc)-O`^=n$?|OOu^M+x^%3tuD9~S7-A(M5J0C1
z_)QSd9D%qH_|DO5X_WGmF)(B4iU(Jln8$Y38uj_shM+ZH5EcPjdW=AFH#f;P<VU?h
zG2L@3JG#YF@WAn;`je(9Gl9G?4F_T3SZp)<kF(4LE+^QpF$mNFCIMm2fIKr2Ledq`
z>80AwT#P4*(M}*;UQujr4aVaXZasDx{=4u02K>Tryv`m^JPQGX^Pd;E2-G_Ybh}y}
z$al9)p^W(!aW>Tx1n7DCwUV@9XEw7}-^~GKA?(I8Jy=_x>fmjmmP^M^B=ENTx^QA;
z0{Jv)2Q3BE+QOCYsQ0*20WEH+U)!`Txz3^@+TKb~^a|Z^jQw&}t4>-fgh_4fLZ2D)
zL)QP(-%!taY#(U%4z%A=Cx{M)NX)x?gpS9F+Q%tYHZEP<fU3U2K}PSWt`9z80ZiCq
zB?&vrfX(wmzpJcKLRcW-t0v}?Y}i4qCv$C9L{ZymSvJuuZI{_Z<AZgJSrgcX2X#{;
z1|{rk?NvZk&Gv$C-1q4HEOfn<!^{GS0BQ`kT~4S0Zm<m~Bc+%TbE2ib+Wx&vG1`It
zd9gc$$<7XBs|R4xJqho;^9A_e8=irW-hURBySZPmYLO7Cm4mtv4c4?)Tug@Lb7{z<
zaJjbh(bd;QjJ-x19H5cn(ZIsHZdV6>UjgNgafW2w4*bjyrLgisp@2APUsUGm;<HY<
z0vqZ*Y@3nf8eq4Ls^><ITVfLF_J}mZ@nQ(`)AFIc%vYOlB<47Z6%#~s`o@0{rj2nQ
zXcxj+Cmr;<e*yXE3cK<>O5K2tsX9p@)fHze9ynH8hGO`Iu5jrdc8s~9tck2rvLsfl
zI9$fWKq^cXjIquT?A-)g!3$yYWGQJY`-$Cqi&)D-*8@N38)O6zpIax0a|;NQfw)~x
zLbWj^)}#T!e<$`i7zjJ9y(TBj1KjXJsF|(;T(!h6c4vy=8o(vCIor6R0Jsl@Vz?i8
z-6i<#FP<u8sA$O^TR@kz`2LEn@#?MtwbN5Qn+(bTm~xC`D|^Lx1Vz8UyY8e9wppD3
zGK1IOmB90tl2%)n*(3>c*K>9LTvg`{fvYQqVF|M3Qoj%_q$1R7lgO}M7A)f)r;FhA
zv|P0`t-9Ezp*8PsqD0sS+P&Qbjwhc4UrBl_qnQhed^jDowE84=q_aJvP+|qHL92er
zdS&HQ5L`ll>NPz;jaBQR*=4Yhgy6`Xr~<r8%WN!PFk-i$C9lXWyG<C&4d+2dW3hZ0
z0b^j>B#ksYRtq-|NtpD<3`J{nP3)EzyqqozPS=Bl02cz!Z3VbCQ*|=achO0;zEF&(
zFjgRZ=3oXV)<*Em)g|cEwAz*tIYIS@n5{?kq+~Wk3C*+4<^!x=S*UN9mlL@A_K8~l
zU9(Gjp+meAEk9>k8i>g?&cB+iC`NmDTQS=mD-+}v2vaZorIZe8Lo_0d3t@mvl+oIj
z(6L$_jfI~r(LNygeszBUz71}#G@z|!vR6Cp>9hlv)doGTS#4r0EHtAiO)B6bfYgM+
z0wc)>Nm_xWBUKzcAqbt(OgN3R)P*I47&tb8ZDK;djsLTS#X83BD)H7JteI`WrUj<~
zNHvY^Srlwzas&t9+Qf+n*al40NC|95EW&OvkQ1c;cjp2wu-9*5xz67^lO-ZcDh{cg
z)6WXiKp^K#WrzmJRNJO*`Km?*Ed;J{UBSu*05{zTaQ>`fv!un!D)l{GDilLcq1c(}
zrVdUVN@vMTf$SPF`%MMTg}q8uEY^(}cVH_+MvLG(P9p9DzZe$SzUcg=Aejl2ZjuPF
zhMW6i@NII-Ua4=4U9dN^44zV;d7K!h>%=Yd4^kJ~Cp@pH2F)a#Cl;3wOuzzGIw(5<
zSwiDt5&|q>`C=<=>e;8`S|r$RV@a%@p(PVh7G+$)K}fc==aUs)D%ge>7M!o!hQlb!
zHazhn*sX|cU#x4l)dk6F-AUx<oJB=4dqa7FF60}#9k{aHHNohu#i;mFztK<2*(epu
zWXt|XoKp}}*g6&Ps@o>8w7#vtDl0oV^!}#_9(@7%_3DfdUy;t2?xBg=CWQ`;;mj4w
zp^VJ)Dn)!*AF+9bmagiL3NPMNZkwTxjdS+=k4|obKiCJ_ml1Q-N%OU=1NTiv{3I5-
z3nooiBw*rad`P>~O1(8w7;|m7k^)}npr;nZjt?R{!*&q~q1L1j(V86KQ1?<|fwPWr
z70M-=qzG-naU<2spF8lCzT^?MtH!`S3brvuzGtw7IJ-?4lS+asUX0y_+n6)cq)Ka}
zeN8SEa~FC)x;9olroE@_g67_<juj~x@CU%V+$rFrUpoqyw<z4ESV%*~n4XH*$a<+r
zR?J56<<T5)t-eJ)k@l@`x}rYlRrPhpt2&AfLT4q@Aw8lYKY-4U?hz9ZgHCp^AnUSc
zC02|U+gt}>Hy8(2?}8_)`V18#Hxs{EsNJ^sXKKGbybrW54O+wF?yDVja*TF@6OK-%
ztV*iVM@vyr&C+LyzPC0B0L5$1EzE0HEuD-3wMhtj(Q5-~LL_kkDr{jTnXQmeYRaY*
z=)e{=*aB3Rr?SC=b-h6Xkv!c1Y(+yc4Vu9gqOwWEC&vqAk~7O7qtX?<5}(1kZI$l=
z%!UAyZFO8+1sHE3Ox5><S!4ywr>LWiO?4a%*mf0|EDKmU4shTM!1{57)k6r~CByop
zJ@M({-N_I>_0R$M=bxrgKSd)W#in8vw&WhzjZ`QmTTFMW4}~q#L{!4X^4MNkF5pe~
zD9Sq9wQSZulG3GBbv$Pf4aQcWnX2FKtQTf5qf69sz-pPS17JsDqSZ^zED$RO3lYfx
ztK*!?T5?B}dU2zFwtBh$3v+;dpnXXtvDzaKbO&V(q09u3=x5Nn%v$6iA}g?rO~Umg
z1nWX@`mO|s+Q(j$UW*Odt*|Lw7!yS6+a<}=2|7g^nBr{nR!VTiK&M$IJ~PAsv>@37
z*hXZ>R_8^NZVL_U)@io@HWbEUzzl5rECoU<Kvh^Wyr{tS8d4J$(AX}TBup0|{cnL<
ztIzG%<<gZH@05J}2$Ks1yznIf*SdYUwz>rQ@g5vIE8*-hwe(iZ_3E$#pL=`-{@|+z
zVWJMOPFF-`eKmn<6R_549~G#CNNq7}arPR%)>JY0J8qf4t>-5oDIX%tnw12!((kt7
zKcA6oP|#on6B5G!(MSdsWXtK(qRORhldA3bYF{n@@B(Js%5v9qg!#{luLjj^OWl7D
zU>|5-JeiGKH6H2>U_%|32ell)_AxCL=>XBoX{JktlT&ywxaTIYBCISmcq%Yq8CK$r
z&4GsH>>`%0mZ=Q7Xjja;-k3i^-Eo2r^t=MwYMEv&Pl<g@2Gb}VLj=EQR^8F_Mz(=%
zIC{J_10p6R@YhOMagr{kBf6uWqLNTMDEX*20CrzcAh~0To^-(_ZClzJ6@6dG0A!gK
zP9LkQ&~~ae_5+>6@Bkcwr(hX|TN&i)wZ%hVavM?w;JMJi-S5zpf|<We#(71s7NGTj
zl7KeREw2Sp@s=(tY<WEmw37th{^o7yuSv*vlKO?ZAippgrWiTSh#B@y<OUE6!CGSl
z(`2F2X(g~6S$`68y%3f#HVgIcFndgDeRgUtssiVdum7Na=ed2LeK7z#YxNvoNi%pv
z9g|w8O*2snOXNP_GsQG3%CR>1&q)JLubtP(Ab7-RX(bCJgn4=`%<I+yKGU#$asyV+
zAq|;w1*j@6lB(IkbRSu*Rv<I=3$NJ20kqZ>0O(E4#qc>Xu&qz7_Ro#5y^c+{a3iL0
z=CTMV_!%{mCEXk|D+x>-m@@Y2?uBVT)gU`FfXi=Pg$|Td^ffpLpBBg9F<8-$lWVY>
z<m&EYV=v>|T?QEkxJS_S!L{~0#Fk0uEda}2k_H(5@cXZ8w}F(xyTBNrHPVP?<+=Ye
zQ!GR194R!Lt#nz|)m2Id?j#bGg)&G9!G;->;nbaQ@&ay&s$kk)2&1n)0uo>!X#bO_
zw(!|rAMP9P*dm7ucSduvW!-96A<w1elN8*XFl2h6Na7L#1#~3LbiXGFp-Hc8$**m+
zwA2bu=1M_Do$0Qr(o#Xq@(TM|g;#;+<8Lr1D0#Li2*1X1<D2@UsE;t`+fy{weC!E}
z=3W@jvp(s|S$<fayoEFq0W@&#7}>pKuzB?_?RR3Ybiv6B^Sxvso00ii-5-KA_+vN@
zPbdbfhZKel|L7AZUm{4%s-Y3=8W?K`tWg<3>Zn9nP&UHMUMSnyYsj1@QvvthJ%YRM
z96>%x4JjxwveNRw`p;e06*4y4Jy}4yMi;lVoTtcxxgEfkvOytCBx%#!F^IX)M3DBx
zjtknKn~|T#S?!;wfBz6*A823HEtxke5#cl40sPl)$Ln5br{m?WfQ8y87<xF-pPXG|
zvr!2FMY${&tmoY88e0%-7s^8j6TE8`CjR%#2j~nyFQsX|5{)8vOK{-=bFgBwm02Gv
zw#tANV>t>nri$%tyN#9}D6MlIiz~s`04cGtQg1Cx!6mo<77j>@ipA!Z#k%iHmjSU-
z^#?Z<XZ?f%*!%H_{&QW6A{gpDjbq5o^1c%Ov6*$wEr>Na353o(kR&$aB08-P))U2I
z-|?0qQ0n5?$_B_@yF9cKVZGx1QjGkwy%SSolbnR$%8FOc<|Um*%LYpz#FsP;|8m(t
zKSYfRyKDepd+p{U@NIZ|<wytfyXgL(ZVxUeDIC?ss>H8e>&LpTC}uUxFvFIyQVc+|
zCLsu;*Cw>w5|J_I^Yq%i7ROqFH%4;JMWwewCz$b3W|<8PPngTV1?QAk7E$w$BKx|O
zP8!}@BPKyTubL0QET3Rq6ApYez!sv^T^*AxBm-D`mpS`h?O$0qMq7bP$F4s=gNNad
z@EBZE@Y>bF0Y_Dg6kPylK$pMjsH@`)OV1!in!vFAKyGmn@L6J_$==bpkt^(9TQ1<;
zZ{5)Y4J$1<qJ;~V?vqseg|yq=*&O85FjbyCPysA!R&bI*VJGP}U8ou^y0x$w+PvF|
znWvIKygR0P%?sadMX+x->A>i;9r5{255A8AW~d4c%sZ=rmSPlbf|O*-*Mv79Sl5DM
zu3Qe_HZQLr#3nFsjki&+Z7Ytofo)7aXlmtUU`ySdWPPLUl4Zh<EVoHuOnVhxIJSr~
zSbk1MF9P#wKs8Mc{iUdM{#8+GuCnm|b!^rFEoZb;<SLmifh=ROeT5<yU<rO-9)|~U
zO_4MOBA!fue#1zaNeQ+kR@zldqCu9rNw8_MZ3r+JqsMVz4Id=dtX<qF=YlK$*;s+=
zn_sgFci%o%``%6^fO_Ktvg1k@ld)p6{TpYH9zc^X8^{Hfht@iBESuF=;v$eCFuEX!
zCwOuFj`sJ}K!&J&Sr#@wqIS;KKG43Tn^@!-pY9Lf`$og6K&3NebIXSGU^!70fuPc5
zYkDoe(DS8zpx0_vE6^Y42y^sWXpjt`9;DUEVCOMgc49593LtmPSZ$jmH?6&iovxb*
zEad?a6um@PwTgl4LQ4`KJiIEi16O+j7bTMg4{Rj|S;<(ev;fN(t(28i(6M5`{dfp|
zzc>zC>Jb9ic*BDNHAVe}3z=ZxC}c2~t&N?^7IcB8cteb9wb&p|A~cU}2UGZa@7s2u
z*ORa_Oe<L=nq^>@Zw31^>g(POg<-8lFfh@{2GW-joNPd=5Ko3^m_u3pO!y${dXHv0
zg%LbwN{!g-KQdDP{7d*Yy}g2B5*K>bC;Q9lu(*r~?dYWJcrphV#oy^L?Sw@i@+sNi
zkFIj<>q#gf1bVGEh;R>jZIjC&+BxRlpkp6R&W6BWi0I}ApklT{cRlS~S0~}vfi1m1
z;Z1NT;~0h4XjdK9Vh_8FOD0%>khCY216RrKSb?d#JMfeN&}xYwkP(ofSYQ3IOW1?|
zD38IH<(e*lX%-tWEzKHfn4$w%ME`0a8mJ@ULI*3hdS)BwKQF>1>Ye8kfZE{m@IBd(
zZ?zqc9L(W+-Zq3Wg=H6ZXC_$ppt{19W1*I%W~&l9CnXdlI}}ilF_g?l>p&K(*TaG_
zk5F3*vS(xZtd_X8?L_k=xOml%!GEdt+vEE{`x0+*u>tO1>-OPkb-tV{@+vJ~172b0
z*UzZMQs`otEb4`<QbJ%7K*>-8pDhPf-J;9&TK1g17ROp03c{BV;w`RWvCV?5dLte6
z+1HN(Y+n^H*|j5b(rUtPVncZZZ)1fjkVQa)y#|`41Fu4jRU-*9k1KM3MW4|k`?``5
z(31@eAp4F2x<7#H@SDX+#bPt)iz2cj5N7g0ngsw`I{+7E0F7bXvA~xoxMG0C!T>Ey
zp;;^N-^Xa2zz@G?3vO0Re{T+$6tPOP>7ukit2co<Px`0TdaVz7d`xwrtQW#6fE887
zNN(>US!`2aU0%|X@n+y5XXga_B*c0D9()_bA^v|sqt*4vG=)#~mf+m>bp;|)R1;2f
z1A<a(c)}LTs;(4)5iJ%134s;NxJDb*YwdLH1oluIo5yT9g2x&Mf&-DGy<^=v3n3w}
zMa6U!yWIeoj7@lrBXfzUa(CVM9No+t#0iQP7K>4!wIGWXup$Fm_qDrYz-kTHVog3U
zbKrayOOAp+lt<wH;-LOX-*e(S?K4%Mxnr&_hznF)aZatPIkO=Cw0f1WHtbRVQ>f26
zi~P~}`=tx&@<75*{J@sYbr3Z#bM1nto<o|f-b~g4);nire_;VN*#JYwf%Ih{nwE<N
zH0Q+%h)=oYn=W^<0aUHo7}>l6KBC_5bMS3^dj;9M7G_Z&Us;Er-rlfT1WA=qYr4ve
zgdl8ih-13mGExL>x~#RAKQ8vD*Vc+-FV<tr#pQ4mPE^Nr-8r^1j4V^?kM)<;$us~M
zD%L>TYdWdqgeq*j3eXlzMu--Eu@1I;^^I)YdyU!3D#WEGC0GV41MOA@42B#9w5z|Q
zSnTf?$KWz{w2ezd)ci#2uvt}J2bjZ5A<jkxEEw<-mkna<7Xu`r%mXZPh?elZC5`!h
zM4e!79KmaDo5JpHS^>6b23pNpXBH^QJA0!dDo6fb_Ra*}vZSu>|2pTcZ@F*l*Xzvm
zGAn}&gEMRbB1}{aOadW>n1G35T!JCS5I$r>P>E3x0YyzB28}Vw2Lg(y0ip&OKv|So
zfmxjH>Am0n-d)d9sj748oT@riXSwfn_v`Me`P{khy}tL{d(S=Rdw%t+|3Zt}AZ1!F
zt5*;%oFFWYfe&&g1YF>lU=4`-QC)GV#9sERTqob~y8#1O(C&nFP(IV+zE&GH>J8}7
z&>j|j0P?IbDK^8EuJSD+B>P3;bCH@gCi=Bls0Rz6O=c*JL@<SY>6$_+Q3#nuJI&7t
zYyl^W71Q%X@l6rfu0+sfz;&Yw6!&W-6<Yzc$%zPQ6{b*tEf#D8J!r9P9bg%-C<ZLO
zKY`nDUpNO}4rkbIX=#EkqlkezlkK>qznVK$#|2QW0#+T}`BljD-cUC3fZA-Yyk`q&
zf@I%AaUuyemKS6T#zVyH0vs#a#!WQJ!U0~GMJ@Ou-G@Sqt6=ruFmF+`;NFQE_0so*
zT>ZzVGq6z?+`%fI2C$&L)Z;8sWS^Osf>*3AV-{t=Yyw`nix!2!h!qfVTX9S+mcwk+
z8m+u2cv7%N_*q+0F$%`XmM|!aM5q$>CBjxozR;F(MQI61-W`}fiJlZR#&&*x1YNpV
zMsLHoI-ety8<gw=)1*RCDPoHf5wM{MUJlzJ0)?t-qvv5^hJ#r&!HE3yIG%(r5V$@N
zOv8Zu-i(!P7AUb7E2>yra`jc4ynqe=hV|=PTCf`4M0{1IO&T#@Oej%MW=Oz#`;8;`
z_U8<s+jWJqf>A-FjC~LvFF_x%gaiuKI#IK=!_nW=?=aKH3k!?0JOUv|ft}~9=-`{|
z4*I>XLE30jo#CQLxv#Il)MOaGkv!&yEogUOREZ`c2f_#16tqieBSv~vq&62v4fSbh
zs~5JoMX%&B@zljJF?N>6$+`e?H(V^2RFqcxt1OP0RICbH(5O{YeF2SM%i|XjO3Nd0
z0M>}uo7)G_S%_duRW1z)3j!Is$mI2D7CW$_fD-E<#7PAxYU_lmg}@UR;+Jyc1ui-^
z$xjc36Y$w!4xS`RmIiCl%r2dZ<qKYELE_TuTG=VTLA7Q#o9TgD0<7xq^f>i}PN2GX
zC;ySA-2T0n^k8-}fQ_D`gy<ptMUtvV0##c5jBc)ROSIoZU-{fhqeL;AFR9+eV`zQz
z<Nz0`TRKKjgWW_aD<Gf+ejYg2ghSqtp5K29(_j+v@hxaCopnIRCtGbe(P+XA-Uzcq
zg`~B0n5x)d6ooq_wJ|lKApx&2?N8d?sL=`_#aTxQ59;DriAaQuGA*(ZbQXb79#Y#E
zU4<=5i!Ae^+cSG2;L>t~)Kch@sa!v<>Dr`~tjNs+l+<ZW&Pk0z2@}vpADF9F9H-f)
zc0$^=+lj%7n0<&~9oOLmZo${WNq8b`!xC;J-fYu!fhP0IA}`hq+oHHt6{sd#p)6RH
z*CO%~he07+`S5%M#}4}NcV5_o9))Zi<S*Bnz?nE`*5;`j!LfFTT+j~E!aWL9u`)x!
zN;ic>*$Ng!k&;y*%cC0T^>7vBY%t*%r^nvc*PHOzxjNi&pa-K65&aEE$?a<vw3l}D
zi1PaQ<TSit<$UB9Ik6`jdRQonh}nuPlc)iQEz%|(@CsmRe66X<R|MO5am)~jur1iC
zHiAZBW?(CvY%**?S^bOOUwpFATEBGRZ2mwL1i!Tj@Ucf|x>*RfHTy7y0;nS#ofGke
zDCF%&6cvkO5+@c-OfQ#L&W#g`e6qDQREMX+7Mu)PaDv>Q3!AWsUAA2c;6`5JJ1Z*W
z3MsPrR!3R-V#r_I%9n747u85S%!(n6j8N5$5dq~JUcCti<^tI2JBfdbl>TYWnL7A=
zKROq9myONncxc`pC$D%&o2`{eS_nakt7Q-83t>jEB5kfm@;ADMvWm0T13yQ|`TF~h
zPs7WmHu&Z#r*5;L-GSj$T~);Jk;y4|1Gf*HcyR|jly=6YtwMx&TPLO^&o1Xatm-``
z$qqWdR_&t87oP-}O5L?%<y$(Tp$u%r7}`*iV4!O&E;MyidwTI~ExH|QE$rKi;km8{
z|MqkHpuZl#!Nv#{9G~6h+z@8S{RC5)A%kI^*UF6n5}l)nP4{VIrvW*0`UHp@VGUNp
zI;`Ltxz&kct;0I`8{LOY-6EV6e#tYF($rbqf)_3?Xu$+S1m(KV8ep4A(WMa;L8M+W
zPT-1h`Dq;WW}kl4hwpk$AG%#9>ew8wVn+5=wC~-f1MRsctZ(>f_>~vMtGfHh?EpC^
z29UHvl2xoGdrS3clTb0xm(Vp?2jX>}M;q`HL^uy7Y9ai|*=abt>cX)DBdTWk)^4&M
z?M_$+)x$ULYqsIxRvT{b_b|A1B-cJjdUB?#?+l8p<qJ;Q<*4=mPOYw_?TrbxX;v9Z
zs*mZqIEdk1r4kw-r!Im{*%})#3h`+?VgeM{iolH*s|MuYzH7b*?|b2C`0>v!!b4ka
zXc53t1@F?>R0?DiP5bFRy}r2!C;NaVcd!LX8fr)GsV(4BJApR~jBNuN6w;K!DhhxZ
zo5&a`sc1#%%NUovc&7o^Wz{P-RP+kv&%sI|;_-{9(&O(3zH19Q4S>yo6Q@*Tp;Tq$
zgHP>ivF|n*rJe%olsqI#_s%%^z(<;pE0nPgGFAewmyomws$d_8Mc&tOR5RKEY2}s9
zn%06E{Nnxd@Vb2~Y_=$L)}6MXy*y(?j;#-OX5p>ftytC8<H}Wmuuv5*%Fw)jo?gfT
z`&HP8el52V;`4<sj+rWbfeKsQHVa@Yu4fn*$Z~2Uh}MU8fh^&K9Fd@dH+|i%=fJJA
zLwL`N&cmAtY>#i&nA(V*>$1mCfO^<a;1Z<^lSo+P%4;(vR<Xk3?@3k#GWwmR7rzSI
zdFOyRCtM7hw#^I2AXJ+7>gW?l-gUDFFMAe^G!T7Rl$N<92WM@f2F<BDcmqN~FE&3>
z)Um={B**7`1l&vpSFTT+s@ddm9>_7YX3IOf5Ee#B3hC>{%||I{n;3rS!Fkx+LU8vj
zM7fWgxYZMT=JJ&cTIWiB^W-Z3J5wDPHCs_LzNFPQq*a5k8iEAE3MxP*JSkCj!T}O$
zO1?>f`pLaqsR*mvgq(!})4_@jQ!vvER=d(G=RKx9oRl{US=in@<H5UMbOCN8_gx=^
z#yOFKby%oX$UIo-MmFHEo1ry{_U-fkgoQ^3$;}J5dxNmVV{-n^-y`#(!}wkd8djeZ
zpJ+}!vOKCfWH^d>{$ZkK8)Rov51qw{bDuQ%8NtL{JxW#?;&{O-Qm=GJy8D5(is7la
z$u@ZLbw9m@e)iw_4abFkczm?+#-9@k_jGr3$&X!}%%1o*C&-NH_fK`;Hy)mW@7TKu
z6HXAd6bhmndHnH8U$X`6j*dsj)$UKHJ8{W8UTae+bdjufOYDiHCa+_`qaLtOLsf*N
z`0rZS@?#0hnKoM3ifqF<kW^u-yJ@Cq7@MH1z&5!sVEr~JY)1%=OnXGxUVz)?JlOJ3
zo)k3S)Yr)T&IK5Xv(=nP(c&EfY$)7v9~&k<Y6{e9P|fw0D~>Kvps#&#7ryOj1L$>;
z1jR7EQJbJSU4wdyT=qt^NKDA4_n1SO?`i?k9JZkXRvgG+O<E1{*jXQv3^NFFZejK@
z%+g!K(!bNcwaEGUjb00W{woVGUkl)cvs=(7koDtom@M?L4jbeKWp5U=rh^cVcOzfa
zyQik3t9}rti?f(ou}DTdWeEj%h63rZs$2!%Sb}7zSG*!e64-{at*3*nPT69tFXnG-
zerK!$S^~Bps9PyWR^DWf!1cg{&tUt!eFNAUp)n<dp_fV0P6x@;_Z_>1$(fBsRhm(!
zDolmcwjGg7)oM@D1+ZHV`0&GjYYT?MDDfl%L7IS2r)svwdalue_aRlZfvj9rC9A69
zT(~C68AS!ceLYA)QM5RatF$piy(Rl$)Z_PD1V8`40-WjA;O?0o9H@IRh#O=w&_;{X
z>xC*>xLMHd{P<+E37?;wimvP|$;OQVDnKiYX(cPtxT~iCTb*qn!dV5Tx^m0IpD^%k
z=fl<%+--zy3A;gGXc@9HI#YjCQJx}f$$`Jn3gDeDxB!3q$QEq*j(lMndp;*F!o<)U
z=Rd68!VEk)K(U-vp$F*>&q1U2;a6H5rsCnv_in;MJ7mo%K?SB4EzC~L*P~<2W5zl7
zeVm1-Y6JKRP<57qA6XAHL^ALr(9@&`z8J=5k>ZV)PfW@v@*B15XaSi~dc9$j&l-Yv
zKD-E@J=uoEmJhF3SeKNnADz!V^7)n_6aZgzvx{M7MZ1mhYn>T*{>FNA5V*~_i$Z{f
zMV7c2I8K*YFp?L?l8_h3i9`_6bTefYK}cv|20xE-5El9kbrHlMfucBD@x2)ZlM+*}
zUnEOG#|uVFAz(r~a(Xu;CtK4A;cd^p0CUX%e)rK1iyWwzjm;}ldjKKWRsoS+XwcEn
zE?%9Bs<a^iPrHV5>;BTng4cg*7hZhJkY#{L^(c5@d$O(eVh!pI#MCTb6!W`bQeU=k
zkx-gkpiGgV%p`<Y07E6WD=gmP4fzdCHbVG~6LavPuXk9R_oq+v;b>#X)GXrdn8<z2
zg;fSxyBN0p5ro^i{qOc9oNBeBfP2P@x;&*%4kCzP8%nAV398qyI2H;Er=rRYvn#BU
zjZjkAnpSDC!5+Y-I-fa~M3I${QMa0t#-j}s$?Z*dF2mcNvjiP-vh@5NJdC!z*i~Z5
z4Tn;w75zB~Jn;P?zz&y*qTA+>r3GN7n;2ek>i}AHY<#=am%Zm{L-^5`Zo;6C5+xfZ
z-G33wdaSoyXivLQYAt`vC~DVk^iX}2ERtbCu|}#@_H0#uHEIiA(w7zN1NPPQ>6JRQ
z4W?=#e0F6Le&vCAn5abwF)!+Df=@3Lp`d1?K6od|dDabeRo@IZ3)+h_*2wqwfrUNM
z7tFj``pH}lx7Zp`OTUTUY|-MF2wUa6mSC$qFBIFkXr7xX(4v7SHb4}I26$q<En3M+
z0F<>7cv(M8eOm`!ad;Dc`Ne18`TP5@MSdTJXcrw4G)cfGC+sj$l=NrcACdbJ`B+hE
z69sJgJKk2Ts~)t`j@u;geBSjV_~5Ho;T_+x4*RA;cF|JbGkx6MhdubYzqbZ0ngZ>~
zJ}JbobIFu@YQbfmEVT?+Gg4YCoxsc+Kr-D=ZeDy7V46VH(?l5fnnf`FSdAB(u^?0k
zZ>2t2o2b{v2Tk~?uPm}`w}70iH?{_FTeHV3DxZFi*q?2+*y}#B<5$3I7PNSKHv+p4
zPE0~?VuE~eu`pp7VPfZ1kVBh7MWu2jr!J1^!oJi+D;;dpG*u+S7V<;Cv^71;L?l3k
zh=dH7)etbDv7Tn3jNVbW(ujn2z2F?Y<*sEoIO#)|s9UOVDMT(;L3|2W3RHR@d9y+4
z(eea>Fl6AxILJ)%chnL?F7*8xyz2G=yyxX>aBR+JVM|RnOcrZdgavtA*K5Kv4u<fK
zd)Jxb8x4`XI2D&Cq(|^Hfh@u@*x2F|QL}W>N%CcNeyzHQC92k>)2*yj6Cj5<i)f+z
zesTOf7(^!p4N+SQT=<V)-V0~8YS3^aW&ixCP4ao@#fL){v$d9HgMH=)c6?%Ut$MUO
zF#ZN1_`vJ}{EMyQkyp!V)jDaKDo@R2$pwfnjG)BcOv@ieMk-xs2py&7f$}$=L5K`}
z$E1V?r7nV6UJ;P&^`bKEZ=gbAgHo#jX*14*Y%)+2926rMMSdgw%&)m=9qzfV3tu?f
zhQB=5hDTN#aA8nm;bB4i+3Dk4ls1b*7X`9j29_9ypo^~8cMH#}LS1e6@x|sP#{zi!
zOV`;Jdt`smsj(N<q2|_E*J6(xP(Im@fA^cZ@ULFH3JX&K^ag3iizF!_{?4Ws9ag}d
z*D^?|&ynNG>qSj0jge$|MPJnGtuh;;^%1aN?9XE5m_qU599uUbAK)GLFTw*$O_-_^
zu#z`^eRBxUXl+5CXK=>H%EBypPQbYR7gsu*uC(Ti`6pQb@0gl|*R>~Lc0i_2P1<_9
zh9iZ`iw=ZQtCs|d@efGtzs1WcmVm8@pQQ4a3R}<=p@D44Mq>t9S=gG=^ff8EQf*wU
zS(y~-+eQ!5Lx_G%n%po|3*Z$;HsR$*wqSkaz=eJd9^a_LgUc;A+jC)=fOom?FeS`Y
zFDu<hR1RHGbI|q=BC{ebcYq;N_3Vm+`mwj{@!-a}5&W~e*4byHi-|7zoCDv5B{FsH
z2Q|VU40|R5_<r)3?|Ie+vt<T@w1z<h+O#6q^gag~Z4^ZqAmM9@j~^CsP<A0q_3<+n
z7LsR2Tq&cHyO$rs{pbjyVEvUx=i!qlr(n7sB*)gbO|3$m><N!3U5D%+dSUL&kjFR4
z=NZBU^0^+gpxs^L963?`>)brN`P5Tf)zXE7xHKP5q$@k4XjCPKZAe>lLpBnD!B*29
zK`c6h#X>S_dvl=(4FFfRQEO`~ce~yZ*aGMx3=Ha4hfV3RVlN+FKnJo#eB*zoCrCF=
zXrTV$(diM~JUfK%x?zjeJs1Rt0hvO0i9q<oW(}U)XuzXu4R~z50qaADOsS*tjF;_t
zABTpGlU%?D^{=0MXaL`R`vx59_;9%6!N5bw%%(*?<3GP^4Nk1r;D%Wbo^#y*uAlW;
zs%;YCBB)t@Kuj$nXigw@T!Y#pEIzKOqBTYw<Yp5ha|R-ZuV+}CHN6gf+oPzi!32Tq
z?>*IlU;p|XOu7+dY5Mj}%^p0xxk)ZM4vVH>Me4~+baBp!k}fb)v+EYLJ9dEY%yxnR
z-ZMQ7KR7{DZGV8FNkB_s%YwK$^yt(irW}szp|VH>5MWCiKRP*KU!a6~@xEh7u>`cr
zHfjORTjF31Y%yp`ED9hr)kl!JI6#iFRjmYM2(ink+t^n$HF`qnf*DPnq}Br8UoP1P
z`zCz2Zi+r{$evAAZJ(&yGrbyo>0Apw^k@f;6BSH>JBA}lzK>e0YR5aEcvjlDV~bow
z?m94lpSkA(v}++#uzfGJr|7<>smZUpd4t8tvOPieL3e;;n?NdkNR=!B^fX<(Qd`2O
z^$zGlm*0n^nPTY~qyex}-Qhr~L0fi~O4RJ68^RZtC*U1lU1aA-O{jkNE$tO{;&|i)
zapDu^&_Qy+r8SCKRvY@n)t~^cHbqOv8S)){aL*$A*i$E>BnGz;g}o#TRm>}jV2fjN
zan@lmwl%g9(#L9GD^&QxO3`qvvk~}0TLEm7ZEGrkX=7~_dq7)~(bTpaG`=w2p1M^p
zq7<^51VSHsVwx$~4Wjz!?}H$UX{KRfRQY|!4PChJ%mh5T+K7Dgii3jIaa<NnFkS?~
z__hI6vUlzu!aH8F1T&3*U1YofWxR2E9bh4GLPJat6s!nY=E?3w(C$Fe-z#|xpM1wP
zXDMXEVU9mr09s>#874m~ZWBd|WlaLnC9ekWd~grhAHdW+^RJ1TJ=*BO(OQok1Hjt*
zVK}hYfrSZLyM%3yhJ*ZH3))@g(I%cDhIdX*!awQEz})&;R6;Sa5RlklHeTw9DaoK3
zMm@-o;8Rg$YlJNpx-E#x)-l)!D1~YmD=0^SZK7sl*rJ^7x}fwaGxjGFpM%9|Y1T?G
z;>M_Mm1k<UPxlEewRm{ig9nzIY|(6~@3Iq*S_SkoeCE^yv}za@T0Z;R_)!apsKrJc
z!|GQ8E-pE>qOrtOwNvHIgc||ptqUXg*_WJ$eUkx8TQ+trR#l^r$Rh20atuu$Ap31L
zF7>Iq9tbn2(I$>y>~2rZV%^{TisvZx-iJ|BO$ynstv6UC1>Y>ah<;0RnJDiNd_-H9
zV>r0z!jVNM%J7U{`#$pjM=fY~?>J4)t)HKpgP-19$E-C=t%V{pUjR_ldWJ4ep`^xX
z2DT_Fk_<2gY=yOiOnF7&AP*JTBB8^BI<-$cJVm7z`nINpF^!dwtBAFc35uPdW_Jnf
zy?e0_&)?UBr?wjKJCAnYPYGPl_G;|8bgE51^UA>8frYWSBknfJ6Phe8szw*u0lf5Z
z5B}u%1gw(xOMm~V7cas7DFbBrz6x^ua=u%GsE~bUKP?s$tu-VyA;j-rsO3tZJK6#{
z{S+I%b12c*OAVo{aMk0YVuE~-4?I2xe|%~xfh_lCpV3%{!_F2_xeiNGSe$p^*#5|u
zP1_>DFI_D_+BI>sRSHIwxe?I4tJQ=DJF`&<MY`a{T1#om9P*0yniyLtp+U|b%d3mP
z3q~c|P~&W|TwZ_|#TNZnU2O$Xt>$@ZnFWu$lgO0dfO9H`DRH;y{zKWaX2L`1becvT
z>}`ASukT!fU%%%x{Ksc6!E^Typy5W*3oII;f&z^~x_ssDVUnz{V}SJ>7P9pc0@&Yp
z#TmH!zyQv6Yed2NOv&CfH)7#zxm|Ap$gRLe|DE=^n>~yPWU>7CFulh-Haw=1-@~y#
zD-?|p&k0|XOpsGl2E-B&LA9`UIwr|}zwg`x{FiUcvzbgXvmwXFwBy4I8%u2QbVRnj
zXU>7AU+=Ql4brj`v~A5FTrHrzS`}?{PKWRx=4R2yHaEyYIKWVE$1AqNl$$M12w`98
zG(3*6mAWl(Ws6vy)iTN!!gK{W)52WwW^o+H%am)`@Gn(~s#AYWaV}I80;YPmCJO?I
zlvV5m{vi=$`$?l{5scnu8v(rX=mxy}@FpDJY%ojV(<dk4YpV@%5=P-rH1x|wCII>j
zv<TIb)LIrR9VaV{vlu3RZtAhp_tC6j`1Ye+c=fHD@SFpE@;3*5^{-}O4^gu3dg*!i
zro|y!2+OENp>{bdx)OiC>6a&8D5-+&9E?Ok<jG?FtV8q+Xlw4(xX4Tu>7@Alre2e{
zNX;t$Oj{eRY`V-cpfSTu!OEa<voCC{!Yr9y(*1SxkPA<{&Sjs~4}@0r82*cc*c{Y?
zb|;5_aq^Qt?$+V6^9$&O=g*OoHHeZJSep-_8$sfe#q)J6gni*S>?=t~h>xr?um#bJ
z1)(Jlk|PP??BBF44v)1(a+h8dM=oHb^dT$j+ZK7ZCg7s{t}$9WAz4fmU?DD;#m}P(
zk>2Q^4^NNamf0b^>evQ6vetwzoo~Ze&Nmr=SB4JrMd`kwtJZED)J_+_s71h<9R?$A
z)Qq)65M5a7FpMjcQUCbJj0blSwf&MCy6nClFXp`KFX!Px*M)cAa~__)hd^WKXdxzM
z4pJX7-9<S4{^QQglY7W?druq%6M#1MS*060rpU)0ZlJ>E5hlMl*QKdg4U4{?Hc>e5
z{l*@6e5)Z@1~kNP(HX(*XqBbf-bhsJtp{8teu7Y{xxPYv`d=Xiu%Nv%2Aw&+X}SaV
zZEb?v>thy&m;j5P3yBOBlr3M)jbWRpk~jpc3~WW1VL|DJN^$}JnS(rx+k`vHVj2jI
z7~@djZ1peoTrYyHc|A$5Zc$F9HKih$*1uH)l7)wlV)aOO_p|m4;MsfoFd)#oFmT};
zYYlj4r3sI(H{ir(9hS-8s23Vw8W!X-0Mjp<btXeN(>PdmRicEIAmsKAA^>%u({h<Y
zJvK9d+ZKj!2T`fF%#C2C6)?zCbxR{9e*57WSnj#-8?QJ`9_vMRfo>U5v~_$<Z?QP}
zrPctL+DDZ8RGdZ&Vx=y@mo<D(6teUhgB%!hQCWHK;`bd?+u#II2sE<f!^b-?Sql|r
zBe)w~U=bO&9BabC83%kXO1TwM>8aTGRq`F4yP80BwS$(9zaU5S`)B9S8+*Nw`L#3(
zffi~~6A(n$^0+D_WRF#~5im}-iFCGt@N)uNfOvZ-UVM{bi-n$c+O*xWRstx`FRO0B
zuplR~MhD#ZVui3A5~hJW-M_R{9>lHE_qKgFH0iMvUpn>Nh_lX~B*1-WxycGfuMS<7
z@IXO03gQY-nAcl~+V0d`7wTl^Q7?G19*`5>hdmP^9GnW^8GAgqq2s|Kd96+}WCf{x
z9D%<ZTLSbDps~R(Chy}1?pS4ZM$gkU&Qksq`U>fV@4wlhi3lKA1+t|iGzv+MSLvR7
z&cV82akIo!A0fkH7zn;_Nmf&P<-}?o-uKW#Ca7gZ!@2MV+&#Amci!40``&?}htp#G
zyfiRIU9w+)`QjvKThOu!Ll<$pwbg=qr#t8<4fkRZ1#WEe$Erb9wg~eW1T3ZMf@C8U
zz*e)(vasc=$|0{23$pS>6?|J`yls({kdsjcU<d`%`L{aYit|<jaQVf+i{nxGKAj}f
z_fBWTnn%8jW}Q(Wvcw0(R<Y^*fURZ&gC!l*YN)wUh}lFPGh3it4_Q$YC*G$l$%1T$
zW^rLa8Q~qq?XYi|3s`Le-!uyl_Yp6`g5(7+8r$7oh&);Pc$#d0G*FcyOOSG*qp`C+
znhhrG?g|1Fsc$w^e)r3Rmc3u{xqkVfIanFFY(Mca2pyPqeR%zmWw`6Q28-gMki{Zo
zab%kj$iAEW<<!-t_O1m*OUF8yp1fsd7X5Coi@_U`ldg%PX^{}F#p@Wbga)R9qU&;~
zgDnVNEQ2i=lNvIx#d1cO1lw2zOVtbG#0CeHg)t$L3YW1GkRrH>!oVslmSvtR#nR>h
z7qY+=;jVd)42ZGX1YwFjL7+KV^8vL$TeL=QS%#Q`>WBJHz~bwv4D|w3ZU!Eg6a-<0
zL*dw-L(u9(wN{f%FY$VVl=y2EzQSwtSEA|tSjlWcTs4m?m!MlRV1quZLsM*@n1WBA
zno1x`k8@hh?MTOmH{Est?wY~Sr$u!z$VwK+4O0OgBESFi)d-;7qi8RFvEC0mF8t}-
zyz`O^=R=|(FpE_Tefc04m8}R{Y_t&~H49FD23c~#Az@L>(JXdBHn9Q4ux0N@^=$<u
zT*gWmd!Z~ZvrHFz3t*@WX7X^=4`Y5!@gjr-C<f{mSx(Yrl%rNzo2K2m={k;MU-|bK
zd+W6}QPeZEV7H)l;{yqc`v_&PJ7P8%@4ime>~IUDS{h}Cqgyyrm3YZPX9o|iG~rhs
znosIf&>00?IDF-iP59o!t8lRH!&Y3&A;cNGfUi&d1YAXt2G^pZ<qKnPY)`@$rl!#3
z<|d9ly`UtqlTO3ax&#qyb8Q5A;6{=*p6aK^ts}x#{Cf;r<OuZ<!Zgoa4gZRiYUJA@
zCA*8ie}v?=J4P!(T`1dWb&G|fC|Y>s02ixL9Ob^Y1YH&KD1S4$b}Q23!~AVvgRjXu
z&vLa`Cknek6s+5hJnFy~FT&|XoBuC?tn}JxlmU*X>D{HshN!A$k><OW8ft{)>l*N?
zWWVs&3oP-3X3BL5Wbc?C!VlcI0?(f5!_WiP&@+K-C_pw|m?R(XBjm@AT&?iAmOx9#
zg9Ns3nVvzv*ze(}jj@wfTvao#lEeXnjX=T2RVh0slR`9*gf?-TK=opinh0T}#9SnV
zd4Z~C#n@XE!!uR4B3z^_Ta%TbE|le{TcZb?2V6BAtO{@iDW~;uP0Ct@F3RyMQSl;?
zc44sKqQfEvymZDueb~k{QLq!Bglq{Z*MKEOn?%7W%ACjd^18F5E+)5hL9FcB5mLT;
z?Zwi|`Hq$6P@CWr$EV?o=Ub6|QxD<$kFLYtKeW#39MD)<-kBt07sQYyf7>LV;Z0T6
z-YjUx9KL_aUh0=!7hXkR`_k3r_-Nv=6$7_(V4H+~VIf^NQKf0sFNh1TgrV%SiLm7`
z3?Li+r7n_T$XW?VdC!%tgaUP2SfHkge_H{#S|2w<Hocc?@>g@!YY}+CU=zgZlDCCn
z%><jk;7Y9mb}R&G^GkWfOZ-&^E*9cs#TaB1D?*x}ko#T>l&tCTShoOXcq}axMAN1J
z+at5gCiu>STkzT=>u|I^WLb2*&`C2S<!&e`Wa&X1zz>pNpS+qC-nFJ^84CRXexyBt
zzA_rZWH;$EFDP3DK0HiIXCp|kg=~pM4qL2vdsqqg5f|5VNeW4g1jS0gv6YZi42w@j
z(MnJg9CFpI0i1;q2Dk)paW;fjhNV89GqDvCPX}kSqjD5$#?wV5Yy&8OFOQcVrGTwZ
z0`p&;M!K+?Hg~|XFh@vHvhwO32P_uzr{gMJ!!;sI21?v4Dhb)p@cH9^3%&9u5^bpX
zYmd#sLNkE3J>xt)ZF<ONiA=>}kRZ#mBtx8fvT=IvyU5%5ovR%>*CJ@?_y+ls|I>5_
zy<<4Uk(zd*gPJd9Ns3eB*@`xT1Y0b?mR81h%&-Nllt&cKgCgHH$$!F;l@MYKk}WE#
zTO1Y8L1h-o#5Jk1z}0~lax4X8@KZB!xOyKqqjF8wLIHHO;4M<?kOG!1a=8GFDO$8B
zZk+^5Ru>3fy6{<}wo1Y#5z5SZMD@$V5CfJ4hO^d4P7H14&!JxZi|OfQ)bYm9fu~Ij
z;k9?JLOZUzE7kxBHNCt-EIcNFFNK8B*8*^^MeBf%pCbp<^Exxmy(`OMI-QRTee?4j
zi*dDrvW>&(g`aV35h$G+!bsV&ItGGLl~RBe*z!dKzR02TZKZhH_(bJ>uvB&Hh$j?M
zUKjM4UWIl-o*iJC(rXkhprRt>CR@P(-ApSCv%R1NZw_d9!$IaY)gz05-Y4Ia&`%3%
z6tWtgg#`#l9X%l1(+%VcNPh`uL2gjnvh|Ro(1j+CTB`tMLCs=;{SaO--;Im6BYmU9
zP!Cx$3phz2`#t3S^(<(w?%~$~z20rY{S%XD|JG&*u8U#-#a$H;r2W0rm{<_(2EHPU
z<7!fBTb%f44tW@pAYG9oE5!tq@zm2nf^RF>0cyN$QobBvxrQx35(%MODATH2RlSyp
zPSB~sB1=KJ(B$_#)2rMJbP>+JF<jmv&~+dNq4*H>T{&Daq#yyseoX)>UIP^1XZWvN
z6tM8+(mxM3B1Mae7U}r=af<zCUY#q~G7t~WK!)cq?)#SP3lJ*RnISs}e0Vka9FJWq
zut9j2^yWqA(xu$}>9^e$drSz{N5LznYVJpuR|23mf`igU3rA=Z0zw8^@^f<Ij}vn2
z<A#sP=1{uAB}DZ|+Ywa{QeM{)V<?fLR@8rsqY{v!q7ceH9~n-5$WvrUuRf9Cd4>Kb
zD!Cmn8O8cvkqT&(|9IU6goWSLB8wma7uG9O-RG5R6&QZj?q{*`mlJuigSC==taxnX
zfis38?aE*RH;Q)%j%$8m0hpk*2IPN}tO6WWF!M+7I`aO0OFI5`c)a*e9<iXk+@KZ5
zCth$1+_${-3-|7u`?06akD`z-galwk7D4j6Bb-kr*a{DD1U1ZCvmi%abyi_3{T<}j
zRbeSL@&onXu)G~%;l&Y**j)o$6Ld>&BOjtj7oV%BZp8Ps18MCG(1SJay&<I?jru*6
z-VS*W0a2TS)odGY<5%EhRj<CaI;6ey6#tbksA9|;RwAkXGJlTFhfQlUqofEv9W;K}
z8^K%1;s3LlW8Q-Hss=4P9B1n8^n33(@~P|Vjpv?U@ssz1RAmd}z?M!q<%JH!r-KL;
zD_cdmI?7`ZWYuj3#DJykC7(}(kM?;bV0*EFi_BtlT<9VpoGNp%O5QipLQ@ZL<?|wW
zMq*Oss6esv*xUYE?4OoMOb{>ZCcyF$3?XS-E*(n=FmaNuoKdlYRlt=jgd%W}RJh&^
zX@gYs?miCxwSzR`!h-gy1+C;79%?rZz5kg<KHnHQ*RO2`2{?_)Rx=fJOt1w3wu+S?
z!4|S7sS0#JvZ^(~wu-t<;IF9YQtB2Ucd=>Pz^!U6AhVAkSqT*sysS)-^trj6kb$iZ
zs09}bbzd?MbUjkE(xR3wSq>=~VyZW;THIa)*<`a)rw$EZA!`?eii*XGlI4G|VF&JC
z>c8{p)9p9E@G}ozl9PM4a4k9i;o2KIed3(zk50Ys@pEsOoN#cv<-}PmI7t_bjzOF(
zmZ)uPa8iLN^|C_A3&UwIr1&7_2X*p%$WFneRyJZA6OdPR)yIgfa`;LN24UfXzi+_l
z$r1m%8ep#LUL!8@>zetAC%n`WM|@mfOC8ly#M$lf_blhDn!_B@{f?p)LSEE5)U1+=
zugf397L9Nc-^{1zNd2tJ_Cn?N<aM$9v-I2`f~-FhAQ$TQ9}*T-jjf5q->E(3<HQ+B
zk2TDW->9vUqGChw7|%jBt|OZ&+4#LqAQ%4M>8;-+KVCA(?n>xfV~Vy&2L(THc<)=k
z_qxTmpIi078{zn5Ql|b0Wo(0tx9V`UiWSv~QV&hA5|AJ_bqiJ|D`C6pR#sARQFC!o
z&!lio)7`QP7xJgoRaLI>wYBd-Q#mY=ddYPus|4v4nU+;-Al>H7`zLQ->Ffd=6^mh!
z04VRAsW$yif*9y_13@$ZSFtE_VH7Vqq2b?fC@*^PedYuXeEh`PFTVGQvp?PsLLUlx
zMqJH`_F4jM5oGzqEO^UJ2Y>ZtduD&=%!-#(UXnf7F<`5lkVU?&2sxvb00qEB*&3%A
z?^Xjplz7r<;FO~Q*tURM2D;-|3uWzq-0kXLj7A<fb*%M+k=6&U2;iu_28=c#UX;!E
zh0Asd#$p&BtuZ+gXCrB2(mb008)jRoRlwuXTcHadd~Eq=-v8v;e`ol#*n;-z18v^v
zt3*D6Kk2&d|9smGe{^fB{i3A}FP$oa?A!8CEglAhG!SCGt%EX)Qt85l0PiGbGRm2i
z!oWaTy)J?+WZ|q|EYql4#lHp6`@1?d2PJ@0$;Yh%+&raQ7P1ELvd><}rQWlc%5C&u
zLH74q0*W6M@z!RR3CSJNv50ebLN>!Twme20oSJYgP?V}6q9BbQPAhUHvBq>(G;-iK
z|7PhOzk2-Kf6!QU_)@^ug7(sbwhCnVZMd&dKlIM09r?3Gr*`A&mM=}e#RV)%(%gkC
zb%j+k#ZT-BNLR#FD*+6OHB+mkNZsmytEgAqR9Lz|Xcl;o&i&Q_8H%UFmF6H-zI}B+
zl!Pt&ergrAt=$L6XcsWZlIuBZ7mjl*ml8ICOflJ`Mqb*{)~H|wn*hKRx~0zotC2Ui
zwS{}{{l>W;`opEw-vT*64qr;xTF_ov&{lyg2nPne_3oISc+uN$y8dI1kLI`ffpnld
zf)W+qKQcuPIC-!|X_Nv=RitBrZ5ef|gR?=Ama!9bz(pu+=aUQEstUJ^%B`w&^Hg`v
zHrOJQn`3oU0Xx!PRcPG=8fs;H+kCcUsMCuxHi71xrdq+r>4K=DU?r#mn3EDf16lI0
z26kX&BV7N_UqAi2KVRGUIMA-+f<tksVQWEq=|EdX59QtHDYkj%^yIg{?Zz8E5_))g
zFbotGiPD%_R06i*-yMD8ffQB-+-^YHj;MLDw>s787`)poaIvh?4PIj=CbtN<+l6kC
zn%ypV6*cLIkj;5sQ3x*>ECg1Ic&M=oKs=7HCN?N*9ORzIK^)Fyun0_c0e~2VfwV~p
zbkqX}zIuM}rT0E@_Md;P*ZU&*Q&WMg4z~DWdbSp{mj<+X>)2I5OYb+nZEohZZ$5JH
zH+#b<O&2+$ibQg7x?};w3l>$Z1P4h`2vSy=0P<4m7Bqi1sbCFokx<p&r2OP)2qak$
zTH8PaOH^^ut8~;t73iv;%K^zJuXL0ZSroBVK<gIhtO7PuQ0o+6gYOCk2UNHZM->$;
zXfnJ&2rq<m(W~aU@Tn6UAN{%Gr@y}&1T;x_0_4CrxE!$EZJ@mtiproI>%atFN4TH+
zv(@zv?XB02eBXh+KS}%Hcpgsb#ENYhcwRWAE3cFlRoLRiXM~6I#SI6P=8#zF0UZ|)
z#|YGzb+Pk8rYMY1nJZIGPk0HbhoV?rOd<@<Y!k%xJSaW5c~+I9DdVqgZH?q@<oc(&
zcIUd!jWtTO40wg_gctt7n(ZOTe|`cq<vs8kwG^_UpM8I+U(de`9f=I3)^sHk!zkH-
z<1SCZN<M9#O~5m~$d2i4LHOYlOYiybXU_kGhgn~SX$7uD4TKO}f>1B3XfKYU&097R
z?;Yi56||1>xZb^c=HKvx2loA3Zxn#<3!O(1FW4<BPOeCKCYUL73v?-o2xVeyk!JBr
zSLXmJwt+VE2pNjZm^@ijP2ozPQMCb3K~z;4f3}R$tzs#le5(Uhu@4Nd!MZSb+1GSX
zYCY*C9yWtr_j`=5V3Z~fm;sBVq!|-n0jC75`wl#IVRZa`PoDkJFK=!AG5J#)lHfE+
z&Eg#U;G+7q);hSjpxv%zpaNF?TlXLBU3~jL-n;m(Hb*`Lfec#&O7wslp#WH3L{qw&
z0@6eZAlU=fK~W1^(WljSQOV@xBb{Fhx{6^~?+F{gBiRc&OQXc)vTR(g>VuZ@PEmy;
z34~IWWnMqd@?s4cv0|6xlrhA4s=1Idv1%4F1VO7{qv?bRuu>=&>pe>T*GKS|=X#%i
z_leU#a(Xm+L{PD~BxrT8-Ej-Sg7(sZ78zh`iZalFR=v?NdhOoDxBi30JwHm7Z9tA@
zB#;aV-fapw@!xSK;UN=h<*0B&X_-aP)nL#7*HAwJ>0qc0_sRz@NJ$oYxS4*}Lbw8S
zb?Vtz2cW<!t?cQRNxtAGd#Kc_HK=A>0-U7*6UNF}lZLHkZW#d!a+)_gQ33?ZtGM@D
zPc6Ok<15Smb%Zf3*xdvvk=Y1ZL-MfEueG4v#h@K0URLMHnjkB#K@VQNu<+ymbl<)=
zcRgQ*Ehr&i8g<L#WYvW<Np(6pb&C?Xf$&^YdTt?b4Ov`c16K!d9TXuODyAw|1SONU
z#!Zd@s1~_UCVo|H^N#i4FMYOEfvW)7z|(*g47D?KfK}^w(9w0^kqg7ee&OVqH-2N#
z`y50IUPuGkD$4evS_l@jmlm{DEQ2D@x{Bf*{lh(rZz8uh4txSztcPvJN)Xj;l9h!d
zHR|Z5^%*sb)BUEK`YYSeSpa#!MLFSQst21s7iUy@A#n5Z{z0kTP!@_%!Q(9xPm7c@
z9~qW&@D7@cW#Fn5@HRnK^=3hcBFF<Q8X;I+!@=*LS^MDsURiqoTHv3K{n)?&SrxQ-
z_Q6F}wHCA&2ejj=S!WE;x`MJD-aEJOL$BSl_;1L5bb~OEGP<-@0;t|Cmdh2IYRWn~
zzc%R)n=V%I4h}h9tvY2_EAk^#d@bnXc2xzMzAqW{U{cW<aOXkSR3;FcpqyhXl(7bM
z?-h@8WNrf?SouZ#o%+ADHUgAUuZrSU7sptHi;uwDK=9Ygz59Rj{P~}KsNeg4<ROjt
zxDN_IyB$@#V_vNV?WF_lPI|Mh^0WAR_nyw|>;Bo^18+q*bbTC1bxY-1rJ98@FsoZ_
zYONyz2PHx6NQk`>lO8Y_5+e*iEtSw90@}$=%aLd)fO(sc^ICZ-w~YEMJLNC+JT%@W
zjT!zs09XFy(x#??FH32odKIuHB`5G}5%pzz4xCyEwtnxz@&`Y@w(@}?4mSlaR)lO-
z*ot0ln4@N~1?|-V+Ht&DouZ{b*W&yB^QJm~=SLO~ysha#o5NObB?t>)s=5^vs!82C
zZgdL+$Sk%cJ<H-gCal>c2;FZX+i%R&R}6H@)!^5H&W4blgB6P*2cm|OgL&<~D%CDP
z+c>gv{(UEwa&ewLpzHwFd&`gFuEnSV$WyP7{h29PYCH50EUkv#XIC~q^?Pf}A2{g^
zABHr;%P#;e*V6%Hs_d4s5G-h~aM0#i2Tn;v>lT2P|K7i~)qeiJ+;`}w_ta{OBkT+6
z6=hqU0MfuI3rt4?vRd3MkWUwp+VoL)tn2cV2}}Fg*bLI7PV-7G>Z}ULhMh^Z6rdm;
zSM#mrEw+`h7smR#>9Kf+Ky4yQPPjh>tnbS(=5U1)>Qzjh=yfsl*AaYmz4zDuWBL4h
zo*WGxh+o-_0V~4QS0G!~t1TPuWkI`(L0ja{s-Sfg`=F|t6_u<ATKe<g`bP6<Z`^zE
zr;aq5M}|z<Vof|PXzSXlc0lr`Glj>=3)Z4EO|hDNs-n}3GQ?r)#OjA<v7urm3#LW1
zBH%){Usk3dIT-3GXnscqPd3j&&~CRZ_)rPRRybU7S+Ew2AdLLjFicyl7r_-kUgV<t
zjb5M!J%G)148uMKA7lUDpE>^ev)+iR*tP&y5wt;pqBZo5$XytN9N=yXwidLP546rU
z{aIDfx(Z}DbiEn3w(mz45B%G^C#Ie~pvo3u38E%-D=SPSH4#Kg4FwKcH(r(t<Csk_
zWSF_J<&gA*!s_d2fUC$vT|xuO_|Q4P1$`)4`nj>zpGBwux+bVr@pj9=)&N<Y^Bjz~
ztIeW|Df423G;>S}+XAySAnrHMBMNp4!`21{Zy2?$X*viV8usu1nX@N<EPl8SvZ{4Z
zMbYYf+C0$ih^n<c!!8lGw+ZR(=%3bl;IF;w+{w58;l}DG>U55eo#e<*(j7(hA^u%#
zEfUK8oDx9BkMq6Qr^AuDO+Xq7swaL9pKdZvxQIL!#r>i%vlYY>m-j9U#U5A6DmL$f
z6$-yo-%#v)%8NqdP@}YzuBl;M=QIonOlZec-os3c^@MDBzT|A?+fdJ1WpzFIIGR#_
z;x=>t-Slr^_LkcV&7gF#u<tw{!C;8keaQE7m`?qZzGT9`g+gU5HarY#%NWj_!mxTF
z1b;|35VAr=F4@qZZ*6`OM=;eb9P5s8bcxQ-t7g=$vCoTk-~h;LBF#sGOvm8Ym(ITL
z<Y;*6AI&d*Ujw=IkXi}+YAY_3B_|h7$}dJU{B)_A{fOenFn1t&KA%cb#ma8A^n_#O
z@le`vmxk@olaei{v0~OJav6AIKCXyy`rddU93&_ysUs`Mg=u(3k(&5`h0lRd+LKEy
z3?s(*r;B(fV~wJm*(KJhVftCI{1_!F0OjeYJiA~U;z?^OQ0fu&>Id=n2x+w}`W@F?
z9Dz4f8f}UhXw+sHgs{E|@bFd(M&vlT(dj`A;biH*Ne+Vh2fh36>u!9S3WQjp?!c!S
z``pA9w05YX0}7@)bl)~Uxv~1O6Qki%KfJjAUmU16_KpZ_odl}_RK+6=<FvpC&zI-G
z<G>X{y106xCti(16bWgV2?;S%i|nyZY9~Y?V<_%snkr}BQisodT$Ig&=hq9~TvqJn
zEv{@!)xvPr!<C?`DpDlFCh4Jwg}w!9p)p-`F}2G9mivF<qA5?&1GeGQA_1_TFLyX#
z<p{~qRIg$79rQ;CMqV~)fqiD5K)4&i@&<x0_a@<UUI%Web>UlUYvh2$(nXOT9v@j-
z{-0q~d8@8~)(-2@7Eb?7-4iZ`M_W_w`Oo$EXL|4LsnxH4{o?)~`sRtLXLzA6`;khS
zD|w|K84JgxeyJQr#?>u{t(f1g*3D&>Lyh+~lT{T~roG&rNFJv=CR0ZN>HSr0v;rzo
zE1{^4g2t0A>&qgPgT!&;XiESWaSt|DutAt!T<HF;(+iw~qx!TEL3TJ2>|$Pe(+gPy
z!IK+xqEaW|FZ~X9<T>A7TY_h~TT!7-p@#Sb`6B;lbNy4lwsh`Y@$u>lx3Y_2)}y_~
zK?{%{bx;MgCdlfd4#b5q@kU`AItaDzoteM)@6OJ@vgM!}P1|*pRUc$%MFTqEX4>JT
zpVSc|6B1RdD{vD3;;<810V&G*oXPf`SUEeA_aXbw3KUHXVE{Q{W?;xL(``csT4Xpl
zs<`hsjRH|sa+$d>GFT84suEyPG;3geU1d~MZP#X~ff)p8q(vo08Y!s(1QY>@8EQ!B
z?(RlXAEX3i1c9Nu8wKfd2<f4_Q^Ie2*So&;t>?#g{_M5(Ip<pU+4nyC+_Cp{oISJ}
zjtkDBKKx@rEA{&q@t0eGMtKGi^Nek$P79YeXIiL-YwtYVIO4$GAXpr^g>iIu?h(p)
zb*vyGK%eD5o1Wyf9nq<HlOTy_9xxi^wY6+roWFvd^nF226#mK)(`Pa#-xTUn(EzfU
zWYLv8pRPiMOR%$NUk8A%+b*E30tW(%G*8nJFBc)1e(@0dWM1HMf#-`@sBVLDjKNdC
z5mQ?_3*XGbIqD(U>Q~PQeCIsPkE<am@6sbOMWn<>pV18VY2~4OduZvy@VJYzXYih3
zSYK{`=U6D-u^v=rlugkG?cyq-BsWdHZGT1pn;i0uvPow7A4g4v3I%V7rYxy>No~J;
z?YL|5ebwr?^$mH<#lyMZg-Hd0$L}7-rt{=lsuF|W=7g&C(R7dDu10zN5}Pr^pQ$>R
z)##FYppZekux3kDS`1D7vpX_n8)YO^f4RM(s<z1V<Oyn9grmBIsNwAq{Y%r$o>5iF
z0jRF?c&(OcAm2a9Pt7|EEcwNiGd|}GmKoqtt{G^6mD$(xZ;EC+3E$@&k;<KYi{4Ha
z9YY5C^3)Mr`rWT?QJ?z~rpPoJO}ZLUF+<>u&GHW#%ML9ECRM1-o=`-OE0pEd3VVCr
z;)awewdtfX+DB7!qA;6vR^xf(9J%!}f!kIryB;!R8tbVAfKuBBR2GpA^$jGtqeiVr
zVc9xmPu&O8lUQ=Hlc}Hu^9{sZU)REvyFop*9<eTfs6Ryt#*KHRWtjw4&!?r)Y83YA
ze5v9)`nw>3xvA+=?-7YCr!%R^Fss%sVc{8BN`SddEmI6K0qh?clV=Sk)qC!C_>HrK
zchyL1H(P?UfJ`)TkoDplAksM+bHg4w;-J#C5y>PLmH|B><uV}7H>JO~l(B7vA@oXO
z)Fl<iVX{WP?AGj1n`CTo=_C+!$8a!<pS87bI{H)OunEYL%$Sgju6K%zWE1pG7StkJ
zLuJA0JOnycEDc?)ug0De_BM$lse?$#gg^bj_R_|Jm72;z&m)S=!8}|Wp(@RW-qGHV
z+OUx27aS7RR0fR+MZ-VfJHHe=6o|uXN8!nWlQl1<6sTbuvAqV$V;!2+RlJlpQL=Ad
z0`35bR%^gFk{L_aYN_8@9b<f|r6WsA?=u@0chc77FO@55Ij7*H_;x?@Wi^N1Gi|TN
z6`dHC2abKG%Xv%wHaHJBWj`MgmPE?<xwP}xSImDZ*GlH_YQLv|wX|yujJ)?T`<4Q1
zBKzuzU!UDL_T6F}T`!y|qQMrUeJb)weg{QuOcUKGwukqe6g(ff+HaH!@-r?K*`s{7
zwT(^>tJ?c6Tj*5`k>JXwwtzpPC=I3Je5f`7x18az&(>qEoEd^WkQWaa0JZ4s73OcP
z7Y!JM;gX3QI45-$8(+!wGrWC9{PUx(5~tleH|a$B69fnA{0s@EJmu5j2IA)-+=)V@
z52Kj~h}Cmu4Hd5;1ZGw9hxw{>K93Hi?Zg+iJ{L6<6NHD!Yw@~Ae+pO~v|f>s3jE!=
zNO#swHA~R8u1#fw)F;F~orL3S21MdH2(Og13JKs|4c4||5hIukNiusFjijD%sHoR&
zzY{)*<qM+Gs6P{%85{Gb4?hKIYc>$_)Bg-4;D27GzCvwBmGiJxMC)pxZ_@U?Y(b3%
za0n8xK%1b<ZJ&%1$OyX3dx2#fDryrR9`KC5osN`;K{P7K_$Dx9DfyUKBcNimJ`TA)
zmqB4n-fN@SO~%14AEN2T9k~qkfG?OX%scuyNy9Ka2U>dk1`JVW>Kn4**6Tu{0~yRc
z=D0mv>WT$YsCMaGvW_|-Ne9*oab=qg%e8Cn^?!Ulcw)ChAR=eDGC#SWndaM5Y)QK>
zK4ZOqug_&0cQfQ^pMG~PK`-pAAENxRl3q|Gxa?;r$dJ0G$wmSaO$2qt#f9L$4f&^3
zzi*)7Wt}{6ZoXEj0_*jv_C0C$Dm-I)6<IPY)sHEzJ<HEUsc9f>bZ9H|PV8|t6D>`l
zYgWm(_|>|^8%fM_;xE4qgA+4#n-A*w3@%G~NmEwL)X&U{dxlaB@tf_}$g!oz($)js
zwJX1C^IwJw#+t$H@sBnt-esnzdRl(IJ|4b_%{MF<wjE?Mbe8V-m;3szR`qF^O@{@y
zV=mA@Z`!uA*Y7i6cn^^;A+4MYgSF1GHEjPQlN|j{g*??EiFGD07U!&bN9*vefX0Li
zB|s3H24rZ}0L_`5QU7Jey!w6rymqG|3N@wRx`Sp~?-Qht9BcckN;Ogveu>91@@Kz5
zbSlue0p|S#AfX0GhkPJ(uAC?#*y{#5z`>@OocQ(OO{EWz#i5fEC<J+3iOS#?-;=}E
zYPZGTCGQFmh|0kt8_v*=>_+)T1~|RC=l9Wv0<Y%ZUippJ%n9)3gb+_dpe{#f>2hZ=
z*7&Aw-(iR*BCf(@(R>b)sbs#3ZvdaVpd4VjoE|5MWleLzvu+-{^`DQ5(8p2AkZLGf
zh$7S|K2_{gPFHpaQ{PO0u2?7q1dn9xNFU8^q)MMoqk@8NxUjq*$XEzUpR|(OgwF?P
z0G@eGHd6#P^La;t`f6NUtb>5h7sXn*qn#XU6I)A!E_l4^I1-<`n9K2arn(SXa{kN|
zD0U`5(l_y-7F9KkX<2_}t28e?-gPk=*XU;+un93zY-O`aD95X2pCz?8_^^c5Y8Y>T
zGk)D@J#Bh>ovM=P0@G!Vm<l55H5*B^9d(uS%#Aff7w3(xHA9eFjdV}c;jvyqv_auZ
zg~CCn7`La{m#aP7ECj*ztUPn2u^-NURDeP=Bg$JuR`M0fnGPr|W&Lbq5j}D^)9Eh=
zlj4_Fx&PUE>)^4iZN*jbYc)3CvhC{gR(f-})3fzQ2O<zJp#BKu8UploUca~gp1E+W
z(2|Hn%@c`?Nb!j^ed2T@-F!Z^i$?qz^R6D4@aL1X$0hLq5y+cD<I^JVxS~5p_DnEG
zgb`abTOmCyR3uA}8-xc4tu4JT?Pj_Yl32zYwEI=`#<!?DFM>A-zLdE2;}cC=zi$=o
zkRUd_4qFP4VBE|!ol;5Ok5)vj>4Hj@_3^%JZK$aQ{glf3)m&CAx;`B{cAxcQ<a#be
zogBM9RMmMjR7)@5jsC$Zhvws1xA8Kvbj9Qx*Y!8*)l;AwJs5W74|Ut|v3NR9-OnGw
z(6QB>KgjhsB>)}iZF<tBr`Y+MXtMdCzfa!v<sUu7HChKa&)1{wLDley4J6sy)3Yw?
zIj2vUicZCb4oT#^jYV-a#av9RIjMOPJ$lhY+Hw9+DBbmW7Ix0)_-A-{&W#Mc^K;P5
zL?D%uhXbW|3dwWzFe=-Ar_4m}yf2qQ8r@>6>ng9o_M*pXnD`e2!kUD#G<wfq7Vv;4
z3p6BE;#~Qu+w$*E47HO>4&fTuy5;NI_|9L6W!!%jZo~F<db6)tIapEk72zCqRUqdC
z3x2gX6|Zsi{^P7w{o25JL3kUQzd~@q!H9v8$=$<(cBg;Eq~B%Zv#9VbNseo_8czga
zknEQ|v9ue#tbRCcZMeeI(kiNy1Ggk{cRkzZ1GroYw&?TSZY%veo4B6n89^Opz83_;
zK8(YKgD?3=0AtxtTXEW&#)5W*7#Ol!+ZS)Q??)BWcdT1@ZRHRbar>rA{%Q#oz^nyh
zBfuJ9&og<iK|8dtFjsAlCK=%_>>1h=-Ls&>^ri6c7yme?Z#YX-cos-sX&bk%p^dSn
z>8`o6C&+smO0ouDqwqIPVp5+@VT`f+Nuv+?H1+LCrk?$>bI7PL?;oNs<~8k8*5R1K
zQjLSx8S~|VmCa|}N=mooAA<I~7hCC7k*{-yUP~Vmbkoyu;~HKcRt0jm8NA2#r9X0>
zc={6?MNi>x_*eIn9IBY@h2y;Z^Q^r-gc1LQ&-zg5`59$+-L9<r*&>yB%y+nd@7F8K
z{1f_3>`0s)10Aw_y7i65GI(p*?#D|xC`i>MFR3k@nB1?sW?@%(F^Z$<TlK|-FPVQ^
z^HJkkhYYdJR`~rv4gBX%7`o0W?ibDAr!rMx*C1$X*r(Tj5yL}v=y&n)*C4@bvQrbf
zAfI%r+RJcjW{0}6KkM)M3g*W?xA-`fifr|y$jPTAn2qY}|I>vfmK?*k^~S+HF?)|e
zsI%nq9mmIk(AGezCn9NeIyh#T8w9D6L^l5b_O8}_=(M8%j0cIs(&IZazCrERQ$JcU
zi<fjxATk{ufZ=zj5mkt;%p_3UqYh=+*&tArO7ORREHw)K+VBRoR|g^^^*ovl7FB~W
zUEhz3B9GpyME!24iR?PzC^(SRb>bdf1%9$oM5x6=Xv4UqXp)tcN2R67>eK~lwRgoH
z4*z-$rH=Rcx|v(!%=JdL=8?5OFVE6ELqvr%31)W`;fq`hNb5S|a&l+GA=EK~3xvDY
z65Zgg>9cPk<3f2T+X$SAm(8&W{xa4c8w~x8EI*n{DM;%KH@9P^(_-FNk0_vbSBHkq
z$#Yzt+6#X@Z_zD&BjU|KO=t}Bwt2gz@;yR?U*{_39^qd51HXW^;Hgv5fC*mM=Daqb
zvTTu8up`au5h*T-y#Dzp7;`haC@H}B`F959u<wUrn9>`+Z(7Vf4D@zLl`pAm73+Y>
z)pqT|Hu%Ra4?R{p*=9dz1`v_tRIF8p(>+G)1FE;rPnYQ7c>_2>dZrf5&Fb$l99X}Z
z^NfRf4VO;LPY*b#Z$9UAOF0y>ql+Y|tI_<(fFPXKorM+%eyGH-^<Sl^e;`BPYr&XH
zW`-aKAydda?cfo8v<cmZ*+|-s#t-%G;|y6(oTX&<v!CxI4xe^8$4ffkA8)q|;}W?A
zmVu@^Ou+br1PI|PoCCrR{n35t(G-pP*}`OXbRzc~%({n1?}^t5(hkJ8l3iL?uf3?$
ze7Z1cKi|^6FfFkrhU%mpOKXL~OYrdN?8r|2tlm+4UR;^nT0uVemXeRJ^=AsRP%c0<
z2qPi1q32zWgNSreZb`ym_cF&%Dxj%iVccIm2;b%@zkr<H-mkm4Uw$3v)pw%9cexND
zw6J;V;^e(ta*%Z-u-`)yOq5dvszvp_evgNSnChDnka_A9>4InG@68l#Pp;0V963*1
zS1H%4NErynag(*=n}hB!?4)Rh>*(>;s}#%Y^{}(wcMo#hcQ`ehR9BajB5!}PAP~35
zu1gn=HZ^1{b|Pd(I!@ffQ?`^f(hxkMoy{0J?`|qn`wCJO0%J|x<+vFS^e{zNd-`Ox
z*t3UaC(1#@@b_=aVDGS$j_LxZy?nR)j1Ks+UPIW`2LB+3zKaw-{JV&W4r9YdqQ?hl
zGp3&4aK?&A^|{N6IDMX#M(t8n^;-3dvQTXJ+b7s-SaA5z?}7BUP9tq=GLMGfFke_H
ziM{#+uATXuL0@Wy9Ykcm!tt+IX^KzS306wTN-QhAx#AF=YKO8+yJj}x)&BncD1I_z
z7O`jc;%Jzn7U4v3sJW@>G3Y?3v_%-=p>>_v&HYJ1kv3&AQnrqeZ;?I4jl^3{mo6-M
z0qF9igj}4QNF|J%R0?+h6U?6+?3TniezLO~C`2M65@urdl%)Q**e-eU3{X6o+74~{
z;7^VH!&DdAn&TXzo+Fb1*j&@DdL?px9x1H)YyfBKt1A;HZ#Qb^P(5GITyM71Tw$}L
zL|QR3UX*5T=JTVW^)WO2mMDh!Z&BOvQU#JuYeEPH<4f1}Yt|5&d#HkkR+MgzrEW;0
zMK}3YpJ3E-0DcR&x^@PQ4{&;<(WJpfpwrR9&O3Z%nG+t!c!SxV`Bp41Qv$G6+#7iR
zHfx#RyxLzSgZ6T@Yl#y2d$n=lJ*O7#6b2_s-jk*38gQE>>G*<KG$sHx!k<jjnFqcb
z!LuZXs)BXcpR)F9l*p38P6V4`{HG0xu}=0BSThUQZ}4!69rssNedO_;C)AZ%cV}Dt
zFlp$^82H-u>{e75A<FFdjEu5(nWGh>Wz2BOf;hjWwlGFVFK5lIOs=1kU+$L+pYN4V
zTntUwx~)#y5YvRkLYvCFLAo{M*6!c49qj#YQ-`x|@k6-asj6${qJ=8hIurduz9Rd)
zFbmy7(X&SQvcbR$5}4{UPCN2lNH2CysfXmT<A5rV)yEYe(BDXs)!Q6N(=>=<<$!uw
zpbZXZhjEv6NBcTQ+eZbhR97iGJF=s(zKA}|*P{cpwl&M+iUs5H0}flCkQu6K$9R2G
zEuPgH)E+dK1%>OmtRNy<2g)~~W!}6{`?G(1T)@I|FEMHA0Vul@|30O^`-Klb7>u^i
zJE$ospr>i67yN8Dwygc2VtJnAuhnR4W^1X6YR0&<q)K9rdCU~jx<=IdHi{0C)p8AU
z<T!{}cjV)w05we+L>yEy^$Mo*F7u>~Ln;!xlj*Km!;f7#W=TI;QxH+Y5gZj+$Q_-6
z*0I8JG9Vcf%RLsE13%hcv<xR88Jp-$4Kr^TYTuBpQIT*8K7!a%>)|yUbz;pUg=A7%
z(>9cxb)=I2MM}PMm+57Eo}=MTj*Exi{o|)dxG?QQ-vf%|o%@?222fJKZUqD3Jb$QY
zaN`MtSG>CncOD{>dWCp!NgKdR_mjEdExH)H69k@Ni^wQ&{Bh>40hne)(QF0x1Y48C
zvOw97oEA6FzwCdV;^IFNHysWoEyG#NaYsXx8~WQ5cd8ST4Afz<IL5CyHXQLB?(NcD
zH=~0A3>~Z~A&T^@A0v1_;%DMb$PM-1WnTE=tlNwC0<f7j#eppBiIouR0nSC25Cd(6
zj5{Wzzo6_wTSLxX$Wt3E_Zp+~L}B^93+l1^LtxEAD!w{#vpa`oNbSo;M_?5SAE&6x
zv!Ih90kGkMhIE`$fXX0ewz76#5bmQ1c!s325M^Eb>ZIH_uWjwqyMd0nlByv*1^Bch
zZ411EM4gAScyN&wSf|~JHK^O@ghdpMY&}U!f0qtE5A@3U8RwN3mdm}_aFk{O$|F(B
ztC;|o%PW$s1Hp<pwZS@IeegWvCJk4IV3Ed!({Ne`uNlEdfc<B9u&0TPJaMgPLO+j?
z1E1y(i+bZpP(@uZK`E1&oX&+Cb8vA7owA%eBT7f3LZM?QjE}c5ae#A<&7;|nHL?2E
zCAlb~7<(}_68r?_NWE5!TS3&aa#tE7#h(CIhfip01X^fs76(`Nx5pR5Tq15wq6kVO
z$_T}#ab_hCQwZk8oacr`cvB43ClpaduJw35g0p2HEwDCNUxHWA+k+#kY*LsR&)a%1
zh=DerbK}I}N3H_3tOV&&5tPzt#e-Xy$9iu%VoA8rh%&k!Z-h-jU$K(r^y@tNEHW-j
zeeEI(-zu3(=RbI!0PhnRA6;+;@X&>NOUz{6<{C%m=AsC!3}3SOVjD%UCk!&?p9cH<
zbb?jfW~mpYf@|O(ohE)PJGALYa9i&+$YC;oCY0f-p7MHF${C~)1Sb*C5Dfc!u2<@4
zApFx>NHtNLcWTg`%VI%9Arp4@V3(7>DAbK{&96{8HUjlmV^GPzKny+5KAbUCx(W-d
zr|zx&Mk=w}FcWF!6~g2>ZHl$f{}q4l!7BeHJatEBu*!dlX;WD{tnz=wzo7mL{4c2g
s;{OZkzxe+P^<UusAF<i_CI~=?V{>38zrO#z1P6P(Qc!zQCT9}*KkUUX@&Et;

literal 0
HcmV?d00001

diff --git a/browser/branding/official/content/metro-about-wordmark.png b/browser/branding/official/content/metro-about-wordmark.png
new file mode 100644
index 0000000000000000000000000000000000000000..496d769da996e7f78e93599378146601a1e566f3
GIT binary patch
literal 3751
zcmaJ^dpy%^8y}NXcuGBTh}N8%*vTxLA(_KsVT4LDGYs3<CUfYCJW_H>jx~pBh%$6=
zDy(u!q7ag(ltYCggyNm&eR|&akGJ>t`Tc&^eP5sN_j_H}eO>?DXB`jN$jhqA0ssJc
zf-RmTvMHiZPg+v+Pq-=FDKaV?D|e1F)0Y!QW>EnaK1^>ah(IU%QAt#?Pk6{9Dh>bu
zYSCQWIqpPzEQLvjlGia%E<ISp1^{s8++Z>#kjephQ~hWRQ}E2)MlguxV+wXNBEpHm
zmQ;V5Z3K(z9C5&f5)nwj_<+sLKsYW|BtWNf$RI8~h{48kO~HTZVnyq9Hw+B=3&IIB
z1^+uKccLT6lF6cijG%@F6gUC_LZhJwlo1+@&<7#m2qX+HdeH_56xIlhMeYIp{eVT$
zSU$d365jgnSfZUN*q_4*#=>A>VPViPLnxEw2SZ>mm~{;#(m;eTV23j}WUc{&t@%>{
zPi0eBv|tX6$pEb@lD(Os98<6;(|?yh5B^7%!T$T0L<a`rl7nFgD15!7pFkq<|3m5Y
zf6#0WiTa;>|EDn9B|Ml4BT?DRP!>hhIA6{6P{CMB7M09lvRs(Vpr5Dc=+ERZ+5XI6
zkfk#kw2Mfl&=~6u$X^U15ldjOIb;TfO2C_fMH)~V%?FD{Sy&nyBCHG%XlsPXV65?b
zFjjb@J#cHZHPRCQlZ$6kLg`cn=O@?aKV0iya@U7}9xRHCr?P0rsXo>$CLQ!w(OBBA
zbFuuT-rroGU+04VB^M@22DaYX|7!J5muP<0m;Vf|X!FnLQyHRpXNd+|tF*oy0NAKP
zz+1R*2S0giOh0%~WjIVD>pU5xp^y?o=;wP&Bo}yV7wsC<>(JTpq7>EMO}+Cc7^K-9
zm-6|}mEOX~U|U7o-5K`HF1Ff^sM95Kg_|5D{uDdytL!y4+|am^+f2T-#_r0EoPJvW
zu(7XNx${M2{)vUv#Wk}%nf5wFg%ag!8(M%=A?dZl-n$SvRq-eVV>M%qZ-A$gLBL@N
zPsu#VVWT+P2RO_=3|!tg6=zEqcExC5q8NT;<Y!N$Y5hifgXl$5Iqlc^lfr2ILW@L_
zul#2~d9KvZSSo%?^kU4+_?Mi!8?q(0#`(XLnmBUiluh<H*2@b&`XjlcN9`NG+gj=S
zs1W4E))3@edkxvC(&|Wk<#es%mM(aVCboLN@o`LPbd@P&YBnhx&st4g8%zh}0avXF
zno@jKZgyG~C`VUsaAVNBkuu>zbk!4KGR^~rSarC3aiK@-b)+!J?&wj8dtS2X3E=I4
z`CZosI-RdQll8LH5cJ!&UOanuncr-@FG+|SiTQv`E6!z%z1&M{3#kIgHw4}+2ot|h
zR@ErUXz!UXJ#MS+<kpo9wbd3Qz3bE8M%@FCwg099T~>UJD6NU&Gur3XZF0sP_0F{^
zL?rGyQ<06?kEsl=6ThQ=^ps{7u2On=@rs?tMT<u7{V$WvPF90YEZE%MR=C6|u)~t0
z&Mxw#c@jJe;M{RGT<4uG`HYjWR(MEQ9(`<idJ)(F@Q~#JI8vTKox?44Hi~wtQc<U-
zR#HQ>Ts||sFcsN($B@EKOwtcYNTTla$^o|j_twDb17B)<h7i0F=}x0gc>H)2&f!ue
zCiaeoF9}gp@6iZiI<P`?fu>O;qer19q`0yDHY~=x&hK56$3Cnw%^f{*9z5za1zxdf
z;5V%(O1YTzA-V%#S_*x5j=Oc@F}mBYmLezz7Q2r&$1ugz_Pxs+mSRZgr7tRr2aTC%
ziMNEjdMVFiCb@|x0zKsr)yKWG9k*3<QerS3mvpYL@llbe+?CNQfdgaUs!K8+Z@TQp
zNO)Jkj?24}4_O!I+I%Du44dkpir3BIs_qg|y<d2RIvMvDY+Kx=zo!dAv5K?>P06_c
z^)&5Aft9EaouN$A!gw3j117q}e&x{4gE_VzM*!>?iaH%1dhEfSl8WgQc{A_8DvK<u
zskJ^ni3nWsylG8>JndOa^gud9N>&LQqn{^#ob}F^WJm;TU)&;R93eRQyH)5>sZST3
zzRJeyRgsFcK8(wBJ~Oeu6<wn49_B=FbBcRO=(ACFU_bLmW}a)1kaPP~7iq6o*xeq^
ze6O0dJgoa!8+&WaSBk#r5<X!F;8E~3uz>g`H>$F*(`j&j?+Q$qAD-ZW?v#pI@mE_?
zaT)7Z-jp9ezLeVp_1aPqz1Zwo)6GwNdf0<*RCw$}bdsjjqYR%6;G9jNL$0NFKH+Y+
zmHC?(R8-c<ZXKK?H{)Y!-&k$>a&07_op!9|>*U$nHbJFQ0qRrb8)?9M8}u)q_)5ty
zLv9`zozTSoP%2P8Q%N`X%Ix->c-gS1SM&qDspe&=!)!o$5#XRO#LQ)Bn7*~YS4ZU|
z!K<dc3^#)sjD!wu@c8K7_(kYi*cDXJ+rI!Ud^NW>iSmizy0&IP(Rjh1ANp=2tJ)?V
zhHt{T&DN@x0R`gi0}WC+ZmVW8+=G*Q5YhMJmJV+}(f3U*)ZBMh$6N;Bs!Mic1F||R
zYQ~EKsMtHXDDFtR0~2RB51zY!a_7q=2~TIa)jE3~I4S%A>6EUP>{zY+3){=TE2Oli
zs70Sh{-cW|>;D5EAt2?2E9_|+S=EUP7btLBqzj%SR?!hi3pI{p#j9s-0%Gv(9kTk)
z!{cUEIYmQ_QWF_6b3TD^U9fCw__HH!64mEV`_^}t^S-3jj1KSH!mHnQ<o%)MOpM_}
z0AES7&hgRNGD;%kOw*B-*tg``Af-wN-`%xn+DTJ*UkK9x9^b;UDAdhFI2N6kXqGe)
z>|r}~zrX6LC;8#?ne1_#Hn<*(KZ%%igDh%IEbVNaZ;grH-mm=$(Zf%er`M@*>u>dJ
zv9j($*;pmrUM32`u2=z6Av|rEUrli)N^Jg?mtZm!&|HMt-@TFUjC=MbAqyA(j2&67
zw|(VK^v<}p?ky{ANiZq6O(LwiWXr6Vg}vDsn*5~&*7RHN%neQ6w~Z$9wdb0QPhW3x
z)BEk=AIYO}GJ5Kz*Rh~Kzkq`EMvh&j2UTnDAEOo5wZ(&r8)RdDdw(`yqqMTlwTpTg
z(&4o-&|;!)#>(z4hMgvHD)!z>L@SaytU;LiIw@AEeK|5_8~ePnf#H(H`}X;oM}i9T
zy!Wb2H@vPsxlP{qw#jVSVXwF0wGm7E*u>zWW5n3{hg6+7$F2+4+oRnj0<IrXjnp}k
zg3hhS*b_cVKS!P**CFTLmDV|=WjAAZNAz1i&LX@>(LPGcP)o%%x8f>8f=PxNBvZ}g
zH7m=pEa*{M$YG$eZr*({n0!S%Ds+LkKM$nnwx%XLQUnYgh!f)OcHF-yV@@bqg<g=o
ztuC`)BFGl;>Koi;KV$;@WFqra?PJSiSpG@77j54K*Q)SX6vT7jJZd>Eyh=4JbRWdD
z67Eu@++whOM5m;uwr{8MyT`AeBwStvUMN-i#Ok=^iFp&-J+aaWdNCBX)qxS*hFIQ=
zo`T0`WiMO_oSqeAI$D*vJWxGmH(LL@*4(|z13EtvO`=9}w4ldh!Nda!la<eRt!O1u
z##aP@h8v067~ImPIf#|2Cy+PtJlpT;O^bb5j^gSN#n=TJ^_BLW;Gm1EzzHK-{1|;?
z&8Elp_*99OTfH};lAft|e86W^z}I&l+Z@qZb27xT;imG1`^J8A?~bQD-I88gt5~im
z{O)~mHLY50rUpujqq@42Plb%vEu@m~q0(;jXx?M=_?MO^2%2yys-_*#xX;^)!`;Z4
z<?QW{Nu22e<HVprkJkCT+YV+ozFtThm`r%3qw=}cVCF*rl{a$fp`FVPSAI%rR12zV
zHzK9x1L<~sUr2eHE`77Zmk^h2v5&M!nm=TN8y%85I(oTspz~M~WiAhVD6gQbJHFKN
zz>i}4QY9Mi?a|J8g2H*FezmZ@J=d=ekEUABZKWA_4u&Oa<Uox@)t!}l%CBj;@<3^>
zcl9~nOey^ocj;^mx$kfynWv@kY^X_-#~-?W`7o_OY-n%E+l22`x2C}PUzbat#m3Ca
zJTVko%#(E-$;v@ZrtDjBJ*v0n2U#A{T(Z8Aph&PYZ<B0?MOn?$Bh<7zT;BhIkY6FY
zxM|Cd;%o_%PU_Fg&bc~mkSet0Pmj;E*Q>M~H9jsqmp*o;G9lgS=?8W~`jd{{h1C4h
z=Rt>T{%CN$cQrq!cl;6Qae8pj&8nqIf7tUZ<th_HUe@;0mnMnouZ^5)oyGh7%(R0x
z85FNfgG+#EJEm}+A3gTfD=#jsBB0*v%#K_65e@Cz^&t}n94;TMlt()uxr@yT{-_*X
z^Jb98{eieBqeHo;W%fATGZ${?Z#Wdle{#Me`z{1H#<K~9FuwRDnE)pIE;jqrx#`c8
zCac}OzsNugAF(%q$^Cf1Z}^na#yL0d$(r&IbdgE!4V2lNtqYQOd>~cl+Vr&>nv=iG
z__mfn$t&4RC;~}Fn@c{wRQ%NiT9u_6;LYRbsco@VZNjwvIiF{sGxwX=z5SLY)g|wD
zo@4V2c>S`wGe@i6M11SbIoYAyA9zfXjXAxL6zDL>{WcXj)+jCq09z%W6YO~4w|;db
MSRKF%_IaK97tR-uuK)l5

literal 0
HcmV?d00001

diff --git a/browser/branding/official/content/metro-about.css b/browser/branding/official/content/metro-about.css
new file mode 100644
index 000000000000..70c5c73b9aa8
--- /dev/null
+++ b/browser/branding/official/content/metro-about.css
@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#about-flyoutpanel {
+  background-color: #0095dd;
+  color: white;
+}
+
+#about-policy-label:hover,
+#about-policy-label:active {
+  background: #036fa4;
+}
+
diff --git a/browser/branding/unofficial/content/jar.mn b/browser/branding/unofficial/content/jar.mn
index e22cb11c088d..3946423387f3 100644
--- a/browser/branding/unofficial/content/jar.mn
+++ b/browser/branding/unofficial/content/jar.mn
@@ -17,3 +17,8 @@ browser.jar:
   content/branding/identity-icons-brand.png      (identity-icons-brand.png)
   content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
+#ifdef MOZ_METRO
+  content/branding/metro-about.css               (metro-about.css)
+  content/branding/metro-about-footer.png        (metro-about-footer.png)
+  content/branding/metro-about-wordmark.png      (metro-about-wordmark.png)
+#endif
diff --git a/browser/branding/unofficial/content/metro-about-footer.png b/browser/branding/unofficial/content/metro-about-footer.png
new file mode 100644
index 0000000000000000000000000000000000000000..8e507f174085347b918c8ac422374613713593be
GIT binary patch
literal 95994
zcmbTdbzEG{wk?Xg26sy!xI2wQ2p-(M@y6X95<EDB;O^FV0|^$~U7Fwy!Tpkb_P5`A
z=bd~1xczHctE$GRF{@@(^;$L8XI147m}sPEFfcHfALXRgU|?YN{(ex9UQ>)erFgvl
zkhsa{xT!l@x_O$q0AVC79L<2#A3>&8KsBJLg}3uBpa={MytR#nj+>5>qL8^Gh|TnG
z88$DF(<>SVMnufZ$<*8q=tgY@w6bvk(4Mw;(Nf!30BE&&l{l1~q=42oay~9VbsuF7
zb00f%K?_<jQECw{p;rPB(9M+E3uN!$D&z&A{THv$>+#=Yc3SFx6>+lz(EgVw9VJz2
zDMuF|H7^@Ct2qZJCp8}*8z&DhA0H<RH5Ugb7dyx6n~#-~M~IhCh>M^4-!IzN+FUFw
zh18^F|6SMX8GzQ>&CN-Oo!!&Zlg*Qx&C$h*ol{Uy@Gl1!7wc;YR#$HaH&ZWG2Uog(
z7^H!&<}Nl)ZZ?h%)PEUG%^cm`0JN`4|H}lBlakVZh#g%2-B7Ph#_nb6#Lmga!43lb
zwd-G{UES1x|BsCSv9zm(w-b<E4e09V?qdGhAC`3gfM470|6I}Eg0E_XR9tLcJH^yq
z+R@w{1axrwC=H-}&0({!u@I7#66D|#<mKa*=HlQJ;N%qG;*yY(;+B@+<CEm&=jZx|
z<A1{POGxqaa0v)-^7Bb^a>{T^NN`FDNC`>_aB%VSb8<@lgZ=2>>SpR-4*aKHo7Z~(
zjphG8Vuhq!fTnJaE*g%G_WyW*s<oq=qpP)}6Sb5&AN6}BQ*#@KzX^<gJLtdcl?J-l
zcmOSAT^vEw|7u|&oBu%pkDxRMH>a!&HwPEbKbA{MNec1_@JPtW$Vk)v8*A}@(`xLm
zV%Yz>$N$S+{z-cE!M}(9asJnn{|q0X!|RxFc^w>an>qj(Sl9O-r6n}HmX116Ti(uV
z(%-H}t=u%v`8GK+eJuK_@%5bo*uF!qpSXc|iTHM*f8vRkM*)5mx)Yk0u}^8q;guU~
zx+HF%S{K>pV9!TpZ?CZSR)6l~tGwFr@Uk)F#$`MvN_cl=!9jY*R}=WQ)!>W1v6e$3
z?j0BH^X+Nivuj*}8ZF5$Ia#i+=f5%O?ohub##p?igI#+4dQA@E`>(u27!cRLa>TR#
zW|N>!(ErVr<$9B=^a@RkL9kBx{{Us-8vjN5AK-td{0C_9_P<g71N{F{{_nK>N98}1
z|7iJ-%6};TG2*{#`T8G~|4qw(%&RaftOm1R3ahw%?Q}VgkHJYN#6hOvU<=B`$+smg
zg)#g3-LYi8qR}9nGL2fgM_6n6&7kk0^_1^d(fQp0zk(Z5w=T(M!M0hN?Myo0wDVSd
zvQCPc=;7+}FSeHJ0hP6{DzE0TqjLc4QJev*jtt@*aXEM`%DB|ZI55hBZ;)WA?C-}(
z1#0cd;#eh4gS!)*zMkfN|LHrrLF9!}z!C;4<)yN3<aLA8X^mrh;V%TF&gL^EJ-9Mr
z0<vTk*GZnTPu)|MEHmo8$Sj?3E`xIlKmxz275;Wp%M#M&a%`9lGK$6xy3~p?J2{Q@
zijA;~k2usC&utMQA$2=sKi9E<zt&`$3=FLB9nRn0lfo#jwEn19B{j?xv#m4%zrV0%
zuD70xT(-75PXVVRt7nYr8l2IUp23A`k7}*X81U^~!fN7hk>?f{y_(G?#Em{yk-n%q
z-AF7)fsDvnGoA}&`o?Ds{B4(YSTy@+=U;A-=AwubL_zD}#U6b439dyLb=pH8!NU-4
z3KrHf{uGtN7oqgn!x)wxJ_ox}txin}mKMG!fz5zS7Hve0pnGbRLmjFMSp~HZ7uB;h
z9J^CLP#|{1l!eH>hp$Jki<#>%`oOweQo_0)+T7#VQ-_qGr4rl#2jvL{L82sETN+eH
zPDcn`JT;kQwk~Y8&`I#+@64qWs8Zq{f18;2&yg;uOd*;kkfZ&}0oiAui+2<V@{Yy(
zH_ZFzWKrIPtdf-w<Z}PED<r;qo+qp8rDJRpob)$}w009Np|DGa3QD`-rf-6ZXUUBd
zwN(gB3Y$=1vg{5K>IwZ*#b-t)l5=3%mOoLC<^WZjj)UPWEGtKn3EofN<F{+(9@gs;
zMZH5IH)Z<Vqm}!83_pl`730QtVU<4futKMOupZG6X78bhi=@!i8*UM<eD?Q-UzwAa
zeg3t7kvvwP<c=A=onNZf3ry8R0Nh#$+{b^9_B25coHj^Y_n}gll;c~IRS+JNhmTsF
z7Lm@XFOvA2CaM%c76s0r7E0GtMCf_P=M?a9y_{La^Ni7yRr+ij@uAwM$aIJJZifM{
zxYThI_bSAn4tOvgg1^Jbl}=G{C#|mtOiB>AE#OooUwG=KluM+b^2^OSGw%}kZB`Kq
zJD%kkE7GsJx$p<0kJ90emD`ol<%2R=r)TpJr%!OH@o2HzOqf<2(cB1w5%m}vHr&1k
zHS0-%Y;Apk9glJ6=Rbs*QsDmdt<<T}JTNXDt-A|{vg^Uy@d}3hYmm#v3Zocw{o?6e
z-aG&FgRlW$A{f-|4t)<phLfuY9w4Uhv>mIt5)6{5JcmjX5>k8`CPUD$!5e3L)AA8Z
z(V0Wu>uB29U8hep!@c~MsC~3Jw{}<(YyPS|t#P%PM}AOAoN@1r&L`M|zCNUC;g(pK
z`p_gR?F4xu)v}a2|KcwUIT=!2^8*loc_SAY!*~sCPDQD^%E%mtj&1%rNw;b4F>lZu
z7kz~c&%vQiHNPrL+I~Bxfd{Li_J!t`+QMigF)+2TA&;<9<>=_N&!0g;g+ZeF_bCmL
z49&3=-_y&VZx=M0bgOr|#Hn5m9R}`oy7&bURY*Vf4|}5Id@^9AtMlwE+(a^~T9+Wc
z#uCDat0$jmGBi2HDm1H1Jr2&_tW#Z{)w%1G9rzKahczqtB?yFBl&l0z>o@p`gq)G?
z%>>XAa&lgrS9v0X;}1r+lV)j8^(iEWw<pLYQs+56y<&0m<pbm1UZbe;XTrl7tHaW;
zTP*uEd}6blv6{;=OgB=kR3Qq+uTlX?<+WqBulH?9lRRA`Magge$cRSxM$k8MY?SpJ
zSIO)sz{ip*DdHQN@e7yPquCChfkyouhL53M@rOXyFF{>l`-{$sj#L9%U}uei=ojhv
z3~YDdvGq%#&N~D*<2GmB#r8M3{&%tdVI+=kBkll=ho^_WF^%To&~oCE0Ue5Wm;z|M
z#1?|-eLi;KFvk;auw=1pTA6^EWkMFSny<v>sSA~QYl$?z+kwg`wOl4mYon;a^MTnt
zN#{!Y4VUrmb8N6|NlHk@+mf|_T&-)iIdek>$sryQZ%Lm&VQz^AZ5WwFp&liXl4W6V
z%TDvk=FX#%0X|}X=$`<)IqF1F_7FL!F3rx#^V{Pcq&jbYEP6G;^l;9$@oqWbtOrsj
ztdGC;RH+7f`XX;QNSJ|>6EI1!u62*%KaTB@ImhtXzoxBH@b4NY?#mkM_)hD_-_0SA
zpL>2R$g!G-!-N`G`v)eqCplDDbg(?D-U`<oC|)qI?Wb2afENwI>CaCef6toQvv4l4
zgsiSYiQ=ZqfUpMhXlBCvM4hoI76&<LLxXZ!k|1gXKJ{3UUpe0%eu`g(5(ExdRzxp5
zE=9!bZT7B+2cNFE4$QR4Z!UARyOJslW0DJY;FYKtbq@^*DYl2s`B3anwU|MWf~!=k
zQS-<#zX0iCjXb+$d6VUBMow1avXMPZAHIXgwrvmKLn)tIR*yutZm%2v&i^pS^V{jP
zvbUkVMuF)b7p7PiO@N?dT}abV3L<%*RyK|a1^*y{NHYs?p0r{sp@{L1?XpCtIWDw#
zM#x^J{R#-T{opBLBW`Oymq<BwH!?>8n@=N-j$Qb3-XB%6N(8~WSF|Ef7JgNrL34dx
zA*SVSkW%Dj1<~HVF_C>s^K1-^#MC{|rP7+LUc+f;X`u0Jczf75vtGnvd)d+q$%WxF
ze2<5+%W3VH+f-N0COh5kX*M1k>2$Vp$kEjKs5{*oXy>RCsJvW<XF~(Kgkaqj*QgCQ
zPsNbnUjiI9ixh8~_4KbEu?+w7U7pCG)1GB{PJGS-Hi`F>5k2U=IsWLpx)X+!ZVNFd
zM%-h2=>gDL#(m!O)gB>MNob0mlVaPU>%Qfn_)|2T8!Fr+h(iwvCYqT0T4D~~yZd5A
zUfTuQ)iryNm!Q(_V-ItX2Z|;EbOCV|{v0}VD8flVW9BSwpcwb>Q|oJ&4)^S5X73l^
zzl~X_Qj$rPEJ}7Q7og9>JjAU;g*H?4$N9I9B@e{hTrJ&(dK9>Rdg??SRtn;SU8->D
zU<F3ySSS!Gz_G#&fwzU=i47L&$4zVp-onmF7G0;GKKP?Ig=C4>&VUofEUCloeojfK
z`$({TfL9`cU!ozAkiF8m&199txo&9xu@8C4NPw*X{g~WBBw6UA#Yj)Z6|J>9#CilL
zj^F2y)E&cIJ-N522SA8XmtYulN}<aKg2~bJ<cYHFi@`L4Ha{ilv-&Q_3=e+ylb&QG
z?V`l!Gnty1&0`$_{80E;yzK%lRj$~P0gvmWO(&tBD-&QqaE;pIUc#_PD%1O3*vL(p
zy+#>5^+hxIY+j5w!1W5ty84bwZLz(+nr0tDMf#-67PYY{G{twgg=)paUgq{1h#fq0
zrDE7r?J)bHE*eNqi%sZ0dEXC#++i8!q^<;97`1}1x3=~qnY}>?tRK>=t|2q?!A^pK
z0I6Z$24B-cQ+}evgPQmKOLVEWmeDxMRGo8e^-V?7jBVm1u({YifSZOgo<G~9!KJ9}
z^R%h$5k@8P2bVlptIlNAf!m*sL^z)2FB5Ng4m!tMO}@i8z%`;yKrV&jNh%qi>5hN2
z>rgK2y$PidK=V^$3wND1I_9Vg>QQrX>F(D0<d>9cgV*xMlp{Cku78nhjGgz>>7+|W
zqdXxL1yZH>@Tp3(e}TC}4{>VR%D?y!z90v+*aE$YBjR!q=I9#^zI&~E$UtU6ch2v4
zlgg-0?ARXJblU{YVtB3ylKOtzaMRpng8}<i?DqAZm2er02Agebn02?-l+Y+r)$$K<
zh>2qo=_J?5jJo;bMyppy^4z}oP)f)q(ovhkwIfQ!i$cNL%U3||I58@e{_l*Sz!^Xd
z`V#n|{lp=ybBSrNk2=|<fQQYu$q?yq!J#|aoV9!oriwa8iSf90x?ysgIA+S|9XMsW
zl>fmR*XaWF*wWd1+Ku&Wt3lUL6eXho4^@@s&BT|FNQu6JzX4QU*+B$f(ko!}4vul0
z=!&O()I!D!vr&G!Hv)f~RD48z_B1n`8~LFJKwQ)dOB|#7QoW?Uv5t=ECxfGCZh6=>
zAi=|iJ$W(}P#$M`gZbdRNfGJ12M!IiDn1LWV!aXVd!r23@^{L9_#NY`9&rm4qUs7R
z3XZKVAZEdyRyw&sYi{viT?I@WVbnH!mHYy8z1S9R%N7m+RcwVNZ}@0tNP|%u7gxrw
z&_Ps+8_Ew9j`!GAF?quV*?Y<QabSyBiyGL7U*eKy#@KHWu@T^}_rqpe-GX9afLqSQ
z(&$0j=A&`!`qr>uRaq4G4eDE@8{VYimnya=WxHKfH?6%A4qg~cd4X<*dfeQr;4~@g
zXLNEN^()7f=y!Gpl}C-sSW|sy*A#+b`o^yK$d0Qo5=&KGjdfFk-w{S%ufKw>!^s{L
zr5;Ix_dV-g+^g)E35V&nWd=84D$*;r5qj9!lys^sI62g;U9M9uFSWd;{f)-3IX)7F
zeUnQVMr2u@Bq_3-p9;}%jwpw(nRpv!isK>a8g%^~WsYbyBC1l~c6jjpdnsc!gwYB5
zi1(p$jSJ9=%+%rTe%St2?%gw1$5x7n=>f68Eh<%t8q8maiAhRnSRzgY&xb;rS8JQp
zx)qDX(WRjVY>}}M;TqLpWG5}CH7%zOW^LT3`%UM=u|6fo^}i9E@c!CTL2?xOBnUVC
zGSO7nsthx%1{-R;l*K0m&XR*#I<_jR>w>>c)X&oMwFj05NzjMlF;i?QA|N(p=jMVj
zcr-sm?AJeYL1vlW+=i5l{|Vme<^5!M5p(c;0%VBNLz)Rt?5)xzZNKVKK}h95fFZMO
zzPA&taEEI(9|YpO1gN#AQ!{<4eN-#g<opD8?>atlx;*gXkqNEO4{C8XwBs|zjw#2>
z#|)o~Y3vqif6{)eMdZ1DgH&17e70g9U!XHGRX$~Hf2mqJ>qG~80;=gc{4pkl*ELzX
z*}N3%k-+pVrtqgE7uzlxN(VRS%X%ZZ?lzhZM*UH6(R?x%8K#Sk;+!i!0z_wgw{50Q
zl`faH7_%<|(T|ZDt$Hd6&JQne&k>XEOxc783Pw~zoQG4L5+C-oM+KA;z?5Ua&L-mS
zi`&+GI2i43oZIW<E*w3`tUZxFW2Y4z6iVEd3c{>1Yy+`;gDq6EG0?Hu7@RzuwBf4-
z*XMr~8cKP?b=Q%FTJj4?O=<~+*iKOk;Azm?bnlOm>3#(8LNWH)BcaZcYD$(Yk|&xE
zz%zbacoKNtt~qLXy7GM9VLoZ!{ZQ<I|LpHy_wwtli3h>=anyp&gZ@uuwWr0?TS~Ez
zEdM@T1Do0JeSlx9;%W2Oea?q?r5McP$aV_rbcd}NdyusQx+EnUb++!W8;5Z_SWXrr
zRAk5{QT!<mouX;0AtM$c+vF-#n0^)Hy;BD8)$kGsZ4TY?{@tj>k2Hgyb*4g?KOE*(
zc-wTYOB~!hKO`<82MgeE=rSPfz2Wl7LrvXwiQ(g$BU`95f8%>I`g=I%nf&^wa&i;o
zb&zPT195`&Hfss#Y{C^Hvjyjgk|B-IX0oop2`nyQocKK1IiFk#iu{3^+h*CLnx8t<
zSQX6fnR>iXu3Uf|yGLtU_pxo#9tW<r$A*RtyE-$8tL~V){xECL#$WUy9s<2p<@gX#
zAJvBN11FoeVJ+(_Kwv{u3pEJV;q{!FxLs@RP#-u2-=v+_jKVmpsdJk(E&GI}gkbp~
z)4tI2eDM0-opWo^xi%c>8wxO795okjK~Fb)`WUw8tJ%!N94<?R)2yA+&z*qKX2()r
zVDRq>WPb*m`|;H*)f%!5t~Hk)^J<L#@m4R4nk4jzKR#+5)%e=kc>|0oqs0!kWY1RN
z5$17BiksT+lDN>S+b(*rJI=#n#J-R3CbPKy=_MaA!z}tm5_7x|t2J=_7We+x*HF(h
z$5%La+O{H^YJNQBdvt!&B#O_saG!c#X%1Pv)bMw3$JxRRb*B>n_pIt(&x_N81oGtq
zg2MQJ!tv(_3C}Nya(agz?~i9cp9caO9PKCT)Z?A+&xQ%?PnS}ai9tWC={84g)F1h>
zts)O7wCSBhGQ^e60gT=Cl0*{kaTk~fQhgmTS%fj{1s$OBoZ6Z4luMubenGm0f~)f0
z;UUCgUrmKmy1ITNK1}}9#gc}DZ)6q9!AbMBh|&N73+@F-S8LlE%=k0<{wHcPAemq%
z3>9-NxMIJiJHeAsEy)1rB{;1fkW#YXBFtI)m=_?n407KjsyLUBH%#E*+6Xq@%(W<)
zmT8}rXf;qJ=xVE?hXp0gtx7f5MXdT-aqM|;1YW~&wZ`0!Vy!q)5bo|w>MZ9TN(|9;
zNxCu<m#Z!6nl<>=EJu1iE_<2*t3p-$ZmA}1z@I3o26CsR<#n8p0F^aOi8V1B)y*B0
zHFt5oVu`;tK4|Z@GZgyW0n^{b@R>Hk?o9|@8l$KNc5x@*DJY?n0rYKZ{aniE!!T;g
zr7Fb;Jlav-CtMZxk68FCX}PDkufVN-i&D+KvS?rwSuJ*VqR<=wwzU21#`4RXNUy|T
zk&oM<&_sj~8=$UG#Fud$YN0~bTxV~FU84@BL7q#e)ZjXl+#jFk=+3fHB;j3drx5aM
zJ}T8<79z^5W+(hm7)at4soiyGeQd`W{OqQ;is3U-)8iO#9_jA2`Z}?&sY;z@T<Y)E
zJ5+@Q4A5a5RgESG*%Ro(&0j^A*aYe|21xl2`~oF0N#xC+AW3ilU<S^{9`gCLe*SrU
z6DM|!P;6CfVxdrusA6SKF#F49f!rbQYP<e&`9|OCdU(L;`gZ@RscfHW+5Ks&15`q_
z@g|O)p;qayH+ipogn2N!zjHJvY@c(6mly4pH;#5E@6*sllJhlMB(wtA2(hpa8v;q3
zxG(QyJ#$m5ELZ0^v&~>ZnMSU#b{{0ob4@wq*niOSLZ_nLxTk+xMs`{v%fLB)&liT}
zu$^NLQ+k6aDV&xE3(f<^pyuQWxePv#VtR#ZvFF|C`;YRyhoO@iKdOyo`QD3T+tWkP
z4NtdEu(ol6yD~7cu^vytVTH$mPMG&m>lO=nqh@+iN96Pa{I(l%LlTL|#jSG@p0jhN
zWx;0ynn<@LP&*zp7cDLvj_u_dV+;docjbO0=!b_k%UM}d`Fl)zHD;je76D25i+Bfe
zmX2HE_1(b~sT#syjsJtb(|GgxgZ4g4Kt5!`(66<2xp(b~3t3O7Kadd=^)m7csj|;y
zQIdb*ok393&o%@WqOGXPTEgMsj{~T-SOP{jp-o!Y=6x986mGABBT}sKR8{8PiJ}`)
z9*NsOYD9O*XSVQiH9n?|athEKcL1U(XdzcEHBZN7@xVN!xUA%%7Y^MUQ3S@!gC!dj
z!N;-zYmYNC<zU1!q_3^ht|eV*NV9wuYBpg<wfFf=9NtGZ@sU(|b4EyTZ>})@WoGz@
z!z{)Rt#J2m0aPv=s$8Ka{guxG?9&SHZX4cCt#aen6nO88mb?yn*lCU5OXr)EHGZD$
zBQTq$@2BtAu%n`|4z1*@_E%^QsFC9Sg8yZ6Sp$Svp&2<6Yi{Nt?BdpKAmIIGG3I0U
zid4bkz<08mfh@=iC|1hz<YDqY|0$TVGoVVp=Z)|Du;)l2#`!?yuWFat3iC2`UBvdF
z?(aa~U{;#d{1uU>-2sfYFE&eY{A3>O<8x>>N0mTLRr^zW#PB*1WiZRP)xC-<Lhc`k
zmI&|603_5iN(AJ$l!e`~&@P+OG!R?nlwCnbAmJQWcIh{yF9|*O(PY6Eq^W#i{pq1M
z)CHo;I!~dc?!yc*aRZi|$urRP!kDE2+1a*OqQpd(7UI~LSz#2eP85vR{>sJ%m|#|7
zxBX(u3m?o4SaTiY;Nc;jD1W1uFNOlzWx2D~xXX&jmSHKgLMQ&q{CUeK&<m<As#(3+
z*+{8x+T-CwQ9SA-v*jgSkX*J942W`b8MrsAQ3$gT;YKfsxT47UIm7&R`sK>)4s-nh
zbQ-wox$djo!}R!YFRAa(Ru=erA<^{Hto3Iw<Fkdya2*g%LRka~^Tjs$-BWMq1h)Pt
zOl<Wsf^+LWmkt$=kbeytQ73rqWV5Y|>DqyLqpS}r)mndmt#SXY1xXLIc$IQ6LVT~=
zyh#%KEo$2AlIQ};6(mvFbmDj#bv3ul7IoMXZFfiSy>p@-&DB-~bccGRQq4dos}DUs
zH~f~F&K*&@&?yF^(hPz@^9`pkoRB#B!GR__5f$5+(aeG-lO_Q(EwN6+0Lc(%?~Q-h
znS^I|u3hUeBXv?W=Ggnm=fOM;Mw0@_j+XQVCJwm2O>p6teFmO7SH?sHy>tQsZmnUw
z%musIj~~CwHkrhS^f+&1%x{p`b@LXLYu0~$c!7?ixT!qP@Ix-zPZq(=*YM1)oh3;_
zCZFA$lrV&d0#d}Ui1>UEG7;**r|+HAmv}z}=gi8eU&iERQn|3g@fUB})*HZBb|grq
zDo+{cL2vtzz$sJd)jMYyeUyI;S~5coDc=ixXMuW!Ys{E$;C{fKA&I41sw8^*W<@h^
z^`|{=e3=<(Jc}oR7y5^au<ct^jLBpjLr(%DXHdYZ6aFsRLh(fXgtW-<9JZ*;7Lv3m
zbBH)u2a{PGa)R<(cqJcQ)3yjQ+qMnI0tKo7%dB1${?L<#D;Qq6q9){CCsemZD@AB=
zh$AC>)in&>yR2&vvWlo5#`JPYiuBf;27g_BV?L>})&NtlN5deFmm|(JFMwY%cl91$
z8{S}}B;8v=l<g;R;T<XD2pVwHl!BSeV08|9If?wXyzVzFJWsft<3UPMM8+`H6CDQo
zt7%7uLU0=AMY`G8B*@SjV+NH>9`Pu;Nz*QwdV07*skWBWNn-9Cj%)3q+S0CctoqRH
zH{_%rb>b~$j_`*V?oC48I_Xj@CRYF`2|c)>c?JrMD%bNrIXNiBVu{m=m1hcMq97z=
z9Yhp5CrX>3m2H<!qMDu;2B7|sWhtY%Bnb=V2~$R*x#Hh=$2OQ-Xx1Sb0?r>i(vn7X
z6GxEAE&T(Q-orr=Vzj3EGDt$>s@av9P-n7Ii**D(a1J@GIWi3m{)#iBl1!7!Oh7#(
z6J?;qIR`fix3iNa;I#}A@EK6j5fR>%X9q9aH0!YzNavU$OQwp0b(l<Z=XMb^XCB|i
zKzX+#oY=<>S}&i`PSZb~dJ{QzRsOuyK<w;)^Zcm&QgM#`a_sn0s7iQR24Zf>41C>b
zdlDk!$F=kShIPU}ifdip5L5&=+o{<`Jq%-K1GQbOZVy`LriOp1H2#()OkWzp!PBBW
zZ~v|!=EP7aG3yRajl`_YU_VD$uR2h5_nNmcPH(KY`dmcMj%WK6Ga>&f13|juf}s8C
zQVe*lJ;xr5m3=ft+MQ1RGc)nWehPgZ8+$GiiFHSC;X$1R15&-I>c@Fa|I`Bndv#Ch
zTPl3D93R6mmFmcvMhq~H)=x@f;#B%@WHs1QB#4ppl+S7rPFXOF3YAC6GnkpeDL0|Y
z{2PsyX|y(}WwAI>CoL8wAphX;TA#vmX~P}U@*I$&Z0a6>YLx@X`|_(crdDzsG#Bh2
z*nnKi2EC`?I)VwKsIjZNL~DB>vUBe#j&`U^{=mk5rgHiK^L$AZ_+YiaaJzT8Cdu{{
zF)fD3{;lW|(TDh_ycovkGHxgOov6NYd_CaqdGQ}3I_YIkY-wA(7V*Qb-Fa9YNBsrv
z4DD^q!zx(PUd#DC@C-S$x>GZz$mXe6M17SqZVX>z__PzxTT|PEDW^Z#-1OuJDbg`z
z;w;<Ans5Z+MvvaOTB5_i@YmmXoa)9uXWR%z%}_n+pr7yZ@NunDf;~v&5Jbg4!*u)I
z!N@nHm{Mr%l{K51Ne#;WJf=bM3dfj75m!I(B0E26>t^Et@X1Hg)#kGo0FC!_m}x1O
z1W*S2z$|3%wc(Db;Fipqf<90QMVy1C1^hNWzKMF!rY{{HZkqQMM!)y8fL3?hK%Vq#
z-JB`2V~ew72<@8aBA7}rJsYBmRTcEQ#3AW@i&o!%avOU+LXRNuVzs-2mrtvy-*%6F
z)OfC5+y0rPkGV!9H)5PLeyjRqK6YY8KkQ@QKMh$CLIe-}t|u4U?^a?v<JC#wtI%z+
zXQv4c_5o+gymS2hL!L|+RhnT~SH#r;6WbpMd+mc4S>p2k4OCRDIXL`+d2g(yr<(tK
z##P~VCh6im4mux7koT8|83R1BOMniU#;%D!g-d{Lo&MGohu6@@Y2$%IhYFQ73bC*v
z_fxFFY&>~H;y*tky3`Q{9_OXq{O{|ze(0K0mrZJMnt9`{+9JqB9_~e)qDo)s;y#$s
zLNAC<T#>9vxmFm(>I@*=bC&&eEpr1~m>&{YiA+3ws*j)yG8}Z^f?tH+nvjH(F+%1;
z=cJc>+d81SQwH8WSgf`ZtQcgQZl4VGJEFvV=3gMY7gUc&ba=vC>nW@|aPe+jUriP?
z5$kyxo&i5`#QN73gg8~{DOrf*#9({i)s~Sp$MXrmw;qRhE&FvFu3#snRIY`+%etjK
zTr5(r?H*?yVM0nlP3_YQA^D@z{Bhnk9uNV2oi4JsCZ%}kNs~WsireB<P;nuBwqoV7
z9zuO7KlMVG7;hY`l52afpKB(&1}%nxpwUw0X%~T>p?=<ehHUM(2VFWRw3bS~J(mh@
z?t$04#t5lMQnCu~Wus?I!cvCeGjt*m%Lpnaqen2BnBxoSh4WrKEKWH;Bmv&$!q!fR
z9wH+w`WjSgCNNt#Z~S7X;kEurQwwygE|0P#H9Z=}VG?hvYl~B>D%7E$7eE0S!|7G^
zO}LWHv=DqzMrAM2mR`Go2dd3Njy)(E_d@*FZ@S>uAMw`j9GA#$fA-5Oypw<1QyaJ_
zcVx(pF_>v1^+*Tk@XXsNp1hw0`yHlM^!QMh&(fl_jr(B1?9YGR9=Znrk-ITC7iA;2
z;e;ewx#3{<cH?SF$58wftT2HC2b@u^4t{(kZZj@R>><BHBr@G~rc>Brw9wyM?78bn
zG}pl7<qW&TlM&lvbIFu8$eMqc^h!1MW=?=N3$H2C%8<vhW0~MtJo5*c;`%c4jotv^
z%g{-<hKx2nxBv_EjbbB{7C|QdYV+m=#)4l-$!o0y@x!K9(SDc@X*DYlwTYmmF!_)H
z(pyPmD1$*21&um3Ehg_f4Wi_$V(f#{*iAt;eTZ@?Xn=1sFe<J$*{BWxgN;#Q11EQ5
zE)lC7)szJ;o@LGf=G)$!XF)CYv8NtS$l-t^>AKNl#w<FBxUBa%MGo0mKY{g4si-v6
z>$ER67*0184KAU{pd@IUSN2lhhk3`=h86OZzq-b?3aPqWIJAl;W-r#DVz<o47z}`A
zGFrQIGuEUUl55qh;*o+FfmL~5Hva@1!)6*7$Rc)iKvA=;Wh@mJE6L<gLoC*ml#;`-
z-$^{Bp*ZyO07#J4%jPX)(!Fw#YxCg_YL&_0ZD}@7!(n;5YCSCG2oqu5%BT?xJ3EyP
zuqL9XP|9BKbw9RFn(c0^4-i)G$f7Hm#p@<r^8$A8CI@#DNGoVHJu)i3qIbA2bi#5%
z;ViFD=&31N5S@7DgEJ`?O*vQ+2;o|LuqcHk5=P=QST}RYnq{e$`Qq69FE?+0<~(ob
zI8=efI9eH;-@X-pXrfqdDE9i+eM&%tVzF#g1$+CfGkk7<Xi5Y>oP;IGoQA>VaA%}!
zS<jn!F+NwHUU74FWT5bl?>0QIXns4j<hQ?N{Yt%1Zh!;6*juj?^JlE#Shgzu*!G(l
zrvV7+Ws3u>|878gqzGq`@O4~)nZTYP&1DN49JU3o2x<tw*-YODYpsd}*j)uU3E^NR
z_%ECX<Vg9C@u<BlI#F<*GY8uZI=F`HW@YVBhA2F_gg))(G!>b6e0kCfaTMno=8nb{
zaNJjzn&g(Y5!W&$=!?xWyCZ6_`{$%1lA<ubct-i=h*HmH;IYf8b)g!yt7d{z3MS_u
z6Zy2*(5muDyT~SQikc;Tm>;TK;j513wl^5cqUUb|UKn1|P7T{z&gZ$2(Tr$rw+dB)
zu8Sy|aY{v(nzmq(7DXwJblLabb@sx)Bf8y2J5Km@Z)gKjN^0tqH}s=SZYZAeh#%*z
zo!Tq2H6*8*6Nas21uL{WLW>O0I@1*rOtvf&&p#&9S+qFh2d!=*DuOEV!Bw)Ai)s`^
zClDKCuJ)4i#iDBcg#OF)iZf={*4r)W%c1*^*w0yQ;X}<nGG-=}+#U$D>#i5ML_aKo
zT0SyQJuoZh743*8(1A>yyBy{0vWfL&3L7NPI8`1nzrw@agq27Lo6?32?Qn6I*Xy2j
zc2fP~Q6JQ>qMkx1eNq-^hgu-dneG2htJXw`;Wko2-JoZ`jai*!iuS%aa}X65Hi9Z5
z-Aw6^1&(4J8BaB&pI=C{2Y+5f9my8`y#6rh*?D|fU?m1<5Hr?#;H(RLC;spzRv$G6
zvOqFugQSZz9YYgh#sX#_&<SABQ^{$1D$`eGo;#G-zByJi(nS~UcR{1h09kfw%;%~z
zXOjVhKDJM(n)Dk?PhjRSC5e~kzctwNEl!vCtaB81%&TEJaNYreI*#$3|KcWlUyPCR
zSo?k4{4<~#p#z@e6I;RiVnjpQ+ylE1acX8ccEg#(pR7N>;gZ%sGNQ2gv3~!2%a4|;
z*Hs^trqCSm%gL6ShbT1p{0En^g*n%Ry-drw+_1Z~1c$@CLmSMJj$5eNirTjuVq-UC
z|3V-UGto}%6n*Zfinrn{sI9CJmW@S<I;&js^ETmX&YG{-pClQbvH=s;uH`TaSgkT|
zP|>*k@k9nrWvHm=9+;EQP|DvK>t#H?^Uz&I?Cg@L`FPwaEO1ipHGYcycS~scp%g;c
zVl<h*``1<sRaZi5mN{fi(esRqHpZqr11N$_qoJ<px&_v*mhi$JM#4KBH<7tsGGd&3
zcYz9pwnVc$pnhFU_oC5Zm1yQSfEFvX`jGzo;3xN>@~qPj`Hc)rbi(XMJPZf|ls>!F
z9qyW8C(C5O^vkqEIPNS9BHuV+6s%(|%AnIT+a|~W=Vm~5rNv0-u$GT(2!<>F6iv{c
zDmrPU7Qu|i7o>AG@pgL<ky^1F$L01E2iH#f{RbGPKPYy02uQn>q0`lP?V~iTEa_F~
z*5iQ4>+q7-JEjgRmj~K;v-Wp_(=@l(EA=s!b-9=NbXo4f>S+><?8gl32)Q-`_C~M`
zO>~RqZSE{HUagki*t4IRDB3AHPIm*gBdjRBt`)eET?J445;>L;tc@$r%U>5c`rspj
z>8g&D>mz*$A_Rs;$GdA5ePHm%Ez}iyv|>2@fr<ozw=5H^S#J&i9t0?$gW+AnwA5pt
z$|2SYid&CKT2&*^^(Q9a`2kspb8>f+%=E0xKsN(X+YtM3(Z?3F^nIJEGaZIdJ4SPa
zBF%7OSt*j#hnoVUp6j2|2v2mJ7FXSK3}2<%DlOZHguJor^*`YdWFZbThSQ>AP4F6F
z@S0%g7e%5RIvV%xxmm-zn#tI@P23nY_~K;Hsx3Q&eagtoPEljw%_4ligOGVhrlW7v
zufrQzhGuxVLuBBahP|YB?sC0|HvQH^|I?8c=JMKBCXE!5o#3bLSvV7)K;AThcEC_R
zltnXX(4|Uxzytf`$trL^mErju)eOAI$rkrL=y*G}_k(YECQEQ7=Q{EGm5+DR=12--
zmtP_6-2iLQzFlpv<vv7Qe8@zoc}+V*iv^j3!!;C89oWr1z^30e)Akw()}Ue1eqU<T
zJbPUneMH$}XN>uzfu_Q1zapY8o+IjJUxzsD20K&nj`A(304Z!Ez$#>!-(Fx*9BH<m
zW5!fm$Vc{TOi@9EkuLntHNB0&4ZQ}gHQWB-M;Dy)Uv0;ZKO{G0S<dkHuL$<xcQCwx
z6#LTOv3c`n4t`^KyA<K=H<HcdhcEZ^%-e)#cogAR)KqFdUC9tvd9Qd4jOvI6!j6+0
z_iv3Iw>Sh63_$!8-MvsM?E(nX0}?k+Fup-n?U_zNg_~7l)mPEjR45UrRlEjYw(o30
zLwF)4{8}U0jn<L+2R;o+yH-ieV<U^*20oWG)ZAVRJL(859+&0|YMT=3s%h*TI+D{S
z_*-))Xu1Sr!0V$~0Qe4Xw#~YAPW4)9=hWA<sVoHd`pTNBuZBJmBoh;BQb)sp?IL-N
zq@+6ZnN4pra35}zO<0pclZHz{A^~}yOVWf(x73DU6Q}l!SC%O=-201fX_{t@-~62F
zp`SkMwtQz1rrW<_lsMobHy+DNJslV-cYjD|3?F3x6LGmJhZ_26jz!63qFvJZ%2B4$
zE>y*cJX7qF^=B2GJ+?-fbk<YD9g{SOeGd8E%G2?Bu<)s9X-GC^MP>KWfycz@l?|Z<
z<J>T!RZF<QI&=1Skg=Qi<zhwls82Ab)kRJZd*R72QXB=BehoAxCvj(9S-ds|LvPL%
z{kvHa0v+8M!|A<Bd(Qo>I`#<V2qU#}`fDh}%T!(HcF1-2FXt;((MdYRIghM&NPKKm
z7XIL^FbbQyLJJdj5i%TKAW8bLAYC^Gl7T{SrA9C#U4&Ifwa7f@f^LrsQ-z*?PN}D}
zUtO$PzciyA6GJfT&$glv=8u!CBjg+r-5%Us<qH@Yb*=Vfe%ifgV+diIk}v%7#sqY4
z;S9CTu2xHDs0#p{m%GkNyuY1ih1Zcxn>dgJl8wmp_6q6G_ozo6gn3KN^B1Hh?JJZq
zR>UfoJ=^iKGDOBi#Ny*$o_^w_WTVB5e>V!zT@1F*3!3-4ICR3}T<hc~7cbNL1fxw+
zV=4|a@&~@Tr}gT)c0LC$Y(awdh_(a$JMnp^D|{o8NgzcPe`buY6F{FBSvOh}Zn?4d
z;rS=~s`F9Oc!2GW_!#gP>cZ<jzGj@-5<WH<xqhh66o$QsP)~)u3MOXr7oygL0OyP`
zh(U<e5QM4GubpZ6*;u5rI!I`{ZYgfNxQ&b}jAdPHi1cL2hbUxWR1qn?V4%rfJ_XwF
zB)Jd}6Gn#p=KV665(eQR&I)c1Pk}07p>0GiTXQDT7t<wTep5j%1g#p1%^jGkdBTYv
zN1aVlpVO};R|F%L1tx4}_TJL(>cnf@&BTw{1_e^NK}Y1C3H$7M{@2V-ndrBPIrmsc
zOI`3+MVec#^h<W`e%q6H9IgbK#yS=XgEN-rM@bBySO{uw+B$V09FZ<fA!XSOdme2k
z;04VoTW0zZ<U~h!S9o9x4^)V&G$%K`68J%Z-Ih99?xXC7D^=#%^4=DGuhaOak;8cZ
zgA5f1x>|ROuK@6(T)8L6`PoY8+-dyl{Aig_y%7{WuU%Z}1(+TK^-`Q;w>WOI>+tjL
zGEUpnYjIfB)S4@gJ_Ibq4RZ(^EG#!E&}!@y&bzDtCwv)P#A(p8m`|r8+rS0e`H><C
zS50if_*(oXBULT;rcGNOrLiq=`RZQ2=+x*(T6)rJs58N(jC`daoV|L{^kJBZ0#qcS
z^j|1vcZ`i@cqSO3CtQEL@Y9Ds1sWC>sgM_Jqi9O^r#oxRD+BAT?cFAlyjgOD<C~&)
zHM|uo>SB_QOqSQO_b?P$40Tkmu<A3CcWd0)6;eUDi}Vq`f8Y)-b~Uj%A=ZGa@W@YP
zshWmx%1+P#lMFvBvSH?fwcO)!tppa%!39N&8K;P7sPv6#rFHzXtJA=$8fsNP>G#K8
zt80pYV}D<;vGJ3fIS^+yrYnN3Y|T9ddtB*kT$<9+Qc0@`|8sEV_b4d0wo&zBLtVkQ
zACNi>QiM{laa7+q8MVCTR`@(vvJ!l%x!^eMzwQCAEi1i?@hO%$5R}DY>R0}yjkR{c
zH8}>#e~jm|JEKU7>;iW!Nztw|45-C4G>x126QX4rP~9PVd_!DTaOj`bC~vC1!+8GV
z9noi{@541NIb9qd;(}wty;rWvLj|0y2|HIjE@eL2e7EF_R|&XPzx@&UjLd|H_u)iH
z{$V+&$R{>jf>%nQT&9D^rRC23CSQl`_wO=pfj{NKnz<u8nJB46D=?eWo27B_JqK;s
zuRFcCjCyOM%5LE2^5>MXL{ksl+)bgxwr1ttz{7)%Z}q}_4VYDy6kRU`Vi#jY>W5wZ
z`)vlNe6N9#Mp%Q-1QfoGTT6&Xgec-#_pIGNN$aOjd37PcJ!p2xcy`sz>RY553bZuQ
ztskq8xA!1Kg2v2sCuZj+4Ok~4i|~oof`^2>#$~$hk}Cj2s9U}v^38E;<;FYKTUG@>
z)FAH9d%YDo#`$=2z1~Y>cg5j;Lnt#L6CwLV^tg1EOSH1ivQl3=VyG8^**=o?g6nB7
zZ$QwB=iZdc6;<&Tzei3C!kl0Ofe5!l5y(Z!Gw&BXb>c?hQYB>*kTU@hWgtqsXFQ$e
z`&N<lc|~~S@K7_x&<~<7Z*7+?&kmY9V8zZ)jC+sP4EK2S)7P2|S-E+I;gi_P$yr?A
z!Jx~sMdNcCYd5>IU37ceIhHEpdJv<aSDFUw=t9Tcr~O)C#(J-HM{)qc>kk__cXx9x
zH-VJvy1D2QaA4F42TnD~N4V8af5<Py_SGdsi4DJDSE9YL28aO^xx;$VWBt>}9P8un
z5SGxB@8{&@uY2fAsXk*ZKdxDTpm}w5TvpZ5Ve$p7-Yewdy|+W9%E(y!h+7bIG{IOH
z3*DN{vMlbdFRgt@_bW^T9GtmH<4)gH^(NAfiV{BdRycK~L$7GZg|?$xb?L(Uf0M7B
zo4=qDDYHX20-wpzbc4gg`Apv%vK3`nt5(iU*f~Ji*PpV|S%d}d4+?bB^);2@f6jjt
zxwGl!#o+=T3A&_vc&g|way7C$c3iwCJ;Z#xFn(qwWp*&;B)M2AW+s?5xcDkjkFqwD
z8z9-p5gP+jIqbAL-!eElb7Cmq`N;Tqlk?c;N%rO@wdAWL&*#@rLvPx%>tvd>_CZ5i
zUuD(W<*FaR$dOrdN-zV_ZA!BR3w1u0bPI{`H~HZVBl63G>DVeGc&p^K_q>29Lk4(W
ze&ekm#Q6gEsMTVSLXo{tF-ZtQaE)9EXS#84=bS3caE8p{IogPABCZ%5-}ya4qU1{3
zuraMg$Fn(2!7D$HjYP96$UWM+k+hw3%4EA1PonqIV9<2+N}gBGnNcUMdFOLwBAZtz
zeX%XQP!(I-F?a|;*xeQ}f1NtF5n#HaG``J7oSou5GCu3P?%9>%k@I;oUhGiIuz}(f
zj-l4?goRIwkf1wmd<44Ez;L#bmeV@|G5j)XX`OQ_)Pjw^%f=M(t5VPAaRr!RH}4`6
zJnhY{Egaj*C0#kNl<@tq(}=X<_m+8lzIrp{W~{mM&r>L*RKK&vFmkoxW5H|WD0y><
z(m5*IQs-P<0d+;mERv{hjchOlQV*2i4;Z)*65&XZDXZy1A7{^QmLmRmD;cd*wn0{9
z7NHyq^o|;qXy8_0{bp=WJAFu_0?jDK8`_~pYi{*0Fiy|Kv#+iF!dAD4ly|#)vJ`3{
z8tW>nWfLIpdr@*vtJlNsf+vNw6qURIzo~%PD0@VP2`sc(Hx(eJ=idd>g_!EYR;@8f
zvYSj7MDONhd2HSxi$yk!XG^)ed}DK?D9k1tk(_Pvs#6+*r{qqN?Q+aBWWbTpR(f&t
z9;HZM5-lP}W>MnZ3;7ieF}};xKVPtd#L(C2Jo7Af+BQCKU%0x}HKz<*K_|14SA_OF
z40CtZ6Wu+9WbwUR6BPG^wT;x2qf)(l&(2X<trZSOwTEtpp0Lv+$RAFYA$L1BV15f@
zn?7UsTBQ(E?Hsl&dXp#OW_V+eel@V4EY5gr!js7QBT5`0Lg+d{umX{u0q-ytcURQM
zF)eN=QsX##bE0X&6}sAhPlp_)S0PcWqdQ13g{#G11#{LGw(J+$)}?^GXz*UIrcAEQ
zmjz=`ZkOtZcu|1vsJTsRuuS0|bQ~|MNwS#9qA^EN)yUa3!QaLstb>-lxPx5RB+A_=
zqp<c$QjazqI;7_&A<}@wpef#@rO~6HDc66{vzCrs?!7<lX8Eni1yyC`g?bEd2fR!h
z&u#Z3EINW&e>7YVDyV5g{b1}WjMk`_m;TektZu~J>gH6-H=@eeZ{yUSha+%D1aj`X
z9`VF)SOb%8i28j)e^y=<Nc0rb#=Q6ra;jAkiUS_6>zs<N#!j<4o&&3F(w*L2WsG;e
zTu^1L<>XyZ2WO-K3bxJT#IH923Y4aXTJPR^iB}Ls)$yvj=g{p%K&|5b9FmJvSYpEU
z^N^B1{+{wcIt246S6%mj2GB{IZ8|65%^cK|@-aL1Q%SZ46m*d4s56;7_Moh|3Zr;F
zH(|kkaah)7V$so<D*;Y$(|!1q>4%caa|yhSMn+4Q{AZozVQ|hLKXhAC*gBKM@HvPt
zFRg_u6@@CT&l9I&n@Jth@P!&M@=HwPzI%h4E&IT(4;JU;53*+qAzLoS97d$sp5<ou
z#@IoXYt`8JJn+5$@iTYJ+2cn8uM_V}J+hYbL8EU%0dU)&oqe8ouGhS9ZUXmC6Ils3
z>->?JiFP@gd`sXqb}9Ye7~k(AJ6!-gnfRp&AhIm9$899_4pU#uz;$+|9fip_**0Mh
zQqt{KwNjDM19-!t*Zbo~ko_jd{*kNM2eM)KZSY6p<Kd)VT&2(2ZNy#9b^AU*b)&Q4
z^LENX4iXv`$5QQW$qAC4ci7cP!y{g8-}+gFzno~q!#I~sGC1KEj31(?{>q&({vz%+
zA4jTugXw1qDUpBs=en9~*rak^CeVSP%5|8yvXWUa1k0JF+LI%P+4K+8!$L{h_}Y3t
zYF#`=gTCf%3=NwEYacp}*PApiB_l@RPJ?@&4CYOLGmDEsLH9zRVTV6aIBDnF4?dy~
zc}g1e{i+${A6m8g?smsaTy~X3&akm_*N+RD>dVs)f<T7qcrCm75L{3HX|j~p2Vc2S
zL&2V_Rs6UWPaa!Cz>eRsH8c~$@4+@V_d}mdEM4UYF48!CiR;wOGk{!1=fkLYq)eNe
zdyV{OAH=RMx~2?{UMlL2*-xPh!=%=z>g&p4-72hLq&+<@>%zT~IixEzdjMn4q(~j4
z5{i&xZquB}ZQ~zj%RM$ypQ>USqaTo_CNE2@CHo<$nyKQw^FtnE%xKJp!L)29M13(i
zof@1#bKO?gn5P#Nz0KRG4{$@mVw#21GdH)MKut+K`G|ucv1N@AGgckh7&_cd>J7Xl
zsPS|`q+0az{qtwS8_$Rtf~G4O82fSa7vAuK|4paYadRi-p~7%h0IWBO-LAGRLUBos
zK*Zc1w3C<Nu0AW#KPoLxka@F#;Lbs!KevbLcT#@$?4p%yg;sHZNaW}H0&D)vmW}HI
zH}d3!vF$S@u}dso?#&uA&IOk)0kdzGH2nEmy}+Xnom}a3O=iC*l{-Av)xb6CDk34+
z9f#Uta`U-{tuAv<inJ6Rm4%^ZLhm3NrwcoS(6rs?D~Z`zi_ZHxHKdPdA`4@E=B<kZ
z?&^Z%nQXa|7^!pdi}G5W%M81E@-^E)-3p4*6L4Jl67PWt|4evy_itHjf{pGYH|O)$
zNZL@*eiVBuAxMZQs~$C>T{8NhBUPkahMdx@$<AKosjfV`$HTfb5cWgZI0fdQJxzoV
z6-Mx66yxJW@_LpTDK5^1QPR0kbwJ~bd?CCbK5?|NT>(*zX^n)U88K|9nYt{QCwa>#
z)}7fmHjPPL<DM05N_Rk00BBude=O^9Ey6Unb5fi>tp~HF1u^mzLLun$xZicJKSPv?
zI>F+m4{C~Ub+E5f>sQAPAQ_<YhV!iv6OXyYN9%(-7_NBr&@S9@z%{;}9oZmW0Z?f@
z1^3<|8;*wEu{v)U^O<FYogDuoiF0U2UmeqT|1%mPqT)55W&QX^2iL2j!^or-EJ(lj
z;eP#1^ZnTOqExcSH?PkTYW#LF;BY_IafnE*nvK7j);YYq0~Iw6oh|7W?TgfDJKT(x
z)vHup&ibgZfi)98_cT?6Scr$GE-MdLfVYeaWE42fy7F>Wmo4?jrsT;m%_?Q!fLJlk
z{-N?TMZ{hu!a;(cB*0%iKXdpSeMB_kBnCt(So4~0@_z_(FPG)wsL_#sbi=26u>U2;
z`Ax2!NRU(@Tx^=MsLx?82saNxX1xCXNi$BmX><XIuey22xBp|s)&rp1-`(qm`5|uP
zcLuU(_?R9=h9qab1J)a7fB5f+z|TtMZ<0D{P*?=5Q^s0YZ3VL1rtO(6(`h*xLEj_h
zozC`5$pdduMJ^{*UW0aMvc{RqUYE}MjNr#vw4x3dc9Ex|fk{2%0oQnu@F5E&3RiwS
zRc_*(`yuD8KZ4t8pOmNtxsTBhvrGF}wLa^F<+Cy<71ooGKU_ZHJvewP*{oA=Q#rD9
z^4PSYP6WgTr@|b}qbPPo>W2z{XFEjh3Sn!)@LMShTCn=Q=IEnqNHZw!<a6@9j^$)Q
zS7X?9UXShGr4E^A?{Qf;Rid4{`-x#L<)!_2HXBGUY&c{x??q{)wMt9#`d{;n)Bvk!
z#etZsowFEl-d(bV2w`?In2h<2b^N4Hv1g2F6}u+pj92uT*T51=i<v-^2hYfts1z&w
z33+RR#@`Z5Il)7dnyn#MF$r%lFs1u&4tt}ZBU)g#7yW*cD)Oq!A*Jp#*+@1&WJjT(
z%IWTvP3-Qy>OALX?@N8m%zC1$=bZyi&(6-%2Z*84-ME-%W)N>di1D2oZj!Lo#M|Ps
zkQ{_IUo7KDj9_(hccoblYks}gu<a6!KazQBg;)OzRY0o0XEdfBx41#oA!gQU7^Vt@
zb(<|b|L7BRJlnYQ&2PZU+&nSw4RqUG<+Wwtw>U9E)y_4qoN&s~d4>K<nOu&TcM~Tc
ze)QEx-}0>wmM8NkI*k_}Y?ENv*KiO}y_)v#&$C~)ucg;IzBg9$%Cb$XkQSKCn@U^t
zL6+|u9UF(I^Efn_#pg~n6v&=m>tWRq>Og<+Y!gqMZ(=~8%Iub>_<qd;?zC`mt&97g
zT~!So`J80wVyu|<5)|C;wSQYtbwE(;2VqAAUT3%GrbKde{&e1J5iW<hmp8c$Oyk3y
zU*wjhU8TnQh9;LoY*t<}kR>iN?h;n65t}9vT&{L3wvZb)Q)n-xqWbN*r}pet^#+zs
zpTOMd^Im3`9r?A?BYJ}i!LSp+2N-K$69X+O&DHT5KJtFzQiPm&rPwCVatQoN+^CT~
z(?Z00y^Cnka)gD<{W6(+norKo;QX^E@QL?-NPX{Kr-S`RZorQHyJ?oyS82QI0<zxl
zzN2wPNGm;ySD@QEVc?8sWn2^C+%w1U!C!vQhw>HVGlk5{s)p^$j?ogJJ+j`l3-z`g
zwg%Tr9ct15pAYK<s9cAZnP|{1T)F|V0|c_C>wQ)7keQcR$bueXtxX3m9e4(T^S;SE
z78`x65wlgy**my6LhSWjQ~|Uuopj6VeZ^M!5a(?z5g79cXlQ48pFoy9vJ>Tu^2y4v
z3cAFOIK9>pA~s3Z*{#&9Tv4VgN5!aOI_F5Rlrh_uwgO#?HMI9d(4|%eUSWNip>28J
zd#Fd3)_Q!?pjxCeaI_nw+)_618SQ3l7s%z(xOiqBYqXClI}hS5-}lXEHG5dAx6r4l
zz0>c)WYDt*>ThFa`pm<RV|}@fQmw3jh^2wnMw0;OgkrF~34U#LVTo918`*p=EDR$q
zS!Xg9HH>QB{2OEmOq;891*H7e*wmzAxff5I!qGR}LrnU5mCcsP=Fn+0RQB4HF<Ti_
z4HNOeD!o^rzx%l_Jd`Po?R({s`wsnCbJ>1T^B5B8;A;f5#1j9YYs=RxHe64i;rUDL
zz`Er!+aSHxk)FrgZTG^qEk0?|JT)Vf+~_)}6S7`EQ$V?#!v;;|&#bgz5-4+jt_*!{
zqidr<H_M3!aNPDcYP#lC-BPXxM{23KQ7zJM>d4&_8m&HxRhoA0nIfQfbL1m=Ix<?v
zAgII@^Uy|vV$n29jGE3zTDE9yZR7|Kt(4m1s8)+nL9`gq#yzqDz{Ub>`gfEgf?#4)
z9a}jp3FtglT!L-!e#&OKm`hJ(clDhtjKUZu_Uy;hzWu07ZNo;#fXEb-mTGm|a0uWW
zRn`)&%;Q)d1E!gj)mJ4GRrg|In><@lRo=WdGFKLX(B~d9@_R6l^F^Mg^9yIs6Y#E~
zRIR9>+Un9W?)la?qkeG#i>J;ipYG7bNM3sTenz8+5pPZz7c{eb`qK{_xZ$2Rot?dL
z{IS;RizgvmO+fpy=@~}*^0jn;J-`*YI$pFtC=|ne>;tc?X6w@Yu^Szl{^U*UAJ2k;
z`V?!cG!D{po(7%Vu&~kSs`YY^fjx_zW(U=LT4}Quoj7dw;@`WNG1N9qj{NdA22KcG
z0ZR)XORpn?^m<?|6PWMYUdHTAyK#ZoGFSEze&9<wLE&xq{lWO}^m>B%wQ+4<Z|2AF
zE9E)S+N$32aQs&1(Y{=YxjNxv5%dvr`*``_Xv*+&`eS%LWVM{vn@jcB(wZ^~55x^8
z>=7nnEoJl~Eb4Fes$a=q8}4&Q>WvlM-^%TSCW8`|0gKf>r}r6yR&Q8(eZf@kwv84_
z<-B61waE%vbS&(@ewSiwU%LM>Y#TR`vFge}aPGu;nwh|DU$eS`+g^7UG06@VFDzna
z*Q^5D>D@c<nGb&yrrlE=7o^Iraw6KXjP&8bCjG+1kSOjJ>6BsBHzE#$UQaD;(M4ls
z=XPS`JuIHR80f+AS_hXZk*OpL23BS>rrUpvx5I_#mrk9>t@nLn|HnV@?uo{--R!k{
zFG@XxtEp$$%Z1UJG$ns{t!o$7yP=g!Z#$zWBIxn~A5L7}knLKNg%r-M^>LA=_<YFc
z2~-aen_cPyi}j9*L<`fM1RHenSv^bj2jhxy+?r-bIgJTg#{w;z%4e~A-z0WcGPtnN
zRO~tk8X;_0$bfHnwk!UAdHU)T;{|L#xDD%sklg*&Z+9NZ1wsV&B*&8rh5}(Ss?9o^
zoH|mU65<k$1C5ay5!t|#OJw+&D4Ug$!X?AjuFcwy57#-6Lx7{J(Ie*Aa)cKl7HEoV
zv!g&QlXU}^+}EqVRLA<tnvxAzD(KL3Tx9aZbPpgmK8^JzR7I{-p{8y!T_8rBMziJ6
zv66zBE2B=w*z3OI%}8a^ID70_&JmBag1>^<d_>Y2sh@jAZcNpELn2+wtCEgZm;08v
z{mS@zY$<qe4!ODsLH$OBS_LN`e#9)*cHesITdw~=W9h|_5UwUho4VFTXl3Ox#CyAz
zoZxINKfP8ue(=i)N*;#kwV`j;@=|I!34uYA176op<<TQXT5k`qu-?O|6|R^hJe!zn
zxtdHlsE*}vwn-pe&Y;BB8)C$Q4%}>|fXYNkS+<r}n(8|#koD4ddAs}?Yq|wGftwvm
zy_O?5tZo}aVP*_xh*kIceI;So9uT?UDFR*7kx@Jd+ib^V2E<8GRNK6~09FWWBZF6R
zi#;SaOB|3R0(7InFABK&+T`XTG<k{enjFS!fl)R%8L&7(`z%YWHcuDQ<@r?=AWG-b
zsuscH4=$?UP_dMEI}<yWVz~9iRkhE!c5tWFQfafjb{FMh8jVg0rS1D6+RFsuU35Er
zRrde}F54X-N7~=S(BIC#A_v?W%d2h>ix~T!BR8l5<MYp-R;3uP809%g3zyNl@~z9v
z%hMD1+jsx^Tle2_<oovCvFH6ur`oD9>9snpdDj8$-|MBokF2yU#qLb+0JWWH3mQk0
z3mi?K<>h9Gi84q(exZ#roeb@PjlN~8^_^PkASWERowRpsWeEJ5B85&WjaoIYij5SA
zk<9lbE;_`Frz<L5wnqTEy4F#Y!{n+<ba2<`<eDXbX6qIMHv_FjQ^{^;fL*&M;EYvp
zhS(0D2%KIkJ+|q@fXa!SR&vPV1w<1Tu!TMw1z<U(tIEsrzG|oTr7}Nd)Y2uk6bR+!
zfuTzvk-W?jGa~+pt#nJjBRl~Ndt=ktw7Q71-pT-5s^pdCFTK_^yj+SCP3WfdTbkOi
z{7@aQ;MvEYQSHcc)p3~B?a0^0aMN8kE9NQfD@zeZAU*kshg>9l5G{h?rP#8UmuFmD
zc9V7GUDqG<91zYGpMMge3qiROEZ2#UD;3agtmAL~kKcNqw3x(a-3yf`H@pzHt7%;G
zj5ckE57j$1T79pGx7zQHR=2<penn*iwsX~p$#UT9$+?bl2yg>LzRIr<lWh=4-oB%#
zin=^_u1U-?v`?{#oDazktt0KF^|B6{HQb0SS9MYc0x^VIDXR)654`kUPH5mrFl)UX
z`p%7JQ=RF%56z%nD5@eeStSpIC%hA5r%tRc*w9UCtXB8WZWZ^CdWErQLV$>4TfFeh
zkjGVOty{KeK{F~rLIY!Q89=icTiu)~$A610TJ~tI#fL9pv2_cKEKD<W5s|*m%*h7@
z_1x}vAW|8c($B&+bDH;8TsFW$YTY~dSj%LYY!X{-!&LScBVwfE+Q+$S33I2;;o`HW
zVA2JH57}<BqY@@c6E$^_xDv2+i-IyKp;=gOfbrei@zke2mHx~h|Ko4H<>%h~lk1D-
z6<<8QUdA;Iw5AY0+qdOSYh9Ne@?jLV1a~3<FE=LQdRRH>AjOV>o}0kHDYJaxH-uEh
zVc5>aQ}$=-eFd1Ad^*$&g)2)KT4t8}x~rWU{^Z(mQ(pJ&sG`2GhI4COWC@^qJz}qL
zBecElKm{kZUpGTjtuZXDwS%-@73_fv;Civ{z*Qha_T~4YipvHgsx8E(n=)dDGGh9y
z9Kr13bz;Scdb6W|Q^ty%h#^@bI(;9_IO7^?{PR+iRpX9>k<@x~$wFQ#!wf^UYp-1N
z(*8oCeXVsH`)=Hi_Ua-ooH(Ph!{Y0gk*>UMM-Ao4Wssxei;t^jy^e0Lfg4_RHyx)o
z&OG@foeO<+ys`tqQMD1=dLL=dG~;q)+&Hw;!}f!FQK*!0><eE)X{>eyEZ6JY;DIe$
zFSzYaZmfg{{@*|Q2{UECZ}q~$BdYz*3lyOL!FT^p3DCX-qe5i#H&&XqN`1|;%fPd5
z#k(Z99hKb@hpfYHFQ>539C$6m5tzT(-o=b^TP2NkTcBaNEHouT-79E5sufsvvm;%Q
z^&k6Ya+|&+r|)tB8G|)D-VVLrrz?K7m<D!EB2z14z0pz9g6Ubn0w(JLkE1=01ioa<
zBP)j)?ocP!n5}E8M1=r=N9wbi0FB%V&_)E}wpeHUyG1g+<Z!TSBx@e}k*)v(F(e0X
zH7&SujMX-fri=UeCm%&)Wktycy-r(oWnjzJ+R`dr@H5C23&cFr?u^NBJ3ZX^%2%MX
zv4-Pce3&lYJ>2~2J1~3QAw2o{$COmD@0MFoEa$Lv?kr9}{VZxzlV0%)I!D+kzzH$!
zp1O+nI~~j(+=sF4+t6BFQza3vNJ#L(mgP1}sFdKP^Jnq-|L?;euv)DfR?eTNza#&`
zfNcV_FM(uWia%`i9kJ2#Tn2s}13&l`(_{TWSen2ur;-!k*@WC%-veuAuj@n|`_hS+
z?ESE*Ucg>xmGXoLN~d^HScwcB<m_1JI09pYu-S4RjlM*s-^G9q;M;EAjuj(|=a)N3
zNhhc-rlyu61l&M_9l>TDM1x?CUgTSDJ~5V~0$tivS!h9)VJ0f0-3Ro(j`DH?VWZgV
zCf`)QP;9Bu#yGs(r1tDrGk2AnNEC4$B=&nrZ3ZwZA5Cf(umMfyEjo@0#jHB8ij^YT
z8!dF&UA*plz71=Ob()dUF?C_dYhA;!ff800*U@V<vE%w1FtKe+^(HHgjjIAP9B{3h
zT(o=!(|h-z-|wS7zo@`Y4X))tOqgrg=IDT*KXndkD|J*R#?dx5+!(<XSq6Nt6{;pW
zmsI3<MXR}X{f_+yf5MT@?{Yi!YfV46CV`d%V1z;6wc4=*@C&S5F<{jn^8w%NJE{s-
zhP{7&7X`R-K$#BkKCy(AdPjjVPs4PzOpNFTD}(moBFLCgK2X=Gu96;ZJ2;7QTHukE
zi3}ZtH<W-jf$w8$4n$)aPQ3xlPAGPv{Gbf7G77R%W28YLnHW)XFx)R}OSgfPqk~!+
z3ycKBVu7r1sz0n0M{Gx<0%1~)ge-A6fi)S0Eje0V-I`+#3){ipEVpW)E-%66V><Pg
zfZ|KL-ZnW%CGu4a8aC49GQQy*Z^fD8r*Ztzr%{}k#oXC-<yi2OO1Qcga|~v{ECXbV
z<1o@CoPPXq`pokLx)VxX;4HLfAAVfb!9DbfTj>0GQUNOWD9dnH2HOQ&zGnv79}pPN
zEg+q96D-7t(wdh9TgUcf1cR7*8XHRs$QMe#oh=kTur@!x$|WAJrEyIrED)Rh{94C;
z6<6l+B?AsHu~myJVg;QO?681L7$Eb@AiB@t1*q7o%F`>ZU7HQM&-!dNEcoKT>}R|9
z0POc_3Z5$)78H0Eiy7rrTwZP<!_6Goxlqc(A|PKsejaACh1~vGq$jH?aOPJI^BJmp
zA@Cl{FuB1`P;k7&1=|A)B{O(Q49*DIKzas#!`F8mC#aC6^k;2(;k~bl-}uP~-ebdy
zXd5ak&RgCI17X5TPVn1nk4jYFL<XTJD!~6f2$Bkf#<r!FtPosyv}6bgKLF}zH3Gu=
z0DdxpUlTZ#72?Y{(F6xg8};-i4V)c~d3(#j3A5}R_qm=Fp|3NnUEm(O3{EN_RV%CF
zL(Eni#7;9AQ#lsgN?y_L$G;bQe0#l~3bHBilrmt=iZK(@<;S^F7Nu$d>&vSI(yL07
z^^0_I8++*`@i1fFf9p+{d;SzQXxV|P0tWhC)yoQ$sqe|nMR}&i5?m&S$(il%-B?`u
zQI3uLOOqI$JNe;+(Y}am_Fl`8uVTp{Xh{=u8Tf@^Y`@Q!d)@@uLDKWG^1;;MseH!3
zST&F5*ZN9Y&>I^D(tysiydanekv3!~hJc?=AXH&m3k%#Kq1A;+C&5a`qLZkP@dGrK
z+c%BsY#FDXZ6V$6(aw^Q`UH-~W*tp3kRGr)a;SkrENNjh(~{8GtQOr5&H7p+NhxE2
zuwgd0m29vjs~e@y#;E8}&`fs?M5gI-MCeNnNhib3TVDacLJeW0lpsfo+#{DC_W!C3
zIS)j$xis4A>q?SJ5hE<uO4@#rBZGtNhRLV$kpPy|f@mqPHTlZLWxV3e@4$|OyYRu^
z_&v;>KaK6X_P7^c+Lqnx1&I#xC(oeOXrMG+!|eV&O7lJT(8I{(3ztFj1bQ1ynxRP)
zs$~ND4xJ8zf1AnW|MTjF3m0B6tu_JL7vT>w#2>55Tto}~LNF{FSh`=<W3zmqu*1O3
zYZpNcTE7n%f2Kg|s8w>P^KyKZO&jjPDWuD4{h9(o3v@-~0TFQ|s3<TWumrOGb{EYH
zG_C7fikWn1T{~yWN>e_$)KHyn(=;_RGHKQ2G&Qh2MbEofjF1cvu-gzuoEQ-M&jXEA
z(-?dbWMDXJK9CLKSfSN6fL7mNST+a&1EcELYO;g841HF=AV?XX(94mqI?@BH-K5+y
za<@sDGkN&{90T<zIA1y%7bHw@Z!S76)O=+`<X^@=<is`iP1aAxY;~fF&wTLjluU5<
zTi(Re3VitY--lXlOm(^CX+LYLJect^lihjU0b<qbs`^(tomC|oTN@k7Kg=n_?#bcR
z@}>7S*49*Un|()aM7CJOiN~H&)s<SMbz<D*Kh5L|_j0Y?tIZFa0Ik}A;@|WvxpUpK
zbGh9TWZ1#hakE`~TNg+BrwS>w`Zm_PR?w!}aY8`iU_q0Xo8K6qnD$E232)jT0IY-_
zB2xd0P&#mefPrv}$fUS4s)N?tDjl%g$0?=OJLn8hDWp*(w({)RHLUe%n#QS-DMR&q
zQb7bZt2<gS%b)5aOs#da=zEYMCZh=ojvN*I@u!jDi7&M2C1ez6#U|Nck-D@p);v*T
zq5_*#(HbfOGh9e~Q?M8jY#PZTrJi-RMMK6-m@!5Lxi-~q<rW}~Xdp}u{|;g+)-5+D
z%dv>th`(dA4|7(cfrXQ2ac*`BIRe6)?z)?f&n7NBcS;4q{61kExZ-x`#~*nNM_>0E
z^jaOPtuMkv2DiNWRcJLESU7VI&GkBprK+k(wy{yi;k)m^Isx%5ue}F5_U}U~m!oy|
z@!Vs_klvGdBQe}puP-irKE<wvYk<{WTR<!DpH_ReVy24C+Af${w%-oi1zUJoSo~hv
zOsR`4f5rp?+n0n_zL1t{apzjE2#s(0)}cj6Urvx-6)h1B*!a-p*~HkdAZWT}a&}qD
z3{Lt=K8>f(t}CD~molEz0cHE*X`PDIN;}Y4WxNuX-;q}flDU7bXM)#c27OA2u#Spr
z*V2>$y+oss!>rIF_wHx(HZXFOY#>KE8Ah@^Ef^;vUNyPpbX{%<gyC;?X|NmS$HTF=
z%?gD_6_(NX9J{EEkVvF{KZ1r|9{lL-<TrC|jF4<-ip2%VPZ036n@t?L<5uL#6=JV_
z^t)YE`@rt@ycraoOM@<Mf79#G>-O=$M?Q>Ry@m60r|=Em^i~wA6=aA!ESx;2Qj8D2
z;ughJw{4%nvtNE3_y5J;;l{geqhocTw%uvAP$-sup8);{7rVI@SnV~Ff}1kL_qPXf
zhtg)foayzBh4BnfRV}o9YZny2as{n%VzbXJcT@sGN(e7V5*~LO9qyoz!&uJ5z=7We
zDV87ZB@M_hD@#ula5UDYPONMOR;!KWxjI(q`}q~109Vpr*&vs8<ps-<1oB<f(gt?#
zp9UY+ik<5q8?ad!RPB<Qeand~69RJFX%I5guxghfqe%;~j!@BRV+cV}L|Ch~-e5B_
zVmlor8*Dl4mND5N4vrDJ9|xw*N+S+un#oZ~3o!@6Fk9X#(P1-<_7at_Vifz5IboYz
z#4ZPq^^LNlAYUqAiUIMVM^POc#}EH+@1k?acC#B(DfsMTtTKT=`{iH9>f#di-*7YT
z`IfiPIcehW{^(DzNQ`#R4Tn@W2?o*T;u@ZK;0t*A^N*;G6T-3a=qEmd$3OKTYU2|s
zkk;?_ZW5;P+G|Cly=H)x_VsTz6q|Ls5HveB_7sKk{?)sx5Ma>FmeXfhGGMTES*Y;3
z*~&mVX!R`Iy0e5ft#65dn4MJ)Mij~Rs@gk3j;QY%vReh5#9liaEi9c{R0q?Y2ggvz
zr4*nliNg-jtlg$<(g8SK%VVuv!UecRZ5(G5$cDPCUj{K~BI)b0zBVgIOk<^%{2)iW
zPxW$yLh6hwYSS|G_9{{i`^kVPi<6^+UGe^4TiUvOwl*TT7J*Y4p|#Nj4d}@ZmnaB+
z*?}-@39@1+C>UK<VDm`k=9z5rim-LFSfl<XAFHKW1uGZkR0|)L5(dO-)p4OLhf?(g
zTkXxGSjZ8WHt?B`eGCV$KcWDc+vfa_-}wVvJb4<~Tn=lC%c`xqMKiU<GjmAi^T_10
zC{`+}fQ?X9&{XBH-!`rhjrN-OD~Qeh05R4{?l8+XEXQ$A<`&`WLYwQr+Af$V0JX8J
zmcjY;9?sOe1jKH!3?GzSJyog<F!t1PmX;koKfThYdZ89EQX+J`57{dCl|sQ9z`nSG
zUF9?m@0-B>1KYq2bh$a7_odP64Y1MZsnpz8-nJ9ivkjOYQ!HGybsh<_(qq+O6y4D@
zNC&#iAcs<3<Gxurg3U$)<KYhxltBz^St0m}I4Z~(u*9a$qhtff5e#)xuc{m^1&jca
zOBMx_Bd@9>rrq-LRuKE%V$08r=G<b$UpOkVC@%+5x3~z%5f>L`w)1B$-~+$<yKv|n
znw*_gjV0U7w#rgtNv>9y#8aPn2zw77!t&V*c<7^_z{JEf46f-xOqKhj@v)`qFw^Rr
zjWyiz`d8vjKlFB0cwGARkO|n;ab%iDr7+%*0PWTCM+p3Cqvr%&3{+8VIx3gjE?BZG
zV0onwcU02qF?(ZOhXK4wU7<CKWrm4jTGcaHXJ%=NK-UZoYY~lfM<>X`4G<M8YqXKe
zrf}meJJBVE@b}NHK@Kd4Y#KKon#R%HRix=4Ebg6#Jv)KZMh5Gg=1WsJ*iy^z8U|V4
zFYDS`!@tGWBm`#@$v}^^52dvF0j(hkK@MeZ#o4T0=ODs>fnf{Q<;n)ZcZ$mf@iMeg
zKo2i~a%+uM#&yxl&}T=0|HxW1n=oEE$`ZDT?JevqaRq^}k&=SkLbi~x<)P$)OeU?8
z90u%w$>#9Nx7>@JhYq0CZmZ?W#W5WJ(xdp~`#*%KsaX`OWjfcaI2Q><rC7t`pZ+XP
zJ@t%oCb)ic!;PnKB7{&8?)O{^>cQ82FpRa?j^*rRpiOyfmjC1Fj^P>92VRl_pPW00
z%|3atrEFb1>#;RMzn`AUH4oTfzzlh{%SjK07UdP5%RoeqU)Q<in#mo6jPCzu?@gd2
zJI^Y?`(EsO<epjkzNr?ev|ExTOR|tH*_Ib<w{2*{F-uPa1Jm^BrVm4N=%JZ&=Jdds
z)4%}30S{n<0dH8AEm^xtDydW|)t<Fw<-SM8zDK-&{_lTF{BMb@lq~m@&Z&fSr7|NU
zA|u|r?|%2Y-~G&yTiSw93<MDvh~l-yy7-+62lRVx8bQtH$7rsO5NErQksc_0Ni3FY
zLQ0?wylu@sTHC>o4#-+eR?{_O$W8>TA{j_S0!}t7Pk%9o9KcLAE6WLRvRSzISiy0!
z%K*YWa#NX?Y{1;I0hlYW+r0x#);XC?+hxqF6VE)s$F0vgym9biz|7U0>I!t8Kav;6
zUt^-pgH?A=Aj2Ba+LY(?>aSWTVB%Z_{p*JX(=~03ZLKAS6)M>x%H@){uik-y4%j-I
z*BrPD%USXJJ;MXY&o6TT4_II;22)h^7ERS2QJD7hyGR|s!D!z@Hv2mSvTcLSR(Z+4
zE}|kqYrWgBys?Ur%=PNkg3w?627qZsXTLL5)JgbSs<n-c2@>Ivv{()9Eh3uZWYE{f
z7%BX;7KDQ~T>yOieiD%YE>xk1cyrLr_oUF|<yE6n7hQZBxDe0Z1+vE2uv0G3Iu{Gs
znV>l%4kgJz4q?%xDJ!|T#k`Vf9ObWSHm4vhO_YF@F}I$pcoIFYVTm=!2A<li$5*x>
z@3rI`bOX+JqJUn*8nz09S3DBHlvO)fYioqDYsn@azd+NAit5M1ywu;kXB%F7>W3J6
z`yArQl%>^*CUPx@hrje`eEi@3JQi2xyIb05{I_1iosT_)tq1m^Tq@XqP7OCY9#r-B
z-|wXMeGRleMLAS&v7MAPtFu|MXfaHeTgcVhf|)tPz5RxBz_f8`%-pl3!&QraUE%<H
z%f<vY^hd;YT3d6ANzMW|w#q6>XXTXDeCnJ}y6Zu+z)}?lS`*bqOXSvuk`Zy`Xq#HB
zv_@J($5EiM4olT6kn|c#(8p{o;AhN{E8AHk!yJ=cOtxm(*sOkkDuajp3Y{SZkKT-8
zdmeVMQyBA%K=jgB71t(Pc^ZtlK07#k4L5*CcrWX^i@lpZ+uf<)R`k8tc6V7}O%}6v
zrOm=~pv<LN7zag|m-&IPAN_+v!kHk(r^PNN{Vxmf%B_%D!PJE-!ur_Fo+Xx6wwgHc
z?8}^7R5`=-yPqCqA}GpjOi^!D-p4^R?{A=0@xK)tdWM0n&FbsGY58KKZOpK@_35vc
zrWpeZ=7=qmCczALM}gl>hW>Z}lf?!`m#ZS|yT$Z`{2~YR62C9Tziu%_e2?Dxx@OGK
zo7N}+ikii4HG|b^5^$QV)Tqhy|K^OLZQPeRf3JgOhjF(>W`QIZ7@5kN1jubkF0iaz
z8gobn%q1BpPRW1)UOrT3khdynhH6(fD=kuleaoz86AW^5O=7mr@NgTRF>emZ?5OGD
zz7BbVd9XwqnP*+HZe<HwH^$nnRQJ?p?XQvIk{($1yYVEw%;R}os}a^|mQoXoGGxE=
z$A68P%aho5&uvHz_G4*w4t~F12ULE$RICTDeg7E_$Pw&4bc<+onSTVy1m%1I#g!}y
zD><YRX*~P&Z{g&NN0CbRNiVCOl|bjOAOni}o9u>k@c)Zsu&$}G$4N(}DKK;LE9_$(
zCd-cxVx)<XDjH(eE-*7lMAJGf&;YR-{~y|RTjBqbEljKy5BZVfk8{gN3<rmzP<Tm`
z4geJjn^7pgHfRk8SUy&1F{@R=JNiGJ3|Y-;TxrszSLf$OD2%1YYL<mdWb48n7Nbc(
zY}|bpknMP86$d+09G!kyQcxuZsyZ-10lKhR*x4+w`p7NwMi9jdub7v+*$x|w*?qjS
z6u~^kggvQr7mqAma4C9_$ekJt8*y<OR;9_^ro>hW&SmeI(J{M*y{c~PxVU(Dahc(n
z?He9My;Q~0<O06(2fu|)dv_qSFb|c6Z>aICwK!<@pjIrRl+Rnc#wbCol+9!3ZHI8@
z#~;B1pMOF~X~XN+AruaBqSWeW!GdUL`T#ra9aEIgb5`5?er2`qTcG9O`oC10dQPmW
zbasF-iK)`wEn2EbKufIF2zKi11Y@#%p#Mvr+N+rwvV|I={Kmy>1))Y$Bu!BmcQaQ(
zHB&};xrBDMg!*y;l}wTUzGAHWHcNNK26`Gg>HeCPy2Y#suC}y1QI-ihESA}w1x&JV
z$sh}dPAtxM%|oM=bXlnx#aPE>z~J_sDh6wnGiU8=mPtCR%x0Nwq}0^}li8uoJKJH%
z_F(c(1B<yNgHF@RbHsNQ*?`&b(4iGe5{O84^M&{;>qEKH#PF6)NT)(*WamXVwus$S
zeoPIQIe~c%8Zx_f{37e7a;!<v)&D!)--pX5&f?^AN3nI^J`u6ltm;!-bRLi_aO}Ak
zkX>97af|vCoPyzPTXEkfAH(3rjaZtQ!Nxs1Ft}wMmY3&56ReZirEi8XGZIv>0!R6G
z?^p5Q{Th?ViKbGRFE+yjwxr88o3v|7<AB=I2NU?!ldM@cjYP!mt&=k)Ap@A<-zMWV
zn?WQGlo|}{Q(@s!*xDaPG#tRGi5%u~RbCDSk)wQD%H$0Bj5Xl=_bBLvA0Y8{y<k3L
zmy8vm*l|Eg0bVW-m3sifuJg)Wa+3+SrEFA9X2?wT${HXmF*j2}P^9TH*=3;E8ej&P
z8VxzIYl?O3T5=SkVz?DLx~<j$XU&)dbHpLS46iYom5LNeC|k-D2{>($h{jcmIpPF0
zW{*l_MpPms`Nm><8neY4nsJKq{W1CHq6+efNWyku5rIe)b<SoF-n<#rrD+`b?$g-u
z!AH>YB~Vyg6dqHhqt6(xoz_`3!(8aziB@Etix!i7$M!WtnoUZuM>k50mUaJc`Fo5x
zr3pFe(Plvqq-1Vx8tXT0fuEOlb7K?e;cU0rXo$Z%J<!X6HY0qobpOF%3|sc^!T7n0
zC}y(4hfAw-Vtom0-nR><o_`I&P*i|4t=4I^8vK64`Whbos<(ZCvZ858m9@3C$Osej
zKfJ+cf1Hnis(gVn)NrlEjA<!7XO;#N%#)G;wKwX+rG+XkFIB}9m}X>%b{J-7f{Iw9
zj~_TS%B|&KeP*$WI{)6Lo-inGroq8F%7HXOAS>byb*@F(u_MV4`XYW1=-b&Uq}W19
zwvfn&JT|MbPP}1DD*w$mM9mm}XiFzYCtDUGFvm8KAcL$4Dqyyi*{YW=>y!*kV1<1+
zL6zhPRUW;Sc5`)-yqKlC+GPgj(hn7n(N@OnBe%>35cV-=ch&FA25<zyu+;)qI<E&4
zOAW&UJi^Td3`BWlGky}W#vG1*^IJIc+S^DD4r1>uyAe-B&{k-hYy^cu6-C;FP_Bvf
zGIWuy^3q$=9NP(29i5eITF%>b%NJ+xc1(Ebvka>k$GoK!I-iC|)+4{LjA$y2TOa+9
zkP7H8qOHD^Z%gc+Sgz^|h^KJ==yA?`YaCz`NO4w7CsLVLhSf?HeVc|+Dd#xA*7Zyh
z;w`NvTJ^el@s5#%a6>xyAI8J+>*Z!=nybl~EXPr#LyGvCP6z_bLak+3tDI}ZrL`_F
zx8Evasw`V+V7}Bq+y}fpwt^#9b4YV$E8cX4*_u%FKQw8U4Exa&^`mY%3S6YX(rM*&
zGa?HYorYZ7rmt!iV4Fh~ZDwzJX*RckCgFyCB8y2(MX|_|N0x!3<W^jgLFc4YCGV=$
z3`3U;MOPEaIiSF7+ih(w1TQVq0UC19jSRTVvEGJt(<9NvZ6H0CkcAW<CNGWSzI!&}
z0B5ilPLGKTdS*U@P&6jMA(~8Kd@_eZzJx=!?M5oxz{8K<jt3sU7hCsk78`Ao=_qy{
z+J$f=EH3I^&rU%Xv3srMy{zjxbA+!2s7!7gUc)9v`5g3jG}@e{7K9#4z*@`~1iPjE
zV%2Kd*r>q7PBRLmF&n^QV>CZ!ubw!k+Zqiv%UH{}umzAB>IWl9LNH_H-?R52Y`yQE
zF=w5-8*O%T#hCaqod$HW(_%y6I^b{mrgR8#%6x5VdU+|aSq6u7$^ffEy(NydIA^W%
z`5MX`s1uY$AT`abq$>j)2?%zN#C4$M;LfDH1e3wGnKadf4x?@x<Gm(J)xEKr#9&Q;
zWs-*50ob;*C7~<GY7UT<<pOjxPNy!bXm%@>3K?V_qqeT589EyjoNN|uHmf>Vt>OU}
zifuo-qs;Bn1ha?0z~<+*<Bkj}_8XYM-E1@wj>quCXYWEiJCCU=b0XxLA_4=Upa70w
zIE+f6h~=}#!IrP!;>*usVe}*xE}TX)Gl`LYA8HF%z>0Gi9t@&UTtJ()5_pKY%qywA
z3(Iv6Ok4|`+1dsb)~G5{^kHUt7SrdiAQn#`x3q|Sc?G-gJdA;j>p4p;86I5sx+nTO
zL(vFlzfFE0Ga?H?3@q@YpkA(^cikW!`T5W50NkWr3A?$izW=OV@4Lw`er$iHQq|BD
zo>)b&2!2h(N~MJ+2UT(bv}pGi2T5YLKxd<ZT)u0@3KhCV)0i{eI~c=asg9Xk711E2
z(fb6*%29$1+LqgBaR#j*!hh#WcW=a7B@NT_1<ri^_IzbW$6b?tpxKN>%%<O3Sp^c~
zlLsWs?Fw?_AJbr`V$6fd+9tmwkcAw9*s*V!QiBh6y;NqiiewRU+PUmWSN4XN;u!t4
z$p&&Nm?L*q*07zvS>{+N&YT^0nK^njn!HA3P4MRj9<33gwJjHq97na*M(=RH01z3J
zDU7?EnYUKGP|1Aar8mXnQPgEL8pimUQTTazaNlG1<450pLy!Ok-k~;%7pOWn{bKFQ
zcD>{i)-}t)<Gw@|GebU;MKlo?AWMl{RSt^HHsy3=anC0{&e>@NPyX58aK_%i?t_O>
zEmnlLme{ZJgVyq-2l{x$kV0-TBQ9Q~>(W}D<*6C`@UOmRW#5X*P4WFaKRS-zV6;Cm
z#XvB*pQ|*D1Jm%u(o_|#n@N(pfHc+?t+7#s<|+mROxD_FohU@3SwbGvma)oaI2jb>
z{H>c(SeFc=!~xZ0k8~x@h(s+7H*r8lG=z36f>(1*%v2?b!Yu0*dvn9IZi(#<Hpc<8
z*}&Qs19rO*<RJuG(@SG(23f@hvXYNh23gt4Wr3n388ElYz<E+Ck`~;3B1~e|%wzeY
zD-Ka+n#{prnZpLfY&i<dHag23!x+pKm}3Gq1+G{51$!k^=C3<1iTwc-@)eOZMd?$*
ztnc)k(n^?6L}UT@0{Z^0L{AFIbP5q(Hk0|A77vogG|#Ihrs$0xub4&~qhA97_4+;c
z$nqL21s>;}C1y}Fng5NqfAj$)2a+h}Gw9#44j=xx&*F>!@mI0)@Ief3-GtOYFE;Pp
zDHv+KR>qFQ`$fZ=0NU@j^E=wK5KE;v*bZ@W)X*1@iZvg8AuD8O7Ogl&Ra8mru{Qr1
zy>_d8-T>NnZ|S<7gX;D=1+6Hst)@|oZZTyX`1y;xQf{Ek%MtnmHO=fgYnF&FdsBUi
z4j|87SjKXxiT+p+L4J}o4Pd52Y`#$E02{@j^$9HV14T{8pz+UH4!&gK4yf`F0qfYv
zWEO4gA=6}F)jAC>+wCQQm4_5GX<;C<xdZHr6}y3~!a9opMcJ>x(=Y3^aw(Q%Amz@&
z*#KkK<d))<(B)jbXgjx=s}bkgq98ZB9HBAJU~ne+W0{AQ%PBj+N8`~!qm1Xr7YD?}
z`7G9rB=Oi2hmj5xkey#ZuxD5}4aCF}R_QM}zgBgdQk$xwPym@s0q5VoA{;Yxu`icu
zD09~5H-g}ubaPc)bx8*9MwwePfw$~prn2$pOU<m6g#}JrYADg_nR?R#yuOXYA{vn<
zyP}CG%K0pE%S-4V9>DQup2d@2`+qqQ_ha+^J(#|H1;<}~5f6Ro6Zp{QK7q-ZF;Jkl
z8G#t$7ohp^DNLOoLo(TiN}+<A?zsz}{Ec7cx6=>|N1UtVH*+9;NPH=@bMMa^(!slB
zv<iNKoCannwV6pk2WyU(a@AT>7(r@6E7h<*6~b)3jz+!R*=j2@J_Gb<wRkcdK-1W~
z`Q+Ip1o-hD_v<GIG1-Bzihb*nm|_Yp&y+9}(X9ai;|<lMU~s2?#H3g%&5`&8M{<@c
z84&hB85>YAH+V4FtExFITux0Ew({B8{PIapluilL%4M-x6NEK+O3S;HcdsFLWE!}_
zW4f_fxxvM39M*zX5ABx8y0vpeSPh`PGJ$rrh~VIMy%Sz-WBvMG9NHZNYb>I%cnRx<
zcA?q|qF8Jo5@20RZssLbZ~_n@Q$9a7M>cN4@UGoB_R1&{=_J33Rxmu6Mldyq%O^(>
zjs%U1SLZIQU?1i&0P&7ARd$W5L#Lc40KEIY!#MNuYq;s&TQPfOTI>Y#`vQ3Vd(ZLP
zRA>_dE+0RMGe@dug4R975eS9QmmCz6WYuDcvs%vH=a#TEJ;m88uLy5BjB=(ZmO6^)
zL``1|X}<f>cnXW-vqEmrxBANG60ut9WT;=!6!lrWPqbR~eFU-uW}mJ$H4CuJ22z2S
z?%R7q*gX&tg9+4_if~3co2!W&SD6XP9!oQ4n|!mxfHkq=hH*ygM_<^7b~uC*f8b5A
z03O;uj92qbJU3C~AnUh+!Y#`c?4z%33a#O2-Bx5<7F=VvHfaEM=Rw<aCODd1E-g=D
zvevMG25Yp~au-0egRITg#Vl{9A~nC5#6mk(t}ZSE!*gpJsfD`%W;q&UZ5C@~v&=iV
zTh29*Tn@}@=a>BY`TS_{(l$`MirrgiZxuCd0;rYB=#ADeb?FNJ{P+GGlb7eQZCe^6
zv7#P&t*BUA8jEQ+Yzw(y)2?mEEG}biHj8*qKMD)eXqOhT_uv*Jq6%`EoXB`}mj7&(
zSj5!>Vpw;57TxvPJbxZ{Kk-wz<FSWPDi#EDz5jEMi=2Zhe|`^s{t5K28$vOg=O7tG
zB9%se@32@+PHZ@qNFvJr-Xgyr%03tzT#sW<y?|GK^gZ12@CR}0V-JY|2iFQt{yZpr
zDKj&ROUK?8tl8NtRP~0$#~Z$2m?VU5pVt+By<Y|v{HpRG2ia#AN-cpPP10gH*wt$-
zRI5!4#(db)8^*Em0_waxqcEWyXQK2L=|c)kByTmEdL#_x6*P$p%gzAOi}-C*0R_E%
z2`u{kSmr0huAT^1IOr}E>qr<|a23TdcOV}O{K1t<4ZcDd&0fw}$j+i^-J_vx4Q6H=
z8FjHZr+3oSD>c~G#hCl3I@=J8+el2d^F0%|^oy8J(q&a9C36|K^}$POfHZU<8SG_y
z7&@5?s*TN>K&#n@6EtSC!<nOf%rQ*Bq>BWzeNVIL@#ZiDvwQ9IFALN9sui_IG&|E#
zhMqtMCtp3u%h`mO(JvKBf=xvd2~kOz?M>%<!<=1xb10_KM1y~R^vj<C3&il`U;jNu
zhSPZXb03E<62;itXYlsX^XOT(9{KqNy-B7h9zzQ91xJ$}U+X@UAV)!3m5K5CK(pPJ
z8hrGZedH^j#oN!njM3w7as~n%df;9Tv~i5S_Lhh~Z14-z$kt5=a`0UkpEQ_hKuBaH
z3(&M!fdj4BW@}b{wAGn|=eC14Ve<4PVf#{4A3TPuR|73*{CDd9@D~(lU+?xS^V8qC
z!D!zFqy3p`OOsN!blD)Jcg3(!sN>{RNu*#6CWB&K4Qa2!)@7VnG&z>!Y?Sh4o0_~q
z)|}yIV#C2Qr>0~42Bj)55tCt@Z)jL5)rFMMHgw&#bPVhNZH&rN1CGFGE(3KbZ~R=b
zn5wC_wydw2^r_i`V9Z7rbB&kUhalv{Ec5n?W1>n2;*Pt3Nx*3~alkqt3kS%WK-vvt
zy}JL3^sfq7W@1$us!-r?7kD`UoM7RR&;{EdNauOjnqbTUHuT6sm*rokHle7cz*-F`
zJ|C*NWi-lV&dlO^^};Xg<a;&!vfcDfmuw(iFbRYj)f)24SyY$jk)0Y9qr1Lf2(Nti
z8R60W{I7iuAN<(;$naywZiTv*Y_P^zT2~IP<ZuvqvkbYVj95AT!q>lv(WA%En;sGp
z!NS!EPHbv|(I$J+_|$LwlJL#a^2Yl<|4FRhy`5i-^5TLLjE1rGz#d(i)|e!P2hrk8
z_SAE)Z~|24WT`F!WHhZM{#DkXt&)5|Yo7Q;?~5Hzt>W={L!*7ivH=I!$EgXXpwk4S
zEQ8&>0Sw1fjAv@%#4pubxM^Jq)0wKiML{|^>32dt+P0vBp=!==87E+kGnof=4`57F
zaXDW@gic1zPQ%1vX+60VXid7S&nS8sbA(d!A2#DrijYT(#NKwxt=e_l#>yOwh`AT}
z$wqvYIaw?usQ|W#FU7W7%L$aQ#%q~m<C4Q;Y#VW9D;GMfl*u+NFUi1lA8tDrbF9^2
z3|)P*HkI~T6JF95H-4I;UMeG`Hlaq6{Qad1v$67sgKGa!8k29Hg{B1c)hh<OwAUhQ
zXo5LD1~&}j$-nxBn2g$S(_u`GUcu=jZz9ZD9s%$Vn{^Cv@csGU{zW|h&(C0aa$2|?
z)+8Iao(JoW!ydLSs{BYZeeg?9VCvi`W-eXefZHzuy~*o3J2A<@bO-j_bqnUMOmN_x
z#<{b{5JDWk`X~Pfvhzzg`NqrW4G&}6%?B`Zc^su;9udxht%oJn%PYKiFlB|t=wUMY
zl$<Kq?b@_vm1z&v{h=fW-NFrx_PuZ$=tBzq^|o=67{dqj<j0n(xV%_JrQXKf+tUI}
z$CfHcgndE=fZ+fT6D<7lx{#|PUn6NjwOFBL=izt0P->vm<m{zX1xhunaIn@hWEFe1
zhr~#2&Vsh?E@<!*wa}ju>&oFA!F2$h#Y8o^ME168X|@3b)~N(#SAoU;+#t(rAlqpi
z$skLh>VtjVw^v{cB*%emE3VeXGrLLy44xMs=imVx*#mGaS6qe7N^F=mA%{8R+K{TF
ze&q-nGiUUxxk8hL3PuJ3s4h(iCj#k>og^;1zPWl6%p3i(oGsq@Q}^S;UwlI3uP#r`
z>Jgv3r0yB)#rfAyV&cpwN(<Ax9G^fa5?Q<3fH}r=oo)jUq-ItEnJPwOeF085iUpBZ
zKus<4gO2G~B7wqk1{Ka)tHm;Y_>F(S-UGMc7yrv|i4disty}p8tcekRp@^l^Sejoz
zz#qJZVN*})(gS5wqgq%StM#{AG~Mt>(;q^MKXK>h4WNDJjP_HMBOn5?rA%3Jhh$1k
zM0iQRcO-^fl^?7zKQ7G{ktx=NjKDM|d1jf2RHQeQS(_C)CvT9m&r_3GEKg(*;^j>&
z7Q#n1rG>MgrFB9@7;|Ky!XAMr;u$$W4|BvC4yq`(nCpCCnj`Q89`oyFb}nN!2|)mx
zCT&mP&r5YMLIPj9jVh1TIwrZy#+OgCgRBbsazw+s=t{^kn_9{$g9)kx3aZV=>Hud3
zPxph3&05+bbFo?5L>zM)yJSt48auIA82fL(NvzD)+8sBAKbjC*Tvw)N`0?dOu~6cr
zaaoLtuF`SpQl`6aLia-k|4O-vX03rRuY72-OdmaMbH+P@<+(+?_|5NQgtK4rp5nc7
z8!+$5IeP5;(hB<4^<!ZD0G|8KKVyDu0+D#!b`POo7_*nIiUw_zS8I_#9NP~bLLe5!
ziI<OI6KAozcie_kr=CKpzXu2Jz60e-@tP+$9f#y{FjV|C@>!A(IALnHKiF1$hVW<q
zydfRD6Oa`QmVKnw(yY-}GaI17nQ2c%#ckVCn9S60X}%=n1R^0pPEX5?meeHBJy-%V
zlukF7PHM`mrL{3MLc6&)f&f49#wz?|3~^>tZyM5obfu*e*~}bO6v)Y=raUC{<Jk<5
zPNK-mPn9#4kWcM|eWOcfOlqb$mnbSSxpS_KVa&AxT(McMq&;R*scr_vSndJ`$od=;
zTJ{lJcWRVk+q3|yqHtx+N({9lEqK|vv<@ScnV9S}u)QW)=XG<kUV6XO07Co%y0VnV
zvkN(dw%m!9KOrup3V)A$m2vF5YdhYWNn`rT6h83_pTo++3XVSY0+PL{YrCUXNp_*H
zh!tKuaTd8uRxCSIRn?XG+Tfrwyk!Fius+OAF9|!<nq-4(8@fC-aPr3{dXpI3JR*R!
zH#wv?wc2eLV<(oInOhL$Tz~HXUi`*)aplZe^bYo;RViTCorf{9cQYc9FfPA+8j)~p
z)#padu}C6@^*grV>giGbAgai<Wox{6__fw2`4_)-z1zI5dq&G~EY083`^1SLjnlR@
zon`ez19)?~j3eWDkv&T}2e)iZWAi`^rE1FxkTHRP8dG#%BDzg{YS@?zA<AEgA_v!M
zy)9C^A{4n;sN(tgG8)uHwUuhHV&gicKBV**z0{_LTXAj$pIaBfww@@8&30GY0h5}1
z9SK3R<N!t5|7FSqsw*}S9#TQ4>16|1dXAdiUEq`bwz6E{0kV+TwR`%@$dk1O6PU}R
zt2hvY!EM1}GUzg|5?umc&1vpu4v657%gfkyC6C6`X)?BgRaQ`+yNF<ELWH~1$abi?
zjOjC{!~g;5k}C_#DCG)<&$C;Ab~nkx4Ghb(3;6ICK7m_5^Z`s>9J4~P<=;v7_u}lU
z$8q|F7m!HBpb*e9kLDM1=Nx#u6Wp?aWg+H|pIw~Cmc3h%9_Sat1;Jpb>-k6{w)^hB
z6&v^OLN>Q7&YwFTc?h>Wd_OL}_9kkTG9Lf(m$7O0PGsg6Iq6Zaaek{JSZ9UbmbeQI
zM$~Anjqlo8Em`dR?dAp_YahDaw=Z1xK+8-0pQ0vMv)x%iV@Ceb_Jf5=8?&@Q)~||A
z{_f$p2!okgEQvt`D>uOKz0wRqfc&jwxuTPY-=<0b&A<M@)*e)<4U8|B1@H!Fg>t}W
zOp~#WbgD5+7wwd+n(d&c{DgQ<41KKz#>SVB=RXdh6IaOODKJgWSCzn3avo^X&s2|G
zR@1hnYIfjNG)XEj#?e%ZscJ5Ffy`u8>7?}v^0u^BP1?}VO_zn2%fK-~CPz9tV$c}6
zWyabw4Vc3p+-aie8<Ktb39#jhXcw2jaucX7&mbMFA{7O)D^=|O@JF$2|6b8~Pjd$Q
z`VU^h+1F1XmW=CZ|1LJmuGxr^v5wf=#JNkDIDZN8bkdNG?7vSE0$I%hK3;8Q=Qy)$
z>baaAEP3tW-QL?2h&}gh7((y*A<nc<itGZ-nLR6iwDgrrcRluDk%Cdyig@xb{#J|`
zf8l@qb)0<Z4gB*T{&#%qPyQ0^W&?q6Xmy~a<}_#2OH(sqIpe_(-7Uhv%f-?)|0IpS
zCO+083E>mh+a%cg(RJ_;HNo0#DR|jvZqXzc4JZVC<bT!kWGi)j(P6o!dueq|RX@=3
zoZ;@=l!O`$;q+n|G0tKLz$WV&eBmILRUh_@Bv39laAmOwr6=CeAf1DphLM(eoOE>X
z5Kt{;is0uju3qKkAOAlxV$)_%^FAy9;vlckI`nqicE25SzZv8LyPLov6PVw(euueN
zWSapoOxnq1S+<N4UzOOeeYnBHVc;0C_0(nI_Vt3<Hz#=I8NfASY@asM0EgvE23@!q
zXr)}n;k#}}c2vX3i<1b2d<aIOBFCUnts_VbcBO>*6K`7XmRK?&R%(llt)+@!wqges
zf1d;>8KKr|DB8sZ$<LYE<b^BZN3m2wl+NA>WDrcYUMwJ<iX)U7LUv)rNJOJ6hHp)l
zF5Ao@b4#`5d>$YC^y9)_b>Z|0j0|iRE`x3#(O3fGXD@IDx`6Em_h84N1Gw<kDb8M3
z_}_I2Xw*^XuVtdIM;r*(^yxEwj~Gc3O@7|_Ih*zcnrq%TtdfhN-TFww7y3P{c7eD7
zwAa*U@2BZ5MPilul11GgOKZDH4j_&7!c2jeHZ?@~38X-tgkoYmHysNhtNBpi%q3z3
zhSROWs-6ONV!4i+lL6sQXe6T|GXZV4XHqfNYj~E9<fG;P)bbTPuyYX0*%BsBOdv!v
z?P7eeqpdQ2vJlAnb4C8O3N0A41{+LpR~;bEY~6m?^iA9MnbUsN$tvjBz&ar@%o?+0
zws3FP{g~Sl<QxOXP(nwSbzTe{>uH!*PA!vyx|zMn@3M2*6R((u1}qOML?Z!QnW>{#
z8N?kQ-G@MR7DvDJZ4o*>vL%2_fdGC$fxlt&#6|2F8Q}oPFm-uSgraOeuuJR&yZrW9
zv|9lTZdxw@c6oMQ*r8m4tryD`n_?C8j0~cj)xD-#tKD5lHU66dXezn97-eM$!XHbD
zoCS^I6>T88nrz@P5)6ISPCS*y^rbOmXQwfc8rIjxtnxvPyHYlX*~xKi*s>M#)06n(
zZ~q3ao*Tp8{I_36Pv8KiF6vnZv~1Db1Gbircp`-pProdj7IcAYx7%w2F|BzQKW=--
z)Nw;PcsEZ@Rkm=#x{IU(Fh_8=<r?51%317CGK7&-NLacy4aP)>w`SP8Xv8)h3nCl~
zi;cC7X4?vzu~M-3*XyGEL@c*(jvpH#UiJ$hX=`?efKkGGHG$;7l!1sJxm+1%uPh?6
zg`c?mimgy6xuWX%xW>Q1iCF}%ObV@w8Nnl}#s18aU+Zj0u<TYH&@^2J)(EULA*C=$
zDlqj}=$={CoYU2G$-(X}=mN41eb%MBS|F=QjWOnE+QGv=>yQkXysKT74CGL6&BM+m
zH_x0tU50wOhKiQJ#%=4d{g%UM271u06vP@DrBy|p*B~sh0Yf8cY}~O)bmS*Sui(nb
z^P)jit5&go=T_0Is+Fs2Vzc_zY)#zP{tw(H7&65NUNbY6E{v*Aq|s6AU~Xm{hwnRx
z-M1b@F<-hS>tkKN(Ep{2N6%0X(!Ft1@&)nyt`+o6goNaPL@b5b@hS8U4dHA5_5Z}5
z{`UWbyFd74Y}~g?uw#l)d?z65<9{a&K2Q`QxgFLDvO+%KkE62oN3Uo3;JRkC9Cz*~
zkZrXc`=2B~su>hRKH4b%x+fk)k(VG8Z)cux^;!c%eQB%&!pIk^A_t*udOfvHi=0Bk
zLjj-eN}v#Mqd-<HJAs!~T`~LIhT%Zp^3bAvN-IT_Ds^BTXCjL$@D<CbuOEa)4G=#s
zTW1##Sj?cYZV-%@p{kiM2E{dktH9C8cSsA0&E5sOt3YBm-uA7|v{uKVpxGFwZFJX`
z7A7Zo$;~g=Hq_d5SxL^2B?H+lAm{MfCc3=5wO&(M9wFF*wey2&pf`YL{^bZXHHZy&
zK7`WDWvq->kl^nF@zaxUUBzH;1bqX3%#DqsRV!jAFO!#fd0elQaPs+=`SGJ5*_(Fg
znXK!|7<yca1AO(nPm9|GM8l~|aJfV46=S$QzwoA>e&J>6wIfOcG2~bv1}f+7x>k@o
zY;V%f>ZJ;2=Nqu+&VxAd{1E|m!c4vzAoAytUtSi?s?YxBuOO02;FW*+7bJp%oXEuZ
z>r=zK8S5`si`cMpI|t|##?G8aI2>7<qrwQ8@oB9Ow0)t!)9cCWusXk<vko{b{qv=A
z>lao^O|cZwT)-&)<={(K`nIu7hH_$~{Opbg6^za1MPrPP8M17p!hSS3qg-xi2)9}y
z?4=b9cEYvgU~P2PDr+4zwWDP?x|^C@j`1Hg6;-4(9S$+foSj6bT!%mC=WLKOJYJ%f
zHjE%J*o#870ahrZU*#}es*28QYyA)uF-fMm<N?Oq`<-kFT(FP6S`%Whm-UJV$SROB
z3E%~?c5t*cv0!KNvR_tC4O3*0)$A5CS7w3fSvE@U4%5|aD{ADWj7~OdU%aR}womBG
zJ4Iz8R<8tf2THT5dy+YbkTbBfw19i=+sVt~%Lw=MV<WFjrg)h>e(E$55yQP=Mz-02
z*6yaDC5AM*N?RI&`~urEJRq84)4ar{bSj&z&lPbf+50%K(he^A+<NE$fBYb_bMxZ<
z#c`u)j&Ws&gy6_FPz<I`AJxJNFZXLm^!9XRlVnB9XEPYtvIXmRZAT~`#*uG5jc|~&
z&{!O~OhyEsM>w0++V2eT3i&MVd*b85yL{w3-$ydtvvxMjFE-^+e6$jb@AXOga_;Ki
z-(a+BuyyeR33oRn*}&SfWt?EdN{h9Y0Ez=6F>LIQ;<fV&pk=iYpOMbR-}t(bJsW5=
zMAwYAGmsvtII=#8?NMO2*$7b~Z9<SztX(tc2L4iqKiFy@RIYHaRm4;n>2iv(;)cRB
zhGIcnsx@)jx)jn$A6|QP6fu5|r1({#%1ftmZ?Cv$KyH@VG+H}|+UNH>I;*9_d9YZw
z9t$ahfO&!}bI1j9>|r;MRU8W*oormbU*@%*hPfxgI%|mR@{N<tI@hW*$Cg<!*Dv<e
zx4>G>&V@{Ppj)6_8Ogq0kQG`<Z^Grv)2O#Y2*!pG*~l<B5XAWLR|P2h10f0I-E6i}
zC}A6C#6z3b<H&cP5&umMwLl=SI-7Os^BhoU`v6(OGBZ<912KM_MZ_=Z!7Zw>(6Hrx
zB904n=eVLKUlp77?dA8a;M~zSk>JeP>!Z=ABQ?;E-FM%P*~?=%{{81LoZ2AD{Z_jv
zTomFu+J5J(G9F7}a`ZCFyb4Sv)9)O}wALO@5Jvcyb2l{Fcl5-R5zZL)n~g9_lQs0&
zR*TAf6+@{I_N|Mf$eH8mE6e;U8$mP{LYqo|vTpGcD$Z|5TWV>Tff`VuL{zW<>j1YF
z9y0q9QrieC+~cyEyg@-hfFHDnRDP1qF5;zAlc+Xy2Lv<NF#%a36-A$4MT$Izi&??$
zG@3l)jGOV&i$ED3$yDaZna$dz*%_t}ouF=JOpnRqv`k{LK0}YS0jOplMo^^mtu=!z
zIv}gaAj|B{FFBXiD=0?Za_a_PdE8XWY3(whX1AL<;u4t$^RskAhJ~pa6nLpTFc8Pe
z!V>1MPLk?_d_8~z4}Dk!b+;Nd&owmiYI$aa&(npM8e#QnO}JCKW*oBBEK!`<@{4t5
zasr!oj^M7x?ng0~=K$M))~s<5FI$220`%k&WVl%}X{zyb3L`tWAvM$|7_(FVr3(`U
z#%w=u02?@)J@eY@Sl_!v_;BBgs@TUF`O?Is*mz5S-#hsbI<3|c*$3CFpZ59%S{1vR
z?T$WcWds-=))xOCD%}G7;LT^N!bkhoWC7FpI=1zN#d;eS4vCVG0A$ztl<s5YC&oj2
z`qAr$xQ#sBq%r5vfIEj(b>z94(SsB?-fA+8&t?UvrV|nI{Z`8ybJb7}g>hl7i1frX
zPP{#imoCil+vyjDjU#EK(lIpZO<RMf)8LXAp=05q5B6r484#lnAawkuW>d@uN8W&~
zp(L02okpQ88(}q&l>pib@^&`AEY_<ztXy#Dv(ndHJhQe7k;BGh*?qd?_j)r&nbm6u
z2K{2&0?AatkY9Wf18!H#sA~LzoftvDuL$>x94s$80)qTFoVhZAtLHB9-wz3}6&VW5
zZRv8+Vy}QMu>rw{Xexn;^XGBm=^r7eG|(umpjuqPBR}&o3~wAjDOVISo6>E8rSbQY
zTyW;d8+h&8PhrpD!|30z&d40-e2|>bKQw~e(lWmHr+<as-hMsM{yjV2`2~wVSMtxU
zWmv&!Pom@8$J)1DuMM&5*>$ju*sRDmumD!GMp$W6ZLLtj^jsc;i2&OC&FLRZ3jgd$
z&TRes=LqVNi1Xzp-k7T(9Mcc-A03-SW_%HGUJA7p)hcCGv*WKZ&umrk9N-br$Dd<^
zfA&QKyyVm~Z%O;2bvTirU$6>ds-z3k)w-N7^XC^3P6(QJuk+_{;J_9{_;aH;KE(i6
zl}XzRO!t8%I|(`f3n|)A3>z>_8Ym#3XO2lP^KaB_+YuDj8JJ)iy1EP21hST9=xBby
z)CoKL&h*k->lFHqp#^5eJKBNynvwx?+QwkdZFNmp!3s%tFKlETMp<v*%BfMb0|}&e
z+>G>KAHQH$tjDlf&G^Z`W$$)j(OPwX7hBCc;Qk?{U{(0BM8PyZ4)(-OsabXDt&_YA
zKZo77?!u>j^~<PL>qa^69Ue~ZfOsm&*|3I7Z=b@3{d@EQ3G=w)ze`p$v5JX*T`LsV
z6leHOK61GX4&Hw!?t1)TWEL0S(f!j=O~)-~wL5MA?K}M7@9*u6wtfOy3l&X!7d6Vr
zrd4fX(_mbb-p9tWD3t30jCOA7Lr-s9utU+|kA|^W;3XA55Ob9Vwx)yFyQLR-k`feo
zv=yFZtYTQYnA!a@S8<aahNjOrOQ!9+m8nHu5;hD5)IuT>L{B2jfwv{tcS37pkY5a%
z6e2>}Aiu9Bzx}N@Z^5zU8b)VwViL^;u0{jMv{v~nX59fvOF9sefK=jZ9Tuw^APP;=
zO|{Ot8*%>{vkxZ_=xX+TU#b&iZC+Ws&8x#^-O-0~b4t!Dg(Ezs)4-9!cPuXKB^kh>
z?>fVJoB=d&YnZSzWZPy3<6k1Ak!Vn`*<zWq)`4w^_x19>v1Mq$5CPiM0HaR)mYa5C
zVEqU$`D^IDBHg12whHhHA2~n1X|t@3=c-_X=Z~Hcx+{&d&R(5>>eG|4*eY4J^qdo^
z9!yV9h&+Z3ySHI>MIR9^mn#_Bya59n*Wt?PGqzN(_m0u3{B^3LXK0{nGi^2S)vLz#
z{_8dJ;JR#vsiG0aZYRI1!p!_x%?i1u|6bw;k}n)Up1&XS3uTeKWx5Qi6nDo<5vAP#
z<8PosRw~j_>0sk!T#NR|(_leVL$p{C<G5{A?J!njAi+NUq)%}9vjyQ=XmWNMs8;#?
z`=AkX&g9S*Kl2Olq3-fZUS~LAetQZOPx0rIjs&n6i6UGqqQzNJJsd$|xF3@X1?%LI
z8zZ(DV`g6yWB%L(J9+7$A`cKqoovO~@akf_vYZ9*7)Ee0Sr|+h?(tfO#>(JelA66q
z)d`7_G+5gj3fWJqd0Lokn-1W?Fs-WGYoVb#|JN0b=+t>zH7qZ*5bocONNfQYkDuUR
zk;3qn^<u$cg9FHO|M;XBGD!5KMfpwZUC4Q0X0fi;1hea_=o(z3+a248CHcj?M(%_L
zf6rP%M;4l`Gfr1-BJ!_uD;eDT@JG-)Jcv*{E<l!I5kL6(PvH5leG{=*j5FWVPvo3W
zCVDXX`U&JSMWlOrQ7#lZx&X`(YBLyI@stnvF~6A~-+TFgoxj0o*W@@L>kKwG+m8KO
zRuif%EK^i|QxHs@mpr2BL{WzvZRb}i{QC_Ni71zb1U^a5Le7pYVf5+}QfMQP%|qoU
zf>>p2Hf=QKBrt+CE3_hq-`+<jOudfq^a4V&3kXlnLe2AXN`Ne+a2ZV>9^e;=P|%0@
z<s#0$eFd=%gDA%n2&5DE++&AvY&y@`Lm4q+1FB+atQ~2<Ea`0$fxHh)>%<_chD@M#
z!fGw8S7x#1Ya)-_G6zV)17wx8f~;w=g1xC`OWuP0d(7sYbq^-k#%x(P$-urV%#sW=
zJD9_B9k;#NrfJNj-O7y9JndDjE-I|$q933C&3}V!d$(d`Zb|5~8}{x%-%!7(ic0wc
z4&8qjHgd*TvCZ?pGdAn`iD0)r!8WZbh+YTk5vab7O9QLO75sdm5##em-UOp{K7)fe
zKY9#F4zB$p!&sb|<)HnO$$4!Ph?3UL&tDpaCcC5lKDKo?1<1}>mB7|5ACRAx|INFv
z$A;K-3AFtE-rv%+fp%NcM&%$Dt#fdxhHc3FIa$64Y|VA#%-jbiE{ZB;D<agWi)Msc
zsu*qq#U>l5vR-Qf2mvu?C$xqm$;-h9b`A);7Bxva83o2laoSNv790LG#Vi&}HKCD`
zzSWz{qK}uCbzX+mHf+GDr7HZi*Pfpwic$Kj4*k>_z%6UAW;U((UCsXcvP_`JAuOgV
zK*$A}EpSG0Wy88b*3wxuW&>HL$Ch~n$Jhg5WYE(j4c6(Gl^T|^%fJSVvKA}pta5qm
z9Q1dBt;A>*!xm8}R3Hp2!7v54n&LBDp#kJ9;mnruZ7VE+t+yP2)~JcKICnkz0P3~6
zK2qLlBH7o2a4e!9BiFEWt;%Ml9}sg+5B6j8zFlZ=HcR?#F;~E;SC1Q0X{zUiME*O7
zNxuEUtGICVZT#b3{GrGz_=W%Udsvv963@HT%DEOLzNh6i2l0BPj9R54BoI26Xx&Yl
zSAzPg8~xHoK&u(Lu?f27dK><E>-DJ9UZ0E>xT$T(1x(tIATQywMsaOpnNqZ#)OEJ5
za1=0{FQI23g$+G1H1cJ%B4M=o6_f@dnC$U%FiDlXu;C!ocobEBwOuUMQLWU4E=>B8
z7zM8BO@}5wfnrg8jq;(*eR%ke?PANWFPT8TuU~9&h|y#5+nt-vaz@@pQ0V}Wyum;Q
zS09rbWau~^7&As{4M0U_kC>&)I#_JSRnW!01t~K@b1q-Bhs1OiFgidMUgNd)VF<70
zmu$geuv@v{;WDu6>h^M<Im2lHdzHg4zKup3wOUgEDPt7CP1AiqL-XO|UwQ;PxA!1F
zJE;#e(1{)h8EIM$EuS9;(U2d{{KF40JypPlUE8qlwgY(f>)%C%w#D+}hjwkf^v_S>
z!dquV;?=v+W?kRs|4)Mt*~MiM_(J==GRq5M>+anj`zbN*%i7wiWR^atuRs|C@!mB0
z;v2<(ha({@%r4^2&wd7veCB7+B)Lrc$%MC1jsnRl)k2ZK9}Rwfl|{^=4z#@b3`B%G
zL68EPic=LyCQ=0X;Gc(a9WvVMQln)GMrcq$Ggy`;Z#UK8UR9#m8yuZ6T|?bb%<j8}
z20!3p;Q;!48YcOh7UTz(@bPJylO!0rPv@JoMOWij`2q*i@ueajyL%g^Gi4k<J0<c=
zhf@*wIdj;#sUMfdm!O0K$ofOj;z=l**Q1q)h>Qb;Ggu0lro(|ezLpLO@8A_VoJHQZ
zr8;+S!M>=`Dzy~=urEurfJ>8x7M#z+HqI+~Vd1oJbpcuFg6A5qHMLeS*VpFrV2-7X
zp3`5>F<W>@2F%MdOV=Ksuxj=8#S!9Hy3E3gaEb){O@6W$5Q@c67(a*XrBh(JISyDc
z&RE0zeT{NdNFor8@)EmhV}|tXd;62Pa^?zuZ>u<T&#hvp;d^hLLhs0caFrw|9ufKq
z^7n$xnq?q0-v|WDl>+X3_#tdQxQ_$xMLk^H%R<JOr<_359s%>%iBlpQciVw|Vj<)B
z=sDeb^%G)@LjK_QpUW-diC_68%w4{Wqfh-1y}bj-F0UXIiXqwCgQdkeJp6@EBN&O`
z$^YkX`TN&z{aqYrH!ua)T@Ltl$7qek1vfXEQmL!St^mzGswrjEx=$#{PH9F1#wnFc
z!Sq}X3WX}uLD*=b($Kq{vTUGgav86)T8gKmF~cR!dM28R(285s?d8n){`+o%5{u&8
zQU!Cq5OO^|xT*zk?CJ^<<g2AHn?}R(#41uijLcY7b2W`-cMzD`sLvyK2G;FO2HV*@
z&~X%)ELQ7e-@+bRZV#-H*?otZs+t_1sJY|<IjFp|-NK$FD+8-011{i@3^coc)=QUV
z9+H90WuUpXzpA`URZ4U4<;QUA&4c*xqx%tQEh45ZW8DyEp5X?H6X)=wzxxj6W|k36
zCG}~<Y94BJ2~jnV`pUeaA1YQ;$s7`h#KMAw{qJA-4??RQ;1^obOMhIafft*#E|4T|
zk;4Fb2cO>G-r)gj5XW}$T?L8gzC;}2nG49yF9<m#8Rf@$wSsEB_O7g5exF}x(%H<?
zsy<nIJxM2?I>#??bBhQD!&u?Kd+(<|iklz47t8Z=h(=-<JADq*mo6ibOxniPeOhY|
z|8n34qrJ9lK*z!!a{(i>HG4WuG0l~zWe<swGg_^~ipqZus)2SB{zMF{&RIaciC83v
z%@O|Qa&}5~FqM3-URNVAX4{6J8qIzmUY#lmcG|Oj6B_(y|8ij&%|KKPLWKGP;_>~Y
zBLx)ETu`Nx5l*%WZ_;6v=MI(&hpozf(n;)APR)WmaA04TBl~0R`@rlw%w&gyyduZB
zG|}XY?l5k7y$<WBsFJ;|b1~H<7Z!6k51c7rPR9XUg9#>36O#?Ki`cR;jLWAc@X|M*
z5*J)5iwpd?TbP;?U`d)`YM@WQG!aNrHR2DVrEw_J8VIrmT8)^#CBb-n5edXWrMEYU
zXef=Iz7!@eUcs#o-Gk@8_Fa)J+qHIgFjcn79D_F&>p$q}>Bs1?xAFR`&mbMyfS$nt
zBgsx%GqYrz7T)pbLpc8Ii`akPz4+pP_%*!zjqe~=Tja-p`i^1@=_8lV;LyDvz~GjR
z{NnXb!olFlj48S?p1|>^Ul5Hwa!|A=hoMqOv#ue+s{!()S91m2|I;5sW@-`ng(Z<F
z#`M93ASWRNwo5k{?X?^SjP<r`(TJUxz|P6onc|W|G&FR!5x9<6eqhA>3f`V8;ZmWA
zC@&MqtE-ZnKn*eil6u1yx*{{rjw3;5w>@DW(#eQ;gXw4F+ojP~$}aG8=1T4apTSO5
z>tAMLn4OJ|9nds~6@0d)oSnVe7%b~(uuS@yJfOh5Mrlp9>+r|wzFp0+x<>OHtF<v%
zFlp_&ravbQt_s6eb!g7!m*z?bgM*RE@_^gQW#4=Y=9U=5g2e1H2iZ|*YCvpsrHojs
z*+TioV#SQ&Vt(TItk*?`ZQCC=wj;N#)2W)z;=nDN@vndVb7EWU;P$QPUpIu~KX_3O
z5cjZUd9&GTuTAgf_M&w%!yM2K9{PX?zc;H1&viFWK%ilaY7I-7dF;C5X59P4M{(=@
zcj6Cz=9h8)!ZG~ofA^oT_wL(J$YtL(k-DY>fuE-|trq6hA-NHf@idM+`2)Q5+$;F$
z-}ohLKClD%><V7~r>FR9Tom~a=Di!o=D_vlJh<){t*Ri}Y-#HnZCR_6z*S=|>A(&!
zutrDC72y`R@RO%SadTk>sc29%K<?a>!uiuz@fPzT8RJ()esxra2BA=cjHY2+gtOx>
zbu!X`&^_4d)gL5X6|i|_o!@tN$ECC`*Xk-sgLN`kpPn8j_H0A3c}Xo63wRD8z^TVN
zJhonOhb{{jV;(xK6!5*O!$5Pn3ZOZyT+FS@S_2OD*Pj41m(8NNIFD3Vf4`_h-|?y`
zI?-}Ya4CB4B{QEvfS0!Y!@byX*ByBKjmyxQRiT5b<g*U=@T0H(9hRpj@zB5e6oS0`
zIr{x)u`n@<fsG?Ztm2R1oAulrF7+q)-$Myo{p&|?=)rs8kDbKa#R)M=yecC$KIo#e
ze)l%qxqCbQ@^}6#hWP!=Ubuqd@-jbXhOn}*Xt@I3$wxZXhf^=Vj>dB@pnq_9RW?jo
zGwIqifhU@H{B_;BcOUZ089ejVuVHb17Pmh5AT-W!$4;L`s<+R$fGDOLXV3NKJh=W`
z2a2+Xh^N-J2d6Mc$h92kBJYoKPW;&N0?72tzwVC)@PUm<1WN@>UziXlSDe_!;xZU9
z89MRWn$-kS!KBWAM=Q0lQ%!a%$o8p@*6VZ+n7ISp7^~g=0Bd5*PDrH3lE;Qkp@9y#
zS`~~lb}D_D<S4MQSgqr!buM63z3f|%rq;TGtkxZ5!93gs+UgDiR{)H|*UCJy3><8B
zc`=KJKYkBB@X%pQjn8z}h%@FIYLMA1fi~qDKm57Jg$K5nD~hcI?WX>^((6MFw1G{V
z@YBEfD_B}s!KS@Cv2EWDoO}IkB>OzFYu}YN>&<3K11)e?Ug8Yz_76WI;vB#GCtt<x
zTMh_Ef~IL57YDrAEZNOSGAZ%<DP*$fO$}gj<`T{yJBdV3Kcayse)PBhfU76ZA(nV&
zgA1*8OYB|i=^MDF<Uo^ds$UPrr&KaplDXsdgZz66atj%>%S|lu_ikxs9<g|$^S21;
zKv=vE++eiVE-f~;#a=MY##TF4F1SizS*tTgbS-<7qO(L@Qh>-J7zn9&>5VHW<V$FB
z)*2ofKrj|TD?s+GnD9O_as~*7DkajINla!l%UKFtJ22n-8;;sfVeV#!lf63Gs2rn6
zKWLK#qWbyY6-8z2Jbe7b2n=lk>UB>RYg+~>?FCb$K?0{#0Qr94<&%Xi7Ez8mw2#a(
zBRqW#4g**4i@eGORv3(TG8YqzImbD}``~@IV}5cT<L5330AQ}Vg}GQGfh|P=((X6P
z+s@9;V#l7HSjp6pnVT1nHFNnY26|L{@z=kCiPNVsb!8F<@3|ds{NQ;6BB39X&9bg+
zc4>JYkACU%2q&VLxO5u34j;hK=Jm+(3XPgejaJjNp9nTuHa04dc3UnL5l<vUm`swN
z3lwO6>V=n4sLta44?m8*_uhr?|JC1c?$JcLrw`fevZw+mAV+%-tzN<#%m01wOP|5n
zS6;`&*-;TDP8ktz{L9nAv9bHkTLjD9uzMF?`KKrKu=38CV{Qo<y6!6V>(JfR)6(RX
z+m6XF*OZuJ8!V)TnFL&B$`u`Iqci-9UD3_t6gs0+Yn<^l;Op<z=MH#@;v<$KX4(}I
z1xL44q)oKw!a(22r=5xFQ)C_1${aVh|BlxtTxM=)Q2dA|6NuJUP~l~=rucYS8y0JM
zRB3xHGX@q^D;u^0x~j237qTSdvTxZvs`l!_*x3e0IvO0BtgNZCZXoNtsM^PLR}YMl
zSs+6)6~*b}m+|_Gr+F0<bnk!bk||5gvM^^_-~O||!^PuguwmC$3~$?r+0nC{rNvRo
z7s2?2?e34<FGj1s{ilD8i*KFA*oiX&?CjfMe@v%=$4`QRka(QM@oBvB)c1r3c4Yfz
zoPG5e%ADourM~V=DCP1TRELr1OJXNyil6wmU&gN6_aoV#!r1u}IC%f<*naa~G_^Vg
zH*LiD$+MUrALsWG5If8s`NC&KlaQhw-%~K6P#pgG=2OpMWo|*(x8#cq<?JqAoy6TA
zf0SP&`~rX}B+5nB80)>kXs>lu1JVs6C>w^Y3!1&Ww0E3M$<Ds(O0zohkU$t>3arTw
z5I>#R6#h(05zA$?`N5|Q59t;z3hX9<ohEl^2_7#As~nj9Jt@5mYqyPU1@FeM$GSUp
z6fbSoo^!yQY*b>mB)3pDXRDY)H0DD)yT}<_6w#ggQ7x7E-_o#^)v6=m%E@9OJucvA
zrop2;cV)>sbXo_<!q&KS#vn>BgWL>rMjtx-vP|;bx-=xFm&g4>eVDvF!(X4Pi14y>
zHOWB!eJcHX26}~w{>;%6SifU4w%@c1`TQd8eBc1K9@vYW`*+}be>sj5M~>=C9C-zC
zfrIS;2R1PY##Uph?^2uPAE{Iijz9CFV0$s&hycj=KtFEh!2jf5{ylory$Hp5b;B<R
zRF?0#>kt+vXHct_MLjV)HZFjRCLh24`+q3N#a$1460dys2UuR3#mL}BRQY)l=InpZ
zori@#H#0pah78_IZzmmV%QJI=h5O8`TapC$g@P77(qDV=*hw7ymuHbkr@V%diLk8W
zze7)~af8uzgCWNH_0e0e^nG{$u52-aZO&VtLGJ(vIdoJGHoXCT`+^yct>=3xNNT*?
zu9U^zdI7%K9GbK9$c;^5fWK{e5|^HDYvl$Q_uXcSSf8Vs45`a!*B?Q;KZ&)v^jnSD
zJf`N)8jY4P*bgKE7-%hH?$im)%x5v2@FU@GqYa-`5vUF=)}{kH60h9jw2tX2?b;x#
zIY(<P;OYXhHs&hF6*`7W9HA&ob2iQ(vD}UXQ7e_O<=}oq;t3RUIo(U$O)~H(*{R&7
z{a^d;xEZ;XJjPF*1>udK)$z}N^cOhtou~1{FZ`^CFI?isPtRb#D0@9O(ylogk%?3|
zYE}^-s!}+1jlM@K&?&$u7Dciz1&x;^epO$#c<aL-L?{tMex6@=Ljm-T42e%-!RL;?
zg;&1yeGYE3;*uT;N3gQEfKW7w?9u`n{C)@eMuf&n+G&kH_8<Sof5yW26r#qk&wKqr
z`4D1Jq;Wh^lqj*?^w0pdA3lKD%M)T(n%7IG=Y(hj{4CshgVC-Av>LXWjWBt1(>4Vr
zS%!3mr@@|NrwJdR&<Y?W{PTl-M;|ZYS}GPYC4~K|)dZrGE!1iv%bBZ4I%@E%C#}6{
zG%>hk1Oq!aB3r794l|<;uK8Sy0y*K+@1wxcmdYQP`3KI!fq7V67;{@+9DY#QebCX1
z6~m~`pL;Zf9YYbQ**P4YUFIi6RIE{_@~$vFgJ60cXs%ST-4(O>beYo|>tL(0hU@7p
zkhM}x_R#7e>2?=5K$bZd32GiAwNj%EUTy=pwOrY9#y_IbATFG~jJ<pJh{woh3W7m-
zNd~SBvh<Hn!TPP6@T0GPN4zHMw{7IdNehz~u3~Ot3cGH(3B_z4nb`%gD~uK~QgRms
zag)AFnXw@PEe>MzNg6SMiy#>0Km|XBD1e4G?}qu$=%Q39mjr88{XSeeaf*LGEC6ZC
z!M$QV4n-MGoVy4=|K1x<K8+}U+yf7N5O;hmjn}{V1HAIo_i_894`OihI%MV-aO(Bf
zu>a0mkfFhVP()ljNE6+6_g(xVF~b?_jMzxa<h)`2yb}ERs$w&P_LC-E`rjXkAeUXi
zfBfp7V18@@-+1Z&mMmRfU@MNBLH^~18;rKQbTHi3oXhn*oCj8(s`KQ9)xffsj2b`i
zeAu+U7ZVFb34@J;h_jT5nH64ghj|$m)i>GlQZJB*BQiXMOEY;aE*JSp8Wt>>a%4&G
zit>Z5oXKOouZfL;Ci0iZbq^}VGisXMl^}KYolMoHw`z{RQ4WxyzlDl^UqCn6H`>D2
zxgp%d=#kfO{Mb1WtRuq4`R%jWlF)2bNA7@P`Fh>9EycFgK;9b$M<9$QISXWOtY&Dh
zu-0BOn=8ZvWTC+xye%<PjkzbmBzFm8tZVZNaOcsIeTZT;H}Bc5do@WO>LwXD{H|@S
zC7M7R_iPgkdSu5|9Jv2(EKJVg*wZfw03wIMi66a!<@qJy2aP3TNc8vNgP-~cw(j4J
z{`JHB*lJ?K?(MkeiAT}H*`-tOq-NF44}1U{cbO?)45eZbJ8nIMZ5&u5oK2GMJG^ZR
zHtpXd_I7Q%`6k4BQdpdx6`2aed|&_mGx&>t|2tT?I)+dE>Mvt%auOHbIF6GqzJ{HL
z4`OK3X5^MK;&r0|fz)81&_c;eOByNj^xFD<qTw>SilA%BV#+R+6t53$$ECIJIhW=w
zy=&&UIau;~!ZqLT{_gKyS3vvvLi68bi;WEgAR;`bZG384XL!MCmT6YGX$>#HC`V~D
zQZ%rP{*a>o?$za*7*8Y#K`{)@1c;ObRH`)al`q~W)_<HIo#Y2|96Ju|K(0g)cy(S@
z1<)=OQJI-TyuSxY4$6UQ5mkPmE-mE*OAZ*GN{-lq)v5-mb-EPnM2VT*0HI4&Ds`!}
z*F?!EqV5!*$V!MS4WO`s{PYxV+cShntAt}Oz9B$_q>Xj!2N8=!kYCA(b?4!M^@16g
z;H$#EU00D-k=wOSNW%@xKECNn-h#~#&m@qPHzRZ`PEIBZ8^|)vYx4o%j6r0pZA*Yh
zN)`S6wB@2yMRw{c_*=?L<Q#ma&-5ByermoD5G_nhi}BWv{@iC#;`f#20GFGa#}Yp_
zYK1Zf*c9&g=!0Thn}FTVL9Az>58F8y5>Q?`ep>wgPF@OAkjm2ZJio2qvXaqjMxihS
zmNkC7QZp+Si{r|va~L~$4sp&r>Aa|NCVTn#NtF0|efH>a)JtU{gY}IJWAx-n^!D{)
zBM0NLbE5*_*Kga5=fD1KJowp<p;~I-hu{7q9K8KO?7H=!SPnXK=?cHEym*b&Yj|bN
zvEQEnl@%7SeRtoEd47!VJhUJC?z$bvpFe`DCr<O%A=P#AK^)WkJZbpD-}|lq`O{}^
zNC#a$I2(($+ZyafcKbdlok(fMzyfTu&h||Sj)oB>0W}+<jH3@q-=f^h1f6aC{`PF{
z$B`rFacXo1n>P;N-Uklh)zL*>-c`j((B=nmd2Ag10e*trvjcCubP}geT}3h#6ESUc
zA3<KytjsT?C!Rz!5<-n^R$bj)9f0xi6Oo#9#assa4{QUiSZ|9_U`3qB?RpJ8i4a&Z
zi;<)snN|U%MoH|UB0F3x9usDK1ub!6(qmFNyMNy%ltMm~H~{;lVG7%HmjrThdKtP&
z1z5f5)%kB{c7f&&iE)<q1lk&GAZbhIattWIv0u#wl1@fzWz6zwg_r5;ckV>6mBr}W
zqX_Yfrh9F;qsve7J87-74S*jLbdznIl?KDQcE30=A=qcKzZb=otY{WZUA!WKzv*wk
z{FV-`J`stj;mV1#IP=OIygZK~mWo>uo1%p0AWKPH1h64~9ElNHF*IRJww24K*HB+s
zPHXPzc;U~Dg1%??<1$(<IX;b2wtxV?pBKLNE!^@`58(F4K8zC_w6^Tsg<t&7e}osm
z@k9Q6bAky+;|cEzjfX>k7D5L2@lMb6y_ONkwnc*xT0=veR|UH`lfU!vhw*p6|KBlp
z;WB@{QrBoWv&8j;Yu6vpwpl~~trc{l*)nOJ`<!G(YhTo7Ke+{P(AI?-2eXwT!W>+;
zZ|p@R=)>4#hBJ^}^la?s%rq~`u<hGNFp;SslPQP|2^J$A9KxRcn{np#v$!}qjRXbL
zh;At{B?U{%CER*wGX{6B!;7cq5ab7YDCoC3=8DGwN!GE($_j$j9D2y0U0jC0)IzJ?
z6n}qxX$4B7ih@t<N5S%xNt1n8Sj>s%6(MgYMalV9lsL;FbN#w?eF$=9-K;AjolJ4E
zRSEFrlrH<Qhk4OcJO)GD9e*ZStU6ezbx-1gy@PJ*@9rI5UQ=MsTv*M~{DOD>s@O&x
z$K3c7Dsxx#`~kK~d*3WL`1@SuuPcpxQpK?I@P1r4eI93y9K*Il2XOHI58&*P<7hM*
zf(@Q~{VhadQET$7ZzwEeo^}m_L5HGYp{<L<oP#7u7<3$N*}n_tUVW2SP+^@x8^?@h
zEM>GkFP*~aU#hA#-IgHx6(<IbN{v5O0J%(7Fma6^|Fq(!$p1Sv*pJCmlbAR^idZC$
zFbDiKMIiFWC>09$@XvmhGvG0tfBj86K>zqYFOjLcJT)h_JzO~U7IKTrxc$-l(X7?^
zg(h%qV-G{@2GFji(P}KHX(sc4l$Q$2`{~JWG!35dZ{}o}m{D(FWpM=`x??Lcxhgho
z8bqC`7%%dYn}h4yW1KAxrSYkcZNyt=Ca|zj#bBD3;MJCp0jQZl`=7#<0xnD}3Sbo*
zqYc2QRU7CVNMif$O}I2RiA1e}!J!`HiZ!v!uf`vXm}}Ut2pyH46RpBg{XsM{3kYa+
zq=p7?<i)pybP(bv2r(ExMJaN|Qg4~9FikK26&+xyRBRb6T{Fr#9|v5@VOXvNP(zUa
zU&ChCvakD=8is&_xuPQvc&+i4r@JKk7Mvi9E+A_$Y0aokRvAc;^A4m@RwlDANt&<$
zu7jj8enAT-gD5MCN5hM`K$b3IC4PZ^{1-ltO1^}-iD{&Ic`1MPD)v9{A=EN+91t#X
zkmX<*kBZ-+CYSkuWC^QRtHR<H<$y-uS?7$6bXq#ziGh;#ORK(TFJIN)C#6e6&LJVo
z%X;Yd2R3iOgFpKjeDlBknHUM)ynm0VdX^`r@angpLKy`-@R3gn>H7!Y`WtK**ltL2
zYiFgzWNA2~u)HGH^1QbVaZN~QiM}-Eu1<)@8s5BB*wlvB523P>m!^ok8c%{S+yL5Z
zTr7i{=1hF*G*v9!Phv?5b4-oV0i&u`dCZKJB(!;9<A#1@o4o8%LU{Jnyy)~MA^}kn
zCW9)L=CdfRk8wbZpqVeD#D8zyKmz&6X>3XQIE&eiA3l2;;Yd)dr-8{7p=+P%cnHtG
za1xVavpBeKJ=&QDv_ch!_HGm&-m3-9dJA>L`R`N1&8P66=U2pD`Z6z*a{TvtdXm_^
zXCubP=1?O4tIuZvq$>M5Y11wT+E^lr48MRV;$*I&U8jr409v6GmSzh`M9WZ8gJ7gf
zJBI)ur<~a@QqJ`;tFu_gNG;r3gBiMjEc4oS(B(1V&K`C-3|#-+$<46tkH2q4UQ)vb
zwBEWb`A&;VIjm&Ig?|6ZU;TM}_4oe}XI?#tu`4UMhl9;cx9-M?=Ux#Elqxd6aI|#p
zir$yL4I`q=o*um{Tn5y9TA5#hxsqHoH#y^7nw-`BsfzqmJZx(oz)MXcY9hV(^>6d)
z#*gfB21ma6BtJ$tV~xcTibRoC`*G@}qx|ChGKSNeglrJz7YC8oVA!gz<##2veeTE`
z;%|7br331hQ202#Hg`PwASOqzpj=<Vmc2VU0EbY1?KtAeWEV24nAKYJ2GFkdA~P0p
zCgy9FbO2i{p5S&29$K6%gBn204}Ka>@I~XeI9nFj6(OeR(^t%xAF+^%AHFdmB!wgg
z;Du}j{ec!Dtck<7?h_-NgZ&B2%w&*G$E@||^k^aev!#WsIOsNWwmi335;`mGE*rf#
zgJjsxfz^-RzKud34p)}Y6IL*{v?yE=q^<dkQjuozTjm(B&BH1U67ZkZX~CmdlcJzm
zDPi4)Vbpv{lsKq1n?WR!iU_AxB#)^rD$!+$LKiL8WVP@HSy_)oXIEHfi!E%?hpw?&
zXT#0&JvHSct&5GT8|cdSr&)}wu#kgRD)5VH)TPVPYfIi&AAe7$E>GZtpZo}hHvY6&
zsQ8b6^ye5qHHuO_j9mwJptLZ9*(*`R(h2O?vKLbqt_WS9*3~d0eZJM;)k<Fv(gVFB
zD}Z!Wl8l<Qn$cuatt}0<Apqu~=}T0WIc`KiN%8~*!G!qZlXHMHWRofC>|7I%PsD)M
z>g>7mR$M%OQb-He1X-){)DSZ=dfzR`lFhA{)l<L{Jw3*vO5N3vonI6eA9@|>H9GUc
z5Ad6R_*E461+QE!bOl;-)sVup$n}J4%35F8|4|=*aI}ygpUEfnra%jA&LD_I&~C04
z|Ca!Xu6P7s#6~rvldYK}o(8CD{(#t8%ghxuOg}h?1&VUtS_h+9%_>>eqwm!lEo@wu
zMx<WA*rgft52l6onc^k+^mGQrVg=z)K&;&eg><(-G#U~<TDe@Nla@+K`dupZ*X`bc
zg}Dr(t&$j=C|C7Gl2Yv?w&v0%U6FPVN4H-FTVvRwz*)?|x^>un_#md{tEiM~Xe?eq
zY~3!AdC+du9E~tX*~#4Tf;KJI%T-_w5!l$O$7Te01FG%uGzUv{FkyMo<El0;kLH)x
zx^QxFP^RqC=$m5MXYXLYwGhx`RRpRl3(MGZct7s_#3RUM^T^K4;rP=pBHXh9H7$t6
zOQ-ShXCLOQ>#A@AY(Kb1Xrh^!1(b6+OHZWth}<qhI!MOEacqARoMX8%Ven?NjCuUN
z4TM)ew?!kkHzllRH{E+DCeMuG?dM(+mb7b4JgQ;^P+h#Xp-|Wnn6tKz3MU48ZaXZ_
zkMqZl^K(b{?9xS$8j1wABu$WZOs*Nq)y*#Dh2)azNs9<YH_qxQUd3?gk5|UO@hjI0
zu3djVT7AEw)$`Ik!kuNQP_c!bz!+$7Sc0rPRq~oE5^K_I$F-TYsv3!1&8CKR=`a#O
z1@lV<Wcbx|YH|@%)5}PuBIxf=imjbnwhZ!8Du|nI+9dp$6@Eey(^M351+*qi<gs`}
zl$MjH&w}NbkT2FyF4y5VcOQuiR~@*B9Ydt}X;M?qzR}iXxaCp>yLNBHfxB<ViMOs`
z;lztjTU7+3X>p;^nhgtJ-EIP{3&=WB(X0lSeUpK;GRP5q=(2Ayuk8qM`C^@Nfh~Xr
zYw*f;X?{6xPb+M)xhfv|*?)z*9=#Xy6SGE6h7K5{sT14l8SF#<`XO9CaSGr3zy1v8
z-n@YL`rTMrDWO`-WB2VhqqLkwW_F&l!~l--lANqkeIo-X7fOcxN%u7qQx#=)Tl1o;
zwoXo0hYB2k>t$zIBX^?bQ(Vd8?3=G)`urvAyzLObxFm$Vi`egK)~#~6h|M?c!PbNO
zP%Px$mCcJ7EIl4gn2|r3hBxQ}CyslAB`12*;(3zY?Ba!!xSL<_?)lV5#5$X9k7;Zk
z30zOOb{*~vV<Ag}g*0-ib+h$Ifhsb4F;7s)W4fk;!H5SmvunE?nCV0q$4*Tl-YQ@q
z6+$joLXv-v>{E-?I^waAV4}mrJt!2a{NFyTEEfdJB><l0fE<g3Z4+Shc+~WuC*)T<
zjUAhr-vS2(R(Ok(@kq{rcB6rKggVQ4&Zgq<$J4@*5bWQCcCDm`)z~CRH)FN?V=W%#
z;f;lDDvL>gDmS1khATNl?DnjV9AOQZbkl(~&2zD$>tE+KTV`MGX#ba2HmZh9wuJ+?
z-+{5y7qK`!&lzY??0q9gz}V?g&UE`wSXse|myTomEq4eRArz@0%GoY8w+4oLarMMo
zLQm`&>c^pNoACPgek8_Ki8ag7;kpJ(KJL1(bGa>PUWNznz#G;Ts6Bpfm8KI-#0~VW
z!`YXQBD=7NZHM;r@_d=I$)#0g1Y(^ze)|Y7;R!6YYXGz7`IYX+ThF{8-j8Ie2b=cq
z7GukK{`lnV5R!+v<(A(j7D`~|(nWp|TPHGTsXAE2>w5!euh9(iSq(5vDmwuw<3O{m
z#AdEA4rx=XbFH-mE~>uQ#C9@R42qmojkfSO_9v2vh3Cb#+S!?m08)AmrD8>tghyXJ
zC$!t=pL<K##)b#e;s6;OOrgq4c#=ItbHv$nlD7qb!5#7~mzVC47xACX8V76@V{=Ue
z%Q-~(<Extw@bA~5Rg1QfTg3%p-etTU^w80vZ3+Fb+v;FnW24!&A~;zo+}jbno(r>I
zI9H$ga<2?$SpD`%4tA$reH*!nOPo!W@aWHeN|eNJy>Jwjd>*|6Dct+%kDy%9kh)sN
z;&KHcEf0m4+^u#LI}Yyo|JZvE@VL(NO!PfdF*BHgLGJ(yz}`hkBt?l5MagQmWjpH<
zJ5Jd+&N^jNH}~%I?DgI!cQ=pkZZ>heX|`j>RkAJ1lB{CU5-EuyDfUhRAbRh>3<khp
zaL)a|@0^)AZBQsF5A<A)3=;r{)6W0D|5x7cebIUK3i{f6;Pd;DoS8vEaS?_^bo-gV
z_&uC_<p^H=&W})0Tg7EAq9#R(3sF#3j8>7RyDT7Kqcv;S09z!QRhFrA#N1l}oPEu0
zaEkS_>%jwPcV0(tORHf7*8m(YH->xqaqxlt%=K-*e3kFJ+=!Meany-BRR?!YqsCcA
zY{hGcmXzV@v6CpNs}oVM*jwY{3kK{f3D;JhOrnBmyEN8Z4v=*btt9J>3gt``tfw#;
znkohx85u^0Sd~4%hKZW4YfDcY#nlyPTw9L9XpqxNx*tWe^c;B}Cr77wZU-chB6hU(
zp}%Jsb+x4o%H&B#!WfhmIn++V0wcC^MpQ;qBGRd9X*}07V9d`U<;X+L&OKPQZ3m`$
zn$dIRER)mCJY$YREm?tVaIDBu<+3BtvPph0eW;}^gEBxU>whnsy7y)yMcLwEW(HYB
zC$(s{3%5kDP%P$)`r(LNKui%)VNnSEz2lg16f&K!zpD?Cl49hSRw7Wo2E${(krz%N
zH9durkcfWozYnrE%yh5WsYy&vPH<{lT3;=IpcrRfdyBOLNC)BIuYL@*>l@gdk+lIx
zn8oiyL;x)}XBA~Zwu5cRtK^Dim0JvKG@&68#S>$JCeb>sHFK0o*O~=v9QH6lg4`Fx
z`=y#`9!)|ji$9kN>=J+WlcVEWy<B3j?rUkoOngf9U^CrFb7a-l4dRe0K~Y%|9{RN>
zc}T?0M*UrVApbuq9XPTPsBGMLvW^}k8?{ai9#rPdt$~zcY6Pj=TS*;nrH-ePVSr~g
zEdg$Ro(tWBGbr}Xve1Xu?cin{i(a^#*$7$tr+xvf1X5>DT|;qkgsC%>S`qJ-MnBW`
z&yxCrj2lhS`)<JkSlKBzh=_U$tMAx@HLDBp{I{M)V?!zKKCl~SuF`9ijFF%&(l<6z
z6cZ2CG(xN6%37k>OfyVhDlj`A$VPCtlqz7E_{v^4IR}NyCXxk^HG|Aiqcs6E3&M*H
zpI;DRSKJ$y$uVIDZgEXLJ};!$G=BN*@4@Xzi4@t3iLp{7yC%6QySA|&W#s`h9UoV(
zCj$n!1{*CZ#5*s&hB1)>*RET`lZc6!NQFhz+uz=Wj_b|r-l`ZRA7O2P<z{i^G-zB-
zG)t*I*@zQGkcKK~%?3pZfAhjc)NE+Po)15Y%g0Y(dLqsdtX=v^b=AtsRXk9j1~=C7
z0ewCsu0sq05*42lfl63>M!O!qALm~`#-%TcVyWC>Sg(4Z60fiM%mr1wOgs*aFw<x{
z91=bVw-sn*gZb=93yVs>qD5iGu5>oKlJrd<lOuzq6BB2LTBm~t5T-{*ktA`JIn`PQ
zvZ-q=KscTdK<o>ls3?fBk#TrMr0Nr!ktkR*;xRHT25phdh%}KNpUMlZE#0W8D;1y{
z=KE%wQnJ<lM%SP+ybj$=KQw^w<oV%BP2uEAud<DbFH`_IuYk=0Gdd8mjf=3(X2vMU
zB4<XJ4Zo9h#+QZ&SWf#wYE3({t@mOeo2FaICXki0wcf>Qve47EY(Q4Y1+qGTm(_;h
zY-|+Hxk<R?7*b<h7;U+LUHdlRp-&#dtdfU$R|u0sLn70WG1=FS<aB}on!uG*r3O2D
z`FoNSEUhlbrFV|8#=(w5`w<fdG}S~&`+(dG6ib&rN6Emp$z>DGE;D|k*D^Pk!hN6q
zC`xOpM0B3eXj}7K|LkbG&LxhAf9=y4n;5nQziAQW*KTTLM$Pa@za<i-D0O0F1fxR(
zs9v`gk9^^C9GP;*TdZH2PQw!Q5}3I&J;Pk_`1mCH+Pc-fF69(GkZuF*!ndSZ7BDkw
z57|%(NDIlxCSb5^Hd(Pq4btCFPp42-5kZk}9>qQx`93Ez4br6pNpl$>M<`jGx?@wo
zUH9$e?s6oQhpMVV3=NKBbwd?LtVyzo5&tMDK(?l?3<U-GTyx6L&qHf-Hzvm82>8A9
zXeyvm`lt!L=*u3^M|1{5LM?q4|Axr+cOBfzl(JwXgnbX}#HCAJc;{pr{CO^21S=c;
zxC|@<<7cLqAT$ef>l=<nZC$;F0SvWOquQ2@_={pE5F;B?&86^U%|hslfUF_9*D|H#
z><soC*o49Y7ve*`0(2*N(vMPyaMfx!g2fyIP?M9y!ig74HswU?qr;4%F}8NmIN9`P
zwTSetzWokPyl@y1G7z*&^A{@_*iC>b_9cVmMzhpkAhrSNGtk(1_U{}B1q$%`4}Xet
zN8T2ZdyOVqZhU;N*N67YH?V&9b~J9;#%VtZ=ujg|VOhrn_I>nGtl6>|lOi~w=SqnK
zjXtZXi5Skm_LjQ-muU1zQ7`eD={7MqoHf<799djQOx*_B1p`_n6_ZlFWkN|YMOK;U
zM;8I>r52IVsAPFW(z}hvX9e&j5D_3nVBJ`gkNtO4V`?g?9ft~Uw3+Ey21FWQAS%qj
z*gUq~vls3_hym@RAG-$wy(4gm7hYHx5^2#KZ?a&%Po(cEkC&Qm#Gxb(ZT;#B3=fQI
z6JEyX(w3?uE4n(eI%-U{VRi`>e;#`B0c_p95k2iaJn|U~`I&nRIa`0t+Wi=#SbYR*
zmOYepAZqxm<*ax&N3l8pO~2N3X(xMV$QDD%4Cu-*s&K(1CcYp~R<<8-fMQ`f=p$K4
zF-tYd%y&(uB({tveF&1~yXV6Xz?m1szy819MJVLUM9#7zAy`tu)GwwZ<<K0aCeyr#
z;O50+QY1?vEMo)1nw9x-N(Rb%S~Aeklq1fTvlqpoJ#GRm8vFJj8Bd_&;uY*XcrQXC
z)hCw@eFRCPw<J2=df^Jj2S@n21qwo_+q|9`GgKldT~&+X>RNQPUPssUW;J@AnPFiZ
zl5~XGN@$T9FYP10CJ|{nGR$Nh2HLsXK)diso3#2wnQX=lLNanjicf!E!wkQ;meXRf
zlMG@)fM>qngB@FIabVwCv|PT9!M<U<a`+-zuC!ovi35rFG--sRv?PT3x)RnbO^E21
z0Czx$zdo$D-n@aqp*Vbn<tT6501*HqHIu*{dp5H`^I*TqO1N^q8U5mMNm>zFnPQ-O
zfQK*k+_wXL-GgY@P>;J0?Bqx{TP~1|?zcLZTb7R#FU;%ppscb8V?!hG=7(_k)MZxs
zuUx%`XWcX96_bo4WSbI!DeX3@Z7HTyK0BCTU=`@t9EzPYt)&E@b6S96kUE6C09(L3
zDP}T;gu%*N_p@bEEc<&!(-fcqg07oANG7J>5Bl-MZ+}W0#z{=X6qHt%sag{0F=&ys
zblm8~%+!opC$yyc*@hfNYb4Y?K01tD2lwNShwc>z?Vt{@mcf~|gtyAOYWdK6_XYD+
z%NSWP{hiFsuC%7@-H$$m+Kr7E8t&nVuJq@gQs%fmOM*HRGh>LBm*C)Me?=TJZgJ=b
z@$CQl2F|~J0wI5t>$9rj*sZ-*`W(v}R%2Z3F;Y*H9FCmfngH9|5$z&CJCi9GSd{l|
zQqS}zmW?9R`sj^7wzi@G>+7PZEpnkWUq;lIf^&9Uq=|!=73t2JH5Ito+K=A0cH}wL
zM%TS}R-?#2hmp=!u}~bmsfwckzQ`@tx^en+I}-CA9QxQpWId0u(Mjyyvq{r^l{3){
zH5_JmDrg>ko&8*2t*tA^jf>5=bm}TovgmgXE#)Nf8%{wLbwY{ix<rMcni|c_ha&kX
zDh?wV8^^OhI)<D5KuO~cOeMvp77JgoSpCSRTDGo4AZJT3>c^O+&}FS*6l8VQO|@7(
zpvyM(WOF@M&bnb(Y;dp)kcCOVz|2CBWtb<dBtx_-8`f2FdWsuBWoy=mgKrwIJ%1A2
zofE7to9A;QJ4LT<<mq^f%MI%2tPTVf`;e13w-gmV`G;TNS~u}-vyrVnZdGzLz)U3r
zvkt=haHGhxVfPNETAldCi-=a1qhZT-Oo&5+$_wcdNpW>0i`IBuK6pHNc<QhIo}0vy
z)4{K8`~7#}V}JAoG+n)nq3#}bm$-#Ym)9dH+EKKfyEL2mG-huD?Lsd|Lc%UW%4UH!
zQ%6vA0gP^=X%Wbjh-Cd<mjGE0{H}SNJ$)TN`{|qb#mlGQ6bMPWt<^Qf*mKWjY}(#{
z__P4Gu@SVlbco1PM4=NyxNB=6=BDFF$r6v)1_K@u$<E-$jS<Yji<Ec_niSi-t$}O1
zc|I@d*VgdFSXFH~s>K&I0?Nvw{1Qv6O0eyY^{hcl3<m1V_KW9=mPAomU&#w~YAV5?
zR#jil1bUh*BQ+-S2P6BG#%&u>63s(?k%+k50(fT<76yZoDFv8IEwTY%6-5uQ##*jy
zuEpBw!^)<bsBCj68ZE&sqTRB*ILPY6g$&WQ{yrv<%~1c$bz)rvNphDLj-5wWcLJgE
zdQ6VSn9T3Z^JEUav=b{`$H#vCNj6-Z7#`<Zrxj%N29ZEfNhw}`>Sy@+fB7qX>W{yO
zyB>W2BSQl=W43r-IkUOS2nu_tO=)I`Ql?=>bTk@=?YMD`ooVYfZ)6RHxaPG+yyMm@
z*SIut?}r~lPje^cM5Ip*S*pj<*eunvPdxWB!l5V+AuLxLfj)nacuo>CAMY9BhTTFA
z4_Y2LeVg935YRfLX<D}_vx=0y93UIh!puB<hA*1kP_wfsG}acPe>jE{Z#E%MWE4IT
zp^);HB&!=J-|xk-w=QG<z1vV)8pUJvt8wY<Rg_m2WA&y+0f-xzs*{Y5!5z-ijwgjx
zni3*fot>FuP9JNEipaCJu@;RRSK;b~8`yT|MzP7FSht}L|NOU4Gq4i_fmDxX1jugM
zv5q5Dvc&0b>xEOGbk*u=9RKAhln78Rt1d;TAcUhYAIBa0wxZ>F8`d;bi-i})+ouP_
z#!tfMR(Nnhf-#*|EE`ra=)~$HLbHOF{_hRq+%|M9i(s}6Q1zBI7TTTNw3m$rtzA>g
z8p)b#vd9YO*haF(=U}TN(uS2JP1jd~f~?Azq%(q4<T<im!`_cPino69f{4=kSa;S6
zviiCq5C{fv>FqaAR2b!JH7QbU=eP@D0c5Jo<uW+4?_m&2eFTbH%eQXCP)D}_#-wVm
z?)T&Bn<rJCaPewfIr9$N<?MO<5u7{v24=>mSgV5~i$K1gEuV&;c?E@}8<CpkH%%GY
z`h9oc;_Gjt^I9|9?&Z%B@I>A8EaFOx4M-P#^QsQ$%u2$w6=!Ah&S2{Ck<qF3Y-J;-
zZETc`jSX9B%d#OtGt_R=%`g&n5m8}0K7$RbOHmkfqy1(Vr|B6EZCVtZd>qAMX}Z>q
z#H@^MyBZ+RO!2f&TU(!qUh{CXxd)rqSD>?N4B~uc=758V*D_}3#3uF1%tWBmlz6lQ
zeZv?L>0#TAE)4Vxh_tDVbxdzwZ%21WKSxl{KYbYfeClA&iPzSH{7?YxP3`Dx=|W#u
zAM%5K3=fW=`AVyJ-5y*!e*<gRui}A;$&m@fW*rzCnL>WPM<+>WpK2<m&b$F&VaybA
z1FVq+Vo}`!tfRe423c6W!g5V~**3oPhi~?=B)hVcr4eOxa*$wj*Ohdig@eiU4!m>t
zI6~nd3JL?be)gico?#o1HBI`7g%*tz;pT-axOwd=e)SK3pChxISFf@fRp#K5km*TC
z4#}o&``(reIARp(JlX2d2rRK@9GWl^fh;wyDElCB@a7Ab5H2pljzbUN*lRE1SHAe$
z*!}Q>xF`Vm@KevCtfEo`8?zj6&@^0OWhq>wM&^*w+tSXXyUVN1lBykPM1;7xwipwP
zuHC%DMOHRH|BFBP*zwyyo8xwBXnyzb@YJ5<tSZ??i$G=?lqPjZKWjj1wj|F+wCZA&
z9ZqHj5KE`EwHF>ap*A5ht_|7p0$bw{Up6+4w&re;){U}g_b;A3!exMx;xMasxm~h&
ztYHDdc_LL$GGOkyqZV$5O8sfR+=ix$O=6MFAsh)}pmzX?SOUZS!%S!=b4PmNq>1qG
z<NL7t-tGALk6%YmO9z(@Xdw;{40CifIylC{B-C$Vp=fG!F_%?BRZSsw?rua+Ukvfd
z1Pgr|fdkpd(g3t(AjHxDR<f~?ft}iy3A_vgBs#HfTkTlI9&B@I7Z`>k%r)8UP(oUn
zNKwpUF0$z`Pz=H{W{}n7Vbm;0L~vAI2#Rc^On?d57pWj1S))%Km5Z(;S<?_(oJ7CZ
z-@Ow(H`_2h5z920GH5I5+=y+PW6Q5}Dw>+Uo;^V913K(UeT<&dZZa$5xGeVJ&FfcC
z)6mG2uIp#cV%LNBi-_2ZYvc+c0DFEuDb{hGSg%R8S|97{$JwJt5iKmia@7J=H7_sx
z!61(~Fa8c?q?~R6wBBa~(4M(nqs>{PmHN}CDJ(+=imgtmVws{+*b#vhhy>V{h-||(
zJ87sj>UpKy9Tp4B<s}Nv7)A&BFflTYAARQ~{`=0>E*v|09=-kJP-ds#n2WLFK_Zbv
zX;~QSS4R*DIQeI<0QREtLRR`3ADx89<K{Xa)mPIew49m~k?Jr!0(4tMv??j{2o(eo
z43hXVw7Q_of6^Cw+lzFL0H64WlcN*3cCi(5VghR$%P~4OWf*i&GUKz*HMsPYIN8WF
zkh4qz#oX0T4<@8N+Uyjv%nSxuXDtrh=WW9#$*sU8FA-!F3&>`e8qg0`m}LoNliyex
zWQ{yq1zGK5{W_y4Z){))$&>>-58cNgknP-C8(KyWG6~^m0iONFw{Yp`NqC%IOiYZy
z<y4z))akEmT!n21_F^g?!@K3o>iQq5^r#3Z(#@<im=W-jey$3@65Hy`F)!SqH4?RF
z7w<dIm4~^RX{_IKCyHw8k&?;(?6O#&Gy$37$B>f>%4(}ckTHq2i&s%vT*bYJTPP)R
z6M1rYWNAl<lBpfUZa2dg{$M9)R8>|KQ!t=QH|4Bzf`0Q!`e`azVUMSoWD4icUd0?u
z@uWSKOpyxRmlhy_$-NKU0l!#ql(MhiScjtG2)bH(keZ$5sMIea8M<F$YL@G)FaGf7
z_?NFfh5J5q7iQyelvkIr+i2s4dhES_Cnm-wGx`K+cT-{~eC*Q?F%#jNfAd4QY0g{#
zGS%rO$Hub&sINC`wW`>7Ttwb;TvmAV@JSREc(HLyJ@Y?hS;rpG0bG`WU^Yk802Z=^
z$zd67HvCQpnzCZ$#_GXE-|&*n^;p?B%m90*1jSB;%XS#SzT}`-YMZi2)JG4p*^zBY
zi(Vz0S}{$NMT!eB&^3rxpL$WGx5RCB!Ky0@+qv140G*2R8od7EvnXFvhdqxxjLyDh
z_5>rbZc5=>&s`DV<+BNBZ!M%9n;5~~k3NDe_w5nDKB8y(@OzpXpWuN5k}RaL<brat
zMOTM5CMQQxzN!{?eCU2S#Cxq--@w<ta&;Y#;STo=z)wIsPh#~hxXJI#3D%MI2lH*U
zW0$}{QU`%%l8ZX>8cHE_I7qk+w2J`k7>i)bIv|Bj6T~!LtLR5ewfoUY7z%iJctF-i
zd|G6grW&QAF8bM*=SEFkIqFwep|@**PvN>X)gpzT;^`Jr?|SgiRumQmv2Wj6{P|xz
ziLJZ0;Jg2F7^jY1L}gtii_vtq_u}+h=h^axUQ47f%uE7m4p3y;-qIx&=Mc&(3)RIT
ztHgJwW?Q2NMg6b>jsA{{*P)t1I`H;$FQB?2gvqHnj)pTf?CGddwoZh}a#kl-F;TH#
z8qZZsQ)#e>zL=uebeSOSK_x2-h``vWd6}dPm0V-DIY8E0la+0!0`-T7WNNNS83zYs
z>a~hur(vjICKf|+WjU%E*NTI4$_lc^0=HrMi>`Ul7iNv*Rh!pi%bj;&q<@f8<+0uY
zR?p(*ktDq*4KQC`0Bx7Aq3>pg_}-rZGb$TQ3$Wa{?=A!j3lJL{MdiA+Sa<g>5l~Dq
z(<0BGkInbog^7V-ju@Z++Bfj(w|^iG3|Z`pQ7(N<lUf{0LlV%snEuvxvpwVRu-w}`
zKW_k44Xc*SRG_9K0j>C`CT;`mLPcYTqmP_iWmz$gv73Cv>^jl9Zmn3v6y;TvMi2}I
zm=cwNZUco$W-1B|6ws!6_Q$VbXkY|h0gx3{#SCmTR$E?Gg3+Ndv|MWwi`0pId+M-m
zZ4?#tRSaB5pZg^~^V=U`dBU5QoA|y>mv6E_$w2QAR<El=l>l&xVoA;G%!x}P<x)@(
z4RN|<7fI^5su_BfCW=gSGOG7pJ97nH%}pYD-YyP-QPtK)f(2Zaj1{|VN#%{BxVq2A
z0<dO%1mhrs!L!Yz(51+h3u$=_Gd)bn)f7|g!P^#Ob!7lGlGWAa6@5+CSd&)tO)*0`
zK{iC&Qxg*?sj0!*JGQB5zGAJ*nn702myH&b;LR6b#NqG%7<WDRAR8<8^|zvS(|Xix
z*`SISY3!JH+W^ZG;7Vh#1MQvgYCucZg_>Whc5cD_pZz!j1z~txUbLLKfHN;07JDbm
zVC)g#-y?v(_2N|&mXsks9K`kq4xsUlo$P@Yjz$FN&WS+5t$L4%JxnDKpJqgP%ZvyX
zsawwM0SzmVUm!+S60WT{E1R!3rwZHJM|+!_`#r=2AV6UY8~QV)S~Ab2G)4l?{cE*F
zjhVnBk`ztReSCS4y?(go5||n8)qKb1ReKwfSJM=@xalBgyUK~FX~aYX`{~a=hR)U=
zoH>4xpPST&cJJGYsx>tj?CL{%b0=n!^X!nY^X|=TxpDI78H^1M^Tyb@e-{&kW<}If
zR8oi&M^Ce19;t2}{Kx@Jj85X*+vh~o;^OE#PrTl&>x12Nkh(!x4QYB7vs6P9zoF8B
zvrwdPju2bcP$cfrMk=i~IIu)kM!|37kRyae<;wuDuwxX!zR_iFg4x_J+x3@i?!Sac
z7UoD+wpimxHbU`IMx4lo_GVX879d1}By({Z!#2TSt`S?)RM*_x3=3#)+Itt)-LVC4
zKKnBfJ?=;C`bK>9i+>7PM4Ys?ZpAKUvD?V_06zXZUtsCRZ~o<9A?OWp6fJ9e!y(pd
z`cR6EP4FR}oS#8m<9a;t2VX?{r5kwu@BabeaG|&_>D2mE`N`^1#K*?D9AVpBTVf;3
zA-R}oWbjd2C~_2^Q7kV!nRI$8CtJTCUn#h@0%a00A|l#;aXo8{eC@2!pOguDtQIH+
z(P;7+bEHsPQH;*<L5z=%BR?P(f;lypvk}a^)`TKD)sMgT5^K8>1?#?t?-rnV0UfQq
zD6S}BAf{St<Hpr0-RIZ^RMwPXbwdqK^$)T6-B3@zNT-t6xn~QyTe~pSH-y6C0z`_`
zC}E(xpHJ&ZG|cxO9~skWf7%Igt3R`8poka(E<ZPAuAFNT(bOe8@|h<vD7!K5@M`W9
zsZ6)nQY*A^RIr_JQp^I>X6Z$kL}hGrW^<Y*TGM*P7L;WJxSJUV#u}<@5fX>xkWq~M
zS`)({1G2DEzzk(9+CTzCrpCq)A09?wSxL6xvlz&xfkCXDQE@QewS6o5cU?VkMjYIJ
z{P=(UBO;Lk_{4g37ZmV-fWzf{R~w6Y-U0;O?C_!9f`JIGynTvw3_P-v-w%HV<RWci
zuDHD}tlF{>;gVtu^z`A)r+<d#(`OM1Mp*2H*0dx!#hO&m+jNul6R1YJ++a@9*6hUS
z7{ZYv9tD<{&`9HhQ$(|}<mePX##a)kt+>(wT@wK!Ba&gQn$?-Ish*;kQquGUPrB(P
zz@~R7j)ryhC@l(NHkrgY*OO+{i5{I)Uq)j<R_kY>pr3UMhyg$~S{fYa>+D1Gr6%05
zcPrKkkd2lUpsTHibu#aJcn{OU!eYaa1$eKx@5Jy3UjE5p^z{s4*S_ss)UT*2<%N9x
zViPZ*H5*ppz+?AdN<_?RBq3*PVAAg|tMHYj8WEk0eW}D_mRA+ymp^_1H;%jl|J*Q0
zS0<jA(*VWT$V%67A=@(uEOl7ftmviZEz1`6fnujVW?>Y__Dwh2(n5B`S|6FFH<wY+
zMlpKKnHUR-E|OL3B3Ye9y~WcECOuz@@<ztdDAMkOzxt%eBszGy%Ajiub7|Lj=p|>S
zQD47SWM2VHjKxq=S&mKn??N~~AN}2}@P)&0<+*REW1j^eiPLy`%5Z6kv78_>J{lw#
z>gq)>9JR6~Opin(;6)XsoW)I#Pa-KYt32^qsfp)ssH_R5cjbAPW?i16HcRjKqrdmt
zsAyP)>B*(_wdmT-t3W#<tt{Q|6$rHA%j0&oI(SZ6wg^)jh7zEd_JJwwoKNwB7#^8K
zQF$3pXi*fpSAZmG4aDOKtv)9k<OEec*L0dLvC`Hres&afYiqG_M<bdpx8O(L{27Kt
zMEb_d$1v1CjC&65#)+e6F(#gC!}dl@j7-2QPIO9nXaVGj?~6(c5sCy+P!vJ?jW*Um
z^#}6MbnymW`N^xQgd%&Wt9)U-Dwfe*R(-9L<1wt+v<B<8t;4uj^ub639+9KOS}!4r
zA#B)GkNC8#MYXcgbWyekSbbyBd<a<v59F+wq)`FP1}JkzwPs<Mg+_06rGiY;N;?27
zjWa#FAe{v*5XtIT2=*Wgqvg7iE;WILsHb9c*uH-+J1uY{mh^2C(-~P*V^KlnvyveA
z=-3c~rNwyS3!g=>Aj~516a532P0iww&;J@W?!5yoH!dwnAAk;T)<>R7s1d28IvI?Q
z4P)zpz1a7$$FS?c{hSeH<QzpnL83|YB`?AZ2n2&@zIYMWMbu4}J>4zsh!hs9-g_d&
zr{*m68&tZa^sX>~fSdGZsZ=N}L)@DpT1ApZRv6B%JfNjXt303k9O-<@^EOjFrc6%K
zMYf8mL#z%s$ZR!prKum4B9bJR+9Hv@=hH;ioEGtAu*BMw;YNf+O^YDT9XrR&fv5mV
z+C(X;MHPk_h<m#Sk(!-_oSa4LwN~~JOAB;Iq9JAqoPOgpa~aEO%DEiz$R|I<C4)F|
zW5wSS9WBjuq=;M6OZmY_)uJydS<nbD>4~cTQvx)cZln|kymB1ts~so_Lqxp^ZpSLQ
z#KdK*O}L@arK5sn*aVglY1#B|jqCy2rWX{WRxaeFfou*guQ3{vP19;wkX3SkZ1&&T
zfvj<QEd6V;B=5S>g0sIofrdSM@$hebmYF7`O|fSC7V+7~RJ~V+6FNgRF8R!f^;g%h
z5rvf%IQsqXGj-6FA4W%08+IJH7Xxjb=n;>-rg0NTk_4J_JQX;GsfkGz+os1S4lfO}
z&{`wsf|?Bt>`ykGm_k$p7`q>NP(;OfxbVg?9DnW=E>|pvE|uAv0-U{McOzcQo{v6^
z)mt~R1FpV{NML;{Z69LW%p?-*U_y;Ix7&+XzVQ_LTRS;oUTQk5NhDrfX%X#;YleO8
zGO4IbpF4lP^V=gs6Pn9wN^6SEsf25>p!8$8Dmh;T04C+j+3zKP0MxVeiVL~6A`czS
zH__bG&7J>1o&fWdoVB<yHFFH~AW{Jn;7UB%a5x|1!{g}d>gT)FuB}E&913kBN)3@7
ztawba2cg$RjkVQ{bqI(^HZ~FGCRVhp2=^S?gQ0<8JoR_qN1oV}Bw)f_?8zyt-@YEJ
zMWp)T4_?$*4-)L8@o2-$u<(q+v-X(=2Bmf6<RHl?D-A=5uEFSxh?bKHJ^&Pp<v1+O
zFXP#!*o?~Nn(l&q)N1pyf?Q1|o4TmU6~Q8EV`<(k(D>5Z8>JZwfJIo|u5oAA9Fw%j
za4MESVR;E=$bMU%;d+05B*gluSC5}Uw6v4~GM*U2x~)60`|*Rg^42Moud0Dl9JqZQ
zeR$~epT>A^4}SVLe~)#$ccA0S4UF{li}X2;qRMg}XC)w=C&o%)6x~fN+@vC)>bQOb
zrPbBQk4Dgay_wasXrd}F5MV(VlF+1--sQeE-$L3`vjXT3e(n?Kz0r=F=dQrzQ6pLU
znoo)SIX}w*z;a<_W;%iTjq4FAD!@r%JLE?-cip9zOq}Ar32#28Jb_P&@1GiP`{C_~
zcA*-r%jIbGh$xh5qXzjrz$zYM@u|{rY_+jkqF7B#PNS=Doa>qaznk4^DPmR>tNfyp
zgGxl!H8;**=LW?CA34BvV2WORBK@zZE>X=INq^L#)=o(@hMxQSrDkRp-23Q$6qgs{
z=Edtc_x4$g4UVFwp_U^N;xSU1=@tu@nqqBNTi7`_9fe7<*?>^9v+;U3%Af-%5u4(L
zDQkRNC8c0|Jb}{iJW7l51lUJ-!c1*AI53x@K@C~8av{$&==CC?tLe(N7VoyHK1@-u
z0c2$ps~}gYz^ce)2eL{oo~=#eOEDQ8O1jrzp87KKUKa*gq_ug)VMt}5*zkx*bv+{6
z5kHH=m6X0H{jJ}!fg4V%w{67k2M$6J>#(e@2K8GvplnS&rs7F-UunYs{^B3u#ee!1
zimEEmCn8!(>B&;2xTcE#B&S)5Mq?wRSi5sGixE-aL5DH%Z%G@r{o+*~7$Bc7s?Cn{
z^m6)5fWHvPQX`hAUX-ml98TLN6*bGct~F!0tA_&#x*z?X4t&4J`UogV{C?R$L`<5*
z9LD-bQL(lj6^*M{rg2%=LAt^czwV)xhHER(Zk*GqGXcLhE+W!=r$e$XdKi7JvXXx~
zp=<2~mbB&)*~yHPuhx8$sZRxBQOr)wh$u5=91_Ujm~3)~B?_2~Xki%LZQaaF2#SqV
zx2h7?1dx)3Y*;)dMKv^#P%8kG7zHHAz4P8(e9Axj&1b}hO7O;b^XErVy}Aaal_g9w
zBdS(kdmr*ev^?BDgkJF+!EjLHAS#A~Mlmr1=zUTu+PGr_dns{kP&^;a)TacPp84f5
z)Ng8p%U=h{6QmqLEaGVt6$L~X;6^MyCqAbXTW+(`zLFz?HFW;1v@?4~0Tvd7Sps#-
zHX7DboeZjDO2&wDK?;{n3qdh68f>2rFrD;PKxeR{0Tls!E-#Oyx<d}MoWCM~c9Uiw
z<KXmvu(K0C|A%kG>GNUjj&1OXOry7>4f%QbEK67??jIW*!kJf(h;<gm#=X07;^(h&
zNq|fWX_D~LTPNZ5cvSk7cz&M1VkItj#(jW5Ib9}LEPJIjQBqwgvN12ZTUt4VHzBP!
zIA*wB91#0ppre=XOKUV34KeqeBIjFSN6gL5qM)J}lOvN@yJ;(msw>cP=`spDMaydY
zDUviVu5Z(Apj}!ud^*qP?hvQ&MnkA;SnG-|h|SjR6rB}{q864^GdS|@3WZTAfb7EX
zMNaEfRU(CJT$H*ywNXULT(8v4uv6`gYOv&%P`9QASI=GJh>}E);}daIuc|`*x_bWe
z=+EDTM?7v<a|Z@``gvF(Uqm3Z5j^6#iHm#n^c8&OOP^#LnqNMD1asm(RMVsT(QBYO
zFqIpK#h@%e#iHnfqGGy#=671tC?MW<%h^jPUptG6x<<5~JrAb<gGAiLYGn;OHep7J
z;ATq#PJMUV;9y`^E6-IjP;4X%6%)NFmsR+}{8($LK*vN$%NgqatpanoK-LM!U{Q8~
zof?_pwdg@w-z*ci(f%=1iZxQTb`3f&U*o}-{*G>b{gcC^XxzCIg|$_<{`N^s434v2
zYk9qz`rkNx8j)xbKK!NMM6<Ydt~?d=NY0SxPRtmPwWgEScp{Lc$d$@$u?g{b1yL?9
zEwwyIYlj>c{K0_ue$EQCP={WqL`7~QtG2DjXwMMl#JcnN+?=(|h(N+il95Y%PI~>M
zso?SEp{J=uJcbV!j-2E%-)KS6k}It$<G@K@%`}*~(jaZc)o8zZaayG49t;dj{NU{A
z)=yIUPaaq)PQlW3TD5DcUUYRpL6&9R_^Ap!G+#~I$q@)>K<vQu_y7iPUd2Z~eh7-d
zl%GHI8rC+}A~qRgKud!yRc<BO$jz0sI_;VbtGUxWHZ;nqp+mDXq4d2#q)xQh33RE+
zMX5c#Rt9ncc9ZZ34=RY1lTvx2ijk;zq&SK*M^7<GM#SSqOA681)XtA9=}sHPAcH9L
zXC!OtOjO>;2v$QCm~lB3CUjF{g^1{>lv-LzO;2IdJ$Ix2?)&lLkKTaK>rj~rmIxO1
zwNxn9`{@PQvD7FQ3)W*TQ(Bq(%etC+8f0Zt(<=*t2A-_hq1Q&cH&^4$RxVO^U04%i
zatalzs#*NHyQvw`%3}QHfBkcGTyNn4m^%;c#~*&^<0uN3aaObI;R9H`wGsdFU;n!}
ztXJdl-~Jqqzx+CnvQ7*PaLsk0JxgVZ{Ad9-?70IMUVn=__e*VjQ5j&GMsCHrA=ySd
zeFC)y;7~okA_e08QIl>~tf@HnM92krIg?=gTm=y}bSx+>W{TKgM~^1Y=vwk2LF;<X
z=|L<n^h@#4AEax%l4`UoGNPpm=JmMVcDbCNoSU78Mex|J`Jp4xD2kqWFt0|nbg~Oj
z34{w#vSth3eDe|l&Ur*40o}-I_TQUzR~gLbRGk8HLFj1eU?BDBPH#HV34CQO(qI7^
zE`?~eAM|_0NcJHX18qhEi;=!T6qXipH=1P_#U`Otk?XC@rF9soLi){35xU!rUHf)2
z?WVV_M^paFWPMsaR))jlQ+>?b3cYBi#Pr;_fuWd3q`WScbCh*rHWq+20qH`Gu-s9s
zUBfFIX)X<9vlcy>Ar^KRHkDUwTypgz!&VAcj!1Svkd=+kp((<V#&GwI78KT0;;}FN
zdyMyV;+d~~1FJS~#6<yweJw3`=rf<j#n(>oWA?PP;qu8-SifyMm%?8D_EQ)i7-EeK
zvT&h8axpMdG$)AVHr}bepQe%J5`iJmCNLiv78zQ6mK#>Yo2A#59uHqiJ(ig=V!tHk
zlGwfX5N=+$gh*ilN^9%TDLyZX+LsdqQV^tS97q=&kXIb0twg(V9(VQmJuMX3Qq*PG
z>#)fhGrU@z?rMf(D{GuViTSbPlL_2?&n~RnwhaS=6C%o!SY(@`Sx2TGY~+~|I1wPy
zDIN^x<NVv_(A(b4Kx*(Q)9y#*0yjsma%R{-&q>vDR9Vg6?c^o}JvKG8uAjb)lJa8Q
z|FJ`uok`-z&tBt5R}Hr9?8sSOk||=5q6lgl>Y4UsI51=tfOzsumJI_39+8grb`FWC
zO2)>m^%x(YGNtk6VFB4*&d}U2)6=^k=WclE>ZOwY?_@Lm%c%Tic1LC#cg3tHi%gx?
zI98iO*aiy>Pw0<xbFJD0ve`3-m<JJV9!(Am!tKk)mE&h{?Zhbos_mGHPvfq~4vEiv
zgzK)uBAP2IFG0Ah5C=Z_5ghn;A7)uYqH2}aRii`zHg)K8MouCUq_Nl6pMI88@>?B$
z%?ZZTcoS>r?hkzk(ehHU&c>0^kz8UAhG<-?wr)VQtW@k156-=M6kSbC@Q1@H1ITe}
z99&uD(4JU{n6@G#TB@H4pl#02_hP7D9XB<o-UEi|9tC#hjoGOoiewc<o!O>R!}L@f
z9+!yhpq3z<8dD%W;;W}GNxU#-xY0%2+rgee?!5W~#<4)7<p{F2)@GicO+i}GrM*;!
z2p2|}Dn^vBt$Vhiw5A-bS6Y}lW{nWD&q{pVUp)09n?lm-)i-}E<p$lKB$Mb5hcI-r
z34sLJk_5ztnpI08xk>_tQ%|-nXDmLba4S))QAB33rdOtsY1gnbmn>lC!eA^7C^<?e
zb|9NsPXg^pfA-CvzQpC7+BJ<LJCd;Nz<#XRwFS@o^*_SNW3OuCDqlp29oL#LF*wTW
zl{)%fpN|jjiIFibSE<^svJC}GVQ`HU7A~m)w(KA%nM6Rmm%AQ&5HEe>dzkB(U6yMC
zyO}uMB2!Cp9oWI5<4H`<PQxwM9eqBxBAmmF1C=Rp^ES{fkM7Ybz_wQ`lnOnB>7$Zt
z{mi^)bdIm|<6H_3uevA;qG7y!M5JlS8F8XkVs3JXX;s<1uce;i&+*|gj`k|+D!5EA
zGB~29<1%bK<rV8smPM{u8s(DN`b0a?^ThL9c=I%;S5N%r#|3bP@b*hbQCeAwc^hqk
zG+;Xv)jot8d=wqiAz~FWQ7i&6)ZFN9?L)Q8i^B4a;(((OW&0^E+sQ7wvVv_b*2+?l
z6zi~nJ)ptL!?lq)OxM%RAgkDdtj(ydxin&D;R8F6RjeSJmh2RVeJB#*k`mQHr^Y5Y
zf_>-t!)Uv94ds<pS|d}z_`om<OH0vvvxC_z`D~LT3Gi*ky`TIrhC6%Fbmkm<f&72#
zJ&E{K40T&K;mm7qq3Qg2v7d^U4CW*wxn|c6%+Ji@=GpV`1U&HM`NTdO!urkI5iKdk
zD_?&a;ZVWy8cnp<sS)OI4T|-DaYf?UN(EYRGRxs`;7zy3X%#4eO<fQ=#(`n8i_0Ju
zFbT}4N=tJr{T3`NMch$<s?EFb$j1({qix3GTl`68i~AnCA9ozMlQ#{Wv}v&m=xlQ`
zDYXsvR)J#BbyZA`uae&KT0ilmrOd=cAl~cIXAg6&ucomcBmKjc$*k<C?mTy%Yu2q6
zn=_<F2RYJY$@Dwo(bB&e>FGnm+9-+zSd$^1c?=hdY;n?6%%ub<MtuVP)EJBsijqOo
z7CKQFBgolJt7RD?My(4;_t{(YWEZT-nsp(dV;5M5S*($)Vggx{g*Y_Iq4<yZrUM<_
zTv8~lsLZlO#3?@~B0U-m*m%!faFaDmN*!w@`qn^8y8vQUv-aQmM)l#Eh6bi8UOIA2
zWLS}<N6gd{5RvvsXTONlhq(bpkuYgPghYf~xpo!W&s=3KXXr}@8l!?VZ)rVeMVE|^
zEvp&_=b2k~8)%nPrxgn;;C+W0K{N%E)##9n8_+CP0$811iJ?FXnQAzs0PhKiFCRQk
z1tT#Tr>~3X!XHF35mQH6C*vZLbz$AM^~^@-zS)(%$aVt_vNpzRdM()@15>S5whEo7
zP6sdnvy4zd7z15>ICJDA%Bsq+dG8K&5JNVJttcv)%jfsu<jY6V)!fF+1K12?Ko9Ub
zkfcbOq#N_|Bs7vvLTpM0u*hvKV-b+Cuc_)81*%AnX%GTdCkVSquWUV5);ZN`^;q5e
zlmHt&S#x7cww4P_uYGZlH97=mf3(j$(h6+ELCw=9`sffRo1#QKhSgg)pke1$#K$K%
z07!!iMZo=?-R!!nA3R{IquJ!YMfk%*5Xr<WreiTUUG8Q4OR9^xFe~;KO{fv;g(fKJ
zBGql$0AHj4myey|&%{`G1>2Tye_#&^%1Ug97$}P)Lq-wR-dt&;w;uqYO(78QzLp>K
zF>NaAd#4zh4;E+Y^k$W1!$u(i4=s;WMPugG+HZV(3|(DANcziBwSFV&*HkhOkj7?z
z@HhX0%O}orWJyBC*^x`x0FYT9GX2kbS`&=-&kR(U8#7j)th9_`GBJajmu_&qZq=r>
z%&VoQ0wfp|v!-HkmB+ifhD!%V?<=E;rDfz;+-L~n#7jqTS^ztNfCG{xQnfa^Y@%63
zwjGI;VCP~hTMZ%gRyT@lTPiTnw*cs679~B<DawKZF^ZC7Ds0IhYrMueK~|&QnYq2`
zGFaWF2DtN_tX5UGaa~5XGkv&>4G-h-FaA0n{o>~_F*1^QK5EhyR+MHeY2L3JIpvbd
zSLd}B1Vr|uERn`V%$YzWjF11x?;^iAs=C=KsuCEPQ#zb(y!_1{aFnmNxn(OGfddY=
z3mf*|$vulyj;S*OTJeyVR%|JBrM@ttczN>NS3@EH2%Y|_Wt^1lGyz6VDfCgSu|cM=
z*<4DEY9VF8j;KyfC%i6obZ=JjBU)O32R{BVN73VhqpY^2XmwknwQvamlBvmRBamVv
zDQJi)W!V~y%ho6p8f(Jq_wws+zuJU$vCu=&2nx%Jd1O+{mziUnOiZJoxR4d^)hH+Z
znq*yyuGsTq`MwfT(=j~q_%0L_MzjdR4y0w+4j!1x1g0ofjqJ^8X$v_g$XShTz796(
zTRML<2|6&h^*J-A`PSxQy1}<xkhLvqS*GjkImgo?(%b&feyrQIou|S6=}-PITz&H$
zrdz2xuM%^z&-~&DD}#A`{tT!S2b(Bg8SeA@a7$a>5RHol8j=D$$@bnhl{bToI0$A%
zP;lY3w>e;Nx>e0vr^|!<NEFHVGy;CV<@sp9qi6Ic8g_3**R@s=^qhh}oNukql4_aL
zMeFO;m5OI8wi%|?X_Jv?;5C=q^@;S9lav8i#ne&PZ8|8rAWDm3Nr;BrKb<Z^beHxf
z_jw%X?H<B#b3Y!cuEOZR2wO>~Q*>HX(PDMdW{7RUT^7Zt>^74vlop#-7;Jr@^bx4x
z<Wcy!{rLgRPEBK+`MRo<B8}X7yl#XG!U&1z`^3vfd2tt(78z4Y)4adAPRWj^@*G>P
zPsV28b~~~)*d;W?>~sPoedpWsI7-e@UR`6%6akw##FD=5ykM!ozLAzoAlx#nu@K1W
z*PJ<$wb8^iN1YP8KFer6brG?#Nvykb2Wu9PN|(L{njem!<=iD)J8>G}!f1wdKnHAh
zbE{Yb-ghNWxF8cq>>tufa5_C0>FY)9rgg{{>+Q;0CvrCB=(WT~$Hc!2iOcE0_2Xx_
z&YT`ZprMF!hmSE>(_?4ft0w$CIgHKQ?iBCKhf7C~vk-cA;0Ku+e@aBNB2elP|ElG7
zM0+dcgSmNx!v3RqJ~yXOwv`{fb1BTtb-g32hzyfS1HdRcaceo1<T`DzxB}JH#XOWi
zr*;~URr{D3p5}2n9oaH~Sz=I;bK7Q{nn?yjNz>zDfiIR;9G}1xY0!p)sBWld9&m_C
z4B|ajuC77-`qeC<XEa`uVHtBxr`itkc$$PqL>6oI-jApM^>vI64l#h+3WFm@lxQOa
zBblOf#m3efFmr6P*T-JoP_}J)Egxj%+!J4>&nRaktLQ-%)|%`BAe#lzpa8AYXuot_
zTniVQ9>yle#9GV7LX_F~^8M_LO9D0NXp*B{GC+KvK$aN;GYLe>N>Er`!OpnEni%aJ
zfGbB+F3q&qdjCBlODv~8EtebALq*ZDR+;P0=}~xn|BHf%+2k~~i+>*~h_I--oynt=
zt<SzDDawk)vK1ZCCPliRAN0K#E(oyAw%aLbQLU2Eq0OjUX{ny1m)|qV`%#_N>33jm
zUSi!?ueiYTvc9t{vCF~Oz;LFMod$9OSJDzl3%IZ}<Gd=37Z9lwS)`j!TiekbJKruS
zunmnZ(Oz~D6KzY@gq=x?l!hLf&Rs#nuFWW^D#Jwo5IV%ckoFE+$oiV=XyP$K(Ga#A
zdKB&5aYUnj9_CQw`K3j(Pz?IOcHCJ73klM|mbPV(Qv`DGW9@8ta)GRQx)8`Y@s*Rp
zWd&eG$0as^t(mHpt5i0xvI<f@7uv61MO9rrD(kCp^~`zryjja}ax^HaspR^3*R`fw
zc9>o6&F2e<J(I#<UnkSe$T@_j5xu#l)U?1MP*8yJzEPF0?y^?|v)dwMTV7aDf(x&o
zz+gu&%1WzpPMxKkG~I|duyS#BWk<9;itBZ?MGJ%1<aC`@%GPG3Oyk3b%x<ubR!#J1
zVN8z=qcG%Rw}t7MWcsf#ok$`W$iwCx>oDu^WJH#;o?^19yGhY3=_v4+tPguXw4YC9
zO6_AJ!X)7smFO?$uy8TgB2CmV**^L;i)vH!L;(#o#|AsPxl}+KbJhAae4xDk%*(91
zkkdKVkP(Q*Iy;TYqz8$VNDaGt;7n6&Y$;pD2sv%DBOzB)Pqt2X*+#KC+LoQ1qE30s
z!jDyQODyU~b&V5XM%hNoSnVR^0^@*&$>Ypca&wW*NKVX(6GLN7sNK9C_1iXQEzHyR
z5f`2I0*TYmS~D;v-p3m;Qg|>ytEm&~!L2EG<-ET;5AQs8nDul$zU3SUiZ;%xptq%i
zgB-ibGqpbJ<kEpy7cZ`4EL+h)D>3^(L9{6Jk~+7qWd4F1takNA1Lrag$l2yc$TNr4
zB?`(*f*6~e0qJcdre>jt6fH5>3CzY3E-t}@NR6lipP&@YDH%7LmKGCdl_qsKvYm`$
z=e@g8+gK+aVv0p)2&f(DPOz+4J-X73DcO$FB-^CqSs6%Z!Z{9J&}w>LzPcJGUwR!w
z-Tm12#6bprz@{#%V@9x+Xgr2Mc^#ho{V(9+$x8yfr_{x52e2@X{u=772K`whGs9XY
zFjKqCW3)z)l}xH?27as=*bSLO4rYO2xWyQOX0;0zE*B^YOtog4XkP)ADmp-%QcBN1
z{u_S=rvR}xe*6ORy~g?{DZh2M+{EsO4q(Rv_lT@-&XRh+Kg}=^X<xp<^fP@qV?l5c
z07&*cY|yw2p&43}Uh%$XVzd0wIdd31X6myJ*Hwq2^xg*AcX68&=}Lac|GYooH5t^U
z8)L>1Q_0XYld~lTttlp_BpiO_I10Q;Jo%Bm=<Xfkan(ZyH{!uVTQN4!2Wck8g8^%|
zZ^Xu(n^_e<y_wVAQ?$6LBY)+@Im{<#Il7cI#V?v7+qQ2fss!+nc!vE@gPc36wXt?d
ztCATbOgY1UB_O<T^d!bbN;llwug;WDYtgj{T=h$qCdkOWb;tf4=(%_rA-}|aP&DSb
z5Q_jxmgWXM8^ENaU@N6)24hR9Aol=5`WhRWPB}{(ve9}*Q5J4cDMnyitXu$t@Hi}V
zImOh}TSD`fuh*(w+i>y7+i()|Cf_KoLV)G<`!OAlqqnUSI}YwgsHl)9$lkZ6w5GKi
z&?eh*VLDHai2#Mx6fp`Uy#w>oQC6(IS;S&v*mnOO)NN`MfsnnSEd#C7O@j(AVI|iM
zJ_tZd0yBX?-W!p^;0%FoT7FY4BV<BWBj74VK@|QwN#TK$>G(8er;}*Da!r6O)oB$3
zFo}>e0f*azo%`;<kr!S=Wo<d?1W*q34{9P8da%({u*9zep#cAVAm5MEuN_DG^_%R1
zJ0|{Jf<(nL{9Dz-jL6z*-P7zko8G{(4KLT8lbVfCHDD5tTfbo~9{ALUv1Z#Q)Hc*}
z7u%Y(W*>uUy>lrUmyW)LU;gkJeDpK>QCA<u#OS!`J!c03(o`*j*`cA)C0m_|%~N4I
zL&r>GOV{v{^iix{bOv@4Tz2(XIftOPzWibYe5;j@l?s+Utjr)QTdt!mt7L&&UciU8
z%hwSXS<?DlTaaH7Wn#Yp*~H>^iXWTKT*NLB)!saRnb#VL$uRGfr5R%y+vdG%j!_?A
z)wYc&t*v6`Uc167$vkd3um{CeRU-J1Zz0N-RIS^5uUL~asNS#&MU^G|+_nb*^(a&?
zw&zwlj;(m0r8<q<<B*F=Bd^JPvLX|)+Ba2nsV34h4q6&0r$nly;E@kMh**3E&wTf%
z_=7Kf2m$vT4nKbs;Yg4nB{4O_Q&>lzJB;q;b^-K$W9QsvGK{#s!~h@}MY5pjYHGvS
z(1=KZJnD060}_Q5C8`*+Y*oTi6dQFcJHD-DC_tm&%+G5RY!XW)4)+c+L%|BLnF=k}
zb`!CfxPK?s?cA!4AIFAR6If5Hl5`~kMKO&GD_I_^aY`yjnZR5EFh#MFiJc(nro1c@
zT$XyQc?!->o-sGGU_pTx*bO7V5=kqHP2+PZYn>P+d3l%=z&SoJg64A<Ss+L<aaHM+
zP(zBc4pMBBH7gtHD-iFtarX|DLiH{z%FU_#9BIxb5(t+Ti|>=Vy0Yq4OY3fGauRcM
zGW`DFEtfK=_Yo;BL}^78e)8A<gk#UWj9{ohr5+lhS(&--a}M{ULy_OO4Ycq2B8&8P
zRz^`t!4LC;ex&B-bsaIqs>&p#Bi-yKlyngiMF=qwF$DATxEXfl*cpU*?%It@C(q;6
zpS&zCauKK913d#MEG`hwnKDF>k`@I?7V4DxeAGeqGT=Hj{RD-lWBlUv-}A%+yctNs
zPSG~6HEM-T)N0f4F##9RXS#28;5+}%-=TI@C01=&FAj}Fwoa_$e5OHz(!I&i3I1z;
zAb=nI&#&|S8@8@vzOH0bgS8GE$T@_(WkW+sF*Uo4S`XQ41XC279lFp2ycddM%{5mW
z?OSC*_5iYxw;p75lZUp(lLo^|`IaWM2+)GT0ABviGZ-BjML{rX&j85JN9*OwXgPBM
zwd>cien+~jK=sh#n#xSm_Px6K1L8R^UP1He3nF_9Wqwa3jM|Os;1CD;#yxk6U?YO-
z7cMNx9^G!QyF5-2+_Z^IY#dIH0~_}2LcLgvQ?W@SaA{=&5z#)gl4)JKGRMkuSg>1w
zzJNFI)-TSCw_fXT<$2wz(*n6Jh)8l?GbChJ+<A55Q*@_jj<^~31^QEQA~o7A7UUch
zw-1wp!=T6W<#{pOKg<S<%<pr%_<I^uFwlW)j0%l_C_z*AHmY(dDp!>{w*<0jad6uW
znNG_k)rL7HfY9M~@~{Fs-7Z{E<AY?&eRtzifBHN4%J2Lq#D+(ihQpRU;`!NlPkRoM
zfZY4xgXp+?LoDzc*nZ$%<d@ar+==Uu<ay22LCH;nGB<%>t;y;mJjv|3koi3f%z!1)
zwoG8B*m{h?2(acuY%ylRLfQqETJQ2|vi5aavG%-qh>DDApraKjaX?EpMv1h(gCann
z2#`6oPNx>t&hyV?+URgN-qR)-vkjasOpcFZYHkumkur9uE~qa@d36o$dGc}m;#)t$
z&GQ!#2!@sy&5PIVFUUuJK@i>7Z*tR*__~qeV)2|_9?(&pqSc#InMceU#*91fvrc*b
zyLOLx+XZ*oi%${2Cry=<M_;7xGd4+*zA2`CFDb^^cT)r-mLi<~0u)5T0$?2o6@-|S
zPrzMJ7-m;nibU6mQ`8^u^Y4w3t73gzeN7em(OaWZ6@g?zq*sb9$f}P^b>H}8j2min
zKXTGty=@(rB_>D5IZ{E6dTaXef`t*BdHro1d;V1vmzQ9qe~6Wn%Ij))qtG}qeLz&g
zpoSg|KGbbqhiP$eZQQj94}JQ>Y!GP>eSyyS(onKcatgrc=~_^1*aYb))|Bp>qu3>Z
zEOIs7bmo@1l(`lKS>@jZWYej5Z+9DN)~!P0u5F0LCvERXkt=aoM|%7D08clb=$ZyX
z!CPxYEg|9_pBTo@gZJW-|M8Ewrx8z#qpzhMo9^9@>+hV$g}2{ENJO>Ee&1rxkz?<0
zcOQ@F(#_+^<M%hzMQ$N^h9(#dDTs(xaVYZP4+4gLAb^%YVRlAFNk!4O^27d&q+AwY
z(|5Dm^e~ECrzn#3qH^690X`m{KvCzak=a<1PRrIx&X=wAKTFM4lLmybVIyf9#9DjR
zKur9OTzQF__3_{TH8y?hYQ2b!d+)@<pZ^3~%)~~<c{Gy_1L`!(n*5^y{Ke0tU;D$a
z{3A!O2R`vATkMptu0y0G%G50a{n@Dm>Ka#Jd|&{V-a3P#(rWR1U3luN-{DbSF2iW0
z0mWPswsm^YF%B{xyPRoMX6mpSg-bFq6f(^&OD$HftpF46R<WUOnbLVn(+gN|5Wy13
z<`y7VEG3F}x6mmgt6j4SSKmG%()5eS&kyH_08^}Qu>P)H?5{<UtbV_|A2qzRA6<J>
z6H2Nouy*@qG~Tfdzw!sai<UE&@%-1njk3}TRWEs2hl_*7zsazYN^I$gHwtos(E^mz
zR<eRuwrn6%Z5Anq^N3hS{kMVkJ-m^nOSCxjv$Cq<2^u$L>t?N1Yn&D{x-jT}Pk*wL
zf;@*y=WdF}OffAh3zu@{!na*(VIC?)f^w#oY7(tcU>%{=fs9qrOV-L4+1jRFR7E9%
zyTmCzfTq)z;1(O{iO>HQPP}{sRcq=v(hLiryz4{viS%s(P7#Sq%%PMG179k?)}`8&
zQx{i6=41tZ>}Ri_P(--V@?r*QD!tI>_xQj61WIbkv3^Gb>l|D=eN{yJPW8c<x8|^K
zI@zdW=?@{v0K6un#D$t&ITg2Z$uz>&Kr#0af{r6=7MU?evbhcyy}%BX_e3>|g<C|r
z><fojd5zcu&K$;yDyhK1MvNIJjQ2CEoL6NXODd`nDU9N|zx!v53=U%3y$5jZ_*tCz
z$#W<vDoYdGm$$bQ(<rX4!nXVG;UFqK1d-NPh*nmxv#*|QkaT%z&3yZVf?ppPprsF=
zrcTSMi@&d=4{b>&Fr$koB=fYG>3ag7P%sb05x=U&m6?J9GZQFvsTZjmu>|I|W|lQI
z&ej<fOH?Zxxv=J+a|nggt01R?Ym|b$agrZ3FPIO)yi>0oL+gz;RIaXNSJkoMF?{Ne
ze+wISZ5HX)fZCPS1`v2od^&+pQH1@e&L25}QfiQh*U)t468c*^QPoh7`pu0P9~!}P
z-+T^N#r+gl9yaXXFTl8%bsi+Ai1?G!kY{2%f6suc_y009xs0j5S=3xVbf8zp$~w}@
zM)zC8um&uQ0*iN=S+3AxBW`Yb>8WclP_zu?0?PmdY;1Pkn>9|+9F={x+_#4_k%iKK
z;&GEG{OOl}sp@aI-@j>k)-52nX1`w?0zs_XwFCdhzkUt(JoyOD{_-tcJ$4$wqNsN0
zE6YAyXs{=loI#N|>@lDHtO?jjPoYIb_UXwoie_m@A?0u<MMm_@ZJ>S6GZ#rjpb83$
zqu&d%@4S&yYbYP+K-D_bK(^Zs%nE=dcTtIiz@5%)>P<>rV!@YISFkH5k*6&iG1IV;
z7i0t2MqB17SW}Ib8hg~ppba<F(S=uk_%qaQ*??lwFA(Yf`8VFdGk^a*l#A5u^`~FN
z*x)EuZE5627ytYD6fe;7RW)2z2t~qd))yA<<&KB%;}ne|pxEd*TFzhL%|l*eME6~_
zzK(HcVswH_6Z5e_%nsdzl1y+Na4r$oDk6HS7jy?j7GM>fYlLJPsa15p%l>Q>?KWsL
zEEL5q$|_i(9-E#X%+R-x(GgY@t7d_be~Sf0Vs52uz%}#fX>?w`&e5E;9&ZFcx+bKL
zKoQ|`EWVcv4kSM)_Q}}jFlSmMWE2}10GdE$zr>NBzKGYJ`8hf+-M~OoyNIg88BzRY
z2T&w7BHrh=gL~0+wF$HH(-}IOEUSY-)Id&aNifi=Y=alX`ib2J+FQJZihMc0ya5TT
zw}jqawXwdJQY)^l>T0!_L57T7i#goLmJg^2G%7$!A|R#upcd6~=T<DP-p)R@6OnX8
z`|N%-Yb@9_r4-pvTU`7<(<_xpnsE*feBv=gN{jK6zx@^l+q+o5fNX6j+HMv=Ni**}
zJmFBAYxLU5op-~X+t?CBmI-)0tjfQ3D*<*nH^YWHd(p6C3+{gOehi4m{mftd9#(B$
zhoQDMm6bq)43qtA)$a6#F*DSLeD@4IUKdn#M%f6kupgU+sdSR7OrY3;tj#Fz0=02#
zsX(!o3T*4KX8M+FEmvgz-sI--9tIMUOA^s(9A{oR!qhswi-P^;RmHQ*YOBR{$$QV6
zUo_Q7b^Xu%pMS!E4aqQWI(PsFKK?jAZ)_xniK!7@tI`s5Y10D~(_-(ktAzMBV<Usu
zx_>wJJ#h$QLqpsQw7g55wGCO;%!y1(thax_2k5rq)Vq%V^sU^dxcG9rMa(35{xMV-
z`SQGo&a%TV#u7nR3&A*^o8Bnoxs()N(_?)I27;_pE6vSiy6W-K5!5x*VW6v96XZrl
zAxxhy8Z57un?o*g_lN-1lP@1(IvANmIyAk9ba{YmZU{6<ZH#!p^mo)4A^nA;KY5WY
z$|(h<`!t`ujMbYO*(QaC8RoeO2<9x(dryf4ee8wT(b3Y6nRpzelj90iu)2L}dIB@!
z!?^p<V`ys`LeFRnzJSNr5YpGiEsdxwJH%`ZDJdphT0>LG>`Dt*=wqguxxL#iattBp
zqg-UCx%AJaEa0|qi;Z0ZrkQvGJ`s(w?&|OeuT5Xb$5t`H!h-DDTHqFoPhiJ^{is}1
zhnN5L2XH$)@7Xk%TIYALwgC;a5IvAwYfEaYaO|hgqhaeNj=&3w%Gv)bE;6LWtj%dM
zlA`pwE$cAWKg2A9NKpxf`Udb<zy1dp7rzTfqr5h=QFRu09U`DexjY24UE=#!Zv*YS
zxLrDWdeOpp?Z(yLjFyyqxv#yK8)A}_EfH8G2i0D#ZiB18BUPlL@<Pb@5{3mZ`HG9O
z-Fs!8<pt9`L`Cy>$|zbH=KXb1oRls3-NMq&zFzS>WZA)G01-tvNYL4);lYz#PKl!c
zMHgXZYoX$Ois+$SY{a7K3Z7Kka?ft{!i!CjNA}KQ@ou{3PVBsQJIZUyFgErYS}$Hj
zNp%=XsE+A1@y=#M#OHJTh1cMVmWl|w1c|XxO-CV{UQ0RvwFlU2%AFZ%wvk!{jP^Tb
z(6ne0SOyRlU=`SctYYEy8tc8V(QLTYrjo+-)U~@dq4Rn(H@oit)hBr<=JJuZ7<`=W
zrFn79&P}6ceS=8p$1yoMj-qJUdlFeww8=HufL|P}*Rd(K7aR86iNWqJ{Pcf(4O{l#
z$sa?1ZzrDkozJ2BdJB#|^8!3BF9PA9wjLFmGQm6xAl>oE0UZC?FEG&EDGrMJuzv4$
zeD}-$1Hnj$r{1V+5}%l4%X9|`^=oAj+Q&)i8%T~9oGa6V@q+`jk<#d5m3hof&vfU>
zsl(!wJ(!xF(yV0^T_Y@8LdbeLs-v=eKaqYUMKlmB3c?vIM|W#CyrF!Ny3yF8MjaC%
zLK8Ps=XB&b;LZ1P?N*tW4Zxsi;0(Qg<WfV{95({le6i?!0tkn?dsQ9JMf6OKPbYCC
zkS#yTOzEPjxYLJ^p}ek&50QzHQ8b9?VxX%R6ET@>u4$aoA)*GCNJU2mdr=Tju<aus
zLd&Ha813qUFC2lAN;3V;p$Aw4INC?B*`WlOqF5`CT6AM`4Nbtl;bn|stu{5#)ng51
z0JG7eEw$_20olBW3<CxEJgQAm;{1G)4MBO5YZ(z~akLyi{-1x(HO$hYN<$>L?AJsk
zB8jF1$M`+p|LKpT^}=NqiD|!dm80&ub!*Y<%VVd9_}CccMW%J(=$mLca}9;1<yf_C
zgShWCm7--T0dV>+{zp9WXaDw}MbP3xC=x~Ijq4a2>}QoPdgtW494RZp?nfTLh1cIv
z$BT(4OaSa~GuyzS$p3^7*looD?O=P)qN&$xEP=9_<X`4jS05amitB2#I@W>RMwYU(
z>NHi;e!YoBUYG_Y0LB>#@<R9d{ph~gDN>q2gfx$$hV7fsboLTQ94gN*9l@G~yzRul
zrDbhYYHUTzR-s~btw{6R;3qd*Y4NgyK7~);ot$v{Zg!}1@cuk_0s#@NR-mG;5-)x0
zX(pS0>8t-87v4IFZ~o^mi_~xnifijJAV7F}d>HqB<{^YiN^s<vmv}tX<xs??Qt3yM
z7HKFZAhZKm#T*$Lt_@)2r6OlEtC(xzu!~}KHD2>`*iCxb0QP$gvV4dplPD1f9g+J-
z`uarbU4p~kdm2vhAEn@~9Fl-`0SDDh>o=|w5$z;PTRL)3!4~cMi`PV%)9l;~Hs5<U
zN^2@G(A$e4@#PnLqxJkH)?hgG%Ilm3O^dAZ#yjUQK0X3T1Rf1{Y~diJVs$mIH7bkf
zUkick^yC!6#ZmaG{OE1IDIU+q9iqhe3}Qp0B9IBFgFFs!11>%qV<wFZRfpP1VmY2X
zVjP@t%Bk}oG@xB^%`npBT<}Y5aEdgC+PaP?$=Po5y-!C0lA;rv$uJVMW{s2;3a4&P
zB9X+Mk3Ejn8yYZ`NI(|grcljSERaMz&gxY=_w7dg`n8x8r~0)s7gRGkT0q9pv@C8&
z<}UR@-DxG~7il7NHMQdS&tF48EI@<Bx;X<jx6|})tZXMT50B3ap8!c>C_MP@9upD4
zJWK8U+JE_D)NWXV_G>p#T2g?GyLOA`4zatgBF^B#QjxleXz9Z7^Qdd6XKpT$<jMGv
z07LJFE9skJx<;2|+r$El(t@(J*`?SRKibI}8h}_2va%6mmBl8#>_8THuQ;;0q9bcd
zY`A+jYS%ZiMNC0qF+zpW<&DgW^*1fRb^YEu#KBm}&8aj;dpS2cfSqn9>Nc;()&uuo
zRsiN;SD%O`kBNg+1!B_BpxQrqgb`@YCTGNb_wv~7#K;6YM0<U1Tt0RNqrLqW%W%rj
z0?`ngEbb!aOKP5*v@Q{$PA6uNB-2NSn?Gx($Hlhm7ml1@l{<&V2qHI;q?5R_@>lQy
zysbQXm$LX5HGXKGf2^bXzmbQMq5)|JTqSdJOozT&#N`mt?Z7|`4!1W`+npCcPC(nZ
zZ4-C*FQ2)Lq5dIWICEklGdn?&O!ePfQRZTABv<M$F-D{XT}*~5Kn`HF0vRlkn%nE<
zGC`;)isLUFM)Sq%2ox1_lZ;9f{hfp2P#MQWPdh>(ao|kLc<Jj;!Ru7;=of!ofUXn$
z?OkZQe1lcWGW0Dy+~*o#$T6a8@$gdYILYQwYT4FnK9{s1bOR@5dm}r67{yHgdJk{3
zb_ct=QCeMv)tfh9dM3U!T-B&n^O{l@eNT<4i${;6?c!CYdChB+TXy9Kr^CtR33BAn
zH<(g$DSj<u14C#&c^*ygoW-R#P9PdBw$xhbd8x*F^6)F@5t&w)RJK;vp{TM9jk|Yo
z*~yOkO9Mum_TGtM5g|YOwQsQR8R<7nOibYZPd$nIKJ^g{kM?kH1d0IdJU{Xy;mmcR
zXqG^B&gB_($nw)4M4(-9r2|?BOG?4!<}uvX`A@;h^1pMs-4aD^#wjo(<tsf}n_dDW
z8Z$OH2x)3e^<5Gdex5{EW@q6G<#Q?&iH3QUmD2b8P`=i1lC0Rhn3BG-^fQJUZc`#^
zFRm`f+)R?AmJD@fNz8`aqo96&9<HCdfQmKsNK8!Pyog$U^*{YS!Vw?(JGxM^b}foU
zWc$Qt4`E*N;2;0<S262}3UD4k*NtZWO!D$v$S38qY0XAOf(>AqYOApMj0|;H)4^yF
zgTWFR1&Vz+!cH2|GM@e3HoX?Q#)ZYjc=?-8iM2D2f^hMY*eb+436~Zz(8h+xxOPb#
z)LE+SlC-7BF!p`)5s~I!L3h(lW(nwTiJ2*^-MNMB>B*tN>rn>)NM)-}9G<GavV>5y
zKpjvp)qB~AL+niwd#Nm~$F)nRarc3Tu<p+7_{DdhfzKbpz|A(MBFZLt#y}*9GrxFU
zM6$DRlkE(#VVph@)Xb{dABxPb4dk%v5RomF4D`)i+GA9k6}$Q?0F)0R(5|?MR&_;K
z{L7u^AyukWVrcj~R7X-ps3mKZnXcJNilKfOn~bq=%$*PH!(=R;X@I5TahyMPN<<pu
zJW#}zHq=NW>Wa(bu~LzAj|n~V!Dc@zHtD`O^`}9ChMk*n*Q58di>)Fr60O=g1lZT~
zsGFTkOr!PeMW%=CeRx0mnr`5$fBb)=eC-<SdGvtT%%w=pOSpLCO>xNhkQWSNax#gg
zlc!No62+PwTM&<t{^(5h1hcc~v5R2SfR;{iO%bWlG*Kt!m@|sSBF?ntQh{u`AZ9-?
z`F#ah-f#l2#zsa_yKyZ$c*LhBmzLs-$de*Qo*s)t5G;(MyS0VKVMElN7Z;;hTvyV;
zpbU(LR0y2Yx&c#(7~7ari6D`P>6V2m{!X=Fhh_tA3-kiWS8d<SZVoh55zLFQa@W<9
zXR-OfepEHC;Sz!wWYtF7oLFzF<qkcE%bCY(ARG+g_;as_ua{92trV}rtL`8j$f}cI
zZi;4Qhdlqk@d3R#KBzC8qf@cbhg&<oOf^Ru|AS;6UQlfGHPl^3BHvfeUBl5Ak025b
zsDyD6TM-M&Cr)jOYWv!|F(IM{y3yjLbcTSC6}_|ttmq?KDGT#@K(#Nh+FOa!gbyhd
z-Mny(DK19mP{qCmyg<W5Uwfqb8f`vO!l&QVZ(5J)hE>QH8#P*8iD;4P?{xa;DZC>h
zknWZ)1VVny#$#NYEff*eQ2zuZw@<UNk#jf{0J+4t6+6{0MaiKfu&_>nZK=Rw+hbQM
zFgDT5l8>yTK?55C)Y$jU@$R<?9n{pc>gsF7{hxdS)$8hT?ZR33M4FtlR3O$F(HWUx
zP+h@bOMKN7=CI@816aLz3nZ_DUms0wwO+b{(Sbo;Lz@rWgQBX+j5`52%D(iC@8j)f
zUqV!TzwG@+oLaFSsWwmR$m8*%y|sz|^oaoE+Nsm5lbfy|(`QJv*8cu3@jhlWj;$oX
zRBiSZR7QCsjOxCT;u5B}DK^0bm8NE0c_i}vZLyyxZv*XnmRl)H{vzv-@t(fc$)5h_
z{1Kz7yQCYx&7}8IwqZk)R8;309iHHZkvi_E7I@`Ef(Z&lf1*e@7>#hvbhLjEoA&HN
zSVR#7Shke`$!LR~^DD<KTvUJyM~~y;8z)g%QlxWYFw>ou@VS`*UPPYch4#c3K8r)Y
z@;JWrmw$`bpF50mM~<NV++`G(MsU}`odRIQ=ix3uAX<$0a6d{a3($DicDQ^&40Mko
zJ~F~Q+?>yq3t)48WdS><u#7HZH2|z(j5bFUE5V=zL4rDZv%q;x+t{Ir=a8_=RBVFz
z$D|xJlbC+j%Q`kOj%^3_VCTMjaOItoXg+fZ)8lc?5kuXE#7m|zS1QraYoZ2O-G)XC
zj|^g<rw@<(=BIJzqYt9Lw+lVjTd+n%r&rINVP^v><!sq|7q%bV4-Yj^B~|1;&5EJ_
zr?G06(|Jp|H(l?6_D+@OE54r*8BJBgT5LJ658XGK5gQ!Rw2mE^nT)f_+|~nk;Wxhg
z=kWMcEo9ZyQQ_!zQUoxm<g9pHuU0CsQq$7owzKX$YT$kaAK;r~<>9Qd<S(`G@4#q#
z=bt)g6D@(>lJQ0*aq!d}w(Z|1QsNSkQctNTF$rUcMedkOip4aCaj{?uOG}t`LL~0>
zyS552%mQsr)|Iq`S78Gt6t$4RcYZjSk%L?ku-Z1@j6d?>A|CU|k6yr;x8A|skKB(3
zKJh5N@Rk3D&g)J1>X-gZq@$f8x~)NX`yg+e$-!Ri|Hy*^D3Un$#yLcaBK$atoWl`f
zp|M)U9*EPhs3=&p*_D=Fv_`R62M3iRl;miXH@A4L^Ro%a0zl`*bq$vkhzQUj4wN`%
zrYE_pULX#&8S!%}HN!w4i3LT`B&F+4=eyq~v$HcOTUCQf@ioxdgSf~N8n^90rN}7y
zhPoMW31GL}w-=?g)fgD>;`bAqj^V(QAHjiN`7lnrd>EHcoWh~cd<KvI?r(^LFan<|
zUyZ;W4rU&V_6>;jo5J~5k7BUB1Kxl?bA4DG{1!C{6wPKQ-5?`f<HX1WPfL>CF^vGz
z<4#W{P$J&r+Pk-*aqo6!9LOn|`wetG==rG`N7IMU6v&kH2(;-4AfTmaHYGV<7m@9?
z4>HiMIERIXoxiv2=E7Wj3N?4`c*R#zbSOSJtj035xyWrnd{JSazn3-F1^)d!>mBSn
zv|ps@7twa+B)mR9Z%Ty#jsz{l2Bd{CulaEChDpqDI`2wbg(%jU{dC<jZ43UcBm6~=
zjoiPc*GeMdRED5f{*ljr442<Jg@W1|eEQG+1D^iMU;lsXy$5()=XoW3?({zBod8I%
z_g*B5k|>d)tY%BHY`H{MT;kYXC(gg?IBo4D{?pdkI2$Kx$32#dWc6b8Mir70doLhS
zNc1uQrq{dQ``&v8gTXX_pahW^KJ(0QFc{3tz2EuH+s=W>R>Yz;#C7JaSc-RFdmHZZ
za&(^U#5=!x74udtLM)-<_PViAbb5gcNFTAyIB<~ixC}XOF-;!#duf6%X%k)qT9ivP
z8ujRFZ-*iS5m%fFWC_kvm(nUIfHWKmV(!WnTnRt)=3B7aT`IdIFi=<+iTsSwd!0<`
zKy@adFuFv5x<4Agk~M3Xb-Kz+aAwZ|oIZ94o3`%|4DqZ0;Mr(gwHz%+j=&%puyDgV
z0cc(9$XwIZ#1x4NVvm3KhcFtHQESpBV5@E_gk^K@m=e^GIB**n=)l^o+qq5crJp~{
z!x#3_B3ymv4){Goc;QzMiM1Dl)8fRe1#`u55uhwK0!f$PRzbRIT_BRASAD_cB*>ES
z;)u1F9$71ZYTrcP=5%scn08$U6SpS@_a^q8IrpWyB6qW%EHEOG<d3v*0hXavmm-hs
ziU&xN@Wsbo!2G2P;4H6%udiExt(`j%i2Wpd0Rgs71}o~JCG7wj%~gn&giJjEqmyV#
z7GWZvhFBsoS{4(L3T#`Dv*pwzW=I3wLs+nOIX2z4joCS!z%;PX(|#V``^ul;^zr?e
zH*bjuJJ&Kmo!WZ<XAd5M(`Dl-@Rqx8!GYKJ!l)y6QX4M_IobA<X%rR{2iR<uI5Nf#
zC*<oWNMXzISeTDhR4`e}d239LZb^EN6#Xd#wmF<=KXHoBI}+K}&Ogd+mey2?Q^AB`
zv3XOq{bDXOPHlHkH;V!Gq9Ux_cmtmQ*{{Vu9LHT>{Q|%LrUgsT+un%^u?g19n}>n+
z9+a0=<CR}O4sZW38rQ7A^`HC%9{B5jKyi67dv)>Tl*z)x!eX}-xIte;2u!H~u|ZK^
zZFzMA+E1UtJQ3xU%&Hcfm66jJ-Dg{v!5YP8RqQUofTvHK)8ZIN6h%hFcWF>t%+z+v
zG>}z*R)*hTrQGZ*`b2CWKHwMqx4!kQY4wKw?FY|He76vbAmkbH=**_;?B%76G0mPh
zE$=5|d}vE;Ua|-$i$zH69T-R|OHl_yf<hfKSQIBrO+y{`A(CvOCg3tYLm+1czyeNs
zuKtR@MLn+cHx#>@!a#NO$FkaQ8DTFl%J()do+lXFVqP5mB4mB}H&39yqnjB$v7?I0
zT9%`uiuKNipAlho8Okcl@y2scp{$$)Lu_ytJH>Zk;+{(>ZCq7O|BRDnuozQF%h$3s
z_E*OOKW$V7!J0^Bk~dB%^=-tNMW(7vv0g@6!Hd#L&f;PvL>}>_6(uKK!DWD_P?|z~
zDhv_8^orvW3&$C73??(53;SQ#iMB(>aZX&xWq=A%KEcA9mMwtEKpuK_v>rW)uCuK?
z)kO{j#xY$nm*zsIr4_SkQMaH8OE+)8u9u&K9MSPc-hAL7F0?gc@wyER`lk;b5bx84
z`~LFlXgPdJM2?3PFEhc=dFm?>QwwB<G>}cORZYO`q_6Bw36pbC_{JaKJp;7aF5mn9
zGh?L>3%Ej6w2JurC++1WpCciPIOjLh99-p5E!5Ozc`87xziuPv;yRkoawS!Dgh7<F
zKE)kk%5`(<l`vd9pTaXaT`Es5Bs-ktrzE&xHKSqie0aKhIaHN$&b^Ok(*y=oWFS@g
z;>t1x5bBnoanD`PzQjQ5EOv1Rfo2rRSq|~HX>5|@6}>ci>-8fzBo<U{HMZROA;E-u
zam}qaa6#nATl-l2L(Ve(Iu10)s9)s**i43&iL|dS2a8SlWh!Fcc;DSTF4}VBm|(Ql
zl;=yCL*caVn!X!ql?wSo>am_00OM4YW~eB>PkL|uAulsh%3)GpDfP(`P*DUyS1Kfx
z*VnNK(sMs~0Ire}aXg>L>?MofDlLX@WEhq8voO%ps}w1xGP+dPR_cW;?0udQv>iJI
ztI@$Z@qvymu_+l59Q5<3ddtxhC@Zao-e~4&ul|k;OaN$IQp$ks&{Z2LU7GnM87~G*
z4(gqKK_|z*Guih)oq+ZO-F1+9B}JsD*Slxve8<xUi+PMztk&+8N<pP0o1sEQjP+-0
zXEz`gS9@b6CERm39Vo9TMXxxKiUiwSuxcq6!^mbN{k00BotbJ@vXT=dL5*W?z02u?
z(Uzj@UAO6lHPV%>n>QQt)+}Str713AJ=CUD+gQ)cNSxMcZW*Jdi3G?3<Y{t@e8i}K
zcf-v$iV)Y0-M@PowM}#3=@hSZ<S+}02YtcO_nt^~i$KPa+02~;$k47OXYMA@id~6x
z_k%>n+%5sZ{+HiiOCY1gJnkDS<U+tlI=&Pw$x|t+t)?$1r>cxdD;gBsW2#pkCpUpq
za2xgxV#((9xa&{8h^pC*JR&{R-^U(Xnp?8PscHpG;rrzN+BB9-?Pwk6TG4*)47Zx~
z40ebJEXw*L^uCC(yTnFJW5qgyQLy*0h?E{@6*xM_OKWRkce}acfLJYoZtCl^ADD=q
zLQ1E>S8<tKrd=^?-ij|yIxLfEhFX^Et5+{0PjUtgTAb9JPpnNTkSPT*(mNo@IxdjO
zij4?8?CWlaF%c51&yKKQdBhkj77I%$dIh^(x^5*JMA-D&BhPT!L36W}Q;ilA$l{}w
zpPR}V7(`YOmq&BKo<R@hEM17kg>!N4$O*KaIK!26%}_7rMv&G+I@sHX8$R}7PMbXT
zlfOoJ(K@bP-}a@?i16<i4!-mz9D-FvV>({sX0s{f?-ZIMNE<jvEp%l~6Uf<Z&QorQ
zEqO_WN`$6Xr<K8sG<t0g2Twv3;zq!ZvN}CmUCZzDFcN7C)XZssS$q~M<PP`rp}(^W
z5!E}77_LcxwGx^53lrhab0PLwQeDYHHzb>BR`m<IJm+xLwYPGM<Jl7@ar6E6;+>~o
z!rq;)!fh|*O@qd0DJ?>iU|fWhG_%DRimNJl(1Dn{-e6Qz=2DKQUaUv2#U+5&_M$!!
z+kP>hVa9HJqI9p2D=iGle}yCM!{<AGM7yU>8l4nNCA3MlD<zw~)UE;v*W7-y2#wvG
zBA}3w<l#C_pM_q8Jf-C&Xg_lno#)#5#N&YiwWUl-QI?UUwCY$6Zc0TfFZE8UQ#_+u
z3YmS%#`Tp7&=?TF_|ZT5EUvx#7QFNPYXW4OQNp8;i8Nr#(uy?(U=rNU_Tq0ILuYdf
zw%+<>9s{P)U>c*O&E?Dg@>j6g^k`Z(4~sUe=0<#CQ?#Kahi2u83>?Urr?%uwhM4J^
zvKaIF+;tF*u&B13BpqcPlkUxTeh6iC)yW3_Ou$N^duq{#a<kzSSJwBfVl68|E0uM%
zXgPQcedjv`Yq#<M4Yj6`2oe>iYUj=2qU}YqFEwXPER-~JS+IuImteQI-uHQ|+`1Vi
zy9Hj)02d0WPu60#ahghrI;a;p$j6$%lzxABV1R9tMtTR~AMz-ZXc<5@VlXLvvx)c@
zaT#4MAD~s85h%~;@9zDhfM7I=vRBfvaWsXHHbJIH)KbezOt3T=3)ZiJ-C<$yqg)*s
zB*w)3IL~^UaB$}?l-5*X)pb|F)7Q^xVq;mvsK||+xjL2v7%Eb&-F_{qs4<>&9&$D7
zr@n@ySW^=?G%TElo|f}?`uo3NMpIl-IwnV*$$~qb;nH`PQ0Lo;_0uL*EWmpGhqm$t
zM*XCFUw=ihSP_f7`+OJr+s>h<`83<=P?)HM+3}nJJAU9G(<YJ_JK2Rq1~=M7+9X*b
zWlu>Fk|CjOok@J2?DB)ONl-zF3OvgHWfs!je*ZmKv}v{22tDuXiipOd>^wldr$gQW
zael61{Z`8L(uG($i7Zjh)U28qUR1$LoQI@^TvA<yqKa~S`Cq?{&3E0(uFO`070>+V
zFYxp)9)KK7;DPV_ZybF24c2TJ7ix(s3G9>H=eiv?2$mdAj^Q%&WH=sz$<pfiz925=
zE+?R!eq9Iu_sNUgIwTsS71$TmIV#Jql{r<A7#oVFc}~emMK7TFSTm0V>g6bUJ34se
zmVC2_F(e33N&G_GFBYMbq*ofni46yaePXd16&X1Jo>a`DvB+?;;ay5`AQ)w31Zrhf
z72FoX_R{&P+p<zniK;BaE*2b3kezt<0RKKsu_cnuy#*BKWUX64&p9*#Z`vemb{pDH
zHFJ@Sm_4zm^71P9JVV&`;_J+$>ArWMUo4rJ2w#ifEH8tnt5<1(%TOR2+p0C@!EuGI
zLem7vqKz7vAXWHBJWNGQI!>qG*~ddBW^0zhmZZ$sQwm87LTFR<4h|zY;>&B(a>;Ug
zbgaeurkrNb??ZKC14jA=IghRts${iBLC3yOQKoUrh8R3)eo&iRaS@OFk`!XcnHJV;
zK6CIWhP%3PWX~Qzkdflza{ij_HWxG5L>3P<zi$Nd*Q{g-#)Gf!rm0(To~iC7sX#=|
z&4S4WO!k1de;pJ*+>5$Qr()Rj%h4|T+{J$=aV7DT;zjcY+%=UYK@r-LBY@0#+Bky=
zhd9am+AxD)b<r5Y;RNa%E8w<EsA!nY!Wqr`4#G;7GE^xpE#mem67FbRG>=CmJI<U#
zK>Qs7tMb|^1_=VEvg%5<^iHViVsc_EyVdCwReKJ<QuBvd4hw-d6}d_TIB&l5X0)Ab
z#_>1b;hAwm4pETt;5vGts&>`vdUka<z3;Hnl>mwJbiIAu_~ifiBVL40|L6gfloWHn
zE#+*rA`#``C?CFX(<bq~#L#uNg^O!r|4yb>EnuvDdrEdUeePY()OV|lS5v!`Z+KXM
zsGdVrgFyk)VUGv5ed#`QpCfJGXW=d?%bAm<C_pnrBmkq-fyL_J&zdfl@}9+as?V0S
z$jPJ6Yj56)cYpU1>mX<aHE!t>kxfuAUINK%!wP)7GIUrlYZk|vh6*T+MJb3*0kA_N
zTBG0bd57V!JNX=)u$?%)c9fzk150aa!wKmgbM(Ant2noG`mgKcsnMLB$<gMic3$k2
z<p!zMsqOqHDdbIdAxJ4XR85mW8Y|za3^M3(p|uOXpg4hLBNlAjh!1_?K4wM<v71Ln
z0z7q8T3vzGQ)l^inwBr-5Zlw+r?9&sw_=H|)1|zAO8z#fL7sra?Pl{uy024b@d^Bt
zym2b~PH^ke)py*4H8);^Lpyh)?Z`>)g3xF5X-d}{NUzB$KPR?6)Z35F=2oTXp*q%5
zDu9eD-}&9kSbf7aSbp_-4EFYNRa{PtDs)k?g8**ee4Ai^{pvzbWw05Pvyj?ymnOoK
z?n0Z?dq|A26z9BZFbuofA&$?zN{S~E6Cf1kQCh3bjDs(|E<);)ushr-%vDxKsMCso
zqpq_u0}thR>9f9<Agf~r8&M_@bq4hH_u|G+e-w*1u0%)waqN8XNu~c=1z843!NO^}
zY~3x}l<zUi`<0S4fV8kyL^FQx2)DzLGT5P4-{dww+HC3XPzQn0Qh>{@`rT6dBfU3|
zh;}HyZ?!pKG8$Bn)nWXoEwyvm5Y-#I1jznxT!xqFmpb^5C#EFNOQ09?`I}=2d4s*8
zbY4QRFpLv^PIXyTAES^aBEVUITyM7rN8WrFJ?))hjSJ@4*9X1DE<n*PSZKcpm=h=x
zOtSstSze3_*RJ4UhBF6_VWfY6o63g;o29lLDZL3yvn)>&5~oF0R9OahX)%WT2b0A%
z4YP=GP|=IP{k12a5`VvBd=5BkgF|Nj8y?PJL%!HJI~1!;@hxjRdWt9GD(Y&uK&a`L
zvSy1;$L}*748U1lieMn3ZeZ!Xw#cY4J3gh5IZZI`dD^X5y!5BM14>cOY&Y@(r_ExZ
zqm!%il!N8(T6K3NP-ZPu%0~;J@p^`od499fTkI$*=5gKkI^v^gJ}TN3SCygbLM!I3
zT7k;OYM5w>%~gu?XU=fGoQ{jOYm={?&Fw;2eJ#!&IKq)ldJ2j{_{E#nu{BM1Yr6u}
z>IUQW4q@){WgL06pFG7IKl{#2P~(BlAxg0<+OP%#-96a$$-7~7xY*vtU^b|KZ+y=z
zwR8E*E^6(%Lwuqs%gxU8(OzOkt7)E6F)Yy4{prBq5KJtDtSWj*(x?-Sl-6UbhGH~=
zYqgmKuvBthspaTN7#+oe<ykN^<im|0zZ+NGbgf_lUT)w&Cs-3P+?Cf|B|<H)!urHQ
z=Mb6-ZQ?aNf;E!90-eC*UQ3H%tUA|dC&BpMO@)zH)KucP|MEjT`_l)}&@g9AZZjKW
z9al&jW3Mv`__|cVk)#z)j3>-Go6n)UrHz5WT~^ABJt9KFg!*0yko+RluBa}>@BPIe
ziZC{yY9r_}I~|O1O~_&^lT$WPc|I*{V*f|qct^>v3eYUBtit>?D>%I}YtcN|id?)g
zQ9hiCGvo~L;jera^Ea*)Ot4hEh=eU4y$y3$F6B-VqsfZexlNq+OiX1DZGjd4M4XDU
zA>ODGp#XmQzy1aLUU>_KgaI{k8nN}>kBXnilFXIPbFz?m`_X5xY|AF@sg0)z5?QTw
z)==nc>kuKlGQdF-Swn1fE^+%9>m+FD0jZGp8CPW-m2-%CVvR;C%4%w1ve-mqLFt%8
zvc*el^GZ!C(60ssagin6(_&kD6_@E{`sHYsd}b=oTJ{3dxn19^ShDb2G*U}>#{{<`
zDS27G)$+7z;f%hLc+jitzErJ_MU&#z)T<lx2QhcqLX_8*WAE!b1-l(UX+=3gp$Kda
zE0zf6aQOANG1Sw?EjaYL<dd}N=B;QIfJ{~}l?`>Q($#VLoCw{`$rGD^iNK6!*Tv?L
zQ2Tt94M5o$v`|*DAkV{CQ<!5xn_LbCOy3i=a?M`8h!^OBwX1kkb?=L>!De^x=x~t$
zu5!W10=}sDE+zDLbSWdtDKvZBL|3jtSC&!UTo>xsEE1tK0cE*hd9rG`b3lZ|WV}gW
zVsp7sHLsC-Qi;hm(nOxPPhe!R+PJtQNz!`^vO3l-2>3^M^C#9x28d3lo7=X65igdl
zyBduv7h~r`k8^~P)J0AtIA>cW0JHmCo2nbD8v~4#Tc`6(Gk^?;b9~9Vb!;WSf9Fnw
zN5ZfPkj}fgP$VPH1)f-Itb?zAh@BA#XlbmLq60ENC1PPT>&5*Nwa7X)ZD0`Rc2EGb
z*W!xm6LIoNADqhXb2{Z{rybDFU3}lvQg*W75X{Oxr}1=I<E(k1;bEod6<7N{HPDTZ
z7Q}dvAs%57a2++QlPGaQ%@tA}Rh+<H&oBbsAXZ(!9y+TYCw9Hd=?2PcQV%Pg)a0eK
z>zS9uLa{+_GUJ*%ZsLaj_7i7dvD;Yz%+ou-zhfsBqUF}q?ieLKnSj-9;~DY(j-Jdy
z;FAT`alj?#%{FjXg$P}#tD;P>Ym(|4?CM6y8(=`C+~VMH57u3Kz4)pmv>!j0oOF_t
zW{J4~HcL8T0_Q1@W2^nI1iDlxRMfcqs@6c9L4wW!`tB*zrYb&7k<sSILoGQ6M=s5U
zj<wD05Z|v)oLj>vDytCZP_@{w2gPj-&YwJo&aSgCiGP%rA2ZU-;HQuP#gj`K+YP9C
zjtvicP*haHAl}p4j_W>rCl^7V{@Kq_URG0B9+t_54{LAQDk6jk&h9%3gW1R+OYBvf
zRwLmhV$Gv$b~H^!6JQDP*s!gHJX1a+{{Qo-{yt}lVL8{mJf&AMtTWJTcKd}psY}49
zc`2nhB8(Z)<%g)!YZBlZMLg_N<n>Z66qeD>Z*y4qq|-|x+|rqntdu$sJU#tvnD?=-
zeF0?+vsilZ(eM2P9cSBEi-16VKs@K#kKT$!8&>h;QZgbY_8|a5$(ic7Fhd0fN;hOq
z1<3gg8go83Q)&TY7^qf!B5)!=B^&br0kC>9>@%2{@$=8bcU@D}fYa|D#JK~9KtF;U
zVb-sK-#BOBwDH|+X@ZHIL-am~(bA++I1u30Hyuk`CK!aMWsRJH>3Nc>^iMsg+Gh7&
zgDhPFUN07IT!Z>W^Whg@YZt70*5XBQm6zkxz5}Riti`5n+hMeu$7)Te-yzx6Y`T5B
zh&UE=aVs@<8WkH0^~T=*h0kyfwx{<zYO3ep)Sg3l>}Nkhk-b#i+!Gm{4m7YP$<SfJ
zvMu5@7Hn9f7H)$)pb(Eo`1h66oI$NGXk8A{xK4wB*+J@DCoToZPPfanlS#Z3$WJX<
zhy;%gx3vF*dFjG$P{VX08exc)r9}GJ7?e3L!CXyZ;RXGQ%8;5+lC|3e^&7fy>cBC?
zqj6NvsYE2=7h$M}ds|6izWKlr)XtsF4xkrKo<?~?9eP^Y#0hC&Fr~r^xi%1pQrnhh
zHABUYQo&>h6lfwy)+;CY*i?Z$5#%YTC^r5fIV(dZR%jF~om>b=1&mS%G`K)t6oHjl
zFm_sW@kkiei{@e3>_%KT(SlA9nw#yG(JqP9sjt+(HHDFuR^Xd%(Ode(?sDPCtGoDp
zmX|c3r>zU^Cm-fc5E9gGTD1gLw;k`i{0gjQYmyx(zFcuwEq0vTy^qrjCZmN#Uix~w
zV0XA+7RQQMFipm_w4KE2Ypy}lvSoPliAT{idof(4Wo+umMMIr3Xb@q4GIuhSKsj)#
zIqbOm(^z`ddi?xb-{DCw8dFcO6^)i2ATjS)(sWT-)u}0i7=lI{LIx}JiP(p61ze^b
zqm7A!I@Q-G^{@(13k?kZndd@hyUAu|kd>15<dQlqru~B=wjx-q-r^WNNs^X0%I-|y
zM~YWArwsv*j|H7eYbwxtzEklt>+Hd+zkL!hvEz4~ZRK_?T}rzbwIv;W^BtU5T}w#>
zg=WZS2}VOqf!~R&2!$x2U>>{jY{jHJ&I_5CtDKD?tN&G$@^yISfk)Yq*y41GO=eJ0
zWlEY>D&gyelV`<7qNmPWI7^F^K@Fa2O0yA{(+Xo(*hQxfC-8S8$s9S5`!X@{@|s#c
zmtXwFZ{e`mldV*o`l6yMjfDG#Q8}jp8*aIg(^&&U-MIel4`bV>??xyQMAwCObf0a<
z&7Zm#!Jz=o>^+RWjvka$)xus>EdHd9HHc%OIO^uk!<y~aa`(n)?I6Vc<5s&9FZ}Gc
zhy{Wi*>GA73X4_D72|xXIohU6AjVh%(Ls`%UlR|Vo&nnT;Sv=G?NVIBG7FW$)6#w$
z$<kSpT?i?92xB@C=uVv5y|}25GRiypa|Ia4i)pBT1aeqL{rovtux14ou3jd>H=l@_
zBg_P7CY>~2IaH-ZB7U6;WDaUX_YCu68$Yxa?(z~;&7Q@D1h2=FTW~t77g=Gznhvhx
zTxm0;5_GD}AGNR1!lR90ptl=yRxHNmdv53O)h|BJumD}2nxob>@g2SNlV9W9frF@M
zsKA2tD|z&oCa#j54zhg30&Hr^L$jNaQ*y7gc~O3K-}A3>-5^eFYXd!sOEOiE#C@{K
zS#{&}SaJPkWs{Ce2u1=tEk;pONC0MV*ay!*FBYs=$;X@~wC2uVi<U#jadOvQ)`wtL
zs#glKB)O@*A1ZKF)YoGB{rBRTAN&%hcJ1TWFsN;FO3ER@T`H-L336HufKmp2vy)N=
z?+VcU?v-+Er(Np6BwfPAX3|3+j2`Yk)AEhl<qQ9T3If{5rL3{ql!UD+|IMJNJO`t>
zCTSGxXa_GUFG9<)bFj3v<MaRPuLLWIpi3~@?v{2=1I%B!gnMd<UCSbz*7FIhhu`PN
z_TRf3oy~1L;6Njf%?FOcRqR$fBXSpmIBbk5Gw=G;$uK#0L4!g_MFua644|C(flx3Y
zK5IFaUb6um&8_IYZ~?<3gP6B+F>fZ%KlDp%+<XJ4RSvzrn>QgUo>9St3VE%Ej-kA%
z5%bn8=h4pdr<=uoCUfTnx4T{8V4LkiIoEkjO9Tj3!&X*;%DO6e`})QA-wo-cj)jDZ
zD$B8d_*Hh#C>F<P<Bn~3{6Bvp7P%3n6;%v`XHOl&zL#Fd{8cN&v5eqs-x1#Y={!gd
zW{6|Zci}v1eb6zDghQ-*QBqYYNP(B-LZc!|Bl~)ePRL`8^RjyGNhW)7rKM{uyik_`
z>CBQ3m_8A^=Sn($(++4yVwbjWQ8Jnk92ovbsk!Zj`USJMQTVUqmXf&vr6{2G+Kw|@
zOqT*vflz7I*27&=irr5>kHfq7Vg0si5m>cM0Psmf1QS_u^*U75RpXhTKZx3<*(efW
zv`n@+#JC0M9DZ{*$|@_k@;!bUDKh{m1t>+rj#y8oB95Fk_DZck#7?LOlJp9abNq4+
zv{eZ&jegQdYH@W1ZzA+Q%iNWC_Q$_Q?Sdw3zvH7YJFMK5F)-4Ns?s{lS+<x3xT7J(
z4dd{>XK~BNzQR@MvxkqOanVBbU+Cfi4SGEi?1|?xrn~|#H2l)r-o+b{I}kx-O*KXa
zMqm)3{)XE>#M4#OVe|G=FQBvU1h(G#N$8AvPT9DfMTo_t41y*0a=h{U@8B|)akN1l
z3Py`5>3>I?e^paG3w7(b&pXb=*xGqb;{PT*{lL#rThYi&7Af}eRL4-#VmkG9{9r=F
zU>0oFLGSf`@lflPbo{1Wdsori-=ErWj1eN9RCrSKV&lX(t+SWT9W1FRv2ejjZM;vY
z{j`bHzFM`dYxGtfDj*p`wOOCpDfQD<6|v7&Bpk;B|MXpK`{X@Xd*c?g9zTO>0dB|k
z9z^}ZdF&1K@&ms?<*YjKv(s?8ovf;#h{jNWXU*uwG~~hNkKD@d?ae2ifxD<=9I&SU
zhlFC5U4Jz@Igo9&S?k2e0IumTqq(h;sy}&P5dhHN>+k7A)vN~G`Um%+{nQz@Jn3ui
zzy<NSmv7rF7PJ$mckhLNXarRav(S9>1b>&&Xc#N5-HcEm%m7Oj@i!iMioLvm8Fo7+
za$&s;i8}~rD2BfG>iT-Dzjd2nvn4on@EEpz;x0V*<Da3bu>mhW@Cf^M>C~1$)|joW
zLKO+zi}Ul;I|sRSaFk0(TnjK*4e$*P@;ObqvIYULRA8g?+-y!4kdakO8eP(CF}=e;
zr#^qkRzmsNM+KX`OA8-Kh#qPIP5GQUV2V0E2G9IthS6rbBtqR&e1;lCxMfy%TBG={
zL%G$3f?aK%PuLueN6l8VqI#sJ4w%gXV-C3Xn37@`o3CZZTgpvA4~Jm1R2&Ni266qJ
zcZeTJc<A4LjJv-4S-}Pqn7w!bn*qM^;G?K%Y~&(_yQGL00SU8E7?-c!m3px|1%SPC
zfEOKAm*p{e+RPwLxwvC*?B>(~f%_Oso{X7?(P0B(oJNyDgr;S@d6Do4y@t)^z`9#+
z0zpAVLmjsqFI>L{Zwb)!3UFPzWi$4_@G5^+5_<XWm;Q`<Mi*Um9fo=b;3#&oC<+Zc
zkbz%39_GT#%q1m%s}3O0lw*mw5+kK?=x2ZYD_sA{k8m&cnM23W+t~w$)6FVsI!W=6
z>-Y8uni0c-S!;36*S~_FeB<xAH8B;)>0BP@?czyCS7|AHLtX}2wih=jAeyeymFoMI
z>D;6K9b(&FOEKaGTZec@_eg34MeUQxtE@yYay&F@VKkFExO5k9$Foz<26QGRIj<-G
zqGIUHrDB&iBOEn8)_z+4r>14|ziu=|dDl)Yipko4G;ozP*G`Ph+p1veE-exv@>v{z
z=Mc8tcNgyX%I9!qp8&x`7*>}X&4&)7PO#dp<`#IpgK(Fx7GYUTfN}sE1uLP}Co)c?
z5KkHhb#g{l%WeW9{HIH*X=JX912K9N7ulpy1+GkpoMY;Y*gh3W*6z3ttw&Dc-1$S8
zy<`E7zV!|lUI<W6?s->zojBT$9v5uYft5RM#L+#6;0d(|mb(NC)~?2$XI??;fs+{O
z_uzoMlO0|)ZQOKrG;<l7HX^&B*3MHboB8o?d<Dn$>_bGHPf!2$r>HBR&sw@>s||PD
zcR#0Q4!yYxk9_9`815NJy5{mQhuGw4P-4mEbt2+uWFIq<!!)=|DXFvZZlOwNL3T|D
zy&xa~iwj|E33L(f_Gn}%F30?cM}`Ee?iZ&<nAZn^tp>g`se|_@M0#)kpaa#5Z+&~t
z@(r8(o(^&Hj+Ia3>9JTMsXs6#ji61G#g)hC#G^ji)!VMYP50l8R~~o>B{kK!<^DVH
z(Dxn^C$k8f1<=0z^b2qo7vuE4Ls+-{S~dZs+$V`~?0)h&Hb>M7Ls~b0G)DHTu(U$1
zd}~J5nj_sX<{?P|Yg(WSHmt^l6V0d>Ap7c*PoSc#3Sap@e}@-;@i5+a_GuJZOW_TA
zP*G9C0|LvpZRJr{r`w8-lWjP-dlyPw6+B!(#mPt{z=af}(KZ9J1zaedU?+hbzYkyj
z-ao=<v*B;={ymszID^svb`x&=_{XvRzI*UrfBVm9IUpEs%XzWMmnD0dNpz=bHjOG%
zip{_sA=KNg*B9#ioB25D1>5Dkth))pzFl974jun)A|8BCqktJkI}I>hIT}8>>)69P
z9K|&q6}1%(?_e)9IYYHOFooTYve@LQB`GN;#Y8|703o6Od>eY(&ZFh<aU6dAEf~!f
z9DMOj1VSO~xbJRUd-omK{q%F(Q%a5AG_gh+vov#01ueZArctO!OoNy<g@p<`*A)P&
zg#haWz%}(}>IdiQawsYo?7KX9w_?i%L_{cRC5vv08LqN2l)3A85QApj1A^ra^qvDb
z6kq%CkDy(EbHpD)iK9#r-hncLs-z3#oGfYPg5<g2>l+lC-746M?D*+l{}Z;}a|brx
zeiL4L=plp=#OAfPAsi0l%_m=gr=wS#n_b*JAg2_vc=|9LW#@yAGtF!{LmOW<UEA@?
zC^3%h>WHL>-w(RxAmVL)Bs{S1yH|3Ea-}lbaWRn2RIzF44PSlRW{JW-qUdQRv|?C%
zRDfn|Q7ob6XO+Sk3vWduf+6_Ouxts9PYHJFMPHW(MgzGmgkcnbNi49xtra~j=XkLM
zNQ=SYP@2_aaRybIydnTzx_KiSmoC7|zj}<d5u%|87c5v+pIL7PaLn1^l}$rYnRe51
zb>p5dNl8Y}&k^r|3Su<%<{R;e&l<s>{O9+?XYI$M-}^q6tY3}hcMsvv&Rv4N7Acyw
zf+3Oh54~p|-4%dLcG_b*EYwYI24wT64k9tJsfkVQ#?4rF+YU7EJAmN}=dt*jtMKoC
z`b})O{(3YYI)VVPQ=^q9&-_C}<D@Xz#UT_{id_YoS1M~&mmIq_7|h9IMt#$C^}8Dp
zjQRKb+kU%7tpi8}?&y~tqt#u3=V!WgB3~1c-d(5O{?%8aahu}1q=|}1qh@1LvQjFI
zRjSu~a9A)pj+&-M!3xYQI%Bq2*-e*DW}2dr1ehLu?Jal)y=Yjnkf+7!=Qpvn_1qOp
zu=&F`qra=0!ITPPB=p^K<RlB!klY_n42j37C5P3RRDjg_{Rya96h-w=OEO~t=41~o
zK^iwLMjwMZ5j=zatSL(^Z&cZ)7Aw-nB_IrXeLQMQl6;C68xV{JF>CQceD&Y{9&z#i
z*B^cyzxnn*qIuW5=sMGa1F!5tA{^s_Ohmly@X(;xIM!kDhLzA+^vq;4wXw~BY+;vB
zC<s?o1<GbsVW6cAD>rXKaYF;_6&1MSbDu**97h7cu%85yqT={_6s9^ZXRnCs7&SNJ
zf|igZo*QML)um{GXvMF9qY5FNAr`ps^i~yQby?Ql6>%|K;UJs3;UvPt$N&BGyU#3L
zyy@028e=4u5lz+r<dmtg<mk49aecKEDu=|0Z7+_()7>YSX%sf6RSAVjEL*S%Bi#yc
zTz|_B!2r9NEt9NVcl!mH1sKnoKNmwi{jds_+jX`TZAVYCv|Y{IM$|2w$5MsVoZfQy
zm;m-DU#TCG<i%qu(<R`f3bE7WMj+rr{ld9$l(=zX_x@24Y-QVLCf%@X0j|C0cI<iP
zC3K6wX>~dooN4jV7-n%z1(t5v#I`%f-+GsG*jsM9jpyT^`N7XoKX)OX{pqj8@7Zw2
zAAJ_J^B2P8aN_*2)7(Q_SznLdp7U^36d@XjA`}R4r@{=VPA=+;iBNwa*o*)6NB@Z7
z{(ijv$m3{iUM7xp0N(yVoIQA4L==a4P{dVMn%vNm127l+_hTW>rBkYh+PbvkNO{?S
zwG?4X8A9!k-Ij>?hw0(58U8VB_KHX)7_LBo&Bki!yNG(bcK%_@(ekBpmaf~Jh<6Fr
zm{5loq?C!VvEZ88rJyrN7!UwkTv>#>zxI3RJ>QR~zW)o9R8}U>HOj$8hlj=Ezr^()
zyB)9p<`Gu!q8DyI*^K$CmgC^STP*HuvRM=xX8~+9ma7wsi1M}s+ND*M+|#;f<7ym#
zdoO&x5nOZUhuA8eD*vPl`^?WC;G!KlyjISsM?gHEJk<KzE^z3sh&)RS^gXTTxiDgN
zIhiffq?*;`fcPc;IgQpH+4(l2{xCD6^T$r{c;{PzleqoU|DClSX0KR*n?83h{`s?i
zitEICS$fSzy#CwAVKy7Z@5nf@Yd`ejerZ`Hk84Ug-3)S0ASbJY_z50zsh>3uI;$0D
z4xeVB?S*TX;irH3cj)iyLWzr98p>5k(D)RByiNt#1bee7+6JQ_8#Xx*vR5P6_0pH4
z{`1eNAe){tNU!W(_F#J@<Y=>jY^GT+TJ>RZHP<e?|IDnpb7lpGyAh8j#^}}}Im{rB
z?LJWN2S)@0EH6b}Qw=-<K+hdMi=vVumTXMs*I2qPj7=Z88OQhS#f1|m1?!u|RyCD%
zH5lyaRV+*Fb{2!?vofZ<2buuVoDImrq`0ySJpwqX`M<iM9zg+&c9${$adO{&*ewo(
zBVo2hFR!WQ(N}tH4df_IL1_Vh#0!VnrHocW@m(XiMq=qS`%dl<t|B)VO<005s>nFT
z1S79*tY<^a!QKI}LB!!Ma$xaQ>tS)Zc#5cI?rc2ro&ONbxCHn8&;NnfAN(C&78^`y
zS;Y*3j$HtJZbeur%c2}3b&b+vWF;>P=-T@6JMij*PhsIz8*uGi+wt7b9%2XL{+15b
zq-EpADaI}>CrejyQlOSetp}SxmMv+D=Ofs^=byrTd;U}fSv|&fhNpLl%a<x|JDsrY
zatGQ%Ko)69079Q2V42mp?z1N=Yszf?p<cD^OJxTt=%yFOwEK$Kcn}?3XK~fm>tS=a
zap1Mxu)CcpZ$z;rH;Bcw;<^n2pt{g}@E9BA4GGq|`PQ36SbhfGE$5Z)gqS+rmXODY
zJ<}u^EkKLi%DJ+D&&Ne4VvCfobrlz@&cAB0E}@8qur})y9ed5Hn$jDTb0!d{{!UVx
z3V4Q4HMbGlKmS>b^mO6v$Da_N(Zr4Lo}K}<5q{<YPBO90qMiHH+GiE#NlA4DJe@t9
zCzn(WUpijIQoGw*xYJ<MZ9CA{(XZsS1^DfJ@ELgfhhTHrryOM1x<-I$EEdiHvT<^+
zg<pVd$anU|z=dbGt82-O%yLF@9)OiEH=w<o&+<Z<Y^ML)fzbKZeZRa`Z@B-RlG0)+
zFfssH?Pt|e33AFL8B%h&adG02;(S?gHIEpQ8a*4`$z$ET%yu(dz4!;ca0)Q?^?A^+
zatW&E&O!J2c9hSm;m|xR7>bEpNTFyl5bGsN7Aj!ScqLWtm8qS$s!9eJp){Hk;A&x~
zqS!R`+N^B5lQPOl43<(0RNN!W9&*_2Idw#ULLcXD-+1ORSm6-Ny`EY2m42aP5*YUK
zv1(X6A8|Q`rCZkF?MI*IVx(EH)4|?8!Ej9scGP}#{#3JwUXF|CLBdl%{UKbIA~@V7
zuwDX?)y@}UvIc`?9LUDSN$D?Y62#%cyTOj<wyVEFCq$;oS|O=}%Py6mn*rHzY*xGP
zL}F;~xxK%<Wq2qqLU`AxHMukz=4o9C6n;x7xm@n8Wx*E<npQ4SG)B`+5d}awoK_rt
za}PStw2QwU!^Z8`VgBl+II`~*4&kr=#9iD6nbaN?zqexRHE@;{k6LESa>lV;Iqlzj
zbs<kKa+o;q(oVekt4E<1U&cLO|0?QNEW^4Rx1hSJ5lc305KKIB#TUaU`k;-7{LALA
zUydOWJ$ZV1@WM}iC4kG%`TW7YK5V{g2R7b%BNl90g&MJ0=><o6;)g%S{%2o7O=Tl%
z#HxsR5lcqO`ZJ1(6ko7WkfrW|g!mPI(Hum=14jerpWLV(PgkCGmW}A-TEjCy`vC`8
z<N#fl9PNF!dEY~y_xknhPp=7uE5M3TA=?bEYAbT$LUS8-KlvgoX2a+kV>2*Wgo#1a
z&2Pf>_v{eNwNorABZfP>(Rtzw+|FvW3f8h{<66vJy&S`X1I$X3on&L)zWlxdYx-qq
zs2^)?x(?TV><;t{x1sBN2fqKOe-F?33+Ou6hIO}WM`>L(eBR;r#WH59@|Bv~av>rp
zlA2ei3uzAw2r#8FS8`EauyGaUuUm!@5jAl^G7w6J>d{!3bMNPmpM=LVjNkwEH!yqA
zT%2t?fvV~TRk4j!x-L!^Lh<^_=9MNhz-qb&3dkn-4D-2XBN7h|`r9AdEGzTe#d$zh
z%9FyoJel8RmZP0W;VU1brTY|TQ|vu#a4h(fd22rW&sI~IhY%8K;Y+(s=4!_j$z;Sr
zVeU&c8VyL5VWhJ(7Kx#_x(s%=70vsP2zKj2Z*MnDf;kjdl%uD&7n?tN8(c0Yc0KhR
z7sH6*P(LIU$tWk9P<v+I_v5Bk#A$q!vKFha-NHUxuRi(&c6{ny?0Vukwz<|@Ex7u_
zx1e_J9Q?=E{sMN3J*h4=-7kvYm|h)*iVFaY@t$e6m@_hSMJqU#jB=<yo2LB88F}fJ
z4XkUi=eg(6v}7UYxVu_fQBqNrO!xRkhFIBb{@NAz%|HAb=tz@cqtQV5DZT27d@)NU
zC6$#X<dSX;K8BsiiVB|3-H5ORU!e8jb@AxPN%5mHuv$J6>We2b<Y=?yY%|?nRK9km
z81~)(Z6SrPTp+965<*7A)njxl{Hvx_cl?db6hOe|Ra{q8+j31lQBIjAOX?%UQ)CrW
zu$I9o97RaHmc?#Lp8VRdmtHKS-u^zpYS+Up7U$8o_OQX8!iZH4n`%4rK3*u7SXx`f
zIoUJs9_Fbr(m<s)u8P^SaC-kC=q)B}5g<#zI@~vc(|h)F@$7@p;zjRsL@-bi<1w1_
z7#!@zrdw`CWqlnU{@#D0w77~lK}Ew==I2xE9UU)vd}LsNt<R}INy8@VZ`q1-M^0e>
zi?71Kw)PS`BWq$hv<||dAcN_3AG?!s40!5CKg6m{*B}y#;oRY4aF>=%s&z|Y%W(!*
zMcNQ!qN7pouPh)dPClQrUVyAT9B6xNlK|Nh;=#%cAX^B~Ub1e48KAv1KzlJDn+a&s
z!8RnWg9gW<zinE1+h5v^0&M+W6<pH=XHsm-8H8o^|M9HjuZehsSq&ADXrLf@T*U8D
zTbRyl;({1;AIO@omfC!-0qy&FEJ+lnsGL00DslGEaduXqcS9f(iHET6#;vfp9VjX-
z6`&l)lmF+(JQAuW6|w1@r)7KX82b8q@$s*JRYV>KaQL-1VG``TqP7~&l2Z7*LGDea
zsX85}mGnH2QC44#@>#Vwf8rGUo*~s1M$ftRA>RP3dYb^t(j<dT1qeD{Xkf)?F=D8f
zl-^3wcJ4Sn@`XRZqN_LIKmPbHkO<IVOi^Zsj2z2E@$}MszI1un?kLDAoi9Fj1HvNe
z3ba1BIvyE5AbwP*Mt<=uAe#!l$Z%iI!)hl5wlgERmp(6>E89O&W~+Ti<kDCk^PTvs
zvj?C08(-K6i_I=hRC%-@rfL9;DUzk+Z%2K`#$F|vdM9;gTD<};vI(Ig*C>@zbV#Fd
z#3K=YS^mGIs55C6&}>bvd;daka(SSl&hg#*#C>COM45_!4wswL3M3*^)6|4mAOv4*
zggY~)yHA+R&KX8**tQjY?QIwo;XZv<i^Yb{=2o;EJ%LqQH{piQ+>Pbetw;Z02W#m{
zx&*?0A6kzbgLhz1*-%t(Et<9~FRkVjLORG&d!LVbn#HDT78`5bf_WUK4|VszZ7ai`
zXI{kK=U>69>$ae%s)E1Qi7b&sB9dgX=`IMlFpWS~%gKgmgr)7V>r{|!z-T9dF3UPf
zeXI~NblK%=FBe9ekIkkJCFBBFU55MGbc;!4wjFx=yuX;e{I+j9OhJUif=VRhl$1d{
z$z~OntKFAbY?&0hbZI9!jm$2*YAtH#H{zvVJjiJSVn3-CJ6fSa$04eLM{LQ6&s|o^
zfG|P}TAxK|W->Wf5&E)kRFNy^=%!W>N<DV;`y^yeeV;UKMr~>(wH4TW*N4&D(t*9t
zy~wIwAA~(T9139VP1lGpe<uPXJ~-K4do*N^tM)rImOR+q&Aq`qL8Z2?Q7%2#I-}=C
z!y(>u{NW(({_^M1ccBxnJn|Uq78lGmOG?O}fOl{Rb@S&T7K*Z1x}Js;vb?_Lh(X7Q
zUMJ3$HWM3WpcXDt;^LfaA~GCkf9(21)Jq^cm$F7F3^vnMo<PoaO7pcdjP}y8*?cV`
zQVy1z33$^%myR6i6*k8GXa4_|!%zR!NI<X~yAzydlypjgLZ{qHD)WT;7=w}Ka+-)C
zwWW|W4q8RXefZVguv(okm?%vk7T&Ng3AP%L(WF>lc$l@wgCbm=vwA68lm`NS<vnN)
z5f_zn4Z~eohNe}^xM-Kl95O6e6@iTQ{v;mQ@bf4yX(o`isZ+4GwhJfu6IailBMABj
zz!QwZWD)YuUcLZF-h2l^v2i#`ipJ$d=~MT#v|~Vkqse53HkL|hlQD*wSuV8knjH?9
z#dl@Y8`yrH3T0NSDsYqn9Nc$U>|#KtoVU?p&6zr&V^dmJiSmXjp6t`>%@YRMIJw{!
zH6fA+4F_5uzD@<%MHsL6ak1B_h+L;<jvtrjC7Vi6p{-rnKv(-6YQ~-y_n-cD%aJGk
z#4{p*(&h#i&n3m6PO~XzuvI}<yRS2lrH(;iz_Oy{Nz8*7>R?Bg!d#*<DjOQGa_bf@
zn6aHRsVoV0R6B1rsv7Gt(%T2S&5olx_u$mtg96NolkI1?NbjX!z{g{=SKWRSFVI8=
zu%P!tT?RXT|6bHDnumbbt1j*k%Iaza_|IiFwQ&6^j0_FI3@f)bb)G&4v&lM5Q?iQq
z4~67I14AegAVm{=<X%Ccd?rw%+$;I6k#<C40{K!UwGu<0rxQCq^D(|sKKq^Dz09KU
z4o6W2Y9MihP*zukn?HB2s^S(IbK2`T4;<mwCR-p%<=C8VWx8<!HZe3-8xz3qE1HW)
zbg0wc`pEV~JaAn6Xc<ODXmvTF#9Zqx-`c&bQV1XP)IqLxu0nIMx-6*!U0UiO{Z@0L
zI}T&TCu$dd_`gbv%_7|Pus0Y~t8h*k#8by~Wi`E^IyuCmswrN2D#4G&6^jL%T7;K=
z{-9VadKS&5*RVM3n6q+;SV(c4*!3>UFgnUgm@R913yO^F#TUsG%XK*`<BN;W(jY*V
z^0Pzz1MHGOz+`hfIsaHayAibu=HTS+ePSah5?~zQ{!w<V&`rZNL^{Oek!7{wru*-~
z@wfNj(91iyBOvJ(JIUA8(hTfez-EgvIK+1njYin{nAmUMg$_1D%%0MbxX;!sHdtqI
zF{d)L&J$&F%gkaxq<=yA@sYtn-n3=*inABorJzql5iwX1pq#9)b$_tq*-r?N?h!v~
zf}#f!Pq`*iZnLEhG8M-rnnsvV3Sp+};L-qXAw9D?<S%>`3bY#7(*I9ESA0{&yxab(
zvZB};4-E(gpxWEWqjopkfiNbQs{(N>uC_QyDJ+TH6@n~*ShsKvdRkkRmM=k@i6zqb
z?aCXkVW)z)U|$2B-E0F+ItI*S6Qjj8Wg$*1#ihBf(!w<4$N|#x{3BlOlpsbIjfA<9
zPIlzyPn=;L22Y?5S6zP-cT@y@A)d!4Q$d3&UNddNJ8=y9y1KCRs`Y{`ejK}>dl}8|
z9AxXAu};AgV8@hq^$d%!I|_Gk3AcNZ76d&`QN!Go%lWt;+qDN)tDQRyM*Y&pUt$83
zORB3GJjv9OU2Lf!8Vjio6-EpX58$d>cCb*;@m>32ce)Bb_N*t%DqKzkT>@l>PrM!I
zeBt9Nkj}~gvgrUDp8~K2rl8$x256@SXs3eB76P)F05%<L2{BF!&akRv&aMAdQ#-3t
z4)-Avj*VKAv#^WIg|bms2Bl3)yUoUeOjaB0MK&JIq>zw8RqDs=9y*I#KK5D6Tek{7
z`t!emE+(^kDKS|FTutOVp@fW6Q6$TE8SxHb<4xNbRChi5JnWQjHW*pQmZqGRU40cs
zdWV$4opBmTZIJl+h#%z*b(p_?nF!tYqxtADIBjl@ASTnVO20$LYWC`7Xk5Gi2VQs;
zHS?R$yzdAPz0gKO?2}HwLUOsBJC8(AQC}z6sw_4vk2ubXl?<I<UIFN|$(B}BA`}Yo
z-zIikXu3eh&IoaYEF}m!Y7rhh_;j#m=O3$UqzXzQIG%&e#wS@6OJo4pi!O@I0PXYv
z+H9Q$T9<)72hbW)Zs{?qGPH=hb<Ub?->s=%w8kiVIA56r+mwFWQARsD+>q_`VYgEe
ziU+*I%xDzmqE}BO3GV80%wDz#ou|&>)WHJ`Zp55qHK!-3-cOqH*HlfCY3`{${|HJ;
z%hmQJrQMA|CPf&6^3P=1v*ANG!qYv-TDImCA)5C+W582iIxN0s9eP??adO{2l$2H|
zf<c+`)0%Bd%K1u`+q9t&BP}W`<Gxyp(}C+h{ZR~e^$4JSjTOzb<37fdtHAS~-7*3}
z24;$CsE|hQh4e6%Y+NhA+l<3+?tx8g&Xj5@_*km#TS0r3V6!d=fc@9V&@uA)azh!b
zB_<oY2%w#4`T$t~w_vcH0otht+CoQdbp?R!MA>ZWeFEDq`lIHO4d1Srz2SC;(J#Q(
z&m9D*PP%eR&NkImHy7AaeJe)x%v3z13bamXAtH~n1?$$Ze-vrW_O*9mpr;$9CFMv+
zvfBNS3b={MpM+|$h;qpE8Z~nov1s#py!M;Nd1{LD#47vKCcZqLUflGlPr^}JjNkst
zf1skgR$<)J=G>E*5t5*_tGpEFPoIIyUCdKnq$NOouk=|Hs$ZI<ZZb$6u?01kda-!@
zdKPLwxbqFzZ7%-3fY*;mBnT(Hrf#f={6%aHT=XLM3s0aQn{T=WvzIPK$EmZ}`||5>
zxrz&pUa065Cz(TM10v%6g*spSX4KdEQz$*MbWTT95X}X&@k^XO_&@{g<t}fZt=c&e
zHk=E%(|@Mrv5LZjd%n?j>c#JSf@Tr=7lC9~<+SbtNo@mzUTp=-F^Wn#TPl9poo?Lz
z#rqHyVAkK?4YS!Q*i$(>?jG2=liP$o^*{dvn{M6)U)aY$KvijFG*}tj(cZ&EdzR_>
zf#DH^10mFk5SW0-XfyLfn5(=5y`BzkhvI3la0I;rov3W6MctfvIQ{NXoP29Pirr=E
z;L$YN;Kh5PzT}#DbJ?1wX~i<`m8FGB6It<?BDO-4c?7VOzHyWkb8#s+;#CGnD6ALJ
zhP$E+CAC$2Ut8$p6<1VR#`$$^)4SLU<zoB#I#5wxi;w-`f5V02t$6kazr^0>UPDQ7
zc|jm6QPD3EMbu!1uV@~^ao=E|_2DlFko}GL@nR^gjQLu)P+%mPiy-BTR&zb~g8@XB
zIitOp)Il~zt4~WAWMj5bX1AuA+e+)N{nLulQahppY~HBlXcMW$v6R6Ey3H2evPzRh
z!qvBJXGQ&2AA1}{uF_;!+0}OeTXuYit!J8#pTJ0GADi@fhdn4MDI2ZyCq2VPyAyI<
zh&g*k2C#713eGc@R8+Du*_xZS;KA?w8&++;N_=u1hWiGv@8ws}w0H>?Zdi@CpLhv2
zyIlbAFar;DBTS{W%9NdVG=XQ<!EU$Vs=IH)ei7y$+_e+6b#oB)g+(Nx<VL&N&LbKO
z!|rmRn1>YN80hGP(PV~RXW%wAV!lNsB_dF{biKlU{|M$RTY@>um!h|=6Q_0`gvo4#
z&RE#AohA$uvJ@js`Ph+D`-7b?{jDs=+f*hSQ5kG31CxzSg3;#6(<X2Uh8Jdpzu$kB
zn+vdW0eB%hv1W8no#t~9>3nXW`QdZn;I?m8)y$h`whSmej<QajfQTnCo`t;`_7WMv
zmcsH_EQ-N%eHiK)<i1tvSkS^-THv)6_1OK~i`=J5F0<~665RaJkD%jh3wA&IJTD(=
z!J_=0oSYt(l6A98=WjR|6fCV8+duzlL`10CC0@%(jLz=B+mAgD|KJeL>^+KQ*I$j0
zHH@{}u17^}tzdgW!G6i#ECRFL&Yy8Qf~>}BhkN?qvx>+e97a`R9qw5AC5#9L|Kda6
z!~CXA2!?{V@l$uBue}pHfA<6`X4fb4(HzbQU?r<~?f#{Dp9;m)!Cg{;{tJEB{n87l
zt)8v)@D>0rlq#S}uYj|Ty9>g-Z$2Cz*#Gb9xjRoSdgWU)`J%*3YeOz@eO`7V#aAMu
z%_SaFXj@nM)sVt!4QW>b+-?fPOr;yYQdztDMyEM~L}(b%n4IjjO)rdT3^(KMD8k%c
z!J^33wtis~`p$Q75rzb|$qGD~gB90MIEcErbFgm5jd=IPmj&Y-gi(Z@Lw)^9wU6y*
zbi7EZjVrZa#;sf45zJq`QZaTEz<%KQ*WrtJarc-05Qkpfjg}KfQC?Y%NI1&<vD6$-
zy}#6^bY|}n@tR7SM6WYW@0CEUb0z~M!D?-05_8ex-ar2ueEuMI{`Nt%96E!T0N~k6
z7jnzm*&|0G#g)@7Rds8!J3mdG1wuZQl~*cSL22vKAU4^7-d-MtDXXl4PH%$OGsG=;
z?y?e25fzY$W{`~-EC@Oq5s3$)p{`f{B^o&YwD@tk8i|E7Fxgm^{Om-EVsaK{n|>dd
zqRxYvV%U`hv|1{`FRot6+IV|u?N#@e6ct(ZluC%kxzMF_CdAVQ8q{9gENKL4;UU$1
zN&JO(UU-S^YrG<Kb+}x~2_-6+P}4e9plP~k>nHDIb*=8UHqPw^y*>n~uqFQXz+jJf
zvqtgzMSLF9;t$6|nA0S{B^E(@+iA>Qu#7bfx-Yb&u4%4df67MD*V!dPR|{MM{DZzA
zvutwE)pK%M{y;b>kkE>rdTDz*QNMf%*4(&7fN4a0e?!>!;!apC7POu@1&hhX!x!;M
zj1lWqz@*%|!{rovX`GK06%`wnEWn$OJqx2j&j3o`Np2Mc;v?Q+?D+I28Gm2?^&@b*
zizoJX6N+we$XbGstqM_p>zQEJtN%9<^B;nuzLm(3E=UL48K9j>9ZZC~<g`D|bTA94
zc*;3`pH4jL8h6XV)@S;gyUqlwulr(I<=h1}^N0Ye02Ji|a!^Pxrpr=-!$W?74BZHn
zMlhSrIP%&a1Op?e5({;~#?{#K)UyaMvou5b)i~#C3HS({-+c6UZ0IP9ZG$BCh>cl%
zKFnXgn!f~Z{{RNMdf*f+$?0^Uw7L?%{@3rJ$WemQqAJ)39K`RJRn~A3tgo#bL!Log
z`|;Zl90}pj>u<wObNgz8|HLHx-oMSAC#zy1boX_jzG)8b{Nq1>&Edq)|NL7xabhp3
zis}&>@v*+HGKCc@^u_r*pv}x8q7A?Ju5bSRPoeu<3l6`z3ndlRu(^w1wYy;}QZ_hZ
z%p{sl*S_<eFdEG;nd}G$!ipf#1oV5A0R%EnGzb=3hlq$Q!aX}53wsVfsDkHQmBl9V
zteHa3^+I1G*YhsB)PW9H_C?MBxKf_y6xw={{=9_xea{x>b+5nc`M<w#Zs(H&0V5<!
zDNIHkxBh6tG+dod?M9Hs=jw<pQeUmfXvKvSEf{F;LU~OMH^HY~h%u9OwY{W>I}k>O
zJj{CgTHA4S_gnn#20Q!UC@RIGP3zEc_8eM|oa9kjn&6@te}ma17QB%~z2$@+ZV}=(
z?>mNQB*e;PRdZ&exU!u8|AATn+#(l4ScL7=hIZ90H)F;1*WvJsui~FS{RMQKK8L!p
zChj(%u7QcNBmzcavGZ0h7n_d*IuU+^1lZDMWwtoPVKu-%FoXlIzlMj!hDIj{bv!gI
zStM>nG%pL5tv8`q9Gf?O`xM@O>^T${mlgKe1Y4#luaMczHsGPSpOm-0D?s)a^k>Ai
zLIvAQOj6EsULy}V$+g}t1whZ_Xy3=w0dR4BwCUXk=~@Tr>4R*k1MO-|$=gy_!XOMK
z>s>WlK3Q5^Q(=~e5s&y0<G?GW8zD7~kmYcZCauM7hskC__t{q11RK>3EscDZ)m5`d
z%>I|&K+VDi)HadKUI=Fn9fBOu2{!8I@7^08!PPr%;O>D#`}V*DGs*?)BDVwr^<v5o
zijUyw>xR)};hZ7o5Bn7Ba5u5%4}db4W-~+Qztw5uprg6<2tM=w{W<5YUw`Nccsjeq
z_i3GQ8ywpU@kXfU<7Kkg(6D$RE(p+$hJtJ-Pg=$fw+o?QKtv}ps%OtaPum6Y^C;|Y
zH@kQEhDOA3v`<K=W(<qf3sAS!AY!y2;yJn})cf{tWhA;(fQ_bHV=1@UQU~!YDTJ9m
z+A9cX3jx`Qw0Gre@zP}h*i89aqk7+%^8eJUhf)f9_wwzfm8-YAtw!jg1A>(%M0l#Y
zD5MNJa2g?zee<_EtQZlY{Lr9B0AwYD9%&;qELq6Jm=^nv-~R;Oe(HIIML0We)iQK8
zx5Lvz+5-mGR+zP*3BKV$CGTo7Ctsb$KTB(>#WIovSoCrCf~2aIX<+a{F<YefOF99b
z!Cov}yF!3&g8O9Y4A}e9tKxv^S(tkwHE=~TGQ{Z>mtds>=X=C!T6x0@jChl_Hlztl
zW3j|)^=7?@BGzK=%4K-@7mva>Fw7$1l=s%G;U|@gwG<(2uMxoAI~3}D^Wj*abGKS6
zptgum3b>{MY&1gwEcO4196&oW88!p71^a^)Ivtje*`{ChDZpw-16-}=b_9mv6^_cy
zA1N-btG2=`nC1wxTcuDYk4}=QEI0i^ZDR(j0Xy!$7w6A3<Bi9kgw<$+v!WbpwqHlh
zusFGAKU$8T;$n{0mPE`{nTeM<l%^sWS<ytJA%2cU08&C78I4EcJm#r4XyBS)8|n{Q
zx}dkK18Z-*UVO$NPQ0^^^PqKt@%x9p=<n?0*0qVQ4HDsQTDcS@H8nW0bB|#9#?jdX
zHsg#!GSGxsRD8b{K9<z!Kzha_10L1DbCRElbqW%Q7|h%k8`0?z892B*)W7Fh@ncfm
zDp7$jlEz~5G1;jC+CsGs5?Rs=Gg=4l6VOg3eV{|(t_qXwKG5d?+H{cB?wi!xValE9
z-OIMPOP5^Zw!6$m!EO_=2x18-nMN2L*_FqAca(o!x_OfbKkeA{?6WY7g=e<eINwSW
zP6V37q;#s~4q2xR3-)U=+2ATE5llLg41e9_CGhn12zEQn%2Pa39}Ge#8ToZ&S#y3!
zd?1)CX%Wz8p`7gEtJb2w;{rxR7|+%&f<4lAL^*Mb%{rlQou>8z0-)(=R5sKLz_hSK
z0`)OdK~u3AlHe?JW3ao6Hzq9-AUhe7GgO>2^pjb@oQtIq+OV}8VZmgh{*JD2|DKm)
z!R~j(Q>++m+tNTal7Yoew%cGvz3U1C+KXki69HOX7J$uk-<TzhkSUd5R!>wPBvYNa
zZ2h*P(uGSL`Z)BQPLP#uuf(X{ZF)xn<w+?ANI!Fz6hm(j%qAQXq3Z}s8Kzs#(1g*l
zt2PR@6~~zahv9G*@d-LO(2H%K_$XFx-Gm>1^Y7s8BgSPCU|h_q{v*AEoP&&pV+>BL
z2QbY$3`iGX?yBVswq^B|Yy)(FbOB0AFKQ&10J?tZLWI123|{Evab7Au(s2p;yfE3#
zoJye70Znm%4_Sgi_F^_DZSWv$awFoXMkG2Mi}b(ya%A|_9zKVZf>$bwjpksnQH<}I
z%>}lT&CO2K8Fx}?gXspeAM~yRd6GW^viI%fx@NOb&b6awIx#a{HKsv8Tn;%h9PWGb
zq2AWtJ={Ii+v_(}LuYcrq*tu0H3tXi$95!8$AP2B1!svHVF9p|9awksHmu#gl~uMf
z>}>oAY%V)wNlpq|7ZsOb=OfRcv-JWNtzIKoU>rUX8n3?LTHNr7yWsH*!Z+eURZ}f$
z<~Fd%%=9mS=~&#wXpwN@t#{G9{|FCONRxUkWg?7nuOyJ8Y%)3?`cO6<nL7>~r4H^Q
zFx#AHIdob)L(i>wdQK}$4rKL$!RqB0!bTf>?l}n9%MtV(Iqq+L_(uX{UsE^mV)eX=
zVqyaanbH9AMKIJvj_^NUm&0V%_4GXVE(3GMT!Iz3SZ%&ELZK-H9kO>IOeT$BOi3ru
zV_r@txE614mM&f6w79J1xB$$kPq14_wI|7(x8>rD2=(3NW!$3G-_^zEJ=slbHq$hp
z?;Y}>a(1J@c9~h9q$*62wYksh<51cnSS<C98Yvtmg(qKtyAWKZF7aF=YZ>rx!Zc4E
zj0_G4Ff_311LbPZ9XgIkD2S4Zih{c(=)0l9Aa!%hU$+wF^>sM>(p#)QY;`F4Y(?!W
zj#W2agR=*YVc<eHi_l!mdZSJP>L{Seu86IYZ==4p&d9*tU9nK_arIoZq@)R=S@N-k
zbQom1pUA^#FV>uKN^QqyQU_BDw1wtsQ~$3+eiz(A^=WlEa<zrDeHk;{rh=_WJwZc|
z3>60V;uX%4rE48#ht3oo5KAVY0Isa$ZpVQwx!H!oe9~!CMr3)C;9309G=id+U|}m1
zE$_;=DGs;E*AlN`ve{T8L9<3zv=gR3*-)Hh72B8P+pdPw<;I2Mr*LfFJ~(Wy)Kxml
z_*2+FjXC%Cb#rC^w$J_^bVd^nyznN%{vd1ajy-=B<%)~VUQ-U1a<NqCidxGNF**<l
zT<DJu9^4!Cw-dkyp>z|(GNcJ&6G#_i1KNoczv4Ln_KJ1Ey&QoyAJ}HI9naTSTL{qR
zQ}xOQy1BqM^{Rw|dh0Ax(TWw0qPdIhCNoT70l2Y{0=OCSwwb<PVy6VQW7YR%&KpvL
zyiT>&QO=LcY*2^0C!!b}?7?++-_FIX*B*NUE_;zOwZdtEgwh8KMUpTa^t0f0LP}um
z4cDTgVHW#}?Rw;Sc>4!gl`P|8S2b)WBaNs5Y*ZYNh_wt6vm3E+pD!|S;6P;L%n>!(
zv8o411K7v}8SG>VUxl`FWlAd~GJtDhszG)JXfF-WUQ7yMqOJ@11{w0P+tl=dJ_Fzy
z3rHzM`Q$V>XPHY@u5!5M%(3b9Fh+*NPyAZzZN?U`)O@94Z!>z;+#8bpvEn09HJ-rt
zasylz(h-|YNAEciYuiv-UIAIBX!Vk71Pyo4X4HN5ykPoPIEoxFyDfsrTd?ikkKx?G
z6L{!{KR|7X09><i@}`aBPGVV=FqBy*mH;+tav>7x3&e(w9t{s2Ck8v9rU;Ou&=oBZ
zV6%a2tbkNOJV)+!qUnMuOBu`n?WG0ULQ@EZ<ZLs6Z7!fKr1fheLk)%;3|AAWF{-&Z
zfw0AOCfD4#4)?r8R)bA4Mu(t_jPT-*%Tmr$R8s9`NY1dTX%@@^NKPL($T?XpwIHzu
zgPtd*CSq4T-7oZ68kfyyFdgpqprWysC+a$yTToO{0`I^uskJln-SUxJP}x|IS08*F
z;gK-B9uLZ^D@7EMn5u=y3^pM)xTwL3n6*^gS_G5s9*zy4I2j!|(=6U^uX^ltc>uN$
z7Mm>(n<*cg3tZzF0CuuD*^6rDngQDP2WSh)*Xq(9&(-pknmQ;{AUxY(L;5sXHlWQ0
zxQ4WXnbQ1faMT*zi{@LMv*+4PE|V$hg<h~+a#u*mQqF84g~|jnWSH3B*(E~bYUm6)
zbT_xL%wa4Rhu!WJ4A-byUCAGGl;v=~q^6Qh4oS#Gv!@}ZOTET4DVJb%t*H2!St&fm
z;+$%js+_boXh40iQKJn}OF5!C1ERrBPju+$$*A|-87TeL#tZ<PFGY|k2b&JAh2&ym
zS%5Ylz)sdy{Gvg2252uW&`t(y^Re1&`P#`8$#PAS6{?evEuX8U6a+OgmKhjuo0_cV
z61zDOfj%?{DH>$3O-TBT-#gF#3l>c7ta=8SD7rh^u;s(IVa0V<<NN>puVFD;SR93%
zZI!0}4>sTuz><6<fh<qnso#ZCG)r(En?Gw@aS|@ntu{Y<RsL2?Y+NyO5u)Z|aqwb@
z`dYhVLnlv11Lxb+9IPoVMUV?zqdA!CWVB@q$;HMoG3SK$1Y~D`_R<6GM8S5drpI&>
z1l(*a*O(){V90SlHNBv*kYb&)sord_ueaH1YRx(m^x+Y~a)%)ih)|wZ(q$!lbRku%
z>NyQ?mK4ERRt#VNAes*yOQsWO+Ke=9$y+OF*>D+M6bZ$PUh}HZi;`ww_G+*qZYe=j
zFy%;OAQbntwa0ud=VPJ1b|_i|X7xBuHZ_oK=wKp~UipBwP>tC_bqp>#FFOOY?=8??
zEVG?RpKUgFo2^imno207OCcBF<^x`+3(^czQMJ+8)L?NmHdu^qn<*X@pzDD?8szht
zSgxGmyVnagM^k0wv`{;L4yqbw!PDK1wv(q&T3royX&GiMT!6jLzs9|^?y_PoG=1Px
z3sZE_QUkQ9#RRBE%`U`EZban>qJggdxc6*p)Z5%D*z%wXETi2eg)!E2V2$Ph*2zqH
z#ZlPc!o~E-PASOF0PTARwE4g`9e8zF0Jl)JuXJXc4RmvLDdfuI=4uVg2EwWTS9C`u
zU9sNLSZ8!J&azl41<SR<7z+uOI|5xSpq!wj#+Al&sTxlW`kLhn>G+xL7L?c5V8Pl|
zc=v_ZvE`$;;>DjmjNs5P3}*8c39OVBAn|s(rSCAVHz8(niK`PaDs)8#gE3!QN6g#Y
z77q`0ieCw+$4Sb=R`aC=G68C=!1Tam+P0>07-7mmb_QtQTcDi^W}A!Q7BWqiukTi$
z=W3i}PB&YgS5_CGQ8GFz^p4rHjMkb;v(a5{G1zs6SQxsfk3pB17_nRe-ee(7O%D)j
zCABarlKDo4P&c=cr=*VT+|8P*#Dp(Hq5K@IRZgY_2wW3J2VzDiqLM7Y)f0$^dI#dZ
z*7LDIN2g$~9`#oZDd~Yih6%Ez1Y#+#6EE<Z3bZovPkG6hn42x|9(5PY0PXYu+FW3Z
z93Y#@a&?nTDd=-BUHv3;xrJ!p=96pG?rRIn0)xHOV4qcOwAI#_%;l9P0lLO`ltEV?
z^|MmH!geL)n(`IWF(XAR@8A#{1yWW1a!wtLvR38$AaIRQ&Q*YG+-OHkjv*Eq3d90k
zJ#oKauYnGleI8MP(4d|Jh2~fD<yuqQu?k_Z6Df3M8$OuGq*o!s2vZKSGeG<P0Btsa
z%>}mE^0vspXbaU!$miaWkMSA`Og9t)zUj}=7OGh?*vj;_x=OvZs@h~OD>E5gBu5T?
zEXYh(N31sy9R*%0^+=iav&#ikl`B$!HK8{nZm<bp6<3`J(Rcvy=+JQ7-`O1xT<D4g
zyL(k|jip2q@hl;Kww9}W+5?3$*7SU9DvK>7MUeh~U}CLX`8o<N2?)&q?fVC``M@?G
z&`xx!EF1V{%i&Hmy`Y;Q0B5^R1zlYV=$atuTzYGDrOr}bYP43>7z{3#QD-t3bw=ok
z@luK*9)ctouf(D!NP=!U^PSd!ssbs$V|7g=w6uxNfQ0zG#8wkDOh61i5k@=~2*$$$
zgNb050N3u`cyyR1w*2b%rzz~ja{y<)LRI?n6UaSOFwx>xA^F!t8n{lz86g*_UNQih
z0owN$XbVXtOeA-ktN&J?1Ax;f&2shQ>QX>37XTN+fG6@ZjlpZOR(45mc1lLKTd>^<
zy}6{sXmXbt3{IO~GKyc4po@ng#X@|`td|S|Q_eAEP)+@MlK0;`ARWCw`j?ZeT&EN4
z)X1PJQ!0R55F`U)a+HS_ViAug9`Ot$f<1%raDQJSG9nnOOueq*l<!W?!8)@s(QK{-
zG31xo%mu3XM7d>*pX|DrLf3oNx-|o|9}J+K2)iv5bag0voHre4bEOsXX)6@k(NJjd
zEt@Br_TEz$9*H72b*5ssxR&ZHWhFX;-Dwc_4LXZiFF;Bs*dX~>5$GzcHzw{!#4AL(
z*p>vnwDVAw^6ib8*Q=CvI;XO0?UsR5g!{x)Wn!v&6<o!?m^uk2*y%_jGCU-%Bk@pA
zj~w-R6EWWq6hZAo+A&T{AcT)k@VSYLV5`}LxZ^q4>qLhRrWK2w0ov&av=c3qO(dN#
zQP<t{R6;t#&6aA&m2SwE|1C5xoPIyk|5F#PP61!NTW54SV6Zv#=F&28Uoc^dO{ce5
zbvly(V3Sp^w@5k`u91`%BG65+K^ni5qzbD5T18*Z0kaxImec_Zg`LvdlqsJ|fXc5V
zD{odX)Ob7;lM~@kA|46J@nBGn1^tQ0kN{SXM~(#oiI{&_O#^6bUi<7Qu(%YTz~hBz
zy-vi{AXi#oA~J@PHBgk_Pk@~P+UW_j`2bfcfaT_!F3SeAh30kj1s2r`vEC_UicMDl
zsAv1zQij}~)>=lY;YLYkwn-+pTY#@s62L3z%_ecR=nM|0__0}%3`R-Pu@!;DHWE5<
z%UXlFjO&RJS!N?OS&qkL63mt3F~Lj)K@Ix_6ZInz35)v?IS~<{>i5Y}uTM@yDdeXq
zEN${Cp69dV(_qaNzF+Kf^8M{xMXW;GveHcw3+;u?<eY%_6J%$AcKQNsw)j-a!E`ef
z&~$k~H(y$zkYd_oKzB0#&-Hpzp2u_<K5y#cOt&-8VeEi~vN15ws!oO(=X+(<VgjmT
zrJUO8l-iRjr@V*MC_&1?;?e<YBFr&f01y`f+HwKU&j+yCY?!7pJ@CG#31)!yg9Wsc
z1>9^5Hy`LqSpcb!3ABj-a3O#^k>Abr-tuiAxl%1CVBt<C=MLodfy;NBizQynH9pDT
zlMDENzMj{qE^tj7fSry&JH1Vw-p6B<VX?|-tSprYNomi~uJN@0%Nf8$P6<&jCe3iM
zU@T4GXHt&)`8E%!0I-#EY;O6E8S*f&d|;C(fZgVk2+WleohW$5a{#_Pf!kb$iTS|w
z0|l_t@iGIn69Zg13yaEhvgHC-q<~K%0}v(B04!c0_)eA$OBZ=R8@Lt<u*d_n`M@?C
z$YulG)M=$e0U%r`>&^9ep`t9gs{a!ifxQ^kS_rVt0PGCVzGn<K+jFHHV2dn|X9DCz
z8X#u_-E2UoRmt@Qq$MT-+Ec+?a}9`K5<n{z2(rNVq7U)_R4&k!3k=zFS#@j77Z|Va
zDo+qx3)LN%Z1=znz|H{ev;f@n1)mP2z{G|j($fl30pO<nKb8kTbGb_VKlaXO$59vv
zf}Z^UFCTMHE1h!K(>;b=HmZ^$vV?@iN-FI!F-}r-<@yrjs!F!1>&~S6F51H=F(@hW
z*bt_ZQV%hqIupE9r)eQrMEm2y&2c^u6DLbmx?ge{<NtXVW|Dg~#O#Vx8QkiW3S7xL
zvR!qP-J2r4V?)|*_rE$ON3Nt-MEf}5j!7*y#5ZRO(tVfnF-g0#d39G(bP}msb5+U&
zvq7&oX~$V_B8EPBNe+F$Z0B~E>t~PsTTdQCn<+~v1*n&gL9mGSapDc(O&jC<EQT}b
zj-gHEsC3n@xGDRZeQ79y?WWl(g(=G{MCPQ)ZW46{sycO6Wnc@rBHCY{a%W=BlLV(+
zGW{@;r1O~C^;Z+C@=LpwV8dv0w`QxB6~;za-FcpJ7C==FP>&zEBHE7=Z-{T`Sxq+!
zafO&BRVi1Zt@c0rUn|je)2vcktb~-C_p`Z;BKS^ft>lVe5iQa^DJ{&>t}5X7<!kYL
zMcmH5+%iF2(9Yd->!jbRYropAlDAt1Slvggh?Ww=$p<8glsg28Rr34O5Tz<pSFTs2
z+D;jvBQ;mTL+tABq|`Lq1rRN1SLo_Rk$Tnc`i?N2Z91~O>Wi#e=brME7jC<gP$>r>
zTDUOnIv<`K>r>6t9|)+4R28Wr)wsDW9dS7WN;~V6^@tVG!b8NHi<FzD2s^TLO97Qs
zud2~HDR<VUxhdt2L@5OzT6mCnRr#)j?21uIqi$l2Z)`6|Zh7<HiZ~G~qJ>{3-|97H
z63(Vb?@F#$$#zGwo$fqI716?n%eN!kS@O*ddB(%rCO038flvX_B4I&*N+PQ+PaBK!
z#nakCnVZ7t9UxOcw9pnw7~7{I=bt{#yrHcC5G~v$<CRqN1C9$o{}4Rw;*0<QpT>(O
z002O=004*<000mz005!|06??=0Dx!#01zzz0HOr|07MG_fM@{#0MP;fd?SAa7ywWp
VSUM=f!r=e_002ovPDHLkV1hxMcQ60|

literal 0
HcmV?d00001

diff --git a/browser/branding/unofficial/content/metro-about-wordmark.png b/browser/branding/unofficial/content/metro-about-wordmark.png
new file mode 100644
index 0000000000000000000000000000000000000000..94569858eeede9c42297637af3396b39b13587c9
GIT binary patch
literal 5770
zcmbVQX*`r|-zM82+Ypi%W0z&dGM4N!gRx8)qU_7W#4H#YvSrCy6osKg)|8@d`;vVt
zOWAix*|$g$Ufs{#^S&RR-}B+Ue%J53&gD3c|9XD8;>^*8Y%BsSG&D49C?kX=4GpdM
z$y^D*crp%T3n5QFXURxgGKP4K9N^-MrO|UIx?({nyo(3c66@j~=+lMOq@khn#97&r
zZOu$I+=zI2m){t93Z8VrrlHZ)p^#kMys%`DE7k)?&;oDNHiAJocP+4uiW$U=1jl;f
zjDmczm>{&3TacHVx;t1$8>C6mI1#{O$u1xY-kad3LD2&Lt*db||GljM2K@~oduf6H
z<&>?NIS5Yl#e!7imE_zYP$&onlZPs+z+g~WkRk-Cr~o;6VRBGq4HcM%qAKX02Yh19
z*ZrD?CBonzTPG_muqT;J(oj$c2ndi5P?9J5dMH5E)zyD%C@RXGAmsc431k<F9KlcY
zj{*Yg=jMwek#R%<=(nPaE76~<1wQfgUm@U0W@i5uCiwl6sFRc_P+Uj~P<e;~9{)S8
zztMhVOYHx;@gLECR)Hj}f+g0E=<n-xQjcq*f5<1f`|pN+15dosxa5mFDT<3Xg6QUt
z#}ddWgckVZMBW|eu3-RIhbXG6z?2Y*5SSVis-~!@2Zt*m^k6W36;)NmKN|mutEvZA
zRaR6}hN{94P$*JKPY<fE23LoxK@?S0p-}xlTol2N>_TwE{;`WYvHK5K>A!L{;J#QF
zGSSzHNc8^G0p^}WGSSbINCLqzFp!j)iyMycdqetnf&LXQ0_%&rfps_VCE`JUXIKOG
zA3RW2M?jRI21q4{qVk`}_2K&JFg0a8Boc`L|HF0v|71<!#2JO(?eTxw<<Hhh5B{G1
zyZKKR|Gqw0!pWWSJ-Hl*pKsXE&;YAY2t6yx_^JbIl?{ehXRq6AqhCyBD78OQYAEkB
z*V!|w#V*Ogra&OH<wrbKuer@xY#tLwR;bRsmyvs|b0R?crTvb9LV$77#7gh}u2a~J
zgZ278?XO|I$AQCpFE)N1AFQ6NPloSTy<Yxx!_nIMK}uTM*C^(l#E(msMz%4Vbj`&(
z@7B<~H1&3JHK)Y|bw{ILam~?2O#phBXGDYJNJ91B2$B(5bONGsOCJ(8>D!G3SUn1H
zcHfphJlsSOR?yd1@LdGN=&p{f^?7YcO<7h(yRc?|>l^0iQ4MM?>Zg2klnJ1c`ytok
zluzF$#qLBKH`9H5vmt@PABv3OJKb`v1e_mbb7SitIBnX00a`&4wjI)&=)yQ1;+en6
zB?OyMOiM{7gE}pXA1saKpYAE_UU3SjS?zEzcL<Q$-p%Q0B-t5Fn~Y{|H)iBEEb66I
z=6xO>d`$eXS<BWmnR=fir{XBx3SBH?OSxKfpbl?%6vc#HjPla28gpwr-2)|Hb8<Ok
z0O$6f6W`cpNX%%O9qVK_H~e^zt5ul46mZdEU>M!y4G#tQhl>9qxOOsq-|avB$Zv#u
z_~YaSQNc?9!WKib!>kZ<p<%>>kKvnNlCuZwQ$i`v9H~`_yX3JKiwSv4ahedC5*{2|
z%9xXievx0s=DGOkX=-pLb6978mx^wRb|i_Pty!x%JbZl>VmxtfAdg?KP&+Vu-wkfG
zt03ZCXmqUBwoz{lM)>QC>4S7f?IT73WtA7^bekD?+bX?yQ}W8a^b&}YEdBu!lTW);
zwc%~|_o;hh3^1)+b%QNAcBDu=(UAK{3VV3>Rbc#q8?wAL@Y#VoGFx~)r|vZTLmY-`
zP&MiH$ce>!C1yuI?PFgDz>76df*al0|FeJ_rGtfOoeHR;wzt&}I?Y6bWI|B>ZWj)&
zHp65!j^z?P0`t$Hf*%@NIi%=@{Pi(Ts_C((OGKo*2HSm`B}tx}3{e}F<2GkCbI8I)
z;9M00TeH!`FnAq5(<h$xyn?Oh=$!(=^%a8;#}0#%c8d91Kf5RZH9)g#^VzfLWbh_O
zpV9HlCvD3{91F*M{y8dwvWGM2s5^a04cQ)}y#BWo!p(YJ=Z<fkm2LJAu-KOd8xw*l
z*48GOa>f-Ko(0t->6@|@(`(INwg|iDX){^*Kb7eZ_FevZH+esgan2%2a_d0wOw^FV
zvRO*m?ekd&d2dXLLhxV#pc;?Sapi5zY`VYD93gLA@2f+Fsq=uOuU;X|m+$5wI(m5>
z&?1^GaZ68<h4+j6qBPGhDt5(P*^9qi%g3!<LeXA6haR;N@tW7>`SwbZYMQ$s({j^Z
zFYRuWiprJoxA_KsMDZbqydv(2<}_e)c|DUK$HCGmDURT;*DgX2rzO%FZUc|R+Itg;
zoQ|I@+50w1s}BXW_Re$qNLIW*jo!LqJh9*-HR$g;eCWj49uP4r`okvl7}R0UC*%iV
zQyY%Ea(~A43NL=SZJxs*a?~PP$cHs)<X8i$)Bb?EZ8(q*oeJwQtWA2ts>u)ptZ@Ex
zisA48{f_RFpPBlb4Ox-m`Z|#F*0APx6Nh@<D8M%|WKNeq(o#$Kpor<4t-JZNNz+qk
zHs^3F&t-!2CG+phmiWI^XEj@t17+p|#Yz{?a1@;0OcCgbwA>ZSXHG{=<`iv!r=L|Y
z?9B6@F$9#RY;wcL9^c;hm_^Dgm{csSm6*Qeqc-QyJL3Rjra;h>`8)MdYjVryuDJo<
z2KMAV$H*<m^bBF6dgK~AI->TR12Q;Me8pU#H)XutB*|q*3mPdj`&02G#yLWo2e?l}
zpsPh;$8ykP$6&VlFUM}bT8{DlsK!RXMj@NUr@93HHS^QgxEvoYFBw%0e>DucWAhjk
zXL-&?Tq0QcR?Sf{Zl>+FqVRI7ovAIndOE96C85g?5XQuW5k@Sb^i1W_)*lqym&(y$
z_F(dUSt;yd$(gTb3Lwrh4Ddb#!dPOZLJF2RZ1|*&5A?e+Um{^eUv}h{3KoxaQ`iSq
zec;uubI7^4<C^)I7c}0a;=69!v_x(@JNaK>u_X6XyNA54$+8_El^*--^!7nKt=VK_
zRpBbw0`o@+KU7;E5`M9Pf_|2@>V!{JXCh%-y^%Ti_?=8ozF(ghWe6Lt3|e(Ob?ZlZ
zNgqd%*{o%CMnI=Y8vBJAx}Za8=2W?RN5U^%mF=H2mQO3sryA@(`Tih+Vv{m<otuv=
zidl@4pB&^b#y?FjNq^ea7`M?g+IK&5O!o(54$xfkV~^wZuRYJvxjWQfoM%>ye<r8|
zj!3o6)kH-y*Io$?$iT?lOWjwjRPM`f=xLr!U7X&f5}~G_jWSA>o|Rc0-zL$DkckSL
zYNadSh8H$!MQ(LjaEe;1@{Y=!d)v3~<wsp*pF<0SvR=coEH5G(2815ps@_j|H_$<(
z#(qE?sSzkax`^Wb2!P86Ed)hcL^hJh)jd-x{TeRDt{*BzbBynw8?;GX%Ik9avdtwR
z!{{mq>F2ndT1?ywiaE-8Y6vA{DHnaezI}%A6~CNvoTrS>>2<E#`z(<X#(@3~dL!Q2
z@eH22{+m)ek2|V%Vo)|JX|JMlR`0|sMq*H@YBNCT88AoRVhM1{JNCX@DkCBl?SJzw
z;av6y4r}viwM599m$&rhG&OZ|l`mu1L$AgNbPp+!$ZbLow(UM01(F}}UW?^m&7~(S
zDP^chW=K7HNjZ*@oi?*xhh`&|F3mREcMG-7l<w1`<t*-Z><C?%!BW~=;=jJR+w<2F
zeJ0x;#F=SfVZoYz2QAa*<^4@3rzCYbvUJw*{hA*g^~s{gd6(d<@mB-=4RW`?vwc8p
zw!VhpDi)y0SAD{|!gU=-Ztvh(^Y$VLsOhpLGyFx-xcL`pV0<Z3{mj<t%KT5!V&QcW
z<(mHfkkR%o<0Wz|5{Ai<Jm-Ana&KkS^tTnVm~p|T&`7+9o)x!MiuOc)mN8BeeIIlx
z-Oa?YknYu->9w<|`Cl(EZtaoJ=1bE>>>Al`$u{xJpJN;xuB(0LGM&-7RRGMepL#Ot
z_}tQ%u;lZc$3iP9u(J`pKLZ&`d7w(tzJH(Ts_cigGa*i3_GQy>>>zEnfFrPElc-#&
zQ@%K99iJrhRrV@<f9TY5qXSghdd+U7HIdz#R8x>hP-U;Z@hp8P_Ae!su1EpF2*FgL
z?kQT-^@#Y_)3_^_9T&Hiqa2w`G%NfsQG3k-^>kA1MAVZ|2SfAM2H055&TZ`Fi!@eE
zbV+t-486#ie>J{+HvPvlIs4A)9&YbOLha4!nDnV!@i%5uKBWL~w+Qdy#YwY7KpdoL
zeHo9l$e?K%5qo3Uc1FLkvK^cM^6Bg^*q23|%4Tkr9q@ukcP}jUp6a8AmNOwPCaDIJ
z0ySbN=WUp96BB>cEqPtLd7AN&%P9@b@bfjGZ?72TpKQFrh_^STHpL-Zm77L+n97b{
zbNj`_(M?{IPrf_{31*-1e>Q<@a^B%i^Of{k?p6=4WxE5dyQzwb%6uWR2-?@m`+NxV
zzV42iNe6Vy(ytJBbPvcD92c|(%f=QCZB|;<R(aJ~rnu?6;X<ZcZ`;vR!TV!|MnW8!
z!Xk+zegw0I9KS;RQQ}C`e%52Jc*Y#x*BJ|+<=@?pwbV&Rd;Sv5(de`Zj>#6W(@z^@
zEn5f4*7{!*cYGdY7C4pqc;)oovINdYhBQCS1O6#4!VTX^@IFNoGtS2qtzXv7$Ek0%
z^m5iUyT>P2EPnh|^~E+za>*A?!8VL<%vF(L2hr6a&gr&+Oi`NILmheML)(dH-MV=z
zn|Ddv`Y*lNiya^)wzBy-eV1R=k2tKx{-Wm=9@7S7O+Jv>QjbBXExIif0ixr}0QE0}
z6-g-D6!4I<WfUA&eKD_wn?XVHYI;RxB@O^oE0UC3zD+xmpj@SGv=u;KNiN+ieUV{D
zrOv7<n-!f8j*yq=$N&c16ne_8n|#~yJQ3lwr=2Md6<|noFhpgZ>2K?je9Gf-!9p?m
zVAV@e(g>()YQ9u|J*cRK{O->Bj%BRGds(EFEp0$S!!uKB$${5%6*LyJ`f<)^j(eDK
z58WQ0kW#X%1Pjb1NW}N_rJ>?l9H5_7OV-GVKVbAMFJBEU%fJgN4p9+HykJk3C}won
zR8#0UT0~on<!B(I4@bycG*&E~-%-GM?<(;D38rhDqwkqj@-AE$bfIpRM_g#htqiX&
zuFXov+s4F#)<(i?DSXCVifLmrX5=1;+&6;*c9Fu5B-Su`CLI26hV#Onfs7!;{^)$&
z)c4>>{t@xE$lA$bLaX{XGZdzgm6HLFlzyucL4PYYDfaYu>iAF$2{4D}9La4#J^&@S
zda#BhvPD&}tjk=C1F|KrX@*<%i?UIR>?~GB1%aInej1`E>rv~hlEU)ZQ%t8aK~=uN
zM9%r^xBHnGgtpPiRn?E{s#e)=fpQ#T8^wjHs^X3V=D8^{qCsv9FO7~bvi5%2E}c-V
z*{mLWa{x0;VNY7WDor@|DRJd_O5Yo)q#t8UUhD54NSqbK`@>MABZqc$L*@1DDDn0y
z!k(R5FBf#Lsfo%bzTVXh)<EIR9n<ofo3&ap=)7g(2o8b03f&u_uw1(eu6!Kz0gqsd
zu-5aeKtcDl@Nk{s;P-1>ymzxkJU@(RH2>VRx`e6GeAZ<r!j-wixURV1Do7hK8dpfN
zUyOQ9H)3&bSh{l~+ikOar%|$bLv3j7VR^RHR_jPL=I!*t9xr{d95+X-&eKzbPa)Ku
z8+YgOY_D^xNl)R#kXrzN>FCkiV!%>+f{3N9q;I_hG2Jz5ZLd{YC<%b#A2rjbq+Yk-
zm<v+%JuSx7qkj40M8BSoW)3?}?Y#TfseNfN<4xSEXxs+pl(w>2E14x`<w7{s{0PEs
zQWE)<`M}5p?Nc$y5T&FZ;Vc+xiKH{lyCdjg&H%WpqW1>;<)cHXk2)@|AUUi`TDNZ9
zTV7iP&J-ZAIkf;H_Jj-$^g}`;SYjq_9q8nMVhDwYRJ2mrYJ%m^5`<cp@|jdGlr6s3
zF(lOe1*OMaDHG9aMlKQaiUp29-})w7lkDBO-?64kou2~+oLf8M^%%h2y$_sM4>+@o
z$HvxNSpb$+NplD~bWX_^gN^O`Mj>&)ufo!DMxoA+WHf!^V?XdC500L6+L&NMBf<8>
zhM0<8^F$l28fv%4qfF+qXlG#;`mYsOR%i#gT$1tdQ+PyO+XUlz&I(kRaxe$yO2ysK
zN|sv7QEF%sldks4NAmETlJv%kyz9mkigTVN_~FgB&~qJ(TMkdGI^?D7(awrxu|7H6
zej&6CUs`WyH2M!_^7cFQV%n}=qLnqzGn;!_QQ#}(Zkw}$kWyznD?8m(rsMqcSM-N4
zpT{p07ZqQpV1UcZErq^6XtQ1n!7)V6$;pBEp-IN!&KU%^l{R~(kK%3Q&Fjz@-gN%L
z*;E-IKU_7cOZunhCDE+Oro#&@Q^j9W)s6*wp!pgqHQ5pyEIkz!P|c0d%IzyF$tEQ;
z!I!~F0fR7gnQ%7=o=+VXKifnq*bJj1qw8;x@{wF5mawLS*sT|%?Mw3T>Wj86tHVO0
zff+ZX4p-ZA`fLDIinruj+Tj^i*|>=354Q2741}6W!3&CKkx3XHL~mjKvyE+l$4>6A
zu9E0|jpAPtX}=)*!2{wPH&m0X>SpYxgU4j1uJ;-w6AtO<MpdYx3O;g43^6i3<!323
z`D$riW#|^Rv(?D_q;q?#;A$Z;hHq)6xtNEs^-eI1Yb`Zb=k7lKT+SC18{*XNYG<z*
zU3r`$v=VM4={Lkcwbd`C7z!e;cCsp0<+3<}IMeZ^b0GE@<N&5xuzfzW!Y>MWM37}n
z$hBj&IZ&YE6V#(0GflRNkskhL(dT~do|NGMC3jFE#k(81l?v{(PJXX-qddRX#vK39
zJE<l>xYNQZ`);fyJr}<fUwJ21<Ln5HB<gqs=rbYUgF1k@hsuf7=d)mdaYQb}W>1yQ
zWsw{2cU({9j^$H%ch?&l0^fg6--?w&ayBWrg~de_)gdTZCe^{sIRZ~Vu3I!-c97le
zGIWd$L9aF-Id5Ito>j{qQMrCPD>dQKr7T0<nH+t}NkN*@N{Vye@lZ`{7AV=^8ZlQ)
z+lw}r*2xKsZe1)U9@HT@;LOK&-cD+6)U<j$Ns?2WJNDQekqV9lV607=3jvh}AOp3;
zt!>cMJ;hhYRL@|h?Cl{1E{k|jME2KHU?q^0GuK>6loMAeA6UieRc&W*^8w(}w@*dX
zg%DK?$N;pidLS|QHy&^bWIUDORhRwh3fTY9DV&yu_JXVRU`yQn-+zZuNHn5U-#Oxc
E02&EnSpWb4

literal 0
HcmV?d00001

diff --git a/browser/branding/unofficial/content/metro-about.css b/browser/branding/unofficial/content/metro-about.css
new file mode 100644
index 000000000000..ae59ca779e3c
--- /dev/null
+++ b/browser/branding/unofficial/content/metro-about.css
@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#about-flyoutpanel {
+  background-color: #002147;
+  color: white;
+}
+
+#about-policy-label:hover,
+#about-policy-label:active {
+  background: #0a111c;
+}
+
diff --git a/browser/metro/base/content/browser.xul b/browser/metro/base/content/browser.xul
index 7e9fd2cfc941..ad97c2857fad 100644
--- a/browser/metro/base/content/browser.xul
+++ b/browser/metro/base/content/browser.xul
@@ -9,6 +9,7 @@
 <?xml-stylesheet href="chrome://browser/content/browser.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/skin/cssthrobber.css" type="text/css"?>
 <?xml-stylesheet href="chrome://browser/skin/tiles.css" type="text/css"?>
+<?xml-stylesheet href="chrome://branding/content/metro-about.css" type="text/css"?>
 
 <!DOCTYPE window [
 <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd">
@@ -384,7 +385,9 @@ Desktop browser's sync prefs.
     </appbar>
     <autoscroller class="autoscroller" id="autoscrollerid"/>
     <flyoutpanel id="about-flyoutpanel" class="flyout-narrow" headertext="&aboutHeader.title;">
-      <label id="about-product-label" linewrap="true" value="&aboutHeader.product.label;"/>
+      <label align="start">
+        <html:img src="chrome://branding/content/metro-about-wordmark.png" alt="&aboutHeader.product.label;"/>
+      </label>
       <label value="&aboutHeader.company.label;" linewrap="true"/>
 #expand <label id="about-version-label">__MOZ_APP_VERSION__</label>
       <vbox id="updateBox">
diff --git a/browser/metro/theme/browser.css b/browser/metro/theme/browser.css
index c8b750353f0d..42459e4d0938 100644
--- a/browser/metro/theme/browser.css
+++ b/browser/metro/theme/browser.css
@@ -1167,25 +1167,34 @@ flyoutpanel > settings:first-child {
 
 /* About flyout pane ------------------------------------------------------- */
 
+/* Colors are defined in /browser/branding/<dir>/content/metro-about.css */
+
 #about-flyoutpanel {
-  background-image:url('chrome://browser/skin/images/about-footer.png');
+  background-image: url('chrome://branding/content/metro-about-footer.png');
   background-repeat: no-repeat;
   background-attachment: fixed;
   background-position: right bottom;
 }
 
-#about-product-label {
- font-weight: bold;
+#about-flyoutpanel .text-link {
+  color: inherit;
+}
+
+#about-flyoutpanel > .flyoutpanel-wrapper > .flyoutpanel-header,
+#about-flyoutpanel > .flyoutpanel-wrapper > .flyoutpanel-contents {
+  background-color: inherit;
+  border: none;
+}
+
+#about-policy-label {
+  padding: 1.5em @metro_spacing_large@;
+  margin: 1em -@metro_spacing_large@;
 }
 
 #about-version-label {
  margin-top: 11pt;
 }
 
-#about-policy-label {
- margin-top: 24pt;
-}
-
 #currentChannel {
   margin: 0;
   padding: 0;
diff --git a/browser/metro/theme/flyoutpanel.css b/browser/metro/theme/flyoutpanel.css
index 34e55627f4d3..eeab519b177f 100644
--- a/browser/metro/theme/flyoutpanel.css
+++ b/browser/metro/theme/flyoutpanel.css
@@ -63,7 +63,7 @@ flyoutpanel[visible] {
   border-width: 1px;
   -moz-border-start-style: solid;
   border-color: #c2c2c2;
-  padding: 40px;
+  padding: @metro_spacing_large@;
   width: 100%;
 }
 
diff --git a/browser/metro/theme/images/about-footer.png b/browser/metro/theme/images/about-footer.png
deleted file mode 100644
index 3dd34b345327de7418861456dec8f3942d3e54df..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 129698
zcmV*ZKvutrP)<h;3K|Lk000e1NJLTq00CYA009#S1^@s6e(i3k00006VoOIv0RI60
z0RN!9r;`8x010qNS#tmY3ljhU3ljkVnw%H_000McNliru-2oR7B^sKq104VWAOJ~3
zK~#9!?7i8uC24l$_1mAjpWzO1<Hnc~nGrce&NX(aRHdQSv=D7zbc28gpv`y$jK79|
zfH&TF0SvP?gQg!40!&j6vXWYAR8=`tW>yX{-njP+?*8q~!``2}pPNxbi<T-&b=~a5
zJ;%=wXI#F%wbx!-xY#bXi|wb{%nT8E=5?z2xqTw?%=?&`h)88-38+M*0umrVGP6oV
z8Z&D|qy}nW7W)C}cnpdAoPT_c|J#5r?$ZJabY|9xNFVz$U~!$AKd=J*<nmATK0Irm
zs*+N=`0|{8uP)w#i|u0j=>fKY$rM!MuK;3Z;us_~uovJt0~P_E^EkgO`$S{`%;MCP
zlbO{4$`w$VSrU<gVpV|evrw&o=@d{^M0zvpMI;BX_7f1^nprC%TVP{m8xdIn>)77~
zP?zhv>HiZT|2dHUN$=w?Dkxt7@5OcjvOgur#_vUdCKziiA~Q4F6OjYp5I6w#;&d<p
z**!Cxi^v?92M9MJ(gdTe18@t_*1>|)WS_+IO_TFK@}-?SX#ivnMw_P~9QzBncI9Md
zTM=0U+W_IUh@8dWQ(z680#D=bs(^X`b3b`LKlZ);MFQgs;Jw&>p|&6Q!wzs|vg9XN
z=svI~B1_;BaBOBrB2s{MKfrfsX8XV*SnS-)76Gp3PjyHKQ;<C`Ii!i4AaQy69OcJ=
z?)0w)NEbasCxD!T4QDe`AQxsFpjjAk2W;YR8|OCxysOFS40vK@PetT0@HqAtfZoJo
zn~2y?0_2}`V7vg{i|u0jIbyPAHn7-WkOd6)MC2#{_9#I1vWQ%c%ZI^Y4}-bx70F=o
zcNT28Jm%*l1E9zTQ(zSlnaUME@^$=W0cmnS8+X~jj02pXb;=V4TNrU4Ot=kZTv&0D
zDNf^Z0pUkx_DDpY04HYlSVT@3wdQW}JpR(3?FH~&Y!}-Xi_I3+SOsYA$LTU~!_2M#
zM^lhBvjY*?H?uupDI$Au-*PGvK^-8QfC98k<bof|Qm1+`BIAwh{5|a7;Lq0L;Uvxr
zCZBtBi|1xhXtN0zTd>z0%s87_8|OCxsM`tSJqs{C1x|n`!HypTp8@wp<iyO*fQ^W3
zgN5sl`&@q>LHGiAFSfstKpQRt5s})=>RA3C0mr~q;9C5>8X$W)K=`mo3rq@NAsaNf
z3!$*s0;)1`8So=v(f}Fu*cbTs_pkfh3`b>TQp_u0JYmV(IBkkn3_J~>JpoRF8Q(Xv
z&qU<2V91Zm>@+m!KID*}YeswlycgTw7#Sg!=oRh=IEaGR72tLN?TrA~<B4ogiedY~
zV5bg)QuIob(@s%qV5)vau*aVcxCVjKj3T~fgRF*{(W`+Oy+Nlgjfk)7=}kwmpkN;|
zve;+*U(+oCvm{7LVB_VKoRn9|PYI~2M4jYWbp0p3PUq1(1-^bFD-_+hoX&tVGkXd=
z6_H0kIei9v0(=q-`BX$Ur9k-OY<^$FV%-JsUTi<N%r;nU!Yx_z0M!Dp&zo5R+N;5K
zk0$a$(Prn2Hm;h{J&=BU!G|6C`lEnV&B$gBsAi}^+bf%#S@+7O&un{Tn=_p%r)|&U
zb<e8LoSe06yG)xir|T_!-(x_VmCbgGX2k+hO%=8HUv>Py!9m@$fU`gUgfXisn%M%2
zH*qm*ST5((A{;K~9PTwNE8)iBk}J!Grb;YQ#iFTbYX7^a63badEkY$i5(n?}6G7Pw
z!wfWvcSWYyhRm>@$P-gp;*p4a3j7fG6nGE}`4rfSNEdR*7n%uQ0Pn^2a|O0$CgBDs
zPJ&}IyCotwf#=NZhKO7Zrh5rEFtfvO94rH%XA_VuPJ++<FhdzI<QdB66kKtZ+NsiJ
z3lKF<+sx^<<7C@&+IF0E9cOLk;kxC?y5)4$vD&t*HZ5J-(RCeJl|DO&W>W`Ojq|FQ
zlVDIqEn{i}$eKE^JEr-2SQxe6&jw~b+=r35yWA_7fnZ4T>#8IqNz_e4T{rCQEm$sQ
zTsvHH{b0_E$9o(sW*p8N_GdGW_GVmOG#oD*W+~Cs74xQM*(6K+SmZOz)I_q3mbBua
zD2|Du4?hkteh@79V-fiT_+b?7RsrPs{P*aK0KgZ(d$E1t0XM*Q5jyRaD1zMuZi~nb
zGrKAxSAyLhO?2AAXy=Uft@Nz#z44QcvAr2tjSOshWz}V#wjJwUd9vwvyl#1L+H$hp
za<*-Gylz>wJ?nKx+jg{lPwx5vxheQLBh_$Ps49wKCYY&%tJ!#cfUBB@J7aWdn2kW|
z@14f`YNOl`R~E3H-hRZtax)t*QvlyV-VYK+pAD&N>ZYNY%{V?-aP4r(bH@klFPB_7
z*yqm8V_rJm<9M&((yU^ysX3S>_UdF!5=lS$Z6BIHm{{3D7cS0;C%|J7c>sKDW<L~>
zkK+7&++(~Ik@oz@`?HcFE`ax9`y%VLOWY%SMMRzlo&)XxHv??1nb{=~xfELM5?Dl|
zLe1FiwX4e(Jr<t%pBEO}Wo46<b+4@Z%;QbR<5kO9-}B(C<-ysOlhuZ^P0M=Q(f3N5
zl|J|6Y|coH0XVZcxbB>E_pfO%SNw!pfU*YYx{hFqgEL`^D*!$PUZ<`Ux0nTbjv)K2
z%jG~|BS;s}wSkmQkSkC`64J~u5^4gAeKakxB&51wx!hyXR2=Np93Rej?qJ59!#TGP
zXIwv+aqXbt@~q}~S+i^^Th>YHXMZ#>Hh&a5+a|Q(L6Q)WhoK4o(9AvpJ`$0S&Fn-(
zPR*=ODcR3Tj<^8ci|vcVY*Vn)O98C6fjegQd`Jn`fh*ywJqQ_LFXV%w(SDB6j%=1^
zN(R}C-i%J+ELf~-tsM_mEss`PPBtx1Hyvl|mhHABYYuRA4Oc@B$XYaAXRhV4YB>dC
zG?x=hnd}=`tH%8c2o`YF0<yt!wSc1<6HYsTquE4KHA4)FxXMJ9u!6ugUMJ_7aok4g
z8B)(mArVP6)qJ07?+B?HAR$$?`}m<jYqpS4;{U0IgT0y?2Mss&8lJzr;P#az&+pH;
zb=Yw2V8-P|V@LB!7FBu{5XZv7y3+2<*sSq5bm9BKhJOgWZ)QIL?uSfq2DInDi+|Nj
z_yTw@w!c<(3%gxPQ6O6ahaz$vcOcvWUI@+hnuuHr3E>iBJ8mh6JyWAK!{kS3vkGjp
zvdzY-3nsg5d9v+zbk_3dY{TiMW!?5{yG++*a_)n%I%s57dSw9MvM(!SRTOogjq64Y
z*7w_l@jBj3z&E4;XPP>I?1+s8WJi#+b0IxLgGgb%Mcz;wnC<|K=O0f;5H7xi90!f6
zs@S`6m$Y{@056h|)C|melrqlo)T!aZijJUYhCU8ZCc<J~v8)r9mo+!9EVz5T;H9Gl
zFB~s;?$Vsw2aO#q8d)}pbF6rf+$Xsc=XK%x!Gu2s-UmJaJ_@E>ENg$|AbbJ57u(ND
zN|>A3CESH@OGNIP*&PwNg}V~2nAvfF?NqNV%?a{(phcclOwVR?2J7Bk15ewI$Lo$q
ztCq)`mXl4(>AGdJ?dY?*mYbC>J5cuO+HPMMtorqC{Za?v39HS)V08f6Qs}Y)bc<GN
zQQ$Hg3ugmXqQeq@jEX3FYZS(UIf{K=a<E{+;{%WSFcbM<1mp2B209-57Ri`bLc4dF
z=IR}!nh*Ca2aa)h!A}O>iQZg12>x2dnXwi9J6>NB4)<r=x;*3M;{`8X-{bkCId_ld
zJa;s=>-#e~p4ZP}!#!AUCL0mfxNrCgZc)20BA=Ssha&O=Gkae|J~6WgBC-k(@?VJz
zaRIy++h3=YP=&wtI&j;}?uy8Z6Ia4D++%wwZnrSAS?IMp5<;+NlOOR*XjR$t##v~y
zC!3DP8<!29ZaP-mj!oOsWexB&x&dI#0l0u|)?xn?hzq#(mSYJ$)og)avCfj&0YnGe
zV(^l&$Q9=&EzLWCWz*$*xxe?2jWUEzaAzV*gx_ojko~#nklx_MJO^A62lgz&uiiQ4
z^_$21K|ABKT$2ne$AKgVn-6`Od`@e|&VjC!W5~`jWO$A83{^M$&3!gHGiI}jgGI&F
z{e~B=@A2~Sf>*Ea@zS*=FI`^PwY^66nraGgdQOr!i_;U}A#P3k1o#2)o|%0Rn((8P
z(&{Iz+%ACkV*5g|+ae`|>)@7|y$HN0B6mVcxE|LPkL@0jb%5s?$n=Z;qbyz-|52WH
znX@+Yc-!%C)p4@ja<Xb!wH=!-)8$N;9Z>u1U^@b>gX{pf%7o?mels03+d;oIMO8-K
zb;LM7Uu0N6QjD?z=k(S<m;$_`MruJmr>=#O9#3TjowD4b^`3J(oR=Zg6j6oVAPLoC
zMzdVfEM`buV|C3}ZeQVrqdorQq~*c3Cow)BQ^m58HT39y0?660tV7YTypAEJXCU%2
zzV@=)80>ET`A_P7!+~%_vHiV<=Z<H*a%GQKZtijCF!9>u+HPFFBzLYIGD|yfo{99e
z0N|1*aUb|JoDn|&-ZiuLflo!`Nfh+{e@hV;z<aU%l>lzA+anRVZf19Zm*R9g_FWT^
zV@B&&iAhZ1XxR1CMo;ea|LE1&s=E#zt$R+lEssJvINN5{ZAaVn0kqI+rpvC)cHx)p
zvjyulviao#vRQS|XAAhc1S-L7LB(xfh0*Fz9K-EkgrqRhP<2wYD)eqBqD=~6Bg#Zk
zE0A0WR-JA5|LmNUFaWGhWQ84;8;_mMW6_ok^<qK2STH--W46DfYHFme5X9w^tcX`A
zCr?Yqg9oKiBMvli)X^NTC#yf_tdI@Mpjpvghoh67SBh-Pj%7SJ*)9-^fGTcp!)WF;
zm+Foi&6?{=<EwYBaPRgt-hSyOuirXio_2zQN-ptcq6a@@?3Viw_`aFF7dEx~z}fj)
zg^2vrEcgO=FSfr5?e-e*Jn)i;ycCkcEk;+urEn!ICIzw|;Y5&~sDo_Ax>xV)+V(u&
zbewKlPBwk8T9*&Huy%Foz}ijZgD#pK`aS@*uw5OCWQzZYO(v{W86*O=Y07w1>;q&=
z!Az%KT^mJDMTX)U3JIeUNLD&JjAZ7n0vnwZtui<%EcE5_|51RuG+D6AhzE^V!`Tp*
zUp-pz^_Q>n9hvhaH8f3)q%?s1)JtY@Fd12RybdOSuS{f<&ll9D2Ln?FUh9Jy_YT79
zZGHnw9(7|GWC|IUK2uPRgMx(1M3t`HqU{rA{Zsa<o>y*O;?27^?2S9m$+zElj@wr+
zar1C7E}Z<-n%OGyh9BeZhff25-!rp!MC5(ks`ezMl>c=Z@CEQ*Z2zX@gd^aFh`b2A
z0=yJ9uv@^@D3l$FNSVq|5t+BU%=Ytc1ZTG13HEf`@nq|o?OEHo^PtVNX0%ypyG(D;
z_L)`-;Et@efN<#$E5)*YA`yh@iAJriFw=2$Zi99^0<RSj(b;b>+f31OZCE}x0&^*$
z5JqLeIs@FcW^DS9K+F#qUF0?NTJ+=68eFv9kUOG?SB?||-iL0B+C&?6Civ^$dY#{U
z((+)PsU{!980zCkm_j^t0_bWovhDzCJzwZ6-EnH8r0^^+aq%#RM4?@FK<*UnL$b(%
z$OOzM(HOhZa9kF@eb=sO&mPh~y-z-S%<<7aFW<Vti?^@aH}2h%FTL~}Uw`E$*Y;=S
z0X3NLHo|;P%<MrF<UR^5`1`=Szz1e_Kc%$!X^U|ez<aU%r9n63gkuqT0eCsU_GJ-y
zAzF8jqgb{dO%2TyY$pLTCT242Ce7xSufl9kHa(}?0NXCJ?s{jns&u`}2yHG63^uUc
zK7h9$qy?7`h633@bA)Nn0MR)nlcJOcglMoqw?8?i<?tYM>W_yxYc*9CRbnB+T#Ona
zSz);T*qa_UX0-V8YSq~GE{|kWZ<^34bM``$Oqcq>3{}q+&Zb(imiuemUO7BI;MQ9&
zl9vl#`UgO#0dsAT7KS6^#6w)#l+9e@h0<v!gQPOr-p)5;Odjvta>ppo6X-)$DInZt
zv=3H1SxGn<mO-JI$`MFH%+P*KfA)~|;}6-KKBZ|Ijt=&C?%HL0^Uiho^1bKz)wl2P
z)fcaEd2cq=gIln*nLHJtB&dB1d>|t4nA!J26aLW5&VG_F_yTw@w!aME&dls;ND23V
zSHcQ*I{^2JnH@%<Y|a?^J!+RCp95PpZ_7Q40@=y73$V?sy3DrkY5UAJfVIuaws+Z}
zi_3-CZl_vpDWcf~Y{O}w6L*1zXH~Glo+ZP+vG7%pK?6|wNDvcXCNNJ>nQ^tQ_|@B&
z_~VaHcz4x-LL1CAo9oP)8K2uZ9d_#5EqbZtlI5TvX-B^ui&r|NnyDI%j4jE1Rw}~6
zWr`$Wc4?o(8<$xg9WYzWNOf}1((?L8wmWU`D21{-v^wv~DjAtLDTb=pu9tVGiDTS%
z9*BoxWMRd<V!dLWVO>T$mnwE-3HcFvF_7C6`jb!SpL|T;_3lNK#NPgr7j9g(H(q>B
zzWwGMzWw%HzI690`%N{mr?H6ywI{&Cu%LYayeA^x1>Ol+;_>;wp7L9|0N#u3M{ehj
z(ve5|yqUcWyb_>$7k4WR#j-N)COXlkg|d>V&9kJ0vo3SG>3G_9oV7jcHnSemyBt)v
zS=sjPv2Amv%@Yk*H414q{Piv}ao0nz(c(Plr&?%Ppjw%`<CIT;Bx4tsl-64$fZC{l
zgCsNolARf=-k7Jvuin___dhx1yQ@C*V+N2aF^@ZlGuWye*tUHpVO*+&b?-q1w~qJt
zt!qpE$-58v!PAypv{2nGv^_Ty774z0(t{eaq+DqdpKUU0HLvm)nx7JPukG{qzkHhq
ziv@r1G&7qwV8%?1!z5HGvFbBt;dM40!8YT?vOJL-27mH2!7|vp4d^OkQ4j}v&NFO2
z-*~|Uge@Et+B*o_M$t}pnYE06OcID-eM^7#G5!5_QO#aNG(SjJb<OeNJ}=xnw%708
zkiY%ad;HedU*e_fhs7-3<F1JFmb8yV<Xzx<z+Z$6@gSw77gEE;_OHcoRdp}qgBL~Q
zb>JS}U3McF?qxhHVQyxX<LoZdo(EhF#<%X3v$p5yz-)Uqop+UObI+!CcDpT%Hi~9j
zGrHcvxY)u9!|hGn3PxeIwv%%^7Q)6h+ho%jJPx)M7Jng`BI-+UHBauESHhlv)D^05
zrpAg$`wl0?EWv57Y%>#En1hCt9EaW?+sv7qsCT!eK6A7`<M{G|zyHz|{&=nY*(P&!
z(eN9W=lsscPkHb0+Fb%-q{<x#CIXiE_pa@8NsRyQJD(s~`SL>ehp%1XU%dZ_-+Avb
zfBtw&T|10uR<1RPU%Ij6kqLjEE3Q3v%)Nt#Z{EJdb?Z4hYxz(b{-PH??v&OH%?vHl
zE_JZuv>2QZgC*JgwNf-2cI|WQ>eo!}XH#dxxey;p;V(?nxexGd6*||8J^ymTgj2$D
zNBhaYq<iwIw>t+LHT?U62z6a?bZMWv&t0`|z4fB}-LK!{TW>zkjl=m6>w%9rIuVhF
z5zO<Uh`eiN-wzi2J>XI4jJp8di|xk&?tb`fUj<$d{q_!U6SyAkg#Bo8DC5R|B-j#P
z=B*m*&La~~Ti0t>ZDtc}cB{&!0BonUrnGUn4K`bBVZCOzhsBS+4|Y3rl?5{`plj2P
zD2jgTf!`@!e-fiXsq2cWsc7m%T??tMkh)@)giCdzs)UmaZI#$6Y}Dwh<WxwF4nH7h
z9B91b&FyG|-l68pWv7ZruUKoey|UM4{;RKC<MBbwX%gOFWj@>VSeuy{tTS|)QOnN7
zV~kJXn>Xu3GUNTT4l(0)E&SV87tGt1Klt7Q{)az$pINpDKabb1A!7iqA20cDe&ZE>
z>&rKp2|WGu2`7h__(vbF`JMY49`!C|<dAR-2V!N?(G~zZvUnXG4-?=e3Yf}H>)s9^
z?`p$4V(<vOQ?IW@Ge>qQLN`6ydV`3RX-oon^O*M2Kc`=xky0JNJgx6a<Y@?t`HZW_
zm+ZB>H|5v9c8}lwwKsVCg)5{n<b4}6<{rfqjSnLm;x9zxyJq&Th<tPbycgTEB!wmL
zBJf(A?uCY1f@+T9HnV5MEPl>%YmslT?TuC6bJk|g+J0cSn+OKqWMkWBw!OKupbog(
zkP_O`^pO3B-T_&Kp3=<VSmt_ZgwISsk4Z=k0#t%jiIjx8ageR&HO;JMHcK>BqE1kW
zc+hu({a{RQ&1$YK8vggkYqn<e2wlh*t@)IQmUu4Zc`5XL7!1^x<^(ttU#lr-XY^ZT
z|ES{IuU(>@CGK}Q@)F!qma~Sosc6?n!AZUH-|GMr7EIX8fpvki@Xfa8<4;dGeeXW&
z`)A~?qY>fu<pq0tGrsct5wBlf@YNTu@Qo`o7RLwFdkY?YddmO&&J+Ieqb(n|qi$ZT
zZRG%0<O3Tz;%t%%H);G(&K2Os+mG5X6MNcdFDp9q4hD~6^iFr2f!o&1oC$9-)`m`O
zVC@sy``@EKdxTUqJF&qc!{xGKs#4AV{=#luzbwD}rC0dvUweyReftHj?9WOut|X>C
z5|PjFJcxI3Kk%Pl0Ph9h?nny29T9mGcmubE-NEA+uS7${68GK?fIAt6I04*fl~vf}
z%&N_tb;_#iS$DmIZLh4eYq*=<+3dCp4OgcOcWipdDs-X6^#h<enD)V_^I#3zE&9+@
zF!z(pDx|5X>WZpy_F5+g*crk+35`VLnLv%P4^#+SHEz_fpAz5Ox|OX5S`|7|wgJ9d
zi}^NIENwEdUNcaC!d|?KMuRFtH5cl=ileJ@_V;Q`WRORS$wEW6=u1LbG$Q0)v9?FM
zjBYcwaZoM{QzzcnWJbT~*gQI8d%EQ?3IEY+SD7Cycz>%bn#4S3zO_hv_39o+2Q%LN
z?3DlQvkkw0)^oq}3=GX>MKQKWo9Yl<Igr>qsiGE<Cr?t<RCYmm%683m3vzOf4eL}G
zKBuOh3+)-Cjn1VV+DvXUx;~|S^d9-i54~`i#u=r9g)N#SY?3on*EN?f9oW}idqMur
zH{Res{kvb{?$!MwLu`RlGkX{_<URu4y8zx_P)T7@@IqDRxE<^@;0+OZZNhL%GT0K2
zU6ga3W#=RX2f9))TeUr_&Rq$sKC|w7ww<w#tlMqp6C2uWY_c=lGRdLK;bRTmwzm;z
z$`Zb`^$ts3154hTtCb+j#!s^ft&(ee$#u{qMiq><0&0Xg!VIG}V<zEJ01iZ0;6Rfm
zwzF1<nP{*@X;s)_YzpvZXmPgQWpUP<3;XiC1IhkF?z8dtZY_B8)`CCE#)IOWjSPn(
zq1Y&c4*uccKv$d)>b5TJf&p)Obk(BUJ{lG>V(QXFKtyeDZB~&)c-&=@z=0X}n#9}7
zilZ7n+A7~!_q@|)Ry|{AP{|A~ZM<RI8zhCyu+p$eTH4T0J<0NsKvL7)*6M<EULce4
z{_$bx1eBSSvLtMO?2=%lC`}ftk3Q3%t?3?qMElu0Sl%M3_AgYy;1obyKs^qMW=2&d
z_LfU~{^nKr&2PTJKm4t)@s*cv*t{0S>!N31kIdwg3*i05X1I$en!PO|Z<<-@G`mHN
z&WVPHI;iY`w9m4GIr|K`pv#=~4!G;i-3iWcy>Pbfaum>Xw|JHr0oMYkLOLjNf`hRy
zZTqscZ7Nt)Fn5q;UZG7j82Gb<d4J0I1nOi|=Ab)+0eJWDMu!>R>~N<NURcyT=`tss
zyAgU^QrKko;ckJg!rF|L8f$|y4f|L&T61Y6M^Q?<U}`y>4jEp%((uxqB@gSwY1pH@
znZw-~L+^x*t;l@<i$#-%P9{ba=Yi$I@&bgnJ-TgS(_vj6WKGZEjoK4NWx_!+E?2@F
zSgG-_S9dmOXuRPdv1ntq@|g@{i5MIg(+JBkoW~`RDQopS2OSyf)MGs<xG|L{cEWhh
zTekFECdTI<$3#j3KHbR!wjcck{geAhsz$j%<nyu4$@f{wmJp$7D!Y8?lKkzz^(w#p
zcfQ6y`1U<pHdQIaom~L$FCgfuY7-&jZvbz_-@73xT%Sk^1H+xfFETBdmF!se&ibT=
zb%3r<ZcsK|9;Ah>8rv=kY2nA+mJTz8P9<z#7R9q@Ovt!@ReV{mBG4q#!Hl$MuqI(i
z$SFmeuc1-s%M;dEI<XQiA5<dLzzny8)fg`~6~DgU@V#}%<6b#R@Ma_2UCwy0%{=Ne
zRXo-z!;@ZllwoD=Y}gv?Rj{grd&`;+)cEs_ak}c+Y`hqlvr7%CpqVi=MvZGXXWV{n
zL0u)bYJ-$f*sURhl#)wsL;2xbbkZ@{W`~Itz}Se8y~{0*bm(S_tXk;%iFFRDpo+!&
zTT<GJq+=SoZnRz(A8~PSXdcmS=x&=tU{13zHAWpx^nj7Q7KS|0d`B6<c3E%He0LJi
zqWkc3Ld1D-nBjKTZrFbG4%?64^CMTmTS+^Gx59jxuwXx|2vtgU>C(Qu`SJ_=*Z;|{
z^Y489CA)UGunXY*#VVRfI1=6h-ZHaSLt=P7q8cybO%HW|txUSi%w1x;1+y}SeAV?6
zcB`!VA|*J;Zh9MC3w;cQj4mzDPaxz3i_S9FOLJr_SV~xvV4eo~K&#|{BV)U+icElZ
z#Is?!8rWNTZH*eCvfa7v*DK-GCShtEV7%BQ?j0?VtUOw`2(JGM4!oas$`3l_vkdDb
z9L;Ke{pudy*=DXZi4U^!uUfZX-Cy<m@WGb#(;QWN2V2dM6s{uNuHfG78JBL%`NV{e
z)i?`(aE|ulp)Hw`<shhxU1Unhj0kX2nZ!5Bn1N83XfQoC9k$s*+d<bOs$=Jxc>~8Z
zflb2#mxKL|c@Z`g5eF8l)2_gh9dS<cJ)bYZ6nJ4PU5x+$AOJ~3K~yKs27#T>43S-p
zcRFKE*k#O2GThI1(oMH2(LVT;^>_azXosL+{itIIu`ZYZar!(M8$znY7EL4fUb)ME
z`5*ks1@QiYFkE69@9V&qqImZ5WTeh<0B*xG`hBJvu0=7+a5m~g9|LszaX#6mQ#R`Q
z?Yf^x3VqnY)FOYt!M3wtxG}MzQzHv7tEiSWvfp4$=(OP$Fo9kL6GfxoR!Yhi%X7~E
z_~JKHiA5ld&>+mrSR_~?%rR~V{L;MQ?Y)|P5$3f~H4Ty~tZ%(>qH5@R<#gNeVTSK3
zZ0ZWD5|s!K6jmWYY|PlkdF_llXB`ip^!$?tJqJnnjY}1MXIz<8{MMzKYs-XOZusM@
z{9&iOn~inJMv&3QRhIIuSj23%>_->xC=&;~5P;QWXgDZ+wcdOo(asn9`V4J`)dn^z
zr|7|0b78ZgBNxV7G9#=Thh=&Ta)7Ol12apVK}{$RIE0=Lt;LfN9Gf(k$iyx)Np3S8
z>kLBy?i{Gf)M`VT)H`-@+eGL$XKa7)UG(vNB&CTSo)OPij|WXeW9A@pm}@nNq%k+b
z<qT_PbEz*N>Ti7EY)?d90lpeccW^31Ywvy#y+UV;jvEZuWd@D$FGW-AdgH8jz}<A7
zsj!MJvrYDv-F4s7W^;DiTSy9}Mb;T^hugyXA|)h2=M~kWp*fggO(Ki8_6~p(Ka6aK
ziqhMl)P){8W>slP6;v<ANGcfzG7zT<*cahSu-z~1%{Uh0MuKaH3z}I&-nLX#LS{36
zySg5!DkLk1P2whrC!5R@GtNQ_oeDDXJ0t<KSz>>_U{$vq^l+dc%L>J~|G1+$ta$$F
zl5U>3w`qC5H$D>gCzZ()8YTdnFx>%Q63%LgNyH^+y|fN1I~{IhuMoPOEp%6{AXTtz
zpx#H<YuK)_ev9QyQ4od+8^MH8B}azB$Yv=w9$KG=*5OHbaf#6MunPr=Pg2>*FdnU9
z6X`)F=g+wy9QceP;f@73Z;(+LQ-3Ai*DHC;H)fCcXs_k>ALxW+hpT}Gq;l}pj19vo
ziaPF26-)6trE&tSBHd=q1@Qh2Vz|>hP*t7bbIZPDW?vPNS7W@+tr#SE7=U|zvO|#+
zq%e{^OgDh7Dy!Bdh1H<rhK8G!wc3uH&}!r=L{33(9!S%hgw4vU4J<0^<pSol7sir=
zUCahx$zgddBhj<S4$zj$zsNK+d}{rafju?Ao(M+>M^QZc*3p~?+su9v?(EHxoLQ|q
z_SM^E9cc4dtjW%rI`KkS(TgjCD!Fu!#3o&F{`suU_>L;N-|+gY4Td-N=dE)4DA8Y;
z!?HTp&BahCv~yLWsZC1Fr51*SH6{^^;)T4TD`%G-h%_+2F4*r#qoEh9+K2f9l`VO@
zg3XGYa{&1$FW4|sPR6hvf^F+0cUR93+#I{z#Psvhf}Tq>+kI0$ZzUT7ex?EIlQ$~K
z=xT@qy9j9R=^lK_WgheQzWoA!y12>jeg8g*CX@r$uSF!B6%8U4W*M;_F~vlqdr+b#
z;wumZlGEUe&b7Zu8gA@Mz!eesGVo>K&0x8=i#05oAJWj)J4pvC#WOP*90MlKMmL>u
z*7ZA*!a7IMEbL&LxZL-y;dUWOwBb-FS-6UzNnlY^?a#1TMHX*{=qaPn3!5tyeIv^_
z9;aZ$_}eUjE)snSqfS^D=fZ>oF|H=zW=g0U53_M?mbg|6A9tCyH-6=4!K;fJ)*XkY
zEM^r4^F*ymwOk;LHzl-f&zTvYb(se$oSG+TugrDXwe30{wt~MG@%+Yu86<>bF}_v{
zZ&yO2#`m-F&wAsXkS%%~EK3{o5K<%l9$8FG9>Q$8VEZM@z+_1Kq8Bt95(PI6z!kOO
zJ{AeJGB__3%NgrB^7ahduCcD0gyu|aU}aKrVZ8<52d}P<agbBZwzN~rq^(=Wm4i^U
z>tYe}*FQ{Aj+KCz?H19*y@tc8ryPvKq^s*w+E3pnpWJ7^5^nD`ob;JbH|lvrT4V$p
zEN#Pc!R?7g#;lL$Vjv0I(S7~@ykNXP$CARi#4y3fo!=9YuLEzJ*()M)$INbu$mJM?
zUKd%xBJCvvg<%a=;s^^1*~E~@O{c7~Tf>TOyU8}N-7YS>e(Rv?8m^4lvI){+M!l>_
zi-ue!mo8vP=<0(hWGS=C#HB}E@~{-KgXK4)<22lHHn}s76h7QC`~4uno+MtL*Sxi;
z`Hm`&I_1u?p-Z4`X5Zj_5uSF+m086x71xsM!SkwOo>CMX6|E{vmAXkR%xE(-SrIeW
z{U+X38{4V|xgaxInmUX}2LHS_-tWC}<B<v<t2-u&`9UL!a<G{d(A6;`*g6R&>IE?k
zNpcv?6K}2-JywA}*jxeX91|q^kRWn&#;N)W+xD=k#_|T+Y_PtKrj;Dc5_WFB8y@Fa
zqA4eFl}wnq4YT5Oxb1G=FrTlMoty6_lS)PTEF@Z%3*9KvgRM`|#~+iQKEV18Ny1qN
zfAP4--1d!X9MI2`A4yCN#)e?hgyNoE57yCUMv`ZYW4+jZ9-Rt=WN-`knwfni>|rm7
z$SpIwA|iv1J5dxS7BT;(_Ctt_U+y|*wx?YmazbXEeFDU~B!y)QuvOYViex5HI3oZT
ztP-kaP1*~vm1u~-hQ<g7kRm6P=64xA@=OXYGFhrhu;XAq66|rmf<+~eDsD6tFU^Eg
zgvSC0m2f2`?guNK8#H*D*V15tu}rX!uy62uEnG{^q85>-Th%qaxL0=*1++7TGrSPC
zHh7Yahgmu4l~wH9np?!OjRzJB)>=TMEJeELf-CI51kz|&%Cf~sdE8H1<N{UD)<!*d
z>!4SzlRjJq-MHWS!dhjR3PI?%(G?StL=H*8yXDLjYctku$lVHZ=l5sIaBXOh9;a`F
zpLZBgrxWYhB<O*n%a>`!(<+z^;9Bfu5*{?0Ea?ZWeb6tIWnS~`y;B}OdcZ&Z@F7&y
zGXZhX$7SHo&ZsAaxM52Zq1Z)T#5&Kw5b^8ng7N;`vfR*gQ&_;>0={WxZ$<;e3t<mC
z6p_WmsZbmWW0(yx1j-b~kj+@N%Bt&F_ulNV4tGLvDr}<pp^M^K$tdV7xuk%h;<LP(
zWsS^ha*|0Ft$FLO1Zap*j5_M8;K@A1@n4l8-ejj#-BiMURdG-YdzG+gDrR*>jj$Bs
zl}flJ!vEPSEyk-&#mjZ#_uHOrHj;>Iv2oB5bGGWfVd2vZ>#Q6Cd*ZH$)b?x<wm_4F
zWt}jTZ2nq0;Gh=jI&papr)E6tGN)NNRpT_e*YZ@gjQMSD6N~8%661B^v+8xUa^<*<
zhwlJ=v?TYCyD|I0`qG^h!R=jGx%v_$V}qyIdJpc=BCPv-Axv|yUC)W2cXm6>W78Vd
zJ?OTOw^-jgP-+>9W;;xGhpi47$P<7R9ooyRC<PNM+K$faT1I$qCr*VDj$X2r5vttr
z+|&1XW3lGH_?2Jc&ptWipT7GENm6*!Z4fmE@IU9<9hBps&63hsSD5-I1lNJ_55;;z
z#4dpM=LvA940RG@^L5}W!0Rz~r%Zm>GqY-pXY`Re4!B|Pwld+s8KfF)d-aa9zGv0C
zC2ZYgHtNxao9r6s)&g*gEzF=Rpiv3UqM_Mquqx4s#26l>2YT_mg_s2H`vO=-z#X+u
zDfXPOe^p|nl$h5Qmu3|QRbp1brR3G*Htu&QP^q`?J~DV>@EBtbypxqr)Hqe|P)nuw
zRTzzg!^&$*p8FTqZGe<Z<fJkKF3&6WabIvR#@a?%p=9?q7)MRTqOLelV>NT|ecWZX
zTG;QHW@e0au3U<o*~ad-;wVrf7Y5rx-xUxwit9-`2h<#zt@bf7q6>>yj|Yhta2`gt
zyTssV-H!}6qz7Wkh6A$$rB$`Rn+n!%#thz&4rH(v=-_scNeGTi2Ym(*O4!M!f%M|*
z|M<N8Hq+Q~v2k)ySqYg4wJHDk-+rBMy>!Tb```a#zP~c0sSwK}gC2sC)A&@&bBRYA
zENF4`94uv1zz^2z&$td-U4J1p{2YRC1st2%mqp|oz?X1O?rjmd7CP@>58D~5Gx0_a
zg|j$z_X=lS&si6eLhr@2wMM~Ajkb4Lp&i@^!E_@Ekh-E-)YQuwt&#`a>?Cy+X~BWC
zT+WmcJTf*yOeP74z^oGHRbo*k4(AmIP4ZS>@m600Hu3uQM7V^};u`OXdZT>8m-!-N
z;iZnBKqW9UVP-HBV-fAbGvczrB0Rr!v7v?Ja4c}WNzCemV*IdIJ~Viuu#qUNnRs+0
z#)c?1hLx^0IL*dM+q3Gui?2-SEi>HIqT8)V4JC-Yb1=<4<ko_*I)lxfp>5z}Zw|n{
zVjVH&Cp6xk!A_<{=gGyXkc%(OpFno*?O<yqYORd8z)B}b>^IFwzk$B<_)48dIqDAU
z9j0mQFk&6ibCU5Zg(VN}vXL=M%vqD6s8+6zP@5!tb-(BC>38|Re(;di60HiG(8#5P
zxKC2l#isiVBTc*&V^?Rv>9T*2Axe`+v=?76-k%d`A++2j-f8yBz*o%d)nK{TgXPYH
z<ua8Oka5_ePu8}fiz}<KiA;r6=V@W9TpAzL!6JLeOPih9x|HCBGX>JDV!2n7W))UB
zz_iio+96&z!$v6~mhZj9^0|Pmln`>EsvJ}=&ujJr)DDtR#qCRKSZ}Zm7P2RBS%f9R
zXTaLvScG{pwo#|4Bd=B>7^e#Rm%mMA;)MTd6CR^@NrZ*K)s$$>A8Rgfy-u8F<64t^
zmRfS1yku=_Dzn^dEQ%F88T4#_U+M~u78Q$}c-k3Hx0$wRwIR=F9_@768@Y2iK?|ep
zVhVA{4BFaI%*tIz4qY%{jSq2Xu86|hkiIi`&OFGcOfS}WBBrs=Mkhnbfz18TuPmlO
z6FCU2>%YaU`?<oIjRm=Bzu}}&V$g8S27q)zF_|lGlQHn|dHRpR9XpzZ@1DX7H2h~T
z?elQ0ym#93XHR<`b~b>koF5}JkvmG6ZCu#6OktVbB(sSZLrjL3eF3~*;3C=tbgLMd
z{#6nAB{O>yxF;gd0at-iJR913U73(U^C}Y<N})gv+Rj+_k*kn1>&`7<tMK5i18m!&
zrPt_8yx=85H5c}l4QXDJgH5)PB-Vw5(8W@{%r^_K{;>FRE0lv)BhG4Pjc{X8vq-Mz
zYJg<2F}Nm2GMFJOfP?VkE)v|UD*iMp-_M!P)C+C%`0W&FBjIUWr4EwtPPVzgCE!Ma
z8_D(J6jH>cB&^iIH^u8pNjMW|P^#=6-6z1tChR?=1`Ww1kJ75U5%6Vw7q4~Jz(G}W
zw#lqE*#~H<uQD`ifUX0tbuJU+ZAb}GEYs}!JS#Kybz^W1eE?I@dCMpw)d;WAD54dB
z%f7VNQ63l=Fa4yaSfjPpBAKTfG+wC^XoYDT%X%GI?M^aT=n+<e8uGd88J|OuCng$$
z$;fosm68#InFuc~YJTJTb^iT(*ErLL|K~gJ^FO_N!XMn<a+WO;A<F<%9ae@@gW66Z
zRN^*;bx-pfN>NS*(f0y)zo@Q-lu{X+z89%s-!!wYnb~V1au?5BIKm?a<Xk4MOl5@<
zXi~O5!#X<6{51M+HyUz6=(wFmS{Pn9GoYR)nngo3OJtED$fbaCks$H}baUvpIhq_a
zKyy|Ji^`epUM(Ef6_u3sU*{E`8U}Up-`Y05zbRyaOOm(|OaAx6hNeIhnww0j(*o2{
z0WUw+Y(he~lHi`eb%CpOVxAHYP?s<a){z}6;S)WH_w+=e3AVfjo&u{uN{OKMVEtW$
zruU3&w=;ZYFdVpiWm3-)^CWcZOt;E(8zr}1_{v)cT<wh98@UaP%f4TFcR7^ChzPJ4
za~XnqOPsf&vud!^D5Mntm8{VukcZYc(;PF>x&cI;{r3LJWsgPkaX*vuR{p;{0d0n<
z$udnS3s4)^?>e!M$uI*i5-vkhjn^il4B+yT-@dNlxQ5%uN8I?$Z_(Vk!L{H0Kaf9s
zhwuHbf5NJVN*NwsW#aoa*=@!UFj9zQGU=d`VN_88;X=esE`aw7YZZ$@kyn5(o7p!*
z%Y8L$V^{GRXZ46FPH!a?f1Ltu6y|c|+@3{xScz%e6hCe@wwec)+lGwSA>>M^tBS?a
z!^67(+)jNgc~>lC0Ww*v3|1Iqg;Kq*lCZ222X*4=tmd$(sFLiYRHXpj8rNF^w$TE7
z$k?rRJ)%-Kae83J?{=9k^xxv}84Fe=C?_&*BQWP?626w;P7-Fxn>$X;3v)T73@ti&
zY3>Tfp2dB(Js$nIL1=Mpw};{U7T3B<NP6ky+nS7F>LxL5!{7g`;yOePU2k-!0lL9>
zHKYS;#{{rp^!YH?jmSrcVUne#ZD70Swb~GS)w{?{dn9YH)ZPKq0(6H?GcS*70JUkP
zoM`~5*$^;Oifb0ym)Hb+C(({Fd|tuA%dEPc=rJ3dD3oqF5k$h1Tzm-e8%TIE+a|+j
zt?=N}6$i~JcI`#p`pO<(|AW8a{>N+Dhz%`MGp3ftLZ<!8Dj*u>1{qoJ_-Y2U6(t_@
zLgW3Sg6<r+Yi7S3u7x+u>~2U41IzuKC$}tHhvYDZwERxZC&c!dRUbj*eP$CG3T<|)
znCrOCx;g_=qNx*mi;8Ae(*hff$q-?iYJ*VaX{V`#^(lZjC80@){Yp5VRU9`JdzHil
z;Igump$ETAe<*ghHm;f@e7P1Lnva`#y-vKV#>WaDXv|DA*MBKpcxA$t*jV%^KrF&B
z@P-(-MOY@7SMH2BDON5UGZK&zM&t59Z~j`lGHpVNtuC^9qp-FyFQ{z?AFrS90$^M7
z_p#LoRS&7O?TxN8wpq|+L$~hfPYm7KU;(2m{#YGN(9vxs>a5mc*yeBq>LvxQzT7|u
z&~)R!hHo|xMK-bVwl-+EA*5I)sggAZI8St51G9cI`e$@}IJ51~d2x%hpu2ewWirKJ
zAJCn)hM_$nF*el5m@!P$7d~Dozx%@z^dJ2pmk#Fq@T_IiwtVxs10Jk5{K2Ds;%u1s
zT_%~x<78+r=B47qvC&oG{$Ck0pf$mTo$QNKKr7Nh6v^H)vtJgGubSCCJht&#Xt~XK
zSwV*U&#`z`EHPPOn{`K4D9sO>GW9`AL}UDhO|T^1jWw^SXWl5VRbx{?86x1uij3%%
zuxR`30@SJm`&Hs{Q*o`S*sl{+lEK*TAvF=?9nX0$fHI4-Tmg=P*>+|u5%z#j5q_w~
z4<hejHux^f^0F{h2Y+EKGFoVEmx0&Bi*PDXRcQ#|5%K5QGl^gvjY)CfiEwst38V`t
zqyt(UaJ`vA*c69{5<om*zZ$3P2fw!W`D|V9(m~&QCt9^vdDq)#9ky}Ml;}{CL2fmq
ztm1QN8kqQGb77&yeK54O1*<K<>Fjru7u==b_Yc!w0ITb|4$6K$7wg23zaTbY-sVz+
z4e2uyQikp{MNAyEqvK(!?~d>t`tR7iIBlMgkRDQe$sTTvKYXOTch)kKHIIAcrDn~4
zd^z#&zIBuD{n3ZqZ<Q*J0BMjIVpJ3C*afTj0-KD}G)k7Rq!ik^pvj;61@L}BTnnmN
zM>zR6fv<_kTfi$KatpX@W(z4s!JW>taSm6G*uc^p(Pj%R*MWCE$;I6S%iRVLbOBx_
zLe*3(W);o6rpG~|%h3W{PR0aqeZqsglDt^9sDy(makWWYnN=*443;rdZ$Q{tzTpM5
z%K}G9_)xu=m4Jt4yj3MCfe(7+{j59&wjw-M&!wJEeDsP%P`NvsoRs+E7oTnx;}GFx
z;A$Koa`NdBRdkrG!jjg-52`OKig=9j9+cA-2CaKzUTE8bgRYiwKp{uyc)rcXHpges
zdo-pO(!%PcLS;tEpuJGf1iM<(YfpaYu7i?!Al;a=>$wZTf~9z2ZOlw4Iz=v@;-sji
zdC+<bKzo60WX4z-OCL^Ub&pC_7;^Y`vle~0FyPQ=b4<P{rPiTMcswvnn&MsXu_@~f
zfGzFrCPQn(knJGuI2c_Dew(bygDsr2LXt#<@<z4h<rlB;!nIrcFMsj@_cy)@Egf?z
zll9UhWxdE}I(Ur>!wn5uZ9H(OfTauI{aFES5&YxwUg)>q3TfeW;EtKy5Rn6Xn(q{F
zM~Nu_HxB{N-qg@$8(8i->kwwMi2(9#I2E>KV4?_Bm6*>enpp+OHQa6Jmc0nAy63hX
z3T2~A*ayYluY}8W#kE<*r8==pGPD5`?6wp=ioGgPnizxwJfg7{<4&|+p7g%FUl=R|
zK8@vlaV6yQVL6NeDi;4&WiDOJhY1wIE#NtE*8-KW!Y4?ikWW_PT5T~rwLzweEw0E4
z#gE*Xuto-e-I%d4VWSLe*F$rN&j7Xovc1|cfw-(!rG&Dak3`HN-5l4@8u@XH47A)P
zK@MZitpwnT_Cq#r*diFrzjzjd19o&;m8OEih70fxRxf9~L;A!-CpJgjV8;w#Eartb
zcThy*gG_wA1*mtr(k6}vn+irYcE(NRhRKv+uNZ{ROR)~R6p&3wBHUQOmkv5+`IM@A
z%CEh7n-Bik2Rv?j&uTzO6PaT=->t|ZY53oDGVEAJ*<=_SuNT1kGq#CgX4iqYfp3}F
zSAile9E->vP<?KSuZ`KIeaU@|p?h77-&ys_Ds<d+ND5okQBo+y8-r9O7PE@^tj3b-
zn_Xy*UBowbQd)eAu4x0{Rtb)(isL$Qt*N+DM_740rxX?cDv&XkqF032)bS<VVr;~L
zs{=mFp5LIr53_q}9|^P~)Up%58aAQOg=6%O3?5GZj~j`g^RSE^0ecB72@iv<mJHuK
zN~dlCiy)s8xZVzq1PQsoL3(2hc???<)-ii+tu85SN|#>&+blzVg7*p(_BynzO~wKh
zKsHkEIj_x?1YJTOc3~IOVR&QFR*8f#$r;lQ$wj{{MKISWykJ(mxf4xSN5D1mU;(qj
zcqLDKwiA{dAnU+91_8U&kVk#ibWHOCOybR$+Sg?24U?S!^c~B}4j4)RZywrvOLIkO
z`>hc!H^SGBYJT(W>s-G&Bexs=!N2uY{`vPl=J!9|QdNm$V@IU~$ogA5iVjV3CY@o&
z3p|J=I+VaKfcIx8Ei^I7_nW}q0^Smlm(A=s5jg^8qnzMjcf)-n5G5DkUp%CIqZ&E6
z!Ekl7h_&ZHw>M{b%cf%9RHP=+se{iptW8Ba=mL~_kr=HL_fNvrDskMnq;ObOUSNo$
zd=*RdVj`b<+XZ1J#(rcpJlPr5<M(+S6N~pmSmF}``%*Y#bQUauLySZ5s$=Bh#Jn)K
zqV-`ls`22PJz;2H-W1RA;8cjn#*&Rt<OC}W*rI^u2dPbf?8bzxX#lUVGFWBrRx1Ux
zG7iVonO9}rx+@wTQw8;P8tfg3TUv4pg6(Dh+Z-qQKEeIg8Ecu=P|lkonz6ojT~&j#
zn@a;0OjZb{IVq00y(}(kMkG4a20b=9%fc!)vSkM8z{dv#Gag(PdGz`gXF~DsPKszl
z8}A^i?Y0G5fUiu0(W9VR@{cXFT^V%PNs~+xj;h3)muGzG8((4hwXd-G<KN@t&%VbC
z2Z=vQI@C)91}8^B`4mElsL-Uy8_{VBU9p^5$UXj@ya3+6MwUBay8CAKTCm)2#5naA
zM5IUy^+bv=k+6hE;(tGxqzcffr-%&$CUY6P<LP08j;k&gm<Y4R8E#W2dVx*JTwv1p
z5Mb0<X?*b8G)XwF630!&%{sBHgsP0WMyO=W;n#6NI4lQ~7<Jgao~yh7wNcma&a4DR
zkGTv77@as<42$wmTe&W972`0$QhXMghDp8&d)twewqOsxu4C1Z@n(l7MJF#FWF&%a
zN+HokpKVyeIt|O12`iJ37GSNyS)`9`jF4xTOkQBnMRhWzLCk-=6c>V)Ox;nJEt;v6
zc3l+7{-E`71zRCM$bo~wG{XWWgJYqDHI%|v??4%i6MnuQ029q4c*a!D0*L-tB?CDg
zKaasS6zf;^aBwMsGm-T$7Sg7(-KX}m@b$`6USJn|OShYhornIoh4!Z1L6p-rU_6kc
z*xt5VVJQom=k9RygO7Ooa>eh@6CbQIO(n5{iuU-SQNlkv4XLbV40{@LhZ#M^W*41n
zKMT-R)hl?Y&9|b6b}we1U5Nr(HCa6kISU%I&eTShtLnbnO;*kZX~9O&)p7Dekrk>c
zv6xrPnvfN&cyR+@OomVxw}QC`w-4OB-XyNnE+-t+GK|o{%JP3=hG$&X6^l(7Fqv_G
z@Y86nD4k;iK1W~vVG=G86B;P#RNlgS9k?dOet`5moC$fNKZDQ-EJT>eXbdXaa&0~#
zB1aLejfRIJw@mjHnP82CUMsBB+3%Sa>zM1e&Ya`@DGYR&%{~Z#0k#a4{#2S7)X#fR
zO@M8lF6TXDd}_C<t~A)DN1wDLw=a;bLvl|EVvro=K@G>X_7Q@UW8_FMTh$SOOAt=5
zTq#yEN_X1ic@;pmSUOO=ybR`H$pk~rL!oUj?CF?PR)T44kQ8)cHJi8{Y-}B#Bq#Xq
z#PSfbG{!^*=$fzKPP)vWKU(pB|Kb13tM?yK&tS7PZZCyjzcJ%?K3egp^RZN;FWl1_
zrcE4T6}6APjPJWnJimTV3(Mn0NX}oMw2(yP1vC3wBJ#_j>)yjhsvi+~x##s<cmL>6
zL@Qk|S=|zL)@4?CWVt>z9a__&V%`}@@~FglT_IKYZ%bIYmB1SZpKWNGIhNE29Mu)q
zYnK(4DGfHsAs$Nn3r7Utj7Ff*3E9M@E^6pD0a6{h*~aBQE_QP>!M_NtG~@Eb^S~91
zTHs1@Gf^8JO*I=@gEgdvBVZ^M(4qhUAOJ~3K~z6EGiR`a87B(&&3F_Cfo)jUwh?60
z4#O%-!OYq1S?ITCu?py8e~ELn$skH^0E9q$zh+=yNo9pz*ldoL;9>ku2?vjaFwH*6
zcL*oX8g4BgsZM8D=k5kwb#xz|`lMh}G<V*0Mn?L6WY8MDbJjci%y}qmQM$~mA2i<q
zR4t^0SUQ`I4bdKVrsSe6Pi<?q3#b-se2`71;LAAdvdm_)Y0*qaNw<I=QZmDAGVoVo
z61#t~Qs}zFiY!{y=aq0{QSs_t#jQn+C8O$2d9HiR^H=w{e{h5U@ekkOpT6@kRZ|Tf
ziy=lhtcHt}m?h!U(+$)ODapBM*Q4F>g7N+}fUcP}W_Hiaz7?A8o4{S*2HuEOm4o*V
z=nkXKZ5&eqw55QSy%}N?z}s4ck`Fc|XL7S9v1}@u+FN`baBbqn_1m=pR(aBacDbpz
zR=b9~SEWJXD9bJ;dHQK!yv`&_RX5?Sy_ALpfir_sELt$fs`NOE$W6;F@PjDy8SdeI
z5#vgD<mXAKW2Acx%)*7x26b+Og`R|*P(sX!{VR+W?r7Lx?n;QJhe19V+z2isY$D03
zEd|bS9_WO54Z|dd5$C~v14xHCVj(RQFK)@N9olErsN%BP7@ug^PKuajbqzOVs-r|+
zwOH;E>nDY^V6rxm5Ez>zB0XmS-htT$s~sE+G8V=B`4mCPC4_{Ifjc&V9UFmF$~@?J
zJu-N2Cm;=jgTiFDz&KgS2l%pM?{d;o<PO<sVlbJs{u*>y_+*ti*(PSPr8hxUxSJOI
zhgar&`|c&)`@x()eJ|5$=);BC#%c|NZO+_SHhkmlH~FJ~^*#?*?U1pPbewvv7oBT=
zEzX5~GkaS^zGY@#5750611Fag*TPO_ZjP+g9MVFH%!6(3<9AlsbzQfIMFB0e#V+K9
zR0)@&ct#3$!VpC`Haht5$>K$Id11dwTyH9_Hi`X|hW1H@iLEjju`=+HK~5`%^ID99
z0Q4t}p)}K^Cu5v~QKm~&ctP!n8BgMeHbZzh883=+tP%-XI^CAIH7J|0jd43&Sl`Y<
zqg{%Ra#w>D@Yvu4I5Ak^-rEg6-)v(HKs!v2P(N^)m04T<YtA;#6CYw^hvK}9dTr0n
zC>$q}lcJf1m$h`5MeA>wEjF6A)kC#A_u)z~QOiBDgtV8)4|{K4%g%61(QIh>Eug91
z7EJNl4#{L=V}$8MGlsF#jj_9I1mGznp7@93`oThGdD33XP86i<B$RP(nB_D(!I%tC
zn*`~^cPSBFbrN!K6nWJz6N4*z;Hl~mvY!q9lo^|MwtVvFPq@~e@ujPC{@H_VNMm75
z3)hWA(qDz~!a>6yC;R|3k(GT+mA5lr0PkP1o*NT>e<iG9uL92l$09NZ()lhlpFp5v
zl33`urGU21yV64O<Q5&bQwP#zlh~V8)KzjowPN^>iu}a*573GO%OWMN4=#litkzkp
zOfn9zA}y38rWiFo@lsZJ7uu!d4EHI1AUT<2o-7gelZTYAN|Kidv*-w0mswUOToKo0
zE=8tkN|T^#Gg9=ySJCCx8mz(w*Bfj^I3qM&^K6HwCOpA-YH(^kwr3MF&d$_0Eq1#2
zTZ$&anEGb%yoXj+W$c{};3>s5({ZAL1>-HZm5IbqoDbvm@udGh_TKEtt}8q9`>lP>
z9dg7-02~04;8>*^RjRpEs*=@mSkVz3jt<$5ZaMtucmFefa{Hyjj<6lJBINGqcDH0(
zEw!c^q#DSo;sk;uW+W1sdB?N&UVhkX4>w8K?&+bbC`AQ9Advupyz8#>t?&DNnV>Vo
z;)PBBOnR+ozy%Mx9q}l_YF!d&HBIKLhHBuO48h4;b|Xq#dd+Z<66}X!8KgO2QQO3t
z&mrdE$RCFm`6Blr*R8kexWw2*ymcdLvtjPtz>l@JGbw);MV7E9F12=QXE;Y~hNqgr
z*V$hF<_wPK%2&4GSI_mV*Gt|wiTG?NGY5~eMc{Dd`Oc5u=47!-hq$(Iv&bhOAJ_ha
zgd%JJUs2UB*wFoyh~%c<eNyaKY)EfN3*NvsnIoE7AwnIvw&j+gn~!5QctwQ$amRGj
zqfLzU^rjn3%M_A!8Gt9p9hdr!Go8>oYpM{%sTMzMCoLpTY7vUo%@-4_oyB1f70!3b
zW$=EWfO|k03+zZ5dRjcQ)dCiZK9`y!w#*XNm#M3zNHA;S`9<c;B=3PmgQkr3=do1b
zSkur=t-xvE=5H^eq;QF8(Dh2aDJ`VWnJ(#>ZCkdtSoK}AH<*j6HZPP%=mHmS2X5T-
z^Ttg5%7ZaMW+Vh$^l5V)0!XCW>+s7Vg(h;WH=iBz@Y{gnc#|Nsu}#H#K+ENg^*3DW
z*r^b6(O{4Dv4X{fCh?Y~g|N{$p=fh#i)EOW0LDf@qUut$g*clnQ(<S#4BOX5Ot%iC
z$_y%@s>15Z0G51+b#Paw{P`^MyRTg0zxmB)`0xL(AM(eqy-PnHr#JkvwQH)!T0u`t
zudj>;CF1N!F@8LF|NU*cs%r5<72r8@Equ|2?(?epgox~^YTs<dW#~p5y0MWKybayF
z;VyEyWK4kam0Fvx!O5p1$L_eJ>s-P!X6a$WBG$4M(&PJHFFawvhf#rmry6T4YD+^o
z>&m~1EhQ$EAatZ0dY7AlP0#HjHmGXaQb?NV%rx8vagsJx(<KCD8{wiT6G?WpobS(d
z*{!agtKNgzz}AvN4J8<2dhHyw%{C4Gg{FTWY~Xs+sMTuNwE$A`fyd5Dh9%52uhNtd
znt`j$cB`f3vJ7Y!6JJ3?E`rok+c6siv1|b=rAe*-HU?Y>=-45>q6<r<W$$f%>^DAx
zaoWsN8|#oQpz>IuIC&G!_OteAri~w0YqG5l#l{8EHc*&cAWiqfrk7V6;$kckLvhY%
zY%F3Wm{bqIjh#zMqS16;o7pb6lH}#t)x(@1+}A1JJA{{4OMd5*PjYy8%unw=M#WW=
zn(5$^u4B75cT0@qkBG&3_wnHU4{=0$Swy}Hd_hEB1)jBZ+E%iX=2~?rrIR7r(6t@X
zi5SGj>eNF_tq_I_EWTV)>=c1B)1IwShg!@vdu|8nzk9P*c~w>l+fKMX>Ue70m9j}K
zX7PenqLf`3msFZ?WNBR$O;tQL1cL|{y7XdsKPZP$8*gJhbPTQU(LA`l{W+}cATcTN
z-n0p;rLn|0N>NLxgUPKFiH$oaZL#@Cwju=^@^(AZnk@6?P6(tD$&E^Jty~N(-Dp}$
z7g8LzZE!FNA`j4Z`;E<IC~vT#{+ygn!wzv;=tr?`yD?kAywy1eG^C0U@gbE_hCny&
zVCGTDNj1vAO&hMgSp>hqNJ#cEnidId$YfQ|&4Bd6QOIvDInZD>wesJkvGMJOs()&%
zD9EDoN;BAV?_@3D*#OmO<>PL=HnYpdo(7}&$TdH?WMH{14r+%miBkTGoDJ#k-dV8k
z?($!K`;+|E$(kGg{JSiqXJkibwbxeA$X2Hu+3O~1z-ihRg8g@OACJy|Z+5Y%h<pn8
z4H5aW*~OmALsvvf^q1U+rWP^O><df-X%&=N@XSK;=BD1WYRF$}MGuZT$N9;K={QxU
zFSWWA)>&GRyz!=ZYf!j2>Ud$=b8X!5%&22+t_CM|IFR;$K>7FbW0DSNBGw>bKH5&q
zy5=Yv?ZWEEHP^7yFm0ul1LnH(k$s*M^A+z3TovV#bBtVmvD6e$IlkE7UYKLz5aAG#
zejDLL6Jz&S;V>p$d4VLk)Fg$_NDI09OU<HIF#)kGtpy3ES_>6&FPa_2G{zE?&<0?W
zqP@u)M$l$BHAl4azfg7BFrdCcH+pZ?>uWR&FjyauPn=s_%xdH}_=dUQtxqUJaVo}9
zLM-2|&W1`IlN^Ge>cBboET=xM9o$LVjdkOVu^i*16kmoCGtP;(+PkJr?N6*uh`e>@
zX0+UNshhPz#eQbIh73#>>hVvc9`;<*P7)Cwt(Doq117Trw))g7xb%VC+zv45l}RVe
zeK03V{kq9-G9M4#e+PM?;pgrGpBIsDntS1sB67`~3sZY?{(seT#V+-$5IHGUG4tk{
ztgwpImI7dR+;MI?qU#)k!C6wNWFEd!s(12%ZR%3($ur}g3w`o2&NW%6s+3^ID@ofy
zhZt8u8oy+gY179|P3>I*yCPh0a4#xHx#q_<iVQ~&QsFj@0f2!7%;^MXwte;j=j^D~
zn_D47DVcmp&xF=ap&SDTD%@|{g&(W(m_#$nfOD_rIA~t_rBb~}s(A=kB9?^eOb8`m
zW-qLezAv60oZ24NGzA$#Gu)exjjfg&NfJT`NlywsRfr582_E(N#{zhddT(vP$>E?O
z9nW;RDDH%eft0FYSadjT+G6&y5(!T43{~50e>_VplC5CU=(DYZp>lIG^hXMy!Xyi=
zAKQLaNNZUzCqX_|mF+h-05=W?Y0$jVI3B9=CQBTf&B9Kq+~q`5(o&S(rLWKTAI*4v
zf5bodd*24&-CK9lFX_^6YP)k>nvOVJ2ST}rH2)|1@!<V;9l9~bGr(6w<kv|^$5%z<
zDsWyzDsMqVrO|VTP}C|!93d)mA2}JKu@;PO71JYf25YbEk?GvlnB7sIs&~w{Iuu_i
zg%#_Ca*cmt+;M%<bAIF)yEH6Cvhkl%&POqr+hA=D#d+xFu!J*yF64ki`t^@(^9)8l
z%iCgZp&@U(&21@b&pVR-duCL)y1MkS>w1Qv7fnOg4kkV-GvI*=_Z03ZJhW~1sCaO*
zqpPOwq8;7TY-X9gtD1Fbt!^f*X)@JVhDa`pY-Iw;_o$d%3bFDQ3NgMi6=ELFrLrdl
z8^n7%f_bZ356PDsVmh4pR5PsJ6Jv5HlwlpxRvVY|B2hT?_MZ|PcCMBrT5gxf#IPLg
z)nM^sGW@sd#!{Lf?AO+&e@#MZj!3_TZy@WjI65kWp>DN83(#qXarxZY+8B$AL7HZY
zq8DfHu@TWbo5GF?NzdDECn;Xuxl}imzumc{%?9b%8981a&v=Rx7zTzA(;+r0+r8td
zot~q0WC+-sN9LA&tnvO^NelUiW<&Ra4c)H-pHbE8BJz}~?g4#qEu>?BWWaU^RnKh$
z5wjRrSR=%$Wc{gu2Ziy-aemy>xg2q=T5d2~n9uTp$q{2GJU#BXFzQk@dDGJ1s2pCW
zIq|c(F=!dIX6>@??5t=qnyj(wgdKsqAu`jd7w0OXmfO(oGy{z-%+`Z7)<$g7#GRO|
zURw&!AY60V37>v1UX=y#NQL`Rxue1ZvxwzChhW08sx%wz=J0R-o@1-=QUNb&7|wJl
zZ-%JG#sWrhF=XqO#5{!KrgK4CHbZQj3>I|ov0xcp4C!;2<tm1l24bTD>nRx_{T>7j
zLvlbATbB|;9=dVkF&<hSw}R!-Sj!~KAxs)qf|jAKW<RX`XH@ASHowM3h(b2P6Dp_d
zW14>-O{pZoh-UU{Hx#e}#W$_D@O<+z&1LVkE63ry^`-&r=<^_!{QVuh6DAif@%dLT
zb9uMtU;OwUe{p-pd-H+b!PC1PU;e@u_(y;AeICst&M8Ak13!H1YWTN4qKT!>z7Bkq
z)QfgqL@uf7Uc+0^X5+P{*rY#YjdvLmGj~}IXjZA7b=-0ogZ**G-nb`Pvq5IS7PmqR
zxv?+i3%%p%Nym<>4ggoYhbif`mdaRcGvxW}*4a^`fO-sCJ~0Z^!cdPpc0m-Y{gJZK
zX3widdS!F_%}?cCN^4CyTwzwXW8f18Q$JAUIg>&#FYPQUcM<L?+*Y_BQ>@qL2rm`%
zMcHVZ^GxQfW?7-!zw!_^B_R(;5~N&P+gMJc1qu^ao9$O)X5DI`lx^s~w&{v7aW&-O
znLEd_BVsTq!3g$Qa?rF1M;|s4Xc&nOABv4D2Q^%|w^!e-#3saGGDEBPRs>_J>@kCE
z!(*U;*Hv4`Lwy4isg^a}z>URPxg)LhtO+4#lb_6+ZqUNTDRjst0jCWp$I-%@?f32i
zo&88BAQI_tj7;k4U4koh0^6g=GutDcdf`PbedP<BefbUM@eg=7zro|hK<9+92;cwN
zO*953ouqap`*YFoaRbG_aS|=YD60A-@arP-WmWwYa2>d$sykGT{lj{0qzv7lNtB;w
zqF6L<uGT<=FJ4>W+@xoxcMKN!U6UXz>(cv0VJi$My%U}qcU&Gh)40+`>rS~AI!z3P
zc&duGty{^fYlb@alAH!v)7^22>UF5;k$$1sp->sBkxgl#y?I32aPzPpOG=oj!nH0r
z5Ps^@K;5^Y?Mam?BB{zeBHRngO%-N_|C^91Th>-rl({Xj2|Q>SuCca-H(PIZFKA8?
zs%f(gK@8P~4<1YSp}H92MxY`OUu<KJUdtw&Qe@e25R0@>fW5JTXp)?ebllWYlm~Gr
zE(J7#Q^eJ>$&y6NOx;rJu1#FGdVWhBSZkteGeFTM7h*}gmEjj@qyp+dCL-buhT|Hr
zj5cn;stZdlmn<xYSd9$QSiwq_kR69zV=trfam8i3VqQj~Nehl%Q*-p#B^uwTODz+f
z2s@*WQQxt=^#MM7iOI{K=IRUI;qp&!^5vJFWW89j?E(+(9-zY-7om3@!;p?@>iAgW
z{Wm<KiB+rrrfs^P5s?=}<g$qDBvZhL{kb975zX8Isa`#D5<GLS%q<L&nhA1WSCSBV
z=QuwdG3{NkhGiDR#<rWo5(s;p<ArI@#gR)c1xX<1^ld3d?hcsR7nj#6?&hO{G&HaL
z#v?}hLX>&dWNi~YGCNijDMzVXx~Y=3;>`EPHr%zn7`9w`j0?aso$%?Aa1dZy(tpzf
zO@sZ|9wW~KyIHPLr8mb0$+O2uVb_8f($uI2&4Gs`5k$$q$MkLynwEj$2e!XMvQ!Xq
z7@!W<7#iPg2|=X6DGi$;np7dNIvFzewn_#@_$qFOT-9T)1fS%GI0Q?urRcEwNc5q2
zdL;}6->80t4vV7KN{J0uw4^H=dmetFh8j*e2wZ+X&}f|7rtZ9iEE>HwKQd&iSSiSi
z#hNHhe_Pq`8>?7hi)E=cO9u&*yD{9e4y+A0M~umv>xQzw*BPw8leE>2oG|X}pCXLA
zRDe2lFtu;*jCywCigV!sJG&k8d$+my*1LS`cmFdk^^wQ-@A1Zi8J~XTMb2-Jd3bcf
z^)tK729J*)AJ_gr<%LGib)*io-w=_niO8o#<arXEaJxdwvno-KXaObNfP__0b1fuk
zVPVq3A|`L`I#=x|Z1)}KCnLm3+H|ohb)=vQy`-VLHVNR#vE%xrXS+)Sv&+e^qEU&N
z#nTu2t_Zv0SSF<`{g|XpksOf7$sb8A5RTM$cCmAa!2O^ssZq=f_X+vm4WM2i<EHsx
zgS!{_T<<v72@fJXWt+&G0d5B6fer8LD6jO6H-mDq6E3-|`K4Nx9Va}~2~$<3l0Z7U
zMuH02T4(IkV2P)oG3EB9q6Rafkr>M`D$)Qp=(IVSg~r`r?1emBr6gcu$t6${V<i37
zwpUmB&hl0p>k%rNPd6rzc?>>%@*z~Km(S5)5bF^VlN~e+=&)*%W})h+xvD)M+U)m}
zhHj{G1F`ZPGAEa&_D8CWQ5<6}BqujZ<j{>OE&fT^2%D8*+}g(^*1Az?76svybu5Q2
zifoa#WrrAaJ{^to&+SAQiPEF=ouuQlb4>e=iE~W))FZgn36nlOx%N)E_R<UVCwDk_
z<7eDI8u+X4y~b!g<JZ3QX?}L=5v%!{`Etqe@r>X5FaJKTzwr*M)#~HH`~TCq&;c)s
z$hTGXYa;R~Rejcm?lk*yH#gn%)E9GGEotb^ye~s{X>gl`F<jTS=>~-}<BqeF-U1O~
z$F;2KR&6)8*^b5W!ldKLQBP;rF)>F%9=Pd|s*OZa^)71pBxV?=P@U3?W30lC2)j-=
zBEiPj7Ep*%qqO<u6s=^kZL!G}LeKY(XFK80U^P+TAST<_6yYGkJ$qwG{EE~TaYT|F
z77ACLu-yq=pB&I5d*SY&Tokw{aMlUq%x1_3OG}%@*xqck0k&vyHK;ewZmvZRtz3W&
zMhcHXGe$9zEMwXx(4?f+ie=3FuVPwm%z&Dh5*-?RaxMg)__#4`xoV6C^`;Gb8;&8@
zv$w~!bWn?{Wg?ixKr<Peq1$?Fs~@&(udzK&RVP4=ZJR}`T0qR}n}%+Y4jP?Utk6=W
zQr9XM#LN?U8>jxd?KUh8wT*Uwx2a*IlxIr*HEhx7Md>?xQW9b8gh>aJF8Oh{`t)_S
z)eBpF$5!tccf$6#<Lc8F*@|=g(IX^AZrpp!i`SmuOaJ*l<i_i-^V6H}bG%qX*YmIc
z>TfunFZt5-r$5$s|F-|L_%A@Os?P)8vdZ;Os_L^Mavqr2p{+p6GoXCPNi=I8U0T!c
ziO+DGSX~RY$p+gl&rN%#ohuEuYf|gPT667=lxp=T!oCxp9rx^YVsG@W)LDxK4IGrA
zTN}00<9Tl_4Py}wwZ<B?RGSzDOq65e)(#5yyjm<+8tt^UIh-!T%-&s8c@W?bYcN)L
z$ADH*;l4!Hwjqlh$Q0#)4PYW1i*guYOO;7X2N2hFj8qwAxQeFo%-)V~2PlVzqD)&)
zELZf>ctEqcHXUKvE~Xm?v-I<N1s@_#HPybDED)OwSj^|E&Co5FMxVCYU|Veh)@X4l
z#OwqJwInjP0T;HeW?fg)Kk+5jTYJ)K0c3iYHSIau#d2drE^E~4+0E@2CEgoi)m;Ug
zSXW!#q|0!$4Or@*Z)pN9apcNqP-{D>U2S4gMmhxM&`lY*($?^#Jw92y^BYKdEvP;5
zRqlhc?KdK(x%QGQV<VUP`zDg4g{=;@dYE=;Adh=tXWVmP+S5I}#q`;8Y&~<Cz8Ahc
z1h!f8m;cNEz~lS(n0AiX8`^T*qj=tb_~_%o`?t9lVp@lKQseKpjHCMr;F^eBz`*5*
z8C4Wf8@f6Eo4ut=A5uevkLJyd6>y`qskU>%`RRy}6V{R*i?g)g&8KVlY6c4>Tpl@|
z8TE`T&fA$yrn7XJ7$Lv2N}gh1&&NVZSAUNrqc~|x6-jon-cmcxf(mnu9NIA}2piHu
zrig{cnw0|+dD)Am1K$p2CK5Yz+3O^j?%TC+8vC{b&WiHciQ~<6WKV>7jCd9HI!T__
z&Y{xP#GNXW2)n>o(-7{=o)=?vF(4KJE|xEQ>eehX)UZJQ@9nY`%z)*=;NN-6ZCShN
z52FR%#FG9>(PE>F1^d3(B*1dAECj?ybZ9Hula8#WJd~qauI<U-8$8ZP9V%vnlQs%m
z6J}{(WBi8PsTS)aySW|mn@N5XZvp0&Q<p7XQgqeIV<`FQQ~X^i2hZ{}0>zCZlD=+>
zew*7o@}girR$x0eu~i+;)sTmjgeJHs^qn$sDZtZ<FzOszrt5C?u-y#by)j(bc3gb&
z3cFwZ9hg0U@B9IuKf8mw{3`$C_y3T?$0uy{7928M>!f!a%oZOH-j8xG*ruDg3%_YY
z_mjXgq!88EHeG8Iu`i>b3^7{&lQ2Xr4G|euo{ng0m_{i_w5?u>o}0@iQ^%JSIC(B%
z9L!gEb<}aW?+VyiGAq|fT{!GZe=4vq3E;i5kit}id6e?>+*!T)%7*P&Q_*B+@<7zI
zWrlpS&URHB<ROQzZ0TFqmmM*tEj?1Bn%;)K*p?HWrNLC#5@n*1wPoC$S=V|??m1N+
z50R%P9rMAn?Hrwxay5sx*US!RCZ~9!u^8$fQtPSBN3WQ%e!7_|(+!?(tjV=f+0!Iq
z^RccpPiSG;MsE&?oGvrFRxX%~(e&PsoeD7>@ic+WohHw&hG@X^b&?{?YNqCH$RCqi
zeRHQ<v3zkVppXkK#fECE5n63L*KHCjdvGhfqP4HIeqa4ax}((eL)Cz5XJlCtPWytZ
z5VCnhD{FUb%;5wh?%A7!IeoHQp)Uhh8F!JXOM32B=h*2wc6!HF@0fPN-pDZ?2@+T6
z>;Y~h?0o*$+1);i+kJ{_KYo{=zIzw%2ci>vFN7#~b&U069`8qLx}=uyS4HGos`^Dz
z1Mt;6bn{nRS#~oVBbwn`QsvHU2&sTFxBX^~QB$o<Fq_l%$Z=*mvPXYqt+8C;2OGNH
zwp=fc9S6^kdv;xVtje1}IrZx1*R_bS#N-dtU5A)7(Y)18t;qo!_7ST~mt@=02=_HI
zs}FG|E##=JEpt*gcrk>ew~jI|@NAzRBVO~VC^G#KrbotT!G?jzvo3+$Uk~Z?VV7rz
z@Y)c#CPMGvU>(>p6TFnaKiif>@LoBIT6n+9VlC5+R9bNtG{ag|Yi&;<l$pOc#yVf3
zo@xfJfr|17U%hOWI19BJ$KDcD^AL?h4K)cTX#<VU90##&iwKBmy1A~Mm=kNh9RG?e
z5wz&0g?FH*ikh^kCeM%a&6`>M*tj_vo2YL|^u^|5RGML1Wrhz;;k+5Eb+x4xz38?y
ze(ZLjtNty#UV9B>X(^{NTdBf1rNhx9Y>BYnckE3ZdlSdGNypBpXWVsc^}?igY>zrb
z9LwVa;{Bh|J#hiq-hnXZga7Tn<?c^@#KghY*rjDD2<r|;L0QYk0g8_bM|8I7ew#!X
z`vh<mIH#)P#9Kg0^DiX3Sd8X%Rn|V0PtMG}kQ*Xanp+~U>v|IC_s4zW<HlI=jhZ)I
zwPBV%{%j{)A9qa5!sTomERRj6^XS>)W5bYAjqX@$vXe=+VyQ9~W!oiPH>cH-grST`
zb>u!DRmwrlHeXB2WutgH07?yZsPZsaTCQ}+Db>E22>xns6i;<<A*R}%pvqMdE{}x2
zUJ2KG;k*-$ePpjskPkEf03ZNKL_t)`=*nD)6N$ib2pmRu-z#@jIW}oW8*E{0hi-8s
zR7s)m8O*=Ssi9l8(1t9wkzC72%$zKXo0oaD!<w4Dt1%LM_UWcU8*_q975rc>htxcQ
z4)*&ocuuKe_jL#x{JgY6WII=^k>DJn5UX2n+k;ix?zFu3HXHKBK`oML4V48!!}is3
zKM-YOJ66;5&EQ-C=^F$xIrZ9=%4ujj+d@66sc1=M77u$4aX4d=Aaos^nK+)?oAAtD
z&-v{UXLd%M-5N6*bqrn!0Y;s$J?Yt*j2Lfir9<>|A36IR+<gmOE!mrNoSF8ld}JM9
z+{4(z*zxh;{fMF4n`P`9s``bz>8k2E5gA+jHv`5D)&f3eGFH-W^Uz&JOQV%gL@q{5
zL+b3PXM5aPg?icyec5uYuu;;_aUwi5ay&KalUA#B=(=2+o&yqW#&1(|tJD~<NfHy1
z_BnO62rzpkJE_{Ov+Z_70*j1*edma(+_yp5K0%Tz(oK{0=GO2k+ziRR;hLCf-V#SB
zW3#Z$ENrr8`=AJnG_v%<MS)pJ+U|}htDuZVogJql^o~VPZUyB*RPI=k?IhM=?`$KB
znv#JD{$=Hort_kkdTnMmL``yndM$q7P3U>mgk2ueF>`dyjSylPk{IYF9nj1|7PLqN
z8WQ#~S;{m~$AZzv%3!UXYGsoz{9Y}M!3E8D%2SKB?A(Tx+uFcBv`Mz#r%jEy#ehXO
zK33aQSvw>*N~P-2tp0!X>z2l0X%}B<_zX046Luih7TVuvyOQjX&ZN7oUbwp3^YtgE
zeCnA!&Rm$VwKrww!WBa7czkfce7-_rWI7o!nU2`K_6+^G9dtN^xQ4!G`|LLRJ7adH
zBeqt7#SoH=(Lo<l0O^-{@Sf^MbEMYaZv$VpP4`*gtcZ;3jIPnyG<2ik4oSQPt687>
zr0XsXY?ISd-o8-IjC;1mj+G7Fp!I;3wOntGfKG&~<DSbSSGEEvAqQz7AI-Kabz3b-
zG?gSB*pS|mq~Z4Y(54MZNu@X`6y-Q5j}(s0ZP3{x_o8{S>oje}N(wM|YD(-L!qN_D
zSYt1ZHa9kXCqdNHFk6an*$JbVetd#sEXs>rD#F}%$&;K?fl743QG}ya+HUVfcoY*Q
z?I0?P5@D^uhz(icqW})tmP2TLBMX?@pgv`*QifakxZJ6hE7GI4whGg34L+_-p`@C2
zTabwsc0lv-%^Swiyt_F~7wWH(oDH#VyXEJc+EzEH8O^q9V40%5P`$C4#|xWG+){I1
z%FiSn@U-T|%BMIDQ5R_xTiwJs)_7VP$f_HAujbEJQ^&bE);4S@n|Rg&MI0g#hb!pE
ztxkCE%!n_%dWDyM>pwxx@1wK#kjtM3AK1PB8ezS{&yJEWetQqMvkjMCO-}~1J8<|j
z##f$YJiftJ7nwL1JIBZcOU0!nqW^f)P4WWpJn(H*{fb$}u8PQ6({xV_-83A1)WVUS
z`@n1+na5B(x+|k$C5)q5znQSV)ide4lr%HMV@nnbV%!Bu5Sr(wJ!d;-J!ehBZ##75
z)V8bDnC|RbW0ZXxoU43jw=cR#(o!=y$=hHWfX7DtTIITVRqj!%bb{voHe(|cp<KD_
zgv%mqhtxE&-z66ATOl?4k{uW3#OO3_;uC>$qD)<KBBbgdDac5dBg37e^MO@V9u3M{
z9v*2dMU}^@9BO*%s0u@lpQa7Ik4B4YAEULFPfBPa!1kt4o`&t;W3H&tjVJZ=<KoNq
z88<4_vn-J}&NO6Qw8NPy!CRG&S`fl)W0_8->WM?NL)?H47MutH9oDFNGf)TcLvyLJ
z;B|ovH%YOL^0JL2`KDe=s|}Ysn`!pV)vP_DHBG~+6~ZGM`m9!<4Q+RD`zhr^!<WMT
zqJccs8m($mPm-2w@TQZUY<JwTdww6e@(j9r2D&*+wotc%y<PgfPtcEdV3@(=Jh(Bq
zF{&Qvdi3!J_`{zf(KG2fc6TPsedK7B58uD!bg~i)RTWizPDH*%!aBYJTosY?r!?KN
z>H3%q^-B8o+y_pEoJKR}LQ_KNZQB*+*q`={J6BMQxev{oM=@`?(Si!s#~pi}BV=j8
z-t|9f({;_3>rA8VEgJ0X3;aa2K+!R<`qchR*7nbB5f&(OlSWdat`g5ObSBq;dD1~H
zm`sxU-4-g`R%Kh#zwZLq1TJ?lvG(A(1sV_-Y4TI<2%JUP7RQ7X)f|%^)m-0O{y!$u
zy}3x1z`G%E+nB}q_dk#6&p02(oW(VjieZfQKZ*5m)!9JIHz~CrFUP7pJc1Q}=0!K=
zfP@|5att`ef^5tKGY2Kqnji{^EVFc@mNZ%ho~w_@5KwP}mq^GuZ^$@CZ=s2NXiM99
zd%LQrwVEW`JcKp>)V3YCHhrW6X55_7nfg`agSM)@a&PPMe7Z^a!-p|8K291y4<FKd
zKh#Dn*~^=6A+CgnN|?e9w*lp32%H=p!=pRM&K}zDfsBytvoIQ`s-J!zq=)q(NC*8E
z=o(IL086%C`YdPPxx>Mu8P9+DYrOmR4Icf~j~J~fp_^aI!J8cnHhiB3zLCQbt$X3a
zLszZbHT~rdQJMLW7`h=f052nH=!R$mD3OVrbL>t>j7N@j-k8lA=CftYHcjk^_S~pv
zt4odnXEv;ywkcV4D)`2!(%V)zveDozy1O)EdC=;hbOy3n+A=UQXTgyLBZ3XtRTF+_
zA?Cq6#l9)fT-$Ll^Mhw5E98gBH&&6ezy+u2pOT1XQztw$D%*JnPuLsJxU*i4T%aXQ
z&zfzZKEhFmJc_l}Xho_=@)`3-WTM!nlUs(BnQ6SVTCFy<J?7J`(DKH;kUhHgs4tBb
zEfL774XgwsVyH4gBOw$<f)9<h8;~I)Lkdw4LgF;!*f3gPIWce1788!41{1P;QD>Qc
z$PSi|UfC}urJ6l%4BuK`Z|ZA?)3l#|qpb2&6GRixph=bKhJCCa;5Hh4J^~SmH0}ne
zcAiFUD+@^;#IErjy8`wX1`oH6*1U1^5$AsJ*PI<@^cT)SoT0IYeu}Igp~vq*Si$@*
z_&Mx7i=6ue=oV4;VEZy#=P$9hdz+`PU*-H$m$`lGHh#RzpZ@So)Qx}nBEwB7C8~M_
z_zmEzR@;+fz+<x8<Rdm+NSorxV4H5PUbjtm5vzM)h|oF5-d4|O<ZLJ@Uc@@k@)1gk
zANFGJcz)b7>7>MZ-G?{}7}O(KzNU%|mh4GPC66a2S!920`}G<n4bi~{(vBoz(~(l*
z$sW@2kJ`_escFfFEEaX9kkS?^EJ%ZQX&e07Qfe#U1b74-Ti@9(!c)Ctq{<ZsPj@Me
zH|-p*b6Hoh_^K2}u#oiGwecJtX1W_G5$HveXE(x*3Re-%m^OTt^yeie84bA&qy?Sl
zW0_g7GRja|jH5>T*xI6y{=FW&^3Wx!>ASfZH*dVL3}=nW&&w*JL*_3e=^!8IR8zD#
zQ^_i+%mC@Jv18>%VZTnfuGX)sn^EC>)G8likLe`<vf;UHc*HGm{8YV9ML0H6hQxY|
zQ$FNWsFyP>Lp3#A@FAvyQU|XzmbetA$W_w@ekzapDNNLvg|f3Z_&)PhhJko^kLmn?
zol95f&R#<L9mI{`_y&6Kuh9oL(A7YkA0c6lOwR%^|G}T|{vZ8Q-ucN5Zr?xV=+Pl=
z|03OL#!H|1EFZk{HsAc(7k{}n-d5KIo&>%@0-1k`R7!a<w?=G)BkaYQH{E4aW`l3!
z1!ZYvl*`CQ8m;ey?P-teJ62^&loEu<I_Y5VzE?($XL{o;80gvAdMoBI=p}()dfRrL
z9f{UfSeZGt8Bn8ade<Y>Wge}vea}AEI%<K2dvbwaL8O@On?fGht+3V%Lr>fBinMjk
zZ2$&41n%3LMlhe|V-;q=i74-_0_P<S-JPgR#ukXsicyh`zeCx$sK-cov5oW7geGS0
zunJs=@Y!i^E{1emeC*(+EoS)*F*X%E+E~wWK&EWPgv#-4ZLB#>7Jc#RV(eQjX*IKo
zc`X469kNGPO}}lo;#h}ntf{opI-L0snrht(GuKc+#87NvRXc4gW3fG`(LiQm-B^ol
zr8$Zkv!Nce@~>6XX8BF3+QRCmkVayVO>^$X$EddTKGJNp$v&y4w(9a4Z?^c{7F`$(
zIXb?fT}S3Yc>8FLI)@wGVeit9xOnAN7<rf-psNLO?g=MLWHQF#(D?#Axedd>@^Hq3
zhjSi0UT`q?y#2k`IQi4>G1CddpZ<_h-|@r~=YDwx@2O+jMc^y8>Hdmsx)()cLIvIw
zS;|`sSV_!<6CY9{Ek@=;WT9youS2$srQy|ej_v7)Zqy}LLypjz3&LBn-K)|$;o7+4
z*-=*>g}d@Nl)hNT0wXHcF=#%5CH*zO*NbSavObkyqZ}McLXRCAst<!bdfS(L3nmYm
znF|TdljV}Zkd(nBg}DvfmDXdGraxRh(+jtQ@>4GcwMmDxk;244)4jcEMXhFJv1`9L
zdnmORj2cO;7ua{ouD#HlBpKnJR~|0|vw7fHm4_klshttq&ap;WIAs(AbKpo*&?0NT
zs+$M38eXlbwV0)aSe+7i1J%OdHSN~YXgL-fy#dR$rH{p8Ez?kkti(Vhecsd<QB!Ez
z4B*_Gwh@kqiuzUhKGSw9_$GIrnZDb0hoT!YZw*Y;5N~@RgY0ciL4^ca%1F!xtdk`P
zX~V#j;VvK2Zq<S~&0(#$b!sJiyEvDFUG+rR5lt$9C*x7GW4%!LBJ)AGKO4ArGVu7p
z31{zoK(~5~E*}scy^p{9K7Q%p!g(BH#@m;0XI>$`{U<CR9WYxCEQZL+M^@^XG3IbJ
z@OT+m1m&;)yZ`BzWAL6Dx@Ul2Rn;$x$gimC^CD6xW5zL1(d0t(=F^R8MU;cL!JCkd
zsWk%D8dC$XZBAX+u{|B(Mjb1y7O||4diyK)w!vN<bzJQo7o8(mjm<<7XEwiUZ&@1R
zC~EQg#)4ovMKaGVzAYA&Oo6I}j$5K^OVU@5GLu#s#sYZ|<^)=9htNVs%W1qt;RIKP
zL)#uKz?KNRMh_cFs#QM&yxch!F%5+wrro4kyn<E2yEJ@bD5(&!KCH7La#di}rFir@
z2;JIqXA#&@<)VYBS%!A@rtAnzmTNBh$QenpLtk)^G)&#flhvrWkXoTrQY5FsjP2%)
zW`=FE`3PtOG%*!oDW{a!YP{y(rAiNZJ67}c#!zi%wdOr;9LZ`t*|y$t9c-ewAMz`-
zExt|cy7`|HHyFDabne>54#}1=*|34t1wc0>gaqYb<FHofV{C4(o&A^@={Gj!97HKU
zH(S$;$fp91Sjt+RG}y@o8yPhgc>g*m_f8@=-n&Qt7k|i^%V*fSbdfkef!(JV;*xuR
z{;zO;;E7j1&E9wmH`-z)6HXR^*~+u@k##OVO^=xbO-a^Y_`!RsJz_^yKPMtt(|z9R
zdMes64_y&_h_>k_aQU(K%!lOFT?Er~Lqa+ZB!<91+H`lOJ^jd)?^8QIc^i6p`<*!9
z>bT?SQO5{nq{&>JTNp;!{$(&2FG)9z4bxUOZ0S<K;~PWQ@QV3tF)F%OaxG*TB%a!G
zV+lh@4RvVp*sf!;gk_Gfw+*~B08nXU2SNFs3fDW~#SYHe(Egb!4@G$|L}q5)dd|Ta
zA8;X*gHG=xwfh>Wszh=}W1K|BVc=4i-f+gFp1~{2IPfmY;NaD*j?oZUtYeZ@y5!&N
zG}5W!G~$fE8?*tM8$Z`&w}R=t>YGGcaXX}+n~N=Txg>?T&>YX2>T}KAX+CSZT4jk)
z0Xk{e<~Cr92j>RhG8{vpgn=dwucbQL#9Ah=)xgB&p{-d$%i&8ms-dLd90jE|uv>7#
zl403eCfbH4PT%(O(2Ye>YOiD^^rOutZhR7&L|VZzv_DTs9I{O6%kg1pnu|rs?{nOB
zY>g6s_jriBad*aYaf6riS*~6C1S(q`9~^S$z1!S*|1lkr#rkh}YW9Gwm%hlOxo|jJ
zGhYW*KCt$Ib%+cxGHAeu)O6DSqHns5ZEOO3n$(l_ISWf%QPph`adkdfDP=b0D=b3f
z$onKO<e?iH%b1}ZhuFvqeP>s7JMw6j7_?Z`cbxF-q~lWW7^6(Z0uGuIT%833f*q+!
z<W;Jdu_?H&aro9%qqSOHMT@3;!6ohbet?6hHgu)vxvD0EWU|t!V$Hd2w+pn?_9U=O
zl0I_SU}9;s-qK<xHmq+N!7bMq{Uj(`q*jT05m*IY>XWnKB*gS*L%^w&3ZV{VL?EiN
z2<g}tR-Q9k&Kfq7-rJLGtjB|Lz6)GfuJOHNK6oDa$Vp6Zu*ra+<)|hlIbnKXPPT<=
z+l#SnkqC9WjiFTZXepu$O*o=fz2lP;A-N}FNu$LWiDoS;^*@=>p!V(30$dMoiKCmr
zJGq6gNf+cTd&9k@t;kSZ0@*^Q=tsWBa-vKqV6ifg%f>3Y(fSUXLp&ExO1_%X9OUv&
zTij&QEF7CQHrL1&Qf!xHp)H%PGm2SuZ#c6to*8#s-yiYJ{)D})5gH@Y&f_LqbUXVj
zAKvHjy?ea==YPrF_dbAbf^!{*^MKb|$UA?)&)zxU;cS&8$U#|#m<DhN_!#Zj`wN_0
zi*|4@2Scx_uUZ@MXI1q@5xHXWrrVGgN-1S5!H6S+-OPP*FU+H|^07Q(59S?peaF_;
z2r+q~aA++Qk%2P7F6%E(I-VS*NW=u#6=6$~**j~nv2icu%YJ#l(t7Dv+g7DLpyi>P
ziyWoyJwwC>XL2n>W8G#+B%1a-m~C!l8|uo2<-$NeD=V#z_PFT{hCWu<F%R*Y1gCkd
z@P3R|Ih3~Tk*4FIn!GUpho%o-5O7X7@M-ItTG(O;NxB(3VX|DJD7V+jVes@Ja%GiR
z4eu-?9m?|~$7~&Va}iki$XH-+x97dpz>Ohre^5@mGK5&YxS5lXB?sG7S{{RvtANt6
zEk<uY*18o!;_a6Hv}j1joL;M&u4Gq3G}nT91EDv%v0)r@LavrcQX<P)zEE!iyQIBb
zvq<V@FhMD918JEK+VF}`I}Tb?E;Xi$V>3k}l8NRSk-OO{eab7b;rVUw=63C_DK^W=
zi#E3lsUeA);n3<1Dqi@c@#YuH#5tbZ8}p5;XZge@Uts6bMOF{rWwd*S@nno!9dq!*
zx4CuW7E3?j+_Nw8=-zz}AD?ivNUo(2Jog_jI9Z1@czt9!M3!FD)*IAPs=weHuMJ%X
zydWZ91Adj%BymMmcWFA(u%R1m)Ab5-?>Sy4c=_B1+jJ>-$E;_rV?;W~_EwJ@CwU=Q
zh`?*pR%P6UT^qVDj2zphLybt=t~24EOcGOAYBXY4)#37CNmMpMpXDf>ZR@H{S+`Z~
zsPa%@Np8Fl8}QlIRvRzY7M>XFV74NK5|&wGwntNMZxj=hGYI=GX~qxLy4jjqoeQ1t
z`H|xwDsQX<%Tm>yUb9}6EtLC1`ZHN8-1jM@;53%{AZG()yLY^^irimEMkwzN>5Kd*
zz>_X%<!?phC+o;b5H3stJ1gb83(sAz+*?PEgVEb;%hgcB5_u5E?CIS&z_nF9#!|>z
zZVcvJ(9)+?$}2-1%o@xN7VYq6DK+f-wP_5_QQPcT$O*jkxhU?5q(2Yku|IE;c@Ap(
zh@XQ7A{$lA(k9PZN5jU|t#K?!8?0zM*y;uvX|?92Ha>@cqW#J(YVt$ntNHs3fvTH1
zj*PF$dasbTTvzIVB;!f#b+pyN(>pz%d*xZ4`|ZC+ckv1I@Lfbb%X_yt`pNg1&DU`D
zDL(m$&!EBcoj>|xPVOE+*D+hAz{`9cn6DF`VKJm4+g0$aL#)F${DKbNQ;5f>fiJ7-
zuK}-!$TPqh5$UTUk(widrlFgH5uW2!Nd0KOTE-S3L0R%6vX4sa96MWfNQ+rkkkY!4
zhvJ~=g7^Hm<67@HE5gLNf><=vP1$s_#c6IX0&mT`nJ20_456FX=-6z`S)+@#`Sv1o
zCK0UKrU-LK<kVUI?;A{NSdrR(m)2Vb>CGkD=Wwc=A%!8H5V+P0f3%J~G^ma=wLqN;
zyCR&}i^H3Ykq7h0HtkzPPS$DIodiWfO-=cjw+E&7@NgYD4zV0E*9JeosPKOt1zumJ
zCl#mgqgBK^cz3Ow_{hxuZj*jnnY*=dBD<?B-Ih~qcI?tvLlSA5ZNn0}iDnF0hRDRR
zI%GBEvdU^5)Al#e(%hPZm6SIwOO}Zw$3(F8Q$yKCW#fR=M07c2>0%>)-Ym4*{7^;I
zl%LXA!?Zy!YRgqFsK*B6B#n!q@D!wRBz(kXEK)*5I4Rn%n#7T9b$Q6P5=9P8xN4P1
zb~ER2oxo%Zx%O*t|EF}}El}nD{X-7?l;w^0cy#|hAKZJ$Y)D}G$8*oHT61``U=}6$
z`iJy{HCubuku-FNz!2guUV!3MLFFY8`KtA#eOg4GRn_z6)g>j<>d?)$vDw;lv<~T!
z!Js#bh`oC?rIZoW30vD^Mw8xjP$_7~A*a!7xa>LM3tK&}j61d^!83X%AL@#VB&WoJ
z+!2<Jav89mhi;J|vaV~Su&6D#Ppz6q8HsSYOP}MhwHfD@he1t7uwlP8*&wCQlo?Xw
zlb1WV<b+!>4c#4-^OCgOnUdJIBr2FMcu9(BeyPf>kmP_*je9!aAU829T<wG>JK+N#
zx$6_4XKnuI%)eNwG7phighxXfo~!(Ojj#-G&Ri2eSSknUi60l!*8ZL-$6lG+n`pLz
z#U@D`<7SP!7M^a^VspAnV&hD(|3w?Dn&pOU1uH){4d^tawaO6%Zqsb9+5{3BsE;(f
z-?TX=A25DhF_z^x)mXNQAC67%cni)^spK!E4A_Eo+?be^U(xa&3Y(!E+2RH#Iz!D1
zGr<PDI4otRWpH-F#<0z?_@dj|_fI?F%&6nJEx0%qR?#Jvh6t{~KsrffuxTheCcR^i
zHRm{H_xvvCfUai5gS#Bwyuq9A+~LOU1K#=BTim$u9_zJdy1UO}i1cyb?4`?WpF78c
z!xK)9j#)*R4UyfQZ5}TMmOgT3XN#TftzWFcd&)MpFCt%7)o+T(XUsNs(MV(Ez*;KU
z4U}>+c#d)+&Bv5V3yG(jLlSEX8pJ$wr+u<o+3~4h5N#-qNsYX(OnP3NbZJ1@rYe?(
z?F7Vz@G2U#+q|@DNt>uvYogV;klS%flW)n<8>-Sa+F(|$OP#P%cw`M2$-PjA?%F`;
z>zJ6hGnBbCW#q%)u5H2(Re3^SPbi=B1b7_bc1%GF*BocmToD7xag3Z1;nlw5QH;Dl
zq;}kirh>`|aLcDRAg{0r7EXytQ-5)1j1#!C^498s)hVTI_ng25QGT*k?w6xj<X5&j
zK67@=O&>Y&iZ_fR4Z9}hL8lc5S!9QeZ--KYlX(nimKiGVmKaQPvSI2&#Xn}7S<H<S
z!P<>;X=ZGgwT-TuwcZk*$juZnad~YBD@`|=ZdR_h1h!Iasjcz5@ylp)>}ogXEH|`U
zw0?wsY@vnh!EGBS+Ko03S%+4?tpn$3Gq9wRw=_V@!7ORF<IeHyB=U_jo`3k;U*xO5
z`e`2BzQw^Z;x`~uf>`rJ{%>5zz{zr8d2#~tV@9)w$ngQk@4d~@;R!cyKjQsIOJ*z2
zIwbZ=KbbOHu5f<E%b)oq7cX7r*88{k`fvZo_|=>n_YSyv=>oS7k6HT2Xf(!)`^AwO
zP9Yw*fzJS6GSb*{zy++FGUtHv(DhMSdmFlIpLn`MWF9<A({wXstVjvK*4BuA(xu~C
z)^yEQrB<zz(Th)yJI;(c9^@}<Ny82sx}9WNXnL$)ios)4n22!3!GoYIwQ(;r16NBM
zM01xewy?AfEL3^dQ}_wFo@Z$I3SNb!`G{AgU^7}*T6#hKM1>t9Pul_Gp{8iES1oom
zK}ys#58Y_U%M2#D<s<(rt~uv~S4JI=)`5lTzHeFO{YaIOreh=mC+lc0+4M#+3-<S?
zb_BFk+UIsU#?J9CkC%i9gh(HiUX_I=t<5(m$PCKS(*CRF)Y1|OuA6Y&sOc%kxEL&6
zY@7x2*~ZXzpaqN1Hd}F1?~}mjx&a%{Kyhug+5#uf`G;&3i)dKeFpg~C9ozI-G1*oS
zxo8tqD+4puX5m5=`*6xkvOuqj8dpO^Ht1y<(<ZBNQ%5e){*8l}jp0@za8^>Pn?pKp
z$T7kbW8ois^K*Rd3C|1P`Zi&9!2KWXaj*)!c{mUX6ekVtDq|~$tHA3ImmIDh@W%ZU
zUbuXg7oXVSLN{kvu2~O}#|uxe0@8I<X6r+S^}tK7Ji~>{Pw~C){g8vlCrm~?8q<^J
z+xHGwg@})l`^PiZ@fT3zjWKrSTKI|$-{(Z+302+7!?tQbY13T?<#_EmUi$*QIf;R#
zPh0NN{JMk2lHQtZj~GoyriW61-y(^o)!R@F2s`7Btx?C?hM`00GzADE%0dMnl09lo
zvW~6o*U2`Sc`j(Q)k3xEw&f*i8)e>2vJZFPr6bkD2!}Br(9)a5n%o8<<~~TEnuQ&?
zLfKRWZ%4R&lnbPd{Jtvlrf@Kpg-Hu{RU03(HW~fLF>*gBpBeYO*f}0);J~)iv*Nhe
zbv#^qRzdmN`3cJq`Lm@bM)=o{maHwn;x&PC)@JXzAn@KI@W2P0SI(fRF;;{_A9;T^
zFv~80K&fSqp%TW@oK$mc<)(^g3#d<j?%pD~AtJtdfAcU-Nwe(TO`KebRaS^iKiWnu
zy2Ki+$R|~8nvJD$5wNOuF}FBzZSIHW&w7K<5jGNN#h6(57md7dN(Vl@(Qb62g;Ob`
zIf0r003ZNKL_t(;v4YDSrqJrKwNM-4DzX%!$p%$QL$o3AnZsA=&o5qH8`@(heC5iN
z-~Q5dp1!<~d*zG78-K&+pWfz24;I{>d5#B@G+e{nu_(JnI2j`EpDa0Euetf~gu7SH
z@OQuUMfTi)|Ixe5)&uJy{atmP0}1%S<Hl2#>w&j!-r<AC3;yTd|ED~fEm?bbyquNS
zQu6fvf(+g)F#wG~a=(~u>YA#48Tf4W>VA}M3~TXS+0Z>2l211sTT--d;S*PPZI8FP
zL1Mh!Gu|FmE!2J=BT0V1036$6{8QtOv!kwv{+)e!cajF;o(PAQ4C{o#zzsHZ)jYgQ
ztwT3bZDJ)MW-q_e*Jy@vM*^OUB!bx5>|*PpJ*PC<vI#;gvZXF>s#Yr>fs3T3-y?*(
zR%MiV5v}<r+Rhdlr*Tfp<vxO7GvxhM;Jgc*(Nxj%Fhs6Td%mzU;-4RQj)U^r%rk_*
zi5<ZnX+j;Uy=i%rPL*@ES$$_2SPt+6%8Na`JawF#cKk3zzH4<l!K`AXx+gT6ZsTas
z(nQhN&AipEYb+aX)JPmG@Q{NOmK-YsHz&}nBP~e|Y}O1(LrBcJXkjWC6Ha6Csi@)g
zHJER=v$$ZJg0M9p_nDpM?rP(R*~s61D1Npvi$BC4mS&-rNEzWd!0YU(D8;``N|4Ip
z$V0Gb%1!8@n8>tV+#JGoFI=2<ys*>ppML#SE?hZBnBT=YNB8XKxOn*wxiopeb}!5Z
z3u#2z9KiM%8I3P;w2mx>2=`{Z^xl0w@x++z(FkH>YdYq_{x)|GPFSo~gsA-Zt()Au
z`+&D^A29dI!GpsDnKI6E=3D2#wf+}n=-Rihh{%`BHujQ%aQ0QTYi(n>c6}X{<H2*Z
z@*JCc;lz8hjA`jgOa8lbbm}KPlkIUKbmf7YDPJd~$8(SJ<hbMMamUnE7>APDOt+0f
zzeHGAlC9Lyw3pVh(WXHh$voT=3@KsGkQ;uper%uSUZ`H$!G>>Q>x!{!ZOc^}#A7aZ
z6w}6(s{%U+AE@xi-oZynzhP{@-ymsQUYNgGs0Em)lschMz*x$GrgYi2r#)9tzU$#|
z?fH`sc{oHCG4fX@D`Va&K9~Vsg%}d^;f#TPmQi_cP!>LNN#L_%;aht>FI?DyNyl*i
zgtw2CS;)T!ZTzp<c9-I#c@Ss+Zt9q9DtHLRV;hHHn{$QQXv{}9H3maWkEu<}w|H=y
zh=OY4U~Tl$6iSGN%9aBYiOZ1)WU8Um=2-W<d0U(M_KyleH0{3CbEc<0TtAGJ+|Y?@
zxTh)@X5%8I1M_jrWhA2%fLJ}ONp`l$24`WzyA#u>J~!@o<!sNFE^qOr7cTJ9^H0FT
z_Za36>EHc6a`s8izVIsNUcXPgakGXj@=-58K^nM9V*2_Qdx||=tT_%H{n;luyT8wF
z|A6&mLchJo@L<Mr9f(f2cR1tz;W3ZrG1(GDh%u(O#Vk+eH(2E7d+?q<rm5=Zs4(-V
zRrQRBl%ZQ33^B3_aI#86_hbmn1{=CDZMrMt>JA|${9#nwsAIA_Nk~VtQ3)18h_yXp
zQ03C7<Aq7jw%dHi7lbLw6yd}I7{R{a0*yhuq3=g&%sUzCZSNx?1Nm&2<`k${*kG-~
z+>U-hv@}JmqiwlOWO!}El-w9>jS>#!n!uh2H)29CMoXpbi*VN7NIH`r76KCy_WQIs
z--+;nDu-CVSxma^*xoD_A@YL&E)Hy|@~jiqF;yo$hjMA+*zbhb<{niz+Y9%G<fV2_
zQtfk89tGvzkPcE$b;5N~zP{V>sV8?B?@n0^fioz3s&rB5YKEa~xhXBCR7`Gl5)ic1
zr(@EA8Z5m^46#ZMnSkhH?M@5naE37r64fhidSsi!R}1Qax*cc7L53lv=84cmexm`F
zw6t!ttq$ccxjles3!*u-EH_)P6#JE&N{^Kcr7>@f0G2m*amGwA#3|6Z>Z^59kImVG
zp0`|W+!Jb2*(eM=yEEo@uAk>CpMQZX&s|~sso!Gt-p@Grv)||afAYUFo^EmJ6QAX&
zi|25>n|$oj(jd}!??@QZap$bVR0$e6UPu1?wYSle$DDCJ7tieQgFBD8`{<ak_9@*O
zA}btyCnkGELW~Lj8mn7J^U|b0$H}#J=*Ac)s`?2L`I05nuBz&JjH_GT;Ov;Tig2>_
zJYIQD*2$|o3xS2#a!6YSt64XRL7iiJe?sh}^rGcdT8{DBYm74^#|zV*9s5h{D(abu
zDBET^n`?7?kQR4Gv)$H0NNxT-YSnV%#?Vb)<!6lZduX;XZ@}=u+!t$L87bV{Ts@?w
zBS(^+jl%Oz*cG@DBKPcLI!mTq6y*wVNfOMw13F0zT_rUqzo^0;ue|L83lXkOI(Af9
z4uKVLOB1#1Uo8_<WTZ(O+CdqkJfU5ZWk|#Rw=Zn-zu%qlZdAOF97Z^a$##Y+e`l}f
z6QhphY|X3Zri}L|s1MAJ7aR@g??2@jY}2&~7eh4TfmREd4c+Kl{%!K)26GIk&x1KO
z2uE`|Sn4kE7ETvUR>yy8YmOUmn)+Z`!vt#Ec=o*spngEZx@qRshS{Yb>0&5}w=73U
zbsVTPhc+6!f;vilud|q=%BFpc+E(FmDXVc3I!Uhu=Te+IvqBu^T%fuX>Vn-8cFpzU
zJy)h9zVO^Lyd+0_=K5ux{yV=*Cmz;w{QZZ#@y30=^WFguW&_WC_ifH~@EcdA{2zB#
z9IgVBLdsD(2N$M2*S34kPlQ>359Wafi^wnxymRvdw$}^3bZL?*yN1Agy=G)w@1W`H
z!MQH6O^m}Gn}c_gCq;gqlWPrwp$D#$Fpr-Wk?X2@Nkpc`)wSfTN>pKG0Q1Auz|jzx
z4}p`AxVj6UveiqA0B1IBMA+IJ6Gt6hqmjkxKnrHO@xZimJU8h%+q=dPo(5@08oEe=
zg$HUwuojC>V-?Fs3VWA~q6V>%TEZx#@7H`#OTW$>IJT`ekY$Cc<*w|2H@7V}zXkZL
z=NhT&1qZv5I?^7N?OYg38jKf#=LDYY9ebT))Ild5heP0Dh=!3=&O5j^PVY`<GAp8U
zMBu>?d1oDYN8!Gu<(z%dzUP&ntv%C|G%zJZe)_?T+p9n%^|I|+NF!+Ez{B^CJoJHY
zZaa2&$KZO7PmXx=aKY>A$b*n%kUW6YD$G;&WY%pdtZ>bY-RwlrNTh+x*p)klDKZP8
zN(*J%)mRv|xviqQ4J=nEjeU&TnvhE|MM4c%5RvFnze)pI8;|aWa@*L^3Qs{d`sFB(
z_gaAN(xkxJHwm;-y=nt+4Pj`mPH*swj<n@DmwWRPdCy687~~2bX^4ADu5eG#@~uwk
zbj24hZ}U69@j2fA{$FwY-c4rjyv;;b9KHS*y!FOS{`Bn!{N<fFw@wCl_lPfC+UD1u
z+~dD^ev3c6wczH7PnAFdJH6xOGb6tJ%s$tid5Xj1BYyDyecqc-c;@<bUVix{j(_+U
z@aPW9)lg<a254nG=+;Q<Q&P^(iB=h@Y3lg79K3CHkE&iaUH5Y~fG-2vIS#C(p{phr
z%+`U&^EJoo#MGUIHkp<lUsr~L%zbHF`xD%>w_-{u4u%XhkM=m%Imfk0&*gDf`%!Ik
zbtKxD!>m{KW2$W_y0l;0^?lMh*tEj3px_owZZMsA&k1KmxalJ^du<PvNL%KCo8!Os
z`;Y>}v3GC#dC!WlE$}lB2da(cru62@*ipFLJ1&fS#(kGQSBONE+p4?~l?O4!lt0;Z
zobQ#R5P7EW*q=-Y3KxTCdbHw72g~T_oN{*5v(-C(yc$@<$io4CG8@>{p5t|b+Pu`m
z^A27dI~J<^crDx%<!Fd>W5>1qo?-CZzV(P(^MUUyBCjnY2fnd@X$9X%tl*f~bg^Zd
zSMu6wW$l(qAWO03M4Q&FIhNX-rfs)S%kuINlW3%|1Q@g_#Z0<wPP!TO%PHa`aab9p
zOlwm_JA9>B4A>Bn8!1bgN*yVThIUia4<+0b{SfmZZ_A~oN^@8t*(FCJsoGp%B+eRC
zY}>WNbc*#h_X|xnvh&jszj9&BmtVZXl`Bth_pLYim;dZv@Uwfzyu90S?;rmorW42Q
z!((2%KjUv6EO`HTVCB;h^-u21dG73l-}|qBkI((&C;a38`$zor;hdF+Gb7>CS9bZz
zfAmexfBkn@A06=G>)+w=(G0o?tJ^mj#bfTRR@^;VF&hG%B|5WJvOGnI7Q0-1?bd(K
zj-USLb?DmvodrH`+U|=Y@)WQyBK>Ix!#XIlA@FG7Im|<M@XSL>FD<RQXNWl^l^qOY
zy6us18MGwPf;BT_{Gvm6a@=uk(xopvZCihZiBrzG^u@Oh$+=Mcks{?N5jW+w@-(;6
zI4-H@ENe!&?@U!$!~`Ngu`SnI|JXv6m8H)X=4{BnNV1YOwl5W)6lGuFEuVrCs+D2t
zGLskBcEX;d0!cBO+bl$G`^cRL$CgwJz+Z-hV7#Q@)}EJ0Sj^tRbmBN0g&@jfA2}ug
z=l4-wopdb6k!O3ywaJ*Hwdcl6_~OnOH(PQ3+%8^~mmbd<?N0ge!3nbne>_CEKWDKH
z-1Ct)*O9wJ(%mp7M=;-A8xbx@NMk1y4{q`EW_?!^e>bE}ob01*JJ2-sjik$<4Qyfq
zjY)5OZPmGID4V#H`uEMD>QHpOMto)!w;o-o9cWZ=O|kQ~HR>Bx?`+z}K4f8_qP{e@
zQ&;Pm7W<dtG&vWXra{{yj2w&%ct3LKjeBG~<<6xjyEK4^NYcQ^4nB8zo4@~ef0LJ9
zy-s}a0T14Oi`PDQ$eWKncaI(Koh;evg<}uL>%iCv+r48kBxz*Q36GYM(VZXj)o*?S
ze=_HP{Il12`$Rc2?z#5ld7k){Pa@-hgaamv2dv(HlcU2EjvgH{Tdn!=!v$|0E(>QG
z>fu%M?>mN5hsU<d&O%Z@kF16~bX9e#s-FaYO+;QXCc_z39a$W)I2hJZnT5dNa^Pq^
zuo$dC!l&!^qHMbV4|Q+$Ygu}p_x;{)tv#LjoSKKOs;=(pdEn3_B@U8hQ?g{sjt~Js
zY#>PP0^j6cFbo99Rgl{x7jYCj0}M&Fq{td9(w0OvNj2HsWKY%ARb6w{sj4#%dsu6I
z-<ykXSl`}N0&*j=1)|yLGw!qZUhjIp_kEt<6G>x!Hfj1Louw`lBo$p74HEH~kKj}|
z(ltEYFTD{W9<{>%y5g5<n#f-*Lm{CZb$W4-%$rl!lkZHU%{Ss=o%-yxuJIP%T_+*+
z*Uxf?3Zp<9iz&lJc*8V7uN!B>jrzImF;UhnY{aRa__;2@kTDi7Q#&S6LE&g>-%0OS
z$4+pQH8HIrKzCe7viJ!wtQrQu1FKwa;?mB~cuVzUu_b{Itqn^I*sv9i^>aBo!qMd(
z{XvILAyjq6kM@SVQz<uV#kq!_gTlesIu2}zanCy4Sae;s$nr;tU;)-Pw#OyTLeTN5
z4KGp{GuXx-Gp$XFx75YPZIubfcnL2;qe*e#6)LWc=E;h2>skxe;U<vFlrSyTX&qPW
zOH&?NX7f#AKb_|1Paz`nL90v!Vyb5TUd`vbQTnApt>8PmQpBS{4Rj0fN|@3&A)Qc!
zi)abXZ1ZvCHs2{Y(t#x=bS}I~?Fu^1F<%;bg|OT;%+1fUvbxH9mv6FuFyYjo<kC`y
z0>{IlWwmR#uvju!K2CZ1MV>u#nU|NYu~jz=3g|UsbTUK^_u2WYZ}Zk){uK|3HI^?t
z&v!rk3$CwkvQv4`jfjL%Q~R9xYtZr4*I(eBYj@b#JqR3=b`CDuI!epGr6UFdoD-2R
zsp`wXg&;BQXDSDgAR8Oij@@z1?xf<dvg}7Ya2+IL34BA6jj1v8mj^T=DYi$0BEW_P
zl!hX_*b$x?bQlESjkIC7l<KXzim(wz18r1^*C9G>lOggQh|5L|8aTJmniP^t4&h`W
zoGyfSCmty7grxtS1m?mBuh1~bG!aw`F%3hN1*4n=HXPgyVV5$K`sz>?fM>#uXDm>v
zuv=RWohOoQC>)03TW3)@bufusv2Z__M)uXS6b@ahWsQ`pSO=#Pe;bdTyfz;4Mrn9{
z?3oEa8P@#exZ!5w2~dQ^S3Frb+vccQ>oU!5t7?duX(Zikod0TCXeE%i3%P4n1DByq
z5l#-ZOxfHvjG79!s!ftJk+#6bBaUPSG>s<@8>C|<r1iRts~{~fCkLEQ)5!9NrD?hL
z!~|lUF-El3jI^A}e~)BcZ-Jo@=SK_$bPMPkLr;`m0o}rcg6!c<rOez1!l|TN3X{5K
zYz4-LjMndRa4@7S;O9^D7>+B-xkcW1<BR<8)+0tcL$2*v8rS8*VwYh(MitJl_9^-c
z(4D6{m}jmG<BkGWj~+$mk5G+a>)}3E?(XodI}h0Yj~~!D8<vFAZoGJtF=4DSUnsA?
z_B`9WyOi~W!^W{YZm_jy@kXnN{B4@?MiqneuAF1Qmx0$s<RWl9%yqM6nut}eQrMl;
z?2KymE0<vAhm9|~!$y-8I0jTYV6fW96(+G4qOR3SG&XnzL$?r~?RQu$4Jy8gNg!qw
zIzdY_4xMFkbcNYhysO)|Yzu4!i2U3D0L%(~)XPR4t_mDDxD}YUHGYXUQlVC_6CM$d
zhosn^CWBAe(2-pPzB$+BcZW5VX0$13@sfR2K5x8oqGyC{6|RhZu9;If2-@7;810_L
z*+(JyL}4qs?J~&?afz5M;+vTIYuhl&kySns7+K3Fm0z^os~zighz<(6Tc3`Q&0;gn
zZVtg|!QgrNgyNbQbm_b~L8F|^FVEa0+zhlqX@YAkj1t_84py_Avpl{>^F^Oc@k5g4
zhc0vcS+t%IvSgAz)~QW5^p*ri7JvSv0-9^To}lfGs7IYyu;mJ~@H1UhB&Z<b!pv6b
zh|)3P)F+0%_-kfR2>qg<XT0OA6wf0u!PL+zgkIqhIip6|t>Dh>+bsQu|C5j2`G~jg
z>`*ile)Tv13x>7hfBBt1=FQ*wZ8i@p&oV*zbZ^X3XTYgJhX><^%bR0feD}L><zqhj
z^buDN9NVLYQv<`&kyZA8{FmJR!CQQI`yn4~*X)dIMomojZf{tTvPV!X4GQ7R+B_GR
zOSthaUwe9u_uZKFy&>xb=s_UqSr?wqza=`}TskHq3wW6M=kc7~lL3fR<O&8=VQiJX
zNyFBtX0Hk}-NyOoo-k&pf{`N4a8>Co50Gw=oM{>q3=!6yIu8-f^h(b33RELvuEpAw
zVPP<GUPBuj1Q!+%P9+rG$S??ty9|r!XoD#||JIl8+O=QT3zD$wjrxL%grXbl&T;DE
zpcYM|1*d+rfcXD@I{fTE9M;^nE`yo0t}}!3Y9X8uSTTmRZozlQ4YwVXVX-h)I8;vy
zYl4`(Nuvh;bDGe`+2Ci_gd7Z=DXs4yGICwuBt&V|zEiGQ<xY5f<HrBJE=M<JuCVxV
zXBFop2nk&Kdb&1S%~=~P#13^8>gohX*I*HDtRH72piYF-N9<wha^2LZz^ef4)JPzz
z8YJFvX;l;wLMz2Nv>toc8(9ocJmzP7<W?#(lUSJ)VNWnYOqE>C=B+Mkel=Nn<9H!1
zkNsdR>U0gI7+-u%=x&YBEro%B`BLbYLLZ@D_(Iz?24nmf;@Eu2>G_hLfjftePj@Od
zw)fdNy23}hj;lK()&>Lq<WIlFgM$foxAxet8-FtmPq|gNyffjo)joRA@Tb>zIJ?+k
zQta^U^@_X0hP_6q_7C{*KYg3+NyEE$4tOwXxV>L-*t7*UAE6gUSnC>=1|_P(yfpmg
zFMW=S$L5(Y4r#h8tVqR;dmFsBF{ZJOv9&Z-(n9iYMd8i#x}Csb_(GWLJ_W4CWtxbn
zh_7Z7>)5X>Tf>^YNu6k8hmB=iXIx$9ZLf_&;~ZwLi_CXD{5#GhCF*1Yj68s8j&uwc
z2OYm)koK5G2y*P<30-w~`Jxv+G7Vg0E`$YJWEr?Hxwpv%-0A_Hlkj-rxC71@590Zx
z(ZE^oMQ#)bXHF%^v)V!!(z#IaMf*6)q6#;i<Dm<-=G^`pj2kZ)I3KF<j>1P{$9s7c
zPSi0bi=;1>DV#Gz{)p<7bj@XiEe(!2>(n3dRg+49JpETg;3$&lV;*(j0>+?C*0os|
zs{tIYwoO^^MhCEAOyDt*4eA=7ERih40pn;x1W(gaTUr=*I3+mK7D2}pWG0f%(%2y+
z{R*yiCdLto7y5YxgRKK;%(ln7%zb8(miq}|J(|nYX1_w(>XO}X<*|uFYm$)M<(9j_
zh}~;gtc6*wA2kSr(*HAG_<yhVgtfUYiycE*z~WrV(-%%~;@L|e1CD=qnYpVsSQ?aU
z?~l2;J*EJLwesGrO|~cAu#h)uE<Er1A^YsV`^{hGcfS37{@{~sUOTnIZsW;hFD;k+
z+{rmM_J;hy)orfrRiHwp7FGW>E@<!!u-Yqm?r5J&M;GX-V=(A({>&<uo|@<6ul_d_
zU7_CF<mk}>uQV%+{?+fYHEh@#HyqS;dVHVh!ka4?oO2SSVqXSc2F?L%s@e;A><L$2
zJHHX%9#!m2Dh`{5kyVC`OGUQ|-R>kTfEuT`PC<9M?@bZT&vhN7Icka%R9Gm5OLJX%
zA{h|I_Z|h%Ax7hn$o^@g96&u0W|Go?HF9?~bzw0J%@-$0VUsT07)q4uwX&TQ3sI-*
zXS*8w@iC~<Nfz%DKHe8NA;PXITVeJg(ym|#Z{*Vko-_WKR2ahzRjyd?&~f32>z^-|
z7!p?6S+t8A{a{UQA46M6391ThLT9dCH4w)Hai-}a&e2AAP1LEHc6?wpg>FU`15wx>
z=bgcICNXZuMp{_o7iol|+k`x`pxO1V-{2Gr?laXkqpa;>+X(d7jC#d{Nq_Sc%qBR!
z68S91%(Sk+)oo$aSwmTNYEZI3NX<qZOlijBH@9*yopPa}`DRxi7db?_m$qZ9$jvo)
zwL&R|(iq?M8sGKy3t><g<~oM8Udg%T4i}Hlv$i^ip`tt2Vde90(7p8YsP;M2=^^zl
zA6(zykKX)%Tf0M61|=KA#wU6Q%f1OFq1Gj)H0s!{8_vJ<5}oh9!(Xj$^2}0?Uplc$
zM}$kKkMR0G`p@{i-})`ydvu2yley`_LO;AukI!{j>kF>z(|P_4Zd|!ce{YXxpPOUh
z>6a+hPGJ_0&^u%34N69T^8avlxx>f(lJ0@=MO+*zpYg(*DHy<8@xK_PV;5ERBrq=`
zCeC!h&ja@x$L6SJYgBnVaOK&nqsB3gFmvbA3hHp2t&K3ZGVpWV=u8W4G#fkaz{4$#
zaCT6#R+@0klC+5}!rZ3`MK|W474ZZar7}vO@<%zRhA_+!xQGvRjLuG{5nN8-L^xj@
z)kAg;0*k?_G7LcWC_Azty~2g!*GPN3)&R6n0z)^YuxPje_*}Ge0zY5C#ZJMl3YWt%
zzt(6V(X8M`TeJUMqwO3u0e8aJ+646utEh$$vz@VTT~<_VaGYf^>@IdYu^0vxOymGt
zn{~_DCQOKp^HcncG<LR8S8Lh;N=@SqhYb-tDWo<qaW$wGVplHVATDvy7q{9jC?Zlk
z6YU1gxfEa-#}Zms-kp{y6sByBGE)?%|KqWaRx}$MJk}k{|Ibq>h!gLki-o-PJ*26I
z357UH$$AB$@Cu8i;rLvKi>H=(=GEt!d;UvEQKNg;kOAnU_t3)w?A8tTh7Aw4hYTk*
zi=7fxn1pednS$qNJ9G{*&#QYC|NZ~)Kk=Y8?AFSaoe}@+nN?o;>euOCc!5Vh`WAO?
z-e=J3P)}@<ha#;*6qNanp<5c>zV(ndulzPeQLxtUGN|@B_r<TUvhg8m&mgOpVC^Xu
z)|NT4*rQu``+jMB!y%t#RYN}44P(p~fiH^4Gpc%8M3&-mPy*?~rDa;f_ON1q(lBhI
zY|LANCr!*t3q{vCYA1A-duXqq!Mm-j_$c*c!%YEu!jVqF`9X;diM>%VQmD`gZ{iV>
z+>|2OSS?1MXYMpj28l58kWAeW=wMCAtEvJ+SMh-LLi{}SFdU~xL9q}oD5pvjx?HC&
zb-V-?!z#)mu<jhgDe#V`V$CC*7Wi5zoH4?&UdiQA!<B$zjJ<vuE8sKHG;|-9Fk6iY
z$@s$8B*{?du-$Z)SsYRLg&HYXk|uCzLl^AQC))xZ%@N)=;M(HovT({UFZK_uL7K*Q
zze2z-1_N5-+o{-b$8kmy%sb6ME-uB*#2bbL1-(*)!Be&)h>trf9GaanB*wD`zHW<U
zbdPnOQJWIQ{8Jt4Ea+xNtNVE5ddBO`lYWysZi=cC9=)52)G4AVBItA_>^wR~=oVgM
zyF4g4w$$Oo#iv;O%HKg3&mhKvdj@*PVCNd{&L6Y;;2!1N0&o2Mm)URLX5--lUV80i
zKDu?6AAE9`5$#Em6i20rR9QK=TN##n1)EjHgJI3x%|l*0@f6*czsmTnze4JUuJMh4
zF>zdErd)lVscXEtp)4`RhYH*p8s7f*e~4WF9;d$k_vpNG9Qvzt*3Mw%9jeB9!xUc6
zjQNZ%*K(-2bIydOEW&S|3evG|=!7*wcE?uPo-}M8R_u;F{AO7Dh?sHXm;}CV<-DZH
z2Hmb1l$gbSm_vr+viNx_GmxhF(r|IUi&IIu)+na#NSm$36!4=BqI9zcB1uwEg490f
zYyH(^HO8|0qC5_ZJ_$DEu_#050@AT1rp2wcB`nXyyUEf<Kcqt(7jL-O&Qt_(rrX6E
zDSoLGUhWwBosyfC<<rJ<99)F2&?4`wW)b#jZX3oUu>%cX7rR!XT{k{vxw8ph001BW
zNkl<Z4WJq)K~5Hq?bb71y?!<n*jB~vKi6o|-g-T|OG!G!&eUadzy!64FH{Ve^xdut
zf1lIFp8!lqk}$5-`_bBfB@|r=5OHF+E-rmebE(%%G`nh>vnIC2)s=sYqSF}NyrO2*
zu{bVpGljPGpHC~qG^a0374xj3KXC!a6QmM4RR9zGCTMvJ5xPcL?UkHe>T+_a%jvZ)
z^Tj?|A0V9qZ6+{x+J}D{q0ug*tsQo^Eqm<ZCL;!A!HK8NbAR`cLhfQjAHQj6=6q9S
zyRw`d6bwpXb6oSIyZfB}cmI}?Kl&k`e)J*tN6M)2Ba1dM!;z)ju{&wP5>Ob1w_R;5
zH?~In`TO@UIQmCFU~Ty#X6+2RbcQ_!Y)&kV)s&{u`K-#xGA%B^67a<^*F6s$6OlnI
zZ87nA;v9RmpX+XqDh{hA1kQQN)yOK7CYU5t133t^FqEr<FkUcWw2=9&GrMjnaJFBt
zR2V-q4OqJ(wB!U8L|$}l=yr3tqnjd)wJOg#{EVm-CQ8{-5G5g?Qt1Wg$o0mL7Kn1S
zSoFdPAc~A)?Q+^4E{}+39NZ0gWt!`T184WC0$%DBEcg4qv#l)saDm%!5b!sJHX2B?
zWtoi{Xw87?u2o5hYv<XqgSA0*;AkaaxOTLljw$(<L^N&_a?|2W(rR*{q<9<~%@TpX
z;B3p*4aa;JI$0a^xz0xZLa>BJn7(tqtwR#XTwRv-5a*5Jp@T`;5Y%QG6crMA5w5+7
zU>jd_!wqCQIU+BTni0j~d_E7woN0N(=ckV4JYh0HMl^GeIV@VGOBgA%oo_tl1*U^(
zb?ruAp<{Szsmn{JmN;>Ao|Ut!%s=xYvh)<%T|<fij32`AKDv2}`q2aG(U{Fgd)(R>
zGO1y6V)@tq*YC2|xOTTW!vb<sP$_>c46WltujKY{!uK8xIe6;|M}BgZ^@-#1Uc+8p
z``4fd{d@N38kB?DvDA27F;xszRrV&9D_bK5pFCv#_%_F`{;w=A_IUJYn|H3<V{>FZ
zLNypg>}L^#J~LwI0x#g9=9hrew0vESBL?e~!!Xy~JgnKT8iv*}Y<#x;(8js0?{=Fo
zN3}p_r4OCLFReoN8JU?bZVbX)W~Ezjve%_iFkxv^0Q~?Lslp<x&~_0gv}}^tJ=@Is
ztD2`pw6oc0$!)?&ASOa6P^fowEf$7rjhDh{mJ|_XXinOrJlZ<cM4=~M{JgKqJ}vJd
z9(S$!dG*uAFkg01NNF4{>vnBKJ<={TQuH}(r`yWcLKo>;Cyz^<T^INWek?-J;EE-E
zPb{<vXyL-owyo2PnLtR05-|;q&Mf&ifl}j$!OvH1<0WNr78_@nEq!bnujqj_8UG-v
zC^A=Ca-L<W!Gw9T<|7Ad{aiOBPH4^~SC`FZr)RyIhfnHkYdX~~KZZeX5sx{6z5Sb}
z8tshjfRQv$pPChCNy7258HD+c;mlH(XI^=kg%@APOzvTx`XV~Fid38aagNt<_ufK>
z4Yru0o_K}9px0%u_Rht|lsNG%ibNi97(Q#}rVCqQ6nHeYys<W5yS99KQ1M{Y&?^j$
z`rw0(F}!$cnd7U={MFSv95j}WXac&{4h|Z}YR@oN7!K>epLP~Eas24+KDU1VyBwM8
zael4GskshXSGceg?ic|lxZ*QbcxU*!0-Oyah8I-ztca`v-H<lnCk*Oyw>Br1tx?79
zq+%HDz_n|Wfm2?Z_vbebWT6Z5E!5nF!Wol#MKax;2p8r$n4r5A5jw#RT&qxpPTi=a
z&*y`)6y-&$&5g35s9u;vK0|o>R-x#o)QF&sJ#U1sbPIlOWLbBPG8DYng{0q+b&}Bp
zQidzzXwVXF1$S92SekVT#|k*rDVPY{Ih?TTluxa)n>tyCZB16KS|BnlRHrbOHY>X6
zu{l3ycT+RotT<*eGT-sa)N#RST%NfMIgl0Ka7VMYU8=S8l3?l8wu_FDJ=QgeKql#i
z6viDkEB>MCh=wslB$>H9qfC?PAc5CoF=pmwVI5jGq0!AV*JjLQ+M))dEG=C-Iomg{
z!m2Zd;B3|$<9w!~D4yI3%M&DOj~Dp(X+ILuaIFeZ8bi5!jPmSD=<Wb|D~N<rR4zfk
zK^891JouR5ojZ&x-@=?YwnkkJSwGmyf&gZwAmI;kIruG*({?M%PTlZdf8iomcE-GO
z>j6%MYTR&oP_oc1_~z#>@zR&S!sY+*e`b4ZDLQ3nvVwNJavbZItn^9_n<|a%#*L$~
zp5J@(!1CV1AzwSQz}fi@7Z$pFx>xzcZR3AZ`57KDEQC(?WqfYhQD6{0pHvKE>)5Fq
zw#OA)!-`=Qy4)tn$E;_(R)ILygjuQU6!g{xVcQ?1R`HD~wBVX>R5>+QGGF?s&wQYE
zAu!1tXYCkH((y|(#%=3cY71`c3hPW(ra_fZg(#j{+pj6b(1`MG?br?%Z#?qHg;mlC
z$2t%@<*-!gqO6J!z1&N)SpU5yeEmR#r$rbkyfw0X(pVZ`&-ubz2Ya=nom)onx=r16
zYcp<UWMfhCWuuih#_A|jg_)>e2*(78^V%@FXp+4*Z{xBk_8fm3$%}EOYW?yqM)+tj
zL%0~rGsCYXBm&E9Xr#1J>(Qi<05`4QH%lIFyWu30Q}yY<)g;)Bd8|mb9Wzt2*Xc=w
zX0o;?7v8*MHrYb;F-60Zd>GOe>}d;I{Jf-K)2Km@x0hNyIqv>`#rluG&+(nx%)j^|
z((l1!3zpA;>>!7?(Vbh^om*fhn4+NDEja!1tH^^bKED5!M``3I$7yUt8_Jx?j2j0x
z4r@-o_$n6*<?rrn@?d|=zxj_p;L*f!eZOY-mv6Ii^C~OzeeNGrZ6XX_mpp1L6YF?t
zv4g>}J@Mm?CY+$1QwnVuS>Y#-hWx_WIllSgX}<OGeQxiMaTp49pUrspfBw(^c}GNE
z0e(?cUlWn@s=6j39gRfuptaqu9FN8|5B4YQ9oCE*%VFck43oysbu0C7l*R?kE>Iqw
zgMNqTsCTAS7EE~|5f;jlXBN8@;(_4L7lz};_}OU4h?2l#(9kkCA-(x*mRT0T>9Hg9
zap(TPR3ic5=ry_H(1}mfN9k0+=Q@UqrQzF?hIQw`HC}C+Ew6&~EblnW$YcpIIVZ%k
zZ?~N$ENtSj0xuikg~D(P;d`}ZQ(-UIfybfn#_l$1ab5VG(RLjRK$_{gR*&oA?{%%4
zt&QLb8r`T0(AGb#nW4f(7DGNXPsNYaoyNe*^oOR%^%z1KS-MS-N4XT>7$s>0g@xdz
zewVj^`n71}I*?}9@z&!~hmE=nBN#$03A*9B3Yy<seIQA9E7>STl1{i~Cy33!ORCen
z2Avr$OvSO2ar9=iyitFgIV&<AS-K%4Lq*i^27YcClno{R-$uY%M>QH#Z9Rm;UAntB
zkb}E0*@vy`=)pr69Hm$}hiOKP_jbAc@PLm#xxv+&ci9|P9^u+FDG#xB+K%cqx13A%
z=Ln<5@#eel^Mm&;<NEVlS>NVIw>KDv<wUpB<?ny>3;cs`yutp?4iC2WQqqY8oBv#C
z`11KxzI5?8%cUO;RpIvwJ_w*=goCD`r!~L&PyQ*Zhxh3j!PPY@z2dV|c%5_ni+}Mi
zqN3q6@C#w7c1c7|v<o$_VsPQ^`DkK!bXc)@Fba|}$Eax&f+wm}*3-rs_3#u~=u@l=
zutpMbOj9^dkiH;EpL>3>!|_f*UzB--zCb1L$dcZOaf9n(!f!?{wd8{C@H@pX=d4JI
zS+BxkZ4%%%Re;J&LYA9T<w8f87x=hw9M}l%afwo9(_FYMx+ctpqtf75i1E2+JuE$5
zeO-Kv&+|t3M#o?Z;cctzM|oK6%!3}-1TAi(B-MqZ9XZ6=wT)KY;3kXiwP;?*7ie)t
zESfRF6ROd*ax)v{TDfV!{|sYOb`jcW+m)xH+s3J*@n>eX-q4v!R<M%QcPcW+p%M%Z
zVLmO8^ueeLsKiV&9NlvvtWwlM)1dVv87-!a3)#X-aZ_FHloEl=2`Aat%vysp9j=cJ
z(kTjAV)N>hU%c&hQ?P9Nqb1C91qUHXqR=QO)3)%2?7`aN!BrDw|KTHgb;aWGGgOb(
zsrD<-4%9Wp#cx0(Y<}_~*YEFgV{^pjVa2FX#2DrVJ%7#DHr()oQOHf@J!COOUTZy6
zVW(2wyMB*PA8k>VC57=P+(MM67E6Blt6${UvoG?U?|hH_M$=>O7KY<J_~kb)@sEG=
zA9G=49(Fd^9oHPxe$HGN3EE|0uTl=LU*VM(F7S(A{Tyc)a_Q*8XJ^!qfz222VU;hd
z>iH1OK9?6=#k<e8DnDY_JQy>qY#J|&LZ>^iBwm0GcSY@$l&gIj6BP@-^C|;rs1u6M
zQW&b6e!&a<f~O4ZsIacWwr!J7O-3zC-GWMR-M7aq7v^0}$UTc_NASrIRYpFmLjGA3
zI@iNcNV}?hXKWd2OH4B;$Bi%EcT^wWen)dgvXXk5kcQ4R&a!*JNt9QN@Qr@K`F@AD
zCJnXqvD-}=Taf0WRgl5OMPMxKvEzv9fk*{&Ieje6gF}~=jRYhn>bmxB5?Kpsv*MSI
z){?Zhfew#rq{TfZ7fJ}9v>xH;oncu)PDMAv<)(R2mf{en=;D`g(csZK6WlZ(*XmR}
zyNmA#bsq0nSD~BE>!h2KMx|xd%=n<)bw$2HwrF~?7@^gsqEG%j{PjwQ{2}BaZRE#$
z#TwF$w{c2sgwi=CRv1ac=E&z64kv=F*DO6eMEAEj*tr2k$;#1VEZ7xB_inJWbI5*W
zshn34j3yJFJ$szjKldts^yb@a-F}#!p8PSkYPU2qL?WQZ0NpMo<4}OGJ*;^1#wK6B
zdWRprf0^}Rjp=mLwNnV5(_m}5C!gWz<CoaEx6Y02_joXDaE(nx*WYa5qepuj{oo^>
z`tsLVJHN@pz526Jcr$CT3AC{o&3;N%7e%Ddc9IlE3=LbA<<UXK{-|bHyAa>wyh);I
z6$~-uvr#CQ`?zk=rdb8tn+bExH6vUq;6fpEOG9VAi!s9S!m!ae4ui$E%-(D+brY?F
z&E=jTm6ZM)(;zg;TteVv6N+1dr)!N6CSjpw!|b&{c;tK+Z^B}0S%j~ZhC@|ujc4H3
zLH0Ejr;aiQJX03jah{v2s>};q5asKgf)^GCxTc|}%7VgPklwi&`*EFVMqRL2+stw1
zW{``T&HL20U8>7wv@r!DCj3UZnYC$tF|(YLFpkg=Ch3(6$=yafTa}1%j1Y5|Mc2e!
zw7A5}Xky7Fhf6#KZ)k9B{JYC%rCB&-8ZFpt%n<G}O&!z=-i4U7g}CV%YYr~Y0XSJq
zk2*4#dZ;rAW|NyPX7sx0h9Oh$oBVCmCQh_=_tceV=?YH7?+C;@6dUI|$l8UBH3ub*
zk$8d`wU=;SeXz^?4}Qe?)jkK6<Nl*v=5MXD`q4)mj2k}L81ZmuIjAjja|7lU7C;KN
z_6`}<Hr(tbJrBvyLaX$Ue1@%$JO4De)ubr6xv|gx_V4}!qj5zo9r}r(;vetC2|L^S
z96nrU@!}=sj~%5f3J^b%FcBM2KreuQK725u`ak|Pu5PI6&xmC>TdJ*!$QOWTfv95W
z1=o%eMhyG4W3zH>4l8yJ$BZiLwYtF)JZ?MyCu((T^%tTn_h6wLWMi5D;yr<rg<(nH
zlz~^f!ZU*|y<Ufr2phorm17&9o?8SNnGn+;VoIu}7_Ovg4O-ubMf3^?2^Wl~g^k0A
zAX3VPc+kxx9G^smIZ>YJ2(E!!jZHek3Cd0D80)Nnyw!0w;rQu*jw*fi@j!#v{5a1P
zoflXs;<V1NrhXCUT)RAqGwKAY)>g-xPS~2c#G;ZwTC`zGH`iRX5DH)jn~Z42X!;=8
zjx|jS(kwL;OxJ`6cB`o{CT(p<2v%#`LaA-hZQ(p5Sa?eliv#0~sY`nUh&KdZJEIc9
zW`1wi>U&)<VAv|ev4^7DIyhz+w{ga5r;HMLQA|1p3D1XQN(^Os87P@*VOA+YK4xfV
z$@zRY*`CuhS%Q|gH7mFfv}(ebsSXJx#`=+$*Y#S!_-?pyT<>>z=J~U%cKTes^<6&M
z7-5Weoo$UQTces`RrB1%^IUlPDgNZmxB1Q=|0l*$hD0|vopu!eUt6PxpSep4_B7JY
ze&Y>95O&8kKfbrc`Gqb=2L-#8O(40-TJDc5e|6&#C;#mCc>UM@A^Sy#jmj_aO{ggy
zBXo@C4$qZ_UMU>x?XlAJe2SlW;mtU^9T9n1RbLj7^LUx*e7bRohyp{aY)l%q#x<LJ
zV}|2~kqez}?V;x5#%J5tkppYNb_zPneVW2VH>o!Ts&WM77X}4K3PWEVCyg-Z7nn{-
zzp*UgBTCK}!oG8ig8i`@y4hO%NT3S;M2JnE5^Pm`URxLu5DM`qQvg^MMxo0cC3ly9
z6R+TJ5P~K+xxuIF{zc`2zq}Q;=bcePOsWqUbP9httogX{7fYeuYWzsx&e*clsW1W^
zQRZnG2R4{IVlJC=ZTD+a?6?LOS_>La0GCj6bcS1y#s;ocF|=%j@G%=WX<>mRQ-+FA
zjGK0WCvA9IN|W#j60L?dCObrFmxM8jWD<$?xr|?%N$<kz;KFQHlY1mP??fd+vJhLO
zsc^Q+Y>fICcxLMQhz__ZXk!~#ndX;KwV=7ac*by%({<1%n=<4vhw)<{(_D5Y@pYD9
z1QDzOgQE##yqXa8Ubs*MJ?Eh@h8oB9-HL0E4mh_8M;3bQpnSSDWczU9lfJEoKHb^a
z;h=GB9E_=?8%~!V(HWO(b=W5mh=EfraP~J&frjGq7+&jz!GN#7eu>Rd!|(mzeQa4!
z24%#<al>EU-Dl~88!SD0ogZGl#kI{LmGx}lLfYcnHNv1Y9O(;R{^AQ9S?E)YHh#8+
zcLr{L2Ka)AJR6J>%c@$0jyR1NwkDRXiDhGd%>HP?C^JgLPPeiyNU(y;L!nsi;rg9)
zERN~ET?1#0R|;HM8ep3yq{fE%ox;$0!@_YRTy?M;-ryaCK0f%ZD}G$C75>=|i!>Kz
zw=U0X3x#$RmS;9B+$vRu!MtF@%+9LP3GkhNKeFKs9Qdc1Q;htW9~Uiw0h~JEr1$i*
zG8fGV&KLUYB7AGuu+=!eFkeC;90|=poiFSH_rV5!u+ugzB43il3%|AL=F7AUKpsa5
zc^8}sij(=kO*0VGhMSw!soXS)@i*4T@HiK{=m4I{DeF;H5F>X&Fr_9ZSmrJZ3$FO_
z)*kG#c=l{bXQx9ou@+ZXI9ESrVQ7cjc@SmP0k`ws<WLLqkh}v;dR*14>&sLPGRxr2
zVGsI*0zI2bAv1&Dc6ORlvV+B)@P27r3z5<Qc#df+PKBmWYNLz~EPwLDkNKtNPVw5$
z{TydUBj!H7%UeJGm|6;NWDwz#`x_iwzfTkFa4zV;=gNY!y@JwsC)viRVZU}HYim4N
zFs)afWmH7HvBO~c3(OZb++0cW$Z_MiQ#n3*IOK&}n_RxL$@Z|K?37{m;}?sicrL|a
z$8h1ufR~>;$?>oM2D*LiXJ2?jVV%dP1iu)J5=X#0Q(GgDvR7L+D$B;OW_y2>z&E4%
zamKE{`}sQ|^IgnR&ky`FD{zeMSQ1z+gtAjm8gPxJ4pz{j5IX7@I{2`0Y&Z|V5xix$
zr@k#eZ{VB}23F}S><Mh69E66h%JjMoZNyL=@QxE;5{p-2@cLqX&iGDwoNcq?BCpML
zYW2EF-s9RCb3FB$Yz8R76&5j#4@KElxKdf}Tjlw=f<>UOnr=4!_#cBbb3;TpX6JL=
zj17@95~40wveAKN<glpORoabSG9TCoGY=*at4U(k3OnQIA?kA5VijdrzODp08Pi~I
zjq}1-#3G_G%DG(lIoX)RBP(4i8Os7Q)j2O+tNnN(>E9mPfK4ycBr{h`$N6YhfHOve
zw3cBKyvMaC0G$~#s6LKb$Zf<fTT;chQT{t=^}^}L&IDoF(CtE&wi^?(L*r39uY<3w
z;k|K>xk;bH-2+V7;ng!sEDyTa%5rCW#FZU*WCCxywp7k?tY7frN{@?+UFM9JhSt3~
zKHePi?N2w^t*obwg+DLu+uFTM>~^DG*RZia<p2J&@3GJ^bh=$CYo`+H3K8z_Pxyb|
z{0X-nZsMdRVwr@-gt@Zd>0<+4fBq<IN1*rI7oqsl&rVL3=clRaOCs_O;8hX10Ic~j
zs)&e)s+We{8`V4<)vRwHaxkhAi(%6E`AS3#M)*zRJkrq|orn2uies0EYYZ}%qawUI
z-vOu8lZHkNND+=I!o(?$RJo(dkjSbfX>Sh$yyj4aJ%ts4XG-CyNYdFJhIC&)j?kpn
zjll9Ma%htTwOy*cP#88soQ}!dWszs=X4$sl7a6&ColqF()gLVmtg_Lx8eZ=^hmljZ
z9K1hq98}74U16bPxKX#s6?K4=yAVkeU1w^uqMNk2ZPdBufC`rvRc(2>mbTl?%o7^)
za%x+5TcnkdjYA~f2&@Y^Xl?QI;2AsB8Kyu;oi-fkRPLE;l@01Vg)ELmXw?e2PFJ1F
zmS|DAU<3cwwWEruMOE9$GV@rbmuot08q;ivHVxyQD&j53S6YW(hBud7AEugpA9=Mx
zb3RV6M@v?S)5mk|MdI{GmMN$~Zs<}Gez>*IPd>iRJD=WXdv~ALpFYXo`Q|V3-0Pp?
zM6YIvLyq-?(|yC7SV~cj%=K94cNnQ*Fh9>Xf9WgygKvC}S5GeDw$>>zOqw>qB??C+
zT;D?b9yP`!SpCHLRNzh_jIC??eT6}3sI24D`;XWkPACf#bju;e2w3SGUOlzQ&%JPr
zi!YvK{<WV&7LGtU_p|GGvxV9b5s4~>)4*zAG$8&qE>>Z4;#CX}cZcjBP8eIqxOTy+
zr}S_fHA+{6U0~fQ+g8z)KDyBLu$u5jvLPGFsxlO~WtATsG^|iFFouPtk~xKL<LHMw
zSub?A!_bhKT;U_iT?e;O<`w1*tch@{BODQ>-#8BOBZ?7z)~liW9jCZ;GS)y`&<P8`
zu5+wg7g4V%d#$}bGmZg-qU(=GW{TA0FPfvJp@;BEZ5amexziTEsHz+~<;}x}7dwWp
zuXI=!%Uglh>!PMMc7-<YTA4OPWaEX{F-z!nlc^$u-^i2fwN|H)j<FLK>ryCY8mBl<
zBy)b4+;*%nR5H~rm$J+RmlkJjryIGrwk3wq&T^-8!806&WXf<3wUt*d*bvhmDP^;e
zanUD`$1<u|bmPuychj*sGl%5xoc!zLNjBenj+>7rW(%@BK8p^g#&)TtQ;8T>JkzAn
zuv~RvG!)WPtn)#a4Gt4B*M_0R?igXdfZ7^*XJ2Igl{Z*AxyG3np5}0O#AxS$oksZJ
z)&{@-&ZoS&S21yp3ks(v19ork^6X-dfA&v*l^d7e=Q|%h<WH~d@yXtViEU$z6kjtg
zomi#Y?eXr-`=~Kq=dAwpycmdNW9u*>;!A*uRh%g)gp{J<oTF0|oL%bj%Bguie{PWr
zPak9cjemrkeHnfDHnRHs&!*$mB*NA*%yoYrcom;2u?(1K3szP38pqvn!}`I52U`b>
zYRj+=vFuhc&T*ztKHoRIGT-5dfnjagDh!ij^XQ;Mz@nzPYrCQKL6i>~<zcPt_dD#D
zhM__qVb1t0s7~O4?6?+&qY~1&$ztC_s_+pJmI}k15h|<Pb;`Pm=jMia?ilX`n`AcI
zIy&6K^>ZxncGsOkK4Ya_W{Csi`~_lEDB{LnHKPxPL}Z08_X}^rs4V+UHuB3XwxXVG
zu`^LliQ(Cf;i@W!wsoF4&$65ejm#Zr(*@Y;Xf@;2h9Vt0U&(JivHNvxH|%VPp|`$x
zN2_RBv;`-dhGI!{frVMFsA~m(nU!}sMY&Z;L@8LD?Pg3(@)ts4)VsQDl;WVNd~!q+
z-D2$$FQt~KW}A1N*5_tRQkiw0Wy@3Hain7!0YpH%WCb)=IAq>8kr|(`W|T9Lshfgi
z0QQ!{o=NFu(kWW|ho**Gvt6WL&<d?e8ajnxMI5VkLOI%JvU#6D$FcVES6F%dYaCnX
z@o;mSH*Y-R-mqb!!p@}OgHP{q_tTqv?x{7N{V)Gp&YfA~**VMH<dDsSn!T#=3ozq5
z)A?S>KltJcJpbIYeDB>4p(xYy;2d;IVW}$~;#Ai@hQ2V=;k{fKNetf;gOaa3z05aX
zT;b)XmRLKo%<{QYbYJ^5WKv^4{T@;s{A@bjtlK>;BCo0HGa_;-ARvom3l7KM2jiNp
zal?b{L&jAT*t(Xgfyz4Oo#Rx$<mHn~99x~|+|D7L2m1_7ms^7}NVEK1e98E3cR%V|
zqc+bvw#$M+x8Q^r4xM^nb78zTukl2ND~)A>XKF@mtAxafI#_}?71pgXXB<6X$-t`d
z1*!_gbD};8coL3SWq5No8o@l?&%G+J9!H0fAr<C##!X+8lB}xvNi|!lIT#q&tt_2T
zgtx=vsl)O=MycEI^`F$1-`W`QQoo=s{0zN8nJc01d^&{>xAagSG#@EsYzEcjL{m4N
zE|JLWv7lr{*QHL^yW~=cWt=l+@EiYkx3a4k6Vyt=;>_D+@R<zbs7%jwHD9E;she1k
zXN2PE(&7%MNaNBxH$GO)9BG;r`YE1asKBupYi><enNmPJ8HA%##V|iXg?#cU_gc<i
zK%SspXrn6HlR#3dPj}6dC0V584Gd1b0mrJeO}h<UuklSt49YBmuR)A|A3q!mZ*PpK
zzyB`B-~W(89H$rI`Om|`>1Vk6?vMEK`yX>y`C{mK$DVoC001BWNkl<Z430ayha4^X
z?ClNFy<N=bew|}xfnVO)U}d4hTQ|3Pe|^aPVdF=X0`Gi!552twMQ3X4?SO;Y(Ls3e
z_!2K(y2z*Zw|MK5>nMh9D8N?X>7_2e^4t-A<xA%{`^t-GJ;s%N-0}&w|KbmD!voyj
zI^DVTpMK%ZX1m?6OnXj5&hmu(G>5Voj1muaha3#Ye#DSC49>f^<_C0F2b7ERn1un$
z#_-%+pFIa(>6N@aZum*%DPF&^+^2HNpN}nv>iy$Uj&p3zCkDS<8tywsr}XpOMqw<%
z!^UwWxWqQJJ?=Z&e71?gy&%!ra&Sc8bZIzlyrXF3ye-%}&wRl>A+QhZ<x3r44&`E5
zu&BZScR+~0t)>njo=i8Y8KEiD<W6m=H6$RYP&oD4-P&<+q0731QPZSO-H0y;m3WKt
zVHi1lJaT+GYUmq3@9qdZJ8$^XN{4#V@W{edr`!+89?Z;nBLv2|nGr%L%#tyKX)>ai
zMvHOFKWJT9ZTMu1dUVOY(#~-$qD@w8Y&#RpWo2aC-)u&kceBKWWq_wkhKWqSyK!hW
z@xU8xBWTFG-6@-HtX#QrA#=7dGr!H~W7DY=Gin8Wg6%BTd6($9N|vN6)2J`aHL*JT
z!6yNDVrQ=@Vm?K`N1d;U*Gvc~rR7i*-a!>ox;<q4<3@QfY#0<mX@oQL1+Q#>pCkQu
zxV>}0j~^beTiN7-G~(%J+qLrc^#`2&qkqGRpa1)CxW($}6@KM~i@dQj=7&FcpKtx-
zA)oF}*qGFOeEU8J6N@R!kPX=WtrM#}tQ(H67%m<^LQ~aTzF`=tFtJKmz;nwzzHxSu
zpS!Tcxz}H%|J8p2u3_}<pK<H*P3~Q}ir9uuQL;GrDeHJ=Si9!~dF*L?h~<LMPxIZb
zs?SJ!IBwV&R&4AJ8C71z5NErUf>{_)FVAzgTX1<~InfLm19y5|cFTejrD3TkIo4GQ
z19nhgEvys;^I@)p`XIhn1_f({uxA7#hAl!A2!44cMz~;vx^dibZNFlfa<{St44rTt
zWuWk)TJ}{L0z++)jWx>CM)-|h$)AlI-nCIL>)()T1~zNQHRqRV$wZLsnXP^^O36&n
zO{Ql#IJ->9eOpxF+@NHo5MJ#XPHMr}I+i;n2eoCZwm~;3>?+)J%KZ>=)M=E`Ir_jW
zR`|8W0f+sD^-)b}EB1m_J3dZFdy`1Yf>3x}952MM#Q>Rzh1oh%GH{C6$z*1#&g*uy
z#YiUUS6WKB03e@Es*tHJwgtAQpYO7~vot~oArOtGkkX)^YiGN*L94Jt%L-u2>SCIU
zt1a`Pl?`OeLUP{1%(hf#?8W(wHg=q|varX{k~2z&YzC|e%JU@e@aznlsT)K(jc7X(
znHujUy}3{Dm0)$YVVox>8p@QqvFulEi00j);nTgExdILv<-ypehv)q^qHK&Te|GzT
zx_Y12Z$ILN^9vk*_49OI`6dhF9adNV6~`9~-uifl4>v}<v%Zg|WN4dkeM-Bm6+aHV
zxwX%mZ@tU8uH{#c_qcBjLoIlEUU*@p$H~PWMKi&f5_)|Y4jJBi$hG$`b7OOYagO=Y
z_%!98(THI&6x~Y!h_f2IUGI}nalrbxVQbQGZ|jiZxK3T}xb`3%=K7S2^NhrBqf!o>
zWqE9=It5!L92)qza?~R9OF=|<y9!I)!q06bAoP!v!dl^D+aEbE7jYpfy^K(EBUC7l
zobQ4Qph_6L0KW;NgZ)rIYlV#(PK6opDC<&dg<arE?bwK$-AL~Wo5o`WT&-Q2ndWif
zE;*>erdIR*B{LZWc~1}FxWGvRODNA2@bX%pYkLz!V0{9YC*Iw5QsA5j7y82dV#(&H
zp<|WxM%Z$&XdT^&<LJpH2Ac=m7*@Qmp6{D?y2*l@Ex%Gsx+Ks=ie0y1Y3H)<kIOjZ
zajkFb%!=CUOrNW6$|@Vj9r0)!>y4cOr?*AdWkuJ=fwT*{w!`+!g(?)?7F4b(EybdZ
zLzo^f<U`Wj!knaD`Z(Ywv+z#y7&I-&Br{y7X5)cu>87*11)Z^)%j`qVwPo2dE)U2_
znSycX5S~9{T4|iLI|vPo6cdtOBv96jOeagk2R62joyyk|7Zgk`Pc{lq=R}o{cWU-3
z%dLY7amP6RrBzry1<R*d{OW(smoBbz?g!uEwU5_%`q~!1^OJR&vEf)>IoeUSD#P8e
zM~`-muxykIJ<G3s^$Q$5w#vQhSGarYE*D;Yh2sk)KmN%Tx?lJ;ws$Ps|Mp+vhKJm|
zc8lv9V;&whbWp|}!?^w_X0FYcC7w~$muRDW=KX6O7HYs=WqCAdSl=75vp4cq;NVJI
zEa8jC7Fq8MxQ4-5r4rb0grb0=Q=o<Mqr*7+4DX3icsmrdRD4u9TE-ZgmbXv`+L#G%
zj)>?xT^i1WIqmlw7xK}x)#t{PV*LE`I!YH<2u6sp#)}f}S>+F#CWUXtKDw`PLWM8&
zO15po)v@(T3O9Z1OY>Wek<`ApNTx7|y4_O-UhWxA_6!U2J(}9Fu|HvB;`m_VxH3`h
zRG#AYi74j<zB&-Twph{(4BcLb``cr_vs<xI!K3{#%PU<DMiu*w|30sqm6ka>Yl5(u
zpFWr%uyK~#(#N9mKrHQ?G{v54782=;tWKpm*et1+HeDj>Z$oi#GeGjVbc-qo|8q$a
zHL)5*gz=_e!8N#g0(I?gCghU24B0qaL}tegarP^jc_c}=Tqb)HriS?G$<(O`Hp!fG
z;m-SnY&A`~+k9q`8!$90`cqSej4d%evzB&@p>6J34lWPs;?$8x?4)QgHc8w|NWw@+
zwgj}Ab=cDC*wcJG{Ci}TTZdj7|J2<BUi#oioIHOCj=u&c-=KH2;>_?KD_zUEbEoOs
zF}HWeTsn1xmoHx6`rUQDf8{pgMp^3{&M%aF>6w$f`VW7dg{Pio^$-3fbJdV@FJ9u4
zTMzi7`;Mz`U1u=a!R~L<5oLF5*%@2Z!JzQhW9@#59dGP*MPx-)UkEUqGr{=PN#rs0
z8r*y1hRt!qgRKLqrtv8f0f2LKvBxvVml;iz=AiKomH=%rMM0-qP>4)Hnl;&MC20_&
z7Iq+prC=pS!i%qhn)XGFZyqDU(E`*NuGXHI)P$cEsbU&jWRa^oQss`ou|NhJW*3ij
z-sNVZr4k>qxf<Sle|S*yeiM}oxtl52`m?`_Z0VGAt}Z<HPC3^zys%KRywFFwCC2&X
z&j8q|m4n95VQc48iw}a1_y}XZcw~;_r<Ry=-pTjoxZ%$y4cG4MaIb3ksP^iUmIme*
zUuhX-TRyKxCxTi@FdGfJ;2dT?RdmznVp=-qO%OTwJ1@ZDqINDR7yL<7+gSKq%Nyur
zd8eE7tX2arAr^%OZ5muPMzzV(cU_j`p)+&S{J%9*^Uu1{!r$Y_q-vU$R{9vsCX=JZ
zxS%Kp%kt0Ayim%_5>2NXS*4|UDKj%&ng0DUQ_m%H%1!YT0`xgAqAooaP4|Wr)t+gc
zC2O!vP9fG-QW>8M7ypL9ig-9`c<<4Wt2Z8Sa=07rat-W!h*>$p-0Q!>$(z^sl^3tG
zJ%Xn$UE=I7{6n7k;a_l8_K~8)(WR2IQ_}DCXs*A_{{5@mxbuj&_6n|Ee#Cb!-{q~X
zhWEewHiN=2D1<>N-Zm^SC=5+0G}hanf2yN~(CuEr=ct`i)g!<lj2KdZ-k4NuRhIkP
zLk>ojFS?<~nT0uamgf2Pfn__)b{y?1BfSDj(?<75)@{eFX(H%*<H3=xX&ZvD1c=f}
zla>SVP3Q~ihQbHdOUpcczU_D;qt;8t{Eg%h-gev%MJO^7T9>FKcacL`6JZg@18aQH
zX21rT+{rYP44focq1c(wF~sG?xN#hg8r+<t=qQs>&7+a!=EQMm6>DvJ6N@@32R9wO
z=Pako3S^(*u;TcMdA9EE^2x+8Kd}tev2A@pj*hgPLZ)%#5k>`AaJ8ls*jNDltT&Ts
zg<_oa2rkI9Xo*|ua#pVM7gScP;_}YV5hKeta2v9@saQKbI*1Fsj47d+GtM<Nu9~2(
znJ#{=O@Q!)$0b{KJ8#vgzkzr|6@7xSqIKM9P&TOQlrdq-fu`-z-;o#h#|vei<rZhj
zk|`n5h(+}=q~x@om`rk($=pJwVC%BfzwS8fuSLnPPe~nd{I;l{wbLfwX$PQYH<R$!
zPMmUex8nO(H#zgCf5f>j>|r|4Y+lA3xrDj!C3@W>Jhyg=1GB`v@BA^t2RG5d0@|J9
z>6c#S^f!JPTaB1Jyu;N`@9={k{yFbFIN<%AiqR);Gn~}a)=@cSQYfRs&~IQ+3Ik(s
z)_Ubrp^Sf8VV6<KAR<Rq^#$N*RXr&pNj?_e5QkQ|Ke22KCp_BTr)nJI+EODFEAz<Q
zfFZ)}#QJMgB!otSbPdukGOf2xC7u%ILJ<WSZ>4LdU3-{t3^GBr)d+OdP{y%D;ODLw
z_`6-hJGJ9|+iq{`#L-nI&d-`qVONzMV4$8$TD8|{8V|(7ol#{G_|ig`vj~?r$CQ~^
zU96-Cc2TCF*g>nFHp9_KVezxo?Xl(l&WM$&;nsf5d&7on6J@7%Ok4&N4~nT>Ro-)o
zZcjMAQ!y%)N0sGP?Ym;pmbvO&3on-pZZ0t((<;(P8=IaYa9YZjxHbyMYRh_PGt$}%
zU!4ud`?f%(qMO}>a#ELC#X6fUuv|h<CS^qI!s48_X)VK|imS)Cy7mdhxyDwrqMP99
zOs7AjJeo*)&%igiv~7wqrx}xcdJdaXh^LlfUasZ4W|=DZZLDSXev!wO5pCz06<*QD
zt<G7(!_>s$39z4*(G!+`GP8_}BESsnPG<aYnf|%O+RQHgWac^b*X7pO@|~Nzl>g}i
zUi;(@gMNv_vAS@ZwUgHv9qx0ta(wsGNBrc&tGsl5<iGdch;y$kQ!Jh0(c5qG=68O;
zpWfW#$G11xnlv0V4(og-W7l}DcpbIj9@K&s4(p&&VNxhP^HZ4d#-i(-6W|#Uc`g_w
zjsk<EbWl|%A`izEyS3x?#sQ;A!?3Z89mw)LGCvn+W15r%Y0@V`(JL`!k?!WAEy+m(
zD>SOrBD8y@F!T&bofu!*Mm-c=@T8#uo<=5Np*9JxaYwy`N>Z2We{SUnaUworX{@k;
za2jRcVrT3ZV#fJJU3};EoUka$y-CC6Mtyt=*`f+>MUEYb3B|SLXKS|n_Mcl)<@0M@
z7E9sVI~8`jVW)Q7svH|u*$*RzHvJ(`r5xOBV7s#PtfRkNP>*VcSumvwGt`1CHQ2TS
ze4h#+5Q=V!=gA6<G$chsgp$M?DmJt2#uH4yJBqr@aiwkkT2^r5E1qn`v`9#KY^mll
zzJ<0lNL8e<xMqyAjsG5Lzdz0?^XxOxncy#d(rj0!!Yild!HMas(=ltaii9k5O)_<`
z<oetQKYv0nWV%^pY0A?My1z!}t1_E3Ib(Njt;M-RITcKGZQ(XLRdl0nx&0GE)O=o;
zA<KF3vPqLMOpLUN8Y2hS_G-pAclq(dL;9tm+c6yNJY=PNo!v>p`@0i9*c`DvZg}(F
zJ_7?UE|y&Q(Yx&2z0Jq#oBYAmhrG2pVYhZ^Sr|{nwF@*f*TU7E3eE|Q5h@2gtBijd
zg*O1s31O8lg~i&5*zLx-u87ECV_Bax+}jzlwR_0KIu=BD>c~6~`UAFXNRtTkE*CaR
ziXxqYqF+uOgVOOQ<f63zy%vnIV89svI=cuM35Cr8T@mI*SwR?tCb?4OZlk<Cw%iW*
z)EcF7;<KL+CSj)O(Rkjh&{1DR`zjoSyJ8V+y>ZJf&O>PyfltN`>6QFfM|%A44~HI0
z;4)A*+EU8GCfQ~i=(tFqLwThGhr@>7uau9+HWlR<c|URfxfO@!LAbVvItQ;Um0Voy
z@~8VFMoo6Hx)6Aj05`O<uB64K#Uhd?FtmmU!a~kvU2yPGXGPZ=DO$xr8@VoO1LVA&
zmB+7BZP^VjE4nF6A}-TX2P^FY&)-GRx<;Ex)|J{Y&TV7rW6{(p>n>zIt(1D(M*KuI
ziks2m(suK4$u<?8t1~KtDBY9x_^n}9Hf2wicC0f)hD<YN$rn}GpCNxeD1CaIkr^-Y
z?leD%k}ustMx11g)XW@XmOVUeKq1YvU3Q0X+1^BO>^H)-{ffJX4TbSAoPl^k;ka>Z
zO)UG3SI1Nn%OT1KsvKT<z}odkY>pk*4r+F5=an!sB5GA>)g<bf*(wDVM`QfFw=$ku
z_BUF1Gi$Jf+3ux`$I#C<qN*VGM>RVW$K8j!OsbluQO>O`@QcqK=XdTNaIf}9HyfT*
z&1O}dUI86Rv)jOWXuE^Z_1c&%g)g{^g-MN~%jiXfd6N;CM_3dX6#kvmSWni!Z{U6F
z`Lh-%Ljjy*mf1SUy?%YZ<h+5mh7E`KwB9P~4y<}JMXCOYnF}h1TjPeE#$g(zmzLAn
z9L^~=aD~&oKgELiw22Ew_}WU3hmG>??u21T2Iwku)#qb5>z8^FHJN6b7L0Wq?Q}T1
zP*Uu-&bdN8bJc%u8}KOkc%cd8#Vm?EWe7O}9ZixvOKl`vX;ySYM`R=Cz_khh8+Z!1
zcG*aq^y{Tw4yQJV^-0S*GHWr`wY&Ei7w<F!+%ySpL*nCV+fB!h#qoveV^Hz<0OD9d
zW6@O`1e94P>#})kkSsp7Sd(ngl`(^p;y`2yo<6Ng&?)I|O0oz=eu|lqu!_p8V@I;l
z%Cu=id2F~G3vfm;OJ~e1x+piE#DXm|J4DGyY3=f`{rz#CA0h3roKLKWnI|8eBfWx&
zwikY`L)aW!b|yZ~r*SZGZK`)XS=w-uGWfI&r{D^~H4ZD#F&<UWalYslf769G)9oG$
zBZdpAdR#;nRn=q_Qg*6_hZD!W?F04>$5f5C)7~h$Y~MZP?!+G<;}R>~NmZdNpkJn=
zN_%IODcfUICm_Bk^ne8uuCH{Y@$xYnxta<kN@;umW)X^cFLb4Y#skAkCmaU`DBGeu
zP}sG~B#aY29$VHCZq>>%u;O4RyjUHD^IgM!?VV!t>NwdcS?v|Py)ogyD1T?M%e6zx
zM%}c!#c-D`LVUan%P6bRRb@$pKEl3*-+nY<;(X|5p)jX#x=_v<-+}M;gqsT63j3ol
zR}X56UKifQ@xg;bMlm8K;1*L{k8Ry$ju_i6$z%|VVV(di(czX;zA|-&#Fo_f(S=ti
zG>H|U*0lzPpuk|tOwp3UR5IIbviC+6L%5Z@)?$oP-{sb0-$~QXcv}WUZZQr7I6|%)
zGt#kHYp?Q{c|xYfNdew7d+g7($}%ev)9Dx=X@5nY7BN*Am6=(o%w)0YENbkDPPN%2
zc^+GUNj47F>BxH1UYk)er&HGE9P-n4?5S^#OTY}|quHQYQhLTrl5%>@B0wr@=E4_P
z^~E%IZ$}n}W)^O%ZOlA@&Fl=6;!<&LOo%}Gn;bP{x?Lk8mx49;jEJo9|Izkl&z5A@
zdEamC%ro4v>Q+@(^-$ei7#bh|!W2!2mPCt+kQAE2A-~v9`V;)@zeKNo(}OM35ehkM
zQ<f!LmPp#>ga$wm-Dsf4>YDC6oGEkfwfwM$+<B@=aR3^D=%Mbt=bm%&tXzAo@B4i)
zs~l|R)#UNgbH48R{P>DZA5(%k*yW;~@O&LozE^}NTYj?>+jBB&ag(MB92_nqhosM&
z4U3s{=iO^1=B-r+mr%{5`m|i@lYZAHV?!gt-lXAMjU%|glZ`SLcwK~jF`fkF{|m+s
zL^w|rt{-k<Vd@RO=HQ;dTH{@IM})t3Fy-H#cl4(0N?HO1<9>?b`Q?Ktm))9m53kM}
zo^1kMl4}Kx$VW}NY&$M?&Z}fw4wZpHQk>6y2fs2EerdPmm0MGE*7BRDOa5@}nNAuy
zGu~*0Pf(hD#~Ndy(HUpN$C9El7`O<5gfUP`5`!?}ji;_Sg;54AOQ4bfkdE^CLn%cm
zF--Ld1EMkVafdjiqG(8+Z0uB}>>MN&Uq-gzae{<(T`IaZ6qaH^X2k1dl(SYBR^4J6
zRI;}s_o}qC#ok?8qsMIEkpxUCSWmSOi{=Lz#vQq%E#m{L=A>KmX~yG@k=$&{$gyol
z9-%8`DE2xUGgN8C<#&@bGR$Khs)8;h#oKJWKN|o;`Rgd0ZAueX&E2zRIE^0j4N1+)
zV`Va(mDhdX5SN=*{`!I)vTD6zs6>ic9AQUQjuV#_<niTff8O10n(clyadz*U*}jN0
zY5ahQ$VC@8>jIyg-mqA#>C|9v2X||~#CZe-Z%RnAuySmfINVNKq$_1koA7N#P@dHf
z=@kkBx7wzpLbycEZ*%N*`tKWzD`0N0XNHrQ6LoFI3C8(EnA7m3KJc}Pus>^g*!k$w
z4#sB|lO|Rg|Be`^YJA1TdCOIr>;8)uD^y^f(31E-(+Kxk$J3SPfBF0d58P{ozj1rU
ze>holme{gQqTM%X)_kLI83y)@vw_**)R;Kqwg_*w!rQOyvA;j#<ZQuRG42tQkYB&u
z@{jJ$`4=Zko_EpM;L@l-wJL@dVLg`Kr`W+#^s||(D<PRV5{JQ3%7-N^Wx0&=yfz;X
z3->|CMglBxah1lhd$7VYrkEeA(j+8zvgS({KG=QJ*J!}j8_f49o}JQBi-nO!ICs`U
z4NbR~c)GO!K#F-LjXFffB)L*_(=tix8E!QjmaWH78_UFG>-P{DD<<+>HIFcg+qPPG
zRST?_s;pIt2zxoI*iuw{8I7c3C^jTej0$vGd|MhjjBYSg;RWe2wd%x6qt7slaGK}a
z)z{ikD9hWIYJ%o4(-K6GQbnY?Sy4OW>YJF1pj0_!Bj>Y5U2&ZAI*HkgKbOM0tz-b+
zF|*f`Sz?|HYD2fX>N#0=JUhN*?G<)+X^##gG+Z^M1Y6-Ds7QKcg=W?usoRZ9p0uWt
zDt)2S3T8Z?NE|gt)#bX(vX(KO$Ry5S_Ys^bHx|L@pPTR`VJ2nL@VdZ0a5QQ7Pv<ew
z_IqYLSK~zBG%c`tGrG3nSLTk7Hi0v*I5XxNi|CHPYm<h9X~X7f&7oRc047P;zkj}D
zrxD(6;+)kRT!%O}UZyzvi3v_4BC_Be(#6ySFlY3dkJKIwfg=a6w?^>BWibB7=QrF0
zXtGQ!jR7QtGRJi(<0={<(y>p&z}C&caE)DU4EnA33k9a4sdEYC*eH^%!AZeDWxz=8
zG#6qzaNc$oXiW$M<}uIXf+jqq6**cQJ0y^g4^f*Ne4HEC1^^xBtXXvfC`FerHb+$4
z1u9T@al_R|`+Dg|H5#es%Jn#5)a{Os|3g6-EV{L2xbA#M7W2xyG8_(V#7`fEaBk~p
zYmB8(nMh<5KP0xDWU+177_#JQEM^%KR!CG5RHuvp(x^gZKz2s<gN?8hMUjynDTc?&
zaLuHmtd+XLMkA164m>1<#M<K$SY6YeDDM`Utg`uejT*9&foRrx2Y4hRuK@dI=BhD+
zoNfZ=z4F<MOIFJbZhsfKbwHQ%(o)e4nb{<HXCPSXkXeJdYQbCCW)Z3C?l8O$7CE~v
zkNm1LOq(tSN8~beYV;y31e#R1Zh%XR%!2Fm{=X36LjmWNLo;>+zB3gb3cTAHf1Eb;
z*U9p@(+L0Y-kk4WZuqz79VpBt4&e7(EFQiO>=Q2{mp&{LalAQq{L;N0e(UpVPQ9@V
z###kbm|5)3U7CfjvFNO;(2@>g<Kfr~mzy5fb+qfASJhYvXdAE2Q=i;&nLDaRurLam
z^d(xHGSkQsxzu1L)Z_Tisf%uo2G#T~OAbvO3UP*&NEOB7GK?lgCFP&1X|7>b3HWvR
zh2qanU2(nv^d9xypqh}%I-Bjm>E^C=2c1Vas^hJGQb=HRbh-|5KdH!LS|8)JT#I7%
zC)37?MVgV?!PJmu+e{&BkA+8L0~^nH3+_@zIYcj+CioM&-9Z>Uw)?`Ci9;xvXt}0q
z)?bT^QZX!7a?RHVBmMGlKakO5M)pJT(+|tVA@O!FVO2VAORSc`RxMRCR-L-E>gm!C
z&-)=swWUcn8}%`aP4wr`@m8~45s^0&Yxj+;WT@n0cr`v>b(}2LJUP8a_I7EG4%uW`
zRua)?&224fF%jIX!Oh#s%_E~!QAx)Jll<@bNDBK+%)9r%Bo!$~45lm&9*NOGYm!vT
zqJDR6#zG}=d5vA7EbPQ!p9oIhn>*$^aI05#Z+d#~nYWI6^M;StakTOqPnUef8Gn81
z`0*xoUK5O6g}#pk<n4*$s*fnf+s<*=#5er2WU9C&k>Wo!W03~;x5RNvj2`9G3zs3;
zmlI^9Nd}QcZ(N?OxpOe(*4_?#-ZNkI1n*g!uud9fEnTLTjJ5)(2~rhOEp)>g*Cv|d
z?ll$Z{63^$$-L}J?`vTm<P?cCR&Zq&8*o7fQkljjR0Oj3gOR})iep-$SzdnSq8k+J
z`lwpatmBPEU!>;w)?5C8++{XE(<`EURg~l<Lqv}MDd<XJ0L15`w^m(g6}VZH47zQ0
zNH@5~#$9W|o^H=}DK{70TDgsn)i&yOU!FL8;WmvS5LLFi-4R<jXRuYpvQ`V^|DbjJ
zdc_7FPykieoRO3{#(m2LIGCvz0orY(4IZ;I%Jh1R_NJo;mt@Z$FW)4cNL|LyCfZ^9
zbDZtoF|)4$kBCw22WHlYNKR^(la1%x2R=TzLE8y(bQswOs!4P|6yAC|Wr?HE&Kx*N
z`cNrD_WXu88Aqp7@qbM6fL%z(j0i+7-EsA%Y?50oT7ZR3Dja)}@WaEzVYnr6ma;1_
zX@#b7gw{pUS0Cqyzj81^435`<A9bEL57Yp5`v3qS07*naR2qKma6)s@@ky_=YV3+I
z6L@=n!o#-ZC&xFuHgW7YSb8D`Pn372!dl@nI4+!V?c(=+X(GHeZRpi_+yzeih-*9v
z@VUVvKoelMi8qRNXF_|lM-u{fj&FEn9e5(K*f$bK2?UM2f_#G3YW|qI1eZIOtPV&p
z^PsVix%Aqq4whQ2BXy9H+FPu$qNT9MnQwq(ZO$r$GDb;-S_>dP*>N?o<8+8wH&y5Z
z+WVy8O+{A{C`X1=i^!d;Y|yHM;vzo|Y{|MR&8$>u7U_2_iMLio=G5?)ypRgxvFu36
zP%TWYZZXj+nL;XzfsG;Nw#D%+UACmzb3HcMGJTX(VJk44abmFy&bKe9+I28Jm426c
zaaAQIi&dVD`g_Z-R?UK|#AVs?#g*4UYre6JUxt@hLQ$`te~B?obLgZ+@=|k{SLf#y
zs^w$&Sr^_d-R?u+%SpF;J7XWSS)$hzUb*Nw-vpYYTk%-0@q<2eypdjS&f;u0J)vgO
z;C3eCyJOydQr*c$$<;Q*Jqw9`A3wWo`gci`F-dpYj%bKj8xee*^tF4ykr>|+<C~3e
zD1xMJvT@C5nK5l5a`OAjz<>W_#f6W>WMANWH-XJ6@Ti5EgA0X2XY4y+F5s6NzP{r)
z+L=HD=hq!~CJnO&nkG8IIyIJkG(ofmM>{QtcXlu}?w>8$_&6dtS$jTM!dY+JcEY16
z98M)cfxyJ2Fwj^;^D$UL<oZUb)PVFuhYz?5DdR28aI<vG)J7;-%^hVbV0m#B>qT6w
z4H;;|hFLOoENBruP$WQcOkpX5Epr>J+W4!5689cAwQ;UpxV$OT*%BjoVE2Y`!fyK6
znw(NK)0ea`ON_%x7FR)N>KjR2bhFxHlq#%44<=v0dZ^MxAj+2t67o;#c4e%>knIq)
zFI=cerO=Qu^kxhGFoK|$c|z6Q=J!&n*>5?GjwzR=SuUfUf$BFRr)8;HemzA-#h6-p
zCIir|q8X3*9#l#em60Z8oH`)&oFXL+Ga51FC1bYx=hwCUd33vGb|4~OO|#wmz=4Rg
z>1zy-vyJDh4?J0VWOpa>4bq~<XU=AUjOX;+bQg1io3-F#_k_GWzp7Dmq+|t6v#wU+
z|FdMQtqc@YmcuT0y2L=rWkNx!8T)B~{dOZ9wTa^39Ii=0d0y$(9vVll$|gZlu6kpw
z#*CEcX~q*Z?uqbd;#eni+|jH7AGqa=>C~kdDB<3`rD+}QtVJ4EX4LbmH8&e&=7gP@
z!?p3X**j>tHEC()6YgBB**jj*JK=D*WpTMicjt6#&t`pvZ-k3g$AvdmK?z=QYP5Nd
z8>Hlkl@x{%%R3cYZ;2^T$FAqQzm9mfL+57+!Wl+UJp~S)X3II<w{%S!211z)0o?Ho
z4FljNTj+wvI$z@0jclR_1E@d$zG=Rk=e?tFORWkjRng5$u_Qyw*4SLG<qLGXrZ#eB
zm9kRN$!hu-6+bx6#C5!|vpOQJn*B;8O_QxoUGf5SOA#TqRS5?(f}&%Kvkc3zp__l1
z1N<k}53}laV8i=S6bSN?tWK&<b`bIBB$m8eA9t(um}GR5DMYn_Cp<jc$|0I_<3<l@
zBYs5D47-f-9Mo3!vs5+I=@KIHFwJ%!n%R+v%xn2rFypgT&+*!G=|k*rGlL<`b$wzV
zq-LwUphgUulUY+Kb)rOLct0}qW_ZDCFi0a2YMy88y-+r&0}CpS7J7sg#@dXf!9t@(
z*15P0+d~kEh0%INyNIdm)}FJQo->7~-uOvxOj^g>1=c>s5VfiJI-=R)D^vLD(Uiri
z<7lsCzB56WYuu!PwnZk6cGJbDIGrGq7V{qKdfaY{n;14}IPC)NdPCUsIDvf==Hj?i
z<H<z$qziQCo=I=qdV0ehjKirz9Gt0g+($Cm6u4#JB^p7Nz%ns&o052u`3}*A5?KtH
zmyp@O405oX=s?`=S|Nc|@N&jvtSAdhop(K3Wf(8y4w3qMEb<wOxVY<3AIiX~{4RM;
zE0iw2s4Jw>>egRtTVNj5t)q5TbSvRK^}?@GT@2$DDbBZ1k(8~4nvK-~mIR`)+Z8g4
zZxjzyg;9#xwz6#OfE{sgD`Q5L=eF&v7|l~Fv%|po9jCPo5%FI<ju6?}<Bhsu83A_k
zjUk(;@*<WB6#(1C-%2lE4ROmjvlQ<99y0Q1l;2Ajn3co4S+YB0WE{!5<@V>$?d}0z
z%DP=*YH%ynZQ<$4bJlr2U-Ya)T;TXrd_!W?1{<_{!w@~S?GuNawj-Hh-R9Sk(>1gt
zzr8M5_WEQebPP_nkRHohL_YQ@g?O1d-Y)&%PGJFbO>}N)2Y%z(tRu1LMF$^mjE{Tc
zg*VRCxKvLA#ri9W-LU7tB{uEMV0YHwLO{IGOdK+uz;u${(b%Qo5}hk3n@x=0dD6pm
z*sx5e-A1B=?am^w>(-om<AY7$lP-4fy8=gza7Q9U$MqIRDGK`ndrd5kL1Q@RnHi@F
z*F?LsW8gEGPk2YIq*LWXmsJKK7PLC0AQxO6TwLWu9nx*E1X<>#g;sIu)q*H9bTz}$
zlY7L6Xoyf9n6@^!-efBp$ZU*9q(lG>lCNabE3AjISs6*VDuBC$H0Q14N4jPA#l|$X
zBrB7e$H0*2Az4mhLj+Xmq^nU^4F@+HGk{AP@Myubl@U}OpUv2kk=a(qDwRezS8pBj
zhNaS*W%hNIwp`QL%4@O3iKy|$^`FZZg3|^WSUCyX*h5!`ty&E^t6tN=NWpeU^A<}&
zhRLx=`ERar&izaZZ`SRmzwRdx&Kn|fM?_}v^^3Dzug3AF=WG)=+k{wfHKp9954}(P
zfjr^TO8D#=7nKYtwKpF{wB9|~K(Qa(KT>G*K9RxdgbJUG8Hw;nXK|^vNipn8g=M<1
z8ii|#5kSY@I0}IY#^p`N$7|)2-gxfe^WHcKN=I~*wMCen=wA}4WKlvEO$ptm=iqQg
zGiy`VBIU!EyF{$Pe1Oo?b%E=R=Q>2B=7oo4(D*v0_x<xUPFbmP(Z?~4Goi;=2Ut6p
ziLob<8GLUVfk5-*wpn*@>;j*rn|KHV2GaVh;nl%VP+V)V=vtLaR$7eQAzBzLy!G8O
z{dt`>F{Jr2d|&1w<f5EAZm;nd?K{l(srWcD5ZF?&m*VxUBtjMjEvXIAABy(a3h=yi
zq4@)r<WN${$MRgap6L!ZiL8jIAmw$;(>5PL#}qOwYO>3CB^M#wa8ofEDH)0irC#u<
zjh)P+$c$l8SW=bQ;zU&H1(V8=R%wT2q@0i{I!MYwk$N;C<NkOwexUxc0ibQ!AyvWN
zM}`uW%9tVJ`EF^_tHNwjDN&@#qO0%(B^|n^r`1hh{HzN@SNt<6yt(M6<lwi{Z1+K$
z^-e~!-Oh8e@jSli=tEkfY3wk43OEc2<ej_E{Ek^-G`d-vPNXutsnvBUGVo|^3&W?$
zRnn)J5r^OzigYirFnbeL#A3TvV?opoHyAx|qr$O+V>KRyfc1gPUiolsJP8quajnYZ
z&e(Cn-@G$n6O8vRyT~0#;A=_fx`xPva1uLQnNQO8K9r8EtTi-}v_fy(Y<kZ782s0T
zs2~Wb(aUV$n?w%t>9uwVtiB^~w>4gCg!>cWcH`J@h206v8e!5poO5(NoL{b(Uu;<V
zs9j$8NYdA;Q;ptb2FXLtCCmEU%8540L>sXW80M|1>$TbpkkcP>AZ5ktwU8MM0s0VS
zV%iS}zdVE0FbwF-Mj@CPR#SJ@!(2CaY+4oJ@k~@ocVz>+!K^A;Hc|y_7ci-3$)%If
zigs2n)GC%Sk{Zio)2+y2qqSK{8McvL*lMnX*f`yIOUXd>c_}SX)d^=?ZvEPnvB(#6
zyERSFw%8E1y~x{wr^}WhJCg`UjEBl+JO-#)g~6!kaU(os-Ti(6cX&`rk5QO4u`FlF
zRU?%4XF1yi?j$9{L*R~x>{eJ%Q8S*cdtR&q=Ut?=`_!5FMEwcL^%1ILLR<=@yUVn}
zCQ@{k!;_Ygg;1*(#l!~taM|{jjK#7yP}0Z)N1x0DOEp#q-cmkM`W@E>3pJJ)?X+QM
zr{&JVGr!qH?q=&EsVqbY4jL0`)enimV3;$^N$etn&<91kfSWiFMT%uDDKf-?G-XZ-
zf;Wxn%U<!tVmk=MLz<npX54ZT?avLoITc=;I1U<PzY%6TGulam(;l}ogPkde(5TQ(
z1nC1O8|6tNk!77NRmVg&C)f~qK3FvC0Lk1552to)tXUmJ{Afrz$Y{qd>$OaRQ;jIJ
z5M^T4cWJCqClPD)Gpj9j=`IJ|a6Q)@ce>R=tju_G(UdaxEzhH*9W##J`2uV4;O2`X
zhG9-=73ZP~qGU*}FqMLvG#fTQW!aT}rfhfUX5)M|86TU6S)WzoqwS>|RosvazqeFO
z-TY&c>Y?s-OGcc$-0e!9-P%^SI|89skwNvKM7EkQ8{4K8wq$_vvcsd2qvZxb>Tb98
zag=fBxI&8z`Fqht_cNIBR<m6PWW&U(X|_8VZim7}7kIG_JX?8IUh$@Bt{Wv|L36Zu
zVl&y`M9VLv+nE&N-8N;ZBooNUh#9q`MIts7_z`d;&2@eH`zj?!EG>4#O(qa!FL^4u
zR|e}=IG8l-Oru)i<4xeBYfn&^5R2*m@pMTm@d)2$&Mlx#v_&szxDw-f6`0A29qVa!
zr*XFHJ@f%-+7wS5(52#gWxr{7ICE^ep0x<QM0puipyb4iJ%RhJ@TIBn%CzCY!8EBm
zTGL2O+MCntOkuTvS(9?MhXjLz{g!X8dmb;1(@l&u3Uv-zUUX@kLrZ1Xt%E3s(ZiTg
zP<M8wTg6Y)2*7-q{bjkDWZ+GRi$?Py>0r0H3PT~Yt$)r1wH^hGoMR)|)OaRaq(c>L
z%<3X5^@m@-fF{Pco2)VdN2wY`p*0>u4F71=$zR4rb!6$43M*hQb8lYSb&Y9dC1`-H
zBX&(h8={000BK8|Ruw|2Pqi=t>Ws_lxP>ox$<iLz%k;_vn6<Sv-yuD|)J)$kHP{!v
zATplsS`FmcYRIL^my>$@B0pO>*{x)jc$l)(c15JIYRvHYD$aI~S3O;bxHWHa9vRZO
z!7}2IsM~dJn7PQLK_+fc*3`|ujKzOieGKZGT}Vz6Pj*u!UPCIn8v~EAG-0K&08i56
zhXm8fN3(?qADZ!_Rbbx-47m1j#`*23<4LDH@yaw9_ot38@3ovRJ&UC#W@lu4`X(v|
z&btW75j7r6g?6{Z{9&677Wzmn>jT}&vt9?9SwlN(c*_Z|&K=K!@@Y_f4DZE>FlmfC
z4ZJmPc<o@ye0N6JbeQ+FyEE_}f3?CiM8I>eaD5itHqzjOp^Fvm{w}XfjK6UxEIQ@=
zV4U|_F$0oPphokRE>;HxL&bF}u<;s<ULCis9PtCr!tn2j#b;^kLf2#7CxXw=soGXC
z9g2L_y~VX^6`5`$e!@$}2(9(6FV9emlECVu-^%4i1vM8NoN!tfbS<;zZNow-*5!jB
zRe>LhscgB_hSZ8`@2+E~SaEArss$T8UtU`47k#a4|5-hrke7JCL(#T+YCYoPm~2(S
z++2-j#slt^>gUO}!LG<ObO2M@7ifCRjDDCKn{083<O`U?soSmWBgH9~=g`?`@s}#R
z6$}U9RWtjNh&)I|corWcmj27$bKVD@E_+tq68I)}x|$%w336V#)_R;Hu?uTt%nD6B
z2HnmctNqtwl?(x+!_t;97W$An-3^Y7MO*MnvuiH?PGvBkJ`-z<kIeWjQ}(>^Hn86a
z_XLhwVd>$sPVoUA>^Oey&Wzvp@cxZ2=z<Pow{^U^=Qv(?UUczs=Bt+GdQCg?X{>AX
zH$AIm$J#^JLl=~8(bK8Xwhadd6OMXi7h}FZp%2Eo^Y~6_*MWnXV?Jx5BBbvKy~o@x
zhO)U_(p_y}I>j$m_|*#Ml)b$fy7BnV(_UV4aCpc!4tBWOTynVyToX?&R#{sq6#iUr
z2R&_BVpwMShEil}tmB}S)v|mGHpU>TD)b%Nd&C!-$561T3ShM$vr(3rl{IcIE`yAX
z@k}(y#<q)YDcCY}>{6gVRw*B>N|MmRlMt<58>yUNHY|jS5<<pXd>etkrNp>Nk>#c4
z!gOR|9(VlJGHn|HX#*s^%uR*C;Z`XH3gN6$RMY^Qmq86yQ(T8GUxe-SiS04NOJ#bb
zei|Qw$E>w<KdXJvb?}@G+~3k`kC>FTi?CuBkH!rntz2^6$*|M;%P!ZdSf4#Jds{@_
zO1^@9Gi&Ol+KaX4WbJvj^l_<{rDHa9o?4$$kTHX!0hzVqnT?EDpu;Ffwr<QR7Dps@
zwrS}kgYG}c$Am8FbvrY>Ng~U|?`f2(V~QQ+r73?5Xs7(THy%wKkEQ2#E&`X{*oh8T
zo-927?(-$5tAGzm<AgrMy=shnRxW*D6XIkc9Ix3d;c&+>X&hlX;d1F&Eu+TveC1hq
zV{K8|=A5xQSu<7T?b}oC+?sNu#>v@+>qSrBdoFHz-ndz_J8}5V)2%wD$19}wTwbnN
zZvrl9l%Fj;8x8!zmu9TaH_QpVdTYYYt4HiiCOkU1=FVxL6`$A!gFH;DLOhHQDh*{}
zE^P5|tIp8WswJEaAer33g>?7n`zqEx3^raF6bUbl1`3TX&10n=D=6|(!fvJ6t&aIQ
zZYD3~tS(eixy90=Op>2Jaw+ocm?7{}s<h#H#K2hGPz(=J7v;RXl3@m{T6CzxHf&5)
ztEQJDPD9bORytrSbK*foP-eSQ5ze+|0x29SvXjd=Kwj#Gv8|<=RH#gOnKC%SyGy0I
z_@XI6cGaSTt#=e7R38Q^<?pB{kHpPmZ=cC%XP8}bVnc$)@b7<#8SmCo?XHM?i7M7d
zL|lGfS6+Fs2|Ql(EW8%@P1frMi*{5?u8z{iS56t%HnH#~uz0>})>I{{?wVST4)JGd
z)-k5nud}>$mNeps(y<O$g{ZD@Sw4kD=Bs~s3u?f%8s7`h^vd7I`1Qk<*C)dFFFZdn
z<9RTS7d<boJ7z@bSd*IfM&R>h&*`dXw-NRdxX1T_5QLotyuR09Gx+HFil%MYnYS#w
za=s2MEXv|~uPl0{Q{}V|JYRXPJLR*p4OgAAP-S+y;lTusn)v<&g&7N4qH<%k3EZAI
z-g$Vyd(SR-vDol&xa4}V=1Vi-uc7RmT*A&2)j(%~E^#$7Kw3*g%~)$IiOV|%h=;PM
zD$cfIHP*5qDpD>iCjJJG^d060lS3h`7q=MWXqrm%Nltel%h8lNVnD2xH@zHTlW*+9
zIJ1J@FdXZxCWM(AfIIc_#k6uz=?LdoY{fPxJ0#hT2X1X%1`gow{946pK4j4pBWb@{
zwL7culcR2P82i*Zct#8VN*62R*{&7LV`Zwy8t(Drb~GOz@(g6lATcyiBXCbO+s)6R
zj+lFSa6A<LxOA)<HK~~qu$?_8BTleXHHep<lh_bNC6ba`QV0DPF1)$us%i_oVP+Zq
zc#xKAWvljl({r-%yjXeqpe3-<TXv^abKQJ=apMV&o41G)R5kGy#@^?Waw20vhbA2`
zDQ#D=WKAw9U~$$gF=}WNqSB&)qCU_h)frA<!_iRFMX-_R3OhIWg<BK8dS}Wz?TUYM
z+VNW(<=86|fmdb?o8GhO;)avl4>WlR5!n!PgQp2AAZoO|@nq?71STs_-v=}(jR>xB
zoLqN=l=t@2F7W>OhRz%7V1%F%Mq|cFu}H@P=QJ=$MZ?rMoWS|>hWD;EoNao3aM587
ze$ogxYtLU>e#))GDGN8@a4LkGC}ERaY^g;4S{IRl^fg5DRI}E+%`Y+T)wm#!7(yTI
zzP=w8Wm4I2i`{o98hOiKKCF4PkVXMwwex>VJ0#nAHgT-wtUCFy9k)|u%UPvCEx(VB
zxBw#-fmC#}B73%xrPX9h>RK(%@)6&p(&?&=ZNb#=?s`F2J$|h$8*PiWXS<c?0o!8s
zN@W4Aw6;{zx2j0idfd{nf5B`Qlb4oiR*eFr9>L1CVj<_(foy}@OKq;5cvUI2F{i>_
zn(ea1jIm+Fkd0aesPnTiP#mT)!|T8uGux3oUq~>V7aPxuRnJuy=+mq&Yj@R#uD49t
zM2ciX({?ZeaYiEqv64oSFUs25H-b3HFft%S27{#{Y{U?|Wl|%#Eem96s4Bgq=&;St
z7jp+JXM#4+9!&XKD?D5G{NU2_!W30uqQat&wqa?~)$6L?Re{C`jpKNepyukCUn&=y
z_@u(h5}Ox}_NQERo=xuy!?-u43($K~fMkdgJvG(|hZs-sih8ASp)@1ME91Sh6(&)d
zre;_#JnrFNzwkU+c6{@2%`d+53g0=J@%f_T-9?IK%HZ;llRk!#f|l_@2H#XjN6om%
zq`@t**+a~a^*!46gM=-iB1degQJ8N97pGpLSvk%NFCR^16xlN-h-neXSAmUbYd_!s
zE55`i+snvQ>00Gcx_PlG>0)%?8{r=Zg~Cvv>aH>u%NW`m3LjwL?po<~ha<C=V|~30
z8F#y5W^cU|8~J}r@^cllQ+SCsj)a#%yDQte-D-UDr%A{d$+s#9RwZ(fDuYgmZ0q5)
zA;W&Cp3$=X8vUuVkCDw;M$0wB$v{sOC&^6pmt3v^_eJDU3bec>B2z1b2;p?&Iqw2b
z7Jbo~hE#0Tbl_vBf@?Bh+lo?k)?gDiXx=j{yZTVoL8DfI&yi>YUVEc)@i8<3&hsMA
zTg*S}`jq0EqdgKwLDWh|C{*&NP<^1)SOJfFIPuDS)#G~4#4M)VdZiD>k5@f!?M-;F
zKjC=Uv-SaXiQkfx6H|m`ADO)ZeAX*pJD9N7C{LCFC(s84akwsUdcDR%ND{qdO7Te>
z9W*j9a`8*YeNA>+4T-dsIIa=d7@4>k->6AjeY}DHurYpm4U>Z#-Z-4{on412d~czw
zLpquUDr%Tk1-Dwj<>i?Uv)+6LskiYl<+q366Zk}ndrIo|%LZHOXhBrLSEvegZOn4j
z+<qwP)dDWZ$&@ixoasts`!z|<l-zvRt{<ytYn3vhj1Oe2zQ{_0k-j$H*o4tYql}&_
zy|5;`v6yWYLro2X6v(+%T3IUkR$0E)V*=YUOXN{Ub<!UhCi45@#<i-R?ebDIkkw7+
zmR)(=?fyx#U90A)*$^SsX_~rbj7sP>s)!<ql#zi#s+)SP1{tO)Wu}`R-6gVOlcojj
zUuM3W;5QGGVd5S!`DUPy8FJEjo-cdO)}B7Qs`5h3DqC<Fl*{;Thrqlk9c%5Ojt&rE
zn%a0x{DqF_OtV&4E(4RN8{Y1fj~2?!t(Jq=W^{9gq8l_7-Rv-N1A!?)af(<!zu>i_
zDjnOGz>hoQ{tftr=eF-@62ocTDQ${EpF3z!df($aB{YIMBS=h(c(rvLuZ^3H(zvLu
z_}bB&hr12$pKoZK@Y=08ADu3_-t=@nFm=M=)bZkG!@4Jq7u4`+UY(h^rQ_5=Enwx?
zECUzT;&?(6WlJq4cXSqbf1&)dKYGru-J9{wgMEH=FY4lce-YS($e);6%xH5M!8FDl
zr4bXU0GQgSD2>oj!9(w(L@a1JuI2flAIY_9&5+b0_u2)8jnZ>vOUo;DG!6Ap)J9y@
zAp=ZPb0A}rMvWg$X|t|e<++&aXqh#_L5?iJl{~68g4xz{5ej`Qr{$JlSFH+z4GY0h
zA2;G4jAxqpbRt_wNXvnm_0p+Ms@PgI<#EjRe0Er($)DQo+7~Jr#@%jRgpo>O#*jEJ
zqbM+j@2^!ARVwkwH1QH3$3`<=sm2aj!QfI&tL0_R{(_^1$~1A5U^uUd$WdnQ<}bVU
zfzvMVc;Q*~d8`n}3?aM5%A9LJu}SThZX}Y(YCuKGHJSqlVjLpO(%4~X!j-{QD_q`q
zo__zDH=b?y`rRoXeY)W!80)X>!mqZt-4^pk=Zz4Ai5mbHmbc!a0*6$Z$2#0F-&xmc
ze3Ck2-xy!-jhj`#_kq6mWt0Bt<qFL3LHX4Odziq7rwe*D?lv%;7>`#0?_*Ar6XW|Q
zOJ3a(Q01~yrj4*z_fcbO#@@8y-h4{Gj^LawMB1CCWn`@su!_o6j;K2L(lr%CMN4*6
zQ9%(gj2|zI<)&xtJ>Pn;$FCnum|%SOx+h>9O5_c<5>*#BJ}N*KYV;*NVo*GkkC#`>
zdnEK&(3n$Ix-Bg(EkvXLy~aD(R&;u;ldS;bHQ7t55roK)2{sfz+2VSokj)~UVsPM<
zpCbu1k<|*Ja`)MY5X(#MG#e%3meh+XXRU18({d-iF7-7T#%bHO9q`D|>U=@B`_e*f
zyl<-j>tosHpxfnTSdY{--gtS+T08Q#mYKyBxZN4cD7&pRg!x)3$rd(@Ge$RK8Jh=z
zZLiv3xUj0wOVvq_rE+Dqn|{ZfkQ_%2v88MNA{}o9J9os?;I~qe@PUX->bunO#`9v;
zak}!U+Zk94q0D!sx`?fqd&<*p1tv}9mWXfYRATJSYXYx3I7)inGvKiapY_Jm50)(6
zU+_eY|En`jR)Mezoc`d7uil^W=o^Q;+Z%l!AKMq1rIZh~)0nZ<s4+=A1xZJ8)o~t{
zg%~#ZQGk0BIOvp<i;l&jM>|c6KV#7=P1-DXn<(2_uOlP&Xjiye!Nocr73VIRAU?a;
z@QbhCM_BUPpPX@Vv!Nln{nV6A=ebz+ELNVDh;8f=`AuywCz$#{;jET+FIH^E1%Or3
zXOmDXZSFOVAjIJ5TKPX8FF2gG{8xYLZT3HW#w&QPywL}^<6yTDRw_K}jn6j1i=bRt
zAf)^?tGZNtz<Q4a54)CYLjV9E07*naRGAvb*t!eQIGCiAj!875(<^KObYaW&wFR#p
zHVImFw~?Fbs*Yv&`*7WBA^o}Z@3F|GFz_^2mBd1~AzRH{y2<HiAwGKk%3y=HE%Sv8
z^GX{@y~Y(W7Sc*DT=0nLn7Li-Mx2Rsn#hPx#un+?on;l1b{uas5Xwg1SFFP}QUGMe
z%C=4UWy!3(bh0TL+G^=pcnDdfQOIt*3~(1W#0H6t2xfzr^<{zZXv|=hL4sWOq{z#h
zi>GK;y5ESTb$^k<yM=#ztCEoI0xsWHI#oH|c%CeJZhD_$eAp_wnLg%<CUDHYkAaqP
zzB`^T%|*Bae8~x4Z-u*!!-DbRe1o2KJU#V<pDt;8<yzs7PCA-2sOzsiw?1F<>T5gn
zO^kSNG|zu2N3D=PJQIU?>fm-##7!_*5xd-;1PV_VZKuYSi#SQ2k%Yd4CKOGi!+7_}
zRWuS<L^K}J@T2R%(#N0mOOFomo$|r68-hgubU=&0$5<OY3-5|$Hb@-dZ2G{hiR0_{
z4|sC1<l^jx=|t#)(D}rejX4_?JHaaRL)`@o|6Q$QM#N&RQb=LXd*$Chx#Hk^kGa*a
z`1@}iA+ss#^_q!+E;p>a=cDTlZ7}*Su+hM(T1r~tE8u;!|5kIeT<9BTv>1Dhu<ziY
zb?k{SO>_H2Fs?e|!i=>lLDD>vL9<#$2x&fBq&_Y#TwHb3th+WFH3LG(3(#N*(l0TD
zHQl_*YsHW@p$tnW*m9LwPSLGXE-KSPo!4gL<yy`3ElLdrHG^cONL?&*w>#S6+ejrb
zUZ`!$ysB~EIA6Uw#oG`rnG0n|*Nu#Zy<6&xExGEb2#+MJ>AkFt67?obN{6df*@m~X
zIpvGGU8!8+vh9i(C0*oMaULTKvN0QGydpG`i*Rh}{xZw8+gr@tdZ{L-o46c$zVuPj
zluQb_=;p;uKG2o<U7hdbz|ESHiI!iOMiQhub-NFz4M#guY~i`xui>KO(@$5-ZvqpG
zapk0=w5c&s<M%&XF~2?KZ+~Tvf4esNX@hHH$24ywU9j<mn+x0pUXgf*nE`82&J9k0
z%K%;OfRlP);iC2U7w*rw5aamqf^#2dJ1L9;Coy8Z#qg^9@+))x>eue^yTAL4b=M=N
ze0I8|@07Du$G`mE6T03r56V=Pvp!mMHO=@!Fct_;ub15Pp1ZqK1m(K#m|?6mut^=f
zR<_nbVGu_<S|H;oXCU(zq=~j`RZM;QI^(_bz-PbnA-{Aq<G;DL!`pXf%pM$J%>?hJ
zY_1pV{PZz5n~vve<Cv(tP*q$Xzy~Bb!d$vw<9lqpy4Uca74}6rm^IwrZMZj&o8jOM
z?R!>UIqr;4SMV6)q=%I!!I1{Xmn03Xq~(`m=tLr?*%H35B0J><CqdgaMTe_G<Kj)o
zr!h=OMOVa7LP?`dJ#satwDHVYZ3NjKVHu^i<!(b=w!rYk?wfIl>E>f~DsMev*piM_
zH)6Jo5JS-&Oa!vE?zeKZ&h9%m2H{i?9;+6Zh3F=O_PI`;5VnB_TO5F@@Ybx{k^0Rl
zB}2WO+h#}%-jHFOQ!7L2wot~Sm$-+>#dmAbmj35b0seCp-pV380bVz=haz$}E!B!s
zP0i%A^E_YmTx_B<E0`5ukyXi_!^W|~IaWS&*_ou{PwGZxc#~QjGZ%~SENOk4`GmVp
zIMA59>q3H7WyWhToCKa9FM0N2!mD#woOZ07@XFzgfAaMM{@q2-N$Z%p$jUtsc(pOU
zCh%qhJ7O%n@YowaO$GPDYcgfT59KPr#*DqG<8UfSFhZxeN&4XHkUX%#*h4we!2kB%
zDQBxqN@!L7`1y4SJiO{|5P==wP7}X(;iHaKQx;j*D?eJU`RcuW{)=CEiw~Y$@|)lN
zglPl&t>dsY)|qA&gidoIs>Jg7NNq79*h)^M$3zoTSc~)3OgUHMhZh_Er$2nmKfJi+
zm%sfMlY9H@JbcK`^)+sNO}|;-rR7#*Tx^t87wyKO5ma34#Z{S@a^Q^Dcc*M_7Tnr&
z{Oxali6dKadm6a+&97m8Nq2QgV9w>G=h@S94$qdDMiYsu(3h@|!rd(k4jH;!C(wvR
z?RNfvq`7HS0AwGoON-$U_2=RU>1N?2GKGTHoov#1Gr(*df)*}BMRlvwa}&2hM8;+e
zZ0kr~Io7tqElnzHWjaoey4aC?%&Lh)rFM|9p0|AW7L+{72*)t>v9Q(3Y}ZD5hPq?k
zp0#cv9V?j_*jTY3V;|cH%b4Edp+g=)BvaAff-r~->Y1w5uUEDsLYY+|zv<KzZ{n^R
zFOaS^`SZ_sD~s@c((b-$W=CnyRhDWCuUvGV$JZUpJ`kv5+B3Fw5PqAhW<Un!(tFXm
z2)3=>7)xA*&R~ggy)l+2OXkf6+J@`T7kv7B!^I|MhWXx-TrI_jCmrZy)${(vhL3}C
z<6|1u`l@5LYg|8Dvz#{Exidv>%{g@NP~aCD<I!%*bkeZgcn)qnn*cY!!eZBJX*m^w
zLk0fuvn&41lLe=%5Vzneh@@0o1)Skc`R1PE_-4%?Twc=?3xOnlZHBVs4z)8wn;3|B
z?L9un)r3S}3!an91%L3tbEZwh-}%<-{P@`gA3VE^?zpMrZWAHEof_BPxDK%h#$}>Q
zTl;Dhp-RZ|vRs(+<0i+|st^3&*mEoN?Djoh{)T67zC-Ka&ZF1)vcT#GAM%aYb~(8H
zfIs@|ln-BAaMA^yt$L*Q9696j>orF^j_>@!JNys7{etgaEqUeD1>a~_y!Fm2?0w^x
zz%O8NiA@hUTzcj|c#n1WQ(kn!sdp?@F+Ug_ayOD?VNEKyj@Y@j0*z%hvX#z7+z<n!
zCb8&xqjiEeA-G7`a~M9&i8Di3Qm2~@JTB#wxpd;N@N&@|o%phRtukw5(wB^iu9jnW
zE)vCnVzNam*~<B;`My@s&csFwBrA;FAzgziaG)4fvK3m~prwsRvbc0)j8)tQ<J1Lk
z+a>l=%zQ;6tK-_KSPQPQQIA_-DT~GJ@S?#WAulaDzi3{Z7kc?O78%H7^`B+_xBCk&
z*Cera-vI83$U(tBroYZQ&$E^1Y@L>B8TY7B?oxQ!46qMZ0X;H(O6K!n2{GW|QGvC>
zse@0idfvM9>^42mKfB?05%|%C=gCUB*(j|Uw_RL<Ohjp%vgqN;_gtT>ShyI)ZouWr
z^UvP9<T4nuiSgxjm(znO4&lJyjj3?=V9I1?!rrn&`@ls93kRJ<bH*}hW_=1$e0H_r
z)62-{Z6w39azZZzQI00UktsjD@htnOV+|H(j}ivM#?YxK7d^NZ_RV<F`SLR@sVbgd
zEO~yh<g2e7@SQjB;eznsU=M(2S4*14m^H@C#kuK01FDW?2;BG(!!C0mWXUiaWKCAh
zeI<<zI)!U-d~^-(etM2>dhR_rrk%vs=hNdW-u>xwo_Jy5T0Xv9bGq2jn{m?zzOw81
z2Y>H7{Kjwn5kEY><ofr1%E#9mt~SQM{O-qGz0&gN_MBTUKF8fTg8N@aOqm|Q-is4%
zeex;$S8HaCF_9?GtN&`!qNB;32ZnP-D={6UkvPU`a?*0?`r>j-RnZ{$w!!<TT=A)+
z3M$dHAU^3SQ-#;mNTm1CZIQ#Qnmv}mn^frqTB)>j=w7vg|HxQS8gGR8lxSZxVyH|V
zx;<jBEl7F|QI`RbQ_V%PW;f$1rGggJBNE##{I%O}oK-pUh}E>S@rXcPcB@r0-qOI9
zd30sY5*ta^oNUDwRhF9}NNp=mPqvCJRg_pNxLL`NJKe^`uWA3hV+LSiX0HMdMdVIe
zsx@gCZfYiHUEuRY&($W{gR^ZnLvgImvrpZEm1Sg=20Cko1euB~8cbLUyzol*Y{TgX
zm%P##>y>iu;ggkex>g!hT2odbvJ71C>^L}@7)J!2U)~Uorm<gB2u^vSfz}CaFuv0o
z%?^CpE3Z4pfq-l_$c|&a)9~uu8DeYpu6hm?@WyAVhz4#uVY*&%zFe~mgB>=QCI&?8
zj3>a`GsneBd9qY`pFT9Al{CeQj3|Ot0>K>T0{17zjs~v!sGE&SqWFrcDjz((=JCmr
zP1p0yH*d2Ff%SQhsd3%M55>d@69>+exxhUayM-G9=Y62d@M6vB1d1l$2pZBJM_H?J
zu8vPE(1eEb)dhE-oYR}<`Fg{LH$5LN0x!Cd=Ki@8jq~(p3jh57{vJ=RRxH%`@rx_W
z;46C*W={F>WzX+@bi(|1euvk-{Wi^){}W6m*v&bzJjZLGvv_xNX%|3|A6l8OHF1<p
z>x|aLLOYSV0H+g&*s%1{*uQ#-${cS>kJ6>DUn5vZ_GOnw6JgMS2C2*zRS~Gc>!ml%
zKy$6+W4YwWfRD6Mrz?X}Lu*~ERfKCsY{QxZVHI*xwk^XYNOCKcqHdmx@kCyN%1Fvr
zwrU|Z4n^D^;YtM?8ZYR^S#iS{p|%w}kx`s`2{M%-(ncy(Syod?H4C@O25c3RgQB;w
zkupuvbx@@crJ_6hStBX$@z2xoR`EW2soQ;EX16mCCqMPeE^v~VyQ>fvIa$%5RbXKm
z(B~rz^-{o~amdsa|D#nRa?I!i&eqDaXB&R}WX)k4kB19Q5jfts?3K%)Xo&7HOzDEL
z=sou^9<}iFX2H$gPRTcO4nkvmWe0xou;JA^Q{Fq>a8DF}v8HKf^pDp#lnI_!XH#yy
zzQ^Iol10}MFkWflS9gpzeBeD*tPe#_l$~37x%>J|*j3|$rDxUI;La)+bQIth7pvrM
zM)3$|A#l*bWny5&*U*>6&Bg~-K3*z6czlwMxQfSk<zU9W-5H;pFS%Ivymhd{t!cxP
zvm1g1_8Q@hnPb%}r@hiypw~42(5Mcmt--<ID)d+{th%13OJh$wK?9dwIql;te3dN1
zP3jN?!?|eN{@}$Gu5mQtQYY>CyWjpQVKU=i|L%MI{_%zfPcNCxKjM{xBjn+?LC;v8
zJm<wGaOESw-Yh=n(ef;f7+Qh0847JH##9^=m;NmMKhJ?JK|q2_F>VPs->cB%<w{Vb
z0SSUS861EqTncnR@YaQNWEoDKST3$r@sw;fs^Ic6syKs0P(~<4d&&O#MPFw%LNh13
zSXFQ;0@<K#8-B(}KDG^q-}-hc`BoiFTW6`|MSI=TO5NBqmX8g-hXH2c7&O17Jj#|}
ztd@|;fVa%4H}w%=ut3WwNLebhfOA#BP4}QY){@lq{+U$`m39~4cAD?rP1@aQ{i2<u
z#M`rVV3P`O;Xs*<m>rg+Sy4AzF+Bm92)HDfs$Sf32oOitE2rlxHrE~Vxx+NJ@cU+*
z^~!niCu`vV2oSvTTn(A_yt--lq-hCAJleN0?f3SsaCLga-B<USoAK=N1@E8SaDV35
z!`Pj|{aX_ryz_wB-5uVsK<GNYIte_QIUepd?A*J}2bUXeKR@NE*Qi}(U=}=>3b%o$
z3*~qjA`pi`M=6P4plLpq6D2Gye#DF$Rd$nIaG|lwlgi<gUoiz%-8kFoa@nz1bu2a>
z3CiF4>V3ZP=3V~j|NbsduR1OrOr0<j<#uCOqjV}<bjmtCmjP@Qi}6McPhiz~PQ^!^
ztqGken>0dk>9|~$5N=pJ2(k0d8{mUU%ey~)S|n|<H)DSE3L6Y|4$<S!S$y;fpPk(B
z@v`T*_pC#FeOig?lycGMqAN=4;-62&m^#NqU?MP0$sCO{8eFw_bde$LG;)vwY|KFu
z6ELLFWHb>beGXiWThT6kXkAkEjBU=E3>ibw)$A~{v8&4RXCe2GQpd@Y;6g(>cb=hI
znpKugR|f-$ZJSPVw^tS2^1IpC+_0T|QA@oTkpiojAE{l2W8_S6qvbhuHNYKA5#u8L
z5)`LWNl9%%E@l-O6YQj#=hi}xDAG+fV;eQvHJU<1N)Ie$xhIu#EfwN){W;;!KI5%k
z&`Dx5yjE#<oBaE4g35&tJX?0$bfM&v<)m$`8Ov_ibc(sbb(oJYjl;yn0K;@lDCU*C
zxmBYNfu;AXy9TGmD-Enwx$YIwoHnb)^+X7Ty>Q%l4lkEHn9g`=5+5@allQJ2mut`M
znd1-Mf5E@{=o;Sz?zeEz!2SfjeAe+-mQQ)(tp&5g9qzSoVDS3g9S&YOVDt2h*>cT+
z1fGZJL^F+|`n%I8OIxhr=}OsTHmwez6v-WK>fUm0SX^$!xbR@cr8#z;a8(hn;+;Nj
z=ZD?E0M9lvR=yv(*M9paPx$_4$DAydXi#=06PCW`a6aMhe(O#CpZ6bgcC+BMso<3u
zve_vib@NVv(9xTZIdJK2KZIQiPGX@Ea(7^ZvLM?nF=h^4n>T#*V8R=_vDN%!+H!TZ
z<lT>-!=t;b-+hne*)`{vOMY~*=EIwg^G$s0BI^-Xx{jtvMHi_GtuSfgdogQ-nS%*N
zD-Ep}6Oq{c##f%M7djPIy>Zh7T$dI&I81zkY-bc{e11)`4(A!DjY%|vxx>}q^sV`6
z6&)ls5iMJo)y8DR%IZ9lpl%i2;ufub7pXlb#cDgY1rHsweSujba~0BJPzK4E)U)XP
zcrx0FjsCefzecl<*j>1)8?&nDI~b`YWF*$LvF2B_QgjbDmw_fJBRG2DflH;E7~SA&
zm)bCfa14fu*8TaHYrAIlW^$_C%F*pPW#ZZg&bz>irDy3iE!0xstts{*Lt-mq_l)H%
zp0-K))P!29hB9g(ZH|*rEGQwsF3QB<JOo0F)kQMMCdbQ!P;9<^2%Ibf-|QA#w7aak
z5bdZg@U(CE=btS2-sO+^y_25LJLAw9#|=!=2l4~g^P}@M4<BE!KXW*PHxB1Kkbt(1
zi)U9{TrAPhW8Uz693|YHfeT72!r4Z->;him2Ut>u*Z{eYTjIbV%+Jx`dE>eW#%&ib
z?A~G#%b)E&744>ipJWP_j+!s!C&!m*9<O-c^LM`W7Qg++kGZ`w<=21t5x@77r#xK+
zT4(HtaI1+okfjE$`<_ML;Z@7xO4I1kSz2ld35jjR(c|*c%dF@hry{(u+weDEne*4*
z*x`-Wj&SpRK7Db)AD;Joyy*F(A78Nl(G>@cu~FrC?K$5BI*k|lB;BlCUU;N=ZcChJ
zPn<B7$j#VsvEat{)tEV9D#EOF>^8!@jo%}p^dYeFfyD+c*T%WPrHe52(4{1kczF}j
zaWzl{9u|s?jtK-MM01=ErlgH*jbE#aZbC?k)nv2;&|&EC$|6k%;JTTPc?C9fyHq2F
zQ6npiH1(r}np8g{PnIhS@A!MGxo*iPtD}jeG9V18;kA;X5Y?(&MjI{EhVg-HJ&*c#
zD*nY<yIq`h>9tfD3@{brx8`~jcUmsAshMcf&vZDPgM+F2vlrexW)P7K#5o{JXv^UJ
z!UsNIc3iA|f@5dRt`sSl)yTM7B9f7U<`5^?v;{wKImbFc!-8NwYd$?2bL;{V0;`k*
zCK@GVQot+`0Tzo{pfNb_J+Jl``00dqy~DZ)tW{P1;B3uzFH-Rc@q%77X?A4rnJVwK
zLVKckRptg?pI!4;KRM^E-IkMO#}CfeoNfYLuQV8UCNb*BF#1k7UIn@ki)hGXE>*;0
z@dCv=B_p1s(rlW<2$PK%Qyh<`F>0s_c^j`KU1MZY(c#EhkeQPC3~8?H;5UEw$6(5j
z7aRWD|L)&#w&|mKAp|yRT%k<ObIW;NpEzU}HYQy5%C(QesevYyI+o%ROULiD`4)-u
z(nf@XiQ{X#j=%BNA;0)*zs&rtN7()mv+w>spZ?za{NZ`W^G%>#dnP2xU2=`NvSqe1
z*L7*E&;S!LCI~YT_8Q@^74}+~H&MBm=fE>3>`md;)UiKv?93c(6ID6u-m_TtoZPg$
zSZ<gv<Mrfw@D74Ri?vH88Jr;@9rw!&-$o>@!Qq@#A~G0$VtvqYhn!^&I#9dH)<5A7
z#m2nDQgn0rM;Sr9tW!0qAT(wp&+;hGjq$8Ga}`v+ApX5#|BlULG6K#>#e9&uxQUI&
z47K!jn=h9B%;iX=N}1qfkj$C5G4wta{k-gS`F$uqXL#0mVdvDwv)&{_l$4N8I?*BV
z8hc}Z`X4X6S<PT(6A`&@X0Ik7&Q463h-!vDm|S$qlbfEKPD_`Y(}VMoBPWs;B35qU
zHNSv~nAtW-oS&&n15-C%bJ3XbSMKld*AImM_0wzKeZFSiMpv8*G4)n7Ck#X;ZIdp1
zb8++Csq*xu<IVPhtM)b@uRX!LICpE3q{;;Ajg1IRQ)N|&a_yr=SVPq1o-N?h)rLEb
zu<Vt`tH7BL%q5N}7QUxb<;{7+`8u%Pgyf9U!6s|NtPXr4UB%}z+@XhgubJ`fH;?!S
zzw#yi>A(IV-#cG3bpv}rN<y+Lok+noR#sLclv9YN5496m^&1x5aQ@tJ@K1jA>-@%d
z|CrOOC5Hz){NwNZ0>Amg54pI!=F7V?4yTUG-gDLkdatZQV4YGZG;V8g2(z}~?(T%8
z_bfV3D{;i|tKWEow;$~=d;2Zq=pI}hGm(zndBaW<nHgqAXF6zfU0&A3>#Haekiyw$
zB^qP)8sTW>xHlJWPaAexhm-ug15+^$r;b~@Ew}gQ?A|)0J={TTL+~EI_FSJ`@L{ri
zZ~DNxQ@Y^eEIB=1&+t3tZhufxRS`T|gS{C(9~Of+$4~<)x^1btvbfCB?c|-5#9Spj
z)TR=v(;@~|&j7gDj^wGk-I~EDDI>3TpH}G*HI!VWl6XmxVvXEjk$zYlp0(^DmyB&i
zLx$AnNc%h<aHaSSa}1Yn6iy2AwfrKZB<A#riWC&>usNwL!?l*T`ezYvF24IsV;s#V
zeEt6Jf4uNkrir<ky^+8;huJid4**wv;Ki!reC64sjxHdH$56#iS00#hcS)|7V$*j?
zd!fVKvex%zihSEPJPj@X>Z2<j->h*Gi!rK*PxDd>h(yv>Qx0}Lq`b2xC}*9pKEC4c
zw&R`IoX^(E$`tcL(;DI(=0Qafr-NEXYSuyQ*w1_{#*IY_uc<L_;u7g}9q2Uh`UGy)
zfwNVJg<Z9pb%kPc_4$aTI+||{9fqcvB0RlX^ZuvDTyK25>DZtWDb`if0-mw7>>T|6
zsoRwytkRPDfE15o2<km6>-o*^{V_K;H(-Iw)tcY@;m3S<cEe2<nC&+Fmw)ZsoLyh@
zy&wLB|N3wLGQIcwhyV8ny!oX!S#+Lv-~W_Fr+n+tJ^u0E`Oo<9C!g~8<4=&#@r_&X
zpa0Eoar;mZyN2}ymd|i(IGi`!YK0fh@F5=(-H5;7Y9ds6N{!2k2I1Dk@o>N4XfE8{
zX?U>Pu-iI<MNoY28yaAL>bSMna`5^CCU1QMb`N3kIg@4zHevq!BSQCM7Aw!q+H<w`
zED^fg;W$fk_WUu{m*F=yd@d@&!w^H1bKbVlhjC$C&sb%c*VnGIFhJX_2Cvsg?Od!X
zg+l2Pw<5TtRwivjX>1FTiByUMD=LLi2&HTp7gD3;Waxf#Zdo;jNXZUTW~{{tSe9J_
zFCq8xuGaUuw6Hcu?b(Yrib|7=E6<5MK1n98dbW|ZyIIHUN*y1H@T_sXu{Y(fJlOrS
zjT$s|M~5Qvx|!V-k^N$tNL45&2w!XheMrY(t=<HY(xDByu=oVZC717#O$;6zbaTV|
zqcscEH7w`Ci^Yb^b)X@t7$hWTSn;^0xvo#$Lvj>}Dr$j7g)6T-`}~+kZ#>|gNz1tp
zoc6E@O7L#b2&Qg1A4hb{e~u}=H&m2a`mij!Xeain+?zma#`AT+2OE+JycQ6=Rlsbg
zHH0I6$Xr=2<impSN6&A#xL9)0hXf;c18-Kegh;B?Iayl93#LORvnj=`7B9vap>Dp5
zCIXaC&NgX5=2-Qf?>{|>R!D=h>m~p5AHL7|YR$>TlCOMn%(oxjVLF>~yA|G;O_<%8
zB4)g?Z#>W|ZryA7m3xn9LdU~LuX3=rOY{0ykVym5Acw-v!yUeIdd*wU9nY4+)&I}f
zoBdjLq}hGHFZMq3o$t+gW|B-YIoHgpE>?G|rPgReGAzIX{Aj@chu>`&eiCHp!4NzE
zHlVibmfGE|u3}AOkyV_T^L*#=+%xYXBK#1s_l|v&-K~d25tYeg<{4stvA(r_%R^Th
zvGGehrxiycG-IJDius1(%0iRH*s{=Wkd2O+Yel^H=1tUWfI8k`{=#LV#TE2q$Yg(u
z=_J7-^g0o93oRNe%gEv>q_=`?D5SLjs!0@gS=iiRd3QiJR<t7L(JUry<u}i{KS0IQ
zxA0XtrmM6vrQ{HlYnBsiFpc?mcvx3tIeF+>f9TesH+5J%wZrfmB?iJnHwaotfRr><
zDS-)~ilt;wPWE+(c#$5H0DGzY^;~Lg4#h-SRq7CQnH5X<BI#KmK8s(eq%K=fGPeWs
zSvf*VSqNG#-6YsQ6|Yf<r1Z-)g5kfMc7ugmQ-rmSaQWQ%|72G~1grq(fF+<8geI8g
zn#0s}s*O_j0dO2xsh6~tw^cu;`D=R-U?^=ht%i?h8bW$V@m$man4+`TV}7xRo$WKV
zLQlC5d1@UhumE~1V@gPdDm6Cu|IaDq>T;4PceZv|SYBf>7S1YHpE8bMW?U(zSkRec
ztcu@^Ltz1OANWXIYHg%l8wB1)v=qA+Z)f7^V+GvAGj5$pzi7JfRvhIbtX8C&a8w8`
z@&Db}JyDl5O#I(X7fuPUpBX<rRV-**PP7<Z^>dXe9qnp^bb{4R>QGiNBJNh=`^8kD
zo%#FfBuV(>$qrHETm}E@uWu7$F`{TaK4LBs7Mc-F1!sr5EMGp)*7iPkA8v4ZzQuco
z+r0h9e+Pj1AS(a>AOJ~3K~yn0HqBsi0F6cD)D<GW;;f!<!DO_7Q}a#c+HH)rEO%mB
zktIuW79$O_l+}eUH^1{L*>FJA?Xh?N0fXIr2Dd+9_4E=;uf9g(+>6j#fqY71^ERE`
zb*$C2*Uk{N71CRT<PfV9Bs+$v1&tU~gcU`kob#dKm!Y<{IS=Z56t#N#qI1Szecd>9
zkc+K?Mr9gITS67U4FIMN4L1cRn(9IB8;xrev2yPw^#a}CB(_4Z^S3ok+RF2MnG>D>
z6b7UG1YN?zt7TeI{#dedLr_g<VhBiIMbN=r#;XTJsA%A)W~?PrLRUp}WB0k8WSN5~
z1t~aDs<J7EtRhtne<sjGigU~*qn(7O0v~Y+?hmGWW8FD2OD6xx%e9tonm8*WOMa=Q
ziZ^<c8x9lA-Z*ER<(|nPRnJy2?OJNuZrPG5C&)x`REhMq{`9ieqKvrZnziJe7Au#R
zIW;_FVl=0fLq_f-@OYv*Og!NwXtga060J2fOb)ieIMs-@sPQo)6)|osplnXuG>B3T
zLW6IkuwaaKh(P~t8-r(3nDS~~ObFU)7GpRQDGp|aL886E-<Fa=UVM2%Q#yi}LiH~A
zqJlNv6t1d6GP1B7S+2}0mXz}_?|Z*(NSrdJ(mhMiNYVCN0Mh|ua%`4jbrJqhP68>s
zkXl?>rwX^){=o5Ct1_<ATa?21FM_d_QEnOQ+{Krt@Z|sfh*l(=?ZlkTGvbxg<dZ(>
ztzUvt=<yhu3rvqEJbk#%o!trB{e;|TzV+JcOr*(QzW)io_wARtc43*v4>x(`owxXt
zfBTmlK0M^p%>mPC!YoNq)^P3oA}=p?QAZQH{UhSjIjYe_MAN+Z67lLX^fw?+AezUH
zcVWEaZeq<gk_<6<M7p!X_~4L9s$Jbu5GQpXX+!O6Y;9R$>6jPd`4=HW*HjhkC-hKH
zSFiVC*Z|T}Xt&yybTU%_cWgCj7S;1ol@V6_g}VOX_ajn;EQFeVdZHS`aTx-!*4mSY
zd2q;<L5ZqkLJ*XfXi7(e_=C+Kx;1-T5yUDFYFjxZyso>_RJ^><;_6%jC6-6ynEQj2
zqeMHawW>I}#cNZgyHwQxt*RKd5_>{M@xw^yArAlE3KC=39Aw<uIQ;7m-r5t?+OCM4
z_0#U0wYC|WrH8p;XPR-G<YZy8FK{+kE47lp>Ukq&t#>J5i7M@8C5$6{TIWS{){+{*
zoL=T1FJ9xyc#nLXG2c|&-W~H7n>oMBG$UP@h<yu$ufNeYXD&A6I%kk)2)@^Aum^2J
z-fTHXKrE2C=`{9B8zWWcl`VSX%Cf>rOEVT0V$E4)Iht7Z5<_O3gkY2{<E6%!@(O6Z
zE?8_%ZNRi}KcQ+{-B{psQ*m=K=AGph`;(kck7j(-H*8EbY0$81{FGZ$wu&|iV=yMe
z=C1uAoM#k;Okw@9L&{CLs7i|?*z6W#k+Q}u7(|ud$&M0Mo5HEKaIM$ibSGxHrFi@8
z7mz&VXMg%Dmd;;besPY`)+R=8&_AB>WRUV~ka9fJ<Ocrj&%PqlmK?)Re{-7;VqtBu
z%Pjqj^}&?mS;p?;JqN*2LR$>ix(hT;pJD6nSBQSVIiqNw-zV<1QLC3wYp+0i0kicb
zc65l$orUfSVkgMrRqWA2W{<vLu(8ixe@cIrG0t*Q&&sG3X4<OMvv}^8?`4VfDt>uU
zEo{QewEH|6Q@VkS1nD(v>#f74I+zV6z#-b8Ww@^Enu5P@VwqOevzt2jTnLYr+Jp$t
za}6rrf~~t3DoM2_EmZD?0wV6LSmI;gk@xf)>mK|?;ihwt_+ia&N}66*{lklMy!+Zq
zSb>kezDxde#57Hq1x+Tkrr{!?CKY<qc+ZR~-5FA*Zp%qG3}^)DX?%irdy?_d`tYwm
zc!T<O5s`($&EP{5ap7i2jgfxlfak}lDSMqv5sek`mPO+!O$1Hc)d#^8grq2{WdN-X
zj%QQZp{%x$gGvpfW`k$FvwW+kxN@#Z``j{DKe@{weagd;VVdfovc>wRlEzxiTm-`;
zN1NPFsV;C~NBgMxC5*Hjk;k~Jw+`s~Zlb`$f7}<w*g(q@Sd8Iptm)5kwmiE6-@<_o
zASV#OQNTpL_}zNufR*wAB%-SisDfr}INxgW*6A)k`0mS0P0Zr2zvN(cz(L}`>|q0g
zyXBe^vSO^p>Kvo<T8nRq<C6fzS1z)($6Go!ghWBAsQg!z*VinOfmUoe)s8sViCAe0
zD-GdvC*t)tUgWqx;MS8Jes*`C?ZJ%oy&>JZUvXiv4HhQ3A+y49q8ZLKRy)?hG&jUb
zXggdfqr@=SKIYNZ5eUSpfKR*E(I7my`;ZGO9hR=W#KzsPvF0`_d+RK|aG6G{3)2xy
z4q=)gkwWIrA<LIwc8neEGr50@!_5N@`ct+BGY+OHqckVYJxIs*lo>Di*nrVce0EHT
zfYd?7v;??9qzu#)1B(f!MLAg@X)4}=@p-X&#4LyfTd7j$HdvE~Q1pPOAVKG$3SACC
zAV)%9SKyJYs=Q9}7NjmAlyIWDR;v62+l>^bnhlm(E*3P?rc44BQjf;aPc4Jgp!1wn
zo$&6W@JHXi!1;gv-=cGi{4f6__XZDm)KAC?XNUx~LuG8BBD*=;S-p#`1b*83-@8h$
z6~UP5Hj?C)dxz7%U1|`K25?41PWc5}+iSi6GSh~`G<R%<JondbTl#iO3X+w8G8R^}
zi(3K|KEgP1e-Rx3IgHdRIE-7Aq20A=np!@cSS~i#SZZ}?C}IB00*iAE8fNU%Tc*P7
z`1%_`)3A!eB=hty4<4}wOpY1tLw5<3a`i3REx=SHfJU3#OLnSECKWfr7|UuCPREMF
znPzjAl^U^>tlMIG3_O&@o0a>kd<g9*93RC3#J?_L3{9(9TI?|Q%5@r<<@DW0oPKsd
zSHaK(Emu~TK29;Yn{G|+ZxBVo&3AZ-L5PCXlz-qTDsQQ(gI7xIod_*u=_tnmUTrIu
z8qU7;_VqJlnda`ZT^<Z_k|zh;+Z*up)`<MkfJUTfHzK-5^LO6+Hv5}f{PNB=S?=I8
z_-kiVK`V0hut;1PXQr)-_S&E!p`1RQ3^L8(lh5z5+=-ZPDa_HBQIc};)D`CMeTteK
zpkg7u_6{mLc7H#eVn)ZLcRyvYalm1J#?EoV-Z<lErWt33%r`a{3rd6Igiu_#6y-wJ
z+F;RKTYnV}1u3P9vX-gV{1A43`TeQy$s^EGOX_|Y2(UG0SAE0{7HL&V%a*)|((h|3
z>su*hsDh_$tE&5OiCCZ*ZH;Cg=%ThB)(8qFJ5j{7xdz`o-Q~t|2P@D|HP#phpHY@h
zq(~CWy}^w2<1yEJ9bTFjR-2Z%)j;>RneA?K>a90<WpBji8+}eKF7WhV;BRx(Y+zxq
zxq#u957R>PwKX1lUFHaGtR-1OV3g+nNg8j%PrIug0oe>?h(Tu99On!YUDmW0uycxp
zT44h#mN`-t$SF%%>*GjF%Gd6Q_vG1f+B04wliaBWWEL{PWR`vgpXCrenDWM+;&Qi1
z9tm1&BCQ<*m&!V&ji#fV<ty{nGmCabfrSq+n_-8$(42#~RrWX)iB2OHn>$y6n-a9A
zeL48eYQy!CZOlA}p(rC1zpXYwxk|Y54y`It;q$B%VU(LDOC2qjQa8<aHkfSgpk_lZ
z%tu@pXAIMviEkaoYVZ2UusW{;tWR`|75Z;kB%o~BjaQ}5AQFvOp`pYj!6KLRYAK-^
zS(*(+w-u9U&E8D2kyv)eIUj6~nVE=e;{lCG(TWv~NFgHR8m6N7^WWSeon?$OcUy^+
z+YWbQ#})21+<&vMAR!S+9&t3y7^cpLT}*I|SaD{dMQ#l1ha=)MOWb_x1~MD7zy6H$
z!w)&V+GTO6OJ|`&)L+N0U4--){dk>pbBodTHiyR(4h9MPlbrr6XPD+Bxr3wU1qRg^
zXF)W+;!12e4VV3KWthcFJ;jRNhbTgrx-CNk_03qBMk~3<W#L$G=mtG>VTG2Q=oBk+
z5&<haa1oSAw(xcqFcE7I^`H`{Uda<&=}*LX>-7<p91#huG!@@EJI6nK`zo(|``g&r
zG5yE4i54!<=+2YxKc;i;MQo$P#wR~#_u&Js|K0zLqxGkJ@zHO2|7V}j{>8^6xguLW
z$EOcBdGF>GUi{(j^WXgs|B@u`5UHT3GFa)`0NA4l!XY6`xyJPk+!M7{3n^{3@!zEH
z8fP(@FM#JF(gPa)(6z=|>F3TyHcWIuy(=LfHbgvPgC^FH8&LdQu`p8AKYJnF__(F`
zYGP~rw3`c(S#)YSPAp%ghJz`jCgOBkSZgazw=BclkQq~5cYMokPr)S1t7;bQn*q?J
zhAcM2&h{bhVw-K31k3%vuWea+SRAMek>Y#{8p`r;pxIAN@Z78pf!cLG#D^ANsK`;S
z6c(c$IL0Ukl~x*z(iLqBg%&v6KV<*Q&uO+=oIkh3cSJZGCmc>R&(aK&=MJw`Tx*Rb
zsOPHT`ASy>)+NdS6*+xNfVN*qM1D!?6%>*j5}ng+MReOurfEvM-D2VF8ec!!;BYwQ
z<J~(x6&?{OO}n9p{I$~>$MLY%phbAJbBt2T$9!S2A*^&F)_O5l&Mwo7EXw3)ZHUFv
z>%>f_8IKPq+})pYG}A2gTK*xWdF#!WIhrJV^x^N=?+>|u=OM4Xd6V`mW3so2%?-`Y
z9L-Y~kcL8xCEvc!Xk&-b@s$23Wq+8kH%U33W{i@YG}ENol9`-5H{`i1^Q?kHrdA$W
z>@&*u;bf6x@#|~=r6c&YH4WBQ<hv3C^G%gJ)e^{twLU@J`N_76uyEAY9OP253W9K4
z=|Tvc3&oyCLeE+NWRR-H_j%5)|M^&iQ%(5(+pqA(Kl**zulxXev_YpcKwW<ib@~SS
zt3N|sd<*HVVs~ya*jne)zxqoa?T`8JNuTXWM%QyW2Gey0nc>RrkguL?Bh9uu2>qYA
zsi4<Tw3Lu)%QSc81MYd|lwM;4n_0Pn3cK2ZD0a}0QAkel-=yz)+~bP1_Kb)uT5H=u
z#g9yK!@<lw^(VRU+F`vG#OQi^ZLQGC+s;bpvxr};1siw3=AP80eZnLcRObKx+@dmf
z7>_heVnNa=`OXek8adxxZII+Sn=?0&xHc@!Tx3wjT}xH5SSl`xR(q0^CrsHKJ3Yo`
z2{!Ivqu6WCrZiJGlyyM!7)F_9W9kxWQDMXh7H(DUUTS_qt4{Qvm;z1b!V9Y4g=+Ue
zYDKW1gmYcR@4vXl>n|<Q>{;e6UnV~PBCT7u*xuRW{$a-caE8ep3bEWz7UU@^mTKWc
zEf@!LjfgZiOtp5f7a$XuW|qWOWsQ+?({D=&tw^}AFvst`{sKR}`;^~4-sJOVyR_qo
zhElYnh-M@uNv*IAid85jG*L8T%I02U4Ut&R&NX@a!Xl?yur{Z-`GeQ!o<2h|I3`Up
zWVBCjVTsw)a{l2XS`T))y*=RO^|P2pi(mZabAI{j-y&9Mx7s9`;m(s?j&}FCu-xXQ
ztEX8#vq1aOOT<@Rb6@;Om^^;W?*5qmIOS-V(w}4;%~FPG?h<+0kmi~!wdC3@Pc!5E
zySZp`Yuu7n+cK0AR?3(F&sYv5VWY6v=losP?-D9`K|D|?SZs-T4!Rynts!W<Y=5!g
z!5KJ^!qi;70HSvI7KM~G42#r56P6QFgS97+=0QsZj+=3|*Whe>Mss-;YzlUY^m^#M
z`=q;Dq)%>PpFSctO}3vt;m-b)e}DIgTZdBynW3SesT8Vsy{+P_-9DYeAuFq==*@Kj
zNOQ|_E8>O4Cd;je<0R+7amvOhWtLTiuu6rrL@8UStyFbW1buHd@cLW(w?lFoz$p<q
z1uPU$oZ=_P+QCWsvz%FG!W)ZsDg+TlQwPb{5Rk=}U%9Jdkq<6Dh)NgL<W6QFvzW|F
z4XKL<i*-@DvypJ6ty#Wuiskcjd~b4(&Eb@O24ghZS{k`wF18FZr{}6Nrdzb|`dS;o
z6}DLqxK78A&7j#qqYzO<2puIX#7@t9G;uBuYjYxT9!9L^vuZE2tICaS{1N9S=!zO5
zMKmTih^q2_g)6%k30GQ*m%B}_%`3itrpZe``VP{YL+lJaIYti-xpub4Tbbg)@eYz3
z-np{MaGG*w=NKJYa*7^14*{QP=K}esZ(ZYOx7YdPAgy%5$VVXklp2Y1HbmBPX1>Qy
zUb({Ky*_{P@ogr_jE)i-k)kO=FBTRWP9kWCTTE)7pN|Eak&E!oH-*et_NJD@MAH)C
z##)zu^mo5Qb9zLxVQ6(V@wL}zNDPxb?BEb=M05E9H!hrG`RXR!pMJpBVV~4kuCL8;
zVY$a*x5;EUW}IYn+D#VPiZk;umu|kyTw9<wk8~G7XXG1SGuYVS;CRaJDC2OFF`A`}
z6U`(yOmo9Db1aU;Gb}RWmZ&+J-0IRvQh2?sRM(8KqFp?9!UmMa(%uvlFII~*Q_6G_
zo^XEgD*?lyOeKdBgO#AGj2a@c=x8GV)JWLEEhidyt(@pIJAr$oa?+eEZa>*D@f=!G
z;8fePw$Md&mLZ-)bi(X-%I4=EbF|;*aFmiJIms+%W0dmQ&WtCcl-#=VT7#qL74ZE?
zT(&LKhUsX)k6t>@_g=lm(+BstdUlDIubrdYUE*MGkB@IZ;^WOR8-s*Nn)}jTT<@O0
z)tI0=k`T;8NJy)q&wty&+Xf07S=ak_rMSL~a>L#%<2ZHRU1h5ROKkNaD#JIPziQ2i
z+N6@#;J2J65Uaf$D!GG9+hD0?Qj27uv}2vd;{L#$$kJS0L`Cx~Ej(sE*0jWUE~;iO
zw$6uZjBmGfZVVR?FqqQk>V6GYyDlljiOWesq#{~zi%z3KB*MYOLAYJ>w_t5nl_VM|
zeVx`sWhWM;FIJx@+Org=q800Ki$O_X6bWZqiXSe;{N&myr%%n%>*N@d61RJpt!<L~
zx7oS-l&49PBONhJHCdi><Jx(i?jG^slRa{!N-fTWS6)BqG_mXxF_vO3_iwT(Vx6i4
ziQr2==Q~Z_xN(J1lJfK04{0|VWuwD<LpawFE_P$q+AgMxUsiTwMJtYo6fCzRRu`9<
zOs0Igb<9@>Ga|7p$2sggV&R8>MATcr<^w19<OA%%I{IJ}(_BU$9Wy=Lq2E7dVP%;{
zHzTr|ZZyZG%jcM1S>oB(x0sE_oO$62${Nz+15h!!2uf$L`-JpxkJ0_F+1op2f0VL2
zN;#S)Ofo~7L87&rcr)jhPK+k;p_xn^ILY|-XIscpWoU-l@+p)cEY#~CY6&vG1Pzgn
zA;_kb3<yeNz4{wQK#N1y@(qXX$uI<j{I6Q=dPy(~y2&KK0tAabW2;1)gp;8>FJ=%-
z>9Nstbb>@plBZuH_kK>c^O)_s&-nEx>pVM}kXfN6?z^99%UV--VWG*^IOS-jnHs6J
z0f(uN>1@XSXu_~L$HDP{AAau@uD|z3aOMVUk3VO*^&hylHeh{sz=(*6)*K9`Yz|Vk
z#%`C88K?)prS^KBlyc+01$y2M>f1YE#ZO|a^wXUEiL3Zg<*u*r9oo{1TfM%vF0k8>
zVB|M~TKP1H(^%c|-<b_<?x(^WB(+4^eF!64p%M=>*gT%_>a#v-I$(W!pIj+cyAkO)
zr-@}gG8{}@U?R2_tqn$Ntj&G8$asNW`%Qmg-*Ja@q%2JgD$f|@5o4_|68YeOH@{iq
zKs1E7JMSgVy(X-vJe$G8C)`CSY`u8Tx-iOe6!X?ngSWnSlg>-mnSSvR`N1yJryC6J
z-(zGOJj}cN>F*x!)zOs92s4C#{bwIJ$wetAu@tSSg|6sL@k&7k{OkYt35{lhxV&3c
zbpO~_vPW^`d?R9bxV_JR|9|`$(_GVRM&6<aO%%(q@ajU$_b<+K<@_4$ZVPOVQkqV0
zj^@%C^8PLnmfo8`BH7xY`Ku4;#1J=QuC8@xb{eR53l`T9IR(iO^Xv<TTiXn?nBm|t
zhg-XBPjVjh6Aoq?5yfKDP1;9WeHM<VOlM$eksr^{TB8$~ZVia_jJAGCODx%FOn*3K
zW0bHxN;#Nh3}*!hU6UHaEO&=(G3}<t`KGf%<26ohGoghnOmup?nYHzHiE>F59=gWX
zW4mGVLns;9Dku@Gx=!-Dy!LAX*9rmKfEtu1EDsLn(U83owxL&T5cL|j;?R9=s^vsO
zhHvNX#lp3Y;rwEUqeu6cKK&YHQZ^5!^m|u$G=jl6W2MvJ%0i2aD+@#_Vy{2o>-{lG
zATtSB;(Xt3L0kPdl`r7@;M1@9@S{&SwX(#ih0p0p#L5f1m|35E=^O{^GiI|ffA1gv
zF{jq%*}H#_+Yh(-`Mo_p+nLZ$ba|{7k5yAU=Bu2XeAB@jyeLIX_%yKSX=IWAc}a|=
zpBWBknrW)*ffpYfD6ykd=KsPxUQWF}iB(vu1SvmYr9odyIpx~iBB|>)6OUSKh)a|;
zF$@hn9A><_Kjvs_k6%CTvwZ#(XJg?n@9Yw57mbZDG{k{uu$r~Gm`QHw&vLBI{T0xZ
zCiUWa7J0+<ICoz_Z00LJTt&H66^p(Q)5_9m8&aPA!Y~{XQ~)9g>!qDf$A3v6iWR3i
zO)g(rV=@|{cMmw+9&-F_pWV%U_Kv3POf*l%IZwwK69ajkV~q6xBX0#0Q`XB=mZQpH
zq6FIQCdw~xl%LijUtMy#*W!h<%QWI9sF?R}Js`EPJI;^*_FOD1<|514hULbk6|Vf~
z`^dsF*c8bo&{=@xOX#P!$#&O?I!!t&3tT$CfRMBH!ZmuaCZ6v?e;wL$*r-W<u*3Mt
z7Ehk-^5i&WXPj_2$v8+12h*HsZpuSVFhuKp<|3GHMZ^MZ4al`Y1MLR~tTdhVZNA|E
z>XXc+AN#YM;momkwMS#7xj$&NCDodlb=C5zaR+a1oaU>`+n+7n2DXR_hfCk^&<)_@
zwp{d@dIh^wyO8oAwN=xDEjoQIC)V)Auk~<t|5=s5nNWrvLg07cSuNub*47FtZSm&~
zr{VyHQy%PL;_F1yu=UH_rB=kN^D)1FuEP)BeH%%~96o%&vwp@$>&I*lcZdYmIx$xl
zW8S`Tg_U=HLfo0-+!r4ZefBB+RC74X8E39%P+5(k;oL4#`G>WNkygww(fs_ghs<`i
zcwzOY=vJ4b<{}^8-y$C!^ZH=M)pviw-1WCObL%4_`GEcDHq)boRJ(yh*B(iPWMzL2
z%HNn=i$&zLZ<^>8G2!Cpr@3a=vv-Z9mPoNase`sBf7db%Q=0M%jj04AiyHz9zpfD{
zrsQ5D_5Uono6_1?dJ5)6=m<nMXD-t0KHlWxhx^<eXfDmCv}0&vS#2qH$J${9mGN<6
z!ymnJif6|Y-oLX|UAwjWa7NxLqOB&gmLxY7o4N>!<Tenpq&$4B&(JEV*qk+YO}H!x
zY&nJ2?3OR$4}F+#M$9S2)ChORhA;o(L*|;lWqUZ|?s39l4w)7vnP!-42DxFByAXx8
zrYsgM(SUdxQy{iUO@Ft3X{K0=;M{zRRxD&ui!%#7e(#MJI69gzYc%=!7k3elSB#)G
zg+<md-)wSbX`WVZk-WD?<LnjxI%n9yF4@z2^q+0AzqNxr{VQ~qb2!Wx+6KL553Q#R
z4-yvBXS9zqY?d=QIAnKyoBKyoo{UnqCn-lWclFP-ErTM(M3x%YGQBg)%I4-stOKJ*
zFwBL6#9P!beygpSW|lPfi?U*wW+1ozpFN^7^)1uR)lfJaio{^aDD(ec6%#Mt6A9XY
zjZ{Bh$P*Gkrz-PkH4T^GBwKsNms>7^Lzik&mf%2_pnul}eP@BWwe$p6le5&5ZK3l*
zs2xFJEMBlD>V$kCA`;HGBi=i|$REA;4i~@wT}JnQOS9GG=fAkaZ#JHxQ7pG2R@;iJ
zXP3DA2Y*ca+kcGe&J#6bE^I#G%+ZX;gBeFE;^x&gUb=dbU;XY2MzfsESQ1_R8ATw~
zhV=;~TQfdCOflw=qwymqx#jd+liPp(CtO~LIs3=|g3i_JyuSI6+q)xn$2t8Zci&Y@
z4P)!j$5O@Z?cdzF)&NdfYZpbNCnC+TNqD3U+mnp`Ob5`2sy){RGJ}#}(OPE8i=2un
zMd<S9P0_^Qr3JqYmK?-=+EEr-#<Cb0PBmOm;Z$TfEdy?@<Rph(2KO92>(R44QlmND
ziCAqa4#uvj!u7_w$#3U)!r@?w*bFfR`OAH24VF~nzDU)0QBwS?KEY~<XhXv?5_rZ#
zr=S1WslZ4ZRlm+!LHi)WqOx>b4cbaL&NAMAcEqjiV@@{}U4LL4W`@+_ofME6<F3C!
zyK~8F4Yt{Y1pZ+95aX_8^O53GSMl~@#2<b8I@0d(V0Xk<J0t$ppM8L_4l?9YO+Kb7
z^=1RDElMfo*OpOAk?ijgFD)aYF~cLq4{o#d=m~dsCfq;H7^OKg4Pze_Up)AnxmH9k
z7FHUH)z(8gN|@w^omtNMBxh@yaWpebGoNU(rb3b$N?&ZTcqlD%;v(NkZkeWVB(D7#
zaWP-lD(ra9+BnLbJAi%LuyL-1%z9UYHsr=#ZA(l@;o`9_Rc6BtTIgOVCRXpymBNN5
zf#g+d3NF|Xej1jlM6&SFm)J=Ep1Ox^C3#42<Ed%7woW0FZvc&lVKw38p?hNPvz6>-
z<+;0dpk=#%s}sT5r7ox6e3$0s8^rg1$FXT}cc57xq{IzZ6);G01}WrLVF$ZJi%Udg
zPGiR{Ahm%Dr&js)x8CON*I%*RXp(5lR2!1qkm#Z<$1+Yevs}}jC}QuejzqnIi(>!)
zAOJ~3K~#|$VXL39b^CKxUc63gd684Ezsb#wF?Y7cOmlbRDJ=Qr(yfN2bJolFZ)lsC
zv(~PONU84@GDBu8N2%sumNU(&#gO<fxCy_$62v8yRB5&<x>jkth2-h2v?Yy68;5kv
ztmEwFj+xLC*RgiB0oS|m;#|gs6=<29X9qLR&k08p=+7Y0!kM08u>r9%G$ZXaVzF3d
z`T5;V@?4|D5{o-*Gwq5mGjB9=J!c`o$doM)?vi0Du4nM{wkN%cQUwdc$`x?3O7RlK
zVwjH<-#t6e58t@XfB5h#?hG@gxx1pRr^4>kk+F;|I=;k#>x(bBss2<}Y~3&)LQ}*(
zr@6%f-AFj!QoOs?;vc?#p4Wf!14c)Eb{_qLCp&$f9geZSRidG!+T@0)Xe(p}4kju0
zpY5<_#$1XMv^hjNJ;poR+`YTOC)-oLJWALcYZ8yE%#88%Mb164*i@`F6)R0w*OOZq
zcsXF08fLj`@+kgp#+N`ASj=kYV1lkMPnIgGaICH1+tz&;%h%FRusOxS>wf4`R&Yx-
zZ79FUCRm`AO~E$svfGNeTTnc!h_R_H+azEINPucADzz-ddl`(I#R2Qx4pjp%09Zh$
zzqO!1SXXZR2_F_u+Uk6+RqRMmQ(ucI+i*E}Vo@0WIm2YLf2}eDN15Tl!H^ez^9!z+
z33-z8@Yg?M`0R*ABW9RsBBj}x#{Bl~7R`V2KXdhsH#z<NKVau~zvBMpKI?;oL25{>
z;isS9=C@zp;b5xi#ESW5%tBMqYec@C#oY`Goa5Lx$HdCr;*w0WKFoRaY?CXyTXbH1
zm)7cwocrWHXL^s>8Y@iZALQjc?^`U&52O1_#(xbMM*+*eNq7O*1sD}?<ji<C!_4Vh
zP(3}ZvE{O$FjSjBzp~bxz-t6m+*TnTXd}e}O1mHA#@WWSMHxfOTIL#-m4@O{Q+Rpa
za`|$H?%753pvUUrF>jt}GMXmLbsRSELemiIl(x-Cl>2g^+{9}mg%(#?lp5n2lC?tH
zqH5h#Kyh6R6FN9}ivu;7W~$I#-N9H$5kY7`{If<`m-<?0C>9$+SHXo|%#}-L*#4_e
z7^IqpD7OO?_drPscufHSw^BCE)*ce#Wd-Df>nDhEOL*u;EJbjsE&TAMHC}t~yR>e+
zPWtI@>84|vSwb&Xt_4D>y6svcte^H0Z5hsBFq$BZdD=^JNIt_Hj(E1Q&o7=1`Rp)d
zbCx?Ro7j@0TA26~Z8@Gnk_!8gt7X>~Qf-;#hRhnjIj{W1w)7eY*Yz^M5=4ppf>w&_
zV9-fsF=dmo@rcjjur<X$`$JdzLs$D7pOGpi97-P5^c^%$TNjYAMcPhGtz5Cz=o{4M
z*peq3@(?PiryQoGkX^zdAXuy+&rhQgv_h0lgW%34VKJvX-=|hfau7ge0?<xSzi#}L
zoEcc3<h;K*;P}sf!Q~Hs#hc%HoolbZ!yivS=WO?w&khnc#u?j_l-m*5$A@h7KVbRm
zJM0||xqCQeYnn68-D_~1WE{^dk;Ej4VVGs?&!DXoi>-)GBrG)*Z@zSy7hZai_kZ?F
zo*s<Ia)Xu#ZQ*d1b8q9A8()3F>gzwkW}0L;LZN6xLL(Qn@<CKz|D*%#rv0XaH(0DG
zuk994oVH8Lxu2hE%ic6+kZLmRASJeF6b<;zHh@at{}5sF1{+jHd;FXjS5Rp@VPA4k
zxq(c(saHd64NY-{i}PYwY6y$-4O(YcV7`Hh8uZSc;?lt(FZ9P;m|rFW(!D*FS60a8
z=J?&cT_z@X2c@#8$dZd8$$c=uSQI%*Y(*X`I<ssLsSTPaq##QbY>MD2Xsd6Izluxg
z_bY^#P6Ufhcb#teMca0g^Y0(-@xj)gvolS-Wlwwk#_JST>MbAT9#2(&4nmKf=f8T)
zUPa%pHrLGvdXeU(`6k~x*XD(bi%6$M{`3|$ACm)dEG}lLOGUd%9Tf;b|0m0GOB3Ph
za>T`JXXw24Jp|2k<1zP+*7^Kk%(Iy#(Z)x~J$G3sfiKR72{WmR1#Joasd%x)R#ys$
ze@W~z)evT?g<DvDSOC2xNLrRb84tcO-mj^xTaFb6u9G70KUXUesAzqJpC3~#G>w!E
zE4GjVsJHMI+HVOJFE!n&$C-c%SNMb_;QJQKw&M2}YirHjrGud)mQf~2i=IS+c8_mp
zPJ6CdqBxXoU>z$D`Jk#P;F}>hpZ(W;!}>_kT2FX0Tjy#Q+Ow3mSK3_bMSOgaaI2s4
zXqYfF4W7*`jqM3;`L8*cX_DOi{o5+8nv?_SXOe5Cd5#j8kA-uI;jA<<TJ!xkZ!o`h
ziud3DHG`REoWjvmGu(bc^7L~K4<_7wvc+NIK1a>SHE=6WLDW80Z~W3x`}g#((|DV}
zs&_MVMI^4e&n&~t$qd6J57{YIcT~{hZiAjCL(mp#Z2(5DKJYFm;rzAAI9Lw3Mrng&
z&i>W(0P?sX85x5yG1*LG8!<97M00b@Up~VNlZ<Em3H?b<D>9r}ZjmVAZUc1gU#tcs
z7{<meJe0RrRlxMh;ZRO0*ubpruA_zK8?Fn2;B+~G7WE-YT-$9Y66PC1M=6wYhfhDT
zjQmyB0-K|RMjShbL68G4bu?cvSnf~?8c*3#Qm=V0evKtqcKY{FJ1RZBrsD6td5QPF
z`wGkF)=)|qe)>y}T5H@s8grbv2bU`Er+x~u73)y@bmCHE`PStXzWcpbSbF&tWNsOh
z<@oL$?(g*3oMue&is|8er^X{GZ51&sCpi-&pMq_CP{mXdy=({-50Ry&gpr2_FJfvH
z>%}dm*w~u@d~b|Dbp6k3V?2(@lyy)Rd*bG8YG83|s!~fZL1;qi2j+>`X%VOq>bS<r
zy=bZc1>vC^M0<l8^m6AA{Gy_kJ;3Ky1Tm@(#gOSMw!Y5~_iY3&2wVHCRBYYis-z7J
zv}K%IkOq%Gxlb#fak*{z&u?Dj5C7oXT>AVoR_|``@qWs~LB{SZcflOQ?Krf1xHXI0
zrJo<Ie~;YY;&)02;~YNt>LH)qd4kDv&RmT-wKT_EE9PjDGZ(`vFJ0l>Tkr72*N^%1
z^M~AicFevbt9#anLHXj=+&_eiV^LZ8W>$mOqB_3Va#2J&E-vlf-qct*%G?HTFw+&!
zrS$FwvB!{0ph91uH{l2H4k>Bk2GPEj-A}*nhaob~I@TzBaK@5p8040t!HmY!LmHhJ
zGn>(9L`Y|z)9043os7}FO}a76jt<$|9MKX@CxUJ)q#0znMqy|uTk3SGtj8&?b~cD&
zhKyl?I&FfDFwY&o#`_4nkuVo2+K~$)MB=o{u`xb1=67ucmeKo*Z80tD!iZ=q(sB@9
zsp?crkhVWbhw~GSh<nI+rTX$xkG6sr=HTs@&vWUG8>q9_v4`tyPBfp~d%~kp&LGRt
zR%1n>Ou=mcQKn2vMaFWrt$1g-!8<EWx(bYmP_qeUc*w(t8$3K1Gf2Ib8(v)t35#Hp
z59NDO={Y=i=vId>RmT}s8q(IZ)&QAV{C7>E$(jn8Tj<1PA6?~GFeS6qm!B5lA#3Zb
z+S*=#N}en4@}_bS6#J3F8y`%%l!vZ8QB_<Wy5$4b*4<>qYgMlyA^_@0kW33c(?KN<
zCk|a#+f$|9Y6*qlvnB<bTk5S9bv?q?pgOv+$u(O{;s$rJlwTbS-M+=@nAcCuG2fc<
z@#cV?#1ciSa!6raN=;Sp_Tqc1Lw#9ENfw*snk3aUqlgbayTiS^56LpaLObTQ(;Y4^
zMm*e0_}QnAc=&W18^uHldaW31A;~qFF=%lagS@yMSvUDgIPr$T34hqGipZR`wk;w>
zaKbIt5>0=mndXLu)Y#_r={HQ@I1_J8bT8gG@e2@T#YJRI5uR{MHI*AwZi%gNu~IAz
z|K*tFmcs-#hMFwRXvLP?Xc`U6ycy9J&DD!NI%<VH$;gIddNIs5oMe&bnggSW#1bn*
zYz(m&B8)4WEK%*cB&3zs_8{ACIdK+9!L5+;TGmiPw;{BYcs8u#%qH5BT9<$Z$0Z1-
zSS3Z}b&;M^Wr?M-4o|15lek_3uIiH>-w+qY{~p#_8b<Rk{=x5|k}3Olz9b)y$hOvL
zUA&1o+GBTfkI!%Ia+p~1+|Y}n(kt5(2O(*Q!!^#uiWipKyt>+9E>F?JAx}TQMLwA^
ze}0oE8@s&!)dr7-IjIK}*%~v{J@9l8Q^nf)^b{Ptro2)V%_re^*_P#?)&}K<;Q<`H
zuaxeCYW-VAbWL%yDGpqzrre<T)D~KPS=Qw!WToB6R@1A5TdVL8wLz<|t^U+f({uy)
zjHx2V#j=e6=~zoN1YFr#VKCJLBNS}Q@=5A;^orLUz=8esM8ZS%<a<Kh4@}`*7F*{z
zc>PRSORN;q?(+HGm`8v53l<uRZ!O0B<c%A=`v+(E)1UsD&BGz7fl21vNGi{eC`O{F
zWUv&@0_*nzHsBqID8##qj;ASUnzP)AdG&OMAHQ({V>Lf}|2Nz_28kk;+7V}aG4oAf
zn#0~C=Wv>NCzN%?x7IIQt)Q)`4&D>`?m}QAYguc{nxC0A9L{q3Nmf8As}GtE$V-9V
zX2V*J@Ty+)EEE%m0nyt3Z*l0lX*V{OhG^PWXp0L=L_Q%j%wSI}skU?@H??-Gu+VGM
zQcW6bD_lNvmg(cW*o$k-)CT*bO)js_(OO*M*IztjW(-XQxwwwA7|6WuRXk+Z22hVu
z>n*Hf{!^<>QHlvoB~EZxF3v3CuF%um1vfH-OVbcQ!^H%8mn!LDs+Og!<P4+z?|Z^4
zS)umo`FUG@@=dVC_Vq>LJ|IsXK4mRRxxd%vr@woEIzHt3$`#tG$xOuzY|PPYMkEpc
z#dlxglP7yT+B{%2Hndw!dJW-Hx4~<tTD<YfCA!Ni-2d&D%$+$)du87Bt8E?ei|q*?
z?oHWGb8>T1exmL-E=xs2e`<AD*;?xZW%pPO#AR)5N-j~QL2IrJT>_?lI9E$LTh^Nw
zhejzgh5YGavb0rksD+y5OAyWp*7|||X{!d8aH6zQr_T7=phB{<LOuCbbK2P2UZ9><
zudzY>XESX4t)nDshi<Knp<?@18j)1Ni9+@$58aU77xW8C^^lRW%gjxY{nRqbA=7Xv
zZSjw<o@e<x=Xm(6!Fqqjy`zjlqWS*!zR%9~9$!9q45Hk!%pb-E<sB=O)NToAf+B)a
z!iD87KmOJg-g)m`w)dwj@BNPX*%ZWbZK=TzUR>kc`7`YA9`V`ZJ#Ozqf0jE$sI}x8
za%IulIdQ%zxfT^RGHY#tft2E!JoN`}Av2V9$2PE}gfNgAXES(HP0(;^J&&NE?Rzhd
zJ9J$%xP@U(!Mw6`J#9Yn=J(tf#+h4gnFcI292B|TZqV*@h)<tF=1&tPM_8S)FduPd
zE+TFzx^oRWv8AajxlfcRERkp;<)seap;m)T*!thQ(6L*}WyTw2ExlX1%qXl!;ytzE
z4_d#tzyyb)d+n6yV7m2jWFZJS1YTf!0y1KyR_2GY0Z-LFhbsZldCr?Ru5jhdJWEl|
zA=mlo?R)f(2V6V)-?;w51=?rMGyP<XeyV9j5eJ7OmdN?Zl_kFO>J<jho-)@GuAW)o
z`pYlSJ9nPJvnMPs#I#rDNt<ncbCB@cgM|CTl;b??o1<1!Lm=B!&x*PWAw(F48aCnk
zVoyjb)&`)a;`a$9ib^}T-y~m@1t}7^C2UY08XP=9GOetNvO&u1o2uJw04)y)a<;t2
z2VFI#7uQs`0g*s%2tYX22IqPuy_B9`8|t>UY#gT4eFJh?S+!mrx)MI@ZAd8#;?SlF
zPuW_Kxmff`b+}8N@D;Xg$Kt?C4T01sK7F{&TWi91|LK3tE0YP2-~UTmpWNngKjFs3
zQ%Ex5QS7?^uAf@u{JFDy^u;YkxzpISa+<Q{dHtgk!;Oneyz%27v-0|Ph#o)Xt*e`i
zrt1({zJH~`+dupk3-A0rPJj7Z#>ro>KgmdQN2=4tU?g(Ad}7G0svo?bzgq++7QBDA
zVS|>;kw-xeXSx#A%cWWsEGUZo5L<5V@r#C{-@bT(r4YBhxw}-Ob9eByjAc2ttTq&@
z4VY7w$afg!#*}_qjC+!FW6MGty1h2>QU~eupgl+9`a9^YJ9HbGm9FskV8o-{Av)JI
z6{Kil46(Ij)|Aj3d}*LApNzI#Ff_f#ulP|Ai!u{DMa7m6sKTvRUXfKjHD-gBU*juw
zoJ1}jL==>IO8~_VVb!${k3VQlWgoI~;;ATArP7?unT>~hw132-qZto|8M`x0Z~G3f
z-{0V${NeZ9hbYhKM)2U-7OyVGymxJl@Ba8EncRefXLK4u=jFGNQ&(Av6-Sxn{ac%S
za+GrWXv|@eov%%xly*aFDlxj4JXLrFKB4d0K<kn4u=YM$f+@B>Sr$KUN-lAYnINWS
zhjj39RW(Qi_CXuIrpBD`4OfRxS*s(J_*#qq+9FX%{m^|b<yEA>LUseyueE`TpvKvi
zdOsRc&v8fqc?o{g8tyPWbj#Xx_drwPZ+ha2D-A-HJ9tf|DiC`p(p4`-cp%%l_0en3
zj-clxt){r;w9$s~(GZzC%ksD0B%U0yv9ZqfIO7+;`iSW)VXhgITg&zHYrOsAA9L&W
z9WvkKoon&>y1%u0=Sn+Pto9nHJi%rOa{4;+bC-B!Zv$or#0|yk@BN7R*S?D^t<vm9
zEX}uA?8Y3=9IIJJ?)Qu}WJb}9<as-pFS1+$=Ddxp@bB8(S~*TN{Uj&TrUYP@TUPr`
z=5VQMn8OjP)a<-R(zr?2n!>N^q=c5Wti_h|ZQ){5xX^+{<vavKZ5U)QE3lA}r59Ni
zTf%%-Xe=+nsa0sXst{>4kWP=aYZsZy98Z4vCA0CA*lHSHTUFv70L~hueKO6`i!JlT
ztmzknvB??JV62@^tG#%xP36rk&CKFHkPvVfg4Wdlg;P2n!a>LccV-E3js?q@6U$3E
zY0n9-o&<%3#o-36NI2Nv=l|T<XM2*k`W#V=a<`>zs0sgNZ;no@L5yW37H%vk{_c$h
zUVH5{3opKioOuCz@CdVY7pD8<8yTC=Hu&Y^eg55(K95G3*UrPk@Eha+YXc41mekC;
zLHfjUE$rYunF=Fxq!hNtK<f?ArB-b95U|v)-Okw%*ucsqYo!qv#i1v7<Q2ytm~@L6
zX|464)abuq(harWP_GVjUXcRYErGmO6{&`t+^}lRiml5HKISg=M6<++Mu|e36%V%Q
z#)`#;Vxg&MNA3bU%nZk=<~Z|=lX8kK>uxJ+DJO@Af`*50JP~5$f<q1Ef;&pV&NyfD
z7ylpU`_E|DLtcILJdY2@JlQ=0iCAnYw1u6WJ%0Y@e}*VUQ#7fuG?hYd2}}`p5DS)-
zme7ubhdV>=fBHG6F8&qGm%qcpnN`|q#!)}zaQz8$s|z&qA(9Q4?>1QOG&yYM%!IO$
zBvbCzyV`C%CpCz#_gVD*-G;R`0OPpe#K2eCsDksU>(j11iFPw}HbeQw`dDP)VRUuO
zE)pDDL)TbVBe>Xt7kk3ZrHIpuF|Bq?n&uoGjoBI+4pZm*?M4ngIM-6NI}xfCBXJX=
z7@6#0`%hqeL?n<7j%iq@>qgeK{>IkQQWhf3yjbF1j1@<qpXHjdwj8F0(JbTTvy1#!
zfB#4PtAG0++1yWvm8yNwY`KsK{EsIP&>`$xl<@+;gmk#V?E*%X3D6Q<EG9@CNo|YF
ziHLHIj9+|NRKSZsxY&)Dq&ZK=PIFa}l#Eyqwx)(Z`STC?Y~zSd1gDztgO^V8y?^#k
zh-8W^pM_+Ch$5fN*n9GjN83}r+&t!2J0mux8QSaLb#H5F8K@R6wX#9`oNcUT=zl(S
z8N3sw+?kcU(Hd5fdQ)!c^Q`y@_JlrK1u!aYwWxkF_8S-T<)L5MyFzAxt?RGBq+8Q;
zOKF7i(6vEKw~FK2Alm!<p<6Az0|hW-IfT_VHMCereXRHl<!m8BFOE3XR$T1HT<9p4
zW5|uLm0F&TGooq6!3?wxB$)D#B(?WXYPIj~b%?|*rekr<6iuaQ`lg7@spi?E2h2w!
zR^EPxix=PE@7VvFqxd3UeDG`b4u|AcNV1Im%}siZm~*R(XdCfxYu~+oT9FtBPJiXx
zB5z(j%dMxo+}l5<_q+S_5B?3OFTc-Wf5=z2b{Wkwn(bShTFhyjzd`fnAF_NfWOehH
z{bAz3>xL4nqzx>$qHpx^E(ZSH8u&c%!HMC_7bf~ldHJL^)sjO_UUiGZr;rm$ut$|i
zcahwP$Xa^Fa!OgQw1pRY!mBI7<&_z&Q_HB;Rm?1*yJ2YTSX!f;G>2X@Vr@>bxD?Y|
zY$7U$<N#}X?tqWFs9uiPIkMrGG_0l@L31u<&ALR3(HZA2U8UJ=^Z)$(b9QE$Lr*xG
z_!^MhSk@0m{JWoh%;qRXxu=gi%uJ9}vvPv*EH(aJS$SQ=Eq&8OIg5%4I?;5U9_bIB
zYUyTzLzK$d@D0@el9}R764NZ@@4xvnXGQbVhdX2itHOI+$=$y&NOQhg-(i1hS!qPf
zHzO{z4EAsfdF@?jEn>Fsk>3A=qs<+@ULWz{;{)yua-NKHvMkh70}EncZ?jSzc9x>1
z=>%xW*l(~Pg(kjW;Z`m_D~?EgnhvZ~-X2^;X3OYo$jA+UQ2BvtcD*8q5F9ME$<74Z
z{My8RLWj2@XQ8gqVo!LRCA1fLK0uk6IswR$=U%;%j}U%7B)m!Z2a=Mi5R%|<R|-~J
z5icw>xHjM9YA@#cLWh<4Ir3byxxdfvR8FE}`e{a<S{e%G8qN`%Xu~Y8VE+Y7rj#&*
zV7caaBn?qCl+cQtU2KvWl4M4_a*_DvKY)W<T)labOLJFY_YO}RmeDL{l4u4=#7tY>
zefK-qW{-{k{r@79$a&6N5f|oT-n@2}>u<ip!~TaHKHcMsjUn4dQ|4}OlWD_bma))@
zX~fVx`!Z^N6(piN-(YpA#d5!al!#EFsUlKsh?HNh1y(W<kp&+U?pkYGzWxX67i&jp
z&Lq<(Y-6St)0B|B71nr2pgs9Ga7ioD{_w)mHikv9TyDb6u5fc1&Y#O^T|S4+Go;lZ
zZpU<z0jFmZmQOD*J3K;?0Sk*AT8ll@d<SVZfgDjWbQeJ9*!^{8_aD<$Iak-3Ty4%X
z8BG~aGX}GajiKh*!4dYT!JXrTewH)It)pG}Czl2GCMmmjH!-4!ib<rXp7(XORROdu
z9R(6mrOs>^$Mmn23U3VBy)TBcaPlPI-v&NPspGZ3!6aE|iQy#XriSV95qGnkewqcA
zCTjXyqMfWmo{*@BOvj{|bGNAOJZ3gyx^qDP(Kh$C4*7C-#{FT+vx#Pyo2p&cgbOR4
zcfka9xNy1@zF|_WRVmr$)P*v!X6n;$)qEQ^&e$s8QVOL0DrW3SuX`0Mw$D$DVW*&!
zj+m-_1uFsGvC@yFX1onjW1%E+@=_yJgLmNo2wO$ML$?NM3X*D}msi3lZ*3Y5xxICU
z?@}}3os~8}IoILZN}Hv*Cac$8rFY|7m~6(&2TytZc*tuXe$1~Q>~Unem^`N!yV~@P
zDLk5_9L#)ZD6pCq6L>N0MqXlwBPTO7BB3b?W&CNQG?E-bG^BOuJXW=N?FTQjws4=F
z%>jG;8HWSSVXC<M)mMxYP%2_I7H(W!WwFy>^Ki(AcQ*L>y<PglF{p^+RFi0EO)}0d
zb$R2}i_EE%wY52#=dU6Q=dtOG#{42niyclaOo%MZvWz4Xa<OEQqNRPkd(g2K`Du5~
zPrHSGw}g?5Q_VEf!8NAZ=9U#d5@?Er9ja#ZtpFclJ?z{=!y~0>8pBd7Ty6<3E=8Qa
z(4sM)V#kL_cOG-FiJc6|_ck!c1LB1h+Gap=u}SCLS)|i-we0N$Y}Q94a!=7nVXdaU
zy22SPoNo0nQHzg$_7M+{20ZO2>`qfgTN6f^Ws)1T4yGhqVIWNrHnrL>SSYdO)pDd>
z=qdOrdq2$<FII>y^`Wug3+$tqrh;-xU=-0sHs$%&l;^I91#zs3ggOZHLL4z3j@X#x
zWXAZvhyU0Yc0m6=wp7f2^W&S`IUKS5bc?4)Q(oS91o8hz!W@IA>pWd|U009#3A<C{
z2>rf=x6qRbBF<$@mf-qq!V~mF`|)!+t_>h0C)#QQUv0QSFDYOrO#8J|VpW|I)<x9p
zXN6z3E;UyNa|HztywoT7$E6u1u%H#owo0F+rcn#^f2UZs+K|mFC!*_eV)_ja;4+ma
z{xcFT){5nsRPDyL`i@5;tTZFOwbJ0d-}^qRZ@f)o_?Y;`?-N~o4LzNZeD)tXy^!$Y
z@sOs9_~AeM=M49@=>PWDNZjMA^*#P#z0YTdDF=xzdb>fO;p?DQni0L&g^r5;K8wSt
zwtNw*mIzEAT0La$HCTBWiI-S7`v&cEAF=r57c4&6XBaJT=abLb8xEPwGHzU4<J&i{
zaqWf6?Asnc`=9<L8%bPF+mTY<w{6HX&En!bZ@l{>qWy;~t+t64E<xNwh=>=LSXk_E
zW~oV2U_6B+b=q-c4a?26k{Z0Dq3zp*=YUS2@7mlL>8Cm4)G+z~>3Xv#yRPia@3+rz
zr<{?Qm<NIwNN_HSRV)@uHJ4N>siW1hI$D<0;c)xGVf!!ell0)B{i2SxBCLpRyDhtI
zMN8e1T=UEtNEV9(NCF^;8Hr5fJl=crj%V0=`Qc3a+=QxvK}-ZLZl1gL+G~B^?~6<^
zhf6u5cJVDP%Z39wXj5FbkVL;BCIy@)<a1mR8WqE|=P^B1rFL=|O}OL$03ZNKL_t&z
zr|u)oZOqm(y1h%(=`q~z(rpijme(1don-v<GdR;n!SfKW3OYoEJ*4U-ucuPS8Jj?w
z9dsDd?!<g_{ULW&n{4$0+QXP2HVi|Z2HT~D(WXdcoZQSD;S|djOJ9~>#<GXmh@j&b
z*L84}1CB|5&Xg!#b~mfUMggX7HOKCDidYxNN&pzye3ZK+3*(oCAI?=Bnn6q_Ol4i!
z8Y_d8W{hN&9H6~n$ku*9GmP2k$3(HFJ~l<?@-JC!D{eJ=+-U|Zbt88Bnqi!VJ=y`_
z)^%S>_VUMdm{?5z#}r5zDY&^6*Vd9+qk@9&a-f4PqZ&t|&MnuRSemL_T4qg)RepG=
z0|nQ{+bAhiC7IJKTWICZJ7sBpZC$Kgbfv8K&5Ev_{$h`!>}RF$I}}WX43MrY!eA-!
z0!vD)6rPDWIpuNub6=%$<`UuCE9libFmV{&57_zOeePWT6+c_)veMUt=CAqcr!R5(
zcmFBQiAx;+`QPEbd6~$x__!I+juI)BA{k-4I9=tXDVMp4DqgjUPXeM}9~!m>8jPXl
zDtynyt$CnA7(0j3J#c(z%u$(og8BKgRIa?u=E^Q}lNE4d#%eB4oIk_UuY8iFD{r#d
z4w)LOv#%otI)U8SA{xi@Sl`;?XW#lJ7Y{j{KJ^;PpGXesa06#dm^ePmle5RzU09^O
z-9{Tjt?Ds7=~Hi14j3rvz(hJ`s8}7Z3I%q8m~I#o#zNIepTTUYW=wG^8!NuUv1C4}
zwKA6lrKXES!<(uJoYYcj95e={BM632^AQ~<AErtJb7-2?hd0>o8ERu=^w-;rAKs#J
z>@3s|p?X_LZwve?s^&q|gw7+Ptwr`1R#;u$XL-BN+HQ}25D{sE5uI8+bqX*}BxG82
zzLA#9ikVh1BUx0C<Y6C{&=Zwra-JHi@a5+(@c!Z!x7M3DZW3_>Wkzo)0XrKDh;@1y
zlEBQeiY)c5*&0auGO9|^OW6ldi($IrGU+L{dod=?7!LNZ&*a+Bq#nln@S_Emx|*Xk
zML&%3T!lMvh{pMs(eGVhwHxxV6S6VT^y1__%;%`~0``DL)|ypQE@rCKDVGnpq7X=d
z!Vz2EYs!g>*mSUw*|1ggi`QWe6!j8j)}El-`Dv8Xgk^NnZWmoLqfuFrkuUp7PKSfb
zHW6C_RutXL5ofE{@*Alsj1x+-cyi02^BB3J%5=Y}#1W+kV#9<EIQOZqF}Qn~*5#kj
zd-xG%7%;uMPS6Wj{_s6+tnah1J7B37;as`Pg*l&BKlMpuLUHufS9q<xL8sj%jAQO}
zpcNW?M{%;|@*5{>eD2p@Wo&*5>1?9r&J(ozJh=WLcQ%>~V;J{gdZI$5UIE8R57!u?
z9Yh^MMSBo!;dYjZxAzh*bSyNx5!=`9a^=<%JIxLa51u`DihuI#v%K}eO@4X(E~32j
zxk~1KK@`z!ck!P%heM2B{yARbYtT50I_A=-PEp(0!izghPx>H2ZK6TrrLV%F^9L-$
z_0%{~Pr>K8V=We;8yea{nqpwhqH_2V2R+(GROx|KkOcpcXzyGjDSJ2RevNSmmC%a}
zy90-y*CT$oL0s{XZku7Z%}#5`cE_-`+N3@)PIbDDSFfOqK{vN?gEnTchpLSw*Xf=6
z$nFx-ZKA4&7({C{+kM)-0mC>Z(ka$2wfH6Dg%kss>M@O|RGV3zJ0?qWlXmN614Q1T
znB)PPo}9$<_b`$&E{rYxvc?J{qXH%Na!lpuE9FQjid9rLA~4o}ll_;DourjZ)~1!_
z)6YE33(r5xpMT@0+*#i)7wTkalFICo9|>YZsAC4&qZ`ENp@GIM{^<#L_XC>4n5|(%
zC(_B1%IeyT-I+=e{8*A~S;+|50cLdB=3C<JDyw*!LWEz|w`SJ#QFxOzGnSEpYZZHC
z!G*-K^cIE!$*E^0=UoXhE+un?Jx6DRI%dnXcudjFNo7JQTrrcK8B-L<Vq~uhV~DNj
zEu7XRWMf$ZDy15nlgJzeam-#n;G>NpKmXA;kZv2-OVYx}Zv7n!*y=_s^)>xe8?D9A
z>GUvEaH>Au#29Bk`xSn3<}|Hee9ZcLH|eJM)47W9)Y&;seBo<2M@}GX@1jnA3f=BP
ze*@o*h_qs?3df&1L*?W}@Fzfr(7u7V4OF#`Jo-6ie-Hn~--bK?E@7mkw(tExK({@h
z8);S}P1o&Goomt?1RSa-#KSPwXel@(%4p`EeU<vTvxMzcoM9WsucG`p)R8&VOq20y
zOryO6-Z<{DS5WmjLX2mO!Eqc?cUs*xPGpa?5uqDt+M#BD7^f#=0rwC)n9qv;$xRgY
zX=&1{cgkPLY?dYxl!-CQB}8Z|SRWW#QswyZ6Lha#q1SA)zBlBf<sPkmz%Yt%q{Z01
z6%J2T7`6^^Ry=&&BWmv;N?~+N<M1rOUW@+524km$M%`y-Zi1!ekX{%wj3WYL2#qGz
zI!O-@a>i;7MA6!cLs$6*K0kDvR2VN#v2jir4J+LN|Mti4CU!w5C2vV7q{0H9s6yYG
z0*37HL6L&vTc${-8C$8f)3G}|>kpH3^fBox#yp2xkG5zJBAT83(uY1fG##5<rV|~e
zh|rHTclL%XEN$@YjbG9ny4>ArvO0|D#yWwUs3ZhaMo^l?=)e{UNa@?kD$HUfG}wj+
zlfUOS$lF-U%fc~fbCL^6v6S^>%9<rxI$l9W7LMh)Z@w^=ELgg*&MI4btVXt~A|=3h
zu0&BIUA?lTnI&vxv0PKO49!ZjC|DCVtCv#JugP=4EJB!I*~{f%B4t6*B{0H!@4nB+
z4^|1{m~r2w?k9ZP3E#<6QKl;nuBtFybE&ur+%Y(G31{jIetn6V`!_h_51FY~*@yxn
zqtGIFzTotiQDzQ~z5sfFTZ=h#{wTFc56AJS9(@vjvWk270;<0TgEeR^pqv^qxQ^)$
zk^Lq*x{Gq$L<{UXseWH2@m%TQ@^F2J`)k`oCV5XQUc`9CVbb?-)AwN@@b>q=&H9yb
zUj6zPIl1^#)X@v5!=Hr86iNng@@3p3Lx=;^?DNoBLKc65=QvI_-_79XbrGqFNHPBv
z7#K}I((Di7QtGq~b+%`?Hryixqh`b8q{B57QPnzeiJ2HYR}&%Zhp+;C_^8eJ?#IOa
zCcS~?)=HP9-64^V!K4T{N2pa4JKJsgZ(hbDX8PDX)2GhRTX{&|3~6t5*;&|RzJ45M
z2*;l~$7XB5>RvbP;L-p?okqFn#6Y1X8T1>m^OK}Zo5CKk6pUf9W-j7Dm|+?-?|H^P
zO&4bcRJz=m<`aw(AjK)Jq&Z2-)^R42T9w~s3t5h&1@&;nCp7S@M_YuCHZ5L<$v^A~
zX{*SIGO?i>#3(TgW5c8FfTg`2<EvXNbPPA!Lv{yoDw0oQpe%c;P>$d+HYtsfnL5S$
zD4Bz;h+aruqOsgwc6^Sg9QvLgU=}ydZWP3xiyMncU`wPevYE1qcfPN{2J?tzlquqD
zu!^Y-#>pEQEOUj}qFHj)j1oIZgnY55R6$NFbjT_virE(4JYy_FU1l?3o2@H0P0f};
zsxsO!h0Z)NUFV<u;UDm)|MQ>mV6R8bb2wD<h-xmCF`wggheKl?k#X1!46g6M)I84Y
z9CGg`5bqJMEiy4?c=gMl<I3_kxzieea;Xs#4kCIhkEm5<P_rjc!!^{A=c&H-$5i(2
zfpJksUx2;aFmV#RI?{Q7s!T!cFih8Rycy*FxAD7*#<)+d<0hJ5*GW7HmO;cw;y#Vj
zIsGt#FxCuwhnbqkOwDD?cj$F`tVzu6H-1d5cabAsc@E`HK-@%>hZ=t-`EZ*)1nbDo
z2T1K$N!8$`-R^h_#_{Zqw-*ZSVazZ#IF4k?{1Gaj6-8}F8b~2r&%l%_rA6nCwJ5a;
zr;DnA684PYZaCyp*yr@cGi+bG!%}m|UN68w<2wd%Kq5_bVwPi1KgrJ0BbF9dnTuUi
zwN7<xg2j(+vA(uTD8j>^yvZ<jaDAUDnxo?`t)XFi5D~<Z7TvV)#wLedCu!|cPUW@W
zIQEtz;o_Ro)l!+X=4J&XH9$C77i*LiI%#sFN%o=4p7~;(VyrDQ1yT^pMWqT1T@odq
zr6DA4oY|^FjK_K~MB>!zpV>u?MYT$2*%c2wl|-2n3*snz5gakZ>uc0{aJ23*)`@XQ
z4zpa|lxAP$MaD{J$Y%c~AiLFtWs)tG371oMVe$MGX>x^G=U_Kl<VqDc2duejJ`Xjj
zRBIkraEn|z3M!hi=e;9cuCh!Y*87~v#j-9{ERamLxXYJbc@U;5Zv|8t?xWJA2eFIx
zNYPC+%_^NCOWp{S=Feg;A=OA&c`EAyCTbP>QIG%OU;Y_O%^nUA#zGWnyqe3o=_;Q&
ze~hte6%mh}jaBZq2dpe_a{1r<uha*d%*;>Vk599=)2F?Ao!@`;0>@4q=k51C<a1yB
zI^m?pU;pKQ;{1^xbK&$9vtRx_D)SC1XdzoSpx?*zc5v!7)XX^;wo%OoNNWkHZ=%k8
z4ON+isd;4iR~&im^Hf*YiQoPey*Q>l)QExDWcWr&(?*g5&2f?$c&rVbAVzD0sk<DT
ztO3H#&ORM8&+Psl{^k`pbOz;5rw4O#fZ$Ieg8}V#e^4?|c&UcBp4x^TTjA7=HSItb
zqXUD5zbkaCHp!`=&)bQ-6m%~mX~8uZo#dz`va;k<9}2XLCcr^8Cg=qbJKX@+6()U`
z{b8KXJ0Ct=;m~xAnVD(&vWi=+&~G*Aj?J(ed2H<u3DXR(VHDB}dPGJT_Z2UlnP<Ay
z<IM*<grN}XgkF@48%T4uidnCSQ+z6wd5n51`7mVj&5Q%8tlgW+XKE(zFqAThN+M%h
zWTP8<$KhD>x;&S~&et}j*ObQ$rIhppX0Mra6fZt`g3o{ERsP>M-sQ(P9uTJy?g{EF
z`_P*Fuj(oXNu$dpbq~!}Tu#q4xbUT~aJoK6?R(#1v9-*K14C^)wi1a{uI0@ZZ6=vV
zip7q#O%@qjBEPsB%dIDrH%29hw-g6{Nf%t$Xze(f{6NfchQ;r#Y`0r}gHr{T((0H?
zdRt|I%(LQ`F9%2CckHjVCE3clQf14?vUkIjQY|v$g-O*Y%8Jh|1RaS})THl`oq<Bh
zCSA?|wjXkp7Tt#HFzGoQ8}oSm$T)YGx9B!pS^*5AL}f5jb@=2{$9VO>|1$<lw^5Tv
zn0xyN48Q*!t}d+d;hjfR+{6eGX<>H|;?=4=^<16hy*^hTZ4m$6cbTqwZ13)IcB;)Q
zD-B-re$0_uSMkk0)v-GMk<-K<ei!ffS)BFz(BA^x$2tB2&h%-h9S6sQ*-zjdUO^89
z&rw|Z%5QRNug!Zu{ROu-2Mk+7I*}Xzm`iFVatwq~%;EW?Oiqr|>ou8D!Z3EZ`_>yY
z+#&N%%;P_C31-fq7((L-aD2oW$2svCbo^GyK#}1f$COf)6#kW4g_}W4H_%oCA>~Dr
z6c5ViP(Jg;tMuQADl3g?Pod|YHdGY2N+-dCX^ZdIT^f_)Y+SiatJMdkxp4M4=bt#t
z_kMJlAl7NuYk2>IyG+(Rjvk)IQE=n_Cd-em5y#2wGnRxg5olo;YI?C|wH5K)i%;|H
z<Rt4mZEoxiiK2)wjdKyL($h~{^G9uIMT@K*$BwwpuJt+GL*<<bQYaQms1QlwLJCp8
zDs9jeBVC&9oflO`Kw5y5>?V=`b`m||n5)>>YxDlc_gUR(VoY2X&RetI?3+G{P86pW
z;v`zgQ3k)_Qav<-8aqO@-k|0rlE7R$Ya|B?m9G4`QbeqUl__y&O9U|^mfO{y&DylC
zY~v{<`BS2gR>d+cpNpy@r9xT2am&V>ZTrOn3S|Y$D6Bbdp<OScdy22Ou_a+Ls^zte
zEs`uU^R8c6^39x?Z5Q1_dT3I<Lar|^2`GvMsm;DE3B%JuZ)?jB5)2ax-(1z@MBV54
zDZ?NAcmFMSfBYT3_0xA*+K<>8MEI^l#dYvRgJ|j(U%{E4ht3wqK75NSn>`-1LUxA{
zkxq(TFV=LTeS#Z5Od24^=iS8(Jf*1nE<1r{bEtXHe3!E`Rp!U5R2vN@j_%TkT8!OZ
zrBP8#A3s6;>@!67mvR03)K9O%Q(s3-UBr9#pW-aOiMO;!zvr^Mw~rCw%%K{SHHY>6
zkcH-u?SW2JO@f<hnd21rJ_rK3eFrrRs2-YNdZNMJ{yyt#UE-mpzPQcQVVCL)zm1w0
zhuy2l@-@1vyL2{plH&TOfBL7SZna-iN?im_q~CW$pcflHZuPmg(PzIOrOkxo{}{1Z
z4L0<s_^{=(IGupblk983H$p=T(=JTAB&iGzI68^bIX~&}+^k2`Ytd>BSnY&7THoX0
z!YaL?PGYT7^xhx{nVcNsv%m9Idc%<S-@BfO_a!EXV+K)7Ki2fah+dqGO$J)H_F#j{
zi<|gLakTEz4K=M$6UC{@0h3Niq!fZ!r1Tow?QiK4GCgI%Wz7R2GkSl)BPl1j8uG5p
z?m9{n4$DuU!&gS6R0X4_uqiYg#qqk&-Q5mv+<M4%r)Nhj9N^-rR9iY<^XSKhPNegK
zadOP#Q>P}Go}c64uYSd~kMHr}zGiJ06BuJHp$aj-$q#Ln%dAw^SyM#X6saEeVu~Ub
zhl5NCN<bHD>4hC-u15F^MO0Cyd=OJ~rJ}MBSXD}u$ewRCf?X^dHLSU)4GUKmQ^86B
z&TyVtG*b?eQOXLBEJh=lwN@;sjjfm{m=M-NIDasT*Q0FCae9*~S#?#RlJIbt_Fc}5
z`8<E9%4g0T;$*GMp~*4o&28e?&`-IubqA(IGr4gesf;0meSC%>0avfx;btpfYY@{6
z4V_riixS;;APT|7QAvVCDgemQw4Kn<9teBAh|Ol7<>hsjw>vyq-DiEHLl^+w1WUjC
z8NKy&+}<iRuZ5bs1i=vHx&#YXS^DrJKKN*Xdpko`T0;i0VZ7pUY`nr`#U(O^P$vPn
zVu66-Fr?q_F{WZZ^{JP6=5t?Vb!nBw8y_LzkV8k0B756-lBn$U>OJ<azRk|9yM(4p
zCmT<@-C8>DRoQ$lG=@$X(+}c&VM9qQo+KFL=r}89EoV5G0{v*>gtuEUFo7`V!x0}Q
zy@WtC(1yr^Qw`x%yv^bV3lQ}&D722*AA}540vAVt#t>m}i0O6P{Pgd>!Dg$+-Y`yN
zVWN}tS0Pa@#7P!YpoO6phH=DD3+r8&uPRR0U0j5_ttidVl62%L_WHRPEtqVPQVe44
zMVVp*TvA$Nl%>Ba7lNpg(yXjauz==HxiH)O6CM-UZj5l|P=n7sb&AW&yKJxSU{c_b
z8pWVmyEa$BgbT|-nyj4WE^8CBzP>~B-S4sxH~8MxkcYjPepEIuh}e!X8G*4En$_ZM
zHkQ?^(D~Z9Lp%4bSU^cRTrm%WRJk44vUjDOVg_s}Mm)+=T_`KYO6AzOGEiORy5q-u
zt!??Cva{h-e#qv`I%|x8Wu7UVXoV~jQ#@HJ4^J%!cSw<emd(_&S$PR2lr7~HrJccO
zf=@P8PLfm{4mVt$ov!fo#fwb6_H`JW;e~bwBiHE|;m+QWW@xyzH)QgIk2tfnLv4Hv
zf4oYk-=k5lFo=4z0!?s$ZdgQTiY3p}#vzP^mePnB(hIx<isidhhMI<}=mak9n~%7A
zcad7P!g#Gps~hpsMTg3pe}N49=&|Fd!_QK$EpT|c!NX?ARzId4MhMXGUFNDT7pJTA
z$9#5%5xaw!VJt*|CvbAS%CpBOSh;(Lo7X;OFbwfTXb%*fxX#{Ei;49&s9pUf(V)*T
zblLC3wEKNLDb)GnY2;7EhMxljMraNVVJwA8r9{!ENS=@)Pc4bWr5KjzR2ORut~S(-
zV%{~Jtty^sI2;*s@Z98~t46y#`H3g_@c;WI3(YQpQ8arY+noT?Jfn1F1Cm7d%#Asm
zJvB!+j9G7OFbE?Q8lzLIUwV4QCOJ$(qX~^lPFQ0IwB}v_JHEr2F^^}aU2e5vI<c`5
zi$;)xC5wU$2pA<nS%kJxd8D!+CCUmj6r1u->BF2Sq!~-)l;?vfMw7L3nN%F}<dH-C
z-XH#Fgx~%dS68+eTCv<t+QSv#>!cV|yrk0~Xq|spD~{q=&7s>5nLXa%sq^Rf#?n>R
z`cZNymP}<*qI>1@+gv>%2UrTWEmf==Le|BVr8VSf3sUIsig_!hY&jM?g~G~mvkrhl
z>SnB4oEfn&TZPWCGNXl&k<IA4q4HgyJ;S!;Tav=X^EIQ9gNeN|T6ELMA5(PDCZEQL
zmGW!FbJ>Se=3vXT&)G~oTbgHSxUR!w#pURDg|V~e@lHR32ps<6Z}VK-;o<&mmiI$;
zh7os~0bwlMZ$G5!LN7AROjN0PE;9{}2i;+^su4S6Q%ctF#ICC_P7)?COi`uA#0<ru
z7Hh^_hr`Ea(Q(91KcMY7)P^C|e#lNQp!x6rhNsU=aPo`4%f^*A+1qLoMG4LD%uJP)
z{UMPS23pwZMLaM<)l<yXU1qBuPtDYbMer*=FI{?)Uwi%{jp<pw_3a;XZ*`H$T7|KS
z$Ni;MHdg<Zsd|+|<5kA%9@VPi_{*PR<D-wb{$M5VcvY(1ZKN4%PS){iflio2BuCmV
z3gu42PM*lGg~mz^$gZ(EDa5V_b)`AvC@$3DlgI1KotnW{0cx<xAgc2IH^0SC?(cJR
zYrrrPeAiG_l8c^|5<(LrT61iw%ImMc%+XWFc=PScbi;@s3{wf1q)g02BBDhng*P^Y
zl0*hYCW+#SjA5-GvlGNznDBXS+UH&;VsoGiph-yrrAl$pc>rOd0i#4?v5|Xfq*GE-
zCibba%`<PZ^Y3bFaaI&)^_X;t>>Ix4vbM3s|MV~aoLkKS5eayt$Wpe(3>JK5uHrK^
zF=4E8BHB#F;i(B9$MYFhCuvEIb{JdTlSKhD7B^T?N?s82nECGkkfxNQbmTD*Amtoj
zCNL7+GdfpS_H0wh2wzAFjc^GvuB?=W^p!ayxno93sVhYgsuYXXJQq!s4(_a&meZ4q
ztUOU8If=>|Cy6Qn#ck(bUZ`!mzbdDGXAe>0f-E8Bi!n|5`#4I_u0jQEq_c_RcvNPm
zIQiRu$deEL71y?UtaJ@afuS8~?t6(=Hi!(9dlA3$;u-$<xtCf0n;)^z?B!_H@=ef6
zvq`_LNfvQK1RTMHnkZIGjyZh(>tE;Lts7kV@CHs~IB}>!wNYnduf=XRWUt-jljH9)
zXm%KX@k^}T{)n}Qmzk`%T$-!XTZ`!g5wU?tg#J*oJ&5oe#gy+d<q2PU_9S2XqyK{W
zC(f{P<sE9uFjaS{dJeu1%2l|&PkmyHq0w~rhXlhAo^7z%ci0)k<xvArOW`<Ks&H<e
z=%)Gfb{xB*3_j0^NJa`>cRDXqsU#~)4#sGF1rrXO8uOSxJ;V6Zr!W!_Ee_~DXz}r4
zoAvz=C5DQdbXk!}2HsiMr6kE%i;bom8m@hOpLZ@_r>hN)N|s3(h*+m`kys*P4N=<p
zMgp;xL;@qpJhv0Ye6Sny<b=;NQ$7_3*7};r8n71rAIEb1lrev$Awjx?Q&x~;-XWnZ
zZKx{6jmrp$e<X*XKu~7yi(`jNsM22AQLsM@S?ToI4o#B4stP8rvSx@@|Hy<78v~st
zEGNbK<(Ue{r)nH|;YI%H@_l}~c8e}9o(*od=Ap%QT^^GlAtNJ+5$D|qPr=HlK1eE)
zgNe0DWF%&$pq<%c8N1--^IvO@Q!0kao>5yTqZQbwa+a`lh}v>7%FDKb@F*qXpN*gs
zTbG-{jtZ@Gk!fa2<ci=-$wwPm(N$U3Y+a9}v>;Zcgko(V(3-v$_9IQay#SjZ!|7Mh
zYxjsdUB*1aM8&~Tiv2KRKUDZm@-{~zcwNKGy?_gzlVAlXxDS-_^^^sH&o0n{R!Lk>
zY=kiVZ+C{8?|$d|bbEc;LroRU`4?X2^ouX^*MI)6i1682*{A)3w|V;H4E@?ouHIPS
z=Hfn=j*N4Byuv4sj`6GYE)QEll1`BxNRbw{b<B>y;Kmv||KtC{a~IDN1tF{3O_F$A
zg*J*n1geG?|M4Gi{U<-<*3J7wTDbLp{ySpj65t%@c(eI#4#&};`mtshX`(1e6;7I0
zoh~6%p6aSne5x`<Dz0RqkUE|5YJ<c{vV%#t^iws3U(w0w6}xoSTdZBaP7L@CXfZ^w
zL8)|^rVW@FfU1)m087n))o=X-ZDI!6<f40>O2M?GU9TA8l&KquPC8vl{){ZPCnMi#
zBi!8&>Bk;t8xCVGJnRUA?8=vadW&qU(tK4}h(9|qLD`l~Rf-=^)9s3%6MMg3j?+Fk
z!4<5ihMY!ayWVQ9L)A%sAICxt78AT;bm62^&dI8WW1yV?QxPScY<RqIs7hsKmJiG%
zKi=puFo_GuK0s^=mVM375_!p&g<>z(^AEWataM-~udmd|$Y+#jCI?{THeRy0#@ew#
z7D3Mn*BmYAqEz|t$kHWji?Droh_Z@kp^weM=++fqN(Hyb(i6)8S`<xXaT>^H)w#6J
zioGvXYvp9&()(FZ$@4Hzr)1Pg3hyu$T7jn7kLh&-W~ks!9>%%&CHmk0zfglAzC(UH
z9mFPwnP>CrA6#GL_Wfnn_6PWmD%^VZ)2ND@WJaJhj-b<+EmtS$<Vq>Jk>T?FRcgLV
z&2xwxc<ar#slRuby#TaCpcL&;Q>k>hcxaD7tl1pIoUF~F38}dQK5=A>eyn-e8m9S(
zg{0Y2u+|xJdAUVnvctmaI!hb7G(4B8o1|}6&|*UX03ZNKL_t(|uER#h!TbIXSzlgd
zcMvB1sPTveB3+~myJ_M?O+-AUR2KK6j0l~`Fo+Ukf$OEGp|LEFQux#}B9!d`ParZG
zR3~w%#ac4}y0J?f4Nxj1Tz*Jv;Sucz583GkbfTCb)@ZGXMdKI&iIbwL4GmvWueh`Z
z0sSya0@+h%N2V9mVla{fPR8l?V*@%iMA`TAh&Nq`rqeD~3@mj6`jO)NxX*J_KDYNH
z_G6Q8g-4w4mIK(%sFHFgVJR944@TyMQe_H%-qF}ath@^;_lF$#HA(WZ@a(a9UU}ju
zKfk-e&c+@%)@!zc9J8=Pg<`I%=!9|N;!!Z+I=nt#<ILe1s!u-6U;h0s=tqW%t4ah#
zTg%NzO0XP==P4qPa>Gfs)T9KnJ)kRP^u5NW<XMC<J7>s7W!eXV$S5Hkc?@>5kWCg{
zrcxsXv!v#*ySFlNJb%CKu-FoVLY3e;wi!7eS6DMrrONQ1TumWzaGq>S)JlLR3&?J#
z8I!0@2HLPY)U0<yHn+RXZntsv_fek5#D%AszjK3`UCp7cuy2O=u|afH(v}AXLgi3(
zT>_)il~6fZxNz~Me3zU?l0*tc*<3%}Bl(^~q?0s|NWuN)03`!_FZa$9YvI~vk5|5U
ziZg-7Pd>QKN2|MZ`vc~kfTs`D`Rch@-rtRQ@8Jfap|BID&xz-`cmR_?Y`?CPBw84u
z<~V4erwzUcK~MPMTkqp}9<Jl0W~QY1izVr9NtFy^>0+&7wO$E_H_-G0U0Ng?8A*7x
zV>~G4X_6_BO`>EFoe;^wSm=mhFH*Go1NxhbY<_%)&DDKcy^#C+5u2Tu{U9RH24gga
zq|4UEP<4f;Pt7qoJ<b~+-estRq(hTr387QMSmHd>7?W6kvvGqlf<}nNphYEJu}Quy
zY2rhM=yOD~J%nzgxinSb(zM6@j?fIFGPBfrNORsmKCE&^u9b#D6{X60d+XsesqQwn
znc9=f{MQ#~9W_d3P!<41442NF;Pan-g*&@FZmw*D=M=aIJ18;zjT)ZAj1PAPah@Xk
z;<V4D=?ZHBTz~%#199+N%Y1+oOFtO_(prnH<ma7o@f4eXD+PPuanqa8A+JbDW;YTF
zRPY`~L?0#SQE4HkN~Q&yI)^oz&y*2)=UbXrt0L}7Nomx9vXUuA(48_G_LzrOs@(Q1
z%F0?ZSUs$i;)U`9|1m{ZsUlI?KGm|Zp>h-laxa0v7<Pl0g-*<|l@{agyu<8ni|W(_
z?%ZJxzy1||_skkk++N|@?FH(tgCb&MYm=S*fPqmsfN~thJm^PhvbIf}Q_7M9rZ2-O
zc9uGG+hq%VN2QDO#2n!|MNV53nf$jk0{3?N{PlnQ7E=`uaXs!WuM>-6MJdGh`RAW}
zkzbpdqxXOO2R>{iJ0RCl7^85M!~M-B3mfm@yABh+;^n8$69)kwFD}y`#`vy-=el^2
zpj43-s7(_3>7`PYTBc}FN_qC#9_hrB-w#c3MKi^WPP8d`@70JGpH#&lT2QGSL}Ec=
z!+_+}-02M2S|4&_W5At9Z91{A7ie~R5uHF2>CB&;hGB{@RrPt|^kG8RV>k?nbpjqw
zU^a2m>81xn()CIztVr_Nvay3vX-H*um{{1q+&`a2wG1NRMl0Znai5D5E-QV*#vn$U
zVzXR8PE^UsCTLVnGMDnQdxVvm3Gl@d#+Nqwlye@H4gD^c3+x0LjpCh;Zt>{h0w3*k
z5towGjbhrIt5;@ymwuF76%pZB-Q&}9Rd7AtY#ZL#++eKYBx(rT$)yS?i?Zj>BV+H(
z%~(b<%3~BFQcguKv4$U0OqG;fl!_6=VL6#tO3o}*cCCyq>qJ?dq{%}t%Zy!B9#JSc
z2qZ7X6e)}IU}Y03yDL^X9AE6<O8Z)%OxZ!1EyHcTu2B9OVX=U%L=Z<&dVQG*M3LmE
zwL`<hPDs^(!Sx3meYk?_LOTrUPab9R*a_NB9S3;r!ckuS^vmqty~h3Z7B{cor5Pvg
z)Y+QLewfHRZBDX1a!{&tjO9*8o$1e&lW=0vwCGqIygZw*crHxFmoUPWjXtj&8RO`f
z$Mzt`XpK@1O?QHyJ#2BL-sXk5aRLHvG>1ewiycbF9j<bcB;wF;^7LtXoi@S3a!v~D
zM>+|(&71b*Ydc=6=Bx%EsHQ|Rmpn;3Sw02Yq^T29Bm$d)PL{{DNK#mpt#&X;aaKA-
z`)Q5Q8rLLv$!@IK?rEA2A9D2RXZYF84OY4l!^kj*Vqz_b#JR-ALE|aGuTOAmbDv*b
zzD}%E`i7fCw`+7_dXQw2sKunSUdd@=#w6DkV?bx2og!9<LGjhf^39Y3p*AdZLUhCB
zOv9ssu-plVm4o9t*!NO<9-EAVbpZ!dHVzQ%z^}5jNR6a=z=&wTV!kSC<s_E+q3Be$
zx_w%`9<4}9zek=vlU?ssl4UhtaabF~Xf3!3UY)OTdaA~fGsg9uh>1!X!f7n*q16?t
zk^)A`U~w7gf|XUcC?8Cvit(5TpJJ|Vj|@hcy{ahkkC6mEwz!X^729JOu@-%0`I9PB
z(CidxWy$KYB5o^OY_6!)jVjxoV_m;T`O6vmp(M>y<=uciPEr=UNLgP7WzD7w|BB?9
zYet|O88-ScVxT$HOt%9R$qaR)e~WH>lU^h=svd{u2RyG0XMgQw&K<kJ$-n#y79VZ0
z*ctMu6S6bV`R6o;M@c!`&BjJZrkqb36K#?zYY;r0pjwTn^!2LJO(tuy23ok=3^>+E
zU^zoc<dz>VuJHcd1*Tkh<=8YYpO|HAJmB*3E<<fFO5x~)K<7BnR*Jv;#t)OtjE?!8
z&%8{{gP&aam|C^M{xBpAV+>Gn6lZ3q@)@t6&UZ^4uMz0Sh9F8i-ULZ&QKrgQv&<xs
zLD7|%-0ZAPqGXUL(eTz3Ot`|dqv#t4cWjKvXgXm`Cx{uunkY`$0g`ETq3%N%#O#ML
zZe-|$5mnz$jS>c<HE~vSbJtl~c+(<GT6lHV;VKG-0ENS+7?Ktnc_)?FE%qY1vEkC}
z7%x3}oNFt)JlO5xyOfHA8p$}z$X7C={8cHHT1GzLVp&XWJ4V)E7rT^#hoDBb^o1rf
z2^Xw6ihUiCP%h1Z-AcntWIZ#L<U`&H6Di%vhR+K#RW7`6iS=%U;iHdGu2+mFEGv25
z>D%Cz5&2;*FUvU%HW0kLc`x&C%K@3Ce6~?Yx~)epaYM?Ch0$VZFFwnQIeRRi%7xiV
zlCVu4GO}pPHQE&FpYps~S<5z+Csx~wx?JX_%F*aqY>%jeql$wCSB*p@Ss8B1Cd!Rc
zqLUwwG_;K-(n33osd>pe77FxZML#llC}v&7(%LQ$-+7CfFMOKHv9p~2Xa5cLZ~ryi
z`j|U4k0sxs8>cQ<OS`Ttv}XY|9aWF0{JAqiqVYFrVWb!V+J#q(LK|4^hD=r}%vN36
zL5x9&wLvMD?bz_%PM_a9f1Y1I<uhovxV^7wg)y${Cf#omV$E7NNch&CaOA`Ze5DA?
zO&X3%D2iU3+`xyxFCT7}3$Iejx8dgkDK1gyhw1R!PKZrMw^(RCv7}O@MOaepu4s*D
zjfY{<6;4zYrz>!DtU=Xvd360l8m_}cMG?dW(Mn7b?Qv>;oEM)u!<+Bl;{KyG<l!>a
zT7@`H_yJjhgqDmdmi!(%{jua$Vse|aks<&vcLZ64sJzR}e@x{7aZ$qNAmoTl^7}7c
zWXiqET63Qeg=_Is?JTRJ9GQ}m09)YxxRI!`yAhMyN^Lx<%C3rHavY*9Br{^DB7E+-
zOUzF+_}j}jS!s2_adPgI2>257`=5Q8a4=x;(J~u@m`F6f<M4^uDw7q54R?ZFBl+`S
zUr$FRTjklTl$UQKQ`lUyX?;*^lqB-Fh2;nqa#ZbLheujhe%pgx*mXzuc=FigU1n@4
z9iM9C?`b)|lx=0sI%FjWR2g|#r7Co|Ir=eQ(iJqb?9WgsmCa5nwv{ZU=q-EMXG_y^
z6@)6A3hg9{blUD(=SoB(Hy!9CZN^c`a-Jv4E-!VuiTFrk9>$MSy)@6*&1+0Qy3dsF
zP<0$!r7fvtW;&7*SSo2a4kjgIMPHeWuIG?b>s(2ii8#a4k~CiJK=Wu{n5uf|ZLj#c
zcuKJ!XnykXBBv*Oj*VA&^3*JM+9B7Mw+Lg6=O`SNt>U4j;opDb2OzLFh*;|kQn{Q;
zrFeo4bzXQYS+|?Qa`Lk}&_X{<g!465<)9L=;5S*wW$whW<tqk^HW2G1S51VPBh323
z`I_RzNtg3SCO9$s6m#cKvb*;S1cxAmFwN@17%FJ$zQ^4BJQepYN;&vdHz~R%>1s{3
zG?Ucko5%N<bVDw=_SlFO_+rXP!D2qBicBmUBrXX!8Aow{tI5Cl&YR3u;KFo`N8N~S
zEVxeLnaIW*$#&D4gO@VU3gLS;ZYa-eDQ*3&Q^8UoSkc_}H9Au@h~dPMIZn<_QNMa8
z*)*#1O3sm(lgE$X_V;OStZ=g#qC_~{aC!cakLSDm?c3M5xgRs;d#N1H9F$v$71M63
z3RKbk*)W`P@^KNXp3Qm=+Mq{3<WQcgmPQg*aa8ufpe$y%Ja%bU(gv3neg^|J?OK|v
z2&C**D-}g-9A#k*E{WrEQk}ArEo>dKvLb>k{(>qW+BxheBcEZx=8;jGVQyb`M#fuM
zJBKWmNT<)Zle^rCxvWkNO8wX{2!=>!1L?LIEG-c1Y$n~M>m&`F-RT-~nqKavQ-w@U
zsdPD4pq<K*^BHu?ftn&uE<Q9~XBbBG!WdV<v8e|AP*c~M@ruLlK$pf(+6cE-x4DgQ
zak|RC`1Cnm^nF_2d5b%{U9>SN&sX7ypdGl^?BXbe?>gl;F6$9;|Kv~p1f|p|rPL>Y
zCxF8u)Ur42Q8(m+jV_Bj!vq#=tPfVk))kA~k}XS20UHr*l5RIPxMG-gg_Bjq3w3z$
z<RqtFIK$YvlT<4{!#lUx?MJkNm|i4=I>tj7tHAbtpR0G5*z5N4#LrwVmUg=ZM>G4U
zKnWfwyi)WuGGclVWhH8e-6%=EICE68d|c~>>;*}F*?cVlYYgJ#RCYwTFgMAmL*opB
z2xAPsL+<`6rN)+*-<E<$<*`7c%Y4O1F;F&eM@q{YjiTS&<KfaH9_)4qjY(%<k}gvO
zQ7(5Emgwwkvma_U2O6c|lXG=mJ6_|`7r(;Ve!w6IXt*k6Wn{UIQl48YtNZ&0WM5^+
zm9>etx=@wrT$LQu%Z-?}4_y7Njwzr2+J)Z!P{_gAuF9|GSY2Uu{k04lC@c8V?tC+y
zuFYYPLdBwrPPUlNm$j?Pg6vSbVW?8PeK8?WBhwVgsdjd@o3iM^x#P|v;^pp2Wlx!l
zn^x(}wj6JTTMs-G(^ZF~b&scx)Hpop(C>w;{owCdxp$ZKc8`b60r#4H2BNH)w#vak
zN(!=EqEb-#KW?gCaFxP!vIuyUXw@B<9;@>kzy2B4*Eb2Gh|mAp3%Dj`qt&HR_4(2Z
z7ibP6_SzjLYCd~`E*nWmet%JlR%qDj1q}E1@uLAKs5Hh1VnYze#jaQ7(9V3JuSHVU
zZ}M$VDWycDnmN`It8n_bOEPNchb9*<XR}-jRGE0lO$Ih8eom+8M@biJMjPq~bDrW%
z&EedP$NZ5R^^<dW)8q7(9x>i%FzI%vI3$J%40TUXjzhzDS=`;lcMGnmF&b@jzFgDk
z>(QyK%%sw$L|2fSHcY_=Fj-kLCRGU*fayH3)tZsopKoQ7O{C{I3?svGH{{7lpNr!z
ziyh5wq;Qq++_6I(otc1Wkyg*(y2&V|uZ4a($}uBZS6MexNU}yUyz;}ql!|l#SW%X1
zsVL8jd;3hd&<}L!1FurFh5_1xA%4TK5hM{sW1hq5ai7Cebxxc*%&#vmGZj?W2!zGH
zW^EAB3=CnK^JPX36x$7_N)uEm+093J7ui)><R8%MiW)hrMsFvhQ9r6Y#<9#P<>}Dq
zSi?qS3Pt3aI^fC9QJ9aFgsG7wn{{+b(eBBJj4Ed^lwMBRT{bGgDoM#QH3X(8sM(E<
zVx(iutwt7o)`%tj`Z_5X%drxQCB+nHh!#h|L`CuBc!gJvRJnNR2?lPB5C8A~jg_qd
zJAuX@t8?MfQ*4d3c<b72aQ*zfQjX+Bmuy~}%EKI$7FklsSbpVKjCqRR{QPIQbN3!Q
z?Jmmmb42Avt4lYC@Z4ndu&~uivKI}Ei%^w_5I@!R7YDnWI_9q2Tjpa=@#IvEr>CnN
zIsY_2zj2p4s~zyG$xYZKw}6uMUX>?Oo`|@aW6gr&<jE7m$S?>^q0!B=*2<gdoST{!
zUB?I&N&c-RvD{5LhUX?+UY&J$ZW_)`227rw#_X)nZ`B!YY!L(jflf5FMl>}i(cAWh
zF=Jk`MNGQetaCN#+}7kBuePsv+1MfNg!5vXI(SSjem8l?<&?bk*@Nedd^pn&yvm{^
zVGwH;nh{@m>J(pk<rr_=c))|LHapEW6&-M4T;bO%pcJi0*c@oKhML_VW~l8MRrW`l
zlB&w61H^TU(@V*7FB#HLiH*%6GKQ&%29x6+%k2UEIL<f5N-4r9=4+RZ^ZGOA_}_ng
z1y8}W=W@92as0wL{EElZPaNj(M1#eZO~zXRB1zgr947CzV?{<;F^m>IkrAVTJXS%V
zkOR`Ff>T@+OEr@Iz~g4Zqc(2a)hA*(3oWf)3HfH*c~zNJV(WgDIv@!XRW^T=!Q)nh
zkA1+89#-~356iGYIq=lRVCD`<DYGy#ow$9_h~=^@ZeQx);bVmwWzI%N$^n?!n%H#|
zhpQf+JzD3>U;H#P7oVZMynvj2iFdC5h}}qd>R5$Wj~wRM&?k;R#&!Jyfhl%MAUIYI
zhO59+$-iAk;i-fdEsjIY6Xs_oS+7@F+1%m#-}@ncwMNbNxOL|aI1Y8+B{G`p50(-s
z8c?k@`0Q)X^W(SPrRG<d_I>t;Aw#Y6&fE7rhN+`9(1w#ypa1Hsukq9Ccli0uMFvrF
zixf)%azN^sG8vSJR4uEplYM1l5jE60S*+!$!9|*D&Mh^juqGPG#|dXEaHQeji=w84
z(^EB047a&>*yrf8=aJ4TVRMbv?b~$QG2P8g9`5e5Jq+nYnphhu%CH}5!qCu>eqt+5
zQ-F)YEBWg(k}-mdWtz!<9XUT&GLe5~m?(9Qsyt52;&`lwTa8{x(_hz*H0#5dS1K;g
z&s3O*eP#(bE`~G5$C;a%#0>iEw0hiXh1_gKh&F6%O=xSODJ-TcCkM*tC@%k2oL1|E
z?q-t<RcU)4MKLd5e1aFxJ;A^K*%huoTE}tR9Dd>%#p$sMwTjO`3l*i9swn2iTqY;#
zG)|sp?CkT*Hg}kO_ZR3}3v?nwH!}1iAuz^r<_RSdq_sR0Mxxba6h34HU@~H}wG{^z
zVN6Oe9rak*SlK{f<)Ize4qKkF5fFW8;g`R(5v_5iYgV>%uH5C8cnPKPiIlq5q6sg;
zDN!RjXWL|BDIg@zN3+tG?WSIhyw;K|tvuc?8GI})y0NV0%96_Y%Hiag&#ULBIQCnA
z#Go@EzWg?(I>zGuknPx|QSH%x=Y8H;@8S3r9P8nAtg}p|-E7j`g0B>wn?42F@a%=t
zJp1Gse)+*i?DzZp;EkUX#W8i?qwc%e{fdfP#iZAMPdRwiDv=hVG;a~Dae=3g&-2=I
z7x~V6*SWd2jqkbn-_KPE=jC=Q!2kFG|Kj8^e(Tjw@Nlci?X}$!W=cjZkJ-}ROLe=I
zv<N$eh8JZF1hFI?uf4-Cql7ZaGu6Zhbq8LkE53HP#*-7k-YSZa@uPDry!Q~(n8rK$
zI*|-m{`pV2zqCoK9nl^JEOs@^-H7%uX3}>Nqm!taOyimrSz~vyX}3#JgiDrTiZldc
zZPuj}yJES3tYlavg`L$BCfLHRoUPypc%H}I<xT#!-QugyoZye2I!awaX2)FS=cbrE
z^AyH7bRI1-bNx1vZqtceI@%CLl5-YJ%7U;%2$i8sM@#>B*Ab34JRD$s80W7|jr5vX
z7J94Q;r8MRt^KZ55R;>4y6V!}Yw^QhyiYfX8TS*mgEm6k+`)AAsC?o#sL$<jxV6gD
z-95I#7CR}-IvOUd3o$Zc^eDR<u_AJmwSbcYE-6*2M@7<x-R#-NC1ow~C?B%~(BVMA
z&DpjkZi33CV`6KROIk1~Awb0fz7%5(b>Q!(O2hmzbGTTZNl|nk)8!V57?l^8Y+kKY
z0b947dU?S`m1UEt5=kw0BPwgBYbRW1^W1dVmA&tt>+r;Qh2MPcC?`MtX?hQ@v3KKR
zK6>v%zISJn^-$4|HJjataM)zGIRwWo(5cq@qp}oWitg4+m)A2jp9v4<C+ZxXo#yyt
z1z#d!9aBqZ64@b<$VZ*TYOD>hGRdfdL_XH(4!Hl(b?OzLVHmQy(<F*wrYjyXihf))
zXD)#2aIY2cufO?o&Ye2OtfM(S?y)`)!YDvF9x7E074I#1aIBNc$XunAYnNwDvXKn5
zE=CKcKtE>54<dp}AviUJ=Nc~m=!DCs&y6$l#4$Qoo4o(-J$`g+fz_2AKHKf0-uNkT
zr_J^ITU_57u+t6c#hTVIVs99sfiJ&wf!UMC_>2GNo9yePbuaKLVwon=;)|5rXU5{d
zX3IFSMMAkO$C6~_7FIzyQvN)Z7FjCqbaFy}`lGQChEc?^xoJNCkAI8$k>j}ib=;tX
zI{GZ`;U}41yg_~b5L-WZhljmw)(6ld8LQa!qR_gQ1@2ilW(?GQkKg>nQ@GU{|MrLP
z;QN&Wp4bBEr?|JYOrzrQ$qQ!)Z!fUb>Ek*M#t4%Yg|7^ccJ?r)f-%XMXr(!1eXYsF
z>H^-;+bE-{&mZFS>tEp9-gkM_4%q0&^nwH~Us#;&53v-0?NO$);z0Czk(O(D1P)k%
z55nckS!|4Q+z$L1Hl|XIXpwVmu~o2@8Z~EALO|Lh1v`IDEa!1)R%A!>*e*D+y3g_(
zU=`d^iCCeO$P5~41Pz>XkS*(S0fM*3$mOUafs!V=$TChh3n`PuQHuGh$M2q><n^bH
zP(6B<_3!-+*FL<*n@epz*zD5NCIM9`m(PCUBK7q?Kltz#Zq+YF3Tcsdu#2w3bCP6W
z6KgJ<KEZS6pWyxLH~H1Ozv7Eu{sPVQ6_)SaB{GT0V-Om&4nRl5Zk;GLL`o5A(r9-F
zVuNuMb<d+F5z9L*7Ps~g6ce=yols*$<2c1i(m@d#!^8a{k8a%O_;{7WbswLQxu-92
zXL+4=w^tm-hNPw#l_yR3mTN74EMg-B+RzX5fh(gev&o8b4Y*WO{O(bQ&z!F?b+Un~
zD*D|acURl|XrV<r5<0^ncej3tF)@q#5sRIWUJ#{!UQ7_hOjZ=V{*cBnNX!?K>3Xwy
zt`vn<3Mh`G-xn(<OC)Dum9MpV0WW4*+1yV`E}rtTrZ|<0Zo!tbc*<eI1*g4@Td6Vr
z;;%!03v>THOsxTvbI8OTGbc_mIbNsYCK^a3c3gZ}=&xj?Te2=RVH|U9X&vPzCu|D8
zEgcZq!J<WQad_tRF}(UXR~H^7i^X(n+;HJg-RHmj<KO2mzxfl^TV1-5W~~=<XJwC>
ztM744cks`>h%<AXiqqoQ)Hug#eP%qxuB!;OMn7gQm_I;fq-H5OuuK}Y0^76M$0ckW
z01r!f6ru7wwZ|;#vYGA3m|zr^qecp*Ed?w78&y)sNNMALFvYBh=CS9uHtShRF2`gt
zqDBg?D&5}la8)Vq2}`C5+e<FR$SohglyH*P`<|;$k{NIQ6UKrDDH!+Q>`a6C*MAH5
z%=6TaU19eZSGl@7WMgQE(hSB(6i1I9<qL-bZr#4gwkiJZPP(AWin*f{j*}H&2geik
zT5aw<d_=F;L%Euo?(@R23YW%CG3X6=xYJ{4ug{6o7di9Nr}*K2_$&5F5S2cfz;SZ`
zPM8|MCMqt&NTZ!ZliZ0kn3%egASj(w#%Uy3@F~|p#9?iy>1pAx8}rrY&lB`JT<i4`
zsh!H?g2}kVOQGjpx?C&4TLp#IiIbyXgG#PkuoH$6VcHQsH{<cC<31CI8U(9LY~FjD
zYuA>zu{UHZ6k0({KNfDcLPTPEp-u~XoGK&|bHPl-Ww*D_&wjMPptN8}R1!t{gp_1c
zr6O$oA4@)_6s0(s13FTx*p}?Qwi4YLd59@eV~r%_v*B=n?(M<DD-0KJ5N|Ew&bNt|
zSLrX^WB=hzTCFxg9HVud@*M3{hQfz$haHZh5F;IPb!iPT;Q4+DQ+dFCoJ1w?)`z#)
z3Ju%)T|6iGJNOEY)?JJ-Y;SC!<Ai;@A8C5paQOT=_Pb4{9xXHR%op*FJ%j5!Wah+4
zW)?PSxKPO#RyNq?AAsN}4$ffZF?mO$S9;s~Y91f8QE(%arPH;*PNK@Q))6mui7sb_
zmf9heC3VB7rnXELC>u*gq{a5atk^H8vciKRLAg8v8L?U`%VtiApMIc$D9B$HC`YL>
zEL~Z7Z4|I~r4m&`{<XI3ltQB0y|>-tQwt9{G%?TN*S^Y2_iysv{yjd}*#wo$X*c(K
z{QbK(_~&2$9RKwn{uBQ7Uww;K3>CMS!z4vFRWdjV&vB@@Fh5pDf&q_~JJc&ajarr6
z+aL1MAN=RcKJzO52R9gh<D0~0iwP&D7POhF`#3ICeZ>o}et}!puW@~G3+3j1KE^zU
zmg}IzFo+Ev!dG5>iOBW%`(M19=+so%rLIUs1bd-j;3&TT&igc?0Z)$m>_tLr5EsTE
zRb;Dq>1@}rZ)2f0v;v*lgef8G`C3X{001BWNkl<Z3KK<AgpCnqe8p4ahWRItq2>?K
zx%q&rA3Wg4OKq<11~h}1NNbw0p_BB~h}Nh)6ftp}G(6#jle4_=@-w`3``c)X;3OH#
zHT`0nls;Ahv!~;Or1O;$d|PF5IA!AzMn6agT}7pwu>6BzMYmgBXl#T~In+;_p}o7y
z+JE{hhMUWPq2k}i(GJblK70FJwmSn_!vud>M9j#@FxPq+MoP2h?Be4%sW{jU;<R`Z
zw)3d34Ue{WSlAze>*2dDD$y2lxazUhk9qf}S7?U`k!~1ic7`$A15Lj-WXx|--QL1G
z+QF%fF?Q?(O0Fb;da+U)M3om-j|JVx<4I$Wna>tAPmRnu5B^^Ht>1`c5RgKVJK}&-
zqoWR?6sMy~G%$IrNki-~PDWpzouBp(Q7!G|nVpg$2MRQ~fuZc4%fU)gmLIC@6K`9?
za+8P3qvs1LV_7$CclR<vgDXQIk|lO?sCjE;pXz`7HqX3wnVF}bVfOjg`QrMJyQ{lg
zZH9!(!HDqw!aB7dzRl6eI%lS8c>S1mU~=`5<0Nu1&r$fw!BH^fD}L`EeVv{4HLiYi
zBaxl@iI&&tx2POGgM(r2+8fO8wAk3)qx0@BnHjG$B|_C#oI7`#y_E&V*LE0cm6C1~
zHAdBSK!cwupB}AkCM*X@@&~i`Q0D?pl}a*&fl*vp+F-8gbG+g4{D~>vUTLy5h|_Ut
zs%l7=YZ-Va|DP6NnC6Yyor)N-idv%At%`7}<}*#3cyodNqq{8KUf{#c9#@+IEBz>O
zsia-17L(s*vLNf^i);RW&fY7?vg|t3`_?|^n!GoCR%Mp$>h9{U_5j*|1knHikQllF
z-Ebnr7={c(6OuwwFhY9Kn}T|oXX!~Z5#$U>X$BHT!y#w@!lMb(-kWMuHp`@U*WYu_
z-dhjH?S1a8?#3XZ(cRTqSvT)JXPvdz`v31|u^!TDgna9Tw;3mS(aq>&)|v5Qur?_=
zSAU*ccC=+NHO|Idyv0r-#gR%OuntQgPm(Q`FP;XXxZ$)-x1_gs4*B<g_Y*cYH<_yi
zv}yrOmGUR{hB2Vn8fo@MmQmtIm)mI|9B0NR4(ZCBIoin{*GZp97hi)o;h_`r+;`>#
zFWuOsHyjfvVI~mf>%zt;p%*8qd?u?%o82*g^W!&oV5vsXAJKgAd(_kz-RrXP?qzNc
zH2uUf&TxIcL#pxsky1x$z+a3>RiZWNn(~!rcEXfV?X<0v(jgT|*`$muxAd0Xot4t1
z<wY?SPe0=;NyIv*jnbrmRQV=2fvD9(m37jgr2>~P@tb(X(V6Fp14}B0!G7V+Mhqg>
zyS_^OwCjqro{Z1+6sImW$x;x~@6m}3uOE!rAMLPuZ6A653eEX>7Ds)4`N7jX(jW1y
z4|dodrd{PT?_6UhRIIe?oSv<-+(^6TcB959(e$GjB`Ph73Pcp^SFh0PbO;nQRY<!Q
zU{#&{s~2fM^RKDZEi32GazRJ5Zyzw|M~JFZQwn1Zw_pAdX3*vMY@O}HK3dh%qNrdd
zR3tW42@OYM-nz2R@ufx1F3qvo=@$!2C21C%I1kozZ=~3b3_}y6RgZgSYs}XIu60Hp
zk5>Uf9(?J>fM{bJ1%oSM$P*^gZT^xH?r&O-g=2<SH@SW5kXNtm^2Wi4%~8xa!#R2x
zR=MHA>+~!qW&<9&ca7JceJ^#cWr2exE5MQ|87N+x@z^9@@imh(Mq6xd^UN#j6w*qs
z;^7u8>04Df?mD9eD=B$*u@SPgc9M5)?(*X+`^?WYnXM~kvNOeD6mxv0My%7Ap;WBx
zZox~rPw_<cj*QL?>MglT8>~1BBPFHYGB$>GO`&T6igZ~K2sCR#XvXvgF?E%u(&j(i
zIMH0)?_rY$B!&}Pw>h!6%El|t@%%d*e9(>AAE)UbrZA?Ib9GnuU8FX<z!|arSl6R}
zO?Je#LNsH#+|;SB20tyx`c1QwYbQ=;>=oPzSKbszu#~bd@lrS{&Ad1Aa5LQ;_N>DV
zDEJ%J`nEgk+RY2$ieo<)f23m_@THqG=Q#I@_rki6W+_Kqwrb4DPFj)$BxD@E-I1mj
z8$M78Mh`I@Fjo)x=bwL+KYZ#T!hiGU{NUOl>%EBB3W*3&FQ#8NEY^jm&K>7hzx)MW
zdH*_J|IUxl(!{Ft8V^Fnuy=?V_Gkr`xkkuJtH#Pgov>jc-llfuQ5rx0do&il#$B~l
z#)rEcU3?8?1#L8k2OacW$V_vEPd)V{FTC&?w~q#dfub1-gBTX-0l)P4<FpzL+Vk`5
zjuO81ci#b3OW#`KP}CfQP5w3w63fMdF~=K<`xfea=Ilvc-R!2ShAeeLN)2!Nwhogt
zc|vPH9oAc{nG~9_tl<7*O-_FLDQswIeD@zXdV7=Yk!GlEM&EMH_-Xg4&_(B26H6mV
zBX(YT=PFx!N7R(0%wJcIWXg`W=w%&7#KhLyx=(be+y!Nfwr5NSrp3xwG5&(b%i&2i
zekWTY3xVbvKYo$*PQ*cM>5>qRLD_WeG)U5$t`-Qf)s;V1rUPZH8yjD7OnDo7@fPiQ
z=cKZEXMoTdjMzOKkR%a}EE0HL5}y3r7g^iyar+-$VHhP22Nj0KaB~n*4`Fk+N8|h7
zVdKUj&u<L4(up~U(_B8|DHcj2g|(H4A9wD{G)a}cL(Gu_Z?WQkft{w=b(d_F_sD^Y
zxo?`SWVB5$xcCw>>mnnWk}y(fN4-&y<0P9hTbA;hd+%BPdx}8#d`2x!Y>su=BaTu;
ze5<rK2C<Voa-116ZuF3tGPlp#v^bJd{6@K<D*Jg4V#9xU{VH$V-XjR+`SlA8Os&Ri
z+XG&_x`otIN?1P<WV1u-`B$;gh=<n}2m(cH486#(RI~ib@Babe@Q7Ew_br;H&;56;
zaN$>fhuLt4=3*Ol?>|Cjjx%%bd1kc1%*QOweG=O^MG{$-uD?U$z4tgU4VFInI9D!S
zWV<sYz!KWj2+<5ePA|@)>UF;T+{^5ZEfS`BV`Fn>L~1B;5v0~xMj8v7!<f_UI{)MU
z{6F#RcfVa~cWtVpD%;&G05VRp<9lwDu+G2dAE-%_e`{s{qYhGQqQ?otC`C%9g_6vY
z>&}tV3n)~Ub^r^ZVzDmVf2_swxx3Ky7T<a4A_GH)i_6NbWQ99hq~Wn5CXb)F^vp_y
z{*^<cEBMEW<ErE^4!=us?U#_wpiVXvzj9%fryn`TPu{)B=Kf7Wu|x=FZW%Kik_<YG
zl2ou=6P0!4rbK<%GVQk%0l4Ty-{R>mY)U6rX0Ob<-OR%tWC+YrqG^g{CMa+E)pm_|
zZ;ON7J~aUwh!Yi;E)Nc)gjP_;XyNAN>%6fy=FP(~ok*vw(u{@b?a{2AKI?TNhOF_K
z6SfKpX3EaZPGTE9OSikI6DJmZLVac{B5ms}+&-+}<_ZH`G-ieAEDp`g(;-t)v^fh@
z50z7q+qv0$;`9=32&OMbvjwchN`+-CKC~Zv1{2PxLnaWOlyUdQ!InEqY~w{#r4O{r
zyB)6X9MKK~K7V$Z|K=-C^T_Qjx_|ob=&B|`qe)^cyS))VeDgB%^?<b|{L(LemeZ>X
zTzvg?biYTi^**N`d5rlle3FHgdFEOJX75=+PJIO#-+*QVYzI00Nf_)9ES?}ZK7y5}
zFsem3|6StlK8Ke#c<npiq|+PG6wT?CMIJc6!cX40!cH&Z8_&N%WDGmq0b`S=(qstM
z>XWK6RVq|cR&lcz^MCxG|AyPU`$fkaWDYiEy${YALs`cz>_E`1O$la6VhCHabZ@M4
z`HlB^^YRw&cgOUS6a|?V=v-uNY^q)eFth_<trc*#DV%Nzzj*%=Cx7wh;jh2XJFS4t
zVTy0l1>e;;+hkWp<{W9gjj*l6jf*pOC}G|H^;cO;iS_1p;;0#Nd*FOc@u`&tzkL2U
zpM3CM+EGk*dzT;YjM-BGs@_C3+87;U;x07>cg?`{uCP0HOa>m%+;yQ*K0HLc6k95@
zN0r+wGx2$$e^h0@*HT?^I1=LQTb`J0(m&YYy&Fda*3t~5@bqaTB-XOh40-I>43GTA
zZ*j1D!0TUshOJ?Y$^t{HovXLBlqx>7l5s}$NNlGRTRZ)qD{ujU%9uc=7${sYjGf+5
zJOABH+ASQ6b~2OAy7Dn^5+NR>rr^?f^tN&sR!xd13%rzO6K`x=?jK4<vJ(?8cFNaI
z?lV2;zGE9szlSOn7j9l$p=xl5d8D)0VyWqIM}%%-c;?0d%^$qVfBRcs;9vgl{~PbV
z^8v4Y_nT})A)CWAgrQvzn5hXS86$ecVl!mS4A<X$g=pgv=k7kn@u&U?wYeFj*@pH>
zm|4NvC^co&W?}Y1I)jdT5YC~bLH(|Wn7#B<W;gdx`v;soKF3o}Jj#i+W$G&@xx9Xx
zt?roaXq+ajD@Bl9=h~R`y(mILWb$F^?3NY6-dOXOFTaaHQVCgBbVbBh8s_orxYDdV
z&L=<eYg;7q-nw*y8`~f7?A0x9^di>#F<os6-l<rfioi@ddJt=<1+Y+uyIP9J78H*k
zZ}9LJzrfB*&rn<cfb$DAVyhV@sgU25g&E_FKO~1JyH-8pryNjjZml?Ceh;KQX_lB2
zkXDC?X?NKU;rv2_`#<#r$G-9hTv+%H4`02>JBM2w*#Ij6Bneh0Xk%CiE&t^o{SkZr
z>M!_*_itiFm9yFG#xzzY3KAZ}%6deke4&*)jPg!56sW1pQf$+#tB3AdCAxXQ#!(+@
z4QEa)^VDzt2G9TLS7{BSH0p&E7_EV^wmi5{V|lj0_NDi^veV(6gP6eDN@7nLQdy1{
z#94q=j1be>P+X#!uMDVy+ow^_s`lK;36g)zmuhkMl0dR~tw<%&f+B3Pj7X?*fh&-4
z*Oop-!Qh!1T&Az1HLhL~`3ORsBx|u$mSJv(Tdmsu`ze*~xeV42rwg{;V!617TtB^=
z$l+<yvt5V?{lxOz)g2yr`Az=uljr#IlXvsfv470^wHrM5?mE{F#w;`g&dk?2Hr!&a
z+vii~7DzH$#B4icX?2!x=?t=T4s0Kr^pK#5NDCwY)dV7tIyRg~;yoB{z`;dOW9qFs
zb2D|qM#%XG?q_f7HsAlNzh<*Lq7f?4h9nRI4I`_0U}cv3Pp|R9^&QrC_faaCGFr-)
zm*r<<Y-wBxfm-$yQtl|q0HfHXnP=Hz%yS!=@(3z6WnT974|wDHE<fBF(uvb_V6AnT
zO_dYO3M#*$hGi~PoNNj|_uy$B__bfBdHO7;7MA(asq@IUf529M%w7Qf{0N$*6_?;=
z*IJo{g5-04XMs@-KNOD-D4s+{DzYa}@Zb&nO7VMQgrPP>2fHNe@1ys3NMjxpqJosE
zFzRBHF`<I}Sa|kpf6n0OAd`YwPxxMJuAObVzy7nO6iUi=MMOLjVj$@_ClsNcS&U<A
zXwJ^D-0ssI3{esg9qx1MrJr!u@+_V1ki?iQ&MNiAFEnaAaiUGFy~O2f8~p9{BVy9X
z>m*~i8rOd7%9^|xf2k0$Q^o|IY|*1N*a?2{#D2?7!{rWR3Yj)<uwKXN%|hL|d$lvq
zW~nl*g1J#aSTC2YETFb>J>me)ed(EHl78vWxot64uu|b*+@Zs*zBz?+&)E>=*LR6M
zHqJuQVa<8T#D0hCDQ;YBsle`V%wN6mF73_^zxR8;$+>_2zjAu(5^LZ8YhL~C_i3QG
z=gb<%*JfFG=o8fMc>=rrCN^xLj-MxNj*(i3-F^*`1PL10g$qd7%6^6z^brK}h~9-{
z54zW&zg~<x$C2go)*kPy{|z&t(Cv-W7<LijLT8(v9Q%>x%5I15C@K<!rQ+nX?gL81
z+0Ud+TAsP4JQaAh=}$M*j`+YaCZvROljf+AM){~D;&2$V9~ok!35pyplie@I8T6at
zqO2=e2rP>;b=nU;hFV%hW*0funrH3VpU?^{HARLT%$91o_dORG%hX<U3cA%!5hX|^
zmKQH&*0Zomm5W=303JpOZ|#rx=?ky0ap`@oY;}2cr^jAo&~*r`#*BwptqDZ2-5c=8
zFaI<2%P;f658q%v(r!FhIX4t0&M@wnp$IaxK1?JKmC~EUqLffmLLF!*MI0sUT))PQ
zHZ0Z^)<WGTEF3?<eKfeewa;i6A+<USts3X%>pXeSB5P+(veOlQaP^RDy%C|x@Off9
zh<O^lGO27RLjRm-b2kYAJBh)x6BTocgh47_Twww;p;&RZN4erke6vb*eQB-l_QhXd
zxg9dj+}Gyh3~|M9j*2E%7l<=Tm;!8@h@{Ur&DJq|<OR^W1heWjKBeH6QxrQzxgZl+
zb}kb*KMmy8dFv`f9AHmTkeo=B+#=nN3^(?NtY5sug?ld2JbQ+Fzw~PyTU{hR?9*7g
zkD1jKYKuz*ryhXgZD_3`%{9!mXBfWlHAFPExfy~pPa^RV){c?d0>nGO5NLpoz=W{$
zBr<Fe-rOM!b_l}s8tsiDW@c-&Yw4J-;QbmQP=;C{?DWUn?haEIs0z{~a9hHX+~BC<
z3MkyC>E{tzAD2|AUpWPA3Z$gyW;DuL0+YI|a!ar1w9ppn7i&<~k@R4QVuKCf*j$UJ
zzx;CyZ(L>ng`cqS<Yx(#=I}?~V{798f}jB3K*rw1c@P-urAByMX**SjG_jy5WxT>9
ze$36Sa##)4_xKOB;k~0VKe}<qn_FGp-5+tgpKv(V*qTnAX(j=aK1sV8{`LR+byifu
z!;1~xJBrvD=?v(TZpMmyvV2+LWVv}6kGA}9m86S0g&`0{NLp~~0*ye?2+}8aEeM!v
z)EFgWjJ3?Snp}M4Wo{froNOwd{PnMJ?akL|nlZol$+O(`3r|yj@UwLP-Jfu~zfEW%
z%w&6FL5y+i*Vf@4J9W;K>VjhNRwa^6(dEii0=&JWglw|KwUf)!V%}Q1+q|XHwB?#q
z6GThcjJWPds+dS;c3avK3yW>8o1J*xSEd5RDJ^%HSzrE!IO#89{enB~8RRS?ZN~B_
zV~|vd-^`cOUguk(tr<V2$KrSV#wDCtuo-Vx8#ss!uOE(?ef~9eb~icuiAR}Vo@Z|L
zE*2g+gIaq4X)j@Kzl7a;3$^wbNR8zE?{fI+59szZizim8op=lz#}N0@4qsmf6N8$8
zS{tMWDu&t;EQ|?eULp{KA_J(0!pUQc%&x4lIljpIn}^x`MwZ_uSd(z~@&eRC)_0E>
zM!En832EbF3P_WbR6EDR9XeP$<-My_Bag}F6{b8x8pl0mE!M=CG(pjmF_lUmDRPZ!
z7QXW68aMWP><l6<Uf&_yJS6%4_o+!j>)w0Wy|K>q&X~jDm{F{~nQr>}jk82cQ$=l6
zJa3u2@Fx0UCnj7fFq9$=DE)29Z34uk;A7`o9E=mL9*&r+Dc(C8(~r~lE6l|BN(GpV
z|EUf9@bWgTFxB`yvQ(oNg<S8&?2Qr<Ed@itm{J5URP>(SJS6?KFat%WkY%VTp%$c8
z%w`}o6|`pCoSJViOb&>ngnQ4d(x`{Xja}Mx!`+Jk;YyR$c7wB@_yjXw_|J)Myhn62
zps5080+rI=GGm63QorijQr%Ki3=fP<QIy~j!aT#QomOmRV&WiFi>q@bOU15CwcuLc
zwkvj06Xq~)i$2c!e2?<w8Rrvnr2?ire&$Dc5lqE2<E2D91-I;SU2}#rBd*FF?oe<i
zif*nP%1?EYj~GlD+2m?^iwCI58W!ikEqF^cW6SrmfcQA!ti9Oq?!lO&vF3%{t1P~{
z&V`j3e(j4-^1$bov7;^|LsWYu9TDu`K=0gS`}uEi<@x~xO<MEEkmUzavn^nRZLT8G
zE|`5#4UmwuwH-iwgdHBCqajHglNeoS@K;tAx%;V~<JC)>ymxyar4%Z=7nRZkO3{sC
zOq_DT15qj5$~jVq!!s_8H04Y@^pE3?q9Oma%nlsn;gL31HRSBbGQ!<v8r5Q~pxsa1
zAYw2k?ULpL!$Xf=VC&UOd~od+U;E*koL>mpJL<CC{|1XoZR*EQFt@tP&)>7c)^l&N
z+3yy|K<i9&-C3YGan!zC*H(yCRljDQVu_QmT5g<k5OeW8GNroB_@Ei*Ka*T(78(Jq
zP;nG#!c4a;N~kTaq{EV7KZV5yipW^r-XAevSDbFucw(i&FsXCB7qdOmbfc`|TW8r*
zxQfbn8bq?EGNqCsfG|j*Aoa}k(+q@GAnYA<xMy~jGjkz>f#K}^cQd~*OPe<ct;Sq`
zlSdvr$>Pal)X$zJe)l;J-+Q0KVU&$7$VM4yq1S*CgO)O~ykNFEaHagn?MZJ%d@5L8
zhVnXEe0DN9aS$9LSKbNQ3X7Ntvx_&($di31s#L`&lP_>>PNd5Vr72YkQq_q&9j?np
za2_tUg4UhzNvCjxVk{xWva$r)h<l2wD&(dW+$lx3v=%#acqxg5o}1E3DW<|kwgpqy
zO-WYTIuE2$onfq{8ykk*nA?MdrA9zEhVX~4(!X(wGw1K2IX6SFFpKVQ5+CexbTH=q
zjR70on05meW;STP_8r<Mmk93r0@B}tWCtrT63l@aVpR(<N3j16`r1VXx3AL~YKBoN
z5(sN`j&^qW+yCdQymS4KdacG-n?jl?sj!32V3Y+elvhWJr!o#P+LlYy9CnmFXhNsZ
z8WHi^UE_dhtZyqUmTXzE=_e3p*fYs5e3gl(^ZUkF>dG=33Y`)Bi?4ncYb}j1y@*CS
zW}^=;?hIIMhy3cVoMv`miM0nG;qPC(NNiGIMQR?_zMa;VF)`LwMzqr$Ms~`n)N7AT
z#z)FiDWu|ja&9D3o+^!n!?9+yX_%`CyDFPQ8;#WlRcp{#T4S8tM30B$2N(nn$A-hv
znDtuBT07+Kxq!Rc0b3)@dOuxqM!FJ1Q>da;k-i!rD4WU0L<kXTKwX4}O1s?#hU4>f
ze&G-PE26C%TzU4V%(aA*pZ**x#}?5y-(}|HNoGF#Ptn`&GmdNA{{CNcW3$7RqliJQ
z5oM`~B@sx(qHH!_&a=uq>6j^_j9iJL3mo^D8RAKDm?GDyO3?Drg?KovY30UNM6p$R
zm|LL5Q~P3lR&N<qFD{<8k~3!tjsgzf*`40Wl<PGw?&WyTmU`G?u4<;ZG`NGz&Y_{@
zMZZ{}*)pBg`lp1Pk71=UX?N}GuJYKFY28Mgh$;sck@qfvb9l+~$;KMGk!5=r^Y-45
z*lcpw#xCu8KqQKR1dO!MA8U@r5m91ToQbK2ied6o&YVBNVsD@NOhB-_imW{ejgwg;
zWw7x8yZ0W$t;_7}_1W!=8O8~SVzwbP>Wbaoh(wz#8_{|*YmtnTqtg!A<nqAmK`fqx
z(f_^qrI}lX?{E;AOiuCOIM${Quf#A643Vm3h&2ON6-Tfv`I3f$WA%W8aYSqkHVD8N
zqQr1$G^1G99T-BfTs#<Z`QQCLtwz9G-+P^n!I)4<dOpXbUAChY_0tMW87(7Hy3?Gh
zSv7!JSBqEh7)<e$V#-p)WrpS>zW_@=(cB)y9GeN4s|iPAAc+tiBVhna5j2|Ec$A(J
zvSVS8-JC~}p%X=1QLxesI589O`;VRG{Ml3di*G(pH!{T{D8G<Z_LB#hrZ~t8q0OXZ
zfugQRJKsQ9o(Wl<2{7;fgvENyXMXo9v}P6N(la#T0pVj$qAq+6>NDuUklj~)%FW#Y
zSC1k#2Qg!<2@!%o5m-Z@v;3`0b)t%Q-FO$FXCE$FRi|jW%H(NeNL#gx_!p>D=f4wW
z$2d)|6iz_rfLJJ@%O{68V+d!oYf2cpJ4`9yMefYNcn)9hXB1bf>jYg&4tdKIAvp)Y
zxX7akTkwa^adStTb&kO4e^eEgv7I<&RQGaa9$<P5HyFf-tK%r}k&<TwWfDbq<%Sb>
zicwevV`JEl1l5fgX}CGi%!KI@cw{YcmZ_*jXod<U2{-nJjG}~I1ZNHgoH)14?8(Qo
zz*>tWJum~%hWMyMztd;;s84qkV+9swQmN$PY@K86I@>cbW|(BrKV^b)O@wy6Mn6gz
zMsY<ZsGJ3D#&W=)wOgm-HI?e*V+gX5LLO>aGLmhPjnzpkU7JFM)6h9v$jEXl?MhS8
z8EXcKu6X5Bhg^)NXHtEywT6QcJhWg@k`QZCe6JK}Zi?}UH9o)87u7lG64i~iOtH(m
z0{+~w=8A!*5UBEbpj)F4#tE%ZSZV~s2CPm9bc`^A6(MZSq6a;!j!I`$_V+NmXpM%A
zfnj49L3_yZYQkg74c^`#(~V7qN|nKsMG%z+1*&`_s}x~2_pN0xoYi)XyO)|QE-bQe
zc9mc*Ah_^F=<UMRE69n5kdqICDD1WO2nn&qFdA!;#1a~zh7ejqkaqwk<EJ`>w8)Dy
z)=xHYQxFUlmTh$uU#%qWWZT~1I9;WeIUSk9j43wI#mv?zxW?t`mWat>svy>z@lHq<
zot=Z7@*2gx_KNXAIdc&FYqy-}R=QmKVT(n7j_c>H`8<*dNR*N3ax<qZ%ey#NiBdd7
zq?EWBD#;pdQbu0VoQNWAU=SO2tYvI0yW@mrpt8i@^mo()MXMGPDi|B+MlsT{)WSY9
zjez<2ChhJP(q2j>W#J5Va2q?^A?e4|@A@>!>(|j%m~Yl-%_&Z;F0gj?F5>zIo&LLM
zn`SAF6J5OiP=uv+6T^tXILd6p;t9#zcWTOHj1Y)zI;=4=<)~sj&2DDXHO|rAq@C4K
zY}k{q7?xX{Fg^n-jR37R{X`dX7;Q~i^BwRG+F;R)wdHa*;qG?G?jU9yr$cO0VT4#O
zd&@dI8|$PSIn$pB001BWNkl<Z*y2X<9A6c1isUgbVoKmlxlVTY2icrel@2y3ghQ#W
zb$6U_ZobYVtq`L%wjR+7EqxSbw#_)6W!O6;(T2nwedJbVl@?QN;Ki#Oyng*QpFKIp
zfBn?m+&UWaqf47aKqpR@Tg6dMOrhls#1g19**H*^P#GGbV!k1)uFNw3)UVNe@Nw9G
z3l>kosmI~;Ly!z0I>Zi#(A!PbEBUexOAtUUu>@Hoql}Bl^dEYT?>IA7NTGU|WYhY3
z&ndV2^wCij9VwM>>aiId;#dCiGWd~~P~nA+i5Cnhu9V8UYe1PChfJAzlr=AVEk-;t
zSqV|EKIA8J);_f8R=5q;k)2JCEpm7gQ_sLm68*5Av(JO+SnEk5i!j+@S5v}>EaJhS
zv^5Nqv<MI5w9wYVbhpq56behMEU_|#2}A-ziRq34dc&CEU`(=qoBHY_sfj`anK=)-
zhMj+a!xz5C+}teZm)1!3w^^R4ar%J^v@Sf3ZoI?Bl`HfUOJ@|*k2Kg6#2#zI`p#k6
zxdy4DGgq~gOWBH=2j2)AW(8MIvu;{PIZ#A{I1xaY^5%*R^n#FP5YkjaY|4vswq}^G
z3Ag*k(;?s-JJaK)aZ)4FqP{oM%mr}&e4YKsvfCdq9+~V(Yu&xBM`iLhzQ#CmF*}9f
z>X<A9KUmOaOSi1kkjkJ}j41{5`K(t7lI4`mhXG$aJI9&XI{mTcQmnad8uSyzsD7M7
zrP=SNDG#y9Hpa#}bHY@UTT`ivZKEIa`6nM?b*aUJ-~A~UHxGDqZ^(^)k}g5BD3c&P
z&ZN#YC29P%Dt;7<O)nU8bRC8#Vg6Lw-Hs0tG#tJK^XIXf@1l3ti2)Kf?Z{$H5<8hw
zlKzZJ2})<L(`GOfPxU1pk<gbTIb$o&HTiK1txSBD;&5>%+*wnsyD0Gzc*|DUu@o0h
zw(<nzVkxbwUA1>8w(bpx>j?9SbY<cM)87Lt{%Q11qlK*Cy18#2vCL)r%EvFd?)P;&
z*>X|nJiPKns`W9ZCTB+=-pjCFgX7$b#u8;CD+{Pl&?>dMhsF?TAqWggr`LKvvJ8fr
z;V{7rccF6)+iXMFhTbLY;Z5QXen@Y3hxy~HocQ#wvHz3*$o$$p%>LZ3Vxtjr@+SA6
zm}h%*$aXK{V3-sp7bQYHRO!COTDR5khH9meMJhD6a>lDg#JH#n&t{le)$+oa>&t8w
z-=VA}Ni2P7aH`qhcvGQ=7Ohh}-0_BDkm!_Dghf;q;Zs1(EjF_g=Mg`7x>{r`H;0-p
zotb0aDlY9FrL|P+;-)F(#jaf65wbaUJUbzfccM!iAHKN0Y3~S8Sr-@1u`(Y@Y`Wra
z2a44ieCqsNJn<`EVSKdD+duv;@9#%+n5AbI*=mJcyM3FRhg}ZF2}$m{Dk4P$NumtE
zEYz)~yLpo@{j>jtNB_wm^4{0}CI8`DKj!Z*9dZ~M!hnpc8*=yRGK({H4i5GSf{;K`
zDOn>BR1grG1QYeJ{adhj8tJWLcRzq2L0YR2^)W}ciAE#(qnJUQejZRJ0;p^mro?(3
ze<AC#b^?l%ZgQ!l)Y~adTlM%WlU4|s?liCy3yR5Ug-p2StQVjuZe+U~OXR%TYI8h|
zESkSgu`)4BF6+IW)F(4(oSDk!zf+g%z=leQnlPC{F{P9KkfLiVybSB60E(mYuSD95
z`*j5hRJ>=X$%?hgj&JF$l%Y|xy-i|-(4<MhvCd9(i9$&__KFhCAWj&KMwnq2JGcqG
zIh5&Rx|cCW39@<t{lNx@TbuCAS7|j`wC{a@+PzO;b;9iKE!M7HWOb*{Y&{@U3c;YQ
z<@8*G6U&Rdy>-OaQ5VVNp;nB~-KfgTocA&m5nXN_riiUvgq=-I5_!Q*%@R5_1Xx25
z);YgCM;LW^|7gtmzz`B}?_z`3w>#easzg`iX%fcSerE;V8jLn1BAmYKH0Ljz=f!vb
zj6-SCtcPi~S25o$*XXXz)Qac+aPqb6lmJV&IM|A_$NJGJCDpXTPAKmWrJ$*xIlD;n
z6Hn8Mj=1OMo6H5b(5+d9y2kax8m)SWxwT7j(4{+0Fam)Jk#?J8I3POQ!-`_D5%Bo=
zlLWm(=y$1|e~Qze|4mN5@;=?ScjzQgOF-8G+A87UM<3$ki8X%s^}l4URcEbT=U6M`
z%&B9vTMd@#LxP1<$eCXPeT3b47u)M%Mh66EP9cl;0k1P2Msx=egJF~=K8q<j6OmHX
zFBLnm%3W-gWCNtsHM%Z6q(T&%94bz!J5x*)&Met0hSQ3o*VIY{79;-5z*bN?R;JL)
zCWpAz5f}NpKs#YgpKA26a_2ylDKiYW=(@`<|Abd{M9LkdXVZ$Vbplk=5t3A>gSNzN
zTHki($)m+1sHA5~BN(yii7Gp1n(SIitPog83@DQ>;?v>_N~g`qI59-AB^ix?Ix=@Z
z%$$bk0I7E{{WnRrZ%}X4h?0n)9x}T;LnwV@xC>fS3r4gTn=H@Iu-F`?QAAm9+Z!j`
z+&y4098V;7P=#zwll5f=3X{!wttTgQBwz)V%#HnV2xZDz7L?)GOoLCXo#5${A@AJW
z<$LS<G+Ir5`ROOv|NH0Y+}c5BkYpb(nLW)i@)_=*XDp*Q;@>{=3der>8h0<xGpaSY
z_v|U2f9DdL{b4FeDI$Mt<+x-$EkmIpEy()@7j;nF>&h13aR1E|--_w$Br;WpMU-Gg
zu^qvsOYd>=n}5d2TATUf^UR()N3eE*xIg6BJ8z<mp`#U@utnS(5m}w4GguALxR}?j
z&NlhofBJh|{oAkd-nYNS^7<B6zVlbS_3jlS0tQJ!ATZRLP9*%r-#tSs6cQ`U_j@cg
zLr%2=Rv&nTlgmxoVV7{W4WmQsU;}%!OZ4tbm}o$-yN{ZA34M5zair;wG`&bO)&_0C
z=ybuEBN$wmOz|knBgeCfYw}s1_2D<xN%*jLnliXY`|88;PJ>8CAuvIW5}z_ts$8Z>
z4(*guUvOzB=d9LyDBDUVr=4O2zmx2ZNt>_z5N)oz&??-&GS&L-3vxgHXu&JO9wf*X
zU~Exk%8L@~ok|L0hIOcc`19v{$(a}1LYkJ@&{H~C`tPx%+F&In8?jl&iDfuW7>~dt
z3L1+@`vf!=VdgmDxIwEQb3C?$JBKu8XP8-CB%G^37(mn^m}$^nS!8u_pX2R13yl$-
zae}o_s|B1nxyr(D%%zQ825~}?Id>Bzr7?;)uz&Yxl!4s;_>cd%0Xz)cCn6_+IUvy1
za<d!p!g_~WdxKO6ZEPCpZqfx9+N9c4tvL}GKD!X`3!lEgJ)e7=6-L;@1BOw={^llT
zG^8nMaOPNNST*bBqUnq-mRpoFIC!=V@5h#dSknqEr)L{PR`J2kVfuZTOssUfR+$nH
zQ@CrSl<A}fgfduAyiT?h%quBZNXi*81R}*oe`%)9<M*9Kg&});dn~tW9A8^t;gKh3
zoc|Q<PyG^&)l-DsZKC}Rw)YO$+S%n`f0uEuL)`D6`#p?~igR&il<>yuZ*jXb;^5j9
zZoT>}FI?Z@<->^0VVcsM=2E4BfQd~-;q`3BYivpwyLD@W{f*nq%{E!O>pW`jB6K&1
zZe66ebx41w!*FYx&Xr3<QOxXxC)nIP<n~^Nfi{dajJ08$SRxIPHAFVmaVOTKv*T<9
z;9761NfgCENbUqFvz1?TEU8j0D(-Q^`yyw-<V&Dj%eXI}oPu4qZh)mYrVeqijefFo
z6*XD74F!MBI*o)^4LF(7rF+MHw>aj@o~cDwoT4i~^Ju{<x|B>>S3u^z2c=~eAD~Xj
zcF1qt(gi97Sx>T{OF=TDQf3m$KL4CGoi4f4ie6JfU8Q#T#W1EdKZ~jbDaLVT1!*p!
z0!wS{96|3Et>b5yIrk`P=?t=P542WMjRt`kA^ihl8`ACe87G=%VEOz*ck|!>(SOIe
z(`)Qs{eT&(Y1IQ-fnvU{IJG=aO$muH-h$XVJBQr4md|*->ZDwUB#!FYl)~{Maag6J
zhr}pkZjt#@%iO=(B9s`V;K{Y)Y#;RbhxG$q+)dbtGg+9FM+|q)Lq)Zqg7lBN-q%2v
z@Zb<JNy>##WzqFmDN?d_OX#-43au_woQyD^*&v>{e;Sui#7*U}wCe%)oju9z?R^ff
z-=@BLhPj8ICI|=EIuQ3zx<@1Ev&<nU%mK?XVpADL1ysnE4nc&-THe_{V!olc-V134
z!ay4i#tB1hizw`Tpshruoi|P_kU%erxwdZz-q~i{{ZsCF=sp%soI<3|?p{Q9^N2(n
zMx%&uH{#x7dyJxpVOD5kZAh|buOXKi`Y?KHO$pAn<@iAyc~t&D6m!RZ&y(;?8D>sW
zMw}0*?AEH!-KtA&8u_d`dlm0kUi8UMJbKR3b^m;~Xp7vb&`#-aKgKNAEx6)zxws%F
zKdrLV=uRvqKf25HATU`LomAYPBKUJ#>sbr4hi}^87_q4uMx|v%IYyK`!plfzWy*Bd
zhSX%CGP8xYLToL8w!}8A6aBH_D2&+Z2i(}~Q-AeGEFN5?cJHU*#3zw@3w7#A?BIZz
z#g_@%bI8K|uyhuJ7NSScTB3gL6Py8LZJ(PrH@LCir(@viUXMTj^RM#W^_#43AEkWV
zY>|CtHsrtf-CyCk*WTubZ(XJnB}B$D(hzBz`WGli4N*#P$u?ct2N&c#-omVqg-zPL
z_@*6iVhlZPSRcXVcdj!Vj%bE;&fI;9lcyG#X*6j)^f<lCmx;gqQ?7SM><&^#aS=gj
zZEC@D?=#~B`DBGYvWDA3cxXQ4GmCB3hj4l40BuYWZ8Lf5v<2?(j?k4%9_C)J;sjup
zfs!)im|I@-N>Yi*R%gKf{jHxc*9iE`>I{wk9^vvi)QMBr&MoZDYuNoAYUYT=#Wt%8
zGc4~6X$EQMtn(Z?p*XfGELwz4Wa!1Qb4<^c5qY1lO6#mKf>vp9)Y=d$MO_Jzg`0aF
zlJS`BgSR=mc7xNu_}gr3y};3KkJwno<AhN%pnLFjqV^h*QH-@AHV_+Ibhf#l-@5cF
zCqOOd3tPto;K{GVdTHZA6@p$VrW2!t>1s(&Ip9VqxerTQ;dM~`A{@Sevrx6uI1)Yv
zaca??Izzd`Sm7gPxmJ9Ig{}14RA1kOzUgQ0a?7GynWH=JRX*EQ*2Qr+l&<Q7&=$5Q
zfBuj1BBXNdcRF?uj7k@5DxH-gfkB}dqUj9b_MxH?hN!T^S$&nIaYQ5PqwfA3%&ww4
z2dMTMD$wZNb>#R3#Kxfe=?~L7Nh0fv)?YwJnqiX8lUuX%yn5*tuU@`^s@IF9Uu-OU
zk>c6+Z}8^EA-4x{x)fK?44|Qeu~wL@@LC|T)@l(kRwP&1&<s?e*)2L5CwU@|br%C8
zEVoCR4-PG>m$x}}SDU3ze~vn1%wd<>g-?K*<=AWMwAM$+;TUU^>_w;GoVqnA1ta6C
zc`~4ibL{U$375K>-?{e;pFXzCpMC!&4u_gV%K5PrZWz1`N`CWLKcJ=DV#{RLAr>YF
zdXw5Av2Jut`Xo*_uZD1O85!(hwqiJX7j%R=b}#kids(hO%ju18b9TPR_Ap_TjOb?C
z-250~Ob&XdkmR`3G7mD7wGVmpNZKW6VgsQ`U)M+*0ui?RF&e1X>TLbTud?48lO!o2
zEjE@&8%)2(`Nf!fPMzZ7t$q4BN$s83^e^Y;FMUgrZKo;pnt8)z95zE~OSPq)RG17N
z^{{(Phtncc3NR(4y?SD?Qn89xI$y`#<rj-evV|K@<fUQ=cgCmPfy?+YX1QL`t-KDY
zYUivtG;Th0i8gJ4=Dp`RQ`jxKw)&n`U~rT<a8xz)8U4&!S7+?ASn`KnnJy#6ZeE+z
zDXI|?Y?iiSQ5bp=*j}mzG6FGhHonQpg+=OfC(&w-c>4x%w~s8Jh8yqFAf&dkjB2)E
z?kvpBk;IDr<|ZbNsRcq^!Saby98srv{T5aP4QR2{Q0$Ei|LU7R!bnhn^No`;nAe}8
z@QO%6j!<>3n=p`a*6LBovO6d{VrpaP#g^X4Fp6hTr|zTqz}-YUJH%TT=|1-|I~xbA
zn?-sHcVoH%9BrVZAzG&;=IOiESUo<^Uq1Jin?K+vRLUFmFfx4mgH1ls8SvXrTp+2<
z@XeRs;^t95)v8vWs^#@29wo?~30q3~nDw?l>drb+d>*TN)KnrwiDh#Hmu~E^@ONKj
zKIk*MI79QHFB0DOD8bw@!o4o@GylND=T30;{49U*%xmb*h;epA(b=rFTny!6^-1fp
zcP|$YH9=b;u_-$@(&+^%lHxTRL(Ss7pJs1ki{0%T=tQRlPzgaG9E~*1*(P87(wFFe
z{hLHPJ;vHVLh-shRY0ce6zfB;#ntat43dSX-!b5L1-1$}pLh;dAmdJf6sdN#;?Is{
zQi_((BfX$hhfh#6+wRDXJMa=d(pL7-x?CKsvs8<&D}Suca>avU{7j<-5qDNC4m)D1
zTg5B7ZoYt2p+io*l{a=SPCccD$aty;M+}vHjkaWQJXsQsqzf*kE&XwVm{h*1twtva
zOOLjwB?*JK{+7c_@6+A6#b6xMtk+n&dXe_hJk4V()J}Z@n#<VnKF#H2R_>`Wb99-b
z!x8`fZ~mSHA*|JijeFuq$9*;ki(QcwDM3MnipP4RhBzBH6knqdX*Ys&2BUN9Um5w6
za&Zlk{lH^w=_Z!JaLjn`h|%@|@qVAf%|mY7*yhdM0Wa)~*wi6r@id@l9bBVc7Y><W
z_ShP;3-v6|C@hYZ)<LS}mQHIe*LIE=bh`WxzjdB-XHWCfx8G;|pi2-czk_ftj=~ir
zuI#8R$JSlWiK7j3ERQ8F&-ypDSbSoHr4|MR^(No{>FZp6E8yW%bDTfk=Cod+-8hY!
zKTh}3`yA|d*c&Pi8;Zlo(1}g@p=Knk>MkfPj8(9Udy>qfgVIh}+w`9kV~BL7!Bu5e
z^HF5k8z*$eF-98#1q~H26NW4_0!$P$FFo!*)?_dkV=N34OFzkwp!rj~Vnq{Yp(MFn
zh!Q$(sWKYM2=YSj>y8wvMjv77W==fYcm-TvRTOyLSS5MFv;39{jfqs_JI-&XRMKhL
zn$!N9!w+_sShgZYmTBKWtZ$L~2$RLM(E`=cLM0~tP5?K&2donp?^vM4PRauBC}#1J
zOtMp8{=io`mNvb<wMm-_3xrAt!}L_%?<d5|2GiT;aQzC`UU`L$OCQjQ75#AvIA6ZC
z&%$hjh1mv+$1Zd1v7e)MY>m}NALHJW0&m@59BZWBK;<XUX%=C3&TW0gUOqMr(^<8R
zGCglmctwyPP#O5wiB-?V(b<^6>h#ygV(G+&n?uW`{Q-?PF0*oLn|L(h=Eg3s?~QnE
zf6Tkxh@)|gHkM@e7@uBIJoWH7{`A>(zI(mP_{VQ!!T>S4z#bNY?8;>q)&dTU<<GzS
zJm(kcsCdXss2J&VyDyIWrOb%*yBD2N$dq%zid9~suy>}nA40sUpkfumN<;B;pL&Gr
zx3_ri`Ze~)hJ$WQzxM)bo4bUKHU~GZac!@|%QudAZR;)eVuiM@4%vlHyJr?ZjMIy{
z%#S#k-dbBotV$s|Ce=I&3LO}Xs`J7RzRy7nL0BVDLQ{m<P_fjmao0kF<z^kbcbx|x
zxSOc|KH3W1*l-Z(bipQ-1Rn8gi^^^o5nDNedQ*7Mp(_r@)WbvaVJCQ*P$5j^Ie6UZ
zDN#R#W!KT_R+eQIC&q^q-VYfm+^HdUk|1nV{pQTZCw3Js<mN+03wN63dJD9|#88>%
zx{H{Pur5mlF7KW;d`&lA2VZuG8MZRh^7?rU25VKuswNw$L10ow?pz~eZLY@gR>(?A
zIJamCmrro%AO4;fUwVhbp`kmD8O7-}HWMo5n*r@mSe)JC;pPdBoe>VMUE|udLpFDJ
z(G}i>MVtjPp2>y@PIfuR%q_#?e8HB@dMzL|B^Z;Dz>KTA&1CV#uWQCebAaaBAcdSC
zjt@9~d!JY*tPc}D=#IJ4i`g3{#M)wv#u`mDyUI~(jYMvfG-pxA&tZGJFdkry&fwb9
zh3xr{aph=8XE@@~V>5hauFadfeGYm<lqx$}nS8{82(zMzNjt*o%*r~{uhM2J<q1x_
z@ppECr2nfcp&2L!iRIGPK3j)9ZuevC-jGqG+3$`ywXsJ{guP+HrB1}np{6e(iPc4i
zFIF%ayTLv9S*O!+Ck(lA!JU;EBk2)LY>JF5mR~6!`PkYCM#C{%8@ou7VmfO<$ihsG
z6LSsDojk_zr@qMCXMUY_Z=d^iyX+0t+2{w<viXKB^1f^_%T?K{()gd3_jgrsx4D^I
zwoFp+PV?>sZSP<@aLo@>(keV}Jw8OK8fSjzVhdAah&~j6`ys!@mAOe7>EoU5J%nY|
zWKkiC@$tG`>!~hEopK&i^Ks_6lRv%#zrmCNn{HYL)oxuJ{c#!M>Nt>7^#kd&)2M9f
z8I&Eb$*#Y8C@i)@&Mh{%=lDFQ?m5o<N{g@-G8`lv4H9<y2?v8Q!`P6R(t%kMp;fQ(
z_TCRTv)JH)GsjtIwrRI!h!2K{3QAj$+t3+rRX>q8=l(sP@s9FQLvEswtW|G>K|!3)
z+hk*Ng+u8wON^ys3^$Etlvp-K&{hUx5)R{p-C@Ljq#0^MVhzS>0t~Ngb$Ri|ONdgb
z{Apng)o7vzN2%R!*hxj%ZajO1mJ|lUL8KX~2EYB}gDhOS$v0lVjFynVYZA*V#b9YG
z_`@$h&5tf#<;@%0UU`rTd$)kx<+EI2LcW%(?P>xIQCMr)9wvP2`PT?kK%*9Ns~gde
zG+Vuxxq6Ch93+;#QNs2xp&O+-Sc)i^^cZfe->K(|K=Bq9Qgn$`A-yr_0wBqxJb6d2
z0yum23_Cl!B)4`DYng3?EHp#b<{R8~a+c%woniKoCsAwn!D5fOQ>R(HyiPMrLF<wS
zG)g*eOTFi5^w2bTR(|so_j4vTx3=<L<7A=P4^xp%scLRilb1H^LgXt8tBMMSsf#i`
zrtE;9O&;cDomGSg;-Y=-#H+9$X^8k(x?G2oFulu_JO4~Fy{*re&Ef*pie<EuQ04@5
zTF(pWn`f*8)yWrr+FFzmOpxl+>LDyN0?y1gIQQr$S^4zSNPCvy<u?e&0~$3&oM=Xo
zW{?;XosQhvjT)$c%lm!Cn;n`V{6>9_NAF(YM7z#AN{Z9yG?K`K2gge4^mIZS$XE?V
zL`Fd3IM{@&@U|O42^cqa@-K(Y8(GVNHVj0wGq%*xSgjfBgh8x{j7hs6YcSTLa_3tu
z0IjnG3yU;n3F=KwE-&)AW0r5dbdlY$CQy}!u7_a|KG^GVs~_{F3n$sz-Q~rtK00?!
zO+EZsMoG>eVB!hvUN9L_sf3D55vCbq2?gqs0yM@t6;Ov^4I$OPc8p=DH3y@ZdY}+V
zWhlegFx07B#pXpf-}n~C@sh*qxjd(i@T}J<<e#5bsaioYjc;Tu@4k15-eAZ$(X?s-
zvo*!>R>*y)7C7_3IofAV5-hJ_^@wES8gaKrjF31^Lop7CUsA_X{%$IFeVIJ~byiVS
zHe*)VOgu->yK*g;VrHf`l`_e8s8GquqyTZ8RQ_C1rp}K)N}2F6imv?_BL#P?;JtjQ
zaL=Z7x%fEL|Aa2Lpv@LVx3Yw+7Tr5OMC^p_y~v}Joc@=eB(tkyBK}D{^@4SqokIDL
z$t5LSu&I2{P~ZSkidnlJFmv`k)Y-?d)-v4v5z_BaCqZl)5^s{Y2r0Pdt~1P?IL+Vu
z?KhCx44skTub+LJt@Z27k}%&0*%>5G0*D{%=#B%e7yRg?`-n*m6xob-48$e7K_n0%
z$O=j!am)=9IiEM*`ewX^$fQf5fz>Fh!Dx&z>Gs>rYb$QFG8i$J5nGeO!JEw{cipv0
z?X`EYBMlNbY6NFXju5JV{qB$-zk8k9{U<mz+u+2(fQ_*!^`lPrps<Xr<}beY90_R=
za#V<pz0^6nS$BbkAETWC$7e!?v02fzDX+omd=ZxZzHwq1LrMY5*zVevODgLuok|I_
zbzs?3ZhGfP?kxbxm>O2f<CulSnBu{5_11Pe1J<DGLMv3P&DA+`-~F^7{Q|-AYWjI!
zdxg%+&$4yvCfg%JH;3kAV+EBJ3T0FNa-PT$6psy+$-7e7pfS!-R!Ar9nFZaJpxUCl
z5yu4Mr{Y#-@y_B-938ex0JGDI?NsQ($B=^kEMtW!BLy!8zIdRDcl%C!lZh^Ovgm%)
z^2}BXg!L|Q=e_+9D%u@S9Ti@%^>g=Ja%6s*wIWldM~+&^WW`wF6=lR^GhmAtDI}bu
zSkoIt#Je}4vkmn&cCb&97|uWb6rJ~Ou=(~SKKaN))Y`NB;78AMYwwVHWU&$y{pm(`
z%!{`S4=y!XZH4R&lk|S|x?ML%rQ#O!Wa8=9<<7MP7#Ajr?2!=$!fYcb9Y`i$*4V<{
zTl}#OD$<&iK1L4FvAT?5H$|pU!DuLct%x#7A6*+m!&l$l=5XdXL9~NSMkE@n(bQ`-
z+-Q>2LmhH$`+$GDcf`H(O}_lVX<oj)&pW$4|Fr0ks1g-A0CPV9LA=du{`*uxP%~MP
zNwu?vT9E$tVUl(7j$d1xuFa}4jh52<=lr{$(%=?he^*r1MfxvRoPRcj`p;wqSTg;s
z&G;Fq-8bC^!+fhw^TauVd!I(;mx(UD%;2q`uzBS&SNHqe>LnbG4P%qOYf7bYL)NBq
zWU>In>g=n~j@dkofI{nQgo&TQb39SnLW?nhOom^UU89e0oP^U%E4KFIOTj*@;4(!X
zRxuUsvj6}Ydr3q=RH2<s?8BVdw1+#LP_9hra`8<Z1rpMGfcp+Qsf-p7>+e(Uv_SjN
zF4sL?REn<6t@x8l3t!@C%ZHD185k)Ko+Y-nw5RJ#(ikO%ew45~h`Dh%V*ZVnY0TDW
zKJaN044a32)B;3_A=a9H6cea1iLqS2wMi1+MAho)i7xw0Zgmq{Va!}DpcyJUk@1Zk
zxTG;>qASkKm(sbJCs4#$;msvw2x&x2yB-vP@!|<&GiHOE$L1X0#2G)>Libw|$I`FS
z-k74Oo~FD}#);-uCnA_#rWV$)ogGexnzf}l-df)xf^3FcUTDK{#8I3u-<m;MbDUoo
zvfUZ57uiYKO_opQ<i!>;GOqwnvR2am&Zfz_p@N4_u5fa3ju$W8B+`aZWvQ{Yv{4qT
z3!N>%ax9+pmq+<A3MpkXI2+WdLAp$zr-<_aA(L~J56|?=2C*ho3Y}s0B9qF_%&>#$
zY#}xx-o4HK`Yo>S54qBbxZO`U8fzkxr%$LXbp*6Z=d#*b$4cwmEt&En|IAJKD}^l0
zExN^xn=2yRQ-`epa2!aXzfZH3I{Q)bFFsy(J5>f&t=D%bxQ^k(iqChDJ0)QYA30k1
zaJ7P4=1MNH*lMEk9YzcG!{)iJOHMrguXSz3)i<uHRB<F6CU>Jczh<pq@*vFuGmx2c
z#1I=rH!^JZBR&WeW4+1#@EIN&4B0>I@WJL0yEk59voj>paOKh^tk%?OHDY6sy2|wF
zw%Dyi#&W$Aab~W@Y^c~9M47zMU;eoXH`Wu^lw1<Ym@s6^wUN{HT1Y|KjZhH=D(i3^
z2b(SDy9E?I^Jo}1O~O4k>vG;<98ImeF}2o|7oViEFr@@FGe=|TB%io&AHVj*gVb$O
zJ`l3F8L<|n6wP{#oue+_c<U<H4*J|P*I=Qhvd`F-Xol<(Q2D|okKE3IIPN-GtW!6n
zc!FbLCQ#gaY@Yj09-|0mDHs%GAvHFiO=Zs_ErmAPIDw*tF4l1!xku6R2|BIP+KKt6
zMSSUL?t{+?@mQySrZMRl<Y1)P=tlI`KOlbZ86@h_SUFB7GF;jjaq}o*Z<IoEL?BQq
zix^5jt2B975ugg7Nq}UE3YX>U&xP{^OBozl62QbwsIjTiMQjO$DH3trhki!Jk|Lx~
zCfFO5ccs#{%E#++nPky;Mbb%{b&YcAl1U2uq;*-w?iRz_<hn_&lcR-d@%6?H_}Ox{
z7;!kAs`cg_9|GyA%JuxsS<y@7Dxit?w)%eiw&$V&G48jwZV*#(ub4tnBZNvagd=pv
z3G3a6*Eak7@U?YruW!;ic@MLzC%L)T<)A+%3<JLWOJCr3e*ZrsNXA)mu&ro^)4S~`
z((Dft9$cO0S0B5V(@S$0V~Ts+e{5Qh!0G8Mb4ZT0cAU?6v%f5)vE4JZfMzXVVElsX
zzSq`KIa_xGVXY5M&O$0n7o5XhFH$4&6a!On;#h30!P|Y|);qTuBLrfc;7Q{-mEt5~
zHySet10GszaBjB7r6a@0SZ|gl6GJ8OW>cjSBGWTcdiRmke_d0;^Vhbh-`r!E=xoGL
zT1~a35@mxI(rKO4*fJhcJd$m}IrVg-;xTUhg6v3koODzi=34$^YXc$*gJF=Q7uUO6
z15RJx;e7ZK?fwC^V|RlY(~ULTgM_h8!4!cN4{<2AYGHPx&}Ax~ATJs!yB|$%HO5I&
zuFAV`kdhUJ!z8o7eni#$m|gA1QY(1rm6PVP;?k<57c(X0*bj%B(7{d{EmV_a#0lbb
znZQ;k6O5TMBmY@O3ywU~w+feESDG?h%A1{hOYb1s@cjto|L1U>AW*bwiiJi%yRJ|o
zB#EWh8&IoT&OCe%FFyMm=YPJz?AlrS@dqSnz7V_HTXg$FB5x#@xkYniEuf8Iw?F2y
z58ultAO9q~-+q?sI|mS!i#Eyh^Hda47T@5Q&v+xC4@B15BqNofRGQ!!WMXBPp=+%h
z{cg%Jfx#)j)}QY>-AVrUJO!RSA|#Ldt}H!7QU>f+->{h&Wd0bcyH}0|yhLw7L=glj
z5$NV1;lg~KldX^&{W$I3#ZRxuWn!w}#VRKz#kwY<qWi6hVkS(D1mod=TnXYX3&h{|
zR8Ed1ls!+-$QYBw2WhjdoOSrZBH}HOTt}^P+zZxC-xN;)o4sf0zr`k-%L+u=a5Rd!
zwr_dn-5p5AJb3y60s_u{_8;-MdV{yW^AbA$J&u7xAtWk4_hrR4bxox6s|p9998H=W
zdY8KQ^CDwh4XL=N*z)0DMN0ZP#UC=a{ZA;iA7^nk1)g5?u;Lm;rWIVbn#%Nah>s|^
z6J4*XSip&t@|=BCwUZxnf#yF=$`ql}^q`9NA^q=4ITnM;%r@K77VgH0dAYO5HrdZ0
zlHwxUHN{#h<kVc9m3lz4CRjaUG)ibULZ0~i=lTEs<WKm?|MfM*O1hh{mQkGW>>KZ6
zj3rS47@P8@v$rMDmdNOWHPX|TH?H31)<KtR8@s6<bJ9aqrY097MgRTGqkkfx2aH7|
z2j-v<W@-U5^&rjja$H3286bbU*=ghDJf7McD>!*=?mW)gsieQckEOClN4<${w6MLs
zY*ZlLBEo&JM&lt5J^hQ!#{Yk7=kg?1eckcT`Q3ZFr@QB&(P)q~vV;WUjX@AlfY_AF
z4$dZVrMyU0DrIj|`5UreopqM3R8rZbDoGWDWPu$Fsl>*iAlO16fh9mMq|uB<qj~iE
z-rvdMcOSps?H&x+Y#6;}y8GUHe&2J>_t8VHe#+J;WoxVzRZQy7NR7K0q~BJLO`I#c
zMww-hYS~hkQsUYYN0g~;VU;TtZhT9mJ0(h_xQNF8JqaHQpM0dglUCkti|1*YDYT=E
zp~=|E41?4OTs~OcVKg4mI&^`hwKbNX_y$LsLmoWP;;kFqlJ(&h8<NxM-1oMkWNJVy
zk*Uq5eOpm~eyK(ArJO&ToL*K&z<UpSfiR|P1@yNouwS^~dMC24mea}+PrT3@|1OfL
z$~LY2oat|HFGHJ9c}9>1R@~p!0?qfa{t74;4b+@cvTs5Ys?rSKN4u)kP~S5^D&mnQ
z9~zzH%;tZ$6&aRhB96~Dd1x`==wgSZBL|p&_%ZsoZ*lGVCja@;%UrnGWux13^}?8v
z0y<1>>6DmxhCG=<rx|g4ZjRgiAvd;qSPY+RY;$XChr!U6^K0MOM}wzW!t0oSgmHfH
zG7%Z7>L54EDJg{QhLJ`bd5&Zi6}XCLrktOK#?iG>qUw>R)!X%{=jY)Q=e1mUi~91@
z44V!Zk5igSQnpM|I#5;ZS!<@rduQK=%yRDx9GgwJusvdwPIGLkP_NYry@cFZ*9LbY
zVQiIdnsaMw$qM+b9rf0-P~+LaUCJNOR~$~QBFEL^MNX3?ni_bidz1J#fp@x%dR<Qc
z>Gx@7BVPXLoAi1^QdPRcjI-DKWUs%=H;>Pw67#hu|9~g1t+C#>e6rck&8i)b*X9AA
zhzo2{a-YodzVYgkt=^}xA*^xl*x_LH5~9VU)`^$t#gw=EJ1w>_+3r)D-%e0$Wx^bM
zVtWr$1RqSgJISPnf<MFc3$Bm*eNa<*ElkT>lP`yIgD4MwL{Jr7sqr%EfT%Da3dJLn
zOSI5mxv-8@j0%x~PHb3iCmda9@W5ii6Q>^L@U!10NuYV?2wU&}g7<%Uo{JYhp*zlU
z)tSeLD4soWqlLoaF+<6+l;cMZ^Zh^i7H@y_3IF`+e<4YWZtDEDn~5T+Q_blVIfY1V
zB=3Ek1>#jz-OZP4g*PuoMA}J2J29nSLzVj@!9q;5dK(%HG_-uug3ITJ4VH^d8|0Qv
zsE2YYMgz;!$M!LIazC%WbB-aA<Bb+KoK{<WOhj+Di?wiR9Pz-ugt^3UJIg$_j0TJ!
z6{or?F1*%G_D*bwjc|LE2F#u??%LlJhi#{S7zH*!>P>F7nvwbTiE7mYSQ0!lnj6v=
zq6_uRxTZNt750(VBwRT60f*WNWEoMOl3WllK3Lr)R%LGSBZmC}Gu>O9+TUQSpRhf0
z)}A(3^tgjjN%IkXW{NR>E+5VpVn(W6KxPD!ucg)Vy7i~g1)HHjz~$`M-+HsB0oU(f
ze(U|_ltgYkvBRX%js}y>i67+Kk@^L9%2+|CsHW-$>tUFtdSfM>94&kml<Ofk^=WCI
z*Rs~ocJTR0%?HAJwp2nDW*Lf^KVFe>rsJ*HFxN2L)lN9Rufg$sGkk5a$$@)LGJEQI
zBxy3Zc!urw-saY)7m+AJvk~LeB2n%QW=j+DYPOqm>fQ3$aCLo?S6+Rc&$fGL+(dCI
z-C?T4Vu-|$=H})l&6cX8-pg<<_D;|~&{Nft*<b{jZ$`A6QBHO*7GuQ))rswJmGo<C
z(#x90w#Fy-11OcO+IW}gs<tHRchquduFd>i%h<QhV&XVgO8K+iiu@g!2qVfUbumRJ
z+sfH7^fU2RQPn0>s8e>z6)jC8v|?dnkd>R%%D2@=Vd^E-PEwe(CWG|N)GOwd1_%nB
zhDMm!fR`*11&ovoi!$g_Lb_QL$9!`62Cb!-#ip<=5rwl^5h`(Ry-VxdHJ;qsV)5__
z-#+~U?f-t0pZ)qKJE>)7m?4=srkwg(C^xYaW08y?tFAay3S?VcZ{uaO72eSP8IG-@
zv&$)_*6Dt~4Z796hVl~!Xx+O(YMOkVQf|SI-O*b9S@r$O`)dz`>nqQ~a+MbV@q|Nr
zc`fi2P;TJ2tEGe&LN2^a^Bj}#P!UhWqTXJmQi;1d5{aQ5N6a-0bFpEum2jXHb7a;P
z-j(?V%kv2{`&x*Ov4f1>wM*RjY?a~2sYIW9`~fbnZSv8T8;}bmtdb*LJT_4!Xqs)e
zIC0__{i~~7SiKEVghlD58T*o$#0Y~d%p5FP4xdB+E?5mJB3)pRvm4SJ@iN<tX*HwD
zm8`t+?8LIHFwiOXdXqFAFO{GaUKoTlZzZc3?V@-V_hnIt6M>c;^S@^=vyq-dnoW|z
z+Oe(*^2P+C@rZ9c_7H#d=YP!7;sSsDH-F2!SJu5-wOB^m>h=*008bPN^9{q+Xq>my
zm7>fyUiW8uWn-yK+=PMKnwMB>eRCM~sP5i4LGweXoE=KFSyibDtoR6J;u*`SUItpE
zeD?=`$%p^*6W%_5g|T&V;&E!pG8bz3tE=0zV))Jp!@hW%-#^h}!7Ot2dXI~neKvZz
z<kz_WrwU@FvL-XGkQ*uX1-a+1tvJRJ)nd}*uifS**ESavo7@QAPc=}VQSoJp??j6~
z4b|4Sc(oQd#F)Wo={FbL8e8EjB3!AzhSKj=C+E>$s^IR0a{VQm*50w!URhPRWujB?
zdIL{PVM-x|B{qhIM#RBZ%t|Nb@N9#Fa}5s6H96XeIdu3Souy?ui*05edIkm?4BmNz
z?YDoy_4Q3QdKs$l%r~E>apo-VfBG3FGJbMdUTE>?X|4j#&osFA@LjBK?ULCHiJXN(
zKea42EsY3t<focfmXP{66R%>%tE##qB0W_d<BZW2kVa&fZN|irLDSS*is<D2!l%hh
z_@fr^+t%sZLA1Bl_??kBg1)g1^&RLm_~BDe(%(J7k6w8L@`$2<969AR#Bt2!&sO=D
ze|?#IR+f-qk4P#}m3W)yU@=mBZG?qb802A(;gW+|dq+6muBF;b%^P^yc&)gAz6+UZ
zuECXRf#TD(En(PvK{D}mN?L2*j2LDc5s9&^pZh<4@5zTrhkdTBZm~Vg*cIp(PIOp4
zT<h`h>P=Rzf5^&HFR=6|bY6Rvu_{&v?2cU0#W)}8rmC1cThE$YPHd#w6_h0S!mYpZ
z?k(|NzC>{<IPvDa6+5NQe*J3bR%$JWOm-9!jt~5?f<M#z;sw{2IDb)u>(9d_K$fM|
z;=}^5hH^hw2vMubDwC-afi>y0V@9WwNGwyTugfb#edV6bYk|;?BJOHOJg~39spS^;
zAD(0BK!<iaW^UyO?MMHRc=0GEF|d1;{@EXM?U(1daPcM|-s<w%?uZ*ZL;n6B|A~$6
z5H)eGOUS#rfNSF3uC<_IIDh>XSN`oawudPuPRe&RvdY-PtSEOhWrUgf@$Q8JV()@>
zfgKU)=f&3oW+pZ)w46t4W-Aq1(28jd*{Y9<p~jA`F^Z|EU8+vZV3kN5uQMu^6gkLf
z8l|H{dZQjjgoYOBqd4?jw-GFE789|$-Qz#r`;^9+i~R6APcuG$ne(d~xk|;o27_^K
zLV@B2W{nGv+#TC8ouJ$(d$jbjz?B7AD?28gobVFJTBqCn*7K3YGn5YY6Q=4SC=KK5
z@hY}D_7rD<N6ORBK0}<1I52DYlOOyAZ@%*Hocs7Xii=Mfj-9S1vv6s3hf`6T=KZH>
zHfOp2#(A!8?vh#M&S1>WC}U@k(oe119v6$m^4WK@=*T+uLwV;IhmegY3AXCcPx)(;
zH&qha2>42?si@cI14`|LtIu$zpjxOG-1>njQ;L4Q;Ch31sTJIu{qXq+x8@-nYzQg}
zngns;I(@7ldkwUwryWnDim?aMonVv59<^O2!M>Jp?vw?&lL#xVgvS?~Jom_Pjy~}i
z&E<Kb`FUjND9oKeI?LFdb?n+L)LM22Bkp8yb$i6E?wDbwbhmcN6cXdO>*Ks*cMP1|
zNZre9btYOFyQ8reSLI$~sxHIu&z?KQ<}l@@ch0lk?K_lM-^Wh*Xkzc{aX#Z6_#%qf
z2(zu2I5CX-6`4Kc<J#IaQx81U`MZPyXO9<asA8TCiZkia^6OZHhK_mb%m<vmavhBf
zGe&Boi>i=WDX1aF#l`10dp}jyH@9eu`@RJgt|(pwwX67ECl4?3-LK!rKfLiv=WI{{
zPYK5Xb-xFz9$TUYqJpBTH8FvI;iPmnD!2J)>GV|2f4u|^HLgV~E$O6^37e7^>{NmC
zGls(pGtBqbIePR6`yYP}GwyP1DdF};lbvx!e_T+)Aj>Q_?+p3)+(*nGdzs|^)3g@n
zxo>5jm~A%u32WUEH;wZd*3?;tQqbihr`Ri&nvpS1eqJ&;a_<MPE}9~_B7g85?Z|rb
zQz@x!)x1|rhbsxFf$9}o2@5R~o83JK4wJ%O`9cLZJRs@?ciMQNj&P}Y8~eS#?|B=X
zO4AD7G`VlED+s49K2>ZwwpT(6a0yL!>VHk9?I#`U$y&u2DT5-L5gcd;4<6gk(Wg(-
zdg=vCtL2{6ovUc~8roY!k`B?qlgQc)=9X4@?)3M#_@lq$=I%QC<A_9JQVYAOWoMX@
zjV-By&7@qgsm;^R@r)d$TId!|X{gd0r_3)dpu-G|aa729^wA#3*Dt)8s_y29cLbV(
zBuQ*^sg+0)8G2T$j449@PhYwjP{#rpU_~L5BGf&fXPP{($cXb_h*XF~iH-Yp(+G!}
z5sxmw-6mnQl_18jGq%pG-821mU4(mFwb(cots6p;#QgmHC609x8u{s0M5{SuXv+`E
zh;nqk$>LlaTQ2Z&%2|15xu0)ssNKdVIuwi#D<##)w=DDvc)6q$sS2$+by?6YXrX1V
zX1u<SN~L4hQnp(Z;0Qyf8FTmI438h4<wz^#;IV_W9(<n2SWaGim(8smZtjlQ>Wy4X
zkV0xRZtnJZ=hv%5&7W}Z<zFFDgM05j#L~h()^DtFX)C6gL?qFWjb2JmQU<A$$Z39v
z=6gS<Ix1bMoawvqkf`;#4v`9Vl?Fsop?UErfud8Q%mY;!Qwl8;)gc^<g-C9)=>Fz{
z>&Hda3vQh<#)L_@21vVP(o8eA(U6Mv#Zc~~KSRazs+5%>zTe9qIJBmasUpH!MXsG0
zzS3I6@%T-WU|I`Ed*1y)+`$Yt(Ty|cD04FW?K{}bJAC}}pCY3ncQ3S<Zy4IKFie%3
zy_D6iu-Z-89;Rg2YQ9Sj*m5C-dL67Sx=icb_wJ<d(rZ6sW0<kg9oJ^>Q^@<?e-Xfo
zFTP0b!Fy0dP69^+Swv{4B9}ILynb$t{_eoFfw|)tYI7@iXa88K(KL6b%BPI^*A>gb
z=7_|#?GYA(bxRlHP;QKpL~fbZ5W`(f!!yebzIX3Fo?L0Mpkw-}r8{=szOgu+c3gS^
z6ru)q^BJigAW_$5EVmLeYw3<`PF2#-8^8#iIHKF_^5geDW|Ud)0rAj?YKVozdu&yL
zLMWcB(guu)!dOH-YLW(Rtau@Sr2xXK8@`aFkO&ux$-)c4<OV>ENLZO~@XShwXTN?Q
zCmwl(xusc>d!9lTjxaMfL%Q}Uw{P8HvpZ%ms>Vjvx{*UR9JADEu>bH;S`R(X!pX<!
zG-4Y4JGnu<A@;h86fJX7D;a2IprRAYb_r&T;y?1i0@45Xo?zND9SR=`sb*L5d6Htv
zhQ6{;lKNVszOt_sTmoN(y=J$ifS~?5Yt!SZ>`6Jx6>5SAWHK#4*yH=k<X`gsxcsv8
z?NyH^wg;5nBe=7Yl6W$9pLbsza^mQWf)I(&iVO?Qm;;Hj+{|djL&OdtX@VH^<{6~1
zfVt}wa_|W-O=d=Gj5lwP*fA?}36Cz%^5DTmjx4q~u&+gbFk)wzGDwx7+A71X^nY;c
z-po2)j?HgQ>q&wwLMJhdE$pPW5Nr~phy+e^)j|0G&WMss(&fOY00000NkvXXu0mjf
D->dml

diff --git a/browser/metro/theme/jar.mn b/browser/metro/theme/jar.mn
index 6a2935509abc..ac763ccde71c 100644
--- a/browser/metro/theme/jar.mn
+++ b/browser/metro/theme/jar.mn
@@ -95,7 +95,6 @@ chrome.jar:
   skin/images/aboutAddonsBackground.png     (images/aboutAddonsBackground.png)
   skin/images/aboutAddonsBackgroundFillSlice.png     (images/aboutAddonsBackgroundFillSlice.png)
   skin/images/flyout-back-button.png        (images/flyout-back-button.png)
-  skin/images/about-footer.png              (images/about-footer.png)
   skin/images/arrowleft-16.png              (images/arrowleft-16.png)
   skin/images/arrowright-16.png             (images/arrowright-16.png)
   skin/images/arrowup-16.png                (images/arrowup-16.png)

From 7931a343fb33c2ea10cf6988cd38f954b3dc5b6d Mon Sep 17 00:00:00 2001
From: Rene Amrhein <waldion@hotmail.com>
Date: Thu, 12 Dec 2013 12:37:51 -0500
Subject: [PATCH 158/459] Bug 926477 - Replace className usages with classList
 in browser-places.js. r=jaws

--HG--
extra : rebase_source : 3449c06897fe204c27654aab25e30ff1db8d4960
---
 browser/base/content/browser-places.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js
index 241a658cdaf2..8f3469c0e64c 100644
--- a/browser/base/content/browser-places.js
+++ b/browser/base/content/browser-places.js
@@ -102,9 +102,9 @@ var StarUI = {
               this.cancelButtonOnCommand();
             break;
           case KeyEvent.DOM_VK_RETURN:
-            if (aEvent.target.className == "expander-up" ||
-                aEvent.target.className == "expander-down" ||
-                aEvent.target.id == "editBMPanel_newFolderButton") {
+            if (aEvent.target.classList.contains("expander-up") ||
+                aEvent.target.classList.contains("expander-down") ||
+                aEvent.target.id == "editBMPanel_newFolderButton")  {
               //XXX Why is this necessary? The defaultPrevented check should
               //    be enough.
               break;

From 0f4f7a5d8d38fe8825c0724f5b8d011c3794ce8a Mon Sep 17 00:00:00 2001
From: Jared Wein <jwein@mozilla.com>
Date: Thu, 12 Dec 2013 15:12:01 -0500
Subject: [PATCH 159/459] Bug 949365 - [Australis] Ctrl-K/Cmd-K doesn't focus
 the search bar. r=Gijs

---
 browser/base/content/browser.js               | 32 ++++++++++---------
 .../test/browser_901207_searchbar_in_panel.js | 12 +++++++
 2 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 649bb5091852..166c92016f90 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -2936,27 +2936,29 @@ const BrowserSearch = {
 
     let searchBar = this.searchBar;
     let placement = CustomizableUI.getPlacementOfWidget("search-container");
+    let focusSearchBar = () => {
+      searchBar = this.searchBar;
+      searchBar.select();
+      openSearchPageIfFieldIsNotActive(searchBar);
+    };
     if (placement && placement.area == CustomizableUI.AREA_PANEL) {
       PanelUI.show().then(() => {
         // The panel is not constructed until the first time it is shown.
-        searchBar = this.searchBar;
-        searchBar.select();
-        openSearchPageIfFieldIsNotActive(searchBar);
-      });
-      return;
-    } else if (placement.area == CustomizableUI.AREA_NAVBAR && searchBar &&
-               searchBar.parentNode.classList.contains("overflowedItem")) {
-      let navBar = document.getElementById(CustomizableUI.AREA_NAVBAR);
-      navBar.overflowable.show().then(() => {
-        // The searchBar gets moved when the overflow panel opens.
-        searchBar = this.searchBar;
-        searchBar.select();
-        openSearchPageIfFieldIsNotActive(searchBar);
+        focusSearchBar();
       });
       return;
     }
-    if (searchBar && window.fullScreen) {
-      FullScreen.mouseoverToggle(true);
+    if (placement.area == CustomizableUI.AREA_NAVBAR && searchBar &&
+        searchBar.parentNode.classList.contains("overflowedItem")) {
+      let navBar = document.getElementById(CustomizableUI.AREA_NAVBAR);
+      navBar.overflowable.show().then(() => {
+        focusSearchBar();
+      });
+      return;
+    }
+    if (searchBar) {
+      if (window.fullScreen)
+        FullScreen.mouseoverToggle(true);
       searchBar.select();
     }
     openSearchPageIfFieldIsNotActive(searchBar);
diff --git a/browser/components/customizableui/test/browser_901207_searchbar_in_panel.js b/browser/components/customizableui/test/browser_901207_searchbar_in_panel.js
index 338dfd58f08f..8491470c4e00 100644
--- a/browser/components/customizableui/test/browser_901207_searchbar_in_panel.js
+++ b/browser/components/customizableui/test/browser_901207_searchbar_in_panel.js
@@ -85,6 +85,18 @@ let gTests = [
       ok(!navbar.hasAttribute("overflowing"), "Should not have an overflowing toolbar.");
     }
   },
+  {
+    desc: "Ctrl+K should focus the search bar if it is in the navbar and not overflowing.",
+    run: function() {
+      let searchbar = document.getElementById("searchbar");
+      let placement = CustomizableUI.getPlacementOfWidget("search-container");
+      is(placement.area, CustomizableUI.AREA_NAVBAR, "Should be in nav-bar");
+
+      sendWebSearchKeyCommand();
+      logActiveElement();
+      is(document.activeElement, searchbar.textbox.inputField, "The searchbar should be focused");
+    },
+  },
 ];
 
 function test() {

From 539a0cdebe3003ae656dea66239281626f33df5d Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Thu, 12 Dec 2013 19:38:12 +0200
Subject: [PATCH 160/459] Bug 758157 - Clearly indicate overridden variables,
 r=past

---
 browser/devtools/debugger/test/browser.ini    |   3 +
 ..._dbg_variables-view-frame-parameters-01.js |  12 +-
 .../browser_dbg_variables-view-override-01.js | 219 ++++++++++++++
 .../browser_dbg_variables-view-override-02.js |  54 ++++
 .../browser_dbg_variables-view-reexpand-01.js |   3 +
 .../browser_dbg_variables-view-reexpand-02.js |   2 +-
 .../debugger/test/doc_scope-variable-2.html   |  30 ++
 .../devtools/shared/widgets/VariablesView.jsm | 281 +++++++++++-------
 .../widgets/VariablesViewController.jsm       |  31 +-
 browser/devtools/shared/widgets/widgets.css   |  11 +-
 .../browser/devtools/debugger.properties      |  17 ++
 browser/themes/linux/devtools/widgets.css     |  89 ++++--
 browser/themes/osx/devtools/widgets.css       |  89 ++++--
 browser/themes/shared/devtools/dark-theme.css |   2 +-
 .../themes/shared/devtools/light-theme.css    |   4 +-
 browser/themes/windows/devtools/widgets.css   |  89 ++++--
 16 files changed, 714 insertions(+), 222 deletions(-)
 create mode 100644 browser/devtools/debugger/test/browser_dbg_variables-view-override-01.js
 create mode 100644 browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
 create mode 100644 browser/devtools/debugger/test/doc_scope-variable-2.html

diff --git a/browser/devtools/debugger/test/browser.ini b/browser/devtools/debugger/test/browser.ini
index e1da1f0de68c..18c0e06dc624 100644
--- a/browser/devtools/debugger/test/browser.ini
+++ b/browser/devtools/debugger/test/browser.ini
@@ -51,6 +51,7 @@ support-files =
   doc_random-javascript.html
   doc_recursion-stack.html
   doc_scope-variable.html
+  doc_scope-variable-2.html
   doc_script-switching-01.html
   doc_script-switching-02.html
   doc_step-out.html
@@ -211,6 +212,8 @@ support-files =
 [browser_dbg_variables-view-frozen-sealed-nonext.js]
 [browser_dbg_variables-view-hide-non-enums.js]
 [browser_dbg_variables-view-large-array-buffer.js]
+[browser_dbg_variables-view-override-01.js]
+[browser_dbg_variables-view-override-02.js]
 [browser_dbg_variables-view-popup-01.js]
 [browser_dbg_variables-view-popup-02.js]
 [browser_dbg_variables-view-popup-03.js]
diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-frame-parameters-01.js b/browser/devtools/debugger/test/browser_dbg_variables-view-frame-parameters-01.js
index c3f0d662fed7..44ccf00b98e8 100644
--- a/browser/devtools/debugger/test/browser_dbg_variables-view-frame-parameters-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-frame-parameters-01.js
@@ -51,14 +51,14 @@ function initialChecks() {
   is(gVariables.getScopeAtIndex(1).target, scopeNodes[1],
     "getScopeAtIndex(1) didn't return the expected scope.");
 
-  is(gVariables.getScopeForNode(scopeNodes[0]).target, scopeNodes[0],
-    "getScopeForNode([0]) didn't return the expected scope.");
-  is(gVariables.getScopeForNode(scopeNodes[1]).target, scopeNodes[1],
-    "getScopeForNode([1]) didn't return the expected scope.");
+  is(gVariables.getItemForNode(scopeNodes[0]).target, scopeNodes[0],
+    "getItemForNode([0]) didn't return the expected scope.");
+  is(gVariables.getItemForNode(scopeNodes[1]).target, scopeNodes[1],
+    "getItemForNode([1]) didn't return the expected scope.");
 
-  is(gVariables.getScopeForNode(scopeNodes[0]).expanded, true,
+  is(gVariables.getItemForNode(scopeNodes[0]).expanded, true,
     "The local scope should be expanded by default.");
-  is(gVariables.getScopeForNode(scopeNodes[1]).expanded, false,
+  is(gVariables.getItemForNode(scopeNodes[1]).expanded, false,
     "The global scope should not be collapsed by default.");
 }
 
diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-override-01.js b/browser/devtools/debugger/test/browser_dbg_variables-view-override-01.js
new file mode 100644
index 000000000000..48dcf2ca85f8
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-override-01.js
@@ -0,0 +1,219 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Tests that VariablesView methods responsible for styling variables
+ * as overridden work properly.
+ */
+
+const TAB_URL = EXAMPLE_URL + "doc_scope-variable-2.html";
+
+function test() {
+  Task.spawn(function() {
+    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let win = panel.panelWin;
+    let events = win.EVENTS;
+    let variables = win.DebuggerView.Variables;
+
+    // Allow this generator function to yield first.
+    executeSoon(() => debuggee.test());
+    yield waitForSourceAndCaretAndScopes(panel, ".html", 23);
+
+    let firstScope = variables.getScopeAtIndex(0);
+    let secondScope = variables.getScopeAtIndex(1);
+    let thirdScope = variables.getScopeAtIndex(2);
+    let globalScope = variables.getScopeAtIndex(3);
+
+    ok(firstScope, "The first scope is available.");
+    ok(secondScope, "The second scope is available.");
+    ok(thirdScope, "The third scope is available.");
+    ok(globalScope, "The global scope is available.");
+
+    is(firstScope.name, "Function scope [secondNest]",
+      "The first scope's name is correct.");
+    is(secondScope.name, "Function scope [firstNest]",
+      "The second scope's name is correct.");
+    is(thirdScope.name, "Function scope [test]",
+      "The third scope's name is correct.");
+    is(globalScope.name, "Global scope [Window]",
+      "The global scope's name is correct.");
+
+    is(firstScope.expanded, true,
+      "The first scope's expansion state is correct.");
+    is(secondScope.expanded, false,
+      "The second scope's expansion state is correct.");
+    is(thirdScope.expanded, false,
+      "The third scope's expansion state is correct.");
+    is(globalScope.expanded, false,
+      "The global scope's expansion state is correct.");
+
+    is(firstScope._store.size, 3,
+      "The first scope should have all the variables available.");
+    is(secondScope._store.size, 3,
+      "The second scope shoild have all the variables available.");
+    is(thirdScope._store.size, 3,
+      "The third scope shoild have all the variables available.");
+    is(globalScope._store.size, 0,
+      "The global scope shoild have no variables available.");
+
+    // Test getOwnerScopeForVariableOrProperty with simple variables.
+
+    let thisVar = firstScope.get("this");
+    let thisOwner = variables.getOwnerScopeForVariableOrProperty(thisVar);
+    is(thisOwner, firstScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (1).");
+
+    let someVar1 = firstScope.get("a");
+    let someOwner1 = variables.getOwnerScopeForVariableOrProperty(someVar1);
+    is(someOwner1, firstScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (2).");
+
+    // Test getOwnerScopeForVariableOrProperty with first-degree properties.
+
+    let argsVar1 = firstScope.get("arguments");
+    let fetched = waitForDebuggerEvents(panel, events.FETCHED_PROPERTIES);
+    argsVar1.expand();
+    yield fetched;
+
+    let calleeProp1 = argsVar1.get("callee");
+    let calleeOwner1 = variables.getOwnerScopeForVariableOrProperty(calleeProp1);
+    is(calleeOwner1, firstScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (3).");
+
+    // Test getOwnerScopeForVariableOrProperty with second-degree properties.
+
+    let protoVar1 = argsVar1.get("__proto__");
+    let fetched = waitForDebuggerEvents(panel, events.FETCHED_PROPERTIES);
+    protoVar1.expand();
+    yield fetched;
+
+    let constrProp1 = protoVar1.get("constructor");
+    let constrOwner1 = variables.getOwnerScopeForVariableOrProperty(constrProp1);
+    is(constrOwner1, firstScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (4).");
+
+    // Test getOwnerScopeForVariableOrProperty with a simple variable
+    // from non-topmost scopes.
+
+    let someVar2 = secondScope.get("a");
+    let someOwner2 = variables.getOwnerScopeForVariableOrProperty(someVar2);
+    is(someOwner2, secondScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (5).");
+
+    let someVar3 = thirdScope.get("a");
+    let someOwner3 = variables.getOwnerScopeForVariableOrProperty(someVar3);
+    is(someOwner3, thirdScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (6).");
+
+    // Test getOwnerScopeForVariableOrProperty with first-degree properies
+    // from non-topmost scopes.
+
+    let argsVar2 = secondScope.get("arguments");
+    let fetched = waitForDebuggerEvents(panel, events.FETCHED_PROPERTIES);
+    argsVar2.expand();
+    yield fetched;
+
+    let calleeProp2 = argsVar2.get("callee");
+    let calleeOwner2 = variables.getOwnerScopeForVariableOrProperty(calleeProp2);
+    is(calleeOwner2, secondScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (7).");
+
+    let argsVar3 = thirdScope.get("arguments");
+    let fetched = waitForDebuggerEvents(panel, events.FETCHED_PROPERTIES);
+    argsVar3.expand();
+    yield fetched;
+
+    let calleeProp3 = argsVar3.get("callee");
+    let calleeOwner3 = variables.getOwnerScopeForVariableOrProperty(calleeProp3);
+    is(calleeOwner3, thirdScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (8).");
+
+    // Test getOwnerScopeForVariableOrProperty with second-degree properties
+    // from non-topmost scopes.
+
+    let protoVar2 = argsVar2.get("__proto__");
+    let fetched = waitForDebuggerEvents(panel, events.FETCHED_PROPERTIES);
+    protoVar2.expand();
+    yield fetched;
+
+    let constrProp2 = protoVar2.get("constructor");
+    let constrOwner2 = variables.getOwnerScopeForVariableOrProperty(constrProp2);
+    is(constrOwner2, secondScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (9).");
+
+    let protoVar3 = argsVar3.get("__proto__");
+    let fetched = waitForDebuggerEvents(panel, events.FETCHED_PROPERTIES);
+    protoVar3.expand();
+    yield fetched;
+
+    let constrProp3 = protoVar3.get("constructor");
+    let constrOwner3 = variables.getOwnerScopeForVariableOrProperty(constrProp3);
+    is(constrOwner3, thirdScope,
+      "The getOwnerScopeForVariableOrProperty method works properly (10).");
+
+    // Test getParentScopesForVariableOrProperty with simple variables.
+
+    let varOwners1 = variables.getParentScopesForVariableOrProperty(someVar1);
+    let varOwners2 = variables.getParentScopesForVariableOrProperty(someVar2);
+    let varOwners3 = variables.getParentScopesForVariableOrProperty(someVar3);
+
+    is(varOwners1.length, 0,
+      "There should be no owner scopes for the first variable.");
+
+    is(varOwners2.length, 1,
+      "There should be one owner scope for the second variable.");
+    is(varOwners2[0], firstScope,
+      "The only owner scope for the second variable is correct.");
+
+    is(varOwners3.length, 2,
+      "There should be two owner scopes for the third variable.");
+    is(varOwners3[0], firstScope,
+      "The first owner scope for the third variable is correct.");
+    is(varOwners3[1], secondScope,
+      "The second owner scope for the third variable is correct.");
+
+    // Test getParentScopesForVariableOrProperty with first-degree properties.
+
+    let propOwners1 = variables.getParentScopesForVariableOrProperty(calleeProp1);
+    let propOwners2 = variables.getParentScopesForVariableOrProperty(calleeProp2);
+    let propOwners3 = variables.getParentScopesForVariableOrProperty(calleeProp3);
+
+    is(propOwners1.length, 0,
+      "There should be no owner scopes for the first property.");
+
+    is(propOwners2.length, 1,
+      "There should be one owner scope for the second property.");
+    is(propOwners2[0], firstScope,
+      "The only owner scope for the second property is correct.");
+
+    is(propOwners3.length, 2,
+      "There should be two owner scopes for the third property.");
+    is(propOwners3[0], firstScope,
+      "The first owner scope for the third property is correct.");
+    is(propOwners3[1], secondScope,
+      "The second owner scope for the third property is correct.");
+
+    // Test getParentScopesForVariableOrProperty with second-degree properties.
+
+    let secPropOwners1 = variables.getParentScopesForVariableOrProperty(constrProp1);
+    let secPropOwners2 = variables.getParentScopesForVariableOrProperty(constrProp2);
+    let secPropOwners3 = variables.getParentScopesForVariableOrProperty(constrProp3);
+
+    is(secPropOwners1.length, 0,
+      "There should be no owner scopes for the first inner property.");
+
+    is(secPropOwners2.length, 1,
+      "There should be one owner scope for the second inner property.");
+    is(secPropOwners2[0], firstScope,
+      "The only owner scope for the second inner property is correct.");
+
+    is(secPropOwners3.length, 2,
+      "There should be two owner scopes for the third inner property.");
+    is(secPropOwners3[0], firstScope,
+      "The first owner scope for the third inner property is correct.");
+    is(secPropOwners3[1], secondScope,
+      "The second owner scope for the third inner property is correct.");
+
+    yield resumeDebuggerThenCloseAndFinish(panel);
+  });
+}
diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js b/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
new file mode 100644
index 000000000000..d515359c41d1
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
@@ -0,0 +1,54 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Tests that overridden variables in the VariablesView are styled properly.
+ */
+
+const TAB_URL = EXAMPLE_URL + "doc_scope-variable-2.html";
+
+function test() {
+  Task.spawn(function() {
+    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let win = panel.panelWin;
+    let events = win.EVENTS;
+    let variables = win.DebuggerView.Variables;
+
+    // Allow this generator function to yield first.
+    executeSoon(() => debuggee.test());
+    yield waitForSourceAndCaretAndScopes(panel, ".html", 23);
+
+    // Wait for the hierarchy to be committed by the VariablesViewController.
+    let committed = promise.defer();
+    variables.oncommit = committed.resolve;
+    yield committed.promise;
+
+    let firstScope = variables.getScopeAtIndex(0);
+    let secondScope = variables.getScopeAtIndex(1);
+    let thirdScope = variables.getScopeAtIndex(2);
+
+    let someVar1 = firstScope.get("a");
+    let someVar2 = secondScope.get("a");
+    let someVar3 = thirdScope.get("a");
+
+    let argsVar1 = firstScope.get("arguments");
+    let argsVar2 = secondScope.get("arguments");
+    let argsVar3 = thirdScope.get("arguments");
+
+    is(someVar1.target.hasAttribute("overridden"), false,
+      "The first 'a' variable should not be marked as being overridden.");
+    is(someVar2.target.hasAttribute("overridden"), true,
+      "The second 'a' variable should be marked as being overridden.");
+    is(someVar3.target.hasAttribute("overridden"), true,
+      "The third 'a' variable should be marked as being overridden.");
+
+    is(argsVar1.target.hasAttribute("overridden"), false,
+      "The first 'arguments' variable should not be marked as being overridden.");
+    is(argsVar2.target.hasAttribute("overridden"), true,
+      "The second 'arguments' variable should be marked as being overridden.");
+    is(argsVar3.target.hasAttribute("overridden"), true,
+      "The third 'arguments' variable should be marked as being overridden.");
+
+    yield resumeDebuggerThenCloseAndFinish(panel);
+  });
+}
diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-01.js b/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-01.js
index 5f476fa02d5e..3db66b669577 100644
--- a/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-01.js
@@ -23,6 +23,9 @@ function test() {
     gSources = gDebugger.DebuggerView.Sources;
     gVariables = gDebugger.DebuggerView.Variables;
 
+    // Always expand all items between pauses except 'window' variables.
+    gVariables.commitHierarchyIgnoredItems = Object.create(null, { window: { value: true } });
+
     waitForSourceShown(gPanel, ".html")
       .then(addBreakpoint)
       .then(() => ensureThreadClientState(gPanel, "resumed"))
diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-02.js b/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-02.js
index bb0bc35e99b4..80393c75341d 100644
--- a/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-02.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-reexpand-02.js
@@ -24,7 +24,7 @@ function test() {
     gSources = gDebugger.DebuggerView.Sources;
     gVariables = gDebugger.DebuggerView.Variables;
 
-    // Always expand all scopes between pauses.
+    // Always expand all items between pauses.
     gVariables.commitHierarchyIgnoredItems = Object.create(null);
 
     waitForSourceShown(gPanel, ".html")
diff --git a/browser/devtools/debugger/test/doc_scope-variable-2.html b/browser/devtools/debugger/test/doc_scope-variable-2.html
new file mode 100644
index 000000000000..afbfd166a784
--- /dev/null
+++ b/browser/devtools/debugger/test/doc_scope-variable-2.html
@@ -0,0 +1,30 @@
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!doctype html>
+
+<html>
+  <head>
+    <meta charset="utf-8"/>
+    <title>Debugger test page</title>
+  </head>
+
+  <body>
+    <script type="text/javascript">
+      function test() {
+        var a = "first scope";
+        firstNest();
+
+        function firstNest() {
+          var a = "second scope";
+          secondNest();
+
+          function secondNest() {
+            var a = "third scope";
+            debugger;
+          }
+        }
+      }
+    </script>
+  </body>
+
+</html>
diff --git a/browser/devtools/shared/widgets/VariablesView.jsm b/browser/devtools/shared/widgets/VariablesView.jsm
index dca2211f1ef0..2a22745bc9c0 100644
--- a/browser/devtools/shared/widgets/VariablesView.jsm
+++ b/browser/devtools/shared/widgets/VariablesView.jsm
@@ -16,6 +16,7 @@ const LAZY_APPEND_BATCH = 100; // nodes
 const PAGE_SIZE_SCROLL_HEIGHT_RATIO = 100;
 const PAGE_SIZE_MAX_JUMPS = 30;
 const SEARCH_ACTION_MAX_DELAY = 300; // ms
+const ITEM_FLASH_DURATION = 300 // ms
 
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
@@ -117,6 +118,9 @@ VariablesView.prototype = {
   /**
    * Adds a scope to contain any inspected variables.
    *
+   * This new scope will be considered the parent of any other scope
+   * added afterwards.
+   *
    * @param string aName
    *        The scope's name (e.g. "Local", "Global" etc.).
    * @return Scope
@@ -131,6 +135,7 @@ VariablesView.prototype = {
     this._itemsByElement.set(scope._target, scope);
     this._currHierarchy.set(aName, scope);
     scope.header = !!aName;
+
     return scope;
   },
 
@@ -604,23 +609,6 @@ VariablesView.prototype = {
     return this._store[aIndex];
   },
 
-  /**
-   * Searches for the scope in this container displayed by the specified node.
-   *
-   * @param nsIDOMNode aNode
-   *        The node to search for.
-   * @return Scope
-   *         The matched scope, or null if nothing is found.
-   */
-  getScopeForNode: function(aNode) {
-    let item = this._itemsByElement.get(aNode);
-    // Match only Scopes, not Variables or Properties.
-    if (item && !(item instanceof Variable)) {
-      return item;
-    }
-    return null;
-  },
-
   /**
    * Recursively searches this container for the scope, variable or property
    * displayed by the specified node.
@@ -634,6 +622,43 @@ VariablesView.prototype = {
     return this._itemsByElement.get(aNode);
   },
 
+  /**
+   * Gets the scope owning a Variable or Property.
+   *
+   * @param Variable | Property
+   *        The variable or property to retrieven the owner scope for.
+   * @return Scope
+   *         The owner scope.
+   */
+  getOwnerScopeForVariableOrProperty: function(aItem) {
+    if (!aItem) {
+      return null;
+    }
+    // If this is a Scope, return it.
+    if (!(aItem instanceof Variable)) {
+      return aItem;
+    }
+    // If this is a Variable or Property, find its owner scope.
+    if (aItem instanceof Variable && aItem.ownerView) {
+      return this.getOwnerScopeForVariableOrProperty(aItem.ownerView);
+    }
+    return null;
+  },
+
+  /**
+   * Gets the parent scopes for a specified Variable or Property.
+   * The returned list will not include the owner scope.
+   *
+   * @param Variable | Property
+   *        The variable or property for which to find the parent scopes.
+   * @return array
+   *         A list of parent Scopes.
+   */
+  getParentScopesForVariableOrProperty: function(aItem) {
+    let scope = this.getOwnerScopeForVariableOrProperty(aItem);
+    return this._store.slice(0, Math.max(this._store.indexOf(scope), 0));
+  },
+
   /**
    * Gets the currently focused scope, variable or property in this view.
    *
@@ -976,12 +1001,15 @@ VariablesView.prototype = {
   _window: null,
 
   _store: null,
+  _itemsByElement: null,
   _prevHierarchy: null,
   _currHierarchy: null,
+
   _enumVisible: true,
   _nonEnumVisible: true,
   _alignedValues: false,
   _actionsFirst: false,
+
   _parent: null,
   _list: null,
   _searchboxNode: null,
@@ -1244,6 +1272,7 @@ Scope.prototype = {
     this._variablesView._itemsByElement.set(child._target, child);
     this._variablesView._currHierarchy.set(child._absoluteName, child);
     child.header = !!aName;
+
     return child;
   },
 
@@ -1294,7 +1323,9 @@ Scope.prototype = {
     view._store.splice(view._store.indexOf(this), 1);
     view._itemsByElement.delete(this._target);
     view._currHierarchy.delete(this._nameString);
+
     this._target.remove();
+
     for (let variable of this._store.values()) {
       variable.remove();
     }
@@ -1725,7 +1756,8 @@ Scope.prototype = {
   _onClick: function(e) {
     if (e.button != 0 ||
         e.target == this._editNode ||
-        e.target == this._deleteNode) {
+        e.target == this._deleteNode ||
+        e.target == this._addPropertyNode) {
       return;
     }
     this.toggle();
@@ -1935,25 +1967,6 @@ Scope.prototype = {
     }
   },
 
-  /**
-   * Gets the first search results match in this scope.
-   * @return Variable | Property
-   */
-  get _firstMatch() {
-    for (let [, variable] of this._store) {
-      let match;
-      if (variable._isMatch) {
-        match = variable;
-      } else {
-        match = variable._firstMatch;
-      }
-      if (match) {
-        return match;
-      }
-    }
-    return null;
-  },
-
   /**
    * Find the first item in the tree of visible items in this item that matches
    * the predicate. Searches in visual order (the order seen by the user).
@@ -2078,11 +2091,12 @@ Scope.prototype = {
   switch: null,
   delete: null,
   new: null,
-  editableValueTooltip: "",
+  preventDisableOnChange: false,
+  preventDescriptorModifiers: false,
   editableNameTooltip: "",
+  editableValueTooltip: "",
   editButtonTooltip: "",
   deleteButtonTooltip: "",
-  preventDescriptorModifiers: false,
   contextMenuId: "",
   separatorStr: "",
 
@@ -2178,7 +2192,9 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
     this.ownerView._store.delete(this._nameString);
     this._variablesView._itemsByElement.delete(this._target);
     this._variablesView._currHierarchy.delete(this._absoluteName);
+
     this._target.remove();
+
     for (let property of this._store.values()) {
       property.remove();
     }
@@ -2355,6 +2371,37 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
     this._valueLabel.setAttribute("value", this._valueString);
   },
 
+  /**
+   * Marks this variable as overridden.
+   *
+   * @param boolean aFlag
+   *        Whether this variable is overridden or not.
+   */
+  setOverridden: function(aFlag) {
+    if (aFlag) {
+      this._target.setAttribute("overridden", "");
+    } else {
+      this._target.removeAttribute("overridden");
+    }
+  },
+
+  /**
+   * Briefly flashes this variable.
+   *
+   * @param number aDuration [optional]
+   *        An optional flash animation duration.
+   */
+  flash: function(aDuration = ITEM_FLASH_DURATION) {
+    let fadeInDelay = this._variablesView.lazyEmptyDelay + 1;
+    let fadeOutDelay = fadeInDelay + aDuration;
+
+    setNamedTimeout("vview-flash-in" + this._absoluteName,
+      fadeInDelay, () => this._target.setAttribute("changed", ""));
+
+    setNamedTimeout("vview-flash-out" + this._absoluteName,
+      fadeOutDelay, () => this._target.removeAttribute("changed"));
+  },
+
   /**
    * Initializes this variable's id, view and binds event listeners.
    *
@@ -2405,7 +2452,7 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
 
     let separatorLabel = this._separatorLabel = document.createElement("label");
     separatorLabel.className = "plain separator";
-    separatorLabel.setAttribute("value", this.ownerView.separatorStr);
+    separatorLabel.setAttribute("value", this.ownerView.separatorStr + " ");
 
     let valueLabel = this._valueLabel = document.createElement("label");
     valueLabel.className = "plain value";
@@ -2428,6 +2475,8 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
       separatorLabel.hidden = true;
     }
 
+    // If this is a getter/setter property, create two child pseudo-properties
+    // called "get" and "set" that display the corresponding functions.
     if (descriptor.get || descriptor.set) {
       separatorLabel.hidden = true;
       valueLabel.hidden = true;
@@ -2480,15 +2529,16 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
       this._title.appendChild(deleteNode);
     }
 
-    let { actionsFirst } = this._variablesView;
-    if (ownerView.new || actionsFirst) {
+    if (ownerView.new) {
       let addPropertyNode = this._addPropertyNode = this.document.createElement("toolbarbutton");
       addPropertyNode.className = "plain variables-view-add-property";
       addPropertyNode.addEventListener("mousedown", this._onAddProperty.bind(this), false);
-      if (actionsFirst && VariablesView.isPrimitive(descriptor)) {
+      this._title.appendChild(addPropertyNode);
+
+      // Can't add properties to primitive values, hide the node in those cases.
+      if (VariablesView.isPrimitive(descriptor)) {
         addPropertyNode.setAttribute("invisible", "");
       }
-      this._title.appendChild(addPropertyNode);
     }
 
     if (ownerView.contextMenuId) {
@@ -2554,11 +2604,12 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
 
     let labels = [
       "configurable", "enumerable", "writable",
-      "frozen", "sealed", "extensible", "WebIDL"];
+      "frozen", "sealed", "extensible", "overridden", "WebIDL"];
 
-    for (let label of labels) {
+    for (let type of labels) {
       let labelElement = this.document.createElement("label");
-      labelElement.setAttribute("value", label);
+      labelElement.className = type;
+      labelElement.setAttribute("value", STR.GetStringFromName(type + "Tooltip"));
       tooltip.appendChild(labelElement);
     }
 
@@ -2623,6 +2674,7 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
     if (descriptor && "getterValue" in descriptor) {
       target.setAttribute("safe-getter", "");
     }
+
     if (name == "this") {
       target.setAttribute("self", "");
     }
@@ -2774,8 +2826,8 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
   _absoluteName: "",
   _initialDescriptor: null,
   _separatorLabel: null,
-  _spacer: null,
   _valueLabel: null,
+  _spacer: null,
   _editNode: null,
   _deleteNode: null,
   _addPropertyNode: null,
@@ -2877,69 +2929,101 @@ VariablesView.prototype.createHierarchy = function() {
  * scope/variable/property hierarchies and reopen previously expanded nodes.
  */
 VariablesView.prototype.commitHierarchy = function() {
-  let prevHierarchy = this._prevHierarchy;
-  let currHierarchy = this._currHierarchy;
-
-  for (let [absoluteName, currVariable] of currHierarchy) {
-    // Ignore variables which were already commmitted.
-    if (currVariable._committed) {
-      continue;
-    }
+  for (let [, currItem] of this._currHierarchy) {
     // Avoid performing expensive operations.
-    if (this.commitHierarchyIgnoredItems[currVariable._nameString]) {
+    if (this.commitHierarchyIgnoredItems[currItem._nameString]) {
       continue;
     }
-
-    // Try to get the previous instance of the inspected variable to
-    // determine the difference in state.
-    let prevVariable = prevHierarchy.get(absoluteName);
-    let expanded = false;
-    let changed = false;
-
-    // If the inspected variable existed in a previous hierarchy, check if
-    // the displayed value (a representation of the grip) has changed and if
-    // it was previously expanded.
-    if (prevVariable) {
-      expanded = prevVariable._isExpanded;
-
-      // Only analyze Variables and Properties for displayed value changes.
-      if (currVariable instanceof Variable) {
-        changed = prevVariable._valueString != currVariable._valueString;
-      }
+    let overridden = this.isOverridden(currItem);
+    if (overridden) {
+      currItem.setOverridden(true);
     }
-
-    // Make sure this variable is not handled in ulteror commits for the
-    // same hierarchy.
-    currVariable._committed = true;
-
-    // Re-expand the variable if not previously collapsed.
+    let expanded = !currItem._committed && this.wasExpanded(currItem);
     if (expanded) {
-      currVariable.expand();
+      currItem.expand();
     }
-    // This variable was either not changed or removed, no need to continue.
-    if (!changed) {
-      continue;
+    let changed = !currItem._committed && this.hasChanged(currItem);
+    if (changed) {
+      currItem.flash();
     }
-
-    // Apply an attribute determining the flash type and duration.
-    // Dispatch this action after all the nodes have been drawn, so that
-    // the transition efects can take place.
-    this.window.setTimeout(function(aTarget) {
-      aTarget.addEventListener("transitionend", function onEvent() {
-        aTarget.removeEventListener("transitionend", onEvent, false);
-        aTarget.removeAttribute("changed");
-      }, false);
-      aTarget.setAttribute("changed", "");
-    }.bind(this, currVariable.target), this.lazyEmptyDelay + 1);
+    currItem._committed = true;
+  }
+  if (this.oncommit) {
+    this.oncommit(this);
   }
 };
 
 // Some variables are likely to contain a very large number of properties.
 // It would be a bad idea to re-expand them or perform expensive operations.
-VariablesView.prototype.commitHierarchyIgnoredItems = Object.create(null, {
-  "window": { value: true }
+VariablesView.prototype.commitHierarchyIgnoredItems = Heritage.extend(null, {
+  "window": true,
+  "this": true
 });
 
+/**
+ * Checks if the an item was previously expanded, if it existed in a
+ * previous hierarchy.
+ *
+ * @param Scope | Variable | Property aItem
+ *        The item to verify.
+ * @return boolean
+ *         Whether the item was expanded.
+ */
+VariablesView.prototype.wasExpanded = function(aItem) {
+  if (!(aItem instanceof Scope)) {
+    return false;
+  }
+  let prevItem = this._prevHierarchy.get(aItem._absoluteName || aItem._nameString);
+  return prevItem ? prevItem._isExpanded : false;
+};
+
+/**
+ * Checks if the an item's displayed value (a representation of the grip)
+ * has changed, if it existed in a previous hierarchy.
+ *
+ * @param Variable | Property aItem
+ *        The item to verify.
+ * @return boolean
+ *         Whether the item has changed.
+ */
+VariablesView.prototype.hasChanged = function(aItem) {
+  // Only analyze Variables and Properties for displayed value changes.
+  // Scopes are just collections of Variables and Properties and
+  // don't have a "value", so they can't change.
+  if (!(aItem instanceof Variable)) {
+    return false;
+  }
+  let prevItem = this._prevHierarchy.get(aItem._absoluteName);
+  return prevItem ? prevItem._valueString != aItem._valueString : false;
+};
+
+/**
+ * Checks if the an item was previously expanded, if it existed in a
+ * previous hierarchy.
+ *
+ * @param Scope | Variable | Property aItem
+ *        The item to verify.
+ * @return boolean
+ *         Whether the item was expanded.
+ */
+VariablesView.prototype.isOverridden = function(aItem) {
+  // Only analyze Variables for being overridden in different Scopes.
+  if (!(aItem instanceof Variable) || aItem instanceof Property) {
+    return false;
+  }
+  let currVariableName = aItem._nameString;
+  let parentScopes = this.getParentScopesForVariableOrProperty(aItem);
+
+  for (let otherScope of parentScopes) {
+    for (let [otherVariableName] of otherScope) {
+      if (otherVariableName == currVariableName) {
+        return true;
+      }
+    }
+  }
+  return false;
+};
+
 /**
  * Returns true if the descriptor represents an undefined, null or
  * primitive value.
@@ -3247,9 +3331,6 @@ Editable.prototype = {
     let input = this._input = this._variable.document.createElement("textbox");
     input.className = "plain " + this.className;
     input.setAttribute("value", initialString);
-    if (!this._variable._variablesView.alignedValues) {
-      input.setAttribute("flex", "1");
-    }
 
     // Replace the specified label with a textbox input element.
     label.parentNode.replaceChild(input, label);
diff --git a/browser/devtools/shared/widgets/VariablesViewController.jsm b/browser/devtools/shared/widgets/VariablesViewController.jsm
index d05fdf22862c..45866f96ed92 100644
--- a/browser/devtools/shared/widgets/VariablesViewController.jsm
+++ b/browser/devtools/shared/widgets/VariablesViewController.jsm
@@ -352,13 +352,19 @@ VariablesViewController.prototype = {
       aTarget.showArrow();
     }
 
-    // Make sure that properties are always available on expansion.
-    aTarget.onexpand = () => this.expand(aTarget, aSource);
+    if (aSource.type == "block" || aSource.type == "function") {
+      // Block and function environments already contain scope arguments and
+      // corresponding variables as bindings.
+      this.populate(aTarget, aSource);
+    } else {
+      // Make sure that properties are always available on expansion.
+      aTarget.onexpand = () => this.populate(aTarget, aSource);
 
-    // Some variables are likely to contain a very large number of properties.
-    // It's a good idea to be prepared in case of an expansion.
-    if (aTarget.shouldPrefetch) {
-      aTarget.addEventListener("mouseover", aTarget.onexpand, false);
+      // Some variables are likely to contain a very large number of properties.
+      // It's a good idea to be prepared in case of an expansion.
+      if (aTarget.shouldPrefetch) {
+        aTarget.addEventListener("mouseover", aTarget.onexpand, false);
+      }
     }
 
     // Register all the actors that this controller now depends on.
@@ -373,6 +379,8 @@ VariablesViewController.prototype = {
    * Adds properties to a Scope, Variable, or Property in the view. Triggered
    * when a scope is expanded or certain variables are hovered.
    *
+   * This does not expand the target, it only populates it.
+   *
    * @param Scope aTarget
    *        The Scope to be expanded.
    * @param object aSource
@@ -380,7 +388,7 @@ VariablesViewController.prototype = {
    * @return Promise
    *         The promise that is resolved once the target has been expanded.
    */
-  expand: function(aTarget, aSource) {
+  populate: function(aTarget, aSource) {
     // Fetch the variables only once.
     if (aTarget._fetched) {
       return aTarget._fetched;
@@ -510,16 +518,17 @@ VariablesViewController.prototype = {
     scope.locked = true; // Prevent collpasing the scope.
 
     let variable = scope.addItem("", { enumerable: true });
-    let expanded;
+    let populated;
 
     if (aOptions.objectActor) {
-      expanded = this.expand(variable, aOptions.objectActor);
+      populated = this.populate(variable, aOptions.objectActor);
+      variable.expand();
     } else if (aOptions.rawObject) {
       variable.populate(aOptions.rawObject, { expanded: true });
-      expanded = promise.resolve();
+      populated = promise.resolve();
     }
 
-    return { variable: variable, expanded: expanded };
+    return { variable: variable, expanded: populated };
   },
 };
 
diff --git a/browser/devtools/shared/widgets/widgets.css b/browser/devtools/shared/widgets/widgets.css
index 60f34d20cee8..9eb460bc058f 100644
--- a/browser/devtools/shared/widgets/widgets.css
+++ b/browser/devtools/shared/widgets/widgets.css
@@ -56,10 +56,11 @@
   display: none;
 }
 
-.variable-or-property:not([safe-getter]) > tooltip > label[value=WebIDL],
-.variable-or-property:not([non-extensible]) > tooltip > label[value=extensible],
-.variable-or-property:not([frozen]) > tooltip > label[value=frozen],
-.variable-or-property:not([sealed]) > tooltip > label[value=sealed] {
+.variable-or-property:not([safe-getter]) > tooltip > label.WebIDL,
+.variable-or-property:not([overridden]) > tooltip > label.overridden,
+.variable-or-property:not([non-extensible]) > tooltip > label.extensible,
+.variable-or-property:not([frozen]) > tooltip > label.frozen,
+.variable-or-property:not([sealed]) > tooltip > label.sealed {
   display: none;
 }
 
@@ -73,6 +74,6 @@
   display: none;
 }
 
-.variables-view-container[aligned-values] .title > [optional-visibility] {
+.variables-view-container[aligned-values] [optional-visibility] {
   display: none;
 }
diff --git a/browser/locales/en-US/chrome/browser/devtools/debugger.properties b/browser/locales/en-US/chrome/browser/devtools/debugger.properties
index 0f3b8e3a2dcc..edfb67fa7765 100644
--- a/browser/locales/en-US/chrome/browser/devtools/debugger.properties
+++ b/browser/locales/en-US/chrome/browser/devtools/debugger.properties
@@ -233,6 +233,23 @@ variablesCloseButtonTooltip=Click to remove
 # in the variables list on a getter or setter which can be edited.
 variablesEditButtonTooltip=Click to set value
 
+# LOCALIZATION NOTE (configurable|...|Tooltip): The text that is displayed
+# in the variables list on certain variables or properties as tooltips.
+# Expanations of what these represent can be found at the following links:
+# https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object/defineProperty
+# https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object/isExtensible
+# https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object/isFrozen
+# https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object/isSealed
+# It's probably best to keep these in English.
+configurableTooltip=configurable
+enumerableTooltip=enumerable
+writableTooltip=writable
+frozenTooltip=frozen
+sealedTooltip=sealed
+extensibleTooltip=extensible
+overriddenTooltip=overridden
+WebIDLTooltip=WebIDL
+
 # LOCALIZATION NOTE (variablesSeparatorLabel): The text that is displayed
 # in the variables list as a separator between the name and value.
 variablesSeparatorLabel=:
diff --git a/browser/themes/linux/devtools/widgets.css b/browser/themes/linux/devtools/widgets.css
index 26827a1decde..599eb4799a5a 100644
--- a/browser/themes/linux/devtools/widgets.css
+++ b/browser/themes/linux/devtools/widgets.css
@@ -446,32 +446,7 @@
   -moz-margin-end: 1px;
 }
 
-/* Generic traits applied to both variables and properties */
-
-.variable-or-property {
-  transition: background 1s ease-in-out, color 1s ease-in-out;
-}
-
-.variable-or-property[changed] {
-  color: black;
-  transition-duration: .4s;
-}
-
-.variable-or-property > .title > .value {
-  -moz-box-flex: 1;
-  -moz-padding-start: 6px;
-  -moz-padding-end: 4px;
-}
-
-.variable-or-property[editable] > .title > .value {
-  cursor: text;
-}
-
-.variable-or-property:not([untitled]) > .variables-view-element-details {
-  -moz-margin-start: 10px;
-}
-
-/* Custom variables and properties traits */
+/* Generic variables traits */
 
 .variables-view-variable {
   -moz-margin-start: 1px;
@@ -486,10 +461,54 @@
   font-weight: 600;
 }
 
+/* Generic variables *and* properties traits */
+
 .variable-or-property:focus > .title > label {
   color: inherit !important;
 }
 
+.variable-or-property > .title > .value {
+  -moz-box-flex: 1;
+}
+
+.variable-or-property:not([untitled]) > .variables-view-element-details {
+  -moz-margin-start: 10px;
+}
+
+/* Traits applied when variables or properties are changed or overridden */
+
+.variable-or-property:not([overridden]) {
+  transition: background 1s ease-in-out;
+}
+
+.variable-or-property:not([overridden])[changed] {
+  transition-duration: .4s;
+}
+
+.variable-or-property[overridden] {
+  background: rgba(128,128,128,0.05);
+}
+
+.variable-or-property[overridden] .title > label {
+  /* Cross out the title for this variable and all child properties. */
+  font-style: italic;
+  text-decoration: line-through;
+  border-bottom: none !important;
+  color: rgba(128,128,128,0.9);
+  opacity: 0.7;
+}
+
+/* Traits applied when variables or properties are editable */
+
+.variable-or-property[editable] > .title > .value {
+  cursor: text;
+}
+
+.variable-or-property[overridden] .title > .value {
+  /* Disallow editing this variable and all child properties. */
+  pointer-events: none;
+}
+
 /* Custom configurable/enumerable/writable or frozen/sealed/extensible
  * variables and properties */
 
@@ -567,15 +586,20 @@
   margin: 0 2px 0 2px;
 }
 
-.variable-or-property[non-enumerable] > tooltip > label[value=enumerable],
-.variable-or-property[non-configurable] > tooltip > label[value=configurable],
-.variable-or-property[non-writable] > tooltip > label[value=writable],
-.variable-or-property[non-extensible] > tooltip > label[value=extensible] {
+.variable-or-property[non-enumerable] > tooltip > label.enumerable,
+.variable-or-property[non-configurable] > tooltip > label.configurable,
+.variable-or-property[non-writable] > tooltip > label.writable,
+.variable-or-property[non-extensible] > tooltip > label.extensible {
   color: #800;
   text-decoration: line-through;
 }
 
-.variable-or-property[safe-getter] > tooltip > label[value=WebIDL] {
+.variable-or-property[overridden] > tooltip > label.overridden {
+  -moz-padding-start: 4px;
+  -moz-border-start: 1px dotted #000;
+}
+
+.variable-or-property[safe-getter] > tooltip > label.WebIDL {
   -moz-padding-start: 4px;
   -moz-border-start: 1px dotted #000;
   color: #080;
@@ -610,7 +634,7 @@
 }
 
 .element-value-input {
-  -moz-margin-start: 4px !important;
+  -moz-margin-start: -2px !important;
   -moz-margin-end: 2px !important;
 }
 
@@ -623,6 +647,7 @@
 .element-value-input,
 .element-name-input {
   border: 1px solid rgba(128, 128, 128, .5) !important;
+  border-radius: 0;
   color: inherit;
 }
 
diff --git a/browser/themes/osx/devtools/widgets.css b/browser/themes/osx/devtools/widgets.css
index f6a4782d1fbd..b574c64e1063 100644
--- a/browser/themes/osx/devtools/widgets.css
+++ b/browser/themes/osx/devtools/widgets.css
@@ -440,32 +440,7 @@
   -moz-margin-end: 1px;
 }
 
-/* Generic traits applied to both variables and properties */
-
-.variable-or-property {
-  transition: background 1s ease-in-out, color 1s ease-in-out;
-}
-
-.variable-or-property[changed] {
-  color: black;
-  transition-duration: .4s;
-}
-
-.variable-or-property > .title > .value {
-  -moz-box-flex: 1;
-  -moz-padding-start: 6px;
-  -moz-padding-end: 4px;
-}
-
-.variable-or-property[editable] > .title > .value {
-  cursor: text;
-}
-
-.variable-or-property:not([untitled]) > .variables-view-element-details {
-  -moz-margin-start: 10px;
-}
-
-/* Custom variables and properties traits */
+/* Generic variables traits */
 
 .variables-view-variable {
   -moz-margin-start: 1px;
@@ -480,10 +455,54 @@
   font-weight: 600;
 }
 
+/* Generic variables *and* properties traits */
+
 .variable-or-property:focus > .title > label {
   color: inherit !important;
 }
 
+.variable-or-property > .title > .value {
+  -moz-box-flex: 1;
+}
+
+.variable-or-property:not([untitled]) > .variables-view-element-details {
+  -moz-margin-start: 10px;
+}
+
+/* Traits applied when variables or properties are changed or overridden */
+
+.variable-or-property:not([overridden]) {
+  transition: background 1s ease-in-out;
+}
+
+.variable-or-property:not([overridden])[changed] {
+  transition-duration: .4s;
+}
+
+.variable-or-property[overridden] {
+  background: rgba(128,128,128,0.05);
+}
+
+.variable-or-property[overridden] .title > label {
+  /* Cross out the title for this variable and all child properties. */
+  font-style: italic;
+  text-decoration: line-through;
+  border-bottom: none !important;
+  color: rgba(128,128,128,0.9);
+  opacity: 0.7;
+}
+
+/* Traits applied when variables or properties are editable */
+
+.variable-or-property[editable] > .title > .value {
+  cursor: text;
+}
+
+.variable-or-property[overridden] .title > .value {
+  /* Disallow editing this variable and all child properties. */
+  pointer-events: none;
+}
+
 /* Custom configurable/enumerable/writable or frozen/sealed/extensible
  * variables and properties */
 
@@ -561,15 +580,20 @@
   margin: 0 2px 0 2px;
 }
 
-.variable-or-property[non-enumerable] > tooltip > label[value=enumerable],
-.variable-or-property[non-configurable] > tooltip > label[value=configurable],
-.variable-or-property[non-writable] > tooltip > label[value=writable],
-.variable-or-property[non-extensible] > tooltip > label[value=extensible] {
+.variable-or-property[non-enumerable] > tooltip > label.enumerable,
+.variable-or-property[non-configurable] > tooltip > label.configurable,
+.variable-or-property[non-writable] > tooltip > label.writable,
+.variable-or-property[non-extensible] > tooltip > label.extensible {
   color: #800;
   text-decoration: line-through;
 }
 
-.variable-or-property[safe-getter] > tooltip > label[value=WebIDL] {
+.variable-or-property[overridden] > tooltip > label.overridden {
+  -moz-padding-start: 4px;
+  -moz-border-start: 1px dotted #000;
+}
+
+.variable-or-property[safe-getter] > tooltip > label.WebIDL {
   -moz-padding-start: 4px;
   -moz-border-start: 1px dotted #000;
   color: #080;
@@ -604,7 +628,7 @@
 }
 
 .element-value-input {
-  -moz-margin-start: 4px !important;
+  -moz-margin-start: -2px !important;
   -moz-margin-end: 2px !important;
 }
 
@@ -617,6 +641,7 @@
 .element-value-input,
 .element-name-input {
   border: 1px solid rgba(128, 128, 128, .5) !important;
+  border-radius: 0;
   color: inherit;
 }
 
diff --git a/browser/themes/shared/devtools/dark-theme.css b/browser/themes/shared/devtools/dark-theme.css
index 59e6ab0ed581..ad53887a4c9e 100644
--- a/browser/themes/shared/devtools/dark-theme.css
+++ b/browser/themes/shared/devtools/dark-theme.css
@@ -52,7 +52,7 @@
 }
 
 .theme-bg-contrast,
-.variable-or-property[changed] { /* contrast bg color to attract attention on a container */
+.variable-or-property:not([overridden])[changed] { /* contrast bg color to attract attention on a container */
   background: #a18650;
 }
 
diff --git a/browser/themes/shared/devtools/light-theme.css b/browser/themes/shared/devtools/light-theme.css
index d43bea34273e..dbbf2e00bdac 100644
--- a/browser/themes/shared/devtools/light-theme.css
+++ b/browser/themes/shared/devtools/light-theme.css
@@ -52,7 +52,7 @@
 }
 
 .theme-bg-contrast,
-.variable-or-property[changed] { /* contrast bg color to attract attention on a container */
+.variable-or-property:not([overridden])[changed] { /* contrast bg color to attract attention on a container */
   background: #a18650;
 }
 
@@ -297,4 +297,4 @@ div.CodeMirror span.eval-text {
   border-bottom: 0;
 }
 
-%include toolbars.inc.css
\ No newline at end of file
+%include toolbars.inc.css
diff --git a/browser/themes/windows/devtools/widgets.css b/browser/themes/windows/devtools/widgets.css
index 98710e553fb7..85efa50b2724 100644
--- a/browser/themes/windows/devtools/widgets.css
+++ b/browser/themes/windows/devtools/widgets.css
@@ -443,32 +443,7 @@
   -moz-margin-end: 1px;
 }
 
-/* Generic traits applied to both variables and properties */
-
-.variable-or-property {
-  transition: background 1s ease-in-out, color 1s ease-in-out;
-}
-
-.variable-or-property[changed] {
-  color: black;
-  transition-duration: .4s;
-}
-
-.variable-or-property > .title > .value {
-  -moz-box-flex: 1;
-  -moz-padding-start: 6px;
-  -moz-padding-end: 4px;
-}
-
-.variable-or-property[editable] > .title > .value {
-  cursor: text;
-}
-
-.variable-or-property:not([untitled]) > .variables-view-element-details {
-  -moz-margin-start: 10px;
-}
-
-/* Custom variables and properties traits */
+/* Generic variables traits */
 
 .variables-view-variable {
   -moz-margin-start: 1px;
@@ -483,10 +458,54 @@
   font-weight: 600;
 }
 
+/* Generic variables *and* properties traits */
+
 .variable-or-property:focus > .title > label {
   color: inherit !important;
 }
 
+.variable-or-property > .title > .value {
+  -moz-box-flex: 1;
+}
+
+.variable-or-property:not([untitled]) > .variables-view-element-details {
+  -moz-margin-start: 10px;
+}
+
+/* Traits applied when variables or properties are changed or overridden */
+
+.variable-or-property:not([overridden]) {
+  transition: background 1s ease-in-out;
+}
+
+.variable-or-property:not([overridden])[changed] {
+  transition-duration: .4s;
+}
+
+.variable-or-property[overridden] {
+  background: rgba(128,128,128,0.05);
+}
+
+.variable-or-property[overridden] .title > label {
+  /* Cross out the title for this variable and all child properties. */
+  font-style: italic;
+  text-decoration: line-through;
+  border-bottom: none !important;
+  color: rgba(128,128,128,0.9);
+  opacity: 0.7;
+}
+
+/* Traits applied when variables or properties are editable */
+
+.variable-or-property[editable] > .title > .value {
+  cursor: text;
+}
+
+.variable-or-property[overridden] .title > .value {
+  /* Disallow editing this variable and all child properties. */
+  pointer-events: none;
+}
+
 /* Custom configurable/enumerable/writable or frozen/sealed/extensible
  * variables and properties */
 
@@ -564,15 +583,20 @@
   margin: 0 2px 0 2px;
 }
 
-.variable-or-property[non-enumerable] > tooltip > label[value=enumerable],
-.variable-or-property[non-configurable] > tooltip > label[value=configurable],
-.variable-or-property[non-writable] > tooltip > label[value=writable],
-.variable-or-property[non-extensible] > tooltip > label[value=extensible] {
+.variable-or-property[non-enumerable] > tooltip > label.enumerable,
+.variable-or-property[non-configurable] > tooltip > label.configurable,
+.variable-or-property[non-writable] > tooltip > label.writable,
+.variable-or-property[non-extensible] > tooltip > label.extensible {
   color: #800;
   text-decoration: line-through;
 }
 
-.variable-or-property[safe-getter] > tooltip > label[value=WebIDL] {
+.variable-or-property[overridden] > tooltip > label.overridden {
+  -moz-padding-start: 4px;
+  -moz-border-start: 1px dotted #000;
+}
+
+.variable-or-property[safe-getter] > tooltip > label.WebIDL {
   -moz-padding-start: 4px;
   -moz-border-start: 1px dotted #000;
   color: #080;
@@ -607,7 +631,7 @@
 }
 
 .element-value-input {
-  -moz-margin-start: 4px !important;
+  -moz-margin-start: -2px !important;
   -moz-margin-end: 2px !important;
 }
 
@@ -620,6 +644,7 @@
 .element-value-input,
 .element-name-input {
   border: 1px solid rgba(128, 128, 128, .5) !important;
+  border-radius: 0;
   color: inherit;
 }
 

From cd73ace0b79201b0739912ff0b6a008642d8af29 Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Thu, 12 Dec 2013 22:14:28 +0200
Subject: [PATCH 161/459] Bug 948872 - Safe getters shouldn't be colored
 differently in the variables view, r=past

---
 browser/themes/shared/devtools/dark-theme.css  | 3 +--
 browser/themes/shared/devtools/light-theme.css | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/browser/themes/shared/devtools/dark-theme.css b/browser/themes/shared/devtools/dark-theme.css
index ad53887a4c9e..2a3559cad75d 100644
--- a/browser/themes/shared/devtools/dark-theme.css
+++ b/browser/themes/shared/devtools/dark-theme.css
@@ -112,8 +112,7 @@
 .cm-s-mozilla .cm-builtin,
 .cm-s-mozilla .cm-tag,
 .cm-s-mozilla .cm-header,
-.variables-view-property > .title > .name,
-.variable-or-property[safe-getter] > .title > .name { /* pink/lavender */
+.variables-view-property > .title > .name { /* pink/lavender */
   color: #a673bf;
 }
 
diff --git a/browser/themes/shared/devtools/light-theme.css b/browser/themes/shared/devtools/light-theme.css
index dbbf2e00bdac..b3bffcb76ecb 100644
--- a/browser/themes/shared/devtools/light-theme.css
+++ b/browser/themes/shared/devtools/light-theme.css
@@ -111,8 +111,7 @@
 .cm-s-mozilla .cm-variable,
 .cm-s-mozilla .cm-tag,
 .cm-s-mozilla .cm-header,
-.variables-view-property > .title > .name,
-.variable-or-property[safe-getter] > .title > .name { /* dark blue */
+.variables-view-property > .title > .name { /* dark blue */
   color: hsl(208,81%,21%)
 }
 

From 67c28667965a6f5e9f77d3b4f978ae9da50d1c17 Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Thu, 12 Dec 2013 22:14:29 +0200
Subject: [PATCH 162/459] Bug 948873 - Function closures and other psuedo
 variables shouldn't have a bottom border in the variables view, r=past

---
 browser/devtools/shared/widgets/VariablesView.jsm | 7 +++++++
 browser/devtools/shared/widgets/widgets.css       | 4 ++++
 browser/themes/linux/devtools/widgets.css         | 8 ++++----
 browser/themes/osx/devtools/widgets.css           | 8 ++++----
 browser/themes/shared/devtools/dark-theme.css     | 6 +++---
 browser/themes/shared/devtools/light-theme.css    | 6 +++---
 browser/themes/windows/devtools/widgets.css       | 8 ++++----
 7 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/browser/devtools/shared/widgets/VariablesView.jsm b/browser/devtools/shared/widgets/VariablesView.jsm
index 2a22745bc9c0..a6f80ebfc39c 100644
--- a/browser/devtools/shared/widgets/VariablesView.jsm
+++ b/browser/devtools/shared/widgets/VariablesView.jsm
@@ -2680,12 +2680,19 @@ Variable.prototype = Heritage.extend(Scope.prototype, {
     }
     else if (name == "<exception>") {
       target.setAttribute("exception", "");
+      target.setAttribute("pseudo-item", "");
     }
     else if (name == "<return>") {
       target.setAttribute("return", "");
+      target.setAttribute("pseudo-item", "");
     }
     else if (name == "__proto__") {
       target.setAttribute("proto", "");
+      target.setAttribute("pseudo-item", "");
+    }
+
+    if (Object.keys(descriptor).length == 0) {
+      target.setAttribute("pseudo-item", "");
     }
   },
 
diff --git a/browser/devtools/shared/widgets/widgets.css b/browser/devtools/shared/widgets/widgets.css
index 9eb460bc058f..c3c678d8e9af 100644
--- a/browser/devtools/shared/widgets/widgets.css
+++ b/browser/devtools/shared/widgets/widgets.css
@@ -64,6 +64,10 @@
   display: none;
 }
 
+.variable-or-property[pseudo-item] > tooltip {
+  display: none;
+}
+
 *:not(:hover) .variables-view-delete,
 *:not(:hover) .variables-view-add-property {
   visibility: hidden;
diff --git a/browser/themes/linux/devtools/widgets.css b/browser/themes/linux/devtools/widgets.css
index 599eb4799a5a..f093441aa6d0 100644
--- a/browser/themes/linux/devtools/widgets.css
+++ b/browser/themes/linux/devtools/widgets.css
@@ -512,19 +512,19 @@
 /* Custom configurable/enumerable/writable or frozen/sealed/extensible
  * variables and properties */
 
-.variable-or-property[non-enumerable]:not([self]):not([exception]):not([return]):not([scope]) > .title > .name {
+.variable-or-property[non-enumerable]:not([self]):not([pseudo-item]) > .title > .name {
   opacity: 0.6;
 }
 
-.variable-or-property[non-configurable] > .title > .name {
+.variable-or-property[non-configurable]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #99f;
 }
 
-.variable-or-property[non-writable] > .title > .name {
+.variable-or-property[non-writable]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #f99;
 }
 
-.variable-or-property[safe-getter] > .title > .name {
+.variable-or-property[safe-getter]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #8b0;
 }
 
diff --git a/browser/themes/osx/devtools/widgets.css b/browser/themes/osx/devtools/widgets.css
index b574c64e1063..941130c3bbe1 100644
--- a/browser/themes/osx/devtools/widgets.css
+++ b/browser/themes/osx/devtools/widgets.css
@@ -506,19 +506,19 @@
 /* Custom configurable/enumerable/writable or frozen/sealed/extensible
  * variables and properties */
 
-.variable-or-property[non-enumerable]:not([self]):not([exception]):not([return]):not([scope]) > .title > .name {
+.variable-or-property[non-enumerable]:not([self]):not([pseudo-item]) > .title > .name {
   opacity: 0.6;
 }
 
-.variable-or-property[non-configurable] > .title > .name {
+.variable-or-property[non-configurable]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #99f;
 }
 
-.variable-or-property[non-writable] > .title > .name {
+.variable-or-property[non-writable]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #f99;
 }
 
-.variable-or-property[safe-getter] > .title > .name {
+.variable-or-property[safe-getter]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #8b0;
 }
 
diff --git a/browser/themes/shared/devtools/dark-theme.css b/browser/themes/shared/devtools/dark-theme.css
index 2a3559cad75d..504441561eba 100644
--- a/browser/themes/shared/devtools/dark-theme.css
+++ b/browser/themes/shared/devtools/dark-theme.css
@@ -93,7 +93,8 @@
 .theme-fg-color1,
 .cm-s-mozilla .cm-number,
 .variable-or-property .token-number,
-.variable-or-property[return] > .title > .name { /* green */
+.variable-or-property[return] > .title > .name,
+.variable-or-property[scope] > .title > .name { /* green */
   color: #5c9966;
 }
 
@@ -103,8 +104,7 @@
 .cm-s-mozilla .cm-def,
 .cm-s-mozilla .cm-property,
 .cm-s-mozilla .cm-qualifier,
-.variables-view-variable > .title > .name,
-.variable-or-property[scope] > .title > .name { /* blue */
+.variables-view-variable > .title > .name { /* blue */
   color: #3689b2;
 }
 
diff --git a/browser/themes/shared/devtools/light-theme.css b/browser/themes/shared/devtools/light-theme.css
index b3bffcb76ecb..703199e893a2 100644
--- a/browser/themes/shared/devtools/light-theme.css
+++ b/browser/themes/shared/devtools/light-theme.css
@@ -92,7 +92,8 @@
 .theme-fg-color1,
 .cm-s-mozilla .cm-number,
 .variable-or-property .token-number,
-.variable-or-property[return] > .title > .name { /* green */
+.variable-or-property[return] > .title > .name,
+.variable-or-property[scope] > .title > .name { /* green */
   color: hsl(72,100%,27%);
 }
 
@@ -102,8 +103,7 @@
 .cm-s-mozilla .cm-def,
 .cm-s-mozilla .cm-property,
 .cm-s-mozilla .cm-qualifier,
-.variables-view-variable > .title > .name,
-.variable-or-property[scope] > .title > .name { /* blue */
+.variables-view-variable > .title > .name { /* blue */
   color: hsl(208,56%,40%);
 }
 
diff --git a/browser/themes/windows/devtools/widgets.css b/browser/themes/windows/devtools/widgets.css
index 85efa50b2724..134268736c9d 100644
--- a/browser/themes/windows/devtools/widgets.css
+++ b/browser/themes/windows/devtools/widgets.css
@@ -509,19 +509,19 @@
 /* Custom configurable/enumerable/writable or frozen/sealed/extensible
  * variables and properties */
 
-.variable-or-property[non-enumerable]:not([self]):not([exception]):not([return]):not([scope]) > .title > .name {
+.variable-or-property[non-enumerable]:not([self]):not([pseudo-item]) > .title > .name {
   opacity: 0.6;
 }
 
-.variable-or-property[non-configurable] > .title > .name {
+.variable-or-property[non-configurable]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #99f;
 }
 
-.variable-or-property[non-writable] > .title > .name {
+.variable-or-property[non-writable]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #f99;
 }
 
-.variable-or-property[safe-getter] > .title > .name {
+.variable-or-property[safe-getter]:not([pseudo-item]) > .title > .name {
   border-bottom: 1px dashed #8b0;
 }
 

From de893521abdb106cc58b28a499969fc2985f9c27 Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Thu, 12 Dec 2013 22:14:29 +0200
Subject: [PATCH 163/459] Bug 949561 - The VariablesView and SideMenuWidget
 should use hardware acceleration when possible, r=fitzgen

---
 browser/devtools/shared/widgets/VariablesView.jsm |  2 ++
 browser/themes/linux/devtools/widgets.css         | 10 ++++++++++
 browser/themes/osx/devtools/widgets.css           | 10 ++++++++++
 browser/themes/windows/devtools/widgets.css       | 10 ++++++++++
 4 files changed, 32 insertions(+)

diff --git a/browser/devtools/shared/widgets/VariablesView.jsm b/browser/devtools/shared/widgets/VariablesView.jsm
index a6f80ebfc39c..81ea00ed3939 100644
--- a/browser/devtools/shared/widgets/VariablesView.jsm
+++ b/browser/devtools/shared/widgets/VariablesView.jsm
@@ -913,6 +913,7 @@ VariablesView.prototype = {
     label.className = "variables-view-empty-notice";
     label.setAttribute("value", this._emptyTextValue);
 
+    this._parent.setAttribute("empty", "");
     this._parent.appendChild(label);
     this._emptyTextNode = label;
   },
@@ -925,6 +926,7 @@ VariablesView.prototype = {
       return;
     }
 
+    this._parent.removeAttribute("empty");
     this._parent.removeChild(this._emptyTextNode);
     this._emptyTextNode = null;
   },
diff --git a/browser/themes/linux/devtools/widgets.css b/browser/themes/linux/devtools/widgets.css
index f093441aa6d0..78d0df0ddcab 100644
--- a/browser/themes/linux/devtools/widgets.css
+++ b/browser/themes/linux/devtools/widgets.css
@@ -269,6 +269,11 @@
 
 /* SideMenuWidget */
 
+.side-menu-widget-container {
+  /* Hack: force hardware acceleration */
+  transform: translateX(0px);
+}
+
 .side-menu-widget-container[theme="dark"] {
   background: url(background-noise-toolbar.png), hsl(208,11%,27%);
   color: #fff;
@@ -432,6 +437,11 @@
 
 /* VariablesView */
 
+.variables-view-container:not([empty]) {
+  /* Hack: force hardware acceleration */
+  transform: translateX(1px);
+}
+
 .variables-view-empty-notice {
   color: GrayText;
   padding: 2px;
diff --git a/browser/themes/osx/devtools/widgets.css b/browser/themes/osx/devtools/widgets.css
index 941130c3bbe1..fb6ac2e4408f 100644
--- a/browser/themes/osx/devtools/widgets.css
+++ b/browser/themes/osx/devtools/widgets.css
@@ -269,6 +269,11 @@
 
 /* SideMenuWidget */
 
+.side-menu-widget-container {
+  /* Hack: force hardware acceleration */
+  transform: translateX(0px);
+}
+
 .side-menu-widget-container[theme="dark"] {
   background: url(background-noise-toolbar.png), hsl(208,11%,27%);
   color: #fff;
@@ -426,6 +431,11 @@
 
 /* VariablesView */
 
+.variables-view-container:not([empty]) {
+  /* Hack: force hardware acceleration */
+  transform: translateX(1px);
+}
+
 .variables-view-empty-notice {
   color: GrayText;
   padding: 2px;
diff --git a/browser/themes/windows/devtools/widgets.css b/browser/themes/windows/devtools/widgets.css
index 134268736c9d..89bb14536de0 100644
--- a/browser/themes/windows/devtools/widgets.css
+++ b/browser/themes/windows/devtools/widgets.css
@@ -273,6 +273,11 @@
 
 /* SideMenuWidget */
 
+.side-menu-widget-container {
+  /* Hack: force hardware acceleration */
+  transform: translateX(0px);
+}
+
 .side-menu-widget-container[theme="dark"] {
   background: url(background-noise-toolbar.png), hsl(208,11%,27%);
   color: #fff;
@@ -429,6 +434,11 @@
 
 /* VariablesView */
 
+.variables-view-container:not([empty]) {
+  /* Hack: force hardware acceleration */
+  transform: translateX(1px);
+}
+
 .variables-view-empty-notice {
   color: GrayText;
   padding: 2px;

From 7df0e90023dfdf32bda62072371ecc3e770b3b20 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:34:03 -0800
Subject: [PATCH 164/459] Bug 949429 - Correctly check HomePager presence and
 visibility on redisplay (r=rnewman)

---
 mobile/android/base/BrowserApp.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 3fcfa90c5427..aaa27a068a5d 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1621,7 +1621,7 @@ abstract public class BrowserApp extends GeckoApp
     @Override
     public void onLocaleReady(final String locale) {
         super.onLocaleReady(locale);
-        if (mHomePager != null) {
+        if (isHomePagerVisible()) {
             // Blow it away and rebuild it with the right strings.
             mHomePager.redisplay(getSupportLoaderManager(), getSupportFragmentManager());
         }

From b9162f335a55b1e1b6146bcc1daf6a1e7fb3cc97 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Thu, 12 Dec 2013 12:34:16 -0800
Subject: [PATCH 165/459] Bug 949429 - Properly handle redisplay() calls before
 HomePager config is loaded (r=margaret)

---
 mobile/android/base/home/HomeAdapter.java |  6 ++++++
 mobile/android/base/home/HomePager.java   | 11 ++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/mobile/android/base/home/HomeAdapter.java b/mobile/android/base/home/HomeAdapter.java
index 7cbdc06283a2..db92fb7de291 100644
--- a/mobile/android/base/home/HomeAdapter.java
+++ b/mobile/android/base/home/HomeAdapter.java
@@ -96,6 +96,12 @@ class HomeAdapter extends FragmentStatePagerAdapter {
     }
 
     public Page getPageAtPosition(int position) {
+        // getPageAtPosition() might be called before HomeAdapter
+        // has got its initial list of PageEntries. Just bail.
+        if (mPageInfos.isEmpty()) {
+            return null;
+        }
+
         PageInfo info = mPageInfos.get(position);
         return info.toPage();
     }
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 55b149b7f06d..3e85eb2df75e 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -186,7 +186,16 @@ public class HomePager extends ViewPager {
     public void redisplay(LoaderManager lm, FragmentManager fm) {
         final HomeAdapter adapter = (HomeAdapter) getAdapter();
 
-        Page currentPage = adapter.getPageAtPosition(getCurrentItem());
+        // If mInitialPage is non-null, this means the HomePager hasn't
+        // finished loading its config yet. Simply re-show() with the
+        // current target page.
+        final Page currentPage;
+        if (mInitialPage != null) {
+            currentPage = mInitialPage;
+        } else {
+            currentPage = adapter.getPageAtPosition(getCurrentItem());
+        }
+
         show(lm, fm, currentPage, null);
     }
 

From 4be83d4a79197b02cc529ef9a1f402a052fa7e95 Mon Sep 17 00:00:00 2001
From: Sam Foster <sfoster@mozilla.com>
Date: Thu, 12 Dec 2013 10:05:53 -0800
Subject: [PATCH 166/459] Bug 936635 - Even up tabstrip scroll arrow spacing
 and fix scroff offset problem when toggling between precise/imprecise input.
 r=rsilveira

--HG--
extra : rebase_source : 73711c1bd03f2316086fe0b752105a4239218eaf
---
 browser/metro/theme/browser.css | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/browser/metro/theme/browser.css b/browser/metro/theme/browser.css
index 42459e4d0938..78aed659ed50 100644
--- a/browser/metro/theme/browser.css
+++ b/browser/metro/theme/browser.css
@@ -29,12 +29,12 @@
 #tabs-container {
   background: @panel_dark_color@ @panel_dark_background@;
   padding: 0;
-  -moz-padding-start: @metro_spacing_xnormal@;
+  -moz-padding-start: @metro_spacing_normal@;
   width: 100%;
 }
 
 #tabs {
-  -moz-padding-start: @metro_spacing_large@;
+  -moz-padding-start: 0;
 }
 
 #tabs .tabs-list {
@@ -46,17 +46,22 @@
   overflow: auto;
 }
 
-#tabs > .tabs-scrollbox > .arrowscrollbox-scrollbox {
-  overflow: hidden;
+#tabs[input="precise"] > .tabs-scrollbox > .scrollbutton-up {
+  visibility: visible !important;
+}
+#tabs[input="imprecise"] > .tabs-scrollbox > .scrollbutton-up {
+  visibility: hidden !important;
+  pointer-events: none;
 }
 
-#tabs[input="imprecise"] > .tabs-scrollbox > .scrollbutton-up,
 #tabs[input="imprecise"] > .tabs-scrollbox > .scrollbutton-down {
   visibility: collapse !important;
 }
+
 #tabs > .tabs-scrollbox > .scrollbutton-up {
   list-style-image: url("images/tab-arrows.png") !important;
   -moz-image-region: rect(15px 58px 63px 14px) !important;
+  padding-right: 13px;
 }
 #tabs > .tabs-scrollbox > .scrollbutton-up:hover {
   -moz-image-region: rect(14px 102px 62px 58px) !important;
@@ -71,6 +76,7 @@
 #tabs > .tabs-scrollbox > .scrollbutton-down {
   list-style-image: url("images/tab-arrows.png") !important;
   -moz-image-region: rect(73px 58px 121px 14px) !important;
+  padding-left: 16px;
 }
 #tabs > .tabs-scrollbox > .scrollbutton-down:hover {
   -moz-image-region: rect(72px 102px 120px 58px) !important;
@@ -182,7 +188,7 @@ documenttab[selected] .documenttab-selection {
   list-style-image: url(chrome://browser/skin/images/newtab-default.png);
 
   /* Add some extra padding for a larger target */
-  padding: 18px 25px 30px;
+  padding: 18px 20px 30px 20px;
 }
 
 /* Start UI ----------------------------------------------------------------- */

From 4fd613f1e0b9610c38a17aac6570aabfbdd89196 Mon Sep 17 00:00:00 2001
From: Marina Samuel <msamuel@mozilla.com>
Date: Thu, 12 Dec 2013 15:55:31 -0500
Subject: [PATCH 167/459] Bug 948983: Make about:newtab the start page with
 about:home and about:start as aliases and save all as about:newtab in
 sessionstore. r=mbrubeck

---
 browser/metro/base/content/Util.js             | 1 +
 browser/metro/base/content/bindings/browser.js | 6 ++++++
 browser/metro/base/content/browser-ui.js       | 2 +-
 browser/metro/base/content/browser.js          | 2 +-
 browser/metro/components/AboutRedirector.js    | 8 ++++++--
 browser/metro/components/BrowserCLH.js         | 2 +-
 browser/metro/components/components.manifest   | 1 +
 7 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/browser/metro/base/content/Util.js b/browser/metro/base/content/Util.js
index 542977957faa..b7287b3e45bf 100644
--- a/browser/metro/base/content/Util.js
+++ b/browser/metro/base/content/Util.js
@@ -209,6 +209,7 @@ let Util = {
             aURL == "about:blank" ||
             aURL == "about:empty" ||
             aURL == "about:home" ||
+            aURL == "about:newtab" ||
             aURL == "about:start");
   },
 
diff --git a/browser/metro/base/content/bindings/browser.js b/browser/metro/base/content/bindings/browser.js
index 8f1eb7a02759..4038ffa2ecdd 100644
--- a/browser/metro/base/content/bindings/browser.js
+++ b/browser/metro/base/content/bindings/browser.js
@@ -347,6 +347,12 @@ let WebNavigation =  {
     let history = docShell.QueryInterface(Ci.nsIWebNavigation).sessionHistory;
     for (let i = 0; i < history.count; i++) {
       let entry = this._serializeHistoryEntry(history.getEntryAtIndex(i, false));
+
+      // If someone directly navigates to one of these URLs and they switch to Desktop,
+      // we need to make the page load-able.
+      if (entry.url == "about:home" || entry.url == "about:start") {
+        entry.url = "about:newtab";
+      }
       entries.push(entry);
     }
     let index = history.index + 1;
diff --git a/browser/metro/base/content/browser-ui.js b/browser/metro/base/content/browser-ui.js
index abf604de47f9..a6e20cd7140e 100644
--- a/browser/metro/base/content/browser-ui.js
+++ b/browser/metro/base/content/browser-ui.js
@@ -308,7 +308,7 @@ var BrowserUI = {
 
   isStartURI: function isStartURI(aURI) {
     aURI = aURI || Browser.selectedBrowser.currentURI.spec;
-    return aURI == kStartURI || aURI == "about:home";
+    return aURI == kStartURI || aURI == "about:start" || aURI == "about:home";
   },
 
   updateStartURIAttributes: function (aURI) {
diff --git a/browser/metro/base/content/browser.js b/browser/metro/base/content/browser.js
index 073302c581e8..7075da31a1fd 100644
--- a/browser/metro/base/content/browser.js
+++ b/browser/metro/base/content/browser.js
@@ -11,7 +11,7 @@ let Cr = Components.results;
 Cu.import("resource://gre/modules/PageThumbs.jsm");
 
 // Page for which the start UI is shown
-const kStartURI = "about:start";
+const kStartURI = "about:newtab";
 
 // allow panning after this timeout on pages with registered touch listeners
 const kTouchTimeout = 300;
diff --git a/browser/metro/components/AboutRedirector.js b/browser/metro/components/AboutRedirector.js
index 60728c321682..f3b0807892a8 100644
--- a/browser/metro/components/AboutRedirector.js
+++ b/browser/metro/components/AboutRedirector.js
@@ -8,7 +8,7 @@ const Ci = Components.interfaces;
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 
 let modules = {
-  start: {
+  newtab: {
     uri: "chrome://browser/content/Start.xul",
     privileged: true
   },
@@ -37,8 +37,12 @@ let modules = {
     uri: "chrome://browser/content/aboutCertError.xhtml",
     privileged: true
   },
+  start: {
+    uri: "about:newtab",
+    privileged: true
+  },
   home: {
-    uri: "about:start",
+    uri: "about:newtab",
     privileged: true
   },
 #ifdef MOZ_CRASHREPORTER
diff --git a/browser/metro/components/BrowserCLH.js b/browser/metro/components/BrowserCLH.js
index 2c973d5fbd3b..684087826172 100644
--- a/browser/metro/components/BrowserCLH.js
+++ b/browser/metro/components/BrowserCLH.js
@@ -73,7 +73,7 @@ function needHomepageOverride() {
 }
 
 function getHomePage() {
-  let url = "about:start";
+  let url = "about:newtab";
   try {
     url = Services.prefs.getComplexValue("browser.startup.homepage", Ci.nsIPrefLocalizedString).data;
   } catch (e) { }
diff --git a/browser/metro/components/components.manifest b/browser/metro/components/components.manifest
index f07f86d0d035..ef6066d302bd 100644
--- a/browser/metro/components/components.manifest
+++ b/browser/metro/components/components.manifest
@@ -5,6 +5,7 @@ contract @mozilla.org/network/protocol/about;1?what=empty {433d2d75-5923-49b0-85
 contract @mozilla.org/network/protocol/about;1?what=firefox {433d2d75-5923-49b0-854d-f37267b03dc7}
 contract @mozilla.org/network/protocol/about;1?what=rights {433d2d75-5923-49b0-854d-f37267b03dc7}
 contract @mozilla.org/network/protocol/about;1?what=certerror {433d2d75-5923-49b0-854d-f37267b03dc7}
+contract @mozilla.org/network/protocol/about;1?what=newtab {433d2d75-5923-49b0-854d-f37267b03dc7}
 contract @mozilla.org/network/protocol/about;1?what=home {433d2d75-5923-49b0-854d-f37267b03dc7}
 #ifdef MOZ_CRASHREPORTER
 contract @mozilla.org/network/protocol/about;1?what=crashprompt {433d2d75-5923-49b0-854d-f37267b03dc7}

From 0318016b40b47cb4808e5f8be9d5dc380ad93389 Mon Sep 17 00:00:00 2001
From: Heather Arthur <fayearthur@gmail.com>
Date: Thu, 12 Dec 2013 12:58:28 -0800
Subject: [PATCH 168/459] Bug 949336 - TypeError: inspector.once(...) is
 undefined: highlightNode@browser_computedview_original_source_link.js:41;
 r=pbrosset

---
 .../test/browser_computedview_original_source_link.js           | 2 +-
 .../test/browser_ruleview_734259_style_editor_link.js           | 2 +-
 .../test/browser_ruleview_original_source_link.js               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/browser/devtools/styleinspector/test/browser_computedview_original_source_link.js b/browser/devtools/styleinspector/test/browser_computedview_original_source_link.js
index 044cd8ba503d..6ad88fba6151 100644
--- a/browser/devtools/styleinspector/test/browser_computedview_original_source_link.js
+++ b/browser/devtools/styleinspector/test/browser_computedview_original_source_link.js
@@ -42,7 +42,7 @@ function highlightNode(aInspector, aComputedView)
     is(inspector.selection.node, div, "selection matches the div element");
 
     expandProperty(0, testComputedViewLink);
-  }).then(null, console.error);
+  });
 }
 
 function testComputedViewLink() {
diff --git a/browser/devtools/styleinspector/test/browser_ruleview_734259_style_editor_link.js b/browser/devtools/styleinspector/test/browser_ruleview_734259_style_editor_link.js
index cd6c81120029..322d71cb4911 100644
--- a/browser/devtools/styleinspector/test/browser_ruleview_734259_style_editor_link.js
+++ b/browser/devtools/styleinspector/test/browser_ruleview_734259_style_editor_link.js
@@ -66,7 +66,7 @@ function highlightNode()
   inspector.once("inspector-updated", () => {
     is(inspector.selection.node, div, "selection matches the div element");
     testInlineStyle();
-  }).then(null, console.error);
+  });
 }
 
 function testInlineStyle()
diff --git a/browser/devtools/styleinspector/test/browser_ruleview_original_source_link.js b/browser/devtools/styleinspector/test/browser_ruleview_original_source_link.js
index d570b46491ba..5530909bb5a8 100644
--- a/browser/devtools/styleinspector/test/browser_ruleview_original_source_link.js
+++ b/browser/devtools/styleinspector/test/browser_ruleview_original_source_link.js
@@ -48,7 +48,7 @@ function highlightNode()
   inspector.once("inspector-updated", () => {
     is(inspector.selection.node, div, "selection matches the div element");
     testRuleViewLink();
-  }).then(null, console.error);
+  });
 }
 
 function testRuleViewLink() {

From e5ea99cfe39df4a33077437c12c5938ac7683e37 Mon Sep 17 00:00:00 2001
From: Heather Arthur <fayearthur@gmail.com>
Date: Thu, 12 Dec 2013 12:58:29 -0800
Subject: [PATCH 169/459] Bug 948805 - Fix TypeError: this._toolbox is null:
 StyleEditorPanel.prototype._showError; r=pbrosset

---
 .../devtools/styleeditor/styleeditor-panel.js | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/browser/devtools/styleeditor/styleeditor-panel.js b/browser/devtools/styleeditor/styleeditor-panel.js
index ef55e84761ee..9940fabd15db 100644
--- a/browser/devtools/styleeditor/styleeditor-panel.js
+++ b/browser/devtools/styleeditor/styleeditor-panel.js
@@ -72,15 +72,26 @@ StyleEditorPanel.prototype = {
    *
    * @param  {string} event
    *         Type of event
-   * @param  {string} errorCode
+   * @param  {string} code
    *         Error code of error to report
+   * @param  {string} message
+   *         Extra message to append to error message
    */
-  _showError: function(event, errorCode) {
-    let message = _(errorCode);
+  _showError: function(event, code, message) {
+    if (!this._toolbox) {
+      // could get an async error after we've been destroyed
+      return;
+    }
+
+    let errorMessage = _(code);
+    if (message) {
+      errorMessage += " " + message;
+    }
+
     let notificationBox = this._toolbox.getNotificationBox();
     let notification = notificationBox.getNotificationWithValue("styleeditor-error");
     if (!notification) {
-      notificationBox.appendNotification(message,
+      notificationBox.appendNotification(errorMessage,
         "styleeditor-error", "", notificationBox.PRIORITY_CRITICAL_LOW);
     }
   },

From fe788b81e255b73a5dcbc51c9db99875458ebc82 Mon Sep 17 00:00:00 2001
From: Tim Taubert <tim@timtaubert.de>
Date: Thu, 12 Dec 2013 12:44:33 +0100
Subject: [PATCH 170/459] Bug 947570 - Rewrite browser_597071.js to fix
 intermittent timeouts r=smacleod

From d8b8de84b6a3fadb2f198cddba183231bdffcd07 Mon Sep 17 00:00:00 2001
---
 .../sessionstore/test/browser_597071.js       | 73 ++++++++-----------
 browser/components/sessionstore/test/head.js  | 18 +++++
 2 files changed, 47 insertions(+), 44 deletions(-)

diff --git a/browser/components/sessionstore/test/browser_597071.js b/browser/components/sessionstore/test/browser_597071.js
index bc56718ec6f7..394b60aeee63 100644
--- a/browser/components/sessionstore/test/browser_597071.js
+++ b/browser/components/sessionstore/test/browser_597071.js
@@ -1,53 +1,38 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
 
-function test() {
-  /** Test for Bug 597071 **/
+/**
+ * Bug 597071 - Closed windows should only be resurrected when there is a single
+ * popup window
+ */
+add_task(function test_close_last_nonpopup_window() {
+  // Purge the list of closed windows.
+  while (ss.getClosedWindowCount()) {
+    ss.forgetClosedWindow(0);
+  }
 
-  waitForExplicitFinish();
+  let oldState = ss.getWindowState(window);
 
-  // set the pref to 1 greater than it currently is so we have room for an extra
-  // closed window
-  let closedWindowCount = ss.getClosedWindowCount();
-  Services.prefs.setIntPref("browser.sessionstore.max_windows_undo",
-                            closedWindowCount + 1);
+  let popupState = {windows: [
+    {tabs: [{entries: []}], isPopup: true, hidden: "toolbar"}
+  ]};
 
-  let currentState = ss.getBrowserState();
-  let popupState = { windows:[
-    { tabs:[ {entries:[] }], isPopup: true, hidden: "toolbar" }
-  ] };
-
-  // set this window to be a popup.
+  // Set this window to be a popup.
   ss.setWindowState(window, JSON.stringify(popupState), true);
 
-  // open a new non-popup window
-  let newWin = openDialog(location, "", "chrome,all,dialog=no", "http://example.com");
-  newWin.addEventListener("load", function(aEvent) {
-    newWin.removeEventListener("load", arguments.callee, false);
+  // Open a new window with a tab.
+  let win = yield promiseNewWindowLoaded({private: false});
+  let tab = win.gBrowser.addTab("http://example.com/");
+  yield promiseBrowserLoaded(tab.linkedBrowser);
 
-    newWin.gBrowser.addEventListener("load", function(aEvent) {
-      newWin.gBrowser.removeEventListener("load", arguments.callee, true);
+  // Make sure sessionstore sees this window.
+  let state = JSON.parse(ss.getBrowserState());
+  is(state.windows.length, 2, "sessionstore knows about this window");
 
-      newWin.gBrowser.addTab().linkedBrowser.stop();
-
-      // make sure sessionstore sees this window
-      let state = JSON.parse(ss.getBrowserState());
-      is(state.windows.length, 2, "sessionstore knows about this window");
-
-      newWin.close();
-      newWin.addEventListener("unload", function(aEvent) {
-        newWin.removeEventListener("unload", arguments.callee, false);
-
-        is(ss.getClosedWindowCount(), closedWindowCount + 1,
-           "increased closed window count");
-
-        Services.prefs.clearUserPref("browser.sessionstore.max_windows_undo");
-        ss.setBrowserState(currentState);
-        executeSoon(finish);
-
-      }, false);
-    }, true);
-  }, false);
-}
+  // Closed the window and check the closed window count.
+  yield promiseWindowClosed(win);
+  is(ss.getClosedWindowCount(), 1, "correct closed window count");
 
+  // Cleanup.
+  ss.setWindowState(window, oldState, true);
+});
diff --git a/browser/components/sessionstore/test/head.js b/browser/components/sessionstore/test/head.js
index fee33a150aa5..0e99d5d3d5bf 100644
--- a/browser/components/sessionstore/test/head.js
+++ b/browser/components/sessionstore/test/head.js
@@ -418,6 +418,24 @@ function promiseNewWindowLoaded(aOptions) {
   return deferred.promise;
 }
 
+/**
+ * Chrome windows aren't closed synchronously. Provide a helper method to close
+ * a window and wait until we received the "domwindowclosed" notification for it.
+ */
+function promiseWindowClosed(win) {
+  let deferred = Promise.defer();
+
+  Services.obs.addObserver(function obs(subject, topic) {
+    if (subject == win) {
+      Services.obs.removeObserver(obs, topic);
+      deferred.resolve();
+    }
+  }, "domwindowclosed", false);
+
+  win.close();
+  return deferred.promise;
+}
+
 /**
  * This waits for the browser-delayed-startup-finished notification of a given
  * window. It indicates that the windows has loaded completely and is ready to

From 09d718827aa618b145f810188b82bb64b38c260b Mon Sep 17 00:00:00 2001
From: Marina Samuel <msamuel@mozilla.com>
Date: Thu, 12 Dec 2013 16:59:42 -0500
Subject: [PATCH 171/459] Bug 949612: Restore closed tabs data on startup and
 adjust json format to match desktop. r=mbrubeck

---
 browser/metro/components/SessionStore.js | 35 ++++++++++++++----------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/browser/metro/components/SessionStore.js b/browser/metro/components/SessionStore.js
index 531852036d51..1f69401e2ab2 100644
--- a/browser/metro/components/SessionStore.js
+++ b/browser/metro/components/SessionStore.js
@@ -232,7 +232,7 @@ SessionStore.prototype = {
 
         // Clear all data about closed tabs
         for (let [ssid, win] in Iterator(this._windows))
-          win.closedTabs = [];
+          win._closedTabs = [];
 
         if (this._loadState == STATE_RUNNING) {
           // Save the purged state immediately
@@ -286,7 +286,7 @@ SessionStore.prototype = {
 
     // Assign it a unique identifier (timestamp) and create its data object
     aWindow.__SSID = "window" + Date.now();
-    this._windows[aWindow.__SSID] = { tabs: [], selected: 0, closedTabs: [] };
+    this._windows[aWindow.__SSID] = { tabs: [], selected: 0, _closedTabs: [] };
 
     // Perform additional initialization when the first window is loading
     if (this._loadState == STATE_STOPPED) {
@@ -374,12 +374,15 @@ SessionStore.prototype = {
       // NB: The access to aBrowser.__SS_extdata throws during automation (in
       // browser_msgmgr_01). See bug 888736.
       let data = aBrowser.__SS_data;
+      if (!data) {
+        return; // Cannot restore an empty tab.
+      }
       try { data.extData = aBrowser.__SS_extdata; } catch (e) { }
 
-      this._windows[aWindow.__SSID].closedTabs.unshift(data);
-      let length = this._windows[aWindow.__SSID].closedTabs.length;
+      this._windows[aWindow.__SSID]._closedTabs.unshift({ state: data });
+      let length = this._windows[aWindow.__SSID]._closedTabs.length;
       if (length > this._maxTabsUndo)
-        this._windows[aWindow.__SSID].closedTabs.splice(this._maxTabsUndo, length - this._maxTabsUndo);
+        this._windows[aWindow.__SSID]._closedTabs.splice(this._maxTabsUndo, length - this._maxTabsUndo);
     }
   },
 
@@ -577,21 +580,21 @@ SessionStore.prototype = {
     if (!aWindow || !aWindow.__SSID)
       return 0; // not a browser window, or not otherwise tracked by SS.
 
-    return this._windows[aWindow.__SSID].closedTabs.length;
+    return this._windows[aWindow.__SSID]._closedTabs.length;
   },
 
   getClosedTabData: function ss_getClosedTabData(aWindow) {
     if (!aWindow.__SSID)
       throw (Components.returnCode = Cr.NS_ERROR_INVALID_ARG);
 
-    return JSON.stringify(this._windows[aWindow.__SSID].closedTabs);
+    return JSON.stringify(this._windows[aWindow.__SSID]._closedTabs);
   },
 
   undoCloseTab: function ss_undoCloseTab(aWindow, aIndex) {
     if (!aWindow.__SSID)
       throw (Components.returnCode = Cr.NS_ERROR_INVALID_ARG);
 
-    let closedTabs = this._windows[aWindow.__SSID].closedTabs;
+    let closedTabs = this._windows[aWindow.__SSID]._closedTabs;
     if (!closedTabs)
       return null;
 
@@ -604,13 +607,13 @@ SessionStore.prototype = {
     let closedTab = closedTabs.splice(aIndex, 1).shift();
 
     // create a new tab and bring to front
-    let tab = aWindow.Browser.addTab(closedTab.entries[closedTab.index - 1].url, true);
+    let tab = aWindow.Browser.addTab(closedTab.state.entries[closedTab.state.index - 1].url, true);
 
     tab.browser.messageManager.sendAsyncMessage("WebNavigation:LoadURI", {
-      uri: closedTab.entries[closedTab.index - 1].url,
+      uri: closedTab.state.entries[closedTab.state.index - 1].url,
       flags: null,
-      entries: closedTab.entries,
-      index: closedTab.index
+      entries: closedTab.state.entries,
+      index: closedTab.state.index
     });
 
     // Put back the extra data
@@ -623,7 +626,7 @@ SessionStore.prototype = {
     if (!aWindow.__SSID)
       throw (Components.returnCode = Cr.NS_ERROR_INVALID_ARG);
 
-    let closedTabs = this._windows[aWindow.__SSID].closedTabs;
+    let closedTabs = this._windows[aWindow.__SSID]._closedTabs;
 
     // default to the most-recently closed tab
     aIndex = aIndex || 0;
@@ -723,6 +726,10 @@ SessionStore.prototype = {
 
         let tabs = data.windows[0].tabs;
         let selected = data.windows[0].selected;
+
+        if (data.windows[0]._closedTabs)
+          this._windows[window.__SSID]._closedTabs = data.windows[0]._closedTabs;
+
         if (selected > tabs.length) // Clamp the selected index if it's bogus
           selected = 1;
 
@@ -757,7 +764,7 @@ SessionStore.prototype = {
         }
     
         notifyObservers();
-      });
+      }.bind(this));
     } catch (ex) {
       Cu.reportError("SessionStore: Could not read from sessionstore.bak file: " + ex);
       notifyObservers("fail");

From 83724141f1f2f3413b1ca3b299b18cec006fa81d Mon Sep 17 00:00:00 2001
From: Kartikaya Gupta <kgupta@mozilla.com>
Date: Thu, 12 Dec 2013 17:13:55 -0500
Subject: [PATCH 172/459] Bug 948953 - Allow panning subdocuments in
 full-screen mode. r=Cwiiis

---
 mobile/android/base/gfx/JavaPanZoomController.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/gfx/JavaPanZoomController.java b/mobile/android/base/gfx/JavaPanZoomController.java
index 46bea55ef83c..a2380d2ec025 100644
--- a/mobile/android/base/gfx/JavaPanZoomController.java
+++ b/mobile/android/base/gfx/JavaPanZoomController.java
@@ -475,7 +475,7 @@ class JavaPanZoomController
 
         case TOUCHING:
             // Don't allow panning if there is an element in full-screen mode. See bug 775511.
-            if (mTarget.isFullScreen() || panDistance(event) < PAN_THRESHOLD) {
+            if ((mTarget.isFullScreen() && !mSubscroller.scrolling()) || panDistance(event) < PAN_THRESHOLD) {
                 return false;
             }
             cancelTouch();

From f5e2bec92f19259d4e23cdecd1ad8d9784b30634 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Thu, 28 Nov 2013 15:07:56 +0100
Subject: [PATCH 173/459] Bug 778011 - Re-enable some
 dom/imptests/html/dom/ranges/test_Range-xxx tests that were disabled on
 Android; r=edmorley

---
 testing/mochitest/android.json    | 8 --------
 testing/mochitest/androidx86.json | 8 --------
 2 files changed, 16 deletions(-)

diff --git a/testing/mochitest/android.json b/testing/mochitest/android.json
index c0f5a3227d04..41ff12af9b4d 100644
--- a/testing/mochitest/android.json
+++ b/testing/mochitest/android.json
@@ -129,14 +129,6 @@
  "dom/imptests/editing/conformancetest/test_runtest.html": "",
  "dom/imptests/editing/selecttest/test_addRange.html": "bug 775227",
  "dom/imptests/html/webgl": "WebGL",
- "dom/imptests/html/dom/ranges/test_Range-cloneContents.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-compareBoundaryPoints.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-deleteContents.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-extractContents.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-insertNode.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-mutations.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-set.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-surroundContents.html": "bug 775227",
  "dom/imptests/webapps/WebStorage/tests/submissions/Infraware/test_storage_local_key.html": "bug 775227",
  "dom/indexedDB/ipc/test_ipc.html": "bug 783513",
  "dom/indexedDB/test/test_third_party.html": "TIMED_OUT",
diff --git a/testing/mochitest/androidx86.json b/testing/mochitest/androidx86.json
index e24618aa0450..d093569dee54 100644
--- a/testing/mochitest/androidx86.json
+++ b/testing/mochitest/androidx86.json
@@ -206,14 +206,6 @@
  "dom/imptests/editing/conformancetest/test_runtest.html": "",
  "dom/imptests/editing/selecttest/test_addRange.html": "bug 775227",
  "dom/imptests/html/webgl": "WebGL",
- "dom/imptests/html/dom/ranges/test_Range-cloneContents.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-compareBoundaryPoints.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-deleteContents.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-extractContents.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-insertNode.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-mutations.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-set.html": "bug 775227",
- "dom/imptests/html/dom/ranges/test_Range-surroundContents.html": "bug 775227",
  "dom/imptests/webapps/WebStorage/tests/submissions/Infraware/test_storage_local_key.html": "bug 775227",
  "dom/indexedDB/ipc/test_ipc.html": "bug 783513",
  "dom/indexedDB/test/test_third_party.html": "TIMED_OUT",

From 3bc54353ff4b95e792a06e98838860522663c535 Mon Sep 17 00:00:00 2001
From: teodora vermesan <teodora.vermesan@softvision.ro>
Date: Thu, 21 Nov 2013 12:17:48 +0200
Subject: [PATCH 174/459] Bug 846340 - Robocop: Add test for 'Clear Site
 settings', 'Clear Saved passwords' and 'Clear history' options. r=gbrown

---
 mobile/android/base/tests/StringHelper.java   |  7 ++
 .../base/tests/testClearPrivateData.java      | 81 +++++++++++++++++--
 2 files changed, 82 insertions(+), 6 deletions(-)

diff --git a/mobile/android/base/tests/StringHelper.java b/mobile/android/base/tests/StringHelper.java
index f24e8b155360..2727cc8d5da6 100644
--- a/mobile/android/base/tests/StringHelper.java
+++ b/mobile/android/base/tests/StringHelper.java
@@ -52,6 +52,13 @@ public class StringHelper {
         "Add to Home Screen"
     };
 
+    public static final String[] CONTEXT_MENU_ITEMS_IN_URL_BAR = new String[] {
+        "Share",
+        "Copy Address",
+        "Edit Site Settings",
+        "Add to Home Screen"
+    };
+
     public static final String TITLE_PLACE_HOLDER = "Enter Search or Address";
 
     // Robocop page urls
diff --git a/mobile/android/base/tests/testClearPrivateData.java b/mobile/android/base/tests/testClearPrivateData.java
index 573db9c05e52..edbb22f3cae3 100644
--- a/mobile/android/base/tests/testClearPrivateData.java
+++ b/mobile/android/base/tests/testClearPrivateData.java
@@ -1,8 +1,17 @@
 package org.mozilla.gecko.tests;
-
+import android.view.View;
 import org.mozilla.gecko.*;
 import java.util.ArrayList;
 
+/**
+ * This patch tests the clear private data options:
+ * - clear history option by: adding and checking that clear private
+ * data option removes the history items but not the users bookmarks
+ * - clear site settings and clear saved password by: checking
+ * each option present in the doorhanger and clearing the settings from
+ * the URL bar context menu and settings menu
+ */
+
 public class testClearPrivateData extends PixelTest {
     private final int TEST_WAIT_MS = 10000;
 
@@ -14,21 +23,25 @@ public class testClearPrivateData extends PixelTest {
     public void testClearPrivateData() {
         blockForGeckoReady();
         clearHistory();
+        clearSiteSettings();
+        clearPassword();
     }
 
     private void clearHistory() {
+
         // Loading a page and adding a second one as bookmark to have user made bookmarks and history
         String blank1 = getAbsoluteUrl(StringHelper.ROBOCOP_BLANK_PAGE_01_URL);
         String blank2 = getAbsoluteUrl(StringHelper.ROBOCOP_BLANK_PAGE_02_URL);
-
-        loadAndPaint(blank1);
-        waitForText(StringHelper.ROBOCOP_BLANK_PAGE_01_TITLE);
-
+        String title = StringHelper.ROBOCOP_BLANK_PAGE_01_TITLE;
+        inputAndLoadUrl(blank1);
+        verifyPageTitle(title);
         mDatabaseHelper.addOrUpdateMobileBookmark(StringHelper.ROBOCOP_BLANK_PAGE_02_TITLE, blank2);
 
         // Checking that the history list is not empty
         verifyHistoryCount(1);
-        clearPrivateData();
+
+        //clear and check for device
+        checkDevice(title);
 
         // Checking that history list is empty
         verifyHistoryCount(0);
@@ -45,4 +58,60 @@ public class testClearPrivateData extends PixelTest {
         }, TEST_WAIT_MS);
         mAsserter.ok(match, "Checking that the number of history items is correct", String.valueOf(expectedCount) + " history items present in the database");
     }
+
+    public void clearSiteSettings() {
+        String shareStrings[] = {"Share your location with", "Share", "Don't share", "There are no settings to clear"};
+        String titleGeolocation = StringHelper.ROBOCOP_GEOLOCATION_TITLE;
+        String url = getAbsoluteUrl(StringHelper.ROBOCOP_GEOLOCATION_URL);
+        loadCheckDismiss(shareStrings[1], url, shareStrings[0]);
+        checkOption(shareStrings[1], "Clear");
+        checkOption(shareStrings[3], "Cancel");
+        loadCheckDismiss(shareStrings[2], url, shareStrings[0]);
+        checkOption(shareStrings[2], "Cancel");
+        checkDevice(titleGeolocation);
+    }
+
+    public void clearPassword(){
+        String passwordStrings[] = {"Save password", "Save", "Don't save"};
+        String title = StringHelper.ROBOCOP_BLANK_PAGE_01_TITLE;
+        String loginUrl = getAbsoluteUrl(StringHelper.ROBOCOP_LOGIN_URL);
+        loadCheckDismiss(passwordStrings[1], loginUrl, passwordStrings[0]);
+        checkOption(passwordStrings[1], "Clear");
+        loadCheckDismiss(passwordStrings[2], loginUrl, passwordStrings[0]);
+        checkDevice(title);
+    }
+
+    // clear private data and verify the device type because for phone there is an extra back action to exit the settings menu
+    public void checkDevice(String title) {
+        clearPrivateData();
+        if (mDevice.type.equals("phone")) {
+            mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+            mAsserter.ok(waitForText(StringHelper.PRIVACY_SECTION_LABEL), "waiting to perform one back", "one back");
+            mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+            verifyPageTitle(title);
+        }
+        else {
+            mActions.sendSpecialKey(Actions.SpecialKey.BACK);
+            verifyPageTitle(title);
+        }
+    }
+   
+    // Load a URL, verify that the doorhanger appears and dismiss it
+    public void loadCheckDismiss(String option, String url, String message) {
+        inputAndLoadUrl(url);
+        waitForText(message);
+        mAsserter.is(mSolo.searchText(message), true, "Doorhanger:" + message + " has been displayed");
+        mSolo.clickOnButton(option);
+        mAsserter.is(mSolo.searchText(message), false, "Doorhanger:" + message + " has been hidden");
+    }
+
+    //Verify if there are settings to be clear if so clear them from the URL bar context menu
+    public void checkOption(String option, String button) {
+        final View toolbarView = mSolo.getView("browser_toolbar");
+        mSolo.clickLongOnView(toolbarView);
+        mAsserter.ok(waitForText(StringHelper.CONTEXT_MENU_ITEMS_IN_URL_BAR[2]), "Waiting for the pop-up to open", "Pop up was openend");
+        mSolo.clickOnText(StringHelper.CONTEXT_MENU_ITEMS_IN_URL_BAR[2]);
+        mAsserter.ok(waitForText(option), "Verify that the option: " + option + " is in the list", "The option is in the list. There are settings to clear");
+        mSolo.clickOnButton(button);
+    }
 }

From 69acf977330b913df6c3fecf8620a6388ab860c8 Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Sat, 14 Dec 2013 15:30:00 -0500
Subject: [PATCH 175/459] Bug 863872 - If we have overdue TelemetryPings, try
 to send them all. r=nfroyd, feedback=irving.

---
 .../components/telemetry/TelemetryFile.jsm    |  75 ++++-
 toolkit/components/telemetry/TelemetryPing.js |  26 +-
 .../tests/unit/test_TelemetryPing.js          |   4 +-
 .../tests/unit/test_TelemetrySendOldPings.js  | 265 ++++++++++++++++++
 .../telemetry/tests/unit/xpcshell.ini         |   2 +
 5 files changed, 353 insertions(+), 19 deletions(-)
 create mode 100644 toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js

diff --git a/toolkit/components/telemetry/TelemetryFile.jsm b/toolkit/components/telemetry/TelemetryFile.jsm
index 7a21d5c2fd4e..8db9eb815b58 100644
--- a/toolkit/components/telemetry/TelemetryFile.jsm
+++ b/toolkit/components/telemetry/TelemetryFile.jsm
@@ -22,8 +22,13 @@ const PR_EXCL = 0x80;
 const RW_OWNER = parseInt("0600", 8);
 const RWX_OWNER = parseInt("0700", 8);
 
-// Delete ping files that have been lying around for longer than this.
-const MAX_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
+// Files that have been lying around for longer than MAX_PING_FILE_AGE are
+// deleted without being loaded.
+const MAX_PING_FILE_AGE = 14 * 24 * 60 * 60 * 1000; // 2 weeks
+
+// Files that are older than OVERDUE_PING_FILE_AGE, but younger than
+// MAX_PING_FILE_AGE indicate that we need to send all of our pings ASAP.
+const OVERDUE_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
 
 // The number of outstanding saved pings that we have issued loading
 // requests for.
@@ -32,6 +37,14 @@ let pingsLoaded = 0;
 // The number of those requests that have actually completed.
 let pingLoadsCompleted = 0;
 
+// The number of pings that we have destroyed due to being older
+// than MAX_PING_FILE_AGE.
+let pingsDiscarded = 0;
+
+// The number of pings that are older than OVERDUE_PING_FILE_AGE
+// but younger than MAX_PING_FILE_AGE.
+let pingsOverdue = 0;
+
 // If |true|, send notifications "telemetry-test-save-complete"
 // and "telemetry-test-load-complete" once save/load is complete.
 let shouldNotifyUponSave = false;
@@ -41,6 +54,14 @@ let pendingPings = [];
 
 this.TelemetryFile = {
 
+  get MAX_PING_FILE_AGE() {
+    return MAX_PING_FILE_AGE;
+  },
+
+  get OVERDUE_PING_FILE_AGE() {
+    return OVERDUE_PING_FILE_AGE;
+  },
+
   /**
    * Save a single ping to a file.
    *
@@ -142,7 +163,7 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadSavedPings: function(sync, onLoad = null) {
+  loadSavedPings: function(sync, onLoad = null, onDone = null) {
     let directory = ensurePingDirectory();
     let entries = directory.directoryEntries
                            .QueryInterface(Ci.nsIDirectoryEnumerator);
@@ -150,7 +171,7 @@ this.TelemetryFile = {
     pingLoadsCompleted = 0;
     try {
       while (entries.hasMoreElements()) {
-        this.loadHistograms(entries.nextFile, sync, onLoad);
+        this.loadHistograms(entries.nextFile, sync, onLoad, onDone);
       }
     } finally {
       entries.close();
@@ -169,20 +190,26 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadHistograms: function loadHistograms(file, sync, onLoad = null) {
-    let now = new Date();
+  loadHistograms: function loadHistograms(file, sync, onLoad = null, onDone = null) {
+    let now = Date.now();
     if (now - file.lastModifiedTime > MAX_PING_FILE_AGE) {
       // We haven't had much luck in sending this file; delete it.
       file.remove(true);
+      pingsDiscarded++;
       return;
     }
 
+    // This file is a bit stale, and overdue for sending.
+    if (now - file.lastModifiedTime > OVERDUE_PING_FILE_AGE) {
+      pingsOverdue++;
+    }
+
     pingsLoaded++;
     if (sync) {
       let stream = Cc["@mozilla.org/network/file-input-stream;1"]
                    .createInstance(Ci.nsIFileInputStream);
       stream.init(file, -1, -1, 0);
-      addToPendingPings(file, stream, onLoad);
+      addToPendingPings(file, stream, onLoad, onDone);
     } else {
       let channel = NetUtil.newChannel(file);
       channel.contentType = "application/json";
@@ -191,7 +218,7 @@ this.TelemetryFile = {
         if (!Components.isSuccessCode(result)) {
           return;
         }
-        addToPendingPings(file, stream, onLoad);
+        addToPendingPings(file, stream, onLoad, onDone);
       }).bind(this));
     }
   },
@@ -203,6 +230,22 @@ this.TelemetryFile = {
     return pingsLoaded;
   },
 
+  /**
+   * The number of pings loaded that are older than OVERDUE_PING_FILE_AGE
+   * but younger than MAX_PING_FILE_AGE.
+   */
+  get pingsOverdue() {
+    return pingsOverdue;
+  },
+
+  /**
+   * The number of pings that we just tossed out for being older than
+   * MAX_PING_FILE_AGE.
+   */
+  get pingsDiscarded() {
+    return pingsDiscarded;
+  },
+
   /**
    * Iterate destructively through the pending pings.
    *
@@ -249,7 +292,7 @@ function ensurePingDirectory() {
   return directory;
 };
 
-function addToPendingPings(file, stream, onLoad) {
+function addToPendingPings(file, stream, onLoad, onDone) {
   let success = false;
 
   try {
@@ -263,19 +306,25 @@ function addToPendingPings(file, stream, onLoad) {
     }
     pingLoadsCompleted++;
     pendingPings.push(ping);
-    if (shouldNotifyUponSave &&
-        pingLoadsCompleted == pingsLoaded) {
-      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
-    }
     success = true;
   } catch (e) {
     // An error reading the file, or an error parsing the contents.
     stream.close();           // close is idempotent.
     file.remove(true); // FIXME: Should be false, isn't it?
   }
+
   if (onLoad) {
     onLoad(success);
   }
+
+  if (pingLoadsCompleted == pingsLoaded) {
+    if (onDone) {
+      onDone();
+    }
+    if (shouldNotifyUponSave) {
+      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
+    }
+  }
 };
 
 function finishTelemetrySave(ok, stream) {
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index 6a34661fb0e0..b265432610ac 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -39,6 +39,8 @@ const PREF_PREVIOUS_BUILDID = PREF_BRANCH + "previousBuildID";
 const TELEMETRY_INTERVAL = 60000;
 // Delay before intializing telemetry (ms)
 const TELEMETRY_DELAY = 60000;
+// Delay before initializing telemetry if we're testing (ms)
+const TELEMETRY_TEST_DELAY = 100;
 
 // Seconds of idle time before pinging.
 // On idle-daily a gather-telemetry notification is fired, during it probes can
@@ -218,6 +220,9 @@ TelemetryPing.prototype = {
       ret.savedPings = TelemetryFile.pingsLoaded;
     }
 
+    ret.pingsOverdue = TelemetryFile.pingsOverdue;
+    ret.pingsDiscarded = TelemetryFile.pingsDiscarded;
+
     return ret;
   },
 
@@ -598,7 +603,9 @@ TelemetryPing.prototype = {
 
   popPayloads: function popPayloads(reason) {
     function payloadIter() {
-      yield this.getSessionPayloadAndSlug(reason);
+      if (reason != "overdue-flush") {
+        yield this.getSessionPayloadAndSlug(reason);
+      }
       let iterator = TelemetryFile.popPendingPings(reason);
       for (let data of iterator) {
         yield data;
@@ -760,7 +767,7 @@ TelemetryPing.prototype = {
   /**
    * Initializes telemetry within a timer. If there is no PREF_SERVER set, don't turn on telemetry.
    */
-  setup: function setup() {
+  setup: function setup(aTesting) {
     // Initialize some probes that are kept in their own modules
     this._thirdPartyCookies = new ThirdPartyCookieProbe();
     this._thirdPartyCookies.init();
@@ -823,7 +830,17 @@ TelemetryPing.prototype = {
         {
           let success_histogram = Telemetry.getHistogramById("READ_SAVED_PING_SUCCESS");
           success_histogram.add(success);
-        }));
+        }), () =>
+        {
+          // If we have any TelemetryPings lying around, we'll be aggressive
+          // and try to send them all off ASAP.
+          if (TelemetryFile.pingsOverdue > 0) {
+            // It doesn't really matter what we pass to this.send as a reason,
+            // since it's never sent to the server. All that this.send does with
+            // the reason is check to make sure it's not a test-ping.
+            this.send("overdue-flush", this._server);
+          }
+        });
       this.attachObservers();
       this.gatherMemory();
 
@@ -831,7 +848,8 @@ TelemetryPing.prototype = {
       });
       delete this._timer;
     }
-    this._timer.initWithCallback(timerCallback.bind(this), TELEMETRY_DELAY,
+    this._timer.initWithCallback(timerCallback.bind(this),
+                                 aTesting ? TELEMETRY_TEST_DELAY : TELEMETRY_DELAY,
                                  Ci.nsITimer.TYPE_ONE_SHOT);
   },
 
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
index a9c70abaa70d..a7ecadcd8511 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
@@ -142,7 +142,7 @@ function decodeRequestPayload(request) {
     let observer = {
       buffer: "",
       onStreamComplete: function(loader, context, status, length, result) {
-	this.buffer = String.fromCharCode.apply(this, result);
+        this.buffer = String.fromCharCode.apply(this, result);
       }
     };
 
@@ -363,7 +363,7 @@ function runOldPingFileTest() {
   do_check_true(histogramsFile.exists());
 
   let mtime = histogramsFile.lastModifiedTime;
-  histogramsFile.lastModifiedTime = mtime - 8 * 24 * 60 * 60 * 1000; // 8 days.
+  histogramsFile.lastModifiedTime = mtime - (14 * 24 * 60 * 60 * 1000 + 60000); // 14 days, 1m
   TelemetryPing.testLoadHistograms(histogramsFile, true);
   do_check_false(histogramsFile.exists());
 }
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js b/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
new file mode 100644
index 000000000000..f840563b0fe9
--- /dev/null
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
@@ -0,0 +1,265 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/
+
+/**
+ * This test case populates the profile with some fake stored
+ * pings, and checks that:
+ *
+ * 1) Pings that are considered "expired" are deleted and never sent.
+ * 2) Pings that are considered "overdue" trigger a send of all
+ *    overdue and recent pings.
+ */
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+
+// Get the TelemetryPing definitions directly so we can test it without going through xpcom.
+// That gives us Cc, Ci, Cr and Cu, as well as a number of consts like PREF_ENABLED,
+// and PREF_SERVER.
+Services.scriptloader.loadSubScript("resource://gre/components/TelemetryPing.js");
+
+Cu.import("resource://testing-common/httpd.js");
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/TelemetryFile.jsm");
+
+// We increment TelemetryFile's MAX_PING_FILE_AGE and
+// OVERDUE_PING_FILE_AGE by 1ms so that our test pings exceed
+// those points in time.
+const EXPIRED_PING_FILE_AGE = TelemetryFile.MAX_PING_FILE_AGE + 1;
+const OVERDUE_PING_FILE_AGE = TelemetryFile.OVERDUE_PING_FILE_AGE + 1;
+
+const PING_SAVE_FOLDER = "saved-telemetry-pings";
+const PING_TIMEOUT_LENGTH = 5000;
+const EXPIRED_PINGS = 5;
+const OVERDUE_PINGS = 6;
+const RECENT_PINGS = 4;
+
+const TOTAL_EXPECTED_PINGS = OVERDUE_PINGS + RECENT_PINGS;
+
+let gHttpServer = new HttpServer();
+let gCreatedPings = 0;
+let gSeenPings = 0;
+
+/**
+ * Creates some TelemetryPings for the current session and
+ * saves them to disk. Each ping gets a unique ID slug based on
+ * an incrementor.
+ *
+ * @param aNum the number of pings to create.
+ * @param aAge the age in milliseconds to offset from now. A value
+ *             of 10 would make the ping 10ms older than now, for
+ *             example.
+ * @returns an Array with the created pings.
+ */
+function createSavedPings(aNum, aAge) {
+  // Create a TelemetryPing service that we can generate payloads from.
+  // Luckily, the TelemetryPing constructor does nothing that we need to
+  // clean up.
+  let pingService = new TelemetryPing();
+  let pings = [];
+  let age = Date.now() - aAge;
+  for (let i = 0; i < aNum; ++i) {
+    let payload = pingService.getPayload();
+    let ping = { slug: "test-ping-" + gCreatedPings, reason: "test", payload: payload };
+    TelemetryFile.savePing(ping);
+    if (aAge) {
+      // savePing writes to the file synchronously, so we're good to
+      // modify the lastModifedTime now.
+      let file = getSaveFileForPing(ping);
+      file.lastModifiedTime = age;
+    }
+    gCreatedPings++;
+    pings.push(ping);
+  }
+  return pings;
+}
+
+/**
+ * Deletes locally saved pings in aPings if they
+ * exist.
+ *
+ * @param aPings an Array of pings to delete.
+ */
+function clearPings(aPings) {
+  for (let ping of aPings) {
+    let file = getSaveFileForPing(ping);
+    if (file.exists()) {
+      file.remove(false);
+    }
+  }
+}
+
+/**
+ * Returns a handle for the file that aPing should be
+ * stored in locally.
+ *
+ * @returns nsILocalFile
+ */
+function getSaveFileForPing(aPing) {
+  let file = Services.dirsvc.get("ProfD", Ci.nsILocalFile).clone();
+  file.append(PING_SAVE_FOLDER);
+  file.append(aPing.slug);
+  return file;
+}
+
+/**
+ * Wait for PING_TIMEOUT_LENGTH ms, and make sure we didn't receive
+ * TelemetryPings in that time.
+ *
+ * @returns Promise
+ */
+function assertReceivedNoPings() {
+  let deferred = Promise.defer();
+
+  do_timeout(PING_TIMEOUT_LENGTH, function() {
+    if (gSeenPings > 0) {
+      deferred.reject();
+    } else {
+      deferred.resolve();
+    }
+  });
+
+  return deferred.promise;
+}
+
+/**
+ * Returns a Promise that rejects if the number of TelemetryPings
+ * received by the HttpServer is not equal to aExpectedNum.
+ *
+ * @param aExpectedNum the number of pings we expect to receive.
+ * @returns Promise
+ */
+function assertReceivedPings(aExpectedNum) {
+  let deferred = Promise.defer();
+
+  do_timeout(PING_TIMEOUT_LENGTH, function() {
+    if (gSeenPings == aExpectedNum) {
+      deferred.resolve();
+    } else {
+      deferred.reject("Saw " + gSeenPings + " TelemetryPings, " +
+                      "but expected " + aExpectedNum);
+    }
+  })
+
+  return deferred.promise;
+}
+
+/**
+ * Throws if any pings in aPings is saved locally.
+ *
+ * @param aPings an Array of pings to check.
+ */
+function assertNotSaved(aPings) {
+  let saved = 0;
+  for (let ping of aPings) {
+    let file = getSaveFileForPing(ping);
+    if (file.exists()) {
+      saved++;
+    }
+  }
+  if (saved > 0) {
+    do_throw("Found " + saved + " unexpected saved pings.");
+  }
+}
+
+/**
+ * Our handler function for the HttpServer that simply
+ * increments the gSeenPings global when it successfully
+ * receives and decodes a TelemetryPing payload.
+ *
+ * @param aRequest the HTTP request sent from HttpServer.
+ */
+function pingHandler(aRequest) {
+  gSeenPings++;
+}
+
+/**
+ * Returns a Promise that resolves when gHttpServer has been
+ * successfully shut down.
+ *
+ * @returns Promise
+ */
+function stopHttpServer() {
+  let deferred = Promise.defer();
+  gHttpServer.stop(function() {
+    deferred.resolve();
+  })
+  return deferred.promise;
+}
+
+/**
+ * Teardown a TelemetryPing instance and clear out any pending
+ * pings to put as back in the starting state.
+ */
+function resetTelemetry(aPingService) {
+  aPingService.uninstall();
+  // Quick and dirty way to clear TelemetryFile's pendingPings
+  // collection, and put it back in its initial state.
+  let gen = TelemetryFile.popPendingPings();
+  for (let item of gen) {};
+}
+
+/**
+ * Creates and returns a TelemetryPing instance in "testing"
+ * mode.
+ */
+function startTelemetry() {
+  let service = new TelemetryPing();
+  service.setup(true);
+  return service;
+}
+
+function run_test() {
+  gHttpServer.registerPrefixHandler("/submit/telemetry/", pingHandler);
+  gHttpServer.start(-1);
+  do_get_profile();
+  Services.prefs.setBoolPref(PREF_ENABLED, true);
+  Services.prefs.setCharPref(PREF_SERVER,
+                             "http://localhost:" + gHttpServer.identity.primaryPort);
+  run_next_test();
+}
+
+/**
+ * Test that pings that are considered too old are just chucked out
+ * immediately and never sent.
+ */
+add_task(function test_expired_pings_are_deleted() {
+  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
+  let pingService = startTelemetry();
+  yield assertReceivedNoPings();
+  assertNotSaved(expiredPings);
+  resetTelemetry(pingService);
+})
+
+/**
+ * Test that really recent pings are not sent on Telemetry initialization.
+ */
+add_task(function test_recent_pings_not_sent() {
+  let recentPings = createSavedPings(RECENT_PINGS);
+  let pingService = startTelemetry();
+  yield assertReceivedNoPings();
+  resetTelemetry(pingService);
+  clearPings(recentPings);
+});
+
+/**
+ * Create some recent, expired and overdue pings. The overdue pings should
+ * trigger a send of all recent and overdue pings, but the expired pings
+ * should just be deleted.
+ */
+add_task(function test_overdue_pings_trigger_send() {
+  let recentPings = createSavedPings(RECENT_PINGS);
+  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
+  let overduePings = createSavedPings(OVERDUE_PINGS, OVERDUE_PING_FILE_AGE);
+
+  let pingService = startTelemetry();
+  yield assertReceivedPings(TOTAL_EXPECTED_PINGS);
+
+  assertNotSaved(recentPings);
+  assertNotSaved(expiredPings);
+  assertNotSaved(overduePings);
+  resetTelemetry(pingService);
+})
+
+add_task(function teardown() {
+  yield stopHttpServer();
+});
diff --git a/toolkit/components/telemetry/tests/unit/xpcshell.ini b/toolkit/components/telemetry/tests/unit/xpcshell.ini
index 339219fedcdc..5a0d1b138cd3 100644
--- a/toolkit/components/telemetry/tests/unit/xpcshell.ini
+++ b/toolkit/components/telemetry/tests/unit/xpcshell.ini
@@ -12,3 +12,5 @@ tail =
 [test_TelemetryStopwatch.js]
 [test_TelemetryPingBuildID.js]
 [test_ThirdPartyCookieProbe.js]
+[test_TelemetrySendOldPings.js]
+skip-if = debug == true

From 735523245ece98fd56f706f2cf7415b02bb28466 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Sat, 14 Dec 2013 15:50:22 -0800
Subject: [PATCH 176/459] Bug 947632 - Assert that we don't sendSyncMessage
 while processing a CPOW request (r=dvander)

---
 ipc/glue/MessageChannel.cpp | 8 +++++++-
 ipc/glue/MessageChannel.h   | 8 ++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/ipc/glue/MessageChannel.cpp b/ipc/glue/MessageChannel.cpp
index 8bae180fe8b0..97cc482668c9 100644
--- a/ipc/glue/MessageChannel.cpp
+++ b/ipc/glue/MessageChannel.cpp
@@ -57,6 +57,7 @@ MessageChannel::MessageChannel(MessageListener *aListener)
     mPendingRPCReplies(0),
     mCurrentRPCTransaction(0),
     mDispatchingSyncMessage(false),
+    mDispatchingUrgentMessageCount(0),
     mRemoteStackDepthGuess(false),
     mSawInterruptOutMsg(false)
 {
@@ -416,6 +417,7 @@ MessageChannel::Send(Message* aMsg, Message* aReply)
 
     IPC_ASSERT(aMsg->is_sync(), "can only Send() sync messages here");
     IPC_ASSERT(!DispatchingSyncMessage(), "violation of sync handler invariant");
+    IPC_ASSERT(!DispatchingUrgentMessage(), "sync messages forbidden while handling urgent message");
     IPC_ASSERT(!AwaitingSyncReply(), "nested sync messages are not supported");
 
     AutoEnterPendingReply replies(mPendingSyncReplies);
@@ -937,7 +939,11 @@ MessageChannel::DispatchUrgentMessage(const Message& aMsg)
 
     Message *reply = nullptr;
 
-    if (!MaybeHandleError(mListener->OnCallReceived(aMsg, reply), "DispatchUrgentMessage")) {
+    mDispatchingUrgentMessageCount++;
+    Result rv = mListener->OnCallReceived(aMsg, reply);
+    mDispatchingUrgentMessageCount--;
+
+    if (!MaybeHandleError(rv, "DispatchUrgentMessage")) {
         delete reply;
         reply = new Message();
         reply->set_urgent();
diff --git a/ipc/glue/MessageChannel.h b/ipc/glue/MessageChannel.h
index ac76cc96dda7..0aaa2f45477d 100644
--- a/ipc/glue/MessageChannel.h
+++ b/ipc/glue/MessageChannel.h
@@ -384,6 +384,11 @@ class MessageChannel : HasResultCodes
         return mDispatchingSyncMessage;
     }
 
+    // Returns true if we're dispatching an urgent message's callback.
+    bool DispatchingUrgentMessage() const {
+        return mDispatchingUrgentMessageCount > 0;
+    }
+
     bool Connected() const;
 
   private:
@@ -576,6 +581,9 @@ class MessageChannel : HasResultCodes
     // Set while we are dispatching a synchronous message.
     bool mDispatchingSyncMessage;
 
+    // Count of the recursion depth of dispatching urgent messages.
+    size_t mDispatchingUrgentMessageCount;
+
     // Queue of all incoming messages, except for replies to sync and urgent
     // messages, which are delivered directly to mRecvd, and any pending urgent
     // incall, which is stored in mPendingUrgentRequest.

From f2123068c34a73e85d9a93d0d5de0a91e0444eb5 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Sat, 14 Dec 2013 15:51:11 -0800
Subject: [PATCH 177/459] Bug 947632 - Use sendRpcMessage during session store
 flush (r=ttaubert)

---
 .../sessionstore/content/content-sessionStore.js           | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/browser/components/sessionstore/content/content-sessionStore.js b/browser/components/sessionstore/content/content-sessionStore.js
index 74da0a69bcb4..54b95e3bcf9d 100644
--- a/browser/components/sessionstore/content/content-sessionStore.js
+++ b/browser/components/sessionstore/content/content-sessionStore.js
@@ -392,7 +392,12 @@ let MessageQueue = {
 
     let sync = options && options.sync;
     let startID = (options && options.id) || this._id;
-    let sendMessage = sync ? sendSyncMessage : sendAsyncMessage;
+
+    // We use sendRpcMessage in the sync case because we may have been called
+    // through a CPOW. RPC messages are the only synchronous messages that the
+    // child is allowed to send to the parent while it is handling a CPOW
+    // request.
+    let sendMessage = sync ? sendRpcMessage : sendAsyncMessage;
 
     let data = {};
     for (let [key, id] of this._lastUpdated) {

From 3f5d9fdd147c49ca66d21c25c8cb5ccfaf81e333 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sat, 14 Dec 2013 16:29:43 -0800
Subject: [PATCH 178/459] Bug 950118 - Don't allow the object metadata hook to
 reenter JS, r=jimb.

---
 js/src/builtin/TestingFunctions.cpp          | 55 +++++++++++++-------
 js/src/jit-test/tests/basic/metadata-hook.js | 48 ++++++-----------
 js/src/jsobjinlines.h                        | 11 ++--
 3 files changed, 59 insertions(+), 55 deletions(-)

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 8d1a8b1a91f2..5b2565a3db69 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -25,6 +25,7 @@
 #include "vm/ProxyObject.h"
 
 #include "jscntxtinlines.h"
+#include "jsobjinlines.h"
 
 using namespace js;
 using namespace JS;
@@ -988,22 +989,45 @@ js::testingFunc_inParallelSection(JSContext *cx, unsigned argc, jsval *vp)
     return true;
 }
 
-static const char *ObjectMetadataPropertyName = "__objectMetadataFunction__";
-
 static bool
 ShellObjectMetadataCallback(JSContext *cx, JSObject **pmetadata)
 {
-    RootedValue fun(cx);
-    if (!JS_GetProperty(cx, cx->global(), ObjectMetadataPropertyName, &fun))
+    RootedObject obj(cx, NewBuiltinClassInstance(cx, &JSObject::class_));
+    if (!obj)
         return false;
 
-    RootedValue rval(cx);
-    if (!Invoke(cx, UndefinedValue(), fun, 0, nullptr, &rval))
+    RootedObject stack(cx, NewDenseEmptyArray(cx));
+    if (!stack)
         return false;
 
-    if (rval.isObject())
-        *pmetadata = &rval.toObject();
+    static int createdIndex = 0;
+    createdIndex++;
 
+    if (!JS_DefineProperty(cx, obj, "index", Int32Value(createdIndex),
+                           JS_PropertyStub, JS_StrictPropertyStub, 0))
+    {
+        return false;
+    }
+
+    if (!JS_DefineProperty(cx, obj, "stack", ObjectValue(*stack),
+                           JS_PropertyStub, JS_StrictPropertyStub, 0))
+    {
+        return false;
+    }
+
+    int stackIndex = 0;
+    for (NonBuiltinScriptFrameIter iter(cx); !iter.done(); ++iter) {
+        if (iter.isFunctionFrame()) {
+            if (!JS_DefinePropertyById(cx, stack, INT_TO_JSID(stackIndex), ObjectValue(*iter.callee()),
+                                       JS_PropertyStub, JS_StrictPropertyStub, 0))
+            {
+                return false;
+            }
+            stackIndex++;
+        }
+    }
+
+    *pmetadata = obj;
     return true;
 }
 
@@ -1012,19 +1036,10 @@ SetObjectMetadataCallback(JSContext *cx, unsigned argc, jsval *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
+    bool enabled = argc ? ToBoolean(args[0]) : false;
+    SetObjectMetadataCallback(cx, enabled ? ShellObjectMetadataCallback : nullptr);
+
     args.rval().setUndefined();
-
-    if (argc == 0 || !args[0].isObject() || !args[0].toObject().is<JSFunction>()) {
-        if (!JS_DeleteProperty(cx, cx->global(), ObjectMetadataPropertyName))
-            return false;
-        js::SetObjectMetadataCallback(cx, nullptr);
-        return true;
-    }
-
-    if (!JS_DefineProperty(cx, cx->global(), ObjectMetadataPropertyName, args[0], nullptr, nullptr, 0))
-        return false;
-
-    js::SetObjectMetadataCallback(cx, ShellObjectMetadataCallback);
     return true;
 }
 
diff --git a/js/src/jit-test/tests/basic/metadata-hook.js b/js/src/jit-test/tests/basic/metadata-hook.js
index badac2decd77..ba467009c3a9 100644
--- a/js/src/jit-test/tests/basic/metadata-hook.js
+++ b/js/src/jit-test/tests/basic/metadata-hook.js
@@ -3,46 +3,32 @@ x = [1,2,3];
 setObjectMetadata(x, {y:0});
 assertEq(getObjectMetadata(x).y, 0);
 
-incallback = false;
-count = 0;
-
-function callback(obj) {
-    if (incallback)
-	return null;
-    incallback = true;
-    var res =
-      {
-        count: ++count,
-        location: Error().stack,
-        message: Error().message // no .message => Error.prototype.message => ""
-      };
-    incallback = false;
-    return res;
-}
-callback({});
-
-setObjectMetadataCallback(callback);
+setObjectMetadataCallback(true);
 
 function Foo() {
   this.x = 0;
   this.y = 1;
 }
 
-function f() {
-  w = new Foo();
-  x = [1,2,3];
-  y = [2,3,5];
-  z = {a:0,b:1};
+function hello() {
+  function there() {
+    w = new Foo();
+    x = [1,2,3];
+    y = [2,3,5];
+    z = {a:0,b:1};
+  }
+  callee = there;
+  callee();
 }
-f();
+hello();
 
-var wc = getObjectMetadata(w).count;
-var xc = getObjectMetadata(x).count;
-var yc = getObjectMetadata(y).count;
-var zc = getObjectMetadata(z).count;
+var wc = getObjectMetadata(w).index;
+var xc = getObjectMetadata(x).index;
+var yc = getObjectMetadata(y).index;
+var zc = getObjectMetadata(z).index;
 
 assertEq(xc > wc, true);
 assertEq(yc > xc, true);
 assertEq(zc > yc, true);
-assertEq(/\.js/.test(getObjectMetadata(x).location), true);
-assertEq(getObjectMetadata(x).message, "");
+assertEq(getObjectMetadata(x).stack[0], callee);
+assertEq(getObjectMetadata(x).stack[1], hello);
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index efa47d470594..71ca517b5689 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1047,15 +1047,18 @@ static JS_ALWAYS_INLINE bool
 NewObjectMetadata(ExclusiveContext *cxArg, JSObject **pmetadata)
 {
     // The metadata callback is invoked before each created object, except when
-    // analysis/compilation/parsing is active as the callback may reenter JS.
+    // analysis/compilation is active, to avoid recursion.
     JS_ASSERT(!*pmetadata);
     if (JSContext *cx = cxArg->maybeJSContext()) {
         if (JS_UNLIKELY((size_t)cx->compartment()->hasObjectMetadataCallback()) &&
-            !cx->compartment()->activeAnalysis &&
-            !cx->runtime()->mainThread.activeCompilations)
+            !cx->compartment()->activeAnalysis)
         {
             JS::DisableGenerationalGC(cx->runtime());
-            gc::AutoSuppressGC suppress(cx);
+
+            // Use AutoEnterAnalysis to prohibit both any GC activity under the
+            // callback, and any reentering of JS via Invoke() etc.
+            types::AutoEnterAnalysis enter(cx);
+
             bool status = cx->compartment()->callObjectMetadataCallback(cx, pmetadata);
             JS::EnableGenerationalGC(cx->runtime());
             return status;

From ecb06a8b95b2886895bcdd2e9f04a8cfa51d9b4f Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Sat, 14 Dec 2013 16:38:07 -0800
Subject: [PATCH 179/459] Bug 949747 - Use accessor methods for JSFunction
 fields, r=jandem.

---
 js/src/frontend/Parser.cpp        |  8 +--
 js/src/frontend/SharedContext.h   |  2 +-
 js/src/jit/AsmJS.cpp              |  4 +-
 js/src/jit/AsmJSLink.cpp          |  2 +-
 js/src/jit/BaselineBailouts.cpp   | 10 ++--
 js/src/jit/BaselineCompiler.cpp   |  2 +-
 js/src/jit/BaselineFrame.h        |  2 +-
 js/src/jit/BaselineFrameInfo.h    |  2 +-
 js/src/jit/BaselineIC.cpp         | 12 ++---
 js/src/jit/CodeGenerator.cpp      | 14 +++---
 js/src/jit/CompileInfo.h          |  4 +-
 js/src/jit/Ion.cpp                |  8 +--
 js/src/jit/IonBuilder.cpp         |  8 +--
 js/src/jit/IonFrameIterator.h     |  2 +-
 js/src/jit/IonFrames.cpp          |  8 +--
 js/src/jit/IonMacroAssembler.cpp  |  6 +--
 js/src/jit/IonMacroAssembler.h    | 12 ++---
 js/src/jit/MIR.h                  |  2 +-
 js/src/jit/arm/Trampoline-arm.cpp |  2 +-
 js/src/jit/x64/Trampoline-x64.cpp |  2 +-
 js/src/jit/x86/Trampoline-x86.cpp |  2 +-
 js/src/jsanalyze.h                |  2 +-
 js/src/jsapi.cpp                  |  2 +-
 js/src/jsfun.cpp                  | 44 +++++++++--------
 js/src/jsfun.h                    | 82 +++++++++++++++++++------------
 js/src/jsinfer.cpp                | 10 ++--
 js/src/jsinferinlines.h           |  2 +-
 js/src/jsopcode.cpp               |  4 +-
 js/src/vm/ArgumentsObject.cpp     |  8 +--
 js/src/vm/Debugger.cpp            | 12 ++---
 js/src/vm/Interpreter.cpp         |  2 +-
 js/src/vm/OldDebugAPI.cpp         |  2 +-
 js/src/vm/SelfHosting.cpp         |  4 +-
 js/src/vm/Stack-inl.h             |  2 +-
 js/src/vm/Stack.cpp               |  2 +-
 js/src/vm/Stack.h                 |  4 +-
 36 files changed, 160 insertions(+), 136 deletions(-)

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index b458d1cf67ea..41971fe98211 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -847,7 +847,7 @@ Parser<FullParseHandler>::standaloneFunctionBody(HandleFunction fun, const AutoN
                                          generatorKind);
     if (!funbox)
         return null();
-    funbox->length = fun->nargs - fun->hasRest();
+    funbox->length = fun->nargs() - fun->hasRest();
     handler.setFunctionBox(fn, funbox);
 
     ParseContext<FullParseHandler> funpc(this, pc, fn, funbox, newDirectives,
@@ -2212,7 +2212,7 @@ Parser<FullParseHandler>::standaloneLazyFunction(HandleFunction fun, unsigned st
                                          generatorKind);
     if (!funbox)
         return null();
-    funbox->length = fun->nargs - fun->hasRest();
+    funbox->length = fun->nargs() - fun->hasRest();
 
     Directives newDirectives = directives;
     ParseContext<FullParseHandler> funpc(this, /* parent = */ nullptr, pn, funbox,
@@ -2265,11 +2265,11 @@ Parser<ParseHandler>::functionArgsAndBodyGeneric(Node pn, HandleFunction fun, Fu
     if (hasRest)
         fun->setHasRest();
 
-    if (type == Getter && fun->nargs > 0) {
+    if (type == Getter && fun->nargs() > 0) {
         report(ParseError, false, null(), JSMSG_ACCESSOR_WRONG_ARGS, "getter", "no", "s");
         return false;
     }
-    if (type == Setter && fun->nargs != 1) {
+    if (type == Setter && fun->nargs() != 1) {
         report(ParseError, false, null(), JSMSG_ACCESSOR_WRONG_ARGS, "setter", "one", "");
         return false;
     }
diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h
index 36591f55e06f..9505a5a0392a 100644
--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -289,7 +289,7 @@ class FunctionBox : public ObjectBox, public SharedContext
                                              funCxFlags.definitelyNeedsArgsObj   = true; }
 
     bool hasDefaults() const {
-        return length != function()->nargs - function()->hasRest();
+        return length != function()->nargs() - function()->hasRest();
     }
 
     // Return whether this function has either specified "use asm" or is
diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index 01a05500dd00..58a170fa9bea 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -5967,14 +5967,14 @@ TryEnablingIon(JSContext *cx, AsmJSModule &module, HandleFunction fun, uint32_t
         return true;
 
     // Currently we can't rectify arguments. Therefore disabling if argc is too low.
-    if (fun->nargs > argc)
+    if (fun->nargs() > size_t(argc))
         return true;
 
     // Normally the types should corresond, since we just ran with those types,
     // but there are reports this is asserting. Therefore doing it as a check, instead of DEBUG only.
     if (!types::TypeScript::ThisTypes(script)->hasType(types::Type::UndefinedType()))
         return true;
-    for(uint32_t i = 0; i < fun->nargs; i++) {
+    for(uint32_t i = 0; i < fun->nargs(); i++) {
         types::StackTypeSet *typeset = types::TypeScript::ArgTypes(script, i);
         types::Type type = types::Type::DoubleType();
         if (!argv[i].isDouble())
diff --git a/js/src/jit/AsmJSLink.cpp b/js/src/jit/AsmJSLink.cpp
index eed158104541..7f86dfd930bc 100644
--- a/js/src/jit/AsmJSLink.cpp
+++ b/js/src/jit/AsmJSLink.cpp
@@ -682,7 +682,7 @@ JSFunction *
 js::NewAsmJSModuleFunction(ExclusiveContext *cx, JSFunction *origFun, HandleObject moduleObj)
 {
     RootedPropertyName name(cx, origFun->name());
-    JSFunction *moduleFun = NewFunction(cx, NullPtr(), LinkAsmJS, origFun->nargs,
+    JSFunction *moduleFun = NewFunction(cx, NullPtr(), LinkAsmJS, origFun->nargs(),
                                         JSFunction::NATIVE_FUN, NullPtr(), name,
                                         JSFunction::ExtendedFinalizeKind, TenuredObject);
     if (!moduleFun)
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index ff6b70468b37..688fcddbce52 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -624,7 +624,7 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
 
         JS_ASSERT(iter.slots() >= CountArgSlots(script, fun));
         IonSpew(IonSpew_BaselineBailouts, "      frame slots %u, nargs %u, nfixed %u",
-                iter.slots(), fun->nargs, script->nfixed());
+                iter.slots(), fun->nargs(), script->nfixed());
 
         if (!callerPC) {
             // This is the first frame. Store the formals in a Vector until we
@@ -633,11 +633,11 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
             // locals may still reference the original argument slot
             // (MParameter/LArgument) and expect the original Value.
             JS_ASSERT(startFrameFormals.empty());
-            if (!startFrameFormals.resize(fun->nargs))
+            if (!startFrameFormals.resize(fun->nargs()))
                 return false;
         }
 
-        for (uint32_t i = 0; i < fun->nargs; i++) {
+        for (uint32_t i = 0; i < fun->nargs(); i++) {
             Value arg = iter.read();
             IonSpew(IonSpew_BaselineBailouts, "      arg %d = %016llx",
                         (int) i, *((uint64_t *) &arg));
@@ -1108,7 +1108,7 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
 
     // If actualArgc >= fun->nargs, then we are done.  Otherwise, we need to push on
     // a reconstructed rectifier frame.
-    if (actualArgc >= calleeFun->nargs)
+    if (actualArgc >= calleeFun->nargs())
         return true;
 
     // Push a reconstructed rectifier frame.
@@ -1147,7 +1147,7 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
 #endif
 
     // Push undefined for missing arguments.
-    for (unsigned i = 0; i < (calleeFun->nargs - actualArgc); i++) {
+    for (unsigned i = 0; i < (calleeFun->nargs() - actualArgc); i++) {
         if (!builder.writeValue(UndefinedValue(), "FillerVal"))
             return false;
     }
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index cfdedd195c37..ee2e0ca761ec 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -668,7 +668,7 @@ BaselineCompiler::emitArgumentTypeChecks()
     if (!emitNonOpIC(compiler.getStub(&stubSpace_)))
         return false;
 
-    for (size_t i = 0; i < function()->nargs; i++) {
+    for (size_t i = 0; i < function()->nargs(); i++) {
         frame.pushArg(i);
         frame.popRegsAndSync(1);
 
diff --git a/js/src/jit/BaselineFrame.h b/js/src/jit/BaselineFrame.h
index d1a03a4a5b09..4db027ec1d92 100644
--- a/js/src/jit/BaselineFrame.h
+++ b/js/src/jit/BaselineFrame.h
@@ -182,7 +182,7 @@ class BaselineFrame
                              offsetOfNumActualArgs());
     }
     unsigned numFormalArgs() const {
-        return script()->function()->nargs;
+        return script()->function()->nargs();
     }
     Value &thisValue() const {
         return *(Value *)(reinterpret_cast<const uint8_t *>(this) +
diff --git a/js/src/jit/BaselineFrameInfo.h b/js/src/jit/BaselineFrameInfo.h
index 38527e969072..cd9f978d0cb5 100644
--- a/js/src/jit/BaselineFrameInfo.h
+++ b/js/src/jit/BaselineFrameInfo.h
@@ -182,7 +182,7 @@ class FrameInfo
         return script->nfixed();
     }
     uint32_t nargs() const {
-        return script->function()->nargs;
+        return script->function()->nargs();
     }
 
   private:
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index e12f63ccfe7c..00bb9956633f 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -4125,7 +4125,7 @@ ICGetElemNativeCompiler::emitCallScripted(MacroAssembler &masm, Register objReg)
 
     // Handle arguments underflow.
     Label noUnderflow;
-    masm.load16ZeroExtend(Address(callee, offsetof(JSFunction, nargs)), scratch);
+    masm.load16ZeroExtend(Address(callee, JSFunction::offsetOfNargs()), scratch);
     masm.branch32(Assembler::Equal, scratch, Imm32(0), &noUnderflow);
     {
         // Call the arguments rectifier.
@@ -6682,7 +6682,7 @@ ICGetProp_CallScripted::Compiler::generateStubCode(MacroAssembler &masm)
 
     // Handle arguments underflow.
     Label noUnderflow;
-    masm.load16ZeroExtend(Address(callee, offsetof(JSFunction, nargs)), scratch);
+    masm.load16ZeroExtend(Address(callee, JSFunction::offsetOfNargs()), scratch);
     masm.branch32(Assembler::Equal, scratch, Imm32(0), &noUnderflow);
     {
         // Call the arguments rectifier.
@@ -7591,7 +7591,7 @@ ICSetProp_CallScripted::Compiler::generateStubCode(MacroAssembler &masm)
 
     // Handle arguments underflow.
     Label noUnderflow;
-    masm.load16ZeroExtend(Address(callee, offsetof(JSFunction, nargs)), scratch);
+    masm.load16ZeroExtend(Address(callee, JSFunction::offsetOfNargs()), scratch);
     masm.branch32(Assembler::BelowOrEqual, scratch, Imm32(1), &noUnderflow);
     {
         // Call the arguments rectifier.
@@ -8538,7 +8538,7 @@ ICCallScriptedCompiler::generateStubCode(MacroAssembler &masm)
 
     // Handle arguments underflow.
     Label noUnderflow;
-    masm.load16ZeroExtend(Address(callee, offsetof(JSFunction, nargs)), callee);
+    masm.load16ZeroExtend(Address(callee, JSFunction::offsetOfNargs()), callee);
     masm.branch32(Assembler::AboveOrEqual, argcReg, callee, &noUnderflow);
     {
         // Call the arguments rectifier.
@@ -8794,7 +8794,7 @@ ICCall_ScriptedApplyArray::Compiler::generateStubCode(MacroAssembler &masm)
     masm.Push(scratch);
 
     // Load nargs into scratch for underflow check, and then load jitcode pointer into target.
-    masm.load16ZeroExtend(Address(target, offsetof(JSFunction, nargs)), scratch);
+    masm.load16ZeroExtend(Address(target, JSFunction::offsetOfNargs()), scratch);
     masm.loadPtr(Address(target, JSFunction::offsetOfNativeOrScript()), target);
     masm.loadBaselineOrIonRaw(target, target, SequentialExecution, nullptr);
 
@@ -8905,7 +8905,7 @@ ICCall_ScriptedApplyArguments::Compiler::generateStubCode(MacroAssembler &masm)
     masm.Push(scratch);
 
     // Load nargs into scratch for underflow check, and then load jitcode pointer into target.
-    masm.load16ZeroExtend(Address(target, offsetof(JSFunction, nargs)), scratch);
+    masm.load16ZeroExtend(Address(target, JSFunction::offsetOfNargs()), scratch);
     masm.loadPtr(Address(target, JSFunction::offsetOfNativeOrScript()), target);
     masm.loadBaselineOrIonRaw(target, target, SequentialExecution, nullptr);
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index f44cc6af8431..8dbe1e277efa 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -826,11 +826,11 @@ CodeGenerator::emitLambdaInit(const Register &output, const Register &scopeChain
         } s;
         uint32_t word;
     } u;
-    u.s.nargs = info.fun->nargs;
+    u.s.nargs = info.fun->nargs();
     u.s.flags = info.flags & ~JSFunction::EXTENDED;
 
-    JS_STATIC_ASSERT(offsetof(JSFunction, flags) == offsetof(JSFunction, nargs) + 2);
-    masm.store32(Imm32(u.word), Address(output, offsetof(JSFunction, nargs)));
+    JS_ASSERT(JSFunction::offsetOfFlags() == JSFunction::offsetOfNargs() + 2);
+    masm.store32(Imm32(u.word), Address(output, JSFunction::offsetOfNargs()));
     masm.storePtr(ImmGCPtr(info.scriptOrLazyScript),
                   Address(output, JSFunction::offsetOfNativeOrScript()));
     masm.storePtr(scopeChain, Address(output, JSFunction::offsetOfEnvironment()));
@@ -1953,7 +1953,7 @@ CodeGenerator::visitCallGeneric(LCallGeneric *call)
     masm.Push(Imm32(descriptor));
 
     // Check whether the provided arguments satisfy target argc.
-    masm.load16ZeroExtend(Address(calleereg, offsetof(JSFunction, nargs)), nargsreg);
+    masm.load16ZeroExtend(Address(calleereg, JSFunction::offsetOfNargs()), nargsreg);
     masm.cmp32(nargsreg, Imm32(call->numStackArgs()));
     masm.j(Assembler::Above, &thunk);
 
@@ -2045,7 +2045,7 @@ CodeGenerator::visitCallKnown(LCallKnown *call)
     // Native single targets are handled by LCallNative.
     JS_ASSERT(!target->isNative());
     // Missing arguments must have been explicitly appended by the IonBuilder.
-    JS_ASSERT(target->nargs <= call->numStackArgs());
+    JS_ASSERT(target->nargs() <= call->numStackArgs());
 
     JS_ASSERT_IF(call->mir()->isConstructing(), target->isInterpretedConstructor());
 
@@ -2285,11 +2285,11 @@ CodeGenerator::visitApplyArgsGeneric(LApplyArgsGeneric *apply)
 
         // Check whether the provided arguments satisfy target argc.
         if (!apply->hasSingleTarget()) {
-            masm.load16ZeroExtend(Address(calleereg, offsetof(JSFunction, nargs)), copyreg);
+            masm.load16ZeroExtend(Address(calleereg, JSFunction::offsetOfNargs()), copyreg);
             masm.cmp32(argcreg, copyreg);
             masm.j(Assembler::Below, &underflow);
         } else {
-            masm.cmp32(argcreg, Imm32(apply->getSingleTarget()->nargs));
+            masm.cmp32(argcreg, Imm32(apply->getSingleTarget()->nargs()));
             masm.j(Assembler::Below, &underflow);
         }
 
diff --git a/js/src/jit/CompileInfo.h b/js/src/jit/CompileInfo.h
index 29acd196f9f0..874ad1487ebf 100644
--- a/js/src/jit/CompileInfo.h
+++ b/js/src/jit/CompileInfo.h
@@ -37,7 +37,7 @@ CountArgSlots(JSScript *script, JSFunction *fun)
     // Slot x + n: Argument n.
 
     // Note: when updating this, please also update the assert in SnapshotWriter::startFrame
-    return StartArgSlot(script) + (fun ? fun->nargs + 1 : 0);
+    return StartArgSlot(script) + (fun ? fun->nargs() + 1 : 0);
 }
 
 // Contains information about the compilation source for IR being generated.
@@ -60,7 +60,7 @@ class CompileInfo
 
         nimplicit_ = StartArgSlot(script)                   /* scope chain and argument obj */
                    + (fun ? 1 : 0);                         /* this */
-        nargs_ = fun ? fun->nargs : 0;
+        nargs_ = fun ? fun->nargs() : 0;
         nlocals_ = script->nfixed();
         nstack_ = script->nslots() - script->nfixed();
         nslots_ = nimplicit_ + nargs_ + nlocals_ + nstack_;
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index c103cc61bd38..547c5363c848 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2018,7 +2018,7 @@ jit::CanEnter(JSContext *cx, RunState &state)
             return Method_CantCompile;
         }
 
-        if (TooManyArguments(invoke.args().callee().as<JSFunction>().nargs)) {
+        if (TooManyArguments(invoke.args().callee().as<JSFunction>().nargs())) {
             IonSpew(IonSpew_Abort, "too many args");
             ForbidCompilation(cx, script);
             return Method_CantCompile;
@@ -2165,7 +2165,7 @@ jit::CanEnterUsingFastInvoke(JSContext *cx, HandleScript script, uint32_t numAct
 
     // Don't handle arguments underflow, to make this work we would have to pad
     // missing arguments with |undefined|.
-    if (numActualArgs < script->function()->nargs)
+    if (numActualArgs < script->function()->nargs())
         return Method_Skipped;
 
     if (!cx->compartment()->ensureJitCompartmentExists(cx))
@@ -2226,7 +2226,7 @@ jit::SetEnterJitData(JSContext *cx, EnterJitData &data, RunState &state, AutoVal
 
     if (state.isInvoke()) {
         CallArgs &args = state.asInvoke()->args();
-        unsigned numFormals = state.script()->function()->nargs;
+        unsigned numFormals = state.script()->function()->nargs();
         data.constructing = state.asInvoke()->constructing();
         data.numActualArgs = args.length();
         data.maxArgc = Max(args.length(), numFormals) + 1;
@@ -2309,7 +2309,7 @@ jit::FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args)
     void *calleeToken = CalleeToToken(fun);
 
     RootedValue result(cx, Int32Value(args.length()));
-    JS_ASSERT(args.length() >= fun->nargs);
+    JS_ASSERT(args.length() >= fun->nargs());
 
     JSAutoResolveFlags rf(cx, RESOLVE_INFER);
     enter(jitcode, args.length() + 1, args.array() - 1, nullptr, calleeToken,
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 1293dfa3fb92..934654267982 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -361,7 +361,7 @@ IonBuilder::canInlineTarget(JSFunction *target, CallInfo &callInfo)
     if (!inlineScript->hasBaselineScript())
         return DontInline(inlineScript, "No baseline jitcode");
 
-    if (TooManyArguments(target->nargs))
+    if (TooManyArguments(target->nargs()))
         return DontInline(inlineScript, "Too many args");
 
     if (TooManyArguments(callInfo.argc()))
@@ -5136,12 +5136,12 @@ IonBuilder::testNeedsArgumentCheck(JSFunction *target, CallInfo &callInfo)
 
     if (!ArgumentTypesMatch(callInfo.thisArg(), types::TypeScript::ThisTypes(targetScript)))
         return true;
-    uint32_t expected_args = Min<uint32_t>(callInfo.argc(), target->nargs);
+    uint32_t expected_args = Min<uint32_t>(callInfo.argc(), target->nargs());
     for (size_t i = 0; i < expected_args; i++) {
         if (!ArgumentTypesMatch(callInfo.getArg(i), types::TypeScript::ArgTypes(targetScript, i)))
             return true;
     }
-    for (size_t i = callInfo.argc(); i < target->nargs; i++) {
+    for (size_t i = callInfo.argc(); i < target->nargs(); i++) {
         if (!types::TypeScript::ArgTypes(targetScript, i)->mightBeType(JSVAL_TYPE_UNDEFINED))
             return true;
     }
@@ -5162,7 +5162,7 @@ IonBuilder::makeCallHelper(JSFunction *target, CallInfo &callInfo, bool cloneAtC
     // Collect number of missing arguments provided that the target is
     // scripted. Native functions are passed an explicit 'argc' parameter.
     if (target && !target->isNative())
-        targetArgs = Max<uint32_t>(target->nargs, callInfo.argc());
+        targetArgs = Max<uint32_t>(target->nargs(), callInfo.argc());
 
     MCall *call =
         MCall::New(alloc(), target, targetArgs + 1, callInfo.argc(), callInfo.constructing());
diff --git a/js/src/jit/IonFrameIterator.h b/js/src/jit/IonFrameIterator.h
index 647aa693accf..f4f1727a92f3 100644
--- a/js/src/jit/IonFrameIterator.h
+++ b/js/src/jit/IonFrameIterator.h
@@ -398,7 +398,7 @@ class InlineFrameIteratorMaybeGC
             count = nactual - start;
 
         unsigned end = start + count;
-        unsigned nformal = callee()->nargs;
+        unsigned nformal = callee()->nargs();
 
         JS_ASSERT(start <= end && end <= nactual);
 
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index 8703f31e8ea9..45817f9b7607 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -1659,15 +1659,15 @@ InlineFrameIteratorMaybeGC<allowGC>::dump() const
                 fprintf(stderr, "  scope chain: ");
             else if (i == 1)
                 fprintf(stderr, "  this: ");
-            else if (i - 2 < callee()->nargs)
+            else if (i - 2 < callee()->nargs())
                 fprintf(stderr, "  formal (arg %d): ", i - 2);
             else {
-                if (i - 2 == callee()->nargs && numActualArgs() > callee()->nargs) {
-                    DumpOp d(callee()->nargs);
+                if (i - 2 == callee()->nargs() && numActualArgs() > callee()->nargs()) {
+                    DumpOp d(callee()->nargs());
                     forEachCanonicalActualArg(GetIonContext()->cx, d, d.i_, numActualArgs() - d.i_);
                 }
 
-                fprintf(stderr, "  slot %d: ", i - 2 - callee()->nargs);
+                fprintf(stderr, "  slot %d: ", int(i - 2 - callee()->nargs()));
             }
         } else
             fprintf(stderr, "  slot %u: ", i);
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 45c9c5f428fa..3185d7222c84 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -1780,8 +1780,8 @@ MacroAssembler::branchIfNotInterpretedConstructor(Register fun, Register scratch
 {
     // 16-bit loads are slow and unaligned 32-bit loads may be too so
     // perform an aligned 32-bit load and adjust the bitmask accordingly.
-    JS_STATIC_ASSERT(offsetof(JSFunction, nargs) % sizeof(uint32_t) == 0);
-    JS_STATIC_ASSERT(offsetof(JSFunction, flags) == offsetof(JSFunction, nargs) + 2);
+    JS_ASSERT(JSFunction::offsetOfNargs() % sizeof(uint32_t) == 0);
+    JS_ASSERT(JSFunction::offsetOfFlags() == JSFunction::offsetOfNargs() + 2);
     JS_STATIC_ASSERT(IS_LITTLE_ENDIAN);
 
     // Emit code for the following test:
@@ -1792,7 +1792,7 @@ MacroAssembler::branchIfNotInterpretedConstructor(Register fun, Register scratch
     // }
 
     // First, ensure it's a scripted function.
-    load32(Address(fun, offsetof(JSFunction, nargs)), scratch);
+    load32(Address(fun, JSFunction::offsetOfNargs()), scratch);
     branchTest32(Assembler::Zero, scratch, Imm32(JSFunction::INTERPRETED << 16), label);
 
     // Common case: if both IS_FUN_PROTO and SELF_HOSTED are not set,
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 4a03191b8973..35c9aaeb8fbe 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -490,20 +490,20 @@ class MacroAssembler : public MacroAssemblerSpecific
     void branchIfFunctionHasNoScript(Register fun, Label *label) {
         // 16-bit loads are slow and unaligned 32-bit loads may be too so
         // perform an aligned 32-bit load and adjust the bitmask accordingly.
-        JS_STATIC_ASSERT(offsetof(JSFunction, nargs) % sizeof(uint32_t) == 0);
-        JS_STATIC_ASSERT(offsetof(JSFunction, flags) == offsetof(JSFunction, nargs) + 2);
+        JS_ASSERT(JSFunction::offsetOfNargs() % sizeof(uint32_t) == 0);
+        JS_ASSERT(JSFunction::offsetOfFlags() == JSFunction::offsetOfNargs() + 2);
         JS_STATIC_ASSERT(IS_LITTLE_ENDIAN);
-        Address address(fun, offsetof(JSFunction, nargs));
+        Address address(fun, JSFunction::offsetOfNargs());
         uint32_t bit = JSFunction::INTERPRETED << 16;
         branchTest32(Assembler::Zero, address, Imm32(bit), label);
     }
     void branchIfInterpreted(Register fun, Label *label) {
         // 16-bit loads are slow and unaligned 32-bit loads may be too so
         // perform an aligned 32-bit load and adjust the bitmask accordingly.
-        JS_STATIC_ASSERT(offsetof(JSFunction, nargs) % sizeof(uint32_t) == 0);
-        JS_STATIC_ASSERT(offsetof(JSFunction, flags) == offsetof(JSFunction, nargs) + 2);
+        JS_ASSERT(JSFunction::offsetOfNargs() % sizeof(uint32_t) == 0);
+        JS_ASSERT(JSFunction::offsetOfFlags() == JSFunction::offsetOfNargs() + 2);
         JS_STATIC_ASSERT(IS_LITTLE_ENDIAN);
-        Address address(fun, offsetof(JSFunction, nargs));
+        Address address(fun, JSFunction::offsetOfNargs());
         uint32_t bit = JSFunction::INTERPRETED << 16;
         branchTest32(Assembler::NonZero, address, Imm32(bit), label);
     }
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 0f2344a7ca8a..5897e4fa1239 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -4939,7 +4939,7 @@ struct LambdaFunctionInfo
     bool useNewTypeForClone;
 
     LambdaFunctionInfo(JSFunction *fun)
-      : fun(fun), flags(fun->flags),
+      : fun(fun), flags(fun->flags()),
         scriptOrLazyScript(fun->hasScript()
                            ? (gc::Cell *) fun->nonLazyScript()
                            : (gc::Cell *) fun->lazyScript()),
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 6a7291338d3f..cde6631dba10 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -423,7 +423,7 @@ JitRuntime::generateArgumentsRectifier(JSContext *cx, ExecutionMode mode, void *
 
     // Load the number of |undefined|s to push into r6.
     masm.ma_ldr(DTRAddr(sp, DtrOffImm(IonRectifierFrameLayout::offsetOfCalleeToken())), r1);
-    masm.ma_ldrh(EDtrAddr(r1, EDtrOffImm(offsetof(JSFunction, nargs))), r6);
+    masm.ma_ldrh(EDtrAddr(r1, EDtrOffImm(JSFunction::offsetOfNargs())), r6);
 
     masm.ma_sub(r6, r8, r2);
 
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index 14348720e429..239bdbda8229 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -363,7 +363,7 @@ JitRuntime::generateArgumentsRectifier(JSContext *cx, ExecutionMode mode, void *
 
     // Load the number of |undefined|s to push into %rcx.
     masm.loadPtr(Address(rsp, IonRectifierFrameLayout::offsetOfCalleeToken()), rax);
-    masm.movzwl(Operand(rax, offsetof(JSFunction, nargs)), rcx);
+    masm.movzwl(Operand(rax, JSFunction::offsetOfNargs()), rcx);
     masm.subq(r8, rcx);
 
     // Copy the number of actual arguments
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index 2c6558ccee22..383d57b063c9 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -353,7 +353,7 @@ JitRuntime::generateArgumentsRectifier(JSContext *cx, ExecutionMode mode, void *
 
     // Load the number of |undefined|s to push into %ecx.
     masm.loadPtr(Address(esp, IonRectifierFrameLayout::offsetOfCalleeToken()), eax);
-    masm.movzwl(Operand(eax, offsetof(JSFunction, nargs)), ecx);
+    masm.movzwl(Operand(eax, JSFunction::offsetOfNargs()), ecx);
     masm.subl(esi, ecx);
 
     // Copy the number of actual arguments.
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index 90170513acf3..c4dbc12702d0 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -225,7 +225,7 @@ static inline uint32_t ArgSlot(uint32_t arg) {
     return 1 + arg;
 }
 static inline uint32_t LocalSlot(JSScript *script, uint32_t local) {
-    return 1 + (script->function() ? script->function()->nargs : 0) + local;
+    return 1 + (script->function() ? script->function()->nargs() : 0) + local;
 }
 static inline uint32_t TotalSlots(JSScript *script) {
     return LocalSlot(script, 0) + script->nfixed();
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index a731c49ca07e..8073ec4f366e 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4014,7 +4014,7 @@ JS_GetFunctionDisplayId(JSFunction *fun)
 JS_PUBLIC_API(uint16_t)
 JS_GetFunctionArity(JSFunction *fun)
 {
-    return fun->nargs;
+    return fun->nargs();
 }
 
 JS_PUBLIC_API(bool)
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index bf2fc7559750..9d1624cb3e43 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -302,7 +302,7 @@ js::fun_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
             if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
                 return false;
             uint16_t length = fun->hasScript() ? fun->nonLazyScript()->funLength() :
-                fun->nargs - fun->hasRest();
+                fun->nargs() - fun->hasRest();
             v.setInt32(length);
         } else {
             v.setString(fun->atom() == nullptr ? cx->runtime()->emptyString : fun->atom());
@@ -387,7 +387,7 @@ js::XDRInterpretedFunction(XDRState<mode> *xdr, HandleObject enclosingScope, Han
         if (!script)
             return false;
         atom = fun->atom();
-        flagsword = (fun->nargs << 16) | fun->flags;
+        flagsword = (fun->nargs() << 16) | fun->flags();
 
         if (!xdr->codeUint32(&firstword))
             return false;
@@ -419,14 +419,14 @@ js::XDRInterpretedFunction(XDRState<mode> *xdr, HandleObject enclosingScope, Han
         return false;
 
     if (mode == XDR_DECODE) {
-        fun->nargs = flagsword >> 16;
-        fun->flags = uint16_t(flagsword);
+        fun->setArgCount(flagsword >> 16);
+        fun->setFlags(uint16_t(flagsword));
         fun->initAtom(atom);
         fun->initScript(script);
         script->setFunction(fun);
         if (!JSFunction::setTypeForScriptedFunction(cx, fun))
             return false;
-        JS_ASSERT(fun->nargs == fun->nonLazyScript()->bindings.numArgs());
+        JS_ASSERT(fun->nargs() == fun->nonLazyScript()->bindings.numArgs());
         RootedScript script(cx, fun->nonLazyScript());
         CallNewScriptHook(cx, script, fun);
         objp.set(fun);
@@ -463,8 +463,8 @@ js::CloneFunctionAndScript(JSContext *cx, HandleObject enclosingScope, HandleFun
     if (!clonedScript)
         return nullptr;
 
-    clone->nargs = srcFun->nargs;
-    clone->flags = srcFun->flags;
+    clone->setArgCount(srcFun->nargs());
+    clone->setFlags(srcFun->flags());
     clone->initAtom(srcFun->displayAtom());
     clone->initScript(clonedScript);
     clonedScript->setFunction(clone);
@@ -717,9 +717,9 @@ js::FunctionToString(JSContext *cx, HandleFunction fun, bool bodyOnly, bool lamb
             ScopedJSDeletePtr<BindingVector> freeNames(localNames);
             if (!FillBindingVector(script, localNames))
                 return nullptr;
-            for (unsigned i = 0; i < fun->nargs; i++) {
+            for (unsigned i = 0; i < fun->nargs(); i++) {
                 if ((i && !out.append(", ")) ||
-                    (i == unsigned(fun->nargs - 1) && fun->hasRest() && !out.append("...")) ||
+                    (i == unsigned(fun->nargs() - 1) && fun->hasRest() && !out.append("...")) ||
                     !out.append((*localNames)[i].name())) {
                     return nullptr;
                 }
@@ -1124,8 +1124,8 @@ JSFunction::createScriptForLazilyInterpretedFunction(JSContext *cx, HandleFuncti
         // THING_ROOT_LAZY_SCRIPT).
         AutoSuppressGC suppressGC(cx);
 
-        fun->flags &= ~INTERPRETED_LAZY;
-        fun->flags |= INTERPRETED;
+        fun->flags_ &= ~INTERPRETED_LAZY;
+        fun->flags_ |= INTERPRETED;
 
         RootedScript script(cx, lazy->maybeScript());
 
@@ -1333,7 +1333,7 @@ js_fun_bind(JSContext *cx, HandleObject target, HandleValue thisArg,
     /* Steps 15-16. */
     unsigned length = 0;
     if (target->is<JSFunction>()) {
-        unsigned nargs = target->as<JSFunction>().nargs;
+        unsigned nargs = target->as<JSFunction>().nargs();
         if (nargs > argslen)
             length = nargs - argslen;
     }
@@ -1662,9 +1662,12 @@ js::NewFunctionWithProto(ExclusiveContext *cx, HandleObject funobjArg, Native na
     }
     RootedFunction fun(cx, &funobj->as<JSFunction>());
 
+    if (allocKind == JSFunction::ExtendedFinalizeKind)
+        flags = JSFunction::Flags(flags | JSFunction::EXTENDED);
+
     /* Initialize all function members. */
-    fun->nargs = uint16_t(nargs);
-    fun->flags = flags;
+    fun->setArgCount(uint16_t(nargs));
+    fun->setFlags(flags);
     if (fun->isInterpreted()) {
         JS_ASSERT(!native);
         fun->mutableScript().init(nullptr);
@@ -1674,10 +1677,8 @@ js::NewFunctionWithProto(ExclusiveContext *cx, HandleObject funobjArg, Native na
         JS_ASSERT(native);
         fun->initNative(native, nullptr);
     }
-    if (allocKind == JSFunction::ExtendedFinalizeKind) {
-        fun->flags |= JSFunction::EXTENDED;
+    if (allocKind == JSFunction::ExtendedFinalizeKind)
         fun->initializeExtended();
-    }
     fun->initAtom(atom);
 
     return fun;
@@ -1710,8 +1711,12 @@ js::CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
         return nullptr;
     RootedFunction clone(cx, &cloneobj->as<JSFunction>());
 
-    clone->nargs = fun->nargs;
-    clone->flags = fun->flags & ~JSFunction::EXTENDED;
+    uint16_t flags = fun->flags() & ~JSFunction::EXTENDED;
+    if (allocKind == JSFunction::ExtendedFinalizeKind)
+        flags |= JSFunction::EXTENDED;
+
+    clone->setArgCount(fun->nargs());
+    clone->setFlags(flags);
     if (fun->hasScript()) {
         clone->initScript(fun->nonLazyScript());
         clone->initEnvironment(parent);
@@ -1725,7 +1730,6 @@ js::CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
     clone->initAtom(fun->displayAtom());
 
     if (allocKind == JSFunction::ExtendedFinalizeKind) {
-        clone->flags |= JSFunction::EXTENDED;
         if (fun->isExtended() && fun->compartment() == cx->compartment()) {
             for (unsigned i = 0; i < FunctionExtended::NUM_EXTENDED_SLOTS; i++)
                 clone->initExtendedSlot(i, fun->getExtendedSlot(i));
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index df45c30e4f04..9638848e4aad 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -63,9 +63,10 @@ class JSFunction : public JSObject
                       "shadow interface must match actual interface");
     }
 
-    uint16_t        nargs;        /* number of formal arguments
+  private:
+    uint16_t        nargs_;       /* number of formal arguments
                                      (including defaults and the rest parameter unlike f.length) */
-    uint16_t        flags;        /* bitfield composed of the above Flags enum */
+    uint16_t        flags_;       /* bitfield composed of the above Flags enum */
     union U {
         class Native {
             friend class JSFunction;
@@ -85,7 +86,6 @@ class JSFunction : public JSObject
         } i;
         void            *nativeOrScript;
     } u;
-  private:
     js::HeapPtrAtom  atom_;       /* name for diagnostics and decompiling */
 
   public:
@@ -104,26 +104,36 @@ class JSFunction : public JSObject
                isGenerator();
     }
 
+    size_t nargs() const {
+        js::AutoThreadSafeAccess ts(this);
+        return nargs_;
+    }
+
+    uint16_t flags() const {
+        js::AutoThreadSafeAccess ts(this);
+        return flags_;
+    }
+
     /* A function can be classified as either native (C++) or interpreted (JS): */
-    bool isInterpreted()            const { return flags & (INTERPRETED | INTERPRETED_LAZY); }
+    bool isInterpreted()            const { return flags() & (INTERPRETED | INTERPRETED_LAZY); }
     bool isNative()                 const { return !isInterpreted(); }
 
     /* Possible attributes of a native function: */
-    bool isNativeConstructor()      const { return flags & NATIVE_CTOR; }
+    bool isNativeConstructor()      const { return flags() & NATIVE_CTOR; }
 
     /* Possible attributes of an interpreted function: */
-    bool isFunctionPrototype()      const { return flags & IS_FUN_PROTO; }
-    bool isInterpretedLazy()        const { return flags & INTERPRETED_LAZY; }
-    bool hasScript()                const { return flags & INTERPRETED; }
-    bool isExprClosure()            const { return flags & EXPR_CLOSURE; }
-    bool hasGuessedAtom()           const { return flags & HAS_GUESSED_ATOM; }
-    bool isLambda()                 const { return flags & LAMBDA; }
-    bool isSelfHostedBuiltin()      const { return flags & SELF_HOSTED; }
-    bool isSelfHostedConstructor()  const { return flags & SELF_HOSTED_CTOR; }
-    bool hasRest()                  const { return flags & HAS_REST; }
+    bool isFunctionPrototype()      const { return flags() & IS_FUN_PROTO; }
+    bool isInterpretedLazy()        const { return flags() & INTERPRETED_LAZY; }
+    bool hasScript()                const { return flags() & INTERPRETED; }
+    bool isExprClosure()            const { return flags() & EXPR_CLOSURE; }
+    bool hasGuessedAtom()           const { return flags() & HAS_GUESSED_ATOM; }
+    bool isLambda()                 const { return flags() & LAMBDA; }
+    bool isSelfHostedBuiltin()      const { return flags() & SELF_HOSTED; }
+    bool isSelfHostedConstructor()  const { return flags() & SELF_HOSTED_CTOR; }
+    bool hasRest()                  const { return flags() & HAS_REST; }
     bool isWrappable()              const {
-        JS_ASSERT_IF(flags & SH_WRAPPABLE, isSelfHostedBuiltin());
-        return flags & SH_WRAPPABLE;
+        JS_ASSERT_IF(flags() & SH_WRAPPABLE, isSelfHostedBuiltin());
+        return flags() & SH_WRAPPABLE;
     }
 
     bool hasJITCode() const {
@@ -144,7 +154,7 @@ class JSFunction : public JSObject
     //
     // isArrow() is true for all three of these Function objects.
     // isBoundFunction() is true only for the last one.
-    bool isArrow()                  const { return flags & ARROW; }
+    bool isArrow()                  const { return flags() & ARROW; }
 
     /* Compound attributes: */
     bool isBuiltin() const {
@@ -170,40 +180,48 @@ class JSFunction : public JSObject
         return nonLazyScript()->strict();
     }
 
+    void setFlags(uint16_t flags) {
+        this->flags_ = flags;
+    }
+
     // Can be called multiple times by the parser.
     void setArgCount(uint16_t nargs) {
-        this->nargs = nargs;
+        this->nargs_ = nargs;
     }
 
     // Can be called multiple times by the parser.
     void setHasRest() {
-        flags |= HAS_REST;
+        flags_ |= HAS_REST;
     }
 
     void setIsSelfHostedBuiltin() {
         JS_ASSERT(!isSelfHostedBuiltin());
-        flags |= SELF_HOSTED;
+        flags_ |= SELF_HOSTED;
     }
 
     void setIsSelfHostedConstructor() {
         JS_ASSERT(!isSelfHostedConstructor());
-        flags |= SELF_HOSTED_CTOR;
+        flags_ |= SELF_HOSTED_CTOR;
     }
 
     void makeWrappable() {
         JS_ASSERT(isSelfHostedBuiltin());
         JS_ASSERT(!isWrappable());
-        flags |= SH_WRAPPABLE;
+        flags_ |= SH_WRAPPABLE;
     }
 
     void setIsFunctionPrototype() {
         JS_ASSERT(!isFunctionPrototype());
-        flags |= IS_FUN_PROTO;
+        flags_ |= IS_FUN_PROTO;
     }
 
     // Can be called multiple times by the parser.
     void setIsExprClosure() {
-        flags |= EXPR_CLOSURE;
+        flags_ |= EXPR_CLOSURE;
+    }
+
+    void setArrow() {
+        flags_ |= ARROW;
     }
 
     JSAtom *atom() const { return hasGuessedAtom() ? nullptr : atom_.get(); }
@@ -216,7 +234,7 @@ class JSFunction : public JSObject
         JS_ASSERT(atom != nullptr);
         JS_ASSERT(!hasGuessedAtom());
         atom_ = atom;
-        flags |= HAS_GUESSED_ATOM;
+        flags_ |= HAS_GUESSED_ATOM;
     }
 
     /* uint16_t representation bounds number of call object dynamic slots. */
@@ -241,6 +259,8 @@ class JSFunction : public JSObject
         ((js::HeapPtrObject *)&u.i.env_)->init(obj);
     }
 
+    static inline size_t offsetOfNargs() { return offsetof(JSFunction, nargs_); }
+    static inline size_t offsetOfFlags() { return offsetof(JSFunction, flags_); }
     static inline size_t offsetOfEnvironment() { return offsetof(JSFunction, u.i.env_); }
     static inline size_t offsetOfAtom() { return offsetof(JSFunction, atom_); }
 
@@ -291,8 +311,8 @@ class JSFunction : public JSObject
             if (shadowZone()->needsBarrier())
                 js::LazyScript::writeBarrierPre(lazy);
 
-            flags &= ~INTERPRETED_LAZY;
-            flags |= INTERPRETED;
+            flags_ &= ~INTERPRETED_LAZY;
+            flags_ |= INTERPRETED;
             initScript(script);
         }
         JS_ASSERT(hasScript());
@@ -348,8 +368,8 @@ class JSFunction : public JSObject
 
     void initLazyScript(js::LazyScript *lazy) {
         JS_ASSERT(isInterpreted());
-        flags &= ~INTERPRETED;
-        flags |= INTERPRETED_LAZY;
+        flags_ &= ~INTERPRETED;
+        flags_ |= INTERPRETED_LAZY;
         u.i.s.lazy_ = lazy;
     }
 
@@ -426,8 +446,8 @@ class JSFunction : public JSObject
   public:
     inline bool isExtended() const {
         JS_STATIC_ASSERT(FinalizeKind != ExtendedFinalizeKind);
-        JS_ASSERT_IF(isTenured(), !!(flags & EXTENDED) == (tenuredGetAllocKind() == ExtendedFinalizeKind));
-        return !!(flags & EXTENDED);
+        JS_ASSERT_IF(isTenured(), !!(flags() & EXTENDED) == (tenuredGetAllocKind() == ExtendedFinalizeKind));
+        return !!(flags() & EXTENDED);
     }
 
     /*
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 51c19af54640..62a11ca76e3b 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -692,7 +692,7 @@ TypeScript::FreezeTypeSets(CompilerConstraintList *constraints, JSScript *script
     }
 
     *pThisTypes = types + (ThisTypes(script) - existing);
-    *pArgTypes = (script->function() && script->function()->nargs)
+    *pArgTypes = (script->function() && script->function()->nargs())
                  ? (types + (ArgTypes(script, 0) - existing))
                  : nullptr;
     *pBytecodeTypes = types;
@@ -972,7 +972,7 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
 
         if (!CheckFrozenTypeSet(cx, entry.thisTypes, types::TypeScript::ThisTypes(entry.script)))
             succeeded = false;
-        unsigned nargs = entry.script->function() ? entry.script->function()->nargs : 0;
+        unsigned nargs = entry.script->function() ? entry.script->function()->nargs() : 0;
         for (size_t i = 0; i < nargs; i++) {
             if (!CheckFrozenTypeSet(cx, &entry.argTypes[i], types::TypeScript::ArgTypes(entry.script, i)))
                 succeeded = false;
@@ -3354,7 +3354,7 @@ void
 types::TypeMonitorCallSlow(JSContext *cx, JSObject *callee, const CallArgs &args,
                            bool constructing)
 {
-    unsigned nargs = callee->as<JSFunction>().nargs;
+    unsigned nargs = callee->as<JSFunction>().nargs();
     JSScript *script = callee->as<JSFunction>().nonLazyScript();
 
     if (!constructing)
@@ -3505,7 +3505,7 @@ JSScript::makeTypes(JSContext *cx)
     InferSpew(ISpewOps, "typeSet: %sT%p%s this #%u",
               InferSpewColor(thisTypes), thisTypes, InferSpewColorReset(),
               id());
-    unsigned nargs = function() ? function()->nargs : 0;
+    unsigned nargs = function() ? function()->nargs() : 0;
     for (unsigned i = 0; i < nargs; i++) {
         TypeSet *types = TypeScript::ArgTypes(this, i);
         InferSpew(ISpewOps, "typeSet: %sT%p%s arg%u #%u",
@@ -4385,7 +4385,7 @@ TypeScript::printTypes(JSContext *cx, HandleScript script) const
     fprintf(stderr, "\n    this:");
     TypeScript::ThisTypes(script)->print();
 
-    for (unsigned i = 0; script->function() && i < script->function()->nargs; i++) {
+    for (unsigned i = 0; script->function() && i < script->function()->nargs(); i++) {
         fprintf(stderr, "\n    arg%u:", i);
         TypeScript::ArgTypes(script, i)->print();
     }
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index faad1f66ff62..5d6f7b38f608 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -617,7 +617,7 @@ TypeScript::ThisTypes(JSScript *script)
 /* static */ inline StackTypeSet *
 TypeScript::ArgTypes(JSScript *script, unsigned i)
 {
-    JS_ASSERT(i < script->function()->nargs);
+    JS_ASSERT(i < script->function()->nargs());
     return script->types->typeArray() + script->nTypeSets() + js::analyze::ArgSlot(i);
 }
 
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 91607c264f49..bc25ac46ddc6 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -410,7 +410,7 @@ class BytecodeParser
     }
 
     uint32_t numSlots() {
-        return 1 + (script_->function() ? script_->function()->nargs : 0) + script_->nfixed();
+        return 1 + (script_->function() ? script_->function()->nargs() : 0) + script_->nfixed();
     }
 
     uint32_t maximumStackDepth() {
@@ -1688,7 +1688,7 @@ JSAtom *
 ExpressionDecompiler::getVar(unsigned slot)
 {
     JS_ASSERT(fun);
-    slot += fun->nargs;
+    slot += fun->nargs();
     JS_ASSERT(slot < script->bindings.count());
     return (*localNames)[slot].name();
 }
diff --git a/js/src/vm/ArgumentsObject.cpp b/js/src/vm/ArgumentsObject.cpp
index 31673b20cbe9..2076216cec16 100644
--- a/js/src/vm/ArgumentsObject.cpp
+++ b/js/src/vm/ArgumentsObject.cpp
@@ -96,7 +96,7 @@ struct CopyIonJSFrameArgs
 
     void copyArgs(JSContext *, HeapValue *dstBase, unsigned totalArgs) const {
         unsigned numActuals = frame_->numActualArgs();
-        unsigned numFormals = jit::CalleeTokenToFunction(frame_->calleeToken())->nargs;
+        unsigned numFormals = jit::CalleeTokenToFunction(frame_->calleeToken())->nargs();
         JS_ASSERT(numActuals <= totalArgs);
         JS_ASSERT(numFormals <= totalArgs);
         JS_ASSERT(Max(numActuals, numFormals) == totalArgs);
@@ -144,7 +144,7 @@ struct CopyScriptFrameIterArgs
 
         /* Define formals which are not part of the actuals. */
         unsigned numActuals = iter_.numActualArgs();
-        unsigned numFormals = iter_.callee()->nargs;
+        unsigned numFormals = iter_.callee()->nargs();
         JS_ASSERT(numActuals <= totalArgs);
         JS_ASSERT(numFormals <= totalArgs);
         JS_ASSERT(Max(numActuals, numFormals) == totalArgs);
@@ -192,7 +192,7 @@ ArgumentsObject::create(JSContext *cx, HandleScript script, HandleFunction calle
     if (!shape)
         return nullptr;
 
-    unsigned numFormals = callee->nargs;
+    unsigned numFormals = callee->nargs();
     unsigned numDeletedWords = NumWordsForBitArrayOfLength(numActuals);
     unsigned numArgs = Max(numActuals, numFormals);
     unsigned numBytes = offsetof(ArgumentsData, args) +
@@ -341,7 +341,7 @@ ArgSetter(JSContext *cx, HandleObject obj, HandleId id, bool strict, MutableHand
         unsigned arg = unsigned(JSID_TO_INT(id));
         if (arg < argsobj.initialLength() && !argsobj.isElementDeleted(arg)) {
             argsobj.setElement(cx, arg, vp);
-            if (arg < script->function()->nargs)
+            if (arg < script->function()->nargs())
                 types::TypeScript::SetArgument(cx, script, arg, vp);
             return true;
         }
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index a188f2d5c382..ed23898292ba 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -4720,23 +4720,23 @@ DebuggerObject_getParameterNames(JSContext *cx, unsigned argc, Value *vp)
         return true;
     }
 
-    RootedObject result(cx, NewDenseAllocatedArray(cx, fun->nargs));
+    RootedObject result(cx, NewDenseAllocatedArray(cx, fun->nargs()));
     if (!result)
         return false;
-    result->ensureDenseInitializedLength(cx, 0, fun->nargs);
+    result->ensureDenseInitializedLength(cx, 0, fun->nargs());
 
     if (fun->isInterpreted()) {
         RootedScript script(cx, GetOrCreateFunctionScript(cx, fun));
         if (!script)
             return false;
 
-        JS_ASSERT(fun->nargs == script->bindings.numArgs());
+        JS_ASSERT(fun->nargs() == script->bindings.numArgs());
 
-        if (fun->nargs > 0) {
+        if (fun->nargs() > 0) {
             BindingVector bindings(cx);
             if (!FillBindingVector(script, &bindings))
                 return false;
-            for (size_t i = 0; i < fun->nargs; i++) {
+            for (size_t i = 0; i < fun->nargs(); i++) {
                 Value v;
                 if (bindings[i].name()->length() == 0)
                     v = UndefinedValue();
@@ -4746,7 +4746,7 @@ DebuggerObject_getParameterNames(JSContext *cx, unsigned argc, Value *vp)
             }
         }
     } else {
-        for (size_t i = 0; i < fun->nargs; i++)
+        for (size_t i = 0; i < fun->nargs(); i++)
             result->setDenseElement(i, UndefinedValue());
     }
 
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 57c235331b94..4c6418e55c74 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -3609,7 +3609,7 @@ js::Lambda(JSContext *cx, HandleFunction fun, HandleObject parent)
         clone = js_fun_bind(cx, clone, thisval, nullptr, 0);
         if (!clone)
             return nullptr;
-        clone->as<JSFunction>().flags |= JSFunction::ARROW;
+        clone->as<JSFunction>().setArrow();
     }
 
     JS_ASSERT(clone->global() == clone->global());
diff --git a/js/src/vm/OldDebugAPI.cpp b/js/src/vm/OldDebugAPI.cpp
index e5648f95a7da..1fc3d187f3e3 100644
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@@ -450,7 +450,7 @@ JS_GetLinePCs(JSContext *cx, JSScript *script,
 JS_PUBLIC_API(unsigned)
 JS_GetFunctionArgumentCount(JSContext *cx, JSFunction *fun)
 {
-    return fun->nargs;
+    return fun->nargs();
 }
 
 JS_PUBLIC_API(bool)
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 55335eacfa05..d4c50beeb60e 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -960,8 +960,8 @@ JSRuntime::cloneSelfHostedFunctionScript(JSContext *cx, Handle<PropertyName*> na
         return false;
     targetFun->setScript(cscript);
     cscript->setFunction(targetFun);
-    JS_ASSERT(sourceFun->nargs == targetFun->nargs);
-    targetFun->flags = sourceFun->flags | JSFunction::EXTENDED;
+    JS_ASSERT(sourceFun->nargs() == targetFun->nargs());
+    targetFun->setFlags(sourceFun->flags() | JSFunction::EXTENDED);
     return true;
 }
 
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index fd7088222f91..9683618ead23 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -253,7 +253,7 @@ InterpreterStack::getCallFrame(JSContext *cx, const CallArgs &args, HandleScript
     JSFunction *fun = &args.callee().as<JSFunction>();
 
     JS_ASSERT(fun->nonLazyScript() == script);
-    unsigned nformal = fun->nargs;
+    unsigned nformal = fun->nargs();
     unsigned nvals = script->nslots();
 
     if (args.length() >= nformal) {
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 491bf8cc417a..dee94c0f85c2 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -165,7 +165,7 @@ JSObject *
 StackFrame::createRestParameter(JSContext *cx)
 {
     JS_ASSERT(fun()->hasRest());
-    unsigned nformal = fun()->nargs - 1, nactual = numActualArgs();
+    unsigned nformal = fun()->nargs() - 1, nactual = numActualArgs();
     unsigned nrest = (nactual > nformal) ? nactual - nformal : 0;
     Value *restvp = argv() + nformal;
     JSObject *obj = NewDenseCopiedArray(cx, nrest, restvp, nullptr);
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index e8d4e71479c7..812bb54b8a3b 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -534,7 +534,7 @@ class StackFrame
 
     bool copyRawFrameSlots(AutoValueVector *v);
 
-    unsigned numFormalArgs() const { JS_ASSERT(hasArgs()); return fun()->nargs; }
+    unsigned numFormalArgs() const { JS_ASSERT(hasArgs()); return fun()->nargs(); }
     unsigned numActualArgs() const { JS_ASSERT(hasArgs()); return u.nactual; }
 
     inline Value &canonicalActualArg(unsigned i) const;
@@ -1563,7 +1563,7 @@ class ScriptFrameIter
     JSFunction *callee() const;
     Value       calleev() const;
     unsigned    numActualArgs() const;
-    unsigned    numFormalArgs() const { return script()->function()->nargs; }
+    unsigned    numFormalArgs() const { return script()->function()->nargs(); }
     Value       unaliasedActual(unsigned i, MaybeCheckAliasing = CHECK_ALIASING) const;
 
     JSObject   *scopeChain() const;

From 899505a63136781ead753f0ae176e49ea9320be5 Mon Sep 17 00:00:00 2001
From: Benjamin Smedberg <benjamin@smedbergs.us>
Date: Thu, 21 Nov 2013 12:37:47 -0500
Subject: [PATCH 180/459] Bug 941137 followup - fix xpcshell test which expects
 the test plugin to be click-to-activate to actually set the state it desires.

---
 .../extensions/test/xpcshell/test_plugins.js       | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/toolkit/mozapps/extensions/test/xpcshell/test_plugins.js b/toolkit/mozapps/extensions/test/xpcshell/test_plugins.js
index d9ef812bd44d..15fe338c99fa 100644
--- a/toolkit/mozapps/extensions/test/xpcshell/test_plugins.js
+++ b/toolkit/mozapps/extensions/test/xpcshell/test_plugins.js
@@ -5,11 +5,25 @@
 // This verifies that plugins exist and can be enabled and disabled.
 var gID = null;
 
+function setTestPluginState(state) {
+  let tags = AM_Cc["@mozilla.org/plugin/host;1"].getService(AM_Ci.nsIPluginHost)
+    .getPluginTags();
+  for (let tag of tags) {
+    if (tag.name == "Test Plug-in") {
+      tag.enabledState = state;
+      return;
+    }
+  }
+  throw Error("No plugin tag found for the test plugin");
+}
+
 function run_test() {
   do_test_pending();
   createAppInfo("xpcshell@tests.mozilla.org", "XPCShell", "1", "1.9.2");
   Services.prefs.setBoolPref("plugins.click_to_play", true);
 
+  setTestPluginState(AM_Ci.nsIPluginTag.STATE_CLICKTOPLAY);
+
   startupManager();
   AddonManager.addAddonListener(AddonListener);
   AddonManager.addInstallListener(InstallListener);

From 7da8970d0e765fd024b89506587929f60740dd14 Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 08:34:24 +0000
Subject: [PATCH 181/459] Bug 944442 - DeCOMify imgIContainer::GetFrame. r=seth

--HG--
extra : rebase_source : 612c1923f3ed8a01fc30f2d306b4682e585e53fe
---
 .../shell/src/nsWindowsShellService.cpp       |  7 ++--
 content/svg/content/src/SVGFEImageElement.cpp |  6 +--
 image/public/imgIContainer.idl                |  6 ++-
 image/src/ClippedImage.cpp                    | 22 ++++------
 image/src/ClippedImage.h                      | 14 +++----
 image/src/FrozenImage.cpp                     |  7 ++--
 image/src/FrozenImage.h                       |  5 +--
 image/src/ImageWrapper.cpp                    |  7 ++--
 image/src/OrientedImage.cpp                   | 18 ++++----
 image/src/OrientedImage.h                     |  5 +--
 image/src/RasterImage.cpp                     | 41 ++++++++-----------
 image/src/VectorImage.cpp                     | 18 ++++----
 image/src/imgTools.cpp                        |  7 ++--
 layout/base/nsLayoutUtils.cpp                 |  8 ++--
 widget/cocoa/nsClipboard.mm                   |  7 ++--
 widget/cocoa/nsCocoaUtils.mm                  |  6 +--
 widget/cocoa/nsMenuItemIconX.mm               |  7 ++--
 widget/gtk/nsImageToPixbuf.cpp                | 12 +++---
 widget/os2/nsWindow.cpp                       |  7 ++--
 widget/qt/nsClipboard.cpp                     |  7 ++--
 widget/windows/WinUtils.cpp                   |  4 +-
 widget/windows/nsImageClipboard.cpp           |  7 ++--
 widget/windows/nsWindowGfx.cpp                |  7 ++--
 23 files changed, 100 insertions(+), 135 deletions(-)

diff --git a/browser/components/shell/src/nsWindowsShellService.cpp b/browser/components/shell/src/nsWindowsShellService.cpp
index 35b9bcfc46f0..908508639a97 100644
--- a/browser/components/shell/src/nsWindowsShellService.cpp
+++ b/browser/components/shell/src/nsWindowsShellService.cpp
@@ -752,10 +752,9 @@ WriteBitmap(nsIFile* aFile, imgIContainer* aImage)
 {
   nsresult rv;
 
-  nsRefPtr<gfxASurface> surface;
-  aImage->GetFrame(imgIContainer::FRAME_FIRST,
-                   imgIContainer::FLAG_SYNC_DECODE,
-                   getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aImage->GetFrame(imgIContainer::FRAME_FIRST,
+                     imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
   nsRefPtr<gfxImageSurface> image(surface->GetAsReadableARGB32ImageSurface());
diff --git a/content/svg/content/src/SVGFEImageElement.cpp b/content/svg/content/src/SVGFEImageElement.cpp
index 5ebf78c9d0f7..c91795c30447 100644
--- a/content/svg/content/src/SVGFEImageElement.cpp
+++ b/content/svg/content/src/SVGFEImageElement.cpp
@@ -211,9 +211,9 @@ SVGFEImageElement::GetPrimitiveDescription(nsSVGFilterInstance* aInstance,
 
   nsRefPtr<gfxASurface> currentFrame;
   if (imageContainer) {
-    imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
-                             imgIContainer::FLAG_SYNC_DECODE,
-                             getter_AddRefs(currentFrame));
+    currentFrame =
+      imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
+                               imgIContainer::FLAG_SYNC_DECODE);
   }
 
   if (!currentFrame) {
diff --git a/image/public/imgIContainer.idl b/image/public/imgIContainer.idl
index 3bcfc05689fd..884f27e30838 100644
--- a/image/public/imgIContainer.idl
+++ b/image/public/imgIContainer.idl
@@ -55,6 +55,7 @@ native nsSize(nsSize);
 native Orientation(mozilla::image::Orientation);
 [ref] native TimeStamp(mozilla::TimeStamp);
 [ptr] native SVGImageContext(mozilla::SVGImageContext);
+native already_AddRefed_gfxASurface(already_AddRefed<gfxASurface>);
 
 
 /**
@@ -64,7 +65,7 @@ native Orientation(mozilla::image::Orientation);
  *
  * Internally, imgIContainer also manages animation of images.
  */
-[scriptable, builtinclass, uuid(73340b79-e3ae-4f02-97d0-822db78017e5)]
+[scriptable, builtinclass, uuid(8b7db7dd-bfe9-40d3-9114-3a79c0658afd)]
 interface imgIContainer : nsISupports
 {
   /**
@@ -172,7 +173,8 @@ interface imgIContainer : nsISupports
    * @param aWhichFrame Frame specifier of the FRAME_* variety.
    * @param aFlags Flags of the FLAG_* variety
    */
-  [noscript] gfxASurface getFrame(in uint32_t aWhichFrame,
+  [noscript, notxpcom] already_AddRefed_gfxASurface
+                         getFrame(in uint32_t aWhichFrame,
                                   in uint32_t aFlags);
 
   /**
diff --git a/image/src/ClippedImage.cpp b/image/src/ClippedImage.cpp
index d5cf33ca1578..c09e8d2aa4c6 100644
--- a/image/src/ClippedImage.cpp
+++ b/image/src/ClippedImage.cpp
@@ -209,23 +209,21 @@ ClippedImage::GetIntrinsicRatio(nsSize* aRatio)
   return NS_OK;
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 ClippedImage::GetFrame(uint32_t aWhichFrame,
-                       uint32_t aFlags,
-                       gfxASurface** _retval)
+                       uint32_t aFlags)
 {
-  return GetFrameInternal(mClip.Size(), nullptr, aWhichFrame, aFlags, _retval);
+  return GetFrameInternal(mClip.Size(), nullptr, aWhichFrame, aFlags);
 }
 
-nsresult
+already_AddRefed<gfxASurface>
 ClippedImage::GetFrameInternal(const nsIntSize& aViewportSize,
                                const SVGImageContext* aSVGContext,
                                uint32_t aWhichFrame,
-                               uint32_t aFlags,
-                               gfxASurface** _retval)
+                               uint32_t aFlags)
 {
   if (!ShouldClip()) {
-    return InnerImage()->GetFrame(aWhichFrame, aFlags, _retval);
+    return InnerImage()->GetFrame(aWhichFrame, aFlags);
   }
 
   float frameToDraw = InnerImage()->GetFrameIndex(aWhichFrame);
@@ -273,9 +271,7 @@ ClippedImage::GetFrameInternal(const nsIntSize& aViewportSize,
   }
 
   MOZ_ASSERT(mCachedSurface, "Should have a cached surface now");
-  nsRefPtr<gfxASurface> surf = mCachedSurface->Surface();
-  surf.forget(_retval);
-  return NS_OK;
+  return mCachedSurface->Surface();
 }
 
 NS_IMETHODIMP
@@ -335,8 +331,8 @@ ClippedImage::Draw(gfxContext* aContext,
   if (MustCreateSurface(aContext, aUserSpaceToImageSpace, sourceRect, aSubimage, aFlags)) {
     // Create a temporary surface containing a single tile of this image.
     // GetFrame will call DrawSingleTile internally.
-    nsRefPtr<gfxASurface> surface;
-    GetFrameInternal(aViewportSize, aSVGContext, aWhichFrame, aFlags, getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      GetFrameInternal(aViewportSize, aSVGContext, aWhichFrame, aFlags);
     NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
     // Create a drawable from that surface.
diff --git a/image/src/ClippedImage.h b/image/src/ClippedImage.h
index 51bffa5f5805..69c609fdece1 100644
--- a/image/src/ClippedImage.h
+++ b/image/src/ClippedImage.h
@@ -35,9 +35,8 @@ public:
   NS_IMETHOD GetHeight(int32_t* aHeight) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicSize(nsSize* aSize) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicRatio(nsSize* aRatio) MOZ_OVERRIDE;
-  NS_IMETHOD GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<gfxASurface>) GetFrame(uint32_t aWhichFrame,
+                                                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD GetImageContainer(mozilla::layers::LayerManager* aManager,
                                mozilla::layers::ImageContainer** _retval) MOZ_OVERRIDE;
   NS_IMETHOD Draw(gfxContext* aContext,
@@ -56,11 +55,10 @@ protected:
   ClippedImage(Image* aImage, nsIntRect aClip);
 
 private:
-  nsresult GetFrameInternal(const nsIntSize& aViewportSize,
-                            const SVGImageContext* aSVGContext,
-                            uint32_t aWhichFrame,
-                            uint32_t aFlags,
-                            gfxASurface** _retval);
+  already_AddRefed<gfxASurface> GetFrameInternal(const nsIntSize& aViewportSize,
+                                                 const SVGImageContext* aSVGContext,
+                                                 uint32_t aWhichFrame,
+                                                 uint32_t aFlags);
   bool ShouldClip();
   bool MustCreateSurface(gfxContext* aContext,
                          const gfxMatrix& aTransform,
diff --git a/image/src/FrozenImage.cpp b/image/src/FrozenImage.cpp
index a308fbc914b0..2b2607953449 100644
--- a/image/src/FrozenImage.cpp
+++ b/image/src/FrozenImage.cpp
@@ -40,12 +40,11 @@ FrozenImage::GetAnimated(bool* aAnimated)
   return rv;
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 FrozenImage::GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval)
+                      uint32_t aFlags)
 {
-  return InnerImage()->GetFrame(FRAME_FIRST, aFlags, _retval);
+  return InnerImage()->GetFrame(FRAME_FIRST, aFlags);
 }
 
 NS_IMETHODIMP_(bool)
diff --git a/image/src/FrozenImage.h b/image/src/FrozenImage.h
index 3cb1e8e33aef..947dc322a553 100644
--- a/image/src/FrozenImage.h
+++ b/image/src/FrozenImage.h
@@ -34,9 +34,8 @@ public:
   virtual void DecrementAnimationConsumers() MOZ_OVERRIDE;
 
   NS_IMETHOD GetAnimated(bool* aAnimated) MOZ_OVERRIDE;
-  NS_IMETHOD GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<gfxASurface>) GetFrame(uint32_t aWhichFrame,
+                                                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD_(bool) FrameIsOpaque(uint32_t aWhichFrame) MOZ_OVERRIDE;
   NS_IMETHOD GetImageContainer(layers::LayerManager* aManager,
                                layers::ImageContainer** _retval) MOZ_OVERRIDE;
diff --git a/image/src/ImageWrapper.cpp b/image/src/ImageWrapper.cpp
index 6e2c9adddf6c..aaba02f77c96 100644
--- a/image/src/ImageWrapper.cpp
+++ b/image/src/ImageWrapper.cpp
@@ -196,12 +196,11 @@ ImageWrapper::GetAnimated(bool* aAnimated)
   return mInnerImage->GetAnimated(aAnimated);
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 ImageWrapper::GetFrame(uint32_t aWhichFrame,
-                       uint32_t aFlags,
-                       gfxASurface** _retval)
+                       uint32_t aFlags)
 {
-  return mInnerImage->GetFrame(aWhichFrame, aFlags, _retval);
+  return mInnerImage->GetFrame(aWhichFrame, aFlags);
 }
 
 NS_IMETHODIMP_(bool)
diff --git a/image/src/OrientedImage.cpp b/image/src/OrientedImage.cpp
index fb3ae9c52955..24d4e3b79413 100644
--- a/image/src/OrientedImage.cpp
+++ b/image/src/OrientedImage.cpp
@@ -75,15 +75,14 @@ OrientedImage::GetIntrinsicRatio(nsSize* aRatio)
   return rv;
 }
 
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 OrientedImage::GetFrame(uint32_t aWhichFrame,
-                        uint32_t aFlags,
-                        gfxASurface** _retval)
+                        uint32_t aFlags)
 {
   nsresult rv;
 
   if (mOrientation.IsIdentity()) {
-    return InnerImage()->GetFrame(aWhichFrame, aFlags, _retval);
+    return InnerImage()->GetFrame(aWhichFrame, aFlags);
   }
 
   // Get the underlying dimensions.
@@ -95,7 +94,7 @@ OrientedImage::GetFrame(uint32_t aWhichFrame,
     rv = InnerImage()->GetWidth(&width);
     rv = NS_FAILED(rv) ? rv : InnerImage()->GetHeight(&height);
   }
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_SUCCESS(rv, nullptr);
 
   // Determine an appropriate format for the surface.
   gfx::SurfaceFormat surfaceFormat;
@@ -116,9 +115,9 @@ OrientedImage::GetFrame(uint32_t aWhichFrame,
     GetThebesSurfaceForDrawTarget(target);
 
   // Create our drawable.
-  nsRefPtr<gfxASurface> innerSurface;
-  rv = InnerImage()->GetFrame(aWhichFrame, aFlags, getter_AddRefs(innerSurface));
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsRefPtr<gfxASurface> innerSurface =
+    InnerImage()->GetFrame(aWhichFrame, aFlags);
+  NS_ENSURE_TRUE(innerSurface, nullptr);
   nsRefPtr<gfxDrawable> drawable =
     new gfxSurfaceDrawable(innerSurface, gfxIntSize(width, height));
 
@@ -129,8 +128,7 @@ OrientedImage::GetFrame(uint32_t aWhichFrame,
                              imageRect, imageRect, imageRect, imageRect,
                              imageFormat, GraphicsFilter::FILTER_FAST);
 
-  surface.forget(_retval);
-  return NS_OK;
+  return surface.forget();
 }
 
 NS_IMETHODIMP
diff --git a/image/src/OrientedImage.h b/image/src/OrientedImage.h
index 6f4c209efdf0..1c1886bd655e 100644
--- a/image/src/OrientedImage.h
+++ b/image/src/OrientedImage.h
@@ -32,9 +32,8 @@ public:
   NS_IMETHOD GetHeight(int32_t* aHeight) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicSize(nsSize* aSize) MOZ_OVERRIDE;
   NS_IMETHOD GetIntrinsicRatio(nsSize* aRatio) MOZ_OVERRIDE;
-  NS_IMETHOD GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval) MOZ_OVERRIDE;
+  NS_IMETHOD_(already_AddRefed<gfxASurface>) GetFrame(uint32_t aWhichFrame,
+                                                      uint32_t aFlags) MOZ_OVERRIDE;
   NS_IMETHOD GetImageContainer(mozilla::layers::LayerManager* aManager,
                                mozilla::layers::ImageContainer** _retval) MOZ_OVERRIDE;
   NS_IMETHOD Draw(gfxContext* aContext,
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index 39a8d2b0a3ce..f224c362a909 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -879,30 +879,29 @@ RasterImage::CopyFrame(uint32_t aWhichFrame,
 //******************************************************************************
 /* [noscript] gfxASurface getFrame(in uint32_t aWhichFrame,
  *                                 in uint32_t aFlags); */
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 RasterImage::GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface **_retval)
+                      uint32_t aFlags)
 {
+  MOZ_ASSERT(aWhichFrame <= FRAME_MAX_VALUE);
+
   if (aWhichFrame > FRAME_MAX_VALUE)
-    return NS_ERROR_INVALID_ARG;
+    return nullptr;
 
   if (mError)
-    return NS_ERROR_FAILURE;
+    return nullptr;
 
   // Disallowed in the API
   if (mInDecoder && (aFlags & imgIContainer::FLAG_SYNC_DECODE))
-    return NS_ERROR_FAILURE;
-
-  nsresult rv = NS_OK;
+    return nullptr;
 
   if (!ApplyDecodeFlags(aFlags))
-    return NS_ERROR_NOT_AVAILABLE;
+    return nullptr;
 
   // If the caller requested a synchronous decode, do it
   if (aFlags & FLAG_SYNC_DECODE) {
-    rv = SyncDecode();
-    CONTAINER_ENSURE_SUCCESS(rv);
+    nsresult rv = SyncDecode();
+    CONTAINER_ENSURE_TRUE(NS_SUCCEEDED(rv), nullptr);
   }
 
   // Get the frame. If it's not there, it's probably the caller's fault for
@@ -912,8 +911,7 @@ RasterImage::GetFrame(uint32_t aWhichFrame,
                           0 : GetCurrentImgFrameIndex();
   imgFrame *frame = GetDrawableImgFrame(frameIndex);
   if (!frame) {
-    *_retval = nullptr;
-    return NS_ERROR_FAILURE;
+    return nullptr;
   }
 
   nsRefPtr<gfxASurface> framesurf;
@@ -924,19 +922,17 @@ RasterImage::GetFrame(uint32_t aWhichFrame,
   if (framerect.x == 0 && framerect.y == 0 &&
       framerect.width == mSize.width &&
       framerect.height == mSize.height)
-    rv = frame->GetSurface(getter_AddRefs(framesurf));
+    frame->GetSurface(getter_AddRefs(framesurf));
 
   // The image doesn't have a surface because it's been optimized away. Create
   // one.
   if (!framesurf) {
     nsRefPtr<gfxImageSurface> imgsurf;
-    rv = CopyFrame(aWhichFrame, aFlags, getter_AddRefs(imgsurf));
+    CopyFrame(aWhichFrame, aFlags, getter_AddRefs(imgsurf));
     framesurf = imgsurf;
   }
 
-  *_retval = framesurf.forget().get();
-
-  return rv;
+  return framesurf.forget();
 }
 
 already_AddRefed<layers::Image>
@@ -949,13 +945,8 @@ RasterImage::GetCurrentImage()
     return nullptr;
   }
 
-  nsRefPtr<gfxASurface> imageSurface;
-  nsresult rv = GetFrame(FRAME_CURRENT, FLAG_NONE, getter_AddRefs(imageSurface));
-  NS_ENSURE_SUCCESS(rv, nullptr);
-
-  if (!imageSurface) {
-    return nullptr;
-  }
+  nsRefPtr<gfxASurface> imageSurface = GetFrame(FRAME_CURRENT, FLAG_NONE);
+  NS_ENSURE_TRUE(imageSurface, nullptr);
 
   if (!mImageContainer) {
     mImageContainer = LayerManager::CreateImageContainer();
diff --git a/image/src/VectorImage.cpp b/image/src/VectorImage.cpp
index e99c7a1f4fc3..aaadb9cc9b1c 100644
--- a/image/src/VectorImage.cpp
+++ b/image/src/VectorImage.cpp
@@ -647,18 +647,17 @@ VectorImage::FrameIsOpaque(uint32_t aWhichFrame)
 //******************************************************************************
 /* [noscript] gfxASurface getFrame(in uint32_t aWhichFrame,
  *                                 in uint32_t aFlags; */
-NS_IMETHODIMP
+NS_IMETHODIMP_(already_AddRefed<gfxASurface>)
 VectorImage::GetFrame(uint32_t aWhichFrame,
-                      uint32_t aFlags,
-                      gfxASurface** _retval)
+                      uint32_t aFlags)
 {
-  NS_ENSURE_ARG_POINTER(_retval);
+  MOZ_ASSERT(aWhichFrame <= FRAME_MAX_VALUE);
 
   if (aWhichFrame > FRAME_MAX_VALUE)
-    return NS_ERROR_INVALID_ARG;
+    return nullptr;
 
   if (mError)
-    return NS_ERROR_FAILURE;
+    return nullptr;
 
   // Look up height & width
   // ----------------------
@@ -668,7 +667,7 @@ VectorImage::GetFrame(uint32_t aWhichFrame,
       !mSVGDocumentWrapper->GetWidthOrHeight(SVGDocumentWrapper::eHeight,
                                              imageIntSize.height)) {
     // We'll get here if our SVG doc has a percent-valued width or height.
-    return NS_ERROR_FAILURE;
+    return nullptr;
   }
 
   // Create a surface that we'll ultimately return
@@ -689,9 +688,8 @@ VectorImage::GetFrame(uint32_t aWhichFrame,
                      nsIntRect(nsIntPoint(0,0), imageIntSize),
                      imageIntSize, nullptr, aWhichFrame, aFlags);
 
-  NS_ENSURE_SUCCESS(rv, rv);
-  *_retval = surface.forget().get();
-  return rv;
+  NS_ENSURE_SUCCESS(rv, nullptr);
+  return surface.forget();
 }
 
 //******************************************************************************
diff --git a/image/src/imgTools.cpp b/image/src/imgTools.cpp
index 0dd5640ed8ee..30a6b5c59ea5 100644
--- a/image/src/imgTools.cpp
+++ b/image/src/imgTools.cpp
@@ -276,10 +276,9 @@ NS_IMETHODIMP imgTools::EncodeImageData(gfxImageSurface *aSurface,
 NS_IMETHODIMP imgTools::GetFirstImageFrame(imgIContainer *aContainer,
                                            gfxImageSurface **aSurface)
 {
-  nsRefPtr<gfxASurface> surface;
-  aContainer->GetFrame(imgIContainer::FRAME_FIRST,
-                       imgIContainer::FLAG_SYNC_DECODE,
-                       getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aContainer->GetFrame(imgIContainer::FRAME_FIRST,
+                         imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_NOT_AVAILABLE);
 
   nsRefPtr<gfxImageSurface> frame(surface->CopyToARGB32ImageSurface());
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index aef7bb43b61a..898e2f75df38 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -4816,11 +4816,9 @@ nsLayoutUtils::SurfaceFromElement(nsIImageLoadingContent* aElement,
     frameFlags |= imgIContainer::FLAG_DECODE_NO_COLORSPACE_CONVERSION;
   if (aSurfaceFlags & SFE_NO_PREMULTIPLY_ALPHA)
     frameFlags |= imgIContainer::FLAG_DECODE_NO_PREMULTIPLY_ALPHA;
-  nsRefPtr<gfxASurface> framesurf;
-  rv = imgContainer->GetFrame(whichFrame,
-                              frameFlags,
-                              getter_AddRefs(framesurf));
-  if (NS_FAILED(rv))
+  nsRefPtr<gfxASurface> framesurf =
+    imgContainer->GetFrame(whichFrame, frameFlags);
+  if (!framesurf)
     return result;
 
   int32_t imgWidth, imgHeight;
diff --git a/widget/cocoa/nsClipboard.mm b/widget/cocoa/nsClipboard.mm
index 6e8973dcd054..33f430424e4a 100644
--- a/widget/cocoa/nsClipboard.mm
+++ b/widget/cocoa/nsClipboard.mm
@@ -431,10 +431,9 @@ nsClipboard::PasteboardDictFromTransferable(nsITransferable* aTransferable)
         continue;
       }
 
-      nsRefPtr<gfxASurface> surface;
-      image->GetFrame(imgIContainer::FRAME_CURRENT,
-                      imgIContainer::FLAG_SYNC_DECODE,
-                      getter_AddRefs(surface));
+      nsRefPtr<gfxASurface> surface =
+        image->GetFrame(imgIContainer::FRAME_CURRENT,
+                        imgIContainer::FLAG_SYNC_DECODE);
       if (!surface) {
         continue;
       }
diff --git a/widget/cocoa/nsCocoaUtils.mm b/widget/cocoa/nsCocoaUtils.mm
index daa877d430a7..def55acb5f19 100644
--- a/widget/cocoa/nsCocoaUtils.mm
+++ b/widget/cocoa/nsCocoaUtils.mm
@@ -372,10 +372,8 @@ nsresult nsCocoaUtils::CreateNSImageFromImageContainer(imgIContainer *aImage, ui
   }
 
   else {
-    nsRefPtr<gfxASurface> surface;
-    aImage->GetFrame(aWhichFrame,
-                     imgIContainer::FLAG_SYNC_DECODE,
-                     getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      aImage->GetFrame(aWhichFrame, imgIContainer::FLAG_SYNC_DECODE);
     NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
     frame = surface->GetAsReadableARGB32ImageSurface();
diff --git a/widget/cocoa/nsMenuItemIconX.mm b/widget/cocoa/nsMenuItemIconX.mm
index 2975155c0d1d..a31b0247e702 100644
--- a/widget/cocoa/nsMenuItemIconX.mm
+++ b/widget/cocoa/nsMenuItemIconX.mm
@@ -384,10 +384,9 @@ nsMenuItemIconX::OnStopFrame(imgIRequest*    aRequest)
     mImageRegionRect.SetRect(0, 0, origWidth, origHeight);
   }
   
-  nsRefPtr<gfxASurface> surface;
-  imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
-                           imgIContainer::FLAG_NONE,
-                           getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    imageContainer->GetFrame(imgIContainer::FRAME_CURRENT,
+                             imgIContainer::FLAG_NONE);
   if (!surface) {
     [mNativeMenuItem setImage:nil];
     return NS_ERROR_FAILURE;
diff --git a/widget/gtk/nsImageToPixbuf.cpp b/widget/gtk/nsImageToPixbuf.cpp
index 35319b503c16..0acb7f787dc1 100644
--- a/widget/gtk/nsImageToPixbuf.cpp
+++ b/widget/gtk/nsImageToPixbuf.cpp
@@ -36,19 +36,17 @@ nsImageToPixbuf::ConvertImageToPixbuf(imgIContainer* aImage)
 GdkPixbuf*
 nsImageToPixbuf::ImageToPixbuf(imgIContainer* aImage)
 {
-    nsRefPtr<gfxASurface> surface;
-    aImage->GetFrame(imgIContainer::FRAME_CURRENT,
-                     imgIContainer::FLAG_SYNC_DECODE,
-                     getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      aImage->GetFrame(imgIContainer::FRAME_CURRENT,
+                       imgIContainer::FLAG_SYNC_DECODE);
 
     // If the last call failed, it was probably because our call stack originates
     // in an imgINotificationObserver event, meaning that we're not allowed request
     // a sync decode. Presumably the originating event is something sensible like
     // OnStopFrame(), so we can just retry the call without a sync decode.
     if (!surface)
-        aImage->GetFrame(imgIContainer::FRAME_CURRENT,
-                         imgIContainer::FLAG_NONE,
-                         getter_AddRefs(surface));
+        surface = aImage->GetFrame(imgIContainer::FRAME_CURRENT,
+                                   imgIContainer::FLAG_NONE);
 
     NS_ENSURE_TRUE(surface, nullptr);
 
diff --git a/widget/os2/nsWindow.cpp b/widget/os2/nsWindow.cpp
index a8245bd80deb..5c39f900f121 100644
--- a/widget/os2/nsWindow.cpp
+++ b/widget/os2/nsWindow.cpp
@@ -1334,10 +1334,9 @@ NS_IMETHODIMP nsWindow::SetCursor(imgIContainer* aCursor,
     return NS_OK;
   }
 
-  nsRefPtr<gfxASurface> surface;
-  aCursor->GetFrame(imgIContainer::FRAME_CURRENT,
-                    imgIContainer::FLAG_SYNC_DECODE,
-                    getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aCursor->GetFrame(imgIContainer::FRAME_CURRENT,
+                      imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_NOT_AVAILABLE);
 
   nsRefPtr<gfxImageSurface> frame(surface->GetAsReadableARGB32ImageSurface());
diff --git a/widget/qt/nsClipboard.cpp b/widget/qt/nsClipboard.cpp
index 6fe5fd1d8951..dfabcfaf17ba 100644
--- a/widget/qt/nsClipboard.cpp
+++ b/widget/qt/nsClipboard.cpp
@@ -176,10 +176,9 @@ nsClipboard::SetNativeClipboardData( nsITransferable *aTransferable,
                 if (!image)  // Not getting an image for an image mime type!?
                    continue;
 
-                nsRefPtr<gfxASurface> surface;
-                image->GetFrame(imgIContainer::FRAME_CURRENT,
-                                imgIContainer::FLAG_SYNC_DECODE,
-                                getter_AddRefs(surface));
+                nsRefPtr<gfxASurface> surface =
+                  image->GetFrame(imgIContainer::FRAME_CURRENT,
+                                  imgIContainer::FLAG_SYNC_DECODE);
                 if (!surface)
                   continue;
 
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 7a2aafaba080..0c41149f9376 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -694,8 +694,8 @@ AsyncFaviconDataReady::OnComplete(nsIURI *aFaviconURI,
                                 getter_AddRefs(container));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsRefPtr<gfxASurface> imgFrame;
-  rv = container->GetFrame(imgIContainer::FRAME_FIRST, 0, getter_AddRefs(imgFrame));
+  nsRefPtr<gfxASurface> imgFrame =
+    container->GetFrame(imgIContainer::FRAME_FIRST, 0);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsRefPtr<gfxImageSurface> imageSurface;
diff --git a/widget/windows/nsImageClipboard.cpp b/widget/windows/nsImageClipboard.cpp
index 230692f5242c..58f5e300b8af 100644
--- a/widget/windows/nsImageClipboard.cpp
+++ b/widget/windows/nsImageClipboard.cpp
@@ -116,10 +116,9 @@ nsImageToClipboard::CreateFromImage ( imgIContainer* inImage, HANDLE* outBitmap
     nsresult rv;
     *outBitmap = nullptr;
 
-    nsRefPtr<gfxASurface> surface;
-    inImage->GetFrame(imgIContainer::FRAME_CURRENT,
-                      imgIContainer::FLAG_SYNC_DECODE,
-                      getter_AddRefs(surface));
+    nsRefPtr<gfxASurface> surface =
+      inImage->GetFrame(imgIContainer::FRAME_CURRENT,
+                        imgIContainer::FLAG_SYNC_DECODE);
     NS_ENSURE_TRUE(surface, NS_ERROR_FAILURE);
 
     nsRefPtr<gfxImageSurface> frame(surface->GetAsReadableARGB32ImageSurface());
diff --git a/widget/windows/nsWindowGfx.cpp b/widget/windows/nsWindowGfx.cpp
index c34e87597135..e086bb613ad4 100644
--- a/widget/windows/nsWindowGfx.cpp
+++ b/widget/windows/nsWindowGfx.cpp
@@ -647,10 +647,9 @@ nsresult nsWindowGfx::CreateIcon(imgIContainer *aContainer,
                                   HICON *aIcon) {
 
   // Get the image data
-  nsRefPtr<gfxASurface> surface;
-  aContainer->GetFrame(imgIContainer::FRAME_CURRENT,
-                       imgIContainer::FLAG_SYNC_DECODE,
-                       getter_AddRefs(surface));
+  nsRefPtr<gfxASurface> surface =
+    aContainer->GetFrame(imgIContainer::FRAME_CURRENT,
+                         imgIContainer::FLAG_SYNC_DECODE);
   NS_ENSURE_TRUE(surface, NS_ERROR_NOT_AVAILABLE);
 
   nsRefPtr<gfxImageSurface> frame(surface->GetAsReadableARGB32ImageSurface());

From 27618ee0afd77fc4898e5a6918ce79dde9dab83f Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 08:40:57 +0000
Subject: [PATCH 182/459] Bug 944442 follow-up to check for null instead of rv
 error. r=me

---
 widget/windows/WinUtils.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 0c41149f9376..4457d57d0bba 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -696,7 +696,7 @@ AsyncFaviconDataReady::OnComplete(nsIURI *aFaviconURI,
 
   nsRefPtr<gfxASurface> imgFrame =
     container->GetFrame(imgIContainer::FRAME_FIRST, 0);
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_TRUE(imgFrame, NS_ERROR_FAILURE);
 
   nsRefPtr<gfxImageSurface> imageSurface;
   gfxIntSize size;

From 790a58b7dd08ae0c8bb7f06ef24893de121efde4 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Wed, 4 Dec 2013 15:23:30 -0800
Subject: [PATCH 183/459] Bug 945250 - Evict the nursery before using CellIter;
 r=jonco

---
 js/public/GCAPI.h          |  3 +++
 js/src/gc/GCInternals.h    |  2 +-
 js/src/gc/Iteration.cpp    |  3 +++
 js/src/gc/Nursery.cpp      | 25 ++++++++++++++++---------
 js/src/gc/Nursery.h        |  8 ++++++++
 js/src/gc/Verifier.cpp     | 22 ++++++++++++++++------
 js/src/jit/BaselineJIT.cpp | 10 ++++++++++
 js/src/jscompartment.cpp   |  8 --------
 js/src/jsfriendapi.cpp     | 25 ++++++++++++++++++-------
 js/src/jsgc.cpp            | 10 +++++++++-
 js/src/jsgcinlines.h       | 14 ++++++++++++++
 js/src/jsobjinlines.h      |  5 ++++-
 js/src/vm/Runtime.cpp      |  2 +-
 js/src/vm/Runtime.h        |  2 +-
 js/src/vm/Shape.cpp        |  3 +++
 15 files changed, 107 insertions(+), 35 deletions(-)

diff --git a/js/public/GCAPI.h b/js/public/GCAPI.h
index b37740838a9d..b48106041caa 100644
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -187,6 +187,9 @@ DisableGenerationalGC(JSRuntime *rt);
 extern JS_FRIEND_API(void)
 EnableGenerationalGC(JSRuntime *rt);
 
+extern JS_FRIEND_API(bool)
+IsGenerationalGCEnabled(JSRuntime *rt);
+
 extern JS_FRIEND_API(bool)
 IsIncrementalBarrierNeeded(JSRuntime *rt);
 
diff --git a/js/src/gc/GCInternals.h b/js/src/gc/GCInternals.h
index d675a47c4b46..2acd4fe379bb 100644
--- a/js/src/gc/GCInternals.h
+++ b/js/src/gc/GCInternals.h
@@ -130,7 +130,7 @@ class AutoStopVerifyingBarriers
       : runtime(rt)
     {
         restartPreVerifier = !isShutdown && rt->gcVerifyPreData;
-        restartPostVerifier = !isShutdown && rt->gcVerifyPostData && rt->gcGenerationalEnabled;
+        restartPostVerifier = !isShutdown && rt->gcVerifyPostData && JS::IsGenerationalGCEnabled(rt);
         if (rt->gcVerifyPreData)
             EndVerifyPreBarriers(rt);
         if (rt->gcVerifyPostData)
diff --git a/js/src/gc/Iteration.cpp b/js/src/gc/Iteration.cpp
index 94dbbe998d5d..6b692b55f9db 100644
--- a/js/src/gc/Iteration.cpp
+++ b/js/src/gc/Iteration.cpp
@@ -22,6 +22,7 @@ js::TraceRuntime(JSTracer *trc)
 {
     JS_ASSERT(!IS_GC_MARKING_TRACER(trc));
 
+    MinorGC(trc->runtime, JS::gcreason::EVICT_NURSERY);
     AutoPrepareForTracing prep(trc->runtime, WithAtoms);
     MarkRuntime(trc);
 }
@@ -91,6 +92,7 @@ void
 js::IterateScripts(JSRuntime *rt, JSCompartment *compartment,
                    void *data, IterateScriptCallback scriptCallback)
 {
+    MinorGC(rt, JS::gcreason::EVICT_NURSERY);
     AutoPrepareForTracing prep(rt, SkipAtoms);
 
     if (compartment) {
@@ -110,6 +112,7 @@ js::IterateScripts(JSRuntime *rt, JSCompartment *compartment,
 void
 js::IterateGrayObjects(Zone *zone, GCThingCallback cellCallback, void *data)
 {
+    MinorGC(zone->runtimeFromMainThread(), JS::gcreason::EVICT_NURSERY);
     AutoPrepareForTracing prep(zone->runtimeFromMainThread(), SkipAtoms);
 
     for (size_t finalizeKind = 0; finalizeKind <= FINALIZE_OBJECT_LAST; finalizeKind++) {
diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index 08924deaa8e1..71d38094b102 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -75,9 +75,9 @@ js::Nursery::~Nursery()
 void
 js::Nursery::enable()
 {
+    JS_ASSERT(isEmpty());
     if (isEnabled())
         return;
-    JS_ASSERT_IF(runtime()->gcZeal_ != ZealGenerationalGCValue, position_ == start());
     numActiveChunks_ = 1;
     setCurrentChunk(0);
 #ifdef JS_GC_ZEAL
@@ -91,11 +91,19 @@ js::Nursery::disable()
 {
     if (!isEnabled())
         return;
-    JS_ASSERT_IF(runtime()->gcZeal_ != ZealGenerationalGCValue, position_ == start());
+    JS_ASSERT(isEmpty());
     numActiveChunks_ = 0;
     currentEnd_ = 0;
 }
 
+bool
+js::Nursery::isEmpty() const
+{
+    JS_ASSERT(runtime_);
+    JS_ASSERT_IF(runtime_->gcZeal_ != ZealGenerationalGCValue, currentStart_ == start());
+    return !isEnabled() || position() == currentStart_;
+}
+
 void *
 js::Nursery::allocate(size_t size)
 {
@@ -355,8 +363,6 @@ js::Nursery::forwardBufferPointer(HeapSlot **pSlotsElems)
     JS_ASSERT(!isInside(*pSlotsElems));
 }
 
-namespace {
-
 // Structure for counting how many times objects of a particular type have been
 // tenured during a minor collection.
 struct TenureCount
@@ -365,8 +371,6 @@ struct TenureCount
     int count;
 };
 
-} // anonymous namespace
-
 // Keep rough track of how many times we tenure objects of particular types
 // during minor collections, using a fixed size hash for efficiency at the cost
 // of potential collisions.
@@ -598,11 +602,11 @@ js::Nursery::collect(JSRuntime *rt, JS::gcreason::Reason reason, TypeObjectList
     if (!isEnabled())
         return;
 
-    AutoStopVerifyingBarriers av(rt, false);
-
-    if (position() == start())
+    if (isEmpty())
         return;
 
+    AutoStopVerifyingBarriers av(rt, false);
+
     rt->gcHelperThread.waitBackgroundSweepEnd();
 
     /* Move objects pointed to by roots from the nursery to the major heap. */
@@ -679,6 +683,9 @@ js::Nursery::sweep(JSRuntime *rt)
         if (currentChunk_ + 1 == NumNurseryChunks)
             setCurrentChunk(0);
 
+        /* Set current start position for isEmpty checks. */
+        currentStart_ = position();
+
         return;
     }
 #endif
diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
index 55680cd1adbd..a2a30bd0b91e 100644
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -57,6 +57,7 @@ class Nursery
     explicit Nursery(JSRuntime *rt)
       : runtime_(rt),
         position_(0),
+        currentStart_(0),
         currentEnd_(0),
         currentChunk_(0),
         numActiveChunks_(0)
@@ -69,6 +70,9 @@ class Nursery
     void disable();
     bool isEnabled() const { return numActiveChunks_ != 0; }
 
+    /* Return true if no allocations have been made since the last collection. */
+    bool isEmpty() const;
+
     template <typename T>
     JS_ALWAYS_INLINE bool isInside(const T *p) const {
         return gc::IsInsideNursery((JS::shadow::Runtime *)runtime_, p);
@@ -144,6 +148,9 @@ class Nursery
     /* Pointer to the first unallocated byte in the nursery. */
     uintptr_t position_;
 
+    /* Pointer to the logic start of the Nursery. */
+    uintptr_t currentStart_;
+
     /* Pointer to the last byte of space in the current chunk. */
     uintptr_t currentEnd_;
 
@@ -196,6 +203,7 @@ class Nursery
         JS_ASSERT(chunkno < numActiveChunks_);
         currentChunk_ = chunkno;
         position_ = chunk(chunkno).start();
+        currentStart_ = chunk(0).start();
         currentEnd_ = chunk(chunkno).end();
     }
 
diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index 1d0bd8281dd9..6e7732e507d4 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -14,6 +14,7 @@
 
 #include "gc/GCInternals.h"
 #include "gc/Zone.h"
+#include "js/GCAPI.h"
 #include "js/HashTable.h"
 
 #include "jscntxtinlines.h"
@@ -365,7 +366,8 @@ typedef HashMap<void *, VerifyNode *, DefaultHasher<void *>, SystemAllocPolicy>
  * The nodemap field is a hashtable that maps from the address of the GC thing
  * to the VerifyNode that represents it.
  */
-struct VerifyPreTracer : JSTracer {
+struct VerifyPreTracer : JSTracer
+{
     /* The gcNumber when the verification began. */
     uint64_t number;
 
@@ -379,8 +381,14 @@ struct VerifyPreTracer : JSTracer {
     char *term;
     NodeMap nodemap;
 
-    VerifyPreTracer() : root(nullptr) {}
-    ~VerifyPreTracer() { js_free(root); }
+    VerifyPreTracer(JSRuntime *rt) : root(nullptr) {
+        JS::DisableGenerationalGC(rt);
+    }
+
+    ~VerifyPreTracer() {
+        js_free(root);
+        JS::EnableGenerationalGC(runtime);
+    }
 };
 
 /*
@@ -446,7 +454,7 @@ gc::StartVerifyPreBarriers(JSRuntime *rt)
     if (rt->gcVerifyPreData || rt->gcIncrementalState != NO_INCREMENTAL)
         return;
 
-    MinorGC(rt, JS::gcreason::API);
+    MinorGC(rt, JS::gcreason::EVICT_NURSERY);
 
     AutoPrepareForTracing prep(rt, WithAtoms);
 
@@ -456,7 +464,7 @@ gc::StartVerifyPreBarriers(JSRuntime *rt)
     for (GCChunkSet::Range r(rt->gcChunkSet.all()); !r.empty(); r.popFront())
         r.front()->bitmap.clear();
 
-    VerifyPreTracer *trc = js_new<VerifyPreTracer>();
+    VerifyPreTracer *trc = js_new<VerifyPreTracer>(rt);
     if (!trc)
         return;
 
@@ -576,6 +584,8 @@ AssertMarkedOrAllocated(const EdgeValue &edge)
 void
 gc::EndVerifyPreBarriers(JSRuntime *rt)
 {
+    JS_ASSERT(!JS::IsGenerationalGCEnabled(rt));
+
     AutoPrepareForTracing prep(rt, SkipAtoms);
 
     VerifyPreTracer *trc = (VerifyPreTracer *)rt->gcVerifyPreData;
@@ -658,7 +668,7 @@ gc::StartVerifyPostBarriers(JSRuntime *rt)
         return;
     }
 
-    MinorGC(rt, JS::gcreason::API);
+    MinorGC(rt, JS::gcreason::EVICT_NURSERY);
 
     VerifyPostTracer *trc = js_new<VerifyPostTracer>();
     if (!trc)
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 0956e75f4ca6..36e2867a888a 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -443,6 +443,16 @@ BaselineScript::Trace(JSTracer *trc, BaselineScript *script)
 void
 BaselineScript::Destroy(FreeOp *fop, BaselineScript *script)
 {
+#ifdef JSGC_GENERATIONAL
+    /*
+     * When the script contains pointers to nursery things, the store buffer
+     * will contain entries refering to the referenced things. Since we can
+     * destroy scripts outside the context of a GC, this situation can result
+     * in invalid store buffer entries. Assert that if we do destroy scripts
+     * outside of a GC that we at least emptied the nursery first.
+     */
+    JS_ASSERT(fop->runtime()->gcNursery.isEmpty());
+#endif
     fop->delete_(script);
 }
 
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index a4132018c96f..2d1fbff3ca19 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -634,14 +634,6 @@ JSCompartment::setObjectMetadataCallback(js::ObjectMetadataCallback callback)
     // whether there is a creation callback.
     ReleaseAllJITCode(runtime_->defaultFreeOp());
 
-    // Turn off GGC while the metadata hook is present, to prevent
-    // nursery-allocated metadata from being used as a lookup key in
-    // InitialShapeTable entries.
-    if (callback)
-        JS::DisableGenerationalGC(runtime_);
-    else
-        JS::EnableGenerationalGC(runtime_);
-
     objectMetadataCallback = callback;
 }
 
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 5e2806f42612..e62b9dec3781 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -933,24 +933,35 @@ JS::DisableIncrementalGC(JSRuntime *rt)
 extern JS_FRIEND_API(void)
 JS::DisableGenerationalGC(JSRuntime *rt)
 {
-    rt->gcGenerationalEnabled = false;
 #ifdef JSGC_GENERATIONAL
-    MinorGC(rt, JS::gcreason::API);
-    rt->gcNursery.disable();
-    rt->gcStoreBuffer.disable();
+    if (IsGenerationalGCEnabled(rt)) {
+        MinorGC(rt, JS::gcreason::API);
+        rt->gcNursery.disable();
+        rt->gcStoreBuffer.disable();
+    }
 #endif
+    ++rt->gcGenerationalDisabled;
 }
 
 extern JS_FRIEND_API(void)
 JS::EnableGenerationalGC(JSRuntime *rt)
 {
-    rt->gcGenerationalEnabled = true;
+    JS_ASSERT(rt->gcGenerationalDisabled > 0);
+    --rt->gcGenerationalDisabled;
 #ifdef JSGC_GENERATIONAL
-    rt->gcNursery.enable();
-    rt->gcStoreBuffer.enable();
+    if (IsGenerationalGCEnabled(rt)) {
+        rt->gcNursery.enable();
+        rt->gcStoreBuffer.enable();
+    }
 #endif
 }
 
+extern JS_FRIEND_API(bool)
+JS::IsGenerationalGCEnabled(JSRuntime *rt)
+{
+    return rt->gcGenerationalDisabled == 0;
+}
+
 JS_FRIEND_API(bool)
 JS::IsIncrementalBarrierNeeded(JSRuntime *rt)
 {
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index dd3cde985825..b2e65166aea5 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -5267,8 +5267,16 @@ void
 js::ReleaseAllJITCode(FreeOp *fop)
 {
 #ifdef JS_ION
-    for (ZonesIter zone(fop->runtime(), SkipAtoms); !zone.done(); zone.next()) {
 
+# ifdef JSGC_GENERATIONAL
+    /*
+     * Scripts can entrain nursery things, inserting references to the script
+     * into the store buffer. Clear the store buffer before discarding scripts.
+     */
+    MinorGC(fop->runtime(), JS::gcreason::EVICT_NURSERY);
+# endif
+
+    for (ZonesIter zone(fop->runtime(), SkipAtoms); !zone.done(); zone.next()) {
 # ifdef DEBUG
         /* Assert no baseline scripts are marked as active. */
         for (CellIter i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index 46c0c81d75f2..c162df0b8946 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -244,6 +244,9 @@ class CellIterUnderGC : public CellIterImpl
 {
   public:
     CellIterUnderGC(JS::Zone *zone, AllocKind kind) {
+#ifdef JSGC_GENERATIONAL
+        JS_ASSERT(zone->runtimeFromAnyThread()->gcNursery.isEmpty());
+#endif
         JS_ASSERT(zone->runtimeFromAnyThread()->isHeapBusy());
         init(zone, kind);
     }
@@ -277,16 +280,27 @@ class CellIter : public CellIterImpl
         {
             gc::FinishBackgroundFinalize(zone->runtimeFromMainThread());
         }
+
+#ifdef JSGC_GENERATIONAL
+        /* Evict the nursery before iterating so we can see all things. */
+        JSRuntime *rt = zone->runtimeFromMainThread();
+        if (!rt->gcNursery.isEmpty())
+            MinorGC(rt, JS::gcreason::EVICT_NURSERY);
+#endif
+
         if (lists->isSynchronizedFreeList(kind)) {
             lists = nullptr;
         } else {
             JS_ASSERT(!zone->runtimeFromMainThread()->isHeapBusy());
             lists->copyFreeListToArena(kind);
         }
+
 #ifdef DEBUG
+        /* Assert that no GCs can occur while a CellIter is live. */
         counter = &zone->runtimeFromAnyThread()->noGCOrAllocationCheck;
         ++*counter;
 #endif
+
         init(zone, kind);
     }
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index 4bda696f6ac1..5704017a5eb4 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1019,8 +1019,11 @@ NewObjectMetadata(ExclusiveContext *cxArg, JSObject **pmetadata)
             !cx->compartment()->activeAnalysis &&
             !cx->runtime()->mainThread.activeCompilations)
         {
+            JS::DisableGenerationalGC(cx->runtime());
             gc::AutoSuppressGC suppress(cx);
-            return cx->compartment()->callObjectMetadataCallback(cx, pmetadata);
+            bool status = cx->compartment()->callObjectMetadataCallback(cx, pmetadata);
+            JS::EnableGenerationalGC(cx->runtime());
+            return status;
         }
     }
     return true;
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index d9e57b8cfb26..169921adeee0 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -219,7 +219,7 @@ JSRuntime::JSRuntime(JSUseHelperThreads useHelperThreads)
     gcInterFrameGC(0),
     gcSliceBudget(SliceBudget::Unlimited),
     gcIncrementalEnabled(true),
-    gcGenerationalEnabled(true),
+    gcGenerationalDisabled(0),
     gcManipulatingDeadZones(false),
     gcObjectsMarkedInDeadZones(0),
     gcPoke(false),
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index e60ed6f0b220..0667445320bf 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -1153,7 +1153,7 @@ struct JSRuntime : public JS::shadow::Runtime,
     /*
      * GGC can be enabled from the command line while testing.
      */
-    bool                gcGenerationalEnabled;
+    unsigned            gcGenerationalDisabled;
 
     /*
      * This is true if we are in the middle of a brain transplant (e.g.,
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index 8fb1d34a2a11..f95670834921 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1588,6 +1588,9 @@ EmptyShape::getInitialShape(ExclusiveContext *cx, const Class *clasp, TaggedProt
 {
     JS_ASSERT_IF(proto.isObject(), cx->isInsideCurrentCompartment(proto.toObject()));
     JS_ASSERT_IF(parent, cx->isInsideCurrentCompartment(parent));
+#ifdef JSGC_GENERATIONAL
+    JS_ASSERT_IF(metadata && cx->hasNursery(), !cx->nursery().isInside(metadata));
+#endif
 
     InitialShapeSet &table = cx->compartment()->initialShapes;
 

From bc744f6bf13d3f8c8487f6d692632fb238a77ccd Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Fri, 13 Dec 2013 09:32:19 +0000
Subject: [PATCH 184/459] Bug 945285 - Don't verify post barriers if store
 buffer is disabled r=sfink

---
 js/src/gc/Verifier.cpp                 | 4 +++-
 js/src/jit-test/tests/gc/bug-945285.js | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-945285.js

diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index 6e7732e507d4..9cd3710e57e5 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -830,10 +830,11 @@ MaybeVerifyPreBarriers(JSRuntime *rt, bool always)
 static void
 MaybeVerifyPostBarriers(JSRuntime *rt, bool always)
 {
+#ifdef JSGC_GENERATIONAL
     if (rt->gcZeal() != ZealVerifierPostValue)
         return;
 
-    if (rt->mainThread.suppressGC)
+    if (rt->mainThread.suppressGC || !rt->gcStoreBuffer.isEnabled())
         return;
 
     if (VerifyPostTracer *trc = (VerifyPostTracer *)rt->gcVerifyPostData) {
@@ -843,6 +844,7 @@ MaybeVerifyPostBarriers(JSRuntime *rt, bool always)
         EndVerifyPostBarriers(rt);
     }
     StartVerifyPostBarriers(rt);
+#endif
 }
 
 void
diff --git a/js/src/jit-test/tests/gc/bug-945285.js b/js/src/jit-test/tests/gc/bug-945285.js
new file mode 100644
index 000000000000..c2d83d215f82
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-945285.js
@@ -0,0 +1,3 @@
+gczeal(11);
+function callback(obj) {}
+setObjectMetadataCallback(callback);

From 0fa113316c1441697e58148e2c52d547a984bd0b Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Fri, 13 Dec 2013 09:32:19 +0000
Subject: [PATCH 185/459] Bug 945280 - Reset nursery to initial state on
 disabling generational GC zeal mode r=terrence

---
 js/src/gc/Nursery.h                    |  6 ++++++
 js/src/jit-test/tests/gc/bug-945280.js |  4 ++++
 js/src/jsgc.cpp                        | 23 +++++++++++++----------
 3 files changed, 23 insertions(+), 10 deletions(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-945280.js

diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
index a2a30bd0b91e..524ba30c1fc0 100644
--- a/js/src/gc/Nursery.h
+++ b/js/src/gc/Nursery.h
@@ -135,6 +135,12 @@ class Nursery
         if (isEnabled())
             numActiveChunks_ = NumNurseryChunks;
     }
+    void leaveZealMode() {
+        if (isEnabled()) {
+            JS_ASSERT(isEmpty());
+            setCurrentChunk(0);
+        }
+    }
 #endif
 
   private:
diff --git a/js/src/jit-test/tests/gc/bug-945280.js b/js/src/jit-test/tests/gc/bug-945280.js
new file mode 100644
index 000000000000..48b9695d8ed4
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-945280.js
@@ -0,0 +1,4 @@
+gczeal(7,1);
+setObjectMetadataCallback(setObjectMetadataCallback);
+gczeal(false);
+var statusitems = [];
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index b2e65166aea5..909dff6c5c63 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1014,22 +1014,25 @@ PickChunk(Zone *zone)
 extern void
 js::SetGCZeal(JSRuntime *rt, uint8_t zeal, uint32_t frequency)
 {
-    if (zeal == 0) {
-        if (rt->gcVerifyPreData)
-            VerifyBarriers(rt, PreBarrierVerifier);
-        if (rt->gcVerifyPostData)
-            VerifyBarriers(rt, PostBarrierVerifier);
+    if (rt->gcVerifyPreData)
+        VerifyBarriers(rt, PreBarrierVerifier);
+    if (rt->gcVerifyPostData)
+        VerifyBarriers(rt, PostBarrierVerifier);
+
+#ifdef JSGC_GENERATIONAL
+    if (rt->gcZeal_ == ZealGenerationalGCValue) {
+        MinorGC(rt, JS::gcreason::DEBUG_GC);
+        rt->gcNursery.leaveZealMode();
     }
 
+    if (zeal == ZealGenerationalGCValue)
+        rt->gcNursery.enterZealMode();
+#endif
+
     bool schedule = zeal >= js::gc::ZealAllocValue;
     rt->gcZeal_ = zeal;
     rt->gcZealFrequency = frequency;
     rt->gcNextScheduled = schedule ? frequency : 0;
-
-#ifdef JSGC_GENERATIONAL
-    if (zeal == ZealGenerationalGCValue)
-        rt->gcNursery.enterZealMode();
-#endif
 }
 
 static bool

From cd447e7fa50fcc0b22f17c508cb7af2518748e56 Mon Sep 17 00:00:00 2001
From: Simon Montagu <smontagu@smontagu.org>
Date: Fri, 13 Dec 2013 12:09:26 +0200
Subject: [PATCH 186/459] Add NS_FRAME_IS_BIDI bit even when short-circuiting
 bidi resolution. Bug 942690, r=roc

---
 layout/base/crashtests/942690.html     | 15 +++++++++++++++
 layout/base/crashtests/crashtests.list |  1 +
 layout/base/nsBidiPresUtils.cpp        |  1 +
 3 files changed, 17 insertions(+)
 create mode 100644 layout/base/crashtests/942690.html

diff --git a/layout/base/crashtests/942690.html b/layout/base/crashtests/942690.html
new file mode 100644
index 000000000000..da64dd00dc97
--- /dev/null
+++ b/layout/base/crashtests/942690.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+    <title>14 Rendering — HTML Standard</title>
+    <style>
+      pre.css:first-line { color: #AAAA50; }
+    </style>
+      </head>
+<body>
+  <pre class="css">foo
+
+bar ׳
+</pre>  
+</body></html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index c79e526dd48f..9dc19257ec07 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -422,3 +422,4 @@ load 931464.html
 load 936988-1.html
 load 931460-1.html
 load 935765-1.html
+load 942690.html
diff --git a/layout/base/nsBidiPresUtils.cpp b/layout/base/nsBidiPresUtils.cpp
index 5ec7c469d9d2..6c223c742fc4 100644
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -687,6 +687,7 @@ nsBidiPresUtils::ResolveParagraph(nsBlockFrame* aBlockFrame,
       printf("early return for single direction frame %p\n", (void*)frame);
 #endif
 #endif
+      frame->AddStateBits(NS_FRAME_IS_BIDI);
       return NS_OK;
     }
   }

From bb725d63df84bd72e71455940eea49f5d247c24a Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Fri, 13 Dec 2013 13:17:33 +0200
Subject: [PATCH 187/459] Bug 949968 - Intermittent TEST-UNEXPECTED-FAIL |
 chrome://mochitests/content/browser/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
 | Test timed out, r=me

---
 .../test/browser_dbg_variables-view-override-02.js        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js b/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
index d515359c41d1..f9da58be6877 100644
--- a/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-override-02.js
@@ -14,13 +14,13 @@ function test() {
     let events = win.EVENTS;
     let variables = win.DebuggerView.Variables;
 
-    // Allow this generator function to yield first.
-    executeSoon(() => debuggee.test());
-    yield waitForSourceAndCaretAndScopes(panel, ".html", 23);
-
     // Wait for the hierarchy to be committed by the VariablesViewController.
     let committed = promise.defer();
     variables.oncommit = committed.resolve;
+
+    // Allow this generator function to yield first.
+    executeSoon(() => debuggee.test());
+    yield waitForSourceAndCaretAndScopes(panel, ".html", 23);
     yield committed.promise;
 
     let firstScope = variables.getScopeAtIndex(0);

From 27f0f88f2992bb62e23dc9af2fca8f30de95469b Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Fri, 13 Dec 2013 12:46:03 +0100
Subject: [PATCH 188/459] Backed out changeset 273e7ed05fa3 (bug 949304) for
 Windows Bustage on a CLOSED TREE

---
 .../mozbuild/backend/recursivemake.py         | 21 +++++--------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index a909efff8ee4..c9a4000dd46a 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -268,25 +268,17 @@ class RecursiveMakeBackend(CommonBackend):
         self._ipdl_sources = set()
 
         def detailed(summary):
-            s = '{:d} total backend files; ' \
-                '{:d} created; {:d} updated; {:d} unchanged; ' \
-                '{:d} deleted; {:d} -> {:d} Makefile'.format(
+            s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
                 summary.created_count + summary.updated_count +
-                summary.unchanged_count,
-                summary.created_count,
-                summary.updated_count,
-                summary.unchanged_count,
-                summary.deleted_count,
-                summary.makefile_in_count,
-                summary.makefile_out_count)
-
+                summary.unchanged_count, summary.created_count,
+                summary.updated_count, summary.unchanged_count)
+            if summary.deleted_count:
+                s+= '; {:d} deleted'.format(summary.deleted_count)
             return s
 
         # This is a little kludgy and could be improved with a better API.
         self.summary.backend_detailed_summary = types.MethodType(detailed,
             self.summary)
-        self.summary.makefile_in_count = 0
-        self.summary.makefile_out_count = 0
 
         self._test_manifests = {}
 
@@ -672,7 +664,6 @@ class RecursiveMakeBackend(CommonBackend):
                 if not stub:
                     self.log(logging.DEBUG, 'substitute_makefile',
                         {'path': makefile}, 'Substituting makefile: {path}')
-                    self.summary.makefile_in_count += 1
 
                     for tier, skiplist in self._may_skip.items():
                         if tier in ('compile', 'binaries'):
@@ -1113,8 +1104,6 @@ class RecursiveMakeBackend(CommonBackend):
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
 
-        self.summary.makefile_out_count += 1
-
     def _handle_webidl_collection(self, webidls):
         if not webidls.all_stems():
             return

From dcf3207d311b948d6f45025757873065caeee20e Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Fri, 13 Dec 2013 12:46:22 +0100
Subject: [PATCH 189/459] Backed out changeset 203e2bcc575d (bug 949875) for
 Windows Bustage on a CLOSED TREE

---
 dom/bindings/mozwebidlcodegen/__init__.py | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
index cbd6312b23d4..5516dbb3a1a0 100644
--- a/dom/bindings/mozwebidlcodegen/__init__.py
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -24,8 +24,14 @@ from mozbuild.util import FileAvoidWrite
 
 import mozpack.path as mozpath
 
-# There are various imports in this file in functions to avoid adding
-# dependencies to config.status. See bug 949875.
+import WebIDL
+from Codegen import (
+    CGBindingRoot,
+    CGEventRoot,
+    CGExampleRoot,
+    GlobalGenRoots,
+)
+from Configuration import Configuration
 
 
 class BuildResult(object):
@@ -299,16 +305,11 @@ class WebIDLCodegenManager(LoggingMixin):
 
     def generate_example_files(self, interface):
         """Generates example files for a given interface."""
-        from Codegen import CGExampleRoot
-
         root = CGExampleRoot(self.config, interface)
 
         return self._maybe_write_codegen(root, *self._example_paths(interface))
 
     def _parse_webidl(self):
-        import WebIDL
-        from Configuration import Configuration
-
         self.log(logging.INFO, 'webidl_parse',
             {'count': len(self._input_paths)},
             'Parsing {count} WebIDL files.')
@@ -327,8 +328,6 @@ class WebIDLCodegenManager(LoggingMixin):
         self._input_hashes = hashes
 
     def _write_global_derived(self):
-        from Codegen import GlobalGenRoots
-
         things = [('declare', f) for f in self.GLOBAL_DECLARE_FILES]
         things.extend(('define', f) for f in self.GLOBAL_DEFINE_FILES)
 
@@ -454,11 +453,6 @@ class WebIDLCodegenManager(LoggingMixin):
         return paths
 
     def _generate_build_files_for_webidl(self, filename):
-        from Codegen import (
-            CGBindingRoot,
-            CGEventRoot,
-        )
-
         self.log(logging.INFO, 'webidl_generate_build_for_input',
             {'filename': filename},
             'Generating WebIDL files derived from {filename}')

From 8167b5ca6f52a3c4ecb213a42bd7ed7fceb79edb Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Fri, 13 Dec 2013 00:03:55 +0900
Subject: [PATCH 190/459] Bug 949304 - Print Makefile counts during
 config.status; r=glandium

We now capture and print the number of Makefile.in and the number of
generated Makefile as part of config.status. This should give us a nice,
easy to extract metric going forward.

Pushing on a CLOSED TREE because this patch didn't deserve to get backed
out.

--HG--
extra : amend_source : 36028b17fd09c57455aef681bbe459891f5ed607
---
 .../mozbuild/backend/recursivemake.py         | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index c9a4000dd46a..a909efff8ee4 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -268,17 +268,25 @@ class RecursiveMakeBackend(CommonBackend):
         self._ipdl_sources = set()
 
         def detailed(summary):
-            s = '{:d} total backend files. {:d} created; {:d} updated; {:d} unchanged'.format(
+            s = '{:d} total backend files; ' \
+                '{:d} created; {:d} updated; {:d} unchanged; ' \
+                '{:d} deleted; {:d} -> {:d} Makefile'.format(
                 summary.created_count + summary.updated_count +
-                summary.unchanged_count, summary.created_count,
-                summary.updated_count, summary.unchanged_count)
-            if summary.deleted_count:
-                s+= '; {:d} deleted'.format(summary.deleted_count)
+                summary.unchanged_count,
+                summary.created_count,
+                summary.updated_count,
+                summary.unchanged_count,
+                summary.deleted_count,
+                summary.makefile_in_count,
+                summary.makefile_out_count)
+
             return s
 
         # This is a little kludgy and could be improved with a better API.
         self.summary.backend_detailed_summary = types.MethodType(detailed,
             self.summary)
+        self.summary.makefile_in_count = 0
+        self.summary.makefile_out_count = 0
 
         self._test_manifests = {}
 
@@ -664,6 +672,7 @@ class RecursiveMakeBackend(CommonBackend):
                 if not stub:
                     self.log(logging.DEBUG, 'substitute_makefile',
                         {'path': makefile}, 'Substituting makefile: {path}')
+                    self.summary.makefile_in_count += 1
 
                     for tier, skiplist in self._may_skip.items():
                         if tier in ('compile', 'binaries'):
@@ -1104,6 +1113,8 @@ class RecursiveMakeBackend(CommonBackend):
             # the autogenerated one automatically.
             self.backend_input_files.add(obj.input_path)
 
+        self.summary.makefile_out_count += 1
+
     def _handle_webidl_collection(self, webidls):
         if not webidls.all_stems():
             return

From f47e1b29895d17dbc4ef2e6aa53967c9d3ad385c Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 12:14:36 +0000
Subject: [PATCH 191/459] Bug 944704, part 1 - Extend Moz2D's ArcToBezier
 helper so that it can draw ellipse arcs in addition to circle arcs. r=Bas

---
 gfx/2d/Path.cpp      |  2 +-
 gfx/2d/PathCairo.cpp |  2 +-
 gfx/2d/PathHelpers.h | 24 +++++++++++++-----------
 gfx/2d/PathSkia.cpp  |  2 +-
 4 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/gfx/2d/Path.cpp b/gfx/2d/Path.cpp
index 1bf3563313d5..c3902e816d94 100644
--- a/gfx/2d/Path.cpp
+++ b/gfx/2d/Path.cpp
@@ -121,7 +121,7 @@ void
 FlattenedPath::Arc(const Point &aOrigin, float aRadius, float aStartAngle,
                    float aEndAngle, bool aAntiClockwise)
 {
-  ArcToBezier(this, aOrigin, aRadius, aStartAngle, aEndAngle, aAntiClockwise);
+  ArcToBezier(this, aOrigin, Size(aRadius, aRadius), aStartAngle, aEndAngle, aAntiClockwise);
 }
 
 Float
diff --git a/gfx/2d/PathCairo.cpp b/gfx/2d/PathCairo.cpp
index 63836f0bb4e5..e94b44c76e05 100644
--- a/gfx/2d/PathCairo.cpp
+++ b/gfx/2d/PathCairo.cpp
@@ -113,7 +113,7 @@ void
 PathBuilderCairo::Arc(const Point &aOrigin, float aRadius, float aStartAngle,
                      float aEndAngle, bool aAntiClockwise)
 {
-  ArcToBezier(this, aOrigin, aRadius, aStartAngle, aEndAngle, aAntiClockwise);
+  ArcToBezier(this, aOrigin, Size(aRadius, aRadius), aStartAngle, aEndAngle, aAntiClockwise);
 }
 
 Point
diff --git a/gfx/2d/PathHelpers.h b/gfx/2d/PathHelpers.h
index eb8c9df43e55..7d3ef446e390 100644
--- a/gfx/2d/PathHelpers.h
+++ b/gfx/2d/PathHelpers.h
@@ -13,11 +13,11 @@ namespace mozilla {
 namespace gfx {
 
 template <typename T>
-void ArcToBezier(T* aSink, const Point &aOrigin, float aRadius, float aStartAngle,
-                 float aEndAngle, bool aAntiClockwise)
+void ArcToBezier(T* aSink, const Point &aOrigin, const Size &aRadius,
+                 float aStartAngle, float aEndAngle, bool aAntiClockwise)
 {
-  Point startPoint(aOrigin.x + cos(aStartAngle) * aRadius,
-                   aOrigin.y + sin(aStartAngle) * aRadius);
+  Point startPoint(aOrigin.x + cos(aStartAngle) * aRadius.width,
+                   aOrigin.y + sin(aStartAngle) * aRadius.height);
 
   aSink->LineTo(startPoint);
 
@@ -56,23 +56,25 @@ void ArcToBezier(T* aSink, const Point &aOrigin, float aRadius, float aStartAngl
       currentEndAngle = currentStartAngle + arcSweepLeft * sweepDirection;
     }
 
-    Point currentStartPoint(aOrigin.x + cos(currentStartAngle) * aRadius,
-                            aOrigin.y + sin(currentStartAngle) * aRadius);
-    Point currentEndPoint(aOrigin.x + cos(currentEndAngle) * aRadius,
-                          aOrigin.y + sin(currentEndAngle) * aRadius);
+    Point currentStartPoint(aOrigin.x + cos(currentStartAngle) * aRadius.width,
+                            aOrigin.y + sin(currentStartAngle) * aRadius.height);
+    Point currentEndPoint(aOrigin.x + cos(currentEndAngle) * aRadius.width,
+                          aOrigin.y + sin(currentEndAngle) * aRadius.height);
 
     // Calculate kappa constant for partial curve. The sign of angle in the
     // tangent will actually ensure this is negative for a counter clockwise
     // sweep, so changing signs later isn't needed.
-    Float kappa = (4.0f / 3.0f) * tan((currentEndAngle - currentStartAngle) / 4.0f) * aRadius;
+    Float kappaFactor = (4.0f / 3.0f) * tan((currentEndAngle - currentStartAngle) / 4.0f);
+    Float kappaX = kappaFactor * aRadius.width;
+    Float kappaY = kappaFactor * aRadius.height;
 
     Point tangentStart(-sin(currentStartAngle), cos(currentStartAngle));
     Point cp1 = currentStartPoint;
-    cp1 += tangentStart * kappa;
+    cp1 += Point(tangentStart.x * kappaX, tangentStart.y * kappaY);
 
     Point revTangentEnd(sin(currentEndAngle), -cos(currentEndAngle));
     Point cp2 = currentEndPoint;
-    cp2 += revTangentEnd * kappa;
+    cp2 += Point(revTangentEnd.x * kappaX, revTangentEnd.y * kappaY);
 
     aSink->BezierTo(cp1, cp2, currentEndPoint);
 
diff --git a/gfx/2d/PathSkia.cpp b/gfx/2d/PathSkia.cpp
index a28d96e47268..95c0e6b29664 100644
--- a/gfx/2d/PathSkia.cpp
+++ b/gfx/2d/PathSkia.cpp
@@ -88,7 +88,7 @@ void
 PathBuilderSkia::Arc(const Point &aOrigin, float aRadius, float aStartAngle,
                      float aEndAngle, bool aAntiClockwise)
 {
-  ArcToBezier(this, aOrigin, aRadius, aStartAngle, aEndAngle, aAntiClockwise);
+  ArcToBezier(this, aOrigin, Size(aRadius, aRadius), aStartAngle, aEndAngle, aAntiClockwise);
 }
 
 Point

From 911790747368ddc7ee2ffc13a964d5983769322a Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 12:14:36 +0000
Subject: [PATCH 192/459] Bug 944704, part 2 - Update the Mozilla callers of
 Moz2D's ArcToBezier for its new signature. r=Bas

---
 content/canvas/src/CanvasRenderingContext2D.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index 02c6f453031d..74b9992e4b39 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1890,7 +1890,7 @@ CanvasRenderingContext2D::Arc(double x, double y, double r,
 
   EnsureWritablePath();
 
-  ArcToBezier(this, Point(x, y), r, startAngle, endAngle, anticlockwise);
+  ArcToBezier(this, Point(x, y), Size(r, r), startAngle, endAngle, anticlockwise);
 }
 
 void

From 609fb5fc12993e93e49dfcd1a318b6702d8ee75a Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 12:14:37 +0000
Subject: [PATCH 193/459] Bug 944704, part 3 - Fix stroke dashing for SVG
 ellipses so that the dashing starts from the correct point and progresses in
 the correct direction. r=Bas

---
 content/svg/content/src/SVGEllipseElement.cpp | 11 ++++++++-
 layout/reftests/svg/reftest.list              |  1 +
 layout/reftests/svg/stroke-dasharray-02.svg   | 23 +++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 layout/reftests/svg/stroke-dasharray-02.svg

diff --git a/content/svg/content/src/SVGEllipseElement.cpp b/content/svg/content/src/SVGEllipseElement.cpp
index e405500f8416..d82d939ac39d 100644
--- a/content/svg/content/src/SVGEllipseElement.cpp
+++ b/content/svg/content/src/SVGEllipseElement.cpp
@@ -95,6 +95,15 @@ SVGEllipseElement::GetLengthInfo()
 void
 SVGEllipseElement::ConstructPath(gfxContext *aCtx)
 {
+  if (!aCtx->IsCairo()) {
+    RefPtr<Path> path = BuildPath();
+    if (path) {
+      gfxPath gfxpath(path);
+      aCtx->SetPath(&gfxpath);
+    }
+    return;
+  }
+
   float x, y, rx, ry;
 
   GetAnimatedLengthValues(&x, &y, &rx, &ry, nullptr);
@@ -116,7 +125,7 @@ SVGEllipseElement::BuildPath()
 
   RefPtr<PathBuilder> pathBuilder = CreatePathBuilder();
 
-  AppendEllipseToPath(pathBuilder, Point(x, y), Size(2.0*rx, 2.0*ry));
+  ArcToBezier(pathBuilder.get(), Point(x, y), Size(rx, ry), 0, Float(2*M_PI), false);
 
   return pathBuilder->Finish();
 }
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 001bc0355343..4d83eed91f74 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -319,6 +319,7 @@ HTTP(..) == text-scale-02.svg text-scale-02-ref.svg
 HTTP(..) == text-scale-03.svg text-scale-03-ref.svg
 == text-stroke-scaling-01.svg text-stroke-scaling-01-ref.svg
 fails-if(OSX==10.8) == stroke-dasharray-01.svg stroke-dasharray-01-ref.svg # bug 896487
+== stroke-dasharray-02.svg pass.svg
 == stroke-dasharray-and-pathLength-01.svg pass.svg
 == stroke-dasharray-and-text-01.svg stroke-dasharray-and-text-01-ref.svg 
 == stroke-dashoffset-01.svg pass.svg
diff --git a/layout/reftests/svg/stroke-dasharray-02.svg b/layout/reftests/svg/stroke-dasharray-02.svg
new file mode 100644
index 000000000000..ec1c449473c5
--- /dev/null
+++ b/layout/reftests/svg/stroke-dasharray-02.svg
@@ -0,0 +1,23 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <title>Test the start point and direction of dashing on circle and ellipse</title>
+
+  <!-- https://bugzilla.mozilla.org/show_bug.cgi?id=944704 -->
+
+  <rect width="100%" height="100%" fill="lime"/>
+
+  <!-- Test ellipse element dashes cover two red circles -->
+  <circle cx="95" cy="211" r="8" fill="red"/>
+  <circle cx="47" cy="225" r="8" fill="red"/>
+  <ellipse cx="50" cy="200" rx="50" ry="25" fill="none" stroke="lime" stroke-width="25" stroke-dasharray="25 25 25 100000"/>
+
+  <!-- Sanity test to check that two circles cover ellipse element dashes (i.e. that the previous check didn't pass because the stroke was solid) -->
+  <ellipse cx="200" cy="200" rx="50" ry="25" fill="none" stroke="red" stroke-width="10" stroke-dasharray="10 40 10 100000"/>
+  <circle cx="250" cy="205" r="11" fill="lime"/>
+  <circle cx="206" cy="225" r="11" fill="lime"/>
+
+</svg>

From f36cf5885cddf41c32c96beba0b572a0b6b85cbe Mon Sep 17 00:00:00 2001
From: Kannan Vijayan <kvijayan@mozilla.com>
Date: Fri, 13 Dec 2013 08:37:46 -0500
Subject: [PATCH 194/459] Bug 949496 - Correctly handle frame return values
 when bailing to baseline. r=jandem

---
 js/src/jit/BaselineBailouts.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index 9cba919eef9c..d2fccb1da4fa 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -587,8 +587,10 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
             }
         }
 
-        // Second slot holds the return value.
+        // Make sure to add HAS_RVAL to flags here because setFlags() below
+        // will clobber it.
         returnValue = iter.read();
+        flags |= BaselineFrame::HAS_RVAL;
 
         // If script maybe has an arguments object, the third slot will hold it.
         if (script->argumentsHasVarBinding()) {
@@ -603,8 +605,7 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
     IonSpew(IonSpew_BaselineBailouts, "      ReturnValue=%016llx", *((uint64_t *) &returnValue));
     blFrame->setReturnValue(returnValue);
 
-    // Do not need to initialize scratchValue or returnValue fields in BaselineFrame.
-
+    // Do not need to initialize scratchValue field in BaselineFrame.
     blFrame->setFlags(flags);
 
     // initArgsObjUnchecked modifies the frame's flags, so call it after setFlags.

From 12453ea7a3ac4518771b167ca25edcd06a879318 Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 13:41:46 +0000
Subject: [PATCH 195/459] Bug 944704 follow-up to mark
 zoomed-svg-with-viewBox-01.svg very slightly fuzzy on windows. r=orange

---
 layout/reftests/svg/reftest.list | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 4d83eed91f74..ddec78aef847 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -319,7 +319,7 @@ HTTP(..) == text-scale-02.svg text-scale-02-ref.svg
 HTTP(..) == text-scale-03.svg text-scale-03-ref.svg
 == text-stroke-scaling-01.svg text-stroke-scaling-01-ref.svg
 fails-if(OSX==10.8) == stroke-dasharray-01.svg stroke-dasharray-01-ref.svg # bug 896487
-== stroke-dasharray-02.svg pass.svg
+fuzzy-if(winWidget,12,7) == stroke-dasharray-02.svg pass.svg
 == stroke-dasharray-and-pathLength-01.svg pass.svg
 == stroke-dasharray-and-text-01.svg stroke-dasharray-and-text-01-ref.svg 
 == stroke-dashoffset-01.svg pass.svg

From c21b58cae24cc128066bab99c35c605c0bbebcfb Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Fri, 13 Dec 2013 13:43:58 +0000
Subject: [PATCH 196/459] Bug 944704 follow-up to mark
 zoomed-svg-with-viewBox-01.svg very slightly fuzzy on windows. r=orange

---
 layout/reftests/svg/moz-only/reftest.list | 2 +-
 layout/reftests/svg/reftest.list          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/layout/reftests/svg/moz-only/reftest.list b/layout/reftests/svg/moz-only/reftest.list
index b91d2fec0deb..a21d70834598 100644
--- a/layout/reftests/svg/moz-only/reftest.list
+++ b/layout/reftests/svg/moz-only/reftest.list
@@ -19,4 +19,4 @@ skip-if(B2G) random-if(d2d) == feImage-zoom-01a.svg          feImage-zoom-01-ref
 skip-if(B2G) random-if(d2d) == feImage-zoom-01b.svg          feImage-zoom-01-ref.svg # bug 773482
 skip-if(B2G) == foreignObject-zoom-01.svg                    pass.svg # bug 773482
 skip-if(B2G) == zoom-invalidation-01.svg                     pass.svg # bug 773482
-== zoomed-svg-with-viewBox-01.svg          zoomed-svg-with-viewBox-01-ref.svg
+fuzzy-if(winWidget,12,7) == zoomed-svg-with-viewBox-01.svg   zoomed-svg-with-viewBox-01-ref.svg
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index ddec78aef847..4d83eed91f74 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -319,7 +319,7 @@ HTTP(..) == text-scale-02.svg text-scale-02-ref.svg
 HTTP(..) == text-scale-03.svg text-scale-03-ref.svg
 == text-stroke-scaling-01.svg text-stroke-scaling-01-ref.svg
 fails-if(OSX==10.8) == stroke-dasharray-01.svg stroke-dasharray-01-ref.svg # bug 896487
-fuzzy-if(winWidget,12,7) == stroke-dasharray-02.svg pass.svg
+== stroke-dasharray-02.svg pass.svg
 == stroke-dasharray-and-pathLength-01.svg pass.svg
 == stroke-dasharray-and-text-01.svg stroke-dasharray-and-text-01-ref.svg 
 == stroke-dashoffset-01.svg pass.svg

From 1da060fb8985be26a6af4f5ce7293ae21ad90705 Mon Sep 17 00:00:00 2001
From: Bas Schouten <bschouten@mozilla.com>
Date: Fri, 13 Dec 2013 15:22:37 +0100
Subject: [PATCH 197/459] Bug 946540: Deal with inflection points that all lie
 outside of (0, 1). r=jrmuizel

---
 gfx/2d/Path.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gfx/2d/Path.cpp b/gfx/2d/Path.cpp
index c3902e816d94..a505d921e018 100644
--- a/gfx/2d/Path.cpp
+++ b/gfx/2d/Path.cpp
@@ -407,7 +407,8 @@ FlattenBezier(const BezierControlPoints &aControlPoints,
     return;
   }
 
-  if (count == 0) {
+  // Check that at least one of the inflection points is inside [0..1]
+  if (count == 0 || ((t1 < 0 || t1 > 1.0) && ((t2 < 0 || t2 > 1.0) || count == 1)) ) {
     FlattenBezierCurveSegment(aControlPoints, aSink, aTolerance);
     return;
   }

From 912bf8a84622f675678601bc1b1fed33cae5dd06 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Fri, 13 Dec 2013 09:55:39 -0500
Subject: [PATCH 198/459] Bug 940821 - Build crashreporter in unified mode;
 r=ted

---
 toolkit/crashreporter/InjectCrashReporter.h   |  5 +++++
 .../crashreporter/client/crashreporter.cpp    | 20 +++++++++----------
 .../client/crashreporter_win.cpp              |  4 ++++
 toolkit/crashreporter/client/moz.build        | 10 +++++-----
 .../client/linux/crash_generation/moz.build   |  2 +-
 .../src/client/linux/handler/moz.build        |  2 +-
 .../client/linux/minidump_writer/moz.build    |  2 +-
 .../src/client/mac/crash_generation/moz.build |  2 +-
 .../src/client/mac/handler/moz.build          |  2 +-
 .../google-breakpad/src/common/Makefile.in    |  7 -------
 .../src/common/linux/moz.build                | 10 +++++++---
 .../google-breakpad/src/common/mac/moz.build  |  4 ++--
 .../google-breakpad/src/common/moz.build      | 14 ++++++-------
 .../src/common/solaris/moz.build              |  2 +-
 .../google-breakpad/src/processor/moz.build   |  2 +-
 toolkit/crashreporter/moz.build               |  6 +++---
 toolkit/crashreporter/test/moz.build          |  2 +-
 17 files changed, 50 insertions(+), 46 deletions(-)

diff --git a/toolkit/crashreporter/InjectCrashReporter.h b/toolkit/crashreporter/InjectCrashReporter.h
index c315277f5e6a..38c62acfc38b 100644
--- a/toolkit/crashreporter/InjectCrashReporter.h
+++ b/toolkit/crashreporter/InjectCrashReporter.h
@@ -3,6 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef InjectCrashReporter_h
+#define InjectCrashReporter_h
+
 #include "nsThreadUtils.h"
 #include <windows.h>
 
@@ -21,3 +24,5 @@ private:
 };
   
 } // Namespace mozilla
+
+#endif
diff --git a/toolkit/crashreporter/client/crashreporter.cpp b/toolkit/crashreporter/client/crashreporter.cpp
index 5e43ea0bdce7..d00311ed933e 100644
--- a/toolkit/crashreporter/client/crashreporter.cpp
+++ b/toolkit/crashreporter/client/crashreporter.cpp
@@ -36,7 +36,7 @@ int          gArgc;
 char**       gArgv;
 
 static auto_ptr<ofstream> gLogStream(nullptr);
-static string             gDumpFile;
+static string             gReporterDumpFile;
 static string             gExtraFile;
 
 static string kExtraDataExtension = ".extra";
@@ -323,8 +323,8 @@ void DeleteDump()
 {
   const char* noDelete = getenv("MOZ_CRASHREPORTER_NO_DELETE_DUMP");
   if (!noDelete || *noDelete == '\0') {
-    if (!gDumpFile.empty())
-      UIDeleteFile(gDumpFile);
+    if (!gReporterDumpFile.empty())
+      UIDeleteFile(gReporterDumpFile);
     if (!gExtraFile.empty())
       UIDeleteFile(gExtraFile);
   }
@@ -337,7 +337,7 @@ void SendCompleted(bool success, const string& serverResponse)
       DeleteDump();
     }
     else {
-      string directory = gDumpFile;
+      string directory = gReporterDumpFile;
       int slashpos = directory.find_last_of("/\\");
       if (slashpos < 2)
         return;
@@ -446,14 +446,14 @@ int main(int argc, char** argv)
     return 0;
 
   if (argc > 1) {
-    gDumpFile = argv[1];
+    gReporterDumpFile = argv[1];
   }
 
-  if (gDumpFile.empty()) {
+  if (gReporterDumpFile.empty()) {
     // no dump file specified, run the default UI
     UIShowDefaultUI();
   } else {
-    gExtraFile = GetExtraDataFilename(gDumpFile);
+    gExtraFile = GetExtraDataFilename(gReporterDumpFile);
     if (gExtraFile.empty()) {
       UIError(gStrings[ST_ERROR_BADARGUMENTS]);
       return 0;
@@ -514,13 +514,13 @@ int main(int argc, char** argv)
 
     OpenLogFile();
 
-    if (!UIFileExists(gDumpFile)) {
+    if (!UIFileExists(gReporterDumpFile)) {
       UIError(gStrings[ST_ERROR_DUMPFILEEXISTS]);
       return 0;
     }
 
     string pendingDir = gSettingsPath + UI_DIR_SEPARATOR + "pending";
-    if (!MoveCrashData(pendingDir, gDumpFile, gExtraFile)) {
+    if (!MoveCrashData(pendingDir, gReporterDumpFile, gExtraFile)) {
       return 0;
     }
 
@@ -575,7 +575,7 @@ int main(int argc, char** argv)
        return 0;
      }
 
-    if (!UIShowCrashUI(gDumpFile, queryParameters, sendURL, restartArgs))
+    if (!UIShowCrashUI(gReporterDumpFile, queryParameters, sendURL, restartArgs))
       DeleteDump();
   }
 
diff --git a/toolkit/crashreporter/client/crashreporter_win.cpp b/toolkit/crashreporter/client/crashreporter_win.cpp
index 69c1864164d5..3f2f597cf60f 100644
--- a/toolkit/crashreporter/client/crashreporter_win.cpp
+++ b/toolkit/crashreporter/client/crashreporter_win.cpp
@@ -35,6 +35,10 @@
 
 #define WM_UPLOADCOMPLETE WM_APP
 
+// Thanks, Windows.h :(
+#undef min
+#undef max
+
 using std::string;
 using std::wstring;
 using std::map;
diff --git a/toolkit/crashreporter/client/moz.build b/toolkit/crashreporter/client/moz.build
index bc2d59715c0b..e5b938bb37fd 100644
--- a/toolkit/crashreporter/client/moz.build
+++ b/toolkit/crashreporter/client/moz.build
@@ -8,18 +8,18 @@ if CONFIG['OS_TARGET'] != 'Android':
     PROGRAM = 'crashreporter'
 # The xpcshell test case here verifies that the CA certificate list
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'crashreporter.cpp',
 ]
 
 if CONFIG['OS_ARCH'] == 'WINNT':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_win.cpp',
     ]
     DEFINES['UNICODE'] = True
     DEFINES['_UNICODE'] = True
 elif CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_unix_common.cpp',
     ]
 elif CONFIG['OS_ARCH'] == 'SunOS':
@@ -29,13 +29,13 @@ elif CONFIG['OS_ARCH'] == 'SunOS':
     ]
 
 if CONFIG['MOZ_ENABLE_GTK']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_gtk_common.cpp',
         'crashreporter_linux.cpp',
         'crashreporter_unix_common.cpp'
         ]
 
 if CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'crashreporter_osx.mm',
     ]
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build b/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build
index 80b84c416e7f..99439b9ff769 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/crash_generation/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'crash_generation_client.cc',
     'crash_generation_server.cc',
 ]
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build b/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build
index 837b28422ac9..934f2cb58c29 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/handler/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     '../log/log.cc',
     'exception_handler.cc',
     'minidump_descriptor.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build b/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build
index 13e04e1651d0..7fb163eb5c2c 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/linux/minidump_writer/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'linux_dumper.cc',
     'linux_ptrace_dumper.cc',
     'minidump_writer.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build b/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build
index 1667edeb8220..ef24c724a105 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/mac/crash_generation/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'crash_generation_client.cc',
     'crash_generation_server.cc',
 ]
diff --git a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build
index 44696c5f941f..e5938e280e14 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'breakpad_nlist_64.cc',
     'dynamic_images.cc',
     'exception_handler.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/common/Makefile.in b/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
index 9c463d44d21d..38a65ab2a880 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
+++ b/toolkit/crashreporter/google-breakpad/src/common/Makefile.in
@@ -25,10 +25,3 @@ OS_CXXFLAGS += -DHAVE_MACH_O_NLIST_H
 endif
 
 include $(topsrcdir)/config/rules.mk
-
-ifneq (WINNT,$(OS_TARGET))
-# Headers from this directory are included as "common/header.h". Having
-# -I$(srcdir) on the command line makes us use common/memory.h when
-# <memory.h> is included from system headers, which is not intended.
-INCLUDES = $(LOCAL_INCLUDES) -I$(DIST)/include
-endif
diff --git a/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build b/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
index 9af1365e8a56..d54190456f26 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/linux/moz.build
@@ -4,17 +4,21 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'elfutils.cc',
-    'file_id.cc',
     'guid_creator.cc',
     'linux_libc_support.cc',
     'memory_mapped_file.cc',
     'safe_readlink.cc',
 ]
 
+# file_id.cc cannot be built in unified mode because it uses a custom STL_FLAGS
+SOURCES += [
+    'file_id.cc',
+]
+
 if CONFIG['OS_TARGET'] != 'Android':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'http_upload.cc',
     ]
 
diff --git a/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build b/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build
index 86fb60c332ac..bc785a110583 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/mac/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'arch_utilities.cc',
     'bootstrap_compat.cc',
     'file_id.cc',
@@ -19,7 +19,7 @@ SOURCES += [
 # The host lib is used for dump_syms, and the target lib for the
 # crash reporter client.  Therefore, we don't need all the srcs in both.
 if CONFIG['MOZ_CRASHREPORTER']:
-    HOST_SOURCES += SOURCES
+    HOST_SOURCES += UNIFIED_SOURCES
     HOST_SOURCES += [
         'dump_syms.mm',
     ]
diff --git a/toolkit/crashreporter/google-breakpad/src/common/moz.build b/toolkit/crashreporter/google-breakpad/src/common/moz.build
index 4b5f4d0b3dd3..37a5d9350ea0 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/moz.build
@@ -7,11 +7,8 @@
 if CONFIG['OS_ARCH'] in ('Darwin', 'Linux'):
     DIRS += ['dwarf']
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'convert_UTF.c',
-]
-
-SOURCES += [
     'logging.cc',
     'module.cc',
     'pathname_stripper.cc',
@@ -20,7 +17,7 @@ SOURCES += [
 ]
 
 if CONFIG['OS_TARGET'] != 'WINNT':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'arm_ex_reader.cc',
         'arm_ex_to_module.cc',
         'dwarf/bytereader.cc',
@@ -34,7 +31,7 @@ if CONFIG['OS_TARGET'] != 'WINNT':
     ]
 
 if CONFIG['OS_ARCH'] == 'Linux':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'linux/dump_symbols.cc',
         'linux/elf_symbols_to_module.cc',
     ]
@@ -43,7 +40,7 @@ if CONFIG['OS_TARGET'] == 'Android':
     pass
 else:
     if CONFIG['OS_TARGET'] != 'WINNT':
-        SOURCES += [
+        UNIFIED_SOURCES += [
             'stabs_reader.cc',
             'stabs_to_module.cc',
         ]
@@ -69,11 +66,12 @@ if CONFIG['OS_TARGET'] != 'WINNT' and CONFIG['MOZ_CRASHREPORTER']:
     ]
 
 if CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'mac/dump_syms.mm',
     ]
 
 if CONFIG['OS_TARGET'] == 'Android':
+    # We don't support unifying assembly files.
     SOURCES += [
         'android/breakpad_getcontext.S',
     ]
diff --git a/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build b/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build
index c84c532f7ef0..d32c5f6d4694 100644
--- a/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/common/solaris/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'dump_symbols.cc',
     'file_id.cc',
     'guid_creator.cc',
diff --git a/toolkit/crashreporter/google-breakpad/src/processor/moz.build b/toolkit/crashreporter/google-breakpad/src/processor/moz.build
index d1fb342f6e68..2812b12d78d2 100644
--- a/toolkit/crashreporter/google-breakpad/src/processor/moz.build
+++ b/toolkit/crashreporter/google-breakpad/src/processor/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'basic_code_modules.cc',
     'basic_source_line_resolver.cc',
     'call_stack.cc',
diff --git a/toolkit/crashreporter/moz.build b/toolkit/crashreporter/moz.build
index c09f9dcddf6e..312a81d52a95 100644
--- a/toolkit/crashreporter/moz.build
+++ b/toolkit/crashreporter/moz.build
@@ -50,7 +50,7 @@ DIRS += ['client']
 
 if CONFIG['MOZ_CRASHREPORTER_INJECTOR']:
     DIRS += ['injector']
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'InjectCrashReporter.cpp',
         'LoadLibraryRemote.cpp',
     ]
@@ -61,12 +61,12 @@ EXPORTS += [
     'nsExceptionHandler.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'nsExceptionHandler.cpp',
 ]
 
 if CONFIG['OS_ARCH'] == 'Darwin':
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'mac_utils.mm',
     ]
 
diff --git a/toolkit/crashreporter/test/moz.build b/toolkit/crashreporter/test/moz.build
index d4a143826186..bea32bc8813b 100644
--- a/toolkit/crashreporter/test/moz.build
+++ b/toolkit/crashreporter/test/moz.build
@@ -8,7 +8,7 @@ NO_DIST_INSTALL = True
 XPCSHELL_TESTS_MANIFESTS += ['unit/xpcshell.ini', 'unit_ipc/xpcshell.ini']
 BROWSER_CHROME_MANIFESTS += ['browser/browser.ini']
 
-SOURCES += [
+UNIFIED_SOURCES += [
     '../google-breakpad/src/common/logging.cc',
     '../google-breakpad/src/common/pathname_stripper.cc',
     '../google-breakpad/src/processor/basic_code_modules.cc',

From 501e006ac9362fe93ae27b0d085ccf94437a0a52 Mon Sep 17 00:00:00 2001
From: Julian Seward <jseward@acm.org>
Date: Fri, 13 Dec 2013 12:40:24 +0100
Subject: [PATCH 199/459] Bug 867597 - IonMonkey: ARM hwcaps detection depends
 on uninitialised garbage on the stack.  r=mjrosenb

--HG--
extra : rebase_source : aaa617de72c55552bd63f23d392e25785c1bf65a
---
 js/src/jit/arm/Architecture-arm.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/arm/Architecture-arm.cpp b/js/src/jit/arm/Architecture-arm.cpp
index 2c21891fba82..952c830f0e0d 100644
--- a/js/src/jit/arm/Architecture-arm.cpp
+++ b/js/src/jit/arm/Architecture-arm.cpp
@@ -71,7 +71,8 @@ uint32_t GetARMFlags()
         return false;
 
     char buf[1024];
-    fread(buf, sizeof(char), sizeof(buf), fp);
+    memset(buf, 0, sizeof(buf));
+    fread(buf, sizeof(char), sizeof(buf)-1, fp);
     fclose(fp);
     if (strstr(buf, "vfp"))
         flags |= HWCAP_VFP;

From 5477bd694306033337486f8e5c151aaa01ef3e41 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Fri, 13 Dec 2013 16:36:29 +0200
Subject: [PATCH 200/459] Bug 944847, don't try to compile event handlers for
 data documents, r=bz

--HG--
extra : rebase_source : 2b4ce65fad2433475f4b50ccd89b4301cee6c8b2
---
 content/events/src/nsEventListenerManager.cpp |  4 +-
 content/events/test/mochitest.ini             |  1 +
 content/events/test/test_bug944847.html       | 42 +++++++++++++++++++
 3 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 content/events/test/test_bug944847.html

diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index bcdda331095b..5fbb90c768c0 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -1347,7 +1347,9 @@ nsEventListenerManager::GetScriptGlobalAndDocument(nsIDocument** aDoc)
     // XXX sXBL/XBL2 issue -- do we really want the owner here?  What
     // if that's the XBL document?
     doc = node->OwnerDoc();
-    MOZ_ASSERT(!doc->IsLoadedAsData(), "Should not get in here at all");
+    if (doc->IsLoadedAsData()) {
+      return nullptr;
+    }
 
     // We want to allow compiling an event handler even in an unloaded
     // document, so use GetScopeObject here, not GetScriptHandlingObject.
diff --git a/content/events/test/mochitest.ini b/content/events/test/mochitest.ini
index 53e20c50f22f..c42d5277e837 100644
--- a/content/events/test/mochitest.ini
+++ b/content/events/test/mochitest.ini
@@ -84,6 +84,7 @@ skip-if = true # Disabled due to timeouts.
 [test_bug855741.html]
 [test_bug864040.html]
 [test_bug930374-content.html]
+[test_bug944847.html]
 skip-if = toolkit == "gonk"
 [test_clickevent_on_input.html]
 [test_continuous_wheel_events.html]
diff --git a/content/events/test/test_bug944847.html b/content/events/test/test_bug944847.html
new file mode 100644
index 000000000000..105c0d5c93dd
--- /dev/null
+++ b/content/events/test/test_bug944847.html
@@ -0,0 +1,42 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=944847
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 944847</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 944847 **/
+
+    var e1 = document.createElement("div");
+    is(e1.onclick, null);
+    e1.setAttribute("onclick", "");
+    isnot(e1.onclick, null);
+
+    var e2 = document.implementation.createHTMLDocument(null, null).createElement("div");
+    is(e2.onclick, null);
+    e2.setAttribute("onclick", "");
+    is(e2.onclick, null);
+
+    var e3 = document.createElement("div");
+    is(e3.onclick, null);
+    e3.setAttribute("onclick", "");
+    e2.ownerDocument.adoptNode(e3);
+    is(e3.onclick, null);
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=944847">Mozilla Bug 944847</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>

From 9d189300bb7c81e32df5dc4eb616f6c00611e86e Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Fri, 13 Dec 2013 11:26:35 -0500
Subject: [PATCH 201/459] Bug 943612 - don't use GetPosAndText to convert
 offsets to DOM range, r=tbsaunde

---
 .../src/generic/HyperTextAccessible.cpp       | 93 +++++++++++--------
 accessible/src/generic/HyperTextAccessible.h  | 26 ++++--
 2 files changed, 73 insertions(+), 46 deletions(-)

diff --git a/accessible/src/generic/HyperTextAccessible.cpp b/accessible/src/generic/HyperTextAccessible.cpp
index 3770733b8e00..3baed7afd17c 100644
--- a/accessible/src/generic/HyperTextAccessible.cpp
+++ b/accessible/src/generic/HyperTextAccessible.cpp
@@ -548,14 +548,34 @@ HyperTextAccessible::DOMPointToHypertextOffset(nsINode* aNode,
   return nullptr;
 }
 
-nsresult
-HyperTextAccessible::HypertextOffsetsToDOMRange(int32_t aStartHTOffset,
-                                                int32_t aEndHTOffset,
-                                                nsRange* aRange)
+bool
+HyperTextAccessible::OffsetsToDOMRange(int32_t aStartOffset, int32_t aEndOffset,
+                                       nsRange* aRange)
 {
-  // If the given offsets are 0 and associated editor is empty then return
-  // collapsed range with editor root element as range container.
-  if (aStartHTOffset == 0 && aEndHTOffset == 0) {
+  DOMPoint startPoint = OffsetToDOMPoint(aStartOffset);
+  if (!startPoint.node)
+    return false;
+
+  aRange->SetStart(startPoint.node, startPoint.idx);
+  if (aStartOffset == aEndOffset) {
+    aRange->SetEnd(startPoint.node, startPoint.idx);
+    return true;
+  }
+
+  DOMPoint endPoint = OffsetToDOMPoint(aEndOffset);
+  if (!endPoint.node)
+    return false;
+
+  aRange->SetEnd(endPoint.node, endPoint.idx);
+  return true;
+}
+
+DOMPoint
+HyperTextAccessible::OffsetToDOMPoint(int32_t aOffset)
+{
+  // 0 offset is valid even if no children. In this case the associated editor
+  // is empty so return a DOM point for editor root element.
+  if (aOffset == 0) {
     nsCOMPtr<nsIEditor> editor = GetEditor();
     if (editor) {
       bool isEmpty = false;
@@ -565,40 +585,36 @@ HyperTextAccessible::HypertextOffsetsToDOMRange(int32_t aStartHTOffset,
         editor->GetRootElement(getter_AddRefs(editorRootElm));
 
         nsCOMPtr<nsINode> editorRoot(do_QueryInterface(editorRootElm));
-        if (editorRoot) {
-          aRange->SetStart(editorRoot, 0);
-          aRange->SetEnd(editorRoot, 0);
-
-          return NS_OK;
-        }
+        return DOMPoint(editorRoot, 0);
       }
     }
   }
 
-  nsRefPtr<Accessible> startAcc, endAcc;
-  int32_t startOffset = aStartHTOffset, endOffset = aEndHTOffset;
-  nsIFrame *startFrame = nullptr, *endFrame = nullptr;
+  int32_t childIdx = GetChildIndexAtOffset(aOffset);
+  if (childIdx == -1)
+    return DOMPoint();
 
-  startFrame = GetPosAndText(startOffset, endOffset, nullptr, &endFrame,
-                             getter_AddRefs(startAcc), getter_AddRefs(endAcc));
-  if (!startAcc || !endAcc)
-    return NS_ERROR_FAILURE;
+  Accessible* child = GetChildAt(childIdx);
+  int32_t innerOffset = aOffset - GetChildOffset(childIdx);
 
-  DOMPoint startPoint, endPoint;
-  nsresult rv = GetDOMPointByFrameOffset(startFrame, startOffset, startAcc,
-                                         &startPoint);
-  NS_ENSURE_SUCCESS(rv, rv);
+  // A text leaf case. The point is inside the text node.
+  if (child->IsTextLeaf()) {
+    nsIContent* content = child->GetContent();
+    int32_t idx = 0;
+    if (NS_FAILED(RenderedToContentOffset(content->GetPrimaryFrame(),
+                                          innerOffset, &idx)))
+      return DOMPoint();
 
-  rv = aRange->SetStart(startPoint.node, startPoint.idx);
-  NS_ENSURE_SUCCESS(rv, rv);
+    return DOMPoint(content, idx);
+  }
 
-  if (aStartHTOffset == aEndHTOffset)
-    return aRange->SetEnd(startPoint.node, startPoint.idx);
-
-  rv = GetDOMPointByFrameOffset(endFrame, endOffset, endAcc, &endPoint);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  return aRange->SetEnd(endPoint.node, endPoint.idx);
+  // Case of embedded object. The point is either before or after the element.
+  NS_ASSERTION(innerOffset == 0 || innerOffset == 1, "A wrong inner offset!");
+  nsINode* node = child->GetNode();
+  nsINode* parentNode = node->GetParentNode();
+  return parentNode ?
+    DOMPoint(parentNode, parentNode->IndexOf(node) + innerOffset) :
+    DOMPoint();
 }
 
 int32_t
@@ -1580,7 +1596,8 @@ HyperTextAccessible::SetSelectionBoundsAt(int32_t aSelectionNum,
   if (!range)
     return false;
 
-  HypertextOffsetsToDOMRange(startOffset, endOffset, range);
+  if (!OffsetsToDOMRange(startOffset, endOffset, range))
+    return false;
 
   // If new range was created then add it, otherwise notify selection listeners
   // that existing selection range was changed.
@@ -1610,8 +1627,7 @@ HyperTextAccessible::ScrollSubstringTo(int32_t aStartOffset, int32_t aEndOffset,
                                        uint32_t aScrollType)
 {
   nsRefPtr<nsRange> range = new nsRange(mContent);
-  nsresult rv = HypertextOffsetsToDOMRange(aStartOffset, aEndOffset, range);
-  if (NS_SUCCEEDED(rv))
+  if (OffsetsToDOMRange(aStartOffset, aEndOffset, range))
     nsCoreUtils::ScrollSubstringTo(GetFrame(), range, aScrollType);
 }
 
@@ -1629,8 +1645,7 @@ HyperTextAccessible::ScrollSubstringToPoint(int32_t aStartOffset,
                                                         this);
 
   nsRefPtr<nsRange> range = new nsRange(mContent);
-  nsresult rv = HypertextOffsetsToDOMRange(aStartOffset, aEndOffset, range);
-  if (NS_FAILED(rv))
+  if (!OffsetsToDOMRange(aStartOffset, aEndOffset, range))
     return;
 
   nsPresContext* presContext = frame->PresContext();
@@ -1658,7 +1673,7 @@ HyperTextAccessible::ScrollSubstringToPoint(int32_t aStartOffset,
         int16_t hPercent = offsetPointX * 100 / size.width;
         int16_t vPercent = offsetPointY * 100 / size.height;
 
-        rv = nsCoreUtils::ScrollSubstringTo(frame, range, vPercent, hPercent);
+        nsresult rv = nsCoreUtils::ScrollSubstringTo(frame, range, vPercent, hPercent);
         if (NS_FAILED(rv))
           return;
 
diff --git a/accessible/src/generic/HyperTextAccessible.h b/accessible/src/generic/HyperTextAccessible.h
index b7b33fa378d1..93396c119076 100644
--- a/accessible/src/generic/HyperTextAccessible.h
+++ b/accessible/src/generic/HyperTextAccessible.h
@@ -17,6 +17,9 @@ namespace mozilla {
 namespace a11y {
 
 struct DOMPoint {
+  DOMPoint() : node(nullptr), idx(0) { }
+  DOMPoint(nsINode* aNode, int32_t aIdx) : node(aNode), idx(aIdx) { }
+
   nsINode* node;
   int32_t idx;
 };
@@ -128,15 +131,24 @@ public:
                                         bool aIsEndOffset = false) const;
 
   /**
-   * Turn a start and end hypertext offsets into DOM range.
+   * Convert start and end hypertext offsets into DOM range.
    *
-   * @param  aStartHTOffset  [in] the given start hypertext offset
-   * @param  aEndHTOffset    [in] the given end hypertext offset
-   * @param  aRange      [out] the range whose bounds to set
+   * @param  aStartOffset  [in] the given start hypertext offset
+   * @param  aEndOffset    [in] the given end hypertext offset
+   * @param  aRange        [in, out] the range whose bounds to set
+   * @return true   if conversion was successful
    */
-  nsresult HypertextOffsetsToDOMRange(int32_t aStartHTOffset,
-                                      int32_t aEndHTOffset,
-                                      nsRange* aRange);
+  bool OffsetsToDOMRange(int32_t aStartOffset, int32_t aEndOffset,
+                         nsRange* aRange);
+
+  /**
+   * Convert the given offset into DOM point.
+   *
+   * If offset is at text leaf then DOM point is (text node, offsetInTextNode),
+   * if before embedded object then (parent node, indexInParent), if after then
+   * (parent node, indexInParent + 1).
+   */
+  DOMPoint OffsetToDOMPoint(int32_t aOffset);
 
   /**
    * Return true if the used ARIA role (if any) allows the hypertext accessible

From 7185e14125d3ca3e26b667aa6799c616fff38d31 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:46 -0800
Subject: [PATCH 202/459] Bug 949668 - SpiderMonkey: Rename MoveResolver::Move
 to MoveOp. r=jandem

---
 js/src/jit/CodeGenerator.cpp                  |   4 +-
 js/src/jit/MoveResolver.cpp                   |   2 +-
 js/src/jit/MoveResolver.h                     | 286 +++++++++---------
 js/src/jit/arm/CodeGenerator-arm.cpp          |   2 -
 js/src/jit/arm/CodeGenerator-arm.h            |   2 +-
 js/src/jit/arm/MacroAssembler-arm.cpp         |  12 +-
 js/src/jit/arm/MacroAssembler-arm.h           |   5 +-
 js/src/jit/arm/MoveEmitter-arm.cpp            |  12 +-
 js/src/jit/arm/MoveEmitter-arm.h              |   9 +-
 js/src/jit/arm/Trampoline-arm.cpp             |   2 -
 .../jit/shared/CodeGenerator-x86-shared.cpp   |   2 -
 js/src/jit/shared/CodeGenerator-x86-shared.h  |   2 +-
 js/src/jit/shared/MoveEmitter-x86-shared.cpp  |  16 +-
 js/src/jit/shared/MoveEmitter-x86-shared.h    |   7 +-
 js/src/jit/x64/MacroAssembler-x64.cpp         |   6 +-
 js/src/jit/x64/MacroAssembler-x64.h           |   3 -
 js/src/jit/x64/Trampoline-x64.cpp             |   2 -
 js/src/jit/x86/MacroAssembler-x86.cpp         |   4 +-
 js/src/jit/x86/MacroAssembler-x86.h           |   3 -
 js/src/jit/x86/Trampoline-x86.cpp             |   2 -
 20 files changed, 178 insertions(+), 205 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index b9c2d6bd1525..b6fac075a84a 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1183,9 +1183,7 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
         JS_ASSERT(!from->isConstant());
         JS_ASSERT(from->isDouble() == to->isDouble());
 
-        MoveResolver::Move::Kind kind = from->isDouble()
-                                        ? MoveResolver::Move::DOUBLE
-                                        : MoveResolver::Move::GENERAL;
+        MoveOp::Kind kind = from->isDouble() ? MoveOp::DOUBLE : MoveOp::GENERAL;
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), kind))
             return false;
diff --git a/js/src/jit/MoveResolver.cpp b/js/src/jit/MoveResolver.cpp
index 522bd3b17470..4354f24d8ef5 100644
--- a/js/src/jit/MoveResolver.cpp
+++ b/js/src/jit/MoveResolver.cpp
@@ -21,7 +21,7 @@ MoveResolver::resetState()
 }
 
 bool
-MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // Assert that we're not doing no-op moves.
     JS_ASSERT(!(from == to));
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index 601113b8ac01..bbe6f1201a32 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -14,156 +14,156 @@
 namespace js {
 namespace jit {
 
+// This is similar to Operand, but carries more information. We're also not
+// guaranteed that Operand looks like this on all ISAs.
+class MoveOperand
+{
+    enum Kind {
+        REG,
+        FLOAT_REG,
+        ADDRESS,
+        FLOAT_ADDRESS,
+        EFFECTIVE_ADDRESS
+    };
+
+    Kind kind_;
+    uint32_t code_;
+    int32_t disp_;
+
+  public:
+    enum AddressKind {
+        MEMORY = ADDRESS,
+        EFFECTIVE = EFFECTIVE_ADDRESS,
+        FLOAT = FLOAT_ADDRESS
+    };
+
+    MoveOperand()
+    { }
+    explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
+    { }
+    explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
+    { }
+    MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
+        : kind_((Kind) addrKind),
+        code_(reg.code()),
+        disp_(disp)
+    {
+        // With a zero offset, this is a plain reg-to-reg move.
+        if (disp == 0 && addrKind == EFFECTIVE)
+            kind_ = REG;
+    }
+    MoveOperand(const MoveOperand &other)
+      : kind_(other.kind_),
+        code_(other.code_),
+        disp_(other.disp_)
+    { }
+    bool isFloatReg() const {
+        return kind_ == FLOAT_REG;
+    }
+    bool isGeneralReg() const {
+        return kind_ == REG;
+    }
+    bool isDouble() const {
+        return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
+    }
+    bool isMemory() const {
+        return kind_ == ADDRESS;
+    }
+    bool isFloatAddress() const {
+        return kind_ == FLOAT_ADDRESS;
+    }
+    bool isEffectiveAddress() const {
+        return kind_ == EFFECTIVE_ADDRESS;
+    }
+    Register reg() const {
+        JS_ASSERT(isGeneralReg());
+        return Register::FromCode(code_);
+    }
+    FloatRegister floatReg() const {
+        JS_ASSERT(isFloatReg());
+        return FloatRegister::FromCode(code_);
+    }
+    Register base() const {
+        JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
+        return Register::FromCode(code_);
+    }
+    int32_t disp() const {
+        return disp_;
+    }
+
+    bool operator ==(const MoveOperand &other) const {
+        if (kind_ != other.kind_)
+            return false;
+        if (code_ != other.code_)
+            return false;
+        if (isMemory() || isEffectiveAddress())
+            return disp_ == other.disp_;
+        return true;
+    }
+    bool operator !=(const MoveOperand &other) const {
+        return !operator==(other);
+    }
+};
+
+// This represents a move operation.
+class MoveOp
+{
+  protected:
+    MoveOperand from_;
+    MoveOperand to_;
+    bool cycle_;
+
+  public:
+    enum Kind {
+        GENERAL,
+        DOUBLE
+    };
+
+  protected:
+    Kind kind_;
+
+  public:
+    MoveOp()
+    { }
+    MoveOp(const MoveOp &other)
+      : from_(other.from_),
+        to_(other.to_),
+        cycle_(other.cycle_),
+        kind_(other.kind_)
+    { }
+    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+      : from_(from),
+        to_(to),
+        cycle_(cycle),
+        kind_(kind)
+    { }
+
+    bool inCycle() const {
+        return cycle_;
+    }
+    const MoveOperand &from() const {
+        return from_;
+    }
+    const MoveOperand &to() const {
+        return to_;
+    }
+    Kind kind() const {
+        return kind_;
+    }
+};
+
 class MoveResolver
 {
-  public:
-    // This is similar to Operand, but carries more information. We're also not
-    // guaranteed that Operand looks like this on all ISAs.
-    class MoveOperand
-    {
-        enum Kind {
-            REG,
-            FLOAT_REG,
-            ADDRESS,
-            FLOAT_ADDRESS,
-            EFFECTIVE_ADDRESS
-        };
-
-        Kind kind_;
-        uint32_t code_;
-        int32_t disp_;
-
-      public:
-        enum AddressKind {
-            MEMORY = ADDRESS,
-            EFFECTIVE = EFFECTIVE_ADDRESS,
-            FLOAT = FLOAT_ADDRESS
-        };
-
-        MoveOperand()
-        { }
-        explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
-        { }
-        explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
-        { }
-        MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
-            : kind_((Kind) addrKind),
-            code_(reg.code()),
-            disp_(disp)
-        {
-            // With a zero offset, this is a plain reg-to-reg move.
-            if (disp == 0 && addrKind == EFFECTIVE)
-                kind_ = REG;
-        }
-        MoveOperand(const MoveOperand &other)
-          : kind_(other.kind_),
-            code_(other.code_),
-            disp_(other.disp_)
-        { }
-        bool isFloatReg() const {
-            return kind_ == FLOAT_REG;
-        }
-        bool isGeneralReg() const {
-            return kind_ == REG;
-        }
-        bool isDouble() const {
-            return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
-        }
-        bool isMemory() const {
-            return kind_ == ADDRESS;
-        }
-        bool isFloatAddress() const {
-            return kind_ == FLOAT_ADDRESS;
-        }
-        bool isEffectiveAddress() const {
-            return kind_ == EFFECTIVE_ADDRESS;
-        }
-        Register reg() const {
-            JS_ASSERT(isGeneralReg());
-            return Register::FromCode(code_);
-        }
-        FloatRegister floatReg() const {
-            JS_ASSERT(isFloatReg());
-            return FloatRegister::FromCode(code_);
-        }
-        Register base() const {
-            JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
-            return Register::FromCode(code_);
-        }
-        int32_t disp() const {
-            return disp_;
-        }
-
-        bool operator ==(const MoveOperand &other) const {
-            if (kind_ != other.kind_)
-                return false;
-            if (code_ != other.code_)
-                return false;
-            if (isMemory() || isEffectiveAddress())
-                return disp_ == other.disp_;
-            return true;
-        }
-        bool operator !=(const MoveOperand &other) const {
-            return !operator==(other);
-        }
-    };
-
-    class Move
-    {
-      protected:
-        MoveOperand from_;
-        MoveOperand to_;
-        bool cycle_;
-
-      public:
-        enum Kind {
-            GENERAL,
-            DOUBLE
-        };
-
-      protected:
-        Kind kind_;
-
-      public:
-        Move()
-        { }
-        Move(const Move &other)
-          : from_(other.from_),
-            to_(other.to_),
-            cycle_(other.cycle_),
-            kind_(other.kind_)
-        { }
-        Move(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
-          : from_(from),
-            to_(to),
-            cycle_(cycle),
-            kind_(kind)
-        { }
-
-        bool inCycle() const {
-            return cycle_;
-        }
-        const MoveOperand &from() const {
-            return from_;
-        }
-        const MoveOperand &to() const {
-            return to_;
-        }
-        Kind kind() const {
-            return kind_;
-        }
-    };
-
   private:
     struct PendingMove
-      : public Move,
+      : public MoveOp,
         public TempObject,
         public InlineListNode<PendingMove>
     {
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : Move(from, to, kind, false)
+          : MoveOp(from, to, kind, false)
         { }
         
         void setInCycle() {
@@ -178,7 +178,7 @@ class MoveResolver
   private:
     // Moves that are definitely unblocked (constants to registers). These are
     // emitted last.
-    js::Vector<Move, 16, SystemAllocPolicy> orderedMoves_;
+    js::Vector<MoveOp, 16, SystemAllocPolicy> orderedMoves_;
     bool hasCycles_;
 
     TempObjectPool<PendingMove> movePool_;
@@ -200,13 +200,13 @@ class MoveResolver
     //
     // After calling addMove() for each parallel move, resolve() performs the
     // cycle resolution algorithm. Calling addMove() again resets the resolver.
-    bool addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
+    bool addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
     bool resolve();
 
     size_t numMoves() const {
         return orderedMoves_.length();
     }
-    const Move &getMove(size_t i) const {
+    const MoveOp &getMove(size_t i) const {
         return orderedMoves_[i];
     }
     bool hasCycles() const {
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index ae1984e96efc..c53edb5bf8c8 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -1020,8 +1020,6 @@ CodeGeneratorARM::visitPowHalfD(LPowHalfD *ins)
     return true;
 }
 
-typedef MoveResolver::MoveOperand MoveOperand;
-
 MoveOperand
 CodeGeneratorARM::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/arm/CodeGenerator-arm.h b/js/src/jit/arm/CodeGenerator-arm.h
index a916315a485b..08c90dfd8920 100644
--- a/js/src/jit/arm/CodeGenerator-arm.h
+++ b/js/src/jit/arm/CodeGenerator-arm.h
@@ -43,7 +43,7 @@ class CodeGeneratorARM : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutFrom(Label *label, LSnapshot *snapshot);
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index fe039c5ec771..512aad71c061 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3518,26 +3518,26 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
             if (!from.isFloatReg() || from.floatReg() != fr) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), Move::DOUBLE);
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), MoveOp::DOUBLE);
             }
             // else nothing to do; the value is in the right register already
         } else {
             // If (and only if) the integer registers have started spilling, do we
             // need to take the double register's alignment into account
             uint32_t disp = GetFloatArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::DOUBLE);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::DOUBLE);
         }
         usedFloatSlots_++;
     } else {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
             if (!from.isGeneralReg() || from.reg() != r) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), Move::GENERAL);
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), MoveOp::GENERAL);
             }
             // else nothing to do; the value is in the right register already
         } else {
             uint32_t disp = GetIntArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::GENERAL);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::GENERAL);
         }
         usedIntSlots_++;
     }
@@ -3552,13 +3552,13 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
     uint32_t increment = 1;
     bool useResolver = true;
     ++passedArgs_;
-    Move::Kind kind = Move::GENERAL;
+    MoveOp::Kind kind = MoveOp::GENERAL;
     if (from.isDouble()) {
         // Double arguments need to be rounded up to the nearest doubleword
         // boundary, even if it is in a register!
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
-        kind = Move::DOUBLE;
+        kind = MoveOp::DOUBLE;
     }
 
     Register destReg;
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 9fb423cb43b1..ad0e79f2c58f 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -462,7 +462,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     // Used to work around the move resolver's lack of support for
     // moving into register pairs, which the softfp ABI needs.
-    mozilla::Array<MoveResolver::MoveOperand, 2> floatArgsInGPR;
+    mozilla::Array<MoveOperand, 2> floatArgsInGPR;
     mozilla::Array<bool, 2> floatArgsInGPRValid;
 
     // Compute space needed for the function call and set the properties of the
@@ -485,9 +485,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         setFramePushed(framePushed_ + value);
     }
   public:
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     enum Result {
         GENERAL,
         DOUBLE,
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index 72fabee9a4e1..f5ded1122b99 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -100,7 +100,7 @@ MoveEmitterARM::tempReg()
 }
 
 void
-MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -108,7 +108,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move:
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(toOperand(to, true), temp);
@@ -134,7 +134,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move:
 }
 
 void
-MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
+MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -142,7 +142,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(cycleSlot(), temp);
@@ -232,7 +232,7 @@ MoveEmitterARM::emitDoubleMove(const MoveOperand &from, const MoveOperand &to)
 }
 
 void
-MoveEmitterARM::emit(const Move &move)
+MoveEmitterARM::emit(const MoveOp &move)
 {
     const MoveOperand &from = move.from();
     const MoveOperand &to = move.to();
@@ -248,7 +248,7 @@ MoveEmitterARM::emit(const Move &move)
         inCycle_ = true;
     }
 
-    if (move.kind() == Move::DOUBLE)
+    if (move.kind() == MoveOp::DOUBLE)
         emitDoubleMove(from, to);
     else
         emitMove(from, to);
diff --git a/js/src/jit/arm/MoveEmitter-arm.h b/js/src/jit/arm/MoveEmitter-arm.h
index 049dc28fdf13..c1dca9f5f38f 100644
--- a/js/src/jit/arm/MoveEmitter-arm.h
+++ b/js/src/jit/arm/MoveEmitter-arm.h
@@ -17,9 +17,6 @@ class CodeGenerator;
 
 class MoveEmitterARM
 {
-    typedef MoveResolver::Move Move;
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     bool inCycle_;
     MacroAssemblerARMCompat &masm;
 
@@ -49,9 +46,9 @@ class MoveEmitterARM
 
     void emitMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
-    void completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
-    void emit(const Move &move);
+    void breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    void completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    void emit(const MoveOp &move);
 
   public:
     MoveEmitterARM(MacroAssemblerARMCompat &masm);
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 33478fb93f74..6a7291338d3f 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -654,8 +654,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
     VMWrapperMap::AddPtr p = functionWrappers_->lookupForAdd(&f);
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index e7a1fff0ccc7..2a563f422cac 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -1329,8 +1329,6 @@ CodeGeneratorX86Shared::visitUrshD(LUrshD *ins)
     return true;
 }
 
-typedef MoveResolver::MoveOperand MoveOperand;
-
 MoveOperand
 CodeGeneratorX86Shared::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.h b/js/src/jit/shared/CodeGenerator-x86-shared.h
index 8525a41ab8dd..5ec76b33da0a 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.h
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.h
@@ -49,7 +49,7 @@ class CodeGeneratorX86Shared : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutIf(Assembler::DoubleCondition condition, LSnapshot *snapshot);
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 55ce862e0c6d..51ef2b76b73e 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -27,7 +27,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     size_t swapCount = 0;
 
     for (size_t j = i; ; j++) {
-        const Move &move = moves.getMove(j);
+        const MoveOp &move = moves.getMove(j);
 
         // If it isn't a cycle of registers of the same kind, we won't be able
         // to optimize it.
@@ -56,7 +56,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     }
 
     // Check that the last move cycles back to the first move.
-    const Move &move = moves.getMove(i + swapCount);
+    const MoveOp &move = moves.getMove(i + swapCount);
     if (move.from() != moves.getMove(i).to()) {
         *allGeneralRegs = false;
         *allFloatRegs = false;
@@ -99,7 +99,7 @@ void
 MoveEmitterX86::emit(const MoveResolver &moves)
 {
     for (size_t i = 0; i < moves.numMoves(); i++) {
-        const Move &move = moves.getMove(i);
+        const MoveOp &move = moves.getMove(i);
         const MoveOperand &from = move.from();
         const MoveOperand &to = move.to();
 
@@ -128,7 +128,7 @@ MoveEmitterX86::emit(const MoveResolver &moves)
         }
 
         // A normal move which is not part of a cycle.
-        if (move.kind() == Move::DOUBLE)
+        if (move.kind() == MoveOp::DOUBLE)
             emitDoubleMove(from, to);
         else
             emitGeneralMove(from, to);
@@ -204,7 +204,7 @@ MoveEmitterX86::toPopOperand(const MoveOperand &operand) const
 }
 
 void
-MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
+MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -212,7 +212,7 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(toAddress(to), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, cycleSlot());
@@ -225,7 +225,7 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
 }
 
 void
-MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
+MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -233,7 +233,7 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == Move::DOUBLE) {
+    if (kind == MoveOp::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.h b/js/src/jit/shared/MoveEmitter-x86-shared.h
index b7d8fe7446df..01636af4d063 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.h
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.h
@@ -23,9 +23,6 @@ class CodeGenerator;
 
 class MoveEmitterX86
 {
-    typedef MoveResolver::Move Move;
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     bool inCycle_;
     MacroAssemblerSpecific &masm;
 
@@ -48,8 +45,8 @@ class MoveEmitterX86
                                  bool allGeneralRegs, bool allFloatRegs, size_t swapCount);
     void emitGeneralMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &to, Move::Kind kind);
-    void completeCycle(const MoveOperand &to, Move::Kind kind);
+    void breakCycle(const MoveOperand &to, MoveOp::Kind kind);
+    void completeCycle(const MoveOperand &to, MoveOp::Kind kind);
 
   public:
     MoveEmitterX86(MacroAssemblerSpecific &masm);
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index 4586b3f01675..395a90955272 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -149,7 +149,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(double);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, Move::DOUBLE);
+        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::DOUBLE);
     } else {
         Register dest;
         if (GetIntArgReg(passedIntArgs_++, passedFloatArgs_, &dest)) {
@@ -162,7 +162,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(int64_t);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, Move::GENERAL);
+        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::GENERAL);
     }
 }
 
@@ -264,7 +264,7 @@ MacroAssemblerX64::callWithABI(Address fun, Result result)
     if (IsIntArgReg(fun.base)) {
         // Callee register may be clobbered for an argument. Move the callee to
         // r10, a volatile, non-argument register.
-        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), Move::GENERAL);
+        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), MoveOp::GENERAL);
         fun.base = r10;
     }
 
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index fc68f4ad9601..28f4eed9f6f8 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -85,9 +85,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
         FLOAT
     };
 
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     MacroAssemblerX64()
       : inCall_(false),
         enoughMemory_(true)
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index d41d42bea39d..14348720e429 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -503,8 +503,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index ace3e98d36af..c430c2778441 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -169,10 +169,10 @@ MacroAssemblerX86::passABIArg(const MoveOperand &from)
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
     if (from.isDouble()) {
         stackForCall_ += sizeof(double);
-        enoughMemory_ &= moveResolver_.addMove(from, to, Move::DOUBLE);
+        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::DOUBLE);
     } else {
         stackForCall_ += sizeof(int32_t);
-        enoughMemory_ &= moveResolver_.addMove(from, to, Move::GENERAL);
+        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::GENERAL);
     }
 }
 
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index 0d1395a08300..e7ee36481786 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -76,9 +76,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
         FLOAT
     };
 
-    typedef MoveResolver::MoveOperand MoveOperand;
-    typedef MoveResolver::Move Move;
-
     MacroAssemblerX86()
       : inCall_(false),
         enoughMemory_(true)
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index a14d8e2c2dfc..2c6558ccee22 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -538,8 +538,6 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
-    typedef MoveResolver::MoveOperand MoveOperand;
-
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());

From 371b48053374054a33428f21d3b39d5324474af9 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 203/459] Bug 949668 - SpiderMonkey: MoveOp cleanups. r=jandem

---
 js/src/jit/MoveResolver.h | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index bbe6f1201a32..3ae8a50fd053 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -125,16 +125,10 @@ class MoveOp
   public:
     MoveOp()
     { }
-    MoveOp(const MoveOp &other)
-      : from_(other.from_),
-        to_(other.to_),
-        cycle_(other.cycle_),
-        kind_(other.kind_)
-    { }
-    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind)
       : from_(from),
         to_(to),
-        cycle_(cycle),
+        cycle_(false),
         kind_(kind)
     { }
 
@@ -163,14 +157,13 @@ class MoveResolver
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : MoveOp(from, to, kind, false)
+          : MoveOp(from, to, kind)
         { }
-        
+
         void setInCycle() {
             JS_ASSERT(!inCycle());
             cycle_ = true;
         }
-
     };
 
     typedef InlineList<MoveResolver::PendingMove>::iterator PendingMoveIterator;

From 12ce37d8aa70f31130fa0288d356fc93ac2755f4 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 204/459] Bug 949668 - SpiderMonkey: Add an
 LDefinition::Float32 r=jandem

---
 js/src/jit/BacktrackingAllocator.cpp      |  4 +++-
 js/src/jit/LIR.cpp                        |  5 +++--
 js/src/jit/LIR.h                          |  6 ++++--
 js/src/jit/LinearScan.cpp                 |  6 ++++--
 js/src/jit/LiveRangeAllocator.cpp         |  1 +
 js/src/jit/LiveRangeAllocator.h           |  6 +++---
 js/src/jit/Lowering.cpp                   | 26 +++++++++++------------
 js/src/jit/RegisterAllocator.h            |  2 +-
 js/src/jit/StupidAllocator.cpp            |  6 ++++--
 js/src/jit/arm/Lowering-arm.cpp           |  2 +-
 js/src/jit/shared/Lowering-shared-inl.h   | 12 +++++++++--
 js/src/jit/shared/Lowering-shared.h       |  3 ++-
 js/src/jit/shared/Lowering-x86-shared.cpp |  6 +++---
 13 files changed, 52 insertions(+), 33 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 604f397b1ae9..f7b6ad07d6e7 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -1127,7 +1127,9 @@ BacktrackingAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL ||
+                             def->type() == LDefinition::FLOAT32 ||
+                             def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 9588b00bf6cd..e5bd77ca8986 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -196,10 +196,11 @@ static const char * const TypeChars[] =
 {
     "i",            // INTEGER
     "o",            // OBJECT
-    "f",            // DOUBLE
+    "f",            // FLOAT32
+    "d",            // DOUBLE
 #ifdef JS_NUNBOX32
     "t",            // TYPE
-    "d"             // PAYLOAD
+    "p"             // PAYLOAD
 #elif JS_PUNBOX64
     "x"             // BOX
 #endif
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 4f46e117a4d7..9b38d0d77637 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -446,7 +446,8 @@ class LDefinition
         GENERAL,    // Generic, integer or pointer-width data (GPR).
         OBJECT,     // Pointer that may be collected as garbage (GPR).
         SLOTS,      // Slots/elements pointer that may be moved by minor GCs (GPR).
-        DOUBLE,     // 64-bit point value (FPU).
+        FLOAT32,    // 32-bit floating-point value (FPU).
+        DOUBLE,     // 64-bit floating-point value (FPU).
 #ifdef JS_NUNBOX32
         // A type virtual register must be followed by a payload virtual
         // register, as both will be tracked as a single gcthing.
@@ -540,8 +541,9 @@ class LDefinition
           case MIRType_Object:
             return LDefinition::OBJECT;
           case MIRType_Double:
-          case MIRType_Float32:
             return LDefinition::DOUBLE;
+          case MIRType_Float32:
+            return LDefinition::FLOAT32;
 #if defined(JS_PUNBOX64)
           case MIRType_Value:
             return LDefinition::BOX;
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index cd22f4d36818..86731c3ece01 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -515,7 +515,9 @@ LinearScanAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL ||
+                             def->type() == LDefinition::FLOAT32 ||
+                             def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
@@ -792,7 +794,7 @@ LinearScanAllocator::allocateSlotFor(const LiveInterval *interval)
     LinearScanVirtualRegister *reg = &vregs[interval->vreg()];
 
     SlotList *freed;
-    if (reg->type() == LDefinition::DOUBLE)
+    if (reg->type() == LDefinition::DOUBLE || reg->type() == LDefinition::FLOAT32)
         freed = &finishedDoubleSlots_;
 #ifdef JS_NUNBOX32
     else if (IsNunbox(reg))
diff --git a/js/src/jit/LiveRangeAllocator.cpp b/js/src/jit/LiveRangeAllocator.cpp
index 361fdb60ebcd..0d457286657e 100644
--- a/js/src/jit/LiveRangeAllocator.cpp
+++ b/js/src/jit/LiveRangeAllocator.cpp
@@ -468,6 +468,7 @@ AddRegisterToSafepoint(LSafepoint *safepoint, AnyRegister reg, const LDefinition
 
     JS_ASSERT(def.type() == LDefinition::GENERAL ||
               def.type() == LDefinition::DOUBLE ||
+              def.type() == LDefinition::FLOAT32 ||
               def.type() == LDefinition::OBJECT);
 
     if (def.type() == LDefinition::OBJECT)
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index a469ebda4aeb..cfff988c4163 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -136,7 +136,7 @@ static inline bool
 DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation alloc)
 {
     if (ins->isPhi()) {
-        if (def->type() == LDefinition::DOUBLE)
+        if (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
             return alloc.isFloatReg() || alloc.kind() == LAllocation::DOUBLE_SLOT;
         return alloc.isGeneralReg() || alloc.kind() == LAllocation::STACK_SLOT;
     }
@@ -145,7 +145,7 @@ DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation
       case LDefinition::DEFAULT:
         if (!alloc.isRegister())
             return false;
-        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE);
+        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32);
       case LDefinition::PRESET:
         return alloc == *def->output();
       case LDefinition::MUST_REUSE_INPUT:
@@ -473,7 +473,7 @@ class VirtualRegister
         return intervals_.insert(found, interval);
     }
     bool isDouble() const {
-        return def_->type() == LDefinition::DOUBLE;
+        return def_->type() == LDefinition::DOUBLE || def_->type() == LDefinition::FLOAT32;
     }
 
     LiveInterval *intervalFor(CodePosition pos);
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 54b3a02c0a76..875ae3b7ff1e 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -659,7 +659,7 @@ LIRGenerator::visitTest(MTest *test)
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
-        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempFloat(), temp0, temp1);
+        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempDouble(), temp0, temp1);
         if (!useBox(lir, LTestVAndBranch::Input, opd))
             return false;
         return add(lir, test);
@@ -1026,7 +1026,7 @@ LIRGenerator::visitTypeOf(MTypeOf *ins)
 bool
 LIRGenerator::visitToId(MToId *ins)
 {
-    LToIdV *lir = new(alloc()) LToIdV(tempFloat());
+    LToIdV *lir = new(alloc()) LToIdV(tempDouble());
     if (!useBox(lir, LToIdV::Object, ins->lhs()))
         return false;
     if (!useBox(lir, LToIdV::Index, ins->rhs()))
@@ -1175,7 +1175,7 @@ bool
 LIRGenerator::visitRound(MRound *ins)
 {
     JS_ASSERT(ins->num()->type() == MIRType_Double);
-    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempFloat());
+    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempDouble());
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
@@ -1754,7 +1754,7 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::NORMAL);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::NORMAL);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert) && assignSafepoint(lir, convert);
@@ -1799,7 +1799,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::TRUNCATE);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::TRUNCATE);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, truncate) && assignSafepoint(lir, truncate);
@@ -2025,7 +2025,7 @@ LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
 
     LMaybeToDoubleElement *lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
                                                                     useRegisterAtStart(ins->value()),
-                                                                    tempFloat());
+                                                                    tempDouble());
     return defineBox(lir, ins);
 }
 
@@ -2342,7 +2342,7 @@ LIRGenerator::visitNot(MNot *ins)
             temp1 = LDefinition::BogusTemp();
         }
 
-        LNotV *lir = new(alloc()) LNotV(tempFloat(), temp0, temp1);
+        LNotV *lir = new(alloc()) LNotV(tempDouble(), temp0, temp1);
         if (!useBox(lir, LNotV::Input, op))
             return false;
         return define(lir, ins);
@@ -2625,7 +2625,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
 
       case MIRType_Value:
       {
-        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempFloat());
+        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempDouble());
         if (!useBox(lir, LClampVToUint8::Input, in))
             return false;
         return assignSnapshot(lir) && define(lir, ins) && assignSafepoint(lir, ins);
@@ -2912,15 +2912,15 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
         break;
 
       case MIRType_Double:
-        lir = new(alloc()) LAssertRangeD(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeD(useRegister(input), tempDouble());
         break;
 
       case MIRType_Float32:
-        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat());
+        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat32());
         break;
 
       case MIRType_Value:
-        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempFloat(), tempFloat());
+        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempDouble(), tempDouble());
         if (!useBox(lir, LAssertRangeV::Input, input))
             return false;
         break;
@@ -3026,7 +3026,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
         lir = new(alloc()) LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
-                                             temp(), tempFloat());
+                                             temp(), tempDouble());
 
         if (!useBox(lir, LSetElementCacheV::Index, ins->index()))
             return false;
@@ -3035,7 +3035,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     } else {
         lir = new(alloc()) LSetElementCacheT(useByteOpRegister(ins->object()),
                                              useRegisterOrConstant(ins->value()),
-                                             tempToUnbox(), temp(), tempFloat());
+                                             tempToUnbox(), temp(), tempDouble());
 
         if (!useBox(lir, LSetElementCacheT::Index, ins->index()))
             return false;
diff --git a/js/src/jit/RegisterAllocator.h b/js/src/jit/RegisterAllocator.h
index e6059eaef31d..f5f0d2770cfd 100644
--- a/js/src/jit/RegisterAllocator.h
+++ b/js/src/jit/RegisterAllocator.h
@@ -369,7 +369,7 @@ class RegisterAllocator
 static inline AnyRegister
 GetFixedRegister(const LDefinition *def, const LUse *use)
 {
-    return def->type() == LDefinition::DOUBLE
+    return (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
            ? AnyRegister(FloatRegister::FromCode(use->registerCode()))
            : AnyRegister(Register::FromCode(use->registerCode()));
 }
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 921bdf9d08d4..9c350555d9cc 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -28,7 +28,9 @@ StupidAllocator::stackLocation(uint32_t vreg)
     if (def->policy() == LDefinition::PRESET && def->output()->isArgument())
         return def->output();
 
-    return new(alloc()) LStackSlot(DefaultStackSlot(vreg), def->type() == LDefinition::DOUBLE);
+    return new(alloc()) LStackSlot(DefaultStackSlot(vreg),
+                                   def->type() == LDefinition::DOUBLE ||
+                                   def->type() == LDefinition::FLOAT32);
 }
 
 StupidAllocator::RegisterIndex
@@ -162,7 +164,7 @@ StupidAllocator::allocateRegister(LInstruction *ins, uint32_t vreg)
     for (size_t i = 0; i < registerCount; i++) {
         AnyRegister reg = registers[i].reg;
 
-        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE))
+        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32))
             continue;
 
         // Skip the register if it is in use for an allocated input or output.
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index 8f4ca0c78d19..b74971f3e3f6 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -362,7 +362,7 @@ LIRGeneratorARM::newLTableSwitch(const LAllocation &in, const LDefinition &input
 LTableSwitchV *
 LIRGeneratorARM::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempFloat(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempDouble(), tableswitch);
 }
 
 bool
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index 940d346cae9d..fcc6fdc68ca7 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -149,12 +149,14 @@ LIRGeneratorShared::defineReturn(LInstruction *lir, MDefinition *mir)
 #endif
         break;
       case MIRType_Float32:
+        lir->setDef(0, LDefinition(vreg, LDefinition::FLOAT32, LFloatReg(ReturnFloatReg)));
+        break;
       case MIRType_Double:
         lir->setDef(0, LDefinition(vreg, LDefinition::DOUBLE, LFloatReg(ReturnFloatReg)));
         break;
       default:
         LDefinition::Type type = LDefinition::TypeFrom(mir->type());
-        JS_ASSERT(type != LDefinition::DOUBLE);
+        JS_ASSERT(type != LDefinition::DOUBLE && type != LDefinition::FLOAT32);
         lir->setDef(0, LDefinition(vreg, type, LGeneralReg(ReturnReg)));
         break;
     }
@@ -421,7 +423,13 @@ LIRGeneratorShared::tempFixed(Register reg)
 }
 
 LDefinition
-LIRGeneratorShared::tempFloat()
+LIRGeneratorShared::tempFloat32()
+{
+    return temp(LDefinition::FLOAT32);
+}
+
+LDefinition
+LIRGeneratorShared::tempDouble()
 {
     return temp(LDefinition::DOUBLE);
 }
diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
index fdfb74276682..35075335af13 100644
--- a/js/src/jit/shared/Lowering-shared.h
+++ b/js/src/jit/shared/Lowering-shared.h
@@ -104,7 +104,8 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
     // These create temporary register requests.
     inline LDefinition temp(LDefinition::Type type = LDefinition::GENERAL,
                             LDefinition::Policy policy = LDefinition::DEFAULT);
-    inline LDefinition tempFloat();
+    inline LDefinition tempFloat32();
+    inline LDefinition tempDouble();
     inline LDefinition tempCopy(MDefinition *input, uint32_t reusedInput);
 
     // Note that the fixed register has a GENERAL type.
diff --git a/js/src/jit/shared/Lowering-x86-shared.cpp b/js/src/jit/shared/Lowering-x86-shared.cpp
index 8895dba562bc..71d687543dfa 100644
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -27,7 +27,7 @@ LIRGeneratorX86Shared::newLTableSwitch(const LAllocation &in, const LDefinition
 LTableSwitchV *
 LIRGeneratorX86Shared::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempFloat(), temp(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempDouble(), temp(), tableswitch);
 }
 
 bool
@@ -333,7 +333,7 @@ LIRGeneratorX86Shared::lowerTruncateDToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Double);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempDouble();
     return define(new(alloc()) LTruncateDToInt32(useRegister(opd), maybeTemp), ins);
 }
 
@@ -343,6 +343,6 @@ LIRGeneratorX86Shared::lowerTruncateFToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Float32);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat32();
     return define(new(alloc()) LTruncateFToInt32(useRegister(opd), maybeTemp), ins);
 }

From e55bd88d090603b1aa5f8272cf572b71a4de9a04 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 205/459] Bug 949668 - SpiderMonkey: Add a type to LMoveGroup.
 r=jandem

---
 js/src/jit/BacktrackingAllocator.cpp | 15 +++++++-------
 js/src/jit/LIR-Common.h              | 13 +++++++++----
 js/src/jit/LIR.cpp                   | 10 +++++-----
 js/src/jit/LinearScan.cpp            | 29 +++++++++++++++-------------
 js/src/jit/LinearScan.h              |  2 +-
 js/src/jit/LiveRangeAllocator.h      | 20 +++++++++----------
 js/src/jit/StupidAllocator.cpp       | 17 +++++++++-------
 js/src/jit/StupidAllocator.h         |  5 ++++-
 8 files changed, 63 insertions(+), 48 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index f7b6ad07d6e7..bd601cc0a884 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -917,10 +917,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                 LiveInterval *prevInterval = reg->intervalFor(start.previous());
                 if (start.subpos() == CodePosition::INPUT) {
-                    if (!moveInput(inputOf(data->ins()), prevInterval, interval))
+                    if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
                         return false;
                 } else {
-                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
+                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
                         return false;
                 }
             }
@@ -940,7 +940,8 @@ BacktrackingAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            VirtualRegister *vreg = &vregs[phi->getDef(0)];
+            LDefinition *def = phi->getDef(0);
+            VirtualRegister *vreg = &vregs[def];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -952,7 +953,7 @@ BacktrackingAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to))
+                if (!moveAtExit(predecessor, from, to, def->type()))
                     return false;
             }
         }
@@ -977,10 +978,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                     if (mSuccessor->numPredecessors() > 1) {
                         JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                        if (!moveAtExit(predecessor, from, to))
+                        if (!moveAtExit(predecessor, from, to, reg.type()))
                             return false;
                     } else {
-                        if (!moveAtEntry(successor, from, to))
+                        if (!moveAtEntry(successor, from, to, reg.type()))
                             return false;
                     }
                 }
@@ -1076,7 +1077,7 @@ BacktrackingAllocator::reifyAllocations()
 
                     if (*res != *alloc) {
                         LMoveGroup *group = getInputMoveGroup(inputOf(ins));
-                        if (!group->addAfter(sourceAlloc, res))
+                        if (!group->addAfter(sourceAlloc, res, def->type()))
                             return false;
                         *alloc = *res;
                     }
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 8f94028624a1..c4d11cee87e2 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -71,11 +71,13 @@ class LMove
 {
     LAllocation *from_;
     LAllocation *to_;
+    LDefinition::Type type_;
 
   public:
-    LMove(LAllocation *from, LAllocation *to)
+    LMove(LAllocation *from, LAllocation *to, LDefinition::Type type)
       : from_(from),
-        to_(to)
+        to_(to),
+        type_(type)
     { }
 
     LAllocation *from() {
@@ -90,6 +92,9 @@ class LMove
     const LAllocation *to() const {
         return to_;
     }
+    LDefinition::Type type() const {
+        return type_;
+    }
 };
 
 class LMoveGroup : public LInstructionHelper<0, 0, 0>
@@ -110,10 +115,10 @@ class LMoveGroup : public LInstructionHelper<0, 0, 0>
     void printOperands(FILE *fp);
 
     // Add a move which takes place simultaneously with all others in the group.
-    bool add(LAllocation *from, LAllocation *to);
+    bool add(LAllocation *from, LAllocation *to, LDefinition::Type type);
 
     // Add a move which takes place after existing moves in the group.
-    bool addAfter(LAllocation *from, LAllocation *to);
+    bool addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type);
 
     size_t numMoves() const {
         return moves_.length();
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index e5bd77ca8986..114a6724841e 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -363,18 +363,18 @@ LInstruction::initSafepoint(TempAllocator &alloc)
 }
 
 bool
-LMoveGroup::add(LAllocation *from, LAllocation *to)
+LMoveGroup::add(LAllocation *from, LAllocation *to, LDefinition::Type type)
 {
 #ifdef DEBUG
     JS_ASSERT(*from != *to);
     for (size_t i = 0; i < moves_.length(); i++)
         JS_ASSERT(*to != *moves_[i].to());
 #endif
-    return moves_.append(LMove(from, to));
+    return moves_.append(LMove(from, to, type));
 }
 
 bool
-LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
+LMoveGroup::addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type)
 {
     // Transform the operands to this move so that performing the result
     // simultaneously with existing moves in the group will have the same
@@ -392,12 +392,12 @@ LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
 
     for (size_t i = 0; i < moves_.length(); i++) {
         if (*to == *moves_[i].to()) {
-            moves_[i] = LMove(from, to);
+            moves_[i] = LMove(from, to, type);
             return true;
         }
     }
 
-    return add(from, to);
+    return add(from, to, type);
 }
 
 void
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index 86731c3ece01..6a46531ab37b 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -233,7 +233,8 @@ LinearScanAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            LinearScanVirtualRegister *vreg = &vregs[phi->getDef(0)];
+            LDefinition *def = phi->getDef(0);
+            LinearScanVirtualRegister *vreg = &vregs[def];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -245,14 +246,15 @@ LinearScanAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to))
+                if (!moveAtExit(predecessor, from, to, def->type()))
                     return false;
             }
 
             if (vreg->mustSpillAtDefinition() && !to->isSpill()) {
                 // Make sure this phi is spilled at the loop header.
                 LMoveGroup *moves = successor->getEntryMoveGroup(alloc());
-                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill()))
+                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill(),
+                                def->type()))
                     return false;
             }
         }
@@ -283,10 +285,10 @@ LinearScanAllocator::resolveControlFlow()
 
                 if (mSuccessor->numPredecessors() > 1) {
                     JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                    if (!moveAtExit(predecessor, from, to))
+                    if (!moveAtExit(predecessor, from, to, vreg->type()))
                         return false;
                 } else {
-                    if (!moveAtEntry(successor, from, to))
+                    if (!moveAtEntry(successor, from, to, vreg->type()))
                         return false;
                 }
             }
@@ -297,12 +299,13 @@ LinearScanAllocator::resolveControlFlow()
 }
 
 bool
-LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to)
+LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to,
+                                    LDefinition::Type type)
 {
     if (*from == *to)
         return true;
     LMoveGroup *moves = getInputMoveGroup(pos);
-    return moves->add(from, to);
+    return moves->add(from, to, type);
 }
 
 static inline void
@@ -350,7 +353,7 @@ LinearScanAllocator::reifyAllocations()
                 LiveInterval *to = fixedIntervals[GetFixedRegister(reg->def(), usePos->use).code()];
 
                 *static_cast<LAllocation *>(usePos->use) = *to->getAllocation();
-                if (!moveInput(usePos->pos, interval, to))
+                if (!moveInput(usePos->pos, interval, to, reg->type()))
                     return false;
             } else {
                 JS_ASSERT(UseCompatibleWith(usePos->use, *interval->getAllocation()));
@@ -376,7 +379,7 @@ LinearScanAllocator::reifyAllocations()
                 // it should use the fixed register instead.
                 SetOsiPointUses(interval, defEnd, LAllocation(fixedReg));
 
-                if (!moveAfter(defEnd, from, interval))
+                if (!moveAfter(defEnd, from, interval, def->type()))
                     return false;
                 spillFrom = from->getAllocation();
             } else {
@@ -387,7 +390,7 @@ LinearScanAllocator::reifyAllocations()
                     JS_ASSERT(!inputAlloc->isUse());
 
                     *inputAlloc = *interval->getAllocation();
-                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc))
+                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc, def->type()))
                         return false;
                 }
 
@@ -417,7 +420,7 @@ LinearScanAllocator::reifyAllocations()
                 // or Nop instructions). Note that we explicitly ignore phis,
                 // which should have been handled in resolveControlFlow().
                 LMoveGroup *moves = getMoveGroupAfter(defEnd);
-                if (!moves->add(spillFrom, reg->canonicalSpill()))
+                if (!moves->add(spillFrom, reg->canonicalSpill(), def->type()))
                     return false;
             }
         }
@@ -443,10 +446,10 @@ LinearScanAllocator::reifyAllocations()
             JS_ASSERT(start == inputOf(data->ins()) || start == outputOf(data->ins()));
 
             if (start.subpos() == CodePosition::INPUT) {
-                if (!moveInput(inputOf(data->ins()), prevInterval, interval))
+                if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
                     return false;
             } else {
-                if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
+                if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
                     return false;
             }
 
diff --git a/js/src/jit/LinearScan.h b/js/src/jit/LinearScan.h
index 64ce47d9191a..cf194b9e20b9 100644
--- a/js/src/jit/LinearScan.h
+++ b/js/src/jit/LinearScan.h
@@ -111,7 +111,7 @@ class LinearScanAllocator
     AnyRegister::Code findBestFreeRegister(CodePosition *freeUntil);
     AnyRegister::Code findBestBlockedRegister(CodePosition *nextUsed);
     bool canCoexist(LiveInterval *a, LiveInterval *b);
-    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to);
+    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to, LDefinition::Type type);
     void setIntervalRequirement(LiveInterval *interval);
     bool isSpilledAt(LiveInterval *interval, CodePosition pos);
 
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index cfff988c4163..993f1c495451 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -633,37 +633,37 @@ class LiveRangeAllocator : protected RegisterAllocator
     }
 #endif
 
-    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to) {
+    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         JS_ASSERT(*from->getAllocation() != *to->getAllocation());
-        return moves->add(from->getAllocation(), to->getAllocation());
+        return moves->add(from->getAllocation(), to->getAllocation(), type);
     }
 
-    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to) {
+    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getInputMoveGroup(pos);
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to) {
+    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getMoveGroupAfter(pos);
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to) {
+    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getExitMoveGroup(alloc());
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
-    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to) {
+    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getEntryMoveGroup(alloc());
-        return addMove(moves, from, to);
+        return addMove(moves, from, to, type);
     }
 
     size_t findFirstNonCallSafepoint(CodePosition from) const
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 9c350555d9cc..8f9751faba72 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -143,7 +143,7 @@ StupidAllocator::ensureHasRegister(LInstruction *ins, uint32_t vreg)
     }
 
     RegisterIndex best = allocateRegister(ins, vreg);
-    loadRegister(ins, vreg, best);
+    loadRegister(ins, vreg, best, virtualRegisters[vreg]->type());
 
     return registers[best].reg;
 }
@@ -192,7 +192,7 @@ StupidAllocator::syncRegister(LInstruction *ins, RegisterIndex index)
 
         uint32_t existing = registers[index].vreg;
         LAllocation *dest = stackLocation(existing);
-        input->addAfter(source, dest);
+        input->addAfter(source, dest, registers[index].type);
 
         registers[index].dirty = false;
     }
@@ -206,14 +206,15 @@ StupidAllocator::evictRegister(LInstruction *ins, RegisterIndex index)
 }
 
 void
-StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index)
+StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type)
 {
     // Load a vreg from its stack location to a register.
     LMoveGroup *input = getInputMoveGroup(ins->id());
     LAllocation *source = stackLocation(vreg);
     LAllocation *dest = new(alloc()) LAllocation(registers[index].reg);
-    input->addAfter(source, dest);
+    input->addAfter(source, dest, type);
     registers[index].set(vreg, ins);
+    registers[index].type = type;
 }
 
 StupidAllocator::RegisterIndex
@@ -312,7 +313,7 @@ StupidAllocator::syncForBlockEnd(LBlock *block, LInstruction *ins)
                 }
             }
 
-            group->add(source, dest);
+            group->add(source, dest, phi->getDef(0)->type());
         }
     }
 }
@@ -336,14 +337,14 @@ StupidAllocator::allocateForInstruction(LInstruction *ins)
             AnyRegister reg = ensureHasRegister(ins, vreg);
             alloc.replace(LAllocation(reg));
         } else if (use->policy() == LUse::FIXED) {
-            AnyRegister reg = GetFixedRegister(virtualRegisters[use->virtualRegister()], use);
+            AnyRegister reg = GetFixedRegister(virtualRegisters[vreg], use);
             RegisterIndex index = registerIndex(reg);
             if (registers[index].vreg != vreg) {
                 evictRegister(ins, index);
                 RegisterIndex existing = findExistingRegister(vreg);
                 if (existing != UINT32_MAX)
                     evictRegister(ins, existing);
-                loadRegister(ins, vreg, index);
+                loadRegister(ins, vreg, index, virtualRegisters[vreg]->type());
             }
             alloc.replace(LAllocation(reg));
         } else {
@@ -409,6 +410,7 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
                           : ins->getOperand(def->getReusedInput())->toRegister());
         evictRegister(ins, index);
         registers[index].set(vreg, ins, true);
+        registers[index].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[index].reg));
     } else if (def->policy() == LDefinition::PRESET) {
         // The result must be a stack location.
@@ -417,6 +419,7 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
         // Find a register to hold the result of the instruction.
         RegisterIndex best = allocateRegister(ins, vreg);
         registers[best].set(vreg, ins, true);
+        registers[best].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[best].reg));
     }
 }
diff --git a/js/src/jit/StupidAllocator.h b/js/src/jit/StupidAllocator.h
index f48befa0ff8b..e7891b65a264 100644
--- a/js/src/jit/StupidAllocator.h
+++ b/js/src/jit/StupidAllocator.h
@@ -22,6 +22,9 @@ class StupidAllocator : public RegisterAllocator
     struct AllocatedRegister {
         AnyRegister reg;
 
+        // The type of the value in the register.
+        LDefinition::Type type;
+
         // Virtual register this physical reg backs, or MISSING_ALLOCATION.
         uint32_t vreg;
 
@@ -72,7 +75,7 @@ class StupidAllocator : public RegisterAllocator
 
     void syncRegister(LInstruction *ins, RegisterIndex index);
     void evictRegister(LInstruction *ins, RegisterIndex index);
-    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index);
+    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type);
 
     RegisterIndex findExistingRegister(uint32_t vreg);
 

From cf80b63f425d81d156dc2a1847acc945b6de84bb Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 206/459] Bug 949668 - SpiderMonkey: Delete an unused function.
 r=jandem

---
 js/src/jit/LIR.h | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 9b38d0d77637..15baf7bee34e 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -363,10 +363,6 @@ class LStackSlot : public LAllocation
       : LAllocation(isDouble ? DOUBLE_SLOT : STACK_SLOT, slot)
     { }
 
-    bool isDouble() const {
-        return kind() == DOUBLE_SLOT;
-    }
-
     uint32_t slot() const {
         return data();
     }

From d6a58ddb0bbcc9fe95568cbcc90112cce73fb16d Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 207/459] Bug 949668 - SpiderMonkey: Enum simplification.
 r=jandem

---
 js/src/jit/BaselineIC.cpp                    | 10 ++--
 js/src/jit/CodeGenerator.cpp                 | 59 ++++++++++++--------
 js/src/jit/IonMacroAssembler.h               |  4 +-
 js/src/jit/MoveResolver.h                    | 39 +++++++------
 js/src/jit/arm/MacroAssembler-arm.cpp        | 49 +++++++++-------
 js/src/jit/arm/MacroAssembler-arm.h          | 18 ++----
 js/src/jit/arm/MoveEmitter-arm.cpp           |  6 +-
 js/src/jit/arm/Trampoline-arm.cpp            |  8 +--
 js/src/jit/shared/CodeGenerator-shared.cpp   |  2 +-
 js/src/jit/shared/MoveEmitter-x86-shared.cpp |  4 +-
 js/src/jit/x64/MacroAssembler-x64.cpp        | 32 +++++++----
 js/src/jit/x64/MacroAssembler-x64.h          | 18 ++----
 js/src/jit/x64/Trampoline-x64.cpp            | 37 ++++++------
 js/src/jit/x86/CodeGenerator-x86.cpp         |  4 +-
 js/src/jit/x86/MacroAssembler-x86.cpp        | 29 ++++++----
 js/src/jit/x86/MacroAssembler-x86.h          | 18 ++----
 js/src/jit/x86/Trampoline-x86.cpp            | 50 ++++++++---------
 17 files changed, 204 insertions(+), 183 deletions(-)

diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index e12f63ccfe7c..d6a5177a6081 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -2841,9 +2841,9 @@ ICBinaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
         break;
       case JSOP_MOD:
         masm.setupUnalignedABICall(2, R0.scratchReg());
-        masm.passABIArg(FloatReg0);
-        masm.passABIArg(FloatReg1);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
+        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg1, MoveOp::DOUBLE);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
         JS_ASSERT(ReturnFloatReg == FloatReg0);
         break;
       default:
@@ -2968,7 +2968,7 @@ ICBinaryArith_DoubleWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.bind(&truncateABICall);
         masm.push(intReg);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0);
+        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
         masm.pop(intReg);
@@ -3117,7 +3117,7 @@ ICUnaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
 
         masm.bind(&truncateABICall);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0);
+        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index b6fac075a84a..6a03835e0605 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1,4 +1,4 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mnde: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1177,13 +1177,28 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
 
         const LAllocation *from = move.from();
         const LAllocation *to = move.to();
+        LDefinition::Type type = move.type();
 
         // No bogus moves.
         JS_ASSERT(*from != *to);
         JS_ASSERT(!from->isConstant());
         JS_ASSERT(from->isDouble() == to->isDouble());
 
-        MoveOp::Kind kind = from->isDouble() ? MoveOp::DOUBLE : MoveOp::GENERAL;
+        MoveOp::Kind kind;
+        switch (type) {
+          case LDefinition::OBJECT:
+          case LDefinition::SLOTS:
+#ifdef JS_NUNBOX32
+          case LDefinition::TYPE:
+          case LDefinition::PAYLOAD:
+#else
+          case LDefinition::BOX:
+#endif
+          case LDefinition::GENERAL: kind = MoveOp::GENERAL; break;
+          case LDefinition::FLOAT32:
+          case LDefinition::DOUBLE:  kind = MoveOp::DOUBLE;  break;
+          default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
+        }
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), kind))
             return false;
@@ -3035,9 +3050,9 @@ bool CodeGenerator::visitAtan2D(LAtan2D *lir)
     FloatRegister x = ToFloatRegister(lir->x());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(y);
-    masm.passABIArg(x);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MacroAssembler::DOUBLE);
+    masm.passABIArg(y, MoveOp::DOUBLE);
+    masm.passABIArg(x, MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3050,9 +3065,9 @@ bool CodeGenerator::visitHypot(LHypot *lir)
     FloatRegister y = ToFloatRegister(lir->y());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(x);
-    masm.passABIArg(y);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MacroAssembler::DOUBLE);
+    masm.passABIArg(x, MoveOp::DOUBLE);
+    masm.passABIArg(y, MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3791,10 +3806,10 @@ CodeGenerator::visitPowI(LPowI *ins)
     // its scratch register. We can therefore save an input register by
     // reusing the scratch register to pass constants to callWithABI.
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value);
+    masm.passABIArg(value, MoveOp::DOUBLE);
     masm.passABIArg(power);
 
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MacroAssembler::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MoveOp::DOUBLE);
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     return true;
@@ -3808,9 +3823,9 @@ CodeGenerator::visitPowD(LPowD *ins)
     Register temp = ToRegister(ins->temp());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value);
-    masm.passABIArg(power);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MacroAssembler::DOUBLE);
+    masm.passABIArg(value, MoveOp::DOUBLE);
+    masm.passABIArg(power, MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3826,7 +3841,7 @@ CodeGenerator::visitRandom(LRandom *ins)
 
     masm.setupUnalignedABICall(1, temp2);
     masm.passABIArg(temp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MacroAssembler::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MoveOp::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3846,7 +3861,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
         masm.movePtr(ImmPtr(mathCache), temp);
         masm.passABIArg(temp);
     }
-    masm.passABIArg(input);
+    masm.passABIArg(input, MoveOp::DOUBLE);
 
 #   define MAYBE_CACHED(fcn) (mathCache ? (void*)fcn ## _impl : (void*)fcn ## _uncached)
 
@@ -3927,7 +3942,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
 
 #   undef MAYBE_CACHED
 
-    masm.callWithABI(funptr, MacroAssembler::DOUBLE);
+    masm.callWithABI(funptr, MoveOp::DOUBLE);
     return true;
 }
 
@@ -3939,7 +3954,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(1, temp);
-    masm.passABIArg(input);
+    masm.passABIArg(input, MoveOp::DOUBLE);
 
     void *funptr = nullptr;
     switch (ins->mir()->function()) {
@@ -3956,7 +3971,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MacroAssembler::FLOAT);
+    masm.callWithABI(funptr, MoveOp::DOUBLE);
     return true;
 }
 
@@ -3970,13 +3985,13 @@ CodeGenerator::visitModD(LModD *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(lhs);
-    masm.passABIArg(rhs);
+    masm.passABIArg(lhs, MoveOp::DOUBLE);
+    masm.passABIArg(rhs, MoveOp::DOUBLE);
 
     if (gen->compilingAsmJS())
-        masm.callWithABI(AsmJSImm_ModD, MacroAssembler::DOUBLE);
+        masm.callWithABI(AsmJSImm_ModD, MoveOp::DOUBLE);
     else
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
     return true;
 }
 
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 4a03191b8973..297c1c3bb654 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -865,12 +865,12 @@ class MacroAssembler : public MacroAssemblerSpecific
     // been made so that a safepoint can be made at that location.
 
     template <typename T>
-    void callWithABINoProfiling(const T &fun, Result result = GENERAL) {
+    void callWithABINoProfiling(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
         MacroAssemblerSpecific::callWithABI(fun, result);
     }
 
     template <typename T>
-    void callWithABI(const T &fun, Result result = GENERAL) {
+    void callWithABI(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
         leaveSPSFrame();
         callWithABINoProfiling(fun, result);
         reenterSPSFrame();
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index 3ae8a50fd053..099125b57f3d 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -18,38 +18,39 @@ namespace jit {
 // guaranteed that Operand looks like this on all ISAs.
 class MoveOperand
 {
+  public:
     enum Kind {
+        // A register in the "integer", aka "general purpose", class.
         REG,
+        // A register in the "float" register class.
         FLOAT_REG,
-        ADDRESS,
-        FLOAT_ADDRESS,
+        // A memory region.
+        MEMORY,
+        // The address of a memory region.
         EFFECTIVE_ADDRESS
     };
 
+  private:
     Kind kind_;
     uint32_t code_;
     int32_t disp_;
 
   public:
-    enum AddressKind {
-        MEMORY = ADDRESS,
-        EFFECTIVE = EFFECTIVE_ADDRESS,
-        FLOAT = FLOAT_ADDRESS
-    };
-
     MoveOperand()
     { }
     explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
     { }
     explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
     { }
-    MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
-        : kind_((Kind) addrKind),
+    MoveOperand(const Register &reg, int32_t disp, Kind kind = MEMORY)
+        : kind_(kind),
         code_(reg.code()),
         disp_(disp)
     {
+        JS_ASSERT(isMemoryOrEffectiveAddress());
+
         // With a zero offset, this is a plain reg-to-reg move.
-        if (disp == 0 && addrKind == EFFECTIVE)
+        if (disp == 0 && kind_ == EFFECTIVE_ADDRESS)
             kind_ = REG;
     }
     MoveOperand(const MoveOperand &other)
@@ -63,18 +64,15 @@ class MoveOperand
     bool isGeneralReg() const {
         return kind_ == REG;
     }
-    bool isDouble() const {
-        return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
-    }
     bool isMemory() const {
-        return kind_ == ADDRESS;
-    }
-    bool isFloatAddress() const {
-        return kind_ == FLOAT_ADDRESS;
+        return kind_ == MEMORY;
     }
     bool isEffectiveAddress() const {
         return kind_ == EFFECTIVE_ADDRESS;
     }
+    bool isMemoryOrEffectiveAddress() const {
+        return isMemory() || isEffectiveAddress();
+    }
     Register reg() const {
         JS_ASSERT(isGeneralReg());
         return Register::FromCode(code_);
@@ -84,10 +82,11 @@ class MoveOperand
         return FloatRegister::FromCode(code_);
     }
     Register base() const {
-        JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
+        JS_ASSERT(isMemoryOrEffectiveAddress());
         return Register::FromCode(code_);
     }
     int32_t disp() const {
+        JS_ASSERT(isMemoryOrEffectiveAddress());
         return disp_;
     }
 
@@ -96,7 +95,7 @@ class MoveOperand
             return false;
         if (code_ != other.code_)
             return false;
-        if (isMemory() || isEffectiveAddress())
+        if (isMemoryOrEffectiveAddress())
             return disp_ == other.disp_;
         return true;
     }
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 512aad71c061..a8bc75f6f74d 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3508,13 +3508,14 @@ MacroAssemblerARMCompat::setupUnalignedABICall(uint32_t args, const Register &sc
 }
 #ifdef JS_CPU_ARM_HARDFP
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
     ++passedArgs_;
     if (!enoughMemory_)
         return;
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE: {
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
             if (!from.isFloatReg() || from.floatReg() != fr) {
@@ -3528,7 +3529,9 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
             enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::DOUBLE);
         }
         usedFloatSlots_++;
-    } else {
+        break;
+      }
+      case MoveOp::GENERAL: {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
             if (!from.isGeneralReg() || from.reg() != r) {
@@ -3540,31 +3543,39 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
             enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::GENERAL);
         }
         usedIntSlots_++;
+        break;
+      }
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
 }
 
 #else
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
     uint32_t increment = 1;
     bool useResolver = true;
     ++passedArgs_;
-    MoveOp::Kind kind = MoveOp::GENERAL;
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE:
         // Double arguments need to be rounded up to the nearest doubleword
         // boundary, even if it is in a register!
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
-        kind = MoveOp::DOUBLE;
+        break;
+      case MoveOp::GENERAL:
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
     Register destReg;
     MoveOperand dest;
     if (GetIntArgReg(usedSlots_, 0, &destReg)) {
-        if (from.isDouble()) {
+        if (kind == MoveOp::DOUBLE) {
             floatArgsInGPR[destReg.code() >> 1] = from;
             floatArgsInGPRValid[destReg.code() >> 1] = true;
             useResolver = false;
@@ -3588,13 +3599,13 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
 void
 MacroAssemblerARMCompat::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
 }
 
 void
-MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg)
+MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg, MoveOp::Kind kind)
 {
-    passABIArg(MoveOperand(freg));
+    passABIArg(MoveOperand(freg), kind);
 }
 
 void MacroAssemblerARMCompat::checkStackAlignment()
@@ -3642,7 +3653,7 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
             if (from.isFloatReg()) {
                 ma_vxfer(VFPRegister(from.floatReg()), to0, to1);
             } else {
-                JS_ASSERT(from.isFloatAddress());
+                JS_ASSERT(from.isMemory());
                 // Note: We can safely use the MoveOperand's displacement here,
                 // even if the base is SP: MoveEmitter::toOperand adjusts
                 // SP-relative operands by the difference between the current
@@ -3664,25 +3675,25 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, Result result)
+MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 {
     if (secondScratchReg_ != lr)
         ma_mov(secondScratchReg_, lr);
 
     switch (result) {
-      case DOUBLE:
+      case MoveOp::DOUBLE:
 #ifndef JS_CPU_ARM_HARDFP
         // Move double from r0/r1 to ReturnFloatReg.
         as_vxfer(r0, r1, ReturnFloatReg, CoreToFloat);
         break;
 #endif
-      case FLOAT:
+      case MoveOp::FLOAT32:
 #ifndef JS_CPU_ARM_HARDFP
         // Move float32 from r0 to ReturnFloatReg.
         as_vxfer(r0, InvalidReg, VFPRegister(d0).singleOverlay(), CoreToFloat);
         break;
 #endif
-      case GENERAL:
+      case MoveOp::GENERAL:
         break;
 
       default:
@@ -3702,7 +3713,7 @@ MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, Result result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(void *fun, Result result)
+MacroAssemblerARMCompat::callWithABI(void *fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3711,7 +3722,7 @@ MacroAssemblerARMCompat::callWithABI(void *fun, Result result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, Result result)
+MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3720,7 +3731,7 @@ MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, Result result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(const Address &fun, Result result)
+MacroAssemblerARMCompat::callWithABI(const Address &fun, MoveOp::Kind result)
 {
     // Load the callee in r12, no instruction between the ldr and call
     // should clobber it. Note that we can't use fun.base because it may
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index ad0e79f2c58f..91612e990896 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -485,12 +485,6 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         setFramePushed(framePushed_ + value);
     }
   public:
-    enum Result {
-        GENERAL,
-        DOUBLE,
-        FLOAT
-    };
-
     MacroAssemblerARMCompat()
       : inCall_(false),
         enoughMemory_(true),
@@ -1409,9 +1403,9 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from);
+    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg);
+    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
     void passABIArg(const ValueOperand &regs);
 
   protected:
@@ -1419,13 +1413,13 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, Result result);
+    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, Result result = GENERAL);
-    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
-    void callWithABI(const Address &fun, Result result = GENERAL);
+    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
 
     CodeOffsetLabel labelForPatch() {
         return CodeOffsetLabel(nextOffset().getOffset());
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index f5ded1122b99..c7543d7e9543 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -58,7 +58,7 @@ MoveEmitterARM::spillSlot() const
 Operand
 MoveEmitterARM::toOperand(const MoveOperand &operand, bool isFloat) const
 {
-    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress()) {
+    if (operand.isMemoryOrEffectiveAddress()) {
         if (operand.base() != StackPointer) {
             JS_ASSERT(operand.disp() < 1024 && operand.disp() > -1024);
             return Operand(operand.base(), operand.disp());
@@ -193,7 +193,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
             MOZ_ASSUME_UNREACHABLE("strange move!");
         }
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
+        JS_ASSERT(from.isMemoryOrEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), to.reg());
         else
@@ -202,7 +202,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
         // Memory to memory gpr move.
         Register reg = tempReg();
 
-        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
+        JS_ASSERT(from.isMemoryOrEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), reg);
         else
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index 6a7291338d3f..a53d0d02dd9d 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -735,22 +735,22 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         MoveOperand from;
         switch (f.argProperties(explicitArg)) {
           case VMFunction::WordByValue:
-            masm.passABIArg(MoveOperand(argsBase, argDisp));
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByValue:
             // Values should be passed by reference, not by value, so we
             // assert that the argument is a double-precision float.
             JS_ASSERT(f.argPassedInFloatReg(explicitArg));
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
             argDisp += sizeof(double);
             break;
           case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
             argDisp += 2 * sizeof(void *);
             break;
         }
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index bb6aecb62e36..410af5d2b062 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -768,7 +768,7 @@ CodeGeneratorShared::visitOutOfLineTruncateSlow(OutOfLineTruncateSlow *ool)
     }
 
     masm.setupUnalignedABICall(1, dest);
-    masm.passABIArg(src);
+    masm.passABIArg(src, MoveOp::DOUBLE);
     if (gen->compilingAsmJS())
         masm.callWithABI(AsmJSImm_ToInt32);
     else
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 51ef2b76b73e..0054a2c0e718 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -170,7 +170,7 @@ MoveEmitterX86::toAddress(const MoveOperand &operand) const
 Operand
 MoveEmitterX86::toOperand(const MoveOperand &operand) const
 {
-    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress())
+    if (operand.isMemoryOrEffectiveAddress())
         return Operand(toAddress(operand));
     if (operand.isGeneralReg())
         return Operand(operand.reg());
@@ -255,7 +255,7 @@ MoveEmitterX86::emitGeneralMove(const MoveOperand &from, const MoveOperand &to)
     if (from.isGeneralReg()) {
         masm.mov(from.reg(), toOperand(to));
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
+        JS_ASSERT(from.isMemoryOrEffectiveAddress());
         if (from.isMemory())
             masm.loadPtr(toAddress(from), to.reg());
         else
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index 395a90955272..e9591858bfe8 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -134,10 +134,11 @@ MacroAssemblerX64::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX64::passABIArg(const MoveOperand &from)
+MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE: {
         FloatRegister dest;
         if (GetFloatArgReg(passedIntArgs_, passedFloatArgs_++, &dest)) {
             if (from.isFloatReg() && from.floatReg() == dest) {
@@ -147,10 +148,15 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             to = MoveOperand(dest);
         } else {
             to = MoveOperand(StackPointer, stackForCall_);
-            stackForCall_ += sizeof(double);
+            switch (kind) {
+              case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
+              default: MOZ_ASSUME_UNREACHABLE("Unexpected float register class argument kind");
+            }
         }
         enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::DOUBLE);
-    } else {
+        break;
+      }
+      case MoveOp::GENERAL: {
         Register dest;
         if (GetIntArgReg(passedIntArgs_++, passedFloatArgs_, &dest)) {
             if (from.isGeneralReg() && from.reg() == dest) {
@@ -163,19 +169,23 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from)
             stackForCall_ += sizeof(int64_t);
         }
         enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::GENERAL);
+        break;
+      }
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 }
 
 void
 MacroAssemblerX64::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
 }
 
 void
-MacroAssemblerX64::passABIArg(const FloatRegister &reg)
+MacroAssemblerX64::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), kind);
 }
 
 void
@@ -219,7 +229,7 @@ MacroAssemblerX64::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, Result result)
+MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 {
     freeStack(stackAdjust);
     if (dynamicAlignment_)
@@ -230,7 +240,7 @@ MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, Result result)
 }
 
 void
-MacroAssemblerX64::callWithABI(void *fun, Result result)
+MacroAssemblerX64::callWithABI(void *fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -239,7 +249,7 @@ MacroAssemblerX64::callWithABI(void *fun, Result result)
 }
 
 void
-MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, Result result)
+MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -259,7 +269,7 @@ IsIntArgReg(Register reg)
 }
 
 void
-MacroAssemblerX64::callWithABI(Address fun, Result result)
+MacroAssemblerX64::callWithABI(Address fun, MoveOp::Kind result)
 {
     if (IsIntArgReg(fun.base)) {
         // Callee register may be clobbered for an argument. Move the callee to
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index 28f4eed9f6f8..d8bd8b36d077 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -79,12 +79,6 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
-    enum Result {
-        GENERAL,
-        DOUBLE,
-        FLOAT
-    };
-
     MacroAssemblerX64()
       : inCall_(false),
         enoughMemory_(true)
@@ -1199,19 +1193,19 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from);
+    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg);
+    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, Result result);
+    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, Result result = GENERAL);
-    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
-    void callWithABI(Address fun, Result result = GENERAL);
+    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(Address fun, MoveOp::Kind result = MoveOp::GENERAL);
 
     void handleFailureWithHandler(void *handler);
     void handleFailureWithHandlerTail();
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index 14348720e429..0ebc99a01326 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -586,25 +586,24 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    if (f.explicitArgs) {
-        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-            MoveOperand from;
-            switch (f.argProperties(explicitArg)) {
-              case VMFunction::WordByValue:
-                if (f.argPassedInFloatReg(explicitArg))
-                    masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
-                else
-                    masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::WordByRef:
-                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::DoubleByValue:
-              case VMFunction::DoubleByRef:
-                MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
-            }
+    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+        MoveOperand from;
+        switch (f.argProperties(explicitArg)) {
+          case VMFunction::WordByValue:
+            if (f.argPassedInFloatReg(explicitArg))
+                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
+            else
+                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::WordByRef:
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
+                            MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::DoubleByValue:
+          case VMFunction::DoubleByRef:
+            MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
         }
     }
 
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index 534518ff2eaa..48914c71a1fd 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -900,7 +900,7 @@ CodeGeneratorX86::visitOutOfLineTruncate(OutOfLineTruncate *ool)
         saveVolatile(output);
 
         masm.setupUnalignedABICall(1, output);
-        masm.passABIArg(input);
+        masm.passABIArg(input, MoveOp::DOUBLE);
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
         else
@@ -991,7 +991,7 @@ CodeGeneratorX86::visitOutOfLineTruncateFloat32(OutOfLineTruncateFloat32 *ool)
         masm.push(input);
         masm.setupUnalignedABICall(1, output);
         masm.cvtss2sd(input, input);
-        masm.passABIArg(input);
+        masm.passABIArg(input, MoveOp::DOUBLE);
 
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index c430c2778441..3a1629fe45d9 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -163,29 +163,34 @@ MacroAssemblerX86::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX86::passABIArg(const MoveOperand &from)
+MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     ++passedArgs_;
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
-    if (from.isDouble()) {
+    switch (kind) {
+      case MoveOp::DOUBLE:
         stackForCall_ += sizeof(double);
         enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::DOUBLE);
-    } else {
+        break;
+      case MoveOp::GENERAL:
         stackForCall_ += sizeof(int32_t);
         enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::GENERAL);
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 }
 
 void
 MacroAssemblerX86::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
 }
 
 void
-MacroAssemblerX86::passABIArg(const FloatRegister &reg)
+MacroAssemblerX86::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
 {
-    passABIArg(MoveOperand(reg));
+    passABIArg(MoveOperand(reg), kind);
 }
 
 void
@@ -230,16 +235,16 @@ MacroAssemblerX86::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, Result result)
+MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 {
     freeStack(stackAdjust);
-    if (result == DOUBLE) {
+    if (result == MoveOp::DOUBLE) {
         reserveStack(sizeof(double));
         fstp(Operand(esp, 0));
         loadDouble(Operand(esp, 0), ReturnFloatReg);
         freeStack(sizeof(double));
     }
-    if (result == FLOAT) {
+    if (result == MoveOp::FLOAT32) {
         reserveStack(sizeof(float));
         fstp32(Operand(esp, 0));
         loadFloat(Operand(esp, 0), ReturnFloatReg);
@@ -253,7 +258,7 @@ MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, Result result)
 }
 
 void
-MacroAssemblerX86::callWithABI(void *fun, Result result)
+MacroAssemblerX86::callWithABI(void *fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -262,7 +267,7 @@ MacroAssemblerX86::callWithABI(void *fun, Result result)
 }
 
 void
-MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, Result result)
+MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -271,7 +276,7 @@ MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, Result result)
 }
 
 void
-MacroAssemblerX86::callWithABI(const Address &fun, Result result)
+MacroAssemblerX86::callWithABI(const Address &fun, MoveOp::Kind result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index e7ee36481786..eb4a64cb8ae7 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -70,12 +70,6 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
-    enum Result {
-        GENERAL,
-        DOUBLE,
-        FLOAT
-    };
-
     MacroAssemblerX86()
       : inCall_(false),
         enoughMemory_(true)
@@ -1043,19 +1037,19 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from);
+    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg);
+    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, Result result);
+    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, Result result = GENERAL);
-    void callWithABI(AsmJSImmPtr fun, Result result = GENERAL);
-    void callWithABI(const Address &fun, Result result = GENERAL);
+    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(AsmJSImmPtr fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
 
     // Used from within an Exit frame to handle a pending exception.
     void handleFailureWithHandler(void *handler);
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index 2c6558ccee22..6b584b6cbfc1 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -614,31 +614,31 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    if (f.explicitArgs) {
-        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-            MoveOperand from;
-            switch (f.argProperties(explicitArg)) {
-              case VMFunction::WordByValue:
-                masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::DoubleByValue:
-                // We don't pass doubles in float registers on x86, so no need
-                // to check for argPassedInFloatReg.
-                masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                masm.passABIArg(MoveOperand(argsBase, argDisp));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::WordByRef:
-                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
-                argDisp += sizeof(void *);
-                break;
-              case VMFunction::DoubleByRef:
-                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
-                argDisp += 2 * sizeof(void *);
-                break;
-            }
+    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+        MoveOperand from;
+        switch (f.argProperties(explicitArg)) {
+          case VMFunction::WordByValue:
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::DoubleByValue:
+            // We don't pass doubles in float registers on x86, so no need
+            // to check for argPassedInFloatReg.
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::WordByRef:
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
+                            MoveOp::GENERAL);
+            argDisp += sizeof(void *);
+            break;
+          case VMFunction::DoubleByRef:
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
+                            MoveOp::GENERAL);
+            argDisp += 2 * sizeof(void *);
+            break;
         }
     }
 

From 18f4be66a837a5df5accfd6aef845712fd5233d4 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 208/459] Bug 949668 - SpiderMonkey: Add a MoveOp::FLOAT32
 r=jandem

---
 js/src/jit/CodeGenerator.cpp                 |  6 ++--
 js/src/jit/MoveResolver.h                    |  1 +
 js/src/jit/arm/Assembler-arm.h               | 12 +++++++-
 js/src/jit/arm/MacroAssembler-arm.cpp        | 25 +++++++++-------
 js/src/jit/arm/MoveEmitter-arm.cpp           | 31 ++++++++++++++++----
 js/src/jit/shared/MoveEmitter-x86-shared.cpp | 31 ++++++++++++++++----
 js/src/jit/x64/MacroAssembler-x64.cpp        |  6 ++--
 js/src/jit/x86/MacroAssembler-x86.cpp        | 18 ++++--------
 8 files changed, 90 insertions(+), 40 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 6a03835e0605..9f27af7b3c79 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1195,7 +1195,7 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
           case LDefinition::BOX:
 #endif
           case LDefinition::GENERAL: kind = MoveOp::GENERAL; break;
-          case LDefinition::FLOAT32:
+          case LDefinition::FLOAT32: kind = MoveOp::FLOAT32; break;
           case LDefinition::DOUBLE:  kind = MoveOp::DOUBLE;  break;
           default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
         }
@@ -3954,7 +3954,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(1, temp);
-    masm.passABIArg(input, MoveOp::DOUBLE);
+    masm.passABIArg(input, MoveOp::FLOAT32);
 
     void *funptr = nullptr;
     switch (ins->mir()->function()) {
@@ -3971,7 +3971,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MoveOp::DOUBLE);
+    masm.callWithABI(funptr, MoveOp::FLOAT32);
     return true;
 }
 
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index 099125b57f3d..acb1492051d6 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -115,6 +115,7 @@ class MoveOp
   public:
     enum Kind {
         GENERAL,
+        FLOAT32,
         DOUBLE
     };
 
diff --git a/js/src/jit/arm/Assembler-arm.h b/js/src/jit/arm/Assembler-arm.h
index 362d7d183470..9c5107672729 100644
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -2152,9 +2152,19 @@ GetIntArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *paddi
 }
 
 static inline uint32_t
-GetFloatArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
+GetFloat32ArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
 {
+    JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
+    uint32_t intSlots = 0;
+    if (usedIntArgs > NumIntArgRegs)
+        intSlots = usedIntArgs - NumIntArgRegs;
+    uint32_t float32Slots = usedFloatArgs - NumFloatArgRegs;
+    return (intSlots + float32Slots + *padding) * STACK_SLOT_SIZE;
+}
 
+static inline uint32_t
+GetDoubleArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
+{
     JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
     uint32_t intSlots = 0;
     if (usedIntArgs > NumIntArgRegs) {
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index a8bc75f6f74d..64fbbf5b9f23 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3515,18 +3515,20 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
     if (!enoughMemory_)
         return;
     switch (kind) {
+      case MoveOp::FLOAT32:
       case MoveOp::DOUBLE: {
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
-            if (!from.isFloatReg() || from.floatReg() != fr) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), MoveOp::DOUBLE);
+            if (from.isFloatReg() && from.floatReg() == fr) {
+                // Nothing to do; the value is in the right register already
+                return;
             }
-            // else nothing to do; the value is in the right register already
+            to = MoveOperand(fr);
         } else {
             // If (and only if) the integer registers have started spilling, do we
-            // need to take the double register's alignment into account
+            // need to take the register's alignment into account
             uint32_t disp = GetFloatArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::DOUBLE);
+            to = MoveOperand(sp, disp);
         }
         usedFloatSlots_++;
         break;
@@ -3534,13 +3536,14 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
       case MoveOp::GENERAL: {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
-            if (!from.isGeneralReg() || from.reg() != r) {
-                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), MoveOp::GENERAL);
+            if (from.isGeneralReg() && from.reg() == r) {
+                // Nothing to do; the value is in the right register already
+                return;
             }
-            // else nothing to do; the value is in the right register already
+            to = MoveOperand(r);
         } else {
             uint32_t disp = GetIntArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), MoveOp::GENERAL);
+            to = MoveOperand(sp, disp);
         }
         usedIntSlots_++;
         break;
@@ -3549,6 +3552,7 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
         MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
+    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 #else
@@ -3566,6 +3570,7 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
         break;
+      case MoveOp::FLOAT32:
       case MoveOp::GENERAL:
         break;
       default:
@@ -3575,7 +3580,7 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
     Register destReg;
     MoveOperand dest;
     if (GetIntArgReg(usedSlots_, 0, &destReg)) {
-        if (kind == MoveOp::DOUBLE) {
+        if (kind == MoveOp::DOUBLE || kind == MoveOp::FLOAT32) {
             floatArgsInGPR[destReg.code() >> 1] = from;
             floatArgsInGPRValid[destReg.code() >> 1] = true;
             useResolver = false;
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index c7543d7e9543..549d9f6e1a05 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -108,7 +108,9 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(toOperand(to, true), temp);
@@ -116,7 +118,8 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
         } else {
             masm.ma_vstr(to.floatReg(), cycleSlot());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         // an non-vfp value
         if (to.isMemory()) {
             Register temp = tempReg();
@@ -130,6 +133,9 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
             }
             masm.ma_str(to.reg(), cycleSlot());
         }
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -142,7 +148,9 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(cycleSlot(), temp);
@@ -150,7 +158,8 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
         } else {
             masm.ma_vldr(cycleSlot(), to.floatReg());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         if (to.isMemory()) {
             Register temp = tempReg();
             masm.ma_ldr(cycleSlot(), temp);
@@ -162,6 +171,9 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
             }
             masm.ma_ldr(cycleSlot(), to.reg());
         }
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -248,10 +260,17 @@ MoveEmitterARM::emit(const MoveOp &move)
         inCycle_ = true;
     }
 
-    if (move.kind() == MoveOp::DOUBLE)
+    switch (move.kind()) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         emitDoubleMove(from, to);
-    else
+        break;
+      case MoveOp::GENERAL:
         emitMove(from, to);
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
+    }
 }
 
 void
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 0054a2c0e718..597926d11770 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -128,10 +128,17 @@ MoveEmitterX86::emit(const MoveResolver &moves)
         }
 
         // A normal move which is not part of a cycle.
-        if (move.kind() == MoveOp::DOUBLE)
+        switch (move.kind()) {
+          case MoveOp::FLOAT32:
+          case MoveOp::DOUBLE:
             emitDoubleMove(from, to);
-        else
+            break;
+          case MoveOp::GENERAL:
             emitGeneralMove(from, to);
+            break;
+          default:
+            MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
+        }
     }
 }
 
@@ -212,15 +219,21 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             masm.loadDouble(toAddress(to), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, cycleSlot());
         } else {
             masm.storeDouble(to.floatReg(), cycleSlot());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         masm.Push(toOperand(to));
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -233,19 +246,25 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    if (kind == MoveOp::DOUBLE) {
+    switch (kind) {
+      case MoveOp::FLOAT32:
+      case MoveOp::DOUBLE:
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
         } else {
             masm.loadDouble(cycleSlot(), to.floatReg());
         }
-    } else {
+        break;
+      case MoveOp::GENERAL:
         if (to.isMemory()) {
             masm.Pop(toPopOperand(to));
         } else {
             masm.Pop(to.reg());
         }
+        break;
+      default:
+        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index e9591858bfe8..db522ee87ed4 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -138,6 +138,7 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 {
     MoveOperand to;
     switch (kind) {
+      case MoveOp::FLOAT32:
       case MoveOp::DOUBLE: {
         FloatRegister dest;
         if (GetFloatArgReg(passedIntArgs_, passedFloatArgs_++, &dest)) {
@@ -149,11 +150,11 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
         } else {
             to = MoveOperand(StackPointer, stackForCall_);
             switch (kind) {
+              case MoveOp::FLOAT32: stackForCall_ += sizeof(float);  break;
               case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
               default: MOZ_ASSUME_UNREACHABLE("Unexpected float register class argument kind");
             }
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::DOUBLE);
         break;
       }
       case MoveOp::GENERAL: {
@@ -168,12 +169,13 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(int64_t);
         }
-        enoughMemory_ = moveResolver_.addMove(from, to, MoveOp::GENERAL);
         break;
       }
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
+
+    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 void
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index 3a1629fe45d9..a4b00cdc27fb 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -168,17 +168,12 @@ MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
     ++passedArgs_;
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
     switch (kind) {
-      case MoveOp::DOUBLE:
-        stackForCall_ += sizeof(double);
-        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::DOUBLE);
-        break;
-      case MoveOp::GENERAL:
-        stackForCall_ += sizeof(int32_t);
-        enoughMemory_ &= moveResolver_.addMove(from, to, MoveOp::GENERAL);
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+      case MoveOp::FLOAT32: stackForCall_ += sizeof(float); break;
+      case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
+      case MoveOp::GENERAL: stackForCall_ += sizeof(int32_t); break;
+      default: MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
+    enoughMemory_ &= moveResolver_.addMove(from, to, kind);
 }
 
 void
@@ -243,8 +238,7 @@ MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
         fstp(Operand(esp, 0));
         loadDouble(Operand(esp, 0), ReturnFloatReg);
         freeStack(sizeof(double));
-    }
-    if (result == MoveOp::FLOAT32) {
+    } else if (result == MoveOp::FLOAT32) {
         reserveStack(sizeof(float));
         fstp32(Operand(esp, 0));
         loadFloat(Operand(esp, 0), ReturnFloatReg);

From accec5413439fa92818b2a8b7c6f1e50fa115db6 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 209/459] Bug 949171 - SpiderMonkey: Pad the local slot size by
 at least sizeof(Value). r=nbp

---
 js/src/jit/LIR.h                           | 21 +++++++++++++++++++--
 js/src/jit/shared/CodeGenerator-shared.cpp |  3 +--
 js/src/jit/shared/CodeGenerator-shared.h   | 11 ++++++-----
 3 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 15baf7bee34e..20ad0db4317d 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -1394,7 +1394,20 @@ class LIRGraph
         localSlotCount_ = localSlotCount;
     }
     uint32_t localSlotCount() const {
-        return AlignBytes(localSlotCount_, StackAlignment / STACK_SLOT_SIZE);
+        return localSlotCount_;
+    }
+    // Return the localSlotCount() value rounded up so that it satisfies the
+    // platform stack alignment requirement, and so that it's a multiple of
+    // the number of slots per Value.
+    uint32_t paddedLocalSlotCount() const {
+        // Round to StackAlignment, but also round to at least sizeof(Value) in
+        // case that's greater, because StackOffsetOfPassedArg rounds argument
+        // slots to 8-byte boundaries.
+        size_t Alignment = Max(sizeof(StackAlignment), sizeof(Value));
+        return AlignBytes(localSlotCount(), Alignment / STACK_SLOT_SIZE);
+    }
+    size_t paddedLocalSlotsSize() const {
+        return paddedLocalSlotCount() * STACK_SLOT_SIZE;
     }
     void setArgumentSlotCount(uint32_t argumentSlotCount) {
         argumentSlotCount_ = argumentSlotCount;
@@ -1402,8 +1415,12 @@ class LIRGraph
     uint32_t argumentSlotCount() const {
         return argumentSlotCount_;
     }
+    size_t argumentsSize() const {
+        JS_STATIC_ASSERT(sizeof(Value) >= size_t(STACK_SLOT_SIZE));
+        return argumentSlotCount() * sizeof(Value);
+    }
     uint32_t totalSlotCount() const {
-        return localSlotCount() + (argumentSlotCount() * sizeof(Value) / STACK_SLOT_SIZE);
+        return paddedLocalSlotCount() + (argumentsSize() / STACK_SLOT_SIZE);
     }
     bool addConstantToPool(const Value &v, uint32_t *index);
     size_t numConstants() const {
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index 410af5d2b062..4441b399e9a7 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -49,8 +49,7 @@ CodeGeneratorShared::CodeGeneratorShared(MIRGenerator *gen, LIRGraph *graph, Mac
     sps_(&GetIonContext()->runtime->spsProfiler(), &lastPC_),
     osrEntryOffset_(0),
     skipArgCheckEntryOffset_(0),
-    frameDepth_(graph->localSlotCount() * sizeof(STACK_SLOT_SIZE) +
-                graph->argumentSlotCount() * sizeof(Value))
+    frameDepth_(graph->paddedLocalSlotsSize() + graph->argumentsSize())
 {
     if (!gen->compilingAsmJS())
         masm.setInstrumentation(&sps_);
diff --git a/js/src/jit/shared/CodeGenerator-shared.h b/js/src/jit/shared/CodeGenerator-shared.h
index f2bc4f82d894..f174640cf459 100644
--- a/js/src/jit/shared/CodeGenerator-shared.h
+++ b/js/src/jit/shared/CodeGenerator-shared.h
@@ -170,16 +170,17 @@ class CodeGeneratorShared : public LInstructionVisitor
         // A slot of 0 is permitted only to calculate %esp offset for calls.
         JS_ASSERT(slot >= 0 && slot <= int32_t(graph.argumentSlotCount()));
         int32_t offset = masm.framePushed() -
-                       (graph.localSlotCount() * STACK_SLOT_SIZE) -
+                       graph.paddedLocalSlotsSize() -
                        (slot * sizeof(Value));
+
         // Passed arguments go below A function's local stack storage.
         // When arguments are being pushed, there is nothing important on the stack.
         // Therefore, It is safe to push the arguments down arbitrarily.  Pushing
-        // by 8 is desirable since everything on the stack is a Value, which is 8
-        // bytes large.
-
-        offset &= ~7;
+        // by sizeof(Value) is desirable since everything on the stack is a Value.
+        // Note that paddedLocalSlotCount() aligns to at least a Value boundary
+        // specifically to support this.
         JS_ASSERT(offset >= 0);
+        JS_ASSERT(offset % sizeof(Value) == 0);
         return offset;
     }
 

From bf65a5665cb0cd2a61969a29c17b9dda7015712e Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 210/459] Bug 949171 - IonMonkey: Use the right block for
 EffectiveAddressAnalysis r=nbp

---
 js/src/jit/EffectiveAddressAnalysis.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/js/src/jit/EffectiveAddressAnalysis.cpp b/js/src/jit/EffectiveAddressAnalysis.cpp
index 698696f97367..207e23a60467 100644
--- a/js/src/jit/EffectiveAddressAnalysis.cpp
+++ b/js/src/jit/EffectiveAddressAnalysis.cpp
@@ -12,7 +12,7 @@ using namespace js;
 using namespace jit;
 
 static void
-AnalyzeLsh(TempAllocator &alloc, MBasicBlock *block, MLsh *lsh)
+AnalyzeLsh(TempAllocator &alloc, MLsh *lsh)
 {
     if (lsh->specialization() != MIRType_Int32)
         return;
@@ -86,7 +86,7 @@ AnalyzeLsh(TempAllocator &alloc, MBasicBlock *block, MLsh *lsh)
 
     MEffectiveAddress *eaddr = MEffectiveAddress::New(alloc, base, index, scale, displacement);
     last->replaceAllUsesWith(eaddr);
-    block->insertAfter(last, eaddr);
+    last->block()->insertAfter(last, eaddr);
 }
 
 // This analysis converts patterns of the form:
@@ -109,7 +109,7 @@ EffectiveAddressAnalysis::analyze()
     for (ReversePostorderIterator block(graph_.rpoBegin()); block != graph_.rpoEnd(); block++) {
         for (MInstructionIterator i = block->begin(); i != block->end(); i++) {
             if (i->isLsh())
-                AnalyzeLsh(graph_.alloc(), *block, i->toLsh());
+                AnalyzeLsh(graph_.alloc(), i->toLsh());
         }
     }
     return true;

From 9f4e4d2fefa7cb85a36104ab82f2c0a412db1209 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 211/459] Bug 949171 - SpiderMonkey: Tighten up various
 assertions. r=nbp

---
 js/src/jit/BacktrackingAllocator.cpp |  1 +
 js/src/jit/BitSet.h                  | 12 ++++++------
 js/src/jit/CodeGenerator.cpp         | 12 ++++++++++--
 js/src/jit/LIR.cpp                   |  5 +++--
 js/src/jit/Lowering.cpp              |  1 +
 js/src/jit/MIR.h                     |  1 +
 js/src/jit/MIRGraph.cpp              |  2 ++
 js/src/jit/RangeAnalysis.cpp         |  2 +-
 8 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index bd601cc0a884..803079fc2879 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -835,6 +835,7 @@ BacktrackingAllocator::spill(LiveInterval *interval)
     IonSpew(IonSpew_RegAlloc, "Spilling interval");
 
     JS_ASSERT(interval->requirement()->kind() == Requirement::NONE);
+    JS_ASSERT(!interval->getAllocation()->isStackSlot());
 
     // We can't spill bogus intervals.
     JS_ASSERT(interval->hasVreg());
diff --git a/js/src/jit/BitSet.h b/js/src/jit/BitSet.h
index 730557be1efb..4135c346ad38 100644
--- a/js/src/jit/BitSet.h
+++ b/js/src/jit/BitSet.h
@@ -58,7 +58,7 @@ class BitSet : private TempObject
     // O(1): Check if this set contains the given value.
     bool contains(unsigned int value) const {
         JS_ASSERT(bits_);
-        JS_ASSERT(value <= max_);
+        JS_ASSERT(value < max_);
 
         return !!(bits_[wordForValue(value)] & bitForValue(value));
     }
@@ -69,7 +69,7 @@ class BitSet : private TempObject
     // O(1): Insert the given value into this set.
     void insert(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value <= max_);
+        JS_ASSERT(value < max_);
 
         bits_[wordForValue(value)] |= bitForValue(value);
     }
@@ -80,7 +80,7 @@ class BitSet : private TempObject
     // O(1): Remove the given value from this set.
     void remove(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value <= max_);
+        JS_ASSERT(value < max_);
 
         bits_[wordForValue(value)] &= ~bitForValue(value);
     }
@@ -137,7 +137,7 @@ class BitSet::Iterator
 
     inline Iterator& operator++(int dummy) {
         JS_ASSERT(more());
-        JS_ASSERT(index_ <= set_.max_);
+        JS_ASSERT(index_ < set_.max_);
 
         index_++;
         value_ >>= 1;
@@ -158,12 +158,12 @@ class BitSet::Iterator
         index_ += numZeros;
         value_ >>= numZeros;
 
-        JS_ASSERT_IF(index_ <= set_.max_, set_.contains(index_));
+        JS_ASSERT_IF(index_ < set_.max_, set_.contains(index_));
         return *this;
     }
 
     unsigned int operator *() {
-        JS_ASSERT(index_ <= set_.max_);
+        JS_ASSERT(index_ < set_.max_);
         return index_;
     }
 };
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 9f27af7b3c79..f0c05f4ed83b 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1139,6 +1139,7 @@ CodeGenerator::visitStackArgT(LStackArgT *lir)
     const LAllocation *arg = lir->getArgument();
     MIRType argType = lir->mir()->getArgument()->type();
     uint32_t argslot = lir->argslot();
+    JS_ASSERT(argslot - 1u < graph.argumentSlotCount());
 
     int32_t stack_offset = StackOffsetOfPassedArg(argslot);
     Address dest(StackPointer, stack_offset);
@@ -1150,7 +1151,9 @@ CodeGenerator::visitStackArgT(LStackArgT *lir)
     else
         masm.storeValue(*(arg->toConstant()), dest);
 
-    return pushedArgumentSlots_.append(StackOffsetToSlot(stack_offset));
+    uint32_t slot = StackOffsetToSlot(stack_offset);
+    JS_ASSERT(slot - 1u < graph.totalSlotCount());
+    return pushedArgumentSlots_.append(slot);
 }
 
 bool
@@ -1158,10 +1161,15 @@ CodeGenerator::visitStackArgV(LStackArgV *lir)
 {
     ValueOperand val = ToValue(lir, 0);
     uint32_t argslot = lir->argslot();
+    JS_ASSERT(argslot - 1u < graph.argumentSlotCount());
+
     int32_t stack_offset = StackOffsetOfPassedArg(argslot);
 
     masm.storeValue(val, Address(StackPointer, stack_offset));
-    return pushedArgumentSlots_.append(StackOffsetToSlot(stack_offset));
+
+    uint32_t slot = StackOffsetToSlot(stack_offset);
+    JS_ASSERT(slot - 1u < graph.totalSlotCount());
+    return pushedArgumentSlots_.append(slot);
 }
 
 bool
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 114a6724841e..7fef35f37b2f 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -73,8 +73,9 @@ LBlock::lastId()
 {
     LInstruction *last = *instructions_.rbegin();
     JS_ASSERT(last->id());
-    if (last->numDefs())
-        return last->getDef(last->numDefs() - 1)->virtualRegister();
+    // The last instruction is a control flow instruction which does not have
+    // any output.
+    JS_ASSERT(last->numDefs() == 0);
     return last->id();
 }
 
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 875ae3b7ff1e..5f0b099ba712 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -305,6 +305,7 @@ LIRGenerator::visitPassArg(MPassArg *arg)
 {
     MDefinition *opd = arg->getArgument();
     uint32_t argslot = getArgumentSlot(arg->getArgnum());
+    JS_ASSERT(arg->getArgnum() < prepareCallStack_.back()->argc());
 
     // Pass through the virtual register of the operand.
     // This causes snapshots to correctly copy the operand on the stack.
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 97207eed77b7..3eff668f0e5a 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2829,6 +2829,7 @@ class MPassArg
     // Set by the MCall.
     void setArgnum(uint32_t argnum) {
         argnum_ = argnum;
+        JS_ASSERT(argnum_ >= 0);
     }
     uint32_t getArgnum() const {
         JS_ASSERT(argnum_ >= 0);
diff --git a/js/src/jit/MIRGraph.cpp b/js/src/jit/MIRGraph.cpp
index ac4034f6a536..96fb758b3016 100644
--- a/js/src/jit/MIRGraph.cpp
+++ b/js/src/jit/MIRGraph.cpp
@@ -763,6 +763,7 @@ MBasicBlock::discardAllResumePoints(bool discardEntry)
 void
 MBasicBlock::insertBefore(MInstruction *at, MInstruction *ins)
 {
+    JS_ASSERT(at->block() == this);
     ins->setBlock(this);
     graph().allocDefinitionId(ins);
     instructions_.insertBefore(at, ins);
@@ -772,6 +773,7 @@ MBasicBlock::insertBefore(MInstruction *at, MInstruction *ins)
 void
 MBasicBlock::insertAfter(MInstruction *at, MInstruction *ins)
 {
+    JS_ASSERT(at->block() == this);
     ins->setBlock(this);
     graph().allocDefinitionId(ins);
     instructions_.insertAfter(at, ins);
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index a60f4ca555a1..bef8925e1d0a 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -994,7 +994,7 @@ MPhi::computeRange(TempAllocator &alloc)
         return;
 
     Range *range = nullptr;
-    JS_ASSERT(getOperand(0)->op() != MDefinition::Op_OsrValue);
+    JS_ASSERT(!isOSRLikeValue(getOperand(0)));
     for (size_t i = 0, e = numOperands(); i < e; i++) {
         if (getOperand(i)->block()->unreachable()) {
             IonSpew(IonSpew_Range, "Ignoring unreachable input %d", getOperand(i)->id());

From 2607a0f9638a03520f94f5b3b57de18f09a168de Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 212/459] Bug 949171 - SpiderMonkey: Rename bitset's max to
 numBits. r=nbp

---
 js/src/jit/BitSet.cpp | 12 ++++++------
 js/src/jit/BitSet.h   | 43 ++++++++++++++++++++++---------------------
 2 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/js/src/jit/BitSet.cpp b/js/src/jit/BitSet.cpp
index c320ac8574e4..df5fe4846eae 100644
--- a/js/src/jit/BitSet.cpp
+++ b/js/src/jit/BitSet.cpp
@@ -10,9 +10,9 @@ using namespace js;
 using namespace js::jit;
 
 BitSet *
-BitSet::New(TempAllocator &alloc, unsigned int max)
+BitSet::New(TempAllocator &alloc, unsigned int numBits)
 {
-    BitSet *result = new(alloc) BitSet(max);
+    BitSet *result = new(alloc) BitSet(numBits);
     if (!result->init(alloc))
         return nullptr;
     return result;
@@ -47,7 +47,7 @@ void
 BitSet::insertAll(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     for (unsigned int i = 0; i < numWords(); i++)
@@ -58,7 +58,7 @@ void
 BitSet::removeAll(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     for (unsigned int i = 0; i < numWords(); i++)
@@ -69,7 +69,7 @@ void
 BitSet::intersect(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     for (unsigned int i = 0; i < numWords(); i++)
@@ -81,7 +81,7 @@ bool
 BitSet::fixedPointIntersect(const BitSet *other)
 {
     JS_ASSERT(bits_);
-    JS_ASSERT(other->max_ == max_);
+    JS_ASSERT(other->numBits_ == numBits_);
     JS_ASSERT(other->bits_);
 
     bool changed = false;
diff --git a/js/src/jit/BitSet.h b/js/src/jit/BitSet.h
index 4135c346ad38..434b2bac5a77 100644
--- a/js/src/jit/BitSet.h
+++ b/js/src/jit/BitSet.h
@@ -16,7 +16,8 @@ namespace jit {
 
 // Provides constant time set insertion and removal, and fast linear
 // set operations such as intersection, difference, and union.
-// N.B. All set operations must be performed on sets with the same maximum.
+// N.B. All set operations must be performed on sets with the same number
+// of bits.
 class BitSet : private TempObject
 {
   public:
@@ -25,11 +26,11 @@ class BitSet : private TempObject
     }
 
   private:
-    BitSet(unsigned int max) :
-        max_(max),
+    BitSet(unsigned int numBits) :
+        numBits_(numBits),
         bits_(nullptr) {}
 
-    unsigned int max_;
+    unsigned int numBits_;
     uint32_t *bits_;
 
     static inline uint32_t bitForValue(unsigned int value) {
@@ -41,7 +42,7 @@ class BitSet : private TempObject
     }
 
     inline unsigned int numWords() const {
-        return RawLengthForBits(max_);
+        return RawLengthForBits(numBits_);
     }
 
     bool init(TempAllocator &alloc);
@@ -49,56 +50,56 @@ class BitSet : private TempObject
   public:
     class Iterator;
 
-    static BitSet *New(TempAllocator &alloc, unsigned int max);
+    static BitSet *New(TempAllocator &alloc, unsigned int numBits);
 
-    unsigned int getMax() const {
-        return max_;
+    unsigned int getNumBits() const {
+        return numBits_;
     }
 
     // O(1): Check if this set contains the given value.
     bool contains(unsigned int value) const {
         JS_ASSERT(bits_);
-        JS_ASSERT(value < max_);
+        JS_ASSERT(value < numBits_);
 
         return !!(bits_[wordForValue(value)] & bitForValue(value));
     }
 
-    // O(max): Check if this set contains any value.
+    // O(numBits): Check if this set contains any value.
     bool empty() const;
 
     // O(1): Insert the given value into this set.
     void insert(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value < max_);
+        JS_ASSERT(value < numBits_);
 
         bits_[wordForValue(value)] |= bitForValue(value);
     }
 
-    // O(max): Insert every element of the given set into this set.
+    // O(numBits): Insert every element of the given set into this set.
     void insertAll(const BitSet *other);
 
     // O(1): Remove the given value from this set.
     void remove(unsigned int value) {
         JS_ASSERT(bits_);
-        JS_ASSERT(value < max_);
+        JS_ASSERT(value < numBits_);
 
         bits_[wordForValue(value)] &= ~bitForValue(value);
     }
 
-    // O(max): Remove the every element of the given set from this set.
+    // O(numBits): Remove the every element of the given set from this set.
     void removeAll(const BitSet *other);
 
-    // O(max): Intersect this set with the given set.
+    // O(numBits): Intersect this set with the given set.
     void intersect(const BitSet *other);
 
-    // O(max): Intersect this set with the given set; return whether the
+    // O(numBits): Intersect this set with the given set; return whether the
     // intersection caused the set to change.
     bool fixedPointIntersect(const BitSet *other);
 
-    // O(max): Does inplace complement of the set.
+    // O(numBits): Does inplace complement of the set.
     void complement();
 
-    // O(max): Clear this set.
+    // O(numBits): Clear this set.
     void clear();
 
     uint32_t *raw() const {
@@ -137,7 +138,7 @@ class BitSet::Iterator
 
     inline Iterator& operator++(int dummy) {
         JS_ASSERT(more());
-        JS_ASSERT(index_ < set_.max_);
+        JS_ASSERT(index_ < set_.numBits_);
 
         index_++;
         value_ >>= 1;
@@ -158,12 +159,12 @@ class BitSet::Iterator
         index_ += numZeros;
         value_ >>= numZeros;
 
-        JS_ASSERT_IF(index_ < set_.max_, set_.contains(index_));
+        JS_ASSERT_IF(index_ < set_.numBits_, set_.contains(index_));
         return *this;
     }
 
     unsigned int operator *() {
-        JS_ASSERT(index_ < set_.max_);
+        JS_ASSERT(index_ < set_.numBits_);
         return index_;
     }
 };

From c9d9fd8426fb4189f8fe8c8e69a652a9d3c710b0 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 213/459] Bug 949171 - SpiderMonkey: Remove fudge from the
 RawLengthForBits calculation, and fix Safepoint reading to be ok with this.
 r=nbp

---
 js/src/jit/BitSet.h       |  8 +++++---
 js/src/jit/Safepoints.cpp | 15 +++++++--------
 js/src/jit/Safepoints.h   |  2 +-
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/js/src/jit/BitSet.h b/js/src/jit/BitSet.h
index 434b2bac5a77..b602b4285222 100644
--- a/js/src/jit/BitSet.h
+++ b/js/src/jit/BitSet.h
@@ -21,8 +21,10 @@ namespace jit {
 class BitSet : private TempObject
 {
   public:
+    static const size_t BitsPerWord = 8 * sizeof(uint32_t);
+
     static size_t RawLengthForBits(size_t bits) {
-        return 1 + bits / (8 * sizeof(uint32_t));
+        return (bits + BitsPerWord - 1) / BitsPerWord;
     }
 
   private:
@@ -34,11 +36,11 @@ class BitSet : private TempObject
     uint32_t *bits_;
 
     static inline uint32_t bitForValue(unsigned int value) {
-        return 1l << (uint32_t)(value % (8 * sizeof(uint32_t)));
+        return 1l << uint32_t(value % BitsPerWord);
     }
 
     static inline unsigned int wordForValue(unsigned int value) {
-        return value / (8 * sizeof(uint32_t));
+        return value / BitsPerWord;
     }
 
     inline unsigned int numWords() const {
diff --git a/js/src/jit/Safepoints.cpp b/js/src/jit/Safepoints.cpp
index 125d35acb012..c4f0c7906ecf 100644
--- a/js/src/jit/Safepoints.cpp
+++ b/js/src/jit/Safepoints.cpp
@@ -374,22 +374,21 @@ SafepointReader::InvalidationPatchPoint(IonScript *script, const SafepointIndex
 void
 SafepointReader::advanceFromGcRegs()
 {
-    currentSlotChunkNumber_ = 0;
-    currentSlotChunk_ = stream_.readUnsigned();
+    currentSlotChunk_ = 0;
+    nextSlotChunkNumber_ = 0;
 }
 
 bool
 SafepointReader::getSlotFromBitmap(uint32_t *slot)
 {
     while (currentSlotChunk_ == 0) {
-        currentSlotChunkNumber_++;
-
         // Are there any more chunks to read?
-        if (currentSlotChunkNumber_ == BitSet::RawLengthForBits(frameSlots_))
+        if (nextSlotChunkNumber_ == BitSet::RawLengthForBits(frameSlots_))
             return false;
 
         // Yes, read the next chunk.
         currentSlotChunk_ = stream_.readUnsigned();
+        nextSlotChunkNumber_++;
     }
 
     // The current chunk still has bits in it, so get the next bit, then mask
@@ -399,7 +398,7 @@ SafepointReader::getSlotFromBitmap(uint32_t *slot)
 
     // Return the slot, taking care to add 1 back in since it was subtracted
     // when added in the original bitset.
-    *slot = (currentSlotChunkNumber_ * sizeof(uint32_t) * 8) + bit + 1;
+    *slot = ((nextSlotChunkNumber_ - 1) * BitSet::BitsPerWord) + bit + 1;
     return true;
 }
 
@@ -416,8 +415,8 @@ void
 SafepointReader::advanceFromGcSlots()
 {
     // No, reset the counter.
-    currentSlotChunkNumber_ = 0;
-    currentSlotChunk_ = stream_.readUnsigned();
+    currentSlotChunk_ = 0;
+    nextSlotChunkNumber_ = 0;
 }
 
 bool
diff --git a/js/src/jit/Safepoints.h b/js/src/jit/Safepoints.h
index c151634452ac..ea30e50b29be 100644
--- a/js/src/jit/Safepoints.h
+++ b/js/src/jit/Safepoints.h
@@ -61,7 +61,7 @@ class SafepointReader
     CompactBufferReader stream_;
     uint32_t frameSlots_;
     uint32_t currentSlotChunk_;
-    uint32_t currentSlotChunkNumber_;
+    uint32_t nextSlotChunkNumber_;
     uint32_t osiCallPointOffset_;
     GeneralRegisterSet gcSpills_;
     GeneralRegisterSet valueSpills_;

From 329bfe15baf1ab30630e84c70852cc59244e1344 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:47 -0800
Subject: [PATCH 214/459] Bug 949171 - IonMonkey: Check more things in
 AssertBasicGraphCoherency. r=nbp

---
 js/src/jit/IonAnalysis.cpp | 63 ++++++++++++++++++++++++++------------
 js/src/jit/MIR.h           |  1 +
 2 files changed, 44 insertions(+), 20 deletions(-)

diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 839c3ecb2305..049c9de5c5c6 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1253,29 +1253,19 @@ CheckPredecessorImpliesSuccessor(MBasicBlock *A, MBasicBlock *B)
 }
 
 static bool
-CheckOperandImpliesUse(MInstruction *ins, MDefinition *operand)
+CheckOperandImpliesUse(MNode *n, MDefinition *operand)
 {
     for (MUseIterator i = operand->usesBegin(); i != operand->usesEnd(); i++) {
-        if (i->consumer()->isDefinition() && i->consumer()->toDefinition() == ins)
+        if (i->consumer() == n)
             return true;
     }
     return false;
 }
 
 static bool
-CheckUseImpliesOperand(MInstruction *ins, MUse *use)
+CheckUseImpliesOperand(MDefinition *def, MUse *use)
 {
-    MNode *consumer = use->consumer();
-    uint32_t index = use->index();
-
-    if (consumer->isDefinition()) {
-        MDefinition *def = consumer->toDefinition();
-        return (def->getOperand(index) == ins);
-    }
-
-    JS_ASSERT(consumer->isResumePoint());
-    MResumePoint *res = consumer->toResumePoint();
-    return (res->getOperand(index) == ins);
+    return use->consumer()->getOperand(use->index()) == def;
 }
 #endif // DEBUG
 
@@ -1283,11 +1273,27 @@ void
 jit::AssertBasicGraphCoherency(MIRGraph &graph)
 {
 #ifdef DEBUG
+    JS_ASSERT(graph.entryBlock()->numPredecessors() == 0);
+    JS_ASSERT(graph.entryBlock()->phisEmpty());
+    JS_ASSERT(!graph.entryBlock()->unreachable());
+
+    if (MBasicBlock *osrBlock = graph.osrBlock()) {
+        JS_ASSERT(osrBlock->numPredecessors() == 0);
+        JS_ASSERT(osrBlock->phisEmpty());
+        JS_ASSERT(osrBlock != graph.entryBlock());
+        JS_ASSERT(!osrBlock->unreachable());
+    }
+
+    if (MResumePoint *resumePoint = graph.entryResumePoint())
+        JS_ASSERT(resumePoint->block() == graph.entryBlock());
+
     // Assert successor and predecessor list coherency.
     uint32_t count = 0;
     for (MBasicBlockIterator block(graph.begin()); block != graph.end(); block++) {
         count++;
 
+        JS_ASSERT(&block->graph() == &graph);
+
         for (size_t i = 0; i < block->numSuccessors(); i++)
             JS_ASSERT(CheckSuccessorImpliesPredecessor(*block, block->getSuccessor(i)));
 
@@ -1295,13 +1301,30 @@ jit::AssertBasicGraphCoherency(MIRGraph &graph)
             JS_ASSERT(CheckPredecessorImpliesSuccessor(*block, block->getPredecessor(i)));
 
         // Assert that use chains are valid for this instruction.
-        for (MInstructionIterator ins = block->begin(); ins != block->end(); ins++) {
-            for (uint32_t i = 0, e = ins->numOperands(); i < e; i++)
-                JS_ASSERT(CheckOperandImpliesUse(*ins, ins->getOperand(i)));
+        for (MDefinitionIterator iter(*block); iter; iter++) {
+            for (uint32_t i = 0, e = iter->numOperands(); i < e; i++)
+                JS_ASSERT(CheckOperandImpliesUse(*iter, iter->getOperand(i)));
         }
-        for (MInstructionIterator ins = block->begin(); ins != block->end(); ins++) {
-            for (MUseIterator i(ins->usesBegin()); i != ins->usesEnd(); i++)
-                JS_ASSERT(CheckUseImpliesOperand(*ins, *i));
+        for (MResumePointIterator iter(block->resumePointsBegin()); iter != block->resumePointsEnd(); iter++) {
+            for (uint32_t i = 0, e = iter->numOperands(); i < e; i++) {
+                if (iter->getUseFor(i)->hasProducer())
+                    JS_ASSERT(CheckOperandImpliesUse(*iter, iter->getOperand(i)));
+            }
+        }
+        for (MPhiIterator phi(block->phisBegin()); phi != block->phisEnd(); phi++) {
+            JS_ASSERT(phi->numOperands() == block->numPredecessors());
+        }
+        for (MDefinitionIterator iter(*block); iter; iter++) {
+            JS_ASSERT(iter->block() == *block);
+            for (MUseIterator i(iter->usesBegin()); i != iter->usesEnd(); i++)
+                JS_ASSERT(CheckUseImpliesOperand(*iter, *i));
+
+            if (iter->isInstruction()) {
+                if (MResumePoint *resume = iter->toInstruction()->resumePoint()) {
+                    if (MInstruction *ins = resume->instruction())
+                        JS_ASSERT(ins->block() == iter->block());
+                }
+            }
         }
     }
 
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 3eff668f0e5a..b8bd03eb23f1 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -9005,6 +9005,7 @@ class MResumePoint MOZ_FINAL : public MNode, public InlineForwardListNode<MResum
 
   private:
     friend class MBasicBlock;
+    friend void AssertBasicGraphCoherency(MIRGraph &graph);
 
     FixedList<MUse> operands_;
     uint32_t stackDepth_;

From 7bfe3843b4f032b3ac890deb89eeb985497c5301 Mon Sep 17 00:00:00 2001
From: Dan Gohman <sunfish@google.com>
Date: Fri, 13 Dec 2013 08:27:48 -0800
Subject: [PATCH 215/459] Bug 949171 - IonMonkey: Enforce some invariants for
 LSafepoint. r=nbp

---
 js/src/jit/LIR.h | 63 +++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 49 insertions(+), 14 deletions(-)

diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 20ad0db4317d..3181cd053871 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -1026,6 +1026,14 @@ class LSafepoint : public TempObject
     SlotList slotsOrElementsSlots_;
 
   public:
+    void assertInvariants() {
+        // Every register in valueRegs and gcRegs should also be in liveRegs.
+#ifndef JS_NUNBOX32
+        JS_ASSERT((valueRegs().bits() & ~liveRegs().gprs().bits()) == 0);
+#endif
+        JS_ASSERT((gcRegs().bits() & ~liveRegs().gprs().bits()) == 0);
+    }
+
     LSafepoint(TempAllocator &alloc)
       : safepointOffset_(INVALID_SAFEPOINT_OFFSET)
       , osiCallPointOffset_(0)
@@ -1036,9 +1044,12 @@ class LSafepoint : public TempObject
       , partialNunboxes_(0)
 #endif
       , slotsOrElementsSlots_(alloc)
-    { }
+    {
+      assertInvariants();
+    }
     void addLiveRegister(AnyRegister reg) {
         liveRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     const RegisterSet &liveRegs() const {
         return liveRegs_;
@@ -1046,6 +1057,7 @@ class LSafepoint : public TempObject
 #ifdef CHECK_OSIPOINT_REGISTERS
     void addTempRegister(AnyRegister reg) {
         tempRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     const RegisterSet &tempRegs() const {
         return tempRegs_;
@@ -1053,12 +1065,16 @@ class LSafepoint : public TempObject
 #endif
     void addGcRegister(Register reg) {
         gcRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     GeneralRegisterSet gcRegs() const {
         return gcRegs_;
     }
     bool addGcSlot(uint32_t slot) {
-        return gcSlots_.append(slot);
+        bool result = gcSlots_.append(slot);
+        if (result)
+            assertInvariants();
+        return result;
     }
     SlotList &gcSlots() {
         return gcSlots_;
@@ -1072,18 +1088,23 @@ class LSafepoint : public TempObject
     }
     void addSlotsOrElementsRegister(Register reg) {
         slotsOrElementsRegs_.addUnchecked(reg);
+        assertInvariants();
     }
     bool addSlotsOrElementsSlot(uint32_t slot) {
-        return slotsOrElementsSlots_.append(slot);
+        bool result = slotsOrElementsSlots_.append(slot);
+        if (result)
+            assertInvariants();
+        return result;
     }
     bool addSlotsOrElementsPointer(LAllocation alloc) {
         if (alloc.isStackSlot())
             return addSlotsOrElementsSlot(alloc.toStackSlot()->slot());
         JS_ASSERT(alloc.isRegister());
         addSlotsOrElementsRegister(alloc.toRegister().gpr());
+        assertInvariants();
         return true;
     }
-    bool hasSlotsOrElementsPointer(LAllocation alloc) {
+    bool hasSlotsOrElementsPointer(LAllocation alloc) const {
         if (alloc.isRegister())
             return slotsOrElementsRegs().has(alloc.toRegister().gpr());
         if (alloc.isStackSlot()) {
@@ -1101,10 +1122,11 @@ class LSafepoint : public TempObject
             return addGcSlot(alloc.toStackSlot()->slot());
         if (alloc.isRegister())
             addGcRegister(alloc.toRegister().gpr());
+        assertInvariants();
         return true;
     }
 
-    bool hasGcPointer(LAllocation alloc) {
+    bool hasGcPointer(LAllocation alloc) const {
         if (alloc.isRegister())
             return gcRegs().has(alloc.toRegister().gpr());
         if (alloc.isStackSlot()) {
@@ -1119,13 +1141,16 @@ class LSafepoint : public TempObject
     }
 
     bool addValueSlot(uint32_t slot) {
-        return valueSlots_.append(slot);
+        bool result = valueSlots_.append(slot);
+        if (result)
+            assertInvariants();
+        return result;
     }
     SlotList &valueSlots() {
         return valueSlots_;
     }
 
-    bool hasValueSlot(uint32_t slot) {
+    bool hasValueSlot(uint32_t slot) const {
         for (size_t i = 0; i < valueSlots_.length(); i++) {
             if (valueSlots_[i] == slot)
                 return true;
@@ -1136,7 +1161,10 @@ class LSafepoint : public TempObject
 #ifdef JS_NUNBOX32
 
     bool addNunboxParts(LAllocation type, LAllocation payload) {
-        return nunboxParts_.append(NunboxEntry(type, payload));
+        bool result = nunboxParts_.append(NunboxEntry(type, payload));
+        if (result)
+            assertInvariants();
+        return result;
     }
 
     bool addNunboxType(uint32_t typeVreg, LAllocation type) {
@@ -1153,10 +1181,13 @@ class LSafepoint : public TempObject
 
         // vregs for nunbox pairs are adjacent, with the type coming first.
         uint32_t payloadVreg = typeVreg + 1;
-        return nunboxParts_.append(NunboxEntry(type, LUse(payloadVreg, LUse::ANY)));
+        bool result = nunboxParts_.append(NunboxEntry(type, LUse(payloadVreg, LUse::ANY)));
+        if (result)
+            assertInvariants();
+        return result;
     }
 
-    bool hasNunboxType(LAllocation type) {
+    bool hasNunboxType(LAllocation type) const {
         if (type.isArgument())
             return true;
         if (type.isStackSlot() && hasValueSlot(type.toStackSlot()->slot() + 1))
@@ -1182,10 +1213,13 @@ class LSafepoint : public TempObject
 
         // vregs for nunbox pairs are adjacent, with the type coming first.
         uint32_t typeVreg = payloadVreg - 1;
-        return nunboxParts_.append(NunboxEntry(LUse(typeVreg, LUse::ANY), payload));
+        bool result = nunboxParts_.append(NunboxEntry(LUse(typeVreg, LUse::ANY), payload));
+        if (result)
+            assertInvariants();
+        return result;
     }
 
-    bool hasNunboxPayload(LAllocation payload) {
+    bool hasNunboxPayload(LAllocation payload) const {
         if (payload.isArgument())
             return true;
         if (payload.isStackSlot() && hasValueSlot(payload.toStackSlot()->slot()))
@@ -1209,8 +1243,9 @@ class LSafepoint : public TempObject
 
     void addValueRegister(Register reg) {
         valueRegs_.add(reg);
+        assertInvariants();
     }
-    GeneralRegisterSet valueRegs() {
+    GeneralRegisterSet valueRegs() const {
         return valueRegs_;
     }
 
@@ -1233,7 +1268,7 @@ class LSafepoint : public TempObject
         return true;
     }
 
-    bool hasBoxedValue(LAllocation alloc) {
+    bool hasBoxedValue(LAllocation alloc) const {
         if (alloc.isRegister())
             return valueRegs().has(alloc.toRegister().gpr());
         if (alloc.isStackSlot())

From 4047601939ef0dd079b0efce318b8d36feef348b Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 08:54:04 -0800
Subject: [PATCH 216/459] Bug 944407 - Allow scripts for an XBL binding if and
 only if the XBL document comes from a scriptable domain. r=bz

---
 content/xbl/src/nsXBLBinding.cpp          | 23 +----------------------
 content/xbl/src/nsXBLBinding.h            |  2 +-
 content/xbl/src/nsXBLDocumentInfo.cpp     | 18 ++++++++++++++++++
 content/xbl/src/nsXBLDocumentInfo.h       |  2 +-
 content/xbl/src/nsXBLPrototypeBinding.cpp |  2 +-
 content/xbl/src/nsXBLPrototypeBinding.h   |  2 +-
 6 files changed, 23 insertions(+), 26 deletions(-)

diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
index f8dbfc46df4c..a91fe995ce68 100644
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -1082,28 +1082,7 @@ nsXBLBinding::DoInitJSClass(JSContext *cx, JS::Handle<JSObject*> global,
 bool
 nsXBLBinding::AllowScripts()
 {
-  if (!mPrototypeBinding->GetAllowScripts())
-    return false;
-
-  // Nasty hack.  Use the JSContext of the bound node, since the
-  // security manager API expects to get the docshell type from
-  // that.  But use the nsIPrincipal of our document.
-  nsIScriptSecurityManager* mgr = nsContentUtils::GetSecurityManager();
-  if (!mgr) {
-    return false;
-  }
-
-  nsIDocument* doc = mBoundElement ? mBoundElement->OwnerDoc() : nullptr;
-  if (!doc) {
-    return false;
-  }
-
-  nsCOMPtr<nsIScriptGlobalObject> global = do_QueryInterface(doc->GetInnerWindow());
-  if (!global || !global->GetGlobalJSObject()) {
-    return false;
-  }
-
-  return mgr->ScriptAllowed(global->GetGlobalJSObject());
+  return mPrototypeBinding->GetAllowScripts();
 }
 
 nsXBLBinding*
diff --git a/content/xbl/src/nsXBLBinding.h b/content/xbl/src/nsXBLBinding.h
index ac577fe3b1bd..c2af9a993db8 100644
--- a/content/xbl/src/nsXBLBinding.h
+++ b/content/xbl/src/nsXBLBinding.h
@@ -141,7 +141,7 @@ public:
                                 JS::MutableHandle<JSObject*> aClassObject,
                                 bool* aNew);
 
-  bool AllowScripts();  // XXX make const
+  bool AllowScripts();
 
   mozilla::dom::XBLChildrenElement* FindInsertionPointFor(nsIContent* aChild);
 
diff --git a/content/xbl/src/nsXBLDocumentInfo.cpp b/content/xbl/src/nsXBLDocumentInfo.cpp
index 5c304c26566e..b3f6acde8d4c 100644
--- a/content/xbl/src/nsXBLDocumentInfo.cpp
+++ b/content/xbl/src/nsXBLDocumentInfo.cpp
@@ -403,6 +403,24 @@ nsXBLDocumentInfo::nsXBLDocumentInfo(nsIDocument* aDocument)
       mScriptAccess = allow;
     }
     mIsChrome = true;
+  } else {
+    // If this binding isn't running with system principal, then it's running
+    // from a remote-XUL whitelisted domain. This is already a not-really-
+    // supported configuration (among other things, we don't use XBL scopes in
+    // that configuration for compatibility reasons). But we should still at
+    // least make an effort to prevent binding code from running if content
+    // script is disabled or if the source domain is blacklisted (since the
+    // source domain for remote XBL must always be the same as the source domain
+    // of the bound content).
+    //
+    // If we just ask the binding document if script is enabled, it will
+    // discover that it has no inner window, and return false. So instead, we
+    // short-circuit the normal compartment-managed script-disabling machinery,
+    // and query the policy for the URI directly.
+    bool allow;
+    nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
+    nsresult rv = ssm->PolicyAllowsScript(uri, &allow);
+    mScriptAccess = NS_SUCCEEDED(rv) && allow;
   }
 }
 
diff --git a/content/xbl/src/nsXBLDocumentInfo.h b/content/xbl/src/nsXBLDocumentInfo.h
index 9c88d504e90a..412738a4118d 100644
--- a/content/xbl/src/nsXBLDocumentInfo.h
+++ b/content/xbl/src/nsXBLDocumentInfo.h
@@ -27,7 +27,7 @@ public:
   already_AddRefed<nsIDocument> GetDocument()
     { nsCOMPtr<nsIDocument> copy = mDocument; return copy.forget(); }
 
-  bool GetScriptAccess() { return mScriptAccess; }
+  bool GetScriptAccess() const { return mScriptAccess; }
 
   nsIURI* DocumentURI() { return mDocument->GetDocumentURI(); }
 
diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
index eb0e351ab593..385c3dd3ba4b 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.cpp
+++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
@@ -214,7 +214,7 @@ nsXBLPrototypeBinding::SetBindingElement(nsIContent* aElement)
 }
 
 bool
-nsXBLPrototypeBinding::GetAllowScripts()
+nsXBLPrototypeBinding::GetAllowScripts() const
 {
   return mXBLDocInfoWeak->GetScriptAccess();
 }
diff --git a/content/xbl/src/nsXBLPrototypeBinding.h b/content/xbl/src/nsXBLPrototypeBinding.h
index e38fc8e9e355..eb3fe54df2d8 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.h
+++ b/content/xbl/src/nsXBLPrototypeBinding.h
@@ -48,7 +48,7 @@ public:
   // binding URIs.
   bool CompareBindingURI(nsIURI* aURI) const;
 
-  bool GetAllowScripts();
+  bool GetAllowScripts() const;
 
   nsresult BindingAttached(nsIContent* aBoundElement);
   nsresult BindingDetached(nsIContent* aBoundElement);

From 9d29199dc3aff1c1cfd8a892b77cf7a6f138330a Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 08:54:04 -0800
Subject: [PATCH 217/459] Bug 944407 - Tests. r=bz

---
 content/xbl/test/chrome.ini          |  3 ++
 content/xbl/test/file_bug944407.html |  8 +++
 content/xbl/test/file_bug944407.xml  | 78 ++++++++++++++++++++++++++++
 content/xbl/test/mochitest.ini       |  2 +
 content/xbl/test/test_bug944407.xul  | 44 ++++++++++++++++
 5 files changed, 135 insertions(+)
 create mode 100644 content/xbl/test/file_bug944407.html
 create mode 100644 content/xbl/test/file_bug944407.xml
 create mode 100644 content/xbl/test/test_bug944407.xul

diff --git a/content/xbl/test/chrome.ini b/content/xbl/test/chrome.ini
index f55d0ff8c4e4..cf117273acfb 100644
--- a/content/xbl/test/chrome.ini
+++ b/content/xbl/test/chrome.ini
@@ -1,4 +1,6 @@
 [DEFAULT]
+support-files =
+  file_bug944407.xml
 
 [test_bug378518.xul]
 [test_bug398135.xul]
@@ -6,3 +8,4 @@
 [test_bug721452.xul]
 [test_bug723676.xul]
 [test_bug772966.xul]
+[test_bug944407.xul]
diff --git a/content/xbl/test/file_bug944407.html b/content/xbl/test/file_bug944407.html
new file mode 100644
index 000000000000..5df5d5bc97b0
--- /dev/null
+++ b/content/xbl/test/file_bug944407.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div id="deny" style="-moz-binding: url(file_bug944407.xml#testAllowScript)"></div>
+<div id="allow" style="-moz-binding: url(chrome://mochitests/content/chrome/content/xbl/test/file_bug944407.xml#testAllowScript)"</div>
+<script>/* Flush layout with a script tab - see bug 944407 comment 37. */</script>
+</body>
+</html>
diff --git a/content/xbl/test/file_bug944407.xml b/content/xbl/test/file_bug944407.xml
new file mode 100644
index 000000000000..6aa980dfce9c
--- /dev/null
+++ b/content/xbl/test/file_bug944407.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0"?>
+<bindings id="testBindings" xmlns="http://www.mozilla.org/xbl"
+          xmlns:html="http://www.w3.org/1999/xhtml">
+  <binding id="testAllowScript">
+    <implementation>
+       <property name="someProp" onget="return 2;" readonly="true"></property>
+       <method name="someMethod"><body> return 3; </body></method>
+       <method name="startTest">
+         <body>
+         <![CDATA[
+           // Make sure we only get constructed when we're loaded from a domain
+           // with script enabled.
+           is(this.id, 'allow', "XBL should only be bound when the origin of the binding allows scripts");
+
+           var t = this;
+           doFinish = function() {
+             // Take a moment to make sure that other constructors don't run when they shouldn't.
+             if (t.id == 'allow')
+               setTimeout(SpecialPowers.wrap(window.parent).finish, 100);
+           }
+
+           onTestEvent = function(target) {
+             ok(true, 'called event handler');
+
+             // First, dispatch an event to the anonymous content. The event
+             // handlers on the AC should run, but they won't until bug 948000
+             // is fixed. So the check here is a todo().
+             var e = new MouseEvent('click');
+             document.getAnonymousNodes(target)[1].dispatchEvent(e);
+
+             // Now, dispatch a key event to test key handlers and move the test along.
+             var k = document.createEvent('KeyboardEvent');
+             k.initEvent('keyup', true, true);
+             target.dispatchEvent(k);
+           }
+
+           // Check the implementation.
+           is(this.someProp, 2, "Properties work");
+           is(this.someMethod(), 3, "Methods work");
+
+           // Kick over to the event handlers. This tests XBL event handlers,
+           // XBL key handlers, and event handlers on anonymous content.
+           this.dispatchEvent(new CustomEvent('testEvent'));
+         ]]>
+         </body>
+       </method>
+
+      <constructor>
+      <![CDATA[
+        win = XPCNativeWrapper.unwrap(window);
+        SpecialPowers = win.SpecialPowers;
+        ok = win.ok = SpecialPowers.wrap(window.parent).ok;
+        todo = win.todo = SpecialPowers.wrap(window.parent).todo;
+        is = win.is = SpecialPowers.wrap(window.parent).is;
+        info = win.info = SpecialPowers.wrap(window.parent).info;
+
+        info("Invoked constructor for " + this.id);
+
+        var t = this;
+        window.addEventListener('load', function loadListener() {
+          window.removeEventListener('load', loadListener);
+          // Wait two refresh-driver ticks to make sure that the constructor runs
+          // for both |allow| and |deny| if it's ever going to.
+          //
+          // See bug 944407 comment 37.
+          info("Invoked load listener for " + t.id);
+          window.requestAnimationFrame(function() { window.requestAnimationFrame(t.startTest.bind(t)); });
+        });
+      ]]>
+      </constructor>
+    </implementation>
+    <handlers>
+      <handler event="testEvent" action="onTestEvent(this)" allowuntrusted="true"/>
+      <handler event="keyup" action="ok(true, 'called key handler'); doFinish();" allowuntrusted="true"/>
+    </handlers>
+    <content>Anonymous Content<html:div onclick="todo(true, 'called event handler on ac, this needs bug 948000');"></html:div><html:b style="display:none"><children/></html:b></content>
+  </binding>
+</bindings>
diff --git a/content/xbl/test/mochitest.ini b/content/xbl/test/mochitest.ini
index 8c82329009d9..b390426f19a5 100644
--- a/content/xbl/test/mochitest.ini
+++ b/content/xbl/test/mochitest.ini
@@ -12,6 +12,8 @@ support-files =
   file_bug591198_xbl.xml
   file_bug821850.xhtml
   file_bug844783.xhtml
+  file_bug944407.html
+  file_bug944407.xml
 
 [test_bug310107.html]
 [test_bug366770.html]
diff --git a/content/xbl/test/test_bug944407.xul b/content/xbl/test/test_bug944407.xul
new file mode 100644
index 000000000000..c4ddd200f7e0
--- /dev/null
+++ b/content/xbl/test/test_bug944407.xul
@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=944407
+-->
+<window title="Mozilla Bug 944407"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=944407"
+     target="_blank">Mozilla Bug 944407</a>
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript">
+  <![CDATA[
+
+  /** Test for XBL bindings with script disabled. **/
+  SimpleTest.waitForExplicitFinish();
+  const Cu = Components.utils;
+  Cu.import('resource://gre/modules/Services.jsm');
+
+  function go() {
+
+    // Disable javascript, and load the frame.
+    function loadFrame() {
+      ok(!Services.prefs.getBoolPref('javascript.enabled'), "Javascript should be disabled");
+      $('ifr').setAttribute('src', 'http://mochi.test:8888/tests/content/xbl/test/file_bug944407.html');
+    }
+    SpecialPowers.pushPrefEnv({ set: [['javascript.enabled', false]] }, loadFrame);
+  }
+
+  function finish() {
+    SimpleTest.finish();
+  }
+
+  addLoadEvent(go);
+  ]]>
+  </script>
+  <iframe id='ifr' />
+</window>

From b31e1049fab111c1aa128c998f34b10880f1c633 Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Fri, 13 Dec 2013 17:58:00 +0100
Subject: [PATCH 218/459] Bug 949474 - Reflect the fact that the nominal range
 for the sampleRate argument of the AudioContext.createBuffer changed in the
 spec. r= * * * Bug 949474 - Fix various oranges, on a CLOSED TREE.

--HG--
extra : rebase_source : 1317857063b7f028687aab1c00f113d947cd5685
---
 content/media/webaudio/AudioContext.cpp          |  4 ++--
 .../media/webaudio/test/test_AudioBuffer.html    | 16 +++++++++++-----
 .../test_audioBufferSourceNodeLoopStartEnd.html  |  2 --
 content/media/webaudio/test/test_bug808374.html  |  9 ++++++---
 4 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/content/media/webaudio/AudioContext.cpp b/content/media/webaudio/AudioContext.cpp
index f269163652f7..850727f1ef6c 100644
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -174,8 +174,8 @@ AudioContext::CreateBuffer(JSContext* aJSContext, uint32_t aNumberOfChannels,
                            uint32_t aLength, float aSampleRate,
                            ErrorResult& aRv)
 {
-  if (aSampleRate < 8000 || aSampleRate > 96000 || !aLength) {
-    aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+  if (aSampleRate < 8000 || aSampleRate > 192000 || !aLength || !aNumberOfChannels) {
+    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;
   }
 
diff --git a/content/media/webaudio/test/test_AudioBuffer.html b/content/media/webaudio/test/test_AudioBuffer.html
index 75eeb7ff00e5..47716853bf6c 100644
--- a/content/media/webaudio/test/test_AudioBuffer.html
+++ b/content/media/webaudio/test/test_AudioBuffer.html
@@ -81,15 +81,21 @@ addLoadEvent(function() {
 
   expectException(function() {
     context.createBuffer(2, 2048, 7999);
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INDEX_SIZE_ERR);
   expectException(function() {
-    context.createBuffer(2, 2048, 96001);
-  }, DOMException.NOT_SUPPORTED_ERR);
+    context.createBuffer(2, 2048, 192001);
+  }, DOMException.INDEX_SIZE_ERR);
   context.createBuffer(2, 2048, 8000);  // no exception
-  context.createBuffer(2, 2048, 96000); // no exception
+  context.createBuffer(2, 2048, 192000); // no exception
+  context.createBuffer(32, 2048, 48000); // no exception
+  // Null length
   expectException(function() {
     context.createBuffer(2, 0, 48000);
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INDEX_SIZE_ERR);
+  // Null number of channels
+  expectException(function() {
+    context.createBuffer(0, 2048, 48000);
+  }, DOMException.INDEX_SIZE_ERR);
   SimpleTest.finish();
 });
 
diff --git a/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html b/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html
index 59c2bfd166f5..6f60762eb834 100644
--- a/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html
+++ b/content/media/webaudio/test/test_audioBufferSourceNodeLoopStartEnd.html
@@ -21,8 +21,6 @@ var gTest = {
 
     var source = context.createBufferSource();
     source.buffer = buffer;
-
-    var sp = context.createScriptProcessor(2048 * 4, 1);
     source.start(0);
     source.loop = true;
     source.loopStart = buffer.duration * 0.25;
diff --git a/content/media/webaudio/test/test_bug808374.html b/content/media/webaudio/test/test_bug808374.html
index 3e4ffd428476..cc4e02f41860 100644
--- a/content/media/webaudio/test/test_bug808374.html
+++ b/content/media/webaudio/test/test_bug808374.html
@@ -9,9 +9,12 @@
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
-var ctx = new AudioContext();
-ctx.createBuffer(0, 1, ctx.sampleRate);
-ok(true, "The test should not crash during CC");
+try {
+  var ctx = new AudioContext();
+  ctx.createBuffer(0, 1, ctx.sampleRate);
+} catch (e) {
+  ok(true, "The test should not crash during CC");
+}
 
 </script>
 </pre>

From ab8787514ace5dd2a8c8eb6438f90a4f66344ea7 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Wed, 11 Dec 2013 16:26:37 -0800
Subject: [PATCH 219/459] Bug 949108 - Rooting hazards in nsScriptLoader.cpp
 due to AutoPushJSContext, r=bz

--HG--
extra : rebase_source : 02c19e3831118d3d4703c7904ea0b7228c06261f
---
 content/base/src/nsScriptLoader.cpp | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
index e3f8c945e825..b8bbfc85f4d4 100644
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -789,8 +789,11 @@ nsScriptLoader::AttemptAsyncScriptParse(nsScriptLoadRequest* aRequest)
   if (!context) {
     return NS_ERROR_FAILURE;
   }
-  AutoPushJSContext cx(context->GetNativeContext());
-  JS::Rooted<JSObject*> global(cx, unrootedGlobal);
+
+  JSContext* unpushedCx = context->GetNativeContext();
+  JSAutoRequest ar(unpushedCx);
+  JS::Rooted<JSObject*> global(unpushedCx, unrootedGlobal);
+  AutoPushJSContext cx(unpushedCx);
 
   JS::CompileOptions options(cx);
   FillCompileOptionsForRequest(aRequest, global, &options);
@@ -1002,8 +1005,11 @@ nsScriptLoader::EvaluateScript(nsScriptLoadRequest* aRequest,
   if (!context) {
     return NS_ERROR_FAILURE;
   }
-  AutoPushJSContext cx(context->GetNativeContext());
-  JS::Rooted<JSObject*> global(cx, unrootedGlobal);
+
+  JSContext* unpushedCx = context->GetNativeContext();
+  JSAutoRequest ar(unpushedCx);
+  JS::Rooted<JSObject*> global(unpushedCx, unrootedGlobal);
+  AutoPushJSContext cx(unpushedCx);
 
   bool oldProcessingScriptTag = context->GetProcessingScriptTag();
   context->SetProcessingScriptTag(true);

From 9c371ba0531ec6af3294bb830d7331daecf3500c Mon Sep 17 00:00:00 2001
From: Paul Adenot <paul@paul.cx>
Date: Thu, 12 Dec 2013 18:35:39 +0100
Subject: [PATCH 220/459] Bug 947431 - Be more robust when getting the
 preferred sample rate when using the OpenSL backend. r=kinetik

--HG--
extra : rebase_source : a55d98b9ce2cc6a9c2559d9589984faf8063c301
---
 media/libcubeb/src/cubeb_opensl.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/media/libcubeb/src/cubeb_opensl.c b/media/libcubeb/src/cubeb_opensl.c
index e0fb6fc9b979..c2d5c8e86d16 100644
--- a/media/libcubeb/src/cubeb_opensl.c
+++ b/media/libcubeb/src/cubeb_opensl.c
@@ -275,6 +275,14 @@ opensl_get_preferred_sample_rate(cubeb * ctx, uint32_t * rate)
 
   dlclose(libmedia);
 
+  /* Depending on which method we called above, we can get a zero back, yet have
+   * a non-error return value, especially if the audio system is not
+   * ready/shutting down (i.e. when we can't get our hand on the AudioFlinger
+   * thread). */
+  if (rate == 0) {
+    return CUBEB_ERROR;
+  }
+
   return CUBEB_OK;
 }
 

From 6068ab757be66131e4034c202fd1ef5b5e776151 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 17:56:20 +0100
Subject: [PATCH 221/459] Bug 927782 - Part 1: Expose
 JSScript::getBlockScope(jsbytecode *). r=luke

---
 js/src/jsopcode.cpp       | 53 +--------------------------------------
 js/src/jsopcode.h         |  5 ----
 js/src/jsscript.cpp       | 52 ++++++++++++++++++++++++++++++++++++++
 js/src/jsscript.h         |  3 +++
 js/src/vm/ScopeObject.cpp |  2 +-
 5 files changed, 57 insertions(+), 58 deletions(-)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 504fc6a14868..ceb86e3b9af1 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -1429,57 +1429,6 @@ js_QuoteString(ExclusiveContext *cx, JSString *str, jschar quote)
 
 /************************************************************************/
 
-StaticBlockObject *
-js::GetBlockChainAtPC(JSScript *script, jsbytecode *pc)
-{
-    JS_ASSERT(script->containsPC(pc));
-
-    if (!script->hasBlockScopes())
-        return nullptr;
-
-    if (pc < script->main())
-        return nullptr;
-    ptrdiff_t offset = pc - script->main();
-
-    BlockScopeArray *blockScopes = script->blockScopes();
-    StaticBlockObject *blockChain = nullptr;
-
-    // Find the innermost block chain using a binary search.
-    size_t bottom = 0;
-    size_t top = blockScopes->length;
-
-    while (bottom < top) {
-        size_t mid = bottom + (top - bottom) / 2;
-        const BlockScopeNote *note = &blockScopes->vector[mid];
-        if (note->start <= offset) {
-            // Block scopes are ordered in the list by their starting offset, and since
-            // blocks form a tree ones earlier in the list may cover the pc even if
-            // later blocks end before the pc. This only happens when the earlier block
-            // is a parent of the later block, so we need to check parents of |mid| in
-            // the searched range for coverage.
-            size_t check = mid;
-            while (check >= bottom) {
-                const BlockScopeNote *checkNote = &blockScopes->vector[check];
-                JS_ASSERT(checkNote->start <= offset);
-                if (offset < checkNote->start + checkNote->length) {
-                    // We found a matching block chain but there may be inner ones
-                    // at a higher block chain index than mid. Continue the binary search.
-                    blockChain = &script->getObject(checkNote->index)->as<StaticBlockObject>();
-                    break;
-                }
-                if (checkNote->parent == UINT32_MAX)
-                    break;
-                check = checkNote->parent;
-            }
-            bottom = mid + 1;
-        } else {
-            top = mid;
-        }
-    }
-
-    return blockChain;
-}
-
 namespace {
 /*
  * The expression decompiler is invoked by error handling code to produce a
@@ -1740,7 +1689,7 @@ JSAtom *
 ExpressionDecompiler::findLetVar(jsbytecode *pc, unsigned depth)
 {
     if (script->hasObjects()) {
-        JSObject *chain = GetBlockChainAtPC(script, pc);
+        JSObject *chain = script->getBlockScope(pc);
         if (!chain)
             return nullptr;
         JS_ASSERT(chain->is<BlockObject>());
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 3f019c99aeb0..ed75130495f7 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -777,11 +777,6 @@ GetNextPc(jsbytecode *pc)
     return pc + GetBytecodeLength(pc);
 }
 
-class StaticBlockObject;
-
-StaticBlockObject *
-GetBlockChainAtPC(JSScript *script, jsbytecode *pc);
-
 } /* namespace js */
 
 #if defined(DEBUG)
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index e1004f988947..b94db57d618e 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -2894,6 +2894,58 @@ LazyScript::finalize(FreeOp *fop)
         fop->free_(table_);
 }
 
+StaticBlockObject *
+JSScript::getBlockScope(jsbytecode *pc)
+{
+    JS_ASSERT(containsPC(pc));
+
+    if (!hasBlockScopes())
+        return nullptr;
+
+    ptrdiff_t offset = pc - main();
+
+    if (offset < 0)
+        return nullptr;
+
+    BlockScopeArray *scopes = blockScopes();
+    StaticBlockObject *blockChain = nullptr;
+
+    // Find the innermost block chain using a binary search.
+    size_t bottom = 0;
+    size_t top = scopes->length;
+
+    while (bottom < top) {
+        size_t mid = bottom + (top - bottom) / 2;
+        const BlockScopeNote *note = &scopes->vector[mid];
+        if (note->start <= offset) {
+            // Block scopes are ordered in the list by their starting offset, and since
+            // blocks form a tree ones earlier in the list may cover the pc even if
+            // later blocks end before the pc. This only happens when the earlier block
+            // is a parent of the later block, so we need to check parents of |mid| in
+            // the searched range for coverage.
+            size_t check = mid;
+            while (check >= bottom) {
+                const BlockScopeNote *checkNote = &scopes->vector[check];
+                JS_ASSERT(checkNote->start <= offset);
+                if (offset < checkNote->start + checkNote->length) {
+                    // We found a matching block chain but there may be inner ones
+                    // at a higher block chain index than mid. Continue the binary search.
+                    blockChain = &getObject(checkNote->index)->as<StaticBlockObject>();
+                    break;
+                }
+                if (checkNote->parent == UINT32_MAX)
+                    break;
+                check = checkNote->parent;
+            }
+            bottom = mid + 1;
+        } else {
+            top = mid;
+        }
+    }
+
+    return blockChain;
+}
+
 void
 JSScript::setArgumentsHasVarBinding()
 {
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 544f3798767f..09d88c489bdc 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -43,6 +43,7 @@ class RegExpObject;
 struct SourceCompressionTask;
 class Shape;
 class WatchpointMap;
+class StaticBlockObject;
 
 namespace analyze {
     class ScriptAnalysis;
@@ -1268,6 +1269,8 @@ class JSScript : public js::gc::BarrieredCell<JSScript>
         return arr->vector[index];
     }
 
+    js::StaticBlockObject *getBlockScope(jsbytecode *pc);
+
     /*
      * The isEmpty method tells whether this script has code that computes any
      * result (not return value, result AKA normal completion value) other than
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 4997f4022e25..8114c0b89a65 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -38,7 +38,7 @@ InnermostStaticScope(JSScript *script, jsbytecode *pc)
     JS_ASSERT(script->containsPC(pc));
     JS_ASSERT(JOF_OPTYPE(*pc) == JOF_SCOPECOORD);
 
-    StaticBlockObject *block = GetBlockChainAtPC(script, pc);
+    StaticBlockObject *block = script->getBlockScope(pc);
     if (block)
         return block;
     return script->function();

From 759b9344ea1869fa69b335fc161a126f3767905e Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Mon, 25 Nov 2013 12:19:38 +0100
Subject: [PATCH 222/459] Bug 927782 - Part 2: Remove HAS_BLOCKCHAIN. r=luke

---
 js/src/jit/BaselineCompiler.cpp | 2 ++
 js/src/jit/BaselineFrame.cpp    | 5 +----
 js/src/jit/BaselineFrame.h      | 9 ++-------
 js/src/vm/Stack-inl.h           | 2 +-
 js/src/vm/Stack.cpp             | 3 +--
 js/src/vm/Stack.h               | 7 +++----
 6 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index febad931dae9..d0b4b16f323c 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -289,6 +289,8 @@ BaselineCompiler::emitPrologue()
     else
         masm.storePtr(R1.scratchReg(), frame.addressOfScopeChain());
 
+    masm.storePtr(ImmPtr(nullptr), frame.addressOfBlockChain());
+
     // Functions with a large number of locals require two stack checks.
     // The VMCall for a fallible stack check can only occur after the
     // scope chain has been initialized, as that is required for proper
diff --git a/js/src/jit/BaselineFrame.cpp b/js/src/jit/BaselineFrame.cpp
index ed89bd40b193..82ca90ca60ca 100644
--- a/js/src/jit/BaselineFrame.cpp
+++ b/js/src/jit/BaselineFrame.cpp
@@ -113,10 +113,7 @@ BaselineFrame::initForOsr(StackFrame *fp, uint32_t numStackValues)
     if (fp->hasCallObjUnchecked())
         flags_ |= BaselineFrame::HAS_CALL_OBJ;
 
-    if (fp->hasBlockChain()) {
-        flags_ |= BaselineFrame::HAS_BLOCKCHAIN;
-        blockChain_ = &fp->blockChain();
-    }
+    blockChain_ = fp->maybeBlockChain();
 
     if (fp->isEvalFrame()) {
         flags_ |= BaselineFrame::EVAL;
diff --git a/js/src/jit/BaselineFrame.h b/js/src/jit/BaselineFrame.h
index e996a2cfbb22..32d92b1fcaf3 100644
--- a/js/src/jit/BaselineFrame.h
+++ b/js/src/jit/BaselineFrame.h
@@ -38,9 +38,6 @@ class BaselineFrame
         // The frame has a valid return value. See also StackFrame::HAS_RVAL.
         HAS_RVAL         = 1 << 0,
 
-        // Frame has blockChain_ set.
-        HAS_BLOCKCHAIN   = 1 << 1,
-
         // A call object has been pushed on the scope chain.
         HAS_CALL_OBJ     = 1 << 2,
 
@@ -72,7 +69,7 @@ class BaselineFrame
     uint32_t hiReturnValue_;
     uint32_t frameSize_;
     JSObject *scopeChain_;          // Scope chain (always initialized).
-    StaticBlockObject *blockChain_; // If HAS_BLOCKCHAIN, the static block chain.
+    StaticBlockObject *blockChain_; // The static block chain.
     JSScript *evalScript_;          // If isEvalFrame(), the current eval script.
     ArgumentsObject *argsObj_;      // If HAS_ARGS_OBJ, the arguments object.
     void *hookData_;                // If HAS_HOOK_DATA, debugger call hook data.
@@ -213,7 +210,7 @@ class BaselineFrame
     }
 
     bool hasBlockChain() const {
-        return (flags_ & HAS_BLOCKCHAIN) && blockChain_;
+        return blockChain_;
     }
     StaticBlockObject &blockChain() const {
         JS_ASSERT(hasBlockChain());
@@ -223,11 +220,9 @@ class BaselineFrame
         return hasBlockChain() ? blockChain_ : nullptr;
     }
     void setBlockChain(StaticBlockObject &block) {
-        flags_ |= HAS_BLOCKCHAIN;
         blockChain_ = &block;
     }
     void setBlockChainNull() {
-        JS_ASSERT(!hasBlockChain());
         blockChain_ = nullptr;
     }
     StaticBlockObject **addressOfBlockChain() {
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 914841fcb952..daa06c529d42 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -77,7 +77,7 @@ StackFrame::initCallFrame(JSContext *cx, StackFrame *prev, jsbytecode *prevpc, V
     JS_ASSERT(callee.nonLazyScript() == script);
 
     /* Initialize stack frame members. */
-    flags_ = FUNCTION | HAS_SCOPECHAIN | HAS_BLOCKCHAIN | flagsArg;
+    flags_ = FUNCTION | HAS_SCOPECHAIN | flagsArg;
     argv_ = argv;
     exec.fun = &callee;
     u.nactual = nactual;
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 6f386270908a..c31af6d82d9a 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -37,7 +37,7 @@ StackFrame::initExecuteFrame(JSContext *cx, JSScript *script, AbstractFramePtr e
      * script in the context of another frame and the frame type is determined
      * by the context.
      */
-    flags_ = type | HAS_SCOPECHAIN | HAS_BLOCKCHAIN;
+    flags_ = type | HAS_SCOPECHAIN;
 
     JSObject *callee = nullptr;
     if (!(flags_ & (GLOBAL))) {
@@ -366,7 +366,6 @@ StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
         blockChain_ = &block;
     }
 
-    flags_ |= HAS_BLOCKCHAIN;
     return true;
 }
 
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 775736fee778..053a02f61120 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -311,7 +311,6 @@ class StackFrame
         HAS_HOOK_DATA      =      0x400,  /* frame has hookData_ set */
         HAS_RVAL           =      0x800,  /* frame has rval_ set */
         HAS_SCOPECHAIN     =     0x1000,  /* frame has scopeChain_ set */
-        HAS_BLOCKCHAIN     =     0x2000,  /* frame has blockChain_ set */
 
         /* Debugger state */
         PREV_UP_TO_DATE    =     0x4000,  /* see DebugScopes::updateLiveScopes */
@@ -341,7 +340,7 @@ class StackFrame
     } u;
     mutable JSObject    *scopeChain_;   /* if HAS_SCOPECHAIN, current scope chain */
     Value               rval_;          /* if HAS_RVAL, return value of the frame */
-    StaticBlockObject   *blockChain_;   /* if HAS_BLOCKCHAIN, innermost let block */
+    StaticBlockObject   *blockChain_;   /* innermost let block */
     ArgumentsObject     *argsObj_;      /* if HAS_ARGS_OBJ, the call's arguments object */
 
     /*
@@ -605,11 +604,11 @@ class StackFrame
      */
 
     bool hasBlockChain() const {
-        return (flags_ & HAS_BLOCKCHAIN) && blockChain_;
+        return blockChain_;
     }
 
     StaticBlockObject *maybeBlockChain() {
-        return (flags_ & HAS_BLOCKCHAIN) ? blockChain_ : nullptr;
+        return blockChain_;
     }
 
     StaticBlockObject &blockChain() const {

From 622f257d7851d0971adb4a1be43e3d1c3c69de7b Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Mon, 25 Nov 2013 12:19:58 +0100
Subject: [PATCH 223/459] Bug 927782 - Part 3: Add DEBUGLEAVEBLOCK opcode to
 invalidate live DebugScopes. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 19 ++++++++++++++++++-
 js/src/jit/BaselineCompiler.cpp     | 15 +++++++++++++++
 js/src/jit/BaselineCompiler.h       |  1 +
 js/src/jit/BaselineFrame-inl.h      |  3 ---
 js/src/jit/VMFunctions.cpp          | 11 +++++++++++
 js/src/jit/VMFunctions.h            |  1 +
 js/src/jsopcode.tbl                 |  3 +--
 js/src/vm/Interpreter.cpp           | 15 ++++++++++++++-
 js/src/vm/Stack.cpp                 |  5 -----
 9 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index db41a0a88c7a..c073363c1c3c 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -588,6 +588,8 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
                 stmt = stmt->down;
                 if (stmt == toStmt)
                     break;
+                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                    return false;
                 if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
                     return false;
                 if (stmt->type == STMT_FOR_OF_LOOP) {
@@ -600,6 +602,8 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
                 EMIT_UINT16_IMM_OP(JSOP_POPN, popCount);
             } else {
                 /* There is a Block object with locals on the stack to pop. */
+                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                    return false;
                 EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
             }
         }
@@ -2622,8 +2626,11 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    if (pn->pn_right->isKind(PNK_LEXICALSCOPE))
+    if (pn->pn_right->isKind(PNK_LEXICALSCOPE)) {
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
         EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
+    }
 
     return true;
 }
@@ -3941,6 +3948,8 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
                  */
                 if (Emit1(cx, bce, JSOP_THROWING) < 0)
                     return false;
+                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                    return false;
                 EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, count);
                 JS_ASSERT(bce->stackDepth == depth);
             }
@@ -4200,6 +4209,8 @@ EmitLet(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
     if (!EmitTree(cx, bce, letBody->pn_expr))
         return false;
 
+    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        return false;
     JSOp leaveOp = letBody->getOp();
     JS_ASSERT(leaveOp == JSOP_LEAVEBLOCK || leaveOp == JSOP_LEAVEBLOCKEXPR);
     EMIT_UINT16_IMM_OP(leaveOp, blockObj->slotCount());
@@ -4233,6 +4244,8 @@ EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!EmitTree(cx, bce, pn->pn_expr))
         return false;
 
+    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        return false;
     EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, slots);
 
     return PopStatementBCE(cx, bce);
@@ -4410,6 +4423,8 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PopStatementBCE(cx, bce))
             return false;
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
         if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
             return false;
     }
@@ -4569,6 +4584,8 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PopStatementBCE(cx, bce))
             return false;
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
         if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
             return false;
     }
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index d0b4b16f323c..b9309fcc67a9 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -2625,6 +2625,21 @@ BaselineCompiler::emit_JSOP_ENTERLET2()
     return emitEnterBlock();
 }
 
+typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *);
+static const VMFunction DebugLeaveBlockInfo = FunctionInfo<DebugLeaveBlockFn>(jit::DebugLeaveBlock);
+
+bool
+BaselineCompiler::emit_JSOP_DEBUGLEAVEBLOCK()
+{
+    // Call a stub to pop the block from the block chain.
+    prepareVMCall();
+
+    masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
+    pushArg(R0.scratchReg());
+
+    return callVM(DebugLeaveBlockInfo);
+}
+
 typedef bool (*LeaveBlockFn)(JSContext *, BaselineFrame *);
 static const VMFunction LeaveBlockInfo = FunctionInfo<LeaveBlockFn>(jit::LeaveBlock);
 
diff --git a/js/src/jit/BaselineCompiler.h b/js/src/jit/BaselineCompiler.h
index 1b4d5a8a2c96..a72ceb5e358e 100644
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -152,6 +152,7 @@ namespace jit {
     _(JSOP_LEAVEBLOCK)         \
     _(JSOP_LEAVEBLOCKEXPR)     \
     _(JSOP_LEAVEFORLETIN)      \
+    _(JSOP_DEBUGLEAVEBLOCK)    \
     _(JSOP_EXCEPTION)          \
     _(JSOP_DEBUGGER)           \
     _(JSOP_ARGUMENTS)          \
diff --git a/js/src/jit/BaselineFrame-inl.h b/js/src/jit/BaselineFrame-inl.h
index 8d107515a4a3..234dae4d1969 100644
--- a/js/src/jit/BaselineFrame-inl.h
+++ b/js/src/jit/BaselineFrame-inl.h
@@ -55,9 +55,6 @@ BaselineFrame::popBlock(JSContext *cx)
 {
     JS_ASSERT(hasBlockChain());
 
-    if (cx->compartment()->debugMode())
-        DebugScopes::onPopBlock(cx, this);
-
     if (blockChain_->needsClone()) {
         JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
         popOffScopeChain();
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 8c8ad1c9c753..04fd28a4a003 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -894,6 +894,17 @@ LeaveBlock(JSContext *cx, BaselineFrame *frame)
     return true;
 }
 
+bool
+DebugLeaveBlock(JSContext *cx, BaselineFrame *frame)
+{
+    JS_ASSERT(frame->hasBlockChain());
+
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
+        DebugScopes::onPopBlock(cx, frame);
+
+    return true;
+}
+
 bool
 InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame, uint32_t numStackValues)
 {
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 7fcd44d49c52..a29ae2b6fbf4 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -654,6 +654,7 @@ bool OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bo
 
 bool EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
 bool LeaveBlock(JSContext *cx, BaselineFrame *frame);
+bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame);
 
 bool InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame,
                              uint32_t numStackValues);
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index 8a6a1ee215ce..0e419e58a800 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -438,9 +438,8 @@ OPDEF(JSOP_TYPEOFEXPR,    197,"typeofexpr",  NULL,    1,  1,  1, JOF_BYTE|JOF_DE
  */
 OPDEF(JSOP_ENTERBLOCK,    198,"enterblock",  NULL,    5,  0, -1,  JOF_OBJECT)
 OPDEF(JSOP_LEAVEBLOCK,    199,"leaveblock",  NULL,    3, -1,  0,  JOF_UINT16)
+OPDEF(JSOP_DEBUGLEAVEBLOCK, 200,"debugleaveblock", NULL, 1,  0,  0,  JOF_BYTE)
 
-
-OPDEF(JSOP_UNUSED200,     200,"unused200",  NULL,     1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED201,     201,"unused201",  NULL,     1,  0,  0,  JOF_BYTE)
 
 /*
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index fe105d373d44..e076291e5b2a 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -855,6 +855,8 @@ js::UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth)
           case ScopeIter::Block:
             if (si.staticBlock().stackDepth() < stackDepth)
                 return;
+            if (cx->compartment()->debugMode())
+                DebugScopes::onPopBlock(cx, frame);
             frame.popBlock(cx);
             break;
           case ScopeIter::With:
@@ -1533,7 +1535,6 @@ CASE(JSOP_UNUSED191)
 CASE(JSOP_UNUSED192)
 CASE(JSOP_UNUSED194)
 CASE(JSOP_UNUSED196)
-CASE(JSOP_UNUSED200)
 CASE(JSOP_UNUSED201)
 CASE(JSOP_GETFUNNS)
 CASE(JSOP_UNUSED208)
@@ -3268,6 +3269,18 @@ CASE(JSOP_LEAVEBLOCKEXPR)
 }
 END_CASE(JSOP_LEAVEBLOCK)
 
+CASE(JSOP_DEBUGLEAVEBLOCK)
+{
+    JS_ASSERT(REGS.fp()->hasBlockChain());
+
+    // FIXME: This opcode should not be necessary.  The debugger shouldn't need
+    // help from bytecode to do its job.  See bug 927782.
+
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
+        DebugScopes::onPopBlock(cx, REGS.fp());
+}
+END_CASE(JSOP_DEBUGLEAVEBLOCK)
+
 CASE(JSOP_GENERATOR)
 {
     JS_ASSERT(!cx->isExceptionPending());
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index c31af6d82d9a..0f8e40ab1b30 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -372,11 +372,6 @@ StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
 void
 StackFrame::popBlock(JSContext *cx)
 {
-    JS_ASSERT(hasBlockChain());
-
-    if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onPopBlock(cx, this);
-
     if (blockChain_->needsClone()) {
         JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
         popOffScopeChain();

From 616863d9825bd8c44fa442ff7b6013a0018d9c4a Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:22:06 +0100
Subject: [PATCH 224/459] Bug 927782 - Part 4: Generators allocate all locals
 on the scope chain. r=luke

---
 dom/indexedDB/test/unit/test_cursor_cycle.js  |  5 -
 .../test/unit/test_cursor_mutation.js         |  5 -
 .../test/unit/test_index_object_cursors.js    |  3 -
 .../test/unit/test_index_update_delete.js     |  3 -
 js/src/frontend/BytecodeEmitter.cpp           | 29 +++++-
 js/src/frontend/Parser.cpp                    |  2 +-
 js/src/frontend/SharedContext.h               | 17 +++-
 js/src/jsfun.h                                |  3 +-
 js/src/vm/ScopeObject.cpp                     | 99 +++----------------
 js/src/vm/ScopeObject.h                       | 14 +--
 js/src/vm/Stack-inl.h                         |  8 --
 js/src/vm/Stack.cpp                           | 24 -----
 js/src/vm/Stack.h                             |  4 -
 13 files changed, 58 insertions(+), 158 deletions(-)

diff --git a/dom/indexedDB/test/unit/test_cursor_cycle.js b/dom/indexedDB/test/unit/test_cursor_cycle.js
index 440f1b0a8423..795a9b63d708 100644
--- a/dom/indexedDB/test/unit/test_cursor_cycle.js
+++ b/dom/indexedDB/test/unit/test_cursor_cycle.js
@@ -22,11 +22,6 @@ function testSteps()
   objectStore.add(Bob);
   yield undefined;
 
-  // This direct eval causes locals to be aliased, and thus allocated on
-  // the scope chain.  Comment it out (and the workarounds below) and
-  // the test passes.  Bug 943409.
-  eval('');
-
   db.transaction("foo", "readwrite").objectStore("foo")
     .index("name").openCursor().onsuccess = function(event) {
     event.target.transaction.oncomplete = continueToNextStep;
diff --git a/dom/indexedDB/test/unit/test_cursor_mutation.js b/dom/indexedDB/test/unit/test_cursor_mutation.js
index 059c68e3b4aa..13e859891c1d 100644
--- a/dom/indexedDB/test/unit/test_cursor_mutation.js
+++ b/dom/indexedDB/test/unit/test_cursor_mutation.js
@@ -35,11 +35,6 @@ function testSteps()
   let objectStore = db.createObjectStore("foo", { keyPath: "ss" });
   objectStore.createIndex("name", "name", { unique: true });
 
-  // This direct eval causes locals to be aliased, and thus allocated on
-  // the scope chain.  Comment it out (and the workarounds below) and
-  // the test passes.  Bug 943409.
-  eval('');
-
   for (let i = 0; i < objectStoreData.length - 1; i++) {
     objectStore.add(objectStoreData[i]);
   }
diff --git a/dom/indexedDB/test/unit/test_index_object_cursors.js b/dom/indexedDB/test/unit/test_index_object_cursors.js
index d15c3efd4748..f3daa433b656 100644
--- a/dom/indexedDB/test/unit/test_index_object_cursors.js
+++ b/dom/indexedDB/test/unit/test_index_object_cursors.js
@@ -34,9 +34,6 @@ function testSteps()
 
   event.target.onsuccess = continueToNextStep;
 
-  // Bug 943409.
-  eval('');
-
   for (let objectStoreIndex in objectStoreData) {
     const objectStoreInfo = objectStoreData[objectStoreIndex];
     let objectStore = db.createObjectStore(objectStoreInfo.name,
diff --git a/dom/indexedDB/test/unit/test_index_update_delete.js b/dom/indexedDB/test/unit/test_index_update_delete.js
index 03cd8c10bef2..77c666079a76 100644
--- a/dom/indexedDB/test/unit/test_index_update_delete.js
+++ b/dom/indexedDB/test/unit/test_index_update_delete.js
@@ -18,9 +18,6 @@ function testSteps()
   let db = event.target.result;
   db.onerror = errorHandler;
 
-  // Bug 943409.
-  eval('');
-
   for each (let autoIncrement in [false, true]) {
     let objectStore =
       db.createObjectStore(autoIncrement, { keyPath: "id",
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index c073363c1c3c..9277bfd761bb 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -1024,9 +1024,14 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
         /*
          * There are two ways to alias a let variable: nested functions and
          * dynamic scope operations. (This is overly conservative since the
-         * bindingsAccessedDynamically flag is function-wide.)
+         * bindingsAccessedDynamically flag, checked by allLocalsAliased, is
+         * function-wide.)
+         *
+         * In addition all locals in generators are marked as aliased, to ensure
+         * that they are allocated on scope chains instead of on the stack.  See
+         * the definition of SharedContext::allLocalsAliased.
          */
-        return dn->isClosed() || sc->bindingsAccessedDynamically();
+        return dn->isClosed() || sc->allLocalsAliased();
       case Definition::ARG:
         /*
          * Consult the bindings, since they already record aliasing. We might
@@ -1035,12 +1040,13 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
          * a given name is aliased. This is necessary to avoid generating a
          * shape for the call object with with more than one name for a given
          * slot (which violates internal engine invariants). All this means that
-         * the '|| sc->bindingsAccessedDynamically' disjunct is incorrect since
-         * it will mark both parameters in function(x,x) as aliased.
+         * the '|| sc->allLocalsAliased()' disjunct is incorrect since it will
+         * mark both parameters in function(x,x) as aliased.
          */
         return script->formalIsAliased(pn->pn_cookie.slot());
       case Definition::VAR:
       case Definition::CONST:
+        JS_ASSERT_IF(sc->allLocalsAliased(), script->varIsAliased(pn->pn_cookie.slot()));
         return script->varIsAliased(pn->pn_cookie.slot());
       case Definition::PLACEHOLDER:
       case Definition::NAMED_LAMBDA:
@@ -1072,6 +1078,17 @@ AdjustBlockSlot(ExclusiveContext *cx, BytecodeEmitter *bce, int slot)
     return slot;
 }
 
+#ifdef DEBUG
+static bool
+AllLocalsAliased(StaticBlockObject &obj)
+{
+    for (unsigned i = 0; i < obj.slotCount(); i++)
+        if (!obj.isAliased(i))
+            return false;
+    return true;
+}
+#endif
+
 static bool
 EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp op)
 {
@@ -1108,7 +1125,7 @@ EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp o
 
         /* Beware the empty destructuring dummy. */
         if (!dn) {
-            blockObj->setAliased(i, bce->sc->bindingsAccessedDynamically());
+            blockObj->setAliased(i, bce->sc->allLocalsAliased());
             continue;
         }
 
@@ -1129,6 +1146,8 @@ EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp o
         blockObj->setAliased(i, bce->isAliasedName(dn));
     }
 
+    JS_ASSERT_IF(bce->sc->allLocalsAliased(), AllLocalsAliased(*blockObj));
+
     return true;
 }
 
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 1bcbd752e9dd..3702596a7c0e 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -278,7 +278,7 @@ AppendPackedBindings(const ParseContext<ParseHandler> *pc, const DeclVector &vec
          */
         JS_ASSERT_IF(dn->isClosed(), pc->decls().lookupFirst(name) == dn);
         bool aliased = dn->isClosed() ||
-                       (pc->sc->bindingsAccessedDynamically() &&
+                       (pc->sc->allLocalsAliased() &&
                         pc->decls().lookupFirst(name) == dn);
 
         *dst = Binding(name, kind, aliased);
diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h
index fa3d97001764..36591f55e06f 100644
--- a/js/src/frontend/SharedContext.h
+++ b/js/src/frontend/SharedContext.h
@@ -200,6 +200,8 @@ class SharedContext
     void setBindingsAccessedDynamically() { anyCxFlags.bindingsAccessedDynamically = true; }
     void setHasDebuggerStatement()        { anyCxFlags.hasDebuggerStatement        = true; }
 
+    inline bool allLocalsAliased();
+
     // JSOPTION_EXTRA_WARNINGS warnings or strict mode errors.
     bool needStrictChecks() {
         return strict || extraWarnings;
@@ -307,7 +309,8 @@ class FunctionBox : public ObjectBox, public SharedContext
         // Note: this should be kept in sync with JSFunction::isHeavyweight().
         return bindings.hasAnyAliasedBindings() ||
                hasExtensibleScope() ||
-               needsDeclEnvObject();
+               needsDeclEnvObject() ||
+               isGenerator();
     }
 };
 
@@ -318,6 +321,18 @@ SharedContext::asFunctionBox()
     return static_cast<FunctionBox*>(this);
 }
 
+// In generators, we treat all locals as aliased so that they get stored on the
+// heap.  This way there is less information to copy off the stack when
+// suspending, and back on when resuming.  It also avoids the need to create and
+// invalidate DebugScope proxies for unaliased locals in a generator frame, as
+// the generator frame will be copied out to the heap and released only by GC.
+inline bool
+SharedContext::allLocalsAliased()
+{
+    return bindingsAccessedDynamically() || (isFunctionBox() && asFunctionBox()->isGenerator());
+}
+
+
 /*
  * NB: If you add a new type of statement that is a scope, add it between
  * STMT_WITH and STMT_CATCH, or you will break StmtInfoBase::linksScope. If you
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 21e19a0fd805..df45c30e4f04 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -100,7 +100,8 @@ class JSFunction : public JSObject
         // Note: this should be kept in sync with FunctionBox::isHeavyweight().
         return nonLazyScript()->bindings.hasAnyAliasedBindings() ||
                nonLazyScript()->funHasExtensibleScope() ||
-               nonLazyScript()->funNeedsDeclEnvObject();
+               nonLazyScript()->funNeedsDeclEnvObject() ||
+               isGenerator();
     }
 
     /* A function can be classified as either native (C++) or interpreted (JS): */
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 8114c0b89a65..95e31570278c 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -885,18 +885,6 @@ ScopeIter::ScopeIter(AbstractFramePtr frame, JSContext *cx
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 }
 
-ScopeIter::ScopeIter(const ScopeIter &si, AbstractFramePtr frame, JSContext *cx
-                     MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
-  : cx(si.cx),
-    frame_(frame),
-    cur_(cx, si.cur_),
-    block_(cx, si.block_),
-    type_(si.type_),
-    hasScopeObject_(si.hasScopeObject_)
-{
-    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-}
-
 ScopeIter::ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
   : cx(cx),
@@ -1095,8 +1083,7 @@ class DebugScopeProxy : public BaseProxyHandler
      * the normal Call/BlockObject scope objects and thus must be recovered
      * from somewhere else:
      *  + if the invocation for which the scope was created is still executing,
-     *    there is a StackFrame (either live on the stack or floating in a
-     *    generator object) holding the values;
+     *    there is a StackFrame live on the stack holding the values;
      *  + if the invocation for which the scope was created finished executing:
      *     - and there was a DebugScopeObject associated with scope, then the
      *       DebugScopes::onPop(Call|Block) handler copied out the unaliased
@@ -1595,9 +1582,8 @@ void
 DebugScopes::sweep(JSRuntime *rt)
 {
     /*
-     * Note: missingScopes points to debug scopes weakly not just so that debug
-     * scopes can be released more eagerly, but, more importantly, to avoid
-     * creating an uncollectable cycle with suspended generator frames.
+     * missingScopes points to debug scopes weakly so that debug scopes can be
+     * released more eagerly.
      */
     for (MissingScopeMap::Enum e(missingScopes); !e.empty(); e.popFront()) {
         DebugScopeObject **debugScope = e.front().value().unsafeGet();
@@ -1626,7 +1612,6 @@ DebugScopes::sweep(JSRuntime *rt)
 
     for (LiveScopeMap::Enum e(liveScopes); !e.empty(); e.popFront()) {
         ScopeObject *scope = e.front().key();
-        AbstractFramePtr frame = e.front().value();
 
         /*
          * Scopes can be finalized when a debugger-synthesized ScopeObject is
@@ -1636,19 +1621,6 @@ DebugScopes::sweep(JSRuntime *rt)
             e.removeFront();
             continue;
         }
-
-        /*
-         * As explained in onGeneratorFrameChange, liveScopes includes
-         * suspended generator frames. Since a generator can be finalized while
-         * its scope is live, we must explicitly detect finalized generators.
-         */
-        if (JSGenerator *gen = frame.maybeSuspendedGenerator(rt)) {
-            JS_ASSERT(gen->state == JSGEN_NEWBORN || gen->state == JSGEN_OPEN);
-            if (IsObjectAboutToBeFinalized(&gen->obj)) {
-                e.removeFront();
-                continue;
-            }
-        }
     }
 }
 
@@ -1739,6 +1711,7 @@ DebugScopes::addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject
 {
     JS_ASSERT(!si.hasScopeObject());
     JS_ASSERT(cx->compartment() == debugScope.compartment());
+    JS_ASSERT_IF(si.frame().isFunctionFrame(), !si.frame().callee()->isGenerator());
 
     if (!CanUseDebugScopeMaps(cx))
         return true;
@@ -1890,43 +1863,6 @@ DebugScopes::onPopStrictEvalScope(AbstractFramePtr frame)
         scopes->liveScopes.remove(&frame.scopeChain()->as<CallObject>());
 }
 
-void
-DebugScopes::onGeneratorFrameChange(AbstractFramePtr from, AbstractFramePtr to, JSContext *cx)
-{
-    for (ScopeIter toIter(to, cx); !toIter.done(); ++toIter) {
-        DebugScopes *scopes = ensureCompartmentData(cx);
-        if (!scopes)
-            return;
-
-        if (toIter.hasScopeObject()) {
-            /*
-             * Not only must we correctly replace mappings [scope -> from] with
-             * mappings [scope -> to], but we must add [scope -> to] if it
-             * doesn't already exist so that if we need to proxy a generator's
-             * scope while it is suspended, we can find its frame (which would
-             * otherwise not be found by AllFramesIter).
-             */
-            JS_ASSERT(toIter.scope().compartment() == cx->compartment());
-            LiveScopeMap::AddPtr livePtr = scopes->liveScopes.lookupForAdd(&toIter.scope());
-            if (livePtr) {
-                livePtr->value() = to;
-            } else {
-                scopes->liveScopes.add(livePtr, &toIter.scope(), to);  // OOM here?
-                liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &toIter.scope());
-            }
-        } else {
-            ScopeIter si(toIter, from, cx);
-            JS_ASSERT(si.frame().scopeChain()->compartment() == cx->compartment());
-            if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
-                DebugScopeObject &debugScope = *p->value();
-                scopes->liveScopes.lookup(&debugScope.scope())->value() = to;
-                scopes->missingScopes.remove(p);
-                scopes->missingScopes.put(toIter, &debugScope);  // OOM here?
-            }
-        }
-    }
-}
-
 void
 DebugScopes::onCompartmentLeaveDebugMode(JSCompartment *c)
 {
@@ -1966,6 +1902,9 @@ DebugScopes::updateLiveScopes(JSContext *cx)
         if (frame.scopeChain()->compartment() != cx->compartment())
             continue;
 
+        if (frame.isFunctionFrame() && frame.callee()->isGenerator())
+            continue;
+
         for (ScopeIter si(frame, cx); !si.done(); ++si) {
             if (si.hasScopeObject()) {
                 JS_ASSERT(si.scope().compartment() == cx->compartment());
@@ -1994,25 +1933,9 @@ DebugScopes::hasLiveFrame(ScopeObject &scope)
     if (!scopes)
         return NullFramePtr();
 
-    if (LiveScopeMap::Ptr p = scopes->liveScopes.lookup(&scope)) {
-        AbstractFramePtr frame = p->value();
+    if (LiveScopeMap::Ptr p = scopes->liveScopes.lookup(&scope))
+        return p->value();
 
-        /*
-         * Since liveScopes is effectively a weak pointer, we need a read
-         * barrier. The scenario where this is necessary is:
-         *  1. GC starts, a suspended generator is not live
-         *  2. hasLiveFrame returns a StackFrame* to the (soon to be dead)
-         *     suspended generator
-         *  3. stack frame values (which will neve be marked) are read from the
-         *     StackFrame
-         *  4. GC completes, live objects may now point to values that weren't
-         *     marked and thus may point to swept GC things
-         */
-        if (JSGenerator *gen = frame.maybeSuspendedGenerator(scope.compartment()->runtimeFromMainThread()))
-            JSObject::readBarrier(gen->obj);
-
-        return frame;
-    }
     return NullFramePtr();
 }
 
@@ -2074,6 +1997,8 @@ GetDebugScopeForMissing(JSContext *cx, const ScopeIter &si)
     DebugScopeObject *debugScope = nullptr;
     switch (si.type()) {
       case ScopeIter::Call: {
+        // Generators should always reify their scopes.
+        JS_ASSERT(!si.frame().callee()->isGenerator());
         Rooted<CallObject*> callobj(cx, CallObject::createForFunction(cx, si.frame()));
         if (!callobj)
             return nullptr;
@@ -2090,6 +2015,8 @@ GetDebugScopeForMissing(JSContext *cx, const ScopeIter &si)
         break;
       }
       case ScopeIter::Block: {
+        // Generators should always reify their scopes.
+        JS_ASSERT_IF(si.frame().isFunctionFrame(), !si.frame().callee()->isGenerator());
         Rooted<StaticBlockObject *> staticBlock(cx, &si.staticBlock());
         ClonedBlockObject *block = ClonedBlockObject::create(cx, staticBlock, si.frame());
         if (!block)
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index 07207d4eaf7b..f5eb96a4edf2 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -548,13 +548,6 @@ class ScopeIter
     explicit ScopeIter(JSObject &enclosingScope, JSContext *cx
                        MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
-    /*
-     * For the special case of generators, copy the given ScopeIter, with 'fp'
-     * as the StackFrame instead of si.fp(). Not for general use.
-     */
-    ScopeIter(const ScopeIter &si, AbstractFramePtr frame, JSContext *cx
-              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
-
     /* Like ScopeIter(StackFrame *) except start at 'scope'. */
     ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
               MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
@@ -719,15 +712,12 @@ class DebugScopes
     static bool updateLiveScopes(JSContext *cx);
     static AbstractFramePtr hasLiveFrame(ScopeObject &scope);
 
-    /*
-     * In debug-mode, these must be called whenever exiting a call/block or
-     * when activating/yielding a generator.
-     */
+    // In debug-mode, these must be called whenever exiting a scope that might
+    // have stack-allocated locals.
     static void onPopCall(AbstractFramePtr frame, JSContext *cx);
     static void onPopBlock(JSContext *cx, AbstractFramePtr frame);
     static void onPopWith(AbstractFramePtr frame);
     static void onPopStrictEvalScope(AbstractFramePtr frame);
-    static void onGeneratorFrameChange(AbstractFramePtr from, AbstractFramePtr to, JSContext *cx);
     static void onCompartmentLeaveDebugMode(JSCompartment *c);
 };
 
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index daa06c529d42..4e47e88d9f45 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -516,14 +516,6 @@ AbstractFramePtr::unaliasedActual(unsigned i, MaybeCheckAliasing checkAliasing)
 #endif
 }
 
-inline JSGenerator *
-AbstractFramePtr::maybeSuspendedGenerator(JSRuntime *rt) const
-{
-    if (isStackFrame())
-        return asStackFrame()->maybeSuspendedGenerator(rt);
-    return nullptr;
-}
-
 inline StaticBlockObject *
 AbstractFramePtr::maybeBlockChain() const
 {
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 0f8e40ab1b30..dcb8ea9ae6a9 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -123,9 +123,6 @@ StackFrame::copyFrameAndValues(JSContext *cx, Value *vp, StackFrame *otherfp,
         if (doPostBarrier)
             HeapValue::writeBarrierPost(*dst, dst);
     }
-
-    if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onGeneratorFrameChange(otherfp, this, cx);
 }
 
 /* Note: explicit instantiation for js_NewGenerator located in jsiter.cpp. */
@@ -155,27 +152,6 @@ StackFrame::writeBarrierPost()
         HeapValue::writeBarrierPost(rval_, &rval_);
 }
 
-JSGenerator *
-StackFrame::maybeSuspendedGenerator(JSRuntime *rt)
-{
-    /*
-     * A suspended generator's frame is embedded inside the JSGenerator object
-     * and is not currently running.
-     */
-    if (!isGeneratorFrame() || !isSuspended())
-        return nullptr;
-
-    /*
-     * Once we know we have a suspended generator frame, there is a static
-     * offset from the frame's snapshot to beginning of the JSGenerator.
-     */
-    char *vp = reinterpret_cast<char *>(generatorArgsSnapshotBegin());
-    char *p = vp - offsetof(JSGenerator, stackSnapshot);
-    JSGenerator *gen = reinterpret_cast<JSGenerator *>(p);
-    JS_ASSERT(gen->fp == this);
-    return gen;
-}
-
 bool
 StackFrame::copyRawFrameSlots(AutoValueVector *vec)
 {
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 053a02f61120..4321c1d1f1b9 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -172,8 +172,6 @@ class AbstractFramePtr
 
     operator bool() const { return !!ptr_; }
 
-    inline JSGenerator *maybeSuspendedGenerator(JSRuntime *rt) const;
-
     inline JSObject *scopeChain() const;
     inline CallObject &callObj() const;
     inline bool initFunctionScopeObjects(JSContext *cx);
@@ -863,8 +861,6 @@ class StackFrame
     void copyFrameAndValues(JSContext *cx, Value *vp, StackFrame *otherfp,
                             const Value *othervp, Value *othersp);
 
-    JSGenerator *maybeSuspendedGenerator(JSRuntime *rt);
-
     /*
      * js::Execute pushes both global and function frames (since eval() in a
      * function pushes a frame with isFunctionFrame() && isEvalFrame()). Most

From e877084c47265375a10db2afe3e6fd679b6842da Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 10:11:06 +0100
Subject: [PATCH 225/459] Bug 927782 - Part 5: Clean up bytecode generation for
 catch clauses. r=jorendorff

---
 js/src/frontend/BytecodeEmitter.cpp | 265 +++++++++++++---------------
 js/src/frontend/BytecodeEmitter.h   |   1 +
 2 files changed, 128 insertions(+), 138 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 9277bfd761bb..569cc37067b5 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -3791,8 +3791,6 @@ class EmitLevelManager
 static bool
 EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
-    ptrdiff_t guardJump;
-
     /*
      * Morph STMT_BLOCK to STMT_CATCH, note the block entry code offset,
      * and save the block object atom.
@@ -3841,18 +3839,51 @@ EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         JS_ASSERT(0);
     }
 
-    /* Emit the guard expression, if there is one. */
+    // If there is a guard expression, emit it and arrange to jump to the next
+    // catch block if the guard expression is false.
     if (pn->pn_kid2) {
         if (!EmitTree(cx, bce, pn->pn_kid2))
             return false;
 
-        /* ifeq <next block> */
-        guardJump = EmitJump(cx, bce, JSOP_IFEQ, 0);
+        // If the guard expression is false, fall through, pop the block scope,
+        // and jump to the next catch block.  Otherwise jump over that code and
+        // pop the dupped exception.
+        ptrdiff_t guardCheck = EmitJump(cx, bce, JSOP_IFNE, 0);
+        if (guardCheck < 0)
+            return false;
+
+#ifdef DEBUG
+        uint32_t blockScopeIndex = bce->topStmt->blockScopeIndex;
+        uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
+        ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
+        StaticBlockObject *blockObj = &blockObjBox->object->as<StaticBlockObject>();
+        JS_ASSERT(blockObj == bce->blockChain);
+#endif
+
+        // Save stack depth before popping the block scope.
+        int savedDepth = bce->stackDepth;
+
+        // Move exception back to cx->exception to prepare for
+        // the next catch.
+        if (Emit1(cx, bce, JSOP_THROWING) < 0)
+            return false;
+
+        // Leave the scope for this catch block
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
+        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, bce->blockChain->slotCount());
+
+        // Jump to the next handler.  The jump target is backpatched by EmitTry.
+        ptrdiff_t guardJump = EmitJump(cx, bce, JSOP_GOTO, 0);
         if (guardJump < 0)
             return false;
         stmt->guardJump() = guardJump;
 
-        /* Pop duplicated exception object as we no longer need it. */
+        // Back to normal control flow. restore stack depth after nonlocal exit.
+        bce->stackDepth = savedDepth;
+        SetJumpOffsetAt(bce, guardCheck);
+
+        // Pop duplicated exception object as we no longer need it.
         if (Emit1(cx, bce, JSOP_POP) < 0)
             return false;
     }
@@ -3861,38 +3892,35 @@ EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     return EmitTree(cx, bce, pn->pn_kid3);
 }
 
-/*
- * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See
- * the comment on EmitSwitch.
- */
+// Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047. See the
+// comment on EmitSwitch.
+//
 MOZ_NEVER_INLINE static bool
 EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     StmtInfoBCE stmtInfo(cx);
 
-    /*
-     * Push stmtInfo to track jumps-over-catches and gosubs-to-finally
-     * for later fixup.
-     *
-     * When a finally block is active (STMT_FINALLY in our parse context),
-     * non-local jumps (including jumps-over-catches) result in a GOSUB
-     * being written into the bytecode stream and fixed-up later (c.f.
-     * EmitBackPatchOp and BackPatch).
-     */
+    // Push stmtInfo to track jumps-over-catches and gosubs-to-finally
+    // for later fixup.
+    //
+    // When a finally block is active (STMT_FINALLY in our parse context),
+    // non-local jumps (including jumps-over-catches) result in a GOSUB
+    // being written into the bytecode stream and fixed-up later (c.f.
+    // EmitBackPatchOp and BackPatch).
+    //
     PushStatementBCE(bce, &stmtInfo, pn->pn_kid3 ? STMT_FINALLY : STMT_TRY, bce->offset());
 
-    /*
-     * Since an exception can be thrown at any place inside the try block,
-     * we need to restore the stack and the scope chain before we transfer
-     * the control to the exception handler.
-     *
-     * For that we store in a try note associated with the catch or
-     * finally block the stack depth upon the try entry. The interpreter
-     * uses this depth to properly unwind the stack and the scope chain.
-     */
+    // Since an exception can be thrown at any place inside the try block,
+    // we need to restore the stack and the scope chain before we transfer
+    // the control to the exception handler.
+    //
+    // For that we store in a try note associated with the catch or
+    // finally block the stack depth upon the try entry. The interpreter
+    // uses this depth to properly unwind the stack and the scope chain.
+    //
     int depth = bce->stackDepth;
 
-    /* Mark try location for decompilation, then emit try block. */
+    // Record the try location, then emit the try block.
     ptrdiff_t noteIndex = NewSrcNote(cx, bce, SRC_TRY);
     if (noteIndex < 0 || Emit1(cx, bce, JSOP_TRY) < 0)
         return false;
@@ -3901,146 +3929,101 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         return false;
     JS_ASSERT(depth == bce->stackDepth);
 
-    /* GOSUB to finally, if present. */
+    // GOSUB to finally, if present.
     if (pn->pn_kid3) {
         if (EmitBackPatchOp(cx, bce, &stmtInfo.gosubs()) < 0)
             return false;
     }
 
-    /* Source note points to the jump at the end of the try block. */
+    // Source note points to the jump at the end of the try block.
     if (!SetSrcNoteOffset(cx, bce, noteIndex, 0, bce->offset() - tryStart + JSOP_TRY_LENGTH))
         return false;
 
-    /* Emit (hidden) jump over catch and/or finally. */
+    // Emit jump over catch and/or finally.
     ptrdiff_t catchJump = -1;
     if (EmitBackPatchOp(cx, bce, &catchJump) < 0)
         return false;
 
     ptrdiff_t tryEnd = bce->offset();
 
-    /* If this try has a catch block, emit it. */
-    ParseNode *lastCatch = nullptr;
+    // If this try has a catch block, emit it.
     if (ParseNode *pn2 = pn->pn_kid2) {
-        unsigned count = 0;    /* previous catch block's population */
-
-        /*
-         * The emitted code for a catch block looks like:
-         *
-         * [throwing]                          only if 2nd+ catch block
-         * [leaveblock]                        only if 2nd+ catch block
-         * enterblock
-         * exception
-         * [dup]                               only if catchguard
-         * setlocalpop <slot>                  or destructuring code
-         * [< catchguard code >]               if there's a catchguard
-         * [ifeq <offset to next catch block>]         " "
-         * [pop]                               only if catchguard
-         * < catch block contents >
-         * leaveblock
-         * goto <end of catch blocks>          non-local; finally applies
-         *
-         * If there's no catch block without a catchguard, the last
-         * <offset to next catch block> points to rethrow code.  This
-         * code will [gosub] to the finally code if appropriate, and is
-         * also used for the catch-all trynote for capturing exceptions
-         * thrown from catch{} blocks.
-         */
+        // The emitted code for a catch block looks like:
+        //
+        // enterblock
+        // exception
+        // if there is a catchguard:
+        //   dup
+        // setlocal 0; pop              assign or possibly destructure exception
+        // if there is a catchguard:
+        //   < catchguard code >
+        //   ifne POST
+        //   throwing                   pop exception to cx->exception
+        //   debugleaveblock
+        //   leaveblock
+        //   goto <next catch block>
+        //   POST: pop
+        // < catch block contents >
+        // debugleaveblock
+        // leaveblock
+        // goto <end of catch blocks>   non-local; finally applies
+        //
+        // If there's no catch block without a catchguard, the last <next catch
+        // block> points to rethrow code.  This code will [gosub] to the finally
+        // code if appropriate, and is also used for the catch-all trynote for
+        // capturing exceptions thrown from catch{} blocks.
+        //
         for (ParseNode *pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
-            ptrdiff_t guardJump;
-
             JS_ASSERT(bce->stackDepth == depth);
-            guardJump = stmtInfo.guardJump();
-            if (guardJump != -1) {
-                /* Fix up and clean up previous catch block. */
-                SetJumpOffsetAt(bce, guardJump);
 
-                /*
-                 * Account for JSOP_ENTERBLOCK (whose block object count
-                 * is saved below) and pushed exception object that we
-                 * still have after the jumping from the previous guard.
-                 */
-                bce->stackDepth = depth + count + 1;
-
-                /*
-                 * Move exception back to cx->exception to prepare for
-                 * the next catch.
-                 */
-                if (Emit1(cx, bce, JSOP_THROWING) < 0)
-                    return false;
-                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-                    return false;
-                EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, count);
-                JS_ASSERT(bce->stackDepth == depth);
-            }
-
-            /*
-             * Emit the lexical scope and catch body.  Save the catch's
-             * block object population via count, for use when targeting
-             * guardJump at the next catch (the guard mismatch case).
-             */
+            // Emit the lexical scope and catch body.
             JS_ASSERT(pn3->isKind(PNK_LEXICALSCOPE));
-            count = pn3->pn_objbox->object->as<StaticBlockObject>().slotCount();
             if (!EmitTree(cx, bce, pn3))
                 return false;
 
-            /* gosub <finally>, if required */
+            // gosub <finally>, if required.
             if (pn->pn_kid3) {
                 if (EmitBackPatchOp(cx, bce, &stmtInfo.gosubs()) < 0)
                     return false;
                 JS_ASSERT(bce->stackDepth == depth);
             }
 
-            /*
-             * Jump over the remaining catch blocks.  This will get fixed
-             * up to jump to after catch/finally.
-             */
+            // Jump over the remaining catch blocks.  This will get fixed
+            // up to jump to after catch/finally.
             if (EmitBackPatchOp(cx, bce, &catchJump) < 0)
                 return false;
 
-            /*
-             * Save a pointer to the last catch node to handle try-finally
-             * and try-catch(guard)-finally special cases.
-             */
-            lastCatch = pn3->expr();
+            // If this catch block had a guard clause, patch the guard jump to
+            // come here.
+            if (stmtInfo.guardJump() != -1) {
+                SetJumpOffsetAt(bce, stmtInfo.guardJump());
+                stmtInfo.guardJump() = -1;
+
+                // If this catch block is the last one, rethrow, delegating
+                // execution of any finally block to the exception handler.
+                if (!pn3->pn_next) {
+                    if (Emit1(cx, bce, JSOP_EXCEPTION) < 0)
+                        return false;
+                    if (Emit1(cx, bce, JSOP_THROW) < 0)
+                        return false;
+                }
+            }
         }
     }
 
-    /*
-     * Last catch guard jumps to the rethrow code sequence if none of the
-     * guards match. Target guardJump at the beginning of the rethrow
-     * sequence, just in case a guard expression throws and leaves the
-     * stack unbalanced.
-     */
-    if (lastCatch && lastCatch->pn_kid2) {
-        SetJumpOffsetAt(bce, stmtInfo.guardJump());
-
-        /* Sync the stack to take into account pushed exception. */
-        JS_ASSERT(bce->stackDepth == depth);
-        bce->stackDepth = depth + 1;
-
-        /*
-         * Rethrow the exception, delegating executing of finally if any
-         * to the exception handler.
-         */
-        if (Emit1(cx, bce, JSOP_THROW) < 0)
-            return false;
-    }
-
     JS_ASSERT(bce->stackDepth == depth);
 
-    /* Emit finally handler if any. */
-    ptrdiff_t finallyStart = 0;   /* to quell GCC uninitialized warnings */
+    // Emit the finally handler, if there is one.
+    ptrdiff_t finallyStart = 0;
     if (pn->pn_kid3) {
-        /*
-         * Fix up the gosubs that might have been emitted before non-local
-         * jumps to the finally code.
-         */
+        // Fix up the gosubs that might have been emitted before non-local
+        // jumps to the finally code.
         if (!BackPatch(cx, bce, stmtInfo.gosubs(), bce->code().end(), JSOP_GOSUB))
             return false;
 
         finallyStart = bce->offset();
 
-        /* Indicate that we're emitting a subroutine body. */
+        // Indicate that we're emitting a subroutine body.
         stmtInfo.type = STMT_SUBROUTINE;
         if (!UpdateSourceCoordNotes(cx, bce, pn->pn_kid3->pn_pos.begin))
             return false;
@@ -4055,26 +4038,22 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    /* ReconstructPCStack needs a NOP here to mark the end of the last catch block. */
+    // ReconstructPCStack needs a NOP here to mark the end of the last catch block.
     if (Emit1(cx, bce, JSOP_NOP) < 0)
         return false;
 
-    /* Fix up the end-of-try/catch jumps to come here. */
+    // Fix up the end-of-try/catch jumps to come here.
     if (!BackPatch(cx, bce, catchJump, bce->code().end(), JSOP_GOTO))
         return false;
 
-    /*
-     * Add the try note last, to let post-order give us the right ordering
-     * (first to last for a given nesting level, inner to outer by level).
-     */
+    // Add the try note last, to let post-order give us the right ordering
+    // (first to last for a given nesting level, inner to outer by level).
     if (pn->pn_kid2 && !bce->tryNoteList.append(JSTRY_CATCH, depth, tryStart, tryEnd))
         return false;
 
-    /*
-     * If we've got a finally, mark try+catch region with additional
-     * trynote to catch exceptions (re)thrown from a catch block or
-     * for the try{}finally{} case.
-     */
+    // If we've got a finally, mark try+catch region with additional
+    // trynote to catch exceptions (re)thrown from a catch block or
+    // for the try{}finally{} case.
     if (pn->pn_kid3 && !bce->tryNoteList.append(JSTRY_FINALLY, depth, tryStart, finallyStart))
         return false;
 
@@ -6890,6 +6869,16 @@ CGObjectList::finish(ObjectArray *array)
     JS_ASSERT(cursor == array->vector);
 }
 
+ObjectBox*
+CGObjectList::find(uint32_t index)
+{
+    JS_ASSERT(index < length);
+    ObjectBox *box = lastbox;
+    for (unsigned n = length - 1; n > index; n--)
+        box = box->emitLink;
+    return box;
+}
+
 bool
 CGTryNoteList::append(JSTryNoteKind kind, unsigned stackDepth, size_t start, size_t end)
 {
diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
index 3473a034e831..54b000774289 100644
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -46,6 +46,7 @@ struct CGObjectList {
     unsigned add(ObjectBox *objbox);
     unsigned indexOf(JSObject *obj);
     void finish(ObjectArray *array);
+    ObjectBox* find(uint32_t index);
 };
 
 struct CGTryNoteList {

From 46f0c8499407813a309fc245b46dfa62066be443 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 10:13:59 +0100
Subject: [PATCH 226/459] Bug 927782 - Part 6: Fix for-let nesting so nonlocal
 exits are easier. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 48 +++++++----------------------
 1 file changed, 11 insertions(+), 37 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 569cc37067b5..0d45a65c126b 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -577,35 +577,11 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
 
         if (stmt->isBlockScope) {
             FLUSH_POPS();
-            unsigned blockObjCount = stmt->blockObj->slotCount();
-            if (stmt->isForLetBlock) {
-                /*
-                 * For a for-let-in/of statement, pushing/popping the block is
-                 * interleaved with JSOP_(END)ITER. Just handle both together
-                 * here and skip over the enclosing STMT_FOR_IN_LOOP.
-                 */
-                unsigned popCount = blockObjCount;
-                stmt = stmt->down;
-                if (stmt == toStmt)
-                    break;
-                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-                    return false;
-                if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
-                    return false;
-                if (stmt->type == STMT_FOR_OF_LOOP) {
-                    popCount += 2;
-                } else {
-                    JS_ASSERT(stmt->type == STMT_FOR_IN_LOOP);
-                    if (!PopIterator(cx, bce))
-                        return false;
-                }
-                EMIT_UINT16_IMM_OP(JSOP_POPN, popCount);
-            } else {
-                /* There is a Block object with locals on the stack to pop. */
-                if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-                    return false;
-                EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
-            }
+            JS_ASSERT(stmt->blockObj);
+            StaticBlockObject &blockObj = *stmt->blockObj;
+            if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+                return false;
+            EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
         }
     }
 
@@ -4269,9 +4245,6 @@ EmitWith(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 static bool
 EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
-    StmtInfoBCE stmtInfo(cx);
-    PushStatementBCE(bce, &stmtInfo, STMT_FOR_OF_LOOP, top);
-
     ParseNode *forHead = pn->pn_left;
     ParseNode *forBody = pn->pn_right;
 
@@ -4328,11 +4301,13 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
             return false;
-        letStmt.isForLetBlock = true;
         if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET2))
             return false;
     }
 
+    StmtInfoBCE stmtInfo(cx);
+    PushStatementBCE(bce, &stmtInfo, STMT_FOR_OF_LOOP, top);
+
     // Jump down to the loop condition to minimize overhead assuming at least
     // one iteration, as the other loop forms do.  Annotate so IonMonkey can
     // find the loop-closing jump.
@@ -4436,9 +4411,6 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
 static bool
 EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
-    StmtInfoBCE stmtInfo(cx);
-    PushStatementBCE(bce, &stmtInfo, STMT_FOR_IN_LOOP, top);
-
     ParseNode *forHead = pn->pn_left;
     ParseNode *forBody = pn->pn_right;
 
@@ -4507,11 +4479,13 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
             return false;
-        letStmt.isForLetBlock = true;
         if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET1))
             return false;
     }
 
+    StmtInfoBCE stmtInfo(cx);
+    PushStatementBCE(bce, &stmtInfo, STMT_FOR_IN_LOOP, top);
+
     /* Annotate so IonMonkey can find the loop-closing jump. */
     int noteIndex = NewSrcNote(cx, bce, SRC_FOR_IN);
     if (noteIndex < 0)

From 3b8c9f30e6e61db37850960ee3199a4b36e38b85 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:25:55 +0100
Subject: [PATCH 227/459] Bug 927782 - Part 7: Refactor entering and leaving
 block scopes in BytecodeEmitter. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 362 ++++++++++++++--------------
 js/src/jit/BaselineBailouts.cpp     |   1 -
 js/src/vm/Interpreter.cpp           |   4 +-
 3 files changed, 178 insertions(+), 189 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 0d45a65c126b..81529e9c0de7 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -142,11 +142,12 @@ EmitCheck(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t delta)
 }
 
 static StaticBlockObject &
-CurrentBlock(StmtInfoBCE *topStmt)
+LastBlockAdded(BytecodeEmitter *bce, jsbytecode *pc)
 {
-    JS_ASSERT(topStmt->type == STMT_BLOCK || topStmt->type == STMT_SWITCH);
-    JS_ASSERT(topStmt->blockObj->is<StaticBlockObject>());
-    return *topStmt->blockObj;
+    DebugOnly<uint32_t> index = GET_UINT32_INDEX(pc);
+    JS_ASSERT(index < bce->objectList.length);
+    JS_ASSERT(index == bce->objectList.length - 1);
+    return bce->objectList.lastbox->object->as<StaticBlockObject>();
 }
 
 static void
@@ -176,13 +177,13 @@ UpdateDepth(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t target)
     int nuses, ndefs;
     if (op == JSOP_ENTERBLOCK) {
         nuses = 0;
-        ndefs = CurrentBlock(bce->topStmt).slotCount();
+        ndefs = LastBlockAdded(bce, pc).slotCount();
     } else if (op == JSOP_ENTERLET0) {
-        nuses = ndefs = CurrentBlock(bce->topStmt).slotCount();
+        nuses = ndefs = LastBlockAdded(bce, pc).slotCount();
     } else if (op == JSOP_ENTERLET1) {
-        nuses = ndefs = CurrentBlock(bce->topStmt).slotCount() + 1;
+        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 1;
     } else if (op == JSOP_ENTERLET2) {
-        nuses = ndefs = CurrentBlock(bce->topStmt).slotCount() + 2;
+        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 2;
     } else {
         nuses = StackUses(nullptr, pc);
         ndefs = StackDefs(nullptr, pc);
@@ -653,10 +654,80 @@ EnclosingStaticScope(BytecodeEmitter *bce)
     return bce->sc->asFunctionBox()->function();
 }
 
-// Push a block scope statement and link blockObj into bce->blockChain.
+// In a stack frame, block-scoped locals follow hoisted var-bound locals.  If
+// the current compilation unit is a function, add the number of "fixed slots"
+// (var-bound locals) to the given block-scoped index, to arrive at its final
+// position in the call frame.
+//
 static bool
-PushBlockScopeBCE(BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
-                  ptrdiff_t top)
+AdjustBlockSlot(ExclusiveContext *cx, BytecodeEmitter *bce, uint32_t *slot)
+{
+    JS_ASSERT(*slot < bce->maxStackDepth);
+    if (bce->sc->isFunctionBox()) {
+        *slot += bce->script->bindings.numVars();
+        if ((unsigned) *slot >= SLOTNO_LIMIT) {
+            bce->reportError(nullptr, JSMSG_TOO_MANY_LOCALS);
+            return false;
+        }
+    }
+    return true;
+}
+
+#ifdef DEBUG
+static bool
+AllLocalsAliased(StaticBlockObject &obj)
+{
+    for (unsigned i = 0; i < obj.slotCount(); i++)
+        if (!obj.isAliased(i))
+            return false;
+    return true;
+}
+#endif
+
+static bool
+ComputeAliasedSlots(ExclusiveContext *cx, BytecodeEmitter *bce, StaticBlockObject &blockObj)
+{
+    uint32_t depthPlusFixed = blockObj.stackDepth();
+    if (!AdjustBlockSlot(cx, bce, &depthPlusFixed))
+        return false;
+
+    for (unsigned i = 0; i < blockObj.slotCount(); i++) {
+        Definition *dn = blockObj.maybeDefinitionParseNode(i);
+
+        /* Beware the empty destructuring dummy. */
+        if (!dn) {
+            blockObj.setAliased(i, bce->sc->allLocalsAliased());
+            continue;
+        }
+
+        JS_ASSERT(dn->isDefn());
+        JS_ASSERT(dn->frameSlot() + depthPlusFixed < JS_BIT(16));
+        if (!dn->pn_cookie.set(bce->parser->tokenStream, dn->pn_cookie.level(),
+                               uint16_t(dn->frameSlot() + depthPlusFixed)))
+            return false;
+
+#ifdef DEBUG
+        for (ParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
+            JS_ASSERT(pnu->pn_lexdef == dn);
+            JS_ASSERT(!(pnu->pn_dflags & PND_BOUND));
+            JS_ASSERT(pnu->pn_cookie.isFree());
+        }
+#endif
+
+        blockObj.setAliased(i, bce->isAliasedName(dn));
+    }
+
+    JS_ASSERT_IF(bce->sc->allLocalsAliased(), AllLocalsAliased(blockObj));
+
+    return true;
+}
+
+static bool
+EmitInternedObjectOp(ExclusiveContext *cx, uint32_t index, JSOp op, BytecodeEmitter *bce);
+
+static bool
+EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
+                unsigned extraSlots)
 {
     uint32_t parent = UINT32_MAX;
     if (bce->blockChain) {
@@ -667,16 +738,35 @@ PushBlockScopeBCE(BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
 
     StaticBlockObject &blockObj = objbox->object->as<StaticBlockObject>();
 
-    PushStatementBCE(bce, stmt, STMT_BLOCK, top);
-
-    unsigned scopeObjectIndex = bce->objectList.add(objbox);
+    uint32_t scopeObjectIndex = bce->objectList.add(objbox);
     stmt->blockScopeIndex = bce->blockScopeList.length();
     if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
         return false;
 
+    int depth = bce->stackDepth - (blockObj.slotCount() + extraSlots);
+    JS_ASSERT(depth >= 0);
+    blockObj.setStackDepth(depth);
+
+    JSOp op;
+    switch (extraSlots) {
+      case 0: op = JSOP_ENTERLET0; break;
+      case 1: op = JSOP_ENTERLET1; break;
+      case 2: op = JSOP_ENTERLET2; break;
+      default: MOZ_ASSUME_UNREACHABLE("unexpected extraSlots");
+    }
+
+    if (!ComputeAliasedSlots(cx, bce, blockObj))
+        return false;
+
+    if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
+        return false;
+
+    PushStatementBCE(bce, stmt, STMT_BLOCK, bce->offset());
     blockObj.initEnclosingStaticScope(EnclosingStaticScope(bce));
     FinishPushBlockScope(bce, stmt, blockObj);
 
+    JS_ASSERT(stmt->isBlockScope);
+
     return true;
 }
 
@@ -700,6 +790,35 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
     return true;
 }
 
+static bool
+LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
+{
+#ifdef DEBUG
+    StmtInfoBCE *stmt = bce->topStmt;
+    uint32_t blockScopeIndex = stmt->blockScopeIndex;
+    JS_ASSERT(stmt->isBlockScope);
+    JS_ASSERT(bce->blockScopeList.list[blockScopeIndex].length == 0);
+    uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
+    ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
+    StaticBlockObject *blockObj = &blockObjBox->object->as<StaticBlockObject>();
+    JS_ASSERT(stmt->blockObj == blockObj);
+    JS_ASSERT(blockObj == bce->blockChain);
+#endif
+
+    uint32_t slotCount = bce->blockChain->slotCount();
+
+    if (!PopStatementBCE(cx, bce))
+        return false;
+
+    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        return false;
+
+    JS_ASSERT(op == JSOP_LEAVEBLOCK || op == JSOP_LEAVEBLOCKEXPR);
+    EMIT_UINT16_IMM_OP(op, slotCount);
+
+    return true;
+}
+
 static bool
 EmitIndex32(ExclusiveContext *cx, JSOp op, uint32_t index, BytecodeEmitter *bce)
 {
@@ -1032,101 +1151,6 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
     return false;
 }
 
-/*
- * Adjust the slot for a block local to account for the number of variables
- * that share the same index space with locals. Due to the incremental code
- * generation for top-level script, we do the adjustment via code patching in
- * js::frontend::CompileScript; see comments there.
- *
- * The function returns -1 on failures.
- */
-static int
-AdjustBlockSlot(ExclusiveContext *cx, BytecodeEmitter *bce, int slot)
-{
-    JS_ASSERT((unsigned) slot < bce->maxStackDepth);
-    if (bce->sc->isFunctionBox()) {
-        slot += bce->script->bindings.numVars();
-        if ((unsigned) slot >= SLOTNO_LIMIT) {
-            bce->reportError(nullptr, JSMSG_TOO_MANY_LOCALS);
-            slot = -1;
-        }
-    }
-    return slot;
-}
-
-#ifdef DEBUG
-static bool
-AllLocalsAliased(StaticBlockObject &obj)
-{
-    for (unsigned i = 0; i < obj.slotCount(); i++)
-        if (!obj.isAliased(i))
-            return false;
-    return true;
-}
-#endif
-
-static bool
-EmitEnterBlock(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, JSOp op)
-{
-    JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
-    StmtInfoBCE *stmt = bce->topStmt;
-    JS_ASSERT(stmt->type == STMT_BLOCK || stmt->type == STMT_SWITCH);
-    JS_ASSERT(stmt->isBlockScope);
-    JS_ASSERT(stmt->blockScopeIndex == bce->blockScopeList.length() - 1);
-    JS_ASSERT(bce->blockScopeList.list[stmt->blockScopeIndex].length == 0);
-    uint32_t scopeObjectIndex = bce->blockScopeList.list[stmt->blockScopeIndex].index;
-    JS_ASSERT(scopeObjectIndex == bce->objectList.length - 1);
-    JS_ASSERT(pn->pn_objbox == bce->objectList.lastbox);
-    if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
-        return false;
-
-    Rooted<StaticBlockObject*> blockObj(cx, &pn->pn_objbox->object->as<StaticBlockObject>());
-
-    int extraSlots = (op == JSOP_ENTERLET1)
-                     ? 1
-                     : (op == JSOP_ENTERLET2)
-                     ? 2
-                     : 0;
-    int depth = bce->stackDepth - (blockObj->slotCount() + extraSlots);
-    JS_ASSERT(depth >= 0);
-
-    blockObj->setStackDepth(depth);
-
-    int depthPlusFixed = AdjustBlockSlot(cx, bce, depth);
-    if (depthPlusFixed < 0)
-        return false;
-
-    for (unsigned i = 0; i < blockObj->slotCount(); i++) {
-        Definition *dn = blockObj->maybeDefinitionParseNode(i);
-
-        /* Beware the empty destructuring dummy. */
-        if (!dn) {
-            blockObj->setAliased(i, bce->sc->allLocalsAliased());
-            continue;
-        }
-
-        JS_ASSERT(dn->isDefn());
-        JS_ASSERT(unsigned(dn->frameSlot() + depthPlusFixed) < JS_BIT(16));
-        if (!dn->pn_cookie.set(bce->parser->tokenStream, dn->pn_cookie.level(),
-                               uint16_t(dn->frameSlot() + depthPlusFixed)))
-            return false;
-
-#ifdef DEBUG
-        for (ParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
-            JS_ASSERT(pnu->pn_lexdef == dn);
-            JS_ASSERT(!(pnu->pn_dflags & PND_BOUND));
-            JS_ASSERT(pnu->pn_cookie.isFree());
-        }
-#endif
-
-        blockObj->setAliased(i, bce->isAliasedName(dn));
-    }
-
-    JS_ASSERT_IF(bce->sc->allLocalsAliased(), AllLocalsAliased(*blockObj));
-
-    return true;
-}
-
 /*
  * Try to convert a *NAME op with a free name to a more specialized GNAME,
  * INTRINSIC or ALIASEDVAR op, which optimize accesses on that name.
@@ -2299,7 +2323,6 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     int noteIndex;
     size_t switchSize;
     jsbytecode *pc;
-    StmtInfoBCE stmtInfo(cx);
 
     /* Try for most optimal, fall back if not dense ints. */
     switchOp = JSOP_TABLESWITCH;
@@ -2307,14 +2330,16 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     defaultOffset = -1;
 
     pn2 = pn->pn_right;
+    JS_ASSERT(pn2->isKind(PNK_LEXICALSCOPE) || pn2->isKind(PNK_STATEMENTLIST));
+
     /*
      * If there are hoisted let declarations, their stack slots go under the
      * discriminant's value so push their slots now and enter the block later.
      */
-    uint32_t blockObjCount = 0;
+    StaticBlockObject *blockObj = nullptr;
     if (pn2->isKind(PNK_LEXICALSCOPE)) {
-        blockObjCount = pn2->pn_objbox->object->as<StaticBlockObject>().slotCount();
-        for (uint32_t i = 0; i < blockObjCount; ++i) {
+        blockObj = &pn2->pn_objbox->object->as<StaticBlockObject>();
+        for (uint32_t i = 0; i < blockObj->slotCount(); ++i) {
             if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
                 return false;
         }
@@ -2324,29 +2349,21 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!EmitTree(cx, bce, pn->pn_left))
         return false;
 
+    StmtInfoBCE stmtInfo(cx);
     if (pn2->isKind(PNK_LEXICALSCOPE)) {
-        if (!PushBlockScopeBCE(bce, &stmtInfo, pn2->pn_objbox, -1))
+        if (!EnterBlockScope(cx, bce, &stmtInfo, pn2->pn_objbox, 1))
             return false;
         stmtInfo.type = STMT_SWITCH;
-        if (!EmitEnterBlock(cx, bce, pn2, JSOP_ENTERLET1))
-            return false;
+        stmtInfo.update = top = bce->offset();
+        /* Advance pn2 to refer to the switch case list. */
+        pn2 = pn2->expr();
+    } else {
+        JS_ASSERT(pn2->isKind(PNK_STATEMENTLIST));
+        top = bce->offset();
+        PushStatementBCE(bce, &stmtInfo, STMT_SWITCH, top);
     }
 
     /* Switch bytecodes run from here till end of final case. */
-    top = bce->offset();
-    if (pn2->isKind(PNK_STATEMENTLIST)) {
-        PushStatementBCE(bce, &stmtInfo, STMT_SWITCH, top);
-    } else {
-        /*
-         * Set the statement info record's idea of top. Reset top too, since
-         * repushBlock emits code.
-         */
-        stmtInfo.update = top = bce->offset();
-
-        /* Advance pn2 to refer to the switch case list. */
-        pn2 = pn2->expr();
-    }
-
     uint32_t caseCount = pn2->pn_count;
     uint32_t tableLength = 0;
     ScopedJSFreePtr<ParseNode*> table(nullptr);
@@ -2618,13 +2635,13 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
     }
 
-    if (!PopStatementBCE(cx, bce))
-        return false;
 
     if (pn->pn_right->isKind(PNK_LEXICALSCOPE)) {
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+            return false;
+    } else {
+        if (!PopStatementBCE(cx, bce))
             return false;
-        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObjCount);
     }
 
     return true;
@@ -3139,8 +3156,8 @@ EmitGroupAssignment(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp,
     for (pn = lhs->pn_head; pn; pn = pn->pn_next, ++i) {
         /* MaybeEmitGroupAssignment requires lhs->pn_count <= rhs->pn_count. */
         JS_ASSERT(i < limit);
-        int slot = AdjustBlockSlot(cx, bce, i);
-        if (slot < 0)
+        uint32_t slot = i;
+        if (!AdjustBlockSlot(cx, bce, &slot))
             return false;
 
         if (!EmitUnaliasedVarOp(cx, JSOP_GETLOCAL, slot, bce))
@@ -4173,26 +4190,16 @@ EmitLet(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
     }
 
     StmtInfoBCE stmtInfo(cx);
-    if (!PushBlockScopeBCE(bce, &stmtInfo, letBody->pn_objbox, bce->offset()))
-        return false;
-
-    DebugOnly<ptrdiff_t> bodyBegin = bce->offset();
-    if (!EmitEnterBlock(cx, bce, letBody, JSOP_ENTERLET0))
+    if (!EnterBlockScope(cx, bce, &stmtInfo, letBody->pn_objbox, 0))
         return false;
 
     if (!EmitTree(cx, bce, letBody->pn_expr))
         return false;
 
-    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+    if (!LeaveBlockScope(cx, bce, letBody->getOp()))
         return false;
-    JSOp leaveOp = letBody->getOp();
-    JS_ASSERT(leaveOp == JSOP_LEAVEBLOCK || leaveOp == JSOP_LEAVEBLOCKEXPR);
-    EMIT_UINT16_IMM_OP(leaveOp, blockObj->slotCount());
 
-    DebugOnly<ptrdiff_t> bodyEnd = bce->offset();
-    JS_ASSERT(bodyEnd > bodyBegin);
-
-    return PopStatementBCE(cx, bce);
+    return true;
 }
 
 /*
@@ -4209,20 +4216,22 @@ EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     ObjectBox *objbox = pn->pn_objbox;
     StaticBlockObject &blockObj = objbox->object->as<StaticBlockObject>();
     size_t slots = blockObj.slotCount();
-    if (!PushBlockScopeBCE(bce, &stmtInfo, objbox, bce->offset()))
-        return false;
 
-    if (!EmitEnterBlock(cx, bce, pn, JSOP_ENTERBLOCK))
+    for (size_t n = 0; n < slots; ++n) {
+        if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
+            return false;
+    }
+
+    if (!EnterBlockScope(cx, bce, &stmtInfo, objbox, 0))
         return false;
 
     if (!EmitTree(cx, bce, pn->pn_expr))
         return false;
 
-    if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+    if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
         return false;
-    EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, slots);
 
-    return PopStatementBCE(cx, bce);
+    return true;
 }
 
 static bool
@@ -4299,9 +4308,7 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     // Enter the block before the loop body, after evaluating the obj.
     StmtInfoBCE letStmt(cx);
     if (letDecl) {
-        if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
-            return false;
-        if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET2))
+        if (!EnterBlockScope(cx, bce, &letStmt, pn1->pn_objbox, 2))
             return false;
     }
 
@@ -4393,18 +4400,14 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (!PopStatementBCE(cx, bce))
         return false;
 
+    // Pop result and iter.
+    EMIT_UINT16_IMM_OP(JSOP_POPN, 2);
+
     if (letDecl) {
-        if (!PopStatementBCE(cx, bce))
-            return false;
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-            return false;
-        if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
+        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
             return false;
     }
 
-    // Pop result, iter, and slots from the lexical block (if any).
-    EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount + 2);
-
     return true;
 }
 
@@ -4477,9 +4480,7 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     /* Enter the block before the loop body, after evaluating the obj. */
     StmtInfoBCE letStmt(cx);
     if (letDecl) {
-        if (!PushBlockScopeBCE(bce, &letStmt, pn1->pn_objbox, bce->offset()))
-            return false;
-        if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET1))
+        if (!EnterBlockScope(cx, bce, &letStmt, pn1->pn_objbox, 1))
             return false;
     }
 
@@ -4549,26 +4550,19 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (!SetSrcNoteOffset(cx, bce, (unsigned)noteIndex, 0, beq - jmp))
         return false;
 
-    /* Fixup breaks and continues before JSOP_ITER (and JSOP_LEAVEFORINLET). */
+    // Fix up breaks and continues.
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    if (letDecl) {
-        if (!PopStatementBCE(cx, bce))
-            return false;
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-            return false;
-        if (Emit1(cx, bce, JSOP_LEAVEFORLETIN) < 0)
-            return false;
-    }
-
     if (!bce->tryNoteList.append(JSTRY_ITER, bce->stackDepth, top, bce->offset()))
         return false;
     if (Emit1(cx, bce, JSOP_ENDITER) < 0)
         return false;
 
-    if (letDecl)
-        EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount);
+    if (letDecl) {
+        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+            return false;
+    }
 
     return true;
 }
@@ -6432,8 +6426,6 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
        return false;
 
       case PNK_ARRAYPUSH: {
-        int slot;
-
         /*
          * The array object's stack index is in bce->arrayCompDepth. See below
          * under the array initialiser code generator for array comprehension
@@ -6442,8 +6434,8 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
          */
         if (!EmitTree(cx, bce, pn->pn_kid))
             return false;
-        slot = AdjustBlockSlot(cx, bce, bce->arrayCompDepth);
-        if (slot < 0)
+        uint32_t slot = bce->arrayCompDepth;
+        if (!AdjustBlockSlot(cx, bce, &slot))
             return false;
         if (!EmitUnaliasedVarOp(cx, pn->getOp(), slot, bce))
             return false;
diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index d2fccb1da4fa..9fd0fc07fc10 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -666,7 +666,6 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
     bool resumeAfter = excInfo ? false : iter.resumeAfter();
 
     JSOp op = JSOp(*pc);
-    JS_ASSERT_IF(excInfo, op == JSOP_ENTERBLOCK);
 
     // Fixup inlined JSOP_FUNCALL, JSOP_FUNAPPLY, and accessors on the caller side.
     // On the caller side this must represent like the function wasn't inlined.
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index e076291e5b2a..0ea4658a9817 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -3377,10 +3377,8 @@ DEFAULT()
 
             switch (tn->kind) {
               case JSTRY_CATCH:
-                JS_ASSERT(*REGS.pc == JSOP_ENTERBLOCK || *REGS.pc == JSOP_EXCEPTION);
-
                 /* Catch cannot intercept the closing of a generator. */
-                  if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
+                if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
                     break;
 
                 /*

From e1f6dcf132f54d2399a56fa8740342b8389cd068 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:27:55 +0100
Subject: [PATCH 228/459] Bug 927782 - Part 8: Record block scope ranges more
 precisely. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 164 ++++++++++++++++++++--------
 js/src/frontend/BytecodeEmitter.h   |   1 +
 js/src/jsscript.cpp                 |   5 +-
 js/src/jsscript.h                   |  22 +++-
 js/src/vm/ScopeObject.cpp           |   1 +
 5 files changed, 142 insertions(+), 51 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 81529e9c0de7..e69e982252ef 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -523,19 +523,65 @@ PopIterator(ExclusiveContext *cx, BytecodeEmitter *bce)
     return true;
 }
 
+namespace {
+
+class NonLocalExitScope {
+    ExclusiveContext *cx;
+    BytecodeEmitter *bce;
+    const uint32_t savedScopeIndex;
+    const int savedDepth;
+    uint32_t openScopeIndex;
+
+    NonLocalExitScope(const NonLocalExitScope &) MOZ_DELETE;
+
+  public:
+    explicit NonLocalExitScope(ExclusiveContext *cx_, BytecodeEmitter *bce_)
+      : cx(cx_),
+        bce(bce_),
+        savedScopeIndex(bce->blockScopeList.length()),
+        savedDepth(bce->stackDepth),
+        openScopeIndex(UINT32_MAX) {
+        if (bce->blockChain) {
+            StmtInfoBCE *stmt = bce->topStmt;
+            while (1) {
+                JS_ASSERT(stmt);
+                if (stmt->isBlockScope) {
+                    openScopeIndex = stmt->blockScopeIndex;
+                    break;
+                }
+                stmt = stmt->down;
+            }
+        }
+    }
+
+    ~NonLocalExitScope() {
+        for (uint32_t n = savedScopeIndex; n < bce->blockScopeList.length(); n++)
+            bce->blockScopeList.recordEnd(n, bce->offset());
+        bce->stackDepth = savedDepth;
+    }
+
+    bool popScopeForNonLocalExit(StaticBlockObject &blockObj, uint32_t blockScopeIndex) {
+        uint32_t scopeObjectIndex = bce->blockScopeList.findEnclosingScope(blockScopeIndex);
+        uint32_t parent = openScopeIndex;
+
+        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            return false;
+        if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
+            return false;
+        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
+        openScopeIndex = bce->blockScopeList.length() - 1;
+        return true;
+    }
+
+    bool prepareForNonLocalJump(StmtInfoBCE *toStmt);
+};
+
 /*
  * Emit additional bytecode(s) for non-local jumps.
  */
-static bool
-EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *toStmt)
+bool
+NonLocalExitScope::prepareForNonLocalJump(StmtInfoBCE *toStmt)
 {
-    /*
-     * The non-local jump fixup we emit will unbalance bce->stackDepth, because
-     * the fixup replicates balanced code such as JSOP_LEAVEWITH emitted at the
-     * end of a with statement, so we save bce->stackDepth here and restore it
-     * just before a successful return.
-     */
-    int depth = bce->stackDepth;
     int npops = 0;
 
 #define FLUSH_POPS() if (npops && !FlushPops(cx, bce, &npops)) return false
@@ -580,24 +626,26 @@ EmitNonLocalJumpFixup(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *t
             FLUSH_POPS();
             JS_ASSERT(stmt->blockObj);
             StaticBlockObject &blockObj = *stmt->blockObj;
-            if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
+            if (!popScopeForNonLocalExit(blockObj, stmt->blockScopeIndex))
                 return false;
-            EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
         }
     }
 
     FLUSH_POPS();
-    bce->stackDepth = depth;
     return true;
 
 #undef FLUSH_POPS
 }
 
+}  // anonymous namespace
+
 static ptrdiff_t
 EmitGoto(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *toStmt, ptrdiff_t *lastp,
          SrcNoteType noteType = SRC_NULL)
 {
-    if (!EmitNonLocalJumpFixup(cx, bce, toStmt))
+    NonLocalExitScope nle(cx, bce);
+
+    if (!nle.prepareForNonLocalJump(toStmt))
         return -1;
 
     if (noteType != SRC_NULL) {
@@ -729,7 +777,7 @@ static bool
 EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
                 unsigned extraSlots)
 {
-    uint32_t parent = UINT32_MAX;
+    uint32_t parent = BlockScopeNote::NoBlockScopeIndex;
     if (bce->blockChain) {
         StmtInfoBCE *stmt = bce->topScopeStmt;
         for (; stmt->blockObj != bce->blockChain; stmt = stmt->down) {}
@@ -739,9 +787,6 @@ EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, O
     StaticBlockObject &blockObj = objbox->object->as<StaticBlockObject>();
 
     uint32_t scopeObjectIndex = bce->objectList.add(objbox);
-    stmt->blockScopeIndex = bce->blockScopeList.length();
-    if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
-        return false;
 
     int depth = bce->stackDepth - (blockObj.slotCount() + extraSlots);
     JS_ASSERT(depth >= 0);
@@ -761,6 +806,10 @@ EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, O
     if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
         return false;
 
+    stmt->blockScopeIndex = bce->blockScopeList.length();
+    if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
+        return false;
+
     PushStatementBCE(bce, stmt, STMT_BLOCK, bce->offset());
     blockObj.initEnclosingStaticScope(EnclosingStaticScope(bce));
     FinishPushBlockScope(bce, stmt, blockObj);
@@ -783,9 +832,6 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
         return false;
     }
 
-    if (stmt->isBlockScope)
-        bce->blockScopeList.recordEnd(stmt->blockScopeIndex, bce->offset());
-
     FinishPopStatement(bce);
     return true;
 }
@@ -793,10 +839,11 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
 static bool
 LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
 {
-#ifdef DEBUG
     StmtInfoBCE *stmt = bce->topStmt;
-    uint32_t blockScopeIndex = stmt->blockScopeIndex;
     JS_ASSERT(stmt->isBlockScope);
+    uint32_t blockScopeIndex = stmt->blockScopeIndex;
+
+#ifdef DEBUG
     JS_ASSERT(bce->blockScopeList.list[blockScopeIndex].length == 0);
     uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
     ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
@@ -813,6 +860,8 @@ LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
     if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
         return false;
 
+    bce->blockScopeList.recordEnd(blockScopeIndex, bce->offset());
+
     JS_ASSERT(op == JSOP_LEAVEBLOCK || op == JSOP_LEAVEBLOCKEXPR);
     EMIT_UINT16_IMM_OP(op, slotCount);
 
@@ -3845,35 +3894,26 @@ EmitCatch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         if (guardCheck < 0)
             return false;
 
-#ifdef DEBUG
-        uint32_t blockScopeIndex = bce->topStmt->blockScopeIndex;
-        uint32_t blockObjIndex = bce->blockScopeList.list[blockScopeIndex].index;
-        ObjectBox *blockObjBox = bce->objectList.find(blockObjIndex);
-        StaticBlockObject *blockObj = &blockObjBox->object->as<StaticBlockObject>();
-        JS_ASSERT(blockObj == bce->blockChain);
-#endif
+        {
+            NonLocalExitScope nle(cx, bce);
 
-        // Save stack depth before popping the block scope.
-        int savedDepth = bce->stackDepth;
+            // Move exception back to cx->exception to prepare for
+            // the next catch.
+            if (Emit1(cx, bce, JSOP_THROWING) < 0)
+                return false;
 
-        // Move exception back to cx->exception to prepare for
-        // the next catch.
-        if (Emit1(cx, bce, JSOP_THROWING) < 0)
-            return false;
+            // Leave the scope for this catch block.
+            if (!nle.prepareForNonLocalJump(stmt))
+                return false;
 
-        // Leave the scope for this catch block
-        if (Emit1(cx, bce, JSOP_DEBUGLEAVEBLOCK) < 0)
-            return false;
-        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, bce->blockChain->slotCount());
+            // Jump to the next handler.  The jump target is backpatched by EmitTry.
+            ptrdiff_t guardJump = EmitJump(cx, bce, JSOP_GOTO, 0);
+            if (guardJump < 0)
+                return false;
+            stmt->guardJump() = guardJump;
+        }
 
-        // Jump to the next handler.  The jump target is backpatched by EmitTry.
-        ptrdiff_t guardJump = EmitJump(cx, bce, JSOP_GOTO, 0);
-        if (guardJump < 0)
-            return false;
-        stmt->guardJump() = guardJump;
-
-        // Back to normal control flow. restore stack depth after nonlocal exit.
-        bce->stackDepth = savedDepth;
+        // Back to normal control flow.
         SetJumpOffsetAt(bce, guardCheck);
 
         // Pop duplicated exception object as we no longer need it.
@@ -5066,8 +5106,12 @@ EmitReturn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 
     if (Emit1(cx, bce, JSOP_RETURN) < 0)
         return false;
-    if (!EmitNonLocalJumpFixup(cx, bce, nullptr))
+
+    NonLocalExitScope nle(cx, bce);
+
+    if (!nle.prepareForNonLocalJump(nullptr))
         return false;
+
     if (top + JSOP_RETURN_LENGTH != bce->offset()) {
         bce->code()[top] = JSOP_SETRVAL;
         if (Emit1(cx, bce, JSOP_RETRVAL) < 0)
@@ -6884,6 +6928,30 @@ CGBlockScopeList::append(uint32_t scopeObject, uint32_t offset, uint32_t parent)
     return list.append(note);
 }
 
+uint32_t
+CGBlockScopeList::findEnclosingScope(uint32_t index)
+{
+    JS_ASSERT(index < length());
+    JS_ASSERT(list[index].index != BlockScopeNote::NoBlockScopeIndex);
+
+    DebugOnly<uint32_t> pos = list[index].start;
+    while (index--) {
+        JS_ASSERT(list[index].start <= pos);
+        if (list[index].length == 0) {
+            // We are looking for the nearest enclosing live scope.  If the
+            // scope contains POS, it should still be open, so its length should
+            // be zero.
+            return list[index].index;
+        } else {
+            // Conversely, if the length is not zero, it should not contain
+            // POS.
+            JS_ASSERT(list[index].start + list[index].length <= pos);
+        }
+    }
+
+    return BlockScopeNote::NoBlockScopeIndex;
+}
+
 void
 CGBlockScopeList::recordEnd(uint32_t index, uint32_t offset)
 {
diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
index 54b000774289..0ee9667b812b 100644
--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -63,6 +63,7 @@ struct CGBlockScopeList {
     CGBlockScopeList(ExclusiveContext *cx) : list(cx) {}
 
     bool append(uint32_t scopeObject, uint32_t offset, uint32_t parent);
+    uint32_t findEnclosingScope(uint32_t index);
     void recordEnd(uint32_t index, uint32_t offset);
     size_t length() const { return list.length(); }
     void finish(BlockScopeArray *array);
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index b94db57d618e..7c25e8dbabe8 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -2930,7 +2930,10 @@ JSScript::getBlockScope(jsbytecode *pc)
                 if (offset < checkNote->start + checkNote->length) {
                     // We found a matching block chain but there may be inner ones
                     // at a higher block chain index than mid. Continue the binary search.
-                    blockChain = &getObject(checkNote->index)->as<StaticBlockObject>();
+                    if (checkNote->index == BlockScopeNote::NoBlockScopeIndex)
+                        blockChain = nullptr;
+                    else
+                        blockChain = &getObject(checkNote->index)->as<StaticBlockObject>();
                     break;
                 }
                 if (checkNote->parent == UINT32_MAX)
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 09d88c489bdc..93c309e498ca 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -82,9 +82,27 @@ struct JSTryNote {
 
 namespace js {
 
+// A block scope has a range in bytecode: it is entered at some offset, and left
+// at some later offset.  Scopes can be nested.  Given an offset, the
+// BlockScopeNote containing that offset whose with the highest start value
+// indicates the block scope.  The block scope list is sorted by increasing
+// start value.
+//
+// It is possible to leave a scope nonlocally, for example via a "break"
+// statement, so there may be short bytecode ranges in a block scope in which we
+// are popping the block chain in preparation for a goto.  These exits are also
+// nested with respect to outer scopes.  The scopes in these exits are indicated
+// by the "index" field, just like any other block.  If a nonlocal exit pops the
+// last block scope, the index will be NoBlockScopeIndex.
+//
 struct BlockScopeNote {
-    uint32_t        index;      // Index of StaticScopeObject in the object array.
-    uint32_t        start;      // Bytecode offset at which this scope starts.
+    static const uint32_t NoBlockScopeIndex = UINT32_MAX;
+
+    uint32_t        index;      // Index of StaticScopeObject in the object
+                                // array, or NoBlockScopeIndex if there is no
+                                // block scope in this range.
+    uint32_t        start;      // Bytecode offset at which this scope starts,
+                                // from script->main().
     uint32_t        length;     // Bytecode length of scope.
     uint32_t        parent;     // Index of parent block scope in notes, or UINT32_MAX.
 };
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 95e31570278c..ae8ea9799178 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -50,6 +50,7 @@ js::ScopeCoordinateToStaticScopeShape(JSScript *script, jsbytecode *pc)
     StaticScopeIter<NoGC> ssi(InnermostStaticScope(script, pc));
     ScopeCoordinate sc(pc);
     while (true) {
+        JS_ASSERT(!ssi.done());
         if (ssi.hasDynamicScopeObject()) {
             if (!sc.hops)
                 break;

From bbd69751e9606f8c338036a3a7bfd65a07ff9d91 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:30:05 +0100
Subject: [PATCH 229/459] Bug 927782 - Part 9: Fix js_DumpScriptDepth to not
 abort on unreachable bytecodes. r=luke

---
 js/src/jsopcode.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index ceb86e3b9af1..742de401aa8f 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -778,7 +778,7 @@ js_DisassembleAtPC(JSContext *cx, JSScript *scriptArg, bool lines,
             if (parser.isReachable(next))
                 Sprint(sp, "%05u ", parser.stackDepthAtPC(next));
             else
-                Sprint(sp, "      ", parser.stackDepthAtPC(next));
+                Sprint(sp, "      ");
         }
         len = js_Disassemble1(cx, script, next, script->pcToOffset(next), lines, sp);
         if (!len)

From 7da22095a00fbb332ab4a32fda12444731aea698 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Fri, 6 Dec 2013 18:42:08 +0100
Subject: [PATCH 230/459] Bug 927782 - Part 10: Iterate block chain from
 compile-time block scope maps, not runtime blockChain. r=luke

---
 js/jsd/jsd_stak.cpp             |   2 +-
 js/public/OldDebugAPI.h         |   6 +-
 js/src/jit/BaselineCompiler.cpp |  14 +-
 js/src/jit/IonFrames.cpp        |  10 +-
 js/src/jit/VMFunctions.cpp      |  24 +--
 js/src/jit/VMFunctions.h        |   6 +-
 js/src/jsobj.cpp                |   3 +-
 js/src/jsopcode.cpp             |  27 ++-
 js/src/shell/js.cpp             |   4 +-
 js/src/vm/Debugger.cpp          |   8 +-
 js/src/vm/Interpreter.cpp       | 284 ++++++++++++++++++--------------
 js/src/vm/Interpreter.h         |   8 +-
 js/src/vm/OldDebugAPI.cpp       |  38 +++--
 js/src/vm/ScopeObject.cpp       | 140 ++++++++++------
 js/src/vm/ScopeObject.h         |  59 +++++--
 js/src/vm/Stack.h               |   3 -
 16 files changed, 374 insertions(+), 262 deletions(-)

diff --git a/js/jsd/jsd_stak.cpp b/js/jsd/jsd_stak.cpp
index b5f7e0efd62f..2ee69e9e4aaf 100644
--- a/js/jsd/jsd_stak.cpp
+++ b/js/jsd/jsd_stak.cpp
@@ -97,7 +97,7 @@ jsd_NewThreadState(JSDContext* jsdc, JSContext *cx )
     {
         JSAbstractFramePtr frame = iter.abstractFramePtr();
         JS::RootedScript script(cx, frame.script());
-        uintptr_t  pc = (uintptr_t)iter.pc();
+        uintptr_t  pc = (uintptr_t)frame.pc();
         JS::RootedValue dummyThis(cx);
 
         /*
diff --git a/js/public/OldDebugAPI.h b/js/public/OldDebugAPI.h
index 1b66350d46b8..1dfbc2f1a499 100644
--- a/js/public/OldDebugAPI.h
+++ b/js/public/OldDebugAPI.h
@@ -339,16 +339,18 @@ JS_PutPropertyDescArray(JSContext *cx, JSPropertyDescArray *pda);
 class JS_PUBLIC_API(JSAbstractFramePtr)
 {
     uintptr_t ptr_;
+    jsbytecode *pc_;
 
   protected:
     JSAbstractFramePtr()
-      : ptr_(0)
+      : ptr_(0), pc_(nullptr)
     { }
 
   public:
-    explicit JSAbstractFramePtr(void *raw);
+    JSAbstractFramePtr(void *raw, jsbytecode *pc);
 
     uintptr_t raw() const { return ptr_; }
+    jsbytecode *pc() const { return pc_; }
 
     operator bool() const { return !!ptr_; }
 
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index b9309fcc67a9..60592925193a 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -508,7 +508,7 @@ BaselineCompiler::emitStackCheck(bool earlyCheck)
     return true;
 }
 
-typedef bool (*DebugPrologueFn)(JSContext *, BaselineFrame *, bool *);
+typedef bool (*DebugPrologueFn)(JSContext *, BaselineFrame *, jsbytecode *, bool *);
 static const VMFunction DebugPrologueInfo = FunctionInfo<DebugPrologueFn>(jit::DebugPrologue);
 
 bool
@@ -521,6 +521,7 @@ BaselineCompiler::emitDebugPrologue()
     masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
 
     prepareVMCall();
+    pushArg(ImmPtr(pc));
     pushArg(R0.scratchReg());
     if (!callVM(DebugPrologueInfo))
         return false;
@@ -2625,16 +2626,18 @@ BaselineCompiler::emit_JSOP_ENTERLET2()
     return emitEnterBlock();
 }
 
-typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *);
+typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *, jsbytecode *);
 static const VMFunction DebugLeaveBlockInfo = FunctionInfo<DebugLeaveBlockFn>(jit::DebugLeaveBlock);
 
 bool
 BaselineCompiler::emit_JSOP_DEBUGLEAVEBLOCK()
 {
-    // Call a stub to pop the block from the block chain.
-    prepareVMCall();
+    if (!debugMode_)
+        return true;
 
+    prepareVMCall();
     masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
+    pushArg(ImmPtr(pc));
     pushArg(R0.scratchReg());
 
     return callVM(DebugLeaveBlockInfo);
@@ -2733,7 +2736,7 @@ BaselineCompiler::emit_JSOP_DEBUGGER()
     return true;
 }
 
-typedef bool (*DebugEpilogueFn)(JSContext *, BaselineFrame *, bool);
+typedef bool (*DebugEpilogueFn)(JSContext *, BaselineFrame *, jsbytecode *, bool);
 static const VMFunction DebugEpilogueInfo = FunctionInfo<DebugEpilogueFn>(jit::DebugEpilogue);
 
 bool
@@ -2750,6 +2753,7 @@ BaselineCompiler::emitReturn()
 
         prepareVMCall();
         pushArg(Imm32(1));
+        pushArg(ImmPtr(pc));
         pushArg(R0.scratchReg());
         if (!callVM(DebugEpilogueInfo))
             return false;
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
index cecde0dee5cc..8703f31e8ea9 100644
--- a/js/src/jit/IonFrames.cpp
+++ b/js/src/jit/IonFrames.cpp
@@ -434,7 +434,7 @@ HandleExceptionBaseline(JSContext *cx, const IonFrameIterator &frame, ResumeFrom
 
           case JSTRAP_RETURN:
             JS_ASSERT(baselineFrame->hasReturnValue());
-            if (jit::DebugEpilogue(cx, baselineFrame, true)) {
+            if (jit::DebugEpilogue(cx, baselineFrame, pc, true)) {
                 rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
                 rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
                 rfe->stackPointer = reinterpret_cast<uint8_t *>(baselineFrame);
@@ -457,6 +457,7 @@ HandleExceptionBaseline(JSContext *cx, const IonFrameIterator &frame, ResumeFrom
     JSTryNote *tnEnd = tn + script->trynotes()->length;
 
     uint32_t pcOffset = uint32_t(pc - script->main());
+    ScopeIter si(frame.baselineFrame(), pc, cx);
     for (; tn != tnEnd; ++tn) {
         if (pcOffset < tn->start)
             continue;
@@ -472,7 +473,7 @@ HandleExceptionBaseline(JSContext *cx, const IonFrameIterator &frame, ResumeFrom
 
         // Unwind scope chain (pop block objects).
         if (cx->isExceptionPending())
-            UnwindScope(cx, frame.baselineFrame(), tn->stackDepth);
+            UnwindScope(cx, si, tn->stackDepth);
 
         // Compute base pointer and stack pointer.
         rfe->framePointer = frame.fp() - BaselineFrame::FramePointerOffset;
@@ -607,7 +608,10 @@ HandleException(ResumeFromException *rfe)
                 // If DebugEpilogue returns |true|, we have to perform a forced
                 // return, e.g. return frame->returnValue() to the caller.
                 BaselineFrame *frame = iter.baselineFrame();
-                if (jit::DebugEpilogue(cx, frame, false)) {
+                RootedScript script(cx);
+                jsbytecode *pc;
+                iter.baselineScriptAndPc(script.address(), &pc);
+                if (jit::DebugEpilogue(cx, frame, pc, false)) {
                     JS_ASSERT(frame->hasReturnValue());
                     rfe->kind = ResumeFromException::RESUME_FORCED_RETURN;
                     rfe->framePointer = iter.fp() - BaselineFrame::FramePointerOffset;
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 04fd28a4a003..da14ed83316c 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -679,11 +679,11 @@ GetIndexFromString(JSString *str)
 }
 
 bool
-DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn)
+DebugPrologue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustReturn)
 {
     *mustReturn = false;
 
-    JSTrapStatus status = ScriptDebugPrologue(cx, frame);
+    JSTrapStatus status = ScriptDebugPrologue(cx, frame, pc);
     switch (status) {
       case JSTRAP_CONTINUE:
         return true;
@@ -693,7 +693,7 @@ DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn)
         // debug epilogue handler as well.
         JS_ASSERT(frame->hasReturnValue());
         *mustReturn = true;
-        return jit::DebugEpilogue(cx, frame, true);
+        return jit::DebugEpilogue(cx, frame, pc, true);
 
       case JSTRAP_THROW:
       case JSTRAP_ERROR:
@@ -705,15 +705,16 @@ DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn)
 }
 
 bool
-DebugEpilogue(JSContext *cx, BaselineFrame *frame, bool ok)
+DebugEpilogue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool ok)
 {
     // Unwind scope chain to stack depth 0.
-    UnwindScope(cx, frame, 0);
+    ScopeIter si(frame, pc, cx);
+    UnwindScope(cx, si, 0);
 
     // If ScriptDebugEpilogue returns |true| we have to return the frame's
     // return value. If it returns |false|, the debugger threw an exception.
     // In both cases we have to pop debug scopes.
-    ok = ScriptDebugEpilogue(cx, frame, ok);
+    ok = ScriptDebugEpilogue(cx, frame, pc, ok);
 
     if (frame->isNonEvalFunctionFrame()) {
         JS_ASSERT_IF(ok, frame->hasReturnValue());
@@ -832,7 +833,7 @@ HandleDebugTrap(JSContext *cx, BaselineFrame *frame, uint8_t *retAddr, bool *mus
       case JSTRAP_RETURN:
         *mustReturn = true;
         frame->setReturnValue(rval);
-        return jit::DebugEpilogue(cx, frame, true);
+        return jit::DebugEpilogue(cx, frame, pc, true);
 
       case JSTRAP_THROW:
         cx->setPendingException(rval);
@@ -870,7 +871,7 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
       case JSTRAP_RETURN:
         frame->setReturnValue(rval);
         *mustReturn = true;
-        return jit::DebugEpilogue(cx, frame, true);
+        return jit::DebugEpilogue(cx, frame, pc, true);
 
       case JSTRAP_THROW:
         cx->setPendingException(rval);
@@ -895,12 +896,11 @@ LeaveBlock(JSContext *cx, BaselineFrame *frame)
 }
 
 bool
-DebugLeaveBlock(JSContext *cx, BaselineFrame *frame)
+DebugLeaveBlock(JSContext *cx, BaselineFrame *frame, jsbytecode *pc)
 {
-    JS_ASSERT(frame->hasBlockChain());
+    JS_ASSERT(cx->compartment()->debugMode());
 
-    if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onPopBlock(cx, frame);
+    DebugScopes::onPopBlock(cx, frame, pc);
 
     return true;
 }
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index a29ae2b6fbf4..037b76a5042a 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -638,8 +638,8 @@ void PostGlobalWriteBarrier(JSRuntime *rt, JSObject *obj);
 
 uint32_t GetIndexFromString(JSString *str);
 
-bool DebugPrologue(JSContext *cx, BaselineFrame *frame, bool *mustReturn);
-bool DebugEpilogue(JSContext *cx, BaselineFrame *frame, bool ok);
+bool DebugPrologue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustReturn);
+bool DebugEpilogue(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool ok);
 
 bool StrictEvalPrologue(JSContext *cx, BaselineFrame *frame);
 bool HeavyweightFunPrologue(JSContext *cx, BaselineFrame *frame);
@@ -654,7 +654,7 @@ bool OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bo
 
 bool EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
 bool LeaveBlock(JSContext *cx, BaselineFrame *frame);
-bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame);
+bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame, jsbytecode *pc);
 
 bool InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame,
                              uint32_t numStackValues);
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f909f8ece251..b362833bff1a 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5673,9 +5673,8 @@ js_DumpStackFrame(JSContext *cx, StackFrame *start)
         if (jsbytecode *pc = i.pc()) {
             fprintf(stderr, "  pc = %p\n", pc);
             fprintf(stderr, "  current op: %s\n", js_CodeName[*pc]);
+            MaybeDumpObject("blockChain", i.script()->getBlockScope(pc));
         }
-        if (!i.isJit())
-            MaybeDumpObject("blockChain", i.interpFrame()->maybeBlockChain());
         MaybeDumpValue("this", i.thisv());
         if (!i.isJit()) {
             fprintf(stderr, "  rval: ");
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 742de401aa8f..cb8d3f25f27d 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -1688,24 +1688,17 @@ ExpressionDecompiler::loadAtom(jsbytecode *pc)
 JSAtom *
 ExpressionDecompiler::findLetVar(jsbytecode *pc, unsigned depth)
 {
-    if (script->hasObjects()) {
-        JSObject *chain = script->getBlockScope(pc);
-        if (!chain)
-            return nullptr;
-        JS_ASSERT(chain->is<BlockObject>());
-        do {
-            BlockObject &block = chain->as<BlockObject>();
-            uint32_t blockDepth = block.stackDepth();
-            uint32_t blockCount = block.slotCount();
-            if (uint32_t(depth - blockDepth) < uint32_t(blockCount)) {
-                for (Shape::Range<NoGC> r(block.lastProperty()); !r.empty(); r.popFront()) {
-                    const Shape &shape = r.front();
-                    if (shape.shortid() == int(depth - blockDepth))
-                        return JSID_TO_ATOM(shape.propid());
-                }
+    for (JSObject *chain = script->getBlockScope(pc); chain; chain = chain->getParent()) {
+        StaticBlockObject &block = chain->as<StaticBlockObject>();
+        uint32_t blockDepth = block.stackDepth();
+        uint32_t blockCount = block.slotCount();
+        if (uint32_t(depth - blockDepth) < uint32_t(blockCount)) {
+            for (Shape::Range<NoGC> r(block.lastProperty()); !r.empty(); r.popFront()) {
+                const Shape &shape = r.front();
+                if (shape.shortid() == int(depth - blockDepth))
+                    return JSID_TO_ATOM(shape.propid());
             }
-            chain = chain->getParent();
-        } while (chain && chain->is<BlockObject>());
+        }
     }
     return nullptr;
 }
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 594de924ed93..2d526784902c 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1512,7 +1512,7 @@ TrapHandler(JSContext *cx, JSScript *, jsbytecode *pc, jsval *rvalArg,
     JS_ASSERT(!iter.done());
 
     /* Debug-mode currently disables Ion compilation. */
-    JSAbstractFramePtr frame(Jsvalify(iter.abstractFramePtr()));
+    JSAbstractFramePtr frame(iter.abstractFramePtr().raw(), iter.pc());
     RootedScript script(cx, iter.script());
 
     size_t length;
@@ -2590,7 +2590,7 @@ EvalInFrame(JSContext *cx, unsigned argc, jsval *vp)
     if (!chars)
         return false;
 
-    JSAbstractFramePtr frame(Jsvalify(fi.abstractFramePtr()));
+    JSAbstractFramePtr frame(fi.abstractFramePtr().raw(), fi.pc());
     RootedScript fpscript(cx, frame.script());
     bool ok = !!frame.evaluateUCInStackFrame(cx, chars, length,
                                              fpscript->filename(),
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 3ee25d6bc1e5..a188f2d5c382 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -3988,12 +3988,12 @@ DebuggerFrame_getType(JSContext *cx, unsigned argc, Value *vp)
 static bool
 DebuggerFrame_getEnvironment(JSContext *cx, unsigned argc, Value *vp)
 {
-    THIS_FRAME_OWNER(cx, argc, vp, "get environment", args, thisobj, frame, dbg);
+    THIS_FRAME_OWNER_ITER(cx, argc, vp, "get environment", args, thisobj, _, iter, dbg);
 
     Rooted<Env*> env(cx);
     {
-        AutoCompartment ac(cx, frame.scopeChain());
-        env = GetDebugScopeForFrame(cx, frame);
+        AutoCompartment ac(cx, iter.abstractFramePtr().scopeChain());
+        env = GetDebugScopeForFrame(cx, iter.abstractFramePtr(), iter.pc());
         if (!env)
             return false;
     }
@@ -4439,7 +4439,7 @@ DebuggerGenericEval(JSContext *cx, const char *fullMethodName, const Value &code
         if (!iter->computeThis(cx))
             return false;
         thisv = iter->thisv();
-        env = GetDebugScopeForFrame(cx, iter->abstractFramePtr());
+        env = GetDebugScopeForFrame(cx, iter->abstractFramePtr(), iter->pc());
         if (!env)
             return false;
     } else {
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 0ea4658a9817..d25eda18bfa1 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -845,24 +845,22 @@ EnterWith(JSContext *cx, AbstractFramePtr frame, HandleValue val, uint32_t stack
 
 /* Unwind block and scope chains to match the given depth. */
 void
-js::UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth)
+js::UnwindScope(JSContext *cx, ScopeIter &si, uint32_t stackDepth)
 {
-    JS_ASSERT_IF(frame.isStackFrame(), frame.asStackFrame() == cx->interpreterFrame());
-    JS_ASSERT_IF(frame.isStackFrame(), stackDepth <= cx->interpreterRegs().stackDepth());
-
-    for (ScopeIter si(frame, cx); !si.done(); ++si) {
+    for (; !si.done(); ++si) {
         switch (si.type()) {
           case ScopeIter::Block:
             if (si.staticBlock().stackDepth() < stackDepth)
                 return;
             if (cx->compartment()->debugMode())
-                DebugScopes::onPopBlock(cx, frame);
-            frame.popBlock(cx);
+                DebugScopes::onPopBlock(cx, si);
+            JS_ASSERT(&si.staticBlock() == si.frame().maybeBlockChain());
+            si.frame().popBlock(cx);
             break;
           case ScopeIter::With:
             if (si.scope().as<WithObject>().stackDepth() < stackDepth)
                 return;
-            frame.popWith(cx);
+            si.frame().popWith(cx);
             break;
           case ScopeIter::Call:
           case ScopeIter::StrictEvalScope:
@@ -871,10 +869,24 @@ js::UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth)
     }
 }
 
+static void
+ForcedReturn(JSContext *cx, ScopeIter &si, FrameRegs &regs)
+{
+    UnwindScope(cx, si, 0);
+    regs.setToEndOfScript();
+}
+
+static void
+ForcedReturn(JSContext *cx, FrameRegs &regs)
+{
+    ScopeIter si(regs.fp(), regs.pc, cx);
+    ForcedReturn(cx, si, regs);
+}
+
 void
 js::UnwindForUncatchableException(JSContext *cx, const FrameRegs &regs)
 {
-    /* c.f. the regular (catchable) TryNoteIter loop in Interpret. */
+    /* c.f. the regular (catchable) TryNoteIter loop in HandleError. */
     for (TryNoteIter tni(cx, regs); !tni.done(); ++tni) {
         JSTryNote *tn = *tni;
         if (tn->kind == JSTRY_ITER) {
@@ -943,6 +955,107 @@ TryNoteIter::settle()
     }
 }
 
+enum HandleErrorContinuation
+{
+    SuccessfulReturnContinuation,
+    ErrorReturnContinuation,
+    CatchContinuation,
+    FinallyContinuation
+};
+
+static HandleErrorContinuation
+HandleError(JSContext *cx, FrameRegs &regs)
+{
+    JS_ASSERT(regs.fp()->script()->containsPC(regs.pc));
+
+    ScopeIter si(regs.fp(), regs.pc, cx);
+    bool ok = false;
+
+  again:
+    if (cx->isExceptionPending()) {
+        /* Call debugger throw hooks. */
+        if (JS_UNLIKELY(cx->compartment()->debugMode())) {
+            JSTrapStatus status = DebugExceptionUnwind(cx, regs.fp(), regs.pc);
+            switch (status) {
+              case JSTRAP_ERROR:
+                goto again;
+
+              case JSTRAP_CONTINUE:
+              case JSTRAP_THROW:
+                break;
+
+              case JSTRAP_RETURN:
+                ForcedReturn(cx, si, regs);
+                return SuccessfulReturnContinuation;
+
+              default:
+                MOZ_ASSUME_UNREACHABLE("Invalid trap status");
+            }
+        }
+
+        for (TryNoteIter tni(cx, regs); !tni.done(); ++tni) {
+            JSTryNote *tn = *tni;
+
+            UnwindScope(cx, si, tn->stackDepth);
+
+            /*
+             * Set pc to the first bytecode after the the try note to point
+             * to the beginning of catch or finally or to [enditer] closing
+             * the for-in loop.
+             */
+            regs.pc = regs.fp()->script()->main() + tn->start + tn->length;
+            regs.sp = regs.spForStackDepth(tn->stackDepth);
+
+            switch (tn->kind) {
+              case JSTRY_CATCH:
+                /* Catch cannot intercept the closing of a generator. */
+                if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
+                    break;
+
+                /*
+                 * Don't clear exceptions to save cx->exception from GC
+                 * until it is pushed to the stack via [exception] in the
+                 * catch block.
+                 */
+                return CatchContinuation;
+
+              case JSTRY_FINALLY:
+                return FinallyContinuation;
+
+              case JSTRY_ITER: {
+                /* This is similar to JSOP_ENDITER in the interpreter loop. */
+                JS_ASSERT(JSOp(*regs.pc) == JSOP_ENDITER);
+                RootedObject obj(cx, &regs.sp[-1].toObject());
+                bool ok = UnwindIteratorForException(cx, obj);
+                regs.sp -= 1;
+                if (!ok)
+                    goto again;
+                break;
+              }
+
+              case JSTRY_LOOP:
+                break;
+            }
+        }
+
+        /*
+         * Propagate the exception or error to the caller unless the exception
+         * is an asynchronous return from a generator.
+         */
+        if (JS_UNLIKELY(cx->isExceptionPending() &&
+                        cx->getPendingException().isMagic(JS_GENERATOR_CLOSING))) {
+            cx->clearPendingException();
+            ok = true;
+            regs.fp()->clearReturnValue();
+        }
+    } else {
+        UnwindForUncatchableException(cx, regs);
+    }
+
+    ForcedReturn(cx, si, regs);
+    return ok ? SuccessfulReturnContinuation : ErrorReturnContinuation;
+}
+
 #define REGS                     (activation.regs())
 #define PUSH_COPY(v)             do { *REGS.sp++ = (v); assertSameCompartmentDebugOnly(cx, REGS.sp[-1]); } while (0)
 #define PUSH_COPY_SKIP_CHECK(v)  *REGS.sp++ = (v)
@@ -1373,13 +1486,13 @@ Interpret(JSContext *cx, RunState &state)
         probes::EnterScript(cx, script, script->function(), activation.entryFrame());
     }
     if (JS_UNLIKELY(cx->compartment()->debugMode())) {
-        JSTrapStatus status = ScriptDebugPrologue(cx, activation.entryFrame());
+        JSTrapStatus status = ScriptDebugPrologue(cx, activation.entryFrame(), REGS.pc);
         switch (status) {
           case JSTRAP_CONTINUE:
             break;
           case JSTRAP_RETURN:
-            interpReturnOK = true;
-            goto forced_return;
+            ForcedReturn(cx, REGS);
+            goto successful_return_continuation;
           case JSTRAP_THROW:
           case JSTRAP_ERROR:
             goto error;
@@ -1391,7 +1504,6 @@ Interpret(JSContext *cx, RunState &state)
     if (cx->runtime()->profilingScripts || cx->runtime()->debugHooks.interruptHook)
         activation.enableInterruptsUnconditionally();
 
-  enterInterpreterLoop:
     // Enter the interpreter loop starting at the current pc.
     ADVANCE_AND_DISPATCH(0);
 
@@ -1431,8 +1543,8 @@ CASE(EnableInterruptsPseudoOpcode)
                 break;
               case JSTRAP_RETURN:
                 REGS.fp()->setReturnValue(rval);
-                interpReturnOK = true;
-                goto forced_return;
+                ForcedReturn(cx, REGS);
+                goto successful_return_continuation;
               case JSTRAP_THROW:
                 cx->setPendingException(rval);
                 goto error;
@@ -1452,8 +1564,8 @@ CASE(EnableInterruptsPseudoOpcode)
                 goto error;
               case JSTRAP_RETURN:
                 REGS.fp()->setReturnValue(rval);
-                interpReturnOK = true;
-                goto forced_return;
+                ForcedReturn(cx, REGS);
+                goto successful_return_continuation;
               case JSTRAP_THROW:
                 cx->setPendingException(rval);
                 goto error;
@@ -1650,7 +1762,9 @@ CASE(JSOP_RETRVAL)
      */
     CHECK_BRANCH();
 
+  successful_return_continuation:
     interpReturnOK = true;
+  return_continuation:
     if (activation.entryFrame() != REGS.fp())
   inline_return:
     {
@@ -1659,7 +1773,7 @@ CASE(JSOP_RETRVAL)
 #endif
 
         if (JS_UNLIKELY(cx->compartment()->debugMode()))
-            interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), interpReturnOK);
+            interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), REGS.pc, interpReturnOK);
 
         if (!REGS.fp()->isYielding())
             REGS.fp()->epilogue(cx);
@@ -1692,7 +1806,6 @@ CASE(JSOP_RETRVAL)
     } else {
         JS_ASSERT(REGS.stackDepth() == 0);
     }
-    interpReturnOK = true;
     goto exit;
 }
 
@@ -2568,12 +2681,12 @@ CASE(JSOP_FUNCALL)
     if (!REGS.fp()->prologue(cx))
         goto error;
     if (JS_UNLIKELY(cx->compartment()->debugMode())) {
-        switch (ScriptDebugPrologue(cx, REGS.fp())) {
+        switch (ScriptDebugPrologue(cx, REGS.fp(), REGS.pc)) {
           case JSTRAP_CONTINUE:
             break;
           case JSTRAP_RETURN:
-            interpReturnOK = true;
-            goto forced_return;
+            ForcedReturn(cx, REGS);
+            goto successful_return_continuation;
           case JSTRAP_THROW:
           case JSTRAP_ERROR:
             goto error;
@@ -3213,8 +3326,8 @@ CASE(JSOP_DEBUGGER)
         break;
       case JSTRAP_RETURN:
         REGS.fp()->setReturnValue(rval);
-        interpReturnOK = true;
-        goto forced_return;
+        ForcedReturn(cx, REGS);
+        goto successful_return_continuation;
       case JSTRAP_THROW:
         cx->setPendingException(rval);
         goto error;
@@ -3250,6 +3363,7 @@ CASE(JSOP_LEAVEBLOCKEXPR)
 {
     blockDepth = REGS.fp()->blockChain().stackDepth();
 
+    // Pop block from scope chain.
     REGS.fp()->popBlock(cx);
 
     if (*REGS.pc == JSOP_LEAVEBLOCK) {
@@ -3271,13 +3385,13 @@ END_CASE(JSOP_LEAVEBLOCK)
 
 CASE(JSOP_DEBUGLEAVEBLOCK)
 {
-    JS_ASSERT(REGS.fp()->hasBlockChain());
+    JS_ASSERT(script->getBlockScope(REGS.pc));
 
     // FIXME: This opcode should not be necessary.  The debugger shouldn't need
     // help from bytecode to do its job.  See bug 927782.
 
     if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        DebugScopes::onPopBlock(cx, REGS.fp());
+        DebugScopes::onPopBlock(cx, REGS.fp(), REGS.pc);
 }
 END_CASE(JSOP_DEBUGLEAVEBLOCK)
 
@@ -3339,116 +3453,32 @@ DEFAULT()
     MOZ_ASSUME_UNREACHABLE("Interpreter loop exited via fallthrough");
 
   error:
-    JS_ASSERT(script->containsPC(REGS.pc));
+    switch (HandleError(cx, REGS)) {
+      case SuccessfulReturnContinuation:
+        goto successful_return_continuation;
 
-    if (cx->isExceptionPending()) {
-        /* Call debugger throw hooks. */
-        if (JS_UNLIKELY(cx->compartment()->debugMode())) {
-            JSTrapStatus status = DebugExceptionUnwind(cx, REGS.fp(), REGS.pc);
-            switch (status) {
-              case JSTRAP_ERROR:
-                goto error;
+      case ErrorReturnContinuation:
+        interpReturnOK = false;
+        goto return_continuation;
 
-              case JSTRAP_CONTINUE:
-              case JSTRAP_THROW:
-                break;
-
-              case JSTRAP_RETURN:
-                interpReturnOK = true;
-                goto forced_return;
-
-              default:
-                MOZ_ASSUME_UNREACHABLE("Invalid trap status");
-            }
-        }
-
-        for (TryNoteIter tni(cx, REGS); !tni.done(); ++tni) {
-            JSTryNote *tn = *tni;
-
-            UnwindScope(cx, REGS.fp(), tn->stackDepth);
-
-            /*
-             * Set pc to the first bytecode after the the try note to point
-             * to the beginning of catch or finally or to [enditer] closing
-             * the for-in loop.
-             */
-            REGS.pc = (script)->main() + tn->start + tn->length;
-            REGS.sp = REGS.spForStackDepth(tn->stackDepth);
-
-            switch (tn->kind) {
-              case JSTRY_CATCH:
-                /* Catch cannot intercept the closing of a generator. */
-                if (JS_UNLIKELY(cx->getPendingException().isMagic(JS_GENERATOR_CLOSING)))
-                    break;
-
-                /*
-                 * Don't clear exceptions to save cx->exception from GC
-                 * until it is pushed to the stack via [exception] in the
-                 * catch block.
-                 *
-                 * Also, see the comment below about the use of goto here.
-                 */
-                goto enterInterpreterLoop;
-
-              case JSTRY_FINALLY:
-                /*
-                 * Push (true, exception) pair for finally to indicate that
-                 * [retsub] should rethrow the exception.
-                 */
-                PUSH_BOOLEAN(true);
-                PUSH_COPY(cx->getPendingException());
-                cx->clearPendingException();
-
-                /*
-                 * Leave the scope via a plain goto (and not via
-                 * ADVANCE_AND_DISPATCH, which may be implemented with indirect
-                 * goto) so that the TryNoteIter goes out of scope properly.
-                 */
-                goto enterInterpreterLoop;
-
-              case JSTRY_ITER: {
-                /* This is similar to JSOP_ENDITER in the interpreter loop. */
-                JS_ASSERT(JSOp(*REGS.pc) == JSOP_ENDITER);
-                RootedObject &obj = rootObject0;
-                obj = &REGS.sp[-1].toObject();
-                bool ok = UnwindIteratorForException(cx, obj);
-                REGS.sp -= 1;
-                if (!ok)
-                    goto error;
-                break;
-              }
-
-              case JSTRY_LOOP:
-                break;
-           }
-        }
+      case CatchContinuation:
+        ADVANCE_AND_DISPATCH(0);
 
+      case FinallyContinuation:
         /*
-         * Propagate the exception or error to the caller unless the exception
-         * is an asynchronous return from a generator.
+         * Push (true, exception) pair for finally to indicate that [retsub]
+         * should rethrow the exception.
          */
-        interpReturnOK = false;
-        if (JS_UNLIKELY(cx->isExceptionPending() &&
-                        cx->getPendingException().isMagic(JS_GENERATOR_CLOSING))) {
-            cx->clearPendingException();
-            interpReturnOK = true;
-            REGS.fp()->clearReturnValue();
-        }
-    } else {
-        UnwindForUncatchableException(cx, REGS);
-        interpReturnOK = false;
+        PUSH_BOOLEAN(true);
+        PUSH_COPY(cx->getPendingException());
+        cx->clearPendingException();
+        ADVANCE_AND_DISPATCH(0);
     }
-
-  forced_return:
-    UnwindScope(cx, REGS.fp(), 0);
-    REGS.setToEndOfScript();
-
-    if (activation.entryFrame() != REGS.fp())
-        goto inline_return;
+    MOZ_ASSUME_UNREACHABLE("Invalid HandleError continuation");
 
   exit:
     if (JS_UNLIKELY(cx->compartment()->debugMode()))
-        interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), interpReturnOK);
+        interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), REGS.pc, interpReturnOK);
     if (!REGS.fp()->isYielding())
         REGS.fp()->epilogue(cx);
     else
diff --git a/js/src/vm/Interpreter.h b/js/src/vm/Interpreter.h
index f884b41ed50f..4724413eee19 100644
--- a/js/src/vm/Interpreter.h
+++ b/js/src/vm/Interpreter.h
@@ -18,6 +18,8 @@
 
 namespace js {
 
+class ScopeIter;
+
 /*
  * Announce to the debugger that the thread has entered a new JavaScript frame,
  * |frame|. Call whatever hooks have been registered to observe new frames, and
@@ -36,7 +38,7 @@ namespace js {
  *   has set |frame|'s return value appropriately.
  */
 extern JSTrapStatus
-ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame);
+ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc);
 
 /*
  * Announce to the debugger that the thread has exited a JavaScript frame, |frame|.
@@ -54,7 +56,7 @@ ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame);
  * alternative path, containing its own call to ScriptDebugEpilogue.)
  */
 extern bool
-ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, bool ok);
+ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc, bool ok);
 
 /*
  * Announce to the debugger that an exception has been thrown and propagated
@@ -318,7 +320,7 @@ HasInstance(JSContext *cx, HandleObject obj, HandleValue v, bool *bp);
 
 /* Unwind block and scope chains to match the given depth. */
 extern void
-UnwindScope(JSContext *cx, AbstractFramePtr frame, uint32_t stackDepth);
+UnwindScope(JSContext *cx, ScopeIter &si, uint32_t stackDepth);
 
 /*
  * Unwind for an uncatchable exception. This means not running finalizers, etc;
diff --git a/js/src/vm/OldDebugAPI.cpp b/js/src/vm/OldDebugAPI.cpp
index 18cb5e83c8a5..e5648f95a7da 100644
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@@ -68,18 +68,19 @@ IsTopFrameConstructing(JSContext *cx, AbstractFramePtr frame)
 }
 
 JSTrapStatus
-js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame)
+js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
     JS_ASSERT_IF(frame.isStackFrame(), frame.asStackFrame() == cx->interpreterFrame());
 
     if (!frame.script()->selfHosted()) {
+        JSAbstractFramePtr jsframe(frame.raw(), pc);
         if (frame.isFramePushedByExecute()) {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.executeHook)
-                frame.setHookData(hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame),
+                frame.setHookData(hook(cx, jsframe, IsTopFrameConstructing(cx, frame),
                                        true, 0, cx->runtime()->debugHooks.executeHookData));
         } else {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.callHook)
-                frame.setHookData(hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame),
+                frame.setHookData(hook(cx, jsframe, IsTopFrameConstructing(cx, frame),
                                        true, 0, cx->runtime()->debugHooks.callHookData));
         }
     }
@@ -105,7 +106,7 @@ js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame)
 }
 
 bool
-js::ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, bool okArg)
+js::ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc, bool okArg)
 {
     JS_ASSERT_IF(frame.isStackFrame(), frame.asStackFrame() == cx->interpreterFrame());
 
@@ -113,12 +114,13 @@ js::ScriptDebugEpilogue(JSContext *cx, AbstractFramePtr frame, bool okArg)
 
     // We don't add hook data for self-hosted scripts, so we don't need to check for them, here.
     if (void *hookData = frame.maybeHookData()) {
+        JSAbstractFramePtr jsframe(frame.raw(), pc);
         if (frame.isFramePushedByExecute()) {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.executeHook)
-                hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame), false, &ok, hookData);
+                hook(cx, jsframe, IsTopFrameConstructing(cx, frame), false, &ok, hookData);
         } else {
             if (JSInterpreterHook hook = cx->runtime()->debugHooks.callHook)
-                hook(cx, Jsvalify(frame), IsTopFrameConstructing(cx, frame), false, &ok, hookData);
+                hook(cx, jsframe, IsTopFrameConstructing(cx, frame), false, &ok, hookData);
         }
     }
 
@@ -1228,27 +1230,27 @@ JS::FormatStackDump(JSContext *cx, char *buf, bool showArgs, bool showLocals, bo
     return buf;
 }
 
-JSAbstractFramePtr::JSAbstractFramePtr(void *raw)
-  : ptr_(uintptr_t(raw))
+JSAbstractFramePtr::JSAbstractFramePtr(void *raw, jsbytecode *pc)
+  : ptr_(uintptr_t(raw)), pc_(pc)
 { }
 
 JSObject *
 JSAbstractFramePtr::scopeChain(JSContext *cx)
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     RootedObject scopeChain(cx, frame.scopeChain());
     AutoCompartment ac(cx, scopeChain);
-    return GetDebugScopeForFrame(cx, frame);
+    return GetDebugScopeForFrame(cx, frame, pc());
 }
 
 JSObject *
 JSAbstractFramePtr::callObject(JSContext *cx)
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     if (!frame.isFunctionFrame())
         return nullptr;
 
-    JSObject *o = GetDebugScopeForFrame(cx, frame);
+    JSObject *o = GetDebugScopeForFrame(cx, frame, pc());
 
     /*
      * Given that fp is a function frame and GetDebugScopeForFrame always fills
@@ -1270,21 +1272,21 @@ JSAbstractFramePtr::callObject(JSContext *cx)
 JSFunction *
 JSAbstractFramePtr::maybeFun()
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     return frame.maybeFun();
 }
 
 JSScript *
 JSAbstractFramePtr::script()
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     return frame.script();
 }
 
 bool
 JSAbstractFramePtr::getThisValue(JSContext *cx, MutableHandleValue thisv)
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
 
     RootedObject scopeChain(cx, frame.scopeChain());
     js::AutoCompartment ac(cx, scopeChain);
@@ -1298,7 +1300,7 @@ JSAbstractFramePtr::getThisValue(JSContext *cx, MutableHandleValue thisv)
 bool
 JSAbstractFramePtr::isDebuggerFrame()
 {
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     return frame.isDebuggerFrame();
 }
 
@@ -1340,7 +1342,7 @@ JSAbstractFramePtr::evaluateUCInStackFrame(JSContext *cx,
     if (!env)
         return false;
 
-    AbstractFramePtr frame = Valueify(*this);
+    AbstractFramePtr frame(*this);
     if (!ComputeThis(cx, frame))
         return false;
     RootedValue thisv(cx, frame.thisValue());
@@ -1382,7 +1384,7 @@ JSAbstractFramePtr
 JSBrokenFrameIterator::abstractFramePtr() const
 {
     NonBuiltinScriptFrameIter iter(*(ScriptFrameIter::Data *)data_);
-    return Jsvalify(iter.abstractFramePtr());
+    return JSAbstractFramePtr(iter.abstractFramePtr().raw(), iter.pc());
 }
 
 jsbytecode *
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index ae8ea9799178..5e61bf7f5675 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -874,19 +874,32 @@ ScopeIter::ScopeIter(JSObject &enclosingScope, JSContext *cx
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 }
 
-ScopeIter::ScopeIter(AbstractFramePtr frame, JSContext *cx
+ScopeIter::ScopeIter(AbstractFramePtr frame, jsbytecode *pc, JSContext *cx
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
   : cx(cx),
     frame_(frame),
     cur_(cx, frame.scopeChain()),
-    block_(cx, frame.maybeBlockChain())
+    block_(cx, frame.script()->getBlockScope(pc))
 {
     assertSameCompartment(cx, frame);
     settle();
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
 }
 
-ScopeIter::ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
+ScopeIter::ScopeIter(const ScopeIterVal &val, JSContext *cx
+                     MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
+  : cx(cx),
+    frame_(val.frame_),
+    cur_(cx, val.cur_),
+    block_(cx, val.block_),
+    type_(val.type_),
+    hasScopeObject_(val.hasScopeObject_)
+{
+    assertSameCompartment(cx, val.frame_);
+    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+}
+
+ScopeIter::ScopeIter(AbstractFramePtr frame, jsbytecode *pc, ScopeObject &scope, JSContext *cx
                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
   : cx(cx),
     frame_(frame),
@@ -903,13 +916,13 @@ ScopeIter::ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
      *     let (y = 1) g();
      *   }
      *
-     * g will have x's block in its enclosing scope but not y's. However, at
-     * the debugger statement, both the x's and y's blocks will be on
-     * fp->blockChain. Fortunately, we can compare scope object stack depths to
-     * determine the block (if any) that encloses 'scope'.
+     * g will have x's block in its enclosing scope but not y's. However, at the
+     * debugger statement, both the x's and y's blocks will be on the block
+     * chain. Fortunately, we can compare scope object stack depths to determine
+     * the block (if any) that encloses 'scope'.
      */
     if (cur_->is<NestedScopeObject>()) {
-        block_ = frame.maybeBlockChain();
+        block_ = frame.script()->getBlockScope(pc);
         while (block_) {
             if (block_->stackDepth() <= cur_->as<NestedScopeObject>().stackDepth())
                 break;
@@ -1052,6 +1065,20 @@ ScopeIterKey::match(ScopeIterKey si1, ScopeIterKey si2)
              si1.type_  == si2.type_));
 }
 
+// Live ScopeIter values may be added to DebugScopes::liveScopes, as
+// ScopeIterVal instances.  They need to have write barriers when they are added
+// to the hash table, but no barriers when rehashing inside GC.  It's a nasty
+// hack, but the important thing is that ScopeIterKey and ScopeIterVal need to
+// alias each other.
+void ScopeIterVal::staticAsserts() {
+    static_assert(sizeof(ScopeIterVal) == sizeof(ScopeIterKey),
+                  "ScopeIterVal must be same size of ScopeIterKey");
+    static_assert(offsetof(ScopeIterVal, cur_) == offsetof(ScopeIterKey, cur_),
+                  "ScopeIterVal.cur_ must alias ScopeIterKey.cur_");
+    static_assert(offsetof(ScopeIterVal, block_) == offsetof(ScopeIterKey, block_),
+                  "ScopeIterVal.block_ must alias ScopeIterKey.block_");
+}
+
 /*****************************************************************************/
 
 namespace {
@@ -1104,7 +1131,7 @@ class DebugScopeProxy : public BaseProxyHandler
                                jsid id, Action action, MutableHandleValue vp)
     {
         JS_ASSERT(&debugScope->scope() == scope);
-        AbstractFramePtr maybeframe = DebugScopes::hasLiveFrame(*scope);
+        ScopeIterVal *maybeLiveScope = DebugScopes::hasLiveScope(*scope);
 
         /* Handle unaliased formals, vars, and consts at function scope. */
         if (scope->is<CallObject>() && !scope->as<CallObject>().isForEval()) {
@@ -1125,11 +1152,12 @@ class DebugScopeProxy : public BaseProxyHandler
                 if (script->varIsAliased(i))
                     return false;
 
-                if (maybeframe) {
+                if (maybeLiveScope) {
+                    AbstractFramePtr frame = maybeLiveScope->frame();
                     if (action == GET)
-                        vp.set(maybeframe.unaliasedVar(i));
+                        vp.set(frame.unaliasedVar(i));
                     else
-                        maybeframe.unaliasedVar(i) = vp;
+                        frame.unaliasedVar(i) = vp;
                 } else if (JSObject *snapshot = debugScope->maybeSnapshot()) {
                     if (action == GET)
                         vp.set(snapshot->getDenseElement(bindings.numArgs() + i));
@@ -1146,17 +1174,18 @@ class DebugScopeProxy : public BaseProxyHandler
                 if (script->formalIsAliased(i))
                     return false;
 
-                if (maybeframe) {
-                    if (script->argsObjAliasesFormals() && maybeframe.hasArgsObj()) {
+                if (maybeLiveScope) {
+                    AbstractFramePtr frame = maybeLiveScope->frame();
+                    if (script->argsObjAliasesFormals() && frame.hasArgsObj()) {
                         if (action == GET)
-                            vp.set(maybeframe.argsObj().arg(i));
+                            vp.set(frame.argsObj().arg(i));
                         else
-                            maybeframe.argsObj().setArg(i, vp);
+                            frame.argsObj().setArg(i, vp);
                     } else {
                         if (action == GET)
-                            vp.set(maybeframe.unaliasedFormal(i, DONT_CHECK_ALIASING));
+                            vp.set(frame.unaliasedFormal(i, DONT_CHECK_ALIASING));
                         else
-                            maybeframe.unaliasedFormal(i, DONT_CHECK_ALIASING) = vp;
+                            frame.unaliasedFormal(i, DONT_CHECK_ALIASING) = vp;
                     }
                 } else if (JSObject *snapshot = debugScope->maybeSnapshot()) {
                     if (action == GET)
@@ -1187,13 +1216,14 @@ class DebugScopeProxy : public BaseProxyHandler
             if (block->staticBlock().isAliased(i))
                 return false;
 
-            if (maybeframe) {
-                JSScript *script = maybeframe.script();
+            if (maybeLiveScope) {
+                AbstractFramePtr frame = maybeLiveScope->frame();
+                JSScript *script = frame.script();
                 unsigned local = block->slotToLocalIndex(script->bindings, shape->slot());
                 if (action == GET)
-                    vp.set(maybeframe.unaliasedLocal(local));
+                    vp.set(frame.unaliasedLocal(local));
                 else
-                    maybeframe.unaliasedLocal(local) = vp;
+                    frame.unaliasedLocal(local) = vp;
                 JS_ASSERT(analyze::LocalSlot(script, local) >= analyze::TotalSlots(script));
             } else {
                 if (action == GET)
@@ -1250,14 +1280,14 @@ class DebugScopeProxy : public BaseProxyHandler
         if (scope.as<CallObject>().callee().nonLazyScript()->needsArgsObj())
             return true;
 
-        AbstractFramePtr maybeframe = DebugScopes::hasLiveFrame(scope);
-        if (!maybeframe) {
+        ScopeIterVal *maybeScope = DebugScopes::hasLiveScope(scope);
+        if (!maybeScope) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_DEBUG_NOT_LIVE,
                                  "Debugger scope");
             return false;
         }
 
-        *maybeArgsObj = ArgumentsObject::createUnexpected(cx, maybeframe);
+        *maybeArgsObj = ArgumentsObject::createUnexpected(cx, maybeScope->frame());
         return true;
     }
 
@@ -1544,8 +1574,15 @@ DebugScopes::proxiedScopesPostWriteBarrier(JSRuntime *rt, ObjectWeakMap *map,
 DebugScopes::liveScopesPostWriteBarrier(JSRuntime *rt, LiveScopeMap *map, ScopeObject *key)
 {
 #ifdef JSGC_GENERATIONAL
+    // As above.  Otherwise, barriers could fire during GC when moving the
+    // value.
+    typedef HashMap<ScopeObject *,
+                    ScopeIterKey,
+                    DefaultHasher<ScopeObject *>,
+                    RuntimeAllocPolicy> UnbarrieredLiveScopeMap;
+    typedef gc::HashKeyRef<UnbarrieredLiveScopeMap, ScopeObject *> Ref;
     if (key && IsInsideNursery(rt, key))
-        rt->gcStoreBuffer.putGeneric(gc::HashKeyRef<LiveScopeMap, ScopeObject *>(map, key));
+        rt->gcStoreBuffer.putGeneric(Ref(reinterpret_cast<UnbarrieredLiveScopeMap *>(map), key));
 #endif
 }
 
@@ -1728,7 +1765,7 @@ DebugScopes::addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject
     }
 
     JS_ASSERT(!scopes->liveScopes.has(&debugScope.scope()));
-    if (!scopes->liveScopes.put(&debugScope.scope(), si.frame())) {
+    if (!scopes->liveScopes.put(&debugScope.scope(), si)) {
         js_ReportOutOfMemory(cx);
         return false;
     }
@@ -1762,7 +1799,7 @@ DebugScopes::onPopCall(AbstractFramePtr frame, JSContext *cx)
         if (ObjectWeakMap::Ptr p = scopes->proxiedScopes.lookup(&callobj))
             debugScope = &p->value()->as<DebugScopeObject>();
     } else {
-        ScopeIter si(frame, cx);
+        ScopeIter si(frame, frame.script()->main(), cx);
         if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
             debugScope = p->value();
             scopes->liveScopes.remove(&debugScope->scope().as<CallObject>());
@@ -1817,7 +1854,7 @@ DebugScopes::onPopCall(AbstractFramePtr frame, JSContext *cx)
 }
 
 void
-DebugScopes::onPopBlock(JSContext *cx, AbstractFramePtr frame)
+DebugScopes::onPopBlock(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
     assertSameCompartment(cx, frame);
 
@@ -1825,16 +1862,27 @@ DebugScopes::onPopBlock(JSContext *cx, AbstractFramePtr frame)
     if (!scopes)
         return;
 
-    StaticBlockObject &staticBlock = *frame.maybeBlockChain();
-    if (staticBlock.needsClone()) {
-        ClonedBlockObject &clone = frame.scopeChain()->as<ClonedBlockObject>();
-        clone.copyUnaliasedValues(frame);
+    ScopeIter si(frame, pc, cx);
+    onPopBlock(cx, si);
+}
+
+void
+DebugScopes::onPopBlock(JSContext *cx, const ScopeIter &si)
+{
+    DebugScopes *scopes = cx->compartment()->debugScopes;
+    if (!scopes)
+        return;
+
+    JS_ASSERT(si.type() == ScopeIter::Block);
+
+    if (si.staticBlock().needsClone()) {
+        ClonedBlockObject &clone = si.scope().as<ClonedBlockObject>();
+        clone.copyUnaliasedValues(si.frame());
         scopes->liveScopes.remove(&clone);
     } else {
-        ScopeIter si(frame, cx);
         if (MissingScopeMap::Ptr p = scopes->missingScopes.lookup(si)) {
             ClonedBlockObject &clone = p->value()->scope().as<ClonedBlockObject>();
-            clone.copyUnaliasedValues(frame);
+            clone.copyUnaliasedValues(si.frame());
             scopes->liveScopes.remove(&clone);
             scopes->missingScopes.remove(p);
         }
@@ -1906,13 +1954,13 @@ DebugScopes::updateLiveScopes(JSContext *cx)
         if (frame.isFunctionFrame() && frame.callee()->isGenerator())
             continue;
 
-        for (ScopeIter si(frame, cx); !si.done(); ++si) {
+        for (ScopeIter si(frame, i.pc(), cx); !si.done(); ++si) {
             if (si.hasScopeObject()) {
                 JS_ASSERT(si.scope().compartment() == cx->compartment());
                 DebugScopes *scopes = ensureCompartmentData(cx);
                 if (!scopes)
                     return false;
-                if (!scopes->liveScopes.put(&si.scope(), frame))
+                if (!scopes->liveScopes.put(&si.scope(), si))
                     return false;
                 liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &si.scope());
             }
@@ -1927,17 +1975,17 @@ DebugScopes::updateLiveScopes(JSContext *cx)
     return true;
 }
 
-AbstractFramePtr
-DebugScopes::hasLiveFrame(ScopeObject &scope)
+ScopeIterVal*
+DebugScopes::hasLiveScope(ScopeObject &scope)
 {
     DebugScopes *scopes = scope.compartment()->debugScopes;
     if (!scopes)
-        return NullFramePtr();
+        return nullptr;
 
     if (LiveScopeMap::Ptr p = scopes->liveScopes.lookup(&scope))
-        return p->value();
+        return &p->value();
 
-    return NullFramePtr();
+    return nullptr;
 }
 
 /*****************************************************************************/
@@ -2058,8 +2106,8 @@ GetDebugScope(JSContext *cx, JSObject &obj)
     }
 
     Rooted<ScopeObject*> scope(cx, &obj.as<ScopeObject>());
-    if (AbstractFramePtr frame = DebugScopes::hasLiveFrame(*scope)) {
-        ScopeIter si(frame, *scope, cx);
+    if (ScopeIterVal *maybeLiveScope = DebugScopes::hasLiveScope(*scope)) {
+        ScopeIter si(*maybeLiveScope, cx);
         return GetDebugScope(cx, si);
     }
     ScopeIter si(scope->enclosingScope(), cx);
@@ -2094,12 +2142,12 @@ js::GetDebugScopeForFunction(JSContext *cx, HandleFunction fun)
 }
 
 JSObject *
-js::GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame)
+js::GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
     assertSameCompartment(cx, frame);
     if (CanUseDebugScopeMaps(cx) && !DebugScopes::updateLiveScopes(cx))
         return nullptr;
-    ScopeIter si(frame, cx);
+    ScopeIter si(frame, pc, cx);
     return GetDebugScope(cx, si);
 }
 
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index f5eb96a4edf2..4dafb301719a 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -495,6 +495,7 @@ CloneStaticBlockObject(JSContext *cx, HandleObject enclosingScope, Handle<Static
 /*****************************************************************************/
 
 class ScopeIterKey;
+class ScopeIterVal;
 
 /*
  * A scope iterator describes the active scopes enclosing the current point of
@@ -512,6 +513,7 @@ class ScopeIterKey;
 class ScopeIter
 {
     friend class ScopeIterKey;
+    friend class ScopeIterVal;
 
   public:
     enum Type { Call, Block, With, StrictEvalScope };
@@ -534,22 +536,25 @@ class ScopeIter
   public:
 
     /* Constructing from a copy of an existing ScopeIter. */
-    explicit ScopeIter(const ScopeIter &si, JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+    ScopeIter(const ScopeIter &si, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     /* Constructing from StackFrame places ScopeIter on the innermost scope. */
-    explicit ScopeIter(AbstractFramePtr frame, JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+    ScopeIter(AbstractFramePtr frame, jsbytecode *pc, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     /*
      * Without a StackFrame, the resulting ScopeIter is done() with
      * enclosingScope() as given.
      */
-    explicit ScopeIter(JSObject &enclosingScope, JSContext *cx
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+    ScopeIter(JSObject &enclosingScope, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     /* Like ScopeIter(StackFrame *) except start at 'scope'. */
-    ScopeIter(AbstractFramePtr frame, ScopeObject &scope, JSContext *cx
+    ScopeIter(AbstractFramePtr frame, jsbytecode *pc, ScopeObject &scope, JSContext *cx
+              MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+
+    ScopeIter(const ScopeIterVal &hashVal, JSContext *cx
               MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
 
     bool done() const { return !frame_; }
@@ -574,19 +579,24 @@ class ScopeIter
 
 class ScopeIterKey
 {
+    friend class ScopeIterVal;
+
     AbstractFramePtr frame_;
     JSObject *cur_;
     StaticBlockObject *block_;
     ScopeIter::Type type_;
+    bool hasScopeObject_;
 
   public:
-    ScopeIterKey() : frame_(NullFramePtr()), cur_(nullptr), block_(nullptr), type_() {}
     ScopeIterKey(const ScopeIter &si)
-      : frame_(si.frame_), cur_(si.cur_), block_(si.block_), type_(si.type_)
-    {}
+      : frame_(si.frame()), cur_(si.cur_), block_(si.block_), type_(si.type_),
+        hasScopeObject_(si.hasScopeObject_) {}
 
     AbstractFramePtr frame() const { return frame_; }
+    JSObject *cur() const { return cur_; }
+    StaticBlockObject *block() const { return block_; }
     ScopeIter::Type type() const { return type_; }
+    bool hasScopeObject() const { return hasScopeObject_; }
 
     /* For use as hash policy */
     typedef ScopeIterKey Lookup;
@@ -594,6 +604,26 @@ class ScopeIterKey
     static bool match(ScopeIterKey si1, ScopeIterKey si2);
 };
 
+class ScopeIterVal
+{
+    friend class ScopeIter;
+
+    AbstractFramePtr frame_;
+    RelocatablePtr<JSObject> cur_;
+    RelocatablePtr<StaticBlockObject> block_;
+    ScopeIter::Type type_;
+    bool hasScopeObject_;
+    
+    static void staticAsserts();
+
+  public:
+    ScopeIterVal(const ScopeIter &si)
+      : frame_(si.frame()), cur_(si.cur_), block_(si.block_), type_(si.type_),
+        hasScopeObject_(si.hasScopeObject_) {}
+
+    AbstractFramePtr frame() const { return frame_; }
+};
+
 /*****************************************************************************/
 
 /*
@@ -625,7 +655,7 @@ extern JSObject *
 GetDebugScopeForFunction(JSContext *cx, HandleFunction fun);
 
 extern JSObject *
-GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame);
+GetDebugScopeForFrame(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc);
 
 /* Provides debugger access to a scope. */
 class DebugScopeObject : public ProxyObject
@@ -683,7 +713,7 @@ class DebugScopes
      * updates of liveScopes need only fill in the new scopes.
      */
     typedef HashMap<ScopeObject *,
-                    AbstractFramePtr,
+                    ScopeIterVal,
                     DefaultHasher<ScopeObject *>,
                     RuntimeAllocPolicy> LiveScopeMap;
     LiveScopeMap liveScopes;
@@ -710,12 +740,13 @@ class DebugScopes
     static bool addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject &debugScope);
 
     static bool updateLiveScopes(JSContext *cx);
-    static AbstractFramePtr hasLiveFrame(ScopeObject &scope);
+    static ScopeIterVal *hasLiveScope(ScopeObject &scope);
 
     // In debug-mode, these must be called whenever exiting a scope that might
     // have stack-allocated locals.
     static void onPopCall(AbstractFramePtr frame, JSContext *cx);
-    static void onPopBlock(JSContext *cx, AbstractFramePtr frame);
+    static void onPopBlock(JSContext *cx, const ScopeIter &si);
+    static void onPopBlock(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc);
     static void onPopWith(AbstractFramePtr frame);
     static void onPopStrictEvalScope(AbstractFramePtr frame);
     static void onCompartmentLeaveDebugMode(JSCompartment *c);
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 4321c1d1f1b9..4f3e1a7dd3a3 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -995,9 +995,6 @@ InitialFrameFlagsAreConstructing(InitialFrameFlags initial)
     return !!(initial & INITIAL_CONSTRUCT);
 }
 
-inline AbstractFramePtr Valueify(JSAbstractFramePtr frame) { return AbstractFramePtr(frame); }
-static inline JSAbstractFramePtr Jsvalify(AbstractFramePtr frame)   { return JSAbstractFramePtr(frame.raw()); }
-
 /*****************************************************************************/
 
 class FrameRegs

From 44bd6e47905a8b5cd9a57d0b88d99eed12ba2d03 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 12:07:02 +0100
Subject: [PATCH 231/459] Bug 927782 - Part 11: Optimize block scopes without
 aliased locals. r=luke

---
 js/src/frontend/BytecodeEmitter.cpp | 171 +++++++++++++++++-----------
 js/src/frontend/FullParseHandler.h  |   6 +-
 js/src/frontend/ParseNode.h         |   2 +-
 js/src/frontend/Parser.cpp          |  24 ++--
 js/src/jit/BaselineCompiler.cpp     | 101 ++++------------
 js/src/jit/BaselineCompiler.h       |  13 +--
 js/src/jit/BaselineFrame-inl.h      |  23 ++--
 js/src/jit/BaselineFrame.h          |   2 +-
 js/src/jit/IonBuilder.cpp           |  10 ++
 js/src/jit/VMFunctions.cpp          |   4 +-
 js/src/jit/VMFunctions.h            |   4 +-
 js/src/jsanalyze.cpp                |   1 -
 js/src/jsopcode.cpp                 |  33 +-----
 js/src/jsopcode.tbl                 |  29 ++---
 js/src/vm/Interpreter.cpp           |  75 ++++++------
 js/src/vm/Stack-inl.h               |   2 +-
 js/src/vm/Stack.cpp                 |  38 ++-----
 js/src/vm/Stack.h                   |  13 +--
 18 files changed, 234 insertions(+), 317 deletions(-)

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index e69e982252ef..d566ded30448 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -141,15 +141,6 @@ EmitCheck(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t delta)
     return offset;
 }
 
-static StaticBlockObject &
-LastBlockAdded(BytecodeEmitter *bce, jsbytecode *pc)
-{
-    DebugOnly<uint32_t> index = GET_UINT32_INDEX(pc);
-    JS_ASSERT(index < bce->objectList.length);
-    JS_ASSERT(index == bce->objectList.length - 1);
-    return bce->objectList.lastbox->object->as<StaticBlockObject>();
-}
-
 static void
 UpdateDepth(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t target)
 {
@@ -168,26 +159,8 @@ UpdateDepth(ExclusiveContext *cx, BytecodeEmitter *bce, ptrdiff_t target)
             bce->maxStackDepth = depth;
     }
 
-    /*
-     * Specially handle any case in which StackUses or StackDefs would call
-     * NumBlockSlots, since that requires a well-formed script. This allows us
-     * to safely pass nullptr as the 'script' parameter to StackUses and
-     * StackDefs.
-     */
-    int nuses, ndefs;
-    if (op == JSOP_ENTERBLOCK) {
-        nuses = 0;
-        ndefs = LastBlockAdded(bce, pc).slotCount();
-    } else if (op == JSOP_ENTERLET0) {
-        nuses = ndefs = LastBlockAdded(bce, pc).slotCount();
-    } else if (op == JSOP_ENTERLET1) {
-        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 1;
-    } else if (op == JSOP_ENTERLET2) {
-        nuses = ndefs = LastBlockAdded(bce, pc).slotCount() + 2;
-    } else {
-        nuses = StackUses(nullptr, pc);
-        ndefs = StackDefs(nullptr, pc);
-    }
+    int nuses = StackUses(nullptr, pc);
+    int ndefs = StackDefs(nullptr, pc);
 
     bce->stackDepth -= nuses;
     JS_ASSERT(bce->stackDepth >= 0);
@@ -568,7 +541,10 @@ class NonLocalExitScope {
             return false;
         if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
             return false;
-        EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
+        if (blockObj.needsClone()) {
+            if (Emit1(cx, bce, JSOP_POPBLOCKSCOPE) < 0)
+                return false;
+        }
         openScopeIndex = bce->blockScopeList.length() - 1;
         return true;
     }
@@ -623,11 +599,11 @@ NonLocalExitScope::prepareForNonLocalJump(StmtInfoBCE *toStmt)
         }
 
         if (stmt->isBlockScope) {
-            FLUSH_POPS();
             JS_ASSERT(stmt->blockObj);
             StaticBlockObject &blockObj = *stmt->blockObj;
             if (!popScopeForNonLocalExit(blockObj, stmt->blockScopeIndex))
                 return false;
+            npops += blockObj.slotCount();
         }
     }
 
@@ -773,6 +749,55 @@ ComputeAliasedSlots(ExclusiveContext *cx, BytecodeEmitter *bce, StaticBlockObjec
 static bool
 EmitInternedObjectOp(ExclusiveContext *cx, uint32_t index, JSOp op, BytecodeEmitter *bce);
 
+// ~ Block Scopes ~
+//
+// A block scope is a region of a script with an additional set of named
+// variables.  Those variables may be local and thus accessible directly from
+// the stack, or "aliased" and only accessible through the scope chain.
+//
+// A block scope may or may not have a corresponding link on the scope chain.
+// If no variable declared in the scope is "aliased", then no scope chain node
+// is allocated.
+//
+// To help debuggers, the bytecode emitter arranges to record the PC ranges
+// comprehended by a block scope, and ultimately attach them to the JSScript.
+// An element in the "block scope array" specifies the PC range, and links to a
+// StaticBlockObject in the object list of the script.  That block is linked to
+// the previous block in the scope, if any.  The static block chain at any
+// pre-retire PC can be retrieved using JSScript::getBlockScope(jsbytecode *pc).
+//
+// When PUSHBLOCKSCOPE is executed, it assumes that the block's locals are
+// already on the stack.  Initial values of "aliased" locals are copied from the
+// stack to the ClonedBlockObject, and no further access is made to the stack
+// slot.
+//
+// Likewise after leaving a POPBLOCKSCOPE, we will need to emit code to pop the
+// stack values.
+//
+// Finally, to assist the debugger, we also emit a DEBUGLEAVEBLOCK opcode before
+// POPBLOCKSCOPE in all cases -- even if the block has no aliased locals.  This
+// allows DebugScopes to invalidate any association between a debugger scope
+// object, which can proxy access to unaliased stack locals, and the actual live
+// frame.  In normal, non-debug mode, this opcode does not cause any baseline
+// code to be emitted.
+//
+// In this function "extraSlots" indicates the number of slots that are
+// "floating" on the stack above the scope's slots.  This will only be nonzero
+// in the case of for-let-in and for-let-of loops, where loop iterator state
+// floats above the block scopes.  It would be nice to fix this eventually so
+// that loop iterator state gets assigned to block-scoped fp-addressable
+// temporaries, instead of being addressable only via the sp.  This would also
+// make generators more efficient, as the loop state could be heap-allocated, so
+// that the value stack would likely be empty at yield points inside for-of /
+// for-in loops.
+//
+// Summary: Enter block scopes with EnterBlockScope.  It will emit
+// PUSHBLOCKSCOPE if needed.  Leave them with LeaveBlockScope, which will emit
+// DEBUGLEAVEBLOCK and may emit POPBLOCKSCOPE.  Pass EnterBlockScope a fresh
+// StmtInfoBCE object, and pass that same object to the corresponding
+// LeaveBlockScope.  Push locals before entering a scope, and pop them
+// afterwards.  Brush your teeth, and clean behind your ears!
+//
 static bool
 EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, ObjectBox *objbox,
                 unsigned extraSlots)
@@ -792,19 +817,13 @@ EnterBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, StmtInfoBCE *stmt, O
     JS_ASSERT(depth >= 0);
     blockObj.setStackDepth(depth);
 
-    JSOp op;
-    switch (extraSlots) {
-      case 0: op = JSOP_ENTERLET0; break;
-      case 1: op = JSOP_ENTERLET1; break;
-      case 2: op = JSOP_ENTERLET2; break;
-      default: MOZ_ASSUME_UNREACHABLE("unexpected extraSlots");
-    }
-
     if (!ComputeAliasedSlots(cx, bce, blockObj))
         return false;
 
-    if (!EmitInternedObjectOp(cx, scopeObjectIndex, op, bce))
-        return false;
+    if (blockObj.needsClone()) {
+        if (!EmitInternedObjectOp(cx, scopeObjectIndex, JSOP_PUSHBLOCKSCOPE, bce))
+            return false;
+    }
 
     stmt->blockScopeIndex = bce->blockScopeList.length();
     if (!bce->blockScopeList.append(scopeObjectIndex, bce->offset(), parent))
@@ -837,7 +856,7 @@ PopStatementBCE(ExclusiveContext *cx, BytecodeEmitter *bce)
 }
 
 static bool
-LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
+LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce)
 {
     StmtInfoBCE *stmt = bce->topStmt;
     JS_ASSERT(stmt->isBlockScope);
@@ -852,7 +871,7 @@ LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
     JS_ASSERT(blockObj == bce->blockChain);
 #endif
 
-    uint32_t slotCount = bce->blockChain->slotCount();
+    bool blockOnChain = bce->blockChain->needsClone();
 
     if (!PopStatementBCE(cx, bce))
         return false;
@@ -862,8 +881,10 @@ LeaveBlockScope(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp op)
 
     bce->blockScopeList.recordEnd(blockScopeIndex, bce->offset());
 
-    JS_ASSERT(op == JSOP_LEAVEBLOCK || op == JSOP_LEAVEBLOCKEXPR);
-    EMIT_UINT16_IMM_OP(op, slotCount);
+    if (blockOnChain) {
+        if (Emit1(cx, bce, JSOP_POPBLOCKSCOPE) < 0)
+            return false;
+    }
 
     return true;
 }
@@ -2684,10 +2705,10 @@ EmitSwitch(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         }
     }
 
-
     if (pn->pn_right->isKind(PNK_LEXICALSCOPE)) {
-        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+        if (!LeaveBlockScope(cx, bce))
             return false;
+        EMIT_UINT16_IMM_OP(JSOP_POPN, blockObj->slotCount());
     } else {
         if (!PopStatementBCE(cx, bce))
             return false;
@@ -3983,7 +4004,8 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (ParseNode *pn2 = pn->pn_kid2) {
         // The emitted code for a catch block looks like:
         //
-        // enterblock
+        // undefined...                 as many as there are locals in the catch block
+        // [pushblockscope]             only if any local aliased
         // exception
         // if there is a catchguard:
         //   dup
@@ -3991,14 +4013,16 @@ EmitTry(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         // if there is a catchguard:
         //   < catchguard code >
         //   ifne POST
-        //   throwing                   pop exception to cx->exception
         //   debugleaveblock
-        //   leaveblock
+        //   [popblockscope]            only if any local aliased
+        //   popnv <num block locals>   leave exception on top
+        //   throwing                   pop exception to cx->exception
         //   goto <next catch block>
         //   POST: pop
         // < catch block contents >
         // debugleaveblock
-        // leaveblock
+        // [popblockscope]              only if any local aliased
+        // popn <num block locals>
         // goto <end of catch blocks>   non-local; finally applies
         //
         // If there's no catch block without a catchguard, the last <next catch
@@ -4194,11 +4218,13 @@ EmitIf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
  *  destructure z
  *  pick 1
  *  pop               -1
- *  enterlet0
+ *  pushblockscope (if needed)
  *  evaluate e        +1
- *  leaveblockexpr    -3
+ *  debugleaveblock
+ *  popblockscope (if needed)
+ *  popnv 3           -3
  *
- * Note that, since enterlet0 simply changes fp->blockChain and does not
+ * Note that, since pushblockscope simply changes fp->scopeChain and does not
  * otherwise touch the stack, evaluation of the let-var initializers must leave
  * the initial value in the let-var's future slot.
  */
@@ -4236,9 +4262,13 @@ EmitLet(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
     if (!EmitTree(cx, bce, letBody->pn_expr))
         return false;
 
-    if (!LeaveBlockScope(cx, bce, letBody->getOp()))
+    if (!LeaveBlockScope(cx, bce))
         return false;
 
+    JSOp leaveOp = letBody->getOp();
+    JS_ASSERT(leaveOp == JSOP_POPN || leaveOp == JSOP_POPNV);
+    EMIT_UINT16_IMM_OP(leaveOp, blockObj->slotCount());
+
     return true;
 }
 
@@ -4250,7 +4280,7 @@ MOZ_NEVER_INLINE static bool
 EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
-    JS_ASSERT(pn->getOp() == JSOP_LEAVEBLOCK);
+    JS_ASSERT(pn->getOp() == JSOP_POPN);
 
     StmtInfoBCE stmtInfo(cx);
     ObjectBox *objbox = pn->pn_objbox;
@@ -4268,9 +4298,11 @@ EmitLexicalScope(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     if (!EmitTree(cx, bce, pn->pn_expr))
         return false;
 
-    if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+    if (!LeaveBlockScope(cx, bce))
         return false;
 
+    EMIT_UINT16_IMM_OP(JSOP_POPN, slots);
+
     return true;
 }
 
@@ -4440,14 +4472,14 @@ EmitForOf(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (!PopStatementBCE(cx, bce))
         return false;
 
-    // Pop result and iter.
-    EMIT_UINT16_IMM_OP(JSOP_POPN, 2);
-
     if (letDecl) {
-        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+        if (!LeaveBlockScope(cx, bce))
             return false;
     }
 
+    // Pop result, iter, and slots from the lexical block (if any).
+    EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount + 2);
+
     return true;
 }
 
@@ -4468,20 +4500,24 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
     if (letDecl) {
         /*
          * The let's slot(s) will be under the iterator, but the block must not
-         * be entered (i.e. fp->blockChain set) until after evaluating the rhs.
-         * Thus, push to reserve space and enterblock after. The same argument
-         * applies when leaving the loop. Thus, a for-let-in loop looks like:
+         * be entered until after evaluating the rhs.  So, we reserve space for
+         * the block scope now, and only push the block onto the scope chain
+         * later.  Thus, a for-let-in loop looks like:
          *
          *   push x N
          *   eval rhs
          *   iter
-         *   enterlet1
+         *   pushblockscope (if needed)
          *   goto
          *     ... loop body
          *   ifne
-         *   leaveforinlet
+         *   debugleaveblock
+         *   popblockscope (if needed)
          *   enditer
          *   popn(N)
+         *
+         * Note that pushblockscope and popblockscope only get emitted if some
+         * of the variables in the block are captured.
          */
         for (uint32_t i = 0; i < blockObjCount; ++i) {
             if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
@@ -4600,8 +4636,9 @@ EmitForIn(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t t
         return false;
 
     if (letDecl) {
-        if (!LeaveBlockScope(cx, bce, JSOP_LEAVEBLOCK))
+        if (!LeaveBlockScope(cx, bce))
             return false;
+        EMIT_UINT16_IMM_OP(JSOP_POPN, blockObjCount);
     }
 
     return true;
diff --git a/js/src/frontend/FullParseHandler.h b/js/src/frontend/FullParseHandler.h
index aba7792d6a4a..0eb9f37b657b 100644
--- a/js/src/frontend/FullParseHandler.h
+++ b/js/src/frontend/FullParseHandler.h
@@ -603,9 +603,9 @@ FullParseHandler::addCatchBlock(ParseNode *catchList, ParseNode *letBlock,
 inline void
 FullParseHandler::setLeaveBlockResult(ParseNode *block, ParseNode *kid, bool leaveBlockExpr)
 {
-    JS_ASSERT(block->isOp(JSOP_LEAVEBLOCK));
+    JS_ASSERT(block->isOp(JSOP_POPN));
     if (leaveBlockExpr)
-        block->setOp(JSOP_LEAVEBLOCKEXPR);
+        block->setOp(JSOP_POPNV);
     block->pn_expr = kid;
 }
 
@@ -637,7 +637,7 @@ FullParseHandler::newLexicalScope(ObjectBox *blockbox)
     if (!pn)
         return nullptr;
 
-    pn->setOp(JSOP_LEAVEBLOCK);
+    pn->setOp(JSOP_POPN);
     pn->pn_objbox = blockbox;
     pn->pn_cookie.makeFree();
     pn->pn_dflags = 0;
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index 39fdd2efa173..b00c0425b7a5 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -407,7 +407,7 @@ enum ParseNodeKind
  * PNK_NULL,
  * PNK_THIS
  *
- * PNK_LEXICALSCOPE name    pn_op: JSOP_LEAVEBLOCK or JSOP_LEAVEBLOCKEXPR
+ * PNK_LEXICALSCOPE name    pn_op: JSOP_POPN or JSOP_POPNV
  *                          pn_objbox: block object in ObjectBox holder
  *                          pn_expr: block body
  * PNK_ARRAYCOMP    list    pn_count: 1
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 3702596a7c0e..b458d1cf67ea 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -3231,7 +3231,6 @@ Parser<FullParseHandler>::pushLetScope(HandleStaticBlockObject blockObj, StmtInf
     if (!pn)
         return null();
 
-    /* Tell codegen to emit JSOP_ENTERLETx (not JSOP_ENTERBLOCK). */
     pn->pn_dflags |= PND_LET;
 
     /* Populate the new scope with decls found in the head with updated blockid. */
@@ -3601,7 +3600,7 @@ Parser<FullParseHandler>::letDeclaration()
             if (!pn1)
                 return null();
 
-            pn1->setOp(JSOP_LEAVEBLOCK);
+            pn1->setOp(JSOP_POPN);
             pn1->pn_pos = pc->blockNode->pn_pos;
             pn1->pn_objbox = blockbox;
             pn1->pn_expr = pc->blockNode;
@@ -3637,8 +3636,8 @@ Parser<FullParseHandler>::letStatement()
     if (tokenStream.peekToken() == TOK_LP) {
         pn = letBlock(LetStatement);
         JS_ASSERT_IF(pn, pn->isKind(PNK_LET) || pn->isKind(PNK_SEMI));
-        JS_ASSERT_IF(pn && pn->isKind(PNK_LET) && pn->pn_expr->getOp() != JSOP_LEAVEBLOCK,
-                     pn->isOp(JSOP_NOP));
+        JS_ASSERT_IF(pn && pn->isKind(PNK_LET) && pn->pn_expr->getOp() != JSOP_POPNV,
+                     pn->pn_expr->isOp(JSOP_POPN));
     } else 
         pn = letDeclaration();
     return pn;
@@ -6718,16 +6717,21 @@ Parser<ParseHandler>::arrayInitializer()
          *
          * Each let () {...} or for (let ...) ... compiles to:
          *
-         *   JSOP_ENTERBLOCK <o> ... JSOP_LEAVEBLOCK <n>
+         *   JSOP_PUSHN <N>            // Push space for block-scoped locals.
+         *   (JSOP_PUSHBLOCKSCOPE <O>) // If a local is aliased, push on scope
+         *                             // chain.
+         *   ...
+         *   JSOP_DEBUGLEAVEBLOCK      // Invalidate any DebugScope proxies.
+         *   JSOP_POPBLOCKSCOPE?       // Pop off scope chain, if needed.
+         *   JSOP_POPN <N>             // Pop space for block-scoped locals.
          *
          * where <o> is a literal object representing the block scope,
          * with <n> properties, naming each var declared in the block.
          *
-         * Each var declaration in a let-block binds a name in <o> at
-         * compile time, and allocates a slot on the operand stack at
-         * runtime via JSOP_ENTERBLOCK. A block-local var is accessed by
-         * the JSOP_GETLOCAL and JSOP_SETLOCAL ops. These ops have an
-         * immediate operand, the local slot's stack index from fp->spbase.
+         * Each var declaration in a let-block binds a name in <o> at compile
+         * time. A block-local var is accessed by the JSOP_GETLOCAL and
+         * JSOP_SETLOCAL ops. These ops have an immediate operand, the local
+         * slot's stack index from fp->spbase.
          *
          * The array comprehension iteration step, array.push(i * j) in
          * the example above, is done by <i * j>; JSOP_ARRAYPUSH <array>,
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index 60592925193a..a188d127b9a7 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -860,6 +860,15 @@ BaselineCompiler::emit_JSOP_POPN()
     return true;
 }
 
+bool
+BaselineCompiler::emit_JSOP_POPNV()
+{
+    frame.popRegsAndSync(1);
+    frame.popn(GET_UINT16(pc));
+    frame.push(R0);
+    return true;
+}
+
 bool
 BaselineCompiler::emit_JSOP_DUP()
 {
@@ -2575,23 +2584,14 @@ BaselineCompiler::emit_JSOP_RETSUB()
     return emitOpIC(stubCompiler.getStub(&stubSpace_));
 }
 
-typedef bool (*EnterBlockFn)(JSContext *, BaselineFrame *, Handle<StaticBlockObject *>);
-static const VMFunction EnterBlockInfo = FunctionInfo<EnterBlockFn>(jit::EnterBlock);
+typedef bool (*PushBlockScopeFn)(JSContext *, BaselineFrame *, Handle<StaticBlockObject *>);
+static const VMFunction PushBlockScopeInfo = FunctionInfo<PushBlockScopeFn>(jit::PushBlockScope);
 
 bool
-BaselineCompiler::emitEnterBlock()
+BaselineCompiler::emit_JSOP_PUSHBLOCKSCOPE()
 {
     StaticBlockObject &blockObj = script->getObject(pc)->as<StaticBlockObject>();
 
-    if (JSOp(*pc) == JSOP_ENTERBLOCK) {
-        for (size_t i = 0; i < blockObj.slotCount(); i++)
-            frame.push(UndefinedValue());
-
-        // Pushed values will be accessed using GETLOCAL and SETLOCAL, so ensure
-        // they are synced.
-        frame.syncStack(0);
-    }
-
     // Call a stub to push the block on the block chain.
     prepareVMCall();
     masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
@@ -2599,31 +2599,22 @@ BaselineCompiler::emitEnterBlock()
     pushArg(ImmGCPtr(&blockObj));
     pushArg(R0.scratchReg());
 
-    return callVM(EnterBlockInfo);
+    return callVM(PushBlockScopeInfo);
 }
 
-bool
-BaselineCompiler::emit_JSOP_ENTERBLOCK()
-{
-    return emitEnterBlock();
-}
+typedef bool (*PopBlockScopeFn)(JSContext *, BaselineFrame *);
+static const VMFunction PopBlockScopeInfo = FunctionInfo<PopBlockScopeFn>(jit::PopBlockScope);
 
 bool
-BaselineCompiler::emit_JSOP_ENTERLET0()
+BaselineCompiler::emit_JSOP_POPBLOCKSCOPE()
 {
-    return emitEnterBlock();
-}
+    // Call a stub to pop the block from the block chain.
+    prepareVMCall();
 
-bool
-BaselineCompiler::emit_JSOP_ENTERLET1()
-{
-    return emitEnterBlock();
-}
+    masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
+    pushArg(R0.scratchReg());
 
-bool
-BaselineCompiler::emit_JSOP_ENTERLET2()
-{
-    return emitEnterBlock();
+    return callVM(PopBlockScopeInfo);
 }
 
 typedef bool (*DebugLeaveBlockFn)(JSContext *, BaselineFrame *, jsbytecode *);
@@ -2643,56 +2634,6 @@ BaselineCompiler::emit_JSOP_DEBUGLEAVEBLOCK()
     return callVM(DebugLeaveBlockInfo);
 }
 
-typedef bool (*LeaveBlockFn)(JSContext *, BaselineFrame *);
-static const VMFunction LeaveBlockInfo = FunctionInfo<LeaveBlockFn>(jit::LeaveBlock);
-
-bool
-BaselineCompiler::emitLeaveBlock()
-{
-    // Call a stub to pop the block from the block chain.
-    prepareVMCall();
-
-    masm.loadBaselineFramePtr(BaselineFrameReg, R0.scratchReg());
-    pushArg(R0.scratchReg());
-
-    return callVM(LeaveBlockInfo);
-}
-
-bool
-BaselineCompiler::emit_JSOP_LEAVEBLOCK()
-{
-    if (!emitLeaveBlock())
-        return false;
-
-    // Pop slots pushed by JSOP_ENTERBLOCK.
-    frame.popn(GET_UINT16(pc));
-    return true;
-}
-
-bool
-BaselineCompiler::emit_JSOP_LEAVEBLOCKEXPR()
-{
-    if (!emitLeaveBlock())
-        return false;
-
-    // Pop slots pushed by JSOP_ENTERBLOCK, but leave the topmost value
-    // on the stack.
-    frame.popRegsAndSync(1);
-    frame.popn(GET_UINT16(pc));
-    frame.push(R0);
-    return true;
-}
-
-bool
-BaselineCompiler::emit_JSOP_LEAVEFORLETIN()
-{
-    if (!emitLeaveBlock())
-        return false;
-
-    // Another op will pop the slots (after the enditer).
-    return true;
-}
-
 typedef bool (*GetAndClearExceptionFn)(JSContext *, MutableHandleValue);
 static const VMFunction GetAndClearExceptionInfo =
     FunctionInfo<GetAndClearExceptionFn>(GetAndClearException);
diff --git a/js/src/jit/BaselineCompiler.h b/js/src/jit/BaselineCompiler.h
index a72ceb5e358e..8cc0432ddf11 100644
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@@ -27,6 +27,7 @@ namespace jit {
     _(JSOP_NOTEARG)            \
     _(JSOP_POP)                \
     _(JSOP_POPN)               \
+    _(JSOP_POPNV)              \
     _(JSOP_DUP)                \
     _(JSOP_DUP2)               \
     _(JSOP_SWAP)               \
@@ -145,13 +146,8 @@ namespace jit {
     _(JSOP_FINALLY)            \
     _(JSOP_GOSUB)              \
     _(JSOP_RETSUB)             \
-    _(JSOP_ENTERBLOCK)         \
-    _(JSOP_ENTERLET0)          \
-    _(JSOP_ENTERLET1)          \
-    _(JSOP_ENTERLET2)          \
-    _(JSOP_LEAVEBLOCK)         \
-    _(JSOP_LEAVEBLOCKEXPR)     \
-    _(JSOP_LEAVEFORLETIN)      \
+    _(JSOP_PUSHBLOCKSCOPE)     \
+    _(JSOP_POPBLOCKSCOPE)      \
     _(JSOP_DEBUGLEAVEBLOCK)    \
     _(JSOP_EXCEPTION)          \
     _(JSOP_DEBUGGER)           \
@@ -255,9 +251,6 @@ class BaselineCompiler : public BaselineCompilerSpecific
 
     bool emitFormalArgAccess(uint32_t arg, bool get);
 
-    bool emitEnterBlock();
-    bool emitLeaveBlock();
-
     bool addPCMappingEntry(bool addIndexEntry);
 
     void getScopeCoordinateObject(Register reg);
diff --git a/js/src/jit/BaselineFrame-inl.h b/js/src/jit/BaselineFrame-inl.h
index 234dae4d1969..d4702eaace10 100644
--- a/js/src/jit/BaselineFrame-inl.h
+++ b/js/src/jit/BaselineFrame-inl.h
@@ -36,31 +36,22 @@ BaselineFrame::popOffScopeChain()
 inline bool
 BaselineFrame::pushBlock(JSContext *cx, Handle<StaticBlockObject *> block)
 {
-    JS_ASSERT_IF(hasBlockChain(), blockChain() == *block->enclosingBlock());
+    JS_ASSERT(block->needsClone());
 
-    if (block->needsClone()) {
-        ClonedBlockObject *clone = ClonedBlockObject::create(cx, block, this);
-        if (!clone)
-            return false;
+    ClonedBlockObject *clone = ClonedBlockObject::create(cx, block, this);
+    if (!clone)
+        return false;
+    pushOnScopeChain(*clone);
 
-        pushOnScopeChain(*clone);
-    }
-
-    setBlockChain(*block);
     return true;
 }
 
 inline void
 BaselineFrame::popBlock(JSContext *cx)
 {
-    JS_ASSERT(hasBlockChain());
+    JS_ASSERT(scopeChain_->is<ClonedBlockObject>());
 
-    if (blockChain_->needsClone()) {
-        JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
-        popOffScopeChain();
-    }
-
-    setBlockChain(*blockChain_->enclosingBlock());
+    popOffScopeChain();
 }
 
 inline CallObject &
diff --git a/js/src/jit/BaselineFrame.h b/js/src/jit/BaselineFrame.h
index 32d92b1fcaf3..99504d6b4cb3 100644
--- a/js/src/jit/BaselineFrame.h
+++ b/js/src/jit/BaselineFrame.h
@@ -169,7 +169,7 @@ class BaselineFrame
 
     Value &unaliasedLocal(unsigned i, MaybeCheckAliasing checkAliasing = CHECK_ALIASING) const {
 #ifdef DEBUG
-        CheckLocalUnaliased(checkAliasing, script(), maybeBlockChain(), i);
+        CheckLocalUnaliased(checkAliasing, script(), i);
 #endif
         return *valueSlot(i);
     }
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 28b2285a8fdc..ef0a2e6b7986 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1252,6 +1252,7 @@ IonBuilder::traverseBytecode()
             switch (op) {
               case JSOP_POP:
               case JSOP_POPN:
+              case JSOP_POPNV:
               case JSOP_DUP:
               case JSOP_DUP2:
               case JSOP_PICK:
@@ -1504,6 +1505,15 @@ IonBuilder::inspectOpcode(JSOp op)
             current->pop();
         return true;
 
+      case JSOP_POPNV:
+      {
+        MDefinition *mins = current->pop();
+        for (uint32_t i = 0, n = GET_UINT16(pc); i < n; i++)
+            current->pop();
+        current->push(mins);
+        return true;
+      }
+
       case JSOP_NEWINIT:
         if (GET_UINT8(pc) == JSProto_Array)
             return jsop_newarray(0);
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index da14ed83316c..b7b4f061be41 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -883,13 +883,13 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *m
 }
 
 bool
-EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block)
+PushBlockScope(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block)
 {
     return frame->pushBlock(cx, block);
 }
 
 bool
-LeaveBlock(JSContext *cx, BaselineFrame *frame)
+PopBlockScope(JSContext *cx, BaselineFrame *frame)
 {
     frame->popBlock(cx);
     return true;
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 037b76a5042a..a5ccb4f255c4 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -652,8 +652,8 @@ JSObject *InitRestParameter(JSContext *cx, uint32_t length, Value *rest, HandleO
 bool HandleDebugTrap(JSContext *cx, BaselineFrame *frame, uint8_t *retAddr, bool *mustReturn);
 bool OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, bool *mustReturn);
 
-bool EnterBlock(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
-bool LeaveBlock(JSContext *cx, BaselineFrame *frame);
+bool PushBlockScope(JSContext *cx, BaselineFrame *frame, Handle<StaticBlockObject *> block);
+bool PopBlockScope(JSContext *cx, BaselineFrame *frame);
 bool DebugLeaveBlock(JSContext *cx, BaselineFrame *frame, jsbytecode *pc);
 
 bool InitBaselineFrameForOsr(BaselineFrame *frame, StackFrame *interpFrame,
diff --git a/js/src/jsanalyze.cpp b/js/src/jsanalyze.cpp
index ba4ec3a5e30c..912ea0be1152 100644
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -253,7 +253,6 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
 
           case JSOP_EVAL:
           case JSOP_SPREADEVAL:
-          case JSOP_ENTERLET2:
           case JSOP_ENTERWITH:
             canTrackVars = false;
             break;
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index cb8d3f25f27d..91607c264f49 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -114,18 +114,6 @@ js_GetVariableBytecodeLength(jsbytecode *pc)
     }
 }
 
-static uint32_t
-NumBlockSlots(JSScript *script, jsbytecode *pc)
-{
-    JS_ASSERT(*pc == JSOP_ENTERBLOCK ||
-              *pc == JSOP_ENTERLET0 || *pc == JSOP_ENTERLET1 || *pc == JSOP_ENTERLET2);
-    JS_STATIC_ASSERT(JSOP_ENTERBLOCK_LENGTH == JSOP_ENTERLET0_LENGTH);
-    JS_STATIC_ASSERT(JSOP_ENTERBLOCK_LENGTH == JSOP_ENTERLET1_LENGTH);
-    JS_STATIC_ASSERT(JSOP_ENTERBLOCK_LENGTH == JSOP_ENTERLET2_LENGTH);
-
-    return script->getObject(GET_UINT32_INDEX(pc))->as<StaticBlockObject>().propertyCountForCompilation();
-}
-
 unsigned
 js::StackUses(JSScript *script, jsbytecode *pc)
 {
@@ -138,16 +126,8 @@ js::StackUses(JSScript *script, jsbytecode *pc)
     switch (op) {
       case JSOP_POPN:
         return GET_UINT16(pc);
-      case JSOP_LEAVEBLOCK:
-        return GET_UINT16(pc);
-      case JSOP_LEAVEBLOCKEXPR:
+      case JSOP_POPNV:
         return GET_UINT16(pc) + 1;
-      case JSOP_ENTERLET0:
-        return NumBlockSlots(script, pc);
-      case JSOP_ENTERLET1:
-        return NumBlockSlots(script, pc) + 1;
-      case JSOP_ENTERLET2:
-        return NumBlockSlots(script, pc) + 2;
       default:
         /* stack: fun, this, [argc arguments] */
         JS_ASSERT(op == JSOP_NEW || op == JSOP_CALL || op == JSOP_EVAL ||
@@ -161,15 +141,8 @@ js::StackDefs(JSScript *script, jsbytecode *pc)
 {
     JSOp op = (JSOp) *pc;
     const JSCodeSpec &cs = js_CodeSpec[op];
-    if (cs.ndefs >= 0)
-        return cs.ndefs;
-
-    uint32_t n = NumBlockSlots(script, pc);
-    if (op == JSOP_ENTERLET1)
-        return n + 1;
-    if (op == JSOP_ENTERLET2)
-        return n + 2;
-    return n;
+    JS_ASSERT (cs.ndefs >= 0);
+    return cs.ndefs;
 }
 
 static const char * const countBaseNames[] = {
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index 0e419e58a800..9bc672f5c4eb 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -97,7 +97,9 @@ OPDEF(JSOP_SPREADNEW, 42, "spreadnew",  NULL,         1,  3,  1, JOF_BYTE|JOF_IN
 /* spreadcall variant of JSOP_EVAL */
 OPDEF(JSOP_SPREADEVAL,43, "spreadeval", NULL,         1,  3,  1, JOF_BYTE|JOF_INVOKE|JOF_TYPESET)
 
-OPDEF(JSOP_UNUSED44,  44, "unused44",   NULL,         1,  0,  0,  JOF_BYTE)
+/* Pop N values, preserving top value.  */
+OPDEF(JSOP_POPNV,     44, "popnv",      NULL,         3, -1,  1,  JOF_UINT16)
+
 OPDEF(JSOP_UNUSED45,  45, "unused45",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED46,  46, "unused46",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED47,  47, "unused47",   NULL,         1,  0,  0,  JOF_BYTE)
@@ -220,9 +222,7 @@ OPDEF(JSOP_UNUSED101,  101, "unused101",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED102,  102, "unused102",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED103,  103, "unused103",   NULL,         1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED104,  104, "unused104",   NULL,         1,  0,  0,  JOF_BYTE)
-
-/* Leave a for-let-in block leaving its storage pushed (to be popped after enditer). */
-OPDEF(JSOP_LEAVEFORLETIN, 105,"leaveforletin",NULL,   1,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED105,  105, "unused105",   NULL,         1,  0,  0,  JOF_BYTE)
 
 /* The argument is the offset to the next statement and is used by IonMonkey. */
 OPDEF(JSOP_LABEL,     106,"label",     NULL,          5,  0,  0,  JOF_JUMP)
@@ -398,13 +398,9 @@ OPDEF(JSOP_UNUSED183,     183,"unused183",  NULL,     1,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_CALLPROP,      184,"callprop",   NULL,     5,  1,  1, JOF_ATOM|JOF_PROP|JOF_TYPESET|JOF_TMPSLOT3)
 
-/* Enter a let block/expr whose slots are at the top of the stack. */
-OPDEF(JSOP_ENTERLET0,     185,"enterlet0",  NULL,     5, -1, -1,  JOF_OBJECT)
-
-/* Enter a let block/expr whose slots are 1 below the top of the stack. */
-OPDEF(JSOP_ENTERLET1,     186,"enterlet1",  NULL,     5, -1, -1,  JOF_OBJECT)
-/* Enter a let block/expr whose slots are 2 below the top of the stack. */
-OPDEF(JSOP_ENTERLET2,     187,"enterlet2",  NULL,     5, -1, -1,  JOF_OBJECT)
+OPDEF(JSOP_UNUSED185,     185,"unused185",  NULL,     1,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED186,     186,"unused186",  NULL,     1,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED187,     187,"unused187",  NULL,     1,  0,  0,  JOF_BYTE)
 
 /*
  * Opcode to hold 24-bit immediate integer operands.
@@ -436,8 +432,8 @@ OPDEF(JSOP_TYPEOFEXPR,    197,"typeofexpr",  NULL,    1,  1,  1, JOF_BYTE|JOF_DE
 /*
  * Block-local scope support.
  */
-OPDEF(JSOP_ENTERBLOCK,    198,"enterblock",  NULL,    5,  0, -1,  JOF_OBJECT)
-OPDEF(JSOP_LEAVEBLOCK,    199,"leaveblock",  NULL,    3, -1,  0,  JOF_UINT16)
+OPDEF(JSOP_PUSHBLOCKSCOPE,198,"pushblockscope", NULL, 5,  0,  0,  JOF_OBJECT)
+OPDEF(JSOP_POPBLOCKSCOPE, 199,"popblockscope", NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_DEBUGLEAVEBLOCK, 200,"debugleaveblock", NULL, 1,  0,  0,  JOF_BYTE)
 
 OPDEF(JSOP_UNUSED201,     201,"unused201",  NULL,     1,  0,  0,  JOF_BYTE)
@@ -459,12 +455,7 @@ OPDEF(JSOP_GETFUNNS,      205,"getfunns",   NULL,     1,  0,  1,  JOF_BYTE)
  */
 OPDEF(JSOP_ENUMCONSTELEM, 206,"enumconstelem",NULL,   1,  3,  0,  JOF_BYTE|JOF_SET)
 
-/*
- * Variant of JSOP_LEAVEBLOCK has a result on the stack above the locals,
- * which must be moved down when the block pops.
- */
-OPDEF(JSOP_LEAVEBLOCKEXPR,207,"leaveblockexpr",NULL,  3, -1,  1,  JOF_UINT16)
-
+OPDEF(JSOP_UNUSED207,     207, "unused207",    NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED208,     208, "unused208",    NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED209,     209, "unused209",    NULL,  1,  0,  0,  JOF_BYTE)
 OPDEF(JSOP_UNUSED210,     210, "unused210",    NULL,  1,  0,  0,  JOF_BYTE)
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index d25eda18bfa1..7f03056a48a9 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -854,8 +854,8 @@ js::UnwindScope(JSContext *cx, ScopeIter &si, uint32_t stackDepth)
                 return;
             if (cx->compartment()->debugMode())
                 DebugScopes::onPopBlock(cx, si);
-            JS_ASSERT(&si.staticBlock() == si.frame().maybeBlockChain());
-            si.frame().popBlock(cx);
+            if (si.staticBlock().needsClone())
+                si.frame().popBlock(cx);
             break;
           case ScopeIter::With:
             if (si.scope().as<WithObject>().stackDepth() < stackDepth)
@@ -1589,7 +1589,6 @@ CASE(EnableInterruptsPseudoOpcode)
 /* Various 1-byte no-ops. */
 CASE(JSOP_NOP)
 CASE(JSOP_UNUSED2)
-CASE(JSOP_UNUSED44)
 CASE(JSOP_UNUSED45)
 CASE(JSOP_UNUSED46)
 CASE(JSOP_UNUSED47)
@@ -1602,6 +1601,7 @@ CASE(JSOP_UNUSED101)
 CASE(JSOP_UNUSED102)
 CASE(JSOP_UNUSED103)
 CASE(JSOP_UNUSED104)
+CASE(JSOP_UNUSED105)
 CASE(JSOP_UNUSED107)
 CASE(JSOP_UNUSED125)
 CASE(JSOP_UNUSED126)
@@ -1641,6 +1641,9 @@ CASE(JSOP_UNUSED180)
 CASE(JSOP_UNUSED181)
 CASE(JSOP_UNUSED182)
 CASE(JSOP_UNUSED183)
+CASE(JSOP_UNUSED185)
+CASE(JSOP_UNUSED186)
+CASE(JSOP_UNUSED187)
 CASE(JSOP_UNUSED189)
 CASE(JSOP_UNUSED190)
 CASE(JSOP_UNUSED191)
@@ -1649,6 +1652,7 @@ CASE(JSOP_UNUSED194)
 CASE(JSOP_UNUSED196)
 CASE(JSOP_UNUSED201)
 CASE(JSOP_GETFUNNS)
+CASE(JSOP_UNUSED207)
 CASE(JSOP_UNUSED208)
 CASE(JSOP_UNUSED209)
 CASE(JSOP_UNUSED210)
@@ -1714,11 +1718,24 @@ CASE(JSOP_POPN)
     JS_ASSERT(GET_UINT16(REGS.pc) <= REGS.stackDepth());
     REGS.sp -= GET_UINT16(REGS.pc);
 #ifdef DEBUG
-    if (StaticBlockObject *block = REGS.fp()->maybeBlockChain())
+    if (StaticBlockObject *block = script->getBlockScope(REGS.pc + JSOP_POPN_LENGTH))
         JS_ASSERT(REGS.stackDepth() >= block->stackDepth() + block->slotCount());
 #endif
 END_CASE(JSOP_POPN)
 
+CASE(JSOP_POPNV)
+{
+    JS_ASSERT(GET_UINT16(REGS.pc) < REGS.stackDepth());
+    Value val = REGS.sp[-1];
+    REGS.sp -= GET_UINT16(REGS.pc);
+    REGS.sp[-1] = val;
+#ifdef DEBUG
+    if (StaticBlockObject *block = script->getBlockScope(REGS.pc + JSOP_POPNV_LENGTH))
+        JS_ASSERT(REGS.stackDepth() >= block->stackDepth() + block->slotCount());
+#endif
+}
+END_CASE(JSOP_POPNV)
+
 CASE(JSOP_SETRVAL)
     POP_RETURN_VALUE();
 END_CASE(JSOP_SETRVAL)
@@ -3336,52 +3353,36 @@ CASE(JSOP_DEBUGGER)
 }
 END_CASE(JSOP_DEBUGGER)
 
-CASE(JSOP_ENTERBLOCK)
-CASE(JSOP_ENTERLET0)
-CASE(JSOP_ENTERLET1)
-CASE(JSOP_ENTERLET2)
+CASE(JSOP_PUSHBLOCKSCOPE)
 {
     StaticBlockObject &blockObj = script->getObject(REGS.pc)->as<StaticBlockObject>();
 
-    if (*REGS.pc == JSOP_ENTERBLOCK) {
-        JS_ASSERT(REGS.stackDepth() == blockObj.stackDepth());
-        JS_ASSERT(REGS.stackDepth() + blockObj.slotCount() <= script->nslots());
-        Value *vp = REGS.sp + blockObj.slotCount();
-        SetValueRangeToUndefined(REGS.sp, vp);
-        REGS.sp = vp;
-    }
+    JS_ASSERT(blockObj.needsClone());
+    // FIXME: "Aliased" slots don't need to be on the stack.
+    JS_ASSERT(REGS.stackDepth() >= blockObj.stackDepth() + blockObj.slotCount());
 
-    /* Clone block iff there are any closed-over variables. */
+    // Clone block and push on scope chain.
     if (!REGS.fp()->pushBlock(cx, blockObj))
         goto error;
 }
-END_CASE(JSOP_ENTERBLOCK)
+END_CASE(JSOP_PUSHBLOCKSCOPE)
 
-CASE(JSOP_LEAVEBLOCK)
-CASE(JSOP_LEAVEFORLETIN)
-CASE(JSOP_LEAVEBLOCKEXPR)
+CASE(JSOP_POPBLOCKSCOPE)
 {
-    blockDepth = REGS.fp()->blockChain().stackDepth();
+#ifdef DEBUG
+    // Pop block from scope chain.
+    JS_ASSERT(*(REGS.pc - JSOP_DEBUGLEAVEBLOCK_LENGTH) == JSOP_DEBUGLEAVEBLOCK);
+    StaticBlockObject *blockObj = script->getBlockScope(REGS.pc - JSOP_DEBUGLEAVEBLOCK_LENGTH);
+    JS_ASSERT(blockObj && blockObj->needsClone());
+
+    // FIXME: "Aliased" slots don't need to be on the stack.
+    JS_ASSERT(REGS.stackDepth() >= blockObj->stackDepth() + blockObj->slotCount());
+#endif
 
     // Pop block from scope chain.
     REGS.fp()->popBlock(cx);
-
-    if (*REGS.pc == JSOP_LEAVEBLOCK) {
-        /* Pop the block's slots. */
-        REGS.sp -= GET_UINT16(REGS.pc);
-        JS_ASSERT(REGS.stackDepth() == blockDepth);
-    } else if (*REGS.pc == JSOP_LEAVEBLOCKEXPR) {
-        /* Pop the block's slots maintaining the topmost expr. */
-        Value *vp = &REGS.sp[-1];
-        REGS.sp -= GET_UINT16(REGS.pc);
-        JS_ASSERT(REGS.stackDepth() == blockDepth + 1);
-        REGS.sp[-1] = *vp;
-    } else {
-        /* Another op will pop; nothing to do here. */
-        ADVANCE_AND_DISPATCH(JSOP_LEAVEFORLETIN_LENGTH);
-    }
 }
-END_CASE(JSOP_LEAVEBLOCK)
+END_CASE(JSOP_POPBLOCKSCOPE)
 
 CASE(JSOP_DEBUGLEAVEBLOCK)
 {
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 4e47e88d9f45..3e0766f5b68c 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -110,7 +110,7 @@ inline Value &
 StackFrame::unaliasedLocal(unsigned i, MaybeCheckAliasing checkAliasing)
 {
 #ifdef DEBUG
-    CheckLocalUnaliased(checkAliasing, script(), maybeBlockChain(), i);
+    CheckLocalUnaliased(checkAliasing, script(), i);
 #endif
     return slots()[i];
 }
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index dcb8ea9ae6a9..46066d02d7ee 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -327,20 +327,14 @@ StackFrame::epilogue(JSContext *cx)
 bool
 StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
 {
-    JS_ASSERT_IF(hasBlockChain(), blockChain_ == block.enclosingBlock());
+    JS_ASSERT (block.needsClone());
 
-    if (block.needsClone()) {
-        Rooted<StaticBlockObject *> blockHandle(cx, &block);
-        ClonedBlockObject *clone = ClonedBlockObject::create(cx, blockHandle, this);
-        if (!clone)
-            return false;
+    Rooted<StaticBlockObject *> blockHandle(cx, &block);
+    ClonedBlockObject *clone = ClonedBlockObject::create(cx, blockHandle, this);
+    if (!clone)
+        return false;
 
-        pushOnScopeChain(*clone);
-
-        blockChain_ = blockHandle;
-    } else {
-        blockChain_ = &block;
-    }
+    pushOnScopeChain(*clone);
 
     return true;
 }
@@ -348,12 +342,8 @@ StackFrame::pushBlock(JSContext *cx, StaticBlockObject &block)
 void
 StackFrame::popBlock(JSContext *cx)
 {
-    if (blockChain_->needsClone()) {
-        JS_ASSERT(scopeChain_->as<ClonedBlockObject>().staticBlock() == *blockChain_);
-        popOffScopeChain();
-    }
-
-    blockChain_ = blockChain_->enclosingBlock();
+    JS_ASSERT(scopeChain_->is<ClonedBlockObject>());
+    popOffScopeChain();
 }
 
 void
@@ -1254,8 +1244,7 @@ AbstractFramePtr::hasPushedSPSFrame() const
 
 #ifdef DEBUG
 void
-js::CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script,
-                        StaticBlockObject *maybeBlock, unsigned i)
+js::CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script, unsigned i)
 {
     if (!checkAliasing)
         return;
@@ -1264,13 +1253,8 @@ js::CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script,
     if (i < script->nfixed()) {
         JS_ASSERT(!script->varIsAliased(i));
     } else {
-        unsigned depth = i - script->nfixed();
-        for (StaticBlockObject *b = maybeBlock; b; b = b->enclosingBlock()) {
-            if (b->containsVarAtDepth(depth)) {
-                JS_ASSERT(!b->isAliased(depth - b->stackDepth()));
-                break;
-            }
-        }
+        // FIXME: The callers of this function do not easily have the PC of the
+        // current frame, and so they do not know the block scope.
     }
 }
 #endif
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 4f3e1a7dd3a3..81540bd01af3 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -75,8 +75,7 @@ enum MaybeCheckAliasing { CHECK_ALIASING = true, DONT_CHECK_ALIASING = false };
 
 #ifdef DEBUG
 extern void
-CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script,
-                    StaticBlockObject *maybeBlock, unsigned i);
+CheckLocalUnaliased(MaybeCheckAliasing checkAliasing, JSScript *script, unsigned i);
 #endif
 
 namespace jit {
@@ -591,14 +590,8 @@ class StackFrame
     inline void popOffScopeChain();
 
     /*
-     * Block chain
-     *
-     * Entering/leaving a let (or exception) block may do 1 or 2 things: First,
-     * a static block object (created at compiled time and stored in the
-     * script) is pushed on StackFrame::blockChain. Second, if the static block
-     * may be cloned to hold the dynamic values if this is needed for dynamic
-     * scope access. A clone is created for a static block iff
-     * StaticBlockObject::needsClone.
+     * For blocks with aliased locals, these interfaces push and pop entries on
+     * the scope chain.
      */
 
     bool hasBlockChain() const {

From 9441939663621e9807d7ab3b9ed6f2be6b521f6c Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@igalia.com>
Date: Tue, 26 Nov 2013 12:17:08 +0100
Subject: [PATCH 232/459] Bug 927782 - Part 12: Remove blockChain from
 StackFrame. r=luke

---
 js/src/jit/BaselineBailouts.cpp |  4 ----
 js/src/jit/BaselineCompiler.cpp |  2 --
 js/src/jit/BaselineFrame.cpp    |  2 --
 js/src/jit/BaselineFrame.h      | 27 +++------------------------
 js/src/jit/BaselineFrameInfo.h  |  3 ---
 js/src/vm/Stack-inl.h           | 13 -------------
 js/src/vm/Stack.cpp             |  2 --
 js/src/vm/Stack.h               | 15 ---------------
 8 files changed, 3 insertions(+), 65 deletions(-)

diff --git a/js/src/jit/BaselineBailouts.cpp b/js/src/jit/BaselineBailouts.cpp
index 9fd0fc07fc10..ff6b70468b37 100644
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@@ -612,10 +612,6 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
     if (argsObj)
         blFrame->initArgsObjUnchecked(*argsObj);
 
-    // Ion doesn't compile code with try/catch, so the block object will always be
-    // null.
-    blFrame->setBlockChainNull();
-
     if (fun) {
         // The unpacked thisv and arguments should overwrite the pushed args present
         // in the calling frame.
diff --git a/js/src/jit/BaselineCompiler.cpp b/js/src/jit/BaselineCompiler.cpp
index a188d127b9a7..cfdedd195c37 100644
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@@ -289,8 +289,6 @@ BaselineCompiler::emitPrologue()
     else
         masm.storePtr(R1.scratchReg(), frame.addressOfScopeChain());
 
-    masm.storePtr(ImmPtr(nullptr), frame.addressOfBlockChain());
-
     // Functions with a large number of locals require two stack checks.
     // The VMCall for a fallible stack check can only occur after the
     // scope chain has been initialized, as that is required for proper
diff --git a/js/src/jit/BaselineFrame.cpp b/js/src/jit/BaselineFrame.cpp
index 82ca90ca60ca..a8b4ffffaca4 100644
--- a/js/src/jit/BaselineFrame.cpp
+++ b/js/src/jit/BaselineFrame.cpp
@@ -113,8 +113,6 @@ BaselineFrame::initForOsr(StackFrame *fp, uint32_t numStackValues)
     if (fp->hasCallObjUnchecked())
         flags_ |= BaselineFrame::HAS_CALL_OBJ;
 
-    blockChain_ = fp->maybeBlockChain();
-
     if (fp->isEvalFrame()) {
         flags_ |= BaselineFrame::EVAL;
         evalScript_ = fp->script();
diff --git a/js/src/jit/BaselineFrame.h b/js/src/jit/BaselineFrame.h
index 99504d6b4cb3..d1a03a4a5b09 100644
--- a/js/src/jit/BaselineFrame.h
+++ b/js/src/jit/BaselineFrame.h
@@ -69,11 +69,13 @@ class BaselineFrame
     uint32_t hiReturnValue_;
     uint32_t frameSize_;
     JSObject *scopeChain_;          // Scope chain (always initialized).
-    StaticBlockObject *blockChain_; // The static block chain.
     JSScript *evalScript_;          // If isEvalFrame(), the current eval script.
     ArgumentsObject *argsObj_;      // If HAS_ARGS_OBJ, the arguments object.
     void *hookData_;                // If HAS_HOOK_DATA, debugger call hook data.
     uint32_t flags_;
+#if JS_BITS_PER_WORD == 32
+    uint32_t padding_;              // Pad to 8-byte alignment.
+#endif
 
   public:
     // Distance between the frame pointer and the frame header (return address).
@@ -209,26 +211,6 @@ class BaselineFrame
         return reinterpret_cast<Value *>(&loReturnValue_);
     }
 
-    bool hasBlockChain() const {
-        return blockChain_;
-    }
-    StaticBlockObject &blockChain() const {
-        JS_ASSERT(hasBlockChain());
-        return *blockChain_;
-    }
-    StaticBlockObject *maybeBlockChain() const {
-        return hasBlockChain() ? blockChain_ : nullptr;
-    }
-    void setBlockChain(StaticBlockObject &block) {
-        blockChain_ = &block;
-    }
-    void setBlockChainNull() {
-        blockChain_ = nullptr;
-    }
-    StaticBlockObject **addressOfBlockChain() {
-        return &blockChain_;
-    }
-
     bool hasCallObj() const {
         return flags_ & HAS_CALL_OBJ;
     }
@@ -378,9 +360,6 @@ class BaselineFrame
     static int reverseOffsetOfScopeChain() {
         return -int(Size()) + offsetof(BaselineFrame, scopeChain_);
     }
-    static int reverseOffsetOfBlockChain() {
-        return -int(Size()) + offsetof(BaselineFrame, blockChain_);
-    }
     static int reverseOffsetOfArgsObj() {
         return -int(Size()) + offsetof(BaselineFrame, argsObj_);
     }
diff --git a/js/src/jit/BaselineFrameInfo.h b/js/src/jit/BaselineFrameInfo.h
index fd4bfc33e3a1..38527e969072 100644
--- a/js/src/jit/BaselineFrameInfo.h
+++ b/js/src/jit/BaselineFrameInfo.h
@@ -284,9 +284,6 @@ class FrameInfo
     Address addressOfScopeChain() const {
         return Address(BaselineFrameReg, BaselineFrame::reverseOffsetOfScopeChain());
     }
-    Address addressOfBlockChain() const {
-        return Address(BaselineFrameReg, BaselineFrame::reverseOffsetOfBlockChain());
-    }
     Address addressOfFlags() const {
         return Address(BaselineFrameReg, BaselineFrame::reverseOffsetOfFlags());
     }
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 3e0766f5b68c..fd7088222f91 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -85,8 +85,6 @@ StackFrame::initCallFrame(JSContext *cx, StackFrame *prev, jsbytecode *prevpc, V
     prev_ = prev;
     prevpc_ = prevpc;
     prevsp_ = prevsp;
-    blockChain_= nullptr;
-    JS_ASSERT(!hasBlockChain());
     JS_ASSERT(!hasHookData());
 
     initVarsToUndefined();
@@ -516,17 +514,6 @@ AbstractFramePtr::unaliasedActual(unsigned i, MaybeCheckAliasing checkAliasing)
 #endif
 }
 
-inline StaticBlockObject *
-AbstractFramePtr::maybeBlockChain() const
-{
-    if (isStackFrame())
-        return asStackFrame()->maybeBlockChain();
-#ifdef JS_ION
-    return asBaselineFrame()->maybeBlockChain();
-#else
-    MOZ_ASSUME_UNREACHABLE("Invalid frame");
-#endif
-}
 inline bool
 AbstractFramePtr::hasCallObj() const
 {
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 46066d02d7ee..491bf8cc417a 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -81,7 +81,6 @@ StackFrame::initExecuteFrame(JSContext *cx, JSScript *script, AbstractFramePtr e
     prev_ = nullptr;
     prevpc_ = nullptr;
     prevsp_ = nullptr;
-    blockChain_ = nullptr;
 
     JS_ASSERT_IF(evalInFramePrev, isDebuggerFrame());
     evalInFramePrev_ = evalInFramePrev;
@@ -273,7 +272,6 @@ void
 StackFrame::epilogue(JSContext *cx)
 {
     JS_ASSERT(!isYielding());
-    JS_ASSERT(!hasBlockChain());
 
     RootedScript script(cx, this->script());
     probes::ExitScript(cx, script, script->function(), hasPushedSPSFrame());
diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
index 81540bd01af3..e8d4e71479c7 100644
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -178,7 +178,6 @@ class AbstractFramePtr
 
     inline JSCompartment *compartment() const;
 
-    inline StaticBlockObject *maybeBlockChain() const;
     inline bool hasCallObj() const;
     inline bool isGeneratorFrame() const;
     inline bool isYielding() const;
@@ -337,7 +336,6 @@ class StackFrame
     } u;
     mutable JSObject    *scopeChain_;   /* if HAS_SCOPECHAIN, current scope chain */
     Value               rval_;          /* if HAS_RVAL, return value of the frame */
-    StaticBlockObject   *blockChain_;   /* innermost let block */
     ArgumentsObject     *argsObj_;      /* if HAS_ARGS_OBJ, the call's arguments object */
 
     /*
@@ -594,19 +592,6 @@ class StackFrame
      * the scope chain.
      */
 
-    bool hasBlockChain() const {
-        return blockChain_;
-    }
-
-    StaticBlockObject *maybeBlockChain() {
-        return blockChain_;
-    }
-
-    StaticBlockObject &blockChain() const {
-        JS_ASSERT(hasBlockChain());
-        return *blockChain_;
-    }
-
     bool pushBlock(JSContext *cx, StaticBlockObject &block);
     void popBlock(JSContext *cx);
 

From 354b4180508f4964228385186159826135662a15 Mon Sep 17 00:00:00 2001
From: Sean Stangl <sstangl@mozilla.com>
Date: Fri, 13 Dec 2013 14:49:26 -0800
Subject: [PATCH 233/459] Bug 946481 - Add xaddl to Assembler-x86-shared.
 r=efaust

---
 js/src/assembler/assembler/X86Assembler.h | 19 +++++++++++++++++++
 js/src/jit/shared/Assembler-x86-shared.h  | 13 +++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index da9f01cbea14..3ca38d8f2209 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -273,6 +273,7 @@ private:
         OP_FPU6_F32                     = 0xD9,
         OP_CALL_rel32                   = 0xE8,
         OP_JMP_rel32                    = 0xE9,
+        PRE_LOCK                        = 0xF0,
         PRE_SSE_F2                      = 0xF2,
         PRE_SSE_F3                      = 0xF3,
         OP_HLT                          = 0xF4,
@@ -319,6 +320,7 @@ private:
         OP2_MOVSX_GvEw      = 0xBF,
         OP2_MOVZX_GvEb      = 0xB6,
         OP2_MOVZX_GvEw      = 0xB7,
+        OP2_XADD_EvGv       = 0xC1,
         OP2_PEXTRW_GdUdIb   = 0xC5
     } TwoByteOpcodeID;
 
@@ -624,6 +626,23 @@ public:
         }
     }
 
+    void xaddl_rm(RegisterID srcdest, int offset, RegisterID base)
+    {
+        spew("lock xaddl %s, %s0x%x(%s)",
+            nameIReg(4,srcdest), PRETTY_PRINT_OFFSET(offset), nameIReg(base));
+        m_formatter.oneByteOp(PRE_LOCK);
+        m_formatter.twoByteOp(OP2_XADD_EvGv, srcdest, base, offset);
+    }
+
+    void xaddl_rm(RegisterID srcdest, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        spew("lock xaddl %s, %d(%s,%s,%d)",
+            nameIReg(4, srcdest), PRETTY_PRINT_OFFSET(offset),
+            nameIReg(base), nameIReg(index), 1<<scale);
+        m_formatter.oneByteOp(PRE_LOCK);
+        m_formatter.twoByteOp(OP2_XADD_EvGv, srcdest, base, index, scale, offset);
+    }
+
     void andl_rr(RegisterID src, RegisterID dst)
     {
         spew("andl       %s, %s",
diff --git a/js/src/jit/shared/Assembler-x86-shared.h b/js/src/jit/shared/Assembler-x86-shared.h
index e80bee02f0bb..b5636d73c5af 100644
--- a/js/src/jit/shared/Assembler-x86-shared.h
+++ b/js/src/jit/shared/Assembler-x86-shared.h
@@ -1106,6 +1106,19 @@ class AssemblerX86Shared
         masm.sarl_CLr(dest.code());
     }
 
+    void xaddl(const Register &srcdest, const Operand &mem) {
+        switch (mem.kind()) {
+          case Operand::MEM_REG_DISP:
+            masm.xaddl_rm(srcdest.code(), mem.disp(), mem.base());
+            break;
+          case Operand::MEM_SCALE:
+            masm.xaddl_rm(srcdest.code(), mem.disp(), mem.base(), mem.index(), mem.scale());
+            break;
+          default:
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
+        }
+    }
+
     void push(const Imm32 imm) {
         masm.push_i32(imm.value);
     }

From dc0c636e0b8f7f714e26edf80b54b3b95a958238 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Sat, 14 Dec 2013 01:15:23 +0200
Subject: [PATCH 234/459] Bug 949227 - browser_bug609700.js | Found an
 unexpected tab at the end of test run: about:blank, r=gavin

--HG--
extra : rebase_source : 8d8713551121c58a2cfc5a58516ea1f7a16f1d61
---
 browser/base/content/test/general/browser_bug609700.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/browser/base/content/test/general/browser_bug609700.js b/browser/base/content/test/general/browser_bug609700.js
index 6f413c3bf704..8b4f1ea9160d 100644
--- a/browser/base/content/test/general/browser_bug609700.js
+++ b/browser/base/content/test/general/browser_bug609700.js
@@ -7,8 +7,7 @@ function test() {
 
       ok(true, "duplicateTabIn opened a new window");
 
-      aSubject.addEventListener("load", function () {
-        aSubject.removeEventListener("load", arguments.callee, false);
+      whenDelayedStartupFinished(aSubject, function () {
         executeSoon(function () {
           aSubject.close();
           finish();

From 1c2cf7bb04ad879c47d161d226dfd8caebf429e1 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Thu, 12 Dec 2013 17:19:27 -0500
Subject: [PATCH 235/459] Bug 939890 - Don't build iLBC/G722/iSAC audio codecs
 for webrtc. r=jesup

---
 .../main/source/audio_coding_module.gypi      | 85 ++++++++++---------
 .../modules/audio_coding/neteq4/neteq.gypi    | 17 +++-
 media/webrtc/trunk/webrtc/modules/modules.gyp | 22 +++--
 3 files changed, 74 insertions(+), 50 deletions(-)

diff --git a/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi b/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi
index d5aae6beb37f..6b64ff0a76ac 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi
+++ b/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi
@@ -19,57 +19,26 @@
       ['include_opus==1', {
         'audio_coding_dependencies': ['webrtc_opus',],
         'audio_coding_defines': ['WEBRTC_CODEC_OPUS',],
-        'audio_coding_sources': [
-          'acm_opus.cc',
-          'acm_opus.h',
-        ],
       }],
       ['include_g711==1', {
         'audio_coding_dependencies': ['G711',],
         'audio_coding_defines': ['WEBRTC_CODEC_G711',],
-        'audio_coding_sources': [
-          'acm_pcma.cc',
-          'acm_pcma.h',
-          'acm_pcmu.cc',
-          'acm_pcmu.h',
-        ],
       }],
       ['include_g722==1', {
         'audio_coding_dependencies': ['G722',],
         'audio_coding_defines': ['WEBRTC_CODEC_G722',],
-        'audio_coding_sources': [
-          'acm_g722.cc',
-          'acm_g722.h',
-          'acm_g7221.cc',
-          'acm_g7221.h',
-          'acm_g7221c.cc',
-          'acm_g7221c.h',
-        ],
       }],
       ['include_ilbc==1', {
         'audio_coding_dependencies': ['iLBC',],
         'audio_coding_defines': ['WEBRTC_CODEC_ILBC',],
-        'audio_coding_sources': [
-          'acm_ilbc.cc',
-          'acm_ilbc.h',
-        ],
       }],
       ['include_isac==1', {
         'audio_coding_dependencies': ['iSAC', 'iSACFix',],
         'audio_coding_defines': ['WEBRTC_CODEC_ISAC', 'WEBRTC_CODEC_ISACFX',],
-        'audio_coding_sources': [
-          'acm_isac.cc',
-          'acm_isac.h',
-          'acm_isac_macros.h',
-        ],
       }],
       ['include_pcm16b==1', {
         'audio_coding_dependencies': ['PCM16B',],
         'audio_coding_defines': ['WEBRTC_CODEC_PCM16',],
-        'audio_coding_sources': [
-          'acm_pcm16b.cc',
-          'acm_pcm16b.h',
-        ],
       }],
     ],
   },
@@ -95,7 +64,6 @@
         ],
       },
       'sources': [
-#        '<@(audio_coding_sources)',
         '../interface/audio_coding_module.h',
         '../interface/audio_coding_module_typedefs.h',
         'acm_cng.cc',
@@ -111,14 +79,6 @@
         'acm_neteq.cc',
         'acm_neteq.h',
 # cheat until I get audio_coding_sources to work
-        'acm_opus.cc',
-        'acm_opus.h',
-        'acm_pcm16b.cc',
-        'acm_pcm16b.h',
-        'acm_pcma.cc',
-        'acm_pcma.h',
-        'acm_pcmu.cc',
-        'acm_pcmu.h',
         'acm_red.cc',
         'acm_red.h',
         'acm_resampler.cc',
@@ -128,6 +88,51 @@
         'nack.cc',
         'nack.h',
       ],
+  'conditions': [
+    ['include_opus==1', {
+      'sources': [
+        'acm_opus.cc',
+        'acm_opus.h',
+      ],
+    }],
+    ['include_g711==1', {
+      'sources': [
+        'acm_pcma.cc',
+        'acm_pcma.h',
+        'acm_pcmu.cc',
+        'acm_pcmu.h',
+      ],
+    }],
+    ['include_g722==1', {
+      'sources': [
+        'acm_g722.cc',
+        'acm_g722.h',
+        'acm_g7221.cc',
+        'acm_g7221.h',
+        'acm_g7221c.cc',
+        'acm_g7221c.h',
+      ],
+    }],
+    ['include_ilbc==1', {
+      'sources': [
+        'acm_ilbc.cc',
+        'acm_ilbc.h',
+      ],
+    }],
+    ['include_isac==1', {
+      'sources': [
+        'acm_isac.cc',
+        'acm_isac.h',
+        'acm_isac_macros.h',
+      ],
+    }],
+    ['include_pcm16b==1', {
+      'sources': [
+        'acm_pcm16b.cc',
+        'acm_pcm16b.h',
+      ],
+    }],
+  ],
     },
   ],
   'conditions': [
diff --git a/media/webrtc/trunk/webrtc/modules/audio_coding/neteq4/neteq.gypi b/media/webrtc/trunk/webrtc/modules/audio_coding/neteq4/neteq.gypi
index e98178dfffe6..1f6af7820dcf 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_coding/neteq4/neteq.gypi
+++ b/media/webrtc/trunk/webrtc/modules/audio_coding/neteq4/neteq.gypi
@@ -10,17 +10,25 @@
   'variables': {
     'neteq_dependencies': [
       'G711',
-      'G722',
       'PCM16B',
-      'iLBC',
-      'iSAC',
-      'iSACFix',
       'CNG',
       '<(webrtc_root)/common_audio/common_audio.gyp:common_audio',
       '<(webrtc_root)/system_wrappers/source/system_wrappers.gyp:system_wrappers',
     ],
     'neteq_defines': [],
     'conditions': [
+      ['include_g722==1', {
+        'neteq_dependencies': ['G722'],
+        'neteq_defines': ['WEBRTC_CODEC_G722',],
+      }],
+      ['include_ilbc==1', {
+        'neteq_dependencies': ['iLBC'],
+        'neteq_defines': ['WEBRTC_CODEC_ILBC',],
+      }],
+      ['include_isac==1', {
+        'neteq_dependencies': ['iSAC', 'iSACFix',],
+        'neteq_defines': ['WEBRTC_CODEC_ISAC', 'WEBRTC_CODEC_ISACFIX',],
+      }],
       ['include_opus==1', {
         'neteq_dependencies': ['webrtc_opus',],
         'neteq_defines': ['WEBRTC_CODEC_OPUS',],
@@ -127,6 +135,7 @@
             '<(webrtc_root)/common_audio/common_audio.gyp:common_audio',
             '<(webrtc_root)/test/test.gyp:test_support_main',
           ],
+# FIX for include_isac/etc
           'defines': [
             'AUDIO_DECODER_UNITTEST',
             'WEBRTC_CODEC_G722',
diff --git a/media/webrtc/trunk/webrtc/modules/modules.gyp b/media/webrtc/trunk/webrtc/modules/modules.gyp
index 5dab6f7cd27a..2f84cd60aa61 100644
--- a/media/webrtc/trunk/webrtc/modules/modules.gyp
+++ b/media/webrtc/trunk/webrtc/modules/modules.gyp
@@ -11,10 +11,6 @@
     '../build/common.gypi',
     'audio_coding/codecs/cng/cng.gypi',
     'audio_coding/codecs/g711/g711.gypi',
-    'audio_coding/codecs/g722/g722.gypi',
-    'audio_coding/codecs/ilbc/ilbc.gypi',
-    'audio_coding/codecs/isac/main/source/isac.gypi',
-    'audio_coding/codecs/isac/fix/source/isacfix.gypi',
     'audio_coding/codecs/pcm16b/pcm16b.gypi',
     'audio_coding/main/source/audio_coding_module.gypi',
     'audio_coding/neteq/neteq.gypi',
@@ -36,13 +32,21 @@
     'video_render/video_render.gypi',
   ],
   'conditions': [
+    ['include_g722==1', {
+      'includes': ['audio_coding/codecs/g722/g722.gypi',],
+    }],
+    ['include_ilbc==1', {
+      'includes': ['audio_coding/codecs/ilbc/ilbc.gypi',],
+    }],
+    ['include_isac==1', {
+      'includes': ['audio_coding/codecs/isac/main/source/isac.gypi',
+                   'audio_coding/codecs/isac/fix/source/isacfix.gypi',],
+    }],
     ['include_opus==1', {
       'includes': ['audio_coding/codecs/opus/opus.gypi',],
     }],
     ['include_tests==1', {
       'includes': [
-        'audio_coding/codecs/isac/isac_test.gypi',
-        'audio_coding/codecs/isac/isacfix_test.gypi',
         'audio_processing/audio_processing_tests.gypi',
         'rtp_rtcp/test/testFec/test_fec.gypi',
         'video_coding/main/source/video_coding_test.gypi',
@@ -50,6 +54,12 @@
         'video_coding/codecs/test_framework/test_framework.gypi',
         'video_coding/codecs/tools/video_codecs_tools.gypi',
       ], # includes
+      'conditions': [
+        ['include_isac==1', {
+          'includes': ['audio_coding/codecs/isac/isac_test.gypi',
+                       'audio_coding/codecs/isac/isacfix_test.gypi',],
+        }],
+      ],
       'variables': {
         'conditions': [
           # Desktop capturer is supported only on Windows, OSX and Linux.

From a6c6fc10002c5da491b246b435e87303b3c20a73 Mon Sep 17 00:00:00 2001
From: Sean Stangl <sstangl@mozilla.com>
Date: Fri, 13 Dec 2013 15:46:21 -0800
Subject: [PATCH 236/459] Bug 946481 - Fix PRETTY_PRINT_OFFSET misuse. no_r

---
 js/src/assembler/assembler/X86Assembler.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index 3ca38d8f2209..dca93c53054f 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -636,7 +636,7 @@ public:
 
     void xaddl_rm(RegisterID srcdest, int offset, RegisterID base, RegisterID index, int scale)
     {
-        spew("lock xaddl %s, %d(%s,%s,%d)",
+        spew("lock xaddl %s, %s0x%x(%s,%s,%d)",
             nameIReg(4, srcdest), PRETTY_PRINT_OFFSET(offset),
             nameIReg(base), nameIReg(index), 1<<scale);
         m_formatter.oneByteOp(PRE_LOCK);

From 92644a1ba19cbd91cdb3b287e87107f586d30a1a Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Fri, 13 Dec 2013 12:22:02 -0500
Subject: [PATCH 237/459] Bug 932285 - part 1 - iterate over registered
 histograms, then check existence in snapshots; r=vladan

---
 toolkit/components/telemetry/TelemetryPing.js | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index b96bbde06be2..5fadba44531b 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -1,4 +1,4 @@
-/* -*- indent-tabs-mode: nil -*- */
+/* -*- js-indent-level: 2; indent-tabs-mode: nil -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -285,15 +285,14 @@ TelemetryPing.prototype = {
   },
 
   getHistograms: function getHistograms(hls) {
-    let info = Telemetry.registeredHistograms;
+    let registered = Telemetry.registeredHistograms;
     let ret = {};
 
-    for (let name in hls) {
-      if (info[name]) {
-        ret[name] = this.packHistogram(hls[name]);
-        let startup_name = "STARTUP_" + name;
-        if (hls[startup_name])
-          ret[startup_name] = this.packHistogram(hls[startup_name]);
+    for (let name in registered) {
+      for (let n of [name, "STARTUP_" + name]) {
+        if (n in hls) {
+          ret[n] = this.packHistogram(hls[n]);
+        }
       }
     }
 

From 2ba183828932ba2f7a794a65551b88030faa8eb0 Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Fri, 13 Dec 2013 12:56:11 -0500
Subject: [PATCH 238/459] Bug 932285 - part 2 - convert
 nsITelemetry.registeredHistograms to a function returning an array; r=vladan

---
 toolkit/components/telemetry/Telemetry.cpp    | 20 +++++++------------
 toolkit/components/telemetry/TelemetryPing.js |  8 ++++----
 toolkit/components/telemetry/nsITelemetry.idl | 11 +++++-----
 .../tests/unit/test_TelemetryPing.js          |  4 ++--
 4 files changed, 18 insertions(+), 25 deletions(-)

diff --git a/toolkit/components/telemetry/Telemetry.cpp b/toolkit/components/telemetry/Telemetry.cpp
index 8250ac71945e..50bfeb440c78 100644
--- a/toolkit/components/telemetry/Telemetry.cpp
+++ b/toolkit/components/telemetry/Telemetry.cpp
@@ -1951,25 +1951,19 @@ TelemetryImpl::GetLateWrites(JSContext *cx, JS::Value *ret)
 }
 
 NS_IMETHODIMP
-TelemetryImpl::GetRegisteredHistograms(JSContext *cx, JS::Value *ret)
+TelemetryImpl::RegisteredHistograms(uint32_t *aCount, char*** aHistograms)
 {
   size_t count = ArrayLength(gHistograms);
-  JS::Rooted<JSObject*> info(cx, JS_NewObject(cx, nullptr, nullptr, nullptr));
-  if (!info)
-    return NS_ERROR_FAILURE;
+  char** histograms = static_cast<char**>(nsMemory::Alloc(count * sizeof(char*)));
 
   for (size_t i = 0; i < count; ++i) {
-    JSString *comment = JS_InternString(cx, gHistograms[i].comment());
-
-    if (!(comment
-          && JS_DefineProperty(cx, info, gHistograms[i].id(),
-                               STRING_TO_JSVAL(comment), nullptr, nullptr,
-                               JSPROP_ENUMERATE))) {
-      return NS_ERROR_FAILURE;
-    }
+    const char* h = gHistograms[i].id();
+    size_t len = strlen(h);
+    histograms[i] = static_cast<char*>(nsMemory::Clone(h, len+1));
   }
 
-  *ret = OBJECT_TO_JSVAL(info);
+  *aCount = count;
+  *aHistograms = histograms;
   return NS_OK;
 }
 
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index 5fadba44531b..6a34661fb0e0 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -285,10 +285,10 @@ TelemetryPing.prototype = {
   },
 
   getHistograms: function getHistograms(hls) {
-    let registered = Telemetry.registeredHistograms;
+    let registered = Telemetry.registeredHistograms([]);
     let ret = {};
 
-    for (let name in registered) {
+    for (name of registered) {
       for (let n of [name, "STARTUP_" + name]) {
         if (n in hls) {
           ret[n] = this.packHistogram(hls[n]);
@@ -541,9 +541,9 @@ TelemetryPing.prototype = {
    * Make a copy of interesting histograms at startup.
    */
   gatherStartupHistograms: function gatherStartupHistograms() {
-    let info = Telemetry.registeredHistograms;
+    let info = Telemetry.registeredHistograms([]);
     let snapshots = Telemetry.histogramSnapshots;
-    for (let name in info) {
+    for (let name of info) {
       // Only duplicate histograms with actual data.
       if (this.isInterestingStartupHistogram(name) && name in snapshots) {
         Telemetry.histogramFrom("STARTUP_" + name, name);
diff --git a/toolkit/components/telemetry/nsITelemetry.idl b/toolkit/components/telemetry/nsITelemetry.idl
index 2ab4bb1096d1..26519a9ad848 100644
--- a/toolkit/components/telemetry/nsITelemetry.idl
+++ b/toolkit/components/telemetry/nsITelemetry.idl
@@ -12,7 +12,7 @@ interface nsIFetchTelemetryDataCallback : nsISupports
   void complete();
 };
 
-[scriptable, uuid(e70ba4cc-7ccd-41fe-a75c-e4042233a8cb)]
+[scriptable, uuid(cb97b7b4-dce6-45fa-be6a-47e436a9aef9)]
 interface nsITelemetry : nsISupports
 {
   /**
@@ -129,12 +129,11 @@ interface nsITelemetry : nsISupports
   readonly attribute jsval lateWrites;
 
   /**
-   * An object whose properties are the names of histograms defined in
-   * TelemetryHistograms.h and whose corresponding values are the textual
-   * comments associated with said histograms.
+   * Returns an array whose values are the names of histograms defined
+   * in Histograms.json.
    */
-  [implicit_jscontext]
-  readonly attribute jsval registeredHistograms;
+  void registeredHistograms(out uint32_t count,
+                            [retval, array, size_is(count)] out string histograms);
 
   /** 
    * Create and return a histogram.  Parameters:
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
index c859b779c947..a9c70abaa70d 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
@@ -242,8 +242,8 @@ function checkPayload(request, reason, successfulPings) {
   const READ_SAVED_PING_SUCCESS = "READ_SAVED_PING_SUCCESS";
   do_check_true(TELEMETRY_PING in payload.histograms);
   do_check_true(READ_SAVED_PING_SUCCESS in payload.histograms);
-  let rh = Telemetry.registeredHistograms;
-  for (let name in rh) {
+  let rh = Telemetry.registeredHistograms([]);
+  for (let name of rh) {
     if (/SQLITE/.test(name) && name in payload.histograms) {
       do_check_true(("STARTUP_" + name) in payload.histograms); 
     }

From ae70372c81beb44c389bb3bec31a92ab50965433 Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Fri, 6 Dec 2013 15:18:48 -0500
Subject: [PATCH 239/459] Bug 932285 - part 3 - don't export comments to
 telemetry's string table; r=vladan

---
 toolkit/components/telemetry/Telemetry.cpp         | 8 --------
 toolkit/components/telemetry/gen-histogram-data.py | 9 ++++-----
 2 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/toolkit/components/telemetry/Telemetry.cpp b/toolkit/components/telemetry/Telemetry.cpp
index 50bfeb440c78..bf1fcfd71739 100644
--- a/toolkit/components/telemetry/Telemetry.cpp
+++ b/toolkit/components/telemetry/Telemetry.cpp
@@ -382,11 +382,9 @@ struct TelemetryHistogram {
   uint32_t bucketCount;
   uint32_t histogramType;
   uint32_t id_offset;
-  uint32_t comment_offset;
   bool extendedStatisticsOK;
 
   const char *id() const;
-  const char *comment() const;
 };
 
 #include "TelemetryHistogramData.inc"
@@ -398,12 +396,6 @@ TelemetryHistogram::id() const
   return &gHistogramStringTable[this->id_offset];
 }
 
-const char *
-TelemetryHistogram::comment() const
-{
-  return &gHistogramStringTable[this->comment_offset];
-}
-
 bool
 TelemetryHistogramType(Histogram *h, uint32_t *result)
 {
diff --git a/toolkit/components/telemetry/gen-histogram-data.py b/toolkit/components/telemetry/gen-histogram-data.py
index b4b6969bf6c6..1045637e5b07 100644
--- a/toolkit/components/telemetry/gen-histogram-data.py
+++ b/toolkit/components/telemetry/gen-histogram-data.py
@@ -52,14 +52,14 @@ class StringTable:
         f.write("  /* %5d */ %s, '\\0' };\n\n"
                 % (entries[-1][1], explodeToCharArray(entries[-1][0])))
 
-def print_array_entry(histogram, name_index, desc_index):
+def print_array_entry(histogram, name_index):
     cpp_guard = histogram.cpp_guard()
     if cpp_guard:
         print "#if defined(%s)" % cpp_guard
-    print "  { %s, %s, %s, %s, %d, %d, %s }," \
+    print "  { %s, %s, %s, %s, %d, %s }," \
         % (histogram.low(), histogram.high(),
            histogram.n_buckets(), histogram.nsITelemetry_kind(),
-           name_index, desc_index,
+           name_index,
            "true" if histogram.extended_statistics_ok() else "false")
     if cpp_guard:
         print "#endif"
@@ -70,8 +70,7 @@ def write_histogram_table(histograms):
     print "const TelemetryHistogram gHistograms[] = {"
     for histogram in histograms:
         name_index = table.stringIndex(histogram.name())
-        desc_index = table.stringIndex(histogram.description())
-        print_array_entry(histogram, name_index, desc_index)
+        print_array_entry(histogram, name_index)
     print "};"
 
     strtab_name = "gHistogramStringTable"

From e7c01f9f5bb9f4b6ca0f8c0f9121934689bc2f28 Mon Sep 17 00:00:00 2001
From: David Keeler <dkeeler@mozilla.com>
Date: Fri, 13 Dec 2013 16:06:54 -0800
Subject: [PATCH 240/459] bug 950253 - fix typo in getHSTSPreloadList.js
 r=briansmith DONTBUILD because NPOTB

---
 security/manager/tools/getHSTSPreloadList.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/manager/tools/getHSTSPreloadList.js b/security/manager/tools/getHSTSPreloadList.js
index 5bfd64d0e9ad..9728c1a5a80f 100644
--- a/security/manager/tools/getHSTSPreloadList.js
+++ b/security/manager/tools/getHSTSPreloadList.js
@@ -212,7 +212,7 @@ function output(sortedStatuses, currentList) {
     writeTo(HEADER, fos);
     writeTo(getExpirationTimeString(), fos);
     writeTo(PREFIX, fos);
-    for (var status of hstsStatuses) {
+    for (var status of sortedStatuses) {
 
       // If we've encountered an error for this entry (other than the site not
       // sending an HSTS header), be safe and don't remove it from the list

From 52d794590251caff3f76c05972929788ad1ce132 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Tsai <htsai@mozilla.com>
Date: Fri, 13 Dec 2013 18:22:18 -0800
Subject: [PATCH 241/459] Bug 949949 - [B2G] remove telephony.onincoming before
 test case finishes. r=vicamo

---
 dom/telephony/test/marionette/test_conference.js             | 2 +-
 dom/telephony/test/marionette/test_dsds_normal_call.js       | 2 +-
 dom/telephony/test/marionette/test_incoming_answer_hangup.js | 1 +
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/dom/telephony/test/marionette/test_conference.js b/dom/telephony/test/marionette/test_conference.js
index 3069163a146e..58611ef71edd 100644
--- a/dom/telephony/test/marionette/test_conference.js
+++ b/dom/telephony/test/marionette/test_conference.js
@@ -152,7 +152,7 @@ function remoteDial(number) {
 
   telephony.onincoming = function onincoming(event) {
     log("Received 'incoming' call event.");
-    telephony.onimcoming = null;
+    telephony.onincoming = null;
 
     let call = event.call;
 
diff --git a/dom/telephony/test/marionette/test_dsds_normal_call.js b/dom/telephony/test/marionette/test_dsds_normal_call.js
index b9476388a823..15f2b7e4e557 100644
--- a/dom/telephony/test/marionette/test_dsds_normal_call.js
+++ b/dom/telephony/test/marionette/test_dsds_normal_call.js
@@ -97,7 +97,7 @@ function remoteDial(number) {
 
   telephony.onincoming = function onincoming(event) {
     log("Received 'incoming' call event.");
-    telephony.onimcoming = null;
+    telephony.onincoming = null;
 
     let call = event.call;
 
diff --git a/dom/telephony/test/marionette/test_incoming_answer_hangup.js b/dom/telephony/test/marionette/test_incoming_answer_hangup.js
index fa9cc2f2f065..001dfcc05362 100644
--- a/dom/telephony/test/marionette/test_incoming_answer_hangup.js
+++ b/dom/telephony/test/marionette/test_incoming_answer_hangup.js
@@ -91,6 +91,7 @@ function hangUp() {
 }
 
 function cleanUp() {
+  telephony.onincoming = null;
   finish();
 }
 

From 039552971fa5ed9040e03165896fc6a30061b779 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 18:22:18 -0800
Subject: [PATCH 242/459] Bug 944011 - Remove explicit cx pushing from event
 code. r=bz

---
 content/base/test/test_bug372964-2.html       |  8 +---
 content/events/src/nsEventDispatcher.cpp      | 38 +++++----------
 content/events/src/nsEventListenerManager.cpp | 47 ++++---------------
 content/events/src/nsEventListenerManager.h   | 13 ++---
 4 files changed, 28 insertions(+), 78 deletions(-)

diff --git a/content/base/test/test_bug372964-2.html b/content/base/test/test_bug372964-2.html
index 05eb18de9186..cc2022a60b87 100644
--- a/content/base/test/test_bug372964-2.html
+++ b/content/base/test/test_bug372964-2.html
@@ -21,14 +21,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=372964
 
 var eventCount = 0;
 
-function listener(evt) {
-  ++eventCount;
-}
-
 function runTest() {
   var ifr = document.getElementsByTagName("iframe")[0];
   var xhr = new ifr.contentWindow.XMLHttpRequest();
-  xhr.addEventListener("foo", listener, false);
+  xhr.addEventListener("foo", ifr.contentWindow.listener, false);
   var event = ifr.contentDocument.createEvent("Events");
   event.initEvent("foo", true, true);
   xhr.dispatchEvent(event);
@@ -48,7 +44,7 @@ addLoadEvent(runTest);
 
 </script>
 </pre>
-<iframe>
+<iframe src="data:text/html,<script>function listener() { ++parent.eventCount; } </script>">
 </body>
 </html>
 
diff --git a/content/events/src/nsEventDispatcher.cpp b/content/events/src/nsEventDispatcher.cpp
index 1a4780104c56..31356dc0964d 100644
--- a/content/events/src/nsEventDispatcher.cpp
+++ b/content/events/src/nsEventDispatcher.cpp
@@ -8,7 +8,6 @@
 #include "nsPresContext.h"
 #include "nsEventListenerManager.h"
 #include "nsContentUtils.h"
-#include "nsCxPusher.h"
 #include "nsError.h"
 #include <new>
 #include "nsIContent.h"
@@ -158,8 +157,7 @@ public:
   static void HandleEventTargetChain(nsTArray<nsEventTargetChainItem>& aChain,
                                      nsEventChainPostVisitor& aVisitor,
                                      nsDispatchingCallback* aCallback,
-                                     ELMCreationDetector& aCd,
-                                     nsCxPusher* aPusher);
+                                     ELMCreationDetector& aCd);
 
   /**
    * Resets aVisitor object and calls PreHandleEvent.
@@ -172,8 +170,7 @@ public:
    * manager, this method calls nsEventListenerManager::HandleEvent().
    */
   nsresult HandleEvent(nsEventChainPostVisitor& aVisitor,
-                       ELMCreationDetector& aCd,
-                       nsCxPusher* aPusher)
+                       ELMCreationDetector& aCd)
   {
     if (WantsWillHandleEvent()) {
       mTarget->WillHandleEvent(aVisitor);
@@ -193,8 +190,7 @@ public:
       mManager->HandleEvent(aVisitor.mPresContext, aVisitor.mEvent,
                             &aVisitor.mDOMEvent,
                             CurrentTarget(),
-                            &aVisitor.mEventStatus,
-                            aPusher);
+                            &aVisitor.mEventStatus);
       NS_ASSERTION(aVisitor.mEvent->currentTarget == nullptr,
                    "CurrentTarget should be null!");
     }
@@ -204,8 +200,7 @@ public:
   /**
    * Copies mItemFlags and mItemData to aVisitor and calls PostHandleEvent.
    */
-  nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor,
-                           nsCxPusher* aPusher);
+  nsresult PostHandleEvent(nsEventChainPostVisitor& aVisitor);
 
   nsCOMPtr<EventTarget>             mTarget;
   uint16_t                          mFlags;
@@ -237,10 +232,8 @@ nsEventTargetChainItem::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 }
 
 nsresult
-nsEventTargetChainItem::PostHandleEvent(nsEventChainPostVisitor& aVisitor,
-                                        nsCxPusher* aPusher)
+nsEventTargetChainItem::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
 {
-  aPusher->Pop();
   aVisitor.mItemFlags = mItemFlags;
   aVisitor.mItemData = mItemData;
   mTarget->PostHandleEvent(aVisitor);
@@ -252,8 +245,7 @@ nsEventTargetChainItem::HandleEventTargetChain(
                           nsTArray<nsEventTargetChainItem>& aChain,
                           nsEventChainPostVisitor& aVisitor,
                           nsDispatchingCallback* aCallback,
-                          ELMCreationDetector& aCd,
-                          nsCxPusher* aPusher)
+                          ELMCreationDetector& aCd)
 {
   // Save the target so that it can be restored later.
   nsCOMPtr<EventTarget> firstTarget = aVisitor.mEvent->target;
@@ -267,7 +259,7 @@ nsEventTargetChainItem::HandleEventTargetChain(
     if ((!aVisitor.mEvent->mFlags.mNoContentDispatch ||
          item.ForceContentDispatch()) &&
         !aVisitor.mEvent->mFlags.mPropagationStopped) {
-      item.HandleEvent(aVisitor, aCd, aPusher);
+      item.HandleEvent(aVisitor, aCd);
     }
 
     if (item.GetNewTarget()) {
@@ -289,10 +281,10 @@ nsEventTargetChainItem::HandleEventTargetChain(
   if (!aVisitor.mEvent->mFlags.mPropagationStopped &&
       (!aVisitor.mEvent->mFlags.mNoContentDispatch ||
        targetItem.ForceContentDispatch())) {
-    targetItem.HandleEvent(aVisitor, aCd, aPusher);
+    targetItem.HandleEvent(aVisitor, aCd);
   }
   if (aVisitor.mEvent->mFlags.mInSystemGroup) {
-    targetItem.PostHandleEvent(aVisitor, aPusher);
+    targetItem.PostHandleEvent(aVisitor);
   }
 
   // Bubble
@@ -310,10 +302,10 @@ nsEventTargetChainItem::HandleEventTargetChain(
       if ((!aVisitor.mEvent->mFlags.mNoContentDispatch ||
            item.ForceContentDispatch()) &&
           !aVisitor.mEvent->mFlags.mPropagationStopped) {
-        item.HandleEvent(aVisitor, aCd, aPusher);
+        item.HandleEvent(aVisitor, aCd);
       }
       if (aVisitor.mEvent->mFlags.mInSystemGroup) {
-        item.PostHandleEvent(aVisitor, aPusher);
+        item.PostHandleEvent(aVisitor);
       }
     }
   }
@@ -331,7 +323,6 @@ nsEventTargetChainItem::HandleEventTargetChain(
     // Special handling if PresShell (or some other caller)
     // used a callback object.
     if (aCallback) {
-      aPusher->Pop();
       aCallback->HandleEvent(aVisitor);
     }
 
@@ -342,8 +333,7 @@ nsEventTargetChainItem::HandleEventTargetChain(
     HandleEventTargetChain(aChain,
                            aVisitor,
                            aCallback,
-                           aCd,
-                           aPusher);
+                           aCd);
     aVisitor.mEvent->mFlags.mInSystemGroup = false;
 
     // After dispatch, clear all the propagation flags so that
@@ -601,12 +591,10 @@ nsEventDispatcher::Dispatch(nsISupports* aTarget,
       } else {
         // Event target chain is created. Handle the chain.
         nsEventChainPostVisitor postVisitor(preVisitor);
-        nsCxPusher pusher;
         nsEventTargetChainItem::HandleEventTargetChain(chain,
                                                        postVisitor,
                                                        aCallback,
-                                                       cd,
-                                                       &pusher);
+                                                       cd);
 
         preVisitor.mEventStatus = postVisitor.mEventStatus;
         // If the DOM event was created during event flow.
diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
index 5fbb90c768c0..e5a95256a11c 100644
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -30,7 +30,6 @@
 #include "nsIXPConnect.h"
 #include "nsDOMCID.h"
 #include "nsContentUtils.h"
-#include "nsCxPusher.h"
 #include "nsJSUtils.h"
 #include "nsEventDispatcher.h"
 #include "nsCOMArray.h"
@@ -737,8 +736,7 @@ nsEventListenerManager::SetEventHandler(nsIAtom *aName,
                                                  aPermitUntrustedEvents);
 
   if (!aDeferCompilation) {
-    nsCxPusher pusher;
-    return CompileEventHandlerInternal(ls, pusher, &aBody);
+    return CompileEventHandlerInternal(ls, &aBody);
   }
 
   return NS_OK;
@@ -767,7 +765,6 @@ nsEventListenerManager::RemoveEventHandler(nsIAtom* aName,
 
 nsresult
 nsEventListenerManager::CompileEventHandlerInternal(nsListenerStruct *aListenerStruct,
-                                                    nsCxPusher& aPusher,
                                                     const nsAString* aBody)
 {
   NS_PRECONDITION(aListenerStruct->GetJSListener(),
@@ -789,14 +786,10 @@ nsEventListenerManager::CompileEventHandlerInternal(nsListenerStruct *aListenerS
   nsIScriptContext* context = global->GetScriptContext();
   NS_ENSURE_STATE(context);
 
-  JSContext *cx = context->GetNativeContext();
+  // Push a context to make sure exceptions are reported in the right place.
+  AutoPushJSContext cx(context->GetNativeContext());
   JS::Rooted<JSObject*> handler(cx);
 
-  nsCxPusher pusher;
-  if (aPusher.GetCurrentScriptContext() != context) {
-    pusher.Push(cx);
-  }
-
   if (aListenerStruct->mHandlerIsString) {
     // OK, we didn't find an existing compiled event handler.  Flag us
     // as not a string so we don't keep trying to compile strings
@@ -910,8 +903,7 @@ nsEventListenerManager::CompileEventHandlerInternal(nsListenerStruct *aListenerS
 nsresult
 nsEventListenerManager::HandleEventSubType(nsListenerStruct* aListenerStruct,
                                            nsIDOMEvent* aDOMEvent,
-                                           EventTarget* aCurrentTarget,
-                                           nsCxPusher* aPusher)
+                                           EventTarget* aCurrentTarget)
 {
   nsresult result = NS_OK;
   EventListenerHolder listener(aListenerStruct->mListener);  // strong ref
@@ -920,7 +912,7 @@ nsEventListenerManager::HandleEventSubType(nsListenerStruct* aListenerStruct,
   // compiled the event handler itself
   if ((aListenerStruct->mListenerType == eJSEventListener) &&
       aListenerStruct->mHandlerIsString) {
-    result = CompileEventHandlerInternal(aListenerStruct, *aPusher, nullptr);
+    result = CompileEventHandlerInternal(aListenerStruct, nullptr);
     aListenerStruct = nullptr;
   }
 
@@ -955,8 +947,7 @@ nsEventListenerManager::HandleEventInternal(nsPresContext* aPresContext,
                                             WidgetEvent* aEvent,
                                             nsIDOMEvent** aDOMEvent,
                                             EventTarget* aCurrentTarget,
-                                            nsEventStatus* aEventStatus,
-                                            nsCxPusher* aPusher)
+                                            nsEventStatus* aEventStatus)
 {
   //Set the value of the internal PreventDefault flag properly based on aEventStatus
   if (*aEventStatus == nsEventStatus_eConsumeNoDefault) {
@@ -996,24 +987,7 @@ nsEventListenerManager::HandleEventInternal(nsPresContext* aPresContext,
             }
           }
 
-          // Push the appropriate context. Note that we explicitly don't push a
-          // context in the case that the listener is non-scripted, in which case
-          // it's the native code's responsibility to push a context if it ever
-          // enters JS. Ideally we'd do things this way for all scripted callbacks,
-          // but that would involve a lot of changes and context pushing is going
-          // away soon anyhow.
-          //
-          // NB: Since we're looping here, the no-RePush() case needs to actually be
-          // a Pop(), otherwise we might end up with whatever was pushed in a
-          // previous iteration.
-          if (ls->mListenerType == eNativeListener) {
-            aPusher->Pop();
-          } else if (!aPusher->RePush(aCurrentTarget)) {
-            continue;
-          }
-
-          if (NS_FAILED(HandleEventSubType(ls, *aDOMEvent, aCurrentTarget,
-                                           aPusher))) {
+          if (NS_FAILED(HandleEventSubType(ls, *aDOMEvent, aCurrentTarget))) {
             aEvent->mFlags.mExceptionHasBeenRisen = true;
           }
         }
@@ -1171,9 +1145,7 @@ nsEventListenerManager::GetListenerInfo(nsCOMArray<nsIEventListenerInfo>* aList)
     // If this is a script handler and we haven't yet
     // compiled the event handler itself go ahead and compile it
     if ((ls.mListenerType == eJSEventListener) && ls.mHandlerIsString) {
-      nsCxPusher pusher;
-      CompileEventHandlerInternal(const_cast<nsListenerStruct*>(&ls),
-                                  pusher, nullptr);
+      CompileEventHandlerInternal(const_cast<nsListenerStruct*>(&ls), nullptr);
     }
     nsAutoString eventType;
     if (ls.mAllEvents) {
@@ -1282,8 +1254,7 @@ nsEventListenerManager::GetEventHandlerInternal(nsIAtom *aEventName,
   nsIJSEventListener *listener = ls->GetJSListener();
     
   if (ls->mHandlerIsString) {
-    nsCxPusher pusher;
-    CompileEventHandlerInternal(ls, pusher, nullptr);
+    CompileEventHandlerInternal(ls, nullptr);
   }
 
   const nsEventHandler& handler = listener->GetHandler();
diff --git a/content/events/src/nsEventListenerManager.h b/content/events/src/nsEventListenerManager.h
index 199a701627ac..70ea66ca8369 100644
--- a/content/events/src/nsEventListenerManager.h
+++ b/content/events/src/nsEventListenerManager.h
@@ -20,7 +20,6 @@ class nsIDOMEvent;
 struct EventTypeData;
 class nsEventTargetChainItem;
 class nsPIDOMWindow;
-class nsCxPusher;
 class nsIEventListenerInfo;
 class nsIScriptContext;
 
@@ -301,8 +300,7 @@ public:
                    mozilla::WidgetEvent* aEvent, 
                    nsIDOMEvent** aDOMEvent,
                    mozilla::dom::EventTarget* aCurrentTarget,
-                   nsEventStatus* aEventStatus,
-                   nsCxPusher* aPusher)
+                   nsEventStatus* aEventStatus)
   {
     if (mListeners.IsEmpty() || aEvent->mFlags.mPropagationStopped) {
       return;
@@ -323,7 +321,7 @@ public:
       return;
     }
     HandleEventInternal(aPresContext, aEvent, aDOMEvent, aCurrentTarget,
-                        aEventStatus, aPusher);
+                        aEventStatus);
   }
 
   /**
@@ -413,13 +411,11 @@ protected:
                            mozilla::WidgetEvent* aEvent,
                            nsIDOMEvent** aDOMEvent,
                            mozilla::dom::EventTarget* aCurrentTarget,
-                           nsEventStatus* aEventStatus,
-                           nsCxPusher* aPusher);
+                           nsEventStatus* aEventStatus);
 
   nsresult HandleEventSubType(nsListenerStruct* aListenerStruct,
                               nsIDOMEvent* aDOMEvent,
-                              mozilla::dom::EventTarget* aCurrentTarget,
-                              nsCxPusher* aPusher);
+                              mozilla::dom::EventTarget* aCurrentTarget);
 
   /**
    * Compile the "inline" event listener for aListenerStruct.  The
@@ -427,7 +423,6 @@ protected:
    * will look for it on mTarget.
    */
   nsresult CompileEventHandlerInternal(nsListenerStruct *aListenerStruct,
-                                       nsCxPusher& aPusher,
                                        const nsAString* aBody);
 
   /**

From 5d85a8bc5e72836ad3d91f9df305e5d4bb7448d5 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 18:22:18 -0800
Subject: [PATCH 243/459] Bug 944011 - Tests. r=bz

---
 content/events/test/mochitest.ini       |  1 +
 content/events/test/test_bug944011.html | 52 +++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 content/events/test/test_bug944011.html

diff --git a/content/events/test/mochitest.ini b/content/events/test/mochitest.ini
index c42d5277e837..29d3810cc9e3 100644
--- a/content/events/test/mochitest.ini
+++ b/content/events/test/mochitest.ini
@@ -86,6 +86,7 @@ skip-if = true # Disabled due to timeouts.
 [test_bug930374-content.html]
 [test_bug944847.html]
 skip-if = toolkit == "gonk"
+[test_bug944011.html]
 [test_clickevent_on_input.html]
 [test_continuous_wheel_events.html]
 [test_dblclick_explicit_original_target.html]
diff --git a/content/events/test/test_bug944011.html b/content/events/test/test_bug944011.html
new file mode 100644
index 000000000000..eab74ee32b0a
--- /dev/null
+++ b/content/events/test/test_bug944011.html
@@ -0,0 +1,52 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=944011
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 944011</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 944011 comment 24 - Event handlers should fire even if the
+      target comes from a non-current inner. **/
+  SimpleTest.waitForExplicitFinish();
+  var gLoadCount = 0;
+  function loaded() {
+    ++gLoadCount;
+    switch(gLoadCount) {
+      case 1:
+        ok(true, "Got first load");
+        oldBody = window[0].document.body;
+        oldBody.onclick = function() {
+          ok(true, "Got onclick");
+          SimpleTest.finish();
+        }
+        $('ifr').setAttribute('src', 'data:text/html,<html><body>Second frame</body></html>');
+        break;
+      case 2:
+        ok(true, "Got second load");
+        oldBody.dispatchEvent(new MouseEvent('click'));
+        break;
+      default:
+        ok(false, "Unexpected load");
+        SimpleTest.finish();
+    }
+  }
+
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=944011">Mozilla Bug 944011</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  <iframe id="ifr" onload="loaded();" src="data:text/html,<html><body>foo</body></html>"></iframe>
+  <div name="testTarget"></div>
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>

From 34b94bf8526410bc69f88480c3109b276b41d0c4 Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Sat, 14 Dec 2013 11:38:53 +0900
Subject: [PATCH 244/459] Bug 949334 - Use FINAL_LIBRARY for webrtc. r=gps

---
 layout/media/webrtc/Makefile.in               | 77 -------------------
 media/mtransport/third_party/moz.build        |  2 +
 media/webrtc/moz.build                        |  2 +
 python/mozbuild/mozbuild/frontend/emitter.py  |  2 +-
 python/mozbuild/mozbuild/frontend/reader.py   | 12 +--
 .../mozbuild/frontend/sandbox_symbols.py      |  4 +
 toolkit/library/Makefile.in                   |  7 --
 7 files changed, 16 insertions(+), 90 deletions(-)
 delete mode 100644 layout/media/webrtc/Makefile.in

diff --git a/layout/media/webrtc/Makefile.in b/layout/media/webrtc/Makefile.in
deleted file mode 100644
index 489462226be9..000000000000
--- a/layout/media/webrtc/Makefile.in
+++ /dev/null
@@ -1,77 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# shared libs for webrtc
-SHARED_LIBRARY_LIBS = \
-  $(call EXPAND_LIBNAME_PATH,common_video,$(DEPTH)/media/webrtc/trunk/webrtc/common_video/common_video_common_video) \
-  $(call EXPAND_LIBNAME_PATH,common_audio,$(DEPTH)/media/webrtc/trunk/webrtc/common_audio/common_audio_common_audio) \
-  $(call EXPAND_LIBNAME_PATH,video_capture_module,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_video_capture_module) \
-  $(call EXPAND_LIBNAME_PATH,webrtc_utility,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_webrtc_utility) \
-  $(call EXPAND_LIBNAME_PATH,audio_coding_module,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_audio_coding_module) \
-  $(call EXPAND_LIBNAME_PATH,acm2,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_acm2) \
-  $(call EXPAND_LIBNAME_PATH,CNG,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_CNG) \
-  $(call EXPAND_LIBNAME_PATH,G711,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_G711) \
-  $(call EXPAND_LIBNAME_PATH,PCM16B,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_PCM16B) \
-  $(call EXPAND_LIBNAME_PATH,NetEq,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_NetEq) \
-  $(call EXPAND_LIBNAME_PATH,NetEq4,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_NetEq4) \
-  $(call EXPAND_LIBNAME_PATH,system_wrappers,$(DEPTH)/media/webrtc/trunk/webrtc/system_wrappers/source/system_wrappers_system_wrappers) \
-  $(call EXPAND_LIBNAME_PATH,webrtc_video_coding,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_webrtc_video_coding) \
-  $(call EXPAND_LIBNAME_PATH,video_coding_utility,$(DEPTH)/media/webrtc/trunk/webrtc/modules/video_coding/utility/video_coding_utility_video_coding_utility) \
-  $(call EXPAND_LIBNAME_PATH,webrtc_i420,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_webrtc_i420) \
-  $(call EXPAND_LIBNAME_PATH,webrtc_vp8,$(DEPTH)/media/webrtc/trunk/webrtc/modules/video_coding/codecs/vp8/vp8_webrtc_vp8) \
-  $(call EXPAND_LIBNAME_PATH,webrtc_opus,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_webrtc_opus) \
-  $(call EXPAND_LIBNAME_PATH,video_render_module,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_video_render_module) \
-  $(call EXPAND_LIBNAME_PATH,video_engine_core,$(DEPTH)/media/webrtc/trunk/webrtc/video_engine/video_engine_video_engine_core) \
-  $(call EXPAND_LIBNAME_PATH,voice_engine,$(DEPTH)/media/webrtc/trunk/webrtc/voice_engine/voice_engine_voice_engine) \
-  $(call EXPAND_LIBNAME_PATH,media_file,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_media_file) \
-  $(call EXPAND_LIBNAME_PATH,rtp_rtcp,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_rtp_rtcp) \
-  $(call EXPAND_LIBNAME_PATH,bitrate_controller,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_bitrate_controller) \
-  $(call EXPAND_LIBNAME_PATH,remote_bitrate_estimator,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_remote_bitrate_estimator) \
-  $(call EXPAND_LIBNAME_PATH,rbe_components,$(DEPTH)/media/webrtc/trunk/webrtc/modules/remote_bitrate_estimator/remote_bitrate_estimator_components_rbe_components) \
-  $(call EXPAND_LIBNAME_PATH,paced_sender,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_paced_sender) \
-  $(call EXPAND_LIBNAME_PATH,video_processing,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_video_processing) \
-  $(call EXPAND_LIBNAME_PATH,audio_conference_mixer,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_audio_conference_mixer) \
-  $(call EXPAND_LIBNAME_PATH,audio_device,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_audio_device) \
-  $(call EXPAND_LIBNAME_PATH,audio_processing,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_audio_processing) \
-  $(call EXPAND_LIBNAME_PATH,yuv,$(DEPTH)/media/webrtc/trunk/third_party/libyuv/libyuv_libyuv) \
-  $(call EXPAND_LIBNAME_PATH,nicer,$(DEPTH)/media/mtransport/third_party/nICEr/nicer_nicer) \
-  $(call EXPAND_LIBNAME_PATH,nrappkit,$(DEPTH)/media/mtransport/third_party/nrappkit/nrappkit_nrappkit) \
-  $(NULL)
-
-# if we're on an intel arch, we want SSE2 optimizations
-ifneq (,$(INTEL_ARCHITECTURE))
-SHARED_LIBRARY_LIBS += \
-  $(call EXPAND_LIBNAME_PATH,video_processing_sse2,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_video_processing_sse2) \
-  $(call EXPAND_LIBNAME_PATH,audio_processing_sse2,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_audio_processing_sse2) \
-  $(call EXPAND_LIBNAME_PATH,common_audio_sse2,$(DEPTH)/media/webrtc/trunk/webrtc/common_audio/common_audio_common_audio_sse2) \
-  $(NULL)
-endif
-
-ifeq ($(CPU_ARCH), arm)
-ifeq (Android,$(OS_TARGET))
-# NEON detection on WebRTC is Android only. If WebRTC supports Linux/arm etc,
-# we should remove OS check
-# extra ARM libs
-SHARED_LIBRARY_LIBS += \
-  $(call EXPAND_LIBNAME_PATH,cpu_features_android,$(DEPTH)/media/webrtc/trunk/webrtc/system_wrappers/source/system_wrappers_cpu_features_android) \
-  $(NULL)
-# neon for ARM
-ifeq ($(BUILD_ARM_NEON),1)
-SHARED_LIBRARY_LIBS += \
-  $(call EXPAND_LIBNAME_PATH,common_audio_neon,$(DEPTH)/media/webrtc/trunk/webrtc/common_audio/common_audio_common_audio_neon) \
-  $(call EXPAND_LIBNAME_PATH,audio_processing_neon,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_audio_processing_neon) \
-  $(NULL)
-endif
-endif
-endif
-
-
-# If you enable one of these codecs in webrtc_config.gypi, you'll need to re-add the
-# relevant library from this list:
-#
-#  $(call EXPAND_LIBNAME_PATH,G722,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_G722) \
-#  $(call EXPAND_LIBNAME_PATH,iLBC,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_iLBC) \
-#  $(call EXPAND_LIBNAME_PATH,iSAC,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_iSAC) \
-#  $(call EXPAND_LIBNAME_PATH,iSACFix,$(DEPTH)/media/webrtc/trunk/webrtc/modules/modules_iSACFix) \
-#
diff --git a/media/mtransport/third_party/moz.build b/media/mtransport/third_party/moz.build
index dfc73472cbef..d8b867c19f2f 100644
--- a/media/mtransport/third_party/moz.build
+++ b/media/mtransport/third_party/moz.build
@@ -13,6 +13,8 @@ GYP_DIRS += [
 
 GYP_DIRS['nICEr'].input = 'nICEr/nicer.gyp'
 GYP_DIRS['nICEr'].variables = gyp_vars
+GYP_DIRS['nICEr'].sandbox_vars['FINAL_LIBRARY'] = 'webrtc'
 
 GYP_DIRS['nrappkit'].input = 'nrappkit/nrappkit.gyp'
 GYP_DIRS['nrappkit'].variables = gyp_vars
+GYP_DIRS['nrappkit'].sandbox_vars['FINAL_LIBRARY'] = 'webrtc'
diff --git a/media/webrtc/moz.build b/media/webrtc/moz.build
index 5c5243a4c55c..78d6e2afc7ae 100644
--- a/media/webrtc/moz.build
+++ b/media/webrtc/moz.build
@@ -10,6 +10,7 @@ GYP_DIRS += ['trunk']
 
 GYP_DIRS['trunk'].input = 'trunk/peerconnection.gyp'
 GYP_DIRS['trunk'].variables = gyp_vars
+GYP_DIRS['trunk'].sandbox_vars['FINAL_LIBRARY'] = 'webrtc'
 
 if CONFIG['MOZ_WEBRTC_SIGNALING']:
     GYP_DIRS += ['signaling']
@@ -18,6 +19,7 @@ if CONFIG['MOZ_WEBRTC_SIGNALING']:
     GYP_DIRS['signaling'].variables.update(
         build_for_test=0
     )
+    GYP_DIRS['signaling'].sandbox_vars['FINAL_LIBRARY'] = 'xul'
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] != 'gonk':
     GYP_DIRS += ['trunk/testing']
diff --git a/python/mozbuild/mozbuild/frontend/emitter.py b/python/mozbuild/mozbuild/frontend/emitter.py
index d4ffb481f841..e6374da5a8d6 100644
--- a/python/mozbuild/mozbuild/frontend/emitter.py
+++ b/python/mozbuild/mozbuild/frontend/emitter.py
@@ -340,7 +340,7 @@ class TreeMetadataEmitter(LoggingMixin):
                 LibraryDefinition(sandbox, libname)
 
         if final_lib:
-            if sandbox.get('FORCE_STATIC_LIB'):
+            if isinstance(sandbox, MozbuildSandbox) and sandbox.get('FORCE_STATIC_LIB'):
                 raise SandboxValidationError('FINAL_LIBRARY implies FORCE_STATIC_LIB')
             self._final_libs.append((sandbox['OBJDIR'], libname, final_lib))
             passthru.variables['FORCE_STATIC_LIB'] = True
diff --git a/python/mozbuild/mozbuild/frontend/reader.py b/python/mozbuild/mozbuild/frontend/reader.py
index da87965ea099..37b4f2de44d3 100644
--- a/python/mozbuild/mozbuild/frontend/reader.py
+++ b/python/mozbuild/mozbuild/frontend/reader.py
@@ -768,11 +768,13 @@ class BuildReader(object):
             # configuration, but we need to add the gyp objdirs to that sandbox
             # first.
             from .gyp_reader import read_from_gyp
-            gyp_sandboxes.extend(read_from_gyp(self.config,
-                                               mozpath.join(curdir, gyp_dir.input),
-                                               mozpath.join(sandbox['OBJDIR'],
-                                                            target_dir),
-                                               gyp_dir.variables))
+            for gyp_sandbox in read_from_gyp(self.config,
+                                             mozpath.join(curdir, gyp_dir.input),
+                                             mozpath.join(sandbox['OBJDIR'],
+                                                          target_dir),
+                                             gyp_dir.variables):
+                gyp_sandbox.update(gyp_dir.sandbox_vars)
+                gyp_sandboxes.append(gyp_sandbox)
 
         # Add the gyp subdirectories to DIRS. We don't care about trying to
         # place some of them in PARALLEL_DIRS because they're only going to be
diff --git a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
index 8c70a9589524..1c8c99db3501 100644
--- a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
+++ b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
@@ -564,6 +564,7 @@ VARIABLES = {
     'GYP_DIRS': (StrictOrderingOnAppendListWithFlagsFactory({
             'variables': dict,
             'input': unicode,
+            'sandbox_vars': dict,
         }), list,
         """Defines a list of object directories handled by gyp configurations.
 
@@ -575,6 +576,9 @@ VARIABLES = {
               object directory.
             - variables, a dictionary containing variables and values to pass
               to the gyp processor.
+            - sandbox_vars, a dictionary containing variables and values to
+              pass to the mozbuild processor on top of those derived from gyp
+              configuration.
 
         Typical use looks like:
             GYP_DIRS += ['foo', 'bar']
diff --git a/toolkit/library/Makefile.in b/toolkit/library/Makefile.in
index 812f4b8e0e14..74c9cc711cb5 100644
--- a/toolkit/library/Makefile.in
+++ b/toolkit/library/Makefile.in
@@ -183,13 +183,6 @@ endif
 EXTRA_DSO_LDOPTS += $(call EXPAND_LIBNAME_PATH,gkmedias,$(DIST)/lib)
 
 ifdef MOZ_WEBRTC
-ifdef MOZ_WEBRTC_SIGNALING
-SHARED_LIBRARY_LIBS += \
-  $(DEPTH)/media/webrtc/signaling/signaling_ecc/$(LIB_PREFIX)ecc.$(LIB_SUFFIX) \
-  $(DEPTH)/media/webrtc/signaling/signaling_sipcc/$(LIB_PREFIX)sipcc.$(LIB_SUFFIX) \
-  $(NULL)
-endif
-
 ifeq (WINNT,$(OS_TARGET))
 EXTRA_DSO_LDOPTS += \
   -LIBPATH:'$(MOZ_DIRECTX_SDK_PATH)/lib/$(MOZ_DIRECTX_SDK_CPU_SUFFIX)' \

From 3059f64385321c73b54901bfbad0c9b45211e407 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 19:15:43 -0800
Subject: [PATCH 245/459] Bug 913734 - Remove custom privilege setup for
 cut/copy/paste. r=mrbkap

---
 content/html/document/src/nsHTMLDocument.cpp  | 54 ++-----------------
 content/html/document/src/nsHTMLDocument.h    |  4 --
 .../libeditor/html/tests/test_bug676401.html  | 18 +++----
 modules/libpref/src/init/all.js               |  4 --
 4 files changed, 13 insertions(+), 67 deletions(-)

diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index 44233d5a8d50..6f8787c031e4 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -3144,47 +3144,6 @@ ConvertToMidasInternalCommand(const nsAString & inCommandID,
                                             dummyBool, dummyBool, true);
 }
 
-jsid
-nsHTMLDocument::sCutCopyInternal_id = JSID_VOID;
-jsid
-nsHTMLDocument::sPasteInternal_id = JSID_VOID;
-
-/* Helper function to check security of clipboard commands. If aPaste is */
-/* true, we check paste, else we check cutcopy */
-nsresult
-nsHTMLDocument::DoClipboardSecurityCheck(bool aPaste)
-{
-  nsresult rv = NS_ERROR_FAILURE;
-
-  JSContext *cx = nsContentUtils::GetCurrentJSContext();
-  if (!cx) {
-    return NS_OK;
-  }
-
-  NS_NAMED_LITERAL_CSTRING(classNameStr, "Clipboard");
-
-  nsIScriptSecurityManager *secMan = nsContentUtils::GetSecurityManager();
-
-  if (aPaste) {
-    if (nsHTMLDocument::sPasteInternal_id == JSID_VOID) {
-      nsHTMLDocument::sPasteInternal_id =
-        INTERNED_STRING_TO_JSID(cx, ::JS_InternString(cx, "paste"));
-    }
-    rv = secMan->CheckPropertyAccess(cx, nullptr, classNameStr.get(),
-                                     nsHTMLDocument::sPasteInternal_id,
-                                     nsIXPCSecurityManager::ACCESS_GET_PROPERTY);
-  } else {
-    if (nsHTMLDocument::sCutCopyInternal_id == JSID_VOID) {
-      nsHTMLDocument::sCutCopyInternal_id =
-        INTERNED_STRING_TO_JSID(cx, ::JS_InternString(cx, "cutcopy"));
-    }
-    rv = secMan->CheckPropertyAccess(cx, nullptr, classNameStr.get(),
-                                     nsHTMLDocument::sCutCopyInternal_id,
-                                     nsIXPCSecurityManager::ACCESS_GET_PROPERTY);
-  }
-  return rv;
-}
-
 /* TODO: don't let this call do anything if the page is not done loading */
 /* boolean execCommand(in DOMString commandID, in boolean doShowUI,
                                                in DOMString value); */
@@ -3232,14 +3191,11 @@ nsHTMLDocument::ExecCommand(const nsAString& commandID,
     return false;
   }
 
-  if (commandID.LowerCaseEqualsLiteral("cut") ||
-      commandID.LowerCaseEqualsLiteral("copy")) {
-    rv = DoClipboardSecurityCheck(false);
-  } else if (commandID.LowerCaseEqualsLiteral("paste")) {
-    rv = DoClipboardSecurityCheck(true);
-  }
-
-  if (rv.Failed()) {
+  bool restricted = commandID.LowerCaseEqualsLiteral("cut") ||
+                    commandID.LowerCaseEqualsLiteral("copy")||
+                    commandID.LowerCaseEqualsLiteral("paste");
+  if (restricted && !nsContentUtils::IsCallerChrome()) {
+    rv = NS_ERROR_DOM_SECURITY_ERR;
     return false;
   }
 
diff --git a/content/html/document/src/nsHTMLDocument.h b/content/html/document/src/nsHTMLDocument.h
index dd0a4d7c0a60..16f412204502 100644
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@@ -347,10 +347,6 @@ protected:
   uint32_t mContentEditableCount;
   EditingState mEditingState;
 
-  nsresult   DoClipboardSecurityCheck(bool aPaste);
-  static jsid        sCutCopyInternal_id;
-  static jsid        sPasteInternal_id;
-
   // When false, the .cookies property is completely disabled
   bool mDisableCookieAccess;
 
diff --git a/editor/libeditor/html/tests/test_bug676401.html b/editor/libeditor/html/tests/test_bug676401.html
index a3ecce803a5d..b7644188512b 100644
--- a/editor/libeditor/html/tests/test_bug676401.html
+++ b/editor/libeditor/html/tests/test_bug676401.html
@@ -88,20 +88,18 @@ function runTests() {
   for (i = 0; i < commands.length; i++)
     IsCommandEnabled(commands[i]);
 
-  // cut/copy/paste -- SpecialPowers required
-  SpecialPowers.setCharPref("capability.policy.policynames",                      "allowclipboard");
-  SpecialPowers.setCharPref("capability.policy.allowclipboard.sites",             "http://mochi.test:8888");
-  SpecialPowers.setCharPref("capability.policy.allowclipboard.Clipboard.cutcopy", "allAccess");
-  SpecialPowers.setCharPref("capability.policy.allowclipboard.Clipboard.paste",   "allAccess");
+  // These are privileged, and available only to chrome.
   commands = ["cut", "paste", "copy"];
   for (i = 0; i < commands.length; i++) {
     IsCommandEnabled(commands[i]);
-    document.execCommand(commands[i], false, false);
+    try {
+      document.execCommand(commands[i], false, false);
+      ok(false, "Thould have thrown: " + commands[i]);
+    } catch (e) {
+      ok(/insecure|denied/.test(e), "Threw correctly: " + commands[i] + " - " + e);
+    }
+    SpecialPowers.wrap(document).execCommand(commands[i], false, false);
   }
-  SpecialPowers.clearUserPref("capability.policy.policynames");
-  SpecialPowers.clearUserPref("capability.policy.allowclipboard.sites");
-  SpecialPowers.clearUserPref("capability.policy.allowclipboard.Clipboard.cutcopy");
-  SpecialPowers.clearUserPref("capability.policy.allowclipboard.Clipboard.paste");
 
   // delete/undo/redo -- we have to execute this commands because:
   //  * there's nothing to undo if we haven't modified the selection first
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index b7bec53c4294..73574c3b31a2 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -828,10 +828,6 @@ pref("capability.policy.default.XMLHttpRequest.getInterface", "noAccess");
 pref("capability.policy.default.XMLHttpRequest.open-uri", "allAccess");
 pref("capability.policy.default.DOMParser.parseFromStream", "noAccess");
 
-// Clipboard
-pref("capability.policy.default.Clipboard.cutcopy", "noAccess");
-pref("capability.policy.default.Clipboard.paste", "noAccess");
-
 // Scripts & Windows prefs
 pref("dom.disable_image_src_set",           false);
 pref("dom.disable_window_flip",             false);

From bdd70cb3686e6462bbeab66759d80b1654f0d2c3 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 19:15:43 -0800
Subject: [PATCH 246/459] Bug 913734 - Stop storing security policies on
 XPCWrappedNativeProtos. r=mrbkap

This is just a cache, so we can safely remove it without impacting correctness.
The rest of this mechanism goes away in subsequent patches.
---
 caps/include/nsScriptSecurityManager.h     |  4 +-
 caps/src/nsScriptSecurityManager.cpp       | 49 ++++++----------------
 js/xpconnect/idl/nsIXPCSecurityManager.idl |  8 ++--
 js/xpconnect/idl/nsIXPConnect.idl          | 13 +-----
 js/xpconnect/src/XPCWrappedNative.cpp      | 12 +-----
 js/xpconnect/src/XPCWrappedNativeJSOps.cpp |  3 +-
 js/xpconnect/src/XPCWrappedNativeProto.cpp |  2 -
 js/xpconnect/src/XPCWrappedNativeScope.cpp | 21 ----------
 js/xpconnect/src/nsXPConnect.cpp           |  7 ----
 js/xpconnect/src/xpcprivate.h              | 11 -----
 10 files changed, 21 insertions(+), 109 deletions(-)

diff --git a/caps/include/nsScriptSecurityManager.h b/caps/include/nsScriptSecurityManager.h
index 5adf5c844fa4..df145562f769 100644
--- a/caps/include/nsScriptSecurityManager.h
+++ b/caps/include/nsScriptSecurityManager.h
@@ -396,8 +396,7 @@ private:
                             JSContext* cx, JSObject* aJSObject,
                             nsISupports* aObj,
                             nsIClassInfo* aClassInfo,
-                            const char* aClassName, jsid aProperty,
-                            void** aCachedClassPolicy);
+                            const char* aClassName, jsid aProperty);
 
     nsresult
     CheckSameOriginDOMProp(nsIPrincipal* aSubject, 
@@ -409,7 +408,6 @@ private:
                  ClassInfoData& aClassData,
                  JS::Handle<jsid> aProperty,
                  uint32_t aAction,
-                 ClassPolicy** aCachedClassPolicy,
                  SecurityLevel* result);
 
     nsresult
diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
index 5ee37a855832..2423d3e2a25c 100644
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -539,7 +539,7 @@ nsScriptSecurityManager::CheckPropertyAccess(JSContext* cx,
 {
     return CheckPropertyAccessImpl(aAction, nullptr, cx, aJSObject,
                                    nullptr, nullptr,
-                                   aClassName, aProperty, nullptr);
+                                   aClassName, aProperty);
 }
 
 NS_IMETHODIMP
@@ -614,8 +614,7 @@ nsScriptSecurityManager::CheckPropertyAccessImpl(uint32_t aAction,
                                                  JSContext* cx, JSObject* aJSObject,
                                                  nsISupports* aObj,
                                                  nsIClassInfo* aClassInfo,
-                                                 const char* aClassName, jsid aProperty,
-                                                 void** aCachedClassPolicy)
+                                                 const char* aClassName, jsid aProperty)
 {
     nsresult rv;
     JS::RootedObject jsObject(cx, aJSObject);
@@ -637,7 +636,7 @@ nsScriptSecurityManager::CheckPropertyAccessImpl(uint32_t aAction,
     //-- Look up the security policy for this class and subject domain
     SecurityLevel securityLevel;
     rv = LookupPolicy(subjectPrincipal, classInfoData, property, aAction,
-                      (ClassPolicy**)aCachedClassPolicy, &securityLevel);
+                      &securityLevel);
     if (NS_FAILED(rv))
         return rv;
 
@@ -983,7 +982,6 @@ nsScriptSecurityManager::LookupPolicy(nsIPrincipal* aPrincipal,
                                       ClassInfoData& aClassData,
                                       JS::Handle<jsid> aProperty,
                                       uint32_t aAction,
-                                      ClassPolicy** aCachedClassPolicy,
                                       SecurityLevel* result)
 {
     AutoJSContext cx;
@@ -1072,28 +1070,13 @@ nsScriptSecurityManager::LookupPolicy(nsIPrincipal* aPrincipal,
         aPrincipal->SetSecurityPolicy((void*)dpolicy);
     }
 
-    ClassPolicy* cpolicy = nullptr;
-
-    if ((dpolicy == mDefaultPolicy) && aCachedClassPolicy)
-    {
-        // No per-domain policy for this principal (the more common case)
-        // so look for a cached class policy from the object wrapper
-        cpolicy = *aCachedClassPolicy;
-    }
-
-    if (!cpolicy)
-    { //-- No cached policy for this class, need to look it up
-        cpolicy = static_cast<ClassPolicy*>
+    ClassPolicy* cpolicy = static_cast<ClassPolicy*>
                              (PL_DHashTableOperate(dpolicy,
                                                       aClassData.GetName(),
                                                       PL_DHASH_LOOKUP));
 
-        if (PL_DHASH_ENTRY_IS_FREE(cpolicy))
-            cpolicy = NO_POLICY_FOR_CLASS;
-
-        if ((dpolicy == mDefaultPolicy) && aCachedClassPolicy)
-            *aCachedClassPolicy = cpolicy;
-    }
+    if (PL_DHASH_ENTRY_IS_FREE(cpolicy))
+        cpolicy = NO_POLICY_FOR_CLASS;
 
     NS_ASSERTION(JSID_IS_INT(property) || JSID_IS_OBJECT(property) ||
                  JSID_IS_STRING(property), "Property must be a valid id");
@@ -1456,8 +1439,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
 
         SecurityLevel secLevel;
         rv = LookupPolicy(aPrincipal, nameData, EnabledID(),
-                          nsIXPCSecurityManager::ACCESS_GET_PROPERTY,
-                          nullptr, &secLevel);
+                          nsIXPCSecurityManager::ACCESS_GET_PROPERTY, &secLevel);
         if (NS_SUCCEEDED(rv) && secLevel.level == SCRIPT_SECURITY_ALL_ACCESS)
         {
             // OK for this site!
@@ -1623,7 +1605,7 @@ nsScriptSecurityManager::ScriptAllowed(JSObject *aGlobal)
     nsresult rv = LookupPolicy(doGetObjectPrincipal(global), nameData,
                                EnabledID(),
                                nsIXPCSecurityManager::ACCESS_GET_PROPERTY,
-                               nullptr, &secLevel);
+                               &secLevel);
     if (NS_FAILED(rv) || secLevel.level == SCRIPT_SECURITY_NO_ACCESS) {
         return false;
     }
@@ -1840,8 +1822,7 @@ NS_IMETHODIMP
 nsScriptSecurityManager::CanCreateWrapper(JSContext *cx,
                                           const nsIID &aIID,
                                           nsISupports *aObj,
-                                          nsIClassInfo *aClassInfo,
-                                          void **aPolicy)
+                                          nsIClassInfo *aClassInfo)
 {
 // XXX Special case for nsIXPCException ?
     ClassInfoData objClassInfo = ClassInfoData(aClassInfo, nullptr);
@@ -1947,12 +1928,11 @@ nsScriptSecurityManager::CanAccess(uint32_t aAction,
                                    JSObject* aJSObject,
                                    nsISupports* aObj,
                                    nsIClassInfo* aClassInfo,
-                                   jsid aPropertyName,
-                                   void** aPolicy)
+                                   jsid aPropertyName)
 {
     return CheckPropertyAccessImpl(aAction, aCallContext, cx,
                                    aJSObject, aObj, aClassInfo,
-                                   nullptr, aPropertyName, aPolicy);
+                                   nullptr, aPropertyName);
 }
 
 nsresult
@@ -2218,11 +2198,6 @@ nsScriptSecurityManager::SystemPrincipalSingletonConstructor()
 nsresult
 nsScriptSecurityManager::InitPolicies()
 {
-    // Clear any policies cached on XPConnect wrappers
-    nsresult rv =
-        nsXPConnect::XPConnect()->ClearAllWrappedNativeSecurityPolicies();
-    if (NS_FAILED(rv)) return rv;
-
     //-- Clear mOriginToPolicyMap: delete mapped DomainEntry items,
     //-- whose dtor decrements refcount of stored DomainPolicy object
     delete mOriginToPolicyMap;
@@ -2264,7 +2239,7 @@ nsScriptSecurityManager::InitPolicies()
 
     // Get a JS context - we need it to create internalized strings later.
     AutoSafeJSContext cx;
-    rv = InitDomainPolicy(cx, "default", mDefaultPolicy);
+    nsresult rv = InitDomainPolicy(cx, "default", mDefaultPolicy);
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsAdoptingCString policyNames =
diff --git a/js/xpconnect/idl/nsIXPCSecurityManager.idl b/js/xpconnect/idl/nsIXPCSecurityManager.idl
index 1a12614bc919..092a6ab11d04 100644
--- a/js/xpconnect/idl/nsIXPCSecurityManager.idl
+++ b/js/xpconnect/idl/nsIXPCSecurityManager.idl
@@ -20,7 +20,7 @@ interface nsIClassInfo;
 [ptr] native JSObjectPtr(JSObject);
 [ptr] native JSStackFramePtr(JSStackFrame);
 
-[uuid(31431440-f1ce-11d2-985a-006008962422)]
+[uuid(852e1ea8-1c3f-49e1-b57c-c0f525a167d3)]
 interface nsIXPCSecurityManager : nsISupports
 {
     /**
@@ -34,8 +34,7 @@ interface nsIXPCSecurityManager : nsISupports
     void CanCreateWrapper(in JSContextPtr aJSContext,
                           in nsIIDRef aIID,
                           in nsISupports aObj,
-                          in nsIClassInfo aClassInfo,
-                          inout voidPtr aPolicy);
+                          in nsIClassInfo aClassInfo);
 
     void CanCreateInstance(in JSContextPtr aJSContext,
                            in nsCIDRef aCID);
@@ -56,6 +55,5 @@ interface nsIXPCSecurityManager : nsISupports
                    in JSObjectPtr aJSObject,
                    in nsISupports aObj,
                    in nsIClassInfo aClassInfo,
-                   in jsid aName,
-                   inout voidPtr aPolicy);
+                   in jsid aName);
 };
diff --git a/js/xpconnect/idl/nsIXPConnect.idl b/js/xpconnect/idl/nsIXPConnect.idl
index 4b476725baca..d6054fa343cd 100644
--- a/js/xpconnect/idl/nsIXPConnect.idl
+++ b/js/xpconnect/idl/nsIXPConnect.idl
@@ -60,7 +60,7 @@ interface nsIXPConnectJSObjectHolder : nsISupports
     [notxpcom, nostdcall] JSObjectPtr GetJSObject();
 };
 
-[uuid(2d08015d-7556-4f12-9e89-4c756d129310)]
+[uuid(675b01ba-397b-472a-9b80-5716376a2ec6)]
 interface nsIXPConnectWrappedNative : nsIXPConnectJSObjectHolder
 {
     /* attribute 'JSObject' inherited from nsIXPConnectJSObjectHolder */
@@ -85,13 +85,6 @@ interface nsIXPConnectWrappedNative : nsIXPConnectJSObjectHolder
      */
     void finishInitForWrappedGlobal();
 
-    /* 
-     * This returns a pointer into the instance and care should be taken
-     * to make sure the pointer is not kept past the life time of the
-     * object it points into.
-     */
-    voidPtrPtr GetSecurityInfoAddress();
-
     /*
      * NOTE: Add new IDL methods _before_ the C++ block below if you
      * add them.  Otherwise the vtable won't be what xpidl thinks it
@@ -282,7 +275,7 @@ interface nsIXPCFunctionThisTranslator : nsISupports
     { 0xbd, 0xd6, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74 } }
 %}
 
-[uuid(880be309-88a1-4e98-8621-7f7e42681b20)]
+[uuid(74109b69-de2f-4296-9e08-2a233eafa8f9)]
 interface nsIXPConnect : nsISupports
 {
 %{ C++
@@ -506,8 +499,6 @@ interface nsIXPConnect : nsISupports
     void
     rescueOrphansInScope(in JSContextPtr aJSContext, in JSObjectPtr  aScope);
 
-    void clearAllWrappedNativeSecurityPolicies();
-
     nsIXPConnectJSObjectHolder
     getWrappedNativePrototype(in JSContextPtr aJSContext,
                               in JSObjectPtr  aScope,
diff --git a/js/xpconnect/src/XPCWrappedNative.cpp b/js/xpconnect/src/XPCWrappedNative.cpp
index b88aee46839b..0029552d855d 100644
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -1643,7 +1643,7 @@ XPCWrappedNative::InitTearOff(XPCWrappedNativeTearOff* aTearOff,
     nsIXPCSecurityManager* sm = nsXPConnect::XPConnect()->GetDefaultSecurityManager();
     if (sm && NS_FAILED(sm->
                         CanCreateWrapper(cx, *iid, identity,
-                                         GetClassInfo(), GetSecurityInfoAddr()))) {
+                                         GetClassInfo()))) {
         // the security manager vetoed. It should have set an exception.
         NS_RELEASE(obj);
         aTearOff->SetInterface(nullptr);
@@ -1864,8 +1864,7 @@ XPCWrappedNative::CallMethod(XPCCallContext& ccx,
                                       ccx.GetFlattenedJSObject(),
                                       ccx.GetWrapper()->GetIdentityObject(),
                                       ccx.GetWrapper()->GetClassInfo(),
-                                      ccx.GetMember()->GetName(),
-                                      ccx.GetWrapper()->GetSecurityInfoAddr()))) {
+                                      ccx.GetMember()->GetName()))) {
         // the security manager vetoed. It should have set an exception.
         return false;
     }
@@ -2671,13 +2670,6 @@ NS_IMETHODIMP XPCWrappedNative::FinishInitForWrappedGlobal()
     return NS_OK;
 }
 
-NS_IMETHODIMP XPCWrappedNative::GetSecurityInfoAddress(void*** securityInfoAddrPtr)
-{
-    NS_ENSURE_ARG_POINTER(securityInfoAddrPtr);
-    *securityInfoAddrPtr = GetSecurityInfoAddr();
-    return NS_OK;
-}
-
 /* void debugDump (in short depth); */
 NS_IMETHODIMP XPCWrappedNative::DebugDump(int16_t depth)
 {
diff --git a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
index d890b151e9bc..abd7b96285e8 100644
--- a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
@@ -173,8 +173,7 @@ XPC_WN_DoubleWrappedGetter(JSContext *cx, unsigned argc, jsval *vp)
                                     &ccx, ccx,
                                     ccx.GetFlattenedJSObject(),
                                     wrapper->GetIdentityObject(),
-                                    wrapper->GetClassInfo(), id,
-                                    wrapper->GetSecurityInfoAddr()))) {
+                                    wrapper->GetClassInfo(), id))) {
                 // The SecurityManager should have set an exception.
                 return false;
             }
diff --git a/js/xpconnect/src/XPCWrappedNativeProto.cpp b/js/xpconnect/src/XPCWrappedNativeProto.cpp
index db564bf7098a..5edf7a2b4ceb 100644
--- a/js/xpconnect/src/XPCWrappedNativeProto.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeProto.cpp
@@ -25,7 +25,6 @@ XPCWrappedNativeProto::XPCWrappedNativeProto(XPCWrappedNativeScope* Scope,
       mClassInfo(ClassInfo),
       mClassInfoFlags(ClassInfoFlags),
       mSet(Set),
-      mSecurityInfo(nullptr),
       mScriptableInfo(nullptr)
 {
     // This native object lives as long as its associated JSObject - killed
@@ -208,7 +207,6 @@ XPCWrappedNativeProto::DebugDump(int16_t depth)
         XPC_LOG_ALWAYS(("mScope @ %x", mScope));
         XPC_LOG_ALWAYS(("mJSProtoObject @ %x", mJSProtoObject.get()));
         XPC_LOG_ALWAYS(("mSet @ %x", mSet));
-        XPC_LOG_ALWAYS(("mSecurityInfo of %x", mSecurityInfo));
         XPC_LOG_ALWAYS(("mScriptableInfo @ %x", mScriptableInfo));
         if (depth && mScriptableInfo) {
             XPC_LOG_INDENT();
diff --git a/js/xpconnect/src/XPCWrappedNativeScope.cpp b/js/xpconnect/src/XPCWrappedNativeScope.cpp
index 2c17962bb319..67bb6dc4106c 100644
--- a/js/xpconnect/src/XPCWrappedNativeScope.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeScope.cpp
@@ -545,27 +545,6 @@ XPCWrappedNativeScope::SystemIsBeingShutDown()
 
 /***************************************************************************/
 
-static PLDHashOperator
-WNProtoSecPolicyClearer(PLDHashTable *table, PLDHashEntryHdr *hdr,
-                        uint32_t number, void *arg)
-{
-    XPCWrappedNativeProto* proto =
-        ((ClassInfo2WrappedNativeProtoMap::Entry*)hdr)->value;
-    *(proto->GetSecurityInfoAddr()) = nullptr;
-    return PL_DHASH_NEXT;
-}
-
-// static
-nsresult
-XPCWrappedNativeScope::ClearAllWrappedNativeSecurityPolicies()
-{
-    for (XPCWrappedNativeScope* cur = gScopes; cur; cur = cur->mNext) {
-        cur->mWrappedNativeProtoMap->Enumerate(WNProtoSecPolicyClearer, nullptr);
-    }
-
-    return NS_OK;
-}
-
 static PLDHashOperator
 WNProtoRemover(PLDHashTable *table, PLDHashEntryHdr *hdr,
                uint32_t number, void *arg)
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index 1c893e9db937..a5af112ea910 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -876,13 +876,6 @@ nsXPConnect::SetFunctionThisTranslator(const nsIID & aIID,
     return NS_OK;
 }
 
-/* void clearAllWrappedNativeSecurityPolicies (); */
-NS_IMETHODIMP
-nsXPConnect::ClearAllWrappedNativeSecurityPolicies()
-{
-    return XPCWrappedNativeScope::ClearAllWrappedNativeSecurityPolicies();
-}
-
 NS_IMETHODIMP
 nsXPConnect::CreateSandbox(JSContext *cx, nsIPrincipal *principal,
                            nsIXPConnectJSObjectHolder **_retval)
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 249b21911746..fc8264b2fd33 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -1120,9 +1120,6 @@ public:
     static void
     MarkAllWrappedNativesAndProtos();
 
-    static nsresult
-    ClearAllWrappedNativeSecurityPolicies();
-
 #ifdef DEBUG
     static void
     ASSERT_NoInterfaceSetsAreMarked();
@@ -1836,9 +1833,6 @@ public:
     XPCNativeScriptableInfo*
     GetScriptableInfo()   {return mScriptableInfo;}
 
-    void**
-    GetSecurityInfoAddr() {return &mSecurityInfo;}
-
     uint32_t
     GetClassInfoFlags() const {return mClassInfoFlags;}
 
@@ -1929,7 +1923,6 @@ private:
     nsCOMPtr<nsIClassInfo>   mClassInfo;
     uint32_t                 mClassInfoFlags;
     XPCNativeSet*            mSet;
-    void*                    mSecurityInfo;
     XPCNativeScriptableInfo* mScriptableInfo;
 };
 
@@ -2113,10 +2106,6 @@ public:
     nsIXPCScriptable*      // call this wrong and you deserve to crash
     GetScriptableCallback() const  {return mScriptableInfo->GetCallback();}
 
-    void**
-    GetSecurityInfoAddr() {return HasProto() ?
-                                   GetProto()->GetSecurityInfoAddr() : nullptr;}
-
     nsIClassInfo*
     GetClassInfo() const {return IsValid() && HasProto() ?
                             GetProto()->GetClassInfo() : nullptr;}

From d99e6b8d97d8cc328babd58cb72a401dc526603f Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 19:15:43 -0800
Subject: [PATCH 247/459] Bug 913734 - Stop consulting domain policies in CAPS.
 r=mrbkap

The whole LookupPolicy juggernaut is basically a mechanism for setting custom
per-(protocol, origin, property, action) access control in the preferences
service.

There are two sets of preferences currently in all.js. One of them is set up
for mailnews, for the mailbox:, imap:, and news: protocols. According to jst,
this was designed as a whack-a-mole security mechanism for javascript running
in HTML email. IIUC, we no longer allow JS to run at all in mailnews, so this
is obsolete.

The other mechanism appears to be our old-fashioned implementation of the
same-origin policy, which has been obsoleted by the new compartment
architecture.

In addition, most of this stuff was obsoleted by the new dom bindings, since
these DOM classes no longer go through XPCWrappedNativeJSOps, and thus no
longer trigger these security checks at all.

We stop using the infrastructure in this patch, and rip it out in the next one.
---
 caps/src/nsScriptSecurityManager.cpp | 131 ++++++++-------------------
 1 file changed, 38 insertions(+), 93 deletions(-)

diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
index 2423d3e2a25c..58f2eb025d91 100644
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -629,69 +629,49 @@ nsScriptSecurityManager::CheckPropertyAccessImpl(uint32_t aAction,
 
     nsCOMPtr<nsIPrincipal> objectPrincipal;
 
+    // Even though security wrappers have handled our cross-origin access policy
+    // since FF4, we've still always called into this function, and have relied
+    // on the CAPS policy mechanism to manually approve each cross-origin property
+    // based on a whitelist in all.js. This whitelist has drifted out of sync
+    // with the canonical one in AccessCheck.cpp, but it's always been more
+    // permissive, so we never noticed. This machinery is going away, so for now
+    // let's just skip the check for cross-origin property accesses that we know
+    // we get right.
+    //
+    // Note that while it would be nice to just rely on aClassName here, it
+    // isn't set reliably by callers. :-(
+    const char *className = aClassName;
+    if (!className && jsObject) {
+        className = JS_GetClass(jsObject)->name;
+    }
+    if (className &&
+        (!strcmp(className, "Window") || !strcmp(className, "Location")))
+    {
+        return NS_OK;
+    }
+
     // Hold the class info data here so we don't have to go back to virtual
     // methods all the time
     ClassInfoData classInfoData(aClassInfo, aClassName);
 
-    //-- Look up the security policy for this class and subject domain
-    SecurityLevel securityLevel;
-    rv = LookupPolicy(subjectPrincipal, classInfoData, property, aAction,
-                      &securityLevel);
-    if (NS_FAILED(rv))
-        return rv;
-
-    if (securityLevel.level == SCRIPT_SECURITY_UNDEFINED_ACCESS)
-    {
-        // No policy found for this property so use the default of last resort.
-        // If we were called from somewhere other than XPConnect
-        // (no XPC call context), assume this is a DOM class. Otherwise,
-        // ask the ClassInfo.
-        if (!aCallContext || classInfoData.IsDOMClass())
-            securityLevel.level = SCRIPT_SECURITY_SAME_ORIGIN_ACCESS;
-        else
-            securityLevel.level = SCRIPT_SECURITY_NO_ACCESS;
-    }
-
-    if (SECURITY_ACCESS_LEVEL_FLAG(securityLevel))
-    // This flag means securityLevel is allAccess, noAccess, or sameOrigin
-    {
-        switch (securityLevel.level)
-        {
-        case SCRIPT_SECURITY_NO_ACCESS:
-            rv = NS_ERROR_DOM_PROP_ACCESS_DENIED;
-            break;
-
-        case SCRIPT_SECURITY_ALL_ACCESS:
-            rv = NS_OK;
-            break;
-
-        case SCRIPT_SECURITY_SAME_ORIGIN_ACCESS:
-            {
-                nsCOMPtr<nsIPrincipal> principalHolder;
-                if (jsObject)
-                {
-                    objectPrincipal = doGetObjectPrincipal(jsObject);
-                    if (!objectPrincipal)
-                        rv = NS_ERROR_DOM_SECURITY_ERR;
-                }
-                else
-                {
-                    NS_ERROR("CheckPropertyAccessImpl called without a target object or URL");
-                    return NS_ERROR_FAILURE;
-                }
-                if(NS_SUCCEEDED(rv))
-                    rv = CheckSameOriginDOMProp(subjectPrincipal, objectPrincipal,
-                                                aAction);
-                break;
-            }
-        default:
-            NS_ERROR("Bad Security Level Value");
+    // If we were called from somewhere other than XPConnect
+    // (no XPC call context), assume this is a DOM class. Otherwise,
+    // ask the ClassInfo.
+    if (aCallContext && !classInfoData.IsDOMClass()) {
+        rv = NS_ERROR_DOM_PROP_ACCESS_DENIED;
+    } else {
+        if (!jsObject) {
+            NS_ERROR("CheckPropertyAccessImpl called without a target object or URL");
             return NS_ERROR_FAILURE;
         }
-    }
-    else // if SECURITY_ACCESS_LEVEL_FLAG is false, securityLevel is a capability
-    {
-        rv = SubjectIsPrivileged() ? NS_OK : NS_ERROR_DOM_SECURITY_ERR;
+        nsCOMPtr<nsIPrincipal> principalHolder;
+        objectPrincipal = doGetObjectPrincipal(jsObject);
+        if (!objectPrincipal)
+            rv = NS_ERROR_DOM_SECURITY_ERR;
+
+        if (NS_SUCCEEDED(rv))
+            rv = CheckSameOriginDOMProp(subjectPrincipal, objectPrincipal,
+                                        aAction);
     }
 
     if (NS_SUCCEEDED(rv))
@@ -1433,19 +1413,6 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
             return NS_OK;
         }
 
-        // Now check capability policies
-        static const char loadURIPrefGroup[] = "checkloaduri";
-        ClassInfoData nameData(nullptr, loadURIPrefGroup);
-
-        SecurityLevel secLevel;
-        rv = LookupPolicy(aPrincipal, nameData, EnabledID(),
-                          nsIXPCSecurityManager::ACCESS_GET_PROPERTY, &secLevel);
-        if (NS_SUCCEEDED(rv) && secLevel.level == SCRIPT_SECURITY_ALL_ACCESS)
-        {
-            // OK for this site!
-            return NS_OK;
-        }
-
         if (reportErrors) {
             ReportError(nullptr, errorTag, sourceURI, aTargetURI);
         }
@@ -1588,29 +1555,7 @@ nsScriptSecurityManager::ScriptAllowed(JSObject *aGlobal)
     JS::RootedObject global(cx, js::UncheckedUnwrap(aGlobal, /* stopAtOuter = */ false));
 
     // Check the bits on the compartment private.
-    xpc::Scriptability& scriptability = xpc::Scriptability::Get(aGlobal);
-    if (!scriptability.Allowed()) {
-        return false;
-    }
-
-    // If the compartment is immune to script policy, we're done.
-    if (scriptability.IsImmuneToScriptPolicy()) {
-        return true;
-    }
-
-    // Check for a per-site policy.
-    static const char jsPrefGroupName[] = "javascript";
-    ClassInfoData nameData(nullptr, jsPrefGroupName);
-    SecurityLevel secLevel;
-    nsresult rv = LookupPolicy(doGetObjectPrincipal(global), nameData,
-                               EnabledID(),
-                               nsIXPCSecurityManager::ACCESS_GET_PROPERTY,
-                               &secLevel);
-    if (NS_FAILED(rv) || secLevel.level == SCRIPT_SECURITY_NO_ACCESS) {
-        return false;
-    }
-
-    return true;
+    return xpc::Scriptability::Get(aGlobal).Allowed();
 }
 
 ///////////////// Principals ///////////////////////

From 041e66aa0e2788827a2382cdabab2a18c564b510 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 19:15:43 -0800
Subject: [PATCH 248/459] Bug 913734 - Remove now-unused policy machinery.
 r=mrbkap

---
 caps/idl/nsIPrincipal.idl              |  17 +-
 caps/include/nsPrincipal.h             |   5 -
 caps/include/nsScriptSecurityManager.h | 278 -------------
 caps/src/nsNullPrincipal.cpp           |  23 -
 caps/src/nsPrincipal.cpp               |  34 +-
 caps/src/nsScriptSecurityManager.cpp   | 555 +------------------------
 caps/src/nsSystemPrincipal.cpp         |  13 -
 modules/libpref/src/init/all.js        | 166 --------
 8 files changed, 4 insertions(+), 1087 deletions(-)

diff --git a/caps/idl/nsIPrincipal.idl b/caps/idl/nsIPrincipal.idl
index 8a306bb5808c..7117b87425fa 100644
--- a/caps/idl/nsIPrincipal.idl
+++ b/caps/idl/nsIPrincipal.idl
@@ -20,7 +20,7 @@ interface nsIContentSecurityPolicy;
 [ptr] native JSPrincipals(JSPrincipals);
 [ptr] native PrincipalArray(nsTArray<nsCOMPtr<nsIPrincipal> >);
 
-[scriptable, builtinclass, uuid(551bf53d-203c-4ac4-8c0b-40aa7b5f1ad6)]
+[scriptable, builtinclass, uuid(f09d8a53-a6c8-4f68-b329-9a76a709d24e)]
 interface nsIPrincipal : nsISerializable
 {
     /**
@@ -52,21 +52,6 @@ interface nsIPrincipal : nsISerializable
      */
     [noscript] readonly attribute unsigned long hashValue;
 
-    /**
-     * The domain security policy of the principal.
-     */
-    // XXXcaa should this be here?  The script security manager is the only
-    // thing that should care about this.  Wouldn't storing this data in one
-    // of the hashtables in nsScriptSecurityManager be better?
-    // XXXbz why is this writable?  Who should have write access to this?  What
-    // happens if this principal is in our hashtable and we pass it out of the
-    // security manager and someone writes to this field?  Especially if they
-    // write garbage?  If we need to give someone other than the security
-    // manager a way to set this (which I question, since it can increase the
-    // permissions of a page) it should be a |void clearSecurityPolicy()|
-    // method.
-    [noscript] attribute voidPtr securityPolicy;
-
     /**
      * The codebase URI to which this principal pertains.  This is
      * generally the document URI.
diff --git a/caps/include/nsPrincipal.h b/caps/include/nsPrincipal.h
index 52db12bbeb78..b0e15683ed05 100644
--- a/caps/include/nsPrincipal.h
+++ b/caps/include/nsPrincipal.h
@@ -18,7 +18,6 @@
 
 class nsIObjectInputStream;
 class nsIObjectOutputStream;
-class DomainPolicy; 
 
 class nsBasePrincipal : public nsJSPrincipals
 {
@@ -31,8 +30,6 @@ protected:
 public:
   NS_IMETHOD_(nsrefcnt) AddRef(void);
   NS_IMETHOD_(nsrefcnt) Release(void);
-  NS_IMETHOD GetSecurityPolicy(void** aSecurityPolicy);
-  NS_IMETHOD SetSecurityPolicy(void* aSecurityPolicy);
   NS_IMETHOD GetCsp(nsIContentSecurityPolicy** aCsp);
   NS_IMETHOD SetCsp(nsIContentSecurityPolicy* aCsp);
 public:
@@ -45,8 +42,6 @@ protected:
   virtual void dumpImpl() = 0;
 #endif
 
-  DomainPolicy* mSecurityPolicy;
-
   nsCOMPtr<nsIContentSecurityPolicy> mCSP;
 };
 
diff --git a/caps/include/nsScriptSecurityManager.h b/caps/include/nsScriptSecurityManager.h
index df145562f769..d79a9f33865e 100644
--- a/caps/include/nsScriptSecurityManager.h
+++ b/caps/include/nsScriptSecurityManager.h
@@ -28,266 +28,7 @@ class nsIClassInfo;
 class nsIIOService;
 class nsIStringBundle;
 class nsSystemPrincipal;
-struct ClassPolicy;
 class ClassInfoData;
-class DomainPolicy;
-
-/////////////////////
-// PrincipalKey //
-/////////////////////
-
-class PrincipalKey : public PLDHashEntryHdr
-{
-public:
-    typedef const nsIPrincipal* KeyType;
-    typedef const nsIPrincipal* KeyTypePointer;
-
-    PrincipalKey(const nsIPrincipal* key)
-      : mKey(const_cast<nsIPrincipal*>(key))
-    {
-    }
-
-    PrincipalKey(const PrincipalKey& toCopy)
-      : mKey(toCopy.mKey)
-    {
-    } 
-
-    ~PrincipalKey()
-    {
-    }
-
-    KeyType GetKey() const
-    {
-        return mKey;
-    }
-
-    bool KeyEquals(KeyTypePointer aKey) const
-    {
-        bool eq;
-        mKey->Equals(const_cast<nsIPrincipal*>(aKey),
-                     &eq);
-        return eq;
-    }
-
-    static KeyTypePointer KeyToPointer(KeyType aKey)
-    {
-        return aKey;
-    }
-
-    static PLDHashNumber HashKey(KeyTypePointer aKey)
-    {
-        uint32_t hash;
-        const_cast<nsIPrincipal*>(aKey)->GetHashValue(&hash);
-        return PLDHashNumber(hash);
-    }
-
-    enum { ALLOW_MEMMOVE = true };
-
-private:
-    nsCOMPtr<nsIPrincipal> mKey;
-};
-
-////////////////////
-// Policy Storage //
-////////////////////
-
-// Property Policy
-union SecurityLevel
-{
-    intptr_t   level;
-    char*      capability;
-};
-
-// Security levels
-// These values all have the low bit set (except UNDEFINED_ACCESS)
-// to distinguish them from pointer values, because no pointer
-// to allocated memory ever has the low bit set. A SecurityLevel
-// contains either one of these constants or a pointer to a string
-// representing the name of a capability.
-
-#define SCRIPT_SECURITY_UNDEFINED_ACCESS 0
-#define SCRIPT_SECURITY_ACCESS_IS_SET_BIT 1
-#define SCRIPT_SECURITY_NO_ACCESS \
-  ((1 << 0) | SCRIPT_SECURITY_ACCESS_IS_SET_BIT)
-#define SCRIPT_SECURITY_SAME_ORIGIN_ACCESS \
-  ((1 << 1) | SCRIPT_SECURITY_ACCESS_IS_SET_BIT)
-#define SCRIPT_SECURITY_ALL_ACCESS \
-  ((1 << 2) | SCRIPT_SECURITY_ACCESS_IS_SET_BIT)
-
-#define SECURITY_ACCESS_LEVEL_FLAG(_sl) \
-           ((_sl.level == 0) || \
-            (_sl.level & SCRIPT_SECURITY_ACCESS_IS_SET_BIT))
-
-
-struct PropertyPolicy : public PLDHashEntryHdr
-{
-    JSString       *key;  // interned string
-    SecurityLevel  mGet;
-    SecurityLevel  mSet;
-};
-
-static bool
-InitPropertyPolicyEntry(PLDHashTable *table,
-                     PLDHashEntryHdr *entry,
-                     const void *key)
-{
-    PropertyPolicy* pp = (PropertyPolicy*)entry;
-    pp->key = (JSString *)key;
-    pp->mGet.level = SCRIPT_SECURITY_UNDEFINED_ACCESS;
-    pp->mSet.level = SCRIPT_SECURITY_UNDEFINED_ACCESS;
-    return true;
-}
-
-static void
-ClearPropertyPolicyEntry(PLDHashTable *table, PLDHashEntryHdr *entry)
-{
-    PropertyPolicy* pp = (PropertyPolicy*)entry;
-    pp->key = nullptr;
-}
-
-// Class Policy
-#define NO_POLICY_FOR_CLASS (ClassPolicy*)1
-
-struct ClassPolicy : public PLDHashEntryHdr
-{
-    char* key;
-    PLDHashTable* mPolicy;
-
-    // Note: the DomainPolicy owns us, so if if dies we will too.  Hence no
-    // need to refcount it here (and in fact, we'd probably leak if we tried).
-    DomainPolicy* mDomainWeAreWildcardFor;
-};
-
-static void
-ClearClassPolicyEntry(PLDHashTable *table, PLDHashEntryHdr *entry)
-{
-    ClassPolicy* cp = (ClassPolicy *)entry;
-    if (cp->key)
-    {
-        PL_strfree(cp->key);
-        cp->key = nullptr;
-    }
-    PL_DHashTableDestroy(cp->mPolicy);
-}
-
-// Note: actual impl is going to be after the DomainPolicy class definition,
-// since we need to access members of DomainPolicy in the impl
-static void
-MoveClassPolicyEntry(PLDHashTable *table,
-                     const PLDHashEntryHdr *from,
-                     PLDHashEntryHdr *to);
-
-static bool
-InitClassPolicyEntry(PLDHashTable *table,
-                     PLDHashEntryHdr *entry,
-                     const void *key)
-{
-    static PLDHashTableOps classPolicyOps =
-    {
-        PL_DHashAllocTable,
-        PL_DHashFreeTable,
-        PL_DHashVoidPtrKeyStub,
-        PL_DHashMatchEntryStub,
-        PL_DHashMoveEntryStub,
-        ClearPropertyPolicyEntry,
-        PL_DHashFinalizeStub,
-        InitPropertyPolicyEntry
-    };
-
-    ClassPolicy* cp = (ClassPolicy*)entry;
-    cp->mDomainWeAreWildcardFor = nullptr;
-    cp->key = PL_strdup((const char*)key);
-    if (!cp->key)
-        return false;
-    cp->mPolicy = PL_NewDHashTable(&classPolicyOps, nullptr,
-                                   sizeof(PropertyPolicy), 16);
-    if (!cp->mPolicy) {
-        PL_strfree(cp->key);
-        cp->key = nullptr;
-        return false;
-    }
-    return true;
-}
-
-// Domain Policy
-class DomainPolicy : public PLDHashTable
-{
-public:
-    DomainPolicy() : mWildcardPolicy(nullptr),
-                     mRefCount(0)
-    {
-        mGeneration = sGeneration;
-    }
-
-    bool Init()
-    {
-        static const PLDHashTableOps domainPolicyOps =
-        {
-            PL_DHashAllocTable,
-            PL_DHashFreeTable,
-            PL_DHashStringKey,
-            PL_DHashMatchStringKey,
-            MoveClassPolicyEntry,
-            ClearClassPolicyEntry,
-            PL_DHashFinalizeStub,
-            InitClassPolicyEntry
-        };
-
-        return PL_DHashTableInit(this, &domainPolicyOps, nullptr,
-                                 sizeof(ClassPolicy), 16);
-    }
-
-    ~DomainPolicy()
-    {
-        PL_DHashTableFinish(this);
-        NS_ASSERTION(mRefCount == 0, "Wrong refcount in DomainPolicy dtor");
-    }
-
-    void Hold()
-    {
-        mRefCount++;
-    }
-
-    void Drop()
-    {
-        if (--mRefCount == 0)
-            delete this;
-    }
-    
-    static void InvalidateAll()
-    {
-        sGeneration++;
-    }
-    
-    bool IsInvalid()
-    {
-        return mGeneration != sGeneration; 
-    }
-    
-    ClassPolicy* mWildcardPolicy;
-
-private:
-    uint32_t mRefCount;
-    uint32_t mGeneration;
-    static uint32_t sGeneration;
-};
-
-static void
-MoveClassPolicyEntry(PLDHashTable *table,
-                     const PLDHashEntryHdr *from,
-                     PLDHashEntryHdr *to)
-{
-    memcpy(to, from, table->entrySize);
-
-    // Now update the mDefaultPolicy pointer that points to us, if any.
-    ClassPolicy* cp = static_cast<ClassPolicy*>(to);
-    if (cp->mDomainWeAreWildcardFor) {
-        NS_ASSERTION(cp->mDomainWeAreWildcardFor->mWildcardPolicy ==
-                     static_cast<const ClassPolicy*>(from),
-                     "Unexpected wildcard policy on mDomainWeAreWildcardFor");
-        cp->mDomainWeAreWildcardFor->mWildcardPolicy = cp;
-    }
-}
 
 /////////////////////////////
 // nsScriptSecurityManager //
@@ -403,13 +144,6 @@ private:
                            nsIPrincipal* aObject,
                            uint32_t aAction);
 
-    nsresult
-    LookupPolicy(nsIPrincipal* principal,
-                 ClassInfoData& aClassData,
-                 JS::Handle<jsid> aProperty,
-                 uint32_t aAction,
-                 SecurityLevel* result);
-
     nsresult
     GetCodebasePrincipalInternal(nsIURI* aURI, uint32_t aAppId,
                                  bool aInMozBrowser,
@@ -468,24 +202,12 @@ private:
     nsresult
     InitPrefs();
 
-    nsresult
-    InitPolicies();
-
-    nsresult
-    InitDomainPolicy(JSContext* cx, const char* aPolicyName,
-                     DomainPolicy* aDomainPolicy);
-
     inline void
     ScriptSecurityPrefChanged();
 
-    nsObjectHashtable* mOriginToPolicyMap;
-    DomainPolicy* mDefaultPolicy;
-    nsObjectHashtable* mCapabilities;
-
     nsCOMPtr<nsIPrincipal> mSystemPrincipal;
     bool mPrefInitialized;
     bool mIsJavaScriptEnabled;
-    bool mPolicyPrefsChanged;
 
     // This machinery controls new-style domain policies. The old-style
     // policy machinery will be removed soon.
diff --git a/caps/src/nsNullPrincipal.cpp b/caps/src/nsNullPrincipal.cpp
index 9d67930f34b8..8fc74e16e6ca 100644
--- a/caps/src/nsNullPrincipal.cpp
+++ b/caps/src/nsNullPrincipal.cpp
@@ -146,29 +146,6 @@ nsNullPrincipal::GetHashValue(uint32_t *aResult)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsNullPrincipal::GetSecurityPolicy(void** aSecurityPolicy)
-{
-  // Leftover from old security model, a "security policy" is a set of
-  // rules for property access that can override the SOP. Policies are
-  // associated with origins and since nsNullPinricipals never get the
-  // same origin twice, it's not possible to specify a "security
-  // policy" for it.  Hence, we do not cache the security policy.
-  *aSecurityPolicy = nullptr;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsNullPrincipal::SetSecurityPolicy(void* aSecurityPolicy)
-{
-  // Leftover from old security model, a "security policy" is a set of
-  // rules for property access that can override the SOP. Policies are
-  // associated with origins and since nsNullPinricipals never get the
-  // same origin twice, it's not possible to specify a "security
-  // policy" for it.  Hence, we do not cache the security policy.
-  return NS_OK;
-}
-
 NS_IMETHODIMP 
 nsNullPrincipal::GetURI(nsIURI** aURI)
 {
diff --git a/caps/src/nsPrincipal.cpp b/caps/src/nsPrincipal.cpp
index 21b44f3b045b..77e21a964dc1 100644
--- a/caps/src/nsPrincipal.cpp
+++ b/caps/src/nsPrincipal.cpp
@@ -69,7 +69,7 @@ nsBasePrincipal::Release()
   return count;
 }
 
-nsBasePrincipal::nsBasePrincipal() : mSecurityPolicy(nullptr)
+nsBasePrincipal::nsBasePrincipal()
 {
   if (!gIsObservingCodeBasePrincipalSupport) {
     nsresult rv =
@@ -84,31 +84,6 @@ nsBasePrincipal::nsBasePrincipal() : mSecurityPolicy(nullptr)
 
 nsBasePrincipal::~nsBasePrincipal(void)
 {
-  SetSecurityPolicy(nullptr); 
-}
-
-NS_IMETHODIMP
-nsBasePrincipal::GetSecurityPolicy(void** aSecurityPolicy)
-{
-  if (mSecurityPolicy && mSecurityPolicy->IsInvalid()) 
-    SetSecurityPolicy(nullptr);
-  
-  *aSecurityPolicy = (void *) mSecurityPolicy;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsBasePrincipal::SetSecurityPolicy(void* aSecurityPolicy)
-{
-  DomainPolicy *newPolicy = reinterpret_cast<DomainPolicy *>(aSecurityPolicy);
-  if (newPolicy)
-    newPolicy->Hold();
- 
-  if (mSecurityPolicy)
-    mSecurityPolicy->Drop();
-  
-  mSecurityPolicy = newPolicy;
-  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -406,9 +381,6 @@ nsPrincipal::SetDomain(nsIURI* aDomain)
   mDomain = NS_TryToMakeImmutable(aDomain);
   mDomainImmutable = URIIsImmutable(mDomain);
 
-  // Domain has changed, forget cached security policy
-  SetSecurityPolicy(nullptr);
-
   // Recompute all wrappers between compartments using this principal and other
   // non-chrome compartments.
   AutoSafeJSContext cx;
@@ -532,10 +504,6 @@ nsPrincipal::Write(nsIObjectOutputStream* aStream)
 {
   NS_ENSURE_STATE(mCodebase);
 
-  // mSecurityPolicy is an optimization; it'll get looked up again as needed.
-  // Don't bother saving and restoring it, esp. since it might change if
-  // preferences change.
-
   nsresult rv = NS_WriteOptionalCompoundObject(aStream, mCodebase, NS_GET_IID(nsIURI),
                                                true);
   if (NS_FAILED(rv)) {
diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
index 58f2eb025d91..95756678b067 100644
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -195,9 +195,6 @@ inline void SetPendingException(JSContext *cx, const PRUnichar *aMsg)
     JS_ReportError(cx, "%hs", aMsg);
 }
 
-// DomainPolicy members
-uint32_t DomainPolicy::sGeneration = 0;
-
 // Helper class to get stuff from the ClassInfo and not waste extra time with
 // virtual method calls for things it has already gotten
 class ClassInfoData
@@ -348,71 +345,6 @@ nsScriptSecurityManager::GetCxSubjectPrincipal(JSContext *cx)
     return principal;
 }
 
-////////////////////
-// Policy Storage //
-////////////////////
-
-// Table of security levels
-static bool
-DeleteCapability(nsHashKey *aKey, void *aData, void* closure)
-{
-    NS_Free(aData);
-    return true;
-}
-
-//-- Per-Domain Policy - applies to one or more protocols or hosts
-struct DomainEntry
-{
-    DomainEntry(const char* aOrigin,
-                DomainPolicy* aDomainPolicy) : mOrigin(aOrigin),
-                                               mDomainPolicy(aDomainPolicy),
-                                               mNext(nullptr)
-    {
-        mDomainPolicy->Hold();
-    }
-
-    ~DomainEntry()
-    {
-        mDomainPolicy->Drop();
-    }
-
-    bool Matches(const char *anOrigin)
-    {
-        int len = strlen(anOrigin);
-        int thisLen = mOrigin.Length();
-        if (len < thisLen)
-            return false;
-        if (mOrigin.RFindChar(':', thisLen-1, 1) != -1)
-        //-- Policy applies to all URLs of this scheme, compare scheme only
-            return mOrigin.EqualsIgnoreCase(anOrigin, thisLen);
-
-        //-- Policy applies to a particular host; compare domains
-        if (!mOrigin.Equals(anOrigin + (len - thisLen)))
-            return false;
-        if (len == thisLen)
-            return true;
-        char charBefore = anOrigin[len-thisLen-1];
-        return (charBefore == '.' || charBefore == ':' || charBefore == '/');
-    }
-
-    nsCString         mOrigin;
-    DomainPolicy*     mDomainPolicy;
-    DomainEntry*      mNext;
-};
-
-static bool
-DeleteDomainEntry(nsHashKey *aKey, void *aData, void* closure)
-{
-    DomainEntry *entry = (DomainEntry*) aData;
-    do
-    {
-        DomainEntry *next = entry->mNext;
-        delete entry;
-        entry = next;
-    } while (entry);
-    return true;
-}
-
 /////////////////////////////
 // nsScriptSecurityManager //
 /////////////////////////////
@@ -957,186 +889,6 @@ nsScriptSecurityManager::CheckSameOriginDOMProp(nsIPrincipal* aSubject,
     return NS_ERROR_DOM_PROP_ACCESS_DENIED;
 }
 
-nsresult
-nsScriptSecurityManager::LookupPolicy(nsIPrincipal* aPrincipal,
-                                      ClassInfoData& aClassData,
-                                      JS::Handle<jsid> aProperty,
-                                      uint32_t aAction,
-                                      SecurityLevel* result)
-{
-    AutoJSContext cx;
-    nsresult rv;
-    JS::RootedId property(cx, aProperty);
-    result->level = SCRIPT_SECURITY_UNDEFINED_ACCESS;
-
-    DomainPolicy* dpolicy = nullptr;
-    //-- Initialize policies if necessary
-    if (mPolicyPrefsChanged)
-    {
-        if (!mPrefInitialized) {
-            rv = InitPrefs();
-            NS_ENSURE_SUCCESS(rv, rv);
-        }
-        rv = InitPolicies();
-        if (NS_FAILED(rv))
-            return rv;
-    }
-    else
-    {
-        aPrincipal->GetSecurityPolicy((void**)&dpolicy);
-    }
-
-    if (!dpolicy && mOriginToPolicyMap)
-    {
-        //-- Look up the relevant domain policy, if any
-        if (nsCOMPtr<nsIExpandedPrincipal> exp = do_QueryInterface(aPrincipal)) 
-        {
-            // For expanded principals domain origin is not defined so let's just
-            // use the default policy
-            dpolicy = mDefaultPolicy;
-        }
-        else
-        {
-            nsAutoCString origin;
-            rv = GetPrincipalDomainOrigin(aPrincipal, origin);
-            NS_ENSURE_SUCCESS(rv, rv);
- 
-            char *start = origin.BeginWriting();
-            const char *nextToLastDot = nullptr;
-            const char *lastDot = nullptr;
-            const char *colon = nullptr;
-            char *p = start;
-
-            //-- search domain (stop at the end of the string or at the 3rd slash)
-            for (uint32_t slashes=0; *p; p++)
-            {
-                if (*p == '/' && ++slashes == 3) 
-                {
-                    *p = '\0'; // truncate at 3rd slash
-                    break;
-                }
-                if (*p == '.')
-                {
-                    nextToLastDot = lastDot;
-                    lastDot = p;
-                } 
-                else if (!colon && *p == ':')
-                    colon = p;
-            }
-
-            nsCStringKey key(nextToLastDot ? nextToLastDot+1 : start);
-            DomainEntry *de = (DomainEntry*) mOriginToPolicyMap->Get(&key);
-            if (!de)
-            {
-                nsAutoCString scheme(start, colon-start+1);
-                nsCStringKey schemeKey(scheme);
-                de = (DomainEntry*) mOriginToPolicyMap->Get(&schemeKey);
-            }
-
-            while (de)
-            {
-                if (de->Matches(start))
-                {
-                    dpolicy = de->mDomainPolicy;
-                    break;
-                }
-                de = de->mNext;
-            }
-
-            if (!dpolicy)
-                dpolicy = mDefaultPolicy;
-        }
-
-        aPrincipal->SetSecurityPolicy((void*)dpolicy);
-    }
-
-    ClassPolicy* cpolicy = static_cast<ClassPolicy*>
-                             (PL_DHashTableOperate(dpolicy,
-                                                      aClassData.GetName(),
-                                                      PL_DHASH_LOOKUP));
-
-    if (PL_DHASH_ENTRY_IS_FREE(cpolicy))
-        cpolicy = NO_POLICY_FOR_CLASS;
-
-    NS_ASSERTION(JSID_IS_INT(property) || JSID_IS_OBJECT(property) ||
-                 JSID_IS_STRING(property), "Property must be a valid id");
-
-    // Only atomized strings are stored in the policies' hash tables.
-    if (!JSID_IS_STRING(property))
-        return NS_OK;
-
-    JS::RootedString propertyKey(cx, JSID_TO_STRING(property));
-
-    // We look for a PropertyPolicy in the following places:
-    // 1)  The ClassPolicy for our class we got from our DomainPolicy
-    // 2)  The mWildcardPolicy of our DomainPolicy
-    // 3)  The ClassPolicy for our class we got from mDefaultPolicy
-    // 4)  The mWildcardPolicy of our mDefaultPolicy
-    PropertyPolicy* ppolicy = nullptr;
-    if (cpolicy != NO_POLICY_FOR_CLASS)
-    {
-        ppolicy = static_cast<PropertyPolicy*>
-                             (PL_DHashTableOperate(cpolicy->mPolicy,
-                                                      propertyKey,
-                                                      PL_DHASH_LOOKUP));
-    }
-
-    // If there is no class policy for this property, and we have a wildcard
-    // policy, try that.
-    if (dpolicy->mWildcardPolicy &&
-        (!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy)))
-    {
-        ppolicy =
-            static_cast<PropertyPolicy*>
-                       (PL_DHashTableOperate(dpolicy->mWildcardPolicy->mPolicy,
-                                                propertyKey,
-                                                PL_DHASH_LOOKUP));
-    }
-
-    // If dpolicy is not the defauly policy and there's no class or wildcard
-    // policy for this property, check the default policy for this class and
-    // the default wildcard policy
-    if (dpolicy != mDefaultPolicy &&
-        (!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy)))
-    {
-        cpolicy = static_cast<ClassPolicy*>
-                             (PL_DHashTableOperate(mDefaultPolicy,
-                                                      aClassData.GetName(),
-                                                      PL_DHASH_LOOKUP));
-
-        if (PL_DHASH_ENTRY_IS_BUSY(cpolicy))
-        {
-            ppolicy =
-                static_cast<PropertyPolicy*>
-                           (PL_DHashTableOperate(cpolicy->mPolicy,
-                                                    propertyKey,
-                                                    PL_DHASH_LOOKUP));
-        }
-
-        if ((!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy)) &&
-            mDefaultPolicy->mWildcardPolicy)
-        {
-            ppolicy =
-              static_cast<PropertyPolicy*>
-                         (PL_DHashTableOperate(mDefaultPolicy->mWildcardPolicy->mPolicy,
-                                                  propertyKey,
-                                                  PL_DHASH_LOOKUP));
-        }
-    }
-
-    if (!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy))
-        return NS_OK;
-
-    // Get the correct security level from the property policy
-    if (aAction == nsIXPCSecurityManager::ACCESS_SET_PROPERTY)
-        *result = ppolicy->mSet;
-    else
-        *result = ppolicy->mGet;
-
-    return NS_OK;
-}
-
-
 NS_IMETHODIMP
 nsScriptSecurityManager::CheckLoadURIFromScript(JSContext *cx, nsIURI *aURI)
 {
@@ -1985,12 +1737,10 @@ nsScriptSecurityManager::AsyncOnChannelRedirect(nsIChannel* oldChannel,
 const char sJSEnabledPrefName[] = "javascript.enabled";
 const char sFileOriginPolicyPrefName[] =
     "security.fileuri.strict_origin_policy";
-static const char sPolicyPrefix[] = "capability.policy.";
 
 static const char* kObservedPrefs[] = {
   sJSEnabledPrefName,
   sFileOriginPolicyPrefName,
-  sPolicyPrefix,
   nullptr
 };
 
@@ -2010,11 +1760,6 @@ nsScriptSecurityManager::Observe(nsISupports* aObject, const char* aTopic,
     {
         ScriptSecurityPrefChanged();
     }
-    else if (PL_strncmp(message, sPolicyPrefix, sizeof(sPolicyPrefix)-1) == 0)
-    {
-        // This will force re-initialization of the pref table
-        mPolicyPrefsChanged = true;
-    }
     return rv;
 }
 
@@ -2022,12 +1767,8 @@ nsScriptSecurityManager::Observe(nsISupports* aObject, const char* aTopic,
 // Constructor, Destructor, Initialization //
 /////////////////////////////////////////////
 nsScriptSecurityManager::nsScriptSecurityManager(void)
-    : mOriginToPolicyMap(nullptr),
-      mDefaultPolicy(nullptr),
-      mCapabilities(nullptr),
-      mPrefInitialized(false),
-      mIsJavaScriptEnabled(false),
-      mPolicyPrefsChanged(true)
+    : mPrefInitialized(false)
+    , mIsJavaScriptEnabled(false)
 {
     static_assert(sizeof(intptr_t) == sizeof(void*),
                   "intptr_t and void* have different lengths on this platform. "
@@ -2079,10 +1820,6 @@ static StaticRefPtr<nsScriptSecurityManager> gScriptSecMan;
 nsScriptSecurityManager::~nsScriptSecurityManager(void)
 {
     Preferences::RemoveObservers(this, kObservedPrefs);
-    delete mOriginToPolicyMap;
-    if(mDefaultPolicy)
-        mDefaultPolicy->Drop();
-    delete mCapabilities;
     if (mDomainPolicy)
         mDomainPolicy->Deactivate();
     MOZ_ASSERT(!mDomainPolicy);
@@ -2140,294 +1877,6 @@ nsScriptSecurityManager::SystemPrincipalSingletonConstructor()
     return static_cast<nsSystemPrincipal*>(sysprin);
 }
 
-nsresult
-nsScriptSecurityManager::InitPolicies()
-{
-    //-- Clear mOriginToPolicyMap: delete mapped DomainEntry items,
-    //-- whose dtor decrements refcount of stored DomainPolicy object
-    delete mOriginToPolicyMap;
-    
-    //-- Marks all the survivor DomainPolicy objects (those cached
-    //-- by nsPrincipal objects) as invalid: they will be released
-    //-- on first nsPrincipal::GetSecurityPolicy() attempt.
-    DomainPolicy::InvalidateAll();
-    
-    //-- Release old default policy
-    if(mDefaultPolicy) {
-        mDefaultPolicy->Drop();
-        mDefaultPolicy = nullptr;
-    }
-    
-    //-- Initialize a new mOriginToPolicyMap
-    mOriginToPolicyMap =
-      new nsObjectHashtable(nullptr, nullptr, DeleteDomainEntry, nullptr);
-    if (!mOriginToPolicyMap)
-        return NS_ERROR_OUT_OF_MEMORY;
-
-    //-- Create, refcount and initialize a new default policy 
-    mDefaultPolicy = new DomainPolicy();
-    if (!mDefaultPolicy)
-        return NS_ERROR_OUT_OF_MEMORY;
-
-    mDefaultPolicy->Hold();
-    if (!mDefaultPolicy->Init())
-        return NS_ERROR_UNEXPECTED;
-
-    //-- Initialize the table of security levels
-    if (!mCapabilities)
-    {
-        mCapabilities = 
-          new nsObjectHashtable(nullptr, nullptr, DeleteCapability, nullptr);
-        if (!mCapabilities)
-            return NS_ERROR_OUT_OF_MEMORY;
-    }
-
-    // Get a JS context - we need it to create internalized strings later.
-    AutoSafeJSContext cx;
-    nsresult rv = InitDomainPolicy(cx, "default", mDefaultPolicy);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsAdoptingCString policyNames =
-        Preferences::GetCString("capability.policy.policynames");
-
-    nsAdoptingCString defaultPolicyNames =
-        Preferences::GetCString("capability.policy.default_policynames");
-    policyNames += NS_LITERAL_CSTRING(" ") + defaultPolicyNames;
-
-    //-- Initialize domain policies
-    char* policyCurrent = policyNames.BeginWriting();
-    bool morePolicies = true;
-    while (morePolicies)
-    {
-        while(*policyCurrent == ' ' || *policyCurrent == ',')
-            policyCurrent++;
-        if (*policyCurrent == '\0')
-            break;
-        char* nameBegin = policyCurrent;
-
-        while(*policyCurrent != '\0' && *policyCurrent != ' ' && *policyCurrent != ',')
-            policyCurrent++;
-
-        morePolicies = (*policyCurrent != '\0');
-        *policyCurrent = '\0';
-        policyCurrent++;
-
-        nsAutoCString sitesPrefName(
-            NS_LITERAL_CSTRING(sPolicyPrefix) +
-            nsDependentCString(nameBegin) +
-            NS_LITERAL_CSTRING(".sites"));
-        nsAdoptingCString domainList =
-            Preferences::GetCString(sitesPrefName.get());
-        if (!domainList) {
-            continue;
-        }
-
-        DomainPolicy* domainPolicy = new DomainPolicy();
-        if (!domainPolicy)
-            return NS_ERROR_OUT_OF_MEMORY;
-
-        if (!domainPolicy->Init())
-        {
-            delete domainPolicy;
-            return NS_ERROR_UNEXPECTED;
-        }
-        domainPolicy->Hold();
-        //-- Parse list of sites and create an entry in mOriginToPolicyMap for each
-        char* domainStart = domainList.BeginWriting();
-        char* domainCurrent = domainStart;
-        char* lastDot = nullptr;
-        char* nextToLastDot = nullptr;
-        bool moreDomains = true;
-        while (moreDomains)
-        {
-            if (*domainCurrent == ' ' || *domainCurrent == '\0')
-            {
-                moreDomains = (*domainCurrent != '\0');
-                *domainCurrent = '\0';
-                nsCStringKey key(nextToLastDot ? nextToLastDot+1 : domainStart);
-                DomainEntry *newEntry = new DomainEntry(domainStart, domainPolicy);
-                if (!newEntry)
-                {
-                    domainPolicy->Drop();
-                    return NS_ERROR_OUT_OF_MEMORY;
-                }
-                DomainEntry *existingEntry = (DomainEntry *)
-                    mOriginToPolicyMap->Get(&key);
-                if (!existingEntry)
-                    mOriginToPolicyMap->Put(&key, newEntry);
-                else
-                {
-                    if (existingEntry->Matches(domainStart))
-                    {
-                        newEntry->mNext = existingEntry;
-                        mOriginToPolicyMap->Put(&key, newEntry);
-                    }
-                    else
-                    {
-                        while (existingEntry->mNext)
-                        {
-                            if (existingEntry->mNext->Matches(domainStart))
-                            {
-                                newEntry->mNext = existingEntry->mNext;
-                                existingEntry->mNext = newEntry;
-                                break;
-                            }
-                            existingEntry = existingEntry->mNext;
-                        }
-                        if (!existingEntry->mNext)
-                            existingEntry->mNext = newEntry;
-                    }
-                }
-                domainStart = domainCurrent + 1;
-                lastDot = nextToLastDot = nullptr;
-            }
-            else if (*domainCurrent == '.')
-            {
-                nextToLastDot = lastDot;
-                lastDot = domainCurrent;
-            }
-            domainCurrent++;
-        }
-
-        rv = InitDomainPolicy(cx, nameBegin, domainPolicy);
-        domainPolicy->Drop();
-        if (NS_FAILED(rv))
-            return rv;
-    }
-
-    // Reset the "dirty" flag
-    mPolicyPrefsChanged = false;
-
-    return NS_OK;
-}
-
-
-nsresult
-nsScriptSecurityManager::InitDomainPolicy(JSContext* cx,
-                                          const char* aPolicyName,
-                                          DomainPolicy* aDomainPolicy)
-{
-    nsresult rv;
-    nsAutoCString policyPrefix(NS_LITERAL_CSTRING(sPolicyPrefix) +
-                               nsDependentCString(aPolicyName) +
-                               NS_LITERAL_CSTRING("."));
-    uint32_t prefixLength = policyPrefix.Length() - 1; // subtract the '.'
-
-    uint32_t prefCount;
-    char** prefNames;
-    nsIPrefBranch* branch = Preferences::GetRootBranch();
-    NS_ASSERTION(branch, "failed to get the root pref branch");
-    rv = branch->GetChildList(policyPrefix.get(), &prefCount, &prefNames);
-    if (NS_FAILED(rv)) return rv;
-    if (prefCount == 0)
-        return NS_OK;
-
-    //-- Populate the policy
-    uint32_t currentPref = 0;
-    for (; currentPref < prefCount; currentPref++)
-    {
-        // Get the class name
-        const char* start = prefNames[currentPref] + prefixLength + 1;
-        char* end = PL_strchr(start, '.');
-        if (!end) // malformed pref, bail on this one
-            continue;
-        static const char sitesStr[] = "sites";
-
-        // We dealt with "sites" in InitPolicies(), so no need to do
-        // that again...
-        if (PL_strncmp(start, sitesStr, sizeof(sitesStr)-1) == 0)
-            continue;
-
-        // Get the pref value
-        nsAdoptingCString prefValue =
-            Preferences::GetCString(prefNames[currentPref]);
-        if (!prefValue) {
-            continue;
-        }
-
-        SecurityLevel secLevel;
-        if (PL_strcasecmp(prefValue, "noAccess") == 0)
-            secLevel.level = SCRIPT_SECURITY_NO_ACCESS;
-        else if (PL_strcasecmp(prefValue, "allAccess") == 0)
-            secLevel.level = SCRIPT_SECURITY_ALL_ACCESS;
-        else if (PL_strcasecmp(prefValue, "sameOrigin") == 0)
-            secLevel.level = SCRIPT_SECURITY_SAME_ORIGIN_ACCESS;
-        else 
-        {  //-- pref value is the name of a capability
-            nsCStringKey secLevelKey(prefValue);
-            secLevel.capability =
-                reinterpret_cast<char*>(mCapabilities->Get(&secLevelKey));
-            if (!secLevel.capability)
-            {
-                secLevel.capability = NS_strdup(prefValue);
-                if (!secLevel.capability)
-                    break;
-                mCapabilities->Put(&secLevelKey, 
-                                   secLevel.capability);
-            }
-        }
-
-        *end = '\0';
-        // Find or store this class in the classes table
-        ClassPolicy* cpolicy = 
-          static_cast<ClassPolicy*>
-                     (PL_DHashTableOperate(aDomainPolicy, start,
-                                              PL_DHASH_ADD));
-        if (!cpolicy)
-            break;
-
-        // If this is the wildcard class (class '*'), save it in mWildcardPolicy
-        // (we leave it stored in the hashtable too to take care of the cleanup)
-        if ((*start == '*') && (end == start + 1)) {
-            aDomainPolicy->mWildcardPolicy = cpolicy;
-
-            // Make sure that cpolicy knows about aDomainPolicy so it can reset
-            // the mWildcardPolicy pointer as needed if it gets moved in the
-            // hashtable.
-            cpolicy->mDomainWeAreWildcardFor = aDomainPolicy;
-        }
-
-        // Get the property name
-        start = end + 1;
-        end = PL_strchr(start, '.');
-        if (end)
-            *end = '\0';
-
-        JSString* propertyKey = ::JS_InternString(cx, start);
-        if (!propertyKey)
-            return NS_ERROR_OUT_OF_MEMORY;
-
-        // Store this property in the class policy
-        PropertyPolicy* ppolicy = 
-          static_cast<PropertyPolicy*>
-                     (PL_DHashTableOperate(cpolicy->mPolicy, propertyKey,
-                                              PL_DHASH_ADD));
-        if (!ppolicy)
-            break;
-
-        if (end) // The pref specifies an access mode
-        {
-            start = end + 1;
-            if (PL_strcasecmp(start, "set") == 0)
-                ppolicy->mSet = secLevel;
-            else
-                ppolicy->mGet = secLevel;
-        }
-        else
-        {
-            if (ppolicy->mGet.level == SCRIPT_SECURITY_UNDEFINED_ACCESS)
-                ppolicy->mGet = secLevel;
-            if (ppolicy->mSet.level == SCRIPT_SECURITY_UNDEFINED_ACCESS)
-                ppolicy->mSet = secLevel;
-        }
-    }
-
-    NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(prefCount, prefNames);
-    if (currentPref < prefCount) // Loop exited early because of out-of-memory error
-        return NS_ERROR_OUT_OF_MEMORY;
-    return NS_OK;
-}
-
 inline void
 nsScriptSecurityManager::ScriptSecurityPrefChanged()
 {
diff --git a/caps/src/nsSystemPrincipal.cpp b/caps/src/nsSystemPrincipal.cpp
index 3e270bd2d64e..b5ae0421cb00 100644
--- a/caps/src/nsSystemPrincipal.cpp
+++ b/caps/src/nsSystemPrincipal.cpp
@@ -152,19 +152,6 @@ nsSystemPrincipal::SetDomain(nsIURI* aDomain)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsSystemPrincipal::GetSecurityPolicy(void** aSecurityPolicy)
-{
-    *aSecurityPolicy = nullptr;
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsSystemPrincipal::SetSecurityPolicy(void* aSecurityPolicy)
-{
-    return NS_OK;
-}
-
 NS_IMETHODIMP
 nsSystemPrincipal::GetJarPrefix(nsACString& aJarPrefix)
 {
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 73574c3b31a2..925255ba4bf9 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -662,172 +662,6 @@ pref("editor.css.default_length_unit",       "px");
 pref("editor.resizing.preserve_ratio",       true);
 pref("editor.positioning.offset",            0);
 
-
-// Default Capability Preferences: Security-Critical! 
-// Editing these may create a security risk - be sure you know what you're doing
-//pref("capability.policy.default.barprop.visible.set", "UniversalXPConnect");
-
-pref("capability.policy.default_policynames", "mailnews");
-
-pref("capability.policy.default.DOMException.code", "allAccess");
-pref("capability.policy.default.DOMException.message", "allAccess");
-pref("capability.policy.default.DOMException.name", "allAccess");
-pref("capability.policy.default.DOMException.result", "allAccess");
-pref("capability.policy.default.DOMException.toString.get", "allAccess");
-
-pref("capability.policy.default.History.back.get", "allAccess");
-pref("capability.policy.default.History.current", "UniversalXPConnect");
-pref("capability.policy.default.History.forward.get", "allAccess");
-pref("capability.policy.default.History.go.get", "allAccess");
-pref("capability.policy.default.History.item", "UniversalXPConnect");
-pref("capability.policy.default.History.next", "UniversalXPConnect");
-pref("capability.policy.default.History.previous", "UniversalXPConnect");
-pref("capability.policy.default.History.toString", "UniversalXPConnect");
-
-pref("capability.policy.default.Location.hash.set", "allAccess");
-pref("capability.policy.default.Location.href.set", "allAccess");
-pref("capability.policy.default.Location.replace.get", "allAccess");
-
-pref("capability.policy.default.Window.blur.get", "allAccess");
-pref("capability.policy.default.Window.close.get", "allAccess");
-pref("capability.policy.default.Window.closed.get", "allAccess");
-pref("capability.policy.default.Window.focus.get", "allAccess");
-pref("capability.policy.default.Window.frames.get", "allAccess");
-pref("capability.policy.default.Window.history.get", "allAccess");
-pref("capability.policy.default.Window.length.get", "allAccess");
-pref("capability.policy.default.Window.location", "allAccess");
-pref("capability.policy.default.Window.opener.get", "allAccess");
-pref("capability.policy.default.Window.parent.get", "allAccess");
-pref("capability.policy.default.Window.postMessage.get", "allAccess");
-pref("capability.policy.default.Window.self.get", "allAccess");
-pref("capability.policy.default.Window.top.get", "allAccess");
-pref("capability.policy.default.Window.window.get", "allAccess");
-
-pref("capability.policy.default.Selection.addSelectionListener", "UniversalXPConnect");
-pref("capability.policy.default.Selection.removeSelectionListener", "UniversalXPConnect");
-
-// Restrictions on the DOM for mail/news - see bugs 66938 and 84545
-pref("capability.policy.mailnews.sites", "mailbox: imap: news:");
-
-pref("capability.policy.mailnews.*.attributes.get", "noAccess");
-pref("capability.policy.mailnews.*.baseURI.get", "noAccess");
-pref("capability.policy.mailnews.*.data.get", "noAccess");
-pref("capability.policy.mailnews.*.getAttribute", "noAccess");
-pref("capability.policy.mailnews.HTMLDivElement.getAttribute", "sameOrigin");
-pref("capability.policy.mailnews.*.getAttributeNS", "noAccess");
-pref("capability.policy.mailnews.*.getAttributeNode", "noAccess");
-pref("capability.policy.mailnews.*.getAttributeNodeNS", "noAccess");
-pref("capability.policy.mailnews.*.getNamedItem", "noAccess");
-pref("capability.policy.mailnews.*.getNamedItemNS", "noAccess");
-pref("capability.policy.mailnews.*.host.get", "noAccess");
-pref("capability.policy.mailnews.*.hostname.get", "noAccess");
-pref("capability.policy.mailnews.*.href.get", "noAccess");
-pref("capability.policy.mailnews.*.innerHTML.get", "noAccess");
-pref("capability.policy.mailnews.*.lowSrc.get", "noAccess");
-pref("capability.policy.mailnews.*.nodeValue.get", "noAccess");
-pref("capability.policy.mailnews.*.pathname.get", "noAccess");
-pref("capability.policy.mailnews.*.protocol.get", "noAccess");
-pref("capability.policy.mailnews.*.src.get", "noAccess");
-pref("capability.policy.mailnews.*.substringData.get", "noAccess");
-pref("capability.policy.mailnews.*.text.get", "noAccess");
-pref("capability.policy.mailnews.*.textContent", "noAccess");
-pref("capability.policy.mailnews.*.title.get", "noAccess");
-pref("capability.policy.mailnews.*.wholeText", "noAccess");
-pref("capability.policy.mailnews.DOMException.toString", "noAccess");
-pref("capability.policy.mailnews.HTMLAnchorElement.toString", "noAccess");
-pref("capability.policy.mailnews.HTMLDocument.domain", "noAccess");
-pref("capability.policy.mailnews.HTMLDocument.URL", "noAccess");
-pref("capability.policy.mailnews.*.documentURI", "noAccess");
-pref("capability.policy.mailnews.Location.toString", "noAccess");
-pref("capability.policy.mailnews.Range.toString", "noAccess");
-pref("capability.policy.mailnews.Window.blur", "noAccess");
-pref("capability.policy.mailnews.Window.focus", "noAccess");
-pref("capability.policy.mailnews.Window.innerWidth.set", "noAccess");
-pref("capability.policy.mailnews.Window.innerHeight.set", "noAccess");
-pref("capability.policy.mailnews.Window.moveBy", "noAccess");
-pref("capability.policy.mailnews.Window.moveTo", "noAccess");
-pref("capability.policy.mailnews.Window.name.set", "noAccess");
-pref("capability.policy.mailnews.Window.outerHeight.set", "noAccess");
-pref("capability.policy.mailnews.Window.outerWidth.set", "noAccess");
-pref("capability.policy.mailnews.Window.resizeBy", "noAccess");
-pref("capability.policy.mailnews.Window.resizeTo", "noAccess");
-pref("capability.policy.mailnews.Window.screenX.set", "noAccess");
-pref("capability.policy.mailnews.Window.screenY.set", "noAccess");
-pref("capability.policy.mailnews.Window.sizeToContent", "noAccess");
-pref("capability.policy.mailnews.document.load", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.channel", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.getInterface", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.responseXML", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.responseText", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.status", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.statusText", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.abort", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.getAllResponseHeaders", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.getResponseHeader", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.open", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.send", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.setRequestHeader", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.readyState", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.overrideMimeType", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.onload", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.onerror", "noAccess");
-pref("capability.policy.mailnews.XMLHttpRequest.onreadystatechange", "noAccess");
-pref("capability.policy.mailnews.XMLSerializer.serializeToString", "noAccess");
-pref("capability.policy.mailnews.XMLSerializer.serializeToStream", "noAccess");
-pref("capability.policy.mailnews.DOMParser.parseFromString", "noAccess");
-pref("capability.policy.mailnews.DOMParser.parseFromStream", "noAccess");
-pref("capability.policy.mailnews.SOAPCall.transportURI", "noAccess");
-pref("capability.policy.mailnews.SOAPCall.verifySourceHeader", "noAccess");
-pref("capability.policy.mailnews.SOAPCall.invoke", "noAccess");
-pref("capability.policy.mailnews.SOAPCall.asyncInvoke", "noAccess");
-pref("capability.policy.mailnews.SOAPResponse.fault", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.styleURI", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.getAssociatedEncoding", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.setEncoder", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.getEncoder", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.setDecoder", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.setDecoder", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.getDecoder", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.defaultEncoder", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.defaultDecoder", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.schemaCollection", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.encode", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.decode", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.mapSchemaURI", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.unmapSchemaURI", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.getInternalSchemaURI", "noAccess");
-pref("capability.policy.mailnews.SOAPEncoding.getExternalSchemaURI", "noAccess");
-pref("capability.policy.mailnews.SOAPFault.element", "noAccess");
-pref("capability.policy.mailnews.SOAPFault.faultNamespaceURI", "noAccess");
-pref("capability.policy.mailnews.SOAPFault.faultCode", "noAccess");
-pref("capability.policy.mailnews.SOAPFault.faultString", "noAccess");
-pref("capability.policy.mailnews.SOAPFault.faultActor", "noAccess");
-pref("capability.policy.mailnews.SOAPFault.detail", "noAccess");
-pref("capability.policy.mailnews.SOAPHeaderBlock.actorURI", "noAccess");
-pref("capability.policy.mailnews.SOAPHeaderBlock.mustUnderstand", "noAccess");
-pref("capability.policy.mailnews.SOAPParameter", "noAccess");
-pref("capability.policy.mailnews.SOAPPropertyBagMutator.propertyBag", "noAccess");
-pref("capability.policy.mailnews.SOAPPropertyBagMutator.addProperty", "noAccess");
-pref("capability.policy.mailnews.SchemaLoader.load", "noAccess");
-pref("capability.policy.mailnews.SchemaLoader.loadAsync", "noAccess");
-pref("capability.policy.mailnews.SchemaLoader.processSchemaElement", "noAccess");
-pref("capability.policy.mailnews.SchemaLoader.onLoad", "noAccess");
-pref("capability.policy.mailnews.SchemaLoader.onError", "noAccess");
-pref("capability.policy.mailnews.WSDLLoader.load", "noAccess");
-pref("capability.policy.mailnews.WSDLLoader.loadAsync", "noAccess");
-pref("capability.policy.mailnews.WSDLLoader.onLoad", "noAccess");
-pref("capability.policy.mailnews.WSDLLoader.onError", "noAccess");
-pref("capability.policy.mailnews.WebServiceProxyFactory.createProxy", "noAccess");
-pref("capability.policy.mailnews.WebServiceProxyFactory.createProxyAsync", "noAccess");
-pref("capability.policy.mailnews.WebServiceProxyFactory.onLoad", "noAccess");
-pref("capability.policy.mailnews.WebServiceProxyFactory.onError", "noAccess");
-
-// XMLExtras
-pref("capability.policy.default.XMLHttpRequest.channel", "noAccess");
-pref("capability.policy.default.XMLHttpRequest.getInterface", "noAccess");
-pref("capability.policy.default.XMLHttpRequest.open-uri", "allAccess");
-pref("capability.policy.default.DOMParser.parseFromStream", "noAccess");
-
 // Scripts & Windows prefs
 pref("dom.disable_image_src_set",           false);
 pref("dom.disable_window_flip",             false);

From ebe63441371e36d0a22c4ad3df678cb315ffe64e Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 19:15:44 -0800
Subject: [PATCH 249/459] Bug 913734 - Remove EnabledID() machinery. r=mrbkap

---
 caps/src/nsScriptSecurityManager.cpp | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
index 95756678b067..74aaf7b342c9 100644
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -79,18 +79,6 @@ nsIStringBundle *nsScriptSecurityManager::sStrBundle = nullptr;
 JSRuntime       *nsScriptSecurityManager::sRuntime   = 0;
 bool nsScriptSecurityManager::sStrictFileOriginPolicy = true;
 
-// Lazily initialized. Use the getter below.
-static jsid sEnabledID = JSID_VOID;
-static JS::HandleId
-EnabledID()
-{
-    if (sEnabledID != JSID_VOID)
-        return JS::HandleId::fromMarkedLocation(&sEnabledID);
-    AutoSafeJSContext cx;
-    sEnabledID = INTERNED_STRING_TO_JSID(cx, JS_InternString(cx, "enabled"));
-    return JS::HandleId::fromMarkedLocation(&sEnabledID);
-}
-
 bool
 nsScriptSecurityManager::SubjectIsPrivileged()
 {
@@ -1833,7 +1821,6 @@ nsScriptSecurityManager::Shutdown()
         JS_SetTrustedPrincipals(sRuntime, nullptr);
         sRuntime = nullptr;
     }
-    sEnabledID = JSID_VOID;
 
     NS_IF_RELEASE(sIOService);
     NS_IF_RELEASE(sStrBundle);

From ea866821119133fa41f4df8e1cdf5371fd3edb26 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Fri, 13 Dec 2013 19:15:44 -0800
Subject: [PATCH 250/459] Bug 913734 - Remove namespace mozilla::hotness.
 r=mrbkap

---
 caps/include/DomainPolicy.h          | 6 ------
 caps/src/DomainPolicy.cpp            | 2 --
 caps/src/nsScriptSecurityManager.cpp | 2 +-
 3 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/caps/include/DomainPolicy.h b/caps/include/DomainPolicy.h
index 857f85e9e6f5..22885ff5e7d9 100644
--- a/caps/include/DomainPolicy.h
+++ b/caps/include/DomainPolicy.h
@@ -13,11 +13,6 @@
 
 namespace mozilla {
 
-// The name "DomainPolicy" conflicts with some of the old-style policy machinery
-// in nsScriptSecurityManager.cpp, which needs to #include this file. So we
-// temporarily use a sub-namespace until that machinery goes away in bug 913734.
-namespace hotness {
-
 class DomainPolicy : public nsIDomainPolicy
 {
 public:
@@ -46,7 +41,6 @@ protected:
     nsTHashtable<nsURIHashKey> mHashTable;
 };
 
-} /* namespace hotness */
 } /* namespace mozilla */
 
 #endif /* DomainPolicy_h__ */
diff --git a/caps/src/DomainPolicy.cpp b/caps/src/DomainPolicy.cpp
index be2c752230e4..2207d69ce806 100644
--- a/caps/src/DomainPolicy.cpp
+++ b/caps/src/DomainPolicy.cpp
@@ -8,7 +8,6 @@
 #include "nsScriptSecurityManager.h"
 
 namespace mozilla {
-namespace hotness {
 
 NS_IMPL_ISUPPORTS1(DomainPolicy, nsIDomainPolicy)
 
@@ -161,5 +160,4 @@ DomainSet::ContainsSuperDomain(nsIURI* aDomain, bool* aContains)
 
 }
 
-} /* namespace hotness */
 } /* namespace mozilla */
diff --git a/caps/src/nsScriptSecurityManager.cpp b/caps/src/nsScriptSecurityManager.cpp
index 74aaf7b342c9..00b5672fa787 100644
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -1959,7 +1959,7 @@ nsScriptSecurityManager::ActivateDomainPolicy(nsIDomainPolicy** aRv)
         return NS_ERROR_SERVICE_NOT_AVAILABLE;
     }
 
-    mDomainPolicy = new mozilla::hotness::DomainPolicy();
+    mDomainPolicy = new DomainPolicy();
     nsCOMPtr<nsIDomainPolicy> ptr = mDomainPolicy;
     ptr.forget(aRv);
     return NS_OK;

From d74ea70de766d95e7623d90e3ebc7d86a4742101 Mon Sep 17 00:00:00 2001
From: Geoff Brown <gbrown@mozilla.com>
Date: Fri, 13 Dec 2013 21:20:39 -0700
Subject: [PATCH 251/459] Bug 945975 - Add mach support for Android xpcshell
 tests; r=ted

---
 python/mozbuild/mozbuild/base.py        |   7 ++
 testing/xpcshell/mach_commands.py       | 106 +++++++++++++++++++++++-
 testing/xpcshell/remotexpcshelltests.py |  15 ++--
 3 files changed, 119 insertions(+), 9 deletions(-)

diff --git a/python/mozbuild/mozbuild/base.py b/python/mozbuild/mozbuild/base.py
index 6043c4e8f3e5..33c4926566ba 100644
--- a/python/mozbuild/mozbuild/base.py
+++ b/python/mozbuild/mozbuild/base.py
@@ -590,6 +590,13 @@ class MachCommandConditions(object):
                    cls.substs.get('MOZ_WIDGET_TOOLKIT') != 'gonk'
         return False
 
+    @staticmethod
+    def is_android(cls):
+        """Must have an Android build."""
+        if hasattr(cls, 'substs'):
+            return cls.substs.get('MOZ_WIDGET_TOOLKIT') == 'android'
+        return False
+
 
 class PathArgument(object):
     """Parse a filesystem path argument and transform it in various ways."""
diff --git a/testing/xpcshell/mach_commands.py b/testing/xpcshell/mach_commands.py
index ea1ea76e9f40..ec7c226206ef 100644
--- a/testing/xpcshell/mach_commands.py
+++ b/testing/xpcshell/mach_commands.py
@@ -17,6 +17,7 @@ from StringIO import StringIO
 from mozbuild.base import (
     MachCommandBase,
     MozbuildObject,
+    MachCommandConditions as conditions,
 )
 
 from mach.decorators import (
@@ -53,7 +54,9 @@ class XPCShellRunner(MozbuildObject):
     def run_test(self, test_file, interactive=False,
                  keep_going=False, sequential=False, shuffle=False,
                  debugger=None, debuggerArgs=None, debuggerInteractive=None,
-                 rerun_failures=False):
+                 rerun_failures=False,
+                 # ignore parameters from other platforms' options
+                 **kwargs):
         """Runs an individual xpcshell test."""
         # TODO Bug 794506 remove once mach integrates with virtualenv.
         build_path = os.path.join(self.topobjdir, 'build')
@@ -197,6 +200,90 @@ class XPCShellRunner(MozbuildObject):
                   "to make sure the failures were not caused by this.")
         return int(not result)
 
+class AndroidXPCShellRunner(MozbuildObject):
+    """Get specified DeviceManager"""
+    def get_devicemanager(self, devicemanager, ip, port, remote_test_root):
+        from mozdevice import devicemanagerADB, devicemanagerSUT
+        dm = None
+        if devicemanager == "adb":
+            if ip:
+                dm = devicemanagerADB.DeviceManagerADB(ip, port, packageName=None, deviceRoot=remote_test_root)
+            else:
+                dm = devicemanagerADB.DeviceManagerADB(packageName=None, deviceRoot=remote_test_root)
+        else:
+            if ip:
+                dm = devicemanagerSUT.DeviceManagerSUT(ip, port, deviceRoot=remote_test_root)
+            else:
+                raise Exception("You must provide a device IP to connect to via the --ip option")
+        return dm
+
+    """Run Android xpcshell tests."""
+    def run_test(self,
+                 test_file, keep_going,
+                 devicemanager, ip, port, remote_test_root, no_setup, local_apk,
+                 # ignore parameters from other platforms' options
+                 **kwargs):
+        # TODO Bug 794506 remove once mach integrates with virtualenv.
+        build_path = os.path.join(self.topobjdir, 'build')
+        if build_path not in sys.path:
+            sys.path.append(build_path)
+
+        import remotexpcshelltests
+
+        dm = self.get_devicemanager(devicemanager, ip, port, remote_test_root)
+
+        options = remotexpcshelltests.RemoteXPCShellOptions()
+        options.shuffle = False
+        options.sequential = True
+        options.interactive = False
+        options.debugger = None
+        options.debuggerArgs = None
+        options.setup = not no_setup
+        options.keepGoing = keep_going
+        options.objdir = self.topobjdir
+        options.localLib = os.path.join(self.topobjdir, 'dist/fennec')
+        options.localBin = os.path.join(self.topobjdir, 'dist/bin')
+        options.testingModulesDir = os.path.join(self.topobjdir, '_tests/modules')
+        options.mozInfo = os.path.join(self.topobjdir, 'mozinfo.json')
+        options.manifest = os.path.join(self.topobjdir, '_tests/xpcshell/xpcshell_android.ini')
+        options.symbolsPath = os.path.join(self.distdir, 'crashreporter-symbols')
+        if local_apk:
+            options.localAPK = local_apk
+        else:
+            for file in os.listdir(os.path.join(options.objdir, "dist")):
+                if file.endswith(".apk") and file.startswith("fennec"):
+                    options.localAPK = os.path.join(options.objdir, "dist")
+                    options.localAPK = os.path.join(options.localAPK, file)
+                    print ("using APK: " + options.localAPK)
+                    break
+            else:
+                raise Exception("You must specify an APK")
+
+        if test_file == 'all':
+            testdirs = []
+            options.testPath = None
+            options.verbose = False
+        else:
+            testdirs = test_file
+            options.testPath = test_file
+            options.verbose = True
+        dummy_log = StringIO()
+        xpcshell = remotexpcshelltests.XPCShellRemote(dm, options, args=testdirs, log=dummy_log)
+        self.log_manager.enable_unstructured()
+
+        xpcshell_filter = TestStartFilter()
+        self.log_manager.terminal_handler.addFilter(xpcshell_filter)
+
+        result = xpcshell.runTests(xpcshell='xpcshell',
+                      testClass=remotexpcshelltests.RemoteXPCShellTestThread,
+                      testdirs=testdirs,
+                      mobileArgs=xpcshell.mobileArgs,
+                      **options.__dict__)
+
+        self.log_manager.terminal_handler.removeFilter(xpcshell_filter)
+        self.log_manager.disable_unstructured()
+
+        return int(not result)
 
 @CommandProvider
 class MachCommands(MachCommandBase):
@@ -225,6 +312,18 @@ class MachCommands(MachCommandBase):
         help='Randomize the execution order of tests.')
     @CommandArgument('--rerun-failures', action='store_true',
         help='Reruns failures from last time.')
+    @CommandArgument('--devicemanager', default='adb', type=str,
+        help='(Android) Type of devicemanager to use for communication: adb or sut')
+    @CommandArgument('--ip', type=str, default=None,
+        help='(Android) IP address of device')
+    @CommandArgument('--port', type=int, default=20701,
+        help='(Android) Port of device')
+    @CommandArgument('--remote_test_root', type=str, default=None,
+        help='(Android) Remote test root such as /mnt/sdcard or /data/local')
+    @CommandArgument('--no-setup', action='store_true',
+        help='(Android) Do not copy files to device')
+    @CommandArgument('--local-apk', type=str, default=None,
+        help='(Android) Use specified Fennec APK')
     def run_xpcshell_test(self, **params):
         from mozbuild.controller.building import BuildDriver
 
@@ -236,7 +335,10 @@ class MachCommands(MachCommandBase):
         driver = self._spawn(BuildDriver)
         driver.install_tests(remove=False)
 
-        xpcshell = self._spawn(XPCShellRunner)
+        if conditions.is_android(self):
+            xpcshell = self._spawn(AndroidXPCShellRunner)
+        else:
+            xpcshell = self._spawn(XPCShellRunner)
 
         try:
             return xpcshell.run_test(**params)
diff --git a/testing/xpcshell/remotexpcshelltests.py b/testing/xpcshell/remotexpcshelltests.py
index 1d0ec6bacf2b..729bc9d115c0 100644
--- a/testing/xpcshell/remotexpcshelltests.py
+++ b/testing/xpcshell/remotexpcshelltests.py
@@ -188,8 +188,14 @@ class RemoteXPCShellTestThread(xpcshell.XPCShellTestThread):
 # via devicemanager.
 class XPCShellRemote(xpcshell.XPCShellTests, object):
 
-    def __init__(self, devmgr, options, args):
-        xpcshell.XPCShellTests.__init__(self)
+    def __init__(self, devmgr, options, args, log=None):
+        xpcshell.XPCShellTests.__init__(self, log)
+
+        # Add Android version (SDK level) to mozinfo so that manifest entries
+        # can be conditional on android_version.
+        androidVersion = devmgr.shellCheckOutput(['getprop', 'ro.build.version.sdk'])
+        mozinfo.info['android_version'] = androidVersion
+
         self.localLib = options.localLib
         self.localBin = options.localBin
         self.options = options
@@ -564,11 +570,6 @@ def main():
         print >>sys.stderr, "Error: You must specify a test filename in interactive mode!"
         sys.exit(1)
 
-    # Add Android version (SDK level) to mozinfo so that manifest entries
-    # can be conditional on android_version.
-    androidVersion = dm.shellCheckOutput(['getprop', 'ro.build.version.sdk'])
-    mozinfo.info['android_version'] = androidVersion
-
     xpcsh = XPCShellRemote(dm, options, args)
 
     # we don't run concurrent tests on mobile

From 3290b08b017325f8e903c889ae796fce48d6e467 Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Sat, 14 Dec 2013 13:22:47 +0900
Subject: [PATCH 252/459] Bug 948268 - Remove privilege check from
 MozCancelFullScreen() to comply with the spec. r=cpearce, f=bz,smaug

---
 content/base/src/nsDocument.cpp                    | 8 +-------
 content/html/content/test/file_fullscreen-api.html | 4 +---
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 210e0613ad2d..a396f420a575 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -9714,13 +9714,7 @@ nsDocument::MozCancelFullScreen()
 void
 nsIDocument::MozCancelFullScreen()
 {
-  // Only perform fullscreen changes if we're running in a webapp
-  // same-origin to the web app, or if we're in a user generated event
-  // handler.
-  if (NodePrincipal()->GetAppStatus() >= nsIPrincipal::APP_STATUS_INSTALLED ||
-      nsContentUtils::IsRequestFullScreenAllowed()) {
-    RestorePreviousFullScreenState();
-  }
+  RestorePreviousFullScreenState();
 }
 
 // Runnable to set window full-screen mode. Used as a script runner
diff --git a/content/html/content/test/file_fullscreen-api.html b/content/html/content/test/file_fullscreen-api.html
index 0bff1f69274c..cd3db20a51c5 100644
--- a/content/html/content/test/file_fullscreen-api.html
+++ b/content/html/content/test/file_fullscreen-api.html
@@ -190,14 +190,12 @@ function enter5(event) {
   ok(document.mozFullScreen, "Moved to full-screen after mouse click");
   addFullscreenChangeContinuation("exit", exit5);
   document.mozCancelFullScreen();
-  ok(document.mozFullScreen, "Should still be in full-screen mode, because calling context isn't trusted.");
-  setRequireTrustedContext(false);
-  document.mozCancelFullScreen();
   ok(!document.mozFullScreen, "Should have left full-screen mode.");
 }
 
 function exit5(event) {
   ok(!document.mozFullScreen, "Should have left full-screen mode (last time).");
+  setRequireTrustedContext(false);
 
   SpecialPowers.setBoolPref("full-screen-api.enabled", false);
   is(document.mozFullScreenEnabled, false, "document.mozFullScreenEnabled should be false if full-screen-api.enabled is false");

From b83c984db19ccd8090c4b471b4028be30da359ad Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Sat, 14 Dec 2013 13:22:48 +0900
Subject: [PATCH 253/459] Bug 941300 - Make circle radial-gradient invalid if
 two radii values are given. r=dbaron

---
 layout/style/nsCSSParser.cpp           | 25 +++++++++++---
 layout/style/nsCSSValue.h              | 48 +++++++++++++++++++++-----
 layout/style/test/property_database.js | 10 ++++++
 3 files changed, 70 insertions(+), 13 deletions(-)

diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index 02ba8c03c0b2..4e1c7b8c6a7a 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -6896,10 +6896,26 @@ CSSParserImpl::ParseRadialGradient(nsCSSValue& aValue, bool aIsRepeating,
                                nsCSSProps::kRadialGradientShapeKTable);
     }
   } else if (!aIsLegacy) {
+    // Save RadialShape before parsing RadiusX because RadialShape and
+    // RadiusX share the storage.
+    int32_t shape =
+      cssGradient->GetRadialShape().GetUnit() == eCSSUnit_Enumerated ?
+      cssGradient->GetRadialShape().GetIntValue() : -1;
     // <length> | [<length> | <percentage>]{2}
+    cssGradient->mIsExplicitSize = true;
     haveSize =
       ParseNonNegativeVariant(cssGradient->GetRadiusX(), VARIANT_LP, nullptr);
-    if (haveSize) {
+    if (!haveSize) {
+      // It was not an explicit size after all.
+      // Note that ParseNonNegativeVariant may have put something
+      // invalid into our storage, but only in the case where it was
+      // rejected only for being negative.  Since this means the token
+      // was a length or a percentage, we know it's not valid syntax
+      // (which must be a comma, the 'at' keyword, or a color), so we
+      // know this value will be dropped.  This means it doesn't matter
+      // that we have something invalid in our storage.
+      cssGradient->mIsExplicitSize = false;
+    } else {
       // vertical extent is optional
       bool haveYSize =
         ParseNonNegativeVariant(cssGradient->GetRadiusY(), VARIANT_LP, nullptr);
@@ -6907,10 +6923,10 @@ CSSParserImpl::ParseRadialGradient(nsCSSValue& aValue, bool aIsRepeating,
         nsCSSValue shapeValue;
         haveShape = ParseVariant(shapeValue, VARIANT_KEYWORD,
                                  nsCSSProps::kRadialGradientShapeKTable);
+        if (haveShape) {
+          shape = shapeValue.GetIntValue();
+        }
       }
-      int32_t shape =
-        cssGradient->GetRadialShape().GetUnit() == eCSSUnit_Enumerated ?
-        cssGradient->GetRadialShape().GetIntValue() : -1;
       if (haveYSize
             ? shape == NS_STYLE_GRADIENT_SHAPE_CIRCULAR
             : cssGradient->GetRadiusX().GetUnit() == eCSSUnit_Percent ||
@@ -6918,7 +6934,6 @@ CSSParserImpl::ParseRadialGradient(nsCSSValue& aValue, bool aIsRepeating,
         SkipUntil(')');
         return false;
       }
-      cssGradient->mIsExplicitSize = true;
     }
   }
 
diff --git a/layout/style/nsCSSValue.h b/layout/style/nsCSSValue.h
index 6fcb9fdcfebf..29c4b035e386 100644
--- a/layout/style/nsCSSValue.h
+++ b/layout/style/nsCSSValue.h
@@ -1142,14 +1142,46 @@ struct nsCSSValueGradient {
 private:
   nsCSSValue mRadialValues[2];
 public:
-  nsCSSValue& GetRadialShape() { return mRadialValues[0]; }
-  const nsCSSValue& GetRadialShape() const { return mRadialValues[0]; }
-  nsCSSValue& GetRadialSize() { return mRadialValues[1]; }
-  const nsCSSValue& GetRadialSize() const { return mRadialValues[1]; }
-  nsCSSValue& GetRadiusX() { return mRadialValues[0]; }
-  const nsCSSValue& GetRadiusX() const { return mRadialValues[0]; }
-  nsCSSValue& GetRadiusY() { return mRadialValues[1]; }
-  const nsCSSValue& GetRadiusY() const { return mRadialValues[1]; }
+  nsCSSValue& GetRadialShape()
+  {
+    MOZ_ASSERT(!mIsExplicitSize);
+    return mRadialValues[0];
+  }
+  const nsCSSValue& GetRadialShape() const
+  {
+    MOZ_ASSERT(!mIsExplicitSize);
+    return mRadialValues[0];
+  }
+  nsCSSValue& GetRadialSize()
+  {
+    MOZ_ASSERT(!mIsExplicitSize);
+    return mRadialValues[1];
+  }
+  const nsCSSValue& GetRadialSize() const
+  {
+    MOZ_ASSERT(!mIsExplicitSize);
+    return mRadialValues[1];
+  }
+  nsCSSValue& GetRadiusX()
+  {
+    MOZ_ASSERT(mIsExplicitSize);
+    return mRadialValues[0];
+  }
+  const nsCSSValue& GetRadiusX() const
+  {
+    MOZ_ASSERT(mIsExplicitSize);
+    return mRadialValues[0];
+  }
+  nsCSSValue& GetRadiusY()
+  {
+    MOZ_ASSERT(mIsExplicitSize);
+    return mRadialValues[1];
+  }
+  const nsCSSValue& GetRadiusY() const
+  {
+    MOZ_ASSERT(mIsExplicitSize);
+    return mRadialValues[1];
+  }
 
   InfallibleTArray<nsCSSValueGradientStop> mStops;
 
diff --git a/layout/style/test/property_database.js b/layout/style/test/property_database.js
index 67a946684231..b41a683ee2ce 100644
--- a/layout/style/test/property_database.js
+++ b/layout/style/test/property_database.js
@@ -1513,10 +1513,12 @@ var gCSSProperties = {
 		"radial-gradient(43px 50%, red, blue)",
 		"radial-gradient(50% 43px, red, blue)",
 		"radial-gradient(circle 43px, red, blue)",
+		"radial-gradient(43px circle, red, blue)",
 		"radial-gradient(ellipse 43px 43px, red, blue)",
 		"radial-gradient(ellipse 50% 50%, red, blue)",
 		"radial-gradient(ellipse 43px 50%, red, blue)",
 		"radial-gradient(ellipse 50% 43px, red, blue)",
+		"radial-gradient(50% 43px ellipse, red, blue)",
 
 		"radial-gradient(farthest-corner at top left, red, blue)",
 		"radial-gradient(ellipse closest-corner at 45px, red, blue)",
@@ -1818,6 +1820,14 @@ var gCSSProperties = {
 			"-moz-repeating-radial-gradient(ellipse at 45px closest-corner, red, blue)",
 			"-moz-repeating-radial-gradient(circle at 45px farthest-side, red, blue)",
 
+			"radial-gradient(circle 175px 20px, black, white)",
+			"radial-gradient(175px 20px circle, black, white)",
+			"radial-gradient(ellipse 175px, black, white)",
+			"radial-gradient(175px ellipse, black, white)",
+			"radial-gradient(50%, red, blue)",
+			"radial-gradient(circle 50%, red, blue)",
+			"radial-gradient(50% circle, red, blue)",
+
 			/* Valid only when prefixed */
 			"linear-gradient(top left, red, blue)",
 			"linear-gradient(0 0, red, blue)",

From a2b2ad6fb81fa97b5873105cad5f38a0925a0c7e Mon Sep 17 00:00:00 2001
From: Mike Hommey <mh+mozilla@glandium.org>
Date: Sat, 14 Dec 2013 14:00:53 +0900
Subject: [PATCH 254/459] Followup for bug 939890 and bug 949334: remove now
 irrelevant comments. r=me. DONTBUILD

---
 build/gyp.mozbuild                                               | 1 -
 .../modules/audio_coding/main/source/audio_coding_module.gypi    | 1 -
 2 files changed, 2 deletions(-)

diff --git a/build/gyp.mozbuild b/build/gyp.mozbuild
index 5c00df5c30c5..64761c4e174e 100644
--- a/build/gyp.mozbuild
+++ b/build/gyp.mozbuild
@@ -36,7 +36,6 @@ gyp_vars = {
     # 'aec_debug_dump': 1,
 
     # codec enable/disables:
-    # Note: if you change one here, you must modify layout/media/webrtc/Makefile.in!
     'include_g711': 1,
     'include_opus': 1,
     'include_g722': 0,
diff --git a/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi b/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi
index 6b64ff0a76ac..88e70d461cfe 100644
--- a/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi
+++ b/media/webrtc/trunk/webrtc/modules/audio_coding/main/source/audio_coding_module.gypi
@@ -78,7 +78,6 @@
         'acm_generic_codec.h',
         'acm_neteq.cc',
         'acm_neteq.h',
-# cheat until I get audio_coding_sources to work
         'acm_red.cc',
         'acm_red.h',
         'acm_resampler.cc',

From 4b2523106b4391569023c242921dd15bdd6f74f4 Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Sat, 14 Dec 2013 16:31:10 +0900
Subject: [PATCH 255/459] Bug 949292 - Stop exposing LoadStatus on the global
 object. r=bz

---
 dom/base/nsDOMClassInfo.cpp                      | 9 ---------
 dom/base/nsDOMClassInfoClasses.h                 | 1 -
 dom/interfaces/offline/nsIDOMLoadStatus.idl      | 2 +-
 dom/tests/mochitest/general/test_interfaces.html | 1 -
 js/xpconnect/tests/mochitest/test_bug790732.html | 1 -
 5 files changed, 1 insertion(+), 13 deletions(-)

diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 1301cb689e43..7c343e629f46 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -77,7 +77,6 @@
 #include "nsError.h"
 #include "nsIDOMDOMStringList.h"
 #include "nsIDOMUserDataHandler.h"
-#include "nsIDOMLoadStatus.h"
 #include "nsIDOMXPathNamespace.h"
 #include "nsIDOMXULButtonElement.h"
 #include "nsIDOMXULCheckboxElement.h"
@@ -250,7 +249,6 @@ DOMCI_DATA_NO_CLASS(DOMPrototype)
 DOMCI_DATA_NO_CLASS(DOMConstructor)
 
 DOMCI_DATA_NO_CLASS(UserDataHandler)
-DOMCI_DATA_NO_CLASS(LoadStatus)
 DOMCI_DATA_NO_CLASS(XPathNamespace)
 DOMCI_DATA_NO_CLASS(XULControlElement)
 DOMCI_DATA_NO_CLASS(XULLabeledControlElement)
@@ -527,8 +525,6 @@ static nsDOMClassInfoData sClassInfoData[] = {
 
   NS_DEFINE_CHROME_XBL_CLASSINFO_DATA(UserDataHandler, nsDOMGenericSH,
                                       DOM_DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(LoadStatus, nsDOMGenericSH,
-                           DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CLASSINFO_DATA(XPathNamespace, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
   NS_DEFINE_CHROME_XBL_CLASSINFO_DATA(XULControlElement, nsDOMGenericSH,
@@ -1291,10 +1287,6 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMUserDataHandler)
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(LoadStatus, nsIDOMLoadStatus)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMLoadStatus)
-  DOM_CLASSINFO_MAP_END
-
   DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(XPathNamespace, nsIDOMXPathNamespace)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMXPathNamespace)
   DOM_CLASSINFO_MAP_END
@@ -3353,7 +3345,6 @@ const InterfaceShimEntry kInterfaceShimMap[] =
   { "nsIDOMUIEvent", "UIEvent" },
   { "nsIDOMHTMLMediaElement", "HTMLMediaElement" },
   { "nsIDOMMediaError", "MediaError" },
-  { "nsIDOMLoadStatus", "LoadStatus" },
   { "nsIDOMOfflineResourceList", "OfflineResourceList" },
   { "nsIDOMRange", "Range" },
   { "nsIDOMSVGLength", "SVGLength" },
diff --git a/dom/base/nsDOMClassInfoClasses.h b/dom/base/nsDOMClassInfoClasses.h
index bc776d955c80..e57df048c0eb 100644
--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@@ -130,7 +130,6 @@ DOMCI_CLASS(LockedFile)
 DOMCI_CLASS(CSSFontFeatureValuesRule)
 
 DOMCI_CLASS(UserDataHandler)
-DOMCI_CLASS(LoadStatus)
 DOMCI_CLASS(XPathNamespace)
 DOMCI_CLASS(XULControlElement)
 DOMCI_CLASS(XULLabeledControlElement)
diff --git a/dom/interfaces/offline/nsIDOMLoadStatus.idl b/dom/interfaces/offline/nsIDOMLoadStatus.idl
index f7e817948a0b..748188a43d17 100644
--- a/dom/interfaces/offline/nsIDOMLoadStatus.idl
+++ b/dom/interfaces/offline/nsIDOMLoadStatus.idl
@@ -5,7 +5,7 @@
 
 #include "domstubs.idl"
 
-[scriptable, uuid(2cb53a8a-d2f4-4ddf-874f-3bc2d595c41a)]
+[uuid(2cb53a8a-d2f4-4ddf-874f-3bc2d595c41a)]
 interface nsIDOMLoadStatus : nsISupports
 {
   readonly attribute nsIDOMNode source;
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 0ec83523aa00..458610c82907 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -341,7 +341,6 @@ var interfaceNamesInGlobalScope =
     {name: "InstallTrigger", b2g: false, xbl: false},
     "KeyEvent",
     "KeyboardEvent",
-    "LoadStatus",
     "LocalMediaStream",
     "Location",
     "LockedFile",
diff --git a/js/xpconnect/tests/mochitest/test_bug790732.html b/js/xpconnect/tests/mochitest/test_bug790732.html
index 7e82a7e082ab..63667209d84d 100644
--- a/js/xpconnect/tests/mochitest/test_bug790732.html
+++ b/js/xpconnect/tests/mochitest/test_bug790732.html
@@ -37,7 +37,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=790732
   is(Ci.nsIDOMUIEvent, UIEvent);
   is(Ci.nsIDOMHTMLMediaElement, HTMLMediaElement);
   is(Ci.nsIDOMMediaError, MediaError);
-  is(Ci.nsIDOMLoadStatus, LoadStatus);
   is(Ci.nsIDOMOfflineResourceList, OfflineResourceList);
   is(Ci.nsIDOMRange, Range);
   is(Ci.nsIDOMSVGLength, SVGLength);

From da3a4828dbeed558d7fb19693dddf52e2409c535 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Sat, 14 Dec 2013 10:57:25 +0100
Subject: [PATCH 256/459] Bug 949475 - Remove JOF_TYPESET from initializer ops.
 r=bhackett

---
 js/src/jit/IonBuilder.cpp    | 72 ++++++++++------------------
 js/src/jit/MCallOptimize.cpp |  9 ++--
 js/src/jit/MIR.cpp           | 23 +++++----
 js/src/jit/MIR.h             | 92 +++++++++++++++++++++---------------
 js/src/jit/VMFunctions.cpp   |  8 +---
 js/src/jsinfer.h             |  9 ++--
 js/src/jsopcode.tbl          |  6 +--
 js/src/vm/Interpreter.cpp    |  3 --
 js/src/vm/Xdr.h              |  2 +-
 9 files changed, 109 insertions(+), 115 deletions(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 2c210df8eb92..1293dfa3fb92 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -972,8 +972,7 @@ IonBuilder::initScopeChain(MDefinition *callee)
                 return false;
         }
     } else {
-        scope = MConstant::New(alloc(), ObjectValue(script()->global()));
-        current->add(scope);
+        scope = constant(ObjectValue(script()->global()));
     }
 
     current->setScopeChain(scope);
@@ -3597,9 +3596,7 @@ IonBuilder::processThrow()
 bool
 IonBuilder::pushConstant(const Value &v)
 {
-    MConstant *ins = MConstant::New(alloc(), v);
-    current->add(ins);
-    current->push(ins);
+    current->push(constant(v));
     return true;
 }
 
@@ -4197,8 +4194,7 @@ IonBuilder::inlineCallsite(ObjectVector &targets, ObjectVector &originals,
         // constant.
         if (!lambda) {
             // Replace the function with an MConstant.
-            MConstant *constFun = MConstant::New(alloc(), ObjectValue(*target));
-            current->add(constFun);
+            MConstant *constFun = constant(ObjectValue(*target));
             callInfo.setFun(constFun);
         }
 
@@ -4440,7 +4436,7 @@ IonBuilder::inlineCalls(CallInfo &callInfo, ObjectVector &targets,
             return false;
 
         // Create a function MConstant to use in the entry ResumePoint.
-        MConstant *funcDef = MConstant::New(alloc(), ObjectValue(*target));
+        MConstant *funcDef = MConstant::New(alloc(), ObjectValue(*target), constraints());
         funcDef->setFoldedUnchecked();
         dispatchBlock->add(funcDef);
 
@@ -4726,7 +4722,7 @@ IonBuilder::createThisScriptedSingleton(JSFunction *target, MDefinition *callee)
     // Generate an inline path to create a new |this| object with
     // the given singleton prototype.
     MCreateThisWithTemplate *createThis =
-        MCreateThisWithTemplate::New(alloc(), templateObject,
+        MCreateThisWithTemplate::New(alloc(), constraints(), templateObject,
                                      templateObject->type()->initialHeap(constraints()));
     current->add(createThis);
 
@@ -5066,10 +5062,8 @@ IonBuilder::makeCallsiteClone(JSFunction *target, MDefinition *fun)
     // function, which means that target already is the clone. Make sure to ensure
     // that the old definition remains in resume points.
     if (target) {
-        MConstant *constant = MConstant::New(alloc(), ObjectValue(*target));
-        current->add(constant);
         fun->setFoldedUnchecked();
-        return constant;
+        return constant(ObjectValue(*target));
     }
 
     // Add a callsite clone IC if we have multiple targets. Note that we
@@ -5419,18 +5413,16 @@ IonBuilder::jsop_newarray(uint32_t count)
         return abort("New array has unknown properties");
     }
 
-    types::TemporaryTypeSet::DoubleConversion conversion =
-        bytecodeTypes(pc)->convertDoubleElements(constraints());
-    if (conversion == types::TemporaryTypeSet::AlwaysConvertToDoubles)
-        templateObject->setShouldConvertDoubleElements();
-
-    MNewArray *ins = MNewArray::New(alloc(), count, templateObject,
+    MNewArray *ins = MNewArray::New(alloc(), constraints(), count, templateObject,
                                     templateObject->type()->initialHeap(constraints()),
                                     MNewArray::NewArray_Allocating);
-
     current->add(ins);
     current->push(ins);
 
+    types::TemporaryTypeSet::DoubleConversion conversion =
+        ins->resultTypeSet()->convertDoubleElements(constraints());
+    if (conversion == types::TemporaryTypeSet::AlwaysConvertToDoubles)
+        templateObject->setShouldConvertDoubleElements();
     return true;
 }
 
@@ -5445,7 +5437,7 @@ IonBuilder::jsop_newobject()
         return abort("No template object for NEWOBJECT");
 
     JS_ASSERT(templateObject->is<JSObject>());
-    MNewObject *ins = MNewObject::New(alloc(), templateObject,
+    MNewObject *ins = MNewObject::New(alloc(), constraints(), templateObject,
                                       templateObject->hasSingletonType()
                                       ? gc::TenuredHeap
                                       : templateObject->type()->initialHeap(constraints()),
@@ -6323,8 +6315,7 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
             return pushConstant(NullValue());
     }
 
-    MInstruction *obj = MConstant::New(alloc(), ObjectValue(*staticObject));
-    current->add(obj);
+    MInstruction *obj = constant(ObjectValue(*staticObject));
 
     MIRType rvalType = MIRTypeFromValueType(types->getKnownTypeTag());
     if (barrier)
@@ -6422,8 +6413,7 @@ IonBuilder::jsop_getname(PropertyName *name)
 {
     MDefinition *object;
     if (js_CodeSpec[*pc].format & JOF_GNAME) {
-        MInstruction *global = MConstant::New(alloc(), ObjectValue(script()->global()));
-        current->add(global);
+        MInstruction *global = constant(ObjectValue(script()->global()));
         object = global;
     } else {
         current->push(current->scopeChain());
@@ -6471,10 +6461,7 @@ IonBuilder::jsop_intrinsic(PropertyName *name)
     JS_ALWAYS_TRUE(script()->global().maybeGetIntrinsicValue(name, &vp));
     JS_ASSERT(types->hasType(types::GetValueType(vp)));
 
-    MConstant *ins = MConstant::New(alloc(), vp);
-    current->add(ins);
-    current->push(ins);
-
+    pushConstant(vp);
     return true;
 }
 
@@ -7766,7 +7753,8 @@ IonBuilder::jsop_rest()
 
         // Pass in the number of actual arguments, the number of formals (not
         // including the rest parameter slot itself), and the template object.
-        MRest *rest = MRest::New(alloc(), numActuals, info().nargs() - 1, templateObject);
+        MRest *rest = MRest::New(alloc(), constraints(), numActuals, info().nargs() - 1,
+                                 templateObject);
         current->add(rest);
         current->push(rest);
         return true;
@@ -7777,7 +7765,7 @@ IonBuilder::jsop_rest()
     unsigned numFormals = info().nargs() - 1;
     unsigned numRest = numActuals > numFormals ? numActuals - numFormals : 0;
 
-    MNewArray *array = MNewArray::New(alloc(), numRest, templateObject,
+    MNewArray *array = MNewArray::New(alloc(), constraints(), numRest, templateObject,
                                       templateObject->type()->initialHeap(constraints()),
                                       MNewArray::NewArray_Allocating);
     current->add(array);
@@ -7969,9 +7957,7 @@ IonBuilder::testCommonGetterSetter(types::TemporaryTypeSet *types, PropertyName
     // the prototype chain is guarded by TI freezes. Note that a shape guard is
     // good enough here, even in the proxy case, because we have ensured there
     // are no lookup hooks for this property.
-    MInstruction *wrapper = MConstant::New(alloc(), ObjectValue(*foundProto));
-    current->add(wrapper);
-
+    MInstruction *wrapper = constant(ObjectValue(*foundProto));
     return addShapeGuard(wrapper, lastProperty, Bailout_ShapeGuard);
 }
 
@@ -8253,10 +8239,7 @@ IonBuilder::getPropTryConstant(bool *emitted, PropertyName *name,
     else
         obj->setFoldedUnchecked();
 
-    MConstant *known = MConstant::New(alloc(), ObjectValue(*singleton));
-
-    current->add(known);
-    current->push(known);
+    pushConstant(ObjectValue(*singleton));
 
     *emitted = true;
     return true;
@@ -9059,7 +9042,7 @@ IonBuilder::jsop_regexp(RegExpObject *reobj)
 
     JSObject *prototype = reobj->getProto();
 
-    MRegExp *regexp = MRegExp::New(alloc(), reobj, prototype, mustClone);
+    MRegExp *regexp = MRegExp::New(alloc(), constraints(), reobj, prototype, mustClone);
     current->add(regexp);
     current->push(regexp);
 
@@ -9084,10 +9067,7 @@ IonBuilder::jsop_regexp(RegExpObject *reobj)
 bool
 IonBuilder::jsop_object(JSObject *obj)
 {
-    MConstant *ins = MConstant::New(alloc(), ObjectValue(*obj));
-    current->add(ins);
-    current->push(ins);
-
+    pushConstant(ObjectValue(*obj));
     return true;
 }
 
@@ -9100,7 +9080,7 @@ IonBuilder::jsop_lambda(JSFunction *fun)
     if (fun->isNative() && IsAsmJSModuleNative(fun->native()))
         return abort("asm.js module function");
 
-    MLambda *ins = MLambda::New(alloc(), current->scopeChain(), fun);
+    MLambda *ins = MLambda::New(alloc(), constraints(), current->scopeChain(), fun);
     current->add(ins);
     current->push(ins);
 
@@ -9475,9 +9455,7 @@ IonBuilder::jsop_setaliasedvar(ScopeCoordinate sc)
         if (call) {
             // Push the object on the stack to match the bound object expected in
             // the global and property set cases.
-            MInstruction *constant = MConstant::New(alloc(), ObjectValue(*call));
-            current->add(constant);
-            current->push(constant);
+            pushConstant(ObjectValue(*call));
             current->push(value);
             return setStaticName(call, name);
         }
@@ -9901,7 +9879,7 @@ IonBuilder::storeScalarTypedObjectValue(MDefinition *typedObj,
 MConstant *
 IonBuilder::constant(const Value &v)
 {
-    MConstant *c = MConstant::New(alloc(), v);
+    MConstant *c = MConstant::New(alloc(), v, constraints());
     current->add(c);
     return c;
 }
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 4b010bb50650..2c649f5c758a 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -246,7 +246,7 @@ IonBuilder::inlineArray(CallInfo &callInfo)
     if (conversion == types::TemporaryTypeSet::AlwaysConvertToDoubles)
         templateObject->setShouldConvertDoubleElements();
 
-    MNewArray *ins = MNewArray::New(alloc(), initLength, templateObject,
+    MNewArray *ins = MNewArray::New(alloc(), constraints(), initLength, templateObject,
                                     templateObject->type()->initialHeap(constraints()),
                                     allocating);
     current->add(ins);
@@ -495,8 +495,8 @@ IonBuilder::inlineArrayConcat(CallInfo &callInfo)
 
     callInfo.unwrapArgs();
 
-    MArrayConcat *ins = MArrayConcat::New(alloc(), callInfo.thisArg(), callInfo.getArg(0), templateObj,
-                                          templateObj->type()->initialHeap(constraints()));
+    MArrayConcat *ins = MArrayConcat::New(alloc(), constraints(), callInfo.thisArg(), callInfo.getArg(0),
+                                          templateObj, templateObj->type()->initialHeap(constraints()));
     current->add(ins);
     current->push(ins);
 
@@ -969,7 +969,8 @@ IonBuilder::inlineStringSplit(CallInfo &callInfo)
 
     callInfo.unwrapArgs();
 
-    MStringSplit *ins = MStringSplit::New(alloc(), callInfo.thisArg(), callInfo.getArg(0), templateObject);
+    MStringSplit *ins = MStringSplit::New(alloc(), constraints(), callInfo.thisArg(),
+                                          callInfo.getArg(0), templateObject);
     current->add(ins);
     current->push(ins);
 
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 882b468f6a7b..6c3efded51fe 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -413,34 +413,41 @@ MDefinition::emptyResultTypeSet() const
 }
 
 MConstant *
-MConstant::New(TempAllocator &alloc, const Value &v)
+MConstant::New(TempAllocator &alloc, const Value &v, types::CompilerConstraintList *constraints)
 {
-    return new(alloc) MConstant(v);
+    return new(alloc) MConstant(v, constraints);
 }
 
 MConstant *
 MConstant::NewAsmJS(TempAllocator &alloc, const Value &v, MIRType type)
 {
-    MConstant *constant = new(alloc) MConstant(v);
+    MConstant *constant = new(alloc) MConstant(v, nullptr);
     constant->setResultType(type);
     return constant;
 }
 
 types::TemporaryTypeSet *
-jit::MakeSingletonTypeSet(JSObject *obj)
+jit::MakeSingletonTypeSet(types::CompilerConstraintList *constraints, JSObject *obj)
 {
-    LifoAlloc *alloc = GetIonContext()->temp->lifoAlloc();
-    return alloc->new_<types::TemporaryTypeSet>(types::Type::ObjectType(obj));
+    // Invalidate when this object's TypeObject gets unknown properties. This
+    // happens for instance when we mutate an object's __proto__, in this case
+    // we want to invalidate and mark this TypeSet as containing AnyObject
+    // (because mutating __proto__ will change an object's TypeObject).
+    JS_ASSERT(constraints);
+    types::TypeObjectKey *objType = types::TypeObjectKey::get(obj);
+    objType->hasFlags(constraints, types::OBJECT_FLAG_UNKNOWN_PROPERTIES);
+
+    return GetIonContext()->temp->lifoAlloc()->new_<types::TemporaryTypeSet>(types::Type::ObjectType(obj));
 }
 
-MConstant::MConstant(const js::Value &vp)
+MConstant::MConstant(const js::Value &vp, types::CompilerConstraintList *constraints)
   : value_(vp)
 {
     setResultType(MIRTypeFromValue(vp));
     if (vp.isObject()) {
         // Create a singleton type set for the object. This isn't necessary for
         // other types as the result type encodes all needed information.
-        setResultTypeSet(MakeSingletonTypeSet(&vp.toObject()));
+        setResultTypeSet(MakeSingletonTypeSet(constraints, &vp.toObject()));
     }
 
     setMovable();
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index b8bd03eb23f1..0f2344a7ca8a 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -951,11 +951,12 @@ class MConstant : public MNullaryInstruction
     Value value_;
 
   protected:
-    MConstant(const Value &v);
+    MConstant(const Value &v, types::CompilerConstraintList *constraints);
 
   public:
     INSTRUCTION_HEADER(Constant)
-    static MConstant *New(TempAllocator &alloc, const Value &v);
+    static MConstant *New(TempAllocator &alloc, const Value &v,
+                          types::CompilerConstraintList *constraints = nullptr);
     static MConstant *NewAsmJS(TempAllocator &alloc, const Value &v, MIRType type);
 
     const js::Value &value() const {
@@ -1365,7 +1366,7 @@ class MThrow
 
 // Fabricate a type set containing only the type of the specified object.
 types::TemporaryTypeSet *
-MakeSingletonTypeSet(JSObject *obj);
+MakeSingletonTypeSet(types::CompilerConstraintList *constraints, JSObject *obj);
 
 void
 MergeTypes(MIRType *ptype, types::TemporaryTypeSet **ptypeSet,
@@ -1388,24 +1389,26 @@ class MNewArray : public MNullaryInstruction
     // Allocate space at initialization or not
     AllocatingBehaviour allocating_;
 
-    MNewArray(uint32_t count, JSObject *templateObject, gc::InitialHeap initialHeap,
-              AllocatingBehaviour allocating)
+    MNewArray(types::CompilerConstraintList *constraints, uint32_t count, JSObject *templateObject,
+              gc::InitialHeap initialHeap, AllocatingBehaviour allocating)
       : count_(count),
         templateObject_(templateObject),
         initialHeap_(initialHeap),
         allocating_(allocating)
     {
         setResultType(MIRType_Object);
-        setResultTypeSet(MakeSingletonTypeSet(templateObject));
+        if (!templateObject->hasSingletonType())
+            setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
     }
 
   public:
     INSTRUCTION_HEADER(NewArray)
 
-    static MNewArray *New(TempAllocator &alloc, uint32_t count, JSObject *templateObject,
+    static MNewArray *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                          uint32_t count, JSObject *templateObject,
                           gc::InitialHeap initialHeap, AllocatingBehaviour allocating)
     {
-        return new(alloc) MNewArray(count, templateObject, initialHeap, allocating);
+        return new(alloc) MNewArray(constraints, count, templateObject, initialHeap, allocating);
     }
 
     uint32_t count() const {
@@ -1445,24 +1448,27 @@ class MNewObject : public MNullaryInstruction
     gc::InitialHeap initialHeap_;
     bool templateObjectIsClassPrototype_;
 
-    MNewObject(JSObject *templateObject, gc::InitialHeap initialHeap,
-               bool templateObjectIsClassPrototype)
+    MNewObject(types::CompilerConstraintList *constraints, JSObject *templateObject,
+               gc::InitialHeap initialHeap, bool templateObjectIsClassPrototype)
       : templateObject_(templateObject),
         initialHeap_(initialHeap),
         templateObjectIsClassPrototype_(templateObjectIsClassPrototype)
     {
         JS_ASSERT_IF(templateObjectIsClassPrototype, !shouldUseVM());
         setResultType(MIRType_Object);
-        setResultTypeSet(MakeSingletonTypeSet(templateObject));
+        if (!templateObject->hasSingletonType())
+            setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
     }
 
   public:
     INSTRUCTION_HEADER(NewObject)
 
-    static MNewObject *New(TempAllocator &alloc, JSObject *templateObject, gc::InitialHeap initialHeap,
+    static MNewObject *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                           JSObject *templateObject, gc::InitialHeap initialHeap,
                            bool templateObjectIsClassPrototype)
     {
-        return new(alloc) MNewObject(templateObject, initialHeap, templateObjectIsClassPrototype);
+        return new(alloc) MNewObject(constraints, templateObject, initialHeap,
+                                     templateObjectIsClassPrototype);
     }
 
     // Returns true if the code generator should call through to the
@@ -2524,20 +2530,21 @@ class MCreateThisWithTemplate
     CompilerRootObject templateObject_;
     gc::InitialHeap initialHeap_;
 
-    MCreateThisWithTemplate(JSObject *templateObject, gc::InitialHeap initialHeap)
+    MCreateThisWithTemplate(types::CompilerConstraintList *constraints, JSObject *templateObject,
+                            gc::InitialHeap initialHeap)
       : templateObject_(templateObject),
         initialHeap_(initialHeap)
     {
         setResultType(MIRType_Object);
-        setResultTypeSet(MakeSingletonTypeSet(templateObject));
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
     }
 
   public:
     INSTRUCTION_HEADER(CreateThisWithTemplate);
-    static MCreateThisWithTemplate *New(TempAllocator &alloc, JSObject *templateObject,
-                                        gc::InitialHeap initialHeap)
+    static MCreateThisWithTemplate *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                                        JSObject *templateObject, gc::InitialHeap initialHeap)
     {
-        return new(alloc) MCreateThisWithTemplate(templateObject, initialHeap);
+        return new(alloc) MCreateThisWithTemplate(constraints, templateObject, initialHeap);
     }
 
     JSObject *templateObject() const {
@@ -4355,21 +4362,23 @@ class MStringSplit
 {
     types::TypeObject *typeObject_;
 
-    MStringSplit(MDefinition *string, MDefinition *sep, JSObject *templateObject)
+    MStringSplit(types::CompilerConstraintList *constraints, MDefinition *string, MDefinition *sep,
+                 JSObject *templateObject)
       : MBinaryInstruction(string, sep),
         typeObject_(templateObject->type())
     {
         setResultType(MIRType_Object);
-        setResultTypeSet(MakeSingletonTypeSet(templateObject));
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
     }
 
   public:
     INSTRUCTION_HEADER(StringSplit)
 
-    static MStringSplit *New(TempAllocator &alloc, MDefinition *string, MDefinition *sep,
+    static MStringSplit *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                             MDefinition *string, MDefinition *sep,
                              JSObject *templateObject)
     {
-        return new(alloc) MStringSplit(string, sep, templateObject);
+        return new(alloc) MStringSplit(constraints, string, sep, templateObject);
     }
     types::TypeObject *typeObject() const {
         return typeObject_;
@@ -4845,7 +4854,7 @@ class MRegExp : public MNullaryInstruction
     CompilerRootObject prototype_;
     bool mustClone_;
 
-    MRegExp(RegExpObject *source, JSObject *prototype, bool mustClone)
+    MRegExp(types::CompilerConstraintList *constraints, RegExpObject *source, JSObject *prototype, bool mustClone)
       : source_(source),
         prototype_(prototype),
         mustClone_(mustClone)
@@ -4853,16 +4862,17 @@ class MRegExp : public MNullaryInstruction
         setResultType(MIRType_Object);
 
         JS_ASSERT(source->getProto() == prototype);
-        setResultTypeSet(MakeSingletonTypeSet(source));
+        setResultTypeSet(MakeSingletonTypeSet(constraints, source));
     }
 
   public:
     INSTRUCTION_HEADER(RegExp)
 
-    static MRegExp *New(TempAllocator &alloc, RegExpObject *source, JSObject *prototype,
+    static MRegExp *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                        RegExpObject *source, JSObject *prototype,
                         bool mustClone)
     {
-        return new(alloc) MRegExp(source, prototype, mustClone);
+        return new(alloc) MRegExp(constraints, source, prototype, mustClone);
     }
 
     bool mustClone() const {
@@ -4951,19 +4961,21 @@ class MLambda
 {
     LambdaFunctionInfo info_;
 
-    MLambda(MDefinition *scopeChain, JSFunction *fun)
+    MLambda(types::CompilerConstraintList *constraints, MDefinition *scopeChain, JSFunction *fun)
       : MUnaryInstruction(scopeChain), info_(fun)
     {
         setResultType(MIRType_Object);
         if (!fun->hasSingletonType() && !types::UseNewTypeForClone(fun))
-            setResultTypeSet(MakeSingletonTypeSet(fun));
+            setResultTypeSet(MakeSingletonTypeSet(constraints, fun));
     }
 
   public:
     INSTRUCTION_HEADER(Lambda)
 
-    static MLambda *New(TempAllocator &alloc, MDefinition *scopeChain, JSFunction *fun) {
-        return new(alloc) MLambda(scopeChain, fun);
+    static MLambda *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                        MDefinition *scopeChain, JSFunction *fun)
+    {
+        return new(alloc) MLambda(constraints, scopeChain, fun);
     }
     MDefinition *scopeChain() const {
         return getOperand(0);
@@ -5939,22 +5951,24 @@ class MArrayConcat
     CompilerRootObject templateObj_;
     gc::InitialHeap initialHeap_;
 
-    MArrayConcat(MDefinition *lhs, MDefinition *rhs, JSObject *templateObj, gc::InitialHeap initialHeap)
+    MArrayConcat(types::CompilerConstraintList *constraints, MDefinition *lhs, MDefinition *rhs,
+                 JSObject *templateObj, gc::InitialHeap initialHeap)
       : MBinaryInstruction(lhs, rhs),
         templateObj_(templateObj),
         initialHeap_(initialHeap)
     {
         setResultType(MIRType_Object);
-        setResultTypeSet(MakeSingletonTypeSet(templateObj));
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObj));
     }
 
   public:
     INSTRUCTION_HEADER(ArrayConcat)
 
-    static MArrayConcat *New(TempAllocator &alloc, MDefinition *lhs, MDefinition *rhs,
+    static MArrayConcat *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                             MDefinition *lhs, MDefinition *rhs,
                              JSObject *templateObj, gc::InitialHeap initialHeap)
     {
-        return new(alloc) MArrayConcat(lhs, rhs, templateObj, initialHeap);
+        return new(alloc) MArrayConcat(constraints, lhs, rhs, templateObj, initialHeap);
     }
 
     JSObject *templateObj() const {
@@ -8486,21 +8500,23 @@ class MRest
     public MRestCommon,
     public IntPolicy<0>
 {
-    MRest(MDefinition *numActuals, unsigned numFormals, JSObject *templateObject)
+    MRest(types::CompilerConstraintList *constraints, MDefinition *numActuals, unsigned numFormals,
+          JSObject *templateObject)
       : MUnaryInstruction(numActuals),
         MRestCommon(numFormals, templateObject)
     {
         setResultType(MIRType_Object);
-        setResultTypeSet(MakeSingletonTypeSet(templateObject));
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
     }
 
   public:
     INSTRUCTION_HEADER(Rest);
 
-    static MRest *New(TempAllocator &alloc, MDefinition *numActuals, unsigned numFormals,
+    static MRest *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+                      MDefinition *numActuals, unsigned numFormals,
                       JSObject *templateObject)
     {
-        return new(alloc) MRest(numActuals, numFormals, templateObject);
+        return new(alloc) MRest(constraints, numActuals, numFormals, templateObject);
     }
 
     MDefinition *numActuals() const {
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index b7b4f061be41..59157800c969 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -287,9 +287,7 @@ NewInitArray(JSContext *cx, uint32_t count, types::TypeObject *typeArg)
     if (!obj)
         return nullptr;
 
-    if (!type)
-        types::TypeScript::Monitor(cx, ObjectValue(*obj));
-    else
+    if (type)
         obj->setType(type);
 
     return obj;
@@ -306,9 +304,7 @@ NewInitObject(JSContext *cx, HandleObject templateObject)
     if (!obj)
         return nullptr;
 
-    if (templateObject->hasSingletonType())
-        types::TypeScript::Monitor(cx, ObjectValue(*obj));
-    else
+    if (!templateObject->hasSingletonType())
         obj->setType(templateObject->type());
 
     return obj;
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 38c3be127e82..69e7591d9684 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -424,19 +424,18 @@ enum {
      */
     OBJECT_FLAG_PRE_TENURE            = 0x00400000,
 
-    /* Flags which indicate dynamic properties of represented objects. */
-    OBJECT_FLAG_DYNAMIC_MASK          = 0x007f0000,
-
     /*
      * Whether all properties of this object are considered unknown.
-     * If set, all flags in DYNAMIC_MASK will also be set.
+     * If set, all other flags in DYNAMIC_MASK will also be set.
      */
     OBJECT_FLAG_UNKNOWN_PROPERTIES    = 0x00800000,
 
+    /* Flags which indicate dynamic properties of represented objects. */
+    OBJECT_FLAG_DYNAMIC_MASK          = 0x00ff0000,
+
     /* Mask for objects created with unknown properties. */
     OBJECT_FLAG_UNKNOWN_MASK =
         OBJECT_FLAG_DYNAMIC_MASK
-      | OBJECT_FLAG_UNKNOWN_PROPERTIES
       | OBJECT_FLAG_SETS_MARKED_UNKNOWN
 };
 typedef uint32_t TypeObjectFlags;
diff --git a/js/src/jsopcode.tbl b/js/src/jsopcode.tbl
index 9bc672f5c4eb..818e6bccfdfe 100644
--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@@ -194,9 +194,9 @@ OPDEF(JSOP_UINT16,    88, "uint16",     NULL,         3,  0,  1,  JOF_UINT16)
  * shape, which can be set at the start and slots then filled in directly.
  * NEWINIT has an extra byte so it can be exchanged with NEWOBJECT during emit.
  */
-OPDEF(JSOP_NEWINIT,   89, "newinit",    NULL,         5,  0,  1, JOF_UINT8|JOF_TYPESET)
-OPDEF(JSOP_NEWARRAY,  90, "newarray",   NULL,         4,  0,  1, JOF_UINT24|JOF_TYPESET)
-OPDEF(JSOP_NEWOBJECT, 91, "newobject",  NULL,         5,  0,  1, JOF_OBJECT|JOF_TYPESET)
+OPDEF(JSOP_NEWINIT,   89, "newinit",    NULL,         5,  0,  1, JOF_UINT8)
+OPDEF(JSOP_NEWARRAY,  90, "newarray",   NULL,         4,  0,  1, JOF_UINT24)
+OPDEF(JSOP_NEWOBJECT, 91, "newobject",  NULL,         5,  0,  1, JOF_OBJECT)
 OPDEF(JSOP_ENDINIT,   92, "endinit",    NULL,         1,  0,  0, JOF_BYTE)
 OPDEF(JSOP_INITPROP,  93, "initprop",   NULL,         5,  2,  1, JOF_ATOM|JOF_PROP|JOF_SET|JOF_DETECTING)
 
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 7f03056a48a9..57c235331b94 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -3092,7 +3092,6 @@ CASE(JSOP_NEWINIT)
         goto error;
 
     PUSH_OBJECT(*obj);
-    TypeScript::Monitor(cx, script, REGS.pc, REGS.sp[-1]);
 }
 END_CASE(JSOP_NEWINIT)
 
@@ -3106,7 +3105,6 @@ CASE(JSOP_NEWARRAY)
         goto error;
 
     PUSH_OBJECT(*obj);
-    TypeScript::Monitor(cx, script, REGS.pc, REGS.sp[-1]);
 }
 END_CASE(JSOP_NEWARRAY)
 
@@ -3122,7 +3120,6 @@ CASE(JSOP_NEWOBJECT)
         goto error;
 
     PUSH_OBJECT(*obj);
-    TypeScript::Monitor(cx, script, REGS.pc, REGS.sp[-1]);
 }
 END_CASE(JSOP_NEWOBJECT)
 
diff --git a/js/src/vm/Xdr.h b/js/src/vm/Xdr.h
index 48f5b48722c9..d8071263ff58 100644
--- a/js/src/vm/Xdr.h
+++ b/js/src/vm/Xdr.h
@@ -22,7 +22,7 @@ namespace js {
  * and saved versions. If deserialization fails, the data should be
  * invalidated if possible.
  */
-static const uint32_t XDR_BYTECODE_VERSION = uint32_t(0xb973c0de - 156);
+static const uint32_t XDR_BYTECODE_VERSION = uint32_t(0xb973c0de - 157);
 
 class XDRBuffer {
   public:

From 452b6c3fcf3e617d35a5138f706dd3e062828fa0 Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Sat, 14 Dec 2013 11:09:36 +0000
Subject: [PATCH 257/459] Bug 944704, part 4 - Fix PathBuilderCG::Arc to sweep
 in the correct direction. r=Bas

---
 gfx/2d/PathCG.cpp | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/gfx/2d/PathCG.cpp b/gfx/2d/PathCG.cpp
index de1205b7cd3c..322731407a62 100644
--- a/gfx/2d/PathCG.cpp
+++ b/gfx/2d/PathCG.cpp
@@ -68,12 +68,20 @@ void
 PathBuilderCG::Arc(const Point &aOrigin, Float aRadius, Float aStartAngle,
                  Float aEndAngle, bool aAntiClockwise)
 {
+  // Core Graphic's initial coordinate system is y-axis up, whereas Moz2D's is
+  // y-axis down. Core Graphics therefore considers "clockwise" to mean "sweep
+  // in the direction of decreasing angle" whereas Moz2D considers it to mean
+  // "sweep in the direction of increasing angle". In other words if this
+  // Moz2D method is instructed to sweep anti-clockwise we need to tell
+  // CGPathAddArc to sweep clockwise, and vice versa. Hence why we pass the
+  // value of aAntiClockwise directly to CGPathAddArc's "clockwise" bool
+  // parameter.
   CGPathAddArc(mCGPath, nullptr,
                aOrigin.x, aOrigin.y,
                aRadius,
                aStartAngle,
                aEndAngle,
-               !aAntiClockwise);
+               aAntiClockwise);
 }
 
 Point

From ded0687153ed5432376fe8aa9ef930a4ab51574b Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Sat, 14 Dec 2013 11:09:36 +0000
Subject: [PATCH 258/459] Bug 944704, part 5 - Reftest for stroke-dasharray on
 circle. r=Bas

---
 layout/reftests/svg/stroke-dasharray-02.svg | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/layout/reftests/svg/stroke-dasharray-02.svg b/layout/reftests/svg/stroke-dasharray-02.svg
index ec1c449473c5..beeb36d9b0bf 100644
--- a/layout/reftests/svg/stroke-dasharray-02.svg
+++ b/layout/reftests/svg/stroke-dasharray-02.svg
@@ -10,6 +10,16 @@
 
   <rect width="100%" height="100%" fill="lime"/>
 
+  <!-- Test circle element dashes cover two red circles -->
+  <circle cx="100" cy="62" r="8" fill="red"/>
+  <circle cx="66" cy="98" r="8" fill="red"/>
+  <circle cx="50" cy="50" r="50" fill="none" stroke="lime" stroke-width="30" stroke-dasharray="25 25 25 100000"/>
+
+  <!-- Sanity test to check that two circles cover circle element dashes (i.e. that the previous check didn't pass because the stroke was solid) -->
+  <circle cx="200" cy="50" r="50" fill="none" stroke="red" stroke-width="10" stroke-dasharray="10 40 10 100000"/>
+  <circle cx="250" cy="56" r="11" fill="lime"/>
+  <circle cx="223" cy="96" r="11" fill="lime"/>
+
   <!-- Test ellipse element dashes cover two red circles -->
   <circle cx="95" cy="211" r="8" fill="red"/>
   <circle cx="47" cy="225" r="8" fill="red"/>

From d222832e4cc4f305756f2406bbb6d2d292633305 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Sat, 14 Dec 2013 14:32:08 +0200
Subject: [PATCH 259/459] Bug 936409 - Intermittent failure |
 chrome://mochitests/content/browser/dom/indexedDB/test/browser_perwindow_privateBrowsing.js
 | Test timed out, r=ehsan

---
 dom/indexedDB/test/browser_perwindow_privateBrowsing.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dom/indexedDB/test/browser_perwindow_privateBrowsing.js b/dom/indexedDB/test/browser_perwindow_privateBrowsing.js
index 39c3d2ed2c20..ca11d3923261 100644
--- a/dom/indexedDB/test/browser_perwindow_privateBrowsing.js
+++ b/dom/indexedDB/test/browser_perwindow_privateBrowsing.js
@@ -17,6 +17,10 @@ function test1()
 {
   gBrowser.selectedTab = gBrowser.addTab();
   gBrowser.selectedBrowser.addEventListener("load", function () {
+    if (content.location != testPageURL) {
+      content.location = testPageURL;
+      return;
+    }
     gBrowser.selectedBrowser.removeEventListener("load", arguments.callee, true);
 
     setFinishedCallback(function(result, exception) {
@@ -45,6 +49,10 @@ function test3(win)
 {
   win.gBrowser.selectedTab = win.gBrowser.addTab();
   win.gBrowser.selectedBrowser.addEventListener("load", function () {
+    if (win.content.location != testPageURL) {
+      win.content.location = testPageURL;
+      return;
+    }
     win.gBrowser.selectedBrowser.removeEventListener("load", arguments.callee, true);
 
     setFinishedCallback(function(result, exception) {

From 722f9ebc4c41f78f275ec9588b0f59a0079c740c Mon Sep 17 00:00:00 2001
From: Tom Schuster <evilpies@gmail.com>
Date: Fri, 13 Dec 2013 11:37:53 +0100
Subject: [PATCH 260/459] Bug 939302 - JS::Value in dictionary_helper_gen.py is
 obsolete. r=bz

---
 js/xpconnect/src/dictionary_helper_gen.py | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/js/xpconnect/src/dictionary_helper_gen.py b/js/xpconnect/src/dictionary_helper_gen.py
index fd88d182f725..03011e4aa936 100644
--- a/js/xpconnect/src/dictionary_helper_gen.py
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@@ -236,8 +236,6 @@ def init_value(attribute):
             return ""
         if realtype.count("nsACString"):
             return ""
-        if realtype.count("JS::Value"):
-            return "JSVAL_VOID"
         return "0"
     else:
         if realtype.count("double") and attribute.defvalue == "Infinity":
@@ -279,9 +277,7 @@ def write_getter(a, iface, fd):
     realtype = a.realtype.nativeType('in')
     fd.write("    NS_ENSURE_STATE(JS_GetPropertyById(aCx, aObj, %s, &v));\n"
              % get_jsid(a.name))
-    if realtype.count("JS::Value"):
-        fd.write("    aDict.%s = v;\n" % a.name)
-    elif realtype.count("bool"):
+    if realtype.count("bool"):
         fd.write("    aDict.%s = JS::ToBoolean(v);\n" % a.name)
     elif realtype.count("uint16_t"):
         fd.write("    uint32_t u;\n")
@@ -322,7 +318,7 @@ def write_getter(a, iface, fd):
         fd.write("    nsresult rv = xpc_qsUnwrapArg<%s>(aCx, v, &d, &ref.ptr, &v);\n" % realtype.strip('* '))
         fd.write("    NS_ENSURE_SUCCESS(rv, rv);\n")
         fd.write("    aDict.%s = d;\n" % a.name)
-    elif not realtype.count("JS::Value"):
+    else:
         raise BaseException("Unsupported type %s found in dictionary %s" % (realtype, iface.name))
 
 def write_cpp(iface, fd):
@@ -335,7 +331,7 @@ def write_cpp(iface, fd):
 
     if iface.base is not None or len(attributes) > 0:
         fd.write(" :\n")
-    
+
     if iface.base is not None:
         fd.write("  %s()" % iface.base)
         if len(attributes) > 0:

From d453e990222eb3101b976ee733b6fb929ca3e3f9 Mon Sep 17 00:00:00 2001
From: Tom Schuster <evilpies@gmail.com>
Date: Sat, 30 Nov 2013 19:14:41 +0800
Subject: [PATCH 261/459] Bug 939302 - Use DOMTimestamp for timestamps in MMS.
 r=bz,gen

---
 .../interfaces/nsIDOMMozMmsMessage.idl        | 18 +++---
 .../nsIDOMMozMobileMessageThread.idl          |  6 +-
 .../interfaces/nsIDOMMozSmsMessage.idl        | 13 ++--
 dom/mobilemessage/src/MmsMessage.cpp          | 63 +++++--------------
 dom/mobilemessage/src/MobileMessageThread.cpp |  8 +--
 dom/mobilemessage/src/SmsMessage.cpp          | 19 ++----
 js/xpconnect/src/dictionary_helper_gen.py     |  4 +-
 7 files changed, 40 insertions(+), 91 deletions(-)

diff --git a/dom/mobilemessage/interfaces/nsIDOMMozMmsMessage.idl b/dom/mobilemessage/interfaces/nsIDOMMozMmsMessage.idl
index 48ca52a36d62..8baa6cdf9278 100644
--- a/dom/mobilemessage/interfaces/nsIDOMMozMmsMessage.idl
+++ b/dom/mobilemessage/interfaces/nsIDOMMozMmsMessage.idl
@@ -2,6 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "domstubs.idl"
 #include "nsISupports.idl"
 
 interface nsIDOMBlob;
@@ -19,14 +20,14 @@ dictionary MmsDeliveryInfo
 {
   DOMString? receiver;
   DOMString? deliveryStatus;
-  jsval      deliveryTimestamp; // Date object; null if not available (e.g.,
-                                // |delivery| = "received" or not yet delivered).
+  DOMTimeStamp deliveryTimestamp; // 0 if not available (e.g.,
+                                  // |delivery| = "received" or not yet delivered).
   DOMString? readStatus;
-  jsval      readTimestamp; // Date object. null if not available (e.g.,
-                            // |delivery| = "received" or not yet read).
+  DOMTimeStamp readTimestamp; // 0 if not available (e.g.,
+                              // |delivery| = "received" or not yet read).
 };
 
-[scriptable, builtinclass, uuid(82ca2465-f967-4107-a4da-65b7a15d5dba)]
+[scriptable, builtinclass, uuid(4ca3a456-0e25-4331-974a-a8f11a5efb4b)]
 interface nsIDOMMozMmsMessage : nsISupports
 {
   /**
@@ -58,8 +59,7 @@ interface nsIDOMMozMmsMessage : nsISupports
   [implicit_jscontext]
   readonly attribute jsval     receivers;      // DOMString[]
 
-  [implicit_jscontext]
-  readonly attribute jsval     timestamp;      // Date object
+  readonly attribute DOMTimeStamp timestamp;
 
   readonly attribute boolean   read;
   readonly attribute DOMString subject;
@@ -68,9 +68,7 @@ interface nsIDOMMozMmsMessage : nsISupports
   [implicit_jscontext]
   readonly attribute jsval     attachments;    // MmsAttachment[]
 
-  [implicit_jscontext]
-  readonly attribute jsval     expiryDate;     // Date object
-                                               // Expiry date for an MMS to be
+  readonly attribute DOMTimeStamp expiryDate;  // Expiry date for an MMS to be
                                                // manually downloaded.
 
   // Request read report from sender or not.
diff --git a/dom/mobilemessage/interfaces/nsIDOMMozMobileMessageThread.idl b/dom/mobilemessage/interfaces/nsIDOMMozMobileMessageThread.idl
index 823e6bc41e60..57abc2755402 100644
--- a/dom/mobilemessage/interfaces/nsIDOMMozMobileMessageThread.idl
+++ b/dom/mobilemessage/interfaces/nsIDOMMozMobileMessageThread.idl
@@ -2,9 +2,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "domstubs.idl"
 #include "nsISupports.idl"
 
-[scriptable, builtinclass, uuid(9672c75d-61a2-470e-964b-2396dcff7cf6)]
+[scriptable, builtinclass, uuid(525ad3a6-59a9-11e3-bdc3-836486cb58be)]
 interface nsIDOMMozMobileMessageThread : nsISupports
 {
   // Unique identity of the thread.
@@ -24,8 +25,7 @@ interface nsIDOMMozMobileMessageThread : nsISupports
   readonly attribute jsval              participants; // DOMString[]
 
   // Timestamp of the last message in the thread.
-  [implicit_jscontext]
-  readonly attribute jsval              timestamp; // jsval is for Date.
+  readonly attribute DOMTimeStamp       timestamp;
 
   // Message type of the last message in the thread.
   readonly attribute DOMString          lastMessageType;
diff --git a/dom/mobilemessage/interfaces/nsIDOMMozSmsMessage.idl b/dom/mobilemessage/interfaces/nsIDOMMozSmsMessage.idl
index 895874d58d14..69922cf7afbf 100644
--- a/dom/mobilemessage/interfaces/nsIDOMMozSmsMessage.idl
+++ b/dom/mobilemessage/interfaces/nsIDOMMozSmsMessage.idl
@@ -2,9 +2,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "domstubs.idl"
 #include "nsISupports.idl"
 
-[scriptable, builtinclass, uuid(db9ff254-2745-11e3-aa37-8793b90fc643)]
+[scriptable, builtinclass, uuid(c591dcf8-5322-11e3-899e-9baad640ca82)]
 interface nsIDOMMozSmsMessage : nsISupports
 {
   /**
@@ -49,13 +50,11 @@ interface nsIDOMMozSmsMessage : nsISupports
    */
   readonly attribute DOMString messageClass;
 
-  [implicit_jscontext]
-  readonly attribute jsval     timestamp; // Date object.
+  readonly attribute DOMTimeStamp timestamp;
 
-  [implicit_jscontext]
-  readonly attribute jsval     deliveryTimestamp;
-                               // Date object; null if not available (e.g.,
-                               // |delivery| = "received" or not yet delivered).
+  readonly attribute DOMTimeStamp deliveryTimestamp;
+                                  // 0 if not available (e.g., |delivery| =
+                                  // "received" or not yet delivered).
 
   readonly attribute boolean   read;
 };
diff --git a/dom/mobilemessage/src/MmsMessage.cpp b/dom/mobilemessage/src/MmsMessage.cpp
index 8db34e1c4f68..f8aef2091011 100644
--- a/dom/mobilemessage/src/MmsMessage.cpp
+++ b/dom/mobilemessage/src/MmsMessage.cpp
@@ -134,17 +134,7 @@ MmsMessage::MmsMessage(const mobilemessage::MmsMessageData& aData)
     info.deliveryStatus = statusStr;
 
     // Prepare |info.deliveryTimestamp|.
-    info.deliveryTimestamp = JSVAL_NULL;
-    if (infoData.deliveryTimestamp() != 0) {
-      AutoJSContext cx;
-      JS::Rooted<JSObject*>
-        dateObj(cx, JS_NewDateObjectMsec(cx, infoData.deliveryTimestamp()));
-      if (!dateObj) {
-        NS_WARNING("MmsMessage: Unable to create Date for deliveryTimestamp.");
-      } else {
-        info.deliveryTimestamp = OBJECT_TO_JSVAL(dateObj);
-      }
-    }
+    info.deliveryTimestamp = infoData.deliveryTimestamp();
 
     // Prepare |info.readStatus|.
     nsString statusReadString;
@@ -168,17 +158,7 @@ MmsMessage::MmsMessage(const mobilemessage::MmsMessageData& aData)
     info.readStatus = statusReadString;
 
     // Prepare |info.readTimestamp|.
-    info.readTimestamp = JSVAL_NULL;
-    if (infoData.readTimestamp() != 0) {
-      AutoJSContext cx;
-      JS::Rooted<JSObject*>
-        dateObj(cx, JS_NewDateObjectMsec(cx, infoData.readTimestamp()));
-      if (!dateObj) {
-        NS_WARNING("MmsMessage: Unable to create Data for readTimestamp.");
-      } else {
-        info.readTimestamp = OBJECT_TO_JSVAL(dateObj);
-      }
-    }
+    info.readTimestamp = infoData.readTimestamp();
 
     mDeliveryInfo.AppendElement(info);
   }
@@ -371,12 +351,7 @@ MmsMessage::GetData(ContentParent* aParent,
     infoData.deliveryStatus() = status;
 
     // Prepare |infoData.deliveryTimestamp|.
-    if (info.deliveryTimestamp == JSVAL_NULL) {
-      infoData.deliveryTimestamp() = 0;
-    } else {
-      AutoJSContext cx;
-      convertTimeToInt(cx, info.deliveryTimestamp, infoData.deliveryTimestamp());
-    }
+    infoData.deliveryTimestamp() = info.deliveryTimestamp;
 
     // Prepare |infoData.readStatus|.
     ReadStatus readStatus;
@@ -394,12 +369,7 @@ MmsMessage::GetData(ContentParent* aParent,
     infoData.readStatus() = readStatus;
 
     // Prepare |infoData.readTimestamp|.
-    if (info.readTimestamp == JSVAL_NULL) {
-      infoData.readTimestamp() = 0;
-    } else {
-      AutoJSContext cx;
-      convertTimeToInt(cx, info.readTimestamp, infoData.readTimestamp());
-    }
+    infoData.readTimestamp() = info.readTimestamp;
 
     aData.deliveryInfo().AppendElement(infoData);
   }
@@ -540,8 +510,8 @@ MmsMessage::GetDeliveryInfo(JSContext* aCx, JS::Value* aDeliveryInfo)
     }
 
     // Get |info.deliveryTimestamp|.
-    if (!JS_DefineProperty(aCx, infoJsObj,
-                           "deliveryTimestamp", info.deliveryTimestamp,
+    tmpJsVal.setNumber(static_cast<double>(info.deliveryTimestamp));
+    if (!JS_DefineProperty(aCx, infoJsObj, "deliveryTimestamp", tmpJsVal,
                            nullptr, nullptr, JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
@@ -554,13 +524,14 @@ MmsMessage::GetDeliveryInfo(JSContext* aCx, JS::Value* aDeliveryInfo)
 
     tmpJsVal.setString(tmpJsStr);
     if (!JS_DefineProperty(aCx, infoJsObj, "readStatus", tmpJsVal,
-                           NULL, NULL, JSPROP_ENUMERATE)) {
+                           nullptr, nullptr, JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
 
     // Get |info.readTimestamp|.
-    if (!JS_DefineProperty(aCx, infoJsObj, "readTimestamp", info.readTimestamp,
-                           NULL, NULL, JSPROP_ENUMERATE)) {
+    tmpJsVal.setNumber(static_cast<double>(info.readTimestamp));
+    if (!JS_DefineProperty(aCx, infoJsObj, "readTimestamp", tmpJsVal,
+                           nullptr, nullptr, JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
 
@@ -593,12 +564,9 @@ MmsMessage::GetReceivers(JSContext* aCx, JS::Value* aReceivers)
 }
 
 NS_IMETHODIMP
-MmsMessage::GetTimestamp(JSContext* cx, JS::Value* aDate)
+MmsMessage::GetTimestamp(DOMTimeStamp* aTimestamp)
 {
-  JSObject *obj = JS_NewDateObjectMsec(cx, mTimestamp);
-  NS_ENSURE_TRUE(obj, NS_ERROR_FAILURE);
-
-  *aDate = OBJECT_TO_JSVAL(obj);
+  *aTimestamp = mTimestamp;
   return NS_OK;
 }
 
@@ -691,12 +659,9 @@ MmsMessage::GetAttachments(JSContext* aCx, JS::Value* aAttachments)
 }
 
 NS_IMETHODIMP
-MmsMessage::GetExpiryDate(JSContext* cx, JS::Value* aDate)
+MmsMessage::GetExpiryDate(DOMTimeStamp* aExpiryDate)
 {
-  JSObject *obj = JS_NewDateObjectMsec(cx, mExpiryDate);
-  NS_ENSURE_TRUE(obj, NS_ERROR_FAILURE);
-
-  *aDate = OBJECT_TO_JSVAL(obj);
+  *aExpiryDate = mExpiryDate;
   return NS_OK;
 }
 
diff --git a/dom/mobilemessage/src/MobileMessageThread.cpp b/dom/mobilemessage/src/MobileMessageThread.cpp
index 3da1fea46a53..0555e4fd96b8 100644
--- a/dom/mobilemessage/src/MobileMessageThread.cpp
+++ b/dom/mobilemessage/src/MobileMessageThread.cpp
@@ -174,13 +174,9 @@ MobileMessageThread::GetParticipants(JSContext* aCx,
 }
 
 NS_IMETHODIMP
-MobileMessageThread::GetTimestamp(JSContext* aCx,
-                                  JS::Value* aDate)
+MobileMessageThread::GetTimestamp(DOMTimeStamp* aDate)
 {
-  JSObject *obj = JS_NewDateObjectMsec(aCx, mData.timestamp());
-  NS_ENSURE_TRUE(obj, NS_ERROR_FAILURE);
-
-  *aDate = OBJECT_TO_JSVAL(obj);
+  *aDate = mData.timestamp();
   return NS_OK;
 }
 
diff --git a/dom/mobilemessage/src/SmsMessage.cpp b/dom/mobilemessage/src/SmsMessage.cpp
index 534f2aa45340..1a27b4d38dca 100644
--- a/dom/mobilemessage/src/SmsMessage.cpp
+++ b/dom/mobilemessage/src/SmsMessage.cpp
@@ -260,27 +260,16 @@ SmsMessage::GetMessageClass(nsAString& aMessageClass)
 }
 
 NS_IMETHODIMP
-SmsMessage::GetTimestamp(JSContext* cx, JS::Value* aDate)
+SmsMessage::GetTimestamp(DOMTimeStamp* aDate)
 {
-  JSObject *obj = JS_NewDateObjectMsec(cx, mData.timestamp());
-  NS_ENSURE_TRUE(obj, NS_ERROR_FAILURE);
-
-  *aDate = OBJECT_TO_JSVAL(obj);
+  *aDate = mData.timestamp();
   return NS_OK;
 }
 
 NS_IMETHODIMP
-SmsMessage::GetDeliveryTimestamp(JSContext* aCx, JS::Value* aDate)
+SmsMessage::GetDeliveryTimestamp(DOMTimeStamp* aDate)
 {
-  if (mData.deliveryTimestamp() == 0) {
-    *aDate = JSVAL_NULL;
-    return NS_OK;
-  }
-
-  JSObject *obj = JS_NewDateObjectMsec(aCx, mData.deliveryTimestamp());
-  NS_ENSURE_TRUE(obj, NS_ERROR_FAILURE);
-
-  *aDate = OBJECT_TO_JSVAL(obj);
+  *aDate = mData.deliveryTimestamp();
   return NS_OK;
 }
 
diff --git a/js/xpconnect/src/dictionary_helper_gen.py b/js/xpconnect/src/dictionary_helper_gen.py
index 03011e4aa936..40fea45456f3 100644
--- a/js/xpconnect/src/dictionary_helper_gen.py
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@@ -58,6 +58,8 @@ def attributeVariableTypeAndName(a):
         l = ["nsString %s" % a.name]
     elif a.realtype.nativeType('in').count("JS::Value"):
         l = ["JS::Value %s" % a.name]
+    elif a.realtype.nativeType('in').count("DOMTimeStamp"):
+        l = ["uint64_t /* DOMTimeStamp */ %s" % a.name]
     else:
         l = ["%s%s" % (a.realtype.nativeType('in'),
                        a.name)]
@@ -291,7 +293,7 @@ def write_getter(a, iface, fd):
         fd.write("    NS_ENSURE_STATE(JS::ToUint32(aCx, v, &aDict.%s));\n" % a.name)
     elif realtype.count("int32_t"):
         fd.write("    NS_ENSURE_STATE(JS::ToInt32(aCx, v, &aDict.%s));\n" % a.name)
-    elif realtype.count("uint64_t"):
+    elif realtype.count("uint64_t") or realtype.count("DOMTimeStamp"):
         fd.write("    NS_ENSURE_STATE(JS::ToUint64(aCx, v, &aDict.%s));\n" % a.name)
     elif realtype.count("int64_t"):
         fd.write("    NS_ENSURE_STATE(JS::ToInt64(aCx, v, &aDict.%s));\n" % a.name)

From 6eb7a605db8b8738284c51cf0cae3b15b3455e58 Mon Sep 17 00:00:00 2001
From: Gene Lian <clian@mozilla.com>
Date: Mon, 2 Dec 2013 14:31:57 +0800
Subject: [PATCH 262/459] Bug 939302 - Test. r=vicamo

---
 .../tests/marionette/test_filter_date.js      |  3 +--
 .../tests/marionette/test_getmessage.js       | 10 +++------
 .../tests/marionette/test_getmessages.js      |  3 +--
 .../tests/marionette/test_getthreads.js       |  2 --
 .../tests/marionette/test_incoming.js         |  3 +--
 .../tests/marionette/test_incoming_delete.js  |  3 +--
 .../marionette/test_incoming_max_segments.js  |  3 +--
 .../marionette/test_incoming_multipart.js     |  3 +--
 .../test_massive_incoming_delete.js           |  3 +--
 .../tests/marionette/test_message_classes.js  | 15 ++++++-------
 .../tests/marionette/test_outgoing.js         |  7 +++---
 .../tests/marionette/test_outgoing_delete.js  |  3 +--
 .../test_update_thread_record_in_delete.js    |  2 +-
 .../tests/test_smsservice_createsmsmessage.js | 22 ++++++++-----------
 14 files changed, 31 insertions(+), 51 deletions(-)

diff --git a/dom/mobilemessage/tests/marionette/test_filter_date.js b/dom/mobilemessage/tests/marionette/test_filter_date.js
index ace1532e66c3..b02f21f3c532 100644
--- a/dom/mobilemessage/tests/marionette/test_filter_date.js
+++ b/dom/mobilemessage/tests/marionette/test_filter_date.js
@@ -178,8 +178,7 @@ function getMsgs() {
 function verifyFoundMsgs(foundSmsList) {
   for (var x = 0; x < foundSmsList.length; x++) {
     is(foundSmsList[x].id, smsList[x].id, "id");
-    is(foundSmsList[x].timestamp.getTime(), smsList[x].timestamp.getTime(),
-        "timestmap");
+    is(foundSmsList[x].timestamp, smsList[x].timestamp, "timestmap");
   }
   deleteAllMsgs(cleanUp);
 }
diff --git a/dom/mobilemessage/tests/marionette/test_getmessage.js b/dom/mobilemessage/tests/marionette/test_getmessage.js
index 527979f70a17..edf76f604c4e 100644
--- a/dom/mobilemessage/tests/marionette/test_getmessage.js
+++ b/dom/mobilemessage/tests/marionette/test_getmessage.js
@@ -48,7 +48,6 @@ function simulateIncomingSms() {
     is(incomingSms.receiver, EMULATOR, "receiver");
     is(incomingSms.sender, REMOTE, "sender");
     is(incomingSms.messageClass, "normal", "messageClass");
-    ok(incomingSms.timestamp instanceof Date, "timestamp is instanceof date");
     inSmsTimeStamp = incomingSms.timestamp;
     sendSms();
   };
@@ -77,9 +76,8 @@ function sendSms() {
     is(sentSms.receiver, REMOTE, "receiver");
     is(sentSms.sender, EMULATOR, "sender");
     is(sentSms.messageClass, "normal", "messageClass");
-    ok(sentSms.timestamp instanceof Date, "timestamp is instanceof date");  
     outSmsTimeStamp = sentSms.timestamp;
-    ok(sentSms.deliveryTimestamp === null, "deliveryTimestamp is null");
+    is(sentSms.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
     if (gotSmsOnsent && gotReqOnsuccess) { getReceivedSms(); }
   };
@@ -128,8 +126,7 @@ function getReceivedSms() {
     is(foundSms.receiver, EMULATOR, "receiver");
     is(foundSms.sender, REMOTE, "sender");
     is(foundSms.messageClass, "normal", "messageClass");
-    ok(foundSms.timestamp instanceof Date, "timestamp is instanceof date");
-    is(foundSms.timestamp.getTime(), inSmsTimeStamp.getTime(), "timestamp matches");
+    is(foundSms.timestamp, inSmsTimeStamp, "timestamp matches");
     getSentSms();
   };
 
@@ -162,8 +159,7 @@ function getSentSms() {
     is(foundSms.receiver, REMOTE, "receiver");
     is(foundSms.sender, EMULATOR, "sender");
     is(foundSms.messageClass, "normal", "messageClass");
-    ok(foundSms.timestamp instanceof Date, "timestamp is instanceof date");
-    is(foundSms.timestamp.getTime(), outSmsTimeStamp.getTime(), "timestamp matches");
+    is(foundSms.timestamp, outSmsTimeStamp, "timestamp matches");
     deleteMsgs();
   };
 
diff --git a/dom/mobilemessage/tests/marionette/test_getmessages.js b/dom/mobilemessage/tests/marionette/test_getmessages.js
index 59f8c4c10012..c11edf2efe97 100644
--- a/dom/mobilemessage/tests/marionette/test_getmessages.js
+++ b/dom/mobilemessage/tests/marionette/test_getmessages.js
@@ -201,8 +201,7 @@ function verifyFoundMsgs(foundSmsList, reverse) {
     }
 
     isIn(foundSmsList[x].sender, [smsList[x].sender, "+15552229797"], "sender");
-    is(foundSmsList[x].timestamp.getTime(), smsList[x].timestamp.getTime(),
-        "timestamp");
+    is(foundSmsList[x].timestamp, smsList[x].timestamp, "timestamp");
   }
 
   log("Content in all of the returned SMS messages is correct.");
diff --git a/dom/mobilemessage/tests/marionette/test_getthreads.js b/dom/mobilemessage/tests/marionette/test_getthreads.js
index 737667bbb316..9544d97b896c 100644
--- a/dom/mobilemessage/tests/marionette/test_getthreads.js
+++ b/dom/mobilemessage/tests/marionette/test_getthreads.js
@@ -153,8 +153,6 @@ function checkThread(bodies, lastBody, unreadCount, participants,
        "thread.participants[" + i + "]");
   }
 
-  ok(thread.timestamp instanceof Date, "thread.timestamp");
-
   // Check whether the thread does contain all the messages it supposed to have.
   let filter = new MozSmsFilter;
   filter.threadId = thread.id;
diff --git a/dom/mobilemessage/tests/marionette/test_incoming.js b/dom/mobilemessage/tests/marionette/test_incoming.js
index 839672f3d0aa..f7b5c2c9d56e 100644
--- a/dom/mobilemessage/tests/marionette/test_incoming.js
+++ b/dom/mobilemessage/tests/marionette/test_incoming.js
@@ -35,8 +35,7 @@ manager.onreceived = function onreceived(event) {
   is(message.receiver, RECEIVER, "Message receiver");
   is(message.body, body, "Message body");
   is(message.messageClass, "normal", "Message class");
-  ok(message.timestamp instanceof Date, "Message timestamp is a date");
-  ok(message.deliveryTimestamp === null, "Message deliveryTimestamp is null");
+  is(message.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
   cleanUp();
 };
diff --git a/dom/mobilemessage/tests/marionette/test_incoming_delete.js b/dom/mobilemessage/tests/marionette/test_incoming_delete.js
index 70e8f0ea6f60..d6f504f37da0 100644
--- a/dom/mobilemessage/tests/marionette/test_incoming_delete.js
+++ b/dom/mobilemessage/tests/marionette/test_incoming_delete.js
@@ -36,8 +36,7 @@ function simulateIncomingSms() {
     is(incomingSms.receiver, RECEIVER, "receiver");
     is(incomingSms.sender, SENDER, "sender");
     is(incomingSms.messageClass, "normal", "messageClass");
-    ok(incomingSms.timestamp instanceof Date, "timestamp is istanceof date");
-    ok(incomingSms.deliveryTimestamp === null, "deliveryTimestamp is null");
+    is(incomingSms.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
     verifySmsExists(incomingSms);
   };
diff --git a/dom/mobilemessage/tests/marionette/test_incoming_max_segments.js b/dom/mobilemessage/tests/marionette/test_incoming_max_segments.js
index f353233faa56..737750b258b6 100644
--- a/dom/mobilemessage/tests/marionette/test_incoming_max_segments.js
+++ b/dom/mobilemessage/tests/marionette/test_incoming_max_segments.js
@@ -44,8 +44,7 @@ function simulateIncomingSms() {
     is(incomingSms.read, false, "read");
     is(incomingSms.receiver, EMULATOR, "receiver");
     is(incomingSms.sender, REMOTE, "sender");
-    ok(incomingSms.timestamp instanceof Date, "timestamp is instanceof date");
-    ok(incomingSms.deliveryTimestamp === null, "deliveryTimestamp is null");
+    is(incomingSms.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
     verifySmsExists(incomingSms);
   };
diff --git a/dom/mobilemessage/tests/marionette/test_incoming_multipart.js b/dom/mobilemessage/tests/marionette/test_incoming_multipart.js
index 76221958e33e..f7afdd699095 100644
--- a/dom/mobilemessage/tests/marionette/test_incoming_multipart.js
+++ b/dom/mobilemessage/tests/marionette/test_incoming_multipart.js
@@ -40,8 +40,7 @@ function simulateIncomingSms() {
     is(incomingSms.read, false, "read");
     is(incomingSms.receiver, RECEIVER, "receiver");
     is(incomingSms.sender, SENDER, "sender");
-    ok(incomingSms.timestamp instanceof Date, "timestamp is istanceof date");
-    ok(incomingSms.deliveryTimestamp === null, "deliveryTimestamp is null");
+    is(incomingSms.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
     verifySmsExists(incomingSms);
   };
diff --git a/dom/mobilemessage/tests/marionette/test_massive_incoming_delete.js b/dom/mobilemessage/tests/marionette/test_massive_incoming_delete.js
index 61f01299d82b..be254f72381c 100644
--- a/dom/mobilemessage/tests/marionette/test_massive_incoming_delete.js
+++ b/dom/mobilemessage/tests/marionette/test_massive_incoming_delete.js
@@ -145,8 +145,7 @@ tasks.push(function init() {
     is(incomingSms.receiver, RECEIVER, "receiver");
     is(incomingSms.sender, SENDER, "sender");
     is(incomingSms.messageClass, "normal", "messageClass");
-    ok(incomingSms.timestamp instanceof Date, "timestamp is istanceof date");
-    ok(incomingSms.deliveryTimestamp === null, "deliveryTimestamp is null");
+    is(incomingSms.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
     verifySmsExists(incomingSms);
   };
diff --git a/dom/mobilemessage/tests/marionette/test_message_classes.js b/dom/mobilemessage/tests/marionette/test_message_classes.js
index 8933d4eefda4..f7e6095f1af0 100644
--- a/dom/mobilemessage/tests/marionette/test_message_classes.js
+++ b/dom/mobilemessage/tests/marionette/test_message_classes.js
@@ -49,8 +49,7 @@ function checkMessage(message, id, threadId, messageClass) {
   is(message.sender, "+1", "message.sender");
   is(message.body, "A", "message.body");
   is(message.messageClass, messageClass, "message.messageClass");
-  ok(message.timestamp instanceof Date, "timestamp is instanceof Date");
-  ok(message.deliveryTimestamp === null, "deliveryTimestamp is null");
+  is(message.deliveryTimestamp, 0, "deliveryTimestamp is 0");
   is(message.read, false, "message.read");
 }
 
@@ -67,9 +66,9 @@ function test_message_class_0() {
 
       let message = event.message;
       checkMessage(message, -1, 0, "class-0");
-      ok(event.message.timestamp.getTime() >= timeBeforeSend,
+      ok(event.message.timestamp >= timeBeforeSend,
          "Message's timestamp should be greater then the timetamp of sending");
-      ok(event.message.timestamp.getTime() <= Date.now(),
+      ok(event.message.timestamp <= Date.now(),
          "Message's timestamp should be lesser than the timestamp of now");
 
       // Make sure the message is not stored.
@@ -115,9 +114,9 @@ function doTestMessageClassGeneric(allDCSs, messageClass, next) {
 
       // Make sure we can correctly receive the message
       checkMessage(event.message, null, null, messageClass);
-      ok(event.message.timestamp.getTime() >= timeBeforeSend,
+      ok(event.message.timestamp >= timeBeforeSend,
          "Message's timestamp should be greater then the timetamp of sending");
-      ok(event.message.timestamp.getTime() <= Date.now(),
+      ok(event.message.timestamp <= Date.now(),
          "Message's timestamp should be lesser than the timestamp of now");
 
       ++dcsIndex;
@@ -170,9 +169,9 @@ function test_message_class_2() {
         if (pidIndex == 0) {
           // Make sure we can correctly receive the message
           checkMessage(event.message, null, null, "class-2");
-          ok(event.message.timestamp.getTime() >= timeBeforeSend,
+          ok(event.message.timestamp >= timeBeforeSend,
              "Message's timestamp should be greater then the timetamp of sending");
-          ok(event.message.timestamp.getTime() <= Date.now(),
+          ok(event.message.timestamp <= Date.now(),
              "Message's timestamp should be lesser than the timestamp of now");
 
           next();
diff --git a/dom/mobilemessage/tests/marionette/test_outgoing.js b/dom/mobilemessage/tests/marionette/test_outgoing.js
index 8bc35ca9659c..b3b681230567 100644
--- a/dom/mobilemessage/tests/marionette/test_outgoing.js
+++ b/dom/mobilemessage/tests/marionette/test_outgoing.js
@@ -43,10 +43,9 @@ function checkMessage(message, delivery, body) {
   ok(message.receiver, "message.receiver");
   is(message.body, body, "message.body");
   is(message.messageClass, "normal", "message.messageClass");
-  ok(message.timestamp instanceof Date, "timestamp is instanceof Date");
 
   // TODO: bug 788928 - add test cases for deliverysuccess event.
-  ok(message.deliveryTimestamp === null, "deliveryTimestamp is null");
+  is(message.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
   is(message.read, true, "message.read");
 }
@@ -91,7 +90,7 @@ function doSendMessageAndCheckSuccess(receivers, body, callback) {
     is(message.id, saved.id, "message.id");
     is(message.receiver, saved.receiver, "message.receiver");
     is(message.body, saved.body, "message.body");
-    is(message.timestamp.getTime(), saved.timestamp.getTime(),
+    is(message.timestamp, saved.timestamp,
        "the messages got from onsent event and request result must be the same");
 
     opt[mark] = true;
@@ -120,7 +119,7 @@ function doSendMessageAndCheckSuccess(receivers, body, callback) {
     let message = event.message;
     checkMessage(message, "sending", body);
     // timestamp is in seconds.
-    ok(Math.floor(message.timestamp.getTime() / 1000) >= Math.floor(now / 1000),
+    ok(Math.floor(message.timestamp / 1000) >= Math.floor(now / 1000),
        "sent timestamp is valid");
 
     let receiver = message.receiver;
diff --git a/dom/mobilemessage/tests/marionette/test_outgoing_delete.js b/dom/mobilemessage/tests/marionette/test_outgoing_delete.js
index 5a012bd01996..3b9177ecdefd 100644
--- a/dom/mobilemessage/tests/marionette/test_outgoing_delete.js
+++ b/dom/mobilemessage/tests/marionette/test_outgoing_delete.js
@@ -42,8 +42,7 @@ function sendSms() {
     is(sentSms.receiver, RECEIVER, "receiver");
     is(sentSms.sender, SENDER, "sender");
     is(sentSms.messageClass, "normal", "messageClass");
-    ok(sentSms.timestamp instanceof Date, "timestamp is istanceof date");
-    ok(sentSms.deliveryTimestamp === null, "deliveryTimestamp is null");
+    is(sentSms.deliveryTimestamp, 0, "deliveryTimestamp is 0");
 
     if (gotSmsOnsent && gotReqOnsuccess) { verifySmsExists(smsId); }
   };
diff --git a/dom/mobilemessage/tests/marionette/test_update_thread_record_in_delete.js b/dom/mobilemessage/tests/marionette/test_update_thread_record_in_delete.js
index 071c9cea19f7..4316010af24d 100644
--- a/dom/mobilemessage/tests/marionette/test_update_thread_record_in_delete.js
+++ b/dom/mobilemessage/tests/marionette/test_update_thread_record_in_delete.js
@@ -114,7 +114,7 @@ function checkThread(thread, id, body, unreadCount, timestamp)
   is(thread.body, body, "Thread subject is set to last message body");
   is(thread.unreadCount, unreadCount, "Thread unread count");
   is(JSON.stringify(thread.participants), JSON.stringify([FROM]), "Thread participants");
-  is(thread.timestamp.getTime(), timestamp.getTime(), "Thread timestamp is set");
+  is(thread.timestamp, timestamp, "Thread timestamp is set");
 }
 
 tasks.push(deleteAllMessages);
diff --git a/dom/mobilemessage/tests/test_smsservice_createsmsmessage.js b/dom/mobilemessage/tests/test_smsservice_createsmsmessage.js
index 2c9b51a965f8..ee638e89290a 100644
--- a/dom/mobilemessage/tests/test_smsservice_createsmsmessage.js
+++ b/dom/mobilemessage/tests/test_smsservice_createsmsmessage.js
@@ -44,8 +44,7 @@ add_test(function test_interface() {
   do_check_eq(sms.sender, null);
   do_check_eq(sms.body, null);
   do_check_eq(sms.messageClass, "normal");
-  do_check_true(sms.timestamp instanceof Date);
-  do_check_true(sms.deliveryTimestamp === null);
+  do_check_eq(sms.deliveryTimestamp, 0);
   do_check_true(sms.read);
   run_next_test();
 });
@@ -66,8 +65,7 @@ add_test(function test_icc_id_not_available() {
   do_check_eq(sms.sender, null);
   do_check_eq(sms.body, null);
   do_check_eq(sms.messageClass, "normal");
-  do_check_true(sms.timestamp instanceof Date);
-  do_check_true(sms.deliveryTimestamp === null);
+  do_check_eq(sms.deliveryTimestamp, 0);
   do_check_true(sms.read);
   run_next_test();
 });
@@ -107,11 +105,11 @@ add_test(function test_readonly_attributes() {
   do_check_eq(sms.messageClass, "normal");
 
   let oldTimestamp = sms.timestamp;
-  sms.timestamp = new Date();
-  do_check_eq(sms.timestamp.getTime(), oldTimestamp.getTime());
+  sms.timestamp = Date.now();
+  do_check_eq(sms.timestamp, oldTimestamp);
 
   let oldDeliveryTimestamp = sms.deliveryTimestamp;
-  sms.deliveryTimestamp = new Date();
+  sms.deliveryTimestamp = Date.now();
   do_check_eq(sms.deliveryTimestamp, oldDeliveryTimestamp);
 
   sms.read = false;
@@ -136,9 +134,8 @@ add_test(function test_timestamp_number() {
   do_check_eq(sms.receiver, "the receiver");
   do_check_eq(sms.body, "the body");
   do_check_eq(sms.messageClass, "normal");
-  do_check_true(sms.timestamp instanceof Date);
-  do_check_eq(sms.timestamp.getTime(), ts);
-  do_check_true(sms.deliveryTimestamp === null);
+  do_check_eq(sms.timestamp, ts);
+  do_check_eq(sms.deliveryTimestamp, 0);
   do_check_true(sms.read);
   run_next_test();
 });
@@ -159,9 +156,8 @@ add_test(function test_timestamp_date() {
   do_check_eq(sms.receiver, "the receiver");
   do_check_eq(sms.body, "the body");
   do_check_eq(sms.messageClass, "normal");
-  do_check_true(sms.timestamp instanceof Date);
-  do_check_eq(sms.timestamp.getTime(), date.getTime());
-  do_check_true(sms.deliveryTimestamp === null);
+  do_check_eq(sms.timestamp, date.getTime());
+  do_check_eq(sms.deliveryTimestamp, 0);
   do_check_true(sms.read);
   run_next_test();
 });

From 2b44f13e70d9abe6508fd5669c520803da28f0a1 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 04:00:25 -0800
Subject: [PATCH 263/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/c286367cbca4
Author: Zac <zcampbell@mozilla.com>
Desc: Merge pull request #14603 from askeing/949364

Bug 949364 - Unxfail test_add_photo_to_contact.py

========

https://hg.mozilla.org/integration/gaia-central/rev/cc220c2174e4
Author: askeing <askeing@gmail.com>
Desc: Bug 949364 - Unxfail test_add_photo_to_contact.py
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index c7ef08352cfe..b9216bea4d04 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "5eec0ba9c37b697e3055427ebdd54e8bdc3194dd", 
+    "revision": "c286367cbca47da4e58c6d0405f1058495b7dae5", 
     "repo_path": "/integration/gaia-central"
 }

From 657e70b6271b81a761f83eccfa9e4fc730f40eea Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 04:40:23 -0800
Subject: [PATCH 264/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/260f4e993990
Author: Zac <zcampbell@mozilla.com>
Desc: Merge pull request #14534 from viorelaioia/bug_948385

Bug 948385 - Merge test_set_alarm_repeat, test_set_alarm_snooze, test_set_alarm_sound.py

========

https://hg.mozilla.org/integration/gaia-central/rev/d4550889f8f7
Author: Viorela Ioia <viorelaioia@gmail.com>
Desc: Bug 948385 - Merge test_set_alarm_repeat, test_set_alarm_snooze, test_set_alarm_sound.py
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index b9216bea4d04..6bb0364ca67c 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "c286367cbca47da4e58c6d0405f1058495b7dae5", 
+    "revision": "260f4e9939900dd7a65a9fd6d781e7756c76bcda", 
     "repo_path": "/integration/gaia-central"
 }

From f5a52d7f96b81ddd9b26dbcfc232f8c35138aad4 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 05:05:24 -0800
Subject: [PATCH 265/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/170e7761cc89
Author: Florin Strugariu <bebef_1987@yahoo.com>
Desc: Merge pull request #14606 from zacc/bug_949393

Bug 949393 - Re-enable test_number_keyboard and test_url_keyboard - Trav...

========

https://hg.mozilla.org/integration/gaia-central/rev/56f1a6a032a6
Author: Zac Campbell <zcampbell@mozilla.com>
Desc: Bug 949393 - Re-enable test_number_keyboard and test_url_keyboard - Travis intermittents
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 6bb0364ca67c..daa90c2faad0 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "260f4e9939900dd7a65a9fd6d781e7756c76bcda", 
+    "revision": "170e7761cc89523e753c8ad74918417181360bd8", 
     "repo_path": "/integration/gaia-central"
 }

From ceb9c590f12779888fd9eb799e1fc0e38c845700 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 05:40:24 -0800
Subject: [PATCH 266/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/6d701d9ba0cc
Author: Ben Francis <ben@tola.me.uk>
Desc: Merge pull request #14591 from daleharvey/946807

Bug 946807 - Dont postResult to activity with no return value r=benfrancis

========

https://hg.mozilla.org/integration/gaia-central/rev/95f69b580071
Author: Dale Harvey <dale@arandomurl.com>
Desc: Bug 946807 - Dont postResult to activity with no return value
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index daa90c2faad0..bf9072a48ab7 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "170e7761cc89523e753c8ad74918417181360bd8", 
+    "revision": "6d701d9ba0cc5dd1e1aa0ea98374e4e2dd75a63d", 
     "repo_path": "/integration/gaia-central"
 }

From 602dccce91585855e73aed02fe942174ce766da9 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 06:55:24 -0800
Subject: [PATCH 267/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/c7673349a25a
Author: gitmai <mri@tid.es>
Desc: Merge pull request #14557 from gitmai/bug-937251-CC-Remove-proxy

Bug 937251 - [Cost Control] Remove proxy
r=salva

========

https://hg.mozilla.org/integration/gaia-central/rev/d1c52f81e1d1
Author: mai <mri@tid.es>
Desc: Bug 937251 - [Cost Control] Remove proxy
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index bf9072a48ab7..97c8b4cde09e 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "6d701d9ba0cc5dd1e1aa0ea98374e4e2dd75a63d", 
+    "revision": "c7673349a25a32f37ea7fc1df59c4678e42c67b1", 
     "repo_path": "/integration/gaia-central"
 }

From b8c643a2fb6ea504ae98604cb07a9d2fe0d09864 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 07:20:31 -0800
Subject: [PATCH 268/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/5823626437f8
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Merge pull request #14570 from fcampo/mms-message-width-948346

Bug 948346 - MMS when message has multiple lines, it cuts off (r=julienw)

========

https://hg.mozilla.org/integration/gaia-central/rev/bf02ef63dd92
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Bug 948346 - MMS when message has multiple lines, it cuts off
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 97c8b4cde09e..0663f6759643 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "c7673349a25a32f37ea7fc1df59c4678e42c67b1", 
+    "revision": "5823626437f8f85d43da71be012b3e045ae3b66c", 
     "repo_path": "/integration/gaia-central"
 }

From 399d87d34cf16d2551a10e1faa98f6021f1ebe6e Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 08:05:23 -0800
Subject: [PATCH 269/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/a75131f0d840
Author: Cristian Rodriguez <crdlc@tid.es>
Desc: Merge pull request #14600 from crdlc/bug-949351

Bug 949351 - [Download Manager] Remove workaround to avoid bug 944682

========

https://hg.mozilla.org/integration/gaia-central/rev/e71c17134565
Author: crdlc <crdlc@tid.es>
Desc: Bug 949351 - [Download Manager] Remove workaround to avoid bug 944682
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 0663f6759643..48360733833a 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "5823626437f8f85d43da71be012b3e045ae3b66c", 
+    "revision": "a75131f0d8404baa376d1a3b1d0f11444e363a72", 
     "repo_path": "/integration/gaia-central"
 }

From b5f3dc97e9f5f3abacc041c61f891fefd889593b Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 08:30:23 -0800
Subject: [PATCH 270/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/956a9d7e094c
Author: Amir Nissim <amirnissim@gmail.com>
Desc: Merge pull request #14605 from EverythingMe/949392-music2

Bug 949392 - [e.me] 'Music2' removed from 'Music' collection when adding a web app [r=ranbena]

========

https://hg.mozilla.org/integration/gaia-central/rev/3a63e79f5c02
Author: Amir Nissim <amirnissim@gmail.com>
Desc: Bug 949392 - [e.me] 'Music2' removed from 'Music' collection when adding a web app [r=ranbena]
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 48360733833a..ea8e1a02f82e 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "a75131f0d8404baa376d1a3b1d0f11444e363a72", 
+    "revision": "956a9d7e094c944d585b1896dc5bc5943b69c632", 
     "repo_path": "/integration/gaia-central"
 }

From a8c9c53c8549f6fdbd4149c7c38ed55c41c33b87 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 09:06:25 -0800
Subject: [PATCH 271/459] Bumping gaia.json for 1 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/55fbd5145bbd
Author: Dave Hunt <dave.hunt@gmail.com>
Desc: Bug 949459 - Restore support for older branches in gaia_apps.js. r=akuo
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ea8e1a02f82e..ca6234249b71 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "956a9d7e094c944d585b1896dc5bc5943b69c632", 
+    "revision": "55fbd5145bbdcfd23ff702819f7a556adad830f4", 
     "repo_path": "/integration/gaia-central"
 }

From aef0eaa84cbf29c938020cb6ee21c60fe447d0a0 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 09:45:30 -0800
Subject: [PATCH 272/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/ad3545b1b770
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Merge pull request #14502 from tdz/bug-947918

Bug 947918: Support seeking to end of BlobView buffer r=padenot

========

https://hg.mozilla.org/integration/gaia-central/rev/1f59113f9d80
Author: Thomas Zimmermann <tdz@users.sourceforge.net>
Desc: Bug 947918: Support seeking to end of BlobView buffer

Reading or advancing through all bytes in a BlobView buffer sets
the index to the length of the buffer. This patch changes 'seek'
to work the same way, so it's possible to seek to the buffer's
end.

Signed-off-by: Thomas Zimmermann <tdz@users.sourceforge.net>
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ca6234249b71..ac2fb8bab654 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "55fbd5145bbdcfd23ff702819f7a556adad830f4", 
+    "revision": "ad3545b1b7704566e41a3083b831d8fc8636a436", 
     "repo_path": "/integration/gaia-central"
 }

From ddbe58fa10a791ccba7efdef9cf904ca34d301c6 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 10:21:25 -0800
Subject: [PATCH 273/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/9271d94f35a5
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Merge pull request #14577 from Rik/stop-ringtone-power-button-890434

Bug 890434 - Impossible to silence an incoming call without rejecting it r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/bae67c5e1267
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Bug 890434 - Impossible to silence an incoming call without rejecting it

We use Inter App Communication to make this work
- System app sends a message in 'dialercomms' when we press the power or volumedown buttons
- The Call Screen stops ringing and vibrating when receiving this message

I moved the Audio mock to shared because it is now used by 3 apps.
Had to modify some sms tests to work with the new shared mock.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ac2fb8bab654..32baa9dd5e1b 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "ad3545b1b7704566e41a3083b831d8fc8636a436", 
+    "revision": "9271d94f35a54995e4442da711e51cff0244741d", 
     "repo_path": "/integration/gaia-central"
 }

From 5642127a72fda726ba07dec538f397897656a233 Mon Sep 17 00:00:00 2001
From: Kartikaya Gupta <kgupta@mozilla.com>
Date: Thu, 12 Dec 2013 13:27:07 -0500
Subject: [PATCH 274/459] Bug 933264 - Add functions to print nsDisplayListSet
 instance. r=tn

---
 layout/base/nsLayoutDebugger.cpp | 37 ++++++++++++++++++++++++++++++++
 layout/generic/nsFrame.h         |  4 ++++
 2 files changed, 41 insertions(+)

diff --git a/layout/base/nsLayoutDebugger.cpp b/layout/base/nsLayoutDebugger.cpp
index 5948333193ef..59b955f32385 100644
--- a/layout/base/nsLayoutDebugger.cpp
+++ b/layout/base/nsLayoutDebugger.cpp
@@ -215,4 +215,41 @@ nsFrame::PrintDisplayList(nsDisplayListBuilder* aBuilder,
   PrintDisplayListTo(aBuilder, aList, aFile, aDumpHtml);
 }
 
+static void
+PrintDisplayListSetItem(nsDisplayListBuilder* aBuilder,
+                        const char* aItemName,
+                        const nsDisplayList& aList,
+                        FILE* aFile,
+                        bool aDumpHtml)
+{
+  if (aDumpHtml) {
+    fprintf_stderr(aFile, "<li>");
+  }
+  fprintf_stderr(aFile, "%s", aItemName);
+  PrintDisplayListTo(aBuilder, aList, aFile, aDumpHtml);
+  if (aDumpHtml) {
+    fprintf_stderr(aFile, "</li>");
+  }
+}
+
+void
+nsFrame::PrintDisplayListSet(nsDisplayListBuilder* aBuilder,
+                             const nsDisplayListSet& aSet,
+                             FILE *aFile,
+                             bool aDumpHtml)
+{
+  if (aDumpHtml) {
+    fprintf_stderr(aFile, "<ul>");
+  }
+  PrintDisplayListSetItem(aBuilder, "[BorderBackground]", *(aSet.BorderBackground()), aFile, aDumpHtml);
+  PrintDisplayListSetItem(aBuilder, "[BlockBorderBackgrounds]", *(aSet.BlockBorderBackgrounds()), aFile, aDumpHtml);
+  PrintDisplayListSetItem(aBuilder, "[Floats]", *(aSet.Floats()), aFile, aDumpHtml);
+  PrintDisplayListSetItem(aBuilder, "[PositionedDescendants]", *(aSet.PositionedDescendants()), aFile, aDumpHtml);
+  PrintDisplayListSetItem(aBuilder, "[Outlines]", *(aSet.Outlines()), aFile, aDumpHtml);
+  PrintDisplayListSetItem(aBuilder, "[Content]", *(aSet.Content()), aFile, aDumpHtml);
+  if (aDumpHtml) {
+    fprintf_stderr(aFile, "</ul>");
+  }
+}
+
 #endif
diff --git a/layout/generic/nsFrame.h b/layout/generic/nsFrame.h
index deabc6bbd569..c8a89c88d0eb 100644
--- a/layout/generic/nsFrame.h
+++ b/layout/generic/nsFrame.h
@@ -713,6 +713,10 @@ public:
                                const nsDisplayList& aList,
                                FILE* aFile = stdout,
                                bool aDumpHtml = false);
+  static void PrintDisplayListSet(nsDisplayListBuilder* aBuilder,
+                                  const nsDisplayListSet& aList,
+                                  FILE* aFile = stdout,
+                                  bool aDumpHtml = false);
 
 #endif
 };

From 6c7c9a5200173fb7719af069024fc94ea8999479 Mon Sep 17 00:00:00 2001
From: Kartikaya Gupta <kgupta@mozilla.com>
Date: Thu, 12 Dec 2013 13:34:50 -0500
Subject: [PATCH 275/459] Bug 949310. r=BenWa

---
 gfx/layers/Layers.cpp                            | 14 +++++++-------
 gfx/layers/Layers.h                              |  7 ++-----
 gfx/layers/composite/AsyncCompositionManager.cpp |  2 +-
 gfx/layers/ipc/LayerTransactionParent.cpp        |  6 ++----
 gfx/layers/ipc/LayersMessages.ipdlh              |  1 -
 gfx/layers/ipc/ShadowLayers.cpp                  |  7 ++-----
 6 files changed, 14 insertions(+), 23 deletions(-)

diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 1aa0a3b90e17..f59f9abd44a8 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -175,7 +175,8 @@ Layer::Layer(LayerManager* aManager, void* aImplData) :
   mIsFixedPosition(false),
   mMargins(0, 0, 0, 0),
   mStickyPositionData(nullptr),
-  mIsScrollbar(false),
+  mScrollbarTargetId(FrameMetrics::NULL_SCROLL_ID),
+  mScrollbarDirection(ScrollDirection::NONE),
   mDebugColorIndex(0),
   mAnimationGeneration(0)
 {}
@@ -1268,12 +1269,11 @@ Layer::PrintInfo(nsACString& aTo, const char* aPrefix)
   if (GetContentFlags() & CONTENT_COMPONENT_ALPHA) {
     aTo += " [componentAlpha]";
   }
-  if (GetIsScrollbar()) {
-    if (GetScrollbarDirection() == VERTICAL) {
-      aTo.AppendPrintf(" [vscrollbar=%lld]", GetScrollbarTargetContainerId());
-    } else {
-      aTo.AppendPrintf(" [hscrollbar=%lld]", GetScrollbarTargetContainerId());
-    }
+  if (GetScrollbarDirection() == VERTICAL) {
+    aTo.AppendPrintf(" [vscrollbar=%lld]", GetScrollbarTargetContainerId());
+  }
+  if (GetScrollbarDirection() == HORIZONTAL) {
+    aTo.AppendPrintf(" [hscrollbar=%lld]", GetScrollbarTargetContainerId());
   }
   if (GetIsFixedPosition()) {
     aTo.AppendPrintf(" [isFixedPosition anchor=%f,%f]", mAnchor.x, mAnchor.y);
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index a98f023e4c7c..b560e5fce2dc 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -967,6 +967,7 @@ public:
   }
 
   enum ScrollDirection {
+    NONE,
     VERTICAL,
     HORIZONTAL
   };
@@ -978,11 +979,9 @@ public:
    */
   void SetScrollbarData(FrameMetrics::ViewID aScrollId, ScrollDirection aDir)
   {
-    if (mIsScrollbar ||
-        mScrollbarTargetId != aScrollId ||
+    if (mScrollbarTargetId != aScrollId ||
         mScrollbarDirection != aDir) {
       MOZ_LAYERS_LOG_IF_SHADOWABLE(this, ("Layer::Mutated(%p) ScrollbarData", this));
-      mIsScrollbar = true;
       mScrollbarTargetId = aScrollId;
       mScrollbarDirection = aDir;
       Mutated();
@@ -1013,7 +1012,6 @@ public:
   FrameMetrics::ViewID GetStickyScrollContainerId() { return mStickyPositionData->mScrollId; }
   const LayerRect& GetStickyScrollRangeOuter() { return mStickyPositionData->mOuter; }
   const LayerRect& GetStickyScrollRangeInner() { return mStickyPositionData->mInner; }
-  bool GetIsScrollbar() { return mIsScrollbar; }
   FrameMetrics::ViewID GetScrollbarTargetContainerId() { return mScrollbarTargetId; }
   ScrollDirection GetScrollbarDirection() { return mScrollbarDirection; }
   Layer* GetMaskLayer() const { return mMaskLayer; }
@@ -1387,7 +1385,6 @@ protected:
     LayerRect mInner;
   };
   nsAutoPtr<StickyPositionData> mStickyPositionData;
-  bool mIsScrollbar;
   FrameMetrics::ViewID mScrollbarTargetId;
   ScrollDirection mScrollbarDirection;
   DebugOnly<uint32_t> mDebugColorIndex;
diff --git a/gfx/layers/composite/AsyncCompositionManager.cpp b/gfx/layers/composite/AsyncCompositionManager.cpp
index 1d38bc15dd5c..d92a08f2eb46 100644
--- a/gfx/layers/composite/AsyncCompositionManager.cpp
+++ b/gfx/layers/composite/AsyncCompositionManager.cpp
@@ -525,7 +525,7 @@ AsyncCompositionManager::ApplyAsyncContentTransformToTree(TimeStamp aCurrentFram
     appliedTransform = true;
   }
 
-  if (container->GetIsScrollbar()) {
+  if (container->GetScrollbarDirection() != Layer::NONE) {
     ApplyAsyncTransformToScrollbar(container);
   }
   return appliedTransform;
diff --git a/gfx/layers/ipc/LayerTransactionParent.cpp b/gfx/layers/ipc/LayerTransactionParent.cpp
index efc338941755..6793eb711d5b 100644
--- a/gfx/layers/ipc/LayerTransactionParent.cpp
+++ b/gfx/layers/ipc/LayerTransactionParent.cpp
@@ -280,10 +280,8 @@ LayerTransactionParent::RecvUpdate(const InfallibleTArray<Edit>& cset,
                                      common.stickyScrollRangeOuter(),
                                      common.stickyScrollRangeInner());
       }
-      if (common.isScrollbar()) {
-        layer->SetScrollbarData(common.scrollbarTargetContainerId(),
-          static_cast<Layer::ScrollDirection>(common.scrollbarDirection()));
-      }
+      layer->SetScrollbarData(common.scrollbarTargetContainerId(),
+        static_cast<Layer::ScrollDirection>(common.scrollbarDirection()));
       if (PLayerParent* maskLayer = common.maskLayerParent()) {
         layer->SetMaskLayer(cast(maskLayer)->AsLayer());
       } else {
diff --git a/gfx/layers/ipc/LayersMessages.ipdlh b/gfx/layers/ipc/LayersMessages.ipdlh
index 61b3a32806ce..98b5f2e9ef18 100644
--- a/gfx/layers/ipc/LayersMessages.ipdlh
+++ b/gfx/layers/ipc/LayersMessages.ipdlh
@@ -198,7 +198,6 @@ struct CommonLayerAttributes {
   uint64_t stickyScrollContainerId;
   LayerRect stickyScrollRangeOuter;
   LayerRect stickyScrollRangeInner;
-  bool isScrollbar;
   uint64_t scrollbarTargetContainerId;
   uint32_t scrollbarDirection;
   nullable PLayer maskLayer;
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index 56e02775af34..ae00a6093bac 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -501,11 +501,8 @@ ShadowLayerForwarder::EndTransaction(InfallibleTArray<EditReply>* aReplies, bool
       common.stickyScrollRangeOuter() = mutant->GetStickyScrollRangeOuter();
       common.stickyScrollRangeInner() = mutant->GetStickyScrollRangeInner();
     }
-    common.isScrollbar() = mutant->GetIsScrollbar();
-    if (mutant->GetIsScrollbar()) {
-      common.scrollbarTargetContainerId() = mutant->GetScrollbarTargetContainerId();
-      common.scrollbarDirection() = mutant->GetScrollbarDirection();
-    }
+    common.scrollbarTargetContainerId() = mutant->GetScrollbarTargetContainerId();
+    common.scrollbarDirection() = mutant->GetScrollbarDirection();
     if (Layer* maskLayer = mutant->GetMaskLayer()) {
       common.maskLayerChild() = Shadow(maskLayer->AsShadowableLayer());
     } else {

From 97bca87c640d9a7450c1c1f329f85a3ce263d58b Mon Sep 17 00:00:00 2001
From: Alexandre Poirot <poirot.alex@gmail.com>
Date: Thu, 12 Dec 2013 17:04:43 -0500
Subject: [PATCH 276/459] Bug 945235 - Ensure {menu, tool, location,
 status}bars visiblity is false on b2g. r=fabrice

---
 b2g/app/b2g.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 2fd0d337d596..817da4813953 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -7,6 +7,9 @@
 pref("toolkit.defaultChromeURI", "chrome://browser/content/shell.html");
 pref("browser.chromeURL", "chrome://browser/content/");
 
+// Bug 945235: Prevent all bars to be considered visible:
+pref("toolkit.defaultChromeFeatures", "chrome,dialog=no,close,resizable,scrollbars,extrachrome");
+
 // Device pixel to CSS px ratio, in percent. Set to -1 to calculate based on display density.
 pref("browser.viewport.scaleRatio", -1);
 

From 2bf66ffc35efaa830cb72b081782f1118acee2b6 Mon Sep 17 00:00:00 2001
From: Ben Kelly <ben@wanderview.com>
Date: Thu, 12 Dec 2013 17:05:04 -0500
Subject: [PATCH 277/459] Bug 945948 - Part 1: Use a Map to associate cursors
 with message managers. r=reuben

---
 dom/contacts/fallback/ContactService.jsm | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/dom/contacts/fallback/ContactService.jsm b/dom/contacts/fallback/ContactService.jsm
index fc6abc06af93..2499d822e4f1 100644
--- a/dom/contacts/fallback/ContactService.jsm
+++ b/dom/contacts/fallback/ContactService.jsm
@@ -31,7 +31,7 @@ let ContactService = {
                       "child-process-shutdown", "Contacts:GetRevision",
                       "Contacts:GetCount"];
     this._children = [];
-    this._cursors = {};
+    this._cursors = new Map();
     this._messages.forEach(function(msgName) {
       ppmm.addMessageListener(msgName, this);
     }.bind(this));
@@ -120,18 +120,21 @@ let ContactService = {
         if (!this.assertPermission(aMessage, "contacts-read")) {
           return null;
         }
-        if (!this._cursors[mm]) {
-          this._cursors[mm] = [];
+        let cursorList = this._cursors.get(mm);
+        if (!cursorList) {
+          cursorList = [];
+          this._cursors.set(mm, cursorList);
         }
-        this._cursors[mm].push(msg.cursorId);
+        cursorList.push(msg.cursorId);
 
         this._db.getAll(
           function(aContacts) {
             try {
               mm.sendAsyncMessage("Contacts:GetAll:Next", {cursorId: msg.cursorId, contacts: aContacts});
               if (aContacts === null) {
-                let index = this._cursors[mm].indexOf(msg.cursorId);
-                this._cursors[mm].splice(index, 1);
+                let cursorList = this._cursors.get(mm);
+                let index = cursorList.indexOf(msg.cursorId);
+                cursorList.splice(index, 1);
               }
             } catch (e) {
               if (DEBUG) debug("Child is dead, DB should stop sending contacts");
@@ -240,11 +243,12 @@ let ContactService = {
           if (DEBUG) debug("Unregister index: " + index);
           this._children.splice(index, 1);
         }
-        if (this._cursors[mm]) {
-          for (let id of this._cursors[mm]) {
+        cursorList = this._cursors.get(mm);
+        if (cursorList) {
+          for (let id of cursorList) {
             this._db.clearDispatcher(id);
           }
-          delete this._cursors[mm];
+          this._cursors.delete(mm);
         }
         break;
       default:

From 4af1fbee69a09221031f08850b9b8be3cfe7569e Mon Sep 17 00:00:00 2001
From: Ben Kelly <ben@wanderview.com>
Date: Thu, 12 Dec 2013 17:05:18 -0500
Subject: [PATCH 278/459] Bug 945948 - Part 2: Test contacts shutdown of
 cursors. r=reuben

---
 dom/contacts/fallback/ContactService.jsm      |   2 +-
 dom/contacts/tests/chrome.ini                 |   3 +
 dom/contacts/tests/test_contacts_shutdown.xul | 103 ++++++++++++++++++
 3 files changed, 107 insertions(+), 1 deletion(-)
 create mode 100644 dom/contacts/tests/test_contacts_shutdown.xul

diff --git a/dom/contacts/fallback/ContactService.jsm b/dom/contacts/fallback/ContactService.jsm
index 2499d822e4f1..5ac0e7a6d251 100644
--- a/dom/contacts/fallback/ContactService.jsm
+++ b/dom/contacts/fallback/ContactService.jsm
@@ -11,7 +11,7 @@ const Cu = Components.utils;
 const Cc = Components.classes;
 const Ci = Components.interfaces;
 
-this.EXPORTED_SYMBOLS = [];
+this.EXPORTED_SYMBOLS = ["ContactService"];
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
diff --git a/dom/contacts/tests/chrome.ini b/dom/contacts/tests/chrome.ini
index 073b9ace36b1..17662e3a2f5e 100644
--- a/dom/contacts/tests/chrome.ini
+++ b/dom/contacts/tests/chrome.ini
@@ -1,3 +1,6 @@
 [DEFAULT]
 
+[test_contacts_shutdown.xul]
+skip-if = os == "android"
+
 [test_contacts_upgrade.xul]
diff --git a/dom/contacts/tests/test_contacts_shutdown.xul b/dom/contacts/tests/test_contacts_shutdown.xul
new file mode 100644
index 000000000000..50cc06c97021
--- /dev/null
+++ b/dom/contacts/tests/test_contacts_shutdown.xul
@@ -0,0 +1,103 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin"?>
+<?xml-stylesheet type="text/css" href="/tests/SimpleTest/test.css"?>
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+
+<window title="Mozilla Bug 945948"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <script type="application/javascript;version=1.7">
+  <![CDATA[
+  "use strict";
+  const { 'utils': Cu } = Components;
+  Cu.import("resource://gre/modules/ContactService.jsm", window);
+
+  //
+  // Mock message manager
+  //
+  function MockMessageManager() { }
+  MockMessageManager.prototype.assertPermission = function() { return true; };
+  MockMessageManager.prototype.sendAsyncMessage = function(name, data) { };
+
+  //
+  // Mock ContactDB
+  //
+  function MockContactDB() { }
+  MockContactDB.prototype.getAll = function(cb) {
+    cb([]);
+  };
+  MockContactDB.prototype.clearDispatcher = function() { }
+  MockContactDB.prototype.close = function() { }
+
+  let realContactDB = ContactService._db;
+
+  function before() {
+    ok(true, "Install mock ContactDB object");
+    ContactService._db = new MockContactDB();
+  }
+
+  function after() {
+    ok(true, "Restore real ContactDB object");
+    ContactService._db = realContactDB;
+  }
+
+  function steps() {
+    let mm1 = new MockMessageManager();
+    let mm2 = new MockMessageManager();
+
+    is(ContactService._cursors.size, 0, "Verify clean contact init");
+
+    ContactService.receiveMessage({
+      target: mm1,
+      name: "Contacts:GetAll",
+      data: { cursorId: 1 },
+      findOptions: {}
+    });
+    is(ContactService._cursors.size, 1, "Add contact cursor 1");
+
+    ContactService.receiveMessage({
+      target: mm2,
+      name: "Contacts:GetAll",
+      data: { cursorId: 2 },
+      findOptions: {}
+    });
+    is(ContactService._cursors.size, 2, "Add contact cursor 2");
+
+    ContactService.receiveMessage({
+      target: mm1,
+      name: "child-process-shutdown"
+    });
+    is(ContactService._cursors.size, 1, "Shutdown contact cursor 1");
+
+    ContactService.receiveMessage({
+      target: mm2,
+      name: "child-process-shutdown"
+    });
+    is(ContactService._cursors.size, 0, "Shutdown contact cursor 2");
+  }
+
+  function runTests() {
+    SimpleTest.waitForExplicitFinish();
+    try {
+      before();
+      steps();
+    } finally {
+      after();
+      SimpleTest.finish();
+    }
+  }
+
+  runTests();
+  ]]>
+  </script>
+
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=945948"
+     target="_blank">Mozilla Bug 945948</a>
+  </body>
+</window>

From 275ac6fdcfb02f87c0e6b39bdbcf39975f1d5c8d Mon Sep 17 00:00:00 2001
From: Garner Lee <garner.lee@telekom.com>
Date: Tue, 3 Dec 2013 17:59:16 -0800
Subject: [PATCH 279/459] Bug 946047 - Fix HasNfcSupport in MozNfc.webidl.
 r=khuey

---
 CLOBBER                                          | 5 +----
 dom/tests/mochitest/general/test_interfaces.html | 1 -
 dom/webidl/MozNfc.webidl                         | 3 ++-
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/CLOBBER b/CLOBBER
index 67876f8d1244..f3ffeadb64b7 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -18,7 +18,4 @@
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
 
-Bug 934646 needs a clobber -- the icon resources previously copied
-into $OBJDIR/mobile/android/base/res will conflict with those in
-$BRANDING_DIRECTORY/res.
-
+Bug 946047 - Windows needs a clobber for webidl changes.
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index a55b12916683..c744dea8c430 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -385,7 +385,6 @@ var interfaceNamesInGlobalScope =
     "MozMobileMessageThread",
     "MozNamedAttrMap",
     {name: "MozNdefRecord", b2g: true},
-    {name: "MozNfc", b2g: true},
     {name: "MozNFCPeer", b2g: true},
     {name: "MozNFCTag", b2g: true},
     {name: "MozOtaStatusEvent", b2g: true, pref: "dom.mobileconnection.enabled"},
diff --git a/dom/webidl/MozNfc.webidl b/dom/webidl/MozNfc.webidl
index d903ed588bd8..0560cc0c5741 100644
--- a/dom/webidl/MozNfc.webidl
+++ b/dom/webidl/MozNfc.webidl
@@ -5,7 +5,8 @@
  /* Copyright © 2013 Deutsche Telekom, Inc. */
 
 [JSImplementation="@mozilla.org/navigatorNfc;1",
- NavigatorProperty="mozNfc"]
+ NavigatorProperty="mozNfc",
+ Func="Navigator::HasNfcSupport"]
 interface MozNfc : EventTarget {
    MozNFCTag getNFCTag(DOMString sessionId);
    MozNFCPeer getNFCPeer(DOMString sessionId);

From 34adadfd732e73beb2e847cf59613b933fc9d2dd Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 18:45:24 -0800
Subject: [PATCH 280/459] Bumping gaia.json for 3 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/38a1fd737228
Author: steveck-chung <schung@mozilla.com>
Desc: Merge pull request #14539 from steveck-chung/message-timestamp-changes

Bug 944881 - Gaia should interpret timestamps as long-long numbers. r=julienw, a=blocking-b2g 1.3+

========

https://hg.mozilla.org/integration/gaia-central/rev/1190eb0646f1
Author: Steve Chung <schung@mozilla.com>
Desc: Utilize Date.now() and other fixing.

========

https://hg.mozilla.org/integration/gaia-central/rev/aa7004ea3513
Author: Steve Chung <schung@mozilla.com>
Desc: Bug 944881 - Gaia should interpret timestamps as long-long numbers
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 32baa9dd5e1b..bbc015ce4931 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "9271d94f35a54995e4442da711e51cff0244741d", 
+    "revision": "38a1fd73722896def7fbe38e8241dd21682174fd", 
     "repo_path": "/integration/gaia-central"
 }

From 6956f6ac23a96367cb6848f280a7b5efa8c162d6 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 19:50:26 -0800
Subject: [PATCH 281/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/b715601fc835
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Merge pull request #14624 from timdream/statusbar-animation-icon

Bug 946173 - Update and remove unused and duplicate status bar icon files, r=alive

========

https://hg.mozilla.org/integration/gaia-central/rev/8c8045a17061
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Bug 946173 - Update and remove unused and duplicate status bar icon files
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index bbc015ce4931..3f985d8717e1 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "38a1fd73722896def7fbe38e8241dd21682174fd", 
+    "revision": "b715601fc8358c0845513265f6b1f77545014b39", 
     "repo_path": "/integration/gaia-central"
 }

From 4db577c98713a19d7a39d3e89b6c294221505c96 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 20:00:24 -0800
Subject: [PATCH 282/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/7849a5c8e80c
Author: steveck-chung <schung@mozilla.com>
Desc: Merge pull request #14596 from steveck-chung/DSDS-sim_switch_for_MMS

Bug 949326 - [DSDS][MMS] Switching data call follow-up fixing for default service ID type changes, r=julienw

========

https://hg.mozilla.org/integration/gaia-central/rev/08e6e42168f8
Author: Steve Chung <schung@mozilla.com>
Desc: Bug 949326 - [DSDS][MMS] Switching data call follow-up fixing for default service ID type changes
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 3f985d8717e1..bf1f66a09162 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "b715601fc8358c0845513265f6b1f77545014b39", 
+    "revision": "7849a5c8e80c3ebd953d14532d7274a15f75c580", 
     "repo_path": "/integration/gaia-central"
 }

From d3f11c2705f0c8fa3e545c908dc8a07016301a3f Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 20:25:24 -0800
Subject: [PATCH 283/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/cb7228e13dd0
Author: Rex KM Lee <rexboy@mozilla.com>
Desc: Merge pull request #14523 from rexboy7/fix-bug917221

Bug 917221 - [Dialer] Support merging group call by Bluetooth CHLD=3 com... r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/45b3a22c1903
Author: Rex Lee <rexboy@mozilla.com>
Desc: Bug 917221 - [Dialer] Support merging group call by Bluetooth CHLD=3 command.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index bf1f66a09162..fdf8927b561a 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "7849a5c8e80c3ebd953d14532d7274a15f75c580", 
+    "revision": "cb7228e13dd0018400dfd857c83d7498a7ce2a0e", 
     "repo_path": "/integration/gaia-central"
 }

From 154bf6ca66280f1cc0a8aa7be9f79ea5c6cf998f Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 21:00:24 -0800
Subject: [PATCH 284/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

========

https://hg.mozilla.org/integration/gaia-central/rev/3c3706bd5581
Author: Corey Frang <gnarf37@gmail.com>
Desc: Bug 921317 – [Gaia] Transform Animation in the clock app is wrong - r=jugglinmike

- Allow hashchange to initiate navigation instead of emitting 'selected' event from tabs
- Remove emitter from tabs since it doesn't need to emit anything anymore

========

https://hg.mozilla.org/integration/gaia-central/rev/fdfbe5e1411c
Author: Corey Frang <gnarf37@gmail.com>
Desc: Revert Temporary Workaround from Bug 926587

Revert "Bug 926587 - [B2G][Clock][Stopwatch] Choppy transition animation going to Stopwatch from Timer or Alarm - r=jugglinmike"

This reverts commit af77086d88d66ba75dc040e4cd2fa6990be2b0bf.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index fdf8927b561a..222fb636b924 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "cb7228e13dd0018400dfd857c83d7498a7ce2a0e", 
+    "revision": "3c3706bd5581eb1ff85449470892ae0dabc5ab6b", 
     "repo_path": "/integration/gaia-central"
 }

From 768d80e554aa3c5d9c62bcfee73baf7696c5b84e Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 22:30:34 -0800
Subject: [PATCH 285/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/4b602663e947
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14566 from alivedise/bugzilla/943717/app-window-factory-creation

Bug 943717 - Refine Instantication of AppWindow and ActivityWindow, r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/dca37d4995f5
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 943717 - Refine Instantication of AppWindow and ActivityWindow
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 222fb636b924..ab32304ef5e7 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "3c3706bd5581eb1ff85449470892ae0dabc5ab6b", 
+    "revision": "4b602663e947f6c97d8fbeed277b613844d5beec", 
     "repo_path": "/integration/gaia-central"
 }

From 5a1c3abd8bb25cddf7f6304dfe2e196d7ca12b31 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:05:24 -0800
Subject: [PATCH 286/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/4c5a91931b02
Author: Albert <acperez@tid.es>
Desc: Merge pull request #13485 from acperez/bug-929602

Bug 929602 - Disable setting of origin in metadata.json in external apps

========

https://hg.mozilla.org/integration/gaia-central/rev/af7ef73156ab
Author: Albert <acperez@tid.es>
Desc: Bug 929602 - Disable setting of origin in metadata.json in external apps
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ab32304ef5e7..ef8706df884b 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "4b602663e947f6c97d8fbeed277b613844d5beec", 
+    "revision": "4c5a91931b023b478749b69d85f18312d592e990", 
     "repo_path": "/integration/gaia-central"
 }

From 238e95eb1bb30d81742de2d43da1f1ecccaee893 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:20:23 -0800
Subject: [PATCH 287/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/b6e1e929530d
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14415 from julienw/fix-invalid-recipient-width

Bug 946744 - [Messages] Long invalid recipients makes the recipient pane...

========

https://hg.mozilla.org/integration/gaia-central/rev/9d26171cc2d1
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 946744 - [Messages] Long invalid recipients makes the recipient panel horizontally scrollable r=borja

Uses box-sizing: border-box to have something consistent between recipient
states
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ef8706df884b..6916e83fb734 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "4c5a91931b023b478749b69d85f18312d592e990", 
+    "revision": "b6e1e929530dad55c8d55868cd46e4cafc0cdc73", 
     "repo_path": "/integration/gaia-central"
 }

From 9f1dc1ed479823a9f9e9e86169e581f00a9e6a7e Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:30:24 -0800
Subject: [PATCH 288/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/fae1a0c2fe5e
Author: Greg Weng <snowmantw@gmail.com>
Desc: Merge pull request #14630 from snowmantw/issue948789

Bug 948789 - Lockscreen can be unlocked without using normal gestures

========

https://hg.mozilla.org/integration/gaia-central/rev/9390b461e7e9
Author: Greg Weng (snowmantw) <gweng@mozilla.com>
Desc: Bug 948789 - Lockscreen can be unlocked without using normal gestures
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 6916e83fb734..051f630a8d07 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "b6e1e929530dad55c8d55868cd46e4cafc0cdc73", 
+    "revision": "fae1a0c2fe5efa9bfdad0855270cabb40849562f", 
     "repo_path": "/integration/gaia-central"
 }

From 7944cb8b87f8d0a73b32a69fd563a2a8007c0a89 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 15:31:16 +0800
Subject: [PATCH 289/459] Bug 939441: B2G Bluetooth: add test cases for
 navigator.BluetoothManager.enabled. r=echou, f=jgriffin

---
 dom/bluetooth/tests/marionette/head.js        | 172 ++++++++++++++++++
 dom/bluetooth/tests/marionette/manifest.ini   |   6 +
 .../test_dom_BluetoothManager_enabled.js      |  64 +++++++
 .../client/marionette/tests/unit-tests.ini    |   1 +
 4 files changed, 243 insertions(+)
 create mode 100644 dom/bluetooth/tests/marionette/head.js
 create mode 100644 dom/bluetooth/tests/marionette/manifest.ini
 create mode 100644 dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js

diff --git a/dom/bluetooth/tests/marionette/head.js b/dom/bluetooth/tests/marionette/head.js
new file mode 100644
index 000000000000..78b82ab7e050
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/head.js
@@ -0,0 +1,172 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=2 sts=2 et filetype=javascript
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+let Promise =
+  SpecialPowers.Cu.import("resource://gre/modules/Promise.jsm").Promise;
+
+let bluetoothManager;
+
+/* Get mozSettings value specified by @aKey.
+ *
+ * Resolve if that mozSettings value is retrieved successfully, reject
+ * otherwise.
+ *
+ * Forfill params:
+ *   The corresponding mozSettings value of the key.
+ * Reject params: (none)
+ *
+ * @param aKey
+ *        A string.
+ *
+ * @return A deferred promise.
+ */
+function getSettings(aKey) {
+  let deferred = Promise.defer();
+
+  let request = navigator.mozSettings.createLock().get(aKey);
+  request.addEventListener("success", function(aEvent) {
+    ok(true, "getSettings(" + aKey + ")");
+    deferred.resolve(aEvent.target.result[aKey]);
+  });
+  request.addEventListener("error", function() {
+    ok(false, "getSettings(" + aKey + ")");
+    deferred.reject();
+  });
+
+  return deferred.promise;
+}
+
+/* Set mozSettings values.
+ *
+ * Resolve if that mozSettings value is set successfully, reject otherwise.
+ *
+ * Forfill params: (none)
+ * Reject params: (none)
+ *
+ * @param aSettings
+ *        An object of format |{key1: value1, key2: value2, ...}|.
+ *
+ * @return A deferred promise.
+ */
+function setSettings(aSettings) {
+  let deferred = Promise.defer();
+
+  let request = navigator.mozSettings.createLock().set(aSettings);
+  request.addEventListener("success", function() {
+    ok(true, "setSettings(" + JSON.stringify(aSettings) + ")");
+    deferred.resolve();
+  });
+  request.addEventListener("error", function() {
+    ok(false, "setSettings(" + JSON.stringify(aSettings) + ")");
+    deferred.reject();
+  });
+
+  return deferred.promise;
+}
+
+/* Get mozSettings value of 'bluetooth.enabled'.
+ *
+ * Resolve if that mozSettings value is retrieved successfully, reject
+ * otherwise.
+ *
+ * Forfill params:
+ *   A boolean value.
+ * Reject params: (none)
+ *
+ * @return A deferred promise.
+ */
+function getBluetoothEnabled() {
+  return getSettings("bluetooth.enabled");
+}
+
+/* Set mozSettings value of 'bluetooth.enabled'.
+ *
+ * Resolve if that mozSettings value is set successfully, reject otherwise.
+ *
+ * Forfill params: (none)
+ * Reject params: (none)
+ *
+ * @param aEnabled
+ *        A boolean value.
+ *
+ * @return A deferred promise.
+ */
+function setBluetoothEnabled(aEnabled) {
+  let obj = {};
+  obj["bluetooth.enabled"] = aEnabled;
+  return setSettings(obj);
+}
+
+/* Push required permissions and test if |navigator.mozBluetooth| exists.
+ * Resolve if it does, reject otherwise.
+ *
+ * Forfill params:
+ *   bluetoothManager -- an reference to navigator.mozBluetooth.
+ * Reject params: (none)
+ *
+ * @param aPermissions
+ *        Additional permissions to push before any test cases.  Could be either
+ *        a string or an array of strings.
+ *
+ * @return A deferred promise.
+ */
+function ensureBluetoothManager(aPermissions) {
+  let deferred = Promise.defer();
+
+  let permissions = ["bluetooth"];
+  if (aPermissions) {
+    if (Array.isArray(aPermissions)) {
+      permissions = permissions.concat(aPermissions);
+    } else if (typeof aPermissions == "string") {
+      permissions.push(aPermissions);
+    }
+  }
+
+  let obj = [];
+  for (let perm of permissions) {
+    obj.push({
+      "type": perm,
+      "allow": 1,
+      "context": document,
+    });
+  }
+
+  SpecialPowers.pushPermissions(obj, function() {
+    ok(true, "permissions pushed: " + JSON.stringify(permissions));
+
+    bluetoothManager = window.navigator.mozBluetooth;
+    log("navigator.mozBluetooth is " +
+        (bluetoothManager ? "available" : "unavailable"));
+
+    if (bluetoothManager instanceof BluetoothManager) {
+      deferred.resolve(bluetoothManager);
+    } else {
+      deferred.reject();
+    }
+  });
+
+  return deferred.promise;
+}
+
+/* Flush permission settings and call |finish()|.
+ */
+function cleanUp() {
+  SpecialPowers.flushPermissions(function() {
+    // Use ok here so that we have at least one test run.
+    ok(true, "permissions flushed");
+
+    finish();
+  });
+}
+
+function startBluetoothTestBase(aPermissions, aTestCaseMain) {
+  ensureBluetoothManager(aPermissions)
+    .then(aTestCaseMain)
+    .then(cleanUp, function() {
+      ok(false, "Unhandled rejected promise.");
+      cleanUp();
+    });
+}
diff --git a/dom/bluetooth/tests/marionette/manifest.ini b/dom/bluetooth/tests/marionette/manifest.ini
new file mode 100644
index 000000000000..710020cc7daf
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/manifest.ini
@@ -0,0 +1,6 @@
+[DEFAULT]
+b2g = true
+browser = false
+qemu = true
+
+[test_dom_BluetoothManager_enabled.js]
diff --git a/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js
new file mode 100644
index 000000000000..15ccedcac302
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_enabled.js
@@ -0,0 +1,64 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=2 sts=2 et filetype=javascript
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+let enabledEventReceived;
+function onEnabled() {
+  enabledEventReceived = true;
+}
+
+let disabledEventReceived;
+function onDisabled() {
+  disabledEventReceived = true;
+}
+
+function test(aEnabled) {
+  log("Testing 'bluetooth.enabled' => " + aEnabled);
+
+  let deferred = Promise.defer();
+
+  enabledEventReceived = false;
+  disabledEventReceived = false;
+
+  setBluetoothEnabled(aEnabled).then(function() {
+    log("  Settings set. Waiting 3 seconds and examine results.");
+
+    window.setTimeout(function() {
+      is(bluetoothManager.enabled, aEnabled, "bluetoothManager.enabled");
+      is(enabledEventReceived, aEnabled, "enabledEventReceived");
+      is(disabledEventReceived, !aEnabled, "disabledEventReceived");
+
+      if (bluetoothManager.enabled === aEnabled &&
+          enabledEventReceived === aEnabled &&
+          disabledEventReceived === !aEnabled) {
+        deferred.resolve();
+      } else {
+        deferred.reject();
+      }
+    }, 3000);
+  });
+
+  return deferred.promise;
+}
+
+startBluetoothTestBase(["settings-read", "settings-write"],
+                       function testCaseMain() {
+  bluetoothManager.addEventListener("enabled", onEnabled);
+  bluetoothManager.addEventListener("disabled", onDisabled);
+
+  return getBluetoothEnabled()
+    .then(function(aEnabled) {
+      log("Original 'bluetooth.enabled' is " + aEnabled);
+      // Set to !aEnabled and reset back to aEnabled.
+      return test(!aEnabled).then(test.bind(null, aEnabled));
+    })
+    .then(function() {
+      bluetoothManager.removeEventListener("enabled", onEnabled);
+      bluetoothManager.removeEventListener("disabled", onDisabled);
+    });
+});
diff --git a/testing/marionette/client/marionette/tests/unit-tests.ini b/testing/marionette/client/marionette/tests/unit-tests.ini
index d6ba1b6dfd9e..b6eddaa23bf8 100644
--- a/testing/marionette/client/marionette/tests/unit-tests.ini
+++ b/testing/marionette/client/marionette/tests/unit-tests.ini
@@ -15,6 +15,7 @@ skip = false
 [include:unit/unit-tests.ini]
 
 ; webapi tests
+[include:../../../../../dom/bluetooth/tests/marionette/manifest.ini]
 [include:../../../../../dom/telephony/test/marionette/manifest.ini]
 [include:../../../../../dom/voicemail/test/marionette/manifest.ini]
 [include:../../../../../dom/battery/test/marionette/manifest.ini]

From 0867faba06ba1110afe3a779c3d24dc35ac8eb62 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 15:31:21 +0800
Subject: [PATCH 290/459] Bug 939637: B2G Bluetooth: add test case for
 navigator.BluetoothManager.adapteradded. r=echou

---
 dom/bluetooth/tests/marionette/head.js        | 108 ++++++++++++++++++
 dom/bluetooth/tests/marionette/manifest.ini   |   1 +
 .../test_dom_BluetoothManager_adapteradded.js |  44 +++++++
 3 files changed, 153 insertions(+)
 create mode 100644 dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js

diff --git a/dom/bluetooth/tests/marionette/head.js b/dom/bluetooth/tests/marionette/head.js
index 78b82ab7e050..e5eaca2173ce 100644
--- a/dom/bluetooth/tests/marionette/head.js
+++ b/dom/bluetooth/tests/marionette/head.js
@@ -151,6 +151,81 @@ function ensureBluetoothManager(aPermissions) {
   return deferred.promise;
 }
 
+/* Wait for one named BluetoothManager event.
+ *
+ * Resolve if that named event occurs.  Never reject.
+ *
+ * Forfill params: the DOMEvent passed.
+ *
+ * @return A deferred promise.
+ */
+function waitForManagerEvent(aEventName) {
+  let deferred = Promise.defer();
+
+  bluetoothManager.addEventListener(aEventName, function onevent(aEvent) {
+    bluetoothManager.removeEventListener(aEventName, onevent);
+
+    ok(true, "BluetoothManager event '" + aEventName + "' got.");
+    deferred.resolve(aEvent);
+  });
+
+  return deferred.promise;
+}
+
+/* Convenient function for setBluetoothEnabled and waitForManagerEvent
+ * combined.
+ *
+ * Resolve if that named event occurs.  Reject if we can't set settings.
+ *
+ * Forfill params: the DOMEvent passed.
+ * Reject params: (none)
+ *
+ * @return A deferred promise.
+ */
+function setBluetoothEnabledAndWait(aEnabled) {
+  return setBluetoothEnabled(aEnabled)
+    .then(waitForManagerEvent.bind(null, aEnabled ? "enabled" : "disabled"));
+}
+
+/* Get default adapter.
+ *
+ * Resolve if that default adapter is got, reject otherwise.
+ *
+ * Forfill params: a BluetoothAdapter instance.
+ * Reject params: a DOMError, or null if if there is no adapter ready yet.
+ *
+ * @return A deferred promise.
+ */
+function getDefaultAdapter() {
+  let deferred = Promise.defer();
+
+  let request = bluetoothManager.getDefaultAdapter();
+  request.onsuccess = function(aEvent) {
+    let adapter = aEvent.target.result;
+    if (!(adapter instanceof BluetoothAdapter)) {
+      ok(false, "no BluetoothAdapter ready yet.");
+      deferred.reject(null);
+      return;
+    }
+
+    ok(true, "BluetoothAdapter got.");
+    // TODO: We have an adapter instance now, but some of its attributes may
+    // still remain unassigned/out-dated.  Here we waste a few seconds to
+    // wait for the property changed events.
+    //
+    // See https://bugzilla.mozilla.org/show_bug.cgi?id=932914
+    window.setTimeout(function() {
+      deferred.resolve(adapter);
+    }, 3000);
+  };
+  request.onerror = function(aEvent) {
+    ok(false, "Failed to get default adapter.");
+    deferred.reject(aEvent.target.error);
+  };
+
+  return deferred.promise;
+}
+
 /* Flush permission settings and call |finish()|.
  */
 function cleanUp() {
@@ -170,3 +245,36 @@ function startBluetoothTestBase(aPermissions, aTestCaseMain) {
       cleanUp();
     });
 }
+
+function startBluetoothTest(aReenable, aTestCaseMain) {
+  startBluetoothTestBase(["settings-read", "settings-write"], function() {
+    let origEnabled, needEnable;
+
+    return getBluetoothEnabled()
+      .then(function(aEnabled) {
+        origEnabled = aEnabled;
+        needEnable = !aEnabled;
+        log("Original 'bluetooth.enabled' is " + origEnabled);
+
+        if (aEnabled && aReenable) {
+          log("  Disable 'bluetooth.enabled' ...");
+          needEnable = true;
+          return setBluetoothEnabledAndWait(false);
+        }
+      })
+      .then(function() {
+        if (needEnable) {
+          log("  Enable 'bluetooth.enabled' ...");
+          return setBluetoothEnabledAndWait(true)
+            .then(waitForManagerEvent.bind(null, "adapteradded"));
+        }
+      })
+      .then(getDefaultAdapter)
+      .then(aTestCaseMain)
+      .then(function() {
+        if (!origEnabled) {
+          return setBluetoothEnabledAndWait(false);
+        }
+      });
+  });
+}
diff --git a/dom/bluetooth/tests/marionette/manifest.ini b/dom/bluetooth/tests/marionette/manifest.ini
index 710020cc7daf..6ccb13c6f138 100644
--- a/dom/bluetooth/tests/marionette/manifest.ini
+++ b/dom/bluetooth/tests/marionette/manifest.ini
@@ -4,3 +4,4 @@ browser = false
 qemu = true
 
 [test_dom_BluetoothManager_enabled.js]
+[test_dom_BluetoothManager_adapteradded.js]
diff --git a/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js
new file mode 100644
index 000000000000..9c0dee3e60f0
--- /dev/null
+++ b/dom/bluetooth/tests/marionette/test_dom_BluetoothManager_adapteradded.js
@@ -0,0 +1,44 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=2 sts=2 et filetype=javascript
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+// https://github.com/mozilla-b2g/platform_external_qemu/blob/master/vl-android.c#L765
+// static int bt_hci_parse(const char *str) {
+//   ...
+//   bdaddr.b[0] = 0x52;
+//   bdaddr.b[1] = 0x54;
+//   bdaddr.b[2] = 0x00;
+//   bdaddr.b[3] = 0x12;
+//   bdaddr.b[4] = 0x34;
+//   bdaddr.b[5] = 0x56 + nb_hcis;
+const EMULATOR_ADDRESS = "56:34:12:00:54:52";
+
+// $ adb shell hciconfig /dev/ttyS2 name
+// hci0:  Type: BR/EDR  Bus: UART
+//        BD Address: 56:34:12:00:54:52  ACL MTU: 512:1  SCO MTU: 0:0
+//        Name: 'Full Android on Emulator'
+const EMULATOR_NAME = "Full Android on Emulator";
+
+// $ adb shell hciconfig /dev/ttyS2 class
+// hci0:  Type: BR/EDR  Bus: UART
+//        BD Address: 56:34:12:00:54:52  ACL MTU: 512:1  SCO MTU: 0:0
+//        Class: 0x58020c
+//        Service Classes: Capturing, Object Transfer, Telephony
+//        Device Class: Phone, Smart phone
+const EMULATOR_CLASS = 0x58020c;
+
+startBluetoothTest(true, function testCaseMain(aAdapter) {
+  log("Checking adapter attributes ...");
+
+  is(aAdapter.name, EMULATOR_NAME, "adapter.name");
+  is(aAdapter.class, EMULATOR_CLASS, "adapter.class");
+  is(aAdapter.address, EMULATOR_ADDRESS, "adapter.address");
+  is(aAdapter.discovering, false, "adapter.discovering");
+  is(aAdapter.discoverable, false, "adapter.discoverable");
+  is(aAdapter.discoverableTimeout, 120, "adapter.discoverableTimeout");
+});

From d49f95e7c5e7e31ee694e98cce6020e4cf8fcb06 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Thu, 12 Dec 2013 23:45:24 -0800
Subject: [PATCH 291/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/c5fa2dc97777
Author: ochameau <poirot.alex@gmail.com>
Desc: Merge pull request #14537 from ochameau/simulator-1

Bug 948462 - Fix SIMULATOR=1. r=yurenyu

========

https://hg.mozilla.org/integration/gaia-central/rev/dbaf8879327d
Author: Alexandre Poirot <poirot.alex@gmail.com>
Desc: Bug 948462 - Fix SIMULATOR=1. r=yurenyu
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 051f630a8d07..7bb9803eccd4 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "fae1a0c2fe5efa9bfdad0855270cabb40849562f", 
+    "revision": "c5fa2dc97777833bc1e69862cec075ca4bfa35e0", 
     "repo_path": "/integration/gaia-central"
 }

From 33e327ae7daf8a82c831cb3918a0e961aaf8cd1d Mon Sep 17 00:00:00 2001
From: Hsin-Yi Tsai <htsai@mozilla.com>
Date: Fri, 6 Dec 2013 16:02:28 +0800
Subject: [PATCH 292/459] Bug 944262 - part1 - [B2G]On conference call,we can't
 switch the speaker between off and on. r=vicamo

---
 dom/telephony/gonk/TelephonyProvider.js | 62 +++++++++++++++++++------
 1 file changed, 49 insertions(+), 13 deletions(-)

diff --git a/dom/telephony/gonk/TelephonyProvider.js b/dom/telephony/gonk/TelephonyProvider.js
index 2016951b2c18..5a88c2ff8f09 100644
--- a/dom/telephony/gonk/TelephonyProvider.js
+++ b/dom/telephony/gonk/TelephonyProvider.js
@@ -83,6 +83,32 @@ XPCOMUtils.defineLazyGetter(this, "gPhoneNumberUtils", function () {
   return ns.PhoneNumberUtils;
 });
 
+function SingleCall(options){
+  this.clientId = options.clientId;
+  this.callIndex = options.callIndex;
+  this.state = options.state;
+  this.number = options.number;
+  this.isOutgoing = options.isOutgoing;
+  this.isEmergency = options.isEmergency;
+  this.isConference = options.isConference;
+}
+SingleCall.prototype = {
+  clientId: null,
+  callIndex: null,
+  state: null,
+  number: null,
+  isOutgoing: false,
+  isEmergency: false,
+  isConference: false
+};
+
+function ConferenceCall(state){
+  this.state = state;
+}
+ConferenceCall.prototype = {
+  state: null
+};
+
 function TelephonyProvider() {
   this._numClients = gRadioInterfaceLayer.numRadioInterfaces;
   this._listeners = [];
@@ -162,14 +188,11 @@ TelephonyProvider.prototype = {
     }
   },
 
-  _matchActiveCall: function _matchActiveCall(aCall) {
-    if (this._activeCall &&
-        this._activeCall.callIndex == aCall.callIndex &&
-        this._activeCall.clientId == aCall.clientId) {
-      return true;
-    }
-
-    return false;
+  _matchActiveSingleCall: function _matchActiveSingleCall(aCall) {
+    return this._activeCall &&
+           this._activeCall instanceof SingleCall &&
+           this._activeCall.clientId === aCall.clientId &&
+           this._activeCall.callIndex === aCall.callIndex;
   },
 
   /**
@@ -179,17 +202,28 @@ TelephonyProvider.prototype = {
   _updateCallAudioState: function _updateCallAudioState(aCall,
                                                         aConferenceState) {
     if (aConferenceState === nsITelephonyProvider.CALL_STATE_CONNECTED) {
+      this._activeCall = new ConferenceCall(aConferenceState);
       gAudioManager.phoneState = nsIAudioManager.PHONE_STATE_IN_CALL;
       if (this.speakerEnabled) {
         gAudioManager.setForceForUse(nsIAudioManager.USE_COMMUNICATION,
                                      nsIAudioManager.FORCE_SPEAKER);
       }
+      if (DEBUG) {
+        debug("Active call, put audio system into PHONE_STATE_IN_CALL: " +
+              gAudioManager.phoneState);
+      }
       return;
     }
+
     if (aConferenceState === nsITelephonyProvider.CALL_STATE_UNKNOWN ||
         aConferenceState === nsITelephonyProvider.CALL_STATE_HELD) {
-      if (!this._activeCall) {
+      if (this._activeCall instanceof ConferenceCall) {
+        this._activeCall = null;
         gAudioManager.phoneState = nsIAudioManager.PHONE_STATE_NORMAL;
+        if (DEBUG) {
+          debug("No active call, put audio system into PHONE_STATE_NORMAL: " +
+                gAudioManager.phoneState);
+        }
       }
       return;
     }
@@ -199,7 +233,7 @@ TelephonyProvider.prototype = {
     }
 
     if (aCall.isConference) {
-      if (this._matchActiveCall(aCall)) {
+      if (this._matchActiveSingleCall(aCall)) {
         this._activeCall = null;
       }
       return;
@@ -210,7 +244,7 @@ TelephonyProvider.prototype = {
       case nsITelephonyProvider.CALL_STATE_ALERTING:
       case nsITelephonyProvider.CALL_STATE_CONNECTED:
         aCall.isActive = true;
-        this._activeCall = aCall;
+        this._activeCall = new SingleCall(aCall);
         gAudioManager.phoneState = nsIAudioManager.PHONE_STATE_IN_CALL;
         if (this.speakerEnabled) {
           gAudioManager.setForceForUse(nsIAudioManager.USE_COMMUNICATION,
@@ -238,7 +272,7 @@ TelephonyProvider.prototype = {
       case nsITelephonyProvider.CALL_STATE_HELD: // Fall through...
       case nsITelephonyProvider.CALL_STATE_DISCONNECTED:
         aCall.isActive = false;
-        if (this._matchActiveCall(aCall)) {
+        if (this._matchActiveSingleCall(aCall)) {
           // Previously active call is not active now.
           this._activeCall = null;
         }
@@ -355,7 +389,7 @@ TelephonyProvider.prototype = {
       for (let call of response.calls) {
         call.clientId = aClientId;
         call.state = this._convertRILCallState(call.state);
-        call.isActive = this._matchActiveCall(call);
+        call.isActive = this._matchActiveSingleCall(call);
 
         aListener.enumerateCallState(call.clientId, call.callIndex,
                                      call.state, call.number,
@@ -494,6 +528,7 @@ TelephonyProvider.prototype = {
     };
     gSystemMessenger.broadcastMessage("telephony-call-ended", data);
 
+    aCall.clientId = aClientId;
     this._updateCallAudioState(aCall, null);
 
     if (!aCall.failCause ||
@@ -545,6 +580,7 @@ TelephonyProvider.prototype = {
       gSystemMessenger.broadcastMessage("telephony-new-call", {});
     }
 
+    aCall.clientId = aClientId;
     this._updateCallAudioState(aCall, null);
 
     this._notifyAllListeners("callStateChanged", [aClientId,

From bde24c59044d7736e85370296feb9b96be7b2543 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 16:18:15 +0800
Subject: [PATCH 293/459] Bug 944262 - part2 - test cases. r=htsai

---
 dom/telephony/test/marionette/manifest.ini    |   1 +
 .../test_audiomanager_phonestate.js           | 265 ++++++++++++++++++
 2 files changed, 266 insertions(+)
 create mode 100644 dom/telephony/test/marionette/test_audiomanager_phonestate.js

diff --git a/dom/telephony/test/marionette/manifest.ini b/dom/telephony/test/marionette/manifest.ini
index 6725296d2c94..32e26394576b 100644
--- a/dom/telephony/test/marionette/manifest.ini
+++ b/dom/telephony/test/marionette/manifest.ini
@@ -46,3 +46,4 @@ disabled = Bug 821958
 [test_dsds_default_service_id.js]
 [test_call_mute.js]
 [test_dsds_normal_call.js]
+[test_audiomanager_phonestate.js]
diff --git a/dom/telephony/test/marionette/test_audiomanager_phonestate.js b/dom/telephony/test/marionette/test_audiomanager_phonestate.js
new file mode 100644
index 000000000000..f19ff1c25eaa
--- /dev/null
+++ b/dom/telephony/test/marionette/test_audiomanager_phonestate.js
@@ -0,0 +1,265 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+const AUDIO_MANAGER_CONTRACT_ID = "@mozilla.org/telephony/audiomanager;1";
+
+// See nsIAudioManager
+const PHONE_STATE_INVALID          = -2;
+const PHONE_STATE_CURRENT          = -1;
+const PHONE_STATE_NORMAL           = 0;
+const PHONE_STATE_RINGTONE         = 1;
+const PHONE_STATE_IN_CALL          = 2;
+const PHONE_STATE_IN_COMMUNICATION = 3;
+
+let conference;
+
+function checkTelephonyActiveAndCalls(active, calls) {
+  is(telephony.active, active, "telephony.active");
+  is(telephony.calls.length, calls.length, "telephony.calls");
+  for (let i = 0; i < calls.length; ++i) {
+    is(telephony.calls[i], calls[i]);
+  }
+}
+
+function checkConferenceStateAndCalls(state, calls) {
+  is(conference.state, state, "conference.state");
+  is(conference.calls.length, calls.length, "conference.calls");
+  for (let i = 0; i < calls.length; i++) {
+    is(conference.calls[i], calls[i]);
+  }
+}
+
+function checkInitialState() {
+  log("Verify initial state.");
+  ok(telephony.calls, 'telephony.call');
+  checkTelephonyActiveAndCalls(null, []);
+  ok(conference.calls, 'conference.calls');
+  checkConferenceStateAndCalls('', []);
+}
+
+function checkEventCallState(event, call, state) {
+  is(call, event.call, "event.call");
+  is(call.state, state, "call state");
+}
+
+function dial(number) {
+  log("Make an outgoing call: " + number);
+
+  let deferred = Promise.defer();
+  let call = telephony.dial(number);
+
+  ok(call);
+  is(call.number, number);
+  is(call.state, "dialing");
+
+  call.onalerting = function onalerting(event) {
+    call.onalerting = null;
+    log("Received 'onalerting' call event.");
+    checkEventCallState(event, call, "alerting");
+    deferred.resolve(call);
+  };
+
+  return deferred.promise;
+}
+
+function answer(call) {
+  log("Answering the incoming call.");
+
+  let deferred = Promise.defer();
+
+  call.onconnecting = function onconnectingIn(event) {
+    log("Received 'connecting' call event for incoming call.");
+    call.onconnecting = null;
+    checkEventCallState(event, call, "connecting");
+  };
+
+  call.onconnected = function onconnectedIn(event) {
+    log("Received 'connected' call event for incoming call.");
+    call.onconnected = null;
+    checkEventCallState(event, call, "connected");
+    ok(!call.onconnecting);
+    deferred.resolve(call);
+  };
+  call.answer();
+
+  return deferred.promise;
+}
+
+function remoteDial(number) {
+  log("Simulating an incoming call.");
+
+  let deferred = Promise.defer();
+
+  telephony.onincoming = function onincoming(event) {
+    log("Received 'incoming' call event.");
+    telephony.onimcoming = null;
+
+    let call = event.call;
+
+    ok(call);
+    is(call.number, number);
+    is(call.state, "incoming");
+
+    deferred.resolve(call);
+  };
+  emulator.run("gsm call " + number);
+
+  return deferred.promise;
+}
+
+function remoteAnswer(call) {
+  log("Remote answering the call.");
+
+  let deferred = Promise.defer();
+
+  call.onconnected = function onconnected(event) {
+    log("Received 'connected' call event.");
+    call.onconnected = null;
+    checkEventCallState(event, call, "connected");
+    deferred.resolve(call);
+  };
+  emulator.run("gsm accept " + call.number);
+
+  return deferred.promise;
+}
+
+function remoteHangUp(call) {
+  log("Remote hanging up the call.");
+
+  let deferred = Promise.defer();
+
+  call.ondisconnected = function ondisconnected(event) {
+    log("Received 'disconnected' call event.");
+    call.ondisconnected = null;
+    checkEventCallState(event, call, "disconnected");
+    deferred.resolve(call);
+  };
+  emulator.run("gsm cancel " + call.number);
+
+  return deferred.promise;
+}
+
+function remoteHangUpCalls(calls) {
+  let promise = Promise.resolve();
+
+  for (let call of calls) {
+    promise = promise.then(remoteHangUp.bind(null, call));
+  }
+
+  return promise;
+}
+
+// The length of callsToAdd should be 2.
+function addCallsToConference(callsToAdd) {
+  log("Add " + callsToAdd.length + " calls into conference.");
+
+  let deferred = Promise.defer();
+
+  conference.onconnected = function() {
+    deferred.resolve();
+  };
+
+  conference.add(callsToAdd[0], callsToAdd[1]);
+
+  return deferred.promise;
+}
+
+let audioManager;
+function checkStates(speakerEnabled, phoneState) {
+  if (!audioManager) {
+    audioManager = SpecialPowers.Cc[AUDIO_MANAGER_CONTRACT_ID]
+                                .getService(SpecialPowers.Ci.nsIAudioManager);
+    ok(audioManager, "nsIAudioManager instance");
+  }
+
+  is(telephony.speakerEnabled, speakerEnabled, "telephony.speakerEnabled");
+  if (phoneState == PHONE_STATE_CURRENT) {
+    ok(audioManager.phoneState === PHONE_STATE_CURRENT ||
+       audioManager.phoneState === PHONE_STATE_NORMAL, "audioManager.phoneState");
+  } else {
+    is(audioManager.phoneState, phoneState, "audioManager.phoneState");
+  }
+}
+
+function check(phoneStateOrig, phoneStateEnabled, phoneStateDisabled) {
+  checkStates(false, phoneStateOrig);
+
+  let canEnableSpeaker = arguments.length > 1;
+  telephony.speakerEnabled = true;
+  if (canEnableSpeaker) {
+    checkStates(true, phoneStateEnabled);
+  } else {
+    checkStates(false, phoneStateOrig);
+    return;
+  }
+
+  telephony.speakerEnabled = false;
+  checkStates(false, arguments.length > 2 ? phoneStateDisabled : phoneStateOrig);
+}
+
+// Start the test
+startTest(function() {
+  conference = telephony.conferenceGroup;
+  ok(conference);
+
+  let outNumber = "5555550101";
+  let inNumber  = "5555550201";
+  let outCall;
+  let inCall;
+
+  Promise.resolve()
+    .then(checkInitialState)
+    .then(() => check(PHONE_STATE_CURRENT, PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // Dial in
+    .then(() => remoteDial(inNumber))
+    .then(call => { inCall = call; })
+    // TODO - Bug 948860: should this be {RINGTONE, RINGTONE, RINGTONE}?
+    // From current UX spec, there is no chance that an user may enable speaker
+    // during alerting, so basically this 'set speaker enable' action can't
+    // happen in B2G.
+    .then(() => check(PHONE_STATE_RINGTONE, PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+    .then(() => answer(inCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Hang up all
+    .then(() => remoteHangUp(inCall))
+    .then(() => check(PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // Dial out
+    .then(() => dial(outNumber))
+    .then(call => { outCall = call; })
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    .then(() => remoteAnswer(outCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Hang up all
+    .then(() => remoteHangUp(outCall))
+    .then(() => check(PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // Dial out
+    .then(() => dial(outNumber))
+    .then(call => { outCall = call; })
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    .then(() => remoteAnswer(outCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Dial out and dial in
+    .then(() => remoteDial(inNumber))
+    .then(call => { inCall = call; })
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    .then(() => answer(inCall))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Conference
+    .then(() => addCallsToConference([outCall, inCall]))
+    .then(() => check(PHONE_STATE_IN_CALL, PHONE_STATE_IN_CALL))
+    // Hang up all
+    .then(() => remoteHangUpCalls([outCall, inCall]))
+    .then(() => check(PHONE_STATE_NORMAL, PHONE_STATE_NORMAL))
+
+    // End
+    .then(null, error => {
+      ok(false, 'promise rejects during test.');
+    })
+    .then(finish);
+});

From 2e1b88e2ff86fd4c782cfb3850df689b2c21cddf Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 00:20:26 -0800
Subject: [PATCH 294/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/e091dab8b696
Author: George <georgeiscoming@gmail.com>
Desc: Merge pull request #13118 from cctuan/928254-2

Bug 928254 - [Flatfish][Gallery] support 2 column layout for tablet

========

https://hg.mozilla.org/integration/gaia-central/rev/10d972474dd9
Author: cctuan <georgeiscoming@gmail.com>
Desc: Bug 928254 - [Flatfish][Gallery] support 2 column layout for tablet
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 7bb9803eccd4..3ed6f51e22a2 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "c5fa2dc97777833bc1e69862cec075ca4bfa35e0", 
+    "revision": "e091dab8b696418c4b3fc01f45484e264450bbf4", 
     "repo_path": "/integration/gaia-central"
 }

From 003ce7f7b276271763902c140493f762bff51b4e Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 00:35:23 -0800
Subject: [PATCH 295/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/e520ec1919d3
Author: John Hu <johu@mozilla.com>
Desc: Merge pull request #13340 from huchengtw-moz/video/Bug_903920_flatfish_ui

Bug 903920 - [Flatfish][Video] support 2 column layout for tablet, r=cctuan

========

https://hg.mozilla.org/integration/gaia-central/rev/35e06ab2ebf3
Author: John Hu <johu@mozilla.com>
Desc: Bug 903920 - [Flatfish][Video] support 2 column layout for tablet
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 3ed6f51e22a2..f06eddc5cf23 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "e091dab8b696418c4b3fc01f45484e264450bbf4", 
+    "revision": "e520ec1919d3794830fa72e506b68c4098a8a551", 
     "repo_path": "/integration/gaia-central"
 }

From 750d1b3f99f63aef04772f203e2b54f5d3ae7ac0 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 00:45:24 -0800
Subject: [PATCH 296/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/58da665437f2
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Merge pull request #14579 from jaoo/933203

Bug 933203 - [DSDS] Operator variant logic: APN settings. r=kaze

========

https://hg.mozilla.org/integration/gaia-central/rev/5f437cda7db3
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Bug 933203 - [DSDS] Operator variant logic: APN settings
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index f06eddc5cf23..872c62446213 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "e520ec1919d3794830fa72e506b68c4098a8a551", 
+    "revision": "58da665437f25f577446b62e4e5b9f6749236911", 
     "repo_path": "/integration/gaia-central"
 }

From 032b73144e0e2d7b114777f05890d8605f1aba85 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 01:00:24 -0800
Subject: [PATCH 297/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/4ee9d0390649
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14632 from alivedise/bugzilla/948596_v2/activity-window-size-copy

Bug 948596 - fullscreen state of activity window, r=timdream

========

https://hg.mozilla.org/integration/gaia-central/rev/767ecb92b6e8
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 948596 - fullscreen state of activity window
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 872c62446213..8f68e4c3de5b 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "58da665437f25f577446b62e4e5b9f6749236911", 
+    "revision": "4ee9d03906496a552897cf2688467ca5217f0542", 
     "repo_path": "/integration/gaia-central"
 }

From 2119e194392837e0dafe3a47098bc5bcdbfc3e11 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 01:20:25 -0800
Subject: [PATCH 298/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/e402acba87cf
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14636 from alivedise/bugzilla/949950/typo-gaia-apps

Bug 949950 - fix src in gaia-apps, r=davehunt

========

https://hg.mozilla.org/integration/gaia-central/rev/f397343db001
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 949950 - fix src in gaia-apps

========

https://hg.mozilla.org/integration/gaia-central/rev/4e4fbe820dd0
Author: Arnau <arnau@arnaumarch.com>
Desc: Merge pull request #14497 from rnowm/FB-header

Bug 946775 - [contacts][facebook] When importing contacts, blue facebook...

========

https://hg.mozilla.org/integration/gaia-central/rev/3a8d41c1364c
Author: rnowm <arnau@arnaumarch.com>
Desc: Bug 946775 - [contacts][facebook] When importing contacts, blue facebook header has wrong tapped color

and close icon
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 8f68e4c3de5b..3368e684aa23 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "4ee9d03906496a552897cf2688467ca5217f0542", 
+    "revision": "e402acba87cf7ff74fd7c5a1ea7ea0563c217b9c", 
     "repo_path": "/integration/gaia-central"
 }

From bf4d2a69a42b9e50ccbd5557ed81ec62cdd88a51 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 01:50:24 -0800
Subject: [PATCH 299/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/57da16cd5729
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Merge pull request #14489 from jaoo/928297

Bug 928297 - [DSDS][Gaia] Settings app should support cellular & data settings of multiple sim cards. r=arthurcc

========

https://hg.mozilla.org/integration/gaia-central/rev/8e4914b0263a
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Bug 928297 - [DSDS][Gaia] Settings app should support cellular & data settings of multiple sim cards

========

https://hg.mozilla.org/integration/gaia-central/rev/ec760f98e960
Author: Greg Weng <snowmantw@gmail.com>
Desc: Merge pull request #14631 from snowmantw/issue949904

Bug 949904 - [LockScreen] When tap on the handle after dragged once, it sliding irregular toward the same side

========

https://hg.mozilla.org/integration/gaia-central/rev/8a7e8953b4bc
Author: Greg Weng (snowmantw) <gweng@mozilla.com>
Desc: Bug 949904 - [LockScreen] When tap on the handle after dragged once, it sliding irregular toward the same side
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 3368e684aa23..aa161fb26e87 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "e402acba87cf7ff74fd7c5a1ea7ea0563c217b9c", 
+    "revision": "57da16cd5729afab09c4b1b1305be2625f449e88", 
     "repo_path": "/integration/gaia-central"
 }

From b40ca70a51acbab1eacecc7441e8b1199203c330 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 02:00:24 -0800
Subject: [PATCH 300/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/64a86fa375e9
Author: Etienne Segonzac <etienne@segonzac.info>
Desc: Merge pull request #14546 from karlt/943138

bug 943138 - improve dialer ADSR envelope r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/c8af3b692644
Author: Karl Tomlinson <karlt+@karlt.net>
Desc: bug 943138 - improve dialer ADSR envelope

Scheduling tones at AudioContext.currentTime resulted in the first part of the
tone being cut off, so start an AudioBufferSourceNode for the envelope.

Add a release phase for long dialer tones.

Revert the release period to 0.05 to match the prior mozWriteAudio
implementation.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index aa161fb26e87..a9df0add8881 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "57da16cd5729afab09c4b1b1305be2625f449e88", 
+    "revision": "64a86fa375e95d0aa60e96fb69c09d2c6089d2e8", 
     "repo_path": "/integration/gaia-central"
 }

From 64177168690d12223c5fc08aa33a24085f3ccd16 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 02:50:24 -0800
Subject: [PATCH 301/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/28714578feea
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14635 from alivedise/bugzilla/949527/wrapper-name

Bug 949527 - Modify wrapper name, r=timdream

========

https://hg.mozilla.org/integration/gaia-central/rev/21f5c547894e
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 949527 - Modify wrapper name

========

https://hg.mozilla.org/integration/gaia-central/rev/019e7137d362
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Merge pull request #14628 from timdream/splash-icon-size

Bug 904332 - Select the size of the icon in cold launch splash according to the spec, r=alive

========

https://hg.mozilla.org/integration/gaia-central/rev/150eab46b1a0
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Bug 904332 - Select the size of the icon in cold launch splash according to the spec
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index a9df0add8881..4af865b42e96 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "64a86fa375e95d0aa60e96fb69c09d2c6089d2e8", 
+    "revision": "28714578feeae99aa02527711279d07671120ebf", 
     "repo_path": "/integration/gaia-central"
 }

From 74fa88d0c4aef362841a478392964e03879ffc31 Mon Sep 17 00:00:00 2001
From: Patrick Wang <kk1fff@patrickz.net>
Date: Fri, 13 Dec 2013 16:38:08 +0800
Subject: [PATCH 302/459] Bug 948545: Nuwa process shouldn't exist if
 dom.ipc.processPrelaunch.enabled is false r=khuey

---
 dom/ipc/PreallocatedProcessManager.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/ipc/PreallocatedProcessManager.cpp b/dom/ipc/PreallocatedProcessManager.cpp
index 898663c004f8..11718afe5ac5 100644
--- a/dom/ipc/PreallocatedProcessManager.cpp
+++ b/dom/ipc/PreallocatedProcessManager.cpp
@@ -246,7 +246,7 @@ PreallocatedProcessManagerImpl::DelayedNuwaFork()
   mPreallocateAppProcessTask = nullptr;
 
   if (!mIsNuwaReady) {
-    if (!mPreallocatedAppProcess && !mShutdown) {
+    if (!mPreallocatedAppProcess && !mShutdown && mEnabled) {
       mPreallocatedAppProcess = ContentParent::RunNuwaProcess();
     }
     // else mPreallocatedAppProcess is starting. It will NuwaFork() when ready.

From 71e468b2a6be93d9723463830b2f6306aa40573e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:26 +0100
Subject: [PATCH 303/459] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 1: FxAccountsManager. r=markh

---
 services/fxaccounts/FxAccounts.jsm        |   9 +-
 services/fxaccounts/FxAccountsConsts.js   |  85 +++++
 services/fxaccounts/FxAccountsManager.jsm | 382 ++++++++++++++++++++++
 services/fxaccounts/moz.build             |   8 +-
 4 files changed, 475 insertions(+), 9 deletions(-)
 create mode 100644 services/fxaccounts/FxAccountsConsts.js
 create mode 100644 services/fxaccounts/FxAccountsManager.jsm

diff --git a/services/fxaccounts/FxAccounts.jsm b/services/fxaccounts/FxAccounts.jsm
index aa900cc49ace..c7efa8429b9b 100644
--- a/services/fxaccounts/FxAccounts.jsm
+++ b/services/fxaccounts/FxAccounts.jsm
@@ -16,18 +16,11 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Timer.jsm");
 Cu.import("resource://gre/modules/Task.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
+Cu.import("resource://gre/modules/FxAccountsConsts.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "jwcrypto",
                                   "resource://gre/modules/identity/jwcrypto.jsm");
 
-const DATA_FORMAT_VERSION = 1;
-const DEFAULT_STORAGE_FILENAME = "signedInUser.json";
-const ASSERTION_LIFETIME = 1000 * 60 * 5; // 5 minutes
-const KEY_LIFETIME = 1000 * 3600 * 12;    // 12 hours
-const CERT_LIFETIME = 1000 * 3600 * 6;    // 6 hours
-const POLL_SESSION = 1000 * 60 * 5;       // 5 minutes
-const POLL_STEP = 1000 * 3;               // 3 seconds
-
 // loglevel preference should be one of: "FATAL", "ERROR", "WARN", "INFO",
 // "CONFIG", "DEBUG", "TRACE" or "ALL". We will be logging error messages by
 // default.
diff --git a/services/fxaccounts/FxAccountsConsts.js b/services/fxaccounts/FxAccountsConsts.js
new file mode 100644
index 000000000000..51e8427b038a
--- /dev/null
+++ b/services/fxaccounts/FxAccountsConsts.js
@@ -0,0 +1,85 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+this.DATA_FORMAT_VERSION = 1;
+this.DEFAULT_STORAGE_FILENAME = "signedInUser.json";
+
+// Token life times.
+this.ASSERTION_LIFETIME = 1000 * 60 * 5;    // 5 minutes
+this.CERT_LIFETIME      = 1000 * 3600 * 6;  // 6 hours
+this.KEY_LIFETIME       = 1000 * 3600 * 12; // 12 hours
+
+// Polling timings.
+this.POLL_SESSION       = 1000 * 60 * 5;    // 5 minutes
+this.POLL_STEP          = 1000 * 3;         // 3 seconds
+
+// Server errno.
+// From https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#response-format
+this.ERRNO_ACCOUNT_ALREADY_EXISTS     = 101;
+this.ERRNO_ACCOUNT_DOES_NOT_EXISTS    = 102;
+this.ERRNO_INCORRECT_PASSWORD         = 103;
+this.ERRNO_UNVERIFIED_ACCOUNT         = 104;
+this.ERRNO_INVALID_VERIFICATION_CODE  = 105;
+this.ERRNO_NOT_VALID_JSON_BODY        = 106;
+this.ERRNO_INVALID_BODY_PARAMETERS    = 107;
+this.ERRNO_MISSING_BODY_PARAMETERS    = 108;
+this.ERRNO_INVALID_REQUEST_SIGNATURE  = 109;
+this.ERRNO_INVALID_AUTH_TOKEN         = 110;
+this.ERRNO_INVALID_AUTH_TIMESTAMP     = 111;
+this.ERRNO_MISSING_CONTENT_LENGTH     = 112;
+this.ERRNO_REQUEST_BODY_TOO_LARGE     = 113;
+this.ERRNO_TOO_MANY_CLIENT_REQUESTS   = 114;
+this.ERRNO_INVALID_AUTH_NONCE         = 115;
+this.ERRNO_SERVICE_TEMP_UNAVAILABLE   = 201;
+this.ERRNO_UNKNOWN_ERROR              = 999;
+
+// Errors.
+this.ERROR_ACCOUNT_ALREADY_EXISTS     = "ACCOUNT_ALREADY_EXISTS";
+this.ERROR_ACCOUNT_DOES_NOT_EXISTS    = "ACCOUNT_DOES_NOT_EXISTS";
+this.ERROR_ALREADY_SIGNED_IN_USER     = "ALREADY_SIGNED_IN_USER";
+this.ERROR_INVALID_ACCOUNTID          = "INVALID_ACCOUNTID";
+this.ERROR_INVALID_AUDIENCE           = "INVALID_AUDIENCE";
+this.ERROR_INVALID_AUTH_TOKEN         = "INVALID_AUTH_TOKEN";
+this.ERROR_INVALID_AUTH_TIMESTAMP     = "INVALID_AUTH_TIMESTAMP";
+this.ERROR_INVALID_AUTH_NONCE         = "INVALID_AUTH_NONCE";
+this.ERROR_INVALID_BODY_PARAMETERS    = "INVALID_BODY_PARAMETERS";
+this.ERROR_INVALID_PASSWORD           = "INVALID_PASSWORD";
+this.ERROR_INVALID_VERIFICATION_CODE  = "INVALID_VERIFICATION_CODE";
+this.ERROR_INVALID_REQUEST_SIGNATURE  = "INVALID_REQUEST_SIGNATURE";
+this.ERROR_INTERNAL_INVALID_USER      = "INTERNAL_ERROR_INVALID_USER";
+this.ERROR_MISSING_BODY_PARAMETERS    = "MISSING_BODY_PARAMETERS";
+this.ERROR_MISSING_CONTENT_LENGTH     = "MISSING_CONTENT_LENGTH";
+this.ERROR_NO_TOKEN_SESSION           = "NO_TOKEN_SESSION";
+this.ERROR_NOT_VALID_JSON_BODY        = "NOT_VALID_JSON_BODY";
+this.ERROR_OFFLINE                    = "OFFLINE";
+this.ERROR_REQUEST_BODY_TOO_LARGE     = "REQUEST_BODY_TOO_LARGE";
+this.ERROR_SERVER_ERROR               = "SERVER_ERROR";
+this.ERROR_TOO_MANY_CLIENT_REQUESTS   = "TOO_MANY_CLIENT_REQUESTS";
+this.ERROR_SERVICE_TEMP_UNAVAILABLE   = "SERVICE_TEMPORARY_UNAVAILABLE";
+this.ERROR_UI_ERROR                   = "UI_ERROR";
+this.ERROR_UNKNOWN                    = "UNKNOWN_ERROR";
+this.ERROR_UNVERIFIED_ACCOUNT         = "UNVERIFIED_ACCOUNT";
+
+// Error matching.
+this.SERVER_ERRNO_TO_ERROR = {};
+SERVER_ERRNO_TO_ERROR[ERRNO_ACCOUNT_ALREADY_EXISTS]     = ERROR_ACCOUNT_ALREADY_EXISTS;
+SERVER_ERRNO_TO_ERROR[ERRNO_ACCOUNT_DOES_NOT_EXISTS]    = ERROR_ACCOUNT_DOES_NOT_EXISTS;
+SERVER_ERRNO_TO_ERROR[ERRNO_INCORRECT_PASSWORD]         = ERROR_INVALID_PASSWORD;
+SERVER_ERRNO_TO_ERROR[ERRNO_UNVERIFIED_ACCOUNT]         = ERROR_UNVERIFIED_ACCOUNT;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_VERIFICATION_CODE]  = ERROR_INVALID_VERIFICATION_CODE;
+SERVER_ERRNO_TO_ERROR[ERRNO_NOT_VALID_JSON_BODY]        = ERROR_NOT_VALID_JSON_BODY;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_BODY_PARAMETERS]    = ERROR_INVALID_BODY_PARAMETERS;
+SERVER_ERRNO_TO_ERROR[ERRNO_MISSING_BODY_PARAMETERS]    = ERROR_MISSING_BODY_PARAMETERS;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_REQUEST_SIGNATURE]  = ERROR_INVALID_REQUEST_SIGNATURE;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_AUTH_TOKEN]         = ERROR_INVALID_AUTH_TOKEN;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_AUTH_TIMESTAMP]     = ERROR_INVALID_AUTH_TIMESTAMP;
+SERVER_ERRNO_TO_ERROR[ERRNO_MISSING_CONTENT_LENGTH]     = ERROR_MISSING_CONTENT_LENGTH;
+SERVER_ERRNO_TO_ERROR[ERRNO_REQUEST_BODY_TOO_LARGE]     = ERROR_REQUEST_BODY_TOO_LARGE;
+SERVER_ERRNO_TO_ERROR[ERRNO_TOO_MANY_CLIENT_REQUESTS]   = ERROR_TOO_MANY_CLIENT_REQUESTS;
+SERVER_ERRNO_TO_ERROR[ERRNO_INVALID_AUTH_NONCE]         = ERROR_INVALID_AUTH_NONCE;
+SERVER_ERRNO_TO_ERROR[ERRNO_SERVICE_TEMP_UNAVAILABLE]   = ERROR_SERVICE_TEMP_UNAVAILABLE;
+SERVER_ERRNO_TO_ERROR[ERRNO_UNKNOWN_ERROR]              = ERROR_UNKNOWN;
+
+// Allow this file to be imported via Components.utils.import().
+this.EXPORTED_SYMBOLS = Object.keys(this);
diff --git a/services/fxaccounts/FxAccountsManager.jsm b/services/fxaccounts/FxAccountsManager.jsm
new file mode 100644
index 000000000000..ea45c30cbb8b
--- /dev/null
+++ b/services/fxaccounts/FxAccountsManager.jsm
@@ -0,0 +1,382 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Temporary abstraction layer for common Fx Accounts operations.
+ * For now, we will be using this module only from B2G but in the end we might
+ * want this to be merged with FxAccounts.jsm and let other products also use
+ * it.
+ */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["FxAccountsManager"];
+
+const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/FxAccounts.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/FxAccountsConsts.js");
+
+XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsClient",
+  "resource://gre/modules/FxAccountsClient.jsm");
+
+this.FxAccountsManager = {
+
+  // We don't really need to save fxAccounts instance but this way we allow
+  // to mock FxAccounts from tests.
+  _fxAccounts: fxAccounts,
+
+  // We keep the session details here so consumers don't need to deal with
+  // session tokens and are only required to handle the email.
+  _activeSession: null,
+
+  // We only expose the email and the verified status so far.
+  get _user() {
+    if (!this._activeSession || !this._activeSession.email) {
+      return null;
+    }
+
+    return {
+      accountId: this._activeSession.email,
+      verified: this._activeSession.verified
+    }
+  },
+
+  _getError: function(aServerResponse) {
+    if (!aServerResponse || !aServerResponse.error || !aServerResponse.error.errno) {
+      return;
+    }
+    return SERVER_ERRNO_TO_ERROR[aServerResponse.error.errno];
+  },
+
+  _serverError: function(aServerResponse) {
+    let error = this._getError({ error: aServerResponse });
+    return Promise.reject({
+      error: error ? error : ERROR_SERVER_ERROR,
+      details: aServerResponse
+    });
+  },
+
+  // As we do with _fxAccounts, we don't really need this factory, but this way
+  // we allow tests to mock FxAccountsClient.
+  _createFxAccountsClient: function() {
+    return new FxAccountsClient();
+  },
+
+  _signInSignUp: function(aMethod, aAccountId, aPassword) {
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    if (!aAccountId) {
+      return Promise.reject({
+        error: ERROR_INVALID_ACCOUNTID
+      });
+    }
+
+    if (!aPassword) {
+      return Promise.reject({
+        error: ERROR_INVALID_PASSWORD
+      });
+    }
+
+    // Check that there is no signed in account first.
+    if (this._activeSession) {
+      return Promise.reject({
+        error: ERROR_ALREADY_SIGNED_IN_USER,
+        details: {
+          user: this._user
+        }
+      });
+    }
+
+    let client = this._createFxAccountsClient();
+    return this._fxAccounts.getSignedInUser().then(
+      user => {
+        if (user) {
+          return Promise.reject({
+            error: ERROR_ALREADY_SIGNED_IN_USER,
+            details: {
+              user: user
+            }
+          });
+        }
+        return client[aMethod](aAccountId, aPassword);
+      }
+    ).then(
+      user => {
+        let error = this._getError(user);
+        if (!user || !user.uid || !user.sessionToken || error) {
+          return Promise.reject({
+            error: error ? error : ERROR_INTERNAL_INVALID_USER,
+            details: {
+              user: user
+            }
+          });
+        }
+
+        // Save the credentials of the signed in user.
+        user.email = aAccountId;
+        return this._fxAccounts.setSignedInUser(user, false).then(
+          () => {
+            this._activeSession = user;
+            return Promise.resolve({
+              accountCreated: aMethod === "signUp",
+              user: this._user
+            });
+          }
+        );
+      },
+      reason => { return this._serverError(reason); }
+    );
+  },
+
+  _getAssertion: function(aAudience) {
+    return this._fxAccounts.getAssertion(aAudience);
+  },
+
+  _signOut: function() {
+    if (!this._activeSession) {
+      return Promise.resolve();
+    }
+
+    return this._fxAccounts.signOut(this._activeSession.sessionToken).then(
+      () => {
+        // If there is no connection, removing the local session should be
+        // enough. The client can create new sessions up to the limit (100?).
+        // Orphaned tokens on the server will eventually be garbage collected.
+        if (Services.io.offline) {
+          this._activeSession = null;
+          return Promise.resolve();
+        }
+        // Otherwise, we try to remove the remote session.
+        let client = this._createFxAccountsClient();
+        return client.signOut(this._activeSession.sessionToken).then(
+          result => {
+            // Even if there is a remote server error, we remove the local
+            // session.
+            this._activeSession = null;
+            let error = this._getError(result);
+            if (error) {
+              return Promise.reject({
+                error: error,
+                details: result
+              });
+            }
+            return Promise.resolve();
+          },
+          reason => {
+            // Even if there is a remote server error, we remove the local
+            // session.
+            this._activeSession = null;
+            return this._serverError(reason);
+          }
+        );
+      }
+    );
+  },
+
+  // -- API --
+
+  signIn: function(aAccountId, aPassword) {
+    return this._signInSignUp("signIn", aAccountId, aPassword);
+  },
+
+  signUp: function(aAccountId, aPassword) {
+    return this._signInSignUp("signUp", aAccountId, aPassword);
+  },
+
+  signOut: function() {
+    if (!this._activeSession) {
+      // If there is no cached active session, we try to get it from the
+      // account storage.
+      return this.getAccount().then(
+        result => {
+          if (!result) {
+            return Promise.resolve();
+          }
+          return this._signOut();
+        }
+      );
+    }
+    return this._signOut();
+  },
+
+  getAccount: function() {
+    // We check first if we have session details cached.
+    if (this._activeSession) {
+      // If our cache says that the account is not yet verified, we check that
+      // this information is correct, and update the cached data if not.
+      if (this._activeSession && !this._activeSession.verified &&
+          !Services.io.offline) {
+        return this.verificationStatus(this._activeSession);
+      }
+
+      return Promise.resolve(this._user);
+    }
+
+    // If no cached information, we try to get it from the persistent storage.
+    return this._fxAccounts.getSignedInUser().then(
+      user => {
+        if (!user || !user.email) {
+          return Promise.resolve(null);
+        }
+
+        this._activeSession = user;
+        // If we get a stored information of a not yet verified account,
+        // we check this information with the server, update the stored
+        // data if needed and finally return the account details.
+        if (!user.verified && !Services.io.offline) {
+          return this.verificationStatus(user);
+        }
+
+        return Promise.resolve(this._user);
+      }
+    );
+  },
+
+  queryAccount: function(aAccountId) {
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    let deferred = Promise.defer();
+
+    if (!aAccountId) {
+      return Promise.reject({
+        error: ERROR_INVALID_ACCOUNTID
+      });
+    }
+
+    let client = this._createFxAccountsClient();
+    return client.accountExists(aAccountId).then(
+      result => {
+        let error = this._getError(result);
+        if (error) {
+          return Promise.reject({
+            error: error,
+            details: result
+          });
+        }
+
+        return Promise.resolve({
+          registered: result
+        });
+      },
+      reason => { this._serverError(reason); }
+    );
+  },
+
+  verificationStatus: function() {
+    if (!this._activeSession || !this._activeSession.sessionToken) {
+      return Promise.reject({
+        error: ERROR_NO_TOKEN_SESSION
+      });
+    }
+
+    // There is no way to unverify an already verified account, so we just
+    // return the account details of a verified account
+    if (this._activeSession.verified) {
+      return Promise.resolve(this._user);
+    }
+
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    let client = this._createFxAccountsClient();
+    return client.recoveryEmailStatus(this._activeSession.sessionToken).then(
+      data => {
+        let error = this._getError(data);
+        if (error) {
+          return Promise.reject({
+            error: error,
+            details: data
+          });
+        }
+
+        // If the verification status is different from the one that we have
+        // stored, we update it and return the session data. If not, we simply
+        // return the session data.
+        if (this._activeSession.verified != data.verified) {
+          this._activeSession.verified = data.verified;
+          return this._fxAccounts.setSignedInUser(this._activeSession).then(
+            () => {
+              return Promise.resolve(this._user);
+            }
+          );
+        }
+        return Promise.resolve(this._user);
+      },
+      reason => { return this._serverError(reason); }
+    );
+  },
+
+  getAssertion: function(aAudience) {
+    if (!aAudience) {
+      return Promise.reject({
+        error: ERROR_INVALID_AUDIENCE
+      });
+    }
+
+    if (Services.io.offline) {
+      return Promise.reject({
+        error: ERROR_OFFLINE
+      });
+    }
+
+    return this.getAccount().then(
+      user => {
+        if (user) {
+          // We cannot get assertions for unverified accounts.
+          if (user.verified) {
+            return this._getAssertion(aAudience);
+          }
+
+          return Promise.reject({
+            error: ERROR_UNVERIFIED_ACCOUNT,
+            details: {
+              user: user
+            }
+          });
+        }
+
+        // If there is no currently signed in user, we trigger the signIn UI
+        // flow.
+        let ui = Cc["@mozilla.org/fxaccounts/fxaccounts-ui-glue;1"]
+                   .createInstance(Ci.nsIFxAccountsUIGlue);
+        return ui.signInFlow().then(
+          result => {
+            // Even if we get a successful result from the UI, the account will
+            // most likely be unverified, so we cannot get an assertion.
+            if (result && result.verified) {
+              return this._getAssertion(aAudience);
+            }
+            return Promise.reject({
+              error: ERROR_UNVERIFIED_ACCOUNT,
+              details: {
+                user: result
+              }
+            });
+          },
+          error => {
+            return Promise.reject({
+              error: ERROR_UI_ERROR,
+              details: error
+            });
+          }
+        );
+      }
+    );
+  }
+};
diff --git a/services/fxaccounts/moz.build b/services/fxaccounts/moz.build
index 0f9e7e3ff30a..98741dfd2926 100644
--- a/services/fxaccounts/moz.build
+++ b/services/fxaccounts/moz.build
@@ -5,7 +5,13 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 TEST_DIRS += ['tests']
+
 EXTRA_JS_MODULES += [
   'FxAccounts.jsm',
-  'FxAccountsClient.jsm'
+  'FxAccountsClient.jsm',
+  'FxAccountsConsts.js'
 ]
+
+# For now, we will only be using the FxA manager in B2G.
+if CONFIG['MOZ_B2G']:
+  EXTRA_JS_MODULES += ['FxAccountsManager.jsm']

From e0fba846892b61e21d89c7c7df8a2f995e23cac9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:26 +0100
Subject: [PATCH 304/459] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 2: UI Glue r=fabrice

---
 b2g/components/B2GComponents.manifest         |  4 ++
 b2g/components/FxAccountsUIGlue.js            | 68 +++++++++++++++++++
 b2g/components/moz.build                      |  1 +
 b2g/installer/package-manifest.in             |  3 +
 services/fxaccounts/interfaces/moz.build      | 11 +++
 .../interfaces/nsIFxAccountsUIGlue.idl        | 12 ++++
 services/fxaccounts/moz.build                 |  2 +
 7 files changed, 101 insertions(+)
 create mode 100644 b2g/components/FxAccountsUIGlue.js
 create mode 100644 services/fxaccounts/interfaces/moz.build
 create mode 100644 services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl

diff --git a/b2g/components/B2GComponents.manifest b/b2g/components/B2GComponents.manifest
index 628aad91dd61..0ebcc8cfdf92 100644
--- a/b2g/components/B2GComponents.manifest
+++ b/b2g/components/B2GComponents.manifest
@@ -72,6 +72,10 @@ component {637b0f77-2429-49a0-915f-abf5d0db8b9a} WebappsUpdateTimer.js
 contract @mozilla.org/b2g/webapps-update-timer;1 {637b0f77-2429-49a0-915f-abf5d0db8b9a}
 category update-timer WebappsUpdateTimer @mozilla.org/b2g/webapps-update-timer;1,getService,background-update-timer,webapps.update.interval,86400
 
+# FxAccountsUIGlue.js
+component {51875c14-91d7-4b8c-b65d-3549e101228c} FxAccountsUIGlue.js
+contract @mozilla.org/fxaccounts/fxaccounts-ui-glue;1 {51875c14-91d7-4b8c-b65d-3549e101228c}
+
 # HelperAppDialog.js
 component {710322af-e6ae-4b0c-b2c9-1474a87b077e} HelperAppDialog.js
 contract @mozilla.org/helperapplauncherdialog;1 {710322af-e6ae-4b0c-b2c9-1474a87b077e}
diff --git a/b2g/components/FxAccountsUIGlue.js b/b2g/components/FxAccountsUIGlue.js
new file mode 100644
index 000000000000..a2650237cc90
--- /dev/null
+++ b/b2g/components/FxAccountsUIGlue.js
@@ -0,0 +1,68 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict"
+
+const { interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/ObjectWrapper.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+
+XPCOMUtils.defineLazyServiceGetter(this, "uuidgen",
+                                   "@mozilla.org/uuid-generator;1",
+                                   "nsIUUIDGenerator");
+
+function FxAccountsUIGlue() {
+}
+
+FxAccountsUIGlue.prototype = {
+
+  _browser: Services.wm.getMostRecentWindow("navigator:browser"),
+
+  signInFlow: function() {
+    let deferred = Promise.defer();
+
+    let content = this._browser.getContentWindow();
+    if (!content) {
+      deferred.reject("InternalErrorNoContent");
+      return;
+    }
+
+    let id = uuidgen.generateUUID().toString();
+
+    content.addEventListener("mozFxAccountsRPContentEvent",
+                             function onContentEvent(result) {
+      let msg = result.detail;
+      if (!msg || !msg.id || msg.id != id) {
+        deferred.reject("InternalErrorWrongContentEvent");
+        content.removeEventListener("mozFxAccountsRPContentEvent",
+                                    onContentEvent);
+        return;
+      }
+
+      if (msg.error) {
+        deferred.reject(msg);
+      } else {
+        deferred.resolve(msg.result);
+      }
+      content.removeEventListener("mozFxAccountsRPContentEvent",
+                                  onContentEvent);
+    });
+
+    this._browser.shell.sendCustomEvent("mozFxAccountsRPChromeEvent", {
+      method: "openFlow",
+      id: id
+    });
+
+    return deferred.promise;
+  },
+
+  classID: Components.ID("{51875c14-91d7-4b8c-b65d-3549e101228c}"),
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIFxAccountsUIGlue])
+};
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([FxAccountsUIGlue]);
diff --git a/b2g/components/moz.build b/b2g/components/moz.build
index a0ed6421f002..c5b6bb1dc2e1 100644
--- a/b2g/components/moz.build
+++ b/b2g/components/moz.build
@@ -13,6 +13,7 @@ EXTRA_COMPONENTS += [
     'ContentHandler.js',
     'ContentPermissionPrompt.js',
     'FilePicker.js',
+    'FxAccountsUIGlue.js',
     'HelperAppDialog.js',
     'MailtoProtocolHandler.js',
     'PaymentGlue.js',
diff --git a/b2g/installer/package-manifest.in b/b2g/installer/package-manifest.in
index eb92d18f522c..23243a990137 100644
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -789,6 +789,7 @@ bin/components/@DLL_PREFIX@nkgnomevfs@DLL_SUFFIX@
 @BINPATH@/components/TelProtocolHandler.js
 @BINPATH@/components/B2GAboutRedirector.js
 @BINPATH@/components/FilePicker.js
+@BINPATH@/components/FxAccountsUIGlue.js
 @BINPATH@/components/HelperAppDialog.js
 @BINPATH@/components/DownloadsUI.js
 
@@ -796,6 +797,8 @@ bin/components/@DLL_PREFIX@nkgnomevfs@DLL_SUFFIX@
 @BINPATH@/components/DataStoreService.js
 @BINPATH@/components/dom_datastore.xpt
 
+@BINPATH@/components/services_fxaccounts.xpt
+
 #ifdef MOZ_WEBSPEECH
 @BINPATH@/components/dom_webspeechsynth.xpt
 #endif
diff --git a/services/fxaccounts/interfaces/moz.build b/services/fxaccounts/interfaces/moz.build
new file mode 100644
index 000000000000..3dcb3b997b25
--- /dev/null
+++ b/services/fxaccounts/interfaces/moz.build
@@ -0,0 +1,11 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XPIDL_SOURCES += [
+    'nsIFxAccountsUIGlue.idl'
+]
+
+XPIDL_MODULE = 'services_fxaccounts'
diff --git a/services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl b/services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl
new file mode 100644
index 000000000000..10adbc764cfa
--- /dev/null
+++ b/services/fxaccounts/interfaces/nsIFxAccountsUIGlue.idl
@@ -0,0 +1,12 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+[scriptable, uuid(5805ac8b-7cbe-4fbd-97ad-d3ae8cd29f79)]
+interface nsIFxAccountsUIGlue : nsISupports
+{
+  // Returns a Promise.
+  jsval signInFlow();
+};
diff --git a/services/fxaccounts/moz.build b/services/fxaccounts/moz.build
index 98741dfd2926..060361da2e73 100644
--- a/services/fxaccounts/moz.build
+++ b/services/fxaccounts/moz.build
@@ -4,6 +4,8 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+PARALLEL_DIRS += ['interfaces']
+
 TEST_DIRS += ['tests']
 
 EXTRA_JS_MODULES += [

From 712d24a0911a5308adb401ba5989f6e1559c9985 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:26 +0100
Subject: [PATCH 305/459] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 3: FxA B2G Service. r=fabrice

---
 b2g/chrome/content/shell.js              |   5 +-
 b2g/components/FxAccountsMgmtService.jsm | 127 +++++++++++++++++++++++
 b2g/components/moz.build                 |   1 +
 3 files changed, 132 insertions(+), 1 deletion(-)
 create mode 100644 b2g/components/FxAccountsMgmtService.jsm

diff --git a/b2g/chrome/content/shell.js b/b2g/chrome/content/shell.js
index eb920e0fd7fc..bfc29487f356 100644
--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@@ -21,9 +21,10 @@ Cu.import('resource://gre/modules/ErrorPage.jsm');
 Cu.import('resource://gre/modules/NetworkStatsService.jsm');
 #endif
 
-// identity
+// Identity
 Cu.import('resource://gre/modules/SignInToWebsite.jsm');
 SignInToWebsiteController.init();
+Cu.import('resource://gre/modules/FxAccountsMgmtService.jsm');
 
 Cu.import('resource://gre/modules/DownloadsAPI.jsm');
 
@@ -614,6 +615,8 @@ var shell = {
 
     this.sendEvent(window, 'ContentStart');
 
+    Services.obs.notifyObservers(null, 'content-start', null);
+
 #ifdef MOZ_WIDGET_GONK
     Cu.import('resource://gre/modules/OperatorApps.jsm');
 #endif
diff --git a/b2g/components/FxAccountsMgmtService.jsm b/b2g/components/FxAccountsMgmtService.jsm
new file mode 100644
index 000000000000..fea70f1ab417
--- /dev/null
+++ b/b2g/components/FxAccountsMgmtService.jsm
@@ -0,0 +1,127 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Some specific (certified) apps need to get access to certain Firefox Accounts
+ * functionality that allows them to manage accounts (this is mostly sign up,
+ * sign in, logout and delete) and get information about the currently existing
+ * ones.
+ *
+ * This service listens for requests coming from these apps, triggers the
+ * appropriate Fx Accounts flows and send reponses back to the UI.
+ *
+ * The communication mechanism is based in mozFxAccountsContentEvent (for
+ * messages coming from the UI) and mozFxAccountsChromeEvent (for messages
+ * sent from the chrome side) custom events.
+ */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["FxAccountsMgmtService"];
+
+const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/ObjectWrapper.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsManager",
+  "resource://gre/modules/FxAccountsManager.jsm");
+
+this.FxAccountsMgmtService = {
+
+  _sendChromeEvent: function(aMsg) {
+    if (!this._shell) {
+      return;
+    }
+    this._shell.sendCustomEvent("mozFxAccountsChromeEvent", aMsg);
+  },
+
+  _onFullfill: function(aMsgId, aData) {
+    this._sendChromeEvent({
+      id: aMsgId,
+      data: aData ? aData : null
+    });
+  },
+
+  _onReject: function(aMsgId, aReason) {
+    this._sendChromeEvent({
+      id: aMsgId,
+      error: aReason ? aReason : null
+    });
+  },
+
+  init: function() {
+    Services.obs.addObserver(this, "content-start", false);
+  },
+
+  observe: function(aSubject, aTopic, aData) {
+    this._shell = Services.wm.getMostRecentWindow("navigator:browser").shell;
+    let content = this._shell.contentBrowser.contentWindow;
+    content.addEventListener("mozFxAccountsContentEvent",
+                             FxAccountsMgmtService);
+    Services.obs.removeObserver(this, "content-start");
+  },
+
+  handleEvent: function(aEvent) {
+    let msg = aEvent.detail;
+    let self = FxAccountsMgmtService;
+
+    if (!msg.id) {
+      return;
+    }
+
+    let data = msg.data;
+    if (!data) {
+      return;
+    }
+
+    switch(data.method) {
+      case "getAccounts":
+        FxAccountsManager.getAccount().then(
+          account => {
+            // We only expose the email and verification status so far.
+            self._onFullfill(msg.id, account);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+      case "logout":
+        FxAccountsManager.signOut().then(
+          () => {
+            self._onFullfill(msg.id);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+      case "queryAccount":
+        FxAccountsManager.queryAccount(data.accountId).then(
+          result => {
+            self._onFullfill(msg.id, result);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+      case "signIn":
+      case "signUp":
+        FxAccountsManager[data.method](data.accountId, data.password).then(
+          user => {
+            self._onFullfill(msg.id, user);
+          },
+          reason => {
+            self._onReject(msg.id, reason);
+          }
+        ).then(null, Components.utils.reportError);
+        break;
+    }
+  }
+};
+
+FxAccountsMgmtService.init();
diff --git a/b2g/components/moz.build b/b2g/components/moz.build
index c5b6bb1dc2e1..331b6b1111cf 100644
--- a/b2g/components/moz.build
+++ b/b2g/components/moz.build
@@ -37,6 +37,7 @@ if CONFIG['MOZ_UPDATER']:
 
 EXTRA_JS_MODULES += [
     'ErrorPage.jsm',
+    'FxAccountsMgmtService.jsm',
     'SignInToWebsite.jsm',
     'TelURIParser.jsm',
     'WebappsUpdater.jsm',

From c9a5febee3fe59c2b55069f71bbd9ed4f0982945 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:25:27 +0100
Subject: [PATCH 306/459] Bug 949526 - FxAccountsManager and B2G
 implementation. Part 4: Tests. r=markh

---
 .../fxaccounts/tests/xpcshell/test_manager.js | 583 ++++++++++++++++++
 .../fxaccounts/tests/xpcshell/xpcshell.ini    |   4 +-
 2 files changed, 586 insertions(+), 1 deletion(-)
 create mode 100644 services/fxaccounts/tests/xpcshell/test_manager.js

diff --git a/services/fxaccounts/tests/xpcshell/test_manager.js b/services/fxaccounts/tests/xpcshell/test_manager.js
new file mode 100644
index 000000000000..64ca648a6377
--- /dev/null
+++ b/services/fxaccounts/tests/xpcshell/test_manager.js
@@ -0,0 +1,583 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+const Cm = Components.manager;
+
+Cu.import("resource://gre/modules/FxAccounts.jsm");
+Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsManager.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+
+// === Mocks ===
+
+// Override FxAccountsUIGlue.
+const kFxAccountsUIGlueUUID = "{8f6d5d87-41ed-4bb5-aa28-625de57564c5}";
+const kFxAccountsUIGlueContractID =
+  "@mozilla.org/fxaccounts/fxaccounts-ui-glue;1";
+
+// Save original FxAccountsUIGlue factory.
+const kFxAccountsUIGlueFactory =
+  Cm.getClassObject(Cc[kFxAccountsUIGlueContractID], Ci.nsIFactory);
+
+let fakeFxAccountsUIGlueFactory = {
+  createInstance: function(aOuter, aIid) {
+    return FxAccountsUIGlue.QueryInterface(aIid);
+  }
+};
+
+// FxAccountsUIGlue fake component.
+let FxAccountsUIGlue = {
+  _reject: false,
+
+  _error: 'error',
+
+  _signInFlowCalled: false,
+
+  _reset: function() {
+    this._reject = false;
+    this._error = 'error';
+    this._signInFlowCalled = false;
+  },
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIFxAccountsUIGlue]),
+
+  getUserPermission: function() {},
+
+  signInFlow: function() {
+    this._signInFlowCalled = true;
+    let deferred = Promise.defer();
+
+    if (this._reject) {
+      deferred.reject(this._error);
+    } else {
+      FxAccountsManager._activeSession = {
+        email: "user@domain.org",
+        verified: false,
+        sessionToken: "1234"
+      };
+      FxAccountsManager._fxAccounts
+                       .setSignedInUser(FxAccountsManager._activeSession);
+      deferred.resolve();
+    }
+
+    return deferred.promise;
+  }
+};
+
+(function registerFakeFxAccountsUIGlue() {
+  Cm.QueryInterface(Ci.nsIComponentRegistrar)
+    .registerFactory(Components.ID(kFxAccountsUIGlueUUID),
+                     "FxAccountsUIGlue",
+                     kFxAccountsUIGlueContractID,
+                     fakeFxAccountsUIGlueFactory);
+})();
+
+// Save original fxAccounts instance
+const kFxAccounts = fxAccounts;
+// and change it for a mock FxAccounts.
+FxAccountsManager._fxAccounts = {
+  _reject: false,
+  _getSignedInUserCalled: false,
+  _setSignedInUserCalled: false,
+
+  _error: 'error',
+  _assertion: 'assertion',
+  _signedInUser: null,
+
+  _reset: function() {
+    this._getSignedInUserCalled = false;
+    this._setSignedInUserCalled = false;
+    this._reject = false;
+  },
+
+  getAssertion: function() {
+    if (!this._signedInUser) {
+      return null;
+    }
+
+    let deferred = Promise.defer();
+    deferred.resolve(this._assertion);
+    return deferred.promise;
+  },
+
+  getSignedInUser: function() {
+    this._getSignedInUserCalled = true;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject(this._error)
+                 : deferred.resolve(this._signedInUser);
+    return deferred.promise;
+  },
+
+  setSignedInUser: function(user) {
+    this._setSignedInUserCalled = true;
+    let deferred = Promise.defer();
+    this._signedInUser = user;
+    deferred.resolve();
+    return deferred.promise;
+  },
+
+  signOut: function() {
+    let deferred = Promise.defer();
+    this._signedInUser = null;
+    deferred.resolve();
+    return deferred.promise;
+  }
+};
+
+// Save original FxAccountsClient factory from FxAccountsManager.
+const kFxAccountsClient = FxAccountsManager._createFxAccountsClient;
+// and change it for a fake client factory.
+let FakeFxAccountsClient = {
+  _reject: false,
+  _recoveryEmailStatusCalled: false,
+  _signInCalled: false,
+  _signUpCalled: false,
+  _signOutCalled: false,
+
+  _accountExists: false,
+  _verified: false,
+  _password: null,
+
+  _reset: function() {
+    this._reject = false;
+    this._recoveryEmailStatusCalled = false;
+    this._signInCalled = false;
+    this._signUpCalled = false;
+    this._signOutCalled = false;
+  },
+
+  recoveryEmailStatus: function() {
+    this._recoveryEmailStatusCalled = true;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve({ verified: this._verified });
+    return deferred.promise;
+  },
+
+  signIn: function(user, password) {
+    this._signInCalled = true;
+    this._password = password;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve({ email: user,
+                                      uid: "whatever",
+                                      verified: this._verified,
+                                      sessionToken: "1234" });
+    return deferred.promise;
+  },
+
+  signUp: function(user, password) {
+    this._signUpCalled = true;
+    return this.signIn(user, password);
+  },
+
+  signOut: function() {
+    this._signOutCalled = true;
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve();
+    return deferred.promise;
+  },
+
+  accountExists: function() {
+    let deferred = Promise.defer();
+    this._reject ? deferred.reject()
+                 : deferred.resolve(this._accountExists);
+    return deferred.promise;
+  }
+};
+FxAccountsManager._createFxAccountsClient = function() {
+  return FakeFxAccountsClient;
+}
+
+// === Global cleanup ===
+
+// Unregister mocks and restore original code.
+do_register_cleanup(function() {
+  // Unregister the factory so we do not leak
+  Cm.QueryInterface(Ci.nsIComponentRegistrar)
+    .unregisterFactory(Components.ID(kFxAccountsUIGlueUUID),
+                       fakeFxAccountsUIGlueFactory);
+
+  // Restore the original factory.
+  Cm.QueryInterface(Ci.nsIComponentRegistrar)
+    .registerFactory(Components.ID(kFxAccountsUIGlueUUID),
+                     "FxAccountsUIGlue",
+                     kFxAccountsUIGlueContractID,
+                     kFxAccountsUIGlueFactory);
+
+  // Restore the original FxAccounts instance from FxAccountsManager.
+  FxAccountsManager._fxAccounts = kFxAccounts;
+
+  // Restore the FxAccountsClient getter from FxAccountsManager.
+  FxAccountsManager._createFxAccountsClient = kFxAccountsClient;
+});
+
+
+// === Tests ===
+
+function run_test() {
+  run_next_test();
+}
+
+add_test(function test_initial_state() {
+  do_print("= Test 0 | Initial state =");
+  do_check_neq(FxAccountsManager, undefined);
+  do_check_null(FxAccountsManager._activeSession);
+  do_check_null(FxAccountsManager._user);
+  run_next_test();
+});
+
+add_test(function(test_getAccount_no_session) {
+  do_print("= Test 1 | getAccount no session =");
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_null(result);
+      do_check_null(FxAccountsManager._activeSession);
+      do_check_null(FxAccountsManager._user);
+      do_check_true(FxAccountsManager._fxAccounts._getSignedInUserCalled);
+      FxAccountsManager._fxAccounts._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAssertion_no_audience) {
+  do_print("= Test 2 | getAssertion no audience =");
+  FxAccountsManager.getAssertion().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_AUDIENCE);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_no_session_ui_error) {
+  do_print("= Test 3 | getAssertion no session, UI error =");
+  FxAccountsUIGlue._reject = true;
+  FxAccountsManager.getAssertion("audience").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_UI_ERROR);
+      do_check_eq(error.details, "error");
+      FxAccountsUIGlue._reset();
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_no_session_ui_success) {
+  do_print("= Test 4 | getAssertion no session, UI success =");
+  FxAccountsManager.getAssertion("audience").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_true(FxAccountsUIGlue._signInFlowCalled);
+      do_check_eq(error.error, ERROR_UNVERIFIED_ACCOUNT);
+      FxAccountsUIGlue._reset();
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_active_session_unverified_account) {
+  do_print("= Test 5 | getAssertion active session, unverified account =");
+  FxAccountsManager.getAssertion("audience").then(
+    result => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_false(FxAccountsUIGlue._signInFlowCalled);
+      do_check_eq(error.error, ERROR_UNVERIFIED_ACCOUNT);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_getAssertion_active_session_verified_account) {
+  do_print("= Test 6 | getAssertion active session, verified account =");
+  FxAccountsManager._fxAccounts._signedInUser.verified = true;
+  FxAccountsManager._activeSession.verified = true;
+  FxAccountsManager.getAssertion("audience").then(
+    result => {
+      do_check_false(FxAccountsUIGlue._signInFlowCalled);
+      do_check_eq(result, "assertion");
+      FxAccountsManager._fxAccounts._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAccount_existing_verified_session) {
+  do_print("= Test 7 | getAccount, existing verified session =");
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_false(FxAccountsManager._fxAccounts._getSignedInUserCalled);
+      do_check_eq(result.accountId, FxAccountsManager._user.accountId);
+      do_check_eq(result.verified, FxAccountsManager._user.verified);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAccount_existing_unverified_session_unverified_user) {
+  do_print("= Test 8 | getAccount, existing unverified session, unverified user =");
+  FxAccountsManager._activeSession.verified = false;
+  FxAccountsManager._fxAccounts._signedInUser.verified = false;
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_false(result.verified);
+      do_check_eq(result.accountId, FxAccountsManager._user.accountId);
+      FakeFxAccountsClient._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_getAccount_existing_unverified_session_verified_user) {
+  do_print("= Test 8 | getAccount, existing unverified session, verified user =");
+  FxAccountsManager._activeSession.verified = false;
+  FxAccountsManager._fxAccounts._signedInUser.verified = false;
+  FakeFxAccountsClient._verified = true;
+  FxAccountsManager.getAccount().then(
+    result => {
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_true(result.verified);
+      do_check_eq(result.accountId, FxAccountsManager._user.accountId);
+      FakeFxAccountsClient._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_signOut) {
+  do_print("= Test 9 | signOut =");
+  do_check_true(FxAccountsManager._activeSession != null);
+  FxAccountsManager.signOut().then(
+    result => {
+      do_check_null(result);
+      do_check_null(FxAccountsManager._activeSession);
+      do_check_true(FakeFxAccountsClient._signOutCalled);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_verificationStatus_no_token_session) {
+  do_print("= Test 10 | verificationStatus, no token session =");
+  do_check_null(FxAccountsManager._activeSession);
+  FxAccountsManager.verificationStatus().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_NO_TOKEN_SESSION);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signUp_no_accountId) {
+  do_print("= Test 11 | signUp, no accountId=");
+  FxAccountsManager.signUp().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_ACCOUNTID);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signIn_no_accountId) {
+  do_print("= Test 12 | signIn, no accountId=");
+  FxAccountsManager.signIn().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_ACCOUNTID);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signUp_no_password) {
+  do_print("= Test 13 | signUp, no accountId=");
+  FxAccountsManager.signUp("user@domain.org").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_PASSWORD);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signIn_no_accountId) {
+  do_print("= Test 14 | signIn, no accountId=");
+  FxAccountsManager.signIn("user@domain.org").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_PASSWORD);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signUp) {
+  do_print("= Test 15 | signUp =");
+  FakeFxAccountsClient._verified = false;
+  FxAccountsManager.signUp("user@domain.org", "password").then(
+    result => {
+      do_check_true(FakeFxAccountsClient._signInCalled);
+      do_check_true(FakeFxAccountsClient._signUpCalled);
+      do_check_true(FxAccountsManager._fxAccounts._getSignedInUserCalled);
+      do_check_eq(FxAccountsManager._fxAccounts._signedInUser.email, "user@domain.org");
+      do_check_eq(FakeFxAccountsClient._password, "password");
+      do_check_true(result.accountCreated);
+      do_check_eq(result.user.accountId, "user@domain.org");
+      do_check_false(result.user.verified);
+      FakeFxAccountsClient._reset();
+      FxAccountsManager._fxAccounts._reset();
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error.error);
+    }
+  );
+});
+
+add_test(function(test_signUp_already_signed_user) {
+  do_print("= Test 16 | signUp, already signed user =");
+  FxAccountsManager.signUp("user@domain.org", "password").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_false(FakeFxAccountsClient._signInCalled);
+      do_check_eq(error.error, ERROR_ALREADY_SIGNED_IN_USER);
+      do_check_eq(error.details.user.accountId, "user@domain.org");
+      do_check_false(error.details.user.verified);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_signIn_already_signed_user) {
+  do_print("= Test 17 | signIn, already signed user =");
+  FxAccountsManager.signIn("user@domain.org", "password").then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_ALREADY_SIGNED_IN_USER);
+      do_check_eq(error.details.user.accountId, "user@domain.org");
+      do_check_false(error.details.user.verified);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function(test_verificationStatus_unverified_session_unverified_user) {
+  do_print("= Test 18 | verificationStatus unverified session and user =");
+  FakeFxAccountsClient._verified = false;
+  FxAccountsManager.verificationStatus().then(
+    user => {
+      do_check_false(user.verified);
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_false(FxAccountsManager._fxAccounts._setSignedInUserCalled);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_verificationStatus_unverified_session_verified_user) {
+  do_print("= Test 19 | verificationStatus unverified session, verified user =");
+  FakeFxAccountsClient._verified = true;
+  FxAccountsManager.verificationStatus().then(
+    user => {
+      do_check_true(user.verified);
+      do_check_true(FakeFxAccountsClient._recoveryEmailStatusCalled);
+      do_check_true(FxAccountsManager._fxAccounts._setSignedInUserCalled);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_queryAccount_no_exists) {
+  do_print("= Test 20 | queryAccount, no exists =");
+  FxAccountsManager.queryAccount("user@domain.org").then(
+    result => {
+      do_check_false(result.registered);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_queryAccount_exists) {
+  do_print("= Test 21 | queryAccount, exists =");
+  FakeFxAccountsClient._accountExists = true;
+  FxAccountsManager.queryAccount("user@domain.org").then(
+    result => {
+      do_check_true(result.registered);
+      run_next_test();
+    },
+    error => {
+      do_throw("Unexpected error: " + error);
+    }
+  );
+});
+
+add_test(function(test_queryAccount_no_accountId) {
+  do_print("= Test 22 | queryAccount, no accountId =");
+  FxAccountsManager.queryAccount().then(
+    () => {
+      do_throw("Unexpected success");
+    },
+    error => {
+      do_check_eq(error.error, ERROR_INVALID_ACCOUNTID);
+      run_next_test();
+    }
+  );
+});
diff --git a/services/fxaccounts/tests/xpcshell/xpcshell.ini b/services/fxaccounts/tests/xpcshell/xpcshell.ini
index 414a3649bd92..8b09ed856fe6 100644
--- a/services/fxaccounts/tests/xpcshell/xpcshell.ini
+++ b/services/fxaccounts/tests/xpcshell/xpcshell.ini
@@ -4,4 +4,6 @@ tail =
 
 [test_accounts.js]
 [test_client.js]
-
+[test_manager.js]
+run-if = appname == 'b2g'
+reason = FxAccountsManager is only available for B2G for now

From 6f4e632c54fc8c13dbc7f331056c3707bc859d98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fernando=20Jim=C3=A9nez?= <ferjmoreno@gmail.com>
Date: Fri, 13 Dec 2013 12:37:55 +0100
Subject: [PATCH 307/459] Bug 943998 - Need debug and uri pref for
 FirefoxAccounts. r=markh

--HG--
rename : services/fxaccounts/FxAccountsConsts.js => services/fxaccounts/FxAccountsCommon.js
---
 b2g/components/FxAccountsMgmtService.jsm      |  2 +
 b2g/components/FxAccountsUIGlue.js            | 13 +++++--
 services/fxaccounts/FxAccounts.jsm            | 18 +--------
 services/fxaccounts/FxAccountsClient.jsm      |  8 ++++
 ...xAccountsConsts.js => FxAccountsCommon.js} | 27 ++++++++++++++
 services/fxaccounts/FxAccountsManager.jsm     | 37 ++++++++++++++++++-
 services/fxaccounts/moz.build                 |  2 +-
 .../fxaccounts/tests/xpcshell/test_manager.js |  2 +-
 8 files changed, 84 insertions(+), 25 deletions(-)
 rename services/fxaccounts/{FxAccountsConsts.js => FxAccountsCommon.js} (84%)

diff --git a/b2g/components/FxAccountsMgmtService.jsm b/b2g/components/FxAccountsMgmtService.jsm
index fea70f1ab417..d737fd1109b5 100644
--- a/b2g/components/FxAccountsMgmtService.jsm
+++ b/b2g/components/FxAccountsMgmtService.jsm
@@ -25,6 +25,7 @@ const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/ObjectWrapper.jsm");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsManager",
   "resource://gre/modules/FxAccountsManager.jsm");
@@ -66,6 +67,7 @@ this.FxAccountsMgmtService = {
 
   handleEvent: function(aEvent) {
     let msg = aEvent.detail;
+    log.debug("Got content msg " + JSON.stringify(msg));
     let self = FxAccountsMgmtService;
 
     if (!msg.id) {
diff --git a/b2g/components/FxAccountsUIGlue.js b/b2g/components/FxAccountsUIGlue.js
index a2650237cc90..8fa0987278cc 100644
--- a/b2g/components/FxAccountsUIGlue.js
+++ b/b2g/components/FxAccountsUIGlue.js
@@ -10,6 +10,7 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/ObjectWrapper.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyServiceGetter(this, "uuidgen",
                                    "@mozilla.org/uuid-generator;1",
@@ -43,6 +44,8 @@ FxAccountsUIGlue.prototype = {
         return;
       }
 
+      log.debug("Got content event " + JSON.stringify(msg));
+
       if (msg.error) {
         deferred.reject(msg);
       } else {
@@ -52,10 +55,12 @@ FxAccountsUIGlue.prototype = {
                                   onContentEvent);
     });
 
-    this._browser.shell.sendCustomEvent("mozFxAccountsRPChromeEvent", {
-      method: "openFlow",
-      id: id
-    });
+    let detail = {
+       method: "openFlow",
+       id: id
+    };
+    log.debug("Send chrome event " + JSON.stringify(detail));
+    this._browser.shell.sendCustomEvent("mozFxAccountsRPChromeEvent", detail);
 
     return deferred.promise;
   },
diff --git a/services/fxaccounts/FxAccounts.jsm b/services/fxaccounts/FxAccounts.jsm
index c7efa8429b9b..50f9e5a42f5d 100644
--- a/services/fxaccounts/FxAccounts.jsm
+++ b/services/fxaccounts/FxAccounts.jsm
@@ -16,27 +16,11 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Timer.jsm");
 Cu.import("resource://gre/modules/Task.jsm");
 Cu.import("resource://gre/modules/FxAccountsClient.jsm");
-Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "jwcrypto",
                                   "resource://gre/modules/identity/jwcrypto.jsm");
 
-// loglevel preference should be one of: "FATAL", "ERROR", "WARN", "INFO",
-// "CONFIG", "DEBUG", "TRACE" or "ALL". We will be logging error messages by
-// default.
-const PREF_LOG_LEVEL = "identity.fxaccounts.loglevel";
-try {
-  this.LOG_LEVEL =
-    Services.prefs.getPrefType(PREF_LOG_LEVEL) == Ci.nsIPrefBranch.PREF_STRING
-    && Services.prefs.getCharPref(PREF_LOG_LEVEL);
-} catch (e) {
-  this.LOG_LEVEL = Log.Level.Error;
-}
-
-let log = Log.repository.getLogger("Services.FxAccounts");
-log.level = LOG_LEVEL;
-log.addAppender(new Log.ConsoleAppender(new Log.BasicFormatter()));
-
 InternalMethods = function(mock) {
   this.cert = null;
   this.keyPair = null;
diff --git a/services/fxaccounts/FxAccountsClient.jsm b/services/fxaccounts/FxAccountsClient.jsm
index 5f5df829b77b..09438adbe112 100644
--- a/services/fxaccounts/FxAccountsClient.jsm
+++ b/services/fxaccounts/FxAccountsClient.jsm
@@ -10,6 +10,7 @@ Cu.import("resource://gre/modules/Promise.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://services-common/utils.js");
 Cu.import("resource://services-crypto/utils.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 // Default can be changed by the preference 'identity.fxaccounts.auth.uri'
 let _host = "https://api-accounts.dev.lcip.org/v1";
@@ -283,6 +284,9 @@ this.FxAccountsClient.prototype = {
       payload = JSON.stringify(jsonPayload);
     }
 
+    log.debug("(HAWK request) - Path: " + path + " - Method: " + method +
+              " - Payload: " + payload);
+
     xhr.open(method, URI);
     xhr.channel.loadFlags = Ci.nsIChannel.LOAD_BYPASS_CACHE |
                             Ci.nsIChannel.INHIBIT_CACHING;
@@ -300,12 +304,16 @@ this.FxAccountsClient.prototype = {
     xhr.onload = function onload() {
       try {
         let response = JSON.parse(xhr.responseText);
+        log.debug("(Response) Code: " + xhr.status + " - Status text: " +
+                  xhr.statusText + " - Response text: " + xhr.responseText);
         if (xhr.status !== 200 || response.error) {
           // In this case, the response is an object with error information.
           return deferred.reject(response);
         }
         deferred.resolve(response);
       } catch (e) {
+        log.error("(Response) Code: " + xhr.status + " - Status text: " +
+                  xhr.statusText);
         deferred.reject(constructError(e));
       }
     };
diff --git a/services/fxaccounts/FxAccountsConsts.js b/services/fxaccounts/FxAccountsCommon.js
similarity index 84%
rename from services/fxaccounts/FxAccountsConsts.js
rename to services/fxaccounts/FxAccountsCommon.js
index 51e8427b038a..1c65449bcaee 100644
--- a/services/fxaccounts/FxAccountsConsts.js
+++ b/services/fxaccounts/FxAccountsCommon.js
@@ -2,6 +2,33 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+const { interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/Log.jsm");
+
+// loglevel should be one of "Fatal", "Error", "Warn", "Info", "Config",
+// "Debug", "Trace" or "All". If none is specified, "Error" will be used by
+// default.
+const PREF_LOG_LEVEL = "identity.fxaccounts.loglevel";
+
+XPCOMUtils.defineLazyGetter(this, 'log', function() {
+  let log = Log.repository.getLogger("FirefoxAccounts");
+  log.addAppender(new Log.DumpAppender());
+  log.level = Log.Level.Error;
+  try {
+    let level =
+      Services.prefs.getPrefType(PREF_LOG_LEVEL) == Ci.nsIPrefBranch.PREF_STRING
+      && Services.prefs.getCharPref(PREF_LOG_LEVEL);
+    log.level = Log.Level[level] || Log.Level.Error;
+  } catch (e) {
+    log.error(e);
+  }
+
+  return log;
+});
+
 this.DATA_FORMAT_VERSION = 1;
 this.DEFAULT_STORAGE_FILENAME = "signedInUser.json";
 
diff --git a/services/fxaccounts/FxAccountsManager.jsm b/services/fxaccounts/FxAccountsManager.jsm
index ea45c30cbb8b..cbae6cd0f959 100644
--- a/services/fxaccounts/FxAccountsManager.jsm
+++ b/services/fxaccounts/FxAccountsManager.jsm
@@ -19,7 +19,7 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FxAccounts.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
-Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 
 XPCOMUtils.defineLazyModuleGetter(this, "FxAccountsClient",
   "resource://gre/modules/FxAccountsClient.jsm");
@@ -50,7 +50,9 @@ this.FxAccountsManager = {
     if (!aServerResponse || !aServerResponse.error || !aServerResponse.error.errno) {
       return;
     }
-    return SERVER_ERRNO_TO_ERROR[aServerResponse.error.errno];
+    let error = SERVER_ERRNO_TO_ERROR[aServerResponse.error.errno];
+    log.error(error);
+    return error;
   },
 
   _serverError: function(aServerResponse) {
@@ -69,18 +71,21 @@ this.FxAccountsManager = {
 
   _signInSignUp: function(aMethod, aAccountId, aPassword) {
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
     }
 
     if (!aAccountId) {
+      log.error(ERROR_INVALID_ACCOUNTID);
       return Promise.reject({
         error: ERROR_INVALID_ACCOUNTID
       });
     }
 
     if (!aPassword) {
+      log.error(ERROR_INVALID_PASSWORD);
       return Promise.reject({
         error: ERROR_INVALID_PASSWORD
       });
@@ -88,6 +93,7 @@ this.FxAccountsManager = {
 
     // Check that there is no signed in account first.
     if (this._activeSession) {
+      log.error(ERROR_ALREADY_SIGNED_IN_USER);
       return Promise.reject({
         error: ERROR_ALREADY_SIGNED_IN_USER,
         details: {
@@ -100,6 +106,7 @@ this.FxAccountsManager = {
     return this._fxAccounts.getSignedInUser().then(
       user => {
         if (user) {
+          log.error(ERROR_ALREADY_SIGNED_IN_USER);
           return Promise.reject({
             error: ERROR_ALREADY_SIGNED_IN_USER,
             details: {
@@ -113,6 +120,7 @@ this.FxAccountsManager = {
       user => {
         let error = this._getError(user);
         if (!user || !user.uid || !user.sessionToken || error) {
+          log.error(error ? error : ERROR_INTERNAL_INVALID_USER);
           return Promise.reject({
             error: error ? error : ERROR_INTERNAL_INVALID_USER,
             details: {
@@ -126,6 +134,8 @@ this.FxAccountsManager = {
         return this._fxAccounts.setSignedInUser(user, false).then(
           () => {
             this._activeSession = user;
+            log.debug("User signed in: " + JSON.stringify(this._user) +
+                      " - Account created " + (aMethod == "signUp"));
             return Promise.resolve({
               accountCreated: aMethod === "signUp",
               user: this._user
@@ -169,6 +179,7 @@ this.FxAccountsManager = {
                 details: result
               });
             }
+            log.debug("Signed out");
             return Promise.resolve();
           },
           reason => {
@@ -218,6 +229,7 @@ this.FxAccountsManager = {
         return this.verificationStatus(this._activeSession);
       }
 
+      log.debug("Account " + JSON.stringify(this._user));
       return Promise.resolve(this._user);
     }
 
@@ -225,6 +237,7 @@ this.FxAccountsManager = {
     return this._fxAccounts.getSignedInUser().then(
       user => {
         if (!user || !user.email) {
+          log.debug("No signed in account");
           return Promise.resolve(null);
         }
 
@@ -233,16 +246,20 @@ this.FxAccountsManager = {
         // we check this information with the server, update the stored
         // data if needed and finally return the account details.
         if (!user.verified && !Services.io.offline) {
+          log.debug("Unverified account");
           return this.verificationStatus(user);
         }
 
+        log.debug("Account " + JSON.stringify(this._user));
         return Promise.resolve(this._user);
       }
     );
   },
 
   queryAccount: function(aAccountId) {
+    log.debug("queryAccount " + aAccountId);
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
@@ -251,6 +268,7 @@ this.FxAccountsManager = {
     let deferred = Promise.defer();
 
     if (!aAccountId) {
+      log.error(ERROR_INVALID_ACCOUNTID);
       return Promise.reject({
         error: ERROR_INVALID_ACCOUNTID
       });
@@ -259,6 +277,7 @@ this.FxAccountsManager = {
     let client = this._createFxAccountsClient();
     return client.accountExists(aAccountId).then(
       result => {
+        log.debug("Account " + result ? "" : "does not" + " exists");
         let error = this._getError(result);
         if (error) {
           return Promise.reject({
@@ -276,7 +295,9 @@ this.FxAccountsManager = {
   },
 
   verificationStatus: function() {
+    log.debug("verificationStatus");
     if (!this._activeSession || !this._activeSession.sessionToken) {
+      log.error(ERROR_NO_TOKEN_SESSION);
       return Promise.reject({
         error: ERROR_NO_TOKEN_SESSION
       });
@@ -285,10 +306,12 @@ this.FxAccountsManager = {
     // There is no way to unverify an already verified account, so we just
     // return the account details of a verified account
     if (this._activeSession.verified) {
+      log.debug("Account already verified");
       return Promise.resolve(this._user);
     }
 
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
@@ -312,10 +335,12 @@ this.FxAccountsManager = {
           this._activeSession.verified = data.verified;
           return this._fxAccounts.setSignedInUser(this._activeSession).then(
             () => {
+              log.debug(JSON.stringify(this._user));
               return Promise.resolve(this._user);
             }
           );
         }
+        log.debug(JSON.stringify(this._user));
         return Promise.resolve(this._user);
       },
       reason => { return this._serverError(reason); }
@@ -323,13 +348,16 @@ this.FxAccountsManager = {
   },
 
   getAssertion: function(aAudience) {
+    log.debug("getAssertion " + aAudience);
     if (!aAudience) {
+      log.error(ERROR_INVALID_AUDIENCE);
       return Promise.reject({
         error: ERROR_INVALID_AUDIENCE
       });
     }
 
     if (Services.io.offline) {
+      log.error(ERROR_OFFLINE);
       return Promise.reject({
         error: ERROR_OFFLINE
       });
@@ -343,6 +371,7 @@ this.FxAccountsManager = {
             return this._getAssertion(aAudience);
           }
 
+          log.error(ERROR_UNVERIFIED_ACCOUNT);
           return Promise.reject({
             error: ERROR_UNVERIFIED_ACCOUNT,
             details: {
@@ -351,6 +380,7 @@ this.FxAccountsManager = {
           });
         }
 
+        log.debug("No signed in user");
         // If there is no currently signed in user, we trigger the signIn UI
         // flow.
         let ui = Cc["@mozilla.org/fxaccounts/fxaccounts-ui-glue;1"]
@@ -362,6 +392,8 @@ this.FxAccountsManager = {
             if (result && result.verified) {
               return this._getAssertion(aAudience);
             }
+
+            log.error(ERROR_UNVERIFIED_ACCOUNT);
             return Promise.reject({
               error: ERROR_UNVERIFIED_ACCOUNT,
               details: {
@@ -370,6 +402,7 @@ this.FxAccountsManager = {
             });
           },
           error => {
+            log.error(ERROR_UI_ERROR + " " + error);
             return Promise.reject({
               error: ERROR_UI_ERROR,
               details: error
diff --git a/services/fxaccounts/moz.build b/services/fxaccounts/moz.build
index 060361da2e73..a2e055171d34 100644
--- a/services/fxaccounts/moz.build
+++ b/services/fxaccounts/moz.build
@@ -11,7 +11,7 @@ TEST_DIRS += ['tests']
 EXTRA_JS_MODULES += [
   'FxAccounts.jsm',
   'FxAccountsClient.jsm',
-  'FxAccountsConsts.js'
+  'FxAccountsCommon.js'
 ]
 
 # For now, we will only be using the FxA manager in B2G.
diff --git a/services/fxaccounts/tests/xpcshell/test_manager.js b/services/fxaccounts/tests/xpcshell/test_manager.js
index 64ca648a6377..0261f6826e99 100644
--- a/services/fxaccounts/tests/xpcshell/test_manager.js
+++ b/services/fxaccounts/tests/xpcshell/test_manager.js
@@ -6,7 +6,7 @@
 const Cm = Components.manager;
 
 Cu.import("resource://gre/modules/FxAccounts.jsm");
-Cu.import("resource://gre/modules/FxAccountsConsts.js");
+Cu.import("resource://gre/modules/FxAccountsCommon.js");
 Cu.import("resource://gre/modules/FxAccountsManager.jsm");
 Cu.import("resource://gre/modules/Promise.jsm");
 

From 95b0903c9b6eb850bb3ae2d38a6848db4ac0f839 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 03:50:24 -0800
Subject: [PATCH 308/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

========

https://hg.mozilla.org/integration/gaia-central/rev/47f28091eeed
Author: Germán Toro del Valle <gtorodelvalle@gmail.com>
Desc: Merge pull request #14581 from gtorodelvalle/contacts-bug-938261-contact-update-activity

Bug 938219 - [Contacts] Unable to select a contact via the contact update activity (r=jmcanterafonseca)

========

https://hg.mozilla.org/integration/gaia-central/rev/8c3e597f021a
Author: Germán Toro del Valle <gtorodelvalle@gmail.com>
Desc: Bug 938219 - [Contacts] Unable to select a contact via the contact update activity
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 4af865b42e96..067688b5db04 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "28714578feeae99aa02527711279d07671120ebf", 
+    "revision": "47f28091eeed8c209e062f7103884a07dcbfe356", 
     "repo_path": "/integration/gaia-central"
 }

From ae87d1f0e4c27a0b522fc891819d497f5bcb166d Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 04:40:25 -0800
Subject: [PATCH 309/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/ae3c8b28cffd
Author: Jose M. Cantera <jmcanterafonseca@gmail.com>
Desc: Merge pull request #14645 from jmcanterafonseca/fix_flush_final2

Bug 949422 - If a Facebook Friend is removed (from the import list), the...

========

https://hg.mozilla.org/integration/gaia-central/rev/8c8a30087bda
Author: Jose M. Cantera <jmcanterafonseca@gmail.com>
Desc: Bug 949422 - If a Facebook Friend is removed (from the import list), then it cannot be imported anymore
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 067688b5db04..ca138f665e8b 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "47f28091eeed8c209e062f7103884a07dcbfe356", 
+    "revision": "ae3c8b28cffd4c5bfc7d467b5c41cafaa36f90f7", 
     "repo_path": "/integration/gaia-central"
 }

From a95cb55213e1710ed62ad82d1e7b2ef744fb50ba Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 05:30:24 -0800
Subject: [PATCH 310/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/70b8a8a631b1
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14463 from julienw/946678-use-href-for-activity

Bug 946678 - [Messaging] Creating a new message from contacts does not o...

========

https://hg.mozilla.org/integration/gaia-central/rev/64158f1e1f9c
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 946678 - [Messaging] Creating a new message from contacts does not open the messaging composer when Messaging app is in background r=borja

Adds a hash for the "new" activity. This will have the side-effect of not
registering the notification and sms-received system message handlers which is a
good thing.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ca138f665e8b..6e5456b34463 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "ae3c8b28cffd4c5bfc7d467b5c41cafaa36f90f7", 
+    "revision": "70b8a8a631b10fa935522047d75e0eb0f5e12d0c", 
     "repo_path": "/integration/gaia-central"
 }

From 8116f4edccb4b5325b43cc6742a9a70f7c348f43 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 05:45:29 -0800
Subject: [PATCH 311/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/2f4600ab2988
Author: Florin Strugariu <bebef_1987@yahoo.com>
Desc: Merge pull request #14627 from askeing/949552

Bug 949552 - Fix test_gallery_delete_image

========

https://hg.mozilla.org/integration/gaia-central/rev/8bad640ac1b8
Author: askeing <askeing@gmail.com>
Desc: Bug 949552 - Fix test_gallery_delete_image
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 6e5456b34463..13be138e1cf7 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "70b8a8a631b10fa935522047d75e0eb0f5e12d0c", 
+    "revision": "2f4600ab2988317700fbe056ee4d2704f424f147", 
     "repo_path": "/integration/gaia-central"
 }

From d5d139697643125338f6d3f49648ad2d7dc92360 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 06:45:24 -0800
Subject: [PATCH 312/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/28944ec8ca72
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Bug 949897 - Disable test_cards_view_kill_apps_with_two_apps.py r=me

========

https://hg.mozilla.org/integration/gaia-central/rev/2b84917bc9f1
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Merge pull request #14604 from jaoo/928294

Bug 928294 - [DSDS][Gaia] Settings app should support call settings of multiple sim cards. r=arthurcc

========

https://hg.mozilla.org/integration/gaia-central/rev/2e916b992987
Author: Jose Antonio Olivera Ortega <josea.olivera@gmail.com>
Desc: Bug 928294 - [DSDS][Gaia] Settings app should support call settings of multiple sim cards

========

https://hg.mozilla.org/integration/gaia-central/rev/dace64b0307f
Author: Bebe <bebe@mozilla.ro>
Desc: Bug 949405 - Bump gaiatest version to 0.21.2. r=dhunt
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 13be138e1cf7..39ca10424b1f 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "2f4600ab2988317700fbe056ee4d2704f424f147", 
+    "revision": "28944ec8ca72535f50b097e8277ef111e3963bd7", 
     "repo_path": "/integration/gaia-central"
 }

From 238b35ae84805b82595721368e502e7aeaa4d860 Mon Sep 17 00:00:00 2001
From: Vicamo Yang <vyang@mozilla.com>
Date: Fri, 13 Dec 2013 23:30:35 +0800
Subject: [PATCH 313/459] Bug 943263: B2G MMS - add test cases for
 MobileMessageDB::forEachMatchedMmsDeliveryInfo. r=gene

---
 .../tests/marionette/manifest.ini             |   1 +
 ...test_mmdb_foreachmatchedmmsdeliveryinfo.js | 114 ++++++++++++++++++
 .../tests/marionette/test_mmdb_new.js         |   2 +
 3 files changed, 117 insertions(+)
 create mode 100644 dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js

diff --git a/dom/mobilemessage/tests/marionette/manifest.ini b/dom/mobilemessage/tests/marionette/manifest.ini
index bb7316194ce4..7746dac1447f 100644
--- a/dom/mobilemessage/tests/marionette/manifest.ini
+++ b/dom/mobilemessage/tests/marionette/manifest.ini
@@ -41,4 +41,5 @@ qemu = true
 [test_thread_subject.js]
 [test_mmdb_new.js]
 [test_mmdb_setmessagedeliverybyid_sms.js]
+[test_mmdb_foreachmatchedmmsdeliveryinfo.js]
 [test_replace_short_message_type.js]
diff --git a/dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js b/dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js
new file mode 100644
index 000000000000..57b6b19310d0
--- /dev/null
+++ b/dom/mobilemessage/tests/marionette/test_mmdb_foreachmatchedmmsdeliveryinfo.js
@@ -0,0 +1,114 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+// TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+// empty object in return.
+let mmdb;
+
+const PHONE_0 = "+15555215500";
+const PHONE_1 = "+15555215501";
+const PHONE_2 = "+15555215502";
+const PHONE_2_NET = "5555215502";
+const PHONE_3 = "+15555215503";
+const PHONE_3_NET = "5555215503";
+const EMAIL_1 = "foo@bar.com";
+let deliveryInfo = [
+  { receiver: PHONE_1 },
+  { receiver: PHONE_2 },
+  { receiver: PHONE_1 },
+  { receiver: PHONE_2_NET },
+  { receiver: PHONE_3_NET },
+  { receiver: EMAIL_1 },
+  { receiver: PHONE_3 },
+];
+
+function clearTraversed(aDeliveryInfo) {
+  for (let element of aDeliveryInfo) {
+    delete element.traversed;
+  }
+}
+
+function doTest(aMmdb, aNeedle, aVerifyFunc, aCount) {
+  log("  '" + aNeedle + "': " + aCount);
+
+  clearTraversed(deliveryInfo);
+
+  let count = 0;
+  aMmdb.forEachMatchedMmsDeliveryInfo(deliveryInfo, aNeedle, function(aElement) {
+    ok(true, "checking " + aElement.receiver);
+    ok(!aElement.hasOwnProperty("traversed"), "element.traversed");
+    aVerifyFunc(aElement);
+
+    aElement.traversed = true;
+    ++count;
+  });
+  is(count, aCount, "matched count");
+}
+
+function testNotFound(aMmdb) {
+  log("Testing unavailable");
+
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
+  aMmdb = mmdb;
+
+  doTest(aMmdb, PHONE_0, function(aElement) {
+    ok(false, "Should never have a match");
+  }, 0);
+
+  return aMmdb;
+}
+
+function testDirectMatch(aMmdb) {
+  log("Testing direct matching");
+
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
+  aMmdb = mmdb;
+
+  for (let needle of [PHONE_1, EMAIL_1]) {
+    let count = deliveryInfo.reduce(function(aCount, aElement) {
+      return aElement.receiver == needle ? aCount + 1 : aCount;
+    }, 0);
+    doTest(aMmdb, needle, function(aElement) {
+      is(aElement.receiver, needle, "element.receiver");
+    }, count);
+  }
+
+  return aMmdb;
+}
+
+function testPhoneMatch(aMmdb) {
+  log("Testing phone matching");
+
+  let verifyFunc = function(aValid, aElement) {
+    ok(aValid.indexOf(aElement.receiver) >= 0, "element.receiver");
+  };
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
+  aMmdb = mmdb;
+
+  let matchingGroups = [
+    [PHONE_2, PHONE_2_NET],
+    [PHONE_3, PHONE_3_NET],
+  ];
+  for (let group of matchingGroups) {
+    for (let item of group) {
+      doTest(aMmdb, item, verifyFunc.bind(null, group), group.length);
+    }
+  }
+
+  return aMmdb;
+}
+
+startTestBase(function testCaseMain() {
+  mmdb = newMobileMessageDB();
+  return initMobileMessageDB(mmdb, "test_mmdb_foreachmatchedmmsdeliveryinfo", 0)
+    .then(testNotFound)
+    .then(testDirectMatch)
+    .then(testPhoneMatch)
+    .then(closeMobileMessageDB.bind(null, mmdb));
+});
diff --git a/dom/mobilemessage/tests/marionette/test_mmdb_new.js b/dom/mobilemessage/tests/marionette/test_mmdb_new.js
index da34b13ca9d4..be6fa2fcb260 100644
--- a/dom/mobilemessage/tests/marionette/test_mmdb_new.js
+++ b/dom/mobilemessage/tests/marionette/test_mmdb_new.js
@@ -7,6 +7,8 @@ MARIONETTE_HEAD_JS = 'head.js';
 startTestBase(function testCaseMain() {
   log("Test init MobileMessageDB");
 
+  // TODO: bug 943233 - passing jsm exported objects to |Promise.resolve| gets
+  // empty object in return.
   let mmdb = newMobileMessageDB();
   let dbName = "test_mmdb_new";
   let dbVersion = 0;

From 6c20190937d43fb086a49f6dfbc01311e755276f Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 07:35:26 -0800
Subject: [PATCH 314/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/9a92b00c78ba
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14651 from julienw/938207-try-2

Bug 938207 - [Dialer] Intermittent Travis Unit Test Failure: dialer/call...

========

https://hg.mozilla.org/integration/gaia-central/rev/1def6ed98d53
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 938207 - [Dialer] Intermittent Travis Unit Test Failure: dialer/call_log_db Two calls, same group, different hour Add a call: Error: timeout of 2000ms exceeded r=etienne

Really use a timeout of 20s now!
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 39ca10424b1f..cfecf392ca9d 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "28944ec8ca72535f50b097e8277ef111e3963bd7", 
+    "revision": "9a92b00c78baf10dfd85101ac26790c988918b68", 
     "repo_path": "/integration/gaia-central"
 }

From 6556a5fbd3c0ccf62f0c65ac885f5afd314586f9 Mon Sep 17 00:00:00 2001
From: Reuben Morais <reuben.morais@gmail.com>
Date: Fri, 13 Dec 2013 14:28:46 -0200
Subject: [PATCH 315/459] Bug 938889 - Remote IdleService and disable
 idle-daily notifications in content processes. r=roc

---
 dom/ipc/ContentChild.cpp           | 27 ++++++++++++++++++
 dom/ipc/ContentChild.h             |  6 ++++
 dom/ipc/ContentParent.cpp          | 45 ++++++++++++++++++++++++++++++
 dom/ipc/ContentParent.h            | 23 ++++++++++++++-
 dom/ipc/PContent.ipdl              |  7 +++++
 widget/xpwidgets/nsIdleService.cpp | 35 +++++++++++++++++------
 6 files changed, 133 insertions(+), 10 deletions(-)

diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 222afea3570f..5661dbdf0068 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -1502,6 +1502,33 @@ ContentChild::RecvNotifyPhoneStateChange(const nsString& aState)
   return true;
 }
 
+void
+ContentChild::AddIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS)
+{
+  MOZ_ASSERT(aObserver, "null idle observer");
+  // Make sure aObserver isn't released while we wait for the parent
+  aObserver->AddRef();
+  SendAddIdleObserver(reinterpret_cast<uint64_t>(aObserver), aIdleTimeInS);
+}
+
+void
+ContentChild::RemoveIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS)
+{
+  MOZ_ASSERT(aObserver, "null idle observer");
+  SendRemoveIdleObserver(reinterpret_cast<uint64_t>(aObserver), aIdleTimeInS);
+  aObserver->Release();
+}
+
+bool
+ContentChild::RecvNotifyIdleObserver(const uint64_t& aObserver,
+                                     const nsCString& aTopic,
+                                     const nsString& aTimeStr)
+{
+  nsIObserver* observer = reinterpret_cast<nsIObserver*>(aObserver);
+  observer->Observe(nullptr, aTopic.get(), aTimeStr.get());
+  return true;
+}
+
 bool
 ContentChild::RecvLoadAndRegisterSheet(const URIParams& aURI, const uint32_t& aType)
 {
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index 51de463523a6..a47156e2faa1 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -240,6 +240,12 @@ public:
     virtual bool RecvUnregisterSheet(const URIParams& aURI, const uint32_t& aType);
 
     virtual bool RecvNotifyPhoneStateChange(const nsString& state);
+
+    void AddIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS);
+    void RemoveIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS);
+    virtual bool RecvNotifyIdleObserver(const uint64_t& aObserver,
+                                        const nsCString& aTopic,
+                                        const nsString& aData);
 #ifdef ANDROID
     gfxIntSize GetScreenSize() { return mScreenSize; }
 #endif
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 1bda5817ddff..b69542c5a824 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -68,6 +68,7 @@
 #include "nsIDOMWindow.h"
 #include "nsIExternalProtocolService.h"
 #include "nsIFilePicker.h"
+#include "nsIIdleService.h"
 #include "nsIMemoryReporter.h"
 #include "nsIMozBrowserFrame.h"
 #include "nsIMutable.h"
@@ -1082,6 +1083,8 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
         obs->NotifyObservers((nsIPropertyBag2*) props, "ipc:content-shutdown", nullptr);
     }
 
+    mIdleListeners.Clear();
+
     // If the child process was terminated due to a SIGKIL, ShutDownProcess
     // might not have been called yet.  We must call it to ensure that our
     // channel is closed, etc.
@@ -3155,5 +3158,47 @@ ContentParent::RecvRecordingDeviceEvents(const nsString& aRecordingStatus,
     return true;
 }
 
+bool
+ContentParent::RecvAddIdleObserver(const uint64_t& aObserver, const uint32_t& aIdleTimeInS)
+{
+  nsresult rv;
+  nsCOMPtr<nsIIdleService> idleService =
+    do_GetService("@mozilla.org/widget/idleservice;1", &rv);
+  NS_ENSURE_SUCCESS(rv, false);
+
+  nsCOMPtr<ParentIdleListener> listener = new ParentIdleListener(this, aObserver);
+  mIdleListeners.Put(aObserver, listener);
+  idleService->AddIdleObserver(listener, aIdleTimeInS);
+  return true;
+}
+
+bool
+ContentParent::RecvRemoveIdleObserver(const uint64_t& aObserver, const uint32_t& aIdleTimeInS)
+{
+  nsresult rv;
+  nsCOMPtr<nsIIdleService> idleService =
+    do_GetService("@mozilla.org/widget/idleservice;1", &rv);
+  NS_ENSURE_SUCCESS(rv, false);
+
+  nsCOMPtr<ParentIdleListener> listener;
+  bool found = mIdleListeners.Get(aObserver, &listener);
+  if (found) {
+    mIdleListeners.Remove(aObserver);
+    idleService->RemoveIdleObserver(listener, aIdleTimeInS);
+  }
+
+  return true;
+}
+
 } // namespace dom
 } // namespace mozilla
+
+NS_IMPL_ISUPPORTS1(ParentIdleListener, nsIObserver)
+
+NS_IMETHODIMP
+ParentIdleListener::Observe(nsISupports*, const char* aTopic, const PRUnichar* aData) {
+  mozilla::unused << mParent->SendNotifyIdleObserver(mObserver,
+                                                     nsDependentCString(aTopic),
+                                                     nsDependentString(aData));
+  return NS_OK;
+}
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index 5e64ed2b5561..2d22a9ba2c84 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -15,7 +15,9 @@
 #include "mozilla/LinkedList.h"
 #include "mozilla/StaticPtr.h"
 
+#include "nsDataHashtable.h"
 #include "nsFrameMessageManager.h"
+#include "nsHashKeys.h"
 #include "nsIObserver.h"
 #include "nsIThreadInternal.h"
 #include "nsIDOMGeoPositionCallback.h"
@@ -27,7 +29,7 @@ class mozIApplication;
 class nsConsoleService;
 class nsIDOMBlob;
 class nsIMemoryReporter;
-template<class KeyClass,class DataType> class nsDataHashtable;
+class ParentIdleListener;
 
 namespace mozilla {
 
@@ -510,6 +512,9 @@ private:
 
     virtual void ProcessingError(Result what) MOZ_OVERRIDE;
 
+    virtual bool RecvAddIdleObserver(const uint64_t& observerId, const uint32_t& aIdleTimeInS);
+    virtual bool RecvRemoveIdleObserver(const uint64_t& observerId, const uint32_t& aIdleTimeInS);
+
     // If you add strong pointers to cycle collected objects here, be sure to
     // release these objects in ShutDownProcess.  See the comment there for more
     // details.
@@ -559,9 +564,25 @@ private:
 
     nsRefPtr<nsConsoleService>  mConsoleService;
     nsConsoleService* GetConsoleService();
+
+    nsDataHashtable<nsUint64HashKey, nsCOMPtr<ParentIdleListener> > mIdleListeners;
 };
 
 } // namespace dom
 } // namespace mozilla
 
+class ParentIdleListener : public nsIObserver {
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
+  ParentIdleListener(mozilla::dom::ContentParent* aParent, uint64_t aObserver)
+    : mParent(aParent), mObserver(aObserver)
+  {}
+  virtual ~ParentIdleListener() {}
+private:
+  nsRefPtr<mozilla::dom::ContentParent> mParent;
+  uint64_t mObserver;
+};
+
 #endif
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index f18aa1d3e30d..424065129141 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -325,6 +325,11 @@ child:
     async UnregisterSheet(URIParams uri, uint32_t type);
 
     NotifyPhoneStateChange(nsString newState);
+
+    /**
+     * Notify idle observers in the child
+     */
+    NotifyIdleObserver(uint64_t observerId, nsCString topic, nsString str);
 parent:
     /**
      * Tell the content process some attributes of itself.  This is
@@ -502,6 +507,8 @@ parent:
                                 bool isAudio,
                                 bool isVideo);
 
+    AddIdleObserver(uint64_t observerId, uint32_t idleTimeInS);
+    RemoveIdleObserver(uint64_t observerId, uint32_t idleTimeInS);
 both:
      AsyncMessage(nsString aMessage, ClonedMessageData aData,
                   CpowEntry[] aCpows, Principal aPrincipal);
diff --git a/widget/xpwidgets/nsIdleService.cpp b/widget/xpwidgets/nsIdleService.cpp
index a3af403c7ca1..d1184baefc39 100644
--- a/widget/xpwidgets/nsIdleService.cpp
+++ b/widget/xpwidgets/nsIdleService.cpp
@@ -11,9 +11,11 @@
 #include "nsIServiceManager.h"
 #include "nsDebug.h"
 #include "nsCOMArray.h"
+#include "nsXULAppAPI.h"
 #include "prinrval.h"
 #include "prlog.h"
 #include "prtime.h"
+#include "mozilla/dom/ContentChild.h"
 #include "mozilla/Services.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Telemetry.h"
@@ -397,8 +399,10 @@ nsIdleService::nsIdleService() : mCurrentlySetToTimeoutAt(TimeStamp()),
 #endif
   MOZ_ASSERT(!gIdleService);
   gIdleService = this;
-  mDailyIdle = new nsIdleServiceDaily(this);
-  mDailyIdle->Init();
+  if (XRE_GetProcessType() == GeckoProcessType_Default) {
+    mDailyIdle = new nsIdleServiceDaily(this);
+    mDailyIdle->Init();
+  }
 }
 
 nsIdleService::~nsIdleService()
@@ -417,20 +421,26 @@ NS_IMPL_ISUPPORTS2(nsIdleService, nsIIdleService, nsIIdleServiceInternal)
 NS_IMETHODIMP
 nsIdleService::AddIdleObserver(nsIObserver* aObserver, uint32_t aIdleTimeInS)
 {
+  NS_ENSURE_ARG_POINTER(aObserver);
+  // We don't accept idle time at 0, and we can't handle idle time that are too
+  // high either - no more than ~136 years.
+  NS_ENSURE_ARG_RANGE(aIdleTimeInS, 1, (UINT32_MAX / 10) - 1);
+
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    dom::ContentChild* cpc = dom::ContentChild::GetSingleton();
+    cpc->AddIdleObserver(aObserver, aIdleTimeInS);
+    return NS_OK;
+  }
+
   PR_LOG(sLog, PR_LOG_DEBUG,
-         ("idleService: Register idle observer %x for %d seconds",
-          aObserver, aIdleTimeInS));
+       ("idleService: Register idle observer %x for %d seconds",
+        aObserver, aIdleTimeInS));
 #ifdef MOZ_WIDGET_ANDROID
   __android_log_print(ANDROID_LOG_INFO, "IdleService",
                       "Register idle observer %x for %d seconds",
                       aObserver, aIdleTimeInS);
 #endif
 
-  NS_ENSURE_ARG_POINTER(aObserver);
-  // We don't accept idle time at 0, and we can't handle idle time that are too
-  // high either - no more than ~136 years.
-  NS_ENSURE_ARG_RANGE(aIdleTimeInS, 1, (UINT32_MAX / 10) - 1);
-
   // Put the time + observer in a struct we can keep:
   IdleListener listener(aObserver, aIdleTimeInS);
 
@@ -474,6 +484,13 @@ nsIdleService::RemoveIdleObserver(nsIObserver* aObserver, uint32_t aTimeInS)
 
   NS_ENSURE_ARG_POINTER(aObserver);
   NS_ENSURE_ARG(aTimeInS);
+
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    dom::ContentChild* cpc = dom::ContentChild::GetSingleton();
+    cpc->RemoveIdleObserver(aObserver, aTimeInS);
+    return NS_OK;
+  }
+
   IdleListener listener(aObserver, aTimeInS);
 
   // Find the entry and remove it, if it was the last entry, we just let the

From 0d0234372027710d4783bbf112fe49caafa35a81 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 08:40:23 -0800
Subject: [PATCH 316/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/aed25a1b6915
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Merge pull request #14419 from fcampo/jshint-errors

[Bug 946773] JShint errors (r=arcturus)

========

https://hg.mozilla.org/integration/gaia-central/rev/7042c6be0826
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Fix some JShint errors
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index cfecf392ca9d..1929ed741554 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "9a92b00c78baf10dfd85101ac26790c988918b68", 
+    "revision": "aed25a1b6915f94d81f766c51d71df557019ae3e", 
     "repo_path": "/integration/gaia-central"
 }

From 9abce82c28b49b618378f5c8b98b587223e1ccad Mon Sep 17 00:00:00 2001
From: Bevis Tseng <btseng@mozilla.com>
Date: Fri, 6 Dec 2013 17:35:13 +0800
Subject: [PATCH 317/459] Bug 768441 - Part 1: Support Stored Message Waiting
 Indicators. r=vyang

---
 dom/system/gonk/RadioInterfaceLayer.js |  9 ++-
 dom/system/gonk/ril_consts.js          |  2 +
 dom/system/gonk/ril_worker.js          | 99 ++++++++++++++++++++++++++
 3 files changed, 105 insertions(+), 5 deletions(-)

diff --git a/dom/system/gonk/RadioInterfaceLayer.js b/dom/system/gonk/RadioInterfaceLayer.js
index bc8c57a45dc1..94c36dbc29e4 100644
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -1258,6 +1258,10 @@ RadioInterface.prototype = {
       case "iccmbdn":
         this.handleIccMbdn(message);
         break;
+      case "iccmwis":
+        gMessageManager.sendVoicemailMessage("RIL:VoicemailNotification",
+                                             this.clientId, message.mwi);
+        break;
       case "USSDReceived":
         if (DEBUG) this.debug("USSDReceived " + JSON.stringify(message));
         this.handleUSSDReceived(message);
@@ -2104,11 +2108,6 @@ RadioInterface.prototype = {
       return true;
     }
 
-    // TODO: Bug #768441
-    // For now we don't store indicators persistently. When the mwi.discard
-    // flag is false, we'll need to persist the indicator to EFmwis.
-    // See TS 23.040 9.2.3.24.2
-
     let mwi = message.mwi;
     if (mwi) {
       mwi.returnNumber = message.sender;
diff --git a/dom/system/gonk/ril_consts.js b/dom/system/gonk/ril_consts.js
index cf5efc67ec23..c4a68eb2faaa 100644
--- a/dom/system/gonk/ril_consts.js
+++ b/dom/system/gonk/ril_consts.js
@@ -1206,6 +1206,7 @@ this.GECKO_ICC_SERVICES = {
     PNN: 51,
     OPL: 52,
     MDN: 53,
+    MWIS: 54,
     SPDI: 56
   },
   usim: {
@@ -1221,6 +1222,7 @@ this.GECKO_ICC_SERVICES = {
     PNN: 45,
     OPL: 46,
     MDN: 47,
+    MWIS: 48,
     SPDI: 51
   },
   ruim: {
diff --git a/dom/system/gonk/ril_worker.js b/dom/system/gonk/ril_worker.js
index a2aec4132c02..ff6b04343b8c 100644
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -4206,6 +4206,11 @@ let RIL = {
 
       this.sendChromeMessage(message);
 
+      // Update MWI Status into ICC if present.
+      if (message.mwi && ICCUtilsHelper.isICCServiceAvailable("MWIS")) {
+        SimRecordHelper.updateMWIS(message.mwi);
+      }
+
       // We will acknowledge receipt of the SMS after we try to store it
       // in the database.
       return MOZ_FCS_WAIT_FOR_EXPLICIT_ACK;
@@ -10937,6 +10942,7 @@ let ICCFileHelper = {
         return EF_PATH_MF_SIM + EF_PATH_DF_TELECOM;
       case ICC_EF_AD:
       case ICC_EF_MBDN:
+      case ICC_EF_MWIS:
       case ICC_EF_PLMNsel:
       case ICC_EF_SPN:
       case ICC_EF_SPDI:
@@ -10961,6 +10967,7 @@ let ICCFileHelper = {
       case ICC_EF_AD:
       case ICC_EF_FDN:
       case ICC_EF_MBDN:
+      case ICC_EF_MWIS:
       case ICC_EF_UST:
       case ICC_EF_MSISDN:
       case ICC_EF_SPN:
@@ -11916,6 +11923,13 @@ let SimRecordHelper = {
         if (DEBUG) debug("MDN: MDN service is not available");
       }
 
+      if (ICCUtilsHelper.isICCServiceAvailable("MWIS")) {
+        if (DEBUG) debug("MWIS: MWIS is available");
+        this.readMWIS();
+      } else {
+        if (DEBUG) debug("MWIS: MWIS is not available");
+      }
+
       if (ICCUtilsHelper.isICCServiceAvailable("SPDI")) {
         if (DEBUG) debug("SPDI: SPDI available.");
         this.readSPDI();
@@ -11985,6 +11999,91 @@ let SimRecordHelper = {
                                    callback: callback.bind(this)});
   },
 
+  /**
+   * Read ICC MWIS. (Message Waiting Indication Status)
+   *
+   * @see TS 31.102, clause 4.2.63 for USIM and TS 51.011, clause 10.3.45 for SIM.
+   */
+  readMWIS: function readMWIS() {
+    function callback(options) {
+      let strLen = Buf.readInt32();
+      // Each octet is encoded into two chars.
+      let octetLen = strLen / 2;
+      let mwis = GsmPDUHelper.readHexOctetArray(octetLen);
+      Buf.readStringDelimiter(strLen);
+      if (!mwis) {
+        return;
+      }
+      RIL.iccInfoPrivate.mwis = mwis; //Keep raw MWIS for updateMWIS()
+
+      let mwi = {};
+      // b8 b7 B6 b5 b4 b3 b2 b1   4.2.63, TS 31.102 version 11.6.0
+      //  |  |  |  |  |  |  |  |__ Voicemail
+      //  |  |  |  |  |  |  |_____ Fax
+      //  |  |  |  |  |  |________ Electronic Mail
+      //  |  |  |  |  |___________ Other
+      //  |  |  |  |______________ Videomail
+      //  |__|__|_________________ RFU
+      mwi.active = ((mwis[0] & 0x01) != 0);
+
+      if (mwi.active) {
+        // In TS 23.040 msgCount is in the range from 0 to 255.
+        // The value 255 shall be taken to mean 255 or greater.
+        //
+        // However, There is no definition about 0 when MWI is active.
+        //
+        // Normally, when mwi is active, the msgCount must be larger than 0.
+        // Refer to other reference phone,
+        // 0 is usually treated as UNKNOWN for storing 2nd level MWI status (DCS).
+        mwi.msgCount = (mwis[1] === 0) ? GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN
+                                       : mwis[1];
+      } else {
+        mwi.msgCount = 0;
+      }
+
+      RIL.sendChromeMessage({ rilMessageType: "iccmwis",
+                              mwi: mwi });
+    }
+
+    ICCIOHelper.loadLinearFixedEF({ fileId: ICC_EF_MWIS,
+                                    recordNumber: 1, // Get 1st Subscriber Profile.
+                                    callback: callback });
+  },
+
+  /**
+   * Update ICC MWIS. (Message Waiting Indication Status)
+   *
+   * @see TS 31.102, clause 4.2.63 for USIM and TS 51.011, clause 10.3.45 for SIM.
+   */
+  updateMWIS: function updateMWIS(mwi) {
+    if (!RIL.iccInfoPrivate.mwis) {
+      return;
+    }
+
+    function dataWriter(recordSize) {
+      let mwis = RIL.iccInfoPrivate.mwis;
+
+      let msgCount =
+          (mwi.msgCount === GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN) ? 0 : mwi.msgCount;
+
+      [mwis[0], mwis[1]] = (mwi.active) ? [(mwis[0] | 0x01), msgCount]
+                                        : [(mwis[0] & 0xFE), 0];
+
+      let strLen = recordSize * 2;
+      Buf.writeInt32(strLen);
+
+      for (let i = 0; i < mwis.length; i++) {
+        GsmPDUHelper.writeHexOctet(mwis[i]);
+      }
+
+      Buf.writeStringDelimiter(strLen);
+    }
+
+    ICCIOHelper.updateLinearFixedEF({ fileId: ICC_EF_MWIS,
+                                      recordNumber: 1, // Update 1st Subscriber Profile.
+                                      dataWriter: dataWriter });
+  },
+
   /**
    * Read the SPDI (Service Provider Display Information) from the (U)SIM.
    *

From f09656d765e869905b4ac7deb87d42d13f0bf25d Mon Sep 17 00:00:00 2001
From: Kevin Simons <kevin@comoyo.com>
Date: Thu, 12 Dec 2013 17:37:00 -0500
Subject: [PATCH 318/459] Bug 944646 - Check the DrawTarget type before
 downcasting PathBuilders. r=mattwoodrow

Previously the ScaledFontBase::CopyGlyphsToBuilder methods in the
various ScaledFont subclasses static_cast-ed the passed in PathBuilder
objects without checking which sort of DrawSurface they were created by.
---
 gfx/2d/2D.h                 |  2 +-
 gfx/2d/ScaledFontBase.cpp   | 53 ++++++++++++++++++++-----------------
 gfx/2d/ScaledFontBase.h     |  2 +-
 gfx/2d/ScaledFontDWrite.cpp |  8 ++++--
 gfx/2d/ScaledFontDWrite.h   |  2 +-
 gfx/2d/ScaledFontMac.cpp    |  7 ++++-
 gfx/2d/ScaledFontMac.h      |  2 +-
 gfx/thebes/gfxFont.cpp      |  2 +-
 8 files changed, 46 insertions(+), 32 deletions(-)

diff --git a/gfx/2d/2D.h b/gfx/2d/2D.h
index e6447c579b74..c27bc01ccfea 100644
--- a/gfx/2d/2D.h
+++ b/gfx/2d/2D.h
@@ -523,7 +523,7 @@ public:
    * implementation in some backends, and more efficient implementation in
    * others.
    */
-  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint = nullptr) = 0;
+  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint = nullptr) = 0;
 
   virtual bool GetFontFileData(FontFileDataOutput, void *) { return false; }
 
diff --git a/gfx/2d/ScaledFontBase.cpp b/gfx/2d/ScaledFontBase.cpp
index 5b43e1d55b78..88d4dd85986e 100644
--- a/gfx/2d/ScaledFontBase.cpp
+++ b/gfx/2d/ScaledFontBase.cpp
@@ -113,36 +113,41 @@ ScaledFontBase::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *a
 }
 
 void
-ScaledFontBase::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint)
+ScaledFontBase::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint)
 {
 #ifdef USE_CAIRO
-  PathBuilderCairo* builder = static_cast<PathBuilderCairo*>(aBuilder);
+  if (aBackendType == BACKEND_CAIRO) {
+    MOZ_ASSERT(mScaledFont);
 
-  
-  cairo_t *ctx = cairo_create(DrawTargetCairo::GetDummySurface());
+    PathBuilderCairo* builder = static_cast<PathBuilderCairo*>(aBuilder);
+    cairo_t *ctx = cairo_create(DrawTargetCairo::GetDummySurface());
 
-  if (aTransformHint) {
-    cairo_matrix_t mat;
-    GfxMatrixToCairoMatrix(*aTransformHint, mat);
-    cairo_set_matrix(ctx, &mat);
+    if (aTransformHint) {
+      cairo_matrix_t mat;
+      GfxMatrixToCairoMatrix(*aTransformHint, mat);
+      cairo_set_matrix(ctx, &mat);
+    }
+
+    // Convert our GlyphBuffer into an array of Cairo glyphs.
+    std::vector<cairo_glyph_t> glyphs(aBuffer.mNumGlyphs);
+    for (uint32_t i = 0; i < aBuffer.mNumGlyphs; ++i) {
+      glyphs[i].index = aBuffer.mGlyphs[i].mIndex;
+      glyphs[i].x = aBuffer.mGlyphs[i].mPosition.x;
+      glyphs[i].y = aBuffer.mGlyphs[i].mPosition.y;
+    }
+
+    cairo_set_scaled_font(ctx, mScaledFont);
+    cairo_glyph_path(ctx, &glyphs[0], aBuffer.mNumGlyphs);
+
+    RefPtr<PathCairo> cairoPath = new PathCairo(ctx);
+    cairo_destroy(ctx);
+
+    cairoPath->AppendPathToBuilder(builder);
+    return;
   }
-
-  // Convert our GlyphBuffer into an array of Cairo glyphs.
-  std::vector<cairo_glyph_t> glyphs(aBuffer.mNumGlyphs);
-  for (uint32_t i = 0; i < aBuffer.mNumGlyphs; ++i) {
-    glyphs[i].index = aBuffer.mGlyphs[i].mIndex;
-    glyphs[i].x = aBuffer.mGlyphs[i].mPosition.x;
-    glyphs[i].y = aBuffer.mGlyphs[i].mPosition.y;
-  }
-
-  cairo_set_scaled_font(ctx, mScaledFont);
-  cairo_glyph_path(ctx, &glyphs[0], aBuffer.mNumGlyphs);
-
-  RefPtr<PathCairo> cairoPath = new PathCairo(ctx);
-  cairo_destroy(ctx);
-
-  cairoPath->AppendPathToBuilder(builder);
 #endif
+
+  MOZ_CRASH("The specified backend type is not supported by CopyGlyphsToBuilder");
 }
 
 #ifdef USE_CAIRO_SCALED_FONT
diff --git a/gfx/2d/ScaledFontBase.h b/gfx/2d/ScaledFontBase.h
index 2901ac308ce9..619b26af24e6 100644
--- a/gfx/2d/ScaledFontBase.h
+++ b/gfx/2d/ScaledFontBase.h
@@ -33,7 +33,7 @@ public:
 
   virtual TemporaryRef<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
 
-  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
+  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint);
 
   float GetSize() { return mSize; }
 
diff --git a/gfx/2d/ScaledFontDWrite.cpp b/gfx/2d/ScaledFontDWrite.cpp
index efa6d8230905..6a925fd674cb 100644
--- a/gfx/2d/ScaledFontDWrite.cpp
+++ b/gfx/2d/ScaledFontDWrite.cpp
@@ -324,9 +324,13 @@ ScaledFontDWrite::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget
 }
 
 void
-ScaledFontDWrite::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *)
+ScaledFontDWrite::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint)
 {
-  // XXX - Check path builder type!
+  if (aBackendType != BACKEND_DIRECT2D) {
+    ScaledFontBase::CopyGlyphsToBuilder(aBuffer, aBuilder, aBackendType, aTransformHint);
+    return;
+  }
+
   PathBuilderD2D *pathBuilderD2D =
     static_cast<PathBuilderD2D*>(aBuilder);
 
diff --git a/gfx/2d/ScaledFontDWrite.h b/gfx/2d/ScaledFontDWrite.h
index e099838d03e6..6d0fb5ba683e 100644
--- a/gfx/2d/ScaledFontDWrite.h
+++ b/gfx/2d/ScaledFontDWrite.h
@@ -26,7 +26,7 @@ public:
   virtual FontType GetType() const { return FONT_DWRITE; }
 
   virtual TemporaryRef<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
-  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
+  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint);
 
   void CopyGlyphsToSink(const GlyphBuffer &aBuffer, ID2D1GeometrySink *aSink);
 
diff --git a/gfx/2d/ScaledFontMac.cpp b/gfx/2d/ScaledFontMac.cpp
index a9a23bc8c798..0ae49e425a03 100644
--- a/gfx/2d/ScaledFontMac.cpp
+++ b/gfx/2d/ScaledFontMac.cpp
@@ -102,8 +102,13 @@ ScaledFontMac::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aT
 }
 
 void
-ScaledFontMac::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *)
+ScaledFontMac::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint)
 {
+  if (!(aBackendType == BACKEND_COREGRAPHICS || aBackendType == BACKEND_COREGRAPHICS_ACCELERATED)) {
+    ScaledFontBase::CopyGlyphsToBuilder(aBuffer, aBuilder, aBackendType, aTransformHint);
+    return;
+  }
+
   PathBuilderCG *pathBuilderCG =
     static_cast<PathBuilderCG*>(aBuilder);
   // XXX: check builder type
diff --git a/gfx/2d/ScaledFontMac.h b/gfx/2d/ScaledFontMac.h
index 2137139ce79c..d499fc63448d 100644
--- a/gfx/2d/ScaledFontMac.h
+++ b/gfx/2d/ScaledFontMac.h
@@ -25,7 +25,7 @@ public:
   virtual SkTypeface* GetSkTypeface();
 #endif
   virtual TemporaryRef<Path> GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget);
-  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, const Matrix *aTransformHint);
+  virtual void CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint);
   virtual bool GetFontFileData(FontFileDataOutput aDataCallback, void *aBaton);
 
 private:
diff --git a/gfx/thebes/gfxFont.cpp b/gfx/thebes/gfxFont.cpp
index 3957e9214a77..1af3afc2e4f0 100644
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -2325,7 +2325,7 @@ struct GlyphBufferAzure {
         if (int(aDrawMode) & int(DrawMode::GLYPH_PATH)) {
             aThebesContext->EnsurePathBuilder();
 			Matrix mat = aDT->GetTransform();
-            aFont->CopyGlyphsToBuilder(buf, aThebesContext->mPathBuilder, &mat);
+            aFont->CopyGlyphsToBuilder(buf, aThebesContext->mPathBuilder, aDT->GetType(), &mat);
         }
         if ((int(aDrawMode) & (int(DrawMode::GLYPH_STROKE) | int(DrawMode::GLYPH_STROKE_UNDERNEATH))) ==
                               int(DrawMode::GLYPH_STROKE)) {

From 2192973715738b972d385ffded502350dfe6ac03 Mon Sep 17 00:00:00 2001
From: Kevin Simons <kevin@comoyo.com>
Date: Thu, 12 Dec 2013 17:37:00 -0500
Subject: [PATCH 319/459] Bug 944646 - Implement Skia path in
 ScaledFontBase::CopyGlyphsToBuilder. r=mattwoodrow

Handle PathBuilderSkia with a separate path specifically for
BACKEND_SKIA DrawTarget instances.
---
 gfx/2d/PathSkia.cpp       |  6 +++++
 gfx/2d/PathSkia.h         |  3 +++
 gfx/2d/ScaledFontBase.cpp | 57 ++++++++++++++++++++++++++-------------
 gfx/2d/ScaledFontBase.h   |  2 ++
 4 files changed, 49 insertions(+), 19 deletions(-)

diff --git a/gfx/2d/PathSkia.cpp b/gfx/2d/PathSkia.cpp
index 5b4b6d9cd5f5..a28d96e47268 100644
--- a/gfx/2d/PathSkia.cpp
+++ b/gfx/2d/PathSkia.cpp
@@ -109,6 +109,12 @@ PathBuilderSkia::Finish()
   return path;
 }
 
+void
+PathBuilderSkia::AppendPath(const SkPath &aPath)
+{
+  mPath.addPath(aPath);
+}
+
 TemporaryRef<PathBuilder>
 PathSkia::CopyToBuilder(FillRule aFillRule) const
 {
diff --git a/gfx/2d/PathSkia.h b/gfx/2d/PathSkia.h
index 14b43a6c8c49..72d6195403a8 100644
--- a/gfx/2d/PathSkia.h
+++ b/gfx/2d/PathSkia.h
@@ -33,7 +33,10 @@ public:
   virtual Point CurrentPoint() const;
   virtual TemporaryRef<Path> Finish();
 
+  void AppendPath(const SkPath &aPath);
+
 private:
+
   void SetFillRule(FillRule aFillRule);
 
   SkPath mPath;
diff --git a/gfx/2d/ScaledFontBase.cpp b/gfx/2d/ScaledFontBase.cpp
index 88d4dd85986e..bdcfa10da32f 100644
--- a/gfx/2d/ScaledFontBase.cpp
+++ b/gfx/2d/ScaledFontBase.cpp
@@ -7,8 +7,8 @@
 
 #ifdef USE_SKIA
 #include "PathSkia.h"
+#include "skia/SkEmptyShader.h"
 #include "skia/SkPaint.h"
-#include "skia/SkPath.h"
 #endif
 
 #ifdef USE_CAIRO
@@ -46,29 +46,41 @@ ScaledFontBase::ScaledFontBase(Float aSize)
 #endif
 }
 
+#ifdef USE_SKIA
+SkPath
+ScaledFontBase::GetSkiaPathForGlyphs(const GlyphBuffer &aBuffer)
+{
+  SkTypeface *typeFace = GetSkTypeface();
+  MOZ_ASSERT(typeFace);
+
+  SkPaint paint;
+  paint.setTypeface(typeFace);
+  paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+  paint.setTextSize(SkFloatToScalar(mSize));
+
+  std::vector<uint16_t> indices;
+  std::vector<SkPoint> offsets;
+  indices.resize(aBuffer.mNumGlyphs);
+  offsets.resize(aBuffer.mNumGlyphs);
+
+  for (unsigned int i = 0; i < aBuffer.mNumGlyphs; i++) {
+    indices[i] = aBuffer.mGlyphs[i].mIndex;
+    offsets[i].fX = SkFloatToScalar(aBuffer.mGlyphs[i].mPosition.x);
+    offsets[i].fY = SkFloatToScalar(aBuffer.mGlyphs[i].mPosition.y);
+  }
+
+  SkPath path;
+  paint.getPosTextPath(&indices.front(), aBuffer.mNumGlyphs*2, &offsets.front(), &path);
+  return path;
+}
+#endif
+
 TemporaryRef<Path>
 ScaledFontBase::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *aTarget)
 {
 #ifdef USE_SKIA
   if (aTarget->GetType() == BACKEND_SKIA) {
-    SkPaint paint;
-    paint.setTypeface(GetSkTypeface());
-    paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
-    paint.setTextSize(SkFloatToScalar(mSize));
-
-    std::vector<uint16_t> indices;
-    std::vector<SkPoint> offsets;
-    indices.resize(aBuffer.mNumGlyphs);
-    offsets.resize(aBuffer.mNumGlyphs);
-
-    for (unsigned int i = 0; i < aBuffer.mNumGlyphs; i++) {
-      indices[i] = aBuffer.mGlyphs[i].mIndex;
-      offsets[i].fX = SkFloatToScalar(aBuffer.mGlyphs[i].mPosition.x);
-      offsets[i].fY = SkFloatToScalar(aBuffer.mGlyphs[i].mPosition.y);
-    }
-
-    SkPath path;
-    paint.getPosTextPath(&indices.front(), aBuffer.mNumGlyphs*2, &offsets.front(), &path);
+    SkPath path = GetSkiaPathForGlyphs(aBuffer);
     return new PathSkia(path, FILL_WINDING);
   }
 #endif
@@ -115,6 +127,13 @@ ScaledFontBase::GetPathForGlyphs(const GlyphBuffer &aBuffer, const DrawTarget *a
 void
 ScaledFontBase::CopyGlyphsToBuilder(const GlyphBuffer &aBuffer, PathBuilder *aBuilder, BackendType aBackendType, const Matrix *aTransformHint)
 {
+#ifdef USE_SKIA
+  if (aBackendType == BACKEND_SKIA) {
+    PathBuilderSkia *builder = static_cast<PathBuilderSkia*>(aBuilder);
+    builder->AppendPath(GetSkiaPathForGlyphs(aBuffer));
+    return;
+  }
+#endif
 #ifdef USE_CAIRO
   if (aBackendType == BACKEND_CAIRO) {
     MOZ_ASSERT(mScaledFont);
diff --git a/gfx/2d/ScaledFontBase.h b/gfx/2d/ScaledFontBase.h
index 619b26af24e6..6c72a7ba5347 100644
--- a/gfx/2d/ScaledFontBase.h
+++ b/gfx/2d/ScaledFontBase.h
@@ -14,6 +14,7 @@
 #endif
 
 #ifdef USE_SKIA
+#include "skia/SkPath.h"
 #include "skia/SkTypeface.h"
 #endif
 #ifdef USE_CAIRO_SCALED_FONT
@@ -53,6 +54,7 @@ protected:
   friend class DrawTargetSkia;
 #ifdef USE_SKIA
   SkTypeface* mTypeface;
+  SkPath GetSkiaPathForGlyphs(const GlyphBuffer &aBuffer);
 #endif
 #ifdef USE_CAIRO_SCALED_FONT
   cairo_scaled_font_t* mScaledFont;

From 9dfbbd7c472b7a54596c0bb62481d87a1f8eb8aa Mon Sep 17 00:00:00 2001
From: Catalin Iacob <iacobcatalin@gmail.com>
Date: Mon, 9 Dec 2013 07:58:16 +0100
Subject: [PATCH 320/459] Bug 947117 - Don't tell the compiler to use debug C++
 runtimes just because we're using DMD. r=glandium

---
 config/config.mk        | 8 ++++----
 js/src/config/config.mk | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/config/config.mk b/config/config.mk
index 379eb9aa9141..0f051c42a678 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -557,20 +557,20 @@ ifeq ($(OS_ARCH)_$(GNU_CC),WINNT_)
 #//------------------------------------------------------------------------
 ifdef USE_STATIC_LIBS
 RTL_FLAGS=-MT          # Statically linked multithreaded RTL
-ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC)$(MOZ_DMD))
+ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC))
 ifndef MOZ_NO_DEBUG_RTL
 RTL_FLAGS=-MTd         # Statically linked multithreaded MSVC4.0 debug RTL
 endif
-endif # MOZ_DEBUG || NS_TRACE_MALLOC || MOZ_DMD
+endif # MOZ_DEBUG || NS_TRACE_MALLOC
 
 else # !USE_STATIC_LIBS
 
 RTL_FLAGS=-MD          # Dynamically linked, multithreaded RTL
-ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC)$(MOZ_DMD))
+ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC))
 ifndef MOZ_NO_DEBUG_RTL
 RTL_FLAGS=-MDd         # Dynamically linked, multithreaded MSVC4.0 debug RTL
 endif
-endif # MOZ_DEBUG || NS_TRACE_MALLOC || MOZ_DMD
+endif # MOZ_DEBUG || NS_TRACE_MALLOC
 endif # USE_STATIC_LIBS
 endif # WINNT && !GNU_CC
 
diff --git a/js/src/config/config.mk b/js/src/config/config.mk
index 379eb9aa9141..0f051c42a678 100644
--- a/js/src/config/config.mk
+++ b/js/src/config/config.mk
@@ -557,20 +557,20 @@ ifeq ($(OS_ARCH)_$(GNU_CC),WINNT_)
 #//------------------------------------------------------------------------
 ifdef USE_STATIC_LIBS
 RTL_FLAGS=-MT          # Statically linked multithreaded RTL
-ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC)$(MOZ_DMD))
+ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC))
 ifndef MOZ_NO_DEBUG_RTL
 RTL_FLAGS=-MTd         # Statically linked multithreaded MSVC4.0 debug RTL
 endif
-endif # MOZ_DEBUG || NS_TRACE_MALLOC || MOZ_DMD
+endif # MOZ_DEBUG || NS_TRACE_MALLOC
 
 else # !USE_STATIC_LIBS
 
 RTL_FLAGS=-MD          # Dynamically linked, multithreaded RTL
-ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC)$(MOZ_DMD))
+ifneq (,$(MOZ_DEBUG)$(NS_TRACE_MALLOC))
 ifndef MOZ_NO_DEBUG_RTL
 RTL_FLAGS=-MDd         # Dynamically linked, multithreaded MSVC4.0 debug RTL
 endif
-endif # MOZ_DEBUG || NS_TRACE_MALLOC || MOZ_DMD
+endif # MOZ_DEBUG || NS_TRACE_MALLOC
 endif # USE_STATIC_LIBS
 endif # WINNT && !GNU_CC
 

From 04503ec93afc47dbd3b7960f12bce2595cba70b8 Mon Sep 17 00:00:00 2001
From: Yury Delendik <ydelendik@mozilla.com>
Date: Wed, 11 Dec 2013 09:13:30 -0600
Subject: [PATCH 321/459] Bug 905668 - Add browser's Shumway extension to
 Android Nightly. r=mfinkle, r=gps

---
 mobile/android/app/mobile.js                 |  5 ++++
 mobile/android/chrome/content/browser.js     |  8 ++++++
 mobile/android/extensions/Makefile.in        | 27 ++++++++++++++++++++
 mobile/android/extensions/moz.build          |  6 +++++
 mobile/android/installer/package-manifest.in |  4 +++
 mobile/android/moz.build                     |  1 +
 6 files changed, 51 insertions(+)
 create mode 100644 mobile/android/extensions/Makefile.in
 create mode 100644 mobile/android/extensions/moz.build

diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index c2233a0abeb2..deef952c89ce 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -572,6 +572,11 @@ pref("media.preload.auto", 2);    // preload metadata if preload=auto
 pref("image.mem.decodeondraw", true);
 pref("image.mem.min_discard_timeout_ms", 10000);
 
+#ifdef NIGHTLY_BUILD
+// Shumway component (SWF player) is disabled by default. Also see bug 904346.
+pref("shumway.disabled", true);
+#endif
+
 // enable touch events interfaces
 pref("dom.w3c_touch_events.enabled", 1);
 
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 5c3e7e66a362..0cac8da20f10 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -65,6 +65,11 @@ XPCOMUtils.defineLazyServiceGetter(this, "uuidgen",
                                    "@mozilla.org/uuid-generator;1",
                                    "nsIUUIDGenerator");
 
+#ifdef NIGHTLY_BUILD
+XPCOMUtils.defineLazyModuleGetter(this, "ShumwayUtils",
+                                  "resource://shumway/ShumwayUtils.jsm");
+#endif
+
 // Lazily-loaded browser scripts:
 [
   ["SelectHelper", "chrome://browser/content/SelectHelper.js"],
@@ -341,6 +346,9 @@ var BrowserApp = {
 #ifdef ACCESSIBILITY
     AccessFu.attach(window);
 #endif
+#ifdef NIGHTLY_BUILD
+    ShumwayUtils.init();
+#endif
 
     // Init LoginManager
     Cc["@mozilla.org/login-manager;1"].getService(Ci.nsILoginManager);
diff --git a/mobile/android/extensions/Makefile.in b/mobile/android/extensions/Makefile.in
new file mode 100644
index 000000000000..ce29ad6a714a
--- /dev/null
+++ b/mobile/android/extensions/Makefile.in
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(topsrcdir)/config/rules.mk
+
+SHUMWAY_BROWSER_EXTENSION = $(topsrcdir)/browser/extensions/shumway
+
+exclude_files = \
+  test \
+  $(NULL)
+
+ifdef NIGHTLY_BUILD
+$(FINAL_TARGET)/chrome/shumway.manifest: $(GLOBAL_DEPS)
+	$(call py_action,buildlist,$@ "manifest shumway/chrome.manifest")
+
+libs:: $(SHUMWAY_BROWSER_EXTENSION) $(GLOBAL_DEPS)
+	$(PYTHON) $(topsrcdir)/config/nsinstall.py \
+	  $(SHUMWAY_BROWSER_EXTENSION) \
+          $(foreach exclude,$(exclude_files), -X $(SHUMWAY_BROWSER_EXTENSION)/$(exclude)) \
+          $(FINAL_TARGET)/chrome
+
+libs:: $(FINAL_TARGET)/chrome/shumway.manifest
+	$(call py_action,buildlist,$(FINAL_TARGET)/chrome.manifest "manifest chrome/shumway.manifest")
+endif
+
+
diff --git a/mobile/android/extensions/moz.build b/mobile/android/extensions/moz.build
new file mode 100644
index 000000000000..895d11993cfb
--- /dev/null
+++ b/mobile/android/extensions/moz.build
@@ -0,0 +1,6 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
diff --git a/mobile/android/installer/package-manifest.in b/mobile/android/installer/package-manifest.in
index 98383c4a0176..b8f39850b26d 100644
--- a/mobile/android/installer/package-manifest.in
+++ b/mobile/android/installer/package-manifest.in
@@ -442,6 +442,10 @@
 ; [Browser Chrome Files]
 @BINPATH@/chrome/browser@JAREXT@
 @BINPATH@/chrome/browser.manifest
+#ifdef NIGHTLY_BUILD
+@BINPATH@/chrome/shumway.manifest
+@BINPATH@/chrome/shumway/*
+#endif
 @BINPATH@/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/install.rdf
 @BINPATH@/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/icon.png
 @BINPATH@/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/preview.png
diff --git a/mobile/android/moz.build b/mobile/android/moz.build
index 098855798a31..449681176330 100644
--- a/mobile/android/moz.build
+++ b/mobile/android/moz.build
@@ -17,6 +17,7 @@ DIRS += [
     'app',
     'fonts',
     'geckoview_library',
+    'extensions',
 ]
 
 if not CONFIG['LIBXUL_SDK']:

From 740c468537f9c5c3ca0a00726d6c45e2afccac38 Mon Sep 17 00:00:00 2001
From: Jason Smith <jsmith@mozilla.com>
Date: Mon, 9 Dec 2013 22:55:27 -0800
Subject: [PATCH 322/459] Bug 945099 - Enhance basic download API mochitest
 with attribute checks. r=aus

---
 dom/downloads/tests/test_downloads_basic.html | 61 ++++++++++++++++---
 1 file changed, 52 insertions(+), 9 deletions(-)

diff --git a/dom/downloads/tests/test_downloads_basic.html b/dom/downloads/tests/test_downloads_basic.html
index 7efb1ed87460..943da3816307 100644
--- a/dom/downloads/tests/test_downloads_basic.html
+++ b/dom/downloads/tests/test_downloads_basic.html
@@ -24,6 +24,10 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=938023
 SimpleTest.waitForExplicitFinish();
 
 var index = -1;
+var todayDate = new Date();
+var baseServeURL = "http://mochi.test:8888/tests/dom/downloads/tests/";
+var baseDownloadPath = "/mnt/sdcard/downloads/";
+var lastKnownCurrentBytes = 0;
 
 function next() {
   index += 1;
@@ -38,16 +42,58 @@ function next() {
   }
 }
 
+function checkConsistentDownloadAttributes(download) {
+  var href = document.getElementById("download1").getAttribute("href");
+  var expectedServeURL = baseServeURL + href;
+  var expectedDownloadPath = baseDownloadPath + "test.bin";
+
+  // bug 945323: Download path isn't honoring download attribute
+  todo(download.path === expectedDownloadPath,
+       "Download path = " + expectedDownloadPath);
+
+  // bug 948287: Accessing startTime attribute at download start fires
+  //             NS_ERROR_UNEXPECTED in emulator
+  //ok(download.startTime >= todayDate,
+  //   "Download start time should be greater than or equal to today");
+
+  // bug 945366: Accessing error attribute at download start fires
+  //             NS_ERROR_UNEXPECTED in emulator
+  //is(download.error, null, "Download does not have an error");
+
+  is(download.url, expectedServeURL,
+     "Download URL = " + expectedServeURL);
+  ok(download.id !== null, "Download id is defined");
+  is(download.contentType, "application/octet-stream",
+     "Download content type is application/octet-stream");
+}
+
 function downloadChange(evt) {
   var download = evt.download;
-  if (download.state == "succeeded") {
-    ok(download.totalBytes == 1024, "Download size is 1024 bytes.");
-    ok(download.contentType == "application/octet-stream",
-       "contentType is application/octet-stream.");
+  checkConsistentDownloadAttributes(download);
+  is(download.totalBytes, 1024, "Download total size is 1024 bytes");
+
+  if (download.state === "succeeded") {
+    is(download.currentBytes, 1024, "Download current size is 1024 bytes");
     SimpleTest.finish();
+  } else if (download.state === "downloading") {
+    ok(download.currentBytes > lastKnownCurrentBytes,
+       "Download current size is larger than last download change event");
+    lastKnownCurrentBytes = download.currentBytes;
+  } else {
+    ok(false, "Unexpected download state = " + download.state);
   }
 }
 
+function downloadStart(evt) {
+  var download = evt.download;
+  checkConsistentDownloadAttributes(download);
+
+  is(download.currentBytes, 0, "Download current size is zero");
+  is(download.state, "downloading", "Download state is downloading");
+
+  download.onstatechange = downloadChange;
+}
+
 var steps = [
   // Start by setting the pref to true.
   function() {
@@ -61,11 +107,7 @@ var steps = [
     SpecialPowers.pushPermissions([
       {type: "downloads", allow: true, context: document}
     ], function() {
-      navigator.mozDownloadManager.ondownloadstart =
-        function(evt) {
-          ok(true, "Download started");
-          evt.download.addEventListener("statechange", downloadChange);
-        }
+      navigator.mozDownloadManager.ondownloadstart = downloadStart;
       next();
     });
   },
@@ -82,3 +124,4 @@ next();
 </pre>
 </body>
 </html>
+

From 0473585aa71a1cd743c93cd1f159ec208d8f340d Mon Sep 17 00:00:00 2001
From: Afshin Mehrabani <afshin.meh@gmail.com>
Date: Thu, 12 Dec 2013 17:19:33 -0500
Subject: [PATCH 323/459] Bug 947848 - Change the visibility of debugger
 stacktrace breadcrumbs. r=vp

---
 browser/devtools/debugger/debugger.css | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/browser/devtools/debugger/debugger.css b/browser/devtools/debugger/debugger.css
index 3a2b48482b82..03207b72bfde 100644
--- a/browser/devtools/debugger/debugger.css
+++ b/browser/devtools/debugger/debugger.css
@@ -53,3 +53,7 @@
 #body[layout=horizontal] #vertical-layout-panes-container {
   display: none;
 }
+
+#body[layout=vertical] #stackframes {
+  visibility: hidden;
+}

From 471512cdd2755aad25e31be4801a6c7d80326759 Mon Sep 17 00:00:00 2001
From: Jed Parsons <jedp@mozilla.com>
Date: Mon, 9 Dec 2013 17:15:30 -0800
Subject: [PATCH 324/459] Bug 948212 - Fix FxAccounts.jsm: internal.signOut()
 is not a function. r=markh

---
 services/fxaccounts/FxAccounts.jsm            | 14 +++++++----
 .../tests/xpcshell/test_accounts.js           | 23 +++++++++++++++++++
 2 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/services/fxaccounts/FxAccounts.jsm b/services/fxaccounts/FxAccounts.jsm
index 0f41e22258c0..aa900cc49ace 100644
--- a/services/fxaccounts/FxAccounts.jsm
+++ b/services/fxaccounts/FxAccounts.jsm
@@ -130,6 +130,14 @@ InternalMethods.prototype = {
     }
   },
 
+  signOut: function signOut() {
+    this.abortExistingFlow();
+    this.signedInUser = null; // clear in-memory cache
+    return this.signedInUserStorage.set(null).then(() => {
+      this.notifyObservers("fxaccounts:onlogout");
+    });
+  },
+
   /**
    * Fetch encryption keys for the signed-in-user from the FxA API server.
    *
@@ -582,11 +590,7 @@ this.FxAccounts.prototype = Object.freeze({
    *         The promise is rejected if a storage error occurs.
    */
   signOut: function signOut() {
-    internal.abortExistingFlow();
-    internal.signedInUser = null; // clear in-memory cache
-    return internal.signedInUserStorage.set(null).then(() => {
-      internal.notifyObservers("fxaccounts:onlogout");
-    });
+    return internal.signOut();
   },
 
   // Return the URI of the remote UI flows.
diff --git a/services/fxaccounts/tests/xpcshell/test_accounts.js b/services/fxaccounts/tests/xpcshell/test_accounts.js
index 5f2d67bfdb98..888432a58ed2 100644
--- a/services/fxaccounts/tests/xpcshell/test_accounts.js
+++ b/services/fxaccounts/tests/xpcshell/test_accounts.js
@@ -291,6 +291,29 @@ add_task(function test_getKeys() {
   });
 });
 
+/*
+ * getKeys with no keyFetchToken should trigger signOut
+ */
+add_test(function test_getKeys_no_token() {
+  do_test_pending();
+
+  let fxa = new MockFxAccounts();
+  let user = getTestUser("lettuce.protheroe");
+  delete user.keyFetchToken
+
+  makeObserver("fxaccounts:onlogout", function() {
+    log.debug("test_getKeys_no_token observed logout");
+    fxa.internal.getUserAccountData().then(user => {
+      do_test_finished();
+      run_next_test();
+    });
+  });
+
+  fxa.setSignedInUser(user).then((user) => {
+    fxa.internal.getKeys();
+  });
+});
+
 /*
  * Alice (User A) signs up but never verifies her email.  Then Bob (User B)
  * signs in with a verified email.  Ensure that no sign-in events are triggered

From d0079ab03b49612557029f14c90d5dc5aa8e2a73 Mon Sep 17 00:00:00 2001
From: Bevis Tseng <btseng@mozilla.com>
Date: Tue, 10 Dec 2013 19:24:27 +0800
Subject: [PATCH 325/459] Bug 768441 - Part 2: Test Case to Verify the Access
 of EF_MWIS. r=vyang

---
 dom/system/gonk/tests/test_ril_worker_icc.js | 177 ++++++++++++++++++-
 1 file changed, 176 insertions(+), 1 deletion(-)

diff --git a/dom/system/gonk/tests/test_ril_worker_icc.js b/dom/system/gonk/tests/test_ril_worker_icc.js
index ee1b1c44c657..f4cd767b2c73 100644
--- a/dom/system/gonk/tests/test_ril_worker_icc.js
+++ b/dom/system/gonk/tests/test_ril_worker_icc.js
@@ -2330,6 +2330,10 @@ add_test(function test_reading_optional_efs() {
       testEf.splice(testEf.indexOf("MDN"), 1);
     };
 
+    record.readMWIS = function fakeReadMWIS() {
+      testEf.splice(testEf.indexOf("MWIS"), 1);
+    };
+
     io.loadTransparentEF = function fakeLoadTransparentEF(options) {
       // Write data size
       buf.writeInt32(sst.length * 2);
@@ -2356,7 +2360,7 @@ add_test(function test_reading_optional_efs() {
   }
 
   // TODO: Add all necessary optional EFs eventually
-  let supportedEf = ["MSISDN", "MDN"];
+  let supportedEf = ["MSISDN", "MDN", "MWIS"];
   ril.appType = CARD_APPTYPE_SIM;
   do_test(buildSST(supportedEf), supportedEf);
   ril.appType = CARD_APPTYPE_USIM;
@@ -2435,3 +2439,174 @@ add_test(function test_fetch_icc_recodes() {
 
   run_next_test();
 });
+
+add_test(function test_read_mwis() {
+  let worker = newUint8Worker();
+  let helper = worker.GsmPDUHelper;
+  let recordHelper = worker.SimRecordHelper;
+  let buf    = worker.Buf;
+  let io     = worker.ICCIOHelper;
+  let mwisData;
+  let postedMessage;
+
+  worker.postMessage = function fakePostMessage(message) {
+    postedMessage = message;
+  };
+
+  io.loadLinearFixedEF = function fakeLoadLinearFixedEF(options) {
+    if (mwisData) {
+      // Write data size
+      buf.writeInt32(mwisData.length * 2);
+
+      // Write MWIS
+      for (let i = 0; i < mwisData.length; i++) {
+        helper.writeHexOctet(mwisData[i]);
+      }
+
+      // Write string delimiter
+      buf.writeStringDelimiter(mwisData.length * 2);
+
+      options.recordSize = mwisData.length;
+      if (options.callback) {
+        options.callback(options);
+      }
+    } else {
+      do_print("mwisData[] is not set.");
+    }
+  };
+
+  function buildMwisData(isActive, msgCount) {
+    if (msgCount < 0 || msgCount === GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN) {
+      msgCount = 0;
+    } else if (msgCount > 255) {
+      msgCount = 255;
+    }
+
+    mwisData =  [ (isActive) ? 0x01 : 0x00,
+                  msgCount,
+                  0xFF, 0xFF, 0xFF ];
+  }
+
+  function do_test(isActive, msgCount) {
+    buildMwisData(isActive, msgCount);
+    recordHelper.readMWIS();
+
+    do_check_eq("iccmwis", postedMessage.rilMessageType);
+    do_check_eq(isActive, postedMessage.mwi.active);
+    do_check_eq((isActive) ? msgCount : 0, postedMessage.mwi.msgCount);
+  }
+
+  do_test(true, GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN);
+  do_test(true, 1);
+  do_test(true, 255);
+
+  do_test(false, 0);
+  do_test(false, 255); // Test the corner case when mwi is disable with incorrect msgCount.
+
+  run_next_test();
+});
+
+add_test(function test_update_mwis() {
+  let worker = newUint8Worker();
+  let pduHelper = worker.GsmPDUHelper;
+  let ril = worker.RIL;
+  ril.appType = CARD_APPTYPE_USIM;
+  ril.iccInfoPrivate.mwis = [0x00, 0x00, 0x00, 0x00, 0x00];
+  let recordHelper = worker.SimRecordHelper;
+  let buf = worker.Buf;
+  let ioHelper = worker.ICCIOHelper;
+  let recordSize = ril.iccInfoPrivate.mwis.length;
+  let recordNum = 1;
+
+  ioHelper.updateLinearFixedEF = function (options) {
+    options.pathId = worker.ICCFileHelper.getEFPath(options.fileId);
+    options.command = ICC_COMMAND_UPDATE_RECORD;
+    options.p1 = options.recordNumber;
+    options.p2 = READ_RECORD_ABSOLUTE_MODE;
+    options.p3 = recordSize;
+    ril.iccIO(options);
+  };
+
+  function do_test(isActive, count) {
+    let mwis = ril.iccInfoPrivate.mwis;
+    let isUpdated = false;
+
+    function buildMwisData() {
+      let result = mwis.slice(0);
+      result[0] = isActive? (mwis[0] | 0x01) : (mwis[0] & 0xFE);
+      result[1] = (count === GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN) ? 0 : count;
+
+      return result;
+    }
+
+    buf.sendParcel = function () {
+      isUpdated = true;
+
+      // Request Type.
+      do_check_eq(this.readInt32(), REQUEST_SIM_IO);
+
+      // Token : we don't care
+      this.readInt32();
+
+      // command.
+      do_check_eq(this.readInt32(), ICC_COMMAND_UPDATE_RECORD);
+
+      // fileId.
+      do_check_eq(this.readInt32(), ICC_EF_MWIS);
+
+      // pathId.
+      do_check_eq(this.readString(),
+                  EF_PATH_MF_SIM + ((ril.appType === CARD_APPTYPE_USIM) ? EF_PATH_ADF_USIM : EF_PATH_DF_GSM));
+
+      // p1.
+      do_check_eq(this.readInt32(), recordNum);
+
+      // p2.
+      do_check_eq(this.readInt32(), READ_RECORD_ABSOLUTE_MODE);
+
+      // p3.
+      do_check_eq(this.readInt32(), recordSize);
+
+      // data.
+      let strLen = this.readInt32();
+      do_check_eq(recordSize * 2, strLen);
+      let expectedMwis = buildMwisData();
+      for (let i = 0; i < recordSize; i++) {
+        do_check_eq(expectedMwis[i], pduHelper.readHexOctet());
+      }
+      this.readStringDelimiter(strLen);
+
+      // pin2.
+      do_check_eq(this.readString(), null);
+
+      if (!worker.RILQUIRKS_V5_LEGACY) {
+        // AID. Ignore because it's from modem.
+        this.readInt32();
+      }
+    };
+
+    do_check_false(isUpdated);
+
+    recordHelper.updateMWIS({ active: isActive,
+                              msgCount: count });
+
+    do_check_true((ril.iccInfoPrivate.mwis) ? isUpdated : !isUpdated);
+  }
+
+  do_test(true, GECKO_VOICEMAIL_MESSAGE_COUNT_UNKNOWN);
+  do_test(true, 1);
+  do_test(true, 255);
+
+  do_test(false, 0);
+
+  // Test if Path ID is correct for SIM.
+  ril.appType = CARD_APPTYPE_SIM;
+  do_test(false, 0);
+
+  // Test if loadLinearFixedEF() is not invoked in updateMWIS() when
+  // EF_MWIS is not loaded/available.
+  delete ril.iccInfoPrivate.mwis;
+  do_test(false, 0);
+
+  run_next_test();
+});

From dc7950b5b26e6f35476a476136abce4c99c21285 Mon Sep 17 00:00:00 2001
From: Chuck Lee <chulee@mozilla.com>
Date: Wed, 11 Dec 2013 12:46:16 +0800
Subject: [PATCH 326/459] Bug 947814 - 0001. Assign length of data. r=vicamo

---
 dom/wappush/src/gonk/CpPduHelper.jsm   | 2 +-
 dom/wappush/src/gonk/WapPushManager.js | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/dom/wappush/src/gonk/CpPduHelper.jsm b/dom/wappush/src/gonk/CpPduHelper.jsm
index 5f4bb38f209f..728a31e32d28 100644
--- a/dom/wappush/src/gonk/CpPduHelper.jsm
+++ b/dom/wappush/src/gonk/CpPduHelper.jsm
@@ -185,9 +185,9 @@ this.Authenticator = {
       checked: false,
       sec: AUTH_SEC_TYPE[sec],
       mac: mac.toUpperCase(),
-      dataLength: wbxml.length,
       data: wbxml
     };
+    authInfo.data.length = wbxml.length;
 
     switch (authInfo.sec) {
       case "NETWPIN":
diff --git a/dom/wappush/src/gonk/WapPushManager.js b/dom/wappush/src/gonk/WapPushManager.js
index 4821767af30b..f52ba7a503fc 100644
--- a/dom/wappush/src/gonk/WapPushManager.js
+++ b/dom/wappush/src/gonk/WapPushManager.js
@@ -123,6 +123,7 @@ this.WapPushManager = {
         contentType: contentType,
         content: data.array
       };
+      msg.content.length = data.array.length;
     }
 
     let sender = PhoneNumberUtils.normalize(options.sourceAddress, false);

From cf45d3539cdc9901fa9ad57d9fcaca973f5b12a1 Mon Sep 17 00:00:00 2001
From: Chuck Lee <chulee@mozilla.com>
Date: Wed, 11 Dec 2013 12:46:19 +0800
Subject: [PATCH 327/459] Bug 947814 - 0002. Test case. r=vicamo

---
 dom/wappush/tests/test_cp_pdu_helper.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dom/wappush/tests/test_cp_pdu_helper.js b/dom/wappush/tests/test_cp_pdu_helper.js
index 0463dd2048ab..7a3fa5fa1e64 100644
--- a/dom/wappush/tests/test_cp_pdu_helper.js
+++ b/dom/wappush/tests/test_cp_pdu_helper.js
@@ -14,6 +14,7 @@ function test_parser(rawDataArray, contentType, expectResult) {
   let msg = CP.PduHelper.parse(data, contentType);
   do_check_eq(msg.contentType, expectResult.contentType);
   do_check_eq(msg.content, expectResult.content);
+  do_check_eq(msg.content.length, expectResult.content.length);
 }
 
 function test_hmac(rawDataArray, mac, key, expectResult) {
@@ -21,7 +22,7 @@ function test_hmac(rawDataArray, mac, key, expectResult) {
     return key;
   });
   do_check_eq(authInfo.data, rawDataArray);
-  do_check_eq(authInfo.dataLength, rawDataArray.length);
+  do_check_eq(authInfo.data.length, rawDataArray.length);
   do_check_eq(authInfo.checked, expectResult.checked);
   do_check_eq(authInfo.pass, expectResult.pass);
 }

From 29dfac41ca34e7c6e26ee50ef21c6f225f686f35 Mon Sep 17 00:00:00 2001
From: Bruce Sun <brsun@mozilla.com>
Date: Thu, 12 Dec 2013 11:21:04 +0800
Subject: [PATCH 328/459] Bug 947113 - Sync RTSP play & pause with the life
 time of the decoding thread. r=doublec

---
 content/media/omx/RtspOmxDecoder.cpp | 39 ---------------------------
 content/media/omx/RtspOmxDecoder.h   |  4 ---
 content/media/omx/RtspOmxReader.cpp  | 40 ++++++++++++++++++++++++++++
 content/media/omx/RtspOmxReader.h    |  4 +++
 4 files changed, 44 insertions(+), 43 deletions(-)

diff --git a/content/media/omx/RtspOmxDecoder.cpp b/content/media/omx/RtspOmxDecoder.cpp
index 4844efad0cac..7e3e2ffb2e96 100644
--- a/content/media/omx/RtspOmxDecoder.cpp
+++ b/content/media/omx/RtspOmxDecoder.cpp
@@ -22,44 +22,5 @@ MediaDecoderStateMachine* RtspOmxDecoder::CreateStateMachine()
                                   mResource->IsRealTime());
 }
 
-void RtspOmxDecoder::ApplyStateToStateMachine(PlayState aState)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  GetReentrantMonitor().AssertCurrentThreadIn();
-
-  MediaDecoder::ApplyStateToStateMachine(aState);
-
-
-  // Send play/pause commands here through the nsIStreamingProtocolController
-  // except seek command. We need to clear the decoded/un-decoded buffer data
-  // before sending seek command. So the seek calling path to controller is:
-  // mDecoderStateMachine::Seek-> RtspOmxReader::Seek-> RtspResource::SeekTime->
-  // controller->Seek(). RtspOmxReader::Seek will clear the decoded buffer and
-  // the RtspResource::SeekTime will clear the un-decoded buffer.
-
-  RtspMediaResource* rtspResource = mResource->GetRtspPointer();
-  MOZ_ASSERT(rtspResource);
-
-  nsIStreamingProtocolController* controller =
-    rtspResource->GetMediaStreamController();
-  if (mDecoderStateMachine) {
-    switch (aState) {
-      case PLAY_STATE_PLAYING:
-        if (controller) {
-          controller->Play();
-        }
-        break;
-      case PLAY_STATE_PAUSED:
-        if (controller) {
-          controller->Pause();
-        }
-        break;
-      default:
-        /* No action needed */
-        break;
-    }
-  }
-}
-
 } // namespace mozilla
 
diff --git a/content/media/omx/RtspOmxDecoder.h b/content/media/omx/RtspOmxDecoder.h
index 515d575bb4e9..20b757469c61 100644
--- a/content/media/omx/RtspOmxDecoder.h
+++ b/content/media/omx/RtspOmxDecoder.h
@@ -32,10 +32,6 @@ public:
 
   virtual MediaDecoder* Clone() MOZ_OVERRIDE;
   virtual MediaDecoderStateMachine* CreateStateMachine() MOZ_OVERRIDE;
-  // Called by |ChangeState|, override it to send the Rtsp play/pause commands
-  // through |nsIStreamingProtocolController|.
-  // Call on the main thread only and the lock must be obtained.
-  virtual void ApplyStateToStateMachine(PlayState aState) MOZ_OVERRIDE;
 };
 
 } // namespace mozilla
diff --git a/content/media/omx/RtspOmxReader.cpp b/content/media/omx/RtspOmxReader.cpp
index d19d6800a9ad..7ee1922bc5d2 100644
--- a/content/media/omx/RtspOmxReader.cpp
+++ b/content/media/omx/RtspOmxReader.cpp
@@ -289,4 +289,44 @@ nsresult RtspOmxReader::Seek(int64_t aTime, int64_t aStartTime,
   return MediaOmxReader::Seek(aTime, aStartTime, aEndTime, aCurrentTime);
 }
 
+void RtspOmxReader::OnDecodeThreadStart() {
+  // Start RTSP streaming right after starting the decoding thread in
+  // MediaDecoderStateMachine and before starting OMXCodec decoding.
+  if (mRtspResource) {
+    nsIStreamingProtocolController* controller =
+        mRtspResource->GetMediaStreamController();
+    if (controller) {
+      controller->Play();
+    }
+  }
+
+  // Call parent class to start OMXCodec decoding.
+  MediaOmxReader::OnDecodeThreadStart();
+}
+
+void RtspOmxReader::OnDecodeThreadFinish() {
+  // Call parent class to pause OMXCodec decoding.
+  MediaOmxReader::OnDecodeThreadFinish();
+
+  // Stop RTSP streaming right before destroying the decoding thread in
+  // MediaDecoderStateMachine and after pausing OMXCodec decoding.
+  // RTSP streaming should not be paused until OMXCodec has been paused and
+  // until the decoding thread in MediaDecoderStateMachine is about to be
+  // destroyed. Otherwise, RtspMediaSource::read() would block the binder
+  // thread of OMXCodecObserver::onMessage() --> OMXCodec::on_message() -->
+  // OMXCodec::drainInputBuffer() due to network data starvation. Because
+  // OMXCodec::mLock is held by the binder thread in this case, all other
+  // threads would be blocked when they try to lock this mutex. As a result, the
+  // decoding thread in MediaDecoderStateMachine would be blocked forever in
+  // OMXCodec::read() if there is no enough data for RtspMediaSource::read() to
+  // return.
+  if (mRtspResource) {
+    nsIStreamingProtocolController* controller =
+        mRtspResource->GetMediaStreamController();
+    if (controller) {
+      controller->Pause();
+    }
+  }
+}
+
 } // namespace mozilla
diff --git a/content/media/omx/RtspOmxReader.h b/content/media/omx/RtspOmxReader.h
index 399ab74bf6a4..f616ce7d0cc8 100644
--- a/content/media/omx/RtspOmxReader.h
+++ b/content/media/omx/RtspOmxReader.h
@@ -71,6 +71,10 @@ public:
     return nullptr;
   }
 
+  virtual void OnDecodeThreadStart() MOZ_OVERRIDE;
+
+  virtual void OnDecodeThreadFinish() MOZ_OVERRIDE;
+
 private:
   // A pointer to RtspMediaResource for calling the Rtsp specific function.
   // The lifetime of mRtspResource is controlled by MediaDecoder. MediaDecoder

From 9a92f80b33d3018f20284a0c7078e4b9a28d441f Mon Sep 17 00:00:00 2001
From: Sushil Chauhan <sushilchauhan@codeaurora.org>
Date: Wed, 11 Dec 2013 12:37:25 -0800
Subject: [PATCH 329/459] Bug 947805 - If hwcomposer is already prepared, reset
 with null hwc set. r=dwilson

---
 widget/gonk/HwcComposer2D.cpp | 35 +++++++++++++++++++++++++++--------
 widget/gonk/HwcComposer2D.h   |  2 ++
 2 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/widget/gonk/HwcComposer2D.cpp b/widget/gonk/HwcComposer2D.cpp
index 97556f77f5b0..15c047aefaee 100644
--- a/widget/gonk/HwcComposer2D.cpp
+++ b/widget/gonk/HwcComposer2D.cpp
@@ -64,6 +64,7 @@ HwcComposer2D::HwcComposer2D()
     , mColorFill(false)
     , mRBSwapSupport(false)
     , mPrevRetireFence(-1)
+    , mPrepared(false)
 {
 }
 
@@ -451,7 +452,6 @@ HwcComposer2D::TryHwComposition()
 
     if (!(fbsurface && fbsurface->lastHandle)) {
         LOGD("H/W Composition failed. FBSurface not initialized.");
-        mList->numHwLayers = 0;
         return false;
     }
 
@@ -460,7 +460,6 @@ HwcComposer2D::TryHwComposition()
     if (idx >= mMaxLayerCount) {
         if (!ReallocLayerList() || idx >= mMaxLayerCount) {
             LOGE("TryHwComposition failed! Could not add FB layer");
-            mList->numHwLayers = 0;
             return false;
         }
     }
@@ -495,7 +494,6 @@ HwcComposer2D::TryHwComposition()
 
     // No composition on FB layer, so closing releaseFenceFd
     close(mList->hwLayers[idx].releaseFenceFd);
-    mList->numHwLayers = 0;
     return true;
 }
 
@@ -515,7 +513,7 @@ HwcComposer2D::Render(EGLDisplay dpy, EGLSurface sur)
         return false;
     }
 
-    if (mList->numHwLayers != 0) {
+    if (mPrepared) {
         // No mHwc prepare, if already prepared in current draw cycle
         mList->hwLayers[mList->numHwLayers - 1].handle = fbsurface->lastHandle;
         mList->hwLayers[mList->numHwLayers - 1].acquireFenceFd = fbsurface->lastFenceFD;
@@ -535,7 +533,6 @@ HwcComposer2D::Render(EGLDisplay dpy, EGLSurface sur)
     Commit();
 
     GetGonkDisplay()->SetFBReleaseFd(mList->hwLayers[mList->numHwLayers - 1].releaseFenceFd);
-    mList->numHwLayers = 0;
     return true;
 }
 
@@ -566,7 +563,11 @@ HwcComposer2D::Prepare(buffer_handle_t fbHandle, int fence)
     mList->hwLayers[idx].releaseFenceFd = -1;
     mList->hwLayers[idx].planeAlpha = 0xFF;
 
+    if (mPrepared) {
+        LOGE("Multiple hwc prepare calls!");
+    }
     mHwc->prepare(mHwc, HWC_NUM_DISPLAY_TYPES, displays);
+    mPrepared = true;
 }
 
 bool
@@ -609,8 +610,19 @@ HwcComposer2D::Commit()
         }
     }
 
+    mPrepared = false;
     return !err;
 }
+
+void
+HwcComposer2D::Reset()
+{
+    LOGD("hwcomposer is already prepared, reset with null set");
+    hwc_display_contents_1_t *displays[HWC_NUM_DISPLAY_TYPES] = { nullptr };
+    displays[HWC_DISPLAY_PRIMARY] = nullptr;
+    mHwc->set(mHwc, HWC_DISPLAY_PRIMARY, displays);
+    mPrepared = false;
+}
 #else
 bool
 HwcComposer2D::TryHwComposition()
@@ -623,6 +635,12 @@ HwcComposer2D::Render(EGLDisplay dpy, EGLSurface sur)
 {
     return GetGonkDisplay()->SwapBuffers(dpy, sur);
 }
+
+void
+HwcComposer2D::Reset()
+{
+    mPrepared = false;
+}
 #endif
 
 bool
@@ -640,6 +658,10 @@ HwcComposer2D::TryRender(Layer* aRoot,
         mHwcLayerMap.Clear();
     }
 
+    if (mPrepared) {
+        Reset();
+    }
+
     // XXX: The clear() below means all rect vectors will be have to be
     // reallocated. We may want to avoid this if possible
     mVisibleRegions.clear();
@@ -651,9 +673,6 @@ HwcComposer2D::TryRender(Layer* aRoot,
                           aGLWorldTransform))
     {
         LOGD("Render aborted. Nothing was drawn to the screen");
-        if (mList) {
-           mList->numHwLayers = 0;
-        }
         return false;
     }
 
diff --git a/widget/gonk/HwcComposer2D.h b/widget/gonk/HwcComposer2D.h
index 2ca4defa0f38..06fa1eddba68 100644
--- a/widget/gonk/HwcComposer2D.h
+++ b/widget/gonk/HwcComposer2D.h
@@ -63,6 +63,7 @@ public:
     bool Render(EGLDisplay dpy, EGLSurface sur);
 
 private:
+    void Reset();
     void Prepare(buffer_handle_t fbHandle, int fence);
     bool Commit();
     bool TryHwComposition();
@@ -84,6 +85,7 @@ private:
     nsTArray<int>           mPrevReleaseFds;
     int                     mPrevRetireFence;
     nsTArray<layers::LayerComposite*> mHwcLayerMap;
+    bool                    mPrepared;
 };
 
 } // namespace mozilla

From d699640b332acfdc2fc7893e4c0cf1cdf757c932 Mon Sep 17 00:00:00 2001
From: Chuck Lee <chulee@mozilla.com>
Date: Wed, 11 Dec 2013 12:46:21 +0800
Subject: [PATCH 330/459] Bug 948376 - Add wappush to xpcshell list. r=jgriffin

---
 testing/xpcshell/xpcshell_b2g.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/testing/xpcshell/xpcshell_b2g.ini b/testing/xpcshell/xpcshell_b2g.ini
index 60948a7f0039..025417e3c43e 100644
--- a/testing/xpcshell/xpcshell_b2g.ini
+++ b/testing/xpcshell/xpcshell_b2g.ini
@@ -6,6 +6,7 @@
 [include:dom/mobilemessage/tests/xpcshell.ini]
 [include:dom/network/tests/unit_stats/xpcshell.ini]
 [include:dom/system/gonk/tests/xpcshell.ini]
+[include:dom/wappush/tests/xpcshell.ini]
 [include:toolkit/devtools/apps/tests/unit/xpcshell.ini]
 [include:toolkit/devtools/debugger/tests/unit/xpcshell.ini]
 [include:toolkit/devtools/sourcemap/tests/unit/xpcshell.ini]

From c064900de4cf1e767ea6ac8ef21b3b4ae0270be2 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 13:00:30 -0800
Subject: [PATCH 331/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/f3f08c4170e5
Author: Marcus Cavanaugh <m@mcav.com>
Desc: Merge pull request #14661 from mcav/autoconfig-xhr

Bug 942795 - [email] autoconfig XHR callbacks seem to be firing multiple times on nightly. r=asuth a=fabrice

========

https://hg.mozilla.org/integration/gaia-central/rev/01f210c13827
Author: Marcus Cavanaugh <m@mcav.com>
Desc: Bug 942795 - [email] autoconfig XHR callbacks seem to be firing multiple times on nightly. r=asuth a=fabrice
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index c14c25b2ebc6..711b1587a306 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "62c0ad5b88f15d5da1cc2496b9534087dbc5d015", 
+    "revision": "f3f08c4170e57956cba530affcb5a9fc51db46c5", 
     "repo_path": "/integration/gaia-central"
 }

From 6b31866e222c722486e2f746960efc52be697a00 Mon Sep 17 00:00:00 2001
From: Kevin Grandon <kevingrandon@yahoo.com>
Date: Fri, 13 Dec 2013 16:10:56 -0500
Subject: [PATCH 332/459] Bug 942749 - [keyboard] Fix forms.js contenteditable
 scroll position. r=fabrice

---
 dom/inputmethod/forms.js | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/dom/inputmethod/forms.js b/dom/inputmethod/forms.js
index be99a96e2552..3185dde22254 100644
--- a/dom/inputmethod/forms.js
+++ b/dom/inputmethod/forms.js
@@ -415,7 +415,7 @@ let FormAssistant = {
           this.scrollIntoViewTimeout = content.setTimeout(function () {
             this.scrollIntoViewTimeout = null;
             if (this.focusedElement && !FormVisibility.isVisible(this.focusedElement)) {
-              this.focusedElement.scrollIntoView(false);
+              scrollSelectionOrElementIntoView(this.focusedElement);
             }
           }.bind(this), RESIZE_SCROLL_DELAY);
         }
@@ -1017,6 +1017,23 @@ function setSelectionRange(element, start, end) {
   }
 }
 
+/**
+ * Scroll the given element into view.
+ *
+ * Calls scrollSelectionIntoView for contentEditable elements.
+ */
+function scrollSelectionOrElementIntoView(element) {
+  let editor = getPlaintextEditor(element);
+  if (editor) {
+    editor.selectionController.scrollSelectionIntoView(
+      Ci.nsISelectionController.SELECTION_NORMAL,
+      Ci.nsISelectionController.SELECTION_FOCUS_REGION,
+      Ci.nsISelectionController.SCROLL_SYNCHRONOUS);
+  } else {
+      element.scrollIntoView(false);
+  }
+}
+
 // Get nsIPlaintextEditor object from an input field
 function getPlaintextEditor(element) {
   let editor = null;

From 44af9e6d150506257e8f823d664f6420fcf9949d Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 14:40:25 -0800
Subject: [PATCH 333/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/a8720a418a85
Author: Marcus Cavanaugh <m@mcav.com>
Desc: Merge pull request #14667 from mcav/utf7

Bug 938321 - [email/backend] Implement utf-7 charset support using hand-rolled decoder. r=asuth

========

https://hg.mozilla.org/integration/gaia-central/rev/5037ab809d20
Author: Marcus Cavanaugh <m@mcav.com>
Desc: Bug 938321 - [email/backend] Implement utf-7 charset support using hand-rolled decoder.

========

https://hg.mozilla.org/integration/gaia-central/rev/f1fcc0bf2d28
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14508 from julienw/942863-use-height-instead-of-border-bottom

Bug 942863 - Workaround for a Gecko bug in SMS app with APZ enabled. r=borja

========

https://hg.mozilla.org/integration/gaia-central/rev/d3ac0ec93099
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 942863 - [SMS] The messages list content can not be scrolled to the end r=borja
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 711b1587a306..6a69a7a7763c 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "f3f08c4170e57956cba530affcb5a9fc51db46c5", 
+    "revision": "a8720a418a856aa3d51263eee70fc40df28ad9b2", 
     "repo_path": "/integration/gaia-central"
 }

From 7d8b66a9cd96fdd49ac2f548afd159eecf196c0f Mon Sep 17 00:00:00 2001
From: "glacroix@mozilla.com" <glacroix@mozilla.com>
Date: Fri, 13 Dec 2013 15:31:39 -0800
Subject: [PATCH 334/459] Bug 945366 - Download 'error' attribute throws when
 accessed and value is null. r=gwagner

---
 dom/downloads/src/DownloadsAPI.js             | 10 +++++++++-
 dom/downloads/tests/test_downloads_basic.html | 10 +++-------
 dom/webidl/Downloads.webidl                   |  2 +-
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/dom/downloads/src/DownloadsAPI.js b/dom/downloads/src/DownloadsAPI.js
index a87ca1d44457..668c24c70af2 100644
--- a/dom/downloads/src/DownloadsAPI.js
+++ b/dom/downloads/src/DownloadsAPI.js
@@ -206,9 +206,9 @@ function DOMDownloadImpl() {
   this.path = null;
   this.state = "stopped";
   this.contentType = null;
-  this.error = null;
 
   /* fields that require getters/setters */
+  this._error = null;
   this._startTime = new Date();
 
   /* private fields */
@@ -247,6 +247,14 @@ DOMDownloadImpl.prototype = {
     return this.__DOM_IMPL__.getEventHandler("onstatechange");
   },
 
+  get error() {
+    return this._error;
+  },
+
+  set error(aError) {
+    this._error = aError;
+  },
+
   get startTime() {
     return this._startTime;
   },
diff --git a/dom/downloads/tests/test_downloads_basic.html b/dom/downloads/tests/test_downloads_basic.html
index 943da3816307..c5ada1a0ea65 100644
--- a/dom/downloads/tests/test_downloads_basic.html
+++ b/dom/downloads/tests/test_downloads_basic.html
@@ -51,14 +51,10 @@ function checkConsistentDownloadAttributes(download) {
   todo(download.path === expectedDownloadPath,
        "Download path = " + expectedDownloadPath);
 
-  // bug 948287: Accessing startTime attribute at download start fires
-  //             NS_ERROR_UNEXPECTED in emulator
-  //ok(download.startTime >= todayDate,
-  //   "Download start time should be greater than or equal to today");
+  ok(download.startTime >= todayDate,
+     "Download start time should be greater than or equal to today");
 
-  // bug 945366: Accessing error attribute at download start fires
-  //             NS_ERROR_UNEXPECTED in emulator
-  //is(download.error, null, "Download does not have an error");
+  is(download.error, null, "Download does not have an error");
 
   is(download.url, expectedServeURL,
      "Download URL = " + expectedServeURL);
diff --git a/dom/webidl/Downloads.webidl b/dom/webidl/Downloads.webidl
index e547868991b3..862e3b807c3f 100644
--- a/dom/webidl/Downloads.webidl
+++ b/dom/webidl/Downloads.webidl
@@ -59,7 +59,7 @@ interface DOMDownload : EventTarget {
 
   // A DOM error object, that will be not null when a download is stopped
   // because something failed.
-  readonly attribute DOMError error;
+  readonly attribute DOMError? error;
 
   // Pauses the download.
   Promise pause();

From 8a7b51127ae5f8b1b4356f01dddca189e7035b10 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 15:55:23 -0800
Subject: [PATCH 335/459] Bumping gaia.json for 1 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/a8e6d298564a
Author: John Ford <john@johnford.info>
Desc: Revert "Merge pull request #14632 from alivedise/bugzilla/948596_v2/activity-window-size-copy"

This reverts commit 888f9df5515a47d2f5806efee77485e05e1e5416, reversing
changes made to 53b010647062b4e2637f98ac3538af1c7bfe723a.

This was backed out because of https://bugzilla.mozilla.org/show_bug.cgi?id=950136#c11
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 6a69a7a7763c..7eb83e968939 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "a8720a418a856aa3d51263eee70fc40df28ad9b2", 
+    "revision": "a8e6d298564ac14c79d23ab170be2599f8ae9678", 
     "repo_path": "/integration/gaia-central"
 }

From f445874901d887f48cd0f087fe2dfc524d5ed390 Mon Sep 17 00:00:00 2001
From: Dimi Lee <dlee@mozilla.com>
Date: Wed, 11 Dec 2013 14:04:27 +0800
Subject: [PATCH 336/459] Bug 947100 - B2G NFC: enable/disable NFC worker at
 runtime. r=yoshi

---
 dom/nfc/nsNfc.js                    | 8 ++++++--
 dom/system/gonk/Nfc.js              | 7 ++++++-
 dom/system/gonk/NfcContentHelper.js | 7 ++++++-
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/dom/nfc/nsNfc.js b/dom/nfc/nsNfc.js
index 8cf281374508..55f865d796db 100644
--- a/dom/nfc/nsNfc.js
+++ b/dom/nfc/nsNfc.js
@@ -138,8 +138,12 @@ MozNFCPeer.prototype = {
  */
 function mozNfc() {
   debug("In mozNfc Constructor");
-  this._nfcContentHelper = Cc["@mozilla.org/nfc/content-helper;1"]
-                             .getService(Ci.nsINfcContentHelper);
+  try {
+    this._nfcContentHelper = Cc["@mozilla.org/nfc/content-helper;1"]
+                               .getService(Ci.nsINfcContentHelper);
+  } catch(e) {
+    debug("No NFC support.")
+  }
 }
 mozNfc.prototype = {
   _nfcContentHelper: null,
diff --git a/dom/system/gonk/Nfc.js b/dom/system/gonk/Nfc.js
index 67152fc4d7a3..c2a489ef4260 100644
--- a/dom/system/gonk/Nfc.js
+++ b/dom/system/gonk/Nfc.js
@@ -25,6 +25,9 @@ Cu.import("resource://gre/modules/Services.jsm");
 let NFC = {};
 Cu.import("resource://gre/modules/nfc_consts.js", NFC);
 
+Cu.import("resource://gre/modules/systemlibs.js");
+const NFC_ENABLED = libcutils.property_get("ro.moz.nfc.enabled", "false") === "true";
+
 // set to true in nfc_consts.js to see debug messages
 let DEBUG = NFC.DEBUG_NFC;
 
@@ -627,4 +630,6 @@ Nfc.prototype = {
   }
 };
 
-this.NSGetFactory = XPCOMUtils.generateNSGetFactory([Nfc]);
+if (NFC_ENABLED) {
+  this.NSGetFactory = XPCOMUtils.generateNSGetFactory([Nfc]);
+}
diff --git a/dom/system/gonk/NfcContentHelper.js b/dom/system/gonk/NfcContentHelper.js
index 623206212fd9..2ed5b17670a1 100644
--- a/dom/system/gonk/NfcContentHelper.js
+++ b/dom/system/gonk/NfcContentHelper.js
@@ -26,6 +26,9 @@ Cu.import("resource://gre/modules/DOMRequestHelper.jsm");
 let NFC = {};
 Cu.import("resource://gre/modules/nfc_consts.js", NFC);
 
+Cu.import("resource://gre/modules/systemlibs.js");
+const NFC_ENABLED = libcutils.property_get("ro.moz.nfc.enabled", "false") === "true";
+
 // set to true to in nfc_consts.js to see debug messages
 let DEBUG = NFC.DEBUG_CONTENT_HELPER;
 
@@ -384,4 +387,6 @@ NfcContentHelper.prototype = {
   },
 };
 
-this.NSGetFactory = XPCOMUtils.generateNSGetFactory([NfcContentHelper]);
+if (NFC_ENABLED) {
+  this.NSGetFactory = XPCOMUtils.generateNSGetFactory([NfcContentHelper]);
+}

From 2316157f59a99520fdd3038b6bb361170a5f056a Mon Sep 17 00:00:00 2001
From: Shelly Lin <slin@mozilla.com>
Date: Wed, 11 Dec 2013 17:42:56 +0800
Subject: [PATCH 337/459] Bug 948819 - Do not round the frame size if the
 source video is in odd resolutions. r=roc

---
 content/media/encoder/TrackEncoder.cpp | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/content/media/encoder/TrackEncoder.cpp b/content/media/encoder/TrackEncoder.cpp
index cdfe7bb000c9..a7c1b908be89 100644
--- a/content/media/encoder/TrackEncoder.cpp
+++ b/content/media/encoder/TrackEncoder.cpp
@@ -148,9 +148,7 @@ VideoTrackEncoder::NotifyQueuedTrackChanges(MediaStreamGraph* aGraph,
       VideoChunk chunk = *iter;
       if (!chunk.IsNull()) {
         gfxIntSize imgsize = chunk.mFrame.GetImage()->GetSize();
-        int width = (imgsize.width + 1) / 2 * 2;
-        int height = (imgsize.height + 1) / 2 * 2;
-        nsresult rv = Init(width, height, aTrackRate);
+        nsresult rv = Init(imgsize.width, imgsize.height, aTrackRate);
         if (NS_FAILED(rv)) {
           LOG("[VideoTrackEncoder]: Fail to initialize the encoder!");
           NotifyCancel();

From d1bf402a3492e46690d4315ea181a24bdfb6e124 Mon Sep 17 00:00:00 2001
From: Jared Wein <jwein@mozilla.com>
Date: Fri, 13 Dec 2013 14:27:56 -0500
Subject: [PATCH 338/459] Bug 931891 - [Australis] Backed out bug 887515 and
 the followups (bug 896291, 909662, 896896). r=ttaubert

---
 browser/base/content/browser.js               |  36 ++----
 browser/base/content/browser.xul              |   3 +-
 browser/base/content/tabbrowser.xml           |  45 ++------
 browser/base/content/test/general/browser.ini |   2 -
 .../content/test/general/browser_bug887515.js |  75 ------------
 ...wser_bug896291_closeMaxSessionStoreTabs.js | 108 ------------------
 .../sessionstore/nsISessionStore.idl          |  16 +--
 .../RecentlyClosedTabsAndWindowsMenuUtils.jsm |   2 +-
 .../sessionstore/src/SessionStore.jsm         |  42 -------
 .../sessionstore/test/browser_345898.js       |   4 -
 .../tabview/test/browser_tabview_bug608037.js |   2 +-
 .../tabview/test/browser_tabview_bug624847.js |   4 +-
 .../tabview/test/browser_tabview_bug628270.js |   2 +-
 .../tabview/test/browser_tabview_bug706736.js |   2 +-
 browser/components/tabview/test/head.js       |   2 +-
 .../locales/en-US/chrome/browser/browser.dtd  |   5 -
 16 files changed, 27 insertions(+), 323 deletions(-)
 delete mode 100644 browser/base/content/test/general/browser_bug887515.js
 delete mode 100644 browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index b7adb8dde39b..a247de742b14 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -6101,33 +6101,16 @@ function undoCloseTab(aIndex) {
   if (gBrowser.tabs.length == 1 && isTabEmpty(gBrowser.selectedTab))
     blankTabToRemove = gBrowser.selectedTab;
 
-  let numberOfTabsToUndoClose = 0;
-  let index = Number(aIndex);
-
-
-  if (isNaN(index)) {
-    index = 0;
-    numberOfTabsToUndoClose = SessionStore.getNumberOfTabsClosedLast(window);
-  } else {
-    if (0 > index || index >= SessionStore.getClosedTabCount(window))
-      return null;
-    numberOfTabsToUndoClose = 1;
-  }
-
-  let tab = null;
-  while (numberOfTabsToUndoClose > 0 &&
-         numberOfTabsToUndoClose--) {
+  var tab = null;
+  if (SessionStore.getClosedTabCount(window) > (aIndex || 0)) {
     TabView.prepareUndoCloseTab(blankTabToRemove);
-    tab = SessionStore.undoCloseTab(window, index);
+    tab = SessionStore.undoCloseTab(window, aIndex || 0);
     TabView.afterUndoCloseTab();
-    if (blankTabToRemove) {
+
+    if (blankTabToRemove)
       gBrowser.removeTab(blankTabToRemove);
-      blankTabToRemove = null;
-    }
   }
 
-  // Reset the number of tabs closed last time to the default.
-  SessionStore.setNumberOfTabsClosedLast(window, 1);
   return tab;
 }
 
@@ -6950,13 +6933,8 @@ var TabContextMenu = {
       menuItem.disabled = disabled;
 
     // Session store
-    let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-    let closedTabCount = SessionStore.getNumberOfTabsClosedLast(window);
-    undoCloseTabElement.disabled = closedTabCount == 0;
-    // Change the label of "Undo Close Tab" to specify if it will undo a batch-close
-    // or a single close.
-    let visibleLabel = closedTabCount <= 1 ? "singletablabel" : "multipletablabel";
-    undoCloseTabElement.setAttribute("label", undoCloseTabElement.getAttribute(visibleLabel));
+    document.getElementById("context_undoCloseTab").disabled =
+      SessionStore.getClosedTabCount(window) == 0;
 
     // Only one of pin/unpin should be visible
     document.getElementById("context_pinTab").hidden = this.contextTab.pinned;
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index a32bd183a1dc..a7b821703ce8 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -115,8 +115,7 @@
                 oncommand="gBrowser.removeAllTabsBut(TabContextMenu.contextTab);"/>
       <menuseparator/>
       <menuitem id="context_undoCloseTab"
-                singletablabel="&undoCloseTab.label;"
-                multipletablabel="&undoCloseTabs.label;"
+                label="&undoCloseTab.label;"
                 accesskey="&undoCloseTab.accesskey;"
                 observes="History:UndoCloseTab"/>
       <menuitem id="context_closeTab" label="&closeTab.label;" accesskey="&closeTab.accesskey;"
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 8dab3c672dd3..36e641d99792 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1679,26 +1679,13 @@
               throw new Error("Invalid argument: " + aCloseTabs);
           }
 
-          let maxUndo =
-            Services.prefs.getIntPref("browser.sessionstore.max_tabs_undo");
-          let warnOnCloseOtherTabs =
-            Services.prefs.getBoolPref("browser.tabs.warnOnCloseOtherTabs");
-          let warnOnCloseWindow =
-            Services.prefs.getBoolPref("browser.tabs.warnOnClose");
-          let isWindowClosing = aCloseTabs == this.closingTabsEnum.ALL;
+          if (tabsToClose <= 1)
+            return true;
 
-          let skipWarning =
-            // 1) If there is only one tab to close, we'll never warn the user.
-            tabsToClose <= 1 ||
-            // 2) If the whole window is going to be closed, don't warn the
-            //    user if the user has browser.tabs.warnOnClose set to false.
-            (isWindowClosing && !warnOnCloseWindow) ||
-            // 3) If the number of tabs are less than the undo threshold
-            //    or if the user has specifically opted-in to ignoring
-            //    this warning via the warnOnCloseOtherTabs pref.
-            (!isWindowClosing && (!warnOnCloseOtherTabs ||
-                                            tabsToClose <= maxUndo));
-          if (skipWarning)
+          const pref = aCloseTabs == this.closingTabsEnum.ALL ?
+                       "browser.tabs.warnOnClose" : "browser.tabs.warnOnCloseOtherTabs";
+          var shouldPrompt = Services.prefs.getBoolPref(pref);
+          if (!shouldPrompt)
             return true;
 
           var ps = Services.prompt;
@@ -1722,16 +1709,14 @@
                          + (ps.BUTTON_TITLE_CANCEL * ps.BUTTON_POS_1),
                          bundle.getString("tabs.closeButtonMultiple"),
                          null, null,
-                         bundle.getString("tabs.closeWarningPromptMe"),
+                         aCloseTabs == this.closingTabsEnum.ALL ?
+                           bundle.getString("tabs.closeWarningPromptMe") : null,
                          warnOnClose);
           var reallyClose = (buttonPressed == 0);
 
           // don't set the pref unless they press OK and it's false
-          if (reallyClose && !warnOnClose.value) {
-            let pref = isWindowClosing ? "browser.tabs.warnOnClose" :
-                                         "browser.tabs.warnOnCloseOtherTabs";
+          if (aCloseTabs == this.closingTabsEnum.ALL && reallyClose && !warnOnClose.value)
             Services.prefs.setBoolPref(pref, false);
-          }
 
           return reallyClose;
         ]]>
@@ -1758,11 +1743,9 @@
           <![CDATA[
             if (this.warnAboutClosingTabs(this.closingTabsEnum.TO_END, aTab)) {
               let tabs = this.getTabsToTheEndFrom(aTab);
-              let numberOfTabsToClose = tabs.length;
-              for (let i = numberOfTabsToClose - 1; i >= 0; --i) {
+              for (let i = tabs.length - 1; i >= 0; --i) {
                 this.removeTab(tabs[i], {animate: true});
               }
-              SessionStore.setNumberOfTabsClosedLast(window, numberOfTabsToClose);
             }
           ]]>
         </body>
@@ -1779,14 +1762,10 @@
               let tabs = this.visibleTabs;
               this.selectedTab = aTab;
 
-              let closedTabs = 0;
               for (let i = tabs.length - 1; i >= 0; --i) {
-                if (tabs[i] != aTab && !tabs[i].pinned) {
+                if (tabs[i] != aTab && !tabs[i].pinned)
                   this.removeTab(tabs[i], {animate: true});
-                  closedTabs++;
-                }
               }
-              SessionStore.setNumberOfTabsClosedLast(window, closedTabs);
             }
           ]]>
         </body>
@@ -1815,8 +1794,6 @@
               var byMouse = aParams.byMouse;
             }
 
-            SessionStore.setNumberOfTabsClosedLast(window, 1);
-
             // Handle requests for synchronously removing an already
             // asynchronously closing tab.
             if (!animate &&
diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index bbc5eb6bc9a6..070a0d390bb4 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -229,8 +229,6 @@ run-if = toolkit == "cocoa"
 [browser_bug839103.js]
 [browser_bug880101.js]
 [browser_bug882977.js]
-[browser_bug887515.js]
-[browser_bug896291_closeMaxSessionStoreTabs.js]
 [browser_bug902156.js]
 [browser_bug906190.js]
 [browser_canonizeURL.js]
diff --git a/browser/base/content/test/general/browser_bug887515.js b/browser/base/content/test/general/browser_bug887515.js
deleted file mode 100644
index 48796162f4b9..000000000000
--- a/browser/base/content/test/general/browser_bug887515.js
+++ /dev/null
@@ -1,75 +0,0 @@
-function numClosedTabs()
-  SessionStore.getNumberOfTabsClosedLast(window);
-
-var originalTab;
-var tab1Loaded = false;
-var tab2Loaded = false;
-
-function verifyUndoMultipleClose() {
-  if (!tab1Loaded || !tab2Loaded)
-    return;
-
-  gBrowser.removeAllTabsBut(originalTab);
-  updateTabContextMenu();
-  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-  ok(!undoCloseTabElement.disabled, "Undo Close Tabs should be enabled.");
-  is(numClosedTabs(), 2, "There should be 2 closed tabs.");
-  is(gBrowser.tabs.length, 1, "There should only be 1 open tab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("multipletablabel"),
-     "The label should be showing that the command will restore multiple tabs");
-  undoCloseTab();
-
-  is(gBrowser.tabs.length, 3, "There should be 3 open tabs");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
-     "The label should be showing that the command will restore a single tab");
-
-  gBrowser.removeTabsToTheEndFrom(originalTab);
-  updateTabContextMenu();
-  ok(!undoCloseTabElement.disabled, "Undo Close Tabs should be enabled.");
-  is(numClosedTabs(), 2, "There should be 2 closed tabs.");
-  is(gBrowser.tabs.length, 1, "There should only be 1 open tab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("multipletablabel"),
-     "The label should be showing that the command will restore multiple tabs");
-
-  finish();
-}
-
-function test() {
-  waitForExplicitFinish();
-
-  Services.prefs.setBoolPref("browser.tabs.animate", false);
-  registerCleanupFunction(function() {
-    Services.prefs.clearUserPref("browser.tabs.animate");
-    originalTab.linkedBrowser.loadURI("about:blank");
-    originalTab = null;
-  });
-
-  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
-     "The label should be showing that the command will restore a single tab");
-
-  originalTab = gBrowser.selectedTab;
-  gBrowser.selectedBrowser.loadURI("http://mochi.test:8888/");
-  var tab1 = gBrowser.addTab("http://mochi.test:8888/");
-  var tab2 = gBrowser.addTab("http://mochi.test:8888/");
-  var browser1 = gBrowser.getBrowserForTab(tab1);
-  browser1.addEventListener("load", function onLoad1() {
-    browser1.removeEventListener("load", onLoad1, true);
-    tab1Loaded = true;
-    tab1 = null;
-
-    verifyUndoMultipleClose();
-  }, true);
-  var browser2 = gBrowser.getBrowserForTab(tab2);
-  browser2.addEventListener("load", function onLoad2() {
-    browser2.removeEventListener("load", onLoad2, true);
-    tab2Loaded = true;
-    tab2 = null;
-
-    verifyUndoMultipleClose();
-  }, true);
-}
diff --git a/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js b/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js
deleted file mode 100644
index 98f0b35ace17..000000000000
--- a/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js
+++ /dev/null
@@ -1,108 +0,0 @@
-function numClosedTabs()
-  Cc["@mozilla.org/browser/sessionstore;1"].
-    getService(Ci.nsISessionStore).
-    getNumberOfTabsClosedLast(window);
-
-let originalTab;
-let maxTabsUndo;
-let maxTabsUndoPlusOne;
-let acceptRemoveAllTabsDialogListener;
-let cancelRemoveAllTabsDialogListener;
-
-function test() {
-  waitForExplicitFinish();
-  Services.prefs.setBoolPref("browser.tabs.animate", false);
-
-  registerCleanupFunction(function() {
-    Services.prefs.clearUserPref("browser.tabs.animate");
-
-    originalTab.linkedBrowser.loadURI("about:blank");
-    originalTab = null;
-  });
-
-  // Creating and throwing away this tab guarantees that the
-  // number of tabs closed in the previous tab-close operation is 1.
-  let throwaway_tab = gBrowser.addTab("http://mochi.test:8888/");
-  gBrowser.removeTab(throwaway_tab);
-
-  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
-     "The label should be showing that the command will restore a single tab");
-
-  originalTab = gBrowser.selectedTab;
-  gBrowser.selectedBrowser.loadURI("http://mochi.test:8888/");
-
-  maxTabsUndo = Services.prefs.getIntPref("browser.sessionstore.max_tabs_undo");
-  maxTabsUndoPlusOne = maxTabsUndo + 1;
-  let numberOfTabsLoaded = 0;
-  for (let i = 0; i < maxTabsUndoPlusOne; i++) {
-    let tab = gBrowser.addTab("http://mochi.test:8888/");
-    let browser = gBrowser.getBrowserForTab(tab);
-    browser.addEventListener("load", function onLoad() {
-      browser.removeEventListener("load", onLoad, true);
-
-      if (++numberOfTabsLoaded == maxTabsUndoPlusOne)
-        verifyUndoMultipleClose();
-    }, true);
-  }
-}
-
-function verifyUndoMultipleClose() {
-  info("all tabs opened and loaded");
-  cancelRemoveAllTabsDialogListener = new WindowListener("chrome://global/content/commonDialog.xul", cancelRemoveAllTabsDialog);
-  Services.wm.addListener(cancelRemoveAllTabsDialogListener);
-  gBrowser.removeAllTabsBut(originalTab);
-}
-
-function cancelRemoveAllTabsDialog(domWindow) {
-  ok(true, "dialog appeared in response to multiple tab close action");
-  domWindow.document.documentElement.cancelDialog();
-  Services.wm.removeListener(cancelRemoveAllTabsDialogListener);
-
-  acceptRemoveAllTabsDialogListener = new WindowListener("chrome://global/content/commonDialog.xul", acceptRemoveAllTabsDialog);
-  Services.wm.addListener(acceptRemoveAllTabsDialogListener);
-  waitForCondition(function () gBrowser.tabs.length == 1 + maxTabsUndoPlusOne, function verifyCancel() {
-    is(gBrowser.tabs.length, 1 + maxTabsUndoPlusOne, /* The '1 +' is for the original tab */
-       "All tabs should still be open after the 'Cancel' option on the prompt is chosen");
-    gBrowser.removeAllTabsBut(originalTab);
-  }, "Waited too long to find that no tabs were closed.");
-}
-
-function acceptRemoveAllTabsDialog(domWindow) {
-  ok(true, "dialog appeared in response to multiple tab close action");
-  domWindow.document.documentElement.acceptDialog();
-  Services.wm.removeListener(acceptRemoveAllTabsDialogListener);
-
-  waitForCondition(function () gBrowser.tabs.length == 1, function verifyAccept() {
-    is(gBrowser.tabs.length, 1,
-       "All other tabs should be closed after the 'OK' option on the prompt is chosen");
-    finish();
-  }, "Waited too long for the other tabs to be closed.");
-}
-
-function WindowListener(aURL, aCallback) {
-  this.callback = aCallback;
-  this.url = aURL;
-}
-WindowListener.prototype = {
-  onOpenWindow: function(aXULWindow) {
-    var domWindow = aXULWindow.QueryInterface(Ci.nsIInterfaceRequestor)
-                              .getInterface(Ci.nsIDOMWindow);
-    var self = this;
-    domWindow.addEventListener("load", function() {
-      domWindow.removeEventListener("load", arguments.callee, false);
-
-      info("domWindow.document.location.href: " + domWindow.document.location.href);
-      if (domWindow.document.location.href != self.url)
-        return;
-
-      // Allow other window load listeners to execute before passing to callback
-      executeSoon(function() {
-        self.callback(domWindow);
-      });
-    }, false);
-  },
-  onCloseWindow: function(aXULWindow) {},
-  onWindowTitleChange: function(aXULWindow, aNewTitle) {}
-}
diff --git a/browser/components/sessionstore/nsISessionStore.idl b/browser/components/sessionstore/nsISessionStore.idl
index d11c6fe4001d..f8b9dca0923a 100644
--- a/browser/components/sessionstore/nsISessionStore.idl
+++ b/browser/components/sessionstore/nsISessionStore.idl
@@ -25,7 +25,7 @@ interface nsIDOMNode;
  * |gBrowser.tabContainer| such as e.g. |gBrowser.selectedTab|.
  */
 
-[scriptable, uuid(63a4d9f4-373f-11e3-a237-fa91a24410d2)]
+[scriptable, uuid(0c99811f-6c5f-4a78-9c31-2d266d714175)]
 interface nsISessionStore : nsISupports
 {
   /**
@@ -100,20 +100,6 @@ interface nsISessionStore : nsISupports
   nsIDOMNode duplicateTab(in nsIDOMWindow aWindow, in nsIDOMNode aTab,
                           [optional] in long aDelta);
 
-  /**
-   * Set the number of tabs that was closed during the last close-tabs
-   * operation. This helps us keep track of batch-close operations so
-   * we can restore multiple tabs at once.
-   */
-  void setNumberOfTabsClosedLast(in nsIDOMWindow aWindow, in unsigned long aNumber);
-
-  /**
-   * Get the number of tabs that was closed during the last close-tabs
-   * operation. This helps us keep track of batch-close operations so
-   * we can restore multiple tabs at once.
-   */
-  unsigned long getNumberOfTabsClosedLast(in nsIDOMWindow aWindow);
-
   /**
    * Get the number of restore-able tabs for a browser window
    */
diff --git a/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm b/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
index 98a738444d11..fdc2dee7d6f7 100644
--- a/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
+++ b/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
@@ -66,7 +66,7 @@ this.RecentlyClosedTabsAndWindowsMenuUtils = {
       let restoreAllTabs = fragment.appendChild(doc.createElementNS(kNSXUL, aTagName));
       restoreAllTabs.setAttribute("label", navigatorBundle.GetStringFromName("menuRestoreAllTabs.label"));
       restoreAllTabs.setAttribute("oncommand",
-              "for (var i = 0; i < " + closedTabs.length + "; i++) undoCloseTab(0);");
+              "for (var i = 0; i < " + closedTabs.length + "; i++) undoCloseTab();");
     }
     return fragment;
   },
diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 804541a7cab0..278c1889b098 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -193,14 +193,6 @@ this.SessionStore = {
     return SessionStoreInternal.duplicateTab(aWindow, aTab, aDelta);
   },
 
-  getNumberOfTabsClosedLast: function ss_getNumberOfTabsClosedLast(aWindow) {
-    return SessionStoreInternal.getNumberOfTabsClosedLast(aWindow);
-  },
-
-  setNumberOfTabsClosedLast: function ss_setNumberOfTabsClosedLast(aWindow, aNumber) {
-    return SessionStoreInternal.setNumberOfTabsClosedLast(aWindow, aNumber);
-  },
-
   getClosedTabCount: function ss_getClosedTabCount(aWindow) {
     return SessionStoreInternal.getClosedTabCount(aWindow);
   },
@@ -1616,35 +1608,6 @@ let SessionStoreInternal = {
     return newTab;
   },
 
-  setNumberOfTabsClosedLast: function ssi_setNumberOfTabsClosedLast(aWindow, aNumber) {
-    if (this._disabledForMultiProcess) {
-      return;
-    }
-
-    if (!("__SSi" in aWindow)) {
-      throw Components.Exception("Window is not tracked", Cr.NS_ERROR_INVALID_ARG);
-    }
-
-    return NumberOfTabsClosedLastPerWindow.set(aWindow, aNumber);
-  },
-
-  /* Used to undo batch tab-close operations. Defaults to 1. */
-  getNumberOfTabsClosedLast: function ssi_getNumberOfTabsClosedLast(aWindow) {
-    if (this._disabledForMultiProcess) {
-      return 0;
-    }
-
-    if (!("__SSi" in aWindow)) {
-      throw Components.Exception("Window is not tracked", Cr.NS_ERROR_INVALID_ARG);
-    }
-    // Blank tabs cannot be undo-closed, so the number returned by
-    // the NumberOfTabsClosedLastPerWindow can be greater than the
-    // return value of getClosedTabCount. We won't restore blank
-    // tabs, so we return the minimum of these two values.
-    return Math.min(NumberOfTabsClosedLastPerWindow.get(aWindow) || 1,
-                    this.getClosedTabCount(aWindow));
-  },
-
   getClosedTabCount: function ssi_getClosedTabCount(aWindow) {
     if ("__SSi" in aWindow) {
       return this._windows[aWindow.__SSi]._closedTabs.length;
@@ -4029,11 +3992,6 @@ let DirtyWindows = {
   }
 };
 
-// A map storing the number of tabs last closed per windoow. This only
-// stores the most recent tab-close operation, and is used to undo
-// batch tab-closing operations.
-let NumberOfTabsClosedLastPerWindow = new WeakMap();
-
 // This is used to help meter the number of restoring tabs. This is the control
 // point for telling the next tab to restore. It gets attached to each gBrowser
 // via gBrowser.addTabsProgressListener
diff --git a/browser/components/sessionstore/test/browser_345898.js b/browser/components/sessionstore/test/browser_345898.js
index e5f3a1fe80b1..c4dc7fbb4320 100644
--- a/browser/components/sessionstore/test/browser_345898.js
+++ b/browser/components/sessionstore/test/browser_345898.js
@@ -40,8 +40,4 @@ function test() {
      "Invalid window for getWindowValue throws");
   ok(test(function() ss.setWindowValue({}, "", "")),
      "Invalid window for setWindowValue throws");
-  ok(test(function() ss.getNumberOfTabsClosedLast({})),
-     "Invalid window for getNumberOfTabsClosedLast  throws");
-  ok(test(function() ss.setNumberOfTabsClosedLast({}, 1)),
-     "Invalid window for setNumberOfTabsClosedLast throws");
 }
diff --git a/browser/components/tabview/test/browser_tabview_bug608037.js b/browser/components/tabview/test/browser_tabview_bug608037.js
index a85e3aed99c8..8e02d611feda 100644
--- a/browser/components/tabview/test/browser_tabview_bug608037.js
+++ b/browser/components/tabview/test/browser_tabview_bug608037.js
@@ -38,5 +38,5 @@ function onTabViewWindowLoaded() {
       gBrowser.removeTab(tabTwo);
       finish();
     });
-  }, 0);
+  });
 }
diff --git a/browser/components/tabview/test/browser_tabview_bug624847.js b/browser/components/tabview/test/browser_tabview_bug624847.js
index e91430fd2812..bc5cac4a0d4d 100644
--- a/browser/components/tabview/test/browser_tabview_bug624847.js
+++ b/browser/components/tabview/test/browser_tabview_bug624847.js
@@ -64,7 +64,7 @@ function test() {
 
         createBlankTab();
         afterAllTabsLoaded(testUndoCloseWithSelectedBlankPinnedTab);
-      }, 0);
+      });
     });
   }
 
@@ -94,7 +94,7 @@ function test() {
         gBrowser.removeTab(gBrowser.tabs[0]);
 
         afterAllTabsLoaded(finishTest);
-      }, 0);
+      });
     });
   }
 
diff --git a/browser/components/tabview/test/browser_tabview_bug628270.js b/browser/components/tabview/test/browser_tabview_bug628270.js
index c64c2e58416c..4887c88a5939 100644
--- a/browser/components/tabview/test/browser_tabview_bug628270.js
+++ b/browser/components/tabview/test/browser_tabview_bug628270.js
@@ -81,7 +81,7 @@ function test() {
       gBrowser.removeTab(gBrowser.tabs[1]);
       gBrowser.removeTab(gBrowser.tabs[1]);
       hideTabView(finishTest);
-    }, 0);
+    });
   }
 
   waitForExplicitFinish();
diff --git a/browser/components/tabview/test/browser_tabview_bug706736.js b/browser/components/tabview/test/browser_tabview_bug706736.js
index f47a7d3c5e85..60a1509d2d94 100644
--- a/browser/components/tabview/test/browser_tabview_bug706736.js
+++ b/browser/components/tabview/test/browser_tabview_bug706736.js
@@ -20,7 +20,7 @@ function test() {
     whenTabViewIsHidden(function() {
       win.gBrowser.removeTab(win.gBrowser.selectedTab);
       executeSoon(function() {
-        win.undoCloseTab(0);
+        win.undoCloseTab();
 
         groupItemTwo.addSubscriber("childAdded", function onChildAdded(data) {
           groupItemTwo.removeSubscriber("childAdded", onChildAdded);
diff --git a/browser/components/tabview/test/head.js b/browser/components/tabview/test/head.js
index 61eb5948c169..d5d9679c434f 100644
--- a/browser/components/tabview/test/head.js
+++ b/browser/components/tabview/test/head.js
@@ -362,7 +362,7 @@ function newWindowWithState(state, callback) {
 function restoreTab(callback, index, win) {
   win = win || window;
 
-  let tab = win.undoCloseTab(index);
+  let tab = win.undoCloseTab(index || 0);
   let tabItem = tab._tabViewTabItem;
 
   let finalize = function () {
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index 27b0d1375a89..0b5ff9e58b5f 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -49,11 +49,6 @@ can reach it easily. -->
 <!ENTITY  bookmarkAllTabs.accesskey          "T">
 <!ENTITY  undoCloseTab.label                 "Undo Close Tab">
 <!ENTITY  undoCloseTab.accesskey             "U">
-<!-- LOCALIZATION NOTE (undoCloseTabs.label) : This label is used
-when the previous tab-closing operation closed more than one tab. It
-replaces the undoCloseTab.label and will use the same accesskey as the
-undoCloseTab.label so users will not need to learn new keyboard controls. -->
-<!ENTITY  undoCloseTabs.label                "Undo Close Tabs">
 <!ENTITY  closeTab.label                     "Close Tab">
 <!ENTITY  closeTab.accesskey                 "c">
 

From f6dea06b20060121218d35492f9f2751912046cd Mon Sep 17 00:00:00 2001
From: Victor Porof <vporof@mozilla.com>
Date: Fri, 13 Dec 2013 22:28:04 +0200
Subject: [PATCH 339/459] Bug 948893 - Hovering certain bounds in a HTML source
 while paused in the debugger can sometimes incorrectly show a variable
 inspection popup, r=past

---
 browser/devtools/debugger/debugger-panes.js   |  6 +++-
 browser/devtools/debugger/test/browser.ini    |  2 ++
 .../debugger/test/browser_dbg_parser-03.js    | 34 +++++++++---------
 .../debugger/test/browser_dbg_parser-04.js    |  6 ++--
 .../debugger/test/browser_dbg_parser-05.js    |  6 ++--
 .../browser_dbg_variables-view-popup-09.js    | 33 +++++++++++++++++
 .../debugger/test/doc_scope-variable-3.html   | 23 ++++++++++++
 browser/devtools/shared/Parser.jsm            | 35 +++++++++++++------
 8 files changed, 111 insertions(+), 34 deletions(-)
 create mode 100644 browser/devtools/debugger/test/browser_dbg_variables-view-popup-09.js
 create mode 100644 browser/devtools/debugger/test/doc_scope-variable-3.html

diff --git a/browser/devtools/debugger/debugger-panes.js b/browser/devtools/debugger/debugger-panes.js
index 64bd229c7715..352f6fdfd339 100644
--- a/browser/devtools/debugger/debugger-panes.js
+++ b/browser/devtools/debugger/debugger-panes.js
@@ -1357,7 +1357,11 @@ VariableBubbleView.prototype = {
 
     let scriptLine = hoveredLine - scriptLineOffset;
     let scriptColumn = hoveredColumn - scriptColumnOffset;
-    let identifierInfo = parsedSource.getIdentifierAt(scriptLine + 1, scriptColumn);
+    let identifierInfo = parsedSource.getIdentifierAt({
+      line: scriptLine + 1,
+      column: scriptColumn,
+      scriptIndex: scriptInfo.index
+    });
 
     // If the info is null, we're not hovering any identifier.
     if (!identifierInfo) {
diff --git a/browser/devtools/debugger/test/browser.ini b/browser/devtools/debugger/test/browser.ini
index 18c0e06dc624..47e9eeafdbfb 100644
--- a/browser/devtools/debugger/test/browser.ini
+++ b/browser/devtools/debugger/test/browser.ini
@@ -52,6 +52,7 @@ support-files =
   doc_recursion-stack.html
   doc_scope-variable.html
   doc_scope-variable-2.html
+  doc_scope-variable-3.html
   doc_script-switching-01.html
   doc_script-switching-02.html
   doc_step-out.html
@@ -222,6 +223,7 @@ support-files =
 [browser_dbg_variables-view-popup-06.js]
 [browser_dbg_variables-view-popup-07.js]
 [browser_dbg_variables-view-popup-08.js]
+[browser_dbg_variables-view-popup-09.js]
 [browser_dbg_variables-view-reexpand-01.js]
 [browser_dbg_variables-view-reexpand-02.js]
 [browser_dbg_variables-view-webidl.js]
diff --git a/browser/devtools/debugger/test/browser_dbg_parser-03.js b/browser/devtools/debugger/test/browser_dbg_parser-03.js
index f206b8cce3b4..a4c0fce91681 100644
--- a/browser/devtools/debugger/test/browser_dbg_parser-03.js
+++ b/browser/devtools/debugger/test/browser_dbg_parser-03.js
@@ -33,44 +33,44 @@ function test() {
   is(parsed.scriptCount, 3,
     "There should be 3 scripts parsed in the parent HTML source.");
 
-  is(parsed.getScriptInfo(0).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(0).toSource(), "({start:-1, length:-1, index:-1})",
     "There is no script at the beginning of the parent source.");
-  is(parsed.getScriptInfo(source.length - 1).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.length - 1).toSource(), "({start:-1, length:-1, index:-1})",
     "There is no script at the end of the parent source.");
 
-  is(parsed.getScriptInfo(source.indexOf("let a")).toSource(), "({start:31, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let a")).toSource(), "({start:31, length:13, index:0})",
     "The first script was located correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let b")).toSource(), "({start:85, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let b")).toSource(), "({start:85, length:13, index:1})",
     "The second script was located correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let c")).toSource(), "({start:151, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let c")).toSource(), "({start:151, length:13, index:2})",
     "The third script was located correctly.");
 
-  is(parsed.getScriptInfo(source.indexOf("let a") - 1).toSource(), "({start:31, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let a") - 1).toSource(), "({start:31, length:13, index:0})",
     "The left edge of the first script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let b") - 1).toSource(), "({start:85, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let b") - 1).toSource(), "({start:85, length:13, index:1})",
     "The left edge of the second script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let c") - 1).toSource(), "({start:151, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let c") - 1).toSource(), "({start:151, length:13, index:2})",
     "The left edge of the third script was interpreted correctly.");
 
-  is(parsed.getScriptInfo(source.indexOf("let a") - 2).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let a") - 2).toSource(), "({start:-1, length:-1, index:-1})",
     "The left outside of the first script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let b") - 2).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let b") - 2).toSource(), "({start:-1, length:-1, index:-1})",
     "The left outside of the second script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let c") - 2).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let c") - 2).toSource(), "({start:-1, length:-1, index:-1})",
     "The left outside of the third script was interpreted correctly.");
 
-  is(parsed.getScriptInfo(source.indexOf("let a") + 12).toSource(), "({start:31, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let a") + 12).toSource(), "({start:31, length:13, index:0})",
     "The right edge of the first script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let b") + 12).toSource(), "({start:85, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let b") + 12).toSource(), "({start:85, length:13, index:1})",
     "The right edge of the second script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let c") + 12).toSource(), "({start:151, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let c") + 12).toSource(), "({start:151, length:13, index:2})",
     "The right edge of the third script was interpreted correctly.");
 
-  is(parsed.getScriptInfo(source.indexOf("let a") + 13).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let a") + 13).toSource(), "({start:-1, length:-1, index:-1})",
     "The right outside of the first script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let b") + 13).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let b") + 13).toSource(), "({start:-1, length:-1, index:-1})",
     "The right outside of the second script was interpreted correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let c") + 13).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let c") + 13).toSource(), "({start:-1, length:-1, index:-1})",
     "The right outside of the third script was interpreted correctly.");
 
   finish();
diff --git a/browser/devtools/debugger/test/browser_dbg_parser-04.js b/browser/devtools/debugger/test/browser_dbg_parser-04.js
index 82db773cdf75..2ef653bf367d 100644
--- a/browser/devtools/debugger/test/browser_dbg_parser-04.js
+++ b/browser/devtools/debugger/test/browser_dbg_parser-04.js
@@ -43,11 +43,11 @@ function test() {
   is(parsed.scriptCount, 1,
     "There should be 1 script parsed in the parent HTML source.");
 
-  is(parsed.getScriptInfo(source.indexOf("let a")).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let a")).toSource(), "({start:-1, length:-1, index:-1})",
     "The first script shouldn't be considered valid.");
-  is(parsed.getScriptInfo(source.indexOf("let b")).toSource(), "({start:85, length:13})",
+  is(parsed.getScriptInfo(source.indexOf("let b")).toSource(), "({start:85, length:13, index:0})",
     "The second script was located correctly.");
-  is(parsed.getScriptInfo(source.indexOf("let c")).toSource(), "({start:-1, length:-1})",
+  is(parsed.getScriptInfo(source.indexOf("let c")).toSource(), "({start:-1, length:-1, index:-1})",
     "The third script shouldn't be considered valid.");
 
   finish();
diff --git a/browser/devtools/debugger/test/browser_dbg_parser-05.js b/browser/devtools/debugger/test/browser_dbg_parser-05.js
index ef5988745228..4c1d935a269f 100644
--- a/browser/devtools/debugger/test/browser_dbg_parser-05.js
+++ b/browser/devtools/debugger/test/browser_dbg_parser-05.js
@@ -32,11 +32,11 @@ function test() {
   is(parsed.scriptCount, 1,
     "There should be 1 script parsed in the parent source.");
 
-  is(parsed.getScriptInfo(source.indexOf("let a")).toSource(), "({start:0, length:261})",
+  is(parsed.getScriptInfo(source.indexOf("let a")).toSource(), "({start:0, length:261, index:0})",
     "The script location is correct (1).");
-  is(parsed.getScriptInfo(source.indexOf("<script>")).toSource(), "({start:0, length:261})",
+  is(parsed.getScriptInfo(source.indexOf("<script>")).toSource(), "({start:0, length:261, index:0})",
     "The script location is correct (2).");
-  is(parsed.getScriptInfo(source.indexOf("</script>")).toSource(), "({start:0, length:261})",
+  is(parsed.getScriptInfo(source.indexOf("</script>")).toSource(), "({start:0, length:261, index:0})",
     "The script location is correct (3).");
 
   finish();
diff --git a/browser/devtools/debugger/test/browser_dbg_variables-view-popup-09.js b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-09.js
new file mode 100644
index 000000000000..0a58983e3307
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_variables-view-popup-09.js
@@ -0,0 +1,33 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Tests opening inspecting variables works across scopes.
+ */
+
+const TAB_URL = EXAMPLE_URL + "doc_scope-variable-3.html";
+
+function test() {
+  Task.spawn(function() {
+    let [tab, debuggee, panel] = yield initDebugger(TAB_URL);
+    let win = panel.panelWin;
+    let bubble = win.DebuggerView.VariableBubble;
+    let tooltip = bubble._tooltip.panel;
+
+    // Allow this generator function to yield first.
+    executeSoon(() => debuggee.test());
+    yield waitForSourceAndCaretAndScopes(panel, ".html", 15);
+
+    yield openVarPopup(panel, { line: 12, ch: 10 });
+    ok(true, "The variable inspection popup was shown for the real variable.");
+
+    once(tooltip, "popupshown").then(() => {
+      ok(false, "The variable inspection popup shouldn't have been opened.");
+    });
+
+    reopenVarPopup(panel, { line: 18, ch: 10 });
+    yield waitForTime(1000);
+
+    yield resumeDebuggerThenCloseAndFinish(panel);
+  });
+}
diff --git a/browser/devtools/debugger/test/doc_scope-variable-3.html b/browser/devtools/debugger/test/doc_scope-variable-3.html
new file mode 100644
index 000000000000..fcd45cc0aa97
--- /dev/null
+++ b/browser/devtools/debugger/test/doc_scope-variable-3.html
@@ -0,0 +1,23 @@
+<!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+<!doctype html>
+
+<html>
+  <head>
+    <meta charset="utf-8"/>
+    <title>Debugger test page</title>
+  </head>
+
+  <body>
+    <script type="text/javascript">
+      var trap = "first script";
+      function test() {
+        debugger;
+      }
+    </script>
+    <script type="text/javascript">/*
+          trololol
+  */</script>
+  </body>
+
+</html>
diff --git a/browser/devtools/shared/Parser.jsm b/browser/devtools/shared/Parser.jsm
index ebf4b32f8366..822e95f3879f 100644
--- a/browser/devtools/shared/Parser.jsm
+++ b/browser/devtools/shared/Parser.jsm
@@ -132,15 +132,15 @@ SyntaxTreesPool.prototype = {
   /**
    * @see SyntaxTree.prototype.getIdentifierAt
    */
-  getIdentifierAt: function(aLine, aColumn) {
-    return this._first(this._call("getIdentifierAt", aLine, aColumn));
+  getIdentifierAt: function({ line, column, scriptIndex }) {
+    return this._first(this._call("getIdentifierAt", scriptIndex, line, column));
   },
 
   /**
    * @see SyntaxTree.prototype.getNamedFunctionDefinitions
    */
   getNamedFunctionDefinitions: function(aSubstring) {
-    return this._call("getNamedFunctionDefinitions", aSubstring);
+    return this._call("getNamedFunctionDefinitions", -1, aSubstring);
   },
 
   /**
@@ -161,12 +161,19 @@ SyntaxTreesPool.prototype = {
    *         The offset and length relative to the enclosing script.
    */
   getScriptInfo: function(aOffset) {
+    let info = { start: -1, length: -1, index: -1 };
+
     for (let { offset, length } of this._trees) {
-      if (offset <= aOffset &&  offset + length >= aOffset) {
-        return { start: offset, length: length };
+      info.index++;
+      if (offset <= aOffset && offset + length >= aOffset) {
+        info.start = offset;
+        info.length = length;
+        return info;
       }
     }
-    return { start: -1, length: -1 };
+
+    info.index = -1;
+    return info;
   },
 
   /**
@@ -182,23 +189,31 @@ SyntaxTreesPool.prototype = {
   },
 
   /**
-   * Handles a request for all known syntax trees.
+   * Handles a request for a specific or all known syntax trees.
    *
    * @param string aFunction
    *        The function name to call on the SyntaxTree instances.
+   * @param number aSyntaxTreeIndex
+   *        The syntax tree for which to handle the request. If the tree at
+   *        the specified index isn't found, the accumulated results for all
+   *        syntax trees are returned.
    * @param any aParams
    *        Any kind params to pass to the request function.
    * @return array
    *         The results given by all known syntax trees.
    */
-  _call: function(aFunction, ...aParams) {
+  _call: function(aFunction, aSyntaxTreeIndex, ...aParams) {
     let results = [];
-    let requestId = aFunction + aParams.toSource(); // Cache all the things!
+    let requestId = [aFunction, aSyntaxTreeIndex, aParams].toSource();
 
     if (this._cache.has(requestId)) {
       return this._cache.get(requestId);
     }
-    for (let syntaxTree of this._trees) {
+
+    let requestedTree = this._trees[aSyntaxTreeIndex];
+    let targettedTrees = requestedTree ? [requestedTree] : this._trees;
+
+    for (let syntaxTree of targettedTrees) {
       try {
         results.push({
           sourceUrl: syntaxTree.url,

From d049d3bf34e76b2cd05f715a563983942b183515 Mon Sep 17 00:00:00 2001
From: Jared Wein <jwein@mozilla.com>
Date: Fri, 13 Dec 2013 15:57:31 -0500
Subject: [PATCH 340/459] Backed out changeset 1566f020e34e (bug 931891) for
 timing out some mochitest-bc tests on a CLOSED TREE

--HG--
extra : rebase_source : 423f491a0bedebfd9350167340d6f65d275a64cd
---
 browser/base/content/browser.js               |  40 +++++--
 browser/base/content/browser.xul              |   3 +-
 browser/base/content/tabbrowser.xml           |  45 ++++++--
 browser/base/content/test/general/browser.ini |   2 +
 .../content/test/general/browser_bug887515.js |  75 ++++++++++++
 ...wser_bug896291_closeMaxSessionStoreTabs.js | 108 ++++++++++++++++++
 .../sessionstore/nsISessionStore.idl          |  16 ++-
 .../RecentlyClosedTabsAndWindowsMenuUtils.jsm |   2 +-
 .../sessionstore/src/SessionStore.jsm         |  42 +++++++
 .../sessionstore/test/browser_345898.js       |   4 +
 .../tabview/test/browser_tabview_bug608037.js |   2 +-
 .../tabview/test/browser_tabview_bug624847.js |   4 +-
 .../tabview/test/browser_tabview_bug628270.js |   2 +-
 .../tabview/test/browser_tabview_bug706736.js |   2 +-
 browser/components/tabview/test/head.js       |   2 +-
 .../locales/en-US/chrome/browser/browser.dtd  |   5 +
 16 files changed, 325 insertions(+), 29 deletions(-)
 create mode 100644 browser/base/content/test/general/browser_bug887515.js
 create mode 100644 browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index a247de742b14..b7adb8dde39b 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -6101,16 +6101,33 @@ function undoCloseTab(aIndex) {
   if (gBrowser.tabs.length == 1 && isTabEmpty(gBrowser.selectedTab))
     blankTabToRemove = gBrowser.selectedTab;
 
-  var tab = null;
-  if (SessionStore.getClosedTabCount(window) > (aIndex || 0)) {
-    TabView.prepareUndoCloseTab(blankTabToRemove);
-    tab = SessionStore.undoCloseTab(window, aIndex || 0);
-    TabView.afterUndoCloseTab();
+  let numberOfTabsToUndoClose = 0;
+  let index = Number(aIndex);
 
-    if (blankTabToRemove)
-      gBrowser.removeTab(blankTabToRemove);
+
+  if (isNaN(index)) {
+    index = 0;
+    numberOfTabsToUndoClose = SessionStore.getNumberOfTabsClosedLast(window);
+  } else {
+    if (0 > index || index >= SessionStore.getClosedTabCount(window))
+      return null;
+    numberOfTabsToUndoClose = 1;
   }
 
+  let tab = null;
+  while (numberOfTabsToUndoClose > 0 &&
+         numberOfTabsToUndoClose--) {
+    TabView.prepareUndoCloseTab(blankTabToRemove);
+    tab = SessionStore.undoCloseTab(window, index);
+    TabView.afterUndoCloseTab();
+    if (blankTabToRemove) {
+      gBrowser.removeTab(blankTabToRemove);
+      blankTabToRemove = null;
+    }
+  }
+
+  // Reset the number of tabs closed last time to the default.
+  SessionStore.setNumberOfTabsClosedLast(window, 1);
   return tab;
 }
 
@@ -6933,8 +6950,13 @@ var TabContextMenu = {
       menuItem.disabled = disabled;
 
     // Session store
-    document.getElementById("context_undoCloseTab").disabled =
-      SessionStore.getClosedTabCount(window) == 0;
+    let undoCloseTabElement = document.getElementById("context_undoCloseTab");
+    let closedTabCount = SessionStore.getNumberOfTabsClosedLast(window);
+    undoCloseTabElement.disabled = closedTabCount == 0;
+    // Change the label of "Undo Close Tab" to specify if it will undo a batch-close
+    // or a single close.
+    let visibleLabel = closedTabCount <= 1 ? "singletablabel" : "multipletablabel";
+    undoCloseTabElement.setAttribute("label", undoCloseTabElement.getAttribute(visibleLabel));
 
     // Only one of pin/unpin should be visible
     document.getElementById("context_pinTab").hidden = this.contextTab.pinned;
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index a7b821703ce8..a32bd183a1dc 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -115,7 +115,8 @@
                 oncommand="gBrowser.removeAllTabsBut(TabContextMenu.contextTab);"/>
       <menuseparator/>
       <menuitem id="context_undoCloseTab"
-                label="&undoCloseTab.label;"
+                singletablabel="&undoCloseTab.label;"
+                multipletablabel="&undoCloseTabs.label;"
                 accesskey="&undoCloseTab.accesskey;"
                 observes="History:UndoCloseTab"/>
       <menuitem id="context_closeTab" label="&closeTab.label;" accesskey="&closeTab.accesskey;"
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 36e641d99792..8dab3c672dd3 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1679,13 +1679,26 @@
               throw new Error("Invalid argument: " + aCloseTabs);
           }
 
-          if (tabsToClose <= 1)
-            return true;
+          let maxUndo =
+            Services.prefs.getIntPref("browser.sessionstore.max_tabs_undo");
+          let warnOnCloseOtherTabs =
+            Services.prefs.getBoolPref("browser.tabs.warnOnCloseOtherTabs");
+          let warnOnCloseWindow =
+            Services.prefs.getBoolPref("browser.tabs.warnOnClose");
+          let isWindowClosing = aCloseTabs == this.closingTabsEnum.ALL;
 
-          const pref = aCloseTabs == this.closingTabsEnum.ALL ?
-                       "browser.tabs.warnOnClose" : "browser.tabs.warnOnCloseOtherTabs";
-          var shouldPrompt = Services.prefs.getBoolPref(pref);
-          if (!shouldPrompt)
+          let skipWarning =
+            // 1) If there is only one tab to close, we'll never warn the user.
+            tabsToClose <= 1 ||
+            // 2) If the whole window is going to be closed, don't warn the
+            //    user if the user has browser.tabs.warnOnClose set to false.
+            (isWindowClosing && !warnOnCloseWindow) ||
+            // 3) If the number of tabs are less than the undo threshold
+            //    or if the user has specifically opted-in to ignoring
+            //    this warning via the warnOnCloseOtherTabs pref.
+            (!isWindowClosing && (!warnOnCloseOtherTabs ||
+                                            tabsToClose <= maxUndo));
+          if (skipWarning)
             return true;
 
           var ps = Services.prompt;
@@ -1709,14 +1722,16 @@
                          + (ps.BUTTON_TITLE_CANCEL * ps.BUTTON_POS_1),
                          bundle.getString("tabs.closeButtonMultiple"),
                          null, null,
-                         aCloseTabs == this.closingTabsEnum.ALL ?
-                           bundle.getString("tabs.closeWarningPromptMe") : null,
+                         bundle.getString("tabs.closeWarningPromptMe"),
                          warnOnClose);
           var reallyClose = (buttonPressed == 0);
 
           // don't set the pref unless they press OK and it's false
-          if (aCloseTabs == this.closingTabsEnum.ALL && reallyClose && !warnOnClose.value)
+          if (reallyClose && !warnOnClose.value) {
+            let pref = isWindowClosing ? "browser.tabs.warnOnClose" :
+                                         "browser.tabs.warnOnCloseOtherTabs";
             Services.prefs.setBoolPref(pref, false);
+          }
 
           return reallyClose;
         ]]>
@@ -1743,9 +1758,11 @@
           <![CDATA[
             if (this.warnAboutClosingTabs(this.closingTabsEnum.TO_END, aTab)) {
               let tabs = this.getTabsToTheEndFrom(aTab);
-              for (let i = tabs.length - 1; i >= 0; --i) {
+              let numberOfTabsToClose = tabs.length;
+              for (let i = numberOfTabsToClose - 1; i >= 0; --i) {
                 this.removeTab(tabs[i], {animate: true});
               }
+              SessionStore.setNumberOfTabsClosedLast(window, numberOfTabsToClose);
             }
           ]]>
         </body>
@@ -1762,10 +1779,14 @@
               let tabs = this.visibleTabs;
               this.selectedTab = aTab;
 
+              let closedTabs = 0;
               for (let i = tabs.length - 1; i >= 0; --i) {
-                if (tabs[i] != aTab && !tabs[i].pinned)
+                if (tabs[i] != aTab && !tabs[i].pinned) {
                   this.removeTab(tabs[i], {animate: true});
+                  closedTabs++;
+                }
               }
+              SessionStore.setNumberOfTabsClosedLast(window, closedTabs);
             }
           ]]>
         </body>
@@ -1794,6 +1815,8 @@
               var byMouse = aParams.byMouse;
             }
 
+            SessionStore.setNumberOfTabsClosedLast(window, 1);
+
             // Handle requests for synchronously removing an already
             // asynchronously closing tab.
             if (!animate &&
diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index 070a0d390bb4..bbc5eb6bc9a6 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -229,6 +229,8 @@ run-if = toolkit == "cocoa"
 [browser_bug839103.js]
 [browser_bug880101.js]
 [browser_bug882977.js]
+[browser_bug887515.js]
+[browser_bug896291_closeMaxSessionStoreTabs.js]
 [browser_bug902156.js]
 [browser_bug906190.js]
 [browser_canonizeURL.js]
diff --git a/browser/base/content/test/general/browser_bug887515.js b/browser/base/content/test/general/browser_bug887515.js
new file mode 100644
index 000000000000..48796162f4b9
--- /dev/null
+++ b/browser/base/content/test/general/browser_bug887515.js
@@ -0,0 +1,75 @@
+function numClosedTabs()
+  SessionStore.getNumberOfTabsClosedLast(window);
+
+var originalTab;
+var tab1Loaded = false;
+var tab2Loaded = false;
+
+function verifyUndoMultipleClose() {
+  if (!tab1Loaded || !tab2Loaded)
+    return;
+
+  gBrowser.removeAllTabsBut(originalTab);
+  updateTabContextMenu();
+  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
+  ok(!undoCloseTabElement.disabled, "Undo Close Tabs should be enabled.");
+  is(numClosedTabs(), 2, "There should be 2 closed tabs.");
+  is(gBrowser.tabs.length, 1, "There should only be 1 open tab");
+  updateTabContextMenu();
+  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("multipletablabel"),
+     "The label should be showing that the command will restore multiple tabs");
+  undoCloseTab();
+
+  is(gBrowser.tabs.length, 3, "There should be 3 open tabs");
+  updateTabContextMenu();
+  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
+     "The label should be showing that the command will restore a single tab");
+
+  gBrowser.removeTabsToTheEndFrom(originalTab);
+  updateTabContextMenu();
+  ok(!undoCloseTabElement.disabled, "Undo Close Tabs should be enabled.");
+  is(numClosedTabs(), 2, "There should be 2 closed tabs.");
+  is(gBrowser.tabs.length, 1, "There should only be 1 open tab");
+  updateTabContextMenu();
+  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("multipletablabel"),
+     "The label should be showing that the command will restore multiple tabs");
+
+  finish();
+}
+
+function test() {
+  waitForExplicitFinish();
+
+  Services.prefs.setBoolPref("browser.tabs.animate", false);
+  registerCleanupFunction(function() {
+    Services.prefs.clearUserPref("browser.tabs.animate");
+    originalTab.linkedBrowser.loadURI("about:blank");
+    originalTab = null;
+  });
+
+  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
+  updateTabContextMenu();
+  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
+     "The label should be showing that the command will restore a single tab");
+
+  originalTab = gBrowser.selectedTab;
+  gBrowser.selectedBrowser.loadURI("http://mochi.test:8888/");
+  var tab1 = gBrowser.addTab("http://mochi.test:8888/");
+  var tab2 = gBrowser.addTab("http://mochi.test:8888/");
+  var browser1 = gBrowser.getBrowserForTab(tab1);
+  browser1.addEventListener("load", function onLoad1() {
+    browser1.removeEventListener("load", onLoad1, true);
+    tab1Loaded = true;
+    tab1 = null;
+
+    verifyUndoMultipleClose();
+  }, true);
+  var browser2 = gBrowser.getBrowserForTab(tab2);
+  browser2.addEventListener("load", function onLoad2() {
+    browser2.removeEventListener("load", onLoad2, true);
+    tab2Loaded = true;
+    tab2 = null;
+
+    verifyUndoMultipleClose();
+  }, true);
+}
diff --git a/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js b/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js
new file mode 100644
index 000000000000..98f0b35ace17
--- /dev/null
+++ b/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js
@@ -0,0 +1,108 @@
+function numClosedTabs()
+  Cc["@mozilla.org/browser/sessionstore;1"].
+    getService(Ci.nsISessionStore).
+    getNumberOfTabsClosedLast(window);
+
+let originalTab;
+let maxTabsUndo;
+let maxTabsUndoPlusOne;
+let acceptRemoveAllTabsDialogListener;
+let cancelRemoveAllTabsDialogListener;
+
+function test() {
+  waitForExplicitFinish();
+  Services.prefs.setBoolPref("browser.tabs.animate", false);
+
+  registerCleanupFunction(function() {
+    Services.prefs.clearUserPref("browser.tabs.animate");
+
+    originalTab.linkedBrowser.loadURI("about:blank");
+    originalTab = null;
+  });
+
+  // Creating and throwing away this tab guarantees that the
+  // number of tabs closed in the previous tab-close operation is 1.
+  let throwaway_tab = gBrowser.addTab("http://mochi.test:8888/");
+  gBrowser.removeTab(throwaway_tab);
+
+  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
+  updateTabContextMenu();
+  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
+     "The label should be showing that the command will restore a single tab");
+
+  originalTab = gBrowser.selectedTab;
+  gBrowser.selectedBrowser.loadURI("http://mochi.test:8888/");
+
+  maxTabsUndo = Services.prefs.getIntPref("browser.sessionstore.max_tabs_undo");
+  maxTabsUndoPlusOne = maxTabsUndo + 1;
+  let numberOfTabsLoaded = 0;
+  for (let i = 0; i < maxTabsUndoPlusOne; i++) {
+    let tab = gBrowser.addTab("http://mochi.test:8888/");
+    let browser = gBrowser.getBrowserForTab(tab);
+    browser.addEventListener("load", function onLoad() {
+      browser.removeEventListener("load", onLoad, true);
+
+      if (++numberOfTabsLoaded == maxTabsUndoPlusOne)
+        verifyUndoMultipleClose();
+    }, true);
+  }
+}
+
+function verifyUndoMultipleClose() {
+  info("all tabs opened and loaded");
+  cancelRemoveAllTabsDialogListener = new WindowListener("chrome://global/content/commonDialog.xul", cancelRemoveAllTabsDialog);
+  Services.wm.addListener(cancelRemoveAllTabsDialogListener);
+  gBrowser.removeAllTabsBut(originalTab);
+}
+
+function cancelRemoveAllTabsDialog(domWindow) {
+  ok(true, "dialog appeared in response to multiple tab close action");
+  domWindow.document.documentElement.cancelDialog();
+  Services.wm.removeListener(cancelRemoveAllTabsDialogListener);
+
+  acceptRemoveAllTabsDialogListener = new WindowListener("chrome://global/content/commonDialog.xul", acceptRemoveAllTabsDialog);
+  Services.wm.addListener(acceptRemoveAllTabsDialogListener);
+  waitForCondition(function () gBrowser.tabs.length == 1 + maxTabsUndoPlusOne, function verifyCancel() {
+    is(gBrowser.tabs.length, 1 + maxTabsUndoPlusOne, /* The '1 +' is for the original tab */
+       "All tabs should still be open after the 'Cancel' option on the prompt is chosen");
+    gBrowser.removeAllTabsBut(originalTab);
+  }, "Waited too long to find that no tabs were closed.");
+}
+
+function acceptRemoveAllTabsDialog(domWindow) {
+  ok(true, "dialog appeared in response to multiple tab close action");
+  domWindow.document.documentElement.acceptDialog();
+  Services.wm.removeListener(acceptRemoveAllTabsDialogListener);
+
+  waitForCondition(function () gBrowser.tabs.length == 1, function verifyAccept() {
+    is(gBrowser.tabs.length, 1,
+       "All other tabs should be closed after the 'OK' option on the prompt is chosen");
+    finish();
+  }, "Waited too long for the other tabs to be closed.");
+}
+
+function WindowListener(aURL, aCallback) {
+  this.callback = aCallback;
+  this.url = aURL;
+}
+WindowListener.prototype = {
+  onOpenWindow: function(aXULWindow) {
+    var domWindow = aXULWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                              .getInterface(Ci.nsIDOMWindow);
+    var self = this;
+    domWindow.addEventListener("load", function() {
+      domWindow.removeEventListener("load", arguments.callee, false);
+
+      info("domWindow.document.location.href: " + domWindow.document.location.href);
+      if (domWindow.document.location.href != self.url)
+        return;
+
+      // Allow other window load listeners to execute before passing to callback
+      executeSoon(function() {
+        self.callback(domWindow);
+      });
+    }, false);
+  },
+  onCloseWindow: function(aXULWindow) {},
+  onWindowTitleChange: function(aXULWindow, aNewTitle) {}
+}
diff --git a/browser/components/sessionstore/nsISessionStore.idl b/browser/components/sessionstore/nsISessionStore.idl
index f8b9dca0923a..d11c6fe4001d 100644
--- a/browser/components/sessionstore/nsISessionStore.idl
+++ b/browser/components/sessionstore/nsISessionStore.idl
@@ -25,7 +25,7 @@ interface nsIDOMNode;
  * |gBrowser.tabContainer| such as e.g. |gBrowser.selectedTab|.
  */
 
-[scriptable, uuid(0c99811f-6c5f-4a78-9c31-2d266d714175)]
+[scriptable, uuid(63a4d9f4-373f-11e3-a237-fa91a24410d2)]
 interface nsISessionStore : nsISupports
 {
   /**
@@ -100,6 +100,20 @@ interface nsISessionStore : nsISupports
   nsIDOMNode duplicateTab(in nsIDOMWindow aWindow, in nsIDOMNode aTab,
                           [optional] in long aDelta);
 
+  /**
+   * Set the number of tabs that was closed during the last close-tabs
+   * operation. This helps us keep track of batch-close operations so
+   * we can restore multiple tabs at once.
+   */
+  void setNumberOfTabsClosedLast(in nsIDOMWindow aWindow, in unsigned long aNumber);
+
+  /**
+   * Get the number of tabs that was closed during the last close-tabs
+   * operation. This helps us keep track of batch-close operations so
+   * we can restore multiple tabs at once.
+   */
+  unsigned long getNumberOfTabsClosedLast(in nsIDOMWindow aWindow);
+
   /**
    * Get the number of restore-able tabs for a browser window
    */
diff --git a/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm b/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
index fdc2dee7d6f7..98a738444d11 100644
--- a/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
+++ b/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
@@ -66,7 +66,7 @@ this.RecentlyClosedTabsAndWindowsMenuUtils = {
       let restoreAllTabs = fragment.appendChild(doc.createElementNS(kNSXUL, aTagName));
       restoreAllTabs.setAttribute("label", navigatorBundle.GetStringFromName("menuRestoreAllTabs.label"));
       restoreAllTabs.setAttribute("oncommand",
-              "for (var i = 0; i < " + closedTabs.length + "; i++) undoCloseTab();");
+              "for (var i = 0; i < " + closedTabs.length + "; i++) undoCloseTab(0);");
     }
     return fragment;
   },
diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 278c1889b098..804541a7cab0 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -193,6 +193,14 @@ this.SessionStore = {
     return SessionStoreInternal.duplicateTab(aWindow, aTab, aDelta);
   },
 
+  getNumberOfTabsClosedLast: function ss_getNumberOfTabsClosedLast(aWindow) {
+    return SessionStoreInternal.getNumberOfTabsClosedLast(aWindow);
+  },
+
+  setNumberOfTabsClosedLast: function ss_setNumberOfTabsClosedLast(aWindow, aNumber) {
+    return SessionStoreInternal.setNumberOfTabsClosedLast(aWindow, aNumber);
+  },
+
   getClosedTabCount: function ss_getClosedTabCount(aWindow) {
     return SessionStoreInternal.getClosedTabCount(aWindow);
   },
@@ -1608,6 +1616,35 @@ let SessionStoreInternal = {
     return newTab;
   },
 
+  setNumberOfTabsClosedLast: function ssi_setNumberOfTabsClosedLast(aWindow, aNumber) {
+    if (this._disabledForMultiProcess) {
+      return;
+    }
+
+    if (!("__SSi" in aWindow)) {
+      throw Components.Exception("Window is not tracked", Cr.NS_ERROR_INVALID_ARG);
+    }
+
+    return NumberOfTabsClosedLastPerWindow.set(aWindow, aNumber);
+  },
+
+  /* Used to undo batch tab-close operations. Defaults to 1. */
+  getNumberOfTabsClosedLast: function ssi_getNumberOfTabsClosedLast(aWindow) {
+    if (this._disabledForMultiProcess) {
+      return 0;
+    }
+
+    if (!("__SSi" in aWindow)) {
+      throw Components.Exception("Window is not tracked", Cr.NS_ERROR_INVALID_ARG);
+    }
+    // Blank tabs cannot be undo-closed, so the number returned by
+    // the NumberOfTabsClosedLastPerWindow can be greater than the
+    // return value of getClosedTabCount. We won't restore blank
+    // tabs, so we return the minimum of these two values.
+    return Math.min(NumberOfTabsClosedLastPerWindow.get(aWindow) || 1,
+                    this.getClosedTabCount(aWindow));
+  },
+
   getClosedTabCount: function ssi_getClosedTabCount(aWindow) {
     if ("__SSi" in aWindow) {
       return this._windows[aWindow.__SSi]._closedTabs.length;
@@ -3992,6 +4029,11 @@ let DirtyWindows = {
   }
 };
 
+// A map storing the number of tabs last closed per windoow. This only
+// stores the most recent tab-close operation, and is used to undo
+// batch tab-closing operations.
+let NumberOfTabsClosedLastPerWindow = new WeakMap();
+
 // This is used to help meter the number of restoring tabs. This is the control
 // point for telling the next tab to restore. It gets attached to each gBrowser
 // via gBrowser.addTabsProgressListener
diff --git a/browser/components/sessionstore/test/browser_345898.js b/browser/components/sessionstore/test/browser_345898.js
index c4dc7fbb4320..e5f3a1fe80b1 100644
--- a/browser/components/sessionstore/test/browser_345898.js
+++ b/browser/components/sessionstore/test/browser_345898.js
@@ -40,4 +40,8 @@ function test() {
      "Invalid window for getWindowValue throws");
   ok(test(function() ss.setWindowValue({}, "", "")),
      "Invalid window for setWindowValue throws");
+  ok(test(function() ss.getNumberOfTabsClosedLast({})),
+     "Invalid window for getNumberOfTabsClosedLast  throws");
+  ok(test(function() ss.setNumberOfTabsClosedLast({}, 1)),
+     "Invalid window for setNumberOfTabsClosedLast throws");
 }
diff --git a/browser/components/tabview/test/browser_tabview_bug608037.js b/browser/components/tabview/test/browser_tabview_bug608037.js
index 8e02d611feda..a85e3aed99c8 100644
--- a/browser/components/tabview/test/browser_tabview_bug608037.js
+++ b/browser/components/tabview/test/browser_tabview_bug608037.js
@@ -38,5 +38,5 @@ function onTabViewWindowLoaded() {
       gBrowser.removeTab(tabTwo);
       finish();
     });
-  });
+  }, 0);
 }
diff --git a/browser/components/tabview/test/browser_tabview_bug624847.js b/browser/components/tabview/test/browser_tabview_bug624847.js
index bc5cac4a0d4d..e91430fd2812 100644
--- a/browser/components/tabview/test/browser_tabview_bug624847.js
+++ b/browser/components/tabview/test/browser_tabview_bug624847.js
@@ -64,7 +64,7 @@ function test() {
 
         createBlankTab();
         afterAllTabsLoaded(testUndoCloseWithSelectedBlankPinnedTab);
-      });
+      }, 0);
     });
   }
 
@@ -94,7 +94,7 @@ function test() {
         gBrowser.removeTab(gBrowser.tabs[0]);
 
         afterAllTabsLoaded(finishTest);
-      });
+      }, 0);
     });
   }
 
diff --git a/browser/components/tabview/test/browser_tabview_bug628270.js b/browser/components/tabview/test/browser_tabview_bug628270.js
index 4887c88a5939..c64c2e58416c 100644
--- a/browser/components/tabview/test/browser_tabview_bug628270.js
+++ b/browser/components/tabview/test/browser_tabview_bug628270.js
@@ -81,7 +81,7 @@ function test() {
       gBrowser.removeTab(gBrowser.tabs[1]);
       gBrowser.removeTab(gBrowser.tabs[1]);
       hideTabView(finishTest);
-    });
+    }, 0);
   }
 
   waitForExplicitFinish();
diff --git a/browser/components/tabview/test/browser_tabview_bug706736.js b/browser/components/tabview/test/browser_tabview_bug706736.js
index 60a1509d2d94..f47a7d3c5e85 100644
--- a/browser/components/tabview/test/browser_tabview_bug706736.js
+++ b/browser/components/tabview/test/browser_tabview_bug706736.js
@@ -20,7 +20,7 @@ function test() {
     whenTabViewIsHidden(function() {
       win.gBrowser.removeTab(win.gBrowser.selectedTab);
       executeSoon(function() {
-        win.undoCloseTab();
+        win.undoCloseTab(0);
 
         groupItemTwo.addSubscriber("childAdded", function onChildAdded(data) {
           groupItemTwo.removeSubscriber("childAdded", onChildAdded);
diff --git a/browser/components/tabview/test/head.js b/browser/components/tabview/test/head.js
index d5d9679c434f..61eb5948c169 100644
--- a/browser/components/tabview/test/head.js
+++ b/browser/components/tabview/test/head.js
@@ -362,7 +362,7 @@ function newWindowWithState(state, callback) {
 function restoreTab(callback, index, win) {
   win = win || window;
 
-  let tab = win.undoCloseTab(index || 0);
+  let tab = win.undoCloseTab(index);
   let tabItem = tab._tabViewTabItem;
 
   let finalize = function () {
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index 0b5ff9e58b5f..27b0d1375a89 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -49,6 +49,11 @@ can reach it easily. -->
 <!ENTITY  bookmarkAllTabs.accesskey          "T">
 <!ENTITY  undoCloseTab.label                 "Undo Close Tab">
 <!ENTITY  undoCloseTab.accesskey             "U">
+<!-- LOCALIZATION NOTE (undoCloseTabs.label) : This label is used
+when the previous tab-closing operation closed more than one tab. It
+replaces the undoCloseTab.label and will use the same accesskey as the
+undoCloseTab.label so users will not need to learn new keyboard controls. -->
+<!ENTITY  undoCloseTabs.label                "Undo Close Tabs">
 <!ENTITY  closeTab.label                     "Close Tab">
 <!ENTITY  closeTab.accesskey                 "c">
 

From 828a0acf8ed7b08d915ea1b876ebcca174dd661b Mon Sep 17 00:00:00 2001
From: Jared Wein <jwein@mozilla.com>
Date: Fri, 13 Dec 2013 16:55:49 -0500
Subject: [PATCH 341/459] Bug 931891 - [Australis] Backed out bug 887515 and
 the followups (bug 896291, 909662, 896896). r=ttaubert

--HG--
extra : rebase_source : f6568e83e23c036f21270e0f133ee06b192b1f9e
---
 browser/base/content/browser.js               |  36 ++----
 browser/base/content/browser.xul              |   3 +-
 browser/base/content/tabbrowser.xml           |  45 ++------
 browser/base/content/test/general/browser.ini |   2 -
 .../content/test/general/browser_bug887515.js |  75 ------------
 ...wser_bug896291_closeMaxSessionStoreTabs.js | 108 ------------------
 .../content/test/general/browser_bug906190.js |  15 ++-
 .../sessionstore/nsISessionStore.idl          |  16 +--
 .../RecentlyClosedTabsAndWindowsMenuUtils.jsm |   2 +-
 .../sessionstore/src/SessionStore.jsm         |  42 -------
 .../sessionstore/test/browser_345898.js       |   4 -
 .../tabview/test/browser_tabview_bug608037.js |   2 +-
 .../tabview/test/browser_tabview_bug624847.js |   4 +-
 .../tabview/test/browser_tabview_bug628270.js |   2 +-
 .../tabview/test/browser_tabview_bug706736.js |   2 +-
 browser/components/tabview/test/head.js       |   2 +-
 .../locales/en-US/chrome/browser/browser.dtd  |   5 -
 17 files changed, 37 insertions(+), 328 deletions(-)
 delete mode 100644 browser/base/content/test/general/browser_bug887515.js
 delete mode 100644 browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index b7adb8dde39b..a247de742b14 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -6101,33 +6101,16 @@ function undoCloseTab(aIndex) {
   if (gBrowser.tabs.length == 1 && isTabEmpty(gBrowser.selectedTab))
     blankTabToRemove = gBrowser.selectedTab;
 
-  let numberOfTabsToUndoClose = 0;
-  let index = Number(aIndex);
-
-
-  if (isNaN(index)) {
-    index = 0;
-    numberOfTabsToUndoClose = SessionStore.getNumberOfTabsClosedLast(window);
-  } else {
-    if (0 > index || index >= SessionStore.getClosedTabCount(window))
-      return null;
-    numberOfTabsToUndoClose = 1;
-  }
-
-  let tab = null;
-  while (numberOfTabsToUndoClose > 0 &&
-         numberOfTabsToUndoClose--) {
+  var tab = null;
+  if (SessionStore.getClosedTabCount(window) > (aIndex || 0)) {
     TabView.prepareUndoCloseTab(blankTabToRemove);
-    tab = SessionStore.undoCloseTab(window, index);
+    tab = SessionStore.undoCloseTab(window, aIndex || 0);
     TabView.afterUndoCloseTab();
-    if (blankTabToRemove) {
+
+    if (blankTabToRemove)
       gBrowser.removeTab(blankTabToRemove);
-      blankTabToRemove = null;
-    }
   }
 
-  // Reset the number of tabs closed last time to the default.
-  SessionStore.setNumberOfTabsClosedLast(window, 1);
   return tab;
 }
 
@@ -6950,13 +6933,8 @@ var TabContextMenu = {
       menuItem.disabled = disabled;
 
     // Session store
-    let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-    let closedTabCount = SessionStore.getNumberOfTabsClosedLast(window);
-    undoCloseTabElement.disabled = closedTabCount == 0;
-    // Change the label of "Undo Close Tab" to specify if it will undo a batch-close
-    // or a single close.
-    let visibleLabel = closedTabCount <= 1 ? "singletablabel" : "multipletablabel";
-    undoCloseTabElement.setAttribute("label", undoCloseTabElement.getAttribute(visibleLabel));
+    document.getElementById("context_undoCloseTab").disabled =
+      SessionStore.getClosedTabCount(window) == 0;
 
     // Only one of pin/unpin should be visible
     document.getElementById("context_pinTab").hidden = this.contextTab.pinned;
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index a32bd183a1dc..a7b821703ce8 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -115,8 +115,7 @@
                 oncommand="gBrowser.removeAllTabsBut(TabContextMenu.contextTab);"/>
       <menuseparator/>
       <menuitem id="context_undoCloseTab"
-                singletablabel="&undoCloseTab.label;"
-                multipletablabel="&undoCloseTabs.label;"
+                label="&undoCloseTab.label;"
                 accesskey="&undoCloseTab.accesskey;"
                 observes="History:UndoCloseTab"/>
       <menuitem id="context_closeTab" label="&closeTab.label;" accesskey="&closeTab.accesskey;"
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 8dab3c672dd3..36e641d99792 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1679,26 +1679,13 @@
               throw new Error("Invalid argument: " + aCloseTabs);
           }
 
-          let maxUndo =
-            Services.prefs.getIntPref("browser.sessionstore.max_tabs_undo");
-          let warnOnCloseOtherTabs =
-            Services.prefs.getBoolPref("browser.tabs.warnOnCloseOtherTabs");
-          let warnOnCloseWindow =
-            Services.prefs.getBoolPref("browser.tabs.warnOnClose");
-          let isWindowClosing = aCloseTabs == this.closingTabsEnum.ALL;
+          if (tabsToClose <= 1)
+            return true;
 
-          let skipWarning =
-            // 1) If there is only one tab to close, we'll never warn the user.
-            tabsToClose <= 1 ||
-            // 2) If the whole window is going to be closed, don't warn the
-            //    user if the user has browser.tabs.warnOnClose set to false.
-            (isWindowClosing && !warnOnCloseWindow) ||
-            // 3) If the number of tabs are less than the undo threshold
-            //    or if the user has specifically opted-in to ignoring
-            //    this warning via the warnOnCloseOtherTabs pref.
-            (!isWindowClosing && (!warnOnCloseOtherTabs ||
-                                            tabsToClose <= maxUndo));
-          if (skipWarning)
+          const pref = aCloseTabs == this.closingTabsEnum.ALL ?
+                       "browser.tabs.warnOnClose" : "browser.tabs.warnOnCloseOtherTabs";
+          var shouldPrompt = Services.prefs.getBoolPref(pref);
+          if (!shouldPrompt)
             return true;
 
           var ps = Services.prompt;
@@ -1722,16 +1709,14 @@
                          + (ps.BUTTON_TITLE_CANCEL * ps.BUTTON_POS_1),
                          bundle.getString("tabs.closeButtonMultiple"),
                          null, null,
-                         bundle.getString("tabs.closeWarningPromptMe"),
+                         aCloseTabs == this.closingTabsEnum.ALL ?
+                           bundle.getString("tabs.closeWarningPromptMe") : null,
                          warnOnClose);
           var reallyClose = (buttonPressed == 0);
 
           // don't set the pref unless they press OK and it's false
-          if (reallyClose && !warnOnClose.value) {
-            let pref = isWindowClosing ? "browser.tabs.warnOnClose" :
-                                         "browser.tabs.warnOnCloseOtherTabs";
+          if (aCloseTabs == this.closingTabsEnum.ALL && reallyClose && !warnOnClose.value)
             Services.prefs.setBoolPref(pref, false);
-          }
 
           return reallyClose;
         ]]>
@@ -1758,11 +1743,9 @@
           <![CDATA[
             if (this.warnAboutClosingTabs(this.closingTabsEnum.TO_END, aTab)) {
               let tabs = this.getTabsToTheEndFrom(aTab);
-              let numberOfTabsToClose = tabs.length;
-              for (let i = numberOfTabsToClose - 1; i >= 0; --i) {
+              for (let i = tabs.length - 1; i >= 0; --i) {
                 this.removeTab(tabs[i], {animate: true});
               }
-              SessionStore.setNumberOfTabsClosedLast(window, numberOfTabsToClose);
             }
           ]]>
         </body>
@@ -1779,14 +1762,10 @@
               let tabs = this.visibleTabs;
               this.selectedTab = aTab;
 
-              let closedTabs = 0;
               for (let i = tabs.length - 1; i >= 0; --i) {
-                if (tabs[i] != aTab && !tabs[i].pinned) {
+                if (tabs[i] != aTab && !tabs[i].pinned)
                   this.removeTab(tabs[i], {animate: true});
-                  closedTabs++;
-                }
               }
-              SessionStore.setNumberOfTabsClosedLast(window, closedTabs);
             }
           ]]>
         </body>
@@ -1815,8 +1794,6 @@
               var byMouse = aParams.byMouse;
             }
 
-            SessionStore.setNumberOfTabsClosedLast(window, 1);
-
             // Handle requests for synchronously removing an already
             // asynchronously closing tab.
             if (!animate &&
diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index bbc5eb6bc9a6..070a0d390bb4 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -229,8 +229,6 @@ run-if = toolkit == "cocoa"
 [browser_bug839103.js]
 [browser_bug880101.js]
 [browser_bug882977.js]
-[browser_bug887515.js]
-[browser_bug896291_closeMaxSessionStoreTabs.js]
 [browser_bug902156.js]
 [browser_bug906190.js]
 [browser_canonizeURL.js]
diff --git a/browser/base/content/test/general/browser_bug887515.js b/browser/base/content/test/general/browser_bug887515.js
deleted file mode 100644
index 48796162f4b9..000000000000
--- a/browser/base/content/test/general/browser_bug887515.js
+++ /dev/null
@@ -1,75 +0,0 @@
-function numClosedTabs()
-  SessionStore.getNumberOfTabsClosedLast(window);
-
-var originalTab;
-var tab1Loaded = false;
-var tab2Loaded = false;
-
-function verifyUndoMultipleClose() {
-  if (!tab1Loaded || !tab2Loaded)
-    return;
-
-  gBrowser.removeAllTabsBut(originalTab);
-  updateTabContextMenu();
-  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-  ok(!undoCloseTabElement.disabled, "Undo Close Tabs should be enabled.");
-  is(numClosedTabs(), 2, "There should be 2 closed tabs.");
-  is(gBrowser.tabs.length, 1, "There should only be 1 open tab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("multipletablabel"),
-     "The label should be showing that the command will restore multiple tabs");
-  undoCloseTab();
-
-  is(gBrowser.tabs.length, 3, "There should be 3 open tabs");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
-     "The label should be showing that the command will restore a single tab");
-
-  gBrowser.removeTabsToTheEndFrom(originalTab);
-  updateTabContextMenu();
-  ok(!undoCloseTabElement.disabled, "Undo Close Tabs should be enabled.");
-  is(numClosedTabs(), 2, "There should be 2 closed tabs.");
-  is(gBrowser.tabs.length, 1, "There should only be 1 open tab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("multipletablabel"),
-     "The label should be showing that the command will restore multiple tabs");
-
-  finish();
-}
-
-function test() {
-  waitForExplicitFinish();
-
-  Services.prefs.setBoolPref("browser.tabs.animate", false);
-  registerCleanupFunction(function() {
-    Services.prefs.clearUserPref("browser.tabs.animate");
-    originalTab.linkedBrowser.loadURI("about:blank");
-    originalTab = null;
-  });
-
-  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
-     "The label should be showing that the command will restore a single tab");
-
-  originalTab = gBrowser.selectedTab;
-  gBrowser.selectedBrowser.loadURI("http://mochi.test:8888/");
-  var tab1 = gBrowser.addTab("http://mochi.test:8888/");
-  var tab2 = gBrowser.addTab("http://mochi.test:8888/");
-  var browser1 = gBrowser.getBrowserForTab(tab1);
-  browser1.addEventListener("load", function onLoad1() {
-    browser1.removeEventListener("load", onLoad1, true);
-    tab1Loaded = true;
-    tab1 = null;
-
-    verifyUndoMultipleClose();
-  }, true);
-  var browser2 = gBrowser.getBrowserForTab(tab2);
-  browser2.addEventListener("load", function onLoad2() {
-    browser2.removeEventListener("load", onLoad2, true);
-    tab2Loaded = true;
-    tab2 = null;
-
-    verifyUndoMultipleClose();
-  }, true);
-}
diff --git a/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js b/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js
deleted file mode 100644
index 98f0b35ace17..000000000000
--- a/browser/base/content/test/general/browser_bug896291_closeMaxSessionStoreTabs.js
+++ /dev/null
@@ -1,108 +0,0 @@
-function numClosedTabs()
-  Cc["@mozilla.org/browser/sessionstore;1"].
-    getService(Ci.nsISessionStore).
-    getNumberOfTabsClosedLast(window);
-
-let originalTab;
-let maxTabsUndo;
-let maxTabsUndoPlusOne;
-let acceptRemoveAllTabsDialogListener;
-let cancelRemoveAllTabsDialogListener;
-
-function test() {
-  waitForExplicitFinish();
-  Services.prefs.setBoolPref("browser.tabs.animate", false);
-
-  registerCleanupFunction(function() {
-    Services.prefs.clearUserPref("browser.tabs.animate");
-
-    originalTab.linkedBrowser.loadURI("about:blank");
-    originalTab = null;
-  });
-
-  // Creating and throwing away this tab guarantees that the
-  // number of tabs closed in the previous tab-close operation is 1.
-  let throwaway_tab = gBrowser.addTab("http://mochi.test:8888/");
-  gBrowser.removeTab(throwaway_tab);
-
-  let undoCloseTabElement = document.getElementById("context_undoCloseTab");
-  updateTabContextMenu();
-  is(undoCloseTabElement.label, undoCloseTabElement.getAttribute("singletablabel"),
-     "The label should be showing that the command will restore a single tab");
-
-  originalTab = gBrowser.selectedTab;
-  gBrowser.selectedBrowser.loadURI("http://mochi.test:8888/");
-
-  maxTabsUndo = Services.prefs.getIntPref("browser.sessionstore.max_tabs_undo");
-  maxTabsUndoPlusOne = maxTabsUndo + 1;
-  let numberOfTabsLoaded = 0;
-  for (let i = 0; i < maxTabsUndoPlusOne; i++) {
-    let tab = gBrowser.addTab("http://mochi.test:8888/");
-    let browser = gBrowser.getBrowserForTab(tab);
-    browser.addEventListener("load", function onLoad() {
-      browser.removeEventListener("load", onLoad, true);
-
-      if (++numberOfTabsLoaded == maxTabsUndoPlusOne)
-        verifyUndoMultipleClose();
-    }, true);
-  }
-}
-
-function verifyUndoMultipleClose() {
-  info("all tabs opened and loaded");
-  cancelRemoveAllTabsDialogListener = new WindowListener("chrome://global/content/commonDialog.xul", cancelRemoveAllTabsDialog);
-  Services.wm.addListener(cancelRemoveAllTabsDialogListener);
-  gBrowser.removeAllTabsBut(originalTab);
-}
-
-function cancelRemoveAllTabsDialog(domWindow) {
-  ok(true, "dialog appeared in response to multiple tab close action");
-  domWindow.document.documentElement.cancelDialog();
-  Services.wm.removeListener(cancelRemoveAllTabsDialogListener);
-
-  acceptRemoveAllTabsDialogListener = new WindowListener("chrome://global/content/commonDialog.xul", acceptRemoveAllTabsDialog);
-  Services.wm.addListener(acceptRemoveAllTabsDialogListener);
-  waitForCondition(function () gBrowser.tabs.length == 1 + maxTabsUndoPlusOne, function verifyCancel() {
-    is(gBrowser.tabs.length, 1 + maxTabsUndoPlusOne, /* The '1 +' is for the original tab */
-       "All tabs should still be open after the 'Cancel' option on the prompt is chosen");
-    gBrowser.removeAllTabsBut(originalTab);
-  }, "Waited too long to find that no tabs were closed.");
-}
-
-function acceptRemoveAllTabsDialog(domWindow) {
-  ok(true, "dialog appeared in response to multiple tab close action");
-  domWindow.document.documentElement.acceptDialog();
-  Services.wm.removeListener(acceptRemoveAllTabsDialogListener);
-
-  waitForCondition(function () gBrowser.tabs.length == 1, function verifyAccept() {
-    is(gBrowser.tabs.length, 1,
-       "All other tabs should be closed after the 'OK' option on the prompt is chosen");
-    finish();
-  }, "Waited too long for the other tabs to be closed.");
-}
-
-function WindowListener(aURL, aCallback) {
-  this.callback = aCallback;
-  this.url = aURL;
-}
-WindowListener.prototype = {
-  onOpenWindow: function(aXULWindow) {
-    var domWindow = aXULWindow.QueryInterface(Ci.nsIInterfaceRequestor)
-                              .getInterface(Ci.nsIDOMWindow);
-    var self = this;
-    domWindow.addEventListener("load", function() {
-      domWindow.removeEventListener("load", arguments.callee, false);
-
-      info("domWindow.document.location.href: " + domWindow.document.location.href);
-      if (domWindow.document.location.href != self.url)
-        return;
-
-      // Allow other window load listeners to execute before passing to callback
-      executeSoon(function() {
-        self.callback(domWindow);
-      });
-    }, false);
-  },
-  onCloseWindow: function(aXULWindow) {},
-  onWindowTitleChange: function(aXULWindow, aNewTitle) {}
-}
diff --git a/browser/base/content/test/general/browser_bug906190.js b/browser/base/content/test/general/browser_bug906190.js
index aaf79bfc95c0..748299183765 100644
--- a/browser/base/content/test/general/browser_bug906190.js
+++ b/browser/base/content/test/general/browser_bug906190.js
@@ -212,7 +212,8 @@ function test1C() {
   is(actual, "Mixed Content Blocker disabled", "OK: Executed mixed script in Test 1C");
 
   // remove tabs
-  gTestWin.gBrowser.removeAllTabsBut(mainTab);
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[2], {animate: false});
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[1], {animate: false});
   gTestWin.gBrowser.selectTabAtIndex(0);
 
   var childTabLink = gHttpTestRoot2 + "file_bug906190_2.html";
@@ -269,7 +270,8 @@ function test2C() {
   is(actual, "Mixed Content Blocker enabled", "OK: Blocked mixed script in Test 2C");
 
   // remove tabs
-  gTestWin.gBrowser.removeAllTabsBut(mainTab);
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[2], {animate: false});
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[1], {animate: false});
   gTestWin.gBrowser.selectTabAtIndex(0);
 
   // file_bug906190_3_4.html redirects to page test1.example.com/* using meta-refresh
@@ -336,7 +338,8 @@ function test3E() {
   is(actual, "Mixed Content Blocker disabled", "OK: Executed mixed script in Test 3E");
 
   // remove tabs
-  gTestWin.gBrowser.removeAllTabsBut(mainTab);
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[2], {animate: false});
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[1], {animate: false});
   gTestWin.gBrowser.selectTabAtIndex(0);
 
   var childTabLink = gHttpTestRoot1 + "file_bug906190_3_4.html";
@@ -403,7 +406,8 @@ function test4E() {
   is(actual, "Mixed Content Blocker enabled", "OK: Blocked mixed script in Test 4E");
 
   // remove tabs
-  gTestWin.gBrowser.removeAllTabsBut(mainTab);
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[2], {animate: false});
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[1], {animate: false});
   gTestWin.gBrowser.selectTabAtIndex(0);
 
   // the sjs files returns a 302 redirect- note, same origins
@@ -462,7 +466,8 @@ function test5C() {
   todo_is(actual, "Mixed Content Blocker disabled", "OK: Executed mixed script in Test 5C!");
 
   // remove tabs
-  gTestWin.gBrowser.removeAllTabsBut(mainTab);
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[2], {animate: false});
+  gTestWin.gBrowser.removeTab(gTestWin.gBrowser.tabs[1], {animate: false});
   gTestWin.gBrowser.selectTabAtIndex(0);
 
   // the sjs files returns a 302 redirect - note, different origins
diff --git a/browser/components/sessionstore/nsISessionStore.idl b/browser/components/sessionstore/nsISessionStore.idl
index d11c6fe4001d..f8b9dca0923a 100644
--- a/browser/components/sessionstore/nsISessionStore.idl
+++ b/browser/components/sessionstore/nsISessionStore.idl
@@ -25,7 +25,7 @@ interface nsIDOMNode;
  * |gBrowser.tabContainer| such as e.g. |gBrowser.selectedTab|.
  */
 
-[scriptable, uuid(63a4d9f4-373f-11e3-a237-fa91a24410d2)]
+[scriptable, uuid(0c99811f-6c5f-4a78-9c31-2d266d714175)]
 interface nsISessionStore : nsISupports
 {
   /**
@@ -100,20 +100,6 @@ interface nsISessionStore : nsISupports
   nsIDOMNode duplicateTab(in nsIDOMWindow aWindow, in nsIDOMNode aTab,
                           [optional] in long aDelta);
 
-  /**
-   * Set the number of tabs that was closed during the last close-tabs
-   * operation. This helps us keep track of batch-close operations so
-   * we can restore multiple tabs at once.
-   */
-  void setNumberOfTabsClosedLast(in nsIDOMWindow aWindow, in unsigned long aNumber);
-
-  /**
-   * Get the number of tabs that was closed during the last close-tabs
-   * operation. This helps us keep track of batch-close operations so
-   * we can restore multiple tabs at once.
-   */
-  unsigned long getNumberOfTabsClosedLast(in nsIDOMWindow aWindow);
-
   /**
    * Get the number of restore-able tabs for a browser window
    */
diff --git a/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm b/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
index 98a738444d11..fdc2dee7d6f7 100644
--- a/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
+++ b/browser/components/sessionstore/src/RecentlyClosedTabsAndWindowsMenuUtils.jsm
@@ -66,7 +66,7 @@ this.RecentlyClosedTabsAndWindowsMenuUtils = {
       let restoreAllTabs = fragment.appendChild(doc.createElementNS(kNSXUL, aTagName));
       restoreAllTabs.setAttribute("label", navigatorBundle.GetStringFromName("menuRestoreAllTabs.label"));
       restoreAllTabs.setAttribute("oncommand",
-              "for (var i = 0; i < " + closedTabs.length + "; i++) undoCloseTab(0);");
+              "for (var i = 0; i < " + closedTabs.length + "; i++) undoCloseTab();");
     }
     return fragment;
   },
diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 804541a7cab0..278c1889b098 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -193,14 +193,6 @@ this.SessionStore = {
     return SessionStoreInternal.duplicateTab(aWindow, aTab, aDelta);
   },
 
-  getNumberOfTabsClosedLast: function ss_getNumberOfTabsClosedLast(aWindow) {
-    return SessionStoreInternal.getNumberOfTabsClosedLast(aWindow);
-  },
-
-  setNumberOfTabsClosedLast: function ss_setNumberOfTabsClosedLast(aWindow, aNumber) {
-    return SessionStoreInternal.setNumberOfTabsClosedLast(aWindow, aNumber);
-  },
-
   getClosedTabCount: function ss_getClosedTabCount(aWindow) {
     return SessionStoreInternal.getClosedTabCount(aWindow);
   },
@@ -1616,35 +1608,6 @@ let SessionStoreInternal = {
     return newTab;
   },
 
-  setNumberOfTabsClosedLast: function ssi_setNumberOfTabsClosedLast(aWindow, aNumber) {
-    if (this._disabledForMultiProcess) {
-      return;
-    }
-
-    if (!("__SSi" in aWindow)) {
-      throw Components.Exception("Window is not tracked", Cr.NS_ERROR_INVALID_ARG);
-    }
-
-    return NumberOfTabsClosedLastPerWindow.set(aWindow, aNumber);
-  },
-
-  /* Used to undo batch tab-close operations. Defaults to 1. */
-  getNumberOfTabsClosedLast: function ssi_getNumberOfTabsClosedLast(aWindow) {
-    if (this._disabledForMultiProcess) {
-      return 0;
-    }
-
-    if (!("__SSi" in aWindow)) {
-      throw Components.Exception("Window is not tracked", Cr.NS_ERROR_INVALID_ARG);
-    }
-    // Blank tabs cannot be undo-closed, so the number returned by
-    // the NumberOfTabsClosedLastPerWindow can be greater than the
-    // return value of getClosedTabCount. We won't restore blank
-    // tabs, so we return the minimum of these two values.
-    return Math.min(NumberOfTabsClosedLastPerWindow.get(aWindow) || 1,
-                    this.getClosedTabCount(aWindow));
-  },
-
   getClosedTabCount: function ssi_getClosedTabCount(aWindow) {
     if ("__SSi" in aWindow) {
       return this._windows[aWindow.__SSi]._closedTabs.length;
@@ -4029,11 +3992,6 @@ let DirtyWindows = {
   }
 };
 
-// A map storing the number of tabs last closed per windoow. This only
-// stores the most recent tab-close operation, and is used to undo
-// batch tab-closing operations.
-let NumberOfTabsClosedLastPerWindow = new WeakMap();
-
 // This is used to help meter the number of restoring tabs. This is the control
 // point for telling the next tab to restore. It gets attached to each gBrowser
 // via gBrowser.addTabsProgressListener
diff --git a/browser/components/sessionstore/test/browser_345898.js b/browser/components/sessionstore/test/browser_345898.js
index e5f3a1fe80b1..c4dc7fbb4320 100644
--- a/browser/components/sessionstore/test/browser_345898.js
+++ b/browser/components/sessionstore/test/browser_345898.js
@@ -40,8 +40,4 @@ function test() {
      "Invalid window for getWindowValue throws");
   ok(test(function() ss.setWindowValue({}, "", "")),
      "Invalid window for setWindowValue throws");
-  ok(test(function() ss.getNumberOfTabsClosedLast({})),
-     "Invalid window for getNumberOfTabsClosedLast  throws");
-  ok(test(function() ss.setNumberOfTabsClosedLast({}, 1)),
-     "Invalid window for setNumberOfTabsClosedLast throws");
 }
diff --git a/browser/components/tabview/test/browser_tabview_bug608037.js b/browser/components/tabview/test/browser_tabview_bug608037.js
index a85e3aed99c8..8e02d611feda 100644
--- a/browser/components/tabview/test/browser_tabview_bug608037.js
+++ b/browser/components/tabview/test/browser_tabview_bug608037.js
@@ -38,5 +38,5 @@ function onTabViewWindowLoaded() {
       gBrowser.removeTab(tabTwo);
       finish();
     });
-  }, 0);
+  });
 }
diff --git a/browser/components/tabview/test/browser_tabview_bug624847.js b/browser/components/tabview/test/browser_tabview_bug624847.js
index e91430fd2812..bc5cac4a0d4d 100644
--- a/browser/components/tabview/test/browser_tabview_bug624847.js
+++ b/browser/components/tabview/test/browser_tabview_bug624847.js
@@ -64,7 +64,7 @@ function test() {
 
         createBlankTab();
         afterAllTabsLoaded(testUndoCloseWithSelectedBlankPinnedTab);
-      }, 0);
+      });
     });
   }
 
@@ -94,7 +94,7 @@ function test() {
         gBrowser.removeTab(gBrowser.tabs[0]);
 
         afterAllTabsLoaded(finishTest);
-      }, 0);
+      });
     });
   }
 
diff --git a/browser/components/tabview/test/browser_tabview_bug628270.js b/browser/components/tabview/test/browser_tabview_bug628270.js
index c64c2e58416c..4887c88a5939 100644
--- a/browser/components/tabview/test/browser_tabview_bug628270.js
+++ b/browser/components/tabview/test/browser_tabview_bug628270.js
@@ -81,7 +81,7 @@ function test() {
       gBrowser.removeTab(gBrowser.tabs[1]);
       gBrowser.removeTab(gBrowser.tabs[1]);
       hideTabView(finishTest);
-    }, 0);
+    });
   }
 
   waitForExplicitFinish();
diff --git a/browser/components/tabview/test/browser_tabview_bug706736.js b/browser/components/tabview/test/browser_tabview_bug706736.js
index f47a7d3c5e85..60a1509d2d94 100644
--- a/browser/components/tabview/test/browser_tabview_bug706736.js
+++ b/browser/components/tabview/test/browser_tabview_bug706736.js
@@ -20,7 +20,7 @@ function test() {
     whenTabViewIsHidden(function() {
       win.gBrowser.removeTab(win.gBrowser.selectedTab);
       executeSoon(function() {
-        win.undoCloseTab(0);
+        win.undoCloseTab();
 
         groupItemTwo.addSubscriber("childAdded", function onChildAdded(data) {
           groupItemTwo.removeSubscriber("childAdded", onChildAdded);
diff --git a/browser/components/tabview/test/head.js b/browser/components/tabview/test/head.js
index 61eb5948c169..d5d9679c434f 100644
--- a/browser/components/tabview/test/head.js
+++ b/browser/components/tabview/test/head.js
@@ -362,7 +362,7 @@ function newWindowWithState(state, callback) {
 function restoreTab(callback, index, win) {
   win = win || window;
 
-  let tab = win.undoCloseTab(index);
+  let tab = win.undoCloseTab(index || 0);
   let tabItem = tab._tabViewTabItem;
 
   let finalize = function () {
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index 27b0d1375a89..0b5ff9e58b5f 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -49,11 +49,6 @@ can reach it easily. -->
 <!ENTITY  bookmarkAllTabs.accesskey          "T">
 <!ENTITY  undoCloseTab.label                 "Undo Close Tab">
 <!ENTITY  undoCloseTab.accesskey             "U">
-<!-- LOCALIZATION NOTE (undoCloseTabs.label) : This label is used
-when the previous tab-closing operation closed more than one tab. It
-replaces the undoCloseTab.label and will use the same accesskey as the
-undoCloseTab.label so users will not need to learn new keyboard controls. -->
-<!ENTITY  undoCloseTabs.label                "Undo Close Tabs">
 <!ENTITY  closeTab.label                     "Close Tab">
 <!ENTITY  closeTab.accesskey                 "c">
 

From 480820bbf7682504d20b7ad6c38a290b3ec89bd8 Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Fri, 13 Dec 2013 17:41:54 -0800
Subject: [PATCH 342/459] Back out 86a9b2253199 (bug 943681) because of
 mochitest timeouts on OS X on a CLOSED TREE

---
 browser/devtools/webconsole/hudservice.js     |  4 +--
 browser/devtools/webconsole/panel.js          |  2 +-
 ...r_webconsole_bug_613642_maintain_scroll.js | 36 ++++++++++++-------
 browser/devtools/webconsole/test/head.js      |  2 +-
 browser/devtools/webconsole/webconsole.js     |  2 +-
 5 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/browser/devtools/webconsole/hudservice.js b/browser/devtools/webconsole/hudservice.js
index fed0a290ab69..caca70d3502b 100644
--- a/browser/devtools/webconsole/hudservice.js
+++ b/browser/devtools/webconsole/hudservice.js
@@ -11,9 +11,9 @@ const {Cc, Ci, Cu} = require("chrome");
 let WebConsoleUtils = require("devtools/toolkit/webconsole/utils").Utils;
 let Heritage = require("sdk/core/heritage");
 
+loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
 loader.lazyGetter(this, "Telemetry", () => require("devtools/shared/telemetry"));
 loader.lazyGetter(this, "WebConsoleFrame", () => require("devtools/webconsole/webconsole").WebConsoleFrame);
-loader.lazyImporter(this, "promise", "resource://gre/modules/Promise.jsm", "Promise");
 loader.lazyImporter(this, "gDevTools", "resource:///modules/devtools/gDevTools.jsm");
 loader.lazyImporter(this, "devtools", "resource://gre/modules/devtools/Loader.jsm");
 loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
@@ -110,7 +110,6 @@ HUD_SERVICE.prototype =
   function HS_openBrowserConsole(aTarget, aIframeWindow, aChromeWindow)
   {
     let hud = new BrowserConsole(aTarget, aIframeWindow, aChromeWindow);
-    this._browserConsoleID = hud.hudId;
     this.consoles.set(hud.hudId, hud);
     return hud.init();
   },
@@ -260,6 +259,7 @@ HUD_SERVICE.prototype =
     connect().then(getTarget).then(openWindow).then((aWindow) => {
       this.openBrowserConsole(target, aWindow, aWindow)
         .then((aBrowserConsole) => {
+          this._browserConsoleID = aBrowserConsole.hudId;
           this._browserConsoleDefer.resolve(aBrowserConsole);
           this._browserConsoleDefer = null;
         })
diff --git a/browser/devtools/webconsole/panel.js b/browser/devtools/webconsole/panel.js
index 466f84834dec..48a71f576ec5 100644
--- a/browser/devtools/webconsole/panel.js
+++ b/browser/devtools/webconsole/panel.js
@@ -6,7 +6,7 @@
 
 const {Cc, Ci, Cu} = require("chrome");
 
-loader.lazyImporter(this, "promise", "resource://gre/modules/Promise.jsm", "Promise");
+loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
 loader.lazyGetter(this, "HUDService", () => require("devtools/webconsole/hudservice"));
 loader.lazyGetter(this, "EventEmitter", () => require("devtools/shared/event-emitter"));
 
diff --git a/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js b/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js
index 63da224c9a48..13f018556268 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_613642_maintain_scroll.js
@@ -95,25 +95,37 @@ function testGen() {
     testNext();
   };
   EventUtils.synthesizeKey("VK_END", {});
-  yield undefined;
+  yield;
 
   let oldScrollTop = scrollBox.scrollTop;
 
   content.console.log("test message 151");
 
-  scrollBox.onscroll = () => {
-    dump("\n\nSCROLLED\n\n");
-    if (scrollBox.scrollTop == oldScrollTop) {
-      // Wait for scroll to change.
-      return;
-    }
-    scrollBox.onscroll = null;
-    isnot(scrollBox.scrollTop, oldScrollTop, "scroll location updated (moved to bottom again)");
-    hud = testDriver = null;
-    finishTest();
-  };
+  waitForMessages({
+    webconsole: hud,
+    messages: [{
+      text: "test message 151",
+      category: CATEGORY_WEBDEV,
+      severity: SEVERITY_LOG,
+    }],
+  }).then(() => {
+    scrollBox.onscroll = () => {
+      if (scrollBox.scrollTop == oldScrollTop) {
+        // Wait for scroll to change.
+        return;
+      }
+      scrollBox.onscroll = null;
+      isnot(scrollBox.scrollTop, oldScrollTop, "scroll location updated (moved to bottom again)");
+      testNext();
+    };
+  });
 
   yield undefined;
+
+  hud = testDriver = null;
+  finishTest();
+  
+  yield undefined;
 }
 
 function test() {
diff --git a/browser/devtools/webconsole/test/head.js b/browser/devtools/webconsole/test/head.js
index 744401b971de..c60e972e605a 100644
--- a/browser/devtools/webconsole/test/head.js
+++ b/browser/devtools/webconsole/test/head.js
@@ -8,7 +8,7 @@ let WebConsoleUtils, gDevTools, TargetFactory, console, promise, require;
 (() => {
   gDevTools = Cu.import("resource:///modules/devtools/gDevTools.jsm", {}).gDevTools;
   console = Cu.import("resource://gre/modules/devtools/Console.jsm", {}).console;
-  promise = Cu.import("resource://gre/modules/Promise.jsm", {}).Promise;
+  promise = Cu.import("resource://gre/modules/commonjs/sdk/core/promise.js", {}).Promise;
 
   let tools = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools;
   let utils = tools.require("devtools/toolkit/webconsole/utils");
diff --git a/browser/devtools/webconsole/webconsole.js b/browser/devtools/webconsole/webconsole.js
index 46673010ec1e..5e477227fc98 100644
--- a/browser/devtools/webconsole/webconsole.js
+++ b/browser/devtools/webconsole/webconsole.js
@@ -14,7 +14,7 @@ loader.lazyServiceGetter(this, "clipboardHelper",
                          "@mozilla.org/widget/clipboardhelper;1",
                          "nsIClipboardHelper");
 loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
-loader.lazyImporter(this, "promise", "resource://gre/modules/Promise.jsm", "Promise");
+loader.lazyGetter(this, "promise", () => require("sdk/core/promise"));
 loader.lazyGetter(this, "EventEmitter", () => require("devtools/shared/event-emitter"));
 loader.lazyGetter(this, "AutocompletePopup",
                   () => require("devtools/shared/autocomplete-popup").AutocompletePopup);

From c17f347219e3e1deada72cbdc0a228cb5c61abe3 Mon Sep 17 00:00:00 2001
From: Michael Comella <michael.l.comella@gmail.com>
Date: Wed, 11 Dec 2013 14:31:55 -0800
Subject: [PATCH 343/459] Bug 947550 - Use Robotium side swipe methods.
 r=margaret

---
 mobile/android/base/tests/UITest.java         |  1 -
 .../tests/components/AboutHomeComponent.java  | 30 +++++++------
 .../base/tests/helpers/GestureHelper.java     | 44 -------------------
 3 files changed, 16 insertions(+), 59 deletions(-)
 delete mode 100644 mobile/android/base/tests/helpers/GestureHelper.java

diff --git a/mobile/android/base/tests/UITest.java b/mobile/android/base/tests/UITest.java
index 281161256579..846d56c3e082 100644
--- a/mobile/android/base/tests/UITest.java
+++ b/mobile/android/base/tests/UITest.java
@@ -126,7 +126,6 @@ abstract class UITest extends ActivityInstrumentationTestCase2<Activity>
 
         DeviceHelper.init(this);
         GeckoHelper.init(this);
-        GestureHelper.init(this);
         NavigationHelper.init(this);
         WaitHelper.init(this);
     }
diff --git a/mobile/android/base/tests/components/AboutHomeComponent.java b/mobile/android/base/tests/components/AboutHomeComponent.java
index d12ba88a313b..59a6be43e797 100644
--- a/mobile/android/base/tests/components/AboutHomeComponent.java
+++ b/mobile/android/base/tests/components/AboutHomeComponent.java
@@ -41,6 +41,10 @@ public class AboutHomeComponent extends BaseComponent {
         HISTORY
     }
 
+    // The percentage of the page to swipe between 0 and 1. This value was set through
+    // testing: 0.55f was tested on try and fails on armv6 devices.
+    private static final float SWIPE_PERCENTAGE = 0.70f;
+
     public AboutHomeComponent(final UITestContext testContext) {
         super(testContext);
     }
@@ -70,35 +74,33 @@ public class AboutHomeComponent extends BaseComponent {
         return this;
     }
 
-    // TODO: Take specific page as parameter rather than swipe in a direction?
     public AboutHomeComponent swipeToPageOnRight() {
         mTestContext.dumpLog("Swiping to the page on the right.");
-        swipe(Solo.LEFT);
+        swipeToPage(Solo.RIGHT);
         return this;
     }
 
     public AboutHomeComponent swipeToPageOnLeft() {
         mTestContext.dumpLog("Swiping to the page on the left.");
-        swipe(Solo.RIGHT);
+        swipeToPage(Solo.LEFT);
         return this;
     }
 
-    private void swipe(final int direction) {
+    private void swipeToPage(final int pageDirection) {
+        assertTrue("Swiping in a vaild direction",
+                pageDirection == Solo.LEFT || pageDirection == Solo.RIGHT);
         assertVisible();
 
         final int pageIndex = getHomePagerView().getCurrentItem();
-        if (direction == Solo.LEFT) {
-            GestureHelper.swipeLeft();
-        } else {
-            GestureHelper.swipeRight();
-        }
 
-        final PagerAdapter adapter = getHomePagerView().getAdapter();
-        assertNotNull("The HomePager's PagerAdapter is not null", adapter);
+        mSolo.scrollViewToSide(getHomePagerView(), pageDirection, SWIPE_PERCENTAGE);
 
-        // Swiping left goes to next, swiping right goes to previous
-        final int unboundedPageIndex = pageIndex + (direction == Solo.LEFT ? 1 : -1);
-        final int expectedPageIndex = Math.min(Math.max(0, unboundedPageIndex), adapter.getCount() - 1);
+        // The page on the left is a lower index and vice versa.
+        final int unboundedPageIndex = pageIndex + (pageDirection == Solo.LEFT ? -1 : 1);
+        final int pageCount = DeviceHelper.isTablet() ?
+                TabletPage.values().length : PhonePage.values().length;
+        final int maxPageIndex = pageCount - 1;
+        final int expectedPageIndex = Math.min(Math.max(0, unboundedPageIndex), maxPageIndex);
 
         waitForPageIndex(expectedPageIndex);
     }
diff --git a/mobile/android/base/tests/helpers/GestureHelper.java b/mobile/android/base/tests/helpers/GestureHelper.java
deleted file mode 100644
index 1435ad820bed..000000000000
--- a/mobile/android/base/tests/helpers/GestureHelper.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.tests.helpers;
-
-import org.mozilla.gecko.Driver;
-import org.mozilla.gecko.tests.UITestContext;
-
-import com.jayway.android.robotium.solo.Solo;
-
-/**
- * Provides simplified gestures wrapping the Robotium gestures API.
- */
-public final class GestureHelper {
-    private static int DEFAULT_DRAG_STEP_COUNT = 10;
-
-    private static Solo sSolo;
-    private static Driver sDriver;
-
-    private GestureHelper() { /* To disallow instantation. */ }
-
-    public static void init(final UITestContext context) {
-        sSolo = context.getSolo();
-        sDriver = context.getDriver();
-    }
-
-    private static void swipeOnScreen(final int direction) {
-        final int halfWidth = sDriver.getGeckoWidth() / 2;
-        final int halfHeight = sDriver.getGeckoHeight() / 2;
-
-        sSolo.drag(direction == Solo.LEFT ? halfWidth : 0,
-                   direction == Solo.LEFT ? 0 : halfWidth,
-                   halfHeight, halfHeight, DEFAULT_DRAG_STEP_COUNT);
-    }
-
-    public static void swipeLeft() {
-        swipeOnScreen(Solo.LEFT);
-    }
-
-    public static void swipeRight() {
-        swipeOnScreen(Solo.RIGHT);
-    }
-}

From 8fa7a3a3c35d51ce514c03ab24f34edc2beee7dc Mon Sep 17 00:00:00 2001
From: Ghislain Lacroix <aus@mozilla.com>
Date: Fri, 13 Dec 2013 11:46:22 -0500
Subject: [PATCH 344/459] Bug 948287 - [Download API] Accessing startTime
 attribute at download start fires NS_ERROR_UNEXPECTED in emulator. r=fabrice

---
 dom/downloads/src/DownloadsAPI.js | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/dom/downloads/src/DownloadsAPI.js b/dom/downloads/src/DownloadsAPI.js
index 56586bb99698..a87ca1d44457 100644
--- a/dom/downloads/src/DownloadsAPI.js
+++ b/dom/downloads/src/DownloadsAPI.js
@@ -198,6 +198,7 @@ function createDOMDownloadObject(aWindow, aDownload) {
 
 function DOMDownloadImpl() {
   debug("DOMDownloadImpl constructor ");
+
   this.wrappedJSObject = this;
   this.totalBytes = 0;
   this.currentBytes = 0;
@@ -205,9 +206,11 @@ function DOMDownloadImpl() {
   this.path = null;
   this.state = "stopped";
   this.contentType = null;
-  this.startTime = Date.now();
   this.error = null;
 
+  /* fields that require getters/setters */
+  this._startTime = new Date();
+
   /* private fields */
   this.id = null;
 }
@@ -244,6 +247,19 @@ DOMDownloadImpl.prototype = {
     return this.__DOM_IMPL__.getEventHandler("onstatechange");
   },
 
+  get startTime() {
+    return this._startTime;
+  },
+
+  set startTime(aStartTime) {
+    if (aStartTime instanceof Date) {
+      this._startTime = aStartTime;
+    }
+    else {
+      this._startTime = new Date(aStartTime);
+    }
+  },
+
   _init: function(aWindow, aDownload) {
     this._window = aWindow;
     this.id = aDownload.id;

From 9212f601833798796922571cc68f6e9a339e994d Mon Sep 17 00:00:00 2001
From: Bevis Tseng <btseng@mozilla.com>
Date: Thu, 12 Dec 2013 15:59:34 +0800
Subject: [PATCH 345/459] Bug 949318 - B2G SMS: Class 2 SMS is not working
 after ICCRecordHelper.readSMS() was refactored into SimRecordHelper. r=vyang

---
 dom/system/gonk/ril_worker.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/system/gonk/ril_worker.js b/dom/system/gonk/ril_worker.js
index ff6b04343b8c..6dec70f22f0a 100644
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -6168,7 +6168,7 @@ RIL[UNSOLICITED_RESPONSE_NEW_SMS_STATUS_REPORT] = function UNSOLICITED_RESPONSE_
 RIL[UNSOLICITED_RESPONSE_NEW_SMS_ON_SIM] = function UNSOLICITED_RESPONSE_NEW_SMS_ON_SIM(length) {
   let recordNumber = Buf.readInt32List()[0];
 
-  ICCRecordHelper.readSMS(
+  SimRecordHelper.readSMS(
     recordNumber,
     function onsuccess(message) {
       if (message && message.simStatus === 3) { //New Unread SMS

From 4c159d74d65ed80ff4d8d150b2b23e98c9ad83e3 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Thu, 12 Dec 2013 10:34:18 -0600
Subject: [PATCH 346/459] Bug 949509 - Disable strict compat for addons in
 metrofx. r=mbrubeck

---
 browser/metro/profile/metro.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/browser/metro/profile/metro.js b/browser/metro/profile/metro.js
index fbf938cb8d40..8ed308bbfe7e 100644
--- a/browser/metro/profile/metro.js
+++ b/browser/metro/profile/metro.js
@@ -203,6 +203,8 @@ pref("layout.spellcheckDefault", 1);
 /* extension manager and xpinstall */
 // Completely disable extensions
 pref("extensions.defaultProviders.enabled", false);
+// Disable version checks making addons compatible by default
+pref("extensions.strictCompatibility", false);
 // Disable all add-on locations other than the profile
 pref("extensions.enabledScopes", 1);
 // Auto-disable any add-ons that are "dropped in" to the profile

From c172b7092a2cea32163c05fc7e092892bfa38256 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Thu, 12 Dec 2013 14:08:40 -0800
Subject: [PATCH 347/459] Bug 823787 - Make profilerserver.py use a non-zero
 exit code on failure.  r=ted.

--HG--
extra : rebase_source : 2e7d1ec773dfc286c57832ea3d907f0b18af8908
---
 build/pgo/profileserver.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/build/pgo/profileserver.py b/build/pgo/profileserver.py
index 912684a6a27c..4b09b41e3689 100644
--- a/build/pgo/profileserver.py
+++ b/build/pgo/profileserver.py
@@ -65,7 +65,15 @@ if __name__ == '__main__':
                            cmdargs=cmdargs,
                            env=env)
     runner.start(debug_args=debug_args, interactive=interactive)
-    runner.wait()
+    status = runner.wait()
     httpd.stop()
+    if status != 0:
+        status = 1      # normalize status, in case it's larger than 127
+
+    # Note:  the |finally| block below will always run.
+    # http://docs.python.org/2/library/sys.html#sys.exit says that sys.exit "is
+    # implemented by raising the SystemExit exception, so cleanup actions
+    # specified by finally clauses of try statements are honored".
+    sys.exit(status)
   finally:
     shutil.rmtree(profilePath)

From d1c9d2eccaeb7a93ea47a99d38d70e37dd40d82b Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Thu, 12 Dec 2013 14:44:09 -0800
Subject: [PATCH 348/459] Backed out changeset 372f481bc7ad (bug 942164) for
 leaks on a CLOSED TREE

---
 image/src/imgRequest.cpp       |  2 +-
 image/src/imgStatusTracker.cpp | 24 ++++++++++++------------
 image/src/imgStatusTracker.h   |  6 +++---
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp
index b570496f0197..67529d330fd1 100644
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -637,7 +637,7 @@ NS_IMETHODIMP imgRequest::OnStartRequest(nsIRequest *aRequest, nsISupports *ctxt
     PR_LOG(GetImgLog(), PR_LOG_WARNING,
            ("[this=%p] imgRequest::OnStartRequest -- "
             "RetargetDeliveryTo rv %d=%s\n",
-            this, rv, NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
+            this, NS_SUCCEEDED(rv) ? "succeeded" : "failed", rv));
   }
 
   return NS_OK;
diff --git a/image/src/imgStatusTracker.cpp b/image/src/imgStatusTracker.cpp
index 3fb2640c9c50..b4fd8147d976 100644
--- a/image/src/imgStatusTracker.cpp
+++ b/image/src/imgStatusTracker.cpp
@@ -357,7 +357,7 @@ imgStatusTracker::NotifyCurrentState(imgRequestProxy* proxy)
 
 #define NOTIFY_IMAGE_OBSERVERS(func) \
   do { \
-    nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(proxies); \
+    nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(proxies); \
     while (iter.HasMore()) { \
       nsRefPtr<imgRequestProxy> proxy = iter.GetNext(); \
       if (!proxy->NotificationsDeferred()) { \
@@ -367,7 +367,7 @@ imgStatusTracker::NotifyCurrentState(imgRequestProxy* proxy)
   } while (false);
 
 /* static */ void
-imgStatusTracker::SyncNotifyState(nsTObserverArray<nsRefPtr<imgRequestProxy> >& proxies,
+imgStatusTracker::SyncNotifyState(nsTObserverArray<imgRequestProxy*>& proxies,
                                   bool hasImage, uint32_t state,
                                   nsIntRect& dirtyRect, bool hadLastPart)
 {
@@ -505,7 +505,7 @@ imgStatusTracker::SyncNotifyDifference(const ImageStatusDiff& diff)
   mInvalidRect.SetEmpty();
 
   if (diff.unblockedOnload) {
-    nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+    nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
     while (iter.HasMore()) {
       // Hold on to a reference to this proxy, since notifying the state can
       // cause it to disappear.
@@ -550,7 +550,7 @@ imgStatusTracker::SyncNotify(imgRequestProxy* proxy)
     r = mImage->FrameRect(imgIContainer::FRAME_CURRENT);
   }
 
-  nsTObserverArray<nsRefPtr<imgRequestProxy> > array;
+  nsTObserverArray<imgRequestProxy*> array;
   array.AppendElement(proxy);
   SyncNotifyState(array, !!mImage, mState, r, mHadLastPart);
 }
@@ -781,7 +781,7 @@ imgStatusTracker::OnUnlockedDraw()
 {
   MOZ_ASSERT(NS_IsMainThread());
   RecordUnlockedDraw();
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendUnlockedDraw(iter.GetNext());
   }
@@ -838,7 +838,7 @@ imgStatusTracker::OnStartRequest()
 {
   MOZ_ASSERT(NS_IsMainThread());
   RecordStartRequest();
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendStartRequest(iter.GetNext());
   }
@@ -909,7 +909,7 @@ imgStatusTracker::OnStopRequest(bool aLastPart,
 
   RecordStopRequest(aLastPart, aStatus);
   /* notify the kids */
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator srIter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator srIter(mConsumers);
   while (srIter.HasMore()) {
     SendStopRequest(srIter.GetNext(), aLastPart, aStatus);
   }
@@ -926,7 +926,7 @@ imgStatusTracker::OnDiscard()
   RecordDiscard();
 
   /* notify the kids */
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendDiscard(iter.GetNext());
   }
@@ -939,7 +939,7 @@ imgStatusTracker::FrameChanged(const nsIntRect* aDirtyRect)
   RecordFrameChanged(aDirtyRect);
 
   /* notify the kids */
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendFrameChanged(iter.GetNext(), aDirtyRect);
   }
@@ -952,7 +952,7 @@ imgStatusTracker::OnStopFrame()
   RecordStopFrame();
 
   /* notify the kids */
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendStopFrame(iter.GetNext());
   }
@@ -970,7 +970,7 @@ imgStatusTracker::OnDataAvailable()
     return;
   }
   // Notify any imgRequestProxys that are observing us that we have an Image.
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     iter.GetNext()->SetHasImage();
   }
@@ -1021,7 +1021,7 @@ imgStatusTracker::MaybeUnblockOnload()
 
   RecordUnblockOnload();
 
-  nsTObserverArray<nsRefPtr<imgRequestProxy> >::ForwardIterator iter(mConsumers);
+  nsTObserverArray<imgRequestProxy*>::ForwardIterator iter(mConsumers);
   while (iter.HasMore()) {
     SendUnblockOnload(iter.GetNext());
   }
diff --git a/image/src/imgStatusTracker.h b/image/src/imgStatusTracker.h
index 6ca06c95c062..d70fdbef97d8 100644
--- a/image/src/imgStatusTracker.h
+++ b/image/src/imgStatusTracker.h
@@ -9,6 +9,7 @@
 
 class imgDecoderObserver;
 class imgIContainer;
+class imgRequestProxy;
 class imgStatusNotifyRunnable;
 class imgRequestNotifyRunnable;
 class imgStatusTrackerObserver;
@@ -20,7 +21,6 @@ class nsIRunnable;
 #include "nsTObserverArray.h"
 #include "nsThreadUtils.h"
 #include "nsRect.h"
-#include "imgRequestProxy.h"
 
 namespace mozilla {
 namespace image {
@@ -306,7 +306,7 @@ private:
 
   // Main thread only, since imgRequestProxy calls are expected on the main
   // thread, and mConsumers is not threadsafe.
-  static void SyncNotifyState(nsTObserverArray<nsRefPtr<imgRequestProxy> >& proxies,
+  static void SyncNotifyState(nsTObserverArray<imgRequestProxy*>& proxies,
                               bool hasImage, uint32_t state,
                               nsIntRect& dirtyRect, bool hadLastPart);
 
@@ -322,7 +322,7 @@ private:
   // List of proxies attached to the image. Each proxy represents a consumer
   // using the image. Array and/or individual elements should only be accessed
   // on the main thread.
-  nsTObserverArray<nsRefPtr<imgRequestProxy> > mConsumers;
+  nsTObserverArray<imgRequestProxy*> mConsumers;
 
   mozilla::RefPtr<imgDecoderObserver> mTrackerObserver;
 

From 6f1d153966cb62f394d8f30d1fe967ac1907b207 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Thu, 12 Dec 2013 15:06:50 -0800
Subject: [PATCH 349/459] Bug 948238 - Fix Windows bustage on a CLOSED TREE

---
 accessible/src/windows/msaa/nsWinUtils.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accessible/src/windows/msaa/nsWinUtils.cpp b/accessible/src/windows/msaa/nsWinUtils.cpp
index c21bf8835c01..42ad3d6076e1 100644
--- a/accessible/src/windows/msaa/nsWinUtils.cpp
+++ b/accessible/src/windows/msaa/nsWinUtils.cpp
@@ -16,6 +16,7 @@
 #include "nsIArray.h"
 #include "nsIDocument.h"
 #include "nsIDocShellTreeItem.h"
+#include "nsIXULRuntime.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;

From afaa2bac0c52ce336b595f537f93c2b0aa8f10ba Mon Sep 17 00:00:00 2001
From: Ralph Giles <giles@mozilla.com>
Date: Thu, 12 Dec 2013 15:08:09 -0800
Subject: [PATCH 350/459] Bug 949713 - Remove unused typedef to fix problems
 with unified builds on some systems. r=cpearce

---
 media/libvpx/unified.patch           | 13 +++++++++++++
 media/libvpx/vp8/common/loopfilter.c |  2 --
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/media/libvpx/unified.patch b/media/libvpx/unified.patch
index 13501ae2dee1..f4eddf66f508 100644
--- a/media/libvpx/unified.patch
+++ b/media/libvpx/unified.patch
@@ -67,3 +67,16 @@ index 16a735c..0387a71 100644
  #endif
 +
 +#endif
+diff --git a/media/libvpx/vp8/common/loopfilter.c b/media/libvpx/vp8/common/loopfilter.c
+index 19857a7..3c0fa63 100644
+--- a/media/libvpx/vp8/common/loopfilter.c
++++ b/media/libvpx/vp8/common/loopfilter.c
+@@ -15,8 +15,6 @@
+ #include "onyxc_int.h"
+ #include "vpx_mem/vpx_mem.h"
+ 
+-typedef unsigned char uc;
+-
+ static void lf_init_lut(loop_filter_info_n *lfi)
+ {
+     int filt_lvl;
diff --git a/media/libvpx/vp8/common/loopfilter.c b/media/libvpx/vp8/common/loopfilter.c
index 19857a7e9fbd..3c0fa636f352 100644
--- a/media/libvpx/vp8/common/loopfilter.c
+++ b/media/libvpx/vp8/common/loopfilter.c
@@ -15,8 +15,6 @@
 #include "onyxc_int.h"
 #include "vpx_mem/vpx_mem.h"
 
-typedef unsigned char uc;
-
 static void lf_init_lut(loop_filter_info_n *lfi)
 {
     int filt_lvl;

From 0917e1a8c0c8d395669f9136be7f17a0498fba61 Mon Sep 17 00:00:00 2001
From: Jared Wein <jwein@mozilla.com>
Date: Thu, 12 Dec 2013 18:14:19 -0500
Subject: [PATCH 351/459] Bug 949589 - In-Content Preferences openDialog typo
 in features string (model= should be modal=). r=Unfocused

--HG--
extra : rebase_source : 02726a2a1de45b923dfa420d97ee7c21862e4cc2
---
 browser/components/preferences/in-content/advanced.js | 10 +++++-----
 browser/components/preferences/in-content/privacy.js  |  6 +++---
 browser/components/preferences/in-content/security.js |  4 ++--
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/browser/components/preferences/in-content/advanced.js b/browser/components/preferences/in-content/advanced.js
index b6991911d51d..884d3f543d3e 100644
--- a/browser/components/preferences/in-content/advanced.js
+++ b/browser/components/preferences/in-content/advanced.js
@@ -275,7 +275,7 @@ var gAdvancedPane = {
   {
     openDialog("chrome://browser/content/preferences/connection.xul",
                "mozilla:connectionmanager",
-               "model=yes",
+               "modal=yes",
                null);
   },
 
@@ -441,7 +441,7 @@ var gAdvancedPane = {
                    introText        : bundlePreferences.getString("offlinepermissionstext") };
     openDialog("chrome://browser/content/preferences/permissions.xul",
                "Browser:Permissions",
-               "model=yes",
+               "modal=yes",
                params);
   },
 
@@ -814,7 +814,7 @@ var gAdvancedPane = {
   {
     openDialog("chrome://pippki/content/certManager.xul",
                "mozilla:certmanager",
-               "model=yes", null);
+               "modal=yes", null);
   },
 
   /**
@@ -824,7 +824,7 @@ var gAdvancedPane = {
   {
     openDialog("chrome://mozapps/content/preferences/ocsp.xul",
                "mozilla:crlmanager",
-               "model=yes", null);
+               "modal=yes", null);
   },
 
   /**
@@ -834,7 +834,7 @@ var gAdvancedPane = {
   {
     openDialog("chrome://pippki/content/device_manager.xul",
                "mozilla:devicemanager",
-               "model=yes", null);
+               "modal=yes", null);
   }
 #ifdef HAVE_SHELL_SERVICE
   ,
diff --git a/browser/components/preferences/in-content/privacy.js b/browser/components/preferences/in-content/privacy.js
index b7631792acaa..7d47cf61ddae 100644
--- a/browser/components/preferences/in-content/privacy.js
+++ b/browser/components/preferences/in-content/privacy.js
@@ -471,7 +471,7 @@ var gPrivacyPane = {
                    introText      : bundlePreferences.getString("cookiepermissionstext") };
     openDialog("chrome://browser/content/preferences/permissions.xul",
                "Browser:Permissions",
-               "model=yes", params);
+               "modal=yes", params);
   },
 
   /**
@@ -481,7 +481,7 @@ var gPrivacyPane = {
   {
     openDialog("chrome://browser/content/preferences/cookies.xul",
                "Browser:Cookies",
-               "model=yes", null);
+               "modal=yes", null);
   },
 
   // CLEAR PRIVATE DATA
@@ -500,7 +500,7 @@ var gPrivacyPane = {
   showClearPrivateDataSettings: function ()
   {
     openDialog("chrome://browser/content/preferences/sanitize.xul",
-               "model=yes", null);
+               "modal=yes", null);
   },
 
 
diff --git a/browser/components/preferences/in-content/security.js b/browser/components/preferences/in-content/security.js
index 4c701374f73f..702a15fea5ca 100644
--- a/browser/components/preferences/in-content/security.js
+++ b/browser/components/preferences/in-content/security.js
@@ -57,7 +57,7 @@ var gSecurityPane = {
 
     openDialog("chrome://browser/content/preferences/permissions.xul",
                "Browser:Permissions",
-               "model=yes",
+               "modal=yes",
                params);
   },
 
@@ -111,7 +111,7 @@ var gSecurityPane = {
   {
     openDialog("chrome://passwordmgr/content/passwordManagerExceptions.xul",
                "Toolkit:PasswordManagerExceptions",
-               "model=yes",
+               "modal=yes",
                null);
   },
 

From 22eac44ef0d20481bea0d3e424ff3a119c14e0ad Mon Sep 17 00:00:00 2001
From: Jared Wein <jwein@mozilla.com>
Date: Thu, 12 Dec 2013 18:14:25 -0500
Subject: [PATCH 352/459] Bug 926487 - Replace className comparisons with
 classList.contains in viewSource.js. r=Unfocused

--HG--
extra : rebase_source : 1e5a9b55e2c455b08454e8bd17afe4412f42a042
---
 toolkit/components/viewsource/content/viewSource.js | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/toolkit/components/viewsource/content/viewSource.js b/toolkit/components/viewsource/content/viewSource.js
index 22dbd5d42f28..d890b9346b6c 100644
--- a/toolkit/components/viewsource/content/viewSource.js
+++ b/toolkit/components/viewsource/content/viewSource.js
@@ -623,16 +623,12 @@ function findLocation(pre, line, node, offset, interlinePosition, result)
 function wrapLongLines()
 {
   var myWrap = window.content.document.body;
-
-  if (myWrap.className == '')
-    myWrap.className = 'wrap';
-  else
-    myWrap.className = '';
+  myWrap.classList.toggle("wrap");
 
   // Since multiple viewsource windows are possible, another window could have
   // affected the pref, so instead of determining the new pref value via the current
-  // pref value, we use myWrap.className.
-  Services.prefs.setBoolPref("view_source.wrap_long_lines", myWrap.className != '');
+  // pref value, we use myWrap.classList.
+  Services.prefs.setBoolPref("view_source.wrap_long_lines", myWrap.classList.contains("wrap"));
 }
 
 // Toggles syntax highlighting and sets the view_source.syntax_highlight

From 7d2511377fb0f008334e7e2f32d5a9b1f5e644a2 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Thu, 12 Dec 2013 15:27:07 -0800
Subject: [PATCH 353/459] Bug 948238 - Fix ASAN bustage on a CLOSED TREE

---
 toolkit/xre/nsAppRunner.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index c64b4cc17ba2..4692e9b968cb 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -25,6 +25,7 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/Likely.h"
 #include "mozilla/Poison.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/Telemetry.h"
 
 #include "nsAppRunner.h"
@@ -193,7 +194,6 @@
 #include "nsICrashReporter.h"
 #define NS_CRASHREPORTER_CONTRACTID "@mozilla.org/toolkit/crash-reporter;1"
 #include "nsIPrefService.h"
-#include "mozilla/Preferences.h"
 #endif
 
 #include "base/command_line.h"

From 71bbbd7eb26eaeeb779ad55379bb54e6db9c568c Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:31:35 +0100
Subject: [PATCH 354/459] Bug 929513 - Remove unused #include statements
 r=nical

---
 gfx/layers/client/ClientTiledThebesLayer.cpp | 1 -
 gfx/layers/client/TiledContentClient.h       | 1 -
 gfx/layers/composite/CompositableHost.h      | 1 -
 gfx/layers/composite/ThebesLayerComposite.h  | 1 -
 gfx/layers/composite/TiledContentHost.h      | 1 -
 5 files changed, 5 deletions(-)

diff --git a/gfx/layers/client/ClientTiledThebesLayer.cpp b/gfx/layers/client/ClientTiledThebesLayer.cpp
index 2db6aa600b54..86e5214b47f9 100644
--- a/gfx/layers/client/ClientTiledThebesLayer.cpp
+++ b/gfx/layers/client/ClientTiledThebesLayer.cpp
@@ -8,7 +8,6 @@
 #include "ClientLayerManager.h"         // for ClientLayerManager, etc
 #include "gfx3DMatrix.h"                // for gfx3DMatrix
 #include "gfxPlatform.h"                // for gfxPlatform
-#include "gfxPoint.h"                   // for gfxSize
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/gfx/BaseSize.h"       // for BaseSize
diff --git a/gfx/layers/client/TiledContentClient.h b/gfx/layers/client/TiledContentClient.h
index 37637efe195c..e92f36e5eff1 100644
--- a/gfx/layers/client/TiledContentClient.h
+++ b/gfx/layers/client/TiledContentClient.h
@@ -14,7 +14,6 @@
 #include "Units.h"                      // for CSSPoint
 #include "gfx3DMatrix.h"                // for gfx3DMatrix
 #include "gfxTypes.h"
-#include "gfxPoint.h"                   // for gfxSize
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr
 #include "mozilla/layers/CompositableClient.h"  // for CompositableClient
diff --git a/gfx/layers/composite/CompositableHost.h b/gfx/layers/composite/CompositableHost.h
index 7e7435c6f6b4..aa558fef26f3 100644
--- a/gfx/layers/composite/CompositableHost.h
+++ b/gfx/layers/composite/CompositableHost.h
@@ -8,7 +8,6 @@
 
 #include <stdint.h>                     // for uint64_t
 #include <stdio.h>                      // for FILE
-#include "gfxPoint.h"                   // for gfxSize
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
diff --git a/gfx/layers/composite/ThebesLayerComposite.h b/gfx/layers/composite/ThebesLayerComposite.h
index 74d7f6b9dcd7..3375c6b7ea01 100644
--- a/gfx/layers/composite/ThebesLayerComposite.h
+++ b/gfx/layers/composite/ThebesLayerComposite.h
@@ -7,7 +7,6 @@
 #define GFX_ThebesLayerComposite_H
 
 #include "Layers.h"                     // for Layer (ptr only), etc
-#include "gfxPoint.h"                   // for gfxSize
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr
diff --git a/gfx/layers/composite/TiledContentHost.h b/gfx/layers/composite/TiledContentHost.h
index 163a36da1537..3928a848bc0f 100644
--- a/gfx/layers/composite/TiledContentHost.h
+++ b/gfx/layers/composite/TiledContentHost.h
@@ -12,7 +12,6 @@
 #include "ContentHost.h"                // for ContentHost
 #include "TiledLayerBuffer.h"           // for TiledLayerBuffer, etc
 #include "CompositableHost.h"
-#include "gfxPoint.h"                   // for gfxSize
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr

From eaa77f044b88471058d60118ddc20a44d7c9e4ca Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:31:53 +0100
Subject: [PATCH 355/459] Bug 929513 - Change gfxSize references to gfx::Size
 r=nical

---
 gfx/layers/Layers.cpp                            |  3 ++-
 gfx/layers/composite/AsyncCompositionManager.cpp |  2 +-
 gfx/layers/composite/TiledContentHost.cpp        |  2 +-
 image/src/RasterImage.cpp                        | 12 ++++++------
 image/src/RasterImage.h                          |  6 +++---
 5 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 2a43910515c1..5fffb03188e6 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -16,6 +16,7 @@
 #include "ReadbackLayer.h"              // for ReadbackLayer
 #include "gfxPlatform.h"                // for gfxPlatform
 #include "gfxUtils.h"                   // for gfxUtils, etc
+#include "gfx2DGlue.h"
 #include "mozilla/DebugOnly.h"          // for DebugOnly
 #include "mozilla/Telemetry.h"          // for Accumulate
 #include "mozilla/TelemetryHistogramEnums.h"
@@ -509,7 +510,7 @@ Layer::SnapTransform(const gfx3DMatrix& aTransform,
   gfx3DMatrix result;
   if (mManager->IsSnappingEffectiveTransforms() &&
       aTransform.Is2D(&matrix2D) &&
-      gfxSize(1.0, 1.0) <= aSnapRect.Size() &&
+      gfx::Size(1.0, 1.0) <= ToSize(aSnapRect.Size()) &&
       matrix2D.PreservesAxisAlignedRectangles()) {
     gfxPoint transformedTopLeft = matrix2D.Transform(aSnapRect.TopLeft());
     transformedTopLeft.Round();
diff --git a/gfx/layers/composite/AsyncCompositionManager.cpp b/gfx/layers/composite/AsyncCompositionManager.cpp
index d92a08f2eb46..6cbb354ad29f 100644
--- a/gfx/layers/composite/AsyncCompositionManager.cpp
+++ b/gfx/layers/composite/AsyncCompositionManager.cpp
@@ -703,7 +703,7 @@ AsyncCompositionManager::TransformScrollableLayer(Layer* aLayer)
   }
   oldTransform.Translate(overscrollTranslation);
 
-  gfxSize underZoomScale(1.0f, 1.0f);
+  gfx::Size underZoomScale(1.0f, 1.0f);
   if (mContentRect.width * userZoom.scale < metrics.mCompositionBounds.width) {
     underZoomScale.width = (mContentRect.width * userZoom.scale) /
       metrics.mCompositionBounds.width;
diff --git a/gfx/layers/composite/TiledContentHost.cpp b/gfx/layers/composite/TiledContentHost.cpp
index cb3c4188868b..730ebe98dcc2 100644
--- a/gfx/layers/composite/TiledContentHost.cpp
+++ b/gfx/layers/composite/TiledContentHost.cpp
@@ -228,7 +228,7 @@ TiledContentHost::RenderLayerBuffer(TiledLayerBufferComposite& aLayerBuffer,
     return;
   }
   float resolution = aLayerBuffer.GetResolution();
-  gfxSize layerScale(1, 1);
+  gfx::Size layerScale(1, 1);
   // We assume that the current frame resolution is the one used in our primary
   // layer buffer. Compensate for a changing frame resolution.
   if (aLayerBuffer.GetFrameResolution() != mVideoMemoryTiledBuffer.GetFrameResolution()) {
diff --git a/image/src/RasterImage.cpp b/image/src/RasterImage.cpp
index f224c362a909..b5aad0276352 100644
--- a/image/src/RasterImage.cpp
+++ b/image/src/RasterImage.cpp
@@ -175,7 +175,7 @@ DiscardingEnabled()
 class ScaleRequest
 {
 public:
-  ScaleRequest(RasterImage* aImage, const gfxSize& aScale, imgFrame* aSrcFrame)
+  ScaleRequest(RasterImage* aImage, const gfx::Size& aScale, imgFrame* aSrcFrame)
     : scale(aScale)
     , dstLocked(false)
     , done(false)
@@ -267,7 +267,7 @@ public:
   nsRefPtr<gfxImageSurface> dstSurface;
 
   // Below are the values that may be touched on the scaling thread.
-  gfxSize scale;
+  gfx::Size scale;
   uint8_t* srcData;
   uint8_t* dstData;
   nsIntRect srcRect;
@@ -318,7 +318,7 @@ private: /* members */
 class ScaleRunner : public nsRunnable
 {
 public:
-  ScaleRunner(RasterImage* aImage, const gfxSize& aScale, imgFrame* aSrcFrame)
+  ScaleRunner(RasterImage* aImage, const gfx::Size& aScale, imgFrame* aSrcFrame)
   {
     nsAutoPtr<ScaleRequest> request(new ScaleRequest(aImage, aScale, aSrcFrame));
 
@@ -2420,7 +2420,7 @@ RasterImage::SyncDecode()
 }
 
 bool
-RasterImage::CanQualityScale(const gfxSize& scale)
+RasterImage::CanQualityScale(const gfx::Size& scale)
 {
   // If target size is 1:1 with original, don't scale.
   if (scale.width == 1.0 && scale.height == 1.0)
@@ -2438,7 +2438,7 @@ RasterImage::CanQualityScale(const gfxSize& scale)
 
 bool
 RasterImage::CanScale(GraphicsFilter aFilter,
-                      gfxSize aScale, uint32_t aFlags)
+                      gfx::Size aScale, uint32_t aFlags)
 {
 // The high-quality scaler requires Skia.
 #ifdef MOZ_ENABLE_SKIA
@@ -2514,7 +2514,7 @@ RasterImage::DrawWithPreDownscaleIfNeeded(imgFrame *aFrame,
   gfxMatrix userSpaceToImageSpace = aUserSpaceToImageSpace;
   gfxMatrix imageSpaceToUserSpace = aUserSpaceToImageSpace;
   imageSpaceToUserSpace.Invert();
-  gfxSize scale = imageSpaceToUserSpace.ScaleFactors(true);
+  gfx::Size scale = ToSize(imageSpaceToUserSpace.ScaleFactors(true));
   nsIntRect subimage = aSubimage;
 
   if (CanScale(aFilter, scale, aFlags)) {
diff --git a/image/src/RasterImage.h b/image/src/RasterImage.h
index da5747e8e739..221fc75e7206 100644
--- a/image/src/RasterImage.h
+++ b/image/src/RasterImage.h
@@ -704,8 +704,8 @@ private: // data
   bool     IsDecodeFinished();
   TimeStamp mDrawStartTime;
 
-  inline bool CanQualityScale(const gfxSize& scale);
-  inline bool CanScale(GraphicsFilter aFilter, gfxSize aScale, uint32_t aFlags);
+  inline bool CanQualityScale(const gfx::Size& scale);
+  inline bool CanScale(GraphicsFilter aFilter, gfx::Size aScale, uint32_t aFlags);
 
   struct ScaleResult
   {
@@ -713,7 +713,7 @@ private: // data
      : status(SCALE_INVALID)
     {}
 
-    gfxSize scale;
+    gfx::Size scale;
     nsAutoPtr<imgFrame> frame;
     ScaleStatus status;
   };

From e437dfc935f8cb5e4419240d3bce1d3b11d3e138 Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:31:57 +0100
Subject: [PATCH 356/459] Bug 929513 - Add YCbCrUtils class and change
 gfxIntSize in BasicCompositor r=nical

The purpose of this patch is to replace usages of gfxIntSize with
gfx::IntSize in BasicCompositor.

The new class YCbCrUtils has two methods ported from gfxUtils in thebes.
BasicCompositor now uses these methods instead of the ones in gfxUtils.
Also changed gfxIntSize to gfx::IntSize and gfxImageFormat to
gfx::SurfaceFormat.
---
 gfx/layers/basic/BasicCompositor.cpp |  17 ++-
 gfx/ycbcr/YCbCrUtils.cpp             | 156 +++++++++++++++++++++++++++
 gfx/ycbcr/YCbCrUtils.h               |  30 ++++++
 gfx/ycbcr/moz.build                  |   2 +
 4 files changed, 195 insertions(+), 10 deletions(-)
 create mode 100644 gfx/ycbcr/YCbCrUtils.cpp
 create mode 100644 gfx/ycbcr/YCbCrUtils.h

diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index cc934831b3b8..7710173fe4c2 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -13,6 +13,7 @@
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/Helpers.h"
 #include "gfxUtils.h"
+#include "YCbCrUtils.h"
 #include <algorithm>
 #include "ImageContainer.h"
 #define PIXMAN_DONT_DEFINE_STDINT
@@ -175,24 +176,20 @@ public:
     PlanarYCbCrData data;
     DeserializerToPlanarYCbCrImageData(deserializer, data);
 
-    gfxImageFormat format = gfxImageFormatRGB24;
-    gfxIntSize size;
-    gfxUtils::GetYCbCrToRGBDestFormatAndSize(data, format, size);
+    gfx::SurfaceFormat format = FORMAT_B8G8R8X8;
+    gfx::IntSize size;
+    gfx::GetYCbCrToRGBDestFormatAndSize(data, format, size);
     if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
         size.height > PlanarYCbCrImage::MAX_DIMENSION) {
       NS_ERROR("Illegal image dest width or height");
       return false;
     }
 
-    mSize = ToIntSize(size);
-    mFormat = (format == gfxImageFormatRGB24)
-              ? FORMAT_B8G8R8X8
-              : FORMAT_B8G8R8A8;
+    mSize = size;
+    mFormat = format;
 
     RefPtr<DataSourceSurface> surface = Factory::CreateDataSourceSurface(mSize, mFormat);
-    gfxUtils::ConvertYCbCrToRGB(data, format, size,
-                                surface->GetData(),
-                                surface->Stride());
+    gfx::ConvertYCbCrToRGB(data, format, size, surface->GetData(), surface->Stride());
 
     mSurface = surface;
     return true;
diff --git a/gfx/ycbcr/YCbCrUtils.cpp b/gfx/ycbcr/YCbCrUtils.cpp
new file mode 100644
index 000000000000..0f662008b95a
--- /dev/null
+++ b/gfx/ycbcr/YCbCrUtils.cpp
@@ -0,0 +1,156 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "gfx2DGlue.h"
+
+#include "YCbCrUtils.h"
+#include "yuv_convert.h"
+#include "ycbcr_to_rgb565.h"
+
+namespace mozilla {
+namespace gfx {
+
+void
+GetYCbCrToRGBDestFormatAndSize(const layers::PlanarYCbCrData& aData,
+                               SurfaceFormat& aSuggestedFormat,
+                               IntSize& aSuggestedSize)
+{
+  YUVType yuvtype =
+    TypeFromSize(aData.mYSize.width,
+                 aData.mYSize.height,
+                 aData.mCbCrSize.width,
+                 aData.mCbCrSize.height);
+
+  // 'prescale' is true if the scaling is to be done as part of the
+  // YCbCr to RGB conversion rather than on the RGB data when rendered.
+  bool prescale = aSuggestedSize.width > 0 && aSuggestedSize.height > 0 &&
+                  aSuggestedSize != aData.mPicSize;
+
+  if (aSuggestedFormat == FORMAT_R5G6B5) {
+#if defined(HAVE_YCBCR_TO_RGB565)
+    if (prescale &&
+        !IsScaleYCbCrToRGB565Fast(aData.mPicX,
+                                  aData.mPicY,
+                                  aData.mPicSize.width,
+                                  aData.mPicSize.height,
+                                  aSuggestedSize.width,
+                                  aSuggestedSize.height,
+                                  yuvtype,
+                                  FILTER_BILINEAR) &&
+        IsConvertYCbCrToRGB565Fast(aData.mPicX,
+                                   aData.mPicY,
+                                   aData.mPicSize.width,
+                                   aData.mPicSize.height,
+                                   yuvtype)) {
+      prescale = false;
+    }
+#else
+    // yuv2rgb16 function not available
+    aSuggestedFormat = FORMAT_B8G8R8X8;
+#endif
+  }
+  else if (aSuggestedFormat != FORMAT_B8G8R8X8) {
+    // No other formats are currently supported.
+    aSuggestedFormat = FORMAT_B8G8R8X8;
+  }
+  if (aSuggestedFormat == FORMAT_B8G8R8X8) {
+    /* ScaleYCbCrToRGB32 does not support a picture offset, nor 4:4:4 data.
+     See bugs 639415 and 640073. */
+    if (aData.mPicX != 0 || aData.mPicY != 0 || yuvtype == YV24)
+      prescale = false;
+  }
+  if (!prescale) {
+    aSuggestedSize = aData.mPicSize;
+  }
+}
+
+void
+ConvertYCbCrToRGB(const layers::PlanarYCbCrData& aData,
+                  const SurfaceFormat& aDestFormat,
+                  const IntSize& aDestSize,
+                  unsigned char* aDestBuffer,
+                  int32_t aStride)
+{
+  // ConvertYCbCrToRGB et al. assume the chroma planes are rounded up if the
+  // luma plane is odd sized.
+  MOZ_ASSERT((aData.mCbCrSize.width == aData.mYSize.width ||
+              aData.mCbCrSize.width == (aData.mYSize.width + 1) >> 1) &&
+             (aData.mCbCrSize.height == aData.mYSize.height ||
+              aData.mCbCrSize.height == (aData.mYSize.height + 1) >> 1));
+  YUVType yuvtype =
+    TypeFromSize(aData.mYSize.width,
+                 aData.mYSize.height,
+                 aData.mCbCrSize.width,
+                 aData.mCbCrSize.height);
+
+  // Convert from YCbCr to RGB now, scaling the image if needed.
+  if (aDestSize != ToIntSize(aData.mPicSize)) {
+#if defined(HAVE_YCBCR_TO_RGB565)
+    if (aDestFormat == FORMAT_R5G6B5) {
+      ScaleYCbCrToRGB565(aData.mYChannel,
+                         aData.mCbChannel,
+                         aData.mCrChannel,
+                         aDestBuffer,
+                         aData.mPicX,
+                         aData.mPicY,
+                         aData.mPicSize.width,
+                         aData.mPicSize.height,
+                         aDestSize.width,
+                         aDestSize.height,
+                         aData.mYStride,
+                         aData.mCbCrStride,
+                         aStride,
+                         yuvtype,
+                         FILTER_BILINEAR);
+    } else
+#endif
+      ScaleYCbCrToRGB32(aData.mYChannel, //
+                        aData.mCbChannel,
+                        aData.mCrChannel,
+                        aDestBuffer,
+                        aData.mPicSize.width,
+                        aData.mPicSize.height,
+                        aDestSize.width,
+                        aDestSize.height,
+                        aData.mYStride,
+                        aData.mCbCrStride,
+                        aStride,
+                        yuvtype,
+                        ROTATE_0,
+                        FILTER_BILINEAR);
+  } else { // no prescale
+#if defined(HAVE_YCBCR_TO_RGB565)
+    if (aDestFormat == FORMAT_R5G6B5) {
+      ConvertYCbCrToRGB565(aData.mYChannel,
+                           aData.mCbChannel,
+                           aData.mCrChannel,
+                           aDestBuffer,
+                           aData.mPicX,
+                           aData.mPicY,
+                           aData.mPicSize.width,
+                           aData.mPicSize.height,
+                           aData.mYStride,
+                           aData.mCbCrStride,
+                           aStride,
+                           yuvtype);
+    } else // aDestFormat != gfxImageFormatRGB16_565
+#endif
+      ConvertYCbCrToRGB32(aData.mYChannel, //
+                          aData.mCbChannel,
+                          aData.mCrChannel,
+                          aDestBuffer,
+                          aData.mPicX,
+                          aData.mPicY,
+                          aData.mPicSize.width,
+                          aData.mPicSize.height,
+                          aData.mYStride,
+                          aData.mCbCrStride,
+                          aStride,
+                          yuvtype);
+  }
+}
+
+}
+}
diff --git a/gfx/ycbcr/YCbCrUtils.h b/gfx/ycbcr/YCbCrUtils.h
new file mode 100644
index 000000000000..1e83f4426ff2
--- /dev/null
+++ b/gfx/ycbcr/YCbCrUtils.h
@@ -0,0 +1,30 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef MOZILLA_GFX_UTILS_H_
+#define MOZILLA_GFX_UTILS_H_
+
+#include "mozilla/gfx/Types.h"
+#include "ImageContainer.h"
+
+namespace mozilla {
+namespace gfx {
+
+void
+GetYCbCrToRGBDestFormatAndSize(const layers::PlanarYCbCrData& aData,
+                               SurfaceFormat& aSuggestedFormat,
+                               IntSize& aSuggestedSize);
+
+void
+ConvertYCbCrToRGB(const layers::PlanarYCbCrData& aData,
+                  const SurfaceFormat& aDestFormat,
+                  const IntSize& aDestSize,
+                  unsigned char* aDestBuffer,
+                  int32_t aStride);
+
+}
+}
+
+#endif /* MOZILLA_GFX_UTILS_H_ */
diff --git a/gfx/ycbcr/moz.build b/gfx/ycbcr/moz.build
index 5399782283a8..6de1bc5ee3e2 100644
--- a/gfx/ycbcr/moz.build
+++ b/gfx/ycbcr/moz.build
@@ -7,12 +7,14 @@
 EXPORTS += [
     'chromium_types.h',
     'ycbcr_to_rgb565.h',
+    'YCbCrUtils.h',
     'yuv_convert.h',
     'yuv_row.h',
 ]
 
 UNIFIED_SOURCES += [
     'ycbcr_to_rgb565.cpp',
+    'YCbCrUtils.cpp',
     'yuv_convert.cpp',
     'yuv_row_c.cpp',
     'yuv_row_table.cpp',

From 3d5f99f7f3a4a719a7e1b38a707013059a3856a0 Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:32:02 +0100
Subject: [PATCH 357/459] Bug 929513 - Replace some instances of gfxIntSize
 with gfx::IntSize r=nical

---
 content/media/VideoFrameContainer.cpp         |  4 +--
 content/media/encoder/TrackEncoder.cpp        |  2 +-
 .../webrtc/MediaEngineTabVideoSource.cpp      |  5 ++--
 gfx/layers/D3D9SurfaceImage.cpp               |  7 +++---
 gfx/layers/D3D9SurfaceImage.h                 |  4 +--
 gfx/layers/GrallocImages.cpp                  |  6 ++---
 gfx/layers/ImageContainer.cpp                 | 22 ++++++++--------
 gfx/layers/ImageContainer.h                   | 23 +++++++++--------
 gfx/layers/ImageLayers.cpp                    |  3 ++-
 gfx/layers/MacIOSurfaceImage.h                |  3 ++-
 gfx/layers/SharedTextureImage.h               |  6 ++---
 gfx/layers/basic/BasicImageLayer.cpp          |  8 +++---
 gfx/layers/basic/BasicImages.cpp              | 25 +++++++++++--------
 gfx/layers/client/ImageClient.cpp             |  1 -
 gfx/layers/client/TextureClient.cpp           |  4 +--
 gfx/layers/composite/ImageLayerComposite.cpp  |  1 -
 gfx/layers/d3d10/ImageLayerD3D10.cpp          | 15 +++++++----
 gfx/layers/d3d10/ImageLayerD3D10.h            |  6 +++--
 gfx/layers/d3d9/ImageLayerD3D9.cpp            |  4 +--
 gfx/layers/ipc/LayersSurfaces.ipdlh           |  2 +-
 gfx/layers/ipc/SharedPlanarYCbCrImage.cpp     |  1 -
 gfx/layers/ipc/SharedRGBImage.cpp             |  4 +--
 gfx/layers/ipc/SharedRGBImage.h               |  7 +++---
 gfx/layers/opengl/OGLShaderProgram.cpp        |  1 -
 gfx/layers/opengl/TextureHostOGL.cpp          |  5 ++--
 layout/base/nsDisplayList.cpp                 |  4 +--
 layout/base/nsLayoutUtils.cpp                 |  5 ++--
 layout/generic/nsVideoFrame.cpp               |  2 +-
 .../src/mediapipeline/MediaPipeline.cpp       |  5 ++--
 29 files changed, 97 insertions(+), 88 deletions(-)

diff --git a/content/media/VideoFrameContainer.cpp b/content/media/VideoFrameContainer.cpp
index 66ff347b006f..b6e8b0cc4268 100644
--- a/content/media/VideoFrameContainer.cpp
+++ b/content/media/VideoFrameContainer.cpp
@@ -40,7 +40,7 @@ void VideoFrameContainer::SetCurrentFrame(const gfxIntSize& aIntrinsicSize,
     mIntrinsicSizeChanged = true;
   }
 
-  gfxIntSize oldFrameSize = mImageContainer->GetCurrentSize();
+  gfx::IntSize oldFrameSize = mImageContainer->GetCurrentSize();
   TimeStamp lastPaintTime = mImageContainer->GetPaintTime();
   if (!lastPaintTime.IsNull() && !mPaintTarget.IsNull()) {
     mPaintDelay = lastPaintTime - mPaintTarget;
@@ -57,7 +57,7 @@ void VideoFrameContainer::SetCurrentFrame(const gfxIntSize& aIntrinsicSize,
   mImageContainer->UnlockCurrentImage();
 
   mImageContainer->SetCurrentImage(aImage);
-  gfxIntSize newFrameSize = mImageContainer->GetCurrentSize();
+  gfx::IntSize newFrameSize = mImageContainer->GetCurrentSize();
   if (oldFrameSize != newFrameSize) {
     mImageSizeChanged = true;
   }
diff --git a/content/media/encoder/TrackEncoder.cpp b/content/media/encoder/TrackEncoder.cpp
index a7c1b908be89..fdecba8eeb8c 100644
--- a/content/media/encoder/TrackEncoder.cpp
+++ b/content/media/encoder/TrackEncoder.cpp
@@ -147,7 +147,7 @@ VideoTrackEncoder::NotifyQueuedTrackChanges(MediaStreamGraph* aGraph,
     while (!iter.IsEnded()) {
       VideoChunk chunk = *iter;
       if (!chunk.IsNull()) {
-        gfxIntSize imgsize = chunk.mFrame.GetImage()->GetSize();
+        gfx::IntSize imgsize = chunk.mFrame.GetImage()->GetSize();
         nsresult rv = Init(imgsize.width, imgsize.height, aTrackRate);
         if (NS_FAILED(rv)) {
           LOG("[VideoTrackEncoder]: Fail to initialize the encoder!");
diff --git a/content/media/webrtc/MediaEngineTabVideoSource.cpp b/content/media/webrtc/MediaEngineTabVideoSource.cpp
index a73cf2c9ed90..e29216d41251 100644
--- a/content/media/webrtc/MediaEngineTabVideoSource.cpp
+++ b/content/media/webrtc/MediaEngineTabVideoSource.cpp
@@ -6,6 +6,7 @@
 #include "nsPresContext.h"
 #include "gfxImageSurface.h"
 #include "gfxContext.h"
+#include "gfx2DGlue.h"
 #include "ImageContainer.h"
 #include "Layers.h"
 #include "nsIInterfaceRequestorUtils.h"
@@ -154,8 +155,8 @@ NotifyPull(MediaStreamGraph*, SourceMediaStream* aSource, mozilla::TrackID aID,
   if (delta > 0) {
     // nullptr images are allowed
     if (image) {
-      gfxIntSize size = image->GetSize();
-      segment.AppendFrame(image.forget(), delta, size);
+      gfx::IntSize size = image->GetSize();
+      segment.AppendFrame(image.forget(), delta, gfx::ThebesIntSize(size));
     } else {
       segment.AppendFrame(nullptr, delta, gfxIntSize(0,0));
     }
diff --git a/gfx/layers/D3D9SurfaceImage.cpp b/gfx/layers/D3D9SurfaceImage.cpp
index 7d75bc5a3ad6..dd3ec8ddd8ef 100644
--- a/gfx/layers/D3D9SurfaceImage.cpp
+++ b/gfx/layers/D3D9SurfaceImage.cpp
@@ -5,6 +5,7 @@
 
 #include "D3D9SurfaceImage.h"
 #include "gfxImageSurface.h"
+#include "gfx2DGlue.h"
 
 namespace mozilla {
 namespace layers {
@@ -73,7 +74,7 @@ D3D9SurfaceImage::SetData(const Data& aData)
 
   mTexture = texture;
   mShareHandle = shareHandle;
-  mSize = gfxIntSize(region.width, region.height);
+  mSize = gfx::IntSize(region.width, region.height);
   mQuery = query;
 
   return S_OK;
@@ -109,7 +110,7 @@ D3D9SurfaceImage::GetDesc() const
   return mDesc;
 }
 
-gfxIntSize
+gfx::IntSize
 D3D9SurfaceImage::GetSize()
 {
   return mSize;
@@ -122,7 +123,7 @@ D3D9SurfaceImage::GetAsSurface()
 
   HRESULT hr;
   nsRefPtr<gfxImageSurface> surface =
-    new gfxImageSurface(mSize, gfxImageFormatRGB24);
+    new gfxImageSurface(gfx::ThebesIntSize(mSize), gfxImageFormatRGB24);
 
   if (!surface->CairoSurface() || surface->CairoStatus()) {
     NS_WARNING("Failed to created Cairo image surface for D3D9SurfaceImage.");
diff --git a/gfx/layers/D3D9SurfaceImage.h b/gfx/layers/D3D9SurfaceImage.h
index e71397835ba2..17506db228dd 100644
--- a/gfx/layers/D3D9SurfaceImage.h
+++ b/gfx/layers/D3D9SurfaceImage.h
@@ -44,7 +44,7 @@ public:
   // complete.
   HANDLE GetShareHandle();
 
-  gfxIntSize GetSize() MOZ_OVERRIDE;
+  gfx::IntSize GetSize() MOZ_OVERRIDE;
 
   already_AddRefed<gfxASurface> GetAsSurface() MOZ_OVERRIDE;
 
@@ -54,7 +54,7 @@ private:
   // is complete, whereupon the texture is safe to use.
   void EnsureSynchronized();
 
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
   RefPtr<IDirect3DTexture9> mTexture;
   RefPtr<IDirect3DQuery9> mQuery;
   HANDLE mShareHandle;
diff --git a/gfx/layers/GrallocImages.cpp b/gfx/layers/GrallocImages.cpp
index 856d80ba79be..3b06733ca2a2 100644
--- a/gfx/layers/GrallocImages.cpp
+++ b/gfx/layers/GrallocImages.cpp
@@ -230,7 +230,7 @@ GrallocImage::GetAsSurface()
   }
 
   nsRefPtr<gfxImageSurface> imageSurface =
-    new gfxImageSurface(GetSize(), gfxImageFormatRGB16_565);
+    new gfxImageSurface(gfx::ThebesIntSize(GetSize()), gfxImageFormatRGB16_565);
 
   uint32_t width = GetSize().width;
   uint32_t height = GetSize().height;
@@ -295,9 +295,7 @@ GrallocImage::GetTextureClient()
       flags |= TEXTURE_RB_SWAPPED;
     }
     GrallocBufferActor* actor = static_cast<GrallocBufferActor*>(desc.bufferChild());
-    mTextureClient = new GrallocTextureClientOGL(actor,
-                                                 gfx::ToIntSize(mSize),
-                                                 flags);
+    mTextureClient = new GrallocTextureClientOGL(actor, mSize, flags);
     mTextureClient->SetGraphicBufferLocked(mGraphicBuffer);
   }
   return mTextureClient;
diff --git a/gfx/layers/ImageContainer.cpp b/gfx/layers/ImageContainer.cpp
index e977f69143be..babe7e6318d6 100644
--- a/gfx/layers/ImageContainer.cpp
+++ b/gfx/layers/ImageContainer.cpp
@@ -7,6 +7,7 @@
 #include "ImageContainer.h"
 #include <string.h>                     // for memcpy, memset
 #include "SharedTextureImage.h"         // for SharedTextureImage
+#include "gfx2DGlue.h"
 #include "gfxImageSurface.h"            // for gfxImageSurface
 #include "gfxPlatform.h"                // for gfxPlatform
 #include "gfxUtils.h"                   // for gfxUtils
@@ -16,6 +17,7 @@
 #include "mozilla/layers/ImageBridgeChild.h"  // for ImageBridgeChild
 #include "mozilla/layers/ImageClient.h"  // for ImageClient
 #include "nsISupportsUtils.h"           // for NS_IF_ADDREF
+#include "YCbCrUtils.h"                 // for YCbCr conversions
 #ifdef MOZ_WIDGET_GONK
 #include "GrallocImages.h"
 #endif
@@ -50,7 +52,7 @@ Atomic<int32_t> Image::sSerialCounter(0);
 already_AddRefed<Image>
 ImageFactory::CreateImage(const ImageFormat *aFormats,
                           uint32_t aNumFormats,
-                          const gfxIntSize &,
+                          const gfx::IntSize &,
                           BufferRecycleBin *aRecycleBin)
 {
   if (!aNumFormats) {
@@ -287,7 +289,7 @@ ImageContainer::LockCurrentImage()
 }
 
 already_AddRefed<gfxASurface>
-ImageContainer::LockCurrentAsSurface(gfxIntSize *aSize, Image** aCurrentImage)
+ImageContainer::LockCurrentAsSurface(gfx::IntSize *aSize, Image** aCurrentImage)
 {
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
 
@@ -345,7 +347,7 @@ ImageContainer::UnlockCurrentImage()
 }
 
 already_AddRefed<gfxASurface>
-ImageContainer::GetCurrentAsSurface(gfxIntSize *aSize)
+ImageContainer::GetCurrentAsSurface(gfx::IntSize *aSize)
 {
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
 
@@ -364,7 +366,7 @@ ImageContainer::GetCurrentAsSurface(gfxIntSize *aSize)
   return mActiveImage->GetAsSurface();
 }
 
-gfxIntSize
+gfx::IntSize
 ImageContainer::GetCurrentSize()
 {
   ReentrantMonitorAutoEnter mon(mReentrantMonitor);
@@ -556,9 +558,9 @@ PlanarYCbCrImage::GetAsSurface()
     return result.forget();
   }
 
-  gfxImageFormat format = GetOffscreenFormat();
-  gfxIntSize size(mSize);
-  gfxUtils::GetYCbCrToRGBDestFormatAndSize(mData, format, size);
+  gfx::SurfaceFormat format = gfx::ImageFormatToSurfaceFormat(GetOffscreenFormat());
+  gfx::IntSize size(mSize);
+  gfx::GetYCbCrToRGBDestFormatAndSize(mData, format, size);
   if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
       size.height > PlanarYCbCrImage::MAX_DIMENSION) {
     NS_ERROR("Illegal image dest width or height");
@@ -566,11 +568,9 @@ PlanarYCbCrImage::GetAsSurface()
   }
 
   nsRefPtr<gfxImageSurface> imageSurface =
-    new gfxImageSurface(mSize, format);
+    new gfxImageSurface(gfx::ThebesIntSize(mSize), gfx::SurfaceFormatToImageFormat(format));
 
-  gfxUtils::ConvertYCbCrToRGB(mData, format, mSize,
-                              imageSurface->Data(),
-                              imageSurface->Stride());
+  gfx::ConvertYCbCrToRGB(mData, format, mSize, imageSurface->Data(), imageSurface->Stride());
 
   mSurface = imageSurface;
 
diff --git a/gfx/layers/ImageContainer.h b/gfx/layers/ImageContainer.h
index 933ce00a68da..0ebfbe95faaa 100644
--- a/gfx/layers/ImageContainer.h
+++ b/gfx/layers/ImageContainer.h
@@ -15,6 +15,7 @@
 #include "mozilla/Mutex.h"              // for Mutex
 #include "mozilla/ReentrantMonitor.h"   // for ReentrantMonitorAutoEnter, etc
 #include "mozilla/TimeStamp.h"          // for TimeStamp
+#include "mozilla/gfx/Point.h"          // For IntSize
 #include "mozilla/layers/LayersTypes.h"  // for LayersBackend, etc
 #include "mozilla/mozalloc.h"           // for operator delete, etc
 #include "nsAutoPtr.h"                  // for nsRefPtr, nsAutoArrayPtr, etc
@@ -147,7 +148,7 @@ public:
   void* GetImplData() { return mImplData; }
 
   virtual already_AddRefed<gfxASurface> GetAsSurface() = 0;
-  virtual gfxIntSize GetSize() = 0;
+  virtual gfx::IntSize GetSize() = 0;
   virtual nsIntRect GetPictureRect()
   {
     return nsIntRect(0, 0, GetSize().width, GetSize().height);
@@ -262,7 +263,7 @@ protected:
 
   virtual already_AddRefed<Image> CreateImage(const ImageFormat* aFormats,
                                               uint32_t aNumFormats,
-                                              const gfxIntSize &aScaleHint,
+                                              const gfx::IntSize &aScaleHint,
                                               BufferRecycleBin *aRecycleBin);
 
 };
@@ -483,7 +484,7 @@ public:
    * the lock methods should be used to avoid the copy, however this should be
    * avoided if the surface is required for a long period of time.
    */
-  already_AddRefed<gfxASurface> GetCurrentAsSurface(gfxIntSize* aSizeResult);
+  already_AddRefed<gfxASurface> GetCurrentAsSurface(gfx::IntSize* aSizeResult);
 
   /**
    * This is similar to GetCurrentAsSurface, however this does not make a copy
@@ -493,7 +494,7 @@ public:
    * type of image. Optionally a pointer can be passed to receive the current
    * image.
    */
-  already_AddRefed<gfxASurface> LockCurrentAsSurface(gfxIntSize* aSizeResult,
+  already_AddRefed<gfxASurface> LockCurrentAsSurface(gfx::IntSize* aSizeResult,
                                                      Image** aCurrentImage = nullptr);
 
   /**
@@ -501,7 +502,7 @@ public:
    * Can be called on any thread. This method takes mReentrantMonitor when accessing
    * thread-shared state.
    */
-  gfxIntSize GetCurrentSize();
+  gfx::IntSize GetCurrentSize();
 
   /**
    * Sets a size that the image is expected to be rendered at.
@@ -673,7 +674,7 @@ public:
   ~AutoLockImage() { if (mContainer) { mContainer->UnlockCurrentImage(); } }
 
   Image* GetImage() { return mImage; }
-  const gfxIntSize &GetSize() { return mSize; }
+  const gfx::IntSize &GetSize() { return mSize; }
 
   void Unlock() { 
     if (mContainer) {
@@ -698,7 +699,7 @@ public:
 private:
   ImageContainer *mContainer;
   nsRefPtr<Image> mImage;
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
 };
 
 struct PlanarYCbCrData {
@@ -819,7 +820,7 @@ public:
 
   virtual bool IsValid() { return !!mBufferSize; }
 
-  virtual gfxIntSize GetSize() { return mSize; }
+  virtual gfx::IntSize GetSize() { return mSize; }
 
   PlanarYCbCrImage(BufferRecycleBin *aRecycleBin);
 
@@ -849,7 +850,7 @@ protected:
   nsAutoArrayPtr<uint8_t> mBuffer;
   uint32_t mBufferSize;
   Data mData;
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
   gfxImageFormat mOffscreenFormat;
   nsCountedRef<nsMainThreadSurfaceRef> mSurface;
   nsRefPtr<BufferRecycleBin> mRecycleBin;
@@ -885,7 +886,7 @@ public:
     return surface.forget();
   }
 
-  gfxIntSize GetSize() { return mSize; }
+  gfx::IntSize GetSize() { return mSize; }
 
   CairoImage() : Image(nullptr, CAIRO_SURFACE) {}
 
@@ -899,7 +900,7 @@ public:
 
   already_AddRefed<gfxASurface> GetAsSurface();
 
-  gfxIntSize GetSize() { return mSize; }
+  gfx::IntSize GetSize() { return mSize; }
 
   unsigned char *mData;
   int mStride;
diff --git a/gfx/layers/ImageLayers.cpp b/gfx/layers/ImageLayers.cpp
index 62d0631febe2..3d3c87f66f60 100644
--- a/gfx/layers/ImageLayers.cpp
+++ b/gfx/layers/ImageLayers.cpp
@@ -9,6 +9,7 @@
 #include "gfxRect.h"                    // for gfxRect
 #include "nsDebug.h"                    // for NS_ASSERTION
 #include "nsISupportsImpl.h"            // for ImageContainer::Release, etc
+#include "gfx2DGlue.h"
 
 namespace mozilla {
 namespace layers {
@@ -33,7 +34,7 @@ void ImageLayer::ComputeEffectiveTransforms(const gfx3DMatrix& aTransformToSurfa
   // Snap image edges to pixel boundaries
   gfxRect sourceRect(0, 0, 0, 0);
   if (mContainer) {
-    sourceRect.SizeTo(mContainer->GetCurrentSize());
+    sourceRect.SizeTo(gfx::ThebesIntSize(mContainer->GetCurrentSize()));
     if (mScaleMode != SCALE_NONE &&
         sourceRect.width != 0.0 && sourceRect.height != 0.0) {
       NS_ASSERTION(mScaleMode == SCALE_STRETCH,
diff --git a/gfx/layers/MacIOSurfaceImage.h b/gfx/layers/MacIOSurfaceImage.h
index 66ba6b18df9f..8999af922582 100644
--- a/gfx/layers/MacIOSurfaceImage.h
+++ b/gfx/layers/MacIOSurfaceImage.h
@@ -8,6 +8,7 @@
 
 #include "ImageContainer.h"
 #include "mozilla/gfx/MacIOSurface.h"
+#include "mozilla/gfx/Point.h"
 #include "mozilla/layers/TextureClient.h"
 #include "gfxImageSurface.h"
 
@@ -21,7 +22,7 @@ public:
   void SetSurface(MacIOSurface* aSurface) { mSurface = aSurface; }
   MacIOSurface* GetSurface() { return mSurface; }
 
-  gfxIntSize GetSize() {
+  gfx::IntSize GetSize() {
     return gfxIntSize(mSurface->GetDevicePixelWidth(), mSurface->GetDevicePixelHeight());
   }
 
diff --git a/gfx/layers/SharedTextureImage.h b/gfx/layers/SharedTextureImage.h
index 575c2f370683..2d5b5cb80aed 100644
--- a/gfx/layers/SharedTextureImage.h
+++ b/gfx/layers/SharedTextureImage.h
@@ -11,7 +11,7 @@
 #include "ImageTypes.h"                 // for ImageFormat::SHARED_TEXTURE
 #include "gfxPoint.h"                   // for gfxIntSize
 #include "nsCOMPtr.h"                   // for already_AddRefed
-#include "nsSize.h"                     // for nsIntSize
+#include "mozilla/gfx/Point.h"          // for IntSize
 
 class gfxASurface;
 
@@ -27,14 +27,14 @@ public:
   struct Data {
     gl::SharedTextureHandle mHandle;
     gl::SharedTextureShareType mShareType;
-    gfxIntSize mSize;
+    gfx::IntSize mSize;
     bool mInverted;
   };
 
   void SetData(const Data& aData) { mData = aData; }
   const Data* GetData() { return &mData; }
 
-  gfxIntSize GetSize() { return mData.mSize; }
+  gfx::IntSize GetSize() { return mData.mSize; }
 
   virtual already_AddRefed<gfxASurface> GetAsSurface() {
     return nullptr;
diff --git a/gfx/layers/basic/BasicImageLayer.cpp b/gfx/layers/basic/BasicImageLayer.cpp
index a41ba984b2a7..002c7043be54 100644
--- a/gfx/layers/basic/BasicImageLayer.cpp
+++ b/gfx/layers/basic/BasicImageLayer.cpp
@@ -12,7 +12,6 @@
 #include "gfxASurface.h"                // for gfxASurface, etc
 #include "gfxContext.h"                 // for gfxContext
 #include "gfxPattern.h"                 // for gfxPattern, etc
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "gfxUtils.h"                   // for gfxUtils
 #ifdef MOZ_X11
 #include "gfxXlibSurface.h"             // for gfxXlibSurface
@@ -25,6 +24,7 @@
 #include "nsRect.h"                     // for nsIntRect
 #include "nsRegion.h"                   // for nsIntRegion
 #include "nsTraceRefcnt.h"              // for MOZ_COUNT_CTOR, etc
+#include "mozilla/gfx/Point.h"          // for IntSize
 
 using namespace mozilla::gfx;
 
@@ -69,7 +69,7 @@ protected:
                           float aOpacity,
                           Layer* aMaskLayer);
 
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
 };
 
 void
@@ -94,7 +94,7 @@ BasicImageLayer::GetAndPaintCurrentImage(gfxContext* aContext,
   nsRefPtr<gfxASurface> surface;
   AutoLockImage autoLock(mContainer, getter_AddRefs(surface));
   Image *image = autoLock.GetImage();
-  gfxIntSize size = mSize = autoLock.GetSize();
+  gfx::IntSize size = mSize = autoLock.GetSize();
 
   if (!surface || surface->CairoStatus()) {
     return nullptr;
@@ -166,7 +166,7 @@ BasicImageLayer::GetAsSurface(gfxASurface** aSurface,
     return false;
   }
 
-  gfxIntSize dontCare;
+  gfx::IntSize dontCare;
   nsRefPtr<gfxASurface> surface = mContainer->GetCurrentAsSurface(&dontCare);
   *aSurface = surface.forget().get();
   return true;
diff --git a/gfx/layers/basic/BasicImages.cpp b/gfx/layers/basic/BasicImages.cpp
index ee33c089fb48..5415b0c7ffe2 100644
--- a/gfx/layers/basic/BasicImages.cpp
+++ b/gfx/layers/basic/BasicImages.cpp
@@ -11,7 +11,6 @@
 #include "gfxASurface.h"                // for gfxASurface, etc
 #include "gfxImageSurface.h"            // for gfxImageSurface
 #include "gfxPlatform.h"                // for gfxPlatform, gfxImageFormat
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "gfxUtils.h"                   // for gfxUtils
 #include "mozilla/mozalloc.h"           // for operator delete[], etc
 #include "nsAutoPtr.h"                  // for nsRefPtr, nsAutoArrayPtr
@@ -20,6 +19,9 @@
 #include "nsDebug.h"                    // for NS_ERROR, NS_ASSERTION
 #include "nsISupportsImpl.h"            // for Image::Release, etc
 #include "nsThreadUtils.h"              // for NS_IsMainThread
+#include "mozilla/gfx/Point.h"          // for IntSize
+#include "gfx2DGlue.h"
+#include "YCbCrUtils.h"                 // for YCbCr conversions
 #ifdef XP_MACOSX
 #include "gfxQuartzImageSurface.h"
 #endif
@@ -30,7 +32,7 @@ namespace layers {
 class BasicPlanarYCbCrImage : public PlanarYCbCrImage
 {
 public:
-  BasicPlanarYCbCrImage(const gfxIntSize& aScaleHint, gfxImageFormat aOffscreenFormat, BufferRecycleBin *aRecycleBin)
+  BasicPlanarYCbCrImage(const gfx::IntSize& aScaleHint, gfxImageFormat aOffscreenFormat, BufferRecycleBin *aRecycleBin)
     : PlanarYCbCrImage(aRecycleBin)
     , mScaleHint(aScaleHint)
     , mDelayedConversion(false)
@@ -54,7 +56,7 @@ public:
 
 private:
   nsAutoArrayPtr<uint8_t> mDecodedBuffer;
-  gfxIntSize mScaleHint;
+  gfx::IntSize mScaleHint;
   int mStride;
   bool mDelayedConversion;
 };
@@ -66,7 +68,7 @@ public:
 
   virtual already_AddRefed<Image> CreateImage(const ImageFormat* aFormats,
                                               uint32_t aNumFormats,
-                                              const gfxIntSize &aScaleHint,
+                                              const gfx::IntSize &aScaleHint,
                                               BufferRecycleBin *aRecycleBin)
   {
     if (!aNumFormats) {
@@ -99,25 +101,26 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
     return;
   }
 
-  gfxImageFormat format = GetOffscreenFormat();
+  gfx::SurfaceFormat format = gfx::ImageFormatToSurfaceFormat(GetOffscreenFormat());
 
-  gfxIntSize size(mScaleHint);
-  gfxUtils::GetYCbCrToRGBDestFormatAndSize(aData, format, size);
+  gfx::IntSize size(mScaleHint);
+  gfx::GetYCbCrToRGBDestFormatAndSize(aData, format, size);
   if (size.width > PlanarYCbCrImage::MAX_DIMENSION ||
       size.height > PlanarYCbCrImage::MAX_DIMENSION) {
     NS_ERROR("Illegal image dest width or height");
     return;
   }
 
-  mStride = gfxASurface::FormatStrideForWidth(format, size.width);
+  gfxImageFormat iFormat = gfx::SurfaceFormatToImageFormat(format);
+  mStride = gfxASurface::FormatStrideForWidth(iFormat, size.width);
   mDecodedBuffer = AllocateBuffer(size.height * mStride);
   if (!mDecodedBuffer) {
     // out of memory
     return;
   }
 
-  gfxUtils::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer, mStride);
-  SetOffscreenFormat(format);
+  gfx::ConvertYCbCrToRGB(aData, format, size, mDecodedBuffer, mStride);
+  SetOffscreenFormat(iFormat);
   mSize = size;
 }
 
@@ -146,7 +149,7 @@ BasicPlanarYCbCrImage::GetAsSurface()
   gfxImageFormat format = GetOffscreenFormat();
 
   nsRefPtr<gfxImageSurface> imgSurface =
-      new gfxImageSurface(mDecodedBuffer, mSize, mStride, format);
+    new gfxImageSurface(mDecodedBuffer, gfx::ThebesIntSize(mSize), mStride, format);
   if (!imgSurface || imgSurface->CairoStatus() != 0) {
     return nullptr;
   }
diff --git a/gfx/layers/client/ImageClient.cpp b/gfx/layers/client/ImageClient.cpp
index 90476e3d5e38..51b95753db6e 100644
--- a/gfx/layers/client/ImageClient.cpp
+++ b/gfx/layers/client/ImageClient.cpp
@@ -11,7 +11,6 @@
 #include "gfx2DGlue.h"                  // for ImageFormatToSurfaceFormat
 #include "gfxASurface.h"                // for gfxASurface, etc
 #include "gfxPlatform.h"                // for gfxPlatform
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/RefPtr.h"             // for RefPtr, TemporaryRef
 #include "mozilla/gfx/BaseSize.h"       // for BaseSize
diff --git a/gfx/layers/client/TextureClient.cpp b/gfx/layers/client/TextureClient.cpp
index a84b8981ce70..33e74745c0e6 100644
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@@ -812,7 +812,7 @@ bool AutoLockShmemClient::Update(Image* aImage,
     return false;
   }
 
-  gfxIntSize size = aImage->GetSize();
+  gfx::IntSize size = aImage->GetSize();
 
   gfxContentType contentType = aSurface->GetContentType();
   bool isOpaque = (aContentFlags & Layer::CONTENT_OPAQUE);
@@ -820,7 +820,7 @@ bool AutoLockShmemClient::Update(Image* aImage,
       isOpaque) {
     contentType = GFX_CONTENT_COLOR;
   }
-  mDeprecatedTextureClient->EnsureAllocated(gfx::IntSize(size.width, size.height), contentType);
+  mDeprecatedTextureClient->EnsureAllocated(size, contentType);
 
   OpenMode mode = mDeprecatedTextureClient->GetAccessMode() == DeprecatedTextureClient::ACCESS_READ_WRITE
                   ? OPEN_READ_WRITE
diff --git a/gfx/layers/composite/ImageLayerComposite.cpp b/gfx/layers/composite/ImageLayerComposite.cpp
index ee78d2722371..aa2ec30c3e37 100644
--- a/gfx/layers/composite/ImageLayerComposite.cpp
+++ b/gfx/layers/composite/ImageLayerComposite.cpp
@@ -8,7 +8,6 @@
 #include "Layers.h"                     // for WriteSnapshotToDumpFile, etc
 #include "gfx2DGlue.h"                  // for ToFilter, ToMatrix4x4
 #include "gfx3DMatrix.h"                // for gfx3DMatrix
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "gfxRect.h"                    // for gfxRect
 #include "gfxUtils.h"                   // for gfxUtils, etc
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
diff --git a/gfx/layers/d3d10/ImageLayerD3D10.cpp b/gfx/layers/d3d10/ImageLayerD3D10.cpp
index cb4ac5163b21..a5a125c9eecb 100644
--- a/gfx/layers/d3d10/ImageLayerD3D10.cpp
+++ b/gfx/layers/d3d10/ImageLayerD3D10.cpp
@@ -10,9 +10,13 @@
 #include "yuv_convert.h"
 #include "../d3d9/Nv3DVUtils.h"
 #include "D3D9SurfaceImage.h"
+#include "mozilla/gfx/Point.h"
+#include "gfx2DGlue.h"
 
 #include "gfxWindowsPlatform.h"
 
+using namespace mozilla::gfx;
+
 namespace mozilla {
 namespace layers {
 
@@ -202,7 +206,7 @@ ImageLayerD3D10::RenderLayer()
     return;
   }
 
-  gfxIntSize size = image->GetSize();
+  IntSize size = image->GetSize();
 
   SetEffectTransformAndOpacity();
 
@@ -410,7 +414,7 @@ ImageLayerD3D10::GetAsTexture(gfxIntSize* aSize)
     return nullptr;
   }
 
-  *aSize = image->GetSize();
+  *aSize = gfx::ThebesIntSize(image->GetSize());
   bool dontCare;
   nsRefPtr<ID3D10ShaderResourceView> result = GetImageSRView(image, dontCare);
   return result.forget();
@@ -465,9 +469,10 @@ RemoteDXGITextureImage::GetAsSurface()
   keyedMutex->ReleaseSync(0);
 
   nsRefPtr<gfxImageSurface> surface =
-    new gfxImageSurface(mSize, mFormat == RemoteImageData::BGRX32 ?
-                                          gfxImageFormatRGB24 :
-                                          gfxImageFormatARGB32);
+    new gfxImageSurface(ThebesIntSize(mSize),
+      mFormat == RemoteImageData::BGRX32 ?
+                 gfxImageFormatRGB24 :
+                 gfxImageFormatARGB32);
 
   if (!surface->CairoSurface() || surface->CairoStatus()) {
     NS_WARNING("Failed to created image surface for DXGI texture.");
diff --git a/gfx/layers/d3d10/ImageLayerD3D10.h b/gfx/layers/d3d10/ImageLayerD3D10.h
index 747ace698025..39944d73f484 100644
--- a/gfx/layers/d3d10/ImageLayerD3D10.h
+++ b/gfx/layers/d3d10/ImageLayerD3D10.h
@@ -11,6 +11,8 @@
 #include "ImageContainer.h"
 #include "yuv_convert.h"
 
+using namespace mozilla::gfx;
+
 namespace mozilla {
 namespace layers {
 
@@ -60,11 +62,11 @@ public:
 
   already_AddRefed<gfxASurface> GetAsSurface();
 
-  gfxIntSize GetSize() { return mSize; }
+  IntSize GetSize() { return mSize; }
 
   TextureD3D10BackendData *GetD3D10TextureBackendData(ID3D10Device *aDevice);
 
-  gfxIntSize mSize;
+  IntSize mSize;
   RemoteImageData::Format mFormat;
   HANDLE mHandle;
 };
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.cpp b/gfx/layers/d3d9/ImageLayerD3D9.cpp
index 4f56e02800f0..43a1527fc520 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ImageLayerD3D9.cpp
@@ -403,7 +403,7 @@ ImageLayerD3D9::RenderLayer()
 
   SetShaderTransformAndOpacity();
 
-  gfxIntSize size = image->GetSize();
+  gfx::IntSize size = image->GetSize();
 
   if (image->GetFormat() == CAIRO_SURFACE ||
       image->GetFormat() == REMOTE_IMAGE_BITMAP ||
@@ -564,7 +564,7 @@ ImageLayerD3D9::GetAsTexture(gfxIntSize* aSize)
   }
 
   bool dontCare;
-  *aSize = image->GetSize();
+  *aSize = gfx::ThebesIntSize(image->GetSize());
   nsRefPtr<IDirect3DTexture9> result = GetTexture(image, dontCare);
   return result.forget();
 }
diff --git a/gfx/layers/ipc/LayersSurfaces.ipdlh b/gfx/layers/ipc/LayersSurfaces.ipdlh
index d8cfed1410aa..e9305e2cd7fd 100644
--- a/gfx/layers/ipc/LayersSurfaces.ipdlh
+++ b/gfx/layers/ipc/LayersSurfaces.ipdlh
@@ -52,7 +52,7 @@ struct SurfaceDescriptorMacIOSurface {
 struct SharedTextureDescriptor {
   SharedTextureShareType shareType;
   SharedTextureHandle handle;
-  nsIntSize size;
+  IntSize size;
   bool inverted;
 };
 
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index 3f7e969a1cf6..f90226221072 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -7,7 +7,6 @@
 #include <stddef.h>                     // for size_t
 #include <stdio.h>                      // for printf
 #include "ISurfaceAllocator.h"          // for ISurfaceAllocator, etc
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/gfx/Types.h"          // for SurfaceFormat::FORMAT_YUV
 #include "mozilla/ipc/SharedMemory.h"   // for SharedMemory, etc
diff --git a/gfx/layers/ipc/SharedRGBImage.cpp b/gfx/layers/ipc/SharedRGBImage.cpp
index 6a3c60885b34..849cbdf72ce5 100644
--- a/gfx/layers/ipc/SharedRGBImage.cpp
+++ b/gfx/layers/ipc/SharedRGBImage.cpp
@@ -104,7 +104,7 @@ DeprecatedSharedRGBImage::GetBufferSize()
   return mSize.width * mSize.height * gfxASurface::BytesPerPixel(mImageFormat);
 }
 
-gfxIntSize
+gfx::IntSize
 DeprecatedSharedRGBImage::GetSize()
 {
   return mSize;
@@ -215,7 +215,7 @@ SharedRGBImage::GetBuffer()
   return serializer.GetData();
 }
 
-gfxIntSize
+gfx::IntSize
 SharedRGBImage::GetSize()
 {
   return ThebesIntSize(mSize);
diff --git a/gfx/layers/ipc/SharedRGBImage.h b/gfx/layers/ipc/SharedRGBImage.h
index c682e6c3c362..4bc35ade488e 100644
--- a/gfx/layers/ipc/SharedRGBImage.h
+++ b/gfx/layers/ipc/SharedRGBImage.h
@@ -9,7 +9,6 @@
 #include <stdint.h>                     // for uint8_t
 #include "ImageContainer.h"             // for ISharedImage, Image, etc
 #include "gfxTypes.h"
-#include "gfxPoint.h"                   // for gfxIntSize
 #include "mozilla/Attributes.h"         // for MOZ_OVERRIDE
 #include "mozilla/RefPtr.h"             // for RefPtr
 #include "mozilla/gfx/Point.h"          // for IntSize
@@ -57,7 +56,7 @@ public:
 
   virtual uint8_t *GetBuffer() MOZ_OVERRIDE;
 
-  gfxIntSize GetSize();
+  gfx::IntSize GetSize();
   size_t GetBufferSize();
 
   static uint8_t BytesPerPixel(gfxImageFormat aImageFormat);
@@ -89,7 +88,7 @@ public:
   TextureClient* GetTextureClient() MOZ_OVERRIDE { return nullptr; }
 
 protected:
-  gfxIntSize mSize;
+  gfx::IntSize mSize;
   gfxImageFormat mImageFormat;
   RefPtr<ISurfaceAllocator> mSurfaceAllocator;
 
@@ -114,7 +113,7 @@ public:
 
   virtual uint8_t* GetBuffer() MOZ_OVERRIDE;
 
-  gfxIntSize GetSize();
+  gfx::IntSize GetSize();
 
   size_t GetBufferSize();
 
diff --git a/gfx/layers/opengl/OGLShaderProgram.cpp b/gfx/layers/opengl/OGLShaderProgram.cpp
index f1b7eec4b177..f1436c3d65e0 100644
--- a/gfx/layers/opengl/OGLShaderProgram.cpp
+++ b/gfx/layers/opengl/OGLShaderProgram.cpp
@@ -5,7 +5,6 @@
 #include "OGLShaderProgram.h"
 #include <stdint.h>                     // for uint32_t
 #include "gfxMatrix.h"                  // for gfxMatrix
-#include "gfxPoint.h"                   // for gfxIntSize, gfxPoint, etc
 #include "gfxRect.h"                    // for gfxRect
 #include "mozilla/DebugOnly.h"          // for DebugOnly
 #include "nsAString.h"
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 4b0b12391bb4..39d605007ba8 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -105,7 +105,7 @@ CreateTextureHostOGL(const SurfaceDescriptor& aDesc,
       result = new SharedTextureHostOGL(aFlags,
                                         desc.shareType(),
                                         desc.handle(),
-                                        gfx::ToIntSize(desc.size()),
+                                        desc.size(),
                                         desc.inverted());
       break;
     }
@@ -649,8 +649,7 @@ SharedDeprecatedTextureHostOGL::SwapTexturesImpl(const SurfaceDescriptor& aImage
   SharedTextureDescriptor texture = aImage.get_SharedTextureDescriptor();
 
   SharedTextureHandle newHandle = texture.handle();
-  nsIntSize size = texture.size();
-  mSize = gfx::IntSize(size.width, size.height);
+  mSize = texture.size();
   if (texture.inverted()) {
     mFlags |= TEXTURE_NEEDS_Y_FLIP;
   }
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index ae5ce6fdbeef..6f9a05370177 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1883,7 +1883,7 @@ nsDisplayBackgroundImage::GetLayerState(nsDisplayListBuilder* aBuilder,
   }
 
   if (!animated) {
-    gfxSize imageSize = mImageContainer->GetCurrentSize();
+    mozilla::gfx::IntSize imageSize = mImageContainer->GetCurrentSize();
     NS_ASSERTION(imageSize.width != 0 && imageSize.height != 0, "Invalid image size!");
 
     gfxRect destRect = mDestRect;
@@ -1930,7 +1930,7 @@ nsDisplayBackgroundImage::ConfigureLayer(ImageLayer* aLayer, const nsIntPoint& a
 {
   aLayer->SetFilter(nsLayoutUtils::GetGraphicsFilterForFrame(mFrame));
 
-  gfxIntSize imageSize = mImageContainer->GetCurrentSize();
+  mozilla::gfx::IntSize imageSize = mImageContainer->GetCurrentSize();
   NS_ASSERTION(imageSize.width != 0 && imageSize.height != 0, "Invalid image size!");
 
   gfxMatrix transform;
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 898e2f75df38..61c2664f1288 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -72,6 +72,7 @@
 #include "nsComputedDOMStyle.h"
 #include "ActiveLayerTracker.h"
 #include "mozilla/gfx/2D.h"
+#include "gfx2DGlue.h"
 
 #include "mozilla/Preferences.h"
 
@@ -4961,14 +4962,14 @@ nsLayoutUtils::SurfaceFromElement(HTMLVideoElement* aElement,
   if (!container)
     return result;
 
-  gfxIntSize size;
+  mozilla::gfx::IntSize size;
   nsRefPtr<gfxASurface> surf = container->GetCurrentAsSurface(&size);
   if (!surf)
     return result;
 
   result.mSourceSurface = gfxPlatform::GetPlatform()->GetSourceSurfaceForSurface(aTarget, surf);
   result.mCORSUsed = aElement->GetCORSMode() != CORS_NONE;
-  result.mSize = size;
+  result.mSize = ThebesIntSize(size);
   result.mPrincipal = principal.forget();
   result.mIsWriteOnly = false;
 
diff --git a/layout/generic/nsVideoFrame.cpp b/layout/generic/nsVideoFrame.cpp
index b7c020c0ef73..e847f485a61d 100644
--- a/layout/generic/nsVideoFrame.cpp
+++ b/layout/generic/nsVideoFrame.cpp
@@ -179,7 +179,7 @@ nsVideoFrame::BuildLayer(nsDisplayListBuilder* aBuilder,
   
   // Retrieve the size of the decoded video frame, before being scaled
   // by pixel aspect ratio.
-  gfxIntSize frameSize = container->GetCurrentSize();
+  mozilla::gfx::IntSize frameSize = container->GetCurrentSize();
   if (frameSize.width == 0 || frameSize.height == 0) {
     // No image, or zero-sized image. No point creating a layer.
     return nullptr;
diff --git a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
index 0cf31c4da5af..2e2b825c6bde 100644
--- a/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
+++ b/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp
@@ -39,6 +39,7 @@
 #include "runnable_utils.h"
 #include "gfxImageSurface.h"
 #include "libyuv/convert.h"
+#include "mozilla/gfx/Point.h"
 
 using namespace mozilla;
 
@@ -858,7 +859,7 @@ void MediaPipelineTransmit::PipelineListener::ProcessVideoChunk(
     return;
   }
 
-  gfxIntSize size = img->GetSize();
+  gfx::IntSize size = img->GetSize();
   if ((size.width & 1) != 0 || (size.height & 1) != 0) {
     MOZ_ASSERT(false, "Can't handle odd-sized images");
     return;
@@ -948,7 +949,7 @@ void MediaPipelineTransmit::PipelineListener::ProcessVideoChunk(
     const_cast<layers::CairoImage *>(
           static_cast<const layers::CairoImage *>(img));
 
-    gfxIntSize size = rgb->GetSize();
+    gfx::IntSize size = rgb->GetSize();
     int half_width = (size.width + 1) >> 1;
     int half_height = (size.height + 1) >> 1;
     int c_size = half_width * half_height;

From feefccfd0ceee177b2bf952e4b40c7eb8e2ad5b1 Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:32:06 +0100
Subject: [PATCH 358/459] Bug 929513 - Replace gfxIntSize in
 layers/AutoOpenSurface.h r=nical

This rippled into other replacements in layers and in gfx/gl.
---
 gfx/gl/GLTextureImage.cpp            | 39 +++++++++-------------------
 gfx/gl/GLTextureImage.h              | 25 ++++++------------
 gfx/gl/TextureImageCGL.h             |  2 +-
 gfx/gl/TextureImageCGL.mm            |  2 +-
 gfx/gl/TextureImageEGL.cpp           | 11 ++++----
 gfx/gl/TextureImageEGL.h             |  4 +--
 gfx/layers/ipc/AutoOpenSurface.h     |  2 +-
 gfx/layers/ipc/CompositorParent.cpp  |  6 ++---
 gfx/layers/ipc/ShadowLayers.cpp      |  2 +-
 gfx/layers/opengl/TextureHostOGL.cpp |  2 +-
 10 files changed, 35 insertions(+), 60 deletions(-)

diff --git a/gfx/gl/GLTextureImage.cpp b/gfx/gl/GLTextureImage.cpp
index 36ec89565f39..1fba713c5dec 100644
--- a/gfx/gl/GLTextureImage.cpp
+++ b/gfx/gl/GLTextureImage.cpp
@@ -22,7 +22,7 @@ namespace gl {
 
 already_AddRefed<TextureImage>
 CreateTextureImage(GLContext* gl,
-                   const nsIntSize& aSize,
+                   const gfx::IntSize& aSize,
                    TextureImage::ContentType aContentType,
                    GLenum aWrapMode,
                    TextureImage::Flags aFlags,
@@ -101,7 +101,7 @@ TextureImage::UpdateFromDataSource(gfx::DataSourceSurface *aSurface,
 }
 
 gfx::IntRect TextureImage::GetTileRect() {
-    return gfx::IntRect(gfx::IntPoint(0,0), ToIntSize(mSize));
+    return gfx::IntRect(gfx::IntPoint(0,0), mSize);
 }
 
 gfx::IntRect TextureImage::GetSrcTileRect() {
@@ -133,13 +133,13 @@ BasicTextureImage::BeginUpdate(nsIntRegion& aRegion)
     if (CanUploadSubTextures(mGLContext)) {
         GetUpdateRegion(aRegion);
     } else {
-        aRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
     }
 
     mUpdateRegion = aRegion;
 
     nsIntRect rgnSize = mUpdateRegion.GetBounds();
-    if (!nsIntRect(nsIntPoint(0, 0), mSize).Contains(rgnSize)) {
+    if (!nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize)).Contains(rgnSize)) {
         NS_ERROR("update outside of image");
         return nullptr;
     }
@@ -167,7 +167,7 @@ BasicTextureImage::GetUpdateRegion(nsIntRegion& aForRegion)
   // changed, we need to recreate our backing surface and force the
   // client to paint everything
   if (mTextureState != Valid)
-      aForRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+      aForRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
 }
 
 void
@@ -248,7 +248,7 @@ BasicTextureImage::DirectUpdate(gfxASurface* aSurf, const nsIntRegion& aRegion,
 }
 
 void
-BasicTextureImage::Resize(const nsIntSize& aSize)
+BasicTextureImage::Resize(const gfx::IntSize& aSize)
 {
     NS_ASSERTION(!mUpdateSurface, "Resize() while in update?");
 
@@ -268,13 +268,8 @@ BasicTextureImage::Resize(const nsIntSize& aSize)
     mSize = aSize;
 }
 
-// Moz2D equivalents...
-void TextureImage::Resize(const gfx::IntSize& aSize) {
-  Resize(ThebesIntSize(aSize));
-}
-
 gfx::IntSize TextureImage::GetSize() const {
-  return ToIntSize(mSize);
+  return mSize;
 }
 
 TextureImage::TextureImage(const gfx::IntSize& aSize,
@@ -316,16 +311,6 @@ BasicTextureImage::BasicTextureImage(GLuint aTexture,
   , mUpdateOffset(0, 0)
 {}
 
-already_AddRefed<TextureImage>
-CreateBasicTextureImage(GLContext* aGL,
-                        const gfx::IntSize& aSize,
-                        TextureImage::ContentType aContentType,
-                        GLenum aWrapMode,
-                        TextureImage::Flags aFlags)
-{
-  return CreateBasicTextureImage(aGL, ThebesIntSize(aSize), aContentType, aWrapMode, aFlags);
-}
-
 static bool
 WantsSmallTiles(GLContext* gl)
 {
@@ -345,7 +330,7 @@ WantsSmallTiles(GLContext* gl)
 }
 
 TiledTextureImage::TiledTextureImage(GLContext* aGL,
-                                     nsIntSize aSize,
+                                     gfx::IntSize aSize,
                                      TextureImage::ContentType aContentType,
                                      TextureImage::Flags aFlags,
                                      TextureImage::ImageFormat aImageFormat)
@@ -438,7 +423,7 @@ TiledTextureImage::GetUpdateRegion(nsIntRegion& aForRegion)
         // if the texture hasn't been initialized yet, or something important
         // changed, we need to recreate our backing surface and force the
         // client to paint everything
-        aForRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aForRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
         return;
     }
 
@@ -484,7 +469,7 @@ TiledTextureImage::BeginUpdate(nsIntRegion& aRegion)
         // if the texture hasn't been initialized yet, or something important
         // changed, we need to recreate our backing surface and force the
         // client to paint everything
-        aRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
     }
 
     nsIntRect bounds = aRegion.GetBounds();
@@ -637,7 +622,7 @@ TiledTextureImage::BindTexture(GLenum aTextureUnit)
  * each column, and extra rows are pruned after iteration over the entire image
  * finishes.
  */
-void TiledTextureImage::Resize(const nsIntSize& aSize)
+void TiledTextureImage::Resize(const gfx::IntSize& aSize)
 {
     if (mSize == aSize && mTextureState != Created) {
         return;
@@ -734,7 +719,7 @@ uint32_t TiledTextureImage::GetTileCount()
 
 already_AddRefed<TextureImage>
 CreateBasicTextureImage(GLContext* aGL,
-                        const nsIntSize& aSize,
+                        const gfx::IntSize& aSize,
                         TextureImage::ContentType aContentType,
                         GLenum aWrapMode,
                         TextureImage::Flags aFlags,
diff --git a/gfx/gl/GLTextureImage.h b/gfx/gl/GLTextureImage.h
index efda20554860..6f434b6f262e 100644
--- a/gfx/gl/GLTextureImage.h
+++ b/gfx/gl/GLTextureImage.h
@@ -158,14 +158,12 @@ public:
      * If this isn't implemented by a subclass, it will just perform
      * a dummy BeginUpdate/EndUpdate pair.
      */
-    virtual void Resize(const nsIntSize& aSize) {
+    virtual void Resize(const gfx::IntSize& aSize) {
         mSize = aSize;
         nsIntRegion r(nsIntRect(0, 0, aSize.width, aSize.height));
         BeginUpdate(r);
         EndUpdate();
     }
-    // Moz2D equivalent...
-    void Resize(const gfx::IntSize& aSize);
 
     /**
      * Mark this texture as having valid contents. Call this after modifying
@@ -240,7 +238,7 @@ protected:
 
     virtual gfx::IntRect GetSrcTileRect();
 
-    nsIntSize mSize;
+    gfx::IntSize mSize;
     GLenum mWrapMode;
     ContentType mContentType;
     ImageFormat mImageFormat;
@@ -302,7 +300,7 @@ public:
 
     virtual bool InUpdate() const { return !!mUpdateSurface; }
 
-    virtual void Resize(const nsIntSize& aSize);
+    virtual void Resize(const gfx::IntSize& aSize);
 
 protected:
     GLuint mTexture;
@@ -325,7 +323,7 @@ class TiledTextureImage
 {
 public:
     TiledTextureImage(GLContext* aGL,
-                      nsIntSize aSize,
+                      gfx::IntSize aSize,
                       TextureImage::ContentType,
                       TextureImage::Flags aFlags = TextureImage::NoFlags,
                       TextureImage::ImageFormat aImageFormat = gfxImageFormatUnknown);
@@ -334,7 +332,7 @@ public:
     virtual gfxASurface* BeginUpdate(nsIntRegion& aRegion);
     virtual void GetUpdateRegion(nsIntRegion& aForRegion);
     virtual void EndUpdate();
-    virtual void Resize(const nsIntSize& aSize);
+    virtual void Resize(const gfx::IntSize& aSize);
     virtual uint32_t GetTileCount();
     virtual void BeginTileIteration();
     virtual bool NextTile();
@@ -356,7 +354,7 @@ protected:
     void* mIterationCallbackData;
     nsTArray< nsRefPtr<TextureImage> > mImages;
     bool mInUpdate;
-    nsIntSize mSize;
+    gfx::IntSize mSize;
     unsigned int mTileSize;
     unsigned int mRows, mColumns;
     GLContext* mGL;
@@ -375,19 +373,12 @@ protected:
  */
 already_AddRefed<TextureImage>
 CreateBasicTextureImage(GLContext* aGL,
-                        const nsIntSize& aSize,
+                        const gfx::IntSize& aSize,
                         TextureImage::ContentType aContentType,
                         GLenum aWrapMode,
                         TextureImage::Flags aFlags,
                         TextureImage::ImageFormat aImageFormat = gfxImageFormatUnknown);
 
-already_AddRefed<TextureImage>
-CreateBasicTextureImage(GLContext* aGL,
-                        const gfx::IntSize& aSize,
-                        TextureImage::ContentType aContentType,
-                        GLenum aWrapMode,
-                        TextureImage::Flags aFlags);
-
 /**
   * Return a valid, allocated TextureImage of |aSize| with
   * |aContentType|.  If |aContentType| is COLOR, |aImageFormat| can be used
@@ -406,7 +397,7 @@ CreateBasicTextureImage(GLContext* aGL,
   */
 already_AddRefed<TextureImage>
 CreateTextureImage(GLContext* gl,
-                   const nsIntSize& aSize,
+                   const gfx::IntSize& aSize,
                    TextureImage::ContentType aContentType,
                    GLenum aWrapMode,
                    TextureImage::Flags aFlags = TextureImage::NoFlags,
diff --git a/gfx/gl/TextureImageCGL.h b/gfx/gl/TextureImageCGL.h
index 1f816a9721a0..50490d38b21a 100644
--- a/gfx/gl/TextureImageCGL.h
+++ b/gfx/gl/TextureImageCGL.h
@@ -47,7 +47,7 @@ private:
 
 already_AddRefed<TextureImage>
 CreateTextureImageCGL(GLContext *gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/gl/TextureImageCGL.mm b/gfx/gl/TextureImageCGL.mm
index ff36aac7d8df..e875290a1c6a 100644
--- a/gfx/gl/TextureImageCGL.mm
+++ b/gfx/gl/TextureImageCGL.mm
@@ -108,7 +108,7 @@ TextureImageCGL::FinishedSurfaceUpload()
 
 already_AddRefed<TextureImage>
 CreateTextureImageCGL(GLContext* gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/gl/TextureImageEGL.cpp b/gfx/gl/TextureImageEGL.cpp
index f8277271db01..5bbe85872ce5 100644
--- a/gfx/gl/TextureImageEGL.cpp
+++ b/gfx/gl/TextureImageEGL.cpp
@@ -8,6 +8,7 @@
 #include "GLContext.h"
 #include "GLUploadHelpers.h"
 #include "gfxPlatform.h"
+#include "gfx2DGlue.h"
 #include "mozilla/gfx/Types.h"
 
 namespace mozilla {
@@ -103,7 +104,7 @@ TextureImageEGL::GetUpdateRegion(nsIntRegion& aForRegion)
     if (mTextureState != Valid) {
         // if the texture hasn't been initialized yet, force the
         // client to paint everything
-        aForRegion = nsIntRect(nsIntPoint(0, 0), mSize);
+        aForRegion = nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize));
     }
 
     // We can only draw a rectangle, not subregions due to
@@ -123,7 +124,7 @@ TextureImageEGL::BeginUpdate(nsIntRegion& aRegion)
     mUpdateRect = aRegion.GetBounds();
 
     //printf_stderr("BeginUpdate with updateRect [%d %d %d %d]\n", mUpdateRect.x, mUpdateRect.y, mUpdateRect.width, mUpdateRect.height);
-    if (!nsIntRect(nsIntPoint(0, 0), mSize).Contains(mUpdateRect)) {
+    if (!nsIntRect(nsIntPoint(0, 0), gfx::ThebesIntSize(mSize)).Contains(mUpdateRect)) {
         NS_ERROR("update outside of image");
         return nullptr;
     }
@@ -173,7 +174,7 @@ TextureImageEGL::EndUpdate()
 
     if (mTextureState != Valid) {
         NS_ASSERTION(mUpdateRect.x == 0 && mUpdateRect.y == 0 &&
-                      mUpdateRect.Size() == mSize,
+                      mUpdateRect.Size() == gfx::ThebesIntSize(mSize),
                       "Bad initial update on non-created texture!");
 
         mGLContext->fTexImage2D(LOCAL_GL_TEXTURE_2D,
@@ -242,7 +243,7 @@ TextureImageEGL::BindTexture(GLenum aTextureUnit)
 }
 
 void
-TextureImageEGL::Resize(const nsIntSize& aSize)
+TextureImageEGL::Resize(const gfx::IntSize& aSize)
 {
     NS_ASSERTION(!mUpdateSurface, "Resize() while in update?");
 
@@ -313,7 +314,7 @@ TextureImageEGL::DestroyEGLSurface(void)
 
 already_AddRefed<TextureImage>
 CreateTextureImageEGL(GLContext *gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/gl/TextureImageEGL.h b/gfx/gl/TextureImageEGL.h
index 71e99e1ddc06..89d273f84ae5 100644
--- a/gfx/gl/TextureImageEGL.h
+++ b/gfx/gl/TextureImageEGL.h
@@ -47,7 +47,7 @@ public:
 
     virtual bool InUpdate() const { return !!mUpdateSurface; }
 
-    virtual void Resize(const nsIntSize& aSize);
+    virtual void Resize(const gfx::IntSize& aSize);
 
     bool BindTexImage();
 
@@ -79,7 +79,7 @@ protected:
 
 already_AddRefed<TextureImage>
 CreateTextureImageEGL(GLContext *gl,
-                      const nsIntSize& aSize,
+                      const gfx::IntSize& aSize,
                       TextureImage::ContentType aContentType,
                       GLenum aWrapMode,
                       TextureImage::Flags aFlags,
diff --git a/gfx/layers/ipc/AutoOpenSurface.h b/gfx/layers/ipc/AutoOpenSurface.h
index 4ee35bb61af0..785f668d19ff 100644
--- a/gfx/layers/ipc/AutoOpenSurface.h
+++ b/gfx/layers/ipc/AutoOpenSurface.h
@@ -39,7 +39,7 @@ public:
    */
   gfxContentType ContentType();
   gfxImageFormat ImageFormat();
-  gfxIntSize Size();
+  gfx::IntSize Size();
 
   /** This can't escape the scope of AutoOpenSurface. */
   gfxASurface* Get();
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index d848e61d9ca7..079c9891b0ff 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -312,13 +312,11 @@ CompositorParent::RecvMakeSnapshot(const SurfaceDescriptor& aInSnapshot,
                                    SurfaceDescriptor* aOutSnapshot)
 {
   AutoOpenSurface opener(OPEN_READ_WRITE, aInSnapshot);
-  gfxIntSize size = opener.Size();
+  gfx::IntSize size = opener.Size();
   // XXX CreateDrawTargetForSurface will always give us a Cairo surface, we can
   // do better if AutoOpenSurface uses Moz2D directly.
   RefPtr<DrawTarget> target =
-    gfxPlatform::GetPlatform()->CreateDrawTargetForSurface(opener.Get(),
-                                                           IntSize(size.width,
-                                                                   size.height));
+    gfxPlatform::GetPlatform()->CreateDrawTargetForSurface(opener.Get(), size);
   ComposeToTarget(target);
   *aOutSnapshot = aInSnapshot;
   return true;
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index ae00a6093bac..ed9cdf167e0b 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -822,7 +822,7 @@ AutoOpenSurface::ImageFormat()
     mDescriptor, mMode, getter_AddRefs(mSurface));
 }
 
-gfxIntSize
+gfx::IntSize
 AutoOpenSurface::Size()
 {
   if (mSurface) {
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 39d605007ba8..16be30f5dabe 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -552,7 +552,7 @@ TextureImageDeprecatedTextureHostOGL::UpdateImpl(const SurfaceDescriptor& aImage
 #endif
 
   AutoOpenSurface surf(OPEN_READ_ONLY, aImage);
-  nsIntSize size = surf.Size();
+  gfx::IntSize size = surf.Size();
   TextureImage::ImageFormat format = surf.ImageFormat();
 
   if (!mTexture ||

From a5d20cf034a8efbc02f42c59fdf3db8d7b86a9fc Mon Sep 17 00:00:00 2001
From: Tor Arvid Lund <torarvid@comoyo.com>
Date: Fri, 13 Dec 2013 18:32:10 +0100
Subject: [PATCH 359/459] Bug 929513 - Fix compile errors on Windows/Android
 r=nical

Forgot an include in the ImageLayerD3D9.cpp file (though I am unable to
reproduce the issue on my own windows installation).

Also seems in my previous attempt to fix the build, I introduced a
breakage for Android. Hopefully this will fix things.
---
 content/media/plugins/MediaPluginReader.cpp | 3 ++-
 gfx/layers/d3d9/ImageLayerD3D9.cpp          | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/content/media/plugins/MediaPluginReader.cpp b/content/media/plugins/MediaPluginReader.cpp
index be6b8762bf21..a76950f9428e 100644
--- a/content/media/plugins/MediaPluginReader.cpp
+++ b/content/media/plugins/MediaPluginReader.cpp
@@ -6,6 +6,7 @@
 #include "MediaPluginReader.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/dom/TimeRanges.h"
+#include "mozilla/gfx/Point.h"
 #include "MediaResource.h"
 #include "VideoUtils.h"
 #include "MediaPluginDecoder.h"
@@ -172,7 +173,7 @@ bool MediaPluginReader::DecodeVideoFrame(bool &aKeyframeSkip,
  
     nsAutoPtr<VideoData> v;
     if (currentImage) {
-      gfxIntSize frameSize = currentImage->GetSize();
+      gfx::IntSize frameSize = currentImage->GetSize();
       if (frameSize.width != mInitialFrame.width ||
           frameSize.height != mInitialFrame.height) {
         // Frame size is different from what the container reports. This is legal,
diff --git a/gfx/layers/d3d9/ImageLayerD3D9.cpp b/gfx/layers/d3d9/ImageLayerD3D9.cpp
index 43a1527fc520..e6b58cb72048 100644
--- a/gfx/layers/d3d9/ImageLayerD3D9.cpp
+++ b/gfx/layers/d3d9/ImageLayerD3D9.cpp
@@ -11,6 +11,7 @@
 #include "ThebesLayerD3D9.h"
 #include "gfxPlatform.h"
 #include "gfxImageSurface.h"
+#include "gfx2DGlue.h"
 #include "yuv_convert.h"
 #include "nsIServiceManager.h"
 #include "nsIConsoleService.h"

From 6f30920da5ed9a6c920bbeac2eb66e2e92bc61d7 Mon Sep 17 00:00:00 2001
From: Quentin Headen <qheaden@phaseshiftsoftware.com>
Date: Fri, 13 Dec 2013 12:42:43 -0500
Subject: [PATCH 360/459] Bug 731667 - Rewrite mtable implementation to avoid
 use of _moz-* attributes - implement parsing and rendering. r=karlt, r=bz

---
 layout/generic/nsBlockFrame.cpp       |   7 +
 layout/generic/nsBlockFrame.h         |   8 +
 layout/generic/nsLineLayout.cpp       |  10 +-
 layout/mathml/nsMathMLmtableFrame.cpp | 577 +++++++++++++++-----------
 layout/mathml/nsMathMLmtableFrame.h   |  13 +-
 layout/tables/nsTableCellFrame.cpp    |  24 +-
 layout/tables/nsTableCellFrame.h      |   7 +-
 7 files changed, 398 insertions(+), 248 deletions(-)

diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 4a59b02484f8..2f4244b1f201 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -5706,6 +5706,13 @@ nsBlockFrame::DeleteNextInFlowChild(nsPresContext* aPresContext,
   }
 }
 
+const nsStyleText*
+nsBlockFrame::StyleTextForLineLayout()
+{
+  // Return the pointer to an unmodified style text
+  return StyleText();
+}
+
 ////////////////////////////////////////////////////////////////////////
 // Float support
 
diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h
index b5aedcbb08a3..d063c9346d7e 100644
--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -314,6 +314,14 @@ public:
                                      nsIFrame*      aNextInFlow,
                                      bool           aDeletingEmptyFrames) MOZ_OVERRIDE;
 
+  /**
+    * This is a special method that allows a child class of nsBlockFrame to
+    * return a special, customized nsStyleText object to the nsLineLayout
+    * constructor. It is used when the nsBlockFrame child needs to specify its
+    * custom rendering style.
+    */
+  virtual const nsStyleText* StyleTextForLineLayout();
+
   /**
    * Determines whether the collapsed margin carried out of the last
    * line includes the margin-top of a line with clearance (in which
diff --git a/layout/generic/nsLineLayout.cpp b/layout/generic/nsLineLayout.cpp
index 630e5b738e06..a0073b572343 100644
--- a/layout/generic/nsLineLayout.cpp
+++ b/layout/generic/nsLineLayout.cpp
@@ -82,7 +82,12 @@ nsLineLayout::nsLineLayout(nsPresContext* aPresContext,
   MOZ_COUNT_CTOR(nsLineLayout);
 
   // Stash away some style data that we need
-  mStyleText = aOuterReflowState->frame->StyleText();
+  nsBlockFrame* blockFrame = do_QueryFrame(aOuterReflowState->frame);
+  if (blockFrame)
+    mStyleText = blockFrame->StyleTextForLineLayout();
+  else
+    mStyleText = aOuterReflowState->frame->StyleText();
+
   mLineNumber = 0;
   mTotalPlacedFrames = 0;
   mTopEdge = 0;
@@ -201,7 +206,8 @@ nsLineLayout::BeginLineReflow(nscoord aX, nscoord aY,
 
   mTopEdge = aY;
 
-  psd->mNoWrap = !mStyleText->WhiteSpaceCanWrap(LineContainerFrame());
+  psd->mNoWrap =
+    !mStyleText->WhiteSpaceCanWrapStyle() || LineContainerFrame()->IsSVGText();
   psd->mDirection = aDirection;
   psd->mChangedFrameDirection = false;
 
diff --git a/layout/mathml/nsMathMLmtableFrame.cpp b/layout/mathml/nsMathMLmtableFrame.cpp
index 5095ad1ec2a7..86870f2fb506 100644
--- a/layout/mathml/nsMathMLmtableFrame.cpp
+++ b/layout/mathml/nsMathMLmtableFrame.cpp
@@ -9,6 +9,7 @@
 #include "nsStyleConsts.h"
 #include "nsINameSpaceManager.h"
 #include "nsRenderingContext.h"
+#include "nsCSSRendering.h"
 
 #include "nsTArray.h"
 #include "nsTableFrame.h"
@@ -17,74 +18,127 @@
 #include "RestyleManager.h"
 #include <algorithm>
 
+#include "nsIScriptError.h"
+#include "nsContentUtils.h"
+
 using namespace mozilla;
 
 //
 // <mtable> -- table or matrix - implementation
 //
 
-// helper function to perform an in-place split of a space-delimited string,
-// and return an array of pointers for the beginning of each segment, i.e.,
-// aOffset[0] is the first string, aOffset[1] is the second string, etc.
-// Used to parse attributes like columnalign='left right', rowalign='top bottom'
-static void
-SplitString(nsString&             aString, // [IN/OUT]
-            nsTArray<PRUnichar*>& aOffset) // [OUT]
+static int8_t
+ParseStyleValue(nsIAtom* aAttribute, const nsAString& aAttributeValue)
 {
-  static const PRUnichar kNullCh = PRUnichar('\0');
-
-  aString.Append(kNullCh);  // put an extra null at the end
-
-  PRUnichar* start = aString.BeginWriting();
-  PRUnichar* end   = start;
-
-  while (kNullCh != *start) {
-    while ((kNullCh != *start) && nsCRT::IsAsciiSpace(*start)) {  // skip leading space
-      start++;
-    }
-    end = start;
-
-    while ((kNullCh != *end) && (false == nsCRT::IsAsciiSpace(*end))) { // look for space or end
-      end++;
-    }
-    *end = kNullCh; // end string here
-
-    if (start < end) {
-      aOffset.AppendElement(start); // record the beginning of this segment
-    }
-
-    start = ++end;
+  if (aAttribute == nsGkAtoms::rowalign_) {
+    if (aAttributeValue.EqualsLiteral("top"))
+      return NS_STYLE_VERTICAL_ALIGN_TOP;
+    else if (aAttributeValue.EqualsLiteral("bottom"))
+      return NS_STYLE_VERTICAL_ALIGN_BOTTOM;
+    else if (aAttributeValue.EqualsLiteral("center"))
+      return NS_STYLE_VERTICAL_ALIGN_MIDDLE;
+    else
+      return NS_STYLE_VERTICAL_ALIGN_BASELINE;
+  } else if (aAttribute == nsGkAtoms::columnalign_) {
+    if (aAttributeValue.EqualsLiteral("left"))
+      return NS_STYLE_TEXT_ALIGN_LEFT;
+    else if (aAttributeValue.EqualsLiteral("right"))
+      return NS_STYLE_TEXT_ALIGN_RIGHT;
+    else
+      return NS_STYLE_TEXT_ALIGN_CENTER;
+  } else if (aAttribute == nsGkAtoms::rowlines_ ||
+             aAttribute == nsGkAtoms::columnlines_) {
+    if (aAttributeValue.EqualsLiteral("solid"))
+      return NS_STYLE_BORDER_STYLE_SOLID;
+    else if (aAttributeValue.EqualsLiteral("dashed"))
+      return NS_STYLE_BORDER_STYLE_DASHED;
+    else
+      return NS_STYLE_BORDER_STYLE_NONE;
+  } else {
+    MOZ_CRASH("Unrecognized attribute.");
   }
+
+  return -1;
 }
 
-struct nsValueList
+static nsTArray<int8_t>*
+ExtractStyleValues(const nsAString& aString, nsIAtom* aAttribute,
+                   bool aAllowMultiValues)
 {
-  nsString             mData;
-  nsTArray<PRUnichar*> mArray;
+  nsTArray<int8_t>* styleArray = nullptr;
 
-  nsValueList(nsString& aData) {
-    mData.Assign(aData);
-    SplitString(mData, mArray);
+  const PRUnichar* start = aString.BeginReading();
+  const PRUnichar* end = aString.EndReading();
+
+  int32_t startIndex = 0;
+  int32_t count = 0;
+
+  while (start < end) {
+    // Skip leading spaces.
+    while ((start < end) && nsCRT::IsAsciiSpace(*start)) {
+      start++;
+      startIndex++;
+    }
+
+    // Look for the end of the string, or another space.
+    while ((start < end) && !nsCRT::IsAsciiSpace(*start)) {
+      start++;
+      count++;
+    }
+
+    // Grab the value found and process it.
+    if (count > 0) {
+      if (!styleArray)
+        styleArray = new nsTArray<int8_t>();
+
+      // We want to return a null array if an attribute gives multiple values,
+      // but multiple values aren't allowed.
+      if (styleArray->Length() > 1 && !aAllowMultiValues) {
+        delete styleArray;
+        return nullptr;
+      }
+
+      nsDependentSubstring valueString(aString, startIndex, count);
+      int8_t styleValue = ParseStyleValue(aAttribute, valueString);
+      styleArray->AppendElement(styleValue);
+
+      startIndex += count;
+      count = 0;
+    }
   }
-};
+  return styleArray;
+}
+
+static nsresult ReportParseError(nsIFrame* aFrame, const PRUnichar* aAttribute,
+                                 const PRUnichar* aValue)
+{
+  nsIContent* content = aFrame->GetContent();
+
+  const PRUnichar* params[] =
+    { aValue, aAttribute, content->Tag()->GetUTF16String() };
+
+  return nsContentUtils::ReportToConsole(nsIScriptError::errorFlag,
+                                         NS_LITERAL_CSTRING("MathML"),
+                                         content->OwnerDoc(),
+                                         nsContentUtils::eMATHML_PROPERTIES,
+                                         "AttributeParsingError", params, 3);
+}
 
 // Each rowalign='top bottom' or columnalign='left right center' (from
-// <mtable> or <mtr>) is split once (lazily) into a nsValueList which is
+// <mtable> or <mtr>) is split once into an nsTArray<int8_t> which is
 // stored in the property table. Row/Cell frames query the property table
 // to see what values apply to them.
 
-// XXX See bug 69409 - MathML attributes are not mapped to style.
-
 static void
-DestroyValueList(void* aPropertyValue)
+DestroyStylePropertyList(void* aPropertyValue)
 {
-  delete static_cast<nsValueList*>(aPropertyValue);
+  delete static_cast<nsTArray<int8_t>*>(aPropertyValue);
 }
 
-NS_DECLARE_FRAME_PROPERTY(RowAlignProperty, DestroyValueList)
-NS_DECLARE_FRAME_PROPERTY(RowLinesProperty, DestroyValueList)
-NS_DECLARE_FRAME_PROPERTY(ColumnAlignProperty, DestroyValueList)
-NS_DECLARE_FRAME_PROPERTY(ColumnLinesProperty, DestroyValueList)
+NS_DECLARE_FRAME_PROPERTY(RowAlignProperty, DestroyStylePropertyList)
+NS_DECLARE_FRAME_PROPERTY(RowLinesProperty, DestroyStylePropertyList)
+NS_DECLARE_FRAME_PROPERTY(ColumnAlignProperty, DestroyStylePropertyList)
+NS_DECLARE_FRAME_PROPERTY(ColumnLinesProperty, DestroyStylePropertyList)
 
 static const FramePropertyDescriptor*
 AttributeToProperty(nsIAtom* aAttribute)
@@ -99,141 +153,132 @@ AttributeToProperty(nsIAtom* aAttribute)
   return ColumnLinesProperty();
 }
 
-static PRUnichar*
-GetValueAt(nsIFrame*                      aTableOrRowFrame,
-           const FramePropertyDescriptor* aProperty,
-           nsIAtom*                       aAttribute,
-           int32_t                        aRowOrColIndex)
+/* This method looks for a property that applies to a cell, but it looks
+ * recursively because some cell properties can come from the cell, a row,
+ * a table, etc. This function searches through the heirarchy for a property
+ * and returns its value. The function stops searching after checking a <mtable>
+ * frame.
+ */
+static nsTArray<int8_t>*
+FindCellProperty(const nsIFrame* aCellFrame,
+                 const FramePropertyDescriptor* aFrameProperty)
 {
-  FrameProperties props = aTableOrRowFrame->Properties();
-  nsValueList* valueList = static_cast<nsValueList*>(props.Get(aProperty));
-  if (!valueList) {
-    // The property isn't there yet, so set it
-    nsAutoString values;
-    aTableOrRowFrame->GetContent()->GetAttr(kNameSpaceID_None, aAttribute, values);
-    if (!values.IsEmpty())
-      valueList = new nsValueList(values);
-    if (!valueList || !valueList->mArray.Length()) {
-      delete valueList; // ok either way, delete is null safe
-      return nullptr;
-    }
-    props.Set(aProperty, valueList);
+  const nsIFrame* currentFrame = aCellFrame;
+  nsTArray<int8_t>* propertyData = nullptr;
+
+  while (currentFrame) {
+    FrameProperties props = currentFrame->Properties();
+    propertyData = static_cast<nsTArray<int8_t>*>(props.Get(aFrameProperty));
+    bool frameIsTable = (currentFrame->GetType() == nsGkAtoms::tableFrame);
+
+    if (propertyData || frameIsTable)
+      currentFrame = nullptr; // A null frame pointer exits the loop
+    else
+      currentFrame = currentFrame->GetParent(); // Go to the parent frame
   }
-  int32_t count = valueList->mArray.Length();
-  return (aRowOrColIndex < count)
-         ? valueList->mArray[aRowOrColIndex]
-         : valueList->mArray[count-1];
+
+  return propertyData;
 }
 
+/*
+ * A variant of the nsDisplayBorder contains special code to render a border
+ * around a nsMathMLmtdFrame based on the rowline and columnline properties
+ * set on the cell frame.
+ */
+class nsDisplaymtdBorder : public nsDisplayBorder {
+public:
+  nsDisplaymtdBorder(nsDisplayListBuilder* aBuilder, nsMathMLmtdFrame* aFrame)
+    : nsDisplayBorder(aBuilder, aFrame)
+  {
+  }
+
+  virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx) MOZ_OVERRIDE
+  {
+    int32_t rowIndex;
+    int32_t columnIndex;
+    static_cast<nsTableCellFrame*>(mFrame)->
+      GetCellIndexes(rowIndex, columnIndex);
+
+    nsStyleBorder styleBorder = *mFrame->StyleBorder();
+    nscoord borderWidth =
+      mFrame->PresContext()->GetBorderWidthTable()[NS_STYLE_BORDER_WIDTH_THIN];
+
+    nsTArray<int8_t>* rowLinesList =
+      FindCellProperty(mFrame, RowLinesProperty());
+
+    nsTArray<int8_t>* columnLinesList =
+      FindCellProperty(mFrame, ColumnLinesProperty());
+
+    // We don't place a row line on top of the first row
+    if (rowIndex > 0 && rowLinesList) {
+      // If the row number is greater than the number of provided rowline
+      // values, we simply repeat the last value.
+      int32_t listLength = rowLinesList->Length();
+      if (rowIndex < listLength) {
+        styleBorder.SetBorderStyle(NS_SIDE_TOP,
+                      rowLinesList->ElementAt(rowIndex - 1));
+      } else {
+        styleBorder.SetBorderStyle(NS_SIDE_TOP,
+                      rowLinesList->ElementAt(listLength - 1));
+      }
+      styleBorder.SetBorderWidth(NS_SIDE_TOP, borderWidth);
+    }
+
+    // We don't place a column line on the left of the first column.
+    if (columnIndex > 0 && columnLinesList) {
+      // If the column number is greater than the number of provided columline
+      // values, we simply repeat the last value.
+      int32_t listLength = columnLinesList->Length();
+      if (columnIndex < listLength) {
+        styleBorder.SetBorderStyle(NS_SIDE_LEFT,
+                      columnLinesList->ElementAt(columnIndex - 1));
+      } else {
+        styleBorder.SetBorderStyle(NS_SIDE_LEFT,
+                      columnLinesList->ElementAt(listLength - 1));
+      }
+      styleBorder.SetBorderWidth(NS_SIDE_LEFT, borderWidth);
+    }
+
+    nsPoint offset = ToReferenceFrame();
+    nsCSSRendering::PaintBorderWithStyleBorder(mFrame->PresContext(), *aCtx,
+                                               mFrame, mVisibleRect,
+                                               nsRect(offset,
+                                                      mFrame->GetSize()),
+                                               styleBorder,
+                                               mFrame->StyleContext(),
+                                               mFrame->GetSkipSides());
+  }
+};
+
 #ifdef DEBUG
-static bool
-IsTable(uint8_t aDisplay)
-{
-  if ((aDisplay == NS_STYLE_DISPLAY_TABLE) ||
-      (aDisplay == NS_STYLE_DISPLAY_INLINE_TABLE))
-    return true;
-  return false;
-}
-
 #define DEBUG_VERIFY_THAT_FRAME_IS(_frame, _expected) \
   NS_ASSERTION(NS_STYLE_DISPLAY_##_expected == _frame->StyleDisplay()->mDisplay, "internal error");
-#define DEBUG_VERIFY_THAT_FRAME_IS_TABLE(_frame) \
-  NS_ASSERTION(IsTable(_frame->StyleDisplay()->mDisplay), "internal error");
 #else
 #define DEBUG_VERIFY_THAT_FRAME_IS(_frame, _expected)
-#define DEBUG_VERIFY_THAT_FRAME_IS_TABLE(_frame)
 #endif
 
-// map attributes that depend on the index of the row:
-// rowalign, rowlines, XXX need rowspacing too
 static void
-MapRowAttributesIntoCSS(nsIFrame* aTableFrame,
-                        nsIFrame* aRowFrame)
+ParseFrameAttribute(nsIFrame* aFrame, nsIAtom* aAttribute,
+                    bool aAllowMultiValues)
 {
-  DEBUG_VERIFY_THAT_FRAME_IS_TABLE(aTableFrame);
-  DEBUG_VERIFY_THAT_FRAME_IS(aRowFrame, TABLE_ROW);
-  int32_t rowIndex = ((nsTableRowFrame*)aRowFrame)->GetRowIndex();
-  nsIContent* rowContent = aRowFrame->GetContent();
-  PRUnichar* attr;
+  nsAutoString attrValue;
 
-  // see if the rowalign attribute is not already set
-  if (!rowContent->HasAttr(kNameSpaceID_None, nsGkAtoms::rowalign_) &&
-      !rowContent->HasAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowalign_)) {
-    // see if the rowalign attribute was specified on the table
-    attr = GetValueAt(aTableFrame, RowAlignProperty(),
-                      nsGkAtoms::rowalign_, rowIndex);
-    if (attr) {
-      // set our special _moz attribute on the row without notifying a reflow
-      rowContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowalign_,
-                          nsDependentString(attr), false);
-    }
-  }
+  nsIContent* frameContent = aFrame->GetContent();
+  frameContent->GetAttr(kNameSpaceID_None, aAttribute, attrValue);
 
-  // if we are not on the first row, see if |rowlines| was specified on the table.
-  // Note that we pass 'rowIndex-1' because the CSS rule in mathml.css is associated
-  // to 'border-top', and it is as if we draw the line on behalf of the previous cell.
-  // This way of doing so allows us to handle selective lines, [row]\hline[row][row]',
-  // and cases of spanning cells without further complications.
-  if (rowIndex > 0 &&
-      !rowContent->HasAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowline_)) {
-    attr = GetValueAt(aTableFrame, RowLinesProperty(),
-                      nsGkAtoms::rowlines_, rowIndex-1);
-    if (attr) {
-      // set our special _moz attribute on the row without notifying a reflow
-      rowContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowline_,
-                          nsDependentString(attr), false);
-    }
-  }
-}
+  if (!attrValue.IsEmpty()) {
+    nsTArray<int8_t>* valueList =
+      ExtractStyleValues(attrValue, aAttribute, aAllowMultiValues);
 
-// map attributes that depend on the index of the column:
-// columnalign, columnlines, XXX need columnwidth and columnspacing too
-static void
-MapColAttributesIntoCSS(nsIFrame* aTableFrame,
-                        nsIFrame* aRowFrame,
-                        nsIFrame* aCellFrame)
-{
-  DEBUG_VERIFY_THAT_FRAME_IS_TABLE(aTableFrame);
-  DEBUG_VERIFY_THAT_FRAME_IS(aRowFrame, TABLE_ROW);
-  DEBUG_VERIFY_THAT_FRAME_IS(aCellFrame, TABLE_CELL);
-  int32_t rowIndex, colIndex;
-  ((nsTableCellFrame*)aCellFrame)->GetCellIndexes(rowIndex, colIndex);
-  nsIContent* cellContent = aCellFrame->GetContent();
-  PRUnichar* attr;
-
-  // see if the columnalign attribute is not already set
-  if (!cellContent->HasAttr(kNameSpaceID_None, nsGkAtoms::columnalign_) &&
-      !cellContent->HasAttr(kNameSpaceID_None,
-                            nsGkAtoms::_moz_math_columnalign_)) {
-    // see if the columnalign attribute was specified on the row
-    attr = GetValueAt(aRowFrame, ColumnAlignProperty(),
-                      nsGkAtoms::columnalign_, colIndex);
-    if (!attr) {
-      // see if the columnalign attribute was specified on the table
-      attr = GetValueAt(aTableFrame, ColumnAlignProperty(),
-                        nsGkAtoms::columnalign_, colIndex);
-    }
-    if (attr) {
-      // set our special _moz attribute without notifying a reflow
-      cellContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnalign_,
-                           nsDependentString(attr), false);
-    }
-  }
-
-  // if we are not on the first column, see if |columnlines| was specified on
-  // the table. Note that we pass 'colIndex-1' because the CSS rule in mathml.css
-  // is associated to 'border-left', and it is as if we draw the line on behalf
-  // of the previous cell. This way of doing so allows us to handle selective lines,
-  // e.g., 'r|cl', and cases of spanning cells without further complications.
-  if (colIndex > 0 &&
-      !cellContent->HasAttr(kNameSpaceID_None,
-                            nsGkAtoms::_moz_math_columnline_)) {
-    attr = GetValueAt(aTableFrame, ColumnLinesProperty(),
-                      nsGkAtoms::columnlines_, colIndex-1);
-    if (attr) {
-      // set our special _moz attribute without notifying a reflow
-      cellContent->SetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnline_,
-                           nsDependentString(attr), false);
+    // If valueList is null, that indicates a problem with the attribute value.
+    // Only set properties on a valid attribute value.
+    if (valueList) {
+      // The code reading the property assumes that this list is nonempty.
+      NS_ASSERTION(valueList->Length() >= 1, "valueList should not be empty!");
+      FrameProperties props = aFrame->Properties();
+      props.Set(AttributeToProperty(aAttribute), valueList);
+    } else {
+      ReportParseError(aFrame, aAttribute->GetUTF16String(), attrValue.get());
     }
   }
 }
@@ -243,6 +288,14 @@ MapColAttributesIntoCSS(nsIFrame* aTableFrame,
 static void
 MapAllAttributesIntoCSS(nsIFrame* aTableFrame)
 {
+  // Map mtable rowalign & rowlines.
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::rowalign_, true);
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::rowlines_, true);
+
+  // Map mtable columnalign & columnlines.
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::columnalign_, true);
+  ParseFrameAttribute(aTableFrame, nsGkAtoms::columnlines_, true);
+
   // mtable is simple and only has one (pseudo) row-group
   nsIFrame* rgFrame = aTableFrame->GetFirstPrincipalChild();
   if (!rgFrame || rgFrame->GetType() != nsGkAtoms::tableRowGroupFrame)
@@ -252,12 +305,19 @@ MapAllAttributesIntoCSS(nsIFrame* aTableFrame)
   for ( ; rowFrame; rowFrame = rowFrame->GetNextSibling()) {
     DEBUG_VERIFY_THAT_FRAME_IS(rowFrame, TABLE_ROW);
     if (rowFrame->GetType() == nsGkAtoms::tableRowFrame) {
-      MapRowAttributesIntoCSS(aTableFrame, rowFrame);
+      // Map row rowalign.
+      ParseFrameAttribute(rowFrame, nsGkAtoms::rowalign_, false);
+      // Map row columnalign.
+      ParseFrameAttribute(rowFrame, nsGkAtoms::columnalign_, true);
+
       nsIFrame* cellFrame = rowFrame->GetFirstPrincipalChild();
       for ( ; cellFrame; cellFrame = cellFrame->GetNextSibling()) {
         DEBUG_VERIFY_THAT_FRAME_IS(cellFrame, TABLE_CELL);
         if (IS_TABLE_CELL(cellFrame->GetType())) {
-          MapColAttributesIntoCSS(aTableFrame, rowFrame, cellFrame);
+          // Map cell rowalign.
+          ParseFrameAttribute(cellFrame, nsGkAtoms::rowalign_, false);
+          // Map row columnalign.
+          ParseFrameAttribute(cellFrame, nsGkAtoms::columnalign_, false);
         }
       }
     }
@@ -457,48 +517,27 @@ nsMathMLmtableOuterFrame::AttributeChanged(int32_t  aNameSpaceID,
   }
 
   // ...and the other attributes affect rows or columns in one way or another
-  nsIAtom* MOZrowAtom = nullptr;
-  nsIAtom* MOZcolAtom = nullptr;
-  if (aAttribute == nsGkAtoms::rowalign_)
-    MOZrowAtom = nsGkAtoms::_moz_math_rowalign_;
-  else if (aAttribute == nsGkAtoms::rowlines_)
-    MOZrowAtom = nsGkAtoms::_moz_math_rowline_;
-  else if (aAttribute == nsGkAtoms::columnalign_)
-    MOZcolAtom = nsGkAtoms::_moz_math_columnalign_;
-  else if (aAttribute == nsGkAtoms::columnlines_)
-    MOZcolAtom = nsGkAtoms::_moz_math_columnline_;
 
-  if (!MOZrowAtom && !MOZcolAtom)
+  // Ignore attributes that do not affect layout.
+  if (aAttribute != nsGkAtoms::rowalign_ &&
+      aAttribute != nsGkAtoms::rowlines_ &&
+      aAttribute != nsGkAtoms::columnalign_ &&
+      aAttribute != nsGkAtoms::columnlines_) {
     return NS_OK;
+  }
 
   nsPresContext* presContext = tableFrame->PresContext();
-  // clear any cached nsValueList for this table
+
+  // clear any cached property list for this table
   presContext->PropertyTable()->
     Delete(tableFrame, AttributeToProperty(aAttribute));
 
-  // unset any _moz attribute that we may have set earlier, and re-sync
-  nsIFrame* rowFrame = rgFrame->GetFirstPrincipalChild();
-  for ( ; rowFrame; rowFrame = rowFrame->GetNextSibling()) {
-    if (rowFrame->GetType() == nsGkAtoms::tableRowFrame) {
-      if (MOZrowAtom) { // let rows do the work
-        rowFrame->GetContent()->UnsetAttr(kNameSpaceID_None, MOZrowAtom, false);
-        MapRowAttributesIntoCSS(tableFrame, rowFrame);    
-      } else { // let cells do the work
-        nsIFrame* cellFrame = rowFrame->GetFirstPrincipalChild();
-        for ( ; cellFrame; cellFrame = cellFrame->GetNextSibling()) {
-          if (IS_TABLE_CELL(cellFrame->GetType())) {
-            cellFrame->GetContent()->UnsetAttr(kNameSpaceID_None, MOZcolAtom, false);
-            MapColAttributesIntoCSS(tableFrame, rowFrame, cellFrame);
-          }
-        }
-      }
-    }
-  }
+  // Reparse the new attribute on the table.
+  ParseFrameAttribute(tableFrame, aAttribute, true);
 
-  // Explicitly request a re-resolve and reflow in our subtree to pick up any changes
-  presContext->RestyleManager()->
-    PostRestyleEvent(mContent->AsElement(), eRestyle_Subtree,
-                     nsChangeHint_AllReflowHints);
+  // Explicitly request a reflow in our subtree to pick up any changes
+  presContext->PresShell()->
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
 
   return NS_OK;
 }
@@ -704,43 +743,26 @@ nsMathMLmtrFrame::AttributeChanged(int32_t  aNameSpaceID,
 {
   // Attributes specific to <mtr>:
   // groupalign  : Not yet supported.
-  // rowalign    : Fully specified in mathml.css, and so HasAttributeDependentStyle() will
-  //               pick it up and RestyleManager will issue a PostRestyleEvent().
-  // columnalign : Need an explicit re-style call.
-
-  if (aAttribute == nsGkAtoms::rowalign_) {
-    // unset any _moz attribute that we may have set earlier, and re-sync
-    mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_rowalign_,
-                        false);
-    MapRowAttributesIntoCSS(nsTableFrame::GetTableFrame(this), this);
-    // That's all - see comment above.
-    return NS_OK;
-  }
-
-  if (aAttribute != nsGkAtoms::columnalign_)
-    return NS_OK;
+  // rowalign    : Here
+  // columnalign : Here
 
   nsPresContext* presContext = PresContext();
-  // Clear any cached columnalign's nsValueList for this row
-  presContext->PropertyTable()->Delete(this, AttributeToProperty(aAttribute));
 
-  // Clear any internal _moz attribute that we may have set earlier
-  // in our cells and re-sync their columnalign attribute
-  nsTableFrame* tableFrame = nsTableFrame::GetTableFrame(this);
-  nsIFrame* cellFrame = GetFirstPrincipalChild();
-  for ( ; cellFrame; cellFrame = cellFrame->GetNextSibling()) {
-    if (IS_TABLE_CELL(cellFrame->GetType())) {
-      cellFrame->GetContent()->
-        UnsetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnalign_,
-                  false);
-      MapColAttributesIntoCSS(tableFrame, this, cellFrame);
-    }
+  if (aAttribute != nsGkAtoms::rowalign_ &&
+      aAttribute != nsGkAtoms::columnalign_) {
+    return NS_OK;
   }
 
-  // Explicitly request a re-resolve and reflow in our subtree to pick up any changes
-  presContext->RestyleManager()->
-    PostRestyleEvent(mContent->AsElement(), eRestyle_Subtree,
-                     nsChangeHint_AllReflowHints);
+  presContext->PropertyTable()->Delete(this, AttributeToProperty(aAttribute));
+
+  bool allowMultiValues = (aAttribute == nsGkAtoms::columnalign_);
+
+  // Reparse the new attribute.
+  ParseFrameAttribute(this, aAttribute, allowMultiValues);
+
+  // Explicitly request a reflow in our subtree to pick up any changes
+  presContext->PresShell()->
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
 
   return NS_OK;
 }
@@ -806,16 +828,19 @@ nsMathMLmtdFrame::AttributeChanged(int32_t  aNameSpaceID,
 {
   // Attributes specific to <mtd>:
   // groupalign  : Not yet supported
-  // rowalign    : in mathml.css
+  // rowalign    : here
   // columnalign : here
   // rowspan     : here
   // columnspan  : here
 
-  if (aAttribute == nsGkAtoms::columnalign_) {
-    // unset any _moz attribute that we may have set earlier, and re-sync
-    mContent->UnsetAttr(kNameSpaceID_None, nsGkAtoms::_moz_math_columnalign_,
-                        false);
-    MapColAttributesIntoCSS(nsTableFrame::GetTableFrame(this), mParent, this);
+  if (aAttribute == nsGkAtoms::rowalign_ ||
+      aAttribute == nsGkAtoms::columnalign_) {
+
+    nsPresContext* presContext = PresContext();
+    presContext->PropertyTable()->Delete(this, AttributeToProperty(aAttribute));
+
+    // Reparse the attribute.
+    ParseFrameAttribute(this, aAttribute, false);
     return NS_OK;
   }
 
@@ -830,6 +855,38 @@ nsMathMLmtdFrame::AttributeChanged(int32_t  aNameSpaceID,
   return NS_OK;
 }
 
+uint8_t
+nsMathMLmtdFrame::GetVerticalAlign() const
+{
+  // Set the default alignment in case no alignment was specified
+  uint8_t alignment = nsTableCellFrame::GetVerticalAlign();
+
+  nsTArray<int8_t>* alignmentList = FindCellProperty(this, RowAlignProperty());
+
+  if (alignmentList) {
+    int32_t rowIndex;
+    GetRowIndex(rowIndex);
+
+    // If the row number is greater than the number of provided rowalign values,
+    // we simply repeat the last value.
+    if (rowIndex < (int32_t)alignmentList->Length())
+      alignment = alignmentList->ElementAt(rowIndex);
+    else
+      alignment = alignmentList->ElementAt(alignmentList->Length() - 1);
+  }
+
+  return alignment;
+}
+
+nsresult
+nsMathMLmtdFrame::ProcessBorders(nsTableFrame* aFrame,
+                                 nsDisplayListBuilder* aBuilder,
+                                 const nsDisplayListSet& aLists)
+{
+  aLists.BorderBackground()->AppendNewToTop(new (aBuilder)
+                                            nsDisplaymtdBorder(aBuilder, this));
+  return NS_OK;
+}
 // --------
 // implementation of nsMathMLmtdInnerFrame
 
@@ -845,8 +902,16 @@ NS_NewMathMLmtdInnerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 
 NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmtdInnerFrame)
 
+nsMathMLmtdInnerFrame::nsMathMLmtdInnerFrame(nsStyleContext* aContext)
+  : nsBlockFrame(aContext)
+{
+  // Make a copy of the parent nsStyleText for later modificaiton.
+  mUniqueStyleText = new (PresContext()) nsStyleText(*StyleText());
+}
+
 nsMathMLmtdInnerFrame::~nsMathMLmtdInnerFrame()
 {
+  mUniqueStyleText->Destroy(PresContext());
 }
 
 NS_IMETHODIMP
@@ -862,3 +927,37 @@ nsMathMLmtdInnerFrame::Reflow(nsPresContext*          aPresContext,
   // ...
   return rv;
 }
+
+const
+nsStyleText* nsMathMLmtdInnerFrame::StyleTextForLineLayout()
+{
+  // Set the default alignment in case nothing was specified
+  uint8_t alignment = StyleText()->mTextAlign;
+
+  nsTArray<int8_t>* alignmentList =
+    FindCellProperty(this, ColumnAlignProperty());
+
+  if (alignmentList) {
+    nsMathMLmtdFrame* cellFrame = (nsMathMLmtdFrame*)GetParent();
+    int32_t columnIndex;
+    cellFrame->GetColIndex(columnIndex);
+
+    // If the column number is greater than the number of provided columalign
+    // values, we simply repeat the last value.
+    if (columnIndex < (int32_t)alignmentList->Length())
+      alignment = alignmentList->ElementAt(columnIndex);
+    else
+      alignment = alignmentList->ElementAt(alignmentList->Length() - 1);
+  }
+
+  mUniqueStyleText->mTextAlign = alignment;
+  return mUniqueStyleText;
+}
+
+/* virtual */ void
+nsMathMLmtdInnerFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
+{
+  nsBlockFrame::DidSetStyleContext(aOldStyleContext);
+  mUniqueStyleText->Destroy(PresContext());
+  mUniqueStyleText = new (PresContext()) nsStyleText(*StyleText());
+}
diff --git a/layout/mathml/nsMathMLmtableFrame.h b/layout/mathml/nsMathMLmtableFrame.h
index 45e4e54ccfaf..2f7e4d79d077 100644
--- a/layout/mathml/nsMathMLmtableFrame.h
+++ b/layout/mathml/nsMathMLmtableFrame.h
@@ -209,6 +209,11 @@ public:
                    nsIAtom* aAttribute,
                    int32_t  aModType) MOZ_OVERRIDE;
 
+  virtual uint8_t GetVerticalAlign() const;
+  virtual nsresult ProcessBorders(nsTableFrame* aFrame,
+                                  nsDisplayListBuilder* aBuilder,
+                                  const nsDisplayListSet& aLists);
+
   virtual int32_t GetRowSpan() MOZ_OVERRIDE;
   virtual int32_t GetColSpan() MOZ_OVERRIDE;
   virtual bool IsFrameOfType(uint32_t aFlags) const MOZ_OVERRIDE
@@ -256,9 +261,15 @@ public:
       ~(nsIFrame::eMathML | nsIFrame::eExcludesIgnorableWhitespace));
   }
 
+  virtual const nsStyleText* StyleTextForLineLayout();
+  virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext) MOZ_OVERRIDE;
+
 protected:
-  nsMathMLmtdInnerFrame(nsStyleContext* aContext) : nsBlockFrame(aContext) {}
+  nsMathMLmtdInnerFrame(nsStyleContext* aContext);
   virtual ~nsMathMLmtdInnerFrame();
+
+  nsStyleText* mUniqueStyleText;
+
 };  // class nsMathMLmtdInnerFrame
 
 #endif /* nsMathMLmtableFrame_h___ */
diff --git a/layout/tables/nsTableCellFrame.cpp b/layout/tables/nsTableCellFrame.cpp
index 7be95b708345..f974e7ddd423 100644
--- a/layout/tables/nsTableCellFrame.cpp
+++ b/layout/tables/nsTableCellFrame.cpp
@@ -353,6 +353,24 @@ nsTableCellFrame::PaintCellBackground(nsRenderingContext& aRenderingContext,
   PaintBackground(aRenderingContext, aDirtyRect, aPt, aFlags);
 }
 
+nsresult
+nsTableCellFrame::ProcessBorders(nsTableFrame* aFrame,
+                                 nsDisplayListBuilder* aBuilder,
+                                 const nsDisplayListSet& aLists)
+{
+  const nsStyleBorder* borderStyle = StyleBorder();
+  if (aFrame->IsBorderCollapse() || !borderStyle->HasBorder())
+    return NS_OK;
+
+  if (!GetContentEmpty() ||
+      StyleTableBorder()->mEmptyCells == NS_STYLE_TABLE_EMPTY_CELLS_SHOW) {
+    aLists.BorderBackground()->AppendNewToTop(new (aBuilder)
+                                              nsDisplayBorder(aBuilder, this));
+  }
+
+  return NS_OK;
+}
+
 class nsDisplayTableCellBackground : public nsDisplayTableItem {
 public:
   nsDisplayTableCellBackground(nsDisplayListBuilder* aBuilder,
@@ -486,11 +504,7 @@ nsTableCellFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
       }
     
       // display borders if we need to
-      if (!tableFrame->IsBorderCollapse() && borderStyle->HasBorder() &&
-          emptyCellStyle == NS_STYLE_TABLE_EMPTY_CELLS_SHOW) {
-        aLists.BorderBackground()->AppendNewToTop(new (aBuilder)
-          nsDisplayBorder(aBuilder, this));
-      }
+      ProcessBorders(tableFrame, aBuilder, aLists);
     
       // and display the selection border if we need to
       if (IsSelected()) {
diff --git a/layout/tables/nsTableCellFrame.h b/layout/tables/nsTableCellFrame.h
index c3523c5cae9e..9c5c9fd93820 100644
--- a/layout/tables/nsTableCellFrame.h
+++ b/layout/tables/nsTableCellFrame.h
@@ -101,6 +101,11 @@ public:
                            const nsRect& aDirtyRect, nsPoint aPt,
                            uint32_t aFlags);
 
+ 
+  virtual nsresult ProcessBorders(nsTableFrame* aFrame,
+                                  nsDisplayListBuilder* aBuilder,
+                                  const nsDisplayListSet& aLists);
+
   virtual nscoord GetMinWidth(nsRenderingContext *aRenderingContext) MOZ_OVERRIDE;
   virtual nscoord GetPrefWidth(nsRenderingContext *aRenderingContext) MOZ_OVERRIDE;
   virtual IntrinsicWidthOffsetData
@@ -129,7 +134,7 @@ public:
    * table cell, which means the result is always
    * NS_STYLE_VERTICAL_ALIGN_{TOP,MIDDLE,BOTTOM,BASELINE}.
    */
-  uint8_t GetVerticalAlign() const;
+  virtual uint8_t GetVerticalAlign() const;
 
   bool HasVerticalAlignBaseline() const {
     return GetVerticalAlign() == NS_STYLE_VERTICAL_ALIGN_BASELINE;

From 7e48d344d0da8afedcf466ce2852c9d6a35054da Mon Sep 17 00:00:00 2001
From: Quentin Headen <qheaden@phaseshiftsoftware.com>
Date: Fri, 13 Dec 2013 12:42:57 -0500
Subject: [PATCH 361/459] Bug 731667 - Rewrite mtable implementation to avoid
 use of _moz-* attributes - remove legacy code. r=karlt

---
 content/base/src/nsGkAtomList.h |  7 ----
 layout/mathml/mathml.css        | 73 ---------------------------------
 2 files changed, 80 deletions(-)

diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index 887e914e2933..a5b346cd1bf7 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -1471,13 +1471,6 @@ GK_ATOM(restart, "restart")
 GK_ATOM(to, "to")
 GK_ATOM(XML, "XML")
 
-// internal MathML attributes: different from columnalign_, columnlines_,
-// rowalign_ and rowlines_
-GK_ATOM(_moz_math_columnalign_, "_moz-math-columnalign")
-GK_ATOM(_moz_math_columnline_, "_moz-math-columnline")
-GK_ATOM(_moz_math_rowalign_, "_moz-math-rowalign")
-GK_ATOM(_moz_math_rowline_, "_moz-math-rowline")
-
 GK_ATOM(abs_, "abs")
 GK_ATOM(accent_, "accent")
 GK_ATOM(accentunder_, "accentunder")
diff --git a/layout/mathml/mathml.css b/layout/mathml/mathml.css
index 83ee9f462fb7..ae8abf231b2e 100644
--- a/layout/mathml/mathml.css
+++ b/layout/mathml/mathml.css
@@ -143,53 +143,6 @@ mlabeledtr > mtd:first-child {
     display: none;
 }
 
-/***********************/
-/* -- mtd: columnalign */
-
-mtd[_moz-math-columnalign="left"],
-mtd[columnalign="left"] {
-  text-align: left;
-}
-mtd[_moz-math-columnalign="right"],
-mtd[columnalign="right"] {
-  text-align: right;
-}
-mtd[_moz-math-columnalign="center"],
-mtd[columnalign="center"] {
-  text-align: -moz-center;
-}
-
-/*************************/
-/* -- mtr, mtd: rowalign */
-
-mtr[_moz-math-rowalign="top"],
-mtr[rowalign="top"],
-mtd[rowalign="top"] {
-  vertical-align: top;
-}
-mtr[_moz-math-rowalign="bottom"],
-mtr[rowalign="bottom"],
-mtd[rowalign="bottom"] {
-  vertical-align: bottom;
-}
-mtr[_moz-math-rowalign="center"],
-mtr[rowalign="center"],
-mtd[rowalign="center"] {
-  vertical-align: middle;
-}
-mtr[_moz-math-rowalign="baseline"],
-mtr[rowalign="baseline"],
-mtd[rowalign="baseline"] {
-  vertical-align: baseline;
-}
-/* -- not yet supported --
-mtr[_moz-math-rowalign="axis"],
-mtr[rowalign="axis"],
-mtd[rowalign="axis"] {
-  vertical-align: mathline;
-}
-*/
-
 /**********************************************************************/
 /* rules to achieve the default spacing between cells. The back-end code
    will set the internal attributes depending on the cell's position.
@@ -233,32 +186,6 @@ mtable[frame="dashed"] > mtr > mtd:last-child {
   padding-right: 0.4em; /* framespacing.right */
 }
 
-/**********************************************************************/
-/* internal settings to support 'rowlines' and 'columnlines'. To
-   achieve the recommended behavior, the back-end code will avoid setting
-   unsuitable rules on the cells on the first row and the first column.
-   In general, however, authors can use the 'border' property of CSS to
-   achieve varying effects down to the level of the table cell. */
-mtr[_moz-math-rowline="none"] > mtd {
-  border-top: none;
-}
-mtr[_moz-math-rowline="solid"] > mtd {
-  border-top: solid thin;
-}
-mtr[_moz-math-rowline="dashed"] > mtd {
-  border-top: dashed thin;
-}
-mtd[_moz-math-columnline="none"] {
-  border-left: none;
-}
-mtd[_moz-math-columnline="solid"] {
-  border-left: solid thin;
-}
-mtd[_moz-math-columnline="dashed"] {
-  border-left: dashed thin;
-}
-
-
 /**************************************************************************/
 /* Style used for stretchy symbols *must* be normal to avoid misaligments */
 /* By leaving the font-family empty, the MathML engine will use the value

From 3a7159dca8019add5577671a9d22d6ef59436e09 Mon Sep 17 00:00:00 2001
From: Quentin Headen <qheaden@phaseshiftsoftware.com>
Date: Fri, 13 Dec 2013 12:43:17 -0500
Subject: [PATCH 362/459] Bug 731667 - Rewrite mtable implementation to avoid
 use of _moz-* attributes - tests. r=fredw

---
 ...able-columnalign-multi-mtable-dynamic.html | 146 +++++++++++++++++
 .../mtable-columnalign-multi-mtable.html      | 128 +++++++++++++++
 .../mtable-columnalign-multi-mtr-dynamic.html | 155 ++++++++++++++++++
 .../mathml/mtable-columnalign-multi-mtr.html  | 128 +++++++++++++++
 .../mathml/mtable-columnalign-multi-ref.html  | 128 +++++++++++++++
 ...ble-columnalign-single-mtable-dynamic.html | 146 +++++++++++++++++
 .../mtable-columnalign-single-mtable.html     | 128 +++++++++++++++
 ...mtable-columnalign-single-mtr-dynamic.html | 155 ++++++++++++++++++
 .../mathml/mtable-columnalign-single-mtr.html | 128 +++++++++++++++
 .../mathml/mtable-columnalign-single-ref.html | 128 +++++++++++++++
 ...able-columnlines-multi-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-columnlines-multi-ref.html  |  90 ++++++++++
 ...ble-columnlines-single-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-columnlines-single-ref.html |  90 ++++++++++
 .../mtable-rowalign-multi-mtable-dynamic.html | 146 +++++++++++++++++
 .../mathml/mtable-rowalign-multi-mtable.html  | 128 +++++++++++++++
 .../mathml/mtable-rowalign-multi-ref.html     | 128 +++++++++++++++
 ...mtable-rowalign-single-mtable-dynamic.html | 146 +++++++++++++++++
 .../mathml/mtable-rowalign-single-mtable.html | 128 +++++++++++++++
 .../mtable-rowalign-single-mtr-dynamic.html   | 155 ++++++++++++++++++
 .../mathml/mtable-rowalign-single-mtr.html    | 128 +++++++++++++++
 .../mathml/mtable-rowalign-single-ref.html    | 128 +++++++++++++++
 .../mtable-rowlines-multi-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-rowlines-multi-ref.html     |  90 ++++++++++
 ...mtable-rowlines-single-mtable-dynamic.html | 105 ++++++++++++
 .../mathml/mtable-rowlines-single-ref.html    |  90 ++++++++++
 layout/reftests/mathml/reftest.list           |  18 ++
 27 files changed, 3255 insertions(+)
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-mtr.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-mtr.html
 create mode 100644 layout/reftests/mathml/mtable-columnalign-single-ref.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-columnlines-single-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-multi-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtable.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-mtr.html
 create mode 100644 layout/reftests/mathml/mtable-rowalign-single-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-multi-ref.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html
 create mode 100644 layout/reftests/mathml/mtable-rowlines-single-ref.html

diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..20974a55f313
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("columnalign", "left center right");
+        // Table 2 setup
+        table2.setAttribute("columnalign", "right left center");
+        // Table 3 setup
+        table3.setAttribute("columnalign", "center right left");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtable.html b/layout/reftests/mathml/mtable-columnalign-multi-mtable.html
new file mode 100644
index 000000000000..e74ea9e3c58c
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="left center right">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="right left center">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="center right left">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html b/layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html
new file mode 100644
index 000000000000..0d6b65af774f
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtr-dynamic.html
@@ -0,0 +1,155 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+        var rows = undefined;
+
+        // Table 1 setup
+        rows = table1.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "left center right");
+
+        // Table 2 setup
+        rows = table2.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "right left center");
+
+        // Table 3 setup
+        rows = table3.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "center right left");
+
+        document.documentElement.removeAttribute("class");
+      }
+    window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-mtr.html b/layout/reftests/mathml/mtable-columnalign-multi-mtr.html
new file mode 100644
index 000000000000..cc4cdc87f2d5
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-mtr.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="left center right">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left center right">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left center right">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="right left center">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right left center">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right left center">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="center right left">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center right left">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center right left">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-multi-ref.html b/layout/reftests/mathml/mtable-columnalign-multi-ref.html
new file mode 100644
index 000000000000..4ee19aa0808c
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-multi-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left center right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="right">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right left center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="center">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center right left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html
new file mode 100644
index 000000000000..d01f7a5014cc
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("columnalign", "left");
+        // Table 2 setup
+        table2.setAttribute("columnalign", "center");
+        // Table 3 setup
+        table3.setAttribute("columnalign", "right");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtable.html b/layout/reftests/mathml/mtable-columnalign-single-mtable.html
new file mode 100644
index 000000000000..a3ebec777684
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="left">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="center">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable columnalign="right">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html b/layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html
new file mode 100644
index 000000000000..11112dfa0276
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtr-dynamic.html
@@ -0,0 +1,155 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+        var rows = undefined;
+
+        // Table 1 setup
+        rows = table1.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "left");
+
+        // Table 2 setup
+        rows = table2.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "center");
+
+        // Table 3 setup
+        rows = table3.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("columnalign", "right");
+
+        document.documentElement.removeAttribute("class");
+      }
+    window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-mtr.html b/layout/reftests/mathml/mtable-columnalign-single-mtr.html
new file mode 100644
index 000000000000..f8003ed8ee38
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-mtr.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="left">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="left">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="center">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="center">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr columnalign="right">
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+            <mtd>
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right">
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd>
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr columnalign="right">
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnalign-single-ref.html b/layout/reftests/mathml/mtable-columnalign-single-ref.html
new file mode 100644
index 000000000000..fb926b38fbe7
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnalign-single-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnalign</title>
+  </head>
+  <body>
+    <b>columnalign="left"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="left">
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="center">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>columnalign="right"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>123</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>12345</mtext>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd columnalign="right">
+              <mtext>1234567</mtext>
+            </mtd>
+            <mtd>
+            <mtext>1234567</mtext>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..643fa6ffc08f
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-multi-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("columnlines", "solid dashed");
+        // Table 2 setup
+        table2.setAttribute("columnlines", "dashed solid");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>columnlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-multi-ref.html b/layout/reftests/mathml/mtable-columnlines-multi-ref.html
new file mode 100644
index 000000000000..7b10b4e25e37
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-multi-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnlines</title>
+  </head>
+  <body>
+  <b>columnlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="solid dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="dashed solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html
new file mode 100644
index 000000000000..6b77fb8ebee2
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-single-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML columnlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("columnlines", "solid");
+        // Table 2 setup
+        table2.setAttribute("columnlines", "dashed");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>columnlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-columnlines-single-ref.html b/layout/reftests/mathml/mtable-columnlines-single-ref.html
new file mode 100644
index 000000000000..7a2749156a6c
--- /dev/null
+++ b/layout/reftests/mathml/mtable-columnlines-single-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML columnlines</title>
+  </head>
+  <body>
+  <b>columnlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>columnlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable columnlines="dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..9bcfa2f203b1
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-multi-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("rowalign", "top center bottom");
+        // Table 2 setup
+        table2.setAttribute("rowalign", "bottom top center");
+        // Table 3 setup
+        table3.setAttribute("rowalign", "center bottom top");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>rowalign="top center bottom"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom top center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center bottom top"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-multi-mtable.html b/layout/reftests/mathml/mtable-rowalign-multi-mtable.html
new file mode 100644
index 000000000000..bc3493cf15b4
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-multi-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top center bottom"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable rowalign="top center bottom">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom top center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="bottom top center">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center bottom top"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="center bottom top">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-multi-ref.html b/layout/reftests/mathml/mtable-rowalign-multi-ref.html
new file mode 100644
index 000000000000..a39eab436cf9
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-multi-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top center bottom"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom top center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center bottom top"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html
new file mode 100644
index 000000000000..a147b8e7872b
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtable-dynamic.html
@@ -0,0 +1,146 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+
+        // Table 1 setup
+        table1.setAttribute("rowalign", "top");
+        // Table 2 setup
+        table2.setAttribute("rowalign", "center");
+        // Table 3 setup
+        table3.setAttribute("rowalign", "bottom");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtable.html b/layout/reftests/mathml/mtable-rowalign-single-mtable.html
new file mode 100644
index 000000000000..efa7ef711e9d
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtable.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable rowalign="top">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="center">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable rowalign="bottom">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html b/layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html
new file mode 100644
index 000000000000..e7152776c88b
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtr-dynamic.html
@@ -0,0 +1,155 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowalign</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+        var table3 = document.getElementById("table3");
+        var rows = undefined;
+
+        // Table 1 setup
+        rows = table1.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("rowalign", "top");
+
+        // Table 2 setup
+        rows = table2.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("rowalign", "center");
+
+        // Table 3 setup
+        rows = table3.getElementsByTagName("mtr");
+        for(var i = 0; i < rows.length; i++)
+          rows[i].setAttribute("rowalign", "bottom");
+
+        document.documentElement.removeAttribute("class");
+      }
+    window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable id="table1">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table2">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable id="table3">
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-mtr.html b/layout/reftests/mathml/mtable-rowalign-single-mtr.html
new file mode 100644
index 000000000000..9057e1115aef
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-mtr.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr rowalign="top">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="top">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="top">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr rowalign="center">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="center">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="center">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr rowalign="bottom">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="bottom">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr rowalign="bottom">
+            <mtd>
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd>
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowalign-single-ref.html b/layout/reftests/mathml/mtable-rowalign-single-ref.html
new file mode 100644
index 000000000000..786f5f3e7b69
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowalign-single-ref.html
@@ -0,0 +1,128 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowalign</title>
+  </head>
+  <body>
+    <b>rowalign="top"</b> <br/>
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="top">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="center"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="center">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math> <br />
+    <b>rowalign="bottom"</b> <br />
+    <math>
+      <mstyle>
+        <mtable>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+          <mtr>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="5px" height="5px" mathbackground="red"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="10px" height="10px" mathbackground="green"></mspace>
+            </mtd>
+            <mtd rowalign="bottom">
+              <mspace width="10px" depth="15px" height="15px" mathbackground="blue"></mspace>
+            </mtd>
+          </mtr>
+        </mtable>
+      </mstyle>
+    </math>
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html
new file mode 100644
index 000000000000..bbf203568cc9
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-multi-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("rowlines", "solid dashed");
+        // Table 2 setup
+        table2.setAttribute("rowlines", "dashed solid");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>rowlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-multi-ref.html b/layout/reftests/mathml/mtable-rowlines-multi-ref.html
new file mode 100644
index 000000000000..3562ba0c73fe
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-multi-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowlines</title>
+  </head>
+  <body>
+  <b>rowlines="solid dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="solid dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="dashed solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html b/layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html
new file mode 100644
index 000000000000..3b5bd3c7c0b3
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-single-mtable-dynamic.html
@@ -0,0 +1,105 @@
+<!DOCTYPE>
+<html class="reftest-wait">
+  <head>
+    <title>Test MathML rowlines</title>
+    <script type="text/javascript">
+      function doTest()
+      {
+        var table1 = document.getElementById("table1");
+        var table2 = document.getElementById("table2");
+
+        // Table 1 setup
+        table1.setAttribute("rowlines", "solid");
+        // Table 2 setup
+        table2.setAttribute("rowlines", "dashed");
+
+        document.documentElement.removeAttribute("class");
+      }
+      window.addEventListener("MozReftestInvalidate", doTest, false);
+    </script>
+  </head>
+  <body>
+  <b>rowlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table1">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable id="table2">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/mtable-rowlines-single-ref.html b/layout/reftests/mathml/mtable-rowlines-single-ref.html
new file mode 100644
index 000000000000..9ffc887eb07e
--- /dev/null
+++ b/layout/reftests/mathml/mtable-rowlines-single-ref.html
@@ -0,0 +1,90 @@
+<!DOCTYPE>
+<html>
+  <head>
+    <title>Test MathML rowlines</title>
+  </head>
+  <body>
+  <b>rowlines="solid"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="solid">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  <b>rowlines="dashed"</b> <br />
+  <math>
+    <mstyle>
+      <mtable rowlines="dashed">
+        <mtr>
+          <mtd>
+            <mtext>a</mtext>
+          </mtd>
+          <mtd>
+            <mtext>b</mtext>
+          </mtd>
+          <mtd>
+            <mtext>c</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>d</mtext>
+          </mtd>
+
+          <mtd>
+            <mtext>e</mtext>
+          </mtd>
+          <mtd>
+            <mtext>f</mtext>
+          </mtd>
+        </mtr>
+        <mtr>
+          <mtd>
+            <mtext>g</mtext>
+          </mtd>
+          <mtd>
+            <mtext>h</mtext>
+          </mtd>
+          <mtd>
+            <mtext>i</mtext>
+          </mtd>
+        </mtr>
+      </mtable>
+    </mstyle>
+  </math> <br />
+  </body>
+</html>
diff --git a/layout/reftests/mathml/reftest.list b/layout/reftests/mathml/reftest.list
index 31cb3f47099e..fd34c60730b7 100644
--- a/layout/reftests/mathml/reftest.list
+++ b/layout/reftests/mathml/reftest.list
@@ -113,6 +113,24 @@ fails == mstyle-5.xhtml mstyle-5-ref.xhtml # Bug 787215
 == positive-namedspace.html positive-namedspace-ref.html
 == mtable-align-whitespace.html mtable-align-whitespace-ref.html
 == mtable-width.html mtable-width-ref.html
+== mtable-rowlines-single-mtable-dynamic.html mtable-rowlines-single-ref.html
+== mtable-rowlines-multi-mtable-dynamic.html mtable-rowlines-multi-ref.html
+== mtable-rowalign-single-mtr.html mtable-rowalign-single-ref.html
+== mtable-rowalign-single-mtr-dynamic.html mtable-rowalign-single-ref.html
+== mtable-rowalign-single-mtable.html mtable-rowalign-single-ref.html
+== mtable-rowalign-single-mtable-dynamic.html mtable-rowalign-single-ref.html
+== mtable-rowalign-multi-mtable.html mtable-rowalign-multi-ref.html
+== mtable-rowalign-multi-mtable-dynamic.html mtable-rowalign-multi-ref.html
+== mtable-columnlines-single-mtable-dynamic.html mtable-columnlines-single-ref.html
+== mtable-columnlines-multi-mtable-dynamic.html mtable-columnlines-multi-ref.html
+== mtable-columnalign-single-mtr.html mtable-columnalign-single-ref.html
+== mtable-columnalign-single-mtr-dynamic.html mtable-columnalign-single-ref.html
+== mtable-columnalign-single-mtable.html mtable-columnalign-single-ref.html
+== mtable-columnalign-single-mtable-dynamic.html mtable-columnalign-single-ref.html
+== mtable-columnalign-multi-mtr.html mtable-columnalign-multi-ref.html
+== mtable-columnalign-multi-mtr-dynamic.html mtable-columnalign-multi-ref.html
+== mtable-columnalign-multi-mtable.html mtable-columnalign-multi-ref.html
+== mtable-columnalign-multi-mtable-dynamic.html mtable-columnalign-multi-ref.html
 == maction-selection.html maction-selection-ref.html
 == maction-dynamic-embellished-op.html maction-dynamic-embellished-op-ref.html
 skip-if(B2G) == maction-dynamic-1.html maction-dynamic-1-ref.html # bug 773482

From 287ef9237aa323ce647b0c8fe8e4994f2038871f Mon Sep 17 00:00:00 2001
From: Morris Tseng <mtseng@mozilla.com>
Date: Fri, 13 Dec 2013 12:45:13 -0500
Subject: [PATCH 363/459] Bug 893304 - Convert CanvasClient to new
 TextureClient/Host. r=nical, r=snorp, r=jgilbert

---
 gfx/layers/client/CanvasClient.cpp     |  82 +++++++++++-
 gfx/layers/client/CanvasClient.h       |  31 +++++
 gfx/layers/client/ClientCanvasLayer.h  |   9 +-
 gfx/layers/opengl/TextureClientOGL.cpp |  37 ++++++
 gfx/layers/opengl/TextureClientOGL.h   |  30 +++++
 gfx/layers/opengl/TextureHostOGL.cpp   | 177 +++++++++++++++++++++++++
 gfx/layers/opengl/TextureHostOGL.h     | 102 ++++++++++++++
 7 files changed, 457 insertions(+), 11 deletions(-)

diff --git a/gfx/layers/client/CanvasClient.cpp b/gfx/layers/client/CanvasClient.cpp
index 26553b3e5b94..f7fa64d619e8 100644
--- a/gfx/layers/client/CanvasClient.cpp
+++ b/gfx/layers/client/CanvasClient.cpp
@@ -17,6 +17,8 @@
 #include "mozilla/layers/CompositableForwarder.h"
 #include "mozilla/layers/LayersTypes.h"
 #include "mozilla/layers/TextureClient.h"  // for TextureClient, etc
+#include "mozilla/layers/GrallocTextureClient.h"
+#include "mozilla/layers/TextureClientOGL.h"
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsDebug.h"                    // for printf_stderr, NS_ASSERTION
 #include "nsXULAppAPI.h"                // for XRE_GetProcessType, etc
@@ -27,12 +29,6 @@
 using namespace mozilla::gfx;
 using namespace mozilla::gl;
 
-namespace mozilla {
-namespace gfx {
-class SharedSurface;
-}
-}
-
 namespace mozilla {
 namespace layers {
 
@@ -44,7 +40,7 @@ CanvasClient::CreateCanvasClient(CanvasClientType aType,
   if (aType == CanvasClientGLContext &&
       aForwarder->GetCompositorBackendType() == LAYERS_OPENGL) {
     aFlags |= TEXTURE_DEALLOCATE_CLIENT;
-    return new DeprecatedCanvasClientSurfaceStream(aForwarder, aFlags);
+    return new CanvasClientSurfaceStream(aForwarder, aFlags);
   }
   if (gfxPlatform::GetPlatform()->UseDeprecatedTextures()) {
     aFlags |= TEXTURE_DEALLOCATE_CLIENT;
@@ -106,6 +102,78 @@ CanvasClient2D::CreateBufferTextureClient(gfx::SurfaceFormat aFormat, TextureFla
                                                        mTextureInfo.mTextureFlags | aFlags);
 }
 
+CanvasClientSurfaceStream::CanvasClientSurfaceStream(CompositableForwarder* aLayerForwarder,
+                                                     TextureFlags aFlags)
+  : CanvasClient(aLayerForwarder, aFlags)
+{
+}
+
+void
+CanvasClientSurfaceStream::Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer)
+{
+  GLScreenBuffer* screen = aLayer->mGLContext->Screen();
+  SurfaceStream* stream = screen->Stream();
+
+  bool isCrossProcess = !(XRE_GetProcessType() == GeckoProcessType_Default);
+  bool bufferCreated = false;
+  if (isCrossProcess) {
+#ifdef MOZ_WIDGET_GONK
+    SharedSurface* surf = stream->SwapConsumer();
+    if (!surf) {
+      printf_stderr("surf is null post-SwapConsumer!\n");
+      return;
+    }
+
+    if (surf->Type() != SharedSurfaceType::Gralloc) {
+      printf_stderr("Unexpected non-Gralloc SharedSurface in IPC path!");
+      MOZ_ASSERT(false);
+      return;
+    }
+
+    SharedSurface_Gralloc* grallocSurf = SharedSurface_Gralloc::Cast(surf);
+
+    if (mBuffers.find(surf) == mBuffers.end()) {
+      GrallocTextureClientOGL* grallocTC =
+        new GrallocTextureClientOGL(static_cast<GrallocBufferActor*>(grallocSurf->GetDescriptor().bufferChild()),
+                                                                     grallocSurf->Size(),
+                                                                     mTextureInfo.mTextureFlags);
+
+      mBuffers[surf] = grallocTC;
+      bufferCreated = true;
+    }
+
+    if (bufferCreated && !AddTextureClient(mBuffers[surf])) {
+      mBuffers.erase(surf);
+    }
+
+    if (mBuffers.find(surf) != mBuffers.end()) {
+      GetForwarder()->UseTexture(this, mBuffers[surf]);
+    }
+#else
+    printf_stderr("isCrossProcess, but not MOZ_WIDGET_GONK! Someone needs to write some code!");
+    MOZ_ASSERT(false);
+#endif
+  } else {
+    if (!mBuffer) {
+      StreamTextureClientOGL* textureClient =
+        new StreamTextureClientOGL(mTextureInfo.mTextureFlags);
+      textureClient->InitWith(stream);
+      mBuffer = textureClient;
+      bufferCreated = true;
+    }
+
+    if (bufferCreated && !AddTextureClient(mBuffer)) {
+      mBuffer = nullptr;
+    }
+
+    if (mBuffer) {
+      GetForwarder()->UseTexture(this, mBuffer);
+    }
+  }
+
+  aLayer->Painted();
+}
+
 void
 DeprecatedCanvasClient2D::Updated()
 {
diff --git a/gfx/layers/client/CanvasClient.h b/gfx/layers/client/CanvasClient.h
index e0d534b00d34..e537151d038f 100644
--- a/gfx/layers/client/CanvasClient.h
+++ b/gfx/layers/client/CanvasClient.h
@@ -18,6 +18,12 @@
 #include "mozilla/gfx/Point.h"          // for IntSize
 #include "mozilla/gfx/Types.h"          // for SurfaceFormat
 
+namespace mozilla {
+namespace gfx {
+class SharedSurface;
+}
+}
+
 namespace mozilla {
 namespace layers {
 
@@ -95,6 +101,31 @@ private:
   RefPtr<TextureClient> mBuffer;
 };
 
+// Used for GL canvases where we don't need to do any readback, i.e., with a
+// GL backend.
+class CanvasClientSurfaceStream : public CanvasClient
+{
+public:
+  CanvasClientSurfaceStream(CompositableForwarder* aLayerForwarder, TextureFlags aFlags);
+
+  TextureInfo GetTextureInfo() const
+  {
+    return TextureInfo(COMPOSITABLE_IMAGE);
+  }
+
+  virtual void Update(gfx::IntSize aSize, ClientCanvasLayer* aLayer) MOZ_OVERRIDE;
+
+  virtual void OnDetach() MOZ_OVERRIDE
+  {
+    mBuffers.clear();
+    mBuffer = nullptr;
+  }
+
+private:
+  std::map<gfx::SharedSurface*, RefPtr<TextureClient> > mBuffers;
+  RefPtr<TextureClient> mBuffer;
+};
+
 class DeprecatedCanvasClient2D : public CanvasClient
 {
 public:
diff --git a/gfx/layers/client/ClientCanvasLayer.h b/gfx/layers/client/ClientCanvasLayer.h
index 6af3f430fd64..c46ac332f558 100644
--- a/gfx/layers/client/ClientCanvasLayer.h
+++ b/gfx/layers/client/ClientCanvasLayer.h
@@ -51,11 +51,11 @@ public:
                  "Can only set properties in construction phase");
     CanvasLayer::SetVisibleRegion(aRegion);
   }
-  
+
   virtual void Initialize(const Data& aData);
 
   virtual void RenderLayer();
-  
+
   virtual void FillSpecificAttributes(SpecificLayerAttributes& aAttrs)
   {
     aAttrs = CanvasLayerAttributes(mFilter, mBounds);
@@ -63,7 +63,7 @@ public:
 
   virtual Layer* AsLayer() { return this; }
   virtual ShadowableLayer* AsShadowableLayer() { return this; }
-  
+
   virtual void Disconnect()
   {
     mCanvasClient = nullptr;
@@ -79,7 +79,7 @@ protected:
   {
     return static_cast<ClientLayerManager*>(mManager);
   }
-  
+
   CanvasClientType GetCanvasClientType()
   {
     if (mGLContext) {
@@ -93,6 +93,7 @@ protected:
   friend class DeprecatedCanvasClient2D;
   friend class CanvasClient2D;
   friend class DeprecatedCanvasClientSurfaceStream;
+  friend class CanvasClientSurfaceStream;
 };
 }
 }
diff --git a/gfx/layers/opengl/TextureClientOGL.cpp b/gfx/layers/opengl/TextureClientOGL.cpp
index e52858850ccc..2632f5d0de94 100644
--- a/gfx/layers/opengl/TextureClientOGL.cpp
+++ b/gfx/layers/opengl/TextureClientOGL.cpp
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/layers/TextureClientOGL.h"
+#include "SurfaceStream.h"
 #include "GLContext.h"                  // for GLContext, etc
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT, etc
 #include "mozilla/layers/ISurfaceAllocator.h"
@@ -66,6 +67,42 @@ SharedTextureClientOGL::IsAllocated() const
   return mHandle != 0;
 }
 
+StreamTextureClientOGL::StreamTextureClientOGL(TextureFlags aFlags)
+  : TextureClient(aFlags)
+  , mStream(0)
+{
+}
+
+StreamTextureClientOGL::~StreamTextureClientOGL()
+{
+  // the data is owned externally.
+}
+
+bool
+StreamTextureClientOGL::ToSurfaceDescriptor(SurfaceDescriptor& aOutDescriptor)
+{
+  if (!IsAllocated()) {
+    return false;
+  }
+
+  gfx::SurfaceStreamHandle handle = mStream->GetShareHandle();
+  aOutDescriptor = SurfaceStreamDescriptor(handle, false);
+  return true;
+}
+
+void
+StreamTextureClientOGL::InitWith(gfx::SurfaceStream* aStream)
+{
+  MOZ_ASSERT(!IsAllocated());
+  mStream = aStream;
+}
+
+bool
+StreamTextureClientOGL::IsAllocated() const
+{
+  return mStream != 0;
+}
+
 DeprecatedTextureClientSharedOGL::DeprecatedTextureClientSharedOGL(CompositableForwarder* aForwarder,
                                                const TextureInfo& aTextureInfo)
   : DeprecatedTextureClient(aForwarder, aTextureInfo)
diff --git a/gfx/layers/opengl/TextureClientOGL.h b/gfx/layers/opengl/TextureClientOGL.h
index 6964d100dd3b..6afa130711a3 100644
--- a/gfx/layers/opengl/TextureClientOGL.h
+++ b/gfx/layers/opengl/TextureClientOGL.h
@@ -14,6 +14,12 @@
 #include "mozilla/layers/LayersSurfaces.h"  // for SurfaceDescriptor
 #include "mozilla/layers/TextureClient.h"  // for DeprecatedTextureClient, etc
 
+namespace mozilla {
+namespace gfx {
+class SurfaceStream;
+}
+}
+
 namespace mozilla {
 namespace layers {
 
@@ -57,6 +63,30 @@ protected:
   bool mInverted;
 };
 
+/**
+ * A TextureClient implementation to share SurfaceStream.
+ */
+class StreamTextureClientOGL : public TextureClient
+{
+public:
+  StreamTextureClientOGL(TextureFlags aFlags);
+
+  ~StreamTextureClientOGL();
+
+  virtual bool IsAllocated() const MOZ_OVERRIDE;
+
+  virtual bool ToSurfaceDescriptor(SurfaceDescriptor& aOutDescriptor) MOZ_OVERRIDE;
+
+  virtual TextureClientData* DropTextureData() MOZ_OVERRIDE { return nullptr; }
+
+  void InitWith(gfx::SurfaceStream* aStream);
+
+  virtual gfx::IntSize GetSize() const { return gfx::IntSize(); }
+
+protected:
+  gfx::SurfaceStream* mStream;
+};
+
 class DeprecatedTextureClientSharedOGL : public DeprecatedTextureClient
 {
 public:
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 16be30f5dabe..7207de68d859 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -109,6 +109,11 @@ CreateTextureHostOGL(const SurfaceDescriptor& aDesc,
                                         desc.inverted());
       break;
     }
+    case SurfaceDescriptor::TSurfaceStreamDescriptor: {
+      const SurfaceStreamDescriptor& desc = aDesc.get_SurfaceStreamDescriptor();
+      result = new StreamTextureHostOGL(aFlags, desc);
+      break;
+    }
 #ifdef XP_MACOSX
     case SurfaceDescriptor::TSurfaceDescriptorMacIOSurface: {
       const SurfaceDescriptorMacIOSurface& desc =
@@ -455,6 +460,178 @@ SharedTextureHostOGL::GetFormat() const
   return mTextureSource->GetFormat();
 }
 
+void
+StreamTextureSourceOGL::BindTexture(GLenum activetex)
+{
+  MOZ_ASSERT(gl());
+  gl()->fActiveTexture(activetex);
+  gl()->fBindTexture(mTextureTarget, mTextureHandle);
+}
+
+bool
+StreamTextureSourceOGL::RetrieveTextureFromStream()
+{
+  gl()->MakeCurrent();
+
+  SharedSurface* sharedSurf = mStream->SwapConsumer();
+  if (!sharedSurf) {
+    // We don't have a valid surf to show yet.
+    return false;
+  }
+
+  gl()->MakeCurrent();
+
+  mSize = IntSize(sharedSurf->Size().width, sharedSurf->Size().height);
+
+  gfxImageSurface* toUpload = nullptr;
+  switch (sharedSurf->Type()) {
+    case SharedSurfaceType::GLTextureShare: {
+      SharedSurface_GLTexture* glTexSurf = SharedSurface_GLTexture::Cast(sharedSurf);
+      glTexSurf->SetConsumerGL(gl());
+      mTextureHandle = glTexSurf->Texture();
+      mTextureTarget = glTexSurf->TextureTarget();
+      MOZ_ASSERT(mTextureHandle);
+      mFormat = sharedSurf->HasAlpha() ? FORMAT_R8G8B8A8
+                                       : FORMAT_R8G8B8X8;
+      break;
+    }
+    case SharedSurfaceType::EGLImageShare: {
+      SharedSurface_EGLImage* eglImageSurf =
+          SharedSurface_EGLImage::Cast(sharedSurf);
+
+      mTextureHandle = eglImageSurf->AcquireConsumerTexture(gl());
+      mTextureTarget = eglImageSurf->TextureTarget();
+      if (!mTextureHandle) {
+        toUpload = eglImageSurf->GetPixels();
+        MOZ_ASSERT(toUpload);
+      } else {
+        mFormat = sharedSurf->HasAlpha() ? FORMAT_R8G8B8A8
+                                         : FORMAT_R8G8B8X8;
+      }
+      break;
+    }
+#ifdef XP_MACOSX
+    case SharedSurfaceType::IOSurface: {
+      SharedSurface_IOSurface* glTexSurf = SharedSurface_IOSurface::Cast(sharedSurf);
+      mTextureHandle = glTexSurf->Texture();
+      mTextureTarget = glTexSurf->TextureTarget();
+      MOZ_ASSERT(mTextureHandle);
+      mFormat = sharedSurf->HasAlpha() ? FORMAT_R8G8B8A8
+                                       : FORMAT_R8G8B8X8;
+      break;
+    }
+#endif
+    case SharedSurfaceType::Basic: {
+      toUpload = SharedSurface_Basic::Cast(sharedSurf)->GetData();
+      MOZ_ASSERT(toUpload);
+      break;
+    }
+    default:
+      MOZ_CRASH("Invalid SharedSurface type.");
+  }
+
+  if (toUpload) {
+    // mBounds seems to end up as (0,0,0,0) a lot, so don't use it?
+    nsIntSize size(toUpload->GetSize());
+    nsIntRect rect(nsIntPoint(0,0), size);
+    nsIntRegion bounds(rect);
+    mFormat = UploadSurfaceToTexture(gl(),
+                                     toUpload,
+                                     bounds,
+                                     mUploadTexture,
+                                     true);
+    mTextureHandle = mUploadTexture;
+    mTextureTarget = LOCAL_GL_TEXTURE_2D;
+  }
+
+  MOZ_ASSERT(mTextureHandle);
+  gl()->fBindTexture(mTextureTarget, mTextureHandle);
+  gl()->fTexParameteri(mTextureTarget,
+                      LOCAL_GL_TEXTURE_WRAP_S,
+                      LOCAL_GL_CLAMP_TO_EDGE);
+  gl()->fTexParameteri(mTextureTarget,
+                      LOCAL_GL_TEXTURE_WRAP_T,
+                      LOCAL_GL_CLAMP_TO_EDGE);
+
+  return true;
+}
+
+void
+StreamTextureSourceOGL::DeallocateDeviceData()
+{
+  if (mUploadTexture) {
+    MOZ_ASSERT(gl());
+    gl()->MakeCurrent();
+    gl()->fDeleteTextures(1, &mUploadTexture);
+    mUploadTexture = 0;
+    mTextureHandle = 0;
+  }
+}
+
+gl::GLContext*
+StreamTextureSourceOGL::gl() const
+{
+  return mCompositor ? mCompositor->gl() : nullptr;
+}
+
+StreamTextureHostOGL::StreamTextureHostOGL(TextureFlags aFlags,
+                                           const SurfaceStreamDescriptor& aDesc)
+  : TextureHost(aFlags)
+{
+  mStream = SurfaceStream::FromHandle(aDesc.handle());
+  MOZ_ASSERT(mStream);
+}
+
+StreamTextureHostOGL::~StreamTextureHostOGL()
+{
+  // If need to deallocate textures, call DeallocateSharedData() before
+  // the destructor
+}
+
+bool
+StreamTextureHostOGL::Lock()
+{
+  if (!mCompositor) {
+    return false;
+  }
+
+  if (!mTextureSource) {
+    mTextureSource = new StreamTextureSourceOGL(mCompositor,
+                                                mStream);
+  }
+
+  return mTextureSource->RetrieveTextureFromStream();
+}
+
+void
+StreamTextureHostOGL::Unlock()
+{
+}
+
+void
+StreamTextureHostOGL::SetCompositor(Compositor* aCompositor)
+{
+  CompositorOGL* glCompositor = static_cast<CompositorOGL*>(aCompositor);
+  mCompositor = glCompositor;
+  if (mTextureSource) {
+    mTextureSource->SetCompositor(glCompositor);
+  }
+}
+
+gfx::SurfaceFormat
+StreamTextureHostOGL::GetFormat() const
+{
+  MOZ_ASSERT(mTextureSource);
+  return mTextureSource->GetFormat();
+}
+
+gfx::IntSize
+StreamTextureHostOGL::GetSize() const
+{
+  MOZ_ASSERT(mTextureSource);
+  return mTextureSource->GetSize();
+}
+
 TextureImageDeprecatedTextureHostOGL::~TextureImageDeprecatedTextureHostOGL()
 {
   MOZ_COUNT_DTOR(TextureImageDeprecatedTextureHostOGL);
diff --git a/gfx/layers/opengl/TextureHostOGL.h b/gfx/layers/opengl/TextureHostOGL.h
index 23743453edb2..22f3e6468ee1 100644
--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -333,6 +333,108 @@ protected:
   RefPtr<SharedTextureSourceOGL> mTextureSource;
 };
 
+/**
+ * A texture source meant for use with StreamTextureHostOGL.
+ *
+ * It does not own any texture, we get texture from SurfaceStream.
+ */
+class StreamTextureSourceOGL : public NewTextureSource
+                             , public TextureSourceOGL
+{
+public:
+  StreamTextureSourceOGL(CompositorOGL* aCompositor,
+                         gfx::SurfaceStream* aStream)
+    : mCompositor(aCompositor)
+    , mStream(aStream)
+    , mTextureHandle(0)
+    , mTextureTarget(LOCAL_GL_TEXTURE_2D)
+    , mUploadTexture(0)
+    , mFormat(gfx::FORMAT_UNKNOWN)
+  {
+    MOZ_COUNT_CTOR(StreamTextureSourceOGL);
+  }
+
+  ~StreamTextureSourceOGL()
+  {
+    MOZ_COUNT_DTOR(StreamTextureSourceOGL);
+  }
+
+  virtual TextureSourceOGL* AsSourceOGL() { return this; }
+
+  virtual void BindTexture(GLenum activetex) MOZ_OVERRIDE;
+
+  virtual bool IsValid() const MOZ_OVERRIDE { return !!gl(); }
+
+  virtual gfx::IntSize GetSize() const MOZ_OVERRIDE { return mSize; }
+
+  virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE { return mFormat; }
+
+  virtual GLenum GetTextureTarget() const { return mTextureTarget; }
+
+  virtual GLenum GetWrapMode() const MOZ_OVERRIDE { return LOCAL_GL_CLAMP_TO_EDGE; }
+
+  virtual void DeallocateDeviceData();
+
+  bool RetrieveTextureFromStream();
+
+  void SetCompositor(CompositorOGL* aCompositor) { mCompositor = aCompositor; }
+
+protected:
+  gl::GLContext* gl() const;
+
+  CompositorOGL* mCompositor;
+  gfx::SurfaceStream* mStream;
+  GLuint mTextureHandle;
+  GLenum mTextureTarget;
+  GLuint mUploadTexture;
+  gfx::IntSize mSize;
+  gfx::SurfaceFormat mFormat;
+};
+
+/**
+ * A TextureHost for shared SurfaceStream
+ */
+class StreamTextureHostOGL : public TextureHost
+{
+public:
+  StreamTextureHostOGL(TextureFlags aFlags,
+                       const SurfaceStreamDescriptor& aDesc);
+
+  virtual ~StreamTextureHostOGL();
+
+  // SharedTextureHostOGL doesn't own any GL texture
+  virtual void DeallocateDeviceData() MOZ_OVERRIDE {}
+
+  virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE;
+
+  virtual bool Lock() MOZ_OVERRIDE;
+
+  virtual void Unlock() MOZ_OVERRIDE;
+
+  virtual gfx::SurfaceFormat GetFormat() const MOZ_OVERRIDE;
+
+  virtual NewTextureSource* GetTextureSources() MOZ_OVERRIDE
+  {
+    return mTextureSource;
+  }
+
+  virtual TemporaryRef<gfx::DataSourceSurface> GetAsSurface() MOZ_OVERRIDE
+  {
+    return nullptr; // XXX - implement this (for MOZ_DUMP_PAINTING)
+  }
+
+  virtual gfx::IntSize GetSize() const MOZ_OVERRIDE;
+
+#ifdef MOZ_LAYERS_HAVE_LOG
+  virtual const char* Name() { return "StreamTextureHostOGL"; }
+#endif
+
+protected:
+  CompositorOGL* mCompositor;
+  gfx::SurfaceStream* mStream;
+  RefPtr<StreamTextureSourceOGL> mTextureSource;
+};
+
 /**
  * DeprecatedTextureHost implementation using a TextureImage as the underlying texture.
  */

From 97793677212c48c5199537c124b106dc44633550 Mon Sep 17 00:00:00 2001
From: John Shih <jshih@mozilla.com>
Date: Fri, 13 Dec 2013 16:33:46 +0800
Subject: [PATCH 364/459] Bug 940740 - Make sure do_GetService called in
 mainthread. r=mcmanus

---
 .../protocol/websocket/WebSocketChannel.cpp   | 71 ++++++++++++++++---
 netwerk/protocol/websocket/WebSocketChannel.h |  3 +-
 2 files changed, 63 insertions(+), 11 deletions(-)

diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp
index 7643dcabaca8..b1f2a9c34a0b 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannel.cpp
@@ -1083,7 +1083,10 @@ WebSocketChannel::BeginOpen()
 
 #ifdef MOZ_WIDGET_GONK
   if (mAppId != NECKO_NO_APP_ID) {
-    NS_GetActiveNetworkInterface(mActiveNetwork);
+    nsCOMPtr<nsINetworkInterface> activeNetwork;
+    NS_GetActiveNetworkInterface(activeNetwork);
+    mActiveNetwork =
+      new nsMainThreadPtrHolder<nsINetworkInterface>(activeNetwork);
   }
 #endif
 
@@ -3263,6 +3266,57 @@ WebSocketChannel::OnDataAvailable(nsIRequest *aRequest,
   return NS_OK;
 }
 
+//-----------------------------------------------------------------------------
+// WebSocketChannel save network statistics event
+//-----------------------------------------------------------------------------
+
+#ifdef MOZ_WIDGET_GONK
+namespace {
+class SaveNetworkStatsEvent : public nsRunnable {
+public:
+    SaveNetworkStatsEvent(uint32_t aAppId,
+                          nsMainThreadPtrHandle<nsINetworkInterface> &aActiveNetwork,
+                          uint64_t aCountRecv,
+                          uint64_t aCountSent)
+        : mAppId(aAppId),
+          mActiveNetwork(aActiveNetwork),
+          mCountRecv(aCountRecv),
+          mCountSent(aCountSent)
+    {
+        MOZ_ASSERT(mAppId != NECKO_NO_APP_ID);
+        MOZ_ASSERT(mActiveNetwork);
+    }
+
+    NS_IMETHOD Run()
+    {
+        MOZ_ASSERT(NS_IsMainThread());
+
+        nsresult rv;
+        nsCOMPtr<nsINetworkStatsServiceProxy> mNetworkStatsServiceProxy =
+            do_GetService("@mozilla.org/networkstatsServiceProxy;1", &rv);
+        if (NS_FAILED(rv)) {
+            return rv;
+        }
+
+        // save the network stats through NetworkStatsServiceProxy
+        mNetworkStatsServiceProxy->SaveAppStats(mAppId,
+                                                mActiveNetwork,
+                                                PR_Now() / 1000,
+                                                mCountRecv,
+                                                mCountSent,
+                                                nullptr);
+
+        return NS_OK;
+    }
+private:
+    uint32_t mAppId;
+    nsMainThreadPtrHandle<nsINetworkInterface> mActiveNetwork;
+    uint64_t mCountRecv;
+    uint64_t mCountSent;
+};
+};
+#endif
+
 nsresult
 WebSocketChannel::SaveNetworkStats(bool enforce)
 {
@@ -3285,15 +3339,12 @@ WebSocketChannel::SaveNetworkStats(bool enforce)
     return NS_OK;
   }
 
-  nsresult rv;
-  nsCOMPtr<nsINetworkStatsServiceProxy> mNetworkStatsServiceProxy =
-    do_GetService("@mozilla.org/networkstatsServiceProxy;1", &rv);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-
-  mNetworkStatsServiceProxy->SaveAppStats(mAppId, mActiveNetwork, PR_Now() / 1000,
-                                          mCountRecv, mCountSent, nullptr);
+  // Create the event to save the network statistics.
+  // the event is then dispathed to the main thread.
+  nsRefPtr<nsRunnable> event =
+    new SaveNetworkStatsEvent(mAppId, mActiveNetwork,
+                              mCountRecv, mCountSent);
+  NS_DispatchToMainThread(event);
 
   // Reset the counters after saving.
   mCountSent = 0;
diff --git a/netwerk/protocol/websocket/WebSocketChannel.h b/netwerk/protocol/websocket/WebSocketChannel.h
index 32fcda146da4..cc987045b140 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.h
+++ b/netwerk/protocol/websocket/WebSocketChannel.h
@@ -20,6 +20,7 @@
 
 #ifdef MOZ_WIDGET_GONK
 #include "nsINetworkManager.h"
+#include "nsProxyRelease.h" // for nsMainThreadPtrHandle
 #endif
 
 #include "nsCOMPtr.h"
@@ -261,7 +262,7 @@ private:
   uint64_t                        mCountSent;
   uint32_t                        mAppId;
 #ifdef MOZ_WIDGET_GONK
-  nsCOMPtr<nsINetworkInterface>   mActiveNetwork;
+  nsMainThreadPtrHandle<nsINetworkInterface> mActiveNetwork;
 #endif
   nsresult                        SaveNetworkStats(bool);
   void                            CountRecvBytes(uint64_t recvBytes)

From df7395ce5d555b54708496ae494cbf1de88a60de Mon Sep 17 00:00:00 2001
From: Douglas Crosher <dtc-moz@scieneer.com>
Date: Fri, 13 Dec 2013 15:27:13 +1100
Subject: [PATCH 365/459] Bug 949742 - Ionmonkey: Improve the register
 allocation for Float32ToDouble. r=benj

---
 js/src/jit/Lowering.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 5f0b099ba712..67d8af974949 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1683,7 +1683,7 @@ LIRGenerator::visitToDouble(MToDouble *convert)
 
       case MIRType_Float32:
       {
-        LFloat32ToDouble *lir = new(alloc()) LFloat32ToDouble(useRegister(opd));
+        LFloat32ToDouble *lir = new(alloc()) LFloat32ToDouble(useRegisterAtStart(opd));
         return define(lir, convert);
       }
 

From 20a6dcc6075f3b04b145024660f1cac1b56d3af9 Mon Sep 17 00:00:00 2001
From: "Byron Campen [:bwc]" <docfaraday@gmail.com>
Date: Thu, 12 Dec 2013 16:30:59 -0800
Subject: [PATCH 366/459] Bug 949749 - Fix up include guard in SyncRunnable.h.
 r=froydnj

---
 xpcom/threads/SyncRunnable.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/xpcom/threads/SyncRunnable.h b/xpcom/threads/SyncRunnable.h
index ebd560c3ca86..60ce8e9e2469 100644
--- a/xpcom/threads/SyncRunnable.h
+++ b/xpcom/threads/SyncRunnable.h
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_SyncRunnable_h
+#define mozilla_SyncRunnable_h
 
 #include "nsThreadUtils.h"
 #include "mozilla/Monitor.h"

From d3b2deb0a9afd0c74e98e95deaecc389fd57e6ac Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Thu, 12 Dec 2013 16:38:32 -0800
Subject: [PATCH 367/459] Backed out changeset 2a1e0a4f8d72 (bug 932982) for
 b2g m2 orange on a CLOSED TREE

---
 js/public/MemoryMetrics.h         |   1 +
 js/src/gc/Marking.cpp             |  46 ++++-
 js/src/gc/RootMarking.cpp         |   5 +
 js/src/gc/Statistics.cpp          |   1 +
 js/src/gc/Statistics.h            |   1 +
 js/src/gc/Zone.cpp                |  31 ++-
 js/src/gc/Zone.h                  |   2 +
 js/src/jit/CodeGenerator.cpp      |   6 +-
 js/src/jit/Ion.cpp                |  17 +-
 js/src/jit/Ion.h                  |   2 +-
 js/src/jit/IonBuilder.cpp         |   6 +-
 js/src/jit/IonCode.h              |   3 -
 js/src/jit/MIR.cpp                |   2 +-
 js/src/jscompartment.cpp          |  11 +-
 js/src/jscompartment.h            |   3 +
 js/src/jsgc.cpp                   |  14 +-
 js/src/jsgc.h                     |   7 +-
 js/src/jsinfer.cpp                | 329 +++++++++++++++---------------
 js/src/jsinfer.h                  | 122 +++++++----
 js/src/jsinferinlines.h           |  78 +++++--
 js/src/vm/MemoryMetrics.cpp       |   1 +
 js/xpconnect/src/XPCJSRuntime.cpp |   4 +
 22 files changed, 434 insertions(+), 258 deletions(-)

diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index f974259467d5..95ac91b9f6d5 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -393,6 +393,7 @@ struct CompartmentStats
     macro(Other,   NotLiveGCThing, baselineStubsOptimized) \
     macro(Other,   NotLiveGCThing, ionData) \
     macro(Other,   NotLiveGCThing, typeInferenceTypeScripts) \
+    macro(Other,   NotLiveGCThing, typeInferencePendingArrays) \
     macro(Other,   NotLiveGCThing, typeInferenceAllocationSiteTables) \
     macro(Other,   NotLiveGCThing, typeInferenceArrayTypeTables) \
     macro(Other,   NotLiveGCThing, typeInferenceObjectTypeTables) \
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index d0e3bde29e8a..b0c8a6555988 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1122,11 +1122,14 @@ gc::MarkCycleCollectorChildren(JSTracer *trc, Shape *shape)
 static void
 ScanTypeObject(GCMarker *gcmarker, types::TypeObject *type)
 {
-    unsigned count = type->getPropertyCount();
-    for (unsigned i = 0; i < count; i++) {
-        types::Property *prop = type->getProperty(i);
-        if (prop && JSID_IS_STRING(prop->id))
-            PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
+    /* Don't mark properties for singletons. They'll be purged by the GC. */
+    if (!type->singleton) {
+        unsigned count = type->getPropertyCount();
+        for (unsigned i = 0; i < count; i++) {
+            types::Property *prop = type->getProperty(i);
+            if (prop && JSID_IS_STRING(prop->id))
+                PushMarkStack(gcmarker, JSID_TO_STRING(prop->id));
+        }
     }
 
     if (TaggedProto(type->proto).isObject())
@@ -1347,7 +1350,7 @@ GCMarker::restoreValueArray(JSObject *obj, void **vpp, void **endp)
 }
 
 void
-GCMarker::processMarkStackOther(uintptr_t tag, uintptr_t addr)
+GCMarker::processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr)
 {
     if (tag == TypeTag) {
         ScanTypeObject(this, reinterpret_cast<types::TypeObject *>(addr));
@@ -1361,6 +1364,35 @@ GCMarker::processMarkStackOther(uintptr_t tag, uintptr_t addr)
             pushObject(obj);
     } else if (tag == IonCodeTag) {
         MarkChildren(this, reinterpret_cast<jit::IonCode *>(addr));
+    } else if (tag == ArenaTag) {
+        ArenaHeader *aheader = reinterpret_cast<ArenaHeader *>(addr);
+        AllocKind thingKind = aheader->getAllocKind();
+        size_t thingSize = Arena::thingSize(thingKind);
+
+        for ( ; aheader; aheader = aheader->next) {
+            Arena *arena = aheader->getArena();
+            FreeSpan firstSpan(aheader->getFirstFreeSpan());
+            const FreeSpan *span = &firstSpan;
+
+            for (uintptr_t thing = arena->thingsStart(thingKind); ; thing += thingSize) {
+                JS_ASSERT(thing <= arena->thingsEnd());
+                if (thing == span->first) {
+                    if (!span->hasNext())
+                        break;
+                    thing = span->last;
+                    span = span->nextSpan();
+                } else {
+                    JSObject *object = reinterpret_cast<JSObject *>(thing);
+                    if (object->hasSingletonType() && object->markIfUnmarked(getMarkColor()))
+                        pushObject(object);
+                    budget.step();
+                }
+            }
+            if (budget.isOverBudget()) {
+                pushArenaList(aheader);
+                return;
+            }
+        }
     }
 }
 
@@ -1398,7 +1430,7 @@ GCMarker::processMarkStackTop(SliceBudget &budget)
         goto scan_obj;
     }
 
-    processMarkStackOther(tag, addr);
+    processMarkStackOther(budget, tag, addr);
     return;
 
   scan_value_array:
diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index 541ad84d996c..8ae3e85fd559 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -726,6 +726,11 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
         if (IS_GC_MARKING_TRACER(trc) && !zone->isCollecting())
             continue;
 
+        if (IS_GC_MARKING_TRACER(trc) && zone->isPreservingCode()) {
+            gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_MARK_TYPES);
+            zone->markTypes(trc);
+        }
+
         /* Do not discard scripts with counts while profiling. */
         if (rt->profilingScripts && !rt->isHeapMinorCollecting()) {
             for (CellIterUnderGC i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index be76eee734a1..7744b61d53f5 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -276,6 +276,7 @@ static const PhaseInfo phases[] = {
     { PHASE_PURGE, "Purge", PHASE_NO_PARENT },
     { PHASE_MARK, "Mark", PHASE_NO_PARENT },
     { PHASE_MARK_ROOTS, "Mark Roots", PHASE_MARK },
+    { PHASE_MARK_TYPES, "Mark Types", PHASE_MARK_ROOTS },
     { PHASE_MARK_DELAYED, "Mark Delayed", PHASE_MARK },
     { PHASE_SWEEP, "Sweep", PHASE_NO_PARENT },
     { PHASE_SWEEP_MARK, "Mark During Sweeping", PHASE_SWEEP },
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 1029fd52fe8e..3240fd238f53 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -28,6 +28,7 @@ enum Phase {
     PHASE_PURGE,
     PHASE_MARK,
     PHASE_MARK_ROOTS,
+    PHASE_MARK_TYPES,
     PHASE_MARK_DELAYED,
     PHASE_SWEEP,
     PHASE_SWEEP_MARK,
diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
index 539faabbd7c8..ad0c2fae7fde 100644
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -80,6 +80,35 @@ Zone::setNeedsBarrier(bool needs, ShouldUpdateIon updateIon)
     needsBarrier_ = needs;
 }
 
+void
+Zone::markTypes(JSTracer *trc)
+{
+    /*
+     * Mark all scripts, type objects and singleton JS objects in the
+     * compartment. These can be referred to directly by type sets, which we
+     * cannot modify while code which depends on these type sets is active.
+     */
+    JS_ASSERT(isPreservingCode());
+
+    for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
+        JSScript *script = i.get<JSScript>();
+        MarkScriptRoot(trc, &script, "mark_types_script");
+        JS_ASSERT(script == i.get<JSScript>());
+    }
+
+    for (size_t thingKind = FINALIZE_OBJECT0; thingKind < FINALIZE_OBJECT_LIMIT; thingKind++) {
+        ArenaHeader *aheader = allocator.arenas.getFirstArena(static_cast<AllocKind>(thingKind));
+        if (aheader)
+            trc->runtime->gcMarker.pushArenaList(aheader);
+    }
+
+    for (CellIterUnderGC i(this, FINALIZE_TYPE_OBJECT); !i.done(); i.next()) {
+        types::TypeObject *type = i.get<types::TypeObject>();
+        MarkTypeObjectRoot(trc, &type, "mark_types_scan");
+        JS_ASSERT(type == i.get<types::TypeObject>());
+    }
+}
+
 void
 Zone::resetGCMallocBytes()
 {
@@ -115,7 +144,7 @@ Zone::sweep(FreeOp *fop, bool releaseTypes)
     if (active)
         releaseTypes = false;
 
-    {
+    if (!isPreservingCode()) {
         gcstats::AutoPhase ap(fop->runtime()->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
         types.sweep(fop, releaseTypes);
     }
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index a2fe6a22a022..ebad06d0b6c9 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -310,6 +310,8 @@ struct Zone : public JS::shadow::Zone,
         js_ReportAllocationOverflow(nullptr);
     }
 
+    void markTypes(JSTracer *trc);
+
     js::types::TypeZone types;
 
     void sweep(js::FreeOp *fop, bool releaseTypes);
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index f8a69038c4ac..7cbe48d16495 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -5887,7 +5887,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                      safepoints_.size(), callTargets.length(),
                      patchableBackedges_.length());
     if (!ionScript) {
-        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
         return false;
     }
 
@@ -5912,7 +5912,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         // Use js_free instead of IonScript::Destroy: the cache list and
         // backedge list are still uninitialized.
         js_free(ionScript);
-        recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
+        recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
         return false;
     }
 
@@ -5933,7 +5933,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
                         /* resetUses */ false, /* cancelOffThread*/ false))
         {
             js_free(ionScript);
-            recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
+            recompileInfo.compilerOutput(cx->compartment()->types)->invalidate();
             return false;
         }
     }
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 5bf13a880301..ba3ee46a154d 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2481,7 +2481,7 @@ jit::InvalidateAll(FreeOp *fop, Zone *zone)
 
 
 void
-jit::Invalidate(types::TypeZone &types, FreeOp *fop,
+jit::Invalidate(types::TypeCompartment &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
@@ -2564,7 +2564,7 @@ void
 jit::Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses,
                 bool cancelOffThread)
 {
-    jit::Invalidate(cx->zone()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
+    jit::Invalidate(cx->compartment()->types, cx->runtime()->defaultFreeOp(), invalid, resetUses,
                     cancelOffThread);
 }
 
@@ -2611,13 +2611,14 @@ FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool p
     else
         script->setIonScript(nullptr);
 
-    types::TypeZone &types = script->zone()->types;
-    ionScript->recompileInfo().compilerOutput(types)->invalidate();
-
-    // If this script has Ion code on the stack, invalidated() will return
+    // If this script has Ion code on the stack, invalidation() will return
     // true. In this case we have to wait until destroying it.
-    if (!ionScript->invalidated())
+    if (!ionScript->invalidated()) {
+        types::TypeCompartment &types = script->compartment()->types;
+        ionScript->recompileInfo().compilerOutput(types)->invalidate();
+
         jit::IonScript::Destroy(fop, ionScript);
+    }
 }
 
 void
@@ -2636,6 +2637,8 @@ jit::FinishDiscardJitCode(FreeOp *fop, JSCompartment *comp)
     // Free optimized baseline stubs.
     if (comp->jitCompartment())
         comp->jitCompartment()->optimizedStubSpace()->free();
+
+    comp->types.clearCompilerOutputs(fop);
 }
 
 void
diff --git a/js/src/jit/Ion.h b/js/src/jit/Ion.h
index db6c5ee4f811..37ad4e778387 100644
--- a/js/src/jit/Ion.h
+++ b/js/src/jit/Ion.h
@@ -364,7 +364,7 @@ IonExecStatus IonCannon(JSContext *cx, RunState &state);
 IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgs &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
-void Invalidate(types::TypeZone &types, FreeOp *fop,
+void Invalidate(types::TypeCompartment &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
                 bool cancelOffThread = true);
 void Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses = true,
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index a85d3f37e01a..28b2285a8fdc 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6286,7 +6286,7 @@ IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psuc
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints()))
+        property.configured(constraints(), staticType))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -6376,7 +6376,7 @@ IonBuilder::setStaticName(JSObject *staticObject, PropertyName *name)
     types::HeapTypeSetKey property = staticType->property(id);
     if (!property.maybeTypes() ||
         !property.maybeTypes()->definiteProperty() ||
-        property.configured(constraints()))
+        property.configured(constraints(), staticType))
     {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
@@ -7826,7 +7826,7 @@ IonBuilder::getDefiniteSlot(types::TemporaryTypeSet *types, PropertyName *name,
     *property = type->property(id);
     return property->maybeTypes() &&
            property->maybeTypes()->definiteProperty() &&
-           !property->configured(constraints());
+           !property->configured(constraints(), type);
 }
 
 bool
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index 4acc08d50993..8167d1fa80e9 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -526,9 +526,6 @@ struct IonScript
     const types::RecompileInfo& recompileInfo() const {
         return recompileInfo_;
     }
-    types::RecompileInfo& recompileInfoRef() {
-        return recompileInfo_;
-    }
     uint32_t incrOsrPcMismatchCounter() {
         return ++osrPcMismatchCounter_;
     }
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index 882b468f6a7b..aad9234a367f 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3025,7 +3025,7 @@ jit::PropertyReadIsIdempotent(types::CompilerConstraintList *constraints,
 
             // Check if the property has been reconfigured or is a getter.
             types::HeapTypeSetKey property = object->property(NameToId(name));
-            if (property.configured(constraints))
+            if (property.configured(constraints, object))
                 return false;
         }
     }
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index f9dd807606db..a4132018c96f 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -48,6 +48,7 @@ JSCompartment::JSCompartment(Zone *zone, const JS::CompartmentOptions &options =
 #endif
     global_(nullptr),
     enterCompartmentDepth(0),
+    lastCodeRelease(0),
     data(nullptr),
     objectMetadataCallback(nullptr),
     lastAnimationTime(0),
@@ -544,6 +545,13 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
         WeakMapBase::sweepCompartment(this);
     }
 
+    if (zone()->isPreservingCode()) {
+        gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_ANALYSIS);
+        types.sweepShapes(fop);
+    } else {
+        JS_ASSERT(!types.constrainedOutputs);
+    }
+
     NativeIterator *ni = enumerators->next();
     while (ni != enumerators) {
         JSObject *iterObj = ni->iterObj();
@@ -856,6 +864,7 @@ JSCompartment::clearTraps(FreeOp *fop)
 
 void
 JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                      size_t *tiPendingArrays,
                                       size_t *tiAllocationSiteTables,
                                       size_t *tiArrayTypeTables,
                                       size_t *tiObjectTypeTables,
@@ -867,7 +876,7 @@ JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                       size_t *baselineStubsOptimized)
 {
     *compartmentObject += mallocSizeOf(this);
-    types.addSizeOfExcludingThis(mallocSizeOf, tiAllocationSiteTables,
+    types.addSizeOfExcludingThis(mallocSizeOf, tiPendingArrays, tiAllocationSiteTables,
                                  tiArrayTypeTables, tiObjectTypeTables);
     *shapesCompartmentTables += baseShapes.sizeOfExcludingThis(mallocSizeOf)
                               + initialShapes.sizeOfExcludingThis(mallocSizeOf)
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index f44c2b09e390..15a93afe1280 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -187,6 +187,8 @@ struct JSCompartment
      */
     void adoptWorkerAllocator(js::Allocator *workerAllocator);
 
+
+    int64_t                      lastCodeRelease;
     bool                         activeAnalysis;
 
     /* Type information about the scripts and objects in this compartment. */
@@ -219,6 +221,7 @@ struct JSCompartment
 
   public:
     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                size_t *tiPendingArrays,
                                 size_t *tiAllocationSiteTables,
                                 size_t *tiArrayTypeTables,
                                 size_t *tiObjectTypeTables,
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 27242bdcdb39..dd3cde985825 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2854,9 +2854,13 @@ ShouldPreserveJITCode(JSCompartment *comp, int64_t currentTime)
 
     if (rt->alwaysPreserveCode)
         return true;
-    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime)
+    if (comp->lastAnimationTime + PRMJ_USEC_PER_SEC >= currentTime &&
+        comp->lastCodeRelease + (PRMJ_USEC_PER_SEC * 300) >= currentTime)
+    {
         return true;
+    }
 
+    comp->lastCodeRelease = currentTime;
     return false;
 }
 
@@ -3935,12 +3939,12 @@ BeginSweepingZoneGroup(JSRuntime *rt)
         bool releaseTypes = ReleaseObservedTypes(rt);
         for (GCCompartmentGroupIter c(rt); !c.done(); c.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            c->sweep(&fop, releaseTypes && !c->zone()->isPreservingCode());
+            c->sweep(&fop, releaseTypes);
         }
 
         for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
             gcstats::AutoSCC scc(rt->gcStats, rt->gcZoneGroupIndex);
-            zone->sweep(&fop, releaseTypes && !zone->isPreservingCode());
+            zone->sweep(&fop, releaseTypes);
         }
     }
 
@@ -5289,6 +5293,10 @@ js::ReleaseAllJITCode(FreeOp *fop)
             jit::FinishDiscardBaselineScript(fop, script);
         }
     }
+
+    /* Sweep now invalidated compiler outputs from each compartment. */
+    for (CompartmentsIter comp(fop->runtime(), SkipAtoms); !comp.done(); comp.next())
+        comp->types.clearCompilerOutputs(fop);
 #endif
 }
 
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 9159f31ec024..2e5cbe360930 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -1091,6 +1091,7 @@ struct GCMarker : public JSTracer {
         ObjectTag,
         TypeTag,
         XmlTag,
+        ArenaTag,
         SavedValueArrayTag,
         IonCodeTag,
         LastTag = IonCodeTag
@@ -1118,6 +1119,10 @@ struct GCMarker : public JSTracer {
         pushTaggedPtr(ObjectTag, obj);
     }
 
+    void pushArenaList(gc::ArenaHeader *firstArena) {
+        pushTaggedPtr(ArenaTag, firstArena);
+    }
+
     void pushType(types::TypeObject *type) {
         pushTaggedPtr(TypeTag, type);
     }
@@ -1224,7 +1229,7 @@ struct GCMarker : public JSTracer {
     bool restoreValueArray(JSObject *obj, void **vpp, void **endp);
     void saveValueRanges();
     inline void processMarkStackTop(SliceBudget &budget);
-    void processMarkStackOther(uintptr_t tag, uintptr_t addr);
+    void processMarkStackOther(SliceBudget &budget, uintptr_t tag, uintptr_t addr);
 
     void appendGrayRoot(void *thing, JSGCTraceKind kind);
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 51c19af54640..0c1fe0167a3c 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -243,6 +243,14 @@ types::TypeHasProperty(JSContext *cx, TypeObject *obj, jsid id, const Value &val
         if (id == id___proto__(cx) || id == id_constructor(cx) || id == id_caller(cx))
             return true;
 
+        /*
+         * If we called in here while resolving a type constraint, we may be in the
+         * middle of resolving a standard class and the type sets will not be updated
+         * until the outer TypeSet::add finishes.
+         */
+        if (cx->compartment()->types.pendingCount)
+            return true;
+
         Type type = GetValueType(value);
 
         AutoEnterAnalysis enter(cx);
@@ -734,12 +742,12 @@ class TypeCompilerConstraint : public TypeConstraint
 
     void newType(JSContext *cx, TypeSet *source, Type type) {
         if (data.invalidateOnNewType(type))
-            cx->zone()->types.addPendingRecompile(cx, compilation);
+            cx->compartment()->types.addPendingRecompile(cx, compilation);
     }
 
     void newPropertyState(JSContext *cx, TypeSet *source) {
         if (data.invalidateOnNewPropertyState(source))
-            cx->zone()->types.addPendingRecompile(cx, compilation);
+            cx->compartment()->types.addPendingRecompile(cx, compilation);
     }
 
     void newObjectState(JSContext *cx, TypeObject *object) {
@@ -747,16 +755,7 @@ class TypeCompilerConstraint : public TypeConstraint
         // will be sent on changes to its state, so always invalidate any
         // associated compilations.
         if (object->unknownProperties() || data.invalidateOnNewObjectState(object))
-            cx->zone()->types.addPendingRecompile(cx, compilation);
-    }
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (data.shouldSweep() || compilation.shouldSweep(zone))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeCompilerConstraint<T> >(compilation, data);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
+            cx->compartment()->types.addPendingRecompile(cx, compilation);
     }
 };
 
@@ -909,21 +908,13 @@ class TypeConstraintFreezeStack : public TypeConstraint
 
     const char *kind() { return "freezeStack"; }
 
-    void newType(JSContext *cx, TypeSet *source, Type type) {
+    void newType(JSContext *cx, TypeSet *source, Type type)
+    {
         /*
          * Unlike TypeConstraintFreeze, triggering this constraint once does
          * not disable it on future changes to the type set.
          */
-        cx->zone()->types.addPendingRecompile(cx, script_);
-    }
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (IsScriptAboutToBeFinalized(&script_))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintFreezeStack>(script_);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
+        cx->compartment()->types.addPendingRecompile(cx, script_);
     }
 };
 
@@ -938,22 +929,15 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
 
     CompilerOutput co(script, executionMode);
 
-    TypeZone &types = cx->zone()->types;
-    if (!types.compilerOutputs) {
-        types.compilerOutputs = cx->new_< Vector<CompilerOutput> >(cx);
-        if (!types.compilerOutputs)
+    TypeCompartment &types = cx->compartment()->types;
+    if (!types.constrainedOutputs) {
+        types.constrainedOutputs = cx->new_< Vector<CompilerOutput> >(cx);
+        if (!types.constrainedOutputs)
             return false;
     }
 
-#ifdef DEBUG
-    for (size_t i = 0; i < types.compilerOutputs->length(); i++) {
-        const CompilerOutput &co = (*types.compilerOutputs)[i];
-        JS_ASSERT_IF(co.isValid(), co.script() != script || co.mode() != executionMode);
-    }
-#endif
-
-    uint32_t index = types.compilerOutputs->length();
-    if (!types.compilerOutputs->append(co))
+    uint32_t index = types.constrainedOutputs->length();
+    if (!types.constrainedOutputs->append(co))
         return false;
 
     *precompileInfo = RecompileInfo(index);
@@ -995,8 +979,8 @@ types::FinishCompilation(JSContext *cx, HandleScript script, ExecutionMode execu
             array[i].add(cx, cx->typeLifoAlloc().new_<TypeConstraintFreezeStack>(entry.script), false);
     }
 
-    if (!succeeded || types.compilerOutputs->back().pendingInvalidation()) {
-        types.compilerOutputs->back().invalidate();
+    if (!succeeded || types.constrainedOutputs->back().pendingInvalidation()) {
+        types.constrainedOutputs->back().invalidate();
         script->resetUseCount();
         return false;
     }
@@ -1025,8 +1009,6 @@ class ConstraintDataFreeze
                ? property.maybeTypes()->isSubset(expected)
                : property.maybeTypes()->empty();
     }
-
-    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1213,8 +1195,6 @@ class ConstraintDataFreezeObjectFlags
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
-
-    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
@@ -1309,8 +1289,6 @@ class ConstraintDataFreezeObjectForInlinedCall
     {
         return true;
     }
-
-    bool shouldSweep() { return false; }
 };
 
 // Constraint which triggers recompilation when the template object for a
@@ -1337,11 +1315,6 @@ class ConstraintDataFreezeObjectForNewScriptTemplate
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
-
-    bool shouldSweep() {
-        // Note: |templateObject| is only used for equality testing.
-        return false;
-    }
 };
 
 // Constraint which triggers recompilation when the underlying data pointer for
@@ -1368,11 +1341,6 @@ class ConstraintDataFreezeObjectForTypedArrayBuffer
     {
         return !invalidateOnNewObjectState(property.object()->maybeType());
     }
-
-    bool shouldSweep() {
-        // Note: |viewData| is only used for equality testing.
-        return false;
-    }
 };
 
 } /* anonymous namespace */
@@ -1445,7 +1413,10 @@ namespace {
 class ConstraintDataFreezeConfiguredProperty
 {
   public:
-    ConstraintDataFreezeConfiguredProperty()
+    TypeObjectKey *object;
+
+    ConstraintDataFreezeConfiguredProperty(TypeObjectKey *object)
+      : object(object)
     {}
 
     const char *kind() { return "freezeConfiguredProperty"; }
@@ -1459,16 +1430,31 @@ class ConstraintDataFreezeConfiguredProperty
     bool constraintHolds(JSContext *cx,
                          const HeapTypeSetKey &property, TemporaryTypeSet *expected)
     {
+        // Everywhere compiled code depends on definite properties associated
+        // with a type object's newScript, we need to make sure there are
+        // constraints in place which will mark those properties as configured
+        // should the definite properties be invalidated.
+        TypeObject *type = object->isSingleObject()
+                           ? object->asSingleObject()->type()
+                           : object->asTypeObject();
+        if (type->flags & OBJECT_FLAG_NEW_SCRIPT_REGENERATE) {
+            type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
+            if (type->hasNewScript()) {
+                CheckNewScriptProperties(cx, type, type->newScript()->fun);
+            } else {
+                JS_ASSERT(type->flags & OBJECT_FLAG_ADDENDUM_CLEARED);
+                type->flags &= ~OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
+            }
+        }
+
         return !property.maybeTypes()->configuredProperty();
     }
-
-    bool shouldSweep() { return false; }
 };
 
 } /* anonymous namespace */
 
 bool
-HeapTypeSetKey::configured(CompilerConstraintList *constraints)
+HeapTypeSetKey::configured(CompilerConstraintList *constraints, TypeObjectKey *type)
 {
     if (maybeTypes() && maybeTypes()->configuredProperty())
         return true;
@@ -1477,7 +1463,7 @@ HeapTypeSetKey::configured(CompilerConstraintList *constraints)
 
     typedef CompilerConstraintInstance<ConstraintDataFreezeConfiguredProperty> T;
     constraints->add(alloc->new_<T>(alloc, *this,
-                                    ConstraintDataFreezeConfiguredProperty()));
+                                    ConstraintDataFreezeConfiguredProperty(type)));
     return false;
 }
 
@@ -2000,7 +1986,7 @@ PrototypeHasIndexedProperty(CompilerConstraintList *constraints, JSObject *obj)
         if (type->unknownProperties())
             return true;
         HeapTypeSetKey index = type->property(JSID_VOID);
-        if (index.configured(constraints) || index.isOwnProperty(constraints))
+        if (index.configured(constraints, type) || index.isOwnProperty(constraints))
             return true;
         obj = obj->getProto();
     } while (obj);
@@ -2038,8 +2024,27 @@ types::TypeCanHaveExtraIndexedProperties(CompilerConstraintList *constraints,
     return PrototypeHasIndexedProperty(constraints, proto);
 }
 
+bool
+TypeCompartment::growPendingArray(JSContext *cx)
+{
+    unsigned newCapacity = js::Max(unsigned(100), pendingCapacity * 2);
+    PendingWork *newArray = js_pod_calloc<PendingWork>(newCapacity);
+    if (!newArray) {
+        cx->compartment()->types.setPendingNukeTypes(cx);
+        return false;
+    }
+
+    PodCopy(newArray, pendingArray, pendingCount);
+    js_free(pendingArray);
+
+    pendingArray = newArray;
+    pendingCapacity = newCapacity;
+
+    return true;
+}
+
 void
-TypeZone::processPendingRecompiles(FreeOp *fop)
+TypeCompartment::processPendingRecompiles(FreeOp *fop)
 {
     if (!pendingRecompiles)
         return;
@@ -2090,9 +2095,11 @@ TypeZone::nukeTypes(FreeOp *fop)
      */
     JS_ASSERT(pendingNukeTypes);
 
-    if (pendingRecompiles) {
-        fop->free_(pendingRecompiles);
-        pendingRecompiles = nullptr;
+    for (CompartmentsInZoneIter comp(zone()); !comp.done(); comp.next()) {
+        if (comp->types.pendingRecompiles) {
+            fop->free_(comp->types.pendingRecompiles);
+            comp->types.pendingRecompiles = nullptr;
+        }
     }
 
     inferenceEnabled = false;
@@ -2112,7 +2119,7 @@ TypeZone::nukeTypes(FreeOp *fop)
 }
 
 void
-TypeZone::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
+TypeCompartment::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 {
     CompilerOutput *co = info.compilerOutput(cx);
     if (!co || !co->isValid() || co->pendingInvalidation())
@@ -2138,7 +2145,7 @@ TypeZone::addPendingRecompile(JSContext *cx, const RecompileInfo &info)
 }
 
 void
-TypeZone::addPendingRecompile(JSContext *cx, JSScript *script)
+TypeCompartment::addPendingRecompile(JSContext *cx, JSScript *script)
 {
     JS_ASSERT(script);
 
@@ -3139,15 +3146,6 @@ class TypeConstraintClearDefiniteGetterSetter : public TypeConstraint
     }
 
     void newType(JSContext *cx, TypeSet *source, Type type) {}
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (IsTypeObjectAboutToBeFinalized(&object))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteGetterSetter>(object);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
-    }
 };
 
 bool
@@ -3194,15 +3192,6 @@ class TypeConstraintClearDefiniteSingle : public TypeConstraint
         if (source->baseFlags() || source->getObjectCount() > 1)
             object->clearAddendum(cx);
     }
-
-    TypeConstraint *sweep(TypeZone &zone) {
-        if (IsTypeObjectAboutToBeFinalized(&object))
-            return nullptr;
-        TypeConstraint *res = zone.typeLifoAlloc.new_<TypeConstraintClearDefiniteSingle>(object);
-        if (!res)
-            zone.setPendingNukeTypes();
-        return res;
-    }
 };
 
 void
@@ -3952,19 +3941,8 @@ ConstraintTypeSet::sweep(Zone *zone)
         }
     }
 
-    /*
-     * Type constraints only hold weak references. Copy constraints referring
-     * to data that is still live into the zone's new arena.
-     */
-    TypeConstraint *constraint = constraintList;
+    /* All constraints are wiped out on each GC. */
     constraintList = nullptr;
-    while (constraint) {
-        if (TypeConstraint *copy = constraint->sweep(zone->types)) {
-            copy->next = constraintList;
-            constraintList = copy;
-        }
-        constraint = constraint->next;
-    }
 }
 
 inline void
@@ -3984,6 +3962,18 @@ TypeObject::clearProperties()
 inline void
 TypeObject::sweep(FreeOp *fop)
 {
+    if (singleton) {
+        JS_ASSERT(!hasNewScript());
+
+        /*
+         * All properties can be discarded. We will regenerate them as needed
+         * as code gets reanalyzed.
+         */
+        clearProperties();
+
+        return;
+    }
+
     if (!isMarked()) {
         if (addendum)
             fop->free_(addendum);
@@ -4006,14 +3996,6 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < oldCapacity; i++) {
             Property *prop = oldArray[i];
             if (prop) {
-                if (singleton && !prop->types.constraintList) {
-                    /*
-                     * Don't copy over properties of singleton objects which
-                     * don't have associated constraints. The contents of these
-                     * type sets will be regenerated as necessary.
-                     */
-                    continue;
-                }
                 Property *newProp = typeLifoAlloc.new_<Property>(*prop);
                 if (newProp) {
                     Property **pentry =
@@ -4033,17 +4015,12 @@ TypeObject::sweep(FreeOp *fop)
         setBasePropertyCount(propertyCount);
     } else if (propertyCount == 1) {
         Property *prop = (Property *) propertySet;
-        if (singleton && !prop->types.constraintList) {
-            // Skip, as above.
-            clearProperties();
+        Property *newProp = typeLifoAlloc.new_<Property>(*prop);
+        if (newProp) {
+            propertySet = (Property **) newProp;
+            newProp->types.sweep(zone());
         } else {
-            Property *newProp = typeLifoAlloc.new_<Property>(*prop);
-            if (newProp) {
-                propertySet = (Property **) newProp;
-                newProp->types.sweep(zone());
-            } else {
-                zone()->types.setPendingNukeTypes();
-            }
+            zone()->types.setPendingNukeTypes();
         }
     }
 
@@ -4051,6 +4028,14 @@ TypeObject::sweep(FreeOp *fop)
         for (unsigned i = 0; i < basePropertyCount(); i++)
             JS_ASSERT(propertySet[i]);
     }
+
+    /*
+     * The GC will clear out the constraints ensuring the correctness of the
+     * newScript information, these constraints will need to be regenerated
+     * the next time we compile code which depends on this info.
+     */
+    if (hasNewScript())
+        flags |= OBJECT_FLAG_NEW_SCRIPT_REGENERATE;
 }
 
 void
@@ -4134,6 +4119,52 @@ TypeCompartment::sweep(FreeOp *fop)
                 e.rekeyFront(key);
         }
     }
+
+    /*
+     * The pending array is reset on GC, it can grow large (75+ KB) and is easy
+     * to reallocate if the compartment becomes active again.
+     */
+    if (pendingArray)
+        fop->free_(pendingArray);
+
+    pendingArray = nullptr;
+    pendingCapacity = 0;
+}
+
+void
+TypeCompartment::sweepShapes(FreeOp *fop)
+{
+    /*
+     * Sweep any weak shape references that may be finalized even if a GC is
+     * preserving type information.
+     */
+    if (objectTypeTable) {
+        for (ObjectTypeTable::Enum e(*objectTypeTable); !e.empty(); e.popFront()) {
+            const ObjectTableKey &key = e.front().key();
+            ObjectTableEntry &entry = e.front().value();
+
+            if (IsShapeAboutToBeFinalized(entry.shape.unsafeGet())) {
+                fop->free_(key.properties);
+                fop->free_(entry.types);
+                e.removeFront();
+            }
+        }
+    }
+}
+
+void
+TypeCompartment::clearCompilerOutputs(FreeOp *fop)
+{
+    if (constrainedOutputs) {
+        fop->delete_(constrainedOutputs);
+        constrainedOutputs = nullptr;
+    }
+
+    if (pendingRecompiles) {
+        JS_ASSERT(pendingRecompiles->length() == 0);
+        fop->delete_(pendingRecompiles);
+        pendingRecompiles = nullptr;
+    }
 }
 
 void
@@ -4162,6 +4193,7 @@ JSCompartment::sweepNewTypeObjectTable(TypeObjectWithNewScriptSet &table)
 
 TypeCompartment::~TypeCompartment()
 {
+    js_free(pendingArray);
     js_delete(arrayTypeTable);
     js_delete(objectTypeTable);
     js_delete(allocationSiteTable);
@@ -4180,6 +4212,12 @@ TypeScript::Sweep(FreeOp *fop, JSScript *script)
     /* Remove constraints and references to dead objects from the persistent type sets. */
     for (unsigned i = 0; i < num; i++)
         typeArray[i].sweep(compartment->zone());
+
+    /*
+     * Freeze constraints on stack type sets need to be regenerated the next
+     * time the script is analyzed.
+     */
+    script->clearHasFreezeConstraints();
 }
 
 void
@@ -4196,10 +4234,20 @@ Zone::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, size_t *typePoo
 
 void
 TypeCompartment::addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                        size_t *pendingArrays,
                                         size_t *allocationSiteTables,
                                         size_t *arrayTypeTables,
                                         size_t *objectTypeTables)
 {
+    /* Pending arrays are cleared on GC along with the analysis pool. */
+    *pendingArrays += mallocSizeOf(pendingArray);
+
+    /*
+     * TypeCompartment::pendingRecompiles is non-nullptr only while inference
+     * code is running.
+     */
+    JS_ASSERT(!pendingRecompiles);
+
     if (allocationSiteTable)
         *allocationSiteTables += allocationSiteTable->sizeOfIncludingThis(mallocSizeOf);
 
@@ -4241,8 +4289,6 @@ TypeObject::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
 TypeZone::TypeZone(Zone *zone)
   : zone_(zone),
     typeLifoAlloc(TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
-    compilerOutputs(nullptr),
-    pendingRecompiles(nullptr),
     pendingNukeTypes(false),
     inferenceEnabled(false)
 {
@@ -4250,8 +4296,6 @@ TypeZone::TypeZone(Zone *zone)
 
 TypeZone::~TypeZone()
 {
-    js_delete(compilerOutputs);
-    js_delete(pendingRecompiles);
 }
 
 void
@@ -4268,21 +4312,11 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
     LifoAlloc oldAlloc(typeLifoAlloc.defaultChunkSize());
     oldAlloc.steal(&typeLifoAlloc);
 
-    /* Sweep and find compressed indexes for each compiler output. */
-    size_t newCompilerOutputCount = 0;
-    if (compilerOutputs) {
-        for (size_t i = 0; i < compilerOutputs->length(); i++) {
-            CompilerOutput &output = (*compilerOutputs)[i];
-            if (output.isValid()) {
-                JSScript *script = output.script();
-                if (IsScriptAboutToBeFinalized(&script))
-                    output.invalidate();
-                else
-                    output.setSweepIndex(newCompilerOutputCount++);
-            }
-        }
-    }
-
+    /*
+     * Sweep analysis information and everything depending on it from the
+     * compartment, including all remaining mjit code if inference is
+     * enabled in the compartment.
+     */
     if (inferenceEnabled) {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_TI);
 
@@ -4294,21 +4328,6 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
                 if (releaseTypes) {
                     script->types->destroy();
                     script->types = nullptr;
-
-                    /*
-                     * Freeze constraints on stack type sets need to be
-                     * regenerated the next time the script is analyzed.
-                     */
-                    script->clearHasFreezeConstraints();
-
-                    JS_ASSERT(!script->hasIonScript());
-                    JS_ASSERT(!script->hasParallelIonScript());
-                } else {
-                    /* Update the recompile indexes in any IonScripts still on the script. */
-                    if (script->hasIonScript())
-                        script->ionScript()->recompileInfoRef().shouldSweep(*this);
-                    if (script->hasParallelIonScript())
-                        script->parallelIonScript()->recompileInfoRef().shouldSweep(*this);
                 }
             }
         }
@@ -4328,20 +4347,6 @@ TypeZone::sweep(FreeOp *fop, bool releaseTypes)
             comp->types.sweep(fop);
     }
 
-    if (compilerOutputs) {
-        size_t sweepIndex = 0;
-        for (size_t i = 0; i < compilerOutputs->length(); i++) {
-            CompilerOutput output = (*compilerOutputs)[i];
-            if (output.isValid()) {
-                JS_ASSERT(sweepIndex == output.sweepIndex());
-                output.setSweepIndex(0);
-                (*compilerOutputs)[sweepIndex++] = output;
-            }
-        }
-        JS_ASSERT(sweepIndex == newCompilerOutputCount);
-        JS_ALWAYS_TRUE(compilerOutputs->resize(newCompilerOutputCount));
-    }
-
     {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_CLEAR_SCRIPT_ANALYSIS);
         for (CellIterUnderGC i(zone(), FINALIZE_SCRIPT); !i.done(); i.next()) {
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 38c3be127e82..690631dfa7ad 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -177,7 +177,7 @@ namespace analyze {
 
 namespace types {
 
-class TypeZone;
+class TypeCompartment;
 class TypeSet;
 class TypeObjectKey;
 
@@ -278,10 +278,28 @@ inline Type GetValueType(const Value &val);
  * Type information about the values observed within scripts and about the
  * contents of the heap is accumulated as the program executes. Compilation
  * accumulates constraints relating type information on the heap with the
- * compilations that should be invalidated when those types change. Type
- * information and constraints are allocated in the zone's typeLifoAlloc,
- * and on GC all data referring to live things is copied into a new allocator.
- * Thus, type set and constraints only hold weak references.
+ * compilations that should be invalidated when those types change. This data
+ * is periodically cleared to reduce memory usage.
+ *
+ * GCs may clear both analysis information and jitcode. Sometimes GCs will
+ * preserve all information and code, and will not collect any scripts, type
+ * objects or singleton JS objects.
+ *
+ * The following data is cleared by all non-preserving GCs:
+ *
+ * - The ScriptAnalysis for each analyzed script and data from each analysis
+ *   pass performed.
+ *
+ * - Property type sets for singleton JS objects.
+ *
+ * - Type constraints and dead references in all type sets.
+ *
+ * The following data is occasionally cleared by non-preserving GCs:
+ *
+ * - TypeScripts and their type sets are occasionally destroyed, per a timer.
+ *
+ * - When a JSScript or TypeObject is swept, type information for its contents
+ *   is destroyed.
  */
 
 /*
@@ -316,12 +334,6 @@ public:
      * state.
      */
     virtual void newObjectState(JSContext *cx, TypeObject *object) {}
-
-    /*
-     * If the data this constraint refers to is still live, copy it into the
-     * zone's new allocator. Type constraints only hold weak references.
-     */
-    virtual TypeConstraint *sweep(TypeZone &zone) = 0;
 };
 
 /* Flags and other state stored in TypeSet::flags */
@@ -382,6 +394,13 @@ enum {
     /* If set, addendum information should not be installed on this object. */
     OBJECT_FLAG_ADDENDUM_CLEARED      = 0x2,
 
+    /*
+     * If set, type constraints covering the correctness of the newScript
+     * definite properties need to be regenerated before compiling any jitcode
+     * which depends on this information.
+     */
+    OBJECT_FLAG_NEW_SCRIPT_REGENERATE = 0x4,
+
     /*
      * Whether we have ensured all type sets in the compartment contain
      * ANYOBJECT instead of this object.
@@ -850,6 +869,12 @@ struct TypeTypedObject : public TypeObjectAddendum
  * information is sensitive to changes in the property's type. Future changes
  * to the property (whether those uncovered by analysis or those occurring
  * in the VM) will treat these properties like those of any other type object.
+ *
+ * When a GC occurs, we wipe out all analysis information for all the
+ * compartment's scripts, so can destroy all properties on singleton type
+ * objects at the same time. If there is no reference on the stack to the
+ * type object itself, the type object is also destroyed, and the JS object
+ * reverts to having a lazy type.
  */
 
 /* Type information about an object accessed by a script. */
@@ -1291,7 +1316,7 @@ class HeapTypeSetKey
 
     void freeze(CompilerConstraintList *constraints);
     JSValueType knownTypeTag(CompilerConstraintList *constraints);
-    bool configured(CompilerConstraintList *constraints);
+    bool configured(CompilerConstraintList *constraints, TypeObjectKey *type);
     bool isOwnProperty(CompilerConstraintList *constraints);
     bool knownSubset(CompilerConstraintList *constraints, const HeapTypeSetKey &other);
     JSObject *singleton(CompilerConstraintList *constraints);
@@ -1314,10 +1339,6 @@ class CompilerOutput
     // Whether this compilation is about to be invalidated.
     bool pendingInvalidation_ : 1;
 
-    // During sweeping, the list of compiler outputs is compacted and invalidated
-    // outputs are removed. This gives the new index for a valid compiler output.
-    uint32_t sweepIndex_ : 29;
-
   public:
     CompilerOutput()
       : script_(nullptr), mode_(SequentialExecution), pendingInvalidation_(false)
@@ -1345,15 +1366,6 @@ class CompilerOutput
     bool pendingInvalidation() {
         return pendingInvalidation_;
     }
-
-    void setSweepIndex(uint32_t index) {
-        if (index >= 1 << 29)
-            MOZ_CRASH();
-        sweepIndex_ = index;
-    }
-    uint32_t sweepIndex() {
-        return sweepIndex_;
-    }
 };
 
 class RecompileInfo
@@ -1368,9 +1380,8 @@ class RecompileInfo
     bool operator == (const RecompileInfo &o) const {
         return outputIndex == o.outputIndex;
     }
-    CompilerOutput *compilerOutput(TypeZone &types) const;
+    CompilerOutput *compilerOutput(TypeCompartment &types) const;
     CompilerOutput *compilerOutput(JSContext *cx) const;
-    bool shouldSweep(TypeZone &types);
 };
 
 /* Type information for a compartment. */
@@ -1378,9 +1389,32 @@ struct TypeCompartment
 {
     /* Constraint solving worklist structures. */
 
+    /*
+     * Worklist of types which need to be propagated to constraints. We use a
+     * worklist to avoid blowing the native stack.
+     */
+    struct PendingWork
+    {
+        TypeConstraint *constraint;
+        ConstraintTypeSet *source;
+        Type type;
+    };
+    PendingWork *pendingArray;
+    unsigned pendingCount;
+    unsigned pendingCapacity;
+
+    /* Whether we are currently resolving the pending worklist. */
+    bool resolving;
+
     /* Number of scripts in this compartment. */
     unsigned scriptCount;
 
+    /* Valid & Invalid script referenced by type constraints. */
+    Vector<CompilerOutput> *constrainedOutputs;
+
+    /* Pending recompilations to perform before execution of JIT code can resume. */
+    Vector<RecompileInfo> *pendingRecompiles;
+
     /* Table for referencing types of objects keyed to an allocation site. */
     AllocationSiteTable *allocationSiteTable;
 
@@ -1404,6 +1438,14 @@ struct TypeCompartment
 
     inline JSCompartment *compartment();
 
+    /* Add a type to register with a list of constraints. */
+    inline void addPending(JSContext *cx, TypeConstraint *constraint,
+                           ConstraintTypeSet *source, Type type);
+    bool growPendingArray(JSContext *cx);
+
+    /* Resolve pending type registrations, excluding delayed ones. */
+    inline void resolvePending(JSContext *cx);
+
     /* Prints results of this compartment if spew is enabled or force is set. */
     void print(JSContext *cx, bool force);
 
@@ -1419,16 +1461,26 @@ struct TypeCompartment
     /* Get or make an object for an allocation site, and add to the allocation site table. */
     TypeObject *addAllocationSiteTypeObject(JSContext *cx, AllocationSiteKey key);
 
+    void processPendingRecompiles(FreeOp *fop);
+
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes(ExclusiveContext *cx);
 
+    /* Mark a script as needing recompilation once inference has finished. */
+    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
+    void addPendingRecompile(JSContext *cx, JSScript *script);
+
     /* Mark any type set containing obj as having a generic object type. */
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
     void sweep(FreeOp *fop);
+    void sweepShapes(FreeOp *fop);
+    void clearCompilerOutputs(FreeOp *fop);
+
     void finalizeObjects();
 
     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                                size_t *pendingArrays,
                                 size_t *allocationSiteTables,
                                 size_t *arrayTypeTables,
                                 size_t *objectTypeTables);
@@ -1444,16 +1496,6 @@ struct TypeZone
     static const size_t TYPE_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 8 * 1024;
     js::LifoAlloc                typeLifoAlloc;
 
-    /*
-     * All Ion compilations that have occured in this zone, for indexing via
-     * RecompileInfo. This includes both valid and invalid compilations, though
-     * invalidated compilations are swept on GC.
-     */
-    Vector<CompilerOutput> *compilerOutputs;
-
-    /* Pending recompilations to perform before execution of JIT code can resume. */
-    Vector<RecompileInfo> *pendingRecompiles;
-
     /*
      * Bit set if all current types must be marked as unknown, and all scripts
      * recompiled. Caused by OOM failure within inference operations.
@@ -1474,12 +1516,6 @@ struct TypeZone
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes();
 
-    /* Mark a script as needing recompilation once inference has finished. */
-    void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
-    void addPendingRecompile(JSContext *cx, JSScript *script);
-
-    void processPendingRecompiles(FreeOp *fop);
-
     void nukeTypes(FreeOp *fop);
 };
 
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index 328daf0a076c..c4e07abd3271 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -104,29 +104,17 @@ CompilerOutput::ion() const
 }
 
 inline CompilerOutput*
-RecompileInfo::compilerOutput(TypeZone &types) const
+RecompileInfo::compilerOutput(TypeCompartment &types) const
 {
-    if (!types.compilerOutputs || outputIndex >= types.compilerOutputs->length())
+    if (!types.constrainedOutputs || outputIndex >= types.constrainedOutputs->length())
         return nullptr;
-    return &(*types.compilerOutputs)[outputIndex];
+    return &(*types.constrainedOutputs)[outputIndex];
 }
 
 inline CompilerOutput*
 RecompileInfo::compilerOutput(JSContext *cx) const
 {
-    return compilerOutput(cx->zone()->types);
-}
-
-inline bool
-RecompileInfo::shouldSweep(TypeZone &types)
-{
-    CompilerOutput *output = compilerOutput(types);
-    if (!output || !output->isValid())
-        return true;
-
-    // Update this info for the output's new index in the zone's compiler outputs.
-    outputIndex = output->sweepIndex();
-    return false;
+    return compilerOutput(cx->compartment()->types);
 }
 
 /////////////////////////////////////////////////////////////////////
@@ -300,13 +288,14 @@ struct AutoEnterAnalysis
          * If there are no more type inference activations on the stack,
          * process any triggered recompilations. Note that we should not be
          * invoking any scripted code while type inference is running.
+         * :TODO: assert this.
          */
         if (!compartment->activeAnalysis) {
-            TypeZone &types = compartment->zone()->types;
-            if (types.pendingNukeTypes)
-                types.nukeTypes(freeOp);
-            else if (types.pendingRecompiles)
-                types.processPendingRecompiles(freeOp);
+            TypeCompartment *types = &compartment->types;
+            if (compartment->zone()->types.pendingNukeTypes)
+                compartment->zone()->types.nukeTypes(freeOp);
+            else if (types->pendingRecompiles)
+                types->processPendingRecompiles(freeOp);
         }
     }
 
@@ -863,6 +852,50 @@ TypeCompartment::compartment()
     return (JSCompartment *)((char *)this - offsetof(JSCompartment, types));
 }
 
+inline void
+TypeCompartment::addPending(JSContext *cx, TypeConstraint *constraint,
+                            ConstraintTypeSet *source, Type type)
+{
+    JS_ASSERT(this == &cx->compartment()->types);
+    JS_ASSERT(!cx->runtime()->isHeapBusy());
+
+    InferSpew(ISpewOps, "pending: %sC%p%s %s",
+              InferSpewColor(constraint), constraint, InferSpewColorReset(),
+              TypeString(type));
+
+    if ((pendingCount == pendingCapacity) && !growPendingArray(cx))
+        return;
+
+    PendingWork &pending = pendingArray[pendingCount++];
+    pending.constraint = constraint;
+    pending.source = source;
+    pending.type = type;
+}
+
+inline void
+TypeCompartment::resolvePending(JSContext *cx)
+{
+    JS_ASSERT(this == &cx->compartment()->types);
+
+    if (resolving) {
+        /* There is an active call further up resolving the worklist. */
+        return;
+    }
+
+    resolving = true;
+
+    /* Handle all pending type registrations. */
+    while (pendingCount) {
+        const PendingWork &pending = pendingArray[--pendingCount];
+        InferSpew(ISpewOps, "resolve: %sC%p%s %s",
+                  InferSpewColor(pending.constraint), pending.constraint,
+                  InferSpewColorReset(), TypeString(pending.type));
+        pending.constraint->newType(cx, pending.source, pending.type);
+    }
+
+    resolving = false;
+}
+
 /////////////////////////////////////////////////////////////////////
 // TypeSet
 /////////////////////////////////////////////////////////////////////
@@ -1186,9 +1219,10 @@ ConstraintTypeSet::addType(ExclusiveContext *cxArg, Type type)
     if (JSContext *cx = cxArg->maybeJSContext()) {
         TypeConstraint *constraint = constraintList;
         while (constraint) {
-            constraint->newType(cx, this, type);
+            cx->compartment()->types.addPending(cx, constraint, this, type);
             constraint = constraint->next;
         }
+        cx->compartment()->types.resolvePending(cx);
     } else {
         JS_ASSERT(!constraintList);
     }
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index ee09906df5bd..3ba7d433c6f8 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -215,6 +215,7 @@ StatsCompartmentCallback(JSRuntime *rt, void *data, JSCompartment *compartment)
 
     // Measure the compartment object itself, and things hanging off it.
     compartment->addSizeOfIncludingThis(rtStats->mallocSizeOf_,
+                                        &cStats.typeInferencePendingArrays,
                                         &cStats.typeInferenceAllocationSiteTables,
                                         &cStats.typeInferenceArrayTypeTables,
                                         &cStats.typeInferenceObjectTypeTables,
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index b225830e8efe..1a12e11d83b3 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2122,6 +2122,10 @@ ReportCompartmentStats(const JS::CompartmentStats &cStats,
                    cStats.typeInferenceTypeScripts,
                    "Memory used by type sets associated with scripts.");
 
+    ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/pending-arrays"),
+                   cStats.typeInferencePendingArrays,
+                   "Memory used for solving constraints during type inference.");
+
     ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("type-inference/allocation-site-tables"),
                    cStats.typeInferenceAllocationSiteTables,
                    "Memory indexing type objects associated with allocation sites.");

From 5cfcfcf8a4c222a38d7f35ff70d3fb39b3abb129 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Thu, 12 Dec 2013 19:43:25 -0800
Subject: [PATCH 368/459] Backed out changeset f1abdc201968 (bug 823787) for
 breaking PGO builds on Windows

---
 build/pgo/profileserver.py | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/build/pgo/profileserver.py b/build/pgo/profileserver.py
index 4b09b41e3689..912684a6a27c 100644
--- a/build/pgo/profileserver.py
+++ b/build/pgo/profileserver.py
@@ -65,15 +65,7 @@ if __name__ == '__main__':
                            cmdargs=cmdargs,
                            env=env)
     runner.start(debug_args=debug_args, interactive=interactive)
-    status = runner.wait()
+    runner.wait()
     httpd.stop()
-    if status != 0:
-        status = 1      # normalize status, in case it's larger than 127
-
-    # Note:  the |finally| block below will always run.
-    # http://docs.python.org/2/library/sys.html#sys.exit says that sys.exit "is
-    # implemented by raising the SystemExit exception, so cleanup actions
-    # specified by finally clauses of try statements are honored".
-    sys.exit(status)
   finally:
     shutil.rmtree(profilePath)

From 1669b93c8b9969e50c5675b71cdadf90b702a59b Mon Sep 17 00:00:00 2001
From: Mark Finkle <mfinkle@mozilla.com>
Date: Thu, 12 Dec 2013 23:09:16 -0500
Subject: [PATCH 369/459] Bug 949639 - Move CanAddURI to nsAndroidHistory
 r=blassey

---
 mobile/android/base/GlobalHistory.java        | 37 ----------
 .../components/build/nsAndroidHistory.cpp     | 68 ++++++++++++++++++-
 .../components/build/nsAndroidHistory.h       |  2 +
 3 files changed, 69 insertions(+), 38 deletions(-)

diff --git a/mobile/android/base/GlobalHistory.java b/mobile/android/base/GlobalHistory.java
index 230c10b6ede2..153e04a861d4 100644
--- a/mobile/android/base/GlobalHistory.java
+++ b/mobile/android/base/GlobalHistory.java
@@ -94,49 +94,12 @@ class GlobalHistory {
         GeckoAppShell.notifyUriVisited(uri);
     }
 
-    // Logic ported from nsNavHistory::CanAddURI.
-    // http://mxr.mozilla.org/mozilla-central/source/toolkit/components/places/nsNavHistory.cpp#1272
-    private boolean canAddURI(String uri) {
-        if (uri == null || uri.length() == 0)
-            return false;
-
-        // First, heck the most common cases (HTTP, HTTPS) to avoid most of the work.
-        if (uri.startsWith("http:") || uri.startsWith("https:"))
-            return true;
-
-        String scheme = Uri.parse(uri).getScheme();
-        if (scheme == null)
-            return false;
-
-        // Now check for all bad things.
-        if (scheme.equals("about") ||
-            scheme.equals("imap") ||
-            scheme.equals("news") ||
-            scheme.equals("mailbox") ||
-            scheme.equals("moz-anno") ||
-            scheme.equals("view-source") ||
-            scheme.equals("chrome") ||
-            scheme.equals("resource") ||
-            scheme.equals("data") ||
-            scheme.equals("wyciwyg") ||
-            scheme.equals("javascript"))
-            return false;
-
-        return true;
-    }
-
     public void add(String uri) {
-        if (!canAddURI(uri))
-            return;
-
         BrowserDB.updateVisitedHistory(GeckoAppShell.getContext().getContentResolver(), uri);
         addToGeckoOnly(uri);
     }
 
     public void update(String uri, String title) {
-        if (!canAddURI(uri))
-            return;
-
         BrowserDB.updateHistoryTitle(GeckoAppShell.getContext().getContentResolver(), uri, title);
     }
 
diff --git a/mobile/android/components/build/nsAndroidHistory.cpp b/mobile/android/components/build/nsAndroidHistory.cpp
index d5909c5f6c12..0b21518e7dbf 100644
--- a/mobile/android/components/build/nsAndroidHistory.cpp
+++ b/mobile/android/components/build/nsAndroidHistory.cpp
@@ -84,6 +84,14 @@ nsAndroidHistory::VisitURI(nsIURI *aURI, nsIURI *aLastVisitedURI, uint32_t aFlag
   if (!aURI)
     return NS_OK;
 
+  // Silently return if URI is something we shouldn't add to DB.
+  bool canAdd;
+  nsresult rv = CanAddURI(aURI, &canAdd);
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (!canAdd) {
+    return NS_OK;
+  }
+
   if (!(aFlags & VisitFlags::TOP_LEVEL))
     return NS_OK;
 
@@ -94,7 +102,7 @@ nsAndroidHistory::VisitURI(nsIURI *aURI, nsIURI *aLastVisitedURI, uint32_t aFlag
     return NS_OK;
 
   nsAutoCString uri;
-  nsresult rv = aURI->GetSpec(uri);
+  rv = aURI->GetSpec(uri);
   if (NS_FAILED(rv)) return rv;
   NS_ConvertUTF8toUTF16 uriString(uri);
   GeckoAppShell::MarkURIVisited(uriString);
@@ -104,6 +112,14 @@ nsAndroidHistory::VisitURI(nsIURI *aURI, nsIURI *aLastVisitedURI, uint32_t aFlag
 NS_IMETHODIMP
 nsAndroidHistory::SetURITitle(nsIURI *aURI, const nsAString& aTitle)
 {
+  // Silently return if URI is something we shouldn't add to DB.
+  bool canAdd;
+  nsresult rv = CanAddURI(aURI, &canAdd);
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (!canAdd) {
+    return NS_OK;
+  }
+
   if (AndroidBridge::Bridge()) {
     nsAutoCString uri;
     nsresult rv = aURI->GetSpec(uri);
@@ -144,3 +160,53 @@ nsAndroidHistory::Run()
   }
   return NS_OK;
 }
+
+// Filter out unwanted URIs such as "chrome:", "mailbox:", etc.
+//
+// The model is if we don't know differently then add which basically means
+// we are suppose to try all the things we know not to allow in and then if
+// we don't bail go on and allow it in.
+//
+// Logic ported from nsNavHistory::CanAddURI.
+
+NS_IMETHODIMP
+nsAndroidHistory::CanAddURI(nsIURI* aURI, bool* canAdd)
+{
+  NS_ASSERTION(NS_IsMainThread(), "This can only be called on the main thread");
+  NS_ENSURE_ARG(aURI);
+  NS_ENSURE_ARG_POINTER(canAdd);
+
+  nsAutoCString scheme;
+  nsresult rv = aURI->GetScheme(scheme);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // first check the most common cases (HTTP, HTTPS) to allow in to avoid most
+  // of the work
+  if (scheme.EqualsLiteral("http")) {
+    *canAdd = true;
+    return NS_OK;
+  }
+  if (scheme.EqualsLiteral("https")) {
+    *canAdd = true;
+    return NS_OK;
+  }
+
+  // now check for all bad things
+  if (scheme.EqualsLiteral("about") ||
+      scheme.EqualsLiteral("imap") ||
+      scheme.EqualsLiteral("news") ||
+      scheme.EqualsLiteral("mailbox") ||
+      scheme.EqualsLiteral("moz-anno") ||
+      scheme.EqualsLiteral("view-source") ||
+      scheme.EqualsLiteral("chrome") ||
+      scheme.EqualsLiteral("resource") ||
+      scheme.EqualsLiteral("data") ||
+      scheme.EqualsLiteral("wyciwyg") ||
+      scheme.EqualsLiteral("javascript") ||
+      scheme.EqualsLiteral("blob")) {
+    *canAdd = false;
+    return NS_OK;
+  }
+  *canAdd = true;
+  return NS_OK;
+}
diff --git a/mobile/android/components/build/nsAndroidHistory.h b/mobile/android/components/build/nsAndroidHistory.h
index 7e8c03286ed2..51064838b0b9 100644
--- a/mobile/android/components/build/nsAndroidHistory.h
+++ b/mobile/android/components/build/nsAndroidHistory.h
@@ -34,6 +34,8 @@ private:
 
   nsDataHashtable<nsStringHashKey, nsTArray<mozilla::dom::Link *> *> mListeners;
   nsTPriorityQueue<nsString> mPendingURIs;
+
+  nsresult CanAddURI(nsIURI* aURI, bool* canAdd);
 };
 
 #endif

From 25fd0f7394b723b2b3556dd5309ba756c615d5d6 Mon Sep 17 00:00:00 2001
From: Matthew Noorenberghe <mozilla@noorenberghe.ca>
Date: Fri, 13 Dec 2013 23:54:04 +1300
Subject: [PATCH 370/459] Bug 949380 - [Australis] Add @hidden=true initially
 to UITour panels. r=Unfocused

---
 browser/base/content/browser.xul |  2 ++
 browser/modules/UITour.jsm       | 10 +++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index e9fcaa3c4730..2617e20c7897 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -197,6 +197,7 @@
     <!-- UI tour experience -->
     <panel id="UITourTooltip"
            type="arrow"
+           hidden="true"
            noautofocus="true"
            noautohide="true"
            align="start"
@@ -206,6 +207,7 @@
       <description id="UITourTooltipDescription" flex="1"/>
     </panel>
     <panel id="UITourHighlightContainer"
+           hidden="true"
            noautofocus="true"
            noautohide="true"
            consumeoutsideclicks="false">
diff --git a/browser/modules/UITour.jsm b/browser/modules/UITour.jsm
index 7d4b11cfe0c4..d6fc4d0c9c40 100644
--- a/browser/modules/UITour.jsm
+++ b/browser/modules/UITour.jsm
@@ -464,6 +464,7 @@ this.UITour = {
         effect = this.highlightEffects[randomEffect];
       }
       highlighter.setAttribute("active", effect);
+      highlighter.parentElement.hidden = false;
 
       let targetRect = aTargetEl.getBoundingClientRect();
 
@@ -514,16 +515,15 @@ this.UITour = {
       let tooltipTitle = document.getElementById("UITourTooltipTitle");
       let tooltipDesc = document.getElementById("UITourTooltipDescription");
 
-      tooltip.hidePopup();
+      if (tooltip.state == "open") {
+        tooltip.hidePopup();
+      }
 
       tooltipTitle.textContent = aTitle;
       tooltipDesc.textContent = aDescription;
 
+      tooltip.hidden = false;
       let alignment = "bottomcenter topright";
-
-      if (tooltip.state == "open") {
-        tooltip.hidePopup();
-      }
       tooltip.openPopup(aAnchorEl, alignment);
     }
 

From 98fa1c2e8cb2554f03a483e6ec830537dc471470 Mon Sep 17 00:00:00 2001
From: "Brian R. Bondy" <netzen@gmail.com>
Date: Thu, 12 Dec 2013 20:47:50 -0500
Subject: [PATCH 371/459] Bug 948478 - Metro Firefox hangs at startup trying to
 show add-on update dialog. r=mbrubeck

---
 browser/metro/profile/metro.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/browser/metro/profile/metro.js b/browser/metro/profile/metro.js
index 8ed308bbfe7e..5ff66deb9f3f 100644
--- a/browser/metro/profile/metro.js
+++ b/browser/metro/profile/metro.js
@@ -220,6 +220,7 @@ pref("extensions.blocklist.enabled", true);
 pref("extensions.blocklist.interval", 86400);
 pref("extensions.blocklist.url", "https://addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/%PRODUCT%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/%PING_COUNT%/%TOTAL_PING_COUNT%/%DAYS_SINCE_LAST_PING%/");
 pref("extensions.blocklist.detailsURL", "https://www.mozilla.org/%LOCALE%/blocklist/");
+pref("extensions.showMismatchUI", false);
 
 /* block popups by default, and notify the user about blocked popups */
 pref("dom.disable_open_during_load", true);

From 828c23405bc53162ea13889a1b3f11a8c8dfa80b Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Fri, 13 Dec 2013 09:51:21 -0600
Subject: [PATCH 372/459] Bug 949590 - When switching browsers, wait for the
 previous instance to close the profile before launching. r=bbondy

---
 .../shell/commandexecutehandler/CEHHelper.h   |  2 +-
 .../CommandExecuteHandler.cpp                 |  2 +-
 toolkit/xre/nsAppRunner.cpp                   | 16 +++---
 widget/windows/winrt/MetroAppShell.cpp        | 54 +++++++++----------
 4 files changed, 38 insertions(+), 36 deletions(-)

diff --git a/browser/metro/shell/commandexecutehandler/CEHHelper.h b/browser/metro/shell/commandexecutehandler/CEHHelper.h
index 3bd7bf8fef29..1459e653405c 100644
--- a/browser/metro/shell/commandexecutehandler/CEHHelper.h
+++ b/browser/metro/shell/commandexecutehandler/CEHHelper.h
@@ -15,7 +15,7 @@
 #include <atlbase.h>
 #include <shlobj.h>
 
-//#define SHOW_CONSOLE 1
+#define SHOW_CONSOLE 1
 extern HANDLE sCon;
 extern LPCWSTR metroDX10Available;
 
diff --git a/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp b/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp
index d79ac85daff3..c218ae2f7645 100644
--- a/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp
+++ b/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp
@@ -22,7 +22,7 @@
 #include <shellapi.h>
 #include <wininet.h>
 
-#ifdef SHOW_CONSOLE
+//#ifdef SHOW_CONSOLE
 #define DEBUG_DELAY_SHUTDOWN 1
 #endif
 
diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index 4692e9b968cb..2e7be7d1ebef 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -4072,12 +4072,6 @@ XREMain::XRE_main(int argc, char* argv[], const nsXREAppData* aAppData)
     // We have an application restart don't do any shutdown checks here
     // In particular we don't want to poison IO for checking late-writes.
     gShutdownChecks = SCM_NOTHING;
-
-    #if defined(MOZ_METRO) && defined(XP_WIN)
-    if (rv == NS_SUCCESS_RESTART_METRO_APP) {
-      LaunchDefaultMetroBrowser();
-    }
-    #endif
   }
 
   if (!mShuttingDown) {
@@ -4114,7 +4108,15 @@ XREMain::XRE_main(int argc, char* argv[], const nsXREAppData* aAppData)
     MOZ_gdk_display_close(mGdkDisplay);
 #endif
 
-    rv = LaunchChild(mNativeApp, true);
+#if defined(MOZ_METRO) && defined(XP_WIN)
+    if (rv == NS_SUCCESS_RESTART_METRO_APP) {
+      LaunchDefaultMetroBrowser();
+      rv = NS_OK;
+    } else
+#endif
+    {
+      rv = LaunchChild(mNativeApp, true);
+    }
 
 #ifdef MOZ_CRASHREPORTER
     if (mAppData->flags & NS_XRE_ENABLE_CRASH_REPORTER)
diff --git a/widget/windows/winrt/MetroAppShell.cpp b/widget/windows/winrt/MetroAppShell.cpp
index 7ca6537f9c49..61af8d14561b 100644
--- a/widget/windows/winrt/MetroAppShell.cpp
+++ b/widget/windows/winrt/MetroAppShell.cpp
@@ -113,8 +113,8 @@ HRESULT SHCreateShellItemArrayFromShellItemDynamic(IShellItem *psi, REFIID riid,
   return hr;
 }
 
-BOOL
-WinLaunchDeferredMetroFirefox(bool aInMetro)
+HRESULT
+WinLaunchDeferredMetroFirefox()
 {
   // Create an instance of the Firefox Metro DEH which is used to launch the browser
   const CLSID CLSID_FirefoxMetroDEH = {0x5100FEC1,0x212B, 0x4BF5 ,{0x9B,0xF8, 0x3E,0x65, 0x0F,0xD7,0x94,0xA3}};
@@ -126,51 +126,46 @@ WinLaunchDeferredMetroFirefox(bool aInMetro)
                                 IID_IExecuteCommand,
                                 getter_AddRefs(executeCommand));
   if (FAILED(hr))
-    return FALSE;
+    return hr;
 
   // Get the currently running exe path
   WCHAR exePath[MAX_PATH + 1] = { L'\0' };
   if (!::GetModuleFileNameW(0, exePath, MAX_PATH))
-    return FALSE;
+    return hr;
 
   // Convert the path to a long path since GetModuleFileNameW returns the path
   // that was used to launch Firefox which is not necessarily a long path.
   if (!::GetLongPathNameW(exePath, exePath, MAX_PATH))
-    return FALSE;
+    return hr;
 
   // Create an IShellItem for the current browser path
   nsRefPtr<IShellItem> shellItem;
   hr = WinUtils::SHCreateItemFromParsingName(exePath, nullptr, IID_IShellItem,
                                              getter_AddRefs(shellItem));
   if (FAILED(hr))
-    return FALSE;
+    return hr;
 
   // Convert to an IShellItemArray which is used for the path to launch
   nsRefPtr<IShellItemArray> shellItemArray;
   hr = SHCreateShellItemArrayFromShellItemDynamic(shellItem, IID_IShellItemArray, getter_AddRefs(shellItemArray));
   if (FAILED(hr))
-    return FALSE;
+    return hr;
 
   // Set the path to launch and parameters needed
   nsRefPtr<IObjectWithSelection> selection;
   hr = executeCommand->QueryInterface(IID_IObjectWithSelection, getter_AddRefs(selection));
   if (FAILED(hr))
-    return FALSE;
+    return hr;
   hr = selection->SetSelection(shellItemArray);
   if (FAILED(hr))
-    return FALSE;
+    return hr;
 
-  if (aInMetro) {
-    hr = executeCommand->SetParameters(L"--metro-restart");
-  } else {
-    hr = executeCommand->SetParameters(L"--desktop-restart");
-  }
+  hr = executeCommand->SetParameters(L"--metro-restart");
   if (FAILED(hr))
-    return FALSE;
+    return hr;
 
   // Run the default browser through the DEH
-  hr = executeCommand->Execute();
-  return SUCCEEDED(hr);
+  return executeCommand->Execute();
 }
 
 // Called by appstartup->run in xre, which is initiated by a call to
@@ -200,22 +195,24 @@ MetroAppShell::Run(void)
       mozilla::widget::StopAudioSession();
 
       nsCOMPtr<nsIAppStartup> appStartup (do_GetService(NS_APPSTARTUP_CONTRACTID));
-      bool restartingInMetro = false, restarting = false;
+      bool restartingInMetro = false, restartingInDesktop = false;
 
-      if (appStartup && NS_SUCCEEDED(appStartup->GetRestartingTouchEnvironment(&restartingInMetro)) &&
-          restartingInMetro) {
-        WinLaunchDeferredMetroFirefox(true);
-      }
-
-      if (!appStartup || NS_FAILED(appStartup->GetRestarting(&restarting))) {
+      if (!appStartup || NS_FAILED(appStartup->GetRestarting(&restartingInDesktop))) {
         WinUtils::Log("appStartup->GetRestarting() unsuccessful");
       }
 
-      // This calls XRE_metroShutdown() in xre. This will also destroy
-      // MessagePump.
+      if (appStartup && NS_SUCCEEDED(appStartup->GetRestartingTouchEnvironment(&restartingInMetro)) &&
+          restartingInMetro) {
+        restartingInDesktop = false;
+      }
+
+      // This calls XRE_metroShutdown() in xre. Shuts down gecko, including
+      // releasing the profile, and destroys MessagePump.
       sMetroApp->ShutdownXPCOM();
 
-      if (restarting) {
+      // Handle update restart or browser switch requests
+      if (restartingInDesktop) {
+        WinUtils::Log("Relaunching desktop browser");
         SHELLEXECUTEINFOW sinfo;
         memset(&sinfo, 0, sizeof(SHELLEXECUTEINFOW));
         sinfo.cbSize       = sizeof(SHELLEXECUTEINFOW);
@@ -228,6 +225,9 @@ MetroAppShell::Run(void)
         sinfo.lpParameters = L"--desktop-restart";
         sinfo.nShow        = SW_SHOWNORMAL;
         ShellExecuteEx(&sinfo);
+      } else if (restartingInMetro) {
+        HRESULT hresult = WinLaunchDeferredMetroFirefox();
+        WinUtils::Log("Relaunching metro browser (hr=%X)", hresult);
       }
 
       // This will free the real main thread in CoreApplication::Run()

From 4d82d95f8db8ac3653cb9327833cdc9fc9e6c0d9 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Fri, 13 Dec 2013 09:54:46 -0600
Subject: [PATCH 373/459] Bug 949590 - Follow up, turn off CEH debug console.
 r=me

---
 browser/metro/shell/commandexecutehandler/CEHHelper.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/metro/shell/commandexecutehandler/CEHHelper.h b/browser/metro/shell/commandexecutehandler/CEHHelper.h
index 1459e653405c..3bd7bf8fef29 100644
--- a/browser/metro/shell/commandexecutehandler/CEHHelper.h
+++ b/browser/metro/shell/commandexecutehandler/CEHHelper.h
@@ -15,7 +15,7 @@
 #include <atlbase.h>
 #include <shlobj.h>
 
-#define SHOW_CONSOLE 1
+//#define SHOW_CONSOLE 1
 extern HANDLE sCon;
 extern LPCWSTR metroDX10Available;
 

From 0aa5a840faf21c35257e31d05ddf5f94d87da345 Mon Sep 17 00:00:00 2001
From: "Szu-Yu Chen [:aknow]" <szchen@mozilla.com>
Date: Fri, 13 Dec 2013 11:46:23 -0500
Subject: [PATCH 374/459] Bug 949876 - Fix setRadioEnabled queueing method.
 r=hsinyi

---
 dom/system/gonk/RadioInterfaceLayer.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dom/system/gonk/RadioInterfaceLayer.js b/dom/system/gonk/RadioInterfaceLayer.js
index 94c36dbc29e4..c6b85204d1a0 100644
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -491,7 +491,7 @@ XPCOMUtils.defineLazyGetter(this, "gRadioEnabledController", function () {
     receiveMessage: function(msg) {
       if (DEBUG) debug("setRadioEnabled: receiveMessage: " + JSON.stringify(msg));
       this.pendingMessages.push(msg);
-      if (this.pendingMessages.length === 1) {
+      if (this.pendingMessages.length === 1 && !this.isDeactivatingDataCalls()) {
         this._processNextMessage();
       }
     },
@@ -540,7 +540,6 @@ XPCOMUtils.defineLazyGetter(this, "gRadioEnabledController", function () {
       } else {
         this.request = (function() {
           radioInterface.receiveMessage(msg);
-          this._processNextMessage();
         }).bind(this);
 
         // In some DSDS architecture with only one modem, toggling one radio may
@@ -596,6 +595,7 @@ XPCOMUtils.defineLazyGetter(this, "gRadioEnabledController", function () {
         this.request();
         this.request = null;
       }
+      this._processNextMessage();
     }
   };
 });

From dd731e9a225e16f3a4163a4e15cb8d07ab505323 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Fri, 13 Dec 2013 11:00:44 -0600
Subject: [PATCH 375/459] Bug 949590 - fix windows build bustage. r=bustage

---
 .../metro/shell/commandexecutehandler/CommandExecuteHandler.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp b/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp
index c218ae2f7645..d79ac85daff3 100644
--- a/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp
+++ b/browser/metro/shell/commandexecutehandler/CommandExecuteHandler.cpp
@@ -22,7 +22,7 @@
 #include <shellapi.h>
 #include <wininet.h>
 
-//#ifdef SHOW_CONSOLE
+#ifdef SHOW_CONSOLE
 #define DEBUG_DELAY_SHUTDOWN 1
 #endif
 

From 654bf66577cf2c5e960b5d8265a5d4738b4861b6 Mon Sep 17 00:00:00 2001
From: Chris Karlof <ckarlof@mozilla.com>
Date: Fri, 13 Dec 2013 12:12:00 -0500
Subject: [PATCH 376/459] Bug 772261 - Add duration to token server and client.
 r=rnewman

---
 services/common/tests/unit/test_tokenserverclient.js | 12 ++++++++++--
 services/common/tokenserverclient.js                 |  3 ++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/services/common/tests/unit/test_tokenserverclient.js b/services/common/tests/unit/test_tokenserverclient.js
index d1d24501b395..61022f794630 100644
--- a/services/common/tests/unit/test_tokenserverclient.js
+++ b/services/common/tests/unit/test_tokenserverclient.js
@@ -14,6 +14,7 @@ add_test(function test_working_bid_exchange() {
   _("Ensure that working BrowserID token exchange works as expected.");
 
   let service = "http://example.com/foo";
+  let duration = 300;
 
   let server = httpd_setup({
     "/1.0/foo/1.0": function(request, response) {
@@ -29,6 +30,7 @@ add_test(function test_working_bid_exchange() {
         key:          "key",
         api_endpoint: service,
         uid:          "uid",
+        duration:     duration,
       });
       response.bodyOutputStream.write(body, body.length);
     }
@@ -40,12 +42,12 @@ add_test(function test_working_bid_exchange() {
   client.getTokenFromBrowserIDAssertion(url, "assertion", cb);
   let result = cb.wait();
   do_check_eq("object", typeof(result));
-  do_check_attribute_count(result, 4);
+  do_check_attribute_count(result, 5);
   do_check_eq(service, result.endpoint);
   do_check_eq("id", result.id);
   do_check_eq("key", result.key);
   do_check_eq("uid", result.uid);
-
+  do_check_eq(duration, result.duration);
   server.stop(run_next_test);
 });
 
@@ -200,6 +202,7 @@ add_test(function test_403_no_urls() {
 add_test(function test_send_conditions_accepted() {
   _("Ensures that the condition acceptance header is sent when asked.");
 
+  let duration = 300;
   let server = httpd_setup({
     "/1.0/foo/1.0": function(request, response) {
       do_check_true(request.hasHeader("x-conditions-accepted"));
@@ -213,6 +216,7 @@ add_test(function test_send_conditions_accepted() {
         key:          "key",
         api_endpoint: "http://example.com/",
         uid:          "uid",
+        duration:     duration,
       });
       response.bodyOutputStream.write(body, body.length);
     }
@@ -384,6 +388,7 @@ add_test(function test_unhandled_media_type() {
 add_test(function test_rich_media_types() {
   _("Ensure that extra tokens in the media type aren't rejected.");
 
+  let duration = 300;
   let server = httpd_setup({
     "/foo": function(request, response) {
       response.setStatusLine(request.httpVersion, 200, "OK");
@@ -394,6 +399,7 @@ add_test(function test_rich_media_types() {
         key:          "key",
         api_endpoint: "foo",
         uid:          "uid",
+        duration:     duration,
       });
       response.bodyOutputStream.write(body, body.length);
     }
@@ -411,6 +417,7 @@ add_test(function test_rich_media_types() {
 add_test(function test_exception_during_callback() {
   _("Ensure that exceptions thrown during callback handling are handled.");
 
+  let duration = 300;
   let server = httpd_setup({
     "/foo": function(request, response) {
       response.setStatusLine(request.httpVersion, 200, "OK");
@@ -421,6 +428,7 @@ add_test(function test_exception_during_callback() {
         key:          "key",
         api_endpoint: "foo",
         uid:          "uid",
+        duration:     duration,
       });
       response.bodyOutputStream.write(body, body.length);
     }
diff --git a/services/common/tokenserverclient.js b/services/common/tokenserverclient.js
index c8eb47ec14e8..eb41d97859ab 100644
--- a/services/common/tokenserverclient.js
+++ b/services/common/tokenserverclient.js
@@ -359,7 +359,7 @@ TokenServerClient.prototype = {
       return;
     }
 
-    for (let k of ["id", "key", "api_endpoint", "uid"]) {
+    for (let k of ["id", "key", "api_endpoint", "uid", "duration"]) {
       if (!(k in result)) {
         let error = new TokenServerClientServerError("Expected key not " +
                                                      " present in result: " +
@@ -377,6 +377,7 @@ TokenServerClient.prototype = {
       key:      result.key,
       endpoint: result.api_endpoint,
       uid:      result.uid,
+      duration: result.duration,
     });
   }
 };

From 8a5ab931a1c0044b1dbee78e807ea32538a06b93 Mon Sep 17 00:00:00 2001
From: "Brian R. Bondy" <netzen@gmail.com>
Date: Fri, 13 Dec 2013 12:12:00 -0500
Subject: [PATCH 377/459] Bug 945829 - Metrofox hangs on startup when trying to
 show the profile chooser dialog. r=jimm

---
 toolkit/xre/nsAppRunner.cpp | 38 +++++++++++++++++++++++++++++++++----
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
index 2e7be7d1ebef..834505b1a36a 100644
--- a/toolkit/xre/nsAppRunner.cpp
+++ b/toolkit/xre/nsAppRunner.cpp
@@ -574,6 +574,22 @@ ProcessDDE(nsINativeAppSupport* aNative, bool aWait)
 }
 #endif
 
+/**
+ * Determines if there is support for showing the profile manager
+ *
+ * @return true in all environments except for Windows Metro
+*/
+static bool
+CanShowProfileManager()
+{
+#if defined(XP_WIN)
+  return XRE_GetWindowsEnvironment() == WindowsEnvironmentType_Desktop;
+#else
+  return true;
+#endif
+}
+
+
 bool gSafeMode = false;
 
 /**
@@ -1893,6 +1909,10 @@ static nsresult
 ShowProfileManager(nsIToolkitProfileService* aProfileSvc,
                    nsINativeAppSupport* aNative)
 {
+  if (!CanShowProfileManager()) {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
   nsresult rv;
 
   nsCOMPtr<nsIFile> profD, profLD;
@@ -2243,7 +2263,10 @@ SelectProfile(nsIProfileLock* *aResult, nsIToolkitProfileService* aProfileSvc, n
       PR_fprintf(PR_STDERR, "Error: argument -p is invalid when argument -osint is specified\n");
       return NS_ERROR_FAILURE;
     }
-    return ShowProfileManager(aProfileSvc, aNative);
+
+    if (CanShowProfileManager()) {
+      return ShowProfileManager(aProfileSvc, aNative);
+    }
   }
   if (ar) {
     ar = CheckArg("osint");
@@ -2271,14 +2294,16 @@ SelectProfile(nsIProfileLock* *aResult, nsIToolkitProfileService* aProfileSvc, n
       return ProfileLockedDialog(profile, unlocker, aNative, aResult);
     }
 
-    return ShowProfileManager(aProfileSvc, aNative);
+    if (CanShowProfileManager()) {
+      return ShowProfileManager(aProfileSvc, aNative);
+    }
   }
 
   ar = CheckArg("profilemanager", true);
   if (ar == ARG_BAD) {
     PR_fprintf(PR_STDERR, "Error: argument -profilemanager is invalid when argument -osint is specified\n");
     return NS_ERROR_FAILURE;
-  } else if (ar == ARG_FOUND) {
+  } else if (ar == ARG_FOUND && CanShowProfileManager()) {
     return ShowProfileManager(aProfileSvc, aNative);
   }
 
@@ -2303,8 +2328,9 @@ SelectProfile(nsIProfileLock* *aResult, nsIToolkitProfileService* aProfileSvc, n
   }
 
   bool useDefault = true;
-  if (count > 1)
+  if (count > 1 && CanShowProfileManager()) {
     aProfileSvc->GetStartWithLastProfile(&useDefault);
+  }
 
   if (useDefault) {
     nsCOMPtr<nsIToolkitProfile> profile;
@@ -2359,6 +2385,10 @@ SelectProfile(nsIProfileLock* *aResult, nsIToolkitProfileService* aProfileSvc, n
     }
   }
 
+  if (!CanShowProfileManager()) {
+    return NS_ERROR_FAILURE;
+  }
+
   return ShowProfileManager(aProfileSvc, aNative);
 }
 

From 4b77f45eb9f5ff77dd139b6c6e23a0ca8471b877 Mon Sep 17 00:00:00 2001
From: Jan Beich <jbeich@tormail.org>
Date: Fri, 13 Dec 2013 12:12:00 -0500
Subject: [PATCH 378/459] Bug 948946 - Test toolkit, not platform, for linux
 theme. r=dao

---
 browser/base/content/browser.xul                   |  2 +-
 browser/themes/shared/devtools/common.css          | 14 +++++++-------
 browser/themes/shared/devtools/highlighter.inc.css |  2 +-
 browser/themes/shared/tab-selected.svg             |  2 +-
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index 2617e20c7897..a32bd183a1dc 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -463,7 +463,7 @@
 #ifdef MENUBAR_CAN_AUTOHIDE
              toolbarname="&menubarCmd.label;"
              accesskey="&menubarCmd.accesskey;"
-#ifdef XP_LINUX
+#if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_QT)
              autohide="true"
 #endif
 #endif
diff --git a/browser/themes/shared/devtools/common.css b/browser/themes/shared/devtools/common.css
index a8208dc9fe1e..df70486fbb63 100644
--- a/browser/themes/shared/devtools/common.css
+++ b/browser/themes/shared/devtools/common.css
@@ -11,13 +11,13 @@
 .devtools-monospace {
 %ifdef XP_MACOSX
   font-family: Menlo, monospace;
-%endif
-%ifdef XP_LINUX
-  font-family: monospace;
-  font-size: 80%;
-%endif
-%ifdef XP_WIN
+%elifdef XP_WIN
   font-family: Consolas, monospace;
+%else
+  font-family: monospace;
+%endif
+%if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_QT)
+  font-size: 80%;
 %endif
 }
 
@@ -62,7 +62,7 @@
   background-image: linear-gradient(to bottom, hsla(209,18%,18%,0.9), hsl(210,11%,16%));
   border-radius: 3px;
   overflow-x: hidden;
-%ifdef XP_LINUX
+%if defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_QT)
   max-height: 32rem;
 %else
   max-height: 40rem;
diff --git a/browser/themes/shared/devtools/highlighter.inc.css b/browser/themes/shared/devtools/highlighter.inc.css
index 5b881b5c12fc..050f78bf5bf2 100644
--- a/browser/themes/shared/devtools/highlighter.inc.css
+++ b/browser/themes/shared/devtools/highlighter.inc.css
@@ -54,7 +54,7 @@ html|*.highlighter-nodeinfobar-pseudo-classes {
   padding: 0;
   width: 26px;
   min-height: 26px;
-%ifndef XP_LINUX
+%if !defined(MOZ_WIDGET_GTK) && !defined(MOZ_WIDGET_QT)
   background-color: transparent;
 %endif
 }
diff --git a/browser/themes/shared/tab-selected.svg b/browser/themes/shared/tab-selected.svg
index 4132c4a42460..9577d14078f8 100644
--- a/browser/themes/shared/tab-selected.svg
+++ b/browser/themes/shared/tab-selected.svg
@@ -20,7 +20,7 @@
 
 %ifdef XP_MACOSX
 %include ../osx/shared.inc
-%elifdef XP_LINUX
+%elif defined(MOZ_WIDGET_GTK) || defined(MOZ_WIDGET_QT)
 %include ../linux/linuxShared.inc
 %else
 %include ../windows/windowsShared.inc

From 7ab0a7f7eae810b27561f235fb80973cbe28a18e Mon Sep 17 00:00:00 2001
From: Brian Warner <warner-bugzilla@lothar.com>
Date: Fri, 13 Dec 2013 12:12:01 -0500
Subject: [PATCH 379/459] Bug 949241 - Enhance HAWK tests. r=rnewman

---
 services/crypto/tests/unit/test_utils_hawk.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/services/crypto/tests/unit/test_utils_hawk.js b/services/crypto/tests/unit/test_utils_hawk.js
index 7791c2a356c8..0a2cf6c31716 100644
--- a/services/crypto/tests/unit/test_utils_hawk.js
+++ b/services/crypto/tests/unit/test_utils_hawk.js
@@ -228,6 +228,16 @@ add_test(function test_hawk() {
   do_check_eq(result.artifacts.hash, "66DiyapJ0oGgj09IXWdMv8VCg9xk0PL5RqX7bNnQW2k=");
   do_check_eq(result.artifacts.mac, "2B++3x5xfHEZbPZGDiK3IwfPZctkV4DUr2ORg1vIHvk=");
 
+  // the payload "hash" is also non-urlsafe base64 (+/)
+  result = compute(makeURI("http://example.net/path"), method,
+                   { credentials: credentials_sha256,
+                     ts: 1353809207,
+                     nonce: "Ygvqdz",
+                     payload: "something else",
+                   });
+  do_check_eq(result.artifacts.hash, "lERFXr/IKOaAoYw+eBseDUSwmqZTX0uKZpcWLxsdzt8=");
+  do_check_eq(result.artifacts.mac, "jiZuhsac35oD7IdcblhFncBr8tJFHcwWLr8NIYWr9PQ=");
+
   /* Test non-ascii hostname. HAWK (via the node.js "url" module) punycodes
    * "ëxample.net" into "xn--xample-ova.net" before hashing. I still think
    * punycode was a bad joke that got out of the lab and into a spec.

From 0fd36d97ed20c8c38945a768498197a08af5cd4a Mon Sep 17 00:00:00 2001
From: Vivien Nicolas <21@vingtetun.org>
Date: Fri, 13 Dec 2013 18:23:47 +0100
Subject: [PATCH 380/459] Bug 949404 - Applications are half repainted once the
 keyboard is closed. r=Cwiiis

---
 gfx/layers/FrameMetrics.h                 | 24 +++++++++++++++++++++++
 gfx/layers/ipc/AsyncPanZoomController.cpp | 19 +-----------------
 widget/xpwidgets/APZCCallbackHelper.cpp   |  4 ++--
 3 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/gfx/layers/FrameMetrics.h b/gfx/layers/FrameMetrics.h
index c5d538ad984e..51d442070124 100644
--- a/gfx/layers/FrameMetrics.h
+++ b/gfx/layers/FrameMetrics.h
@@ -113,6 +113,30 @@ public:
     return mCumulativeResolution / mResolution;
   }
 
+  // Ensure the scrollableRect is at least as big as the compositionBounds
+  // because the scrollableRect can be smaller if the content is not large
+  // and the scrollableRect hasn't been updated yet.
+  // We move the scrollableRect up because we don't know if we can move it
+  // down. i.e. we know that scrollableRect can go back as far as zero.
+  // but we don't know how much further ahead it can go.
+  CSSRect GetExpandedScrollableRect() const
+  {
+    CSSRect scrollableRect = mScrollableRect;
+    if (scrollableRect.width < mCompositionBounds.width) {
+      scrollableRect.x = std::max(0.f,
+                                  scrollableRect.x - (mCompositionBounds.width - scrollableRect.width));
+      scrollableRect.width = mCompositionBounds.width;
+    }
+
+    if (scrollableRect.height < mCompositionBounds.height) {
+      scrollableRect.y = std::max(0.f,
+                                  scrollableRect.y - (mCompositionBounds.height - scrollableRect.height));
+      scrollableRect.height = mCompositionBounds.height;
+    }
+
+    return scrollableRect;
+  }
+
   /**
    * Return the scale factor needed to fit the viewport
    * into its composition bounds.
diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index a1a034ffa564..b02e71263980 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -1165,25 +1165,8 @@ const CSSRect AsyncPanZoomController::CalculatePendingDisplayPort(
     aEstimatedPaintDuration > EPSILON ? aEstimatedPaintDuration : 1.0;
 
   CSSIntRect compositionBounds = gfx::RoundedIn(aFrameMetrics.mCompositionBounds / aFrameMetrics.mZoom);
-  CSSRect scrollableRect = aFrameMetrics.mScrollableRect;
-
-  // Ensure the scrollableRect is at least as big as the compositionBounds
-  // because the scrollableRect can be smaller if the content is not large
-  // and the scrollableRect hasn't been updated yet.
-  // We move the scrollableRect up because we don't know if we can move it
-  // down. i.e. we know that scrollableRect can go back as far as zero.
-  // but we don't know how much further ahead it can go.
-  if (scrollableRect.width < compositionBounds.width) {
-      scrollableRect.x = std::max(0.f,
-                                  scrollableRect.x - (compositionBounds.width - scrollableRect.width));
-      scrollableRect.width = compositionBounds.width;
-  }
-  if (scrollableRect.height < compositionBounds.height) {
-      scrollableRect.y = std::max(0.f,
-                                  scrollableRect.y - (compositionBounds.height - scrollableRect.height));
-      scrollableRect.height = compositionBounds.height;
-  }
 
+  CSSRect scrollableRect = aFrameMetrics.GetExpandedScrollableRect();
   CSSPoint scrollOffset = aFrameMetrics.mScrollOffset;
 
   CSSRect displayPort = CSSRect(compositionBounds);
diff --git a/widget/xpwidgets/APZCCallbackHelper.cpp b/widget/xpwidgets/APZCCallbackHelper.cpp
index 79429d542c69..3ea68570101c 100644
--- a/widget/xpwidgets/APZCCallbackHelper.cpp
+++ b/widget/xpwidgets/APZCCallbackHelper.cpp
@@ -78,8 +78,8 @@ MaybeAlignAndClampDisplayPort(mozilla::layers::FrameMetrics& aFrameMetrics,
       - aActualScrollOffset;
   }
 
-  // Finally, clamp the display port to the scrollable rect.
-  CSSRect scrollableRect = aFrameMetrics.mScrollableRect;
+  // Finally, clamp the display port to the expanded scrollable rect.
+  CSSRect scrollableRect = aFrameMetrics.GetExpandedScrollableRect();
   displayPort = scrollableRect.Intersect(displayPort + aActualScrollOffset)
     - aActualScrollOffset;
 }

From fce8b5cad9ae8bf4e51a62f1b2d75e495134d866 Mon Sep 17 00:00:00 2001
From: Vivien Nicolas <21@vingtetun.org>
Date: Fri, 13 Dec 2013 18:23:49 +0100
Subject: [PATCH 381/459] Bug 943849 - [Shared] Fixed headers does not follow
 correctly the rendered view. r=kats

---
 b2g/app/b2g.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 817da4813953..fda271b9cae4 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -856,3 +856,9 @@ pref("osfile.reset_worker_delay", 5000);
 
 // The URL of the Firefox Accounts auth server backend
 pref("identity.fxaccounts.auth.uri", "https://api-accounts.dev.lcip.org/v1");
+
+// APZC preferences.
+//
+// Gaia relies heavily on scroll events for now, so lets fire them
+// more often than the default value (100).
+pref("apz.asyncscroll.throttle", 40);

From a8afdb948a62d728eb6968aa680c66edcfc4e153 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 09:30:25 -0800
Subject: [PATCH 382/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/2b63513acfbf
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Merge pull request #14649 from fcampo/sms-overlay-style-broken-947285

Bug 947285 - [Messaging] Notice style is broken (r=julienw)

========

https://hg.mozilla.org/integration/gaia-central/rev/a6211c58e5cf
Author: Fernando Campo <fernando.campo@o2.com>
Desc: Bug 947285 - [Messaging] Notice style is broken
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 1929ed741554..2ef805efe0f0 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "aed25a1b6915f94d81f766c51d71df557019ae3e", 
+    "revision": "2b63513acfbf8b2c8e55465cb209c2ace9db05b0", 
     "repo_path": "/integration/gaia-central"
 }

From 47faef9328044a0c7376711ec7f1198c5ca1ab2b Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Fri, 13 Dec 2013 12:46:59 -0500
Subject: [PATCH 383/459] Bug 949932 - Null-check the new StickyScrollContainer
 in case we don't have any scroll frame ancestors, e.g. in a position:fixed
 sub-tree. r=roc

---
 layout/generic/StickyScrollContainer.cpp  |  4 +++-
 layout/generic/crashtests/949932.html     | 13 +++++++++++++
 layout/generic/crashtests/crashtests.list |  1 +
 3 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 layout/generic/crashtests/949932.html

diff --git a/layout/generic/StickyScrollContainer.cpp b/layout/generic/StickyScrollContainer.cpp
index bd9bb9f17fc6..245f71677eb7 100644
--- a/layout/generic/StickyScrollContainer.cpp
+++ b/layout/generic/StickyScrollContainer.cpp
@@ -93,7 +93,9 @@ StickyScrollContainer::NotifyReparentedFrameAcrossScrollFrameBoundary(nsIFrame*
     StickyScrollContainer* newSSC = GetStickyScrollContainerForFrame(f);
     if (newSSC != oldSSC) {
       oldSSC->RemoveFrame(f);
-      newSSC->AddFrame(f);
+      if (newSSC) {
+        newSSC->AddFrame(f);
+      }
     }
   }
 }
diff --git a/layout/generic/crashtests/949932.html b/layout/generic/crashtests/949932.html
new file mode 100644
index 000000000000..2b7e7a0be0be
--- /dev/null
+++ b/layout/generic/crashtests/949932.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+    <div style="position: fixed;">
+        <fieldset style="overflow: hidden;">
+            <legend style="position: sticky;"></legend>
+        </fieldset>
+    </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index add355218016..8326c07e59af 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -511,3 +511,4 @@ load 893523.html
 test-pref(layout.css.sticky.enabled,true) load 914891.html
 test-pref(layout.css.sticky.enabled,true) load 915475.xhtml
 load 943509-1.html
+test-pref(layout.css.sticky.enabled,true) load 949932.html

From 5b9d3b09ee6742d7c72aaa9050c0f771435c8dcd Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Fri, 13 Dec 2013 09:50:13 -0800
Subject: [PATCH 384/459] Bug 949878 - Switch to integer indexes to avoid
 pathological array slowdown, r=terrence

--HG--
extra : rebase_source : 93cd0bdd1bb2b1b4f104112613b3609ee4235ddd
---
 js/src/devtools/rootAnalysis/loadCallgraph.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/js/src/devtools/rootAnalysis/loadCallgraph.js b/js/src/devtools/rootAnalysis/loadCallgraph.js
index 295d3f9ce7ce..8964ca64e4a9 100644
--- a/js/src/devtools/rootAnalysis/loadCallgraph.js
+++ b/js/src/devtools/rootAnalysis/loadCallgraph.js
@@ -96,8 +96,9 @@ function loadCallgraph(file)
     // Find all functions reachable via an unsuppressed call chain, and remove
     // them from the suppressedFunctions set. Everything remaining is only
     // reachable when GC is suppressed.
-    while (worklist.length) {
-        name = worklist.pop();
+    var top = worklist.length;
+    while (top > 0) {
+        name = worklist[--top];
         if (shouldSuppressGC(name))
             continue;
         if (!(name in suppressedFunctions))
@@ -107,7 +108,7 @@ function loadCallgraph(file)
             continue;
         for (var entry of calleeGraph[name]) {
             if (!entry.suppressed)
-                worklist.push(entry.callee);
+                worklist[top++] = entry.callee;
         }
     }
 

From 3dadf354c012d72c85e41e354934392fcdd4a6a7 Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Fri, 13 Dec 2013 13:30:27 -0500
Subject: [PATCH 385/459] Backed out 7 changesets (bug 949668) for Windows
 jit-test failures on a CLOSED TREE.

Backed out changeset 3786ca248031 (bug 949668)
Backed out changeset 05c4fa8d327b (bug 949668)
Backed out changeset ca7eeb4f5570 (bug 949668)
Backed out changeset ff3bdc0fb8e3 (bug 949668)
Backed out changeset 2ff5f77b2047 (bug 949668)
Backed out changeset 246083962f43 (bug 949668)
Backed out changeset 8af12200ad0b (bug 949668)
---
 js/src/jit/BacktrackingAllocator.cpp          |  19 +-
 js/src/jit/BaselineIC.cpp                     |  10 +-
 js/src/jit/CodeGenerator.cpp                  |  61 ++--
 js/src/jit/IonMacroAssembler.h                |   4 +-
 js/src/jit/LIR-Common.h                       |  13 +-
 js/src/jit/LIR.cpp                            |  15 +-
 js/src/jit/LIR.h                              |  10 +-
 js/src/jit/LinearScan.cpp                     |  35 +--
 js/src/jit/LinearScan.h                       |   2 +-
 js/src/jit/LiveRangeAllocator.cpp             |   1 -
 js/src/jit/LiveRangeAllocator.h               |  26 +-
 js/src/jit/Lowering.cpp                       |  26 +-
 js/src/jit/MoveResolver.cpp                   |   2 +-
 js/src/jit/MoveResolver.h                     | 283 +++++++++---------
 js/src/jit/RegisterAllocator.h                |   2 +-
 js/src/jit/StupidAllocator.cpp                |  23 +-
 js/src/jit/StupidAllocator.h                  |   5 +-
 js/src/jit/arm/Assembler-arm.h                |  12 +-
 js/src/jit/arm/CodeGenerator-arm.cpp          |   2 +
 js/src/jit/arm/CodeGenerator-arm.h            |   2 +-
 js/src/jit/arm/Lowering-arm.cpp               |   2 +-
 js/src/jit/arm/MacroAssembler-arm.cpp         |  72 ++---
 js/src/jit/arm/MacroAssembler-arm.h           |  23 +-
 js/src/jit/arm/MoveEmitter-arm.cpp            |  43 +--
 js/src/jit/arm/MoveEmitter-arm.h              |   9 +-
 js/src/jit/arm/Trampoline-arm.cpp             |  10 +-
 js/src/jit/shared/CodeGenerator-shared.cpp    |   2 +-
 .../jit/shared/CodeGenerator-x86-shared.cpp   |   2 +
 js/src/jit/shared/CodeGenerator-x86-shared.h  |   2 +-
 js/src/jit/shared/Lowering-shared-inl.h       |  12 +-
 js/src/jit/shared/Lowering-shared.h           |   3 +-
 js/src/jit/shared/Lowering-x86-shared.cpp     |   6 +-
 js/src/jit/shared/MoveEmitter-x86-shared.cpp  |  45 +--
 js/src/jit/shared/MoveEmitter-x86-shared.h    |   7 +-
 js/src/jit/x64/MacroAssembler-x64.cpp         |  40 +--
 js/src/jit/x64/MacroAssembler-x64.h           |  21 +-
 js/src/jit/x64/Trampoline-x64.cpp             |  39 +--
 js/src/jit/x86/CodeGenerator-x86.cpp          |   4 +-
 js/src/jit/x86/MacroAssembler-x86.cpp         |  33 +-
 js/src/jit/x86/MacroAssembler-x86.h           |  21 +-
 js/src/jit/x86/Trampoline-x86.cpp             |  52 ++--
 41 files changed, 467 insertions(+), 534 deletions(-)

diff --git a/js/src/jit/BacktrackingAllocator.cpp b/js/src/jit/BacktrackingAllocator.cpp
index 803079fc2879..64e46a4edfcc 100644
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@@ -918,10 +918,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                 LiveInterval *prevInterval = reg->intervalFor(start.previous());
                 if (start.subpos() == CodePosition::INPUT) {
-                    if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
+                    if (!moveInput(inputOf(data->ins()), prevInterval, interval))
                         return false;
                 } else {
-                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
+                    if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
                         return false;
                 }
             }
@@ -941,8 +941,7 @@ BacktrackingAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            LDefinition *def = phi->getDef(0);
-            VirtualRegister *vreg = &vregs[def];
+            VirtualRegister *vreg = &vregs[phi->getDef(0)];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -954,7 +953,7 @@ BacktrackingAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to, def->type()))
+                if (!moveAtExit(predecessor, from, to))
                     return false;
             }
         }
@@ -979,10 +978,10 @@ BacktrackingAllocator::resolveControlFlow()
 
                     if (mSuccessor->numPredecessors() > 1) {
                         JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                        if (!moveAtExit(predecessor, from, to, reg.type()))
+                        if (!moveAtExit(predecessor, from, to))
                             return false;
                     } else {
-                        if (!moveAtEntry(successor, from, to, reg.type()))
+                        if (!moveAtEntry(successor, from, to))
                             return false;
                     }
                 }
@@ -1078,7 +1077,7 @@ BacktrackingAllocator::reifyAllocations()
 
                     if (*res != *alloc) {
                         LMoveGroup *group = getInputMoveGroup(inputOf(ins));
-                        if (!group->addAfter(sourceAlloc, res, def->type()))
+                        if (!group->addAfter(sourceAlloc, res))
                             return false;
                         *alloc = *res;
                     }
@@ -1129,9 +1128,7 @@ BacktrackingAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL ||
-                             def->type() == LDefinition::FLOAT32 ||
-                             def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index d6a5177a6081..e12f63ccfe7c 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -2841,9 +2841,9 @@ ICBinaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
         break;
       case JSOP_MOD:
         masm.setupUnalignedABICall(2, R0.scratchReg());
-        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
-        masm.passABIArg(FloatReg1, MoveOp::DOUBLE);
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg0);
+        masm.passABIArg(FloatReg1);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
         JS_ASSERT(ReturnFloatReg == FloatReg0);
         break;
       default:
@@ -2968,7 +2968,7 @@ ICBinaryArith_DoubleWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.bind(&truncateABICall);
         masm.push(intReg);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg0);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
         masm.pop(intReg);
@@ -3117,7 +3117,7 @@ ICUnaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
 
         masm.bind(&truncateABICall);
         masm.setupUnalignedABICall(1, scratchReg);
-        masm.passABIArg(FloatReg0, MoveOp::DOUBLE);
+        masm.passABIArg(FloatReg0);
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ToInt32));
         masm.storeCallResult(scratchReg);
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index f0c05f4ed83b..63efbd13937e 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1,4 +1,4 @@
-/* -*- Mnde: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1185,28 +1185,15 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
 
         const LAllocation *from = move.from();
         const LAllocation *to = move.to();
-        LDefinition::Type type = move.type();
 
         // No bogus moves.
         JS_ASSERT(*from != *to);
         JS_ASSERT(!from->isConstant());
         JS_ASSERT(from->isDouble() == to->isDouble());
 
-        MoveOp::Kind kind;
-        switch (type) {
-          case LDefinition::OBJECT:
-          case LDefinition::SLOTS:
-#ifdef JS_NUNBOX32
-          case LDefinition::TYPE:
-          case LDefinition::PAYLOAD:
-#else
-          case LDefinition::BOX:
-#endif
-          case LDefinition::GENERAL: kind = MoveOp::GENERAL; break;
-          case LDefinition::FLOAT32: kind = MoveOp::FLOAT32; break;
-          case LDefinition::DOUBLE:  kind = MoveOp::DOUBLE;  break;
-          default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
-        }
+        MoveResolver::Move::Kind kind = from->isDouble()
+                                        ? MoveResolver::Move::DOUBLE
+                                        : MoveResolver::Move::GENERAL;
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), kind))
             return false;
@@ -3058,9 +3045,9 @@ bool CodeGenerator::visitAtan2D(LAtan2D *lir)
     FloatRegister x = ToFloatRegister(lir->x());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(y, MoveOp::DOUBLE);
-    masm.passABIArg(x, MoveOp::DOUBLE);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MoveOp::DOUBLE);
+    masm.passABIArg(y);
+    masm.passABIArg(x);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3073,9 +3060,9 @@ bool CodeGenerator::visitHypot(LHypot *lir)
     FloatRegister y = ToFloatRegister(lir->y());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(x, MoveOp::DOUBLE);
-    masm.passABIArg(y, MoveOp::DOUBLE);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MoveOp::DOUBLE);
+    masm.passABIArg(x);
+    masm.passABIArg(y);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
     return true;
@@ -3814,10 +3801,10 @@ CodeGenerator::visitPowI(LPowI *ins)
     // its scratch register. We can therefore save an input register by
     // reusing the scratch register to pass constants to callWithABI.
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value, MoveOp::DOUBLE);
+    masm.passABIArg(value);
     masm.passABIArg(power);
 
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MacroAssembler::DOUBLE);
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     return true;
@@ -3831,9 +3818,9 @@ CodeGenerator::visitPowD(LPowD *ins)
     Register temp = ToRegister(ins->temp());
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(value, MoveOp::DOUBLE);
-    masm.passABIArg(power, MoveOp::DOUBLE);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MoveOp::DOUBLE);
+    masm.passABIArg(value);
+    masm.passABIArg(power);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3849,7 +3836,7 @@ CodeGenerator::visitRandom(LRandom *ins)
 
     masm.setupUnalignedABICall(1, temp2);
     masm.passABIArg(temp);
-    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MoveOp::DOUBLE);
+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MacroAssembler::DOUBLE);
 
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
     return true;
@@ -3869,7 +3856,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
         masm.movePtr(ImmPtr(mathCache), temp);
         masm.passABIArg(temp);
     }
-    masm.passABIArg(input, MoveOp::DOUBLE);
+    masm.passABIArg(input);
 
 #   define MAYBE_CACHED(fcn) (mathCache ? (void*)fcn ## _impl : (void*)fcn ## _uncached)
 
@@ -3950,7 +3937,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
 
 #   undef MAYBE_CACHED
 
-    masm.callWithABI(funptr, MoveOp::DOUBLE);
+    masm.callWithABI(funptr, MacroAssembler::DOUBLE);
     return true;
 }
 
@@ -3962,7 +3949,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(1, temp);
-    masm.passABIArg(input, MoveOp::FLOAT32);
+    masm.passABIArg(input);
 
     void *funptr = nullptr;
     switch (ins->mir()->function()) {
@@ -3979,7 +3966,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MoveOp::FLOAT32);
+    masm.callWithABI(funptr, MacroAssembler::FLOAT);
     return true;
 }
 
@@ -3993,13 +3980,13 @@ CodeGenerator::visitModD(LModD *ins)
     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
 
     masm.setupUnalignedABICall(2, temp);
-    masm.passABIArg(lhs, MoveOp::DOUBLE);
-    masm.passABIArg(rhs, MoveOp::DOUBLE);
+    masm.passABIArg(lhs);
+    masm.passABIArg(rhs);
 
     if (gen->compilingAsmJS())
-        masm.callWithABI(AsmJSImm_ModD, MoveOp::DOUBLE);
+        masm.callWithABI(AsmJSImm_ModD, MacroAssembler::DOUBLE);
     else
-        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MacroAssembler::DOUBLE);
     return true;
 }
 
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 297c1c3bb654..4a03191b8973 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -865,12 +865,12 @@ class MacroAssembler : public MacroAssemblerSpecific
     // been made so that a safepoint can be made at that location.
 
     template <typename T>
-    void callWithABINoProfiling(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
+    void callWithABINoProfiling(const T &fun, Result result = GENERAL) {
         MacroAssemblerSpecific::callWithABI(fun, result);
     }
 
     template <typename T>
-    void callWithABI(const T &fun, MoveOp::Kind result = MoveOp::GENERAL) {
+    void callWithABI(const T &fun, Result result = GENERAL) {
         leaveSPSFrame();
         callWithABINoProfiling(fun, result);
         reenterSPSFrame();
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index c4d11cee87e2..8f94028624a1 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -71,13 +71,11 @@ class LMove
 {
     LAllocation *from_;
     LAllocation *to_;
-    LDefinition::Type type_;
 
   public:
-    LMove(LAllocation *from, LAllocation *to, LDefinition::Type type)
+    LMove(LAllocation *from, LAllocation *to)
       : from_(from),
-        to_(to),
-        type_(type)
+        to_(to)
     { }
 
     LAllocation *from() {
@@ -92,9 +90,6 @@ class LMove
     const LAllocation *to() const {
         return to_;
     }
-    LDefinition::Type type() const {
-        return type_;
-    }
 };
 
 class LMoveGroup : public LInstructionHelper<0, 0, 0>
@@ -115,10 +110,10 @@ class LMoveGroup : public LInstructionHelper<0, 0, 0>
     void printOperands(FILE *fp);
 
     // Add a move which takes place simultaneously with all others in the group.
-    bool add(LAllocation *from, LAllocation *to, LDefinition::Type type);
+    bool add(LAllocation *from, LAllocation *to);
 
     // Add a move which takes place after existing moves in the group.
-    bool addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type);
+    bool addAfter(LAllocation *from, LAllocation *to);
 
     size_t numMoves() const {
         return moves_.length();
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index 7fef35f37b2f..fc672bdb356e 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -197,11 +197,10 @@ static const char * const TypeChars[] =
 {
     "i",            // INTEGER
     "o",            // OBJECT
-    "f",            // FLOAT32
-    "d",            // DOUBLE
+    "f",            // DOUBLE
 #ifdef JS_NUNBOX32
     "t",            // TYPE
-    "p"             // PAYLOAD
+    "d"             // PAYLOAD
 #elif JS_PUNBOX64
     "x"             // BOX
 #endif
@@ -364,18 +363,18 @@ LInstruction::initSafepoint(TempAllocator &alloc)
 }
 
 bool
-LMoveGroup::add(LAllocation *from, LAllocation *to, LDefinition::Type type)
+LMoveGroup::add(LAllocation *from, LAllocation *to)
 {
 #ifdef DEBUG
     JS_ASSERT(*from != *to);
     for (size_t i = 0; i < moves_.length(); i++)
         JS_ASSERT(*to != *moves_[i].to());
 #endif
-    return moves_.append(LMove(from, to, type));
+    return moves_.append(LMove(from, to));
 }
 
 bool
-LMoveGroup::addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type)
+LMoveGroup::addAfter(LAllocation *from, LAllocation *to)
 {
     // Transform the operands to this move so that performing the result
     // simultaneously with existing moves in the group will have the same
@@ -393,12 +392,12 @@ LMoveGroup::addAfter(LAllocation *from, LAllocation *to, LDefinition::Type type)
 
     for (size_t i = 0; i < moves_.length(); i++) {
         if (*to == *moves_[i].to()) {
-            moves_[i] = LMove(from, to, type);
+            moves_[i] = LMove(from, to);
             return true;
         }
     }
 
-    return add(from, to, type);
+    return add(from, to);
 }
 
 void
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 3181cd053871..1f802ba79186 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -363,6 +363,10 @@ class LStackSlot : public LAllocation
       : LAllocation(isDouble ? DOUBLE_SLOT : STACK_SLOT, slot)
     { }
 
+    bool isDouble() const {
+        return kind() == DOUBLE_SLOT;
+    }
+
     uint32_t slot() const {
         return data();
     }
@@ -442,8 +446,7 @@ class LDefinition
         GENERAL,    // Generic, integer or pointer-width data (GPR).
         OBJECT,     // Pointer that may be collected as garbage (GPR).
         SLOTS,      // Slots/elements pointer that may be moved by minor GCs (GPR).
-        FLOAT32,    // 32-bit floating-point value (FPU).
-        DOUBLE,     // 64-bit floating-point value (FPU).
+        DOUBLE,     // 64-bit point value (FPU).
 #ifdef JS_NUNBOX32
         // A type virtual register must be followed by a payload virtual
         // register, as both will be tracked as a single gcthing.
@@ -537,9 +540,8 @@ class LDefinition
           case MIRType_Object:
             return LDefinition::OBJECT;
           case MIRType_Double:
-            return LDefinition::DOUBLE;
           case MIRType_Float32:
-            return LDefinition::FLOAT32;
+            return LDefinition::DOUBLE;
 #if defined(JS_PUNBOX64)
           case MIRType_Value:
             return LDefinition::BOX;
diff --git a/js/src/jit/LinearScan.cpp b/js/src/jit/LinearScan.cpp
index 6a46531ab37b..cd22f4d36818 100644
--- a/js/src/jit/LinearScan.cpp
+++ b/js/src/jit/LinearScan.cpp
@@ -233,8 +233,7 @@ LinearScanAllocator::resolveControlFlow()
         for (size_t j = 0; j < successor->numPhis(); j++) {
             LPhi *phi = successor->getPhi(j);
             JS_ASSERT(phi->numDefs() == 1);
-            LDefinition *def = phi->getDef(0);
-            LinearScanVirtualRegister *vreg = &vregs[def];
+            LinearScanVirtualRegister *vreg = &vregs[phi->getDef(0)];
             LiveInterval *to = vreg->intervalFor(inputOf(successor->firstId()));
             JS_ASSERT(to);
 
@@ -246,15 +245,14 @@ LinearScanAllocator::resolveControlFlow()
                 LiveInterval *from = vregs[input].intervalFor(outputOf(predecessor->lastId()));
                 JS_ASSERT(from);
 
-                if (!moveAtExit(predecessor, from, to, def->type()))
+                if (!moveAtExit(predecessor, from, to))
                     return false;
             }
 
             if (vreg->mustSpillAtDefinition() && !to->isSpill()) {
                 // Make sure this phi is spilled at the loop header.
                 LMoveGroup *moves = successor->getEntryMoveGroup(alloc());
-                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill(),
-                                def->type()))
+                if (!moves->add(to->getAllocation(), vregs[to->vreg()].canonicalSpill()))
                     return false;
             }
         }
@@ -285,10 +283,10 @@ LinearScanAllocator::resolveControlFlow()
 
                 if (mSuccessor->numPredecessors() > 1) {
                     JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                    if (!moveAtExit(predecessor, from, to, vreg->type()))
+                    if (!moveAtExit(predecessor, from, to))
                         return false;
                 } else {
-                    if (!moveAtEntry(successor, from, to, vreg->type()))
+                    if (!moveAtEntry(successor, from, to))
                         return false;
                 }
             }
@@ -299,13 +297,12 @@ LinearScanAllocator::resolveControlFlow()
 }
 
 bool
-LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to,
-                                    LDefinition::Type type)
+LinearScanAllocator::moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to)
 {
     if (*from == *to)
         return true;
     LMoveGroup *moves = getInputMoveGroup(pos);
-    return moves->add(from, to, type);
+    return moves->add(from, to);
 }
 
 static inline void
@@ -353,7 +350,7 @@ LinearScanAllocator::reifyAllocations()
                 LiveInterval *to = fixedIntervals[GetFixedRegister(reg->def(), usePos->use).code()];
 
                 *static_cast<LAllocation *>(usePos->use) = *to->getAllocation();
-                if (!moveInput(usePos->pos, interval, to, reg->type()))
+                if (!moveInput(usePos->pos, interval, to))
                     return false;
             } else {
                 JS_ASSERT(UseCompatibleWith(usePos->use, *interval->getAllocation()));
@@ -379,7 +376,7 @@ LinearScanAllocator::reifyAllocations()
                 // it should use the fixed register instead.
                 SetOsiPointUses(interval, defEnd, LAllocation(fixedReg));
 
-                if (!moveAfter(defEnd, from, interval, def->type()))
+                if (!moveAfter(defEnd, from, interval))
                     return false;
                 spillFrom = from->getAllocation();
             } else {
@@ -390,7 +387,7 @@ LinearScanAllocator::reifyAllocations()
                     JS_ASSERT(!inputAlloc->isUse());
 
                     *inputAlloc = *interval->getAllocation();
-                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc, def->type()))
+                    if (!moveInputAlloc(inputOf(reg->ins()), origAlloc, inputAlloc))
                         return false;
                 }
 
@@ -420,7 +417,7 @@ LinearScanAllocator::reifyAllocations()
                 // or Nop instructions). Note that we explicitly ignore phis,
                 // which should have been handled in resolveControlFlow().
                 LMoveGroup *moves = getMoveGroupAfter(defEnd);
-                if (!moves->add(spillFrom, reg->canonicalSpill(), def->type()))
+                if (!moves->add(spillFrom, reg->canonicalSpill()))
                     return false;
             }
         }
@@ -446,10 +443,10 @@ LinearScanAllocator::reifyAllocations()
             JS_ASSERT(start == inputOf(data->ins()) || start == outputOf(data->ins()));
 
             if (start.subpos() == CodePosition::INPUT) {
-                if (!moveInput(inputOf(data->ins()), prevInterval, interval, reg->type()))
+                if (!moveInput(inputOf(data->ins()), prevInterval, interval))
                     return false;
             } else {
-                if (!moveAfter(outputOf(data->ins()), prevInterval, interval, reg->type()))
+                if (!moveAfter(outputOf(data->ins()), prevInterval, interval))
                     return false;
             }
 
@@ -518,9 +515,7 @@ LinearScanAllocator::populateSafepoints()
             if (ins == reg->ins() && !reg->isTemp()) {
                 DebugOnly<LDefinition*> def = reg->def();
                 JS_ASSERT_IF(def->policy() == LDefinition::MUST_REUSE_INPUT,
-                             def->type() == LDefinition::GENERAL ||
-                             def->type() == LDefinition::FLOAT32 ||
-                             def->type() == LDefinition::DOUBLE);
+                             def->type() == LDefinition::GENERAL || def->type() == LDefinition::DOUBLE);
                 continue;
             }
 
@@ -797,7 +792,7 @@ LinearScanAllocator::allocateSlotFor(const LiveInterval *interval)
     LinearScanVirtualRegister *reg = &vregs[interval->vreg()];
 
     SlotList *freed;
-    if (reg->type() == LDefinition::DOUBLE || reg->type() == LDefinition::FLOAT32)
+    if (reg->type() == LDefinition::DOUBLE)
         freed = &finishedDoubleSlots_;
 #ifdef JS_NUNBOX32
     else if (IsNunbox(reg))
diff --git a/js/src/jit/LinearScan.h b/js/src/jit/LinearScan.h
index cf194b9e20b9..64ce47d9191a 100644
--- a/js/src/jit/LinearScan.h
+++ b/js/src/jit/LinearScan.h
@@ -111,7 +111,7 @@ class LinearScanAllocator
     AnyRegister::Code findBestFreeRegister(CodePosition *freeUntil);
     AnyRegister::Code findBestBlockedRegister(CodePosition *nextUsed);
     bool canCoexist(LiveInterval *a, LiveInterval *b);
-    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to, LDefinition::Type type);
+    bool moveInputAlloc(CodePosition pos, LAllocation *from, LAllocation *to);
     void setIntervalRequirement(LiveInterval *interval);
     bool isSpilledAt(LiveInterval *interval, CodePosition pos);
 
diff --git a/js/src/jit/LiveRangeAllocator.cpp b/js/src/jit/LiveRangeAllocator.cpp
index 0d457286657e..361fdb60ebcd 100644
--- a/js/src/jit/LiveRangeAllocator.cpp
+++ b/js/src/jit/LiveRangeAllocator.cpp
@@ -468,7 +468,6 @@ AddRegisterToSafepoint(LSafepoint *safepoint, AnyRegister reg, const LDefinition
 
     JS_ASSERT(def.type() == LDefinition::GENERAL ||
               def.type() == LDefinition::DOUBLE ||
-              def.type() == LDefinition::FLOAT32 ||
               def.type() == LDefinition::OBJECT);
 
     if (def.type() == LDefinition::OBJECT)
diff --git a/js/src/jit/LiveRangeAllocator.h b/js/src/jit/LiveRangeAllocator.h
index 993f1c495451..a469ebda4aeb 100644
--- a/js/src/jit/LiveRangeAllocator.h
+++ b/js/src/jit/LiveRangeAllocator.h
@@ -136,7 +136,7 @@ static inline bool
 DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation alloc)
 {
     if (ins->isPhi()) {
-        if (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
+        if (def->type() == LDefinition::DOUBLE)
             return alloc.isFloatReg() || alloc.kind() == LAllocation::DOUBLE_SLOT;
         return alloc.isGeneralReg() || alloc.kind() == LAllocation::STACK_SLOT;
     }
@@ -145,7 +145,7 @@ DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation
       case LDefinition::DEFAULT:
         if (!alloc.isRegister())
             return false;
-        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32);
+        return alloc.isFloatReg() == (def->type() == LDefinition::DOUBLE);
       case LDefinition::PRESET:
         return alloc == *def->output();
       case LDefinition::MUST_REUSE_INPUT:
@@ -473,7 +473,7 @@ class VirtualRegister
         return intervals_.insert(found, interval);
     }
     bool isDouble() const {
-        return def_->type() == LDefinition::DOUBLE || def_->type() == LDefinition::FLOAT32;
+        return def_->type() == LDefinition::DOUBLE;
     }
 
     LiveInterval *intervalFor(CodePosition pos);
@@ -633,37 +633,37 @@ class LiveRangeAllocator : protected RegisterAllocator
     }
 #endif
 
-    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool addMove(LMoveGroup *moves, LiveInterval *from, LiveInterval *to) {
         JS_ASSERT(*from->getAllocation() != *to->getAllocation());
-        return moves->add(from->getAllocation(), to->getAllocation(), type);
+        return moves->add(from->getAllocation(), to->getAllocation());
     }
 
-    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveInput(CodePosition pos, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getInputMoveGroup(pos);
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
-    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveAfter(CodePosition pos, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = getMoveGroupAfter(pos);
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
-    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveAtExit(LBlock *block, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getExitMoveGroup(alloc());
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
-    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to, LDefinition::Type type) {
+    bool moveAtEntry(LBlock *block, LiveInterval *from, LiveInterval *to) {
         if (*from->getAllocation() == *to->getAllocation())
             return true;
         LMoveGroup *moves = block->getEntryMoveGroup(alloc());
-        return addMove(moves, from, to, type);
+        return addMove(moves, from, to);
     }
 
     size_t findFirstNonCallSafepoint(CodePosition from) const
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 67d8af974949..480ca2ae611f 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -660,7 +660,7 @@ LIRGenerator::visitTest(MTest *test)
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
-        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempDouble(), temp0, temp1);
+        LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempFloat(), temp0, temp1);
         if (!useBox(lir, LTestVAndBranch::Input, opd))
             return false;
         return add(lir, test);
@@ -1027,7 +1027,7 @@ LIRGenerator::visitTypeOf(MTypeOf *ins)
 bool
 LIRGenerator::visitToId(MToId *ins)
 {
-    LToIdV *lir = new(alloc()) LToIdV(tempDouble());
+    LToIdV *lir = new(alloc()) LToIdV(tempFloat());
     if (!useBox(lir, LToIdV::Object, ins->lhs()))
         return false;
     if (!useBox(lir, LToIdV::Index, ins->rhs()))
@@ -1176,7 +1176,7 @@ bool
 LIRGenerator::visitRound(MRound *ins)
 {
     JS_ASSERT(ins->num()->type() == MIRType_Double);
-    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempDouble());
+    LRound *lir = new(alloc()) LRound(useRegister(ins->num()), tempFloat());
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
@@ -1755,7 +1755,7 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::NORMAL);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::NORMAL);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert) && assignSafepoint(lir, convert);
@@ -1800,7 +1800,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
     switch (opd->type()) {
       case MIRType_Value:
       {
-        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::TRUNCATE);
+        LValueToInt32 *lir = new(alloc()) LValueToInt32(tempFloat(), temp(), LValueToInt32::TRUNCATE);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, truncate) && assignSafepoint(lir, truncate);
@@ -2026,7 +2026,7 @@ LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
 
     LMaybeToDoubleElement *lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
                                                                     useRegisterAtStart(ins->value()),
-                                                                    tempDouble());
+                                                                    tempFloat());
     return defineBox(lir, ins);
 }
 
@@ -2343,7 +2343,7 @@ LIRGenerator::visitNot(MNot *ins)
             temp1 = LDefinition::BogusTemp();
         }
 
-        LNotV *lir = new(alloc()) LNotV(tempDouble(), temp0, temp1);
+        LNotV *lir = new(alloc()) LNotV(tempFloat(), temp0, temp1);
         if (!useBox(lir, LNotV::Input, op))
             return false;
         return define(lir, ins);
@@ -2626,7 +2626,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
 
       case MIRType_Value:
       {
-        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempDouble());
+        LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempFloat());
         if (!useBox(lir, LClampVToUint8::Input, in))
             return false;
         return assignSnapshot(lir) && define(lir, ins) && assignSafepoint(lir, ins);
@@ -2913,15 +2913,15 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
         break;
 
       case MIRType_Double:
-        lir = new(alloc()) LAssertRangeD(useRegister(input), tempDouble());
+        lir = new(alloc()) LAssertRangeD(useRegister(input), tempFloat());
         break;
 
       case MIRType_Float32:
-        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat32());
+        lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat());
         break;
 
       case MIRType_Value:
-        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempDouble(), tempDouble());
+        lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempFloat(), tempFloat());
         if (!useBox(lir, LAssertRangeV::Input, input))
             return false;
         break;
@@ -3027,7 +3027,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
         lir = new(alloc()) LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
-                                             temp(), tempDouble());
+                                             temp(), tempFloat());
 
         if (!useBox(lir, LSetElementCacheV::Index, ins->index()))
             return false;
@@ -3036,7 +3036,7 @@ LIRGenerator::visitSetElementCache(MSetElementCache *ins)
     } else {
         lir = new(alloc()) LSetElementCacheT(useByteOpRegister(ins->object()),
                                              useRegisterOrConstant(ins->value()),
-                                             tempToUnbox(), temp(), tempDouble());
+                                             tempToUnbox(), temp(), tempFloat());
 
         if (!useBox(lir, LSetElementCacheT::Index, ins->index()))
             return false;
diff --git a/js/src/jit/MoveResolver.cpp b/js/src/jit/MoveResolver.cpp
index 4354f24d8ef5..522bd3b17470 100644
--- a/js/src/jit/MoveResolver.cpp
+++ b/js/src/jit/MoveResolver.cpp
@@ -21,7 +21,7 @@ MoveResolver::resetState()
 }
 
 bool
-MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
+MoveResolver::addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
 {
     // Assert that we're not doing no-op moves.
     JS_ASSERT(!(from == to));
diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
index acb1492051d6..601113b8ac01 100644
--- a/js/src/jit/MoveResolver.h
+++ b/js/src/jit/MoveResolver.h
@@ -14,156 +14,163 @@
 namespace js {
 namespace jit {
 
-// This is similar to Operand, but carries more information. We're also not
-// guaranteed that Operand looks like this on all ISAs.
-class MoveOperand
-{
-  public:
-    enum Kind {
-        // A register in the "integer", aka "general purpose", class.
-        REG,
-        // A register in the "float" register class.
-        FLOAT_REG,
-        // A memory region.
-        MEMORY,
-        // The address of a memory region.
-        EFFECTIVE_ADDRESS
-    };
-
-  private:
-    Kind kind_;
-    uint32_t code_;
-    int32_t disp_;
-
-  public:
-    MoveOperand()
-    { }
-    explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
-    { }
-    explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
-    { }
-    MoveOperand(const Register &reg, int32_t disp, Kind kind = MEMORY)
-        : kind_(kind),
-        code_(reg.code()),
-        disp_(disp)
-    {
-        JS_ASSERT(isMemoryOrEffectiveAddress());
-
-        // With a zero offset, this is a plain reg-to-reg move.
-        if (disp == 0 && kind_ == EFFECTIVE_ADDRESS)
-            kind_ = REG;
-    }
-    MoveOperand(const MoveOperand &other)
-      : kind_(other.kind_),
-        code_(other.code_),
-        disp_(other.disp_)
-    { }
-    bool isFloatReg() const {
-        return kind_ == FLOAT_REG;
-    }
-    bool isGeneralReg() const {
-        return kind_ == REG;
-    }
-    bool isMemory() const {
-        return kind_ == MEMORY;
-    }
-    bool isEffectiveAddress() const {
-        return kind_ == EFFECTIVE_ADDRESS;
-    }
-    bool isMemoryOrEffectiveAddress() const {
-        return isMemory() || isEffectiveAddress();
-    }
-    Register reg() const {
-        JS_ASSERT(isGeneralReg());
-        return Register::FromCode(code_);
-    }
-    FloatRegister floatReg() const {
-        JS_ASSERT(isFloatReg());
-        return FloatRegister::FromCode(code_);
-    }
-    Register base() const {
-        JS_ASSERT(isMemoryOrEffectiveAddress());
-        return Register::FromCode(code_);
-    }
-    int32_t disp() const {
-        JS_ASSERT(isMemoryOrEffectiveAddress());
-        return disp_;
-    }
-
-    bool operator ==(const MoveOperand &other) const {
-        if (kind_ != other.kind_)
-            return false;
-        if (code_ != other.code_)
-            return false;
-        if (isMemoryOrEffectiveAddress())
-            return disp_ == other.disp_;
-        return true;
-    }
-    bool operator !=(const MoveOperand &other) const {
-        return !operator==(other);
-    }
-};
-
-// This represents a move operation.
-class MoveOp
-{
-  protected:
-    MoveOperand from_;
-    MoveOperand to_;
-    bool cycle_;
-
-  public:
-    enum Kind {
-        GENERAL,
-        FLOAT32,
-        DOUBLE
-    };
-
-  protected:
-    Kind kind_;
-
-  public:
-    MoveOp()
-    { }
-    MoveOp(const MoveOperand &from, const MoveOperand &to, Kind kind)
-      : from_(from),
-        to_(to),
-        cycle_(false),
-        kind_(kind)
-    { }
-
-    bool inCycle() const {
-        return cycle_;
-    }
-    const MoveOperand &from() const {
-        return from_;
-    }
-    const MoveOperand &to() const {
-        return to_;
-    }
-    Kind kind() const {
-        return kind_;
-    }
-};
-
 class MoveResolver
 {
+  public:
+    // This is similar to Operand, but carries more information. We're also not
+    // guaranteed that Operand looks like this on all ISAs.
+    class MoveOperand
+    {
+        enum Kind {
+            REG,
+            FLOAT_REG,
+            ADDRESS,
+            FLOAT_ADDRESS,
+            EFFECTIVE_ADDRESS
+        };
+
+        Kind kind_;
+        uint32_t code_;
+        int32_t disp_;
+
+      public:
+        enum AddressKind {
+            MEMORY = ADDRESS,
+            EFFECTIVE = EFFECTIVE_ADDRESS,
+            FLOAT = FLOAT_ADDRESS
+        };
+
+        MoveOperand()
+        { }
+        explicit MoveOperand(const Register &reg) : kind_(REG), code_(reg.code())
+        { }
+        explicit MoveOperand(const FloatRegister &reg) : kind_(FLOAT_REG), code_(reg.code())
+        { }
+        MoveOperand(const Register &reg, int32_t disp, AddressKind addrKind = MEMORY)
+            : kind_((Kind) addrKind),
+            code_(reg.code()),
+            disp_(disp)
+        {
+            // With a zero offset, this is a plain reg-to-reg move.
+            if (disp == 0 && addrKind == EFFECTIVE)
+                kind_ = REG;
+        }
+        MoveOperand(const MoveOperand &other)
+          : kind_(other.kind_),
+            code_(other.code_),
+            disp_(other.disp_)
+        { }
+        bool isFloatReg() const {
+            return kind_ == FLOAT_REG;
+        }
+        bool isGeneralReg() const {
+            return kind_ == REG;
+        }
+        bool isDouble() const {
+            return kind_ == FLOAT_REG || kind_ == FLOAT_ADDRESS;
+        }
+        bool isMemory() const {
+            return kind_ == ADDRESS;
+        }
+        bool isFloatAddress() const {
+            return kind_ == FLOAT_ADDRESS;
+        }
+        bool isEffectiveAddress() const {
+            return kind_ == EFFECTIVE_ADDRESS;
+        }
+        Register reg() const {
+            JS_ASSERT(isGeneralReg());
+            return Register::FromCode(code_);
+        }
+        FloatRegister floatReg() const {
+            JS_ASSERT(isFloatReg());
+            return FloatRegister::FromCode(code_);
+        }
+        Register base() const {
+            JS_ASSERT(isMemory() || isEffectiveAddress() || isFloatAddress());
+            return Register::FromCode(code_);
+        }
+        int32_t disp() const {
+            return disp_;
+        }
+
+        bool operator ==(const MoveOperand &other) const {
+            if (kind_ != other.kind_)
+                return false;
+            if (code_ != other.code_)
+                return false;
+            if (isMemory() || isEffectiveAddress())
+                return disp_ == other.disp_;
+            return true;
+        }
+        bool operator !=(const MoveOperand &other) const {
+            return !operator==(other);
+        }
+    };
+
+    class Move
+    {
+      protected:
+        MoveOperand from_;
+        MoveOperand to_;
+        bool cycle_;
+
+      public:
+        enum Kind {
+            GENERAL,
+            DOUBLE
+        };
+
+      protected:
+        Kind kind_;
+
+      public:
+        Move()
+        { }
+        Move(const Move &other)
+          : from_(other.from_),
+            to_(other.to_),
+            cycle_(other.cycle_),
+            kind_(other.kind_)
+        { }
+        Move(const MoveOperand &from, const MoveOperand &to, Kind kind, bool cycle = false)
+          : from_(from),
+            to_(to),
+            cycle_(cycle),
+            kind_(kind)
+        { }
+
+        bool inCycle() const {
+            return cycle_;
+        }
+        const MoveOperand &from() const {
+            return from_;
+        }
+        const MoveOperand &to() const {
+            return to_;
+        }
+        Kind kind() const {
+            return kind_;
+        }
+    };
+
   private:
     struct PendingMove
-      : public MoveOp,
+      : public Move,
         public TempObject,
         public InlineListNode<PendingMove>
     {
         PendingMove()
         { }
         PendingMove(const MoveOperand &from, const MoveOperand &to, Kind kind)
-          : MoveOp(from, to, kind)
+          : Move(from, to, kind, false)
         { }
-
+        
         void setInCycle() {
             JS_ASSERT(!inCycle());
             cycle_ = true;
         }
+
     };
 
     typedef InlineList<MoveResolver::PendingMove>::iterator PendingMoveIterator;
@@ -171,7 +178,7 @@ class MoveResolver
   private:
     // Moves that are definitely unblocked (constants to registers). These are
     // emitted last.
-    js::Vector<MoveOp, 16, SystemAllocPolicy> orderedMoves_;
+    js::Vector<Move, 16, SystemAllocPolicy> orderedMoves_;
     bool hasCycles_;
 
     TempObjectPool<PendingMove> movePool_;
@@ -193,13 +200,13 @@ class MoveResolver
     //
     // After calling addMove() for each parallel move, resolve() performs the
     // cycle resolution algorithm. Calling addMove() again resets the resolver.
-    bool addMove(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
+    bool addMove(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
     bool resolve();
 
     size_t numMoves() const {
         return orderedMoves_.length();
     }
-    const MoveOp &getMove(size_t i) const {
+    const Move &getMove(size_t i) const {
         return orderedMoves_[i];
     }
     bool hasCycles() const {
diff --git a/js/src/jit/RegisterAllocator.h b/js/src/jit/RegisterAllocator.h
index f5f0d2770cfd..e6059eaef31d 100644
--- a/js/src/jit/RegisterAllocator.h
+++ b/js/src/jit/RegisterAllocator.h
@@ -369,7 +369,7 @@ class RegisterAllocator
 static inline AnyRegister
 GetFixedRegister(const LDefinition *def, const LUse *use)
 {
-    return (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32)
+    return def->type() == LDefinition::DOUBLE
            ? AnyRegister(FloatRegister::FromCode(use->registerCode()))
            : AnyRegister(Register::FromCode(use->registerCode()));
 }
diff --git a/js/src/jit/StupidAllocator.cpp b/js/src/jit/StupidAllocator.cpp
index 8f9751faba72..921bdf9d08d4 100644
--- a/js/src/jit/StupidAllocator.cpp
+++ b/js/src/jit/StupidAllocator.cpp
@@ -28,9 +28,7 @@ StupidAllocator::stackLocation(uint32_t vreg)
     if (def->policy() == LDefinition::PRESET && def->output()->isArgument())
         return def->output();
 
-    return new(alloc()) LStackSlot(DefaultStackSlot(vreg),
-                                   def->type() == LDefinition::DOUBLE ||
-                                   def->type() == LDefinition::FLOAT32);
+    return new(alloc()) LStackSlot(DefaultStackSlot(vreg), def->type() == LDefinition::DOUBLE);
 }
 
 StupidAllocator::RegisterIndex
@@ -143,7 +141,7 @@ StupidAllocator::ensureHasRegister(LInstruction *ins, uint32_t vreg)
     }
 
     RegisterIndex best = allocateRegister(ins, vreg);
-    loadRegister(ins, vreg, best, virtualRegisters[vreg]->type());
+    loadRegister(ins, vreg, best);
 
     return registers[best].reg;
 }
@@ -164,7 +162,7 @@ StupidAllocator::allocateRegister(LInstruction *ins, uint32_t vreg)
     for (size_t i = 0; i < registerCount; i++) {
         AnyRegister reg = registers[i].reg;
 
-        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE || def->type() == LDefinition::FLOAT32))
+        if (reg.isFloat() != (def->type() == LDefinition::DOUBLE))
             continue;
 
         // Skip the register if it is in use for an allocated input or output.
@@ -192,7 +190,7 @@ StupidAllocator::syncRegister(LInstruction *ins, RegisterIndex index)
 
         uint32_t existing = registers[index].vreg;
         LAllocation *dest = stackLocation(existing);
-        input->addAfter(source, dest, registers[index].type);
+        input->addAfter(source, dest);
 
         registers[index].dirty = false;
     }
@@ -206,15 +204,14 @@ StupidAllocator::evictRegister(LInstruction *ins, RegisterIndex index)
 }
 
 void
-StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type)
+StupidAllocator::loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index)
 {
     // Load a vreg from its stack location to a register.
     LMoveGroup *input = getInputMoveGroup(ins->id());
     LAllocation *source = stackLocation(vreg);
     LAllocation *dest = new(alloc()) LAllocation(registers[index].reg);
-    input->addAfter(source, dest, type);
+    input->addAfter(source, dest);
     registers[index].set(vreg, ins);
-    registers[index].type = type;
 }
 
 StupidAllocator::RegisterIndex
@@ -313,7 +310,7 @@ StupidAllocator::syncForBlockEnd(LBlock *block, LInstruction *ins)
                 }
             }
 
-            group->add(source, dest, phi->getDef(0)->type());
+            group->add(source, dest);
         }
     }
 }
@@ -337,14 +334,14 @@ StupidAllocator::allocateForInstruction(LInstruction *ins)
             AnyRegister reg = ensureHasRegister(ins, vreg);
             alloc.replace(LAllocation(reg));
         } else if (use->policy() == LUse::FIXED) {
-            AnyRegister reg = GetFixedRegister(virtualRegisters[vreg], use);
+            AnyRegister reg = GetFixedRegister(virtualRegisters[use->virtualRegister()], use);
             RegisterIndex index = registerIndex(reg);
             if (registers[index].vreg != vreg) {
                 evictRegister(ins, index);
                 RegisterIndex existing = findExistingRegister(vreg);
                 if (existing != UINT32_MAX)
                     evictRegister(ins, existing);
-                loadRegister(ins, vreg, index, virtualRegisters[vreg]->type());
+                loadRegister(ins, vreg, index);
             }
             alloc.replace(LAllocation(reg));
         } else {
@@ -410,7 +407,6 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
                           : ins->getOperand(def->getReusedInput())->toRegister());
         evictRegister(ins, index);
         registers[index].set(vreg, ins, true);
-        registers[index].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[index].reg));
     } else if (def->policy() == LDefinition::PRESET) {
         // The result must be a stack location.
@@ -419,7 +415,6 @@ StupidAllocator::allocateForDefinition(LInstruction *ins, LDefinition *def)
         // Find a register to hold the result of the instruction.
         RegisterIndex best = allocateRegister(ins, vreg);
         registers[best].set(vreg, ins, true);
-        registers[best].type = virtualRegisters[vreg]->type();
         def->setOutput(LAllocation(registers[best].reg));
     }
 }
diff --git a/js/src/jit/StupidAllocator.h b/js/src/jit/StupidAllocator.h
index e7891b65a264..f48befa0ff8b 100644
--- a/js/src/jit/StupidAllocator.h
+++ b/js/src/jit/StupidAllocator.h
@@ -22,9 +22,6 @@ class StupidAllocator : public RegisterAllocator
     struct AllocatedRegister {
         AnyRegister reg;
 
-        // The type of the value in the register.
-        LDefinition::Type type;
-
         // Virtual register this physical reg backs, or MISSING_ALLOCATION.
         uint32_t vreg;
 
@@ -75,7 +72,7 @@ class StupidAllocator : public RegisterAllocator
 
     void syncRegister(LInstruction *ins, RegisterIndex index);
     void evictRegister(LInstruction *ins, RegisterIndex index);
-    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index, LDefinition::Type type);
+    void loadRegister(LInstruction *ins, uint32_t vreg, RegisterIndex index);
 
     RegisterIndex findExistingRegister(uint32_t vreg);
 
diff --git a/js/src/jit/arm/Assembler-arm.h b/js/src/jit/arm/Assembler-arm.h
index 9c5107672729..362d7d183470 100644
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -2152,19 +2152,9 @@ GetIntArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *paddi
 }
 
 static inline uint32_t
-GetFloat32ArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
+GetFloatArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
 {
-    JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
-    uint32_t intSlots = 0;
-    if (usedIntArgs > NumIntArgRegs)
-        intSlots = usedIntArgs - NumIntArgRegs;
-    uint32_t float32Slots = usedFloatArgs - NumFloatArgRegs;
-    return (intSlots + float32Slots + *padding) * STACK_SLOT_SIZE;
-}
 
-static inline uint32_t
-GetDoubleArgStackDisp(uint32_t usedIntArgs, uint32_t usedFloatArgs, uint32_t *padding)
-{
     JS_ASSERT(usedFloatArgs >= NumFloatArgRegs);
     uint32_t intSlots = 0;
     if (usedIntArgs > NumIntArgRegs) {
diff --git a/js/src/jit/arm/CodeGenerator-arm.cpp b/js/src/jit/arm/CodeGenerator-arm.cpp
index c53edb5bf8c8..ae1984e96efc 100644
--- a/js/src/jit/arm/CodeGenerator-arm.cpp
+++ b/js/src/jit/arm/CodeGenerator-arm.cpp
@@ -1020,6 +1020,8 @@ CodeGeneratorARM::visitPowHalfD(LPowHalfD *ins)
     return true;
 }
 
+typedef MoveResolver::MoveOperand MoveOperand;
+
 MoveOperand
 CodeGeneratorARM::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/arm/CodeGenerator-arm.h b/js/src/jit/arm/CodeGenerator-arm.h
index 08c90dfd8920..a916315a485b 100644
--- a/js/src/jit/arm/CodeGenerator-arm.h
+++ b/js/src/jit/arm/CodeGenerator-arm.h
@@ -43,7 +43,7 @@ class CodeGeneratorARM : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutFrom(Label *label, LSnapshot *snapshot);
diff --git a/js/src/jit/arm/Lowering-arm.cpp b/js/src/jit/arm/Lowering-arm.cpp
index b74971f3e3f6..8f4ca0c78d19 100644
--- a/js/src/jit/arm/Lowering-arm.cpp
+++ b/js/src/jit/arm/Lowering-arm.cpp
@@ -362,7 +362,7 @@ LIRGeneratorARM::newLTableSwitch(const LAllocation &in, const LDefinition &input
 LTableSwitchV *
 LIRGeneratorARM::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempDouble(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempFloat(), tableswitch);
 }
 
 bool
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index 64fbbf5b9f23..fe039c5ec771 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3508,79 +3508,63 @@ MacroAssemblerARMCompat::setupUnalignedABICall(uint32_t args, const Register &sc
 }
 #ifdef JS_CPU_ARM_HARDFP
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
 {
     MoveOperand to;
     ++passedArgs_;
     if (!enoughMemory_)
         return;
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE: {
+    if (from.isDouble()) {
         FloatRegister fr;
         if (GetFloatArgReg(usedIntSlots_, usedFloatSlots_, &fr)) {
-            if (from.isFloatReg() && from.floatReg() == fr) {
-                // Nothing to do; the value is in the right register already
-                return;
+            if (!from.isFloatReg() || from.floatReg() != fr) {
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(fr), Move::DOUBLE);
             }
-            to = MoveOperand(fr);
+            // else nothing to do; the value is in the right register already
         } else {
             // If (and only if) the integer registers have started spilling, do we
-            // need to take the register's alignment into account
+            // need to take the double register's alignment into account
             uint32_t disp = GetFloatArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            to = MoveOperand(sp, disp);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::DOUBLE);
         }
         usedFloatSlots_++;
-        break;
-      }
-      case MoveOp::GENERAL: {
+    } else {
         Register r;
         if (GetIntArgReg(usedIntSlots_, usedFloatSlots_, &r)) {
-            if (from.isGeneralReg() && from.reg() == r) {
-                // Nothing to do; the value is in the right register already
-                return;
+            if (!from.isGeneralReg() || from.reg() != r) {
+                enoughMemory_ = moveResolver_.addMove(from, MoveOperand(r), Move::GENERAL);
             }
-            to = MoveOperand(r);
+            // else nothing to do; the value is in the right register already
         } else {
             uint32_t disp = GetIntArgStackDisp(usedIntSlots_, usedFloatSlots_, &padding_);
-            to = MoveOperand(sp, disp);
+            enoughMemory_ = moveResolver_.addMove(from, MoveOperand(sp, disp), Move::GENERAL);
         }
         usedIntSlots_++;
-        break;
-      }
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
     }
 
-    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 #else
 void
-MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerARMCompat::passABIArg(const MoveOperand &from)
 {
     MoveOperand to;
     uint32_t increment = 1;
     bool useResolver = true;
     ++passedArgs_;
-    switch (kind) {
-      case MoveOp::DOUBLE:
+    Move::Kind kind = Move::GENERAL;
+    if (from.isDouble()) {
         // Double arguments need to be rounded up to the nearest doubleword
         // boundary, even if it is in a register!
         usedSlots_ = (usedSlots_ + 1) & ~1;
         increment = 2;
-        break;
-      case MoveOp::FLOAT32:
-      case MoveOp::GENERAL:
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+        kind = Move::DOUBLE;
     }
 
     Register destReg;
     MoveOperand dest;
     if (GetIntArgReg(usedSlots_, 0, &destReg)) {
-        if (kind == MoveOp::DOUBLE || kind == MoveOp::FLOAT32) {
+        if (from.isDouble()) {
             floatArgsInGPR[destReg.code() >> 1] = from;
             floatArgsInGPRValid[destReg.code() >> 1] = true;
             useResolver = false;
@@ -3604,13 +3588,13 @@ MacroAssemblerARMCompat::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
 void
 MacroAssemblerARMCompat::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
+    passABIArg(MoveOperand(reg));
 }
 
 void
-MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg, MoveOp::Kind kind)
+MacroAssemblerARMCompat::passABIArg(const FloatRegister &freg)
 {
-    passABIArg(MoveOperand(freg), kind);
+    passABIArg(MoveOperand(freg));
 }
 
 void MacroAssemblerARMCompat::checkStackAlignment()
@@ -3658,7 +3642,7 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
             if (from.isFloatReg()) {
                 ma_vxfer(VFPRegister(from.floatReg()), to0, to1);
             } else {
-                JS_ASSERT(from.isMemory());
+                JS_ASSERT(from.isFloatAddress());
                 // Note: We can safely use the MoveOperand's displacement here,
                 // even if the base is SP: MoveEmitter::toOperand adjusts
                 // SP-relative operands by the difference between the current
@@ -3680,25 +3664,25 @@ MacroAssemblerARMCompat::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, Result result)
 {
     if (secondScratchReg_ != lr)
         ma_mov(secondScratchReg_, lr);
 
     switch (result) {
-      case MoveOp::DOUBLE:
+      case DOUBLE:
 #ifndef JS_CPU_ARM_HARDFP
         // Move double from r0/r1 to ReturnFloatReg.
         as_vxfer(r0, r1, ReturnFloatReg, CoreToFloat);
         break;
 #endif
-      case MoveOp::FLOAT32:
+      case FLOAT:
 #ifndef JS_CPU_ARM_HARDFP
         // Move float32 from r0 to ReturnFloatReg.
         as_vxfer(r0, InvalidReg, VFPRegister(d0).singleOverlay(), CoreToFloat);
         break;
 #endif
-      case MoveOp::GENERAL:
+      case GENERAL:
         break;
 
       default:
@@ -3718,7 +3702,7 @@ MacroAssemblerARMCompat::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind resu
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(void *fun, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABI(void *fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3727,7 +3711,7 @@ MacroAssemblerARMCompat::callWithABI(void *fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -3736,7 +3720,7 @@ MacroAssemblerARMCompat::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerARMCompat::callWithABI(const Address &fun, MoveOp::Kind result)
+MacroAssemblerARMCompat::callWithABI(const Address &fun, Result result)
 {
     // Load the callee in r12, no instruction between the ldr and call
     // should clobber it. Note that we can't use fun.base because it may
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 91612e990896..9fb423cb43b1 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -462,7 +462,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     // Used to work around the move resolver's lack of support for
     // moving into register pairs, which the softfp ABI needs.
-    mozilla::Array<MoveOperand, 2> floatArgsInGPR;
+    mozilla::Array<MoveResolver::MoveOperand, 2> floatArgsInGPR;
     mozilla::Array<bool, 2> floatArgsInGPRValid;
 
     // Compute space needed for the function call and set the properties of the
@@ -485,6 +485,15 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         setFramePushed(framePushed_ + value);
     }
   public:
+    typedef MoveResolver::MoveOperand MoveOperand;
+    typedef MoveResolver::Move Move;
+
+    enum Result {
+        GENERAL,
+        DOUBLE,
+        FLOAT
+    };
+
     MacroAssemblerARMCompat()
       : inCall_(false),
         enoughMemory_(true),
@@ -1403,9 +1412,9 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
+    void passABIArg(const MoveOperand &from);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
+    void passABIArg(const FloatRegister &reg);
     void passABIArg(const ValueOperand &regs);
 
   protected:
@@ -1413,13 +1422,13 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
+    void callWithABIPost(uint32_t stackAdjust, Result result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(void *fun, Result result = GENERAL);
+    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
+    void callWithABI(const Address &fun, Result result = GENERAL);
 
     CodeOffsetLabel labelForPatch() {
         return CodeOffsetLabel(nextOffset().getOffset());
diff --git a/js/src/jit/arm/MoveEmitter-arm.cpp b/js/src/jit/arm/MoveEmitter-arm.cpp
index 549d9f6e1a05..72fabee9a4e1 100644
--- a/js/src/jit/arm/MoveEmitter-arm.cpp
+++ b/js/src/jit/arm/MoveEmitter-arm.cpp
@@ -58,7 +58,7 @@ MoveEmitterARM::spillSlot() const
 Operand
 MoveEmitterARM::toOperand(const MoveOperand &operand, bool isFloat) const
 {
-    if (operand.isMemoryOrEffectiveAddress()) {
+    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress()) {
         if (operand.base() != StackPointer) {
             JS_ASSERT(operand.disp() < 1024 && operand.disp() > -1024);
             return Operand(operand.base(), operand.disp());
@@ -100,7 +100,7 @@ MoveEmitterARM::tempReg()
 }
 
 void
-MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -108,9 +108,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(toOperand(to, true), temp);
@@ -118,8 +116,7 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
         } else {
             masm.ma_vstr(to.floatReg(), cycleSlot());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         // an non-vfp value
         if (to.isMemory()) {
             Register temp = tempReg();
@@ -133,14 +130,11 @@ MoveEmitterARM::breakCycle(const MoveOperand &from, const MoveOperand &to, MoveO
             }
             masm.ma_str(to.reg(), cycleSlot());
         }
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
 void
-MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -148,9 +142,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             FloatRegister temp = ScratchFloatReg;
             masm.ma_vldr(cycleSlot(), temp);
@@ -158,8 +150,7 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
         } else {
             masm.ma_vldr(cycleSlot(), to.floatReg());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         if (to.isMemory()) {
             Register temp = tempReg();
             masm.ma_ldr(cycleSlot(), temp);
@@ -171,9 +162,6 @@ MoveEmitterARM::completeCycle(const MoveOperand &from, const MoveOperand &to, Mo
             }
             masm.ma_ldr(cycleSlot(), to.reg());
         }
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -205,7 +193,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
             MOZ_ASSUME_UNREACHABLE("strange move!");
         }
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemoryOrEffectiveAddress());
+        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), to.reg());
         else
@@ -214,7 +202,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
         // Memory to memory gpr move.
         Register reg = tempReg();
 
-        JS_ASSERT(from.isMemoryOrEffectiveAddress());
+        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
         if (from.isMemory())
             masm.ma_ldr(toOperand(from, false), reg);
         else
@@ -244,7 +232,7 @@ MoveEmitterARM::emitDoubleMove(const MoveOperand &from, const MoveOperand &to)
 }
 
 void
-MoveEmitterARM::emit(const MoveOp &move)
+MoveEmitterARM::emit(const Move &move)
 {
     const MoveOperand &from = move.from();
     const MoveOperand &to = move.to();
@@ -260,17 +248,10 @@ MoveEmitterARM::emit(const MoveOp &move)
         inCycle_ = true;
     }
 
-    switch (move.kind()) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (move.kind() == Move::DOUBLE)
         emitDoubleMove(from, to);
-        break;
-      case MoveOp::GENERAL:
+    else
         emitMove(from, to);
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
-    }
 }
 
 void
diff --git a/js/src/jit/arm/MoveEmitter-arm.h b/js/src/jit/arm/MoveEmitter-arm.h
index c1dca9f5f38f..049dc28fdf13 100644
--- a/js/src/jit/arm/MoveEmitter-arm.h
+++ b/js/src/jit/arm/MoveEmitter-arm.h
@@ -17,6 +17,9 @@ class CodeGenerator;
 
 class MoveEmitterARM
 {
+    typedef MoveResolver::Move Move;
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     bool inCycle_;
     MacroAssemblerARMCompat &masm;
 
@@ -46,9 +49,9 @@ class MoveEmitterARM
 
     void emitMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
-    void completeCycle(const MoveOperand &from, const MoveOperand &to, MoveOp::Kind kind);
-    void emit(const MoveOp &move);
+    void breakCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
+    void completeCycle(const MoveOperand &from, const MoveOperand &to, Move::Kind kind);
+    void emit(const Move &move);
 
   public:
     MoveEmitterARM(MacroAssemblerARMCompat &masm);
diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
index a53d0d02dd9d..33478fb93f74 100644
--- a/js/src/jit/arm/Trampoline-arm.cpp
+++ b/js/src/jit/arm/Trampoline-arm.cpp
@@ -654,6 +654,8 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
     VMWrapperMap::AddPtr p = functionWrappers_->lookupForAdd(&f);
@@ -735,22 +737,22 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         MoveOperand from;
         switch (f.argProperties(explicitArg)) {
           case VMFunction::WordByValue:
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
+            masm.passABIArg(MoveOperand(argsBase, argDisp));
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByValue:
             // Values should be passed by reference, not by value, so we
             // assert that the argument is a double-precision float.
             JS_ASSERT(f.argPassedInFloatReg(explicitArg));
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
             argDisp += sizeof(double);
             break;
           case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
             argDisp += sizeof(void *);
             break;
           case VMFunction::DoubleByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS), MoveOp::GENERAL);
+            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
             argDisp += 2 * sizeof(void *);
             break;
         }
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index 4441b399e9a7..0d4307d54982 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -767,7 +767,7 @@ CodeGeneratorShared::visitOutOfLineTruncateSlow(OutOfLineTruncateSlow *ool)
     }
 
     masm.setupUnalignedABICall(1, dest);
-    masm.passABIArg(src, MoveOp::DOUBLE);
+    masm.passABIArg(src);
     if (gen->compilingAsmJS())
         masm.callWithABI(AsmJSImm_ToInt32);
     else
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index 2a563f422cac..e7a1fff0ccc7 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -1329,6 +1329,8 @@ CodeGeneratorX86Shared::visitUrshD(LUrshD *ins)
     return true;
 }
 
+typedef MoveResolver::MoveOperand MoveOperand;
+
 MoveOperand
 CodeGeneratorX86Shared::toMoveOperand(const LAllocation *a) const
 {
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.h b/js/src/jit/shared/CodeGenerator-x86-shared.h
index 5ec76b33da0a..8525a41ab8dd 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.h
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.h
@@ -49,7 +49,7 @@ class CodeGeneratorX86Shared : public CodeGeneratorShared
         return ToOperand(def->output());
     }
 
-    MoveOperand toMoveOperand(const LAllocation *a) const;
+    MoveResolver::MoveOperand toMoveOperand(const LAllocation *a) const;
 
     bool bailoutIf(Assembler::Condition condition, LSnapshot *snapshot);
     bool bailoutIf(Assembler::DoubleCondition condition, LSnapshot *snapshot);
diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
index fcc6fdc68ca7..940d346cae9d 100644
--- a/js/src/jit/shared/Lowering-shared-inl.h
+++ b/js/src/jit/shared/Lowering-shared-inl.h
@@ -149,14 +149,12 @@ LIRGeneratorShared::defineReturn(LInstruction *lir, MDefinition *mir)
 #endif
         break;
       case MIRType_Float32:
-        lir->setDef(0, LDefinition(vreg, LDefinition::FLOAT32, LFloatReg(ReturnFloatReg)));
-        break;
       case MIRType_Double:
         lir->setDef(0, LDefinition(vreg, LDefinition::DOUBLE, LFloatReg(ReturnFloatReg)));
         break;
       default:
         LDefinition::Type type = LDefinition::TypeFrom(mir->type());
-        JS_ASSERT(type != LDefinition::DOUBLE && type != LDefinition::FLOAT32);
+        JS_ASSERT(type != LDefinition::DOUBLE);
         lir->setDef(0, LDefinition(vreg, type, LGeneralReg(ReturnReg)));
         break;
     }
@@ -423,13 +421,7 @@ LIRGeneratorShared::tempFixed(Register reg)
 }
 
 LDefinition
-LIRGeneratorShared::tempFloat32()
-{
-    return temp(LDefinition::FLOAT32);
-}
-
-LDefinition
-LIRGeneratorShared::tempDouble()
+LIRGeneratorShared::tempFloat()
 {
     return temp(LDefinition::DOUBLE);
 }
diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
index 35075335af13..fdfb74276682 100644
--- a/js/src/jit/shared/Lowering-shared.h
+++ b/js/src/jit/shared/Lowering-shared.h
@@ -104,8 +104,7 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
     // These create temporary register requests.
     inline LDefinition temp(LDefinition::Type type = LDefinition::GENERAL,
                             LDefinition::Policy policy = LDefinition::DEFAULT);
-    inline LDefinition tempFloat32();
-    inline LDefinition tempDouble();
+    inline LDefinition tempFloat();
     inline LDefinition tempCopy(MDefinition *input, uint32_t reusedInput);
 
     // Note that the fixed register has a GENERAL type.
diff --git a/js/src/jit/shared/Lowering-x86-shared.cpp b/js/src/jit/shared/Lowering-x86-shared.cpp
index 71d687543dfa..8895dba562bc 100644
--- a/js/src/jit/shared/Lowering-x86-shared.cpp
+++ b/js/src/jit/shared/Lowering-x86-shared.cpp
@@ -27,7 +27,7 @@ LIRGeneratorX86Shared::newLTableSwitch(const LAllocation &in, const LDefinition
 LTableSwitchV *
 LIRGeneratorX86Shared::newLTableSwitchV(MTableSwitch *tableswitch)
 {
-    return new(alloc()) LTableSwitchV(temp(), tempDouble(), temp(), tableswitch);
+    return new(alloc()) LTableSwitchV(temp(), tempFloat(), temp(), tableswitch);
 }
 
 bool
@@ -333,7 +333,7 @@ LIRGeneratorX86Shared::lowerTruncateDToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Double);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempDouble();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
     return define(new(alloc()) LTruncateDToInt32(useRegister(opd), maybeTemp), ins);
 }
 
@@ -343,6 +343,6 @@ LIRGeneratorX86Shared::lowerTruncateFToInt32(MTruncateToInt32 *ins)
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Float32);
 
-    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat32();
+    LDefinition maybeTemp = Assembler::HasSSE3() ? LDefinition::BogusTemp() : tempFloat();
     return define(new(alloc()) LTruncateFToInt32(useRegister(opd), maybeTemp), ins);
 }
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.cpp b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
index 597926d11770..55ce862e0c6d 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.cpp
@@ -27,7 +27,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     size_t swapCount = 0;
 
     for (size_t j = i; ; j++) {
-        const MoveOp &move = moves.getMove(j);
+        const Move &move = moves.getMove(j);
 
         // If it isn't a cycle of registers of the same kind, we won't be able
         // to optimize it.
@@ -56,7 +56,7 @@ MoveEmitterX86::characterizeCycle(const MoveResolver &moves, size_t i,
     }
 
     // Check that the last move cycles back to the first move.
-    const MoveOp &move = moves.getMove(i + swapCount);
+    const Move &move = moves.getMove(i + swapCount);
     if (move.from() != moves.getMove(i).to()) {
         *allGeneralRegs = false;
         *allFloatRegs = false;
@@ -99,7 +99,7 @@ void
 MoveEmitterX86::emit(const MoveResolver &moves)
 {
     for (size_t i = 0; i < moves.numMoves(); i++) {
-        const MoveOp &move = moves.getMove(i);
+        const Move &move = moves.getMove(i);
         const MoveOperand &from = move.from();
         const MoveOperand &to = move.to();
 
@@ -128,17 +128,10 @@ MoveEmitterX86::emit(const MoveResolver &moves)
         }
 
         // A normal move which is not part of a cycle.
-        switch (move.kind()) {
-          case MoveOp::FLOAT32:
-          case MoveOp::DOUBLE:
+        if (move.kind() == Move::DOUBLE)
             emitDoubleMove(from, to);
-            break;
-          case MoveOp::GENERAL:
+        else
             emitGeneralMove(from, to);
-            break;
-          default:
-            MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
-        }
     }
 }
 
@@ -177,7 +170,7 @@ MoveEmitterX86::toAddress(const MoveOperand &operand) const
 Operand
 MoveEmitterX86::toOperand(const MoveOperand &operand) const
 {
-    if (operand.isMemoryOrEffectiveAddress())
+    if (operand.isMemory() || operand.isEffectiveAddress() || operand.isFloatAddress())
         return Operand(toAddress(operand));
     if (operand.isGeneralReg())
         return Operand(operand.reg());
@@ -211,7 +204,7 @@ MoveEmitterX86::toPopOperand(const MoveOperand &operand) const
 }
 
 void
-MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterX86::breakCycle(const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -219,26 +212,20 @@ MoveEmitterX86::breakCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (A -> B), which we reach first. We save B, then allow
     // the original move to continue.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(toAddress(to), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, cycleSlot());
         } else {
             masm.storeDouble(to.floatReg(), cycleSlot());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         masm.Push(toOperand(to));
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
 void
-MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
+MoveEmitterX86::completeCycle(const MoveOperand &to, Move::Kind kind)
 {
     // There is some pattern:
     //   (A -> B)
@@ -246,25 +233,19 @@ MoveEmitterX86::completeCycle(const MoveOperand &to, MoveOp::Kind kind)
     //
     // This case handles (B -> A), which we reach last. We emit a move from the
     // saved value of B, to A.
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE:
+    if (kind == Move::DOUBLE) {
         if (to.isMemory()) {
             masm.loadDouble(cycleSlot(), ScratchFloatReg);
             masm.storeDouble(ScratchFloatReg, toAddress(to));
         } else {
             masm.loadDouble(cycleSlot(), to.floatReg());
         }
-        break;
-      case MoveOp::GENERAL:
+    } else {
         if (to.isMemory()) {
             masm.Pop(toPopOperand(to));
         } else {
             masm.Pop(to.reg());
         }
-        break;
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected move kind");
     }
 }
 
@@ -274,7 +255,7 @@ MoveEmitterX86::emitGeneralMove(const MoveOperand &from, const MoveOperand &to)
     if (from.isGeneralReg()) {
         masm.mov(from.reg(), toOperand(to));
     } else if (to.isGeneralReg()) {
-        JS_ASSERT(from.isMemoryOrEffectiveAddress());
+        JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
         if (from.isMemory())
             masm.loadPtr(toAddress(from), to.reg());
         else
diff --git a/js/src/jit/shared/MoveEmitter-x86-shared.h b/js/src/jit/shared/MoveEmitter-x86-shared.h
index 01636af4d063..b7d8fe7446df 100644
--- a/js/src/jit/shared/MoveEmitter-x86-shared.h
+++ b/js/src/jit/shared/MoveEmitter-x86-shared.h
@@ -23,6 +23,9 @@ class CodeGenerator;
 
 class MoveEmitterX86
 {
+    typedef MoveResolver::Move Move;
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     bool inCycle_;
     MacroAssemblerSpecific &masm;
 
@@ -45,8 +48,8 @@ class MoveEmitterX86
                                  bool allGeneralRegs, bool allFloatRegs, size_t swapCount);
     void emitGeneralMove(const MoveOperand &from, const MoveOperand &to);
     void emitDoubleMove(const MoveOperand &from, const MoveOperand &to);
-    void breakCycle(const MoveOperand &to, MoveOp::Kind kind);
-    void completeCycle(const MoveOperand &to, MoveOp::Kind kind);
+    void breakCycle(const MoveOperand &to, Move::Kind kind);
+    void completeCycle(const MoveOperand &to, Move::Kind kind);
 
   public:
     MoveEmitterX86(MacroAssemblerSpecific &masm);
diff --git a/js/src/jit/x64/MacroAssembler-x64.cpp b/js/src/jit/x64/MacroAssembler-x64.cpp
index db522ee87ed4..4586b3f01675 100644
--- a/js/src/jit/x64/MacroAssembler-x64.cpp
+++ b/js/src/jit/x64/MacroAssembler-x64.cpp
@@ -134,12 +134,10 @@ MacroAssemblerX64::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerX64::passABIArg(const MoveOperand &from)
 {
     MoveOperand to;
-    switch (kind) {
-      case MoveOp::FLOAT32:
-      case MoveOp::DOUBLE: {
+    if (from.isDouble()) {
         FloatRegister dest;
         if (GetFloatArgReg(passedIntArgs_, passedFloatArgs_++, &dest)) {
             if (from.isFloatReg() && from.floatReg() == dest) {
@@ -149,15 +147,10 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
             to = MoveOperand(dest);
         } else {
             to = MoveOperand(StackPointer, stackForCall_);
-            switch (kind) {
-              case MoveOp::FLOAT32: stackForCall_ += sizeof(float);  break;
-              case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
-              default: MOZ_ASSUME_UNREACHABLE("Unexpected float register class argument kind");
-            }
+            stackForCall_ += sizeof(double);
         }
-        break;
-      }
-      case MoveOp::GENERAL: {
+        enoughMemory_ = moveResolver_.addMove(from, to, Move::DOUBLE);
+    } else {
         Register dest;
         if (GetIntArgReg(passedIntArgs_++, passedFloatArgs_, &dest)) {
             if (from.isGeneralReg() && from.reg() == dest) {
@@ -169,25 +162,20 @@ MacroAssemblerX64::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
             to = MoveOperand(StackPointer, stackForCall_);
             stackForCall_ += sizeof(int64_t);
         }
-        break;
-      }
-      default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+        enoughMemory_ = moveResolver_.addMove(from, to, Move::GENERAL);
     }
-
-    enoughMemory_ = moveResolver_.addMove(from, to, kind);
 }
 
 void
 MacroAssemblerX64::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
+    passABIArg(MoveOperand(reg));
 }
 
 void
-MacroAssemblerX64::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
+MacroAssemblerX64::passABIArg(const FloatRegister &reg)
 {
-    passABIArg(MoveOperand(reg), kind);
+    passABIArg(MoveOperand(reg));
 }
 
 void
@@ -231,7 +219,7 @@ MacroAssemblerX64::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
+MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, Result result)
 {
     freeStack(stackAdjust);
     if (dynamicAlignment_)
@@ -242,7 +230,7 @@ MacroAssemblerX64::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX64::callWithABI(void *fun, MoveOp::Kind result)
+MacroAssemblerX64::callWithABI(void *fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -251,7 +239,7 @@ MacroAssemblerX64::callWithABI(void *fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, MoveOp::Kind result)
+MacroAssemblerX64::callWithABI(AsmJSImmPtr imm, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -271,12 +259,12 @@ IsIntArgReg(Register reg)
 }
 
 void
-MacroAssemblerX64::callWithABI(Address fun, MoveOp::Kind result)
+MacroAssemblerX64::callWithABI(Address fun, Result result)
 {
     if (IsIntArgReg(fun.base)) {
         // Callee register may be clobbered for an argument. Move the callee to
         // r10, a volatile, non-argument register.
-        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), MoveOp::GENERAL);
+        moveResolver_.addMove(MoveOperand(fun.base), MoveOperand(r10), Move::GENERAL);
         fun.base = r10;
     }
 
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index d8bd8b36d077..fc68f4ad9601 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -79,6 +79,15 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
+    enum Result {
+        GENERAL,
+        DOUBLE,
+        FLOAT
+    };
+
+    typedef MoveResolver::MoveOperand MoveOperand;
+    typedef MoveResolver::Move Move;
+
     MacroAssemblerX64()
       : inCall_(false),
         enoughMemory_(true)
@@ -1193,19 +1202,19 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
+    void passABIArg(const MoveOperand &from);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
+    void passABIArg(const FloatRegister &reg);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
+    void callWithABIPost(uint32_t stackAdjust, Result result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(AsmJSImmPtr imm, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(Address fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(void *fun, Result result = GENERAL);
+    void callWithABI(AsmJSImmPtr imm, Result result = GENERAL);
+    void callWithABI(Address fun, Result result = GENERAL);
 
     void handleFailureWithHandler(void *handler);
     void handleFailureWithHandlerTail();
diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
index 0ebc99a01326..d41d42bea39d 100644
--- a/js/src/jit/x64/Trampoline-x64.cpp
+++ b/js/src/jit/x64/Trampoline-x64.cpp
@@ -503,6 +503,8 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
@@ -586,24 +588,25 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-        MoveOperand from;
-        switch (f.argProperties(explicitArg)) {
-          case VMFunction::WordByValue:
-            if (f.argPassedInFloatReg(explicitArg))
-                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
-            else
-                masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
-                            MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::DoubleByValue:
-          case VMFunction::DoubleByRef:
-            MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
+    if (f.explicitArgs) {
+        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+            MoveOperand from;
+            switch (f.argProperties(explicitArg)) {
+              case VMFunction::WordByValue:
+                if (f.argPassedInFloatReg(explicitArg))
+                    masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::FLOAT));
+                else
+                    masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::WordByRef:
+                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::DoubleByValue:
+              case VMFunction::DoubleByRef:
+                MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
+            }
         }
     }
 
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index 48914c71a1fd..534518ff2eaa 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -900,7 +900,7 @@ CodeGeneratorX86::visitOutOfLineTruncate(OutOfLineTruncate *ool)
         saveVolatile(output);
 
         masm.setupUnalignedABICall(1, output);
-        masm.passABIArg(input, MoveOp::DOUBLE);
+        masm.passABIArg(input);
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
         else
@@ -991,7 +991,7 @@ CodeGeneratorX86::visitOutOfLineTruncateFloat32(OutOfLineTruncateFloat32 *ool)
         masm.push(input);
         masm.setupUnalignedABICall(1, output);
         masm.cvtss2sd(input, input);
-        masm.passABIArg(input, MoveOp::DOUBLE);
+        masm.passABIArg(input);
 
         if (gen->compilingAsmJS())
             masm.callWithABI(AsmJSImm_ToInt32);
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index a4b00cdc27fb..ace3e98d36af 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -163,29 +163,29 @@ MacroAssemblerX86::setupUnalignedABICall(uint32_t args, const Register &scratch)
 }
 
 void
-MacroAssemblerX86::passABIArg(const MoveOperand &from, MoveOp::Kind kind)
+MacroAssemblerX86::passABIArg(const MoveOperand &from)
 {
     ++passedArgs_;
     MoveOperand to = MoveOperand(StackPointer, stackForCall_);
-    switch (kind) {
-      case MoveOp::FLOAT32: stackForCall_ += sizeof(float); break;
-      case MoveOp::DOUBLE:  stackForCall_ += sizeof(double); break;
-      case MoveOp::GENERAL: stackForCall_ += sizeof(int32_t); break;
-      default: MOZ_ASSUME_UNREACHABLE("Unexpected argument kind");
+    if (from.isDouble()) {
+        stackForCall_ += sizeof(double);
+        enoughMemory_ &= moveResolver_.addMove(from, to, Move::DOUBLE);
+    } else {
+        stackForCall_ += sizeof(int32_t);
+        enoughMemory_ &= moveResolver_.addMove(from, to, Move::GENERAL);
     }
-    enoughMemory_ &= moveResolver_.addMove(from, to, kind);
 }
 
 void
 MacroAssemblerX86::passABIArg(const Register &reg)
 {
-    passABIArg(MoveOperand(reg), MoveOp::GENERAL);
+    passABIArg(MoveOperand(reg));
 }
 
 void
-MacroAssemblerX86::passABIArg(const FloatRegister &reg, MoveOp::Kind kind)
+MacroAssemblerX86::passABIArg(const FloatRegister &reg)
 {
-    passABIArg(MoveOperand(reg), kind);
+    passABIArg(MoveOperand(reg));
 }
 
 void
@@ -230,15 +230,16 @@ MacroAssemblerX86::callWithABIPre(uint32_t *stackAdjust)
 }
 
 void
-MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
+MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, Result result)
 {
     freeStack(stackAdjust);
-    if (result == MoveOp::DOUBLE) {
+    if (result == DOUBLE) {
         reserveStack(sizeof(double));
         fstp(Operand(esp, 0));
         loadDouble(Operand(esp, 0), ReturnFloatReg);
         freeStack(sizeof(double));
-    } else if (result == MoveOp::FLOAT32) {
+    }
+    if (result == FLOAT) {
         reserveStack(sizeof(float));
         fstp32(Operand(esp, 0));
         loadFloat(Operand(esp, 0), ReturnFloatReg);
@@ -252,7 +253,7 @@ MacroAssemblerX86::callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX86::callWithABI(void *fun, MoveOp::Kind result)
+MacroAssemblerX86::callWithABI(void *fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -261,7 +262,7 @@ MacroAssemblerX86::callWithABI(void *fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, MoveOp::Kind result)
+MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
@@ -270,7 +271,7 @@ MacroAssemblerX86::callWithABI(AsmJSImmPtr fun, MoveOp::Kind result)
 }
 
 void
-MacroAssemblerX86::callWithABI(const Address &fun, MoveOp::Kind result)
+MacroAssemblerX86::callWithABI(const Address &fun, Result result)
 {
     uint32_t stackAdjust;
     callWithABIPre(&stackAdjust);
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index eb4a64cb8ae7..0d1395a08300 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -70,6 +70,15 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     using MacroAssemblerX86Shared::callWithExitFrame;
     using MacroAssemblerX86Shared::branch32;
 
+    enum Result {
+        GENERAL,
+        DOUBLE,
+        FLOAT
+    };
+
+    typedef MoveResolver::MoveOperand MoveOperand;
+    typedef MoveResolver::Move Move;
+
     MacroAssemblerX86()
       : inCall_(false),
         enoughMemory_(true)
@@ -1037,19 +1046,19 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     // automatically adjusted. It is extremely important that esp-relative
     // addresses are computed *after* setupABICall(). Furthermore, no
     // operations should be emitted while setting arguments.
-    void passABIArg(const MoveOperand &from, MoveOp::Kind kind);
+    void passABIArg(const MoveOperand &from);
     void passABIArg(const Register &reg);
-    void passABIArg(const FloatRegister &reg, MoveOp::Kind kind);
+    void passABIArg(const FloatRegister &reg);
 
   private:
     void callWithABIPre(uint32_t *stackAdjust);
-    void callWithABIPost(uint32_t stackAdjust, MoveOp::Kind result);
+    void callWithABIPost(uint32_t stackAdjust, Result result);
 
   public:
     // Emits a call to a C/C++ function, resolving all argument moves.
-    void callWithABI(void *fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(AsmJSImmPtr fun, MoveOp::Kind result = MoveOp::GENERAL);
-    void callWithABI(const Address &fun, MoveOp::Kind result = MoveOp::GENERAL);
+    void callWithABI(void *fun, Result result = GENERAL);
+    void callWithABI(AsmJSImmPtr fun, Result result = GENERAL);
+    void callWithABI(const Address &fun, Result result = GENERAL);
 
     // Used from within an Exit frame to handle a pending exception.
     void handleFailureWithHandler(void *handler);
diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
index 6b584b6cbfc1..a14d8e2c2dfc 100644
--- a/js/src/jit/x86/Trampoline-x86.cpp
+++ b/js/src/jit/x86/Trampoline-x86.cpp
@@ -538,6 +538,8 @@ JitRuntime::generateBailoutHandler(JSContext *cx)
 IonCode *
 JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
 {
+    typedef MoveResolver::MoveOperand MoveOperand;
+
     JS_ASSERT(!StackKeptAligned);
     JS_ASSERT(functionWrappers_);
     JS_ASSERT(functionWrappers_->initialized());
@@ -614,31 +616,31 @@ JitRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
     size_t argDisp = 0;
 
     // Copy arguments.
-    for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
-        MoveOperand from;
-        switch (f.argProperties(explicitArg)) {
-          case VMFunction::WordByValue:
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::DoubleByValue:
-            // We don't pass doubles in float registers on x86, so no need
-            // to check for argPassedInFloatReg.
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::WordByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
-                            MoveOp::GENERAL);
-            argDisp += sizeof(void *);
-            break;
-          case VMFunction::DoubleByRef:
-            masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE_ADDRESS),
-                            MoveOp::GENERAL);
-            argDisp += 2 * sizeof(void *);
-            break;
+    if (f.explicitArgs) {
+        for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
+            MoveOperand from;
+            switch (f.argProperties(explicitArg)) {
+              case VMFunction::WordByValue:
+                masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::DoubleByValue:
+                // We don't pass doubles in float registers on x86, so no need
+                // to check for argPassedInFloatReg.
+                masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                masm.passABIArg(MoveOperand(argsBase, argDisp));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::WordByRef:
+                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+                argDisp += sizeof(void *);
+                break;
+              case VMFunction::DoubleByRef:
+                masm.passABIArg(MoveOperand(argsBase, argDisp, MoveOperand::EFFECTIVE));
+                argDisp += 2 * sizeof(void *);
+                break;
+            }
         }
     }
 

From c73a917e235fcda42aba7028110f562416205ede Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabrice=20Desr=C3=A9?= <fabrice@mozilla.com>
Date: Fri, 13 Dec 2013 10:38:38 -0800
Subject: [PATCH 386/459] Bug 949191 - [B2G][Browser] unknown cert issuer error
 message text overlaps the border and the text's letters are too small to read
 it r=gwagner

---
 b2g/chrome/content/netError.css | 131 ++++++++++++++++++++++++++++++++
 b2g/chrome/jar.mn               |   2 +
 2 files changed, 133 insertions(+)
 create mode 100644 b2g/chrome/content/netError.css

diff --git a/b2g/chrome/content/netError.css b/b2g/chrome/content/netError.css
new file mode 100644
index 000000000000..f83ded7d4f35
--- /dev/null
+++ b/b2g/chrome/content/netError.css
@@ -0,0 +1,131 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ *  This defines the look-and-feel styling of the error pages.
+ *  (see: netError.xhtml)
+ *
+ *  Original styling by William Price <bugzilla@mob.rice.edu>
+ *  Updated for mobile by: Wes Johnston <wjohnston@mozilla.com>
+ */
+
+body {
+  margin: 0;
+  padding: 0 8px 8px;
+  font-family: "Nokia Sans", Tahoma, sans-serif !important;
+}
+
+h1 {
+  font-size: 22px;
+}
+
+h2 {
+  font-size: 16px;
+}
+
+ul {
+  margin: 0px;
+  padding: 0px 0px 0px 1em;
+}
+
+li {
+  margin: 0px;
+  padding: 8px 0px;
+}
+
+#errorPage {
+  background-color: #CEE6F4;
+}
+
+#errorPage.certerror {
+  background-color: #EFD400;
+}
+
+#errorPage.blockedsite {
+  background-color: #BF0000;
+}
+
+#errorTitle {
+  background: url("chrome://browser/content/images/errorpage-warning.png") left center no-repeat;
+  /* Scaled by .666 of their actual size */
+  background-size: 40px 40px;
+  background-origin: content-box;
+  min-height: 60px;
+  margin-left: auto;
+  margin-right: auto;
+  max-width: 500px;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+#errorPage.certerror #errorTitle {
+  background-image: url("chrome://browser/content/images/errorpage-larry-black.png");
+}
+
+#errorPage.blockedsite #errorTitle {
+  background-image: url("chrome://browser/content/images/errorpage-larry-white.png");
+  color: white;
+}
+
+.errorTitleText {
+  padding: 0px 0px 0px 50px;
+  display: inline-block;
+  vertical-align: middle
+}
+
+#errorPageContainer {
+  background-color: white;
+  border: 1px solid #999999;
+  border-radius: 6px;
+  padding: 6px 20px 20px;
+  font-size: 14px;
+  max-width: 500px;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+#errorShortDesc > p:empty {
+  display: none;
+}
+
+#errorShortDesc > p {
+  overflow: auto;
+  border-bottom: 1px solid #999999;
+  padding-bottom: 1em;
+}
+
+#errorPage.blockedsite #errorShortDesc > p {
+  font-weight: bold;
+  border-bottom: none;
+  padding-bottom: 0px;
+}
+
+#securityOverrideDiv {
+  padding-top: 10px;
+}
+
+div[collapsed] {
+  padding-left: 15px;
+  background-image: url("chrome://browser/skin/images/arrowright-16.png");
+  background-size: 11px 11px;
+  background-repeat: no-repeat;
+  background-position: left 0.3em;
+}
+
+div[collapsed="true"] {
+  background-image: url("chrome://browser/skin/images/arrowright-16.png");
+}
+
+div[collapsed="false"] {
+  background-image: url("chrome://browser/skin/images/arrowdown-16.png");
+}
+
+div[collapsed="true"] > p,
+div[collapsed="true"] > div {
+  display: none;
+}
+
+button {
+  padding: 0.3em !important;
+}
diff --git a/b2g/chrome/jar.mn b/b2g/chrome/jar.mn
index c8c344be72d8..632668d3f085 100644
--- a/b2g/chrome/jar.mn
+++ b/b2g/chrome/jar.mn
@@ -25,9 +25,11 @@ chrome.jar:
 
 % override chrome://global/skin/media/videocontrols.css chrome://browser/content/touchcontrols.css
 % override chrome://global/content/aboutCertError.xhtml chrome://browser/content/aboutCertError.xhtml
+% override chrome://global/skin/netError.css chrome://browser/content/netError.css
 
   content/ErrorPage.js                  (content/ErrorPage.js)
   content/aboutCertError.xhtml          (content/aboutCertError.xhtml)
+  content/netError.css                  (content/netError.css)
   content/images/errorpage-larry-black.png (content/images/errorpage-larry-black.png)
   content/images/errorpage-larry-white.png (content/images/errorpage-larry-white.png)
   content/images/errorpage-warning.png (content/images/errorpage-warning.png)

From 6da77cb0a598cd83ab7549386c5629ecceec3c8e Mon Sep 17 00:00:00 2001
From: Matt Brubeck <mbrubeck@mozilla.com>
Date: Fri, 13 Dec 2013 10:40:23 -0800
Subject: [PATCH 387/459] Bug 950075 - Don't forward non-navigation keys to the
 menu list [r=rsilveira]

---
 browser/metro/base/content/helperui/MenuUI.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/metro/base/content/helperui/MenuUI.js b/browser/metro/base/content/helperui/MenuUI.js
index 38458dcb17c8..532c56bdaab9 100644
--- a/browser/metro/base/content/helperui/MenuUI.js
+++ b/browser/metro/base/content/helperui/MenuUI.js
@@ -522,7 +522,6 @@ MenuPopup.prototype = {
           aEvent.charCode);  //  in unsigned long charCodeArg);
 
         ev.mine = true;
-        this.commands.dispatchEvent(ev);
 
         switch (aEvent.keyCode) {
           case aEvent.DOM_VK_ESCAPE:
@@ -537,6 +536,7 @@ MenuPopup.prototype = {
         if (Util.isNavigationKey(aEvent.keyCode)) {
           aEvent.stopPropagation();
           aEvent.preventDefault();
+          this.commands.dispatchEvent(ev);
         } else if (!this._wantTypeBehind) {
           // Hide the context menu so you can't type behind it.
           aEvent.stopPropagation();

From ef86288f4aadcaf3171f7147ec42ddaaa9e8d788 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 10:45:24 -0800
Subject: [PATCH 388/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/62c0ad5b88f1
Author: James Lal <james@lightsofapollo.com>
Desc: Merge pull request #14519 from lightsofapollo/s3-uploads

Bug 948177 - Setup Travis S3 bucket / artifact configuration +shepherd

========

https://hg.mozilla.org/integration/gaia-central/rev/a0b719d1599c
Author: James Lal <james@lightsofapollo.com>
Desc: Bug 948177 - Setup Travis S3 bucket / artifact configuration
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 2ef805efe0f0..c14c25b2ebc6 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "2b63513acfbf8b2c8e55465cb209c2ace9db05b0", 
+    "revision": "62c0ad5b88f15d5da1cc2496b9534087dbc5d015", 
     "repo_path": "/integration/gaia-central"
 }

From ab5a05b6e7cf1045c4955e7cbcc0d80d4ff35e81 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Fri, 13 Dec 2013 20:20:23 -0800
Subject: [PATCH 389/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/45fc76dab544
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Merge pull request #14638 from timdream/include-pinyin

Bug 949958 - Include Pinyin IME in eng build by default, r=djf

========

https://hg.mozilla.org/integration/gaia-central/rev/3a118a3c0534
Author: Timothy Guan-tin Chien <timdream@gmail.com>
Desc: Bug 949958 - Include Pinyin IME in eng build by default
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 7eb83e968939..1c68ef678c93 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "a8e6d298564ac14c79d23ab170be2599f8ae9678", 
+    "revision": "45fc76dab5449af2aa333a92251780291a8334ac", 
     "repo_path": "/integration/gaia-central"
 }

From dc085ead35c8d20f7489aba9468a4d1e18592786 Mon Sep 17 00:00:00 2001
From: ffxbld <none@none>
Date: Sat, 14 Dec 2013 03:11:25 -0800
Subject: [PATCH 390/459] No bug, Automated blocklist update from host
 bld-centos6-hp-016 - a=blocklist-update

---
 browser/app/blocklist.xml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/browser/app/blocklist.xml b/browser/app/blocklist.xml
index fb6d6516cf12..a8804da86f3e 100644
--- a/browser/app/blocklist.xml
+++ b/browser/app/blocklist.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1386360478000">
+<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1386891443000">
   <emItems>
       <emItem  blockID="i454" id="sqlmoz@facebook.com">
                         <versionRange  minVersion="0" maxVersion="*" severity="3">
@@ -106,6 +106,10 @@
                         <versionRange  minVersion="3.4.1" maxVersion="3.4.1.194" severity="1">
                     </versionRange>
                   </emItem>
+      <emItem  blockID="i506" id="ext@bettersurfplus.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                  </emItem>
       <emItem  blockID="i100" id="{394DCBA4-1F92-4f8e-8EC9-8D2CB90CB69B}">
                         <versionRange  minVersion="2.5.0" maxVersion="2.5.0" severity="1">
                     </versionRange>
@@ -453,6 +457,10 @@
                         <versionRange  minVersion="0" maxVersion="*" severity="1">
                     </versionRange>
                   </emItem>
+      <emItem  blockID="i507" id="4zffxtbr-bs@VideoDownloadConverter_4z.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                  </emItem>
       <emItem  blockID="i7" id="{2224e955-00e9-4613-a844-ce69fccaae91}">
                         </emItem>
       <emItem  blockID="i485" id="/^brasilescape.*\@facebook\.com$//">
@@ -693,6 +701,10 @@
                         <versionRange  minVersion="0" maxVersion="15.0.5" severity="1">
                     </versionRange>
                   </emItem>
+      <emItem  blockID="i505" id="extacylife@a.com">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                  </emItem>
       <emItem  blockID="i15" id="personas@christopher.beard">
                         <versionRange  minVersion="1.6" maxVersion="1.6">
                       <targetApplication  id="{ec8030f7-c20a-464f-9b0e-13a3a9e97384}">

From b47490ccbfa5b4619787937eedc73acb944d70c1 Mon Sep 17 00:00:00 2001
From: ffxbld <none@none>
Date: Sat, 14 Dec 2013 03:18:03 -0800
Subject: [PATCH 391/459] No bug, Automated HSTS preload list update from host
 bld-linux64-ix-037 - a=hsts-update

---
 security/manager/boot/src/nsSTSPreloadList.errors |  2 ++
 security/manager/boot/src/nsSTSPreloadList.inc    | 10 +++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/security/manager/boot/src/nsSTSPreloadList.errors b/security/manager/boot/src/nsSTSPreloadList.errors
index 2e80a627a2bc..6fb7b561fee9 100644
--- a/security/manager/boot/src/nsSTSPreloadList.errors
+++ b/security/manager/boot/src/nsSTSPreloadList.errors
@@ -47,6 +47,7 @@ groups.google.com: did not receive HSTS header
 history.google.com: did not receive HSTS header
 hostedtalkgadget.google.com: did not receive HSTS header
 id.atlassian.com: did not receive HSTS header
+in.xero.com: max-age too low: 3600
 iop.intuit.com: max-age too low: 86400
 irccloud.com: did not receive HSTS header
 jitsi.org: did not receive HSTS header
@@ -68,6 +69,7 @@ openshift.redhat.com: did not receive HSTS header
 ottospora.nl: could not connect to host
 packagist.org: max-age too low: 2592000
 paypal.com: max-age too low: 14400
+payroll.xero.com: max-age too low: 3600
 platform.lookout.com: could not connect to host
 play.google.com: did not receive HSTS header
 plus.google.com: did not receive HSTS header
diff --git a/security/manager/boot/src/nsSTSPreloadList.inc b/security/manager/boot/src/nsSTSPreloadList.inc
index 93f90fc0361d..672a2cbea031 100644
--- a/security/manager/boot/src/nsSTSPreloadList.inc
+++ b/security/manager/boot/src/nsSTSPreloadList.inc
@@ -8,7 +8,7 @@
 /*****************************************************************************/
 
 #include <stdint.h>
-const PRTime gPreloadListExpirationTime = INT64_C(1397301006735000);
+const PRTime gPreloadListExpirationTime = INT64_C(1397905536640000);
 
 class nsSTSPreload
 {
@@ -21,6 +21,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "aladdinschools.appspot.com", false },
   { "alpha.irccloud.com", false },
   { "api.intercom.io", false },
+  { "api.xero.com", false },
   { "app.recurly.com", false },
   { "appseccalifornia.org", true },
   { "arivo.com.br", true },
@@ -49,6 +50,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "cupcake.is", true },
   { "cybozu.com", true },
   { "cyphertite.com", true },
+  { "data.qld.gov.au", false },
   { "davidlyness.com", true },
   { "developer.mydigipass.com", false },
   { "dist.torproject.org", false },
@@ -57,6 +59,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "download.jitsi.org", false },
   { "ebanking.indovinabank.com.vn", false },
   { "ecosystem.atlassian.net", true },
+  { "eff.org", true },
   { "entropia.de", false },
   { "errors.zenpayroll.com", false },
   { "espra.com", true },
@@ -66,6 +69,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "forum.quantifiedself.com", true },
   { "gernert-server.de", true },
   { "getlantern.org", true },
+  { "go.xero.com", false },
   { "grc.com", false },
   { "haste.ch", true },
   { "howrandom.org", true },
@@ -83,11 +87,13 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "lockify.com", true },
   { "login.persona.org", true },
   { "login.sapo.pt", true },
+  { "login.xero.com", false },
   { "logotype.se", true },
   { "lolicore.ch", true },
   { "lookout.com", false },
   { "lumi.do", false },
   { "luneta.nearbuysystems.com", false },
+  { "mail.de", true },
   { "makeyourlaws.org", false },
   { "manage.zenpayroll.com", false },
   { "manager.linode.com", false },
@@ -98,6 +104,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "members.nearlyfreespeech.net", false },
   { "mudcrab.us", true },
   { "my.onlime.ch", false },
+  { "my.xero.com", false },
   { "mylookout.com", false },
   { "neg9.org", false },
   { "oplop.appspot.com", true },
@@ -110,6 +117,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "paymill.de", false },
   { "piratenlogin.de", true },
   { "pixi.me", true },
+  { "publications.qld.gov.au", false },
   { "riseup.net", true },
   { "roundcube.mayfirst.org", false },
   { "sandbox.mydigipass.com", false },

From 32193ae92af19c8bda75da24ca94c8432576d5d3 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Sat, 14 Dec 2013 14:32:35 +0100
Subject: [PATCH 392/459] Bug 949475 - Add some debug-only sanity checks.
 r=bhackett

--HG--
extra : rebase_source : c64b96293ea729eb3dee52c59262904db849d7ae
---
 js/src/jit/CodeGenerator.cpp     | 174 ++++++++++++++++++++++++++++++-
 js/src/jit/CodeGenerator.h       |   9 ++
 js/src/jit/IonCode.h             |   5 +-
 js/src/jit/IonMacroAssembler.cpp |   2 +-
 js/src/jit/VMFunctions.cpp       |  57 ++++++++++
 js/src/jit/VMFunctions.h         |   7 ++
 6 files changed, 250 insertions(+), 4 deletions(-)

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index ba965f48f66a..f44cc6af8431 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -142,8 +142,11 @@ MNewStringObject::templateObj() const {
 }
 
 CodeGenerator::CodeGenerator(MIRGenerator *gen, LIRGraph *graph, MacroAssembler *masm)
-  : CodeGeneratorSpecific(gen, graph, masm),
-    unassociatedScriptCounts_(nullptr)
+  : CodeGeneratorSpecific(gen, graph, masm)
+#ifdef DEBUG
+  , ionScriptLabels_(gen->alloc())
+#endif
+  , unassociatedScriptCounts_(nullptr)
 {
 }
 
@@ -2878,6 +2881,160 @@ struct ScriptCountBlockState
     }
 };
 
+#ifdef DEBUG
+bool
+CodeGenerator::branchIfInvalidated(Register temp, Label *invalidated)
+{
+    CodeOffsetLabel label = masm.movWithPatch(ImmWord(uintptr_t(-1)), temp);
+    if (!ionScriptLabels_.append(label))
+        return false;
+
+    // If IonScript::refcount != 0, the script has been invalidated.
+    masm.branch32(Assembler::NotEqual,
+                  Address(temp, IonScript::offsetOfRefcount()),
+                  Imm32(0),
+                  invalidated);
+    return true;
+}
+
+bool
+CodeGenerator::emitObjectOrStringResultChecks(LInstruction *lir, MDefinition *mir)
+{
+    if (lir->numDefs() == 0)
+        return true;
+
+    JS_ASSERT(lir->numDefs() == 1);
+    Register output = ToRegister(lir->getDef(0));
+
+    GeneralRegisterSet regs(GeneralRegisterSet::All());
+    regs.take(output);
+
+    Register temp = regs.takeAny();
+    masm.push(temp);
+
+    // Don't check if the script has been invalidated. In that case invalid
+    // types are expected (until we reach the OsiPoint and bailout).
+    Label done;
+    if (!branchIfInvalidated(temp, &done))
+        return false;
+
+    if (mir->type() == MIRType_Object &&
+        mir->resultTypeSet() &&
+        !mir->resultTypeSet()->unknownObject())
+    {
+        // We have a result TypeSet, assert this object is in it.
+        Label miss, ok;
+        if (mir->resultTypeSet()->getObjectCount() > 0)
+            masm.guardObjectType(output, mir->resultTypeSet(), temp, &miss);
+        else
+            masm.jump(&miss);
+        masm.jump(&ok);
+
+        masm.bind(&miss);
+        masm.assumeUnreachable("MIR instruction returned object with unexpected type");
+
+        masm.bind(&ok);
+    }
+
+    // Check that we have a valid GC pointer.
+    if (gen->info().executionMode() != ParallelExecution) {
+        saveVolatile();
+        masm.setupUnalignedABICall(2, temp);
+        masm.loadJSContext(temp);
+        masm.passABIArg(temp);
+        masm.passABIArg(output);
+        masm.callWithABINoProfiling(mir->type() == MIRType_Object
+                                    ? JS_FUNC_TO_DATA_PTR(void *, AssertValidObjectPtr)
+                                    : JS_FUNC_TO_DATA_PTR(void *, AssertValidStringPtr));
+        restoreVolatile();
+    }
+
+    masm.bind(&done);
+    masm.pop(temp);
+    return true;
+}
+
+bool
+CodeGenerator::emitValueResultChecks(LInstruction *lir, MDefinition *mir)
+{
+    if (lir->numDefs() == 0)
+        return true;
+
+    JS_ASSERT(lir->numDefs() == BOX_PIECES);
+    if (!lir->getDef(0)->output()->isRegister())
+        return true;
+
+    ValueOperand output = ToOutValue(lir);
+
+    GeneralRegisterSet regs(GeneralRegisterSet::All());
+    regs.take(output);
+
+    Register temp1 = regs.takeAny();
+    Register temp2 = regs.takeAny();
+    masm.push(temp1);
+    masm.push(temp2);
+
+    // Don't check if the script has been invalidated. In that case invalid
+    // types are expected (until we reach the OsiPoint and bailout).
+    Label done;
+    if (!branchIfInvalidated(temp1, &done))
+        return false;
+
+    if (mir->resultTypeSet() && !mir->resultTypeSet()->unknown()) {
+        // We have a result TypeSet, assert this value is in it.
+        Label miss, ok;
+        masm.guardTypeSet(output, mir->resultTypeSet(), temp1, &miss);
+        masm.jump(&ok);
+
+        masm.bind(&miss);
+        masm.assumeUnreachable("MIR instruction returned value with unexpected type");
+
+        masm.bind(&ok);
+    }
+
+    // Check that we have a valid GC pointer.
+    if (gen->info().executionMode() != ParallelExecution) {
+        saveVolatile();
+
+        masm.pushValue(output);
+        masm.movePtr(StackPointer, temp1);
+
+        masm.setupUnalignedABICall(2, temp2);
+        masm.loadJSContext(temp2);
+        masm.passABIArg(temp2);
+        masm.passABIArg(temp1);
+        masm.callWithABINoProfiling(JS_FUNC_TO_DATA_PTR(void *, AssertValidValue));
+        masm.popValue(output);
+        restoreVolatile();
+    }
+
+    masm.bind(&done);
+    masm.pop(temp2);
+    masm.pop(temp1);
+    return true;
+}
+
+bool
+CodeGenerator::emitDebugResultChecks(LInstruction *ins)
+{
+    // In debug builds, check that LIR instructions return valid values.
+
+    MDefinition *mir = ins->mirRaw();
+    if (!mir)
+        return true;
+
+    switch (mir->type()) {
+      case MIRType_Object:
+      case MIRType_String:
+        return emitObjectOrStringResultChecks(ins, mir);
+      case MIRType_Value:
+        return emitValueResultChecks(ins, mir);
+      default:
+        return true;
+    }
+}
+#endif
+
 bool
 CodeGenerator::generateBody()
 {
@@ -2930,6 +3087,11 @@ CodeGenerator::generateBody()
 
             if (!iter->accept(this))
                 return false;
+
+#ifdef DEBUG
+            if (!emitDebugResultChecks(*iter))
+                return false;
+#endif
         }
         if (masm.oom())
             return false;
@@ -5903,6 +6065,14 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         perfSpewer_.writeProfile(script, code, masm);
 #endif
 
+#ifdef DEBUG
+    for (size_t i = 0; i < ionScriptLabels_.length(); i++) {
+        Assembler::patchDataWithValueCheck(CodeLocationLabel(code, ionScriptLabels_[i]),
+                                           ImmPtr(ionScript),
+                                           ImmPtr((void*)-1));
+    }
+#endif
+
     // for generating inline caches during the execution.
     if (runtimeData_.length())
         ionScript->copyRuntimeData(&runtimeData_[0]);
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 7f264c981c8c..36fb24700d99 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -428,6 +428,15 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool emitAssertRangeI(const Range *r, Register input);
     bool emitAssertRangeD(const Range *r, FloatRegister input, FloatRegister temp);
 
+#ifdef DEBUG
+    Vector<CodeOffsetLabel, 0, IonAllocPolicy> ionScriptLabels_;
+    bool branchIfInvalidated(Register temp, Label *invalidated);
+
+    bool emitDebugResultChecks(LInstruction *ins);
+    bool emitObjectOrStringResultChecks(LInstruction *lir, MDefinition *mir);
+    bool emitValueResultChecks(LInstruction *lir, MDefinition *mir);
+#endif
+
     // Script counts created when compiling code with no associated JSScript.
     IonScriptCounts *unassociatedScriptCounts_;
 
diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
index 4acc08d50993..bcdfcb021b8b 100644
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -256,7 +256,7 @@ struct IonScript
     uint32_t backedgeEntries_;
 
     // Number of references from invalidation records.
-    size_t refcount_;
+    uint32_t refcount_;
 
     // Identifier of the compilation which produced this code.
     types::RecompileInfo recompileInfo_;
@@ -348,6 +348,9 @@ struct IonScript
     static inline size_t offsetOfSkipArgCheckEntryOffset() {
         return offsetof(IonScript, skipArgCheckEntryOffset_);
     }
+    static inline size_t offsetOfRefcount() {
+        return offsetof(IonScript, refcount_);
+    }
 
   public:
     IonCode *method() const {
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index a0511b1c653c..45c9c5f428fa 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -1234,7 +1234,7 @@ MacroAssembler::assumeUnreachable(const char *output)
         setupUnalignedABICall(1, temp);
         movePtr(ImmPtr(output), temp);
         passABIArg(temp);
-        callWithABI(JS_FUNC_TO_DATA_PTR(void *, AssumeUnreachable_));
+        callWithABINoProfiling(JS_FUNC_TO_DATA_PTR(void *, AssumeUnreachable_));
 
         PopRegsInMask(RegisterSet::Volatile());
     }
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 59157800c969..717a2703df7a 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -936,5 +936,62 @@ Recompile(JSContext *cx)
     return true;
 }
 
+#ifdef DEBUG
+void
+AssertValidObjectPtr(JSContext *cx, JSObject *obj)
+{
+    // Check what we can, so that we'll hopefully assert/crash if we get a
+    // bogus object (pointer).
+    JS_ASSERT(obj->compartment() == cx->compartment());
+    JS_ASSERT(obj->runtimeFromMainThread() == cx->runtime());
+
+    JS_ASSERT_IF(!obj->hasLazyType(),
+                 obj->type()->clasp == obj->lastProperty()->getObjectClass());
+
+    if (obj->isTenured()) {
+        JS_ASSERT(obj->isAligned());
+        gc::AllocKind kind = obj->tenuredGetAllocKind();
+        JS_ASSERT(kind >= js::gc::FINALIZE_OBJECT0 && kind <= js::gc::FINALIZE_OBJECT_LAST);
+        JS_ASSERT(obj->tenuredZone() == cx->zone());
+    }
+}
+
+void
+AssertValidStringPtr(JSContext *cx, JSString *str)
+{
+    if (str->isAtom())
+        JS_ASSERT(cx->runtime()->isAtomsZone(str->tenuredZone()));
+    else
+        JS_ASSERT(str->tenuredZone() == cx->zone());
+
+    JS_ASSERT(str->runtimeFromMainThread() == cx->runtime());
+    JS_ASSERT(str->isAligned());
+    JS_ASSERT(str->length() <= JSString::MAX_LENGTH);
+
+    gc::AllocKind kind = str->tenuredGetAllocKind();
+    if (str->isShort())
+        JS_ASSERT(kind == gc::FINALIZE_SHORT_STRING);
+    else if (str->isExternal())
+        JS_ASSERT(kind == gc::FINALIZE_EXTERNAL_STRING);
+    else if (str->isAtom() || str->isFlat())
+        JS_ASSERT(kind == gc::FINALIZE_STRING || kind == gc::FINALIZE_SHORT_STRING);
+    else
+        JS_ASSERT(kind == gc::FINALIZE_STRING);
+}
+
+void
+AssertValidValue(JSContext *cx, Value *v)
+{
+    if (v->isObject()) {
+        AssertValidObjectPtr(cx, &v->toObject());
+        return;
+    }
+    if (v->isString()) {
+        AssertValidStringPtr(cx, v->toString());
+        return;
+    }
+}
+#endif
+
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index a5ccb4f255c4..8b728c530db9 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -663,6 +663,13 @@ JSObject *CreateDerivedTypedObj(JSContext *cx, HandleObject type,
                                 HandleObject owner, int32_t offset);
 
 bool Recompile(JSContext *cx);
+
+#ifdef DEBUG
+void AssertValidObjectPtr(JSContext *cx, JSObject *obj);
+void AssertValidStringPtr(JSContext *cx, JSString *str);
+void AssertValidValue(JSContext *cx, Value *v);
+#endif
+
 } // namespace jit
 } // namespace js
 

From 4ceee932039c330ca518350deaffa80d26f7a78c Mon Sep 17 00:00:00 2001
From: Peiyong Lin <pylaurent1314@gmail.com>
Date: Sat, 14 Dec 2013 08:56:28 -0800
Subject: [PATCH 393/459] Bug 950072 - Metro "View Source" menu item should
 open a "child" tab. r=mbrubeck

---
 browser/metro/base/content/ContextCommands.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/metro/base/content/ContextCommands.js b/browser/metro/base/content/ContextCommands.js
index 04325807a58b..bafc1ba929d6 100644
--- a/browser/metro/base/content/ContextCommands.js
+++ b/browser/metro/base/content/ContextCommands.js
@@ -288,7 +288,7 @@ var ContextCommands = {
   viewPageSource: function cc_viewPageSource() {
     let uri = this.getPageSource();
     if (uri) {
-      BrowserUI.addAndShowTab(uri);
+      BrowserUI.addAndShowTab(uri, Browser.selectedTab);
     }
   },
 

From d45bc9ce29c26505598bfa236017dea3c2d750d8 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sun, 15 Dec 2013 21:11:31 -0800
Subject: [PATCH 394/459] Bug 945189 - Disable test_bug602838.html on gonk for
 constant failures

--HG--
extra : rebase_source : 855afa97756a21c6ea2443d883f8c05b5b094c1c
---
 content/base/test/mochitest.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/base/test/mochitest.ini b/content/base/test/mochitest.ini
index 7371cbcec90a..bad78d43726e 100644
--- a/content/base/test/mochitest.ini
+++ b/content/base/test/mochitest.ini
@@ -438,6 +438,7 @@ support-files =
 [test_bug599588.html]
 [test_bug601803.html]
 [test_bug602838.html]
+skip-if = toolkit == "gonk" # bug 945189
 [test_bug604592.html]
 [test_bug604660.html]
 [test_bug605982.html]

From fde711cd6778aa930cdf1ba40a59d40e9fe2d0b1 Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sun, 15 Dec 2013 21:14:50 -0800
Subject: [PATCH 395/459] Bug 934301 - Disable test_bug450930.xhtml for
 constant failures

--HG--
extra : rebase_source : 9d1dc6c2ff2875272abb0af06d6eb769065e5777
---
 layout/base/tests/mochitest.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/layout/base/tests/mochitest.ini b/layout/base/tests/mochitest.ini
index ba4998d17491..48ec600ab198 100644
--- a/layout/base/tests/mochitest.ini
+++ b/layout/base/tests/mochitest.ini
@@ -73,6 +73,7 @@ skip-if = true # Bug 492575
 [test_bug423523.html]
 [test_bug449781.html]
 [test_bug450930.xhtml]
+skip-if = true # bug 934301
 support-files = bug450930.xhtml
 [test_bug465448.xul]
 [test_bug469170.html]

From abeca479be2d06a74ac516aa300b5207cb63ee5a Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sun, 15 Dec 2013 21:17:52 -0800
Subject: [PATCH 396/459] Bug 934057 - Disable test_notifications_popup.html on
 Linux for constant failures

--HG--
extra : rebase_source : 1c585e1593ccfbcc5613ebe07aed594a0e8c762b
---
 toolkit/components/passwordmgr/test/mochitest.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/toolkit/components/passwordmgr/test/mochitest.ini b/toolkit/components/passwordmgr/test/mochitest.ini
index 6bcf59ea3f54..1fdcba64748c 100644
--- a/toolkit/components/passwordmgr/test/mochitest.ini
+++ b/toolkit/components/passwordmgr/test/mochitest.ini
@@ -59,6 +59,7 @@ skip-if = true
 [test_maxforms_3.html]
 [test_notifications.html]
 [test_notifications_popup.html]
+skip-if = os == "linux" # bug 934057
 [test_prompt_async.html]
 [test_xhr.html]
 [test_xml_load.html]

From 9a1498bda79bc90ad8d671e506e44fb156898c36 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Mon, 16 Dec 2013 18:37:47 +1300
Subject: [PATCH 397/459] Bug 948848 - Fold transform scale factors down to
 leaf layers even for temporary layer managers since it can make a difference
 for clips that are snapped to pixel boundaries. r=roc

---
 layout/base/FrameLayerBuilder.cpp | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 2f0853c9be8e..9505e2e747ae 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -2844,11 +2844,8 @@ ChooseScaleAndSetTransform(FrameLayerBuilder* aLayerBuilder,
 
   bool canDraw2D = transform.CanDraw2D(&transform2d);
   gfxSize scale;
-  bool isRetained = aLayer->Manager()->IsWidgetLayerManager();
-  // Only fiddle with scale factors for the retaining layer manager, since
-  // it only matters for retained layers
   // XXX Should we do something for 3D transforms?
-  if (canDraw2D && isRetained) {
+  if (canDraw2D) {
     // If the container's transform is animated off main thread, then use the
     // maximum scale.
     if (aContainerFrame->GetContent() &&
@@ -2910,6 +2907,7 @@ ChooseScaleAndSetTransform(FrameLayerBuilder* aLayerBuilder,
       aOutgoingScale.mInActiveTransformedSubtree = true;
     }
   }
+  bool isRetained = aLayer->Manager()->IsWidgetLayerManager();
   if (isRetained && (!canDraw2D || transform2d.HasNonIntegerTranslation())) {
     aOutgoingScale.mDisableSubpixelAntialiasingInDescendants = true;
   }

From 0b806c91706165d1d5df8764ea6162a13e30c131 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Mon, 16 Dec 2013 18:38:42 +1300
Subject: [PATCH 398/459] Bug 913503 - Update windowed plugin positions before
 we schedule a composite with OMTC. r=roc

---
 gfx/layers/Layers.h                       | 10 ++++++-
 gfx/layers/client/ClientLayerManager.cpp  | 16 ++++++++---
 gfx/layers/client/ClientLayerManager.h    |  4 ++-
 gfx/layers/ipc/CompositorParent.cpp       | 35 ++++++++++++++++-------
 gfx/layers/ipc/CompositorParent.h         |  6 ++--
 gfx/layers/ipc/LayerTransactionParent.cpp |  8 ++++--
 gfx/layers/ipc/LayerTransactionParent.h   |  4 ++-
 gfx/layers/ipc/PCompositor.ipdl           |  3 ++
 gfx/layers/ipc/PLayerTransaction.ipdl     |  4 +--
 gfx/layers/ipc/ShadowLayers.cpp           |  6 ++--
 gfx/layers/ipc/ShadowLayers.h             |  2 +-
 gfx/layers/ipc/ShadowLayersManager.h      |  3 +-
 layout/base/nsDisplayList.cpp             | 15 +++++++++-
 layout/base/nsLayoutUtils.cpp             | 21 ++++++++++++++
 layout/ipc/RenderFrameParent.cpp          |  3 +-
 layout/ipc/RenderFrameParent.h            |  3 +-
 16 files changed, 111 insertions(+), 32 deletions(-)

diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 38721dd66fff..e24778a5538f 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -219,7 +219,8 @@ public:
   enum EndTransactionFlags {
     END_DEFAULT = 0,
     END_NO_IMMEDIATE_REDRAW = 1 << 0,  // Do not perform the drawing phase
-    END_NO_COMPOSITE = 1 << 1 // Do not composite after drawing thebes layer contents.
+    END_NO_COMPOSITE = 1 << 1, // Do not composite after drawing thebes layer contents.
+    END_NO_REMOTE_COMPOSITE = 1 << 2 // Do not schedule a composition with a remote Compositor, if one exists.
   };
 
   FrameLayerBuilder* GetLayerBuilder() {
@@ -280,6 +281,13 @@ public:
                               void* aCallbackData,
                               EndTransactionFlags aFlags = END_DEFAULT) = 0;
 
+  /**
+   * Schedule a composition with the remote Compositor, if one exists
+   * for this LayerManager. Useful in conjunction with the END_NO_REMOTE_COMPOSITE
+   * flag to EndTransaction.
+   */
+  virtual void Composite() {}
+
   virtual bool HasShadowManagerInternal() const { return false; }
   bool HasShadowManager() const { return HasShadowManagerInternal(); }
 
diff --git a/gfx/layers/client/ClientLayerManager.cpp b/gfx/layers/client/ClientLayerManager.cpp
index 9270cea2a3fb..72cd6a654ac6 100644
--- a/gfx/layers/client/ClientLayerManager.cpp
+++ b/gfx/layers/client/ClientLayerManager.cpp
@@ -209,7 +209,7 @@ ClientLayerManager::EndTransaction(DrawThebesLayerCallback aCallback,
     mWidget->PrepareWindowEffects();
   }
   EndTransactionInternal(aCallback, aCallbackData, aFlags);
-  ForwardTransaction();
+  ForwardTransaction(!(aFlags & END_NO_REMOTE_COMPOSITE));
 
   if (mRepeatTransaction) {
     mRepeatTransaction = false;
@@ -239,7 +239,7 @@ ClientLayerManager::EndEmptyTransaction(EndTransactionFlags aFlags)
   if (mWidget) {
     mWidget->PrepareWindowEffects();
   }
-  ForwardTransaction();
+  ForwardTransaction(!(aFlags & END_NO_REMOTE_COMPOSITE));
   MakeSnapshotIfRequired();
   return true;
 }
@@ -254,6 +254,14 @@ ClientLayerManager::GetRemoteRenderer()
   return mWidget->GetRemoteRenderer();
 }
 
+void
+ClientLayerManager::Composite()
+{
+  if (CompositorChild* remoteRenderer = GetRemoteRenderer()) {
+    remoteRenderer->SendForceComposite();
+  }
+}
+
 void 
 ClientLayerManager::MakeSnapshotIfRequired()
 {
@@ -328,14 +336,14 @@ ClientLayerManager::StopFrameTimeRecording(uint32_t         aStartIndex,
 }
 
 void
-ClientLayerManager::ForwardTransaction()
+ClientLayerManager::ForwardTransaction(bool aScheduleComposite)
 {
   mPhase = PHASE_FORWARD;
 
   // forward this transaction's changeset to our LayerManagerComposite
   bool sent;
   AutoInfallibleTArray<EditReply, 10> replies;
-  if (HasShadowManager() && mForwarder->EndTransaction(&replies, &sent)) {
+  if (HasShadowManager() && mForwarder->EndTransaction(&replies, aScheduleComposite, &sent)) {
     for (nsTArray<EditReply>::size_type i = 0; i < replies.Length(); ++i) {
       const EditReply& reply = replies[i];
 
diff --git a/gfx/layers/client/ClientLayerManager.h b/gfx/layers/client/ClientLayerManager.h
index ddff4448933d..1a6e8b3404fe 100644
--- a/gfx/layers/client/ClientLayerManager.h
+++ b/gfx/layers/client/ClientLayerManager.h
@@ -152,6 +152,8 @@ public:
   }
   bool NeedsComposite() const { return mNeedsComposite; }
 
+  virtual void Composite() MOZ_OVERRIDE;
+
 protected:
   enum TransactionPhase {
     PHASE_NONE, PHASE_CONSTRUCTION, PHASE_DRAWING, PHASE_FORWARD
@@ -162,7 +164,7 @@ private:
   /**
    * Forward transaction results to the parent context.
    */
-  void ForwardTransaction();
+  void ForwardTransaction(bool aScheduleComposite);
 
   /**
    * Take a snapshot of the parent context, and copy
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index 079c9891b0ff..f39839344aa0 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -334,6 +334,13 @@ CompositorParent::RecvFlushRendering()
   return true;
 }
 
+bool
+CompositorParent::RecvForceComposite()
+{
+  ScheduleComposition();
+  return true;
+}
+
 bool
 CompositorParent::RecvNotifyRegionInvalidated(const nsIntRegion& aRegion)
 {
@@ -499,7 +506,7 @@ CompositorParent::ScheduleTask(CancelableTask* task, int time)
 }
 
 void
-CompositorParent::NotifyShadowTreeTransaction(uint64_t aId, bool aIsFirstPaint)
+CompositorParent::NotifyShadowTreeTransaction(uint64_t aId, bool aIsFirstPaint, bool aScheduleComposite)
 {
   if (mApzcTreeManager &&
       mLayerManager &&
@@ -509,7 +516,9 @@ CompositorParent::NotifyShadowTreeTransaction(uint64_t aId, bool aIsFirstPaint)
 
     mCompositor->NotifyLayersTransaction();
   }
-  ScheduleComposition();
+  if (aScheduleComposite) {
+    ScheduleComposition();
+  }
 }
 
 // Used when layout.frame_rate is -1. Needs to be kept in sync with
@@ -668,9 +677,10 @@ SetShadowProperties(Layer* aLayer)
 void
 CompositorParent::ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
                                       const TargetConfig& aTargetConfig,
-                                      bool isFirstPaint)
+                                      bool aIsFirstPaint,
+                                      bool aScheduleComposite)
 {
-  if (!isFirstPaint &&
+  if (!aIsFirstPaint &&
       !mCompositionManager->IsFirstPaint() &&
       mCompositionManager->RequiresReorientation(aTargetConfig.orientation())) {
     if (mForceCompositionTask != nullptr) {
@@ -685,13 +695,13 @@ CompositorParent::ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
   // race condition.
   mLayerManager->UpdateRenderBounds(aTargetConfig.clientBounds());
 
-  mCompositionManager->Updated(isFirstPaint, aTargetConfig);
+  mCompositionManager->Updated(aIsFirstPaint, aTargetConfig);
   Layer* root = aLayerTree->GetRoot();
   mLayerManager->SetRoot(root);
 
   if (mApzcTreeManager) {
     AutoResolveRefLayers resolve(mCompositionManager);
-    mApzcTreeManager->UpdatePanZoomControllerTree(this, root, isFirstPaint, mRootLayerTreeID);
+    mApzcTreeManager->UpdatePanZoomControllerTree(this, root, aIsFirstPaint, mRootLayerTreeID);
   }
 
   if (root) {
@@ -700,7 +710,9 @@ CompositorParent::ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
       mCompositionManager->TransformShadowTree(mTestTime);
     }
   }
-  ScheduleComposition();
+  if (aScheduleComposite) {
+    ScheduleComposition();
+  }
   mCompositor->NotifyLayersTransaction();
 }
 
@@ -978,6 +990,7 @@ public:
                                 SurfaceDescriptor* aOutSnapshot)
   { return true; }
   virtual bool RecvFlushRendering() MOZ_OVERRIDE { return true; }
+  virtual bool RecvForceComposite() MOZ_OVERRIDE { return true; }
   virtual bool RecvNotifyRegionInvalidated(const nsIntRegion& aRegion) { return true; }
   virtual bool RecvStartFrameTimeRecording(const int32_t& aBufferSize, uint32_t* aOutStartIndex) MOZ_OVERRIDE { return true; }
   virtual bool RecvStopFrameTimeRecording(const uint32_t& aStartIndex, InfallibleTArray<float>* intervals) MOZ_OVERRIDE  { return true; }
@@ -992,7 +1005,8 @@ public:
 
   virtual void ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
                                    const TargetConfig& aTargetConfig,
-                                   bool isFirstPaint) MOZ_OVERRIDE;
+                                   bool aIsFirstPaint,
+                                   bool aScheduleComposite) MOZ_OVERRIDE;
 
 private:
   void DeferredDestroy();
@@ -1128,7 +1142,8 @@ void
 CrossProcessCompositorParent::ShadowLayersUpdated(
   LayerTransactionParent* aLayerTree,
   const TargetConfig& aTargetConfig,
-  bool isFirstPaint)
+  bool aIsFirstPaint,
+  bool aScheduleComposite)
 {
   uint64_t id = aLayerTree->GetId();
   MOZ_ASSERT(id != 0);
@@ -1138,7 +1153,7 @@ CrossProcessCompositorParent::ShadowLayersUpdated(
   }
   UpdateIndirectTree(id, shadowRoot, aTargetConfig);
 
-  sIndirectLayerTrees[id].mParent->NotifyShadowTreeTransaction(id, isFirstPaint);
+  sIndirectLayerTrees[id].mParent->NotifyShadowTreeTransaction(id, aIsFirstPaint, aScheduleComposite);
 }
 
 void
diff --git a/gfx/layers/ipc/CompositorParent.h b/gfx/layers/ipc/CompositorParent.h
index cfe5a425738d..d83212af5ff9 100644
--- a/gfx/layers/ipc/CompositorParent.h
+++ b/gfx/layers/ipc/CompositorParent.h
@@ -88,6 +88,7 @@ public:
   virtual bool RecvMakeSnapshot(const SurfaceDescriptor& aInSnapshot,
                                 SurfaceDescriptor* aOutSnapshot);
   virtual bool RecvFlushRendering() MOZ_OVERRIDE;
+  virtual bool RecvForceComposite() MOZ_OVERRIDE;
 
   virtual bool RecvNotifyRegionInvalidated(const nsIntRegion& aRegion) MOZ_OVERRIDE;
   virtual bool RecvStartFrameTimeRecording(const int32_t& aBufferSize, uint32_t* aOutStartIndex) MOZ_OVERRIDE;
@@ -97,7 +98,8 @@ public:
 
   virtual void ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
                                    const TargetConfig& aTargetConfig,
-                                   bool isFirstPaint) MOZ_OVERRIDE;
+                                   bool aIsFirstPaint,
+                                   bool aScheduleComposite) MOZ_OVERRIDE;
   /**
    * This forces the is-first-paint flag to true. This is intended to
    * be called by the widget code when it loses its viewport information
@@ -122,7 +124,7 @@ public:
   bool ScheduleResumeOnCompositorThread(int width, int height);
 
   virtual void ScheduleComposition();
-  void NotifyShadowTreeTransaction(uint64_t aId, bool aIsFirstPaint);
+  void NotifyShadowTreeTransaction(uint64_t aId, bool aIsFirstPaint, bool aScheduleComposite);
 
   /**
    * Returns the unique layer tree identifier that corresponds to the root
diff --git a/gfx/layers/ipc/LayerTransactionParent.cpp b/gfx/layers/ipc/LayerTransactionParent.cpp
index 6793eb711d5b..ff9887a0b323 100644
--- a/gfx/layers/ipc/LayerTransactionParent.cpp
+++ b/gfx/layers/ipc/LayerTransactionParent.cpp
@@ -178,15 +178,17 @@ LayerTransactionParent::Destroy()
 bool
 LayerTransactionParent::RecvUpdateNoSwap(const InfallibleTArray<Edit>& cset,
                                          const TargetConfig& targetConfig,
-                                         const bool& isFirstPaint)
+                                         const bool& isFirstPaint,
+                                         const bool& scheduleComposite)
 {
-  return RecvUpdate(cset, targetConfig, isFirstPaint, nullptr);
+  return RecvUpdate(cset, targetConfig, isFirstPaint, scheduleComposite, nullptr);
 }
 
 bool
 LayerTransactionParent::RecvUpdate(const InfallibleTArray<Edit>& cset,
                                    const TargetConfig& targetConfig,
                                    const bool& isFirstPaint,
+                                   const bool& scheduleComposite,
                                    InfallibleTArray<EditReply>* reply)
 {
   profiler_tracing("Paint", "Composite", TRACING_INTERVAL_START);
@@ -450,7 +452,7 @@ LayerTransactionParent::RecvUpdate(const InfallibleTArray<Edit>& cset,
   // other's buffer contents.
   LayerManagerComposite::PlatformSyncBeforeReplyUpdate();
 
-  mShadowLayersManager->ShadowLayersUpdated(this, targetConfig, isFirstPaint);
+  mShadowLayersManager->ShadowLayersUpdated(this, targetConfig, isFirstPaint, scheduleComposite);
 
 #ifdef COMPOSITOR_PERFORMANCE_WARNING
   int compositeTime = (int)(mozilla::TimeStamp::Now() - updateStart).ToMilliseconds();
diff --git a/gfx/layers/ipc/LayerTransactionParent.h b/gfx/layers/ipc/LayerTransactionParent.h
index f49a5b550ae4..533b913bffa6 100644
--- a/gfx/layers/ipc/LayerTransactionParent.h
+++ b/gfx/layers/ipc/LayerTransactionParent.h
@@ -81,11 +81,13 @@ protected:
   virtual bool RecvUpdate(const EditArray& cset,
                           const TargetConfig& targetConfig,
                           const bool& isFirstPaint,
+                          const bool& scheduleComposite,
                           EditReplyArray* reply) MOZ_OVERRIDE;
 
   virtual bool RecvUpdateNoSwap(const EditArray& cset,
                                 const TargetConfig& targetConfig,
-                                const bool& isFirstPaint) MOZ_OVERRIDE;
+                                const bool& isFirstPaint,
+                                const bool& scheduleComposite) MOZ_OVERRIDE;
 
   virtual bool RecvClearCachedResources() MOZ_OVERRIDE;
   virtual bool RecvGetOpacity(PLayerParent* aParent,
diff --git a/gfx/layers/ipc/PCompositor.ipdl b/gfx/layers/ipc/PCompositor.ipdl
index 5ef6d0222ded..d7301ce46c44 100644
--- a/gfx/layers/ipc/PCompositor.ipdl
+++ b/gfx/layers/ipc/PCompositor.ipdl
@@ -64,6 +64,9 @@ parent:
   // block until they are completed.
   sync FlushRendering();
 
+  // Schedule a composite if one isn't already scheduled.
+  async ForceComposite();
+
   sync StartFrameTimeRecording(int32_t bufferSize)
     returns (uint32_t startIndex);
 
diff --git a/gfx/layers/ipc/PLayerTransaction.ipdl b/gfx/layers/ipc/PLayerTransaction.ipdl
index 3a6a40ced491..e89a3e7a814d 100644
--- a/gfx/layers/ipc/PLayerTransaction.ipdl
+++ b/gfx/layers/ipc/PLayerTransaction.ipdl
@@ -72,7 +72,7 @@ parent:
 
   // The isFirstPaint flag can be used to indicate that this is the first update
   // for a particular document.
-  sync Update(Edit[] cset, TargetConfig targetConfig, bool isFirstPaint)
+  sync Update(Edit[] cset, TargetConfig targetConfig, bool isFirstPaint, bool scheduleComposite)
     returns (EditReply[] reply);
 
   sync GetOpacity(PLayer layer) returns (float opacity);
@@ -80,7 +80,7 @@ parent:
 
   // We don't need to send a sync transaction if
   // no transaction operate require a swap.
-  async UpdateNoSwap(Edit[] cset, TargetConfig targetConfig, bool isFirstPaint);
+  async UpdateNoSwap(Edit[] cset, TargetConfig targetConfig, bool isFirstPaint, bool scheduleComposite);
 
   // Drop any front buffers that might be retained on the compositor
   // side.
diff --git a/gfx/layers/ipc/ShadowLayers.cpp b/gfx/layers/ipc/ShadowLayers.cpp
index ed9cdf167e0b..f7bba640ab7e 100644
--- a/gfx/layers/ipc/ShadowLayers.cpp
+++ b/gfx/layers/ipc/ShadowLayers.cpp
@@ -440,7 +440,7 @@ ShadowLayerForwarder::RemoveTexture(TextureClient* aTexture)
 }
 
 bool
-ShadowLayerForwarder::EndTransaction(InfallibleTArray<EditReply>* aReplies, bool* aSent)
+ShadowLayerForwarder::EndTransaction(InfallibleTArray<EditReply>* aReplies, bool aScheduleComposite, bool* aSent)
 {
   *aSent = false;
 
@@ -546,7 +546,7 @@ ShadowLayerForwarder::EndTransaction(InfallibleTArray<EditReply>* aReplies, bool
     RenderTraceScope rendertrace3("Forward Transaction", "000093");
     if (!HasShadowManager() ||
         !mShadowManager->SendUpdate(cset, targetConfig, mIsFirstPaint,
-                                    aReplies)) {
+                                    aScheduleComposite, aReplies)) {
       MOZ_LAYERS_LOG(("[LayersForwarder] WARNING: sending transaction failed!"));
       return false;
     }
@@ -556,7 +556,7 @@ ShadowLayerForwarder::EndTransaction(InfallibleTArray<EditReply>* aReplies, bool
     MOZ_LAYERS_LOG(("[LayersForwarder] sending no swap transaction..."));
     RenderTraceScope rendertrace3("Forward NoSwap Transaction", "000093");
     if (!HasShadowManager() ||
-        !mShadowManager->SendUpdateNoSwap(cset, targetConfig, mIsFirstPaint)) {
+        !mShadowManager->SendUpdateNoSwap(cset, targetConfig, mIsFirstPaint, aScheduleComposite)) {
       MOZ_LAYERS_LOG(("[LayersForwarder] WARNING: sending transaction failed!"));
       return false;
     }
diff --git a/gfx/layers/ipc/ShadowLayers.h b/gfx/layers/ipc/ShadowLayers.h
index 74ea7ce3e4c5..f1032277d638 100644
--- a/gfx/layers/ipc/ShadowLayers.h
+++ b/gfx/layers/ipc/ShadowLayers.h
@@ -327,7 +327,7 @@ public:
    * |aReplies| are directions from the LayerManagerComposite to the
    * caller of EndTransaction().
    */
-  bool EndTransaction(InfallibleTArray<EditReply>* aReplies, bool* aSent);
+  bool EndTransaction(InfallibleTArray<EditReply>* aReplies, bool aScheduleComposite, bool* aSent);
 
   /**
    * Set an actor through which layer updates will be pushed.
diff --git a/gfx/layers/ipc/ShadowLayersManager.h b/gfx/layers/ipc/ShadowLayersManager.h
index f1fa43b313af..724c06eb768d 100644
--- a/gfx/layers/ipc/ShadowLayersManager.h
+++ b/gfx/layers/ipc/ShadowLayersManager.h
@@ -18,7 +18,8 @@ class ShadowLayersManager
 public:
     virtual void ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
                                      const TargetConfig& aTargetConfig,
-                                     bool isFirstPaint) = 0;
+                                     bool aIsFirstPaint,
+                                     bool aScheduleComposite) = 0;
 };
 
 } // layers
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index b2999c012802..810796540f9b 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1205,8 +1205,21 @@ void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
   layerManager->SetRoot(root);
   layerBuilder->WillEndTransaction();
   bool temp = aBuilder->SetIsCompositingCheap(layerManager->IsCompositingCheap());
+  LayerManager::EndTransactionFlags flags = LayerManager::END_DEFAULT;
+  if (layerManager->NeedsWidgetInvalidation()) {
+    // Client layer managers never composite directly, so
+    // we don't need to worry about END_NO_COMPOSITE.
+    if (aBuilder->WillComputePluginGeometry()) {
+      flags = LayerManager::END_NO_REMOTE_COMPOSITE;
+    }
+  } else {
+    if (aFlags & PAINT_NO_COMPOSITE) {
+      flags = LayerManager::END_NO_COMPOSITE;
+    }
+  }
+
   layerManager->EndTransaction(FrameLayerBuilder::DrawThebesLayer,
-                               aBuilder, (aFlags & PAINT_NO_COMPOSITE) ? LayerManager::END_NO_COMPOSITE : LayerManager::END_DEFAULT);
+                               aBuilder, flags);
   aBuilder->SetIsCompositingCheap(temp);
   layerBuilder->DidEndTransaction();
 
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 61c2664f1288..fd72da235dba 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -2376,9 +2376,30 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
   }
 
   if (builder.WillComputePluginGeometry()) {
+    nsRefPtr<LayerManager> layerManager;
+    nsIWidget* widget = aFrame->GetNearestWidget();
+    if (widget) {
+      layerManager = widget->GetLayerManager();
+    }
+
     rootPresContext->ComputePluginGeometryUpdates(aFrame, &builder, &list);
+
+    // We're not going to get a WillPaintWindow event here if we didn't do
+    // widget invalidation, so just apply the plugin geometry update here instead.
+    // We could instead have the compositor send back an equivalent to WillPaintWindow,
+    // but it should be close enough to now not to matter.
+    if (layerManager && !layerManager->NeedsWidgetInvalidation()) {
+      rootPresContext->ApplyPluginGeometryUpdates();
+    }
+
+    // We told the compositor thread not to composite when it received the transaction because
+    // we wanted to update plugins first. Schedule the composite now.
+    if (layerManager) {
+      layerManager->Composite();
+    }
   }
 
+
   // Flush the list so we don't trigger the IsEmpty-on-destruction assertion
   list.DeleteAll();
   return NS_OK;
diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index d402eda36bbc..ee407a9dd29c 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -780,7 +780,8 @@ RenderFrameParent::ContentViewScaleChanged(nsContentView* aView)
 void
 RenderFrameParent::ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
                                        const TargetConfig& aTargetConfig,
-                                       bool isFirstPaint)
+                                       bool aIsFirstPaint,
+                                       bool aScheduleComposite)
 {
   // View map must only contain views that are associated with the current
   // shadow layer tree. We must always update the map when shadow layers
diff --git a/layout/ipc/RenderFrameParent.h b/layout/ipc/RenderFrameParent.h
index c5dd72de166b..b2914dfdea53 100644
--- a/layout/ipc/RenderFrameParent.h
+++ b/layout/ipc/RenderFrameParent.h
@@ -78,7 +78,8 @@ public:
 
   virtual void ShadowLayersUpdated(LayerTransactionParent* aLayerTree,
                                    const TargetConfig& aTargetConfig,
-                                   bool isFirstPaint) MOZ_OVERRIDE;
+                                   bool aIsFirstPaint,
+                                   bool aScheduleComposite) MOZ_OVERRIDE;
 
   void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                         nsSubDocumentFrame* aFrame,

From c2b654599fd94076805f9e90e5c636e344a0eca4 Mon Sep 17 00:00:00 2001
From: Gregory Szorc <gps@mozilla.com>
Date: Sun, 15 Dec 2013 11:43:47 -0800
Subject: [PATCH 399/459] Bug 950370 - Capture WebIDL example interfaces in
 moz.build; r=glandium

Previously, the set of WebIDL example interfaces to build was hardcoded
in the mozwebidlcodegen Python package. Unfortunately, the example
interfaces in that set were dependent on test-only bindings files,
resulting in build failures when tests were disabled (because those
test-only bindings were defined in a test directory).

In this patch, we now declare example interfaces in moz.build files
so the set of example interfaces lives next to the set of defined
bindings files. The example interfaces are defined in a test moz.build
file - in the same file declaring the bindings files that contain the
interfaces - so the example interfaces only get picked up if the
corresponding bindings are defined.

We could probably switch WebIDL moz.build variables to use lists with
flags. That would be good followup fodder. For now, let's fix the build.

--HG--
extra : rebase_source : 00070a6d560625bc84ab9b10d6848ea037f8f5ed
extra : amend_source : 0890ecef444ba58533fcfaa333773d78deafd7f3
---
 dom/bindings/mozwebidlcodegen/__init__.py     | 21 +++++++------------
 .../test/test_mozwebidlcodegen.py             |  3 ++-
 dom/bindings/test/moz.build                   |  5 +++++
 python/mozbuild/mozbuild/backend/common.py    |  5 +++++
 .../mozbuild/backend/recursivemake.py         |  1 +
 python/mozbuild/mozbuild/frontend/data.py     | 14 +++++++++++++
 python/mozbuild/mozbuild/frontend/emitter.py  |  2 ++
 .../mozbuild/frontend/sandbox_symbols.py      |  8 +++++++
 8 files changed, 45 insertions(+), 14 deletions(-)

diff --git a/dom/bindings/mozwebidlcodegen/__init__.py b/dom/bindings/mozwebidlcodegen/__init__.py
index 5516dbb3a1a0..fdbb49164c94 100644
--- a/dom/bindings/mozwebidlcodegen/__init__.py
+++ b/dom/bindings/mozwebidlcodegen/__init__.py
@@ -146,23 +146,17 @@ class WebIDLCodegenManager(LoggingMixin):
         'UnionTypes.cpp',
     }
 
-    # Example interfaces to build along with the tree. Other example
-    # interfaces will need to be generated manually.
-    BUILD_EXAMPLE_INTERFACES = {
-        'TestExampleInterface',
-        'TestExampleProxyInterface',
-    }
-
     def __init__(self, config_path, inputs, exported_header_dir,
         codegen_dir, state_path, cache_dir=None, make_deps_path=None,
         make_deps_target=None):
         """Create an instance that manages WebIDLs in the build system.
 
         config_path refers to a WebIDL config file (e.g. Bindings.conf).
-        inputs is a 3-tuple describing the input .webidl files and how to
+        inputs is a 4-tuple describing the input .webidl files and how to
         process them. Members are:
             (set(.webidl files), set(basenames of exported files),
-                set(basenames of generated events files))
+                set(basenames of generated events files),
+                set(example interface names))
 
         exported_header_dir and codegen_dir are directories where generated
         files will be written to.
@@ -175,12 +169,13 @@ class WebIDLCodegenManager(LoggingMixin):
         """
         self.populate_logger()
 
-        input_paths, exported_stems, generated_events_stems = inputs
+        input_paths, exported_stems, generated_events_stems, example_interfaces = inputs
 
         self._config_path = config_path
         self._input_paths = set(input_paths)
         self._exported_stems = set(exported_stems)
         self._generated_events_stems = set(generated_events_stems)
+        self._example_interfaces = set(example_interfaces)
         self._exported_header_dir = exported_header_dir
         self._codegen_dir = codegen_dir
         self._state_path = state_path
@@ -283,7 +278,7 @@ class WebIDLCodegenManager(LoggingMixin):
             )
 
         # Process some special interfaces required for testing.
-        for interface in self.BUILD_EXAMPLE_INTERFACES:
+        for interface in self._example_interfaces:
             written = self.generate_example_files(interface)
             result.created |= written[0]
             result.updated |= written[1]
@@ -446,7 +441,7 @@ class WebIDLCodegenManager(LoggingMixin):
             stem, binding_stem, is_event, header_dir, files = self._binding_info(p)
             paths |= {f for f in files if f}
 
-        for interface in self.BUILD_EXAMPLE_INTERFACES:
+        for interface in self._example_interfaces:
             for p in self._example_paths(interface):
                 paths.add(p)
 
@@ -533,7 +528,7 @@ def create_build_system_manager(topsrcdir, topobjdir, dist_dir):
         files = json.load(fh)
 
     inputs = (files['webidls'], files['exported_stems'],
-        files['generated_events_stems'])
+        files['generated_events_stems'], files['example_interfaces'])
 
     cache_dir = os.path.join(obj_dir, '_cache')
     try:
diff --git a/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py b/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py
index fd35e8c63485..424daa787894 100644
--- a/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py
+++ b/dom/bindings/mozwebidlcodegen/test/test_mozwebidlcodegen.py
@@ -65,7 +65,8 @@ class TestWebIDLCodegenManager(unittest.TestCase):
         inputs = (
             ip,
             {mozpath.splitext(mozpath.basename(p))[0] for p in ip},
-            set()
+            set(),
+            set(),
         )
 
         return dict(
diff --git a/dom/bindings/test/moz.build b/dom/bindings/test/moz.build
index 5b129eee9e20..e2a4c91f0549 100644
--- a/dom/bindings/test/moz.build
+++ b/dom/bindings/test/moz.build
@@ -26,6 +26,11 @@ PREPROCESSED_TEST_WEBIDL_FILES += [
     'TestJSImplGen.webidl',
 ]
 
+WEBIDL_EXAMPLE_INTERFACES += [
+    'TestExampleInterface',
+    'TestExampleProxyInterface',
+]
+
 LOCAL_INCLUDES += [
     '/dom/bindings',
     '/js/xpconnect/src',
diff --git a/python/mozbuild/mozbuild/backend/common.py b/python/mozbuild/mozbuild/backend/common.py
index 0a6fe8ad4049..6e37197542ea 100644
--- a/python/mozbuild/mozbuild/backend/common.py
+++ b/python/mozbuild/mozbuild/backend/common.py
@@ -14,6 +14,7 @@ from .base import BuildBackend
 
 from ..frontend.data import (
     ConfigFileSubstitution,
+    ExampleWebIDLInterface,
     HeaderFileSubstitution,
     GeneratedEventWebIDLFile,
     GeneratedWebIDLFile,
@@ -70,6 +71,7 @@ class WebIDLCollection(object):
         self.preprocessed_sources = set()
         self.test_sources = set()
         self.preprocessed_test_sources = set()
+        self.example_interfaces = set()
 
     def all_regular_sources(self):
         return self.sources | self.generated_sources | \
@@ -215,6 +217,9 @@ class CommonBackend(BuildBackend):
             self._webidls.preprocessed_sources.add(mozpath.join(
                 obj.srcdir, obj.basename))
 
+        elif isinstance(obj, ExampleWebIDLInterface):
+            self._webidls.example_interfaces.add(obj.name)
+
         else:
             return
 
diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index a909efff8ee4..860809faa84a 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -1135,6 +1135,7 @@ class RecursiveMakeBackend(CommonBackend):
             webidls=sorted(all_inputs),
             generated_events_stems=sorted(generated_events_stems),
             exported_stems=sorted(exported_stems),
+            example_interfaces=sorted(webidls.example_interfaces),
         )
 
         file_lists = mozpath.join(bindings_dir, 'file-lists.json')
diff --git a/python/mozbuild/mozbuild/frontend/data.py b/python/mozbuild/mozbuild/frontend/data.py
index 4ad4ba1d63ee..b4c1bf3934c0 100644
--- a/python/mozbuild/mozbuild/frontend/data.py
+++ b/python/mozbuild/mozbuild/frontend/data.py
@@ -289,6 +289,20 @@ class GeneratedWebIDLFile(SandboxDerived):
 
         self.basename = path
 
+
+class ExampleWebIDLInterface(SandboxDerived):
+    """An individual WebIDL interface to generate."""
+
+    __slots__ = (
+        'name',
+    )
+
+    def __init__(self, sandbox, name):
+        SandboxDerived.__init__(self, sandbox)
+
+        self.name = name
+
+
 class BaseProgram(SandboxDerived):
     """Sandbox container object for programs, which is a unicode string.
 
diff --git a/python/mozbuild/mozbuild/frontend/emitter.py b/python/mozbuild/mozbuild/frontend/emitter.py
index e6374da5a8d6..6d7728b524d2 100644
--- a/python/mozbuild/mozbuild/frontend/emitter.py
+++ b/python/mozbuild/mozbuild/frontend/emitter.py
@@ -24,6 +24,7 @@ from .data import (
     GeneratedEventWebIDLFile,
     GeneratedInclude,
     GeneratedWebIDLFile,
+    ExampleWebIDLInterface,
     HeaderFileSubstitution,
     HostProgram,
     HostSimpleProgram,
@@ -321,6 +322,7 @@ class TreeMetadataEmitter(LoggingMixin):
             ('PREPROCESSED_WEBIDL_FILES', PreprocessedWebIDLFile),
             ('TEST_WEBIDL_FILES', TestWebIDLFile),
             ('WEBIDL_FILES', WebIDLFile),
+            ('WEBIDL_EXAMPLE_INTERFACES', ExampleWebIDLInterface),
         ]
         for sandbox_var, klass in simple_lists:
             for name in sandbox.get(sandbox_var, []):
diff --git a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
index 1c8c99db3501..633c96403152 100644
--- a/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
+++ b/python/mozbuild/mozbuild/frontend/sandbox_symbols.py
@@ -502,6 +502,14 @@ VARIABLES = {
          These will be preprocessed before being parsed and converted.
          """, 'export'),
 
+    'WEBIDL_EXAMPLE_INTERFACES': (StrictOrderingOnAppendList, list,
+        """Names of example WebIDL interfaces to build as part of the build.
+
+        Names in this list correspond to WebIDL interface names defined in
+        WebIDL files included in the build from one of the \*WEBIDL_FILES
+        variables.
+        """, 'export'),
+
     # Test declaration.
     'A11Y_MANIFESTS': (StrictOrderingOnAppendList, list,
         """List of manifest files defining a11y tests.

From b51b6f7228c98301cc045fbc121de658de93d794 Mon Sep 17 00:00:00 2001
From: Matt Woodrow <mwoodrow@mozilla.com>
Date: Mon, 16 Dec 2013 21:05:20 +1300
Subject: [PATCH 400/459] Bug 913503 - Fix reversed if() condition to fix
 bustage.

---
 layout/base/nsDisplayList.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 810796540f9b..259b896e76f9 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1207,15 +1207,15 @@ void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
   bool temp = aBuilder->SetIsCompositingCheap(layerManager->IsCompositingCheap());
   LayerManager::EndTransactionFlags flags = LayerManager::END_DEFAULT;
   if (layerManager->NeedsWidgetInvalidation()) {
+    if (aFlags & PAINT_NO_COMPOSITE) {
+      flags = LayerManager::END_NO_COMPOSITE;
+    }
+  } else {
     // Client layer managers never composite directly, so
     // we don't need to worry about END_NO_COMPOSITE.
     if (aBuilder->WillComputePluginGeometry()) {
       flags = LayerManager::END_NO_REMOTE_COMPOSITE;
     }
-  } else {
-    if (aFlags & PAINT_NO_COMPOSITE) {
-      flags = LayerManager::END_NO_COMPOSITE;
-    }
   }
 
   layerManager->EndTransaction(FrameLayerBuilder::DrawThebesLayer,

From 263d3452ce0c720865235ff7fd043539be8bc30d Mon Sep 17 00:00:00 2001
From: Raymond Etornam Agbeame <mozbugs.retornam@gmail.com>
Date: Mon, 16 Dec 2013 00:09:21 -0800
Subject: [PATCH 401/459] Bug 945857: Remove the
 security.fresh_revocation_info.require preference, r=briansmith

---
 security/manager/ssl/src/CertVerifier.cpp   | 9 +--------
 security/manager/ssl/src/CertVerifier.h     | 3 ---
 security/manager/ssl/src/nsNSSComponent.cpp | 6 +-----
 3 files changed, 2 insertions(+), 16 deletions(-)

diff --git a/security/manager/ssl/src/CertVerifier.cpp b/security/manager/ssl/src/CertVerifier.cpp
index 39b54c403a74..47173be6a18f 100644
--- a/security/manager/ssl/src/CertVerifier.cpp
+++ b/security/manager/ssl/src/CertVerifier.cpp
@@ -24,13 +24,11 @@ CertVerifier::CertVerifier(missing_cert_download_config mcdc,
                            crl_download_config cdc,
                            ocsp_download_config odc,
                            ocsp_strict_config osc,
-                           any_revo_fresh_config arfc,
                            ocsp_get_config ogc)
   : mMissingCertDownloadEnabled(mcdc == missing_cert_download_on)
   , mCRLDownloadEnabled(cdc == crl_download_allowed)
   , mOCSPDownloadEnabled(odc == ocsp_on)
   , mOCSPStrict(osc == ocsp_strict)
-  , mRequireRevocationInfo(arfc == any_revo_strict)
   , mOCSPGETEnabled(ogc == ocsp_get_enabled)
 {
   MOZ_COUNT_CTOR(CertVerifier);
@@ -378,12 +376,7 @@ CertVerifier::VerifyCert(CERTCertificate * cert,
   rev.leafTests.cert_rev_method_independent_flags =
   rev.chainTests.cert_rev_method_independent_flags =
     // avoiding the network is good, let's try local first
-    CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST
-
-    // is overall revocation requirement strict or relaxed?
-    | (mRequireRevocationInfo ?
-       CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE : CERT_REV_MI_NO_OVERALL_INFO_REQUIREMENT)
-    ;
+    CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST;
 
   // Skip EV parameters
   cvin[evParamLocation].type = cert_pi_end;
diff --git a/security/manager/ssl/src/CertVerifier.h b/security/manager/ssl/src/CertVerifier.h
index 4eb267f0fced..7afedb0c7a10 100644
--- a/security/manager/ssl/src/CertVerifier.h
+++ b/security/manager/ssl/src/CertVerifier.h
@@ -39,7 +39,6 @@ public:
   enum crl_download_config { crl_local_only = 0, crl_download_allowed };
   enum ocsp_download_config { ocsp_off = 0, ocsp_on };
   enum ocsp_strict_config { ocsp_relaxed = 0, ocsp_strict };
-  enum any_revo_fresh_config { any_revo_relaxed = 0, any_revo_strict };
   enum ocsp_get_config { ocsp_get_disabled = 0, ocsp_get_enabled = 1 };
 
   bool IsOCSPDownloadEnabled() const { return mOCSPDownloadEnabled; }
@@ -47,7 +46,6 @@ public:
 private:
   CertVerifier(missing_cert_download_config ac, crl_download_config cdc,
                ocsp_download_config odc, ocsp_strict_config osc,
-               any_revo_fresh_config arfc,
                ocsp_get_config ogc);
   ~CertVerifier();
 
@@ -55,7 +53,6 @@ private:
   const bool mCRLDownloadEnabled;
   const bool mOCSPDownloadEnabled;
   const bool mOCSPStrict;
-  const bool mRequireRevocationInfo;
   const bool mOCSPGETEnabled;
   friend class ::nsNSSComponent;
 };
diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp
index 6d9e98850c38..97c7a37a86a2 100644
--- a/security/manager/ssl/src/nsNSSComponent.cpp
+++ b/security/manager/ssl/src/nsNSSComponent.cpp
@@ -1005,8 +1005,6 @@ void nsNSSComponent::setValidationOptions()
                                             OCSP_ENABLED_DEFAULT);
 
   bool ocspRequired = Preferences::GetBool("security.OCSP.require", false);
-  bool anyFreshRequired = Preferences::GetBool("security.fresh_revocation_info.require",
-                                               false);
   bool aiaDownloadEnabled = Preferences::GetBool("security.missing_cert_download.enabled",
                                                  false);
 
@@ -1025,7 +1023,7 @@ void nsNSSComponent::setValidationOptions()
                            : ocspMode_FailureIsNotAVerificationFailure);
 
   int OCSPTimeoutSeconds = 3;
-  if (ocspRequired || anyFreshRequired) {
+  if (ocspRequired) {
     OCSPTimeoutSeconds = 10;
   }
   CERT_SetOCSPTimeout(OCSPTimeoutSeconds);
@@ -1043,8 +1041,6 @@ void nsNSSComponent::setValidationOptions()
         CertVerifier::ocsp_on : CertVerifier::ocsp_off,
       ocspRequired ? 
         CertVerifier::ocsp_strict : CertVerifier::ocsp_relaxed,
-      anyFreshRequired ?
-        CertVerifier::any_revo_strict : CertVerifier::any_revo_relaxed,
       ocspGetEnabled ?
         CertVerifier::ocsp_get_enabled : CertVerifier::ocsp_get_disabled);
 

From b0566b0cdaacf9b7f027ba466cc84400a86ec915 Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@briansmith.org>
Date: Mon, 16 Dec 2013 00:39:11 -0800
Subject: [PATCH 402/459] Back out cset 1566a2e95c3b (bug 950505) for build
 failure on Windows when warnings are treated as errors

---
 content/media/wmf/WMFUtils.h | 5 -----
 content/media/wmf/moz.build  | 2 +-
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/content/media/wmf/WMFUtils.h b/content/media/wmf/WMFUtils.h
index 89cdfb92d339..0e39f9aabe82 100644
--- a/content/media/wmf/WMFUtils.h
+++ b/content/media/wmf/WMFUtils.h
@@ -4,9 +4,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef WMFUtils_h
-#define WMFUtils_h
-
 #include "WMF.h"
 #include "nsString.h"
 #include "nsRect.h"
@@ -102,5 +99,3 @@ IsFlagSet(DWORD flags, DWORD pattern) {
 }
 
 } // namespace mozilla
-
-#endif
diff --git a/content/media/wmf/moz.build b/content/media/wmf/moz.build
index ebdc76d0cccf..48baf30f9cbb 100644
--- a/content/media/wmf/moz.build
+++ b/content/media/wmf/moz.build
@@ -12,7 +12,7 @@ EXPORTS += [
     'WMFUtils.h',
 ]
 
-UNIFIED_SOURCES += [
+SOURCES += [
     'DXVA2Manager.cpp',
     'WMFByteStream.cpp',
     'WMFDecoder.cpp',

From 2d5a13b2ca18527e7d4a37c6ccb44628e2e26a5b Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@briansmith.org>
Date: Mon, 16 Dec 2013 00:39:13 -0800
Subject: [PATCH 403/459] Back out cset caa78bef50e3 (bug 950506) for build
 failure on Windows when warnings are treated as errors

---
 content/media/MP3FrameParser.h     | 5 -----
 content/media/directshow/moz.build | 2 +-
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/content/media/MP3FrameParser.h b/content/media/MP3FrameParser.h
index ff68c256b86a..e50a6bcc96b3 100644
--- a/content/media/MP3FrameParser.h
+++ b/content/media/MP3FrameParser.h
@@ -4,9 +4,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef MP3FrameParser_h
-#define MP3FrameParser_h
-
 #include <stdint.h>
 
 #include "mozilla/Mutex.h"
@@ -208,5 +205,3 @@ private:
 };
 
 }
-
-#endif
diff --git a/content/media/directshow/moz.build b/content/media/directshow/moz.build
index 5119f58f7db7..6f958231b718 100644
--- a/content/media/directshow/moz.build
+++ b/content/media/directshow/moz.build
@@ -12,7 +12,7 @@ EXPORTS += [
     'DirectShowUtils.h',
 ]
 
-UNIFIED_SOURCES += [
+SOURCES += [
     'AudioSinkFilter.cpp',
     'AudioSinkInputPin.cpp',
     'DirectShowDecoder.cpp',

From 99c6b940f4e36cc677860dcde1c2298e273d2268 Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@briansmith.org>
Date: Mon, 16 Dec 2013 00:39:15 -0800
Subject: [PATCH 404/459] Back out cset bce074481220 (bug 950507) for build
 failure on Windows when warnings are treated as errors

---
 content/media/fmp4/moz.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/media/fmp4/moz.build b/content/media/fmp4/moz.build
index d83fd7d3f52b..fc63df6aef82 100644
--- a/content/media/fmp4/moz.build
+++ b/content/media/fmp4/moz.build
@@ -30,7 +30,7 @@ EXPORTS.mp4_demuxer += [
     'demuxer/video_util.h',
 ]
 
-UNIFIED_SOURCES += [
+SOURCES += [
     'BlankDecoderModule.cpp',
     'demuxer/aac.cc',
     'demuxer/audio_decoder_config.cc',
@@ -58,7 +58,7 @@ if CONFIG['MOZ_WMF']:
       'wmf/WMFDecoderModule.h',
       'wmf/WMFVideoDecoder.h',
   ]
-  UNIFIED_SOURCES += [
+  SOURCES += [
       'wmf/MFTDecoder.cpp',
       'wmf/WMFAudioDecoder.cpp',
       'wmf/WMFDecoderModule.cpp',

From b7bb947338c8771be1557fe0c9d47f22ee3f70ce Mon Sep 17 00:00:00 2001
From: Peter Van der Beken <peterv@propagandism.org>
Date: Sat, 14 Dec 2013 18:52:12 +0100
Subject: [PATCH 405/459] Bug 938640 - Move GetTopImpl. r=bz.

---
 dom/base/nsGlobalWindow.cpp | 46 ++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index dbcc1f5078fe..19d9d70b2626 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -3624,29 +3624,6 @@ nsGlobalWindow::GetRealParent(nsIDOMWindow** aParent)
   return NS_OK;
 }
 
-/**
- * GetScriptableTop is called when script reads window.top.
- *
- * In contrast to GetRealTop, GetScriptableTop respects <iframe mozbrowser>
- * boundaries.  If we encounter a window owned by an <iframe mozbrowser> while
- * walking up the window hierarchy, we'll stop and return that window.
- */
-NS_IMETHODIMP
-nsGlobalWindow::GetScriptableTop(nsIDOMWindow **aTop)
-{
-  return GetTopImpl(aTop, /* aScriptable = */ true);
-}
-
-/**
- * nsIDOMWindow::GetTop (when called from C++) is just a wrapper around
- * GetRealTop.
- */
-NS_IMETHODIMP
-nsGlobalWindow::GetRealTop(nsIDOMWindow** aTop)
-{
-  return GetTopImpl(aTop, /* aScriptable = */ false);
-}
-
 nsresult
 nsGlobalWindow::GetTopImpl(nsIDOMWindow** aTop, bool aScriptable)
 {
@@ -3685,6 +3662,29 @@ nsGlobalWindow::GetTopImpl(nsIDOMWindow** aTop, bool aScriptable)
   return NS_OK;
 }
 
+/**
+ * GetScriptableTop is called when script reads window.top.
+ *
+ * In contrast to GetRealTop, GetScriptableTop respects <iframe mozbrowser>
+ * boundaries.  If we encounter a window owned by an <iframe mozbrowser> while
+ * walking up the window hierarchy, we'll stop and return that window.
+ */
+NS_IMETHODIMP
+nsGlobalWindow::GetScriptableTop(nsIDOMWindow **aTop)
+{
+  return GetTopImpl(aTop, /* aScriptable = */ true);
+}
+
+/**
+ * nsIDOMWindow::GetTop (when called from C++) is just a wrapper around
+ * GetRealTop.
+ */
+NS_IMETHODIMP
+nsGlobalWindow::GetRealTop(nsIDOMWindow** aTop)
+{
+  return GetTopImpl(aTop, /* aScriptable = */ false);
+}
+
 JSObject*
 nsGlobalWindow::GetContent(JSContext* aCx, ErrorResult& aError)
 {

From 38771ca3788f5d7c6f214a242e1488f0ff694b89 Mon Sep 17 00:00:00 2001
From: Peter Van der Beken <peterv@propagandism.org>
Date: Sat, 14 Dec 2013 18:52:13 +0100
Subject: [PATCH 406/459] Bug 938640 - Make forwarding to outer conditional on
 current inner. r=bz.

---
 content/events/test/test_bug457672.html |   2 -
 dom/base/nsGlobalWindow.cpp             | 171 ++++++++++++++----------
 dom/base/nsGlobalWindow.h               |  14 +-
 3 files changed, 105 insertions(+), 82 deletions(-)

diff --git a/content/events/test/test_bug457672.html b/content/events/test/test_bug457672.html
index 6d1b32d611a5..e3b1b8bec4b3 100644
--- a/content/events/test/test_bug457672.html
+++ b/content/events/test/test_bug457672.html
@@ -17,8 +17,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=457672
 <pre id="test">
 <script type="application/javascript">
 
-SimpleTest.expectAssertions(1);
-
 /** Test for Bug 457672 **/
 
 var windowBlurCount = 0;
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 19d9d70b2626..32efb02c0b7b 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -307,8 +307,10 @@ nsGlobalWindow::DOMMinTimeoutValue() const {
   PR_BEGIN_MACRO                                                              \
   if (IsInnerWindow()) {                                                      \
     nsGlobalWindow *outer = GetOuterWindowInternal();                         \
-    if (!outer) {                                                             \
-      NS_WARNING("No outer window available!");                               \
+    if (!outer || outer->GetCurrentInnerWindow() != this) {                   \
+      NS_WARNING(outer ?                                                      \
+                 "Inner window is not its outer's current inner window." :    \
+                 "No outer window available!");                               \
       return err_rval;                                                        \
     }                                                                         \
     return outer->method args;                                                \
@@ -322,9 +324,12 @@ nsGlobalWindow::DOMMinTimeoutValue() const {
     if (!outer) {                                                             \
       NS_WARNING("No outer window available!");                               \
       errorresult.Throw(NS_ERROR_NOT_INITIALIZED);                            \
-      return err_rval;                                                        \
+    } else if (outer->GetCurrentInnerWindow() != this) {                      \
+      errorresult.Throw(NS_ERROR_XPC_SECURITY_MANAGER_VETO);                  \
+    } else {                                                                  \
+      return outer->method args;                                              \
     }                                                                         \
-    return outer->method args;                                                \
+    return err_rval;                                                          \
   }                                                                           \
   PR_END_MACRO
 
@@ -332,8 +337,10 @@ nsGlobalWindow::DOMMinTimeoutValue() const {
   PR_BEGIN_MACRO                                                              \
   if (IsInnerWindow()) {                                                      \
     nsGlobalWindow *outer = GetOuterWindowInternal();                         \
-    if (!outer) {                                                             \
-      NS_WARNING("No outer window available!");                               \
+    if (!outer || outer->GetCurrentInnerWindow() != this) {                   \
+      NS_WARNING(outer ?                                                      \
+                 "Inner window is not its outer's current inner window." :    \
+                 "No outer window available!");                               \
       return;                                                                 \
     }                                                                         \
     outer->method args;                                                       \
@@ -345,8 +352,10 @@ nsGlobalWindow::DOMMinTimeoutValue() const {
   PR_BEGIN_MACRO                                                              \
   if (IsInnerWindow()) {                                                      \
     nsGlobalWindow *outer = GetOuterWindowInternal();                         \
-    if (!outer) {                                                             \
-      NS_WARNING("No outer window available!");                               \
+    if (!outer || outer->GetCurrentInnerWindow() != this) {                   \
+      NS_WARNING(outer ?                                                      \
+                 "Inner window is not its outer's current inner window." :    \
+                 "No outer window available!");                               \
       return err_rval;                                                        \
     }                                                                         \
     return ((nsGlobalChromeWindow *)outer)->method args;                      \
@@ -368,8 +377,10 @@ nsGlobalWindow::DOMMinTimeoutValue() const {
   PR_BEGIN_MACRO                                                              \
   if (IsInnerWindow()) {                                                      \
     nsGlobalWindow *outer = GetOuterWindowInternal();                         \
-    if (!outer) {                                                             \
-      NS_WARNING("No outer window available!");                               \
+    if (!outer || outer->GetCurrentInnerWindow() != this) {                   \
+      NS_WARNING(outer ?                                                      \
+                 "Inner window is not its outer's current inner window." :    \
+                 "No outer window available!");                               \
       return err_rval;                                                        \
     }                                                                         \
     return ((nsGlobalModalWindow *)outer)->method args;                       \
@@ -1828,21 +1839,25 @@ nsGlobalWindow::UnmarkGrayTimers()
 nsresult
 nsGlobalWindow::EnsureScriptEnvironment()
 {
-  FORWARD_TO_OUTER(EnsureScriptEnvironment, (), NS_ERROR_NOT_INITIALIZED);
+  nsGlobalWindow* outer = GetOuterWindowInternal();
+  if (!outer) {
+    NS_WARNING("No outer window available!");
+    return NS_ERROR_FAILURE;
+  }
 
-  if (mJSObject) {
+  if (outer->mJSObject) {
     return NS_OK;
   }
 
-  NS_ASSERTION(!GetCurrentInnerWindowInternal(),
+  NS_ASSERTION(!outer->GetCurrentInnerWindowInternal(),
                "mJSObject is null, but we have an inner window?");
 
   // If this window is a [i]frame, don't bother GC'ing when the frame's context
   // is destroyed since a GC will happen when the frameset or host document is
   // destroyed anyway.
-  nsCOMPtr<nsIScriptContext> context = new nsJSContext(!IsFrame(), this);
+  nsCOMPtr<nsIScriptContext> context = new nsJSContext(!IsFrame(), outer);
 
-  NS_ASSERTION(!mContext, "Will overwrite mContext!");
+  NS_ASSERTION(!outer->mContext, "Will overwrite mContext!");
 
   // should probably assert the context is clean???
   context->WillInitializeContext();
@@ -1850,26 +1865,15 @@ nsGlobalWindow::EnsureScriptEnvironment()
   nsresult rv = context->InitContext();
   NS_ENSURE_SUCCESS(rv, rv);
 
-  mContext = context;
+  outer->mContext = context;
   return NS_OK;
 }
 
 nsIScriptContext *
 nsGlobalWindow::GetScriptContext()
 {
-  FORWARD_TO_OUTER(GetScriptContext, (), nullptr);
-  return mContext;
-}
-
-nsIScriptContext *
-nsGlobalWindow::GetContext()
-{
-  FORWARD_TO_OUTER(GetContext, (), nullptr);
-
-  // check GetContext is indeed identical to GetScriptContext()
-  NS_ASSERTION(mContext == GetScriptContext(),
-               "GetContext confused?");
-  return mContext;
+  nsGlobalWindow* outer = GetOuterWindowInternal();
+  return outer ? outer->mContext : nullptr;
 }
 
 JSObject *
@@ -3036,7 +3040,7 @@ nsGlobalWindow::DialogsAreBeingAbused()
 bool
 nsGlobalWindow::ConfirmDialogIfNeeded()
 {
-  FORWARD_TO_OUTER(ConfirmDialogIfNeeded, (), false);
+  MOZ_ASSERT(IsOuterWindow());
 
   NS_ENSURE_TRUE(mDocShell, false);
   nsCOMPtr<nsIPromptService> promptSvc =
@@ -3197,8 +3201,7 @@ nsGlobalWindow::PoisonOuterWindowProxy(JSObject *aObject)
 nsresult
 nsGlobalWindow::SetArguments(nsIArray *aArguments)
 {
-  FORWARD_TO_OUTER(SetArguments, (aArguments),
-                   NS_ERROR_NOT_INITIALIZED);
+  MOZ_ASSERT(IsOuterWindow());
   nsresult rv;
 
   // Historically, we've used the same machinery to handle openDialog arguments
@@ -3624,16 +3627,15 @@ nsGlobalWindow::GetRealParent(nsIDOMWindow** aParent)
   return NS_OK;
 }
 
-nsresult
-nsGlobalWindow::GetTopImpl(nsIDOMWindow** aTop, bool aScriptable)
+static nsresult
+GetTopImpl(nsGlobalWindow* aWin, nsIDOMWindow** aTop, bool aScriptable)
 {
-  FORWARD_TO_OUTER(GetTopImpl, (aTop, aScriptable), NS_ERROR_NOT_INITIALIZED);
   *aTop = nullptr;
 
   // Walk up the parent chain.
 
-  nsCOMPtr<nsIDOMWindow> prevParent = this;
-  nsCOMPtr<nsIDOMWindow> parent = this;
+  nsCOMPtr<nsIDOMWindow> prevParent = aWin;
+  nsCOMPtr<nsIDOMWindow> parent = aWin;
   do {
     if (!parent) {
       break;
@@ -3672,7 +3674,8 @@ nsGlobalWindow::GetTopImpl(nsIDOMWindow** aTop, bool aScriptable)
 NS_IMETHODIMP
 nsGlobalWindow::GetScriptableTop(nsIDOMWindow **aTop)
 {
-  return GetTopImpl(aTop, /* aScriptable = */ true);
+  FORWARD_TO_OUTER(GetScriptableTop, (aTop), NS_ERROR_NOT_INITIALIZED);
+  return GetTopImpl(this, aTop, /* aScriptable = */ true);
 }
 
 /**
@@ -3682,7 +3685,17 @@ nsGlobalWindow::GetScriptableTop(nsIDOMWindow **aTop)
 NS_IMETHODIMP
 nsGlobalWindow::GetRealTop(nsIDOMWindow** aTop)
 {
-  return GetTopImpl(aTop, /* aScriptable = */ false);
+  nsGlobalWindow* outer;
+  if (IsInnerWindow()) {
+    outer = GetOuterWindowInternal();
+    if (!outer) {
+      NS_WARNING("No outer window available!");
+      return NS_ERROR_NOT_INITIALIZED;
+    }
+  } else {
+    outer = this;
+  }
+  return GetTopImpl(outer, aTop, /* aScriptable = */ false);
 }
 
 JSObject*
@@ -3804,7 +3817,14 @@ nsGlobalWindow::GetScriptableContent(JSContext* aCx, JS::Value* aVal)
 NS_IMETHODIMP
 nsGlobalWindow::GetPrompter(nsIPrompt** aPrompt)
 {
-  FORWARD_TO_OUTER(GetPrompter, (aPrompt), NS_ERROR_NOT_INITIALIZED);
+  if (IsInnerWindow()) {
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    if (!outer) {
+      NS_WARNING("No outer window available!");
+      return NS_ERROR_NOT_INITIALIZED;
+    }
+    return outer->GetPrompter(aPrompt);
+  }
 
   if (!mDocShell)
     return NS_ERROR_FAILURE;
@@ -5555,6 +5575,8 @@ nsGlobalWindow::WindowExists(const nsAString& aName,
 already_AddRefed<nsIWidget>
 nsGlobalWindow::GetMainWidget()
 {
+  FORWARD_TO_OUTER(GetMainWidget, (), nullptr);
+
   nsCOMPtr<nsIBaseWindow> treeOwnerAsWin = GetTreeOwnerWindow();
 
   nsCOMPtr<nsIWidget> widget;
@@ -7105,7 +7127,7 @@ nsGlobalWindow::PopupWhitelisted()
 PopupControlState
 nsGlobalWindow::RevisePopupAbuseLevel(PopupControlState aControl)
 {
-  FORWARD_TO_OUTER(RevisePopupAbuseLevel, (aControl), aControl);
+  MOZ_ASSERT(IsOuterWindow());
 
   NS_ASSERTION(mDocShell, "Must have docshell");
   
@@ -9121,7 +9143,7 @@ nsGlobalWindow::GetContextForEventHandlers(nsresult* aRv)
 nsPIDOMWindow*
 nsGlobalWindow::GetPrivateParent()
 {
-  FORWARD_TO_OUTER(GetPrivateParent, (), nullptr);
+  MOZ_ASSERT(IsOuterWindow());
 
   nsCOMPtr<nsIDOMWindow> parent;
   GetParent(getter_AddRefs(parent));
@@ -9149,24 +9171,18 @@ nsGlobalWindow::GetPrivateParent()
 nsPIDOMWindow*
 nsGlobalWindow::GetPrivateRoot()
 {
-  FORWARD_TO_OUTER(GetPrivateRoot, (), nullptr);
+  if (IsInnerWindow()) {
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    if (!outer) {
+      NS_WARNING("No outer window available!");
+      return nullptr;
+    }
+    return outer->GetPrivateRoot();
+  }
 
   nsCOMPtr<nsIDOMWindow> top;
   GetTop(getter_AddRefs(top));
 
-  nsCOMPtr<nsPIDOMWindow> ptop = do_QueryInterface(top);
-  NS_ASSERTION(ptop, "cannot get ptop");
-  if (!ptop)
-    return nullptr;
-
-  nsIDocShell *docShell = ptop->GetDocShell();
-
-  // Get the chrome event handler from the doc shell, since we only
-  // want to deal with XUL chrome handlers and not the new kind of
-  // window root handler.
-  nsCOMPtr<nsIDOMEventTarget> chromeEventHandler;
-  docShell->GetChromeEventHandler(getter_AddRefs(chromeEventHandler));
-
   nsCOMPtr<nsIContent> chromeElement(do_QueryInterface(mChromeEventHandler));
   if (chromeElement) {
     nsIDocument* doc = chromeElement->GetDocument();
@@ -10131,31 +10147,35 @@ nsGlobalWindow::GetInterface(const nsIID & aIID, void **aSink)
   *aSink = nullptr;
 
   if (aIID.Equals(NS_GET_IID(nsIDocCharset))) {
-    FORWARD_TO_OUTER(GetInterface, (aIID, aSink), NS_ERROR_NOT_INITIALIZED);
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    NS_ENSURE_TRUE(outer, NS_ERROR_NOT_INITIALIZED);
 
     NS_WARNING("Using deprecated nsIDocCharset: use nsIDocShell.GetCharset() instead ");
-    nsCOMPtr<nsIDocCharset> docCharset(do_QueryInterface(mDocShell));
+    nsCOMPtr<nsIDocCharset> docCharset(do_QueryInterface(outer->mDocShell));
     docCharset.forget(aSink);
   }
   else if (aIID.Equals(NS_GET_IID(nsIWebNavigation))) {
-    FORWARD_TO_OUTER(GetInterface, (aIID, aSink), NS_ERROR_NOT_INITIALIZED);
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    NS_ENSURE_TRUE(outer, NS_ERROR_NOT_INITIALIZED);
 
-    nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(mDocShell));
+    nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(outer->mDocShell));
     webNav.forget(aSink);
   }
   else if (aIID.Equals(NS_GET_IID(nsIDocShell))) {
-    FORWARD_TO_OUTER(GetInterface, (aIID, aSink), NS_ERROR_NOT_INITIALIZED);
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    NS_ENSURE_TRUE(outer, NS_ERROR_NOT_INITIALIZED);
 
-    nsCOMPtr<nsIDocShell> docShell = mDocShell;
+    nsCOMPtr<nsIDocShell> docShell = outer->mDocShell;
     docShell.forget(aSink);
   }
 #ifdef NS_PRINTING
   else if (aIID.Equals(NS_GET_IID(nsIWebBrowserPrint))) {
-    FORWARD_TO_OUTER(GetInterface, (aIID, aSink), NS_ERROR_NOT_INITIALIZED);
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    NS_ENSURE_TRUE(outer, NS_ERROR_NOT_INITIALIZED);
 
-    if (mDocShell) {
+    if (outer->mDocShell) {
       nsCOMPtr<nsIContentViewer> viewer;
-      mDocShell->GetContentViewer(getter_AddRefs(viewer));
+      outer->mDocShell->GetContentViewer(getter_AddRefs(viewer));
       if (viewer) {
         nsCOMPtr<nsIWebBrowserPrint> webBrowserPrint(do_QueryInterface(viewer));
         webBrowserPrint.forget(aSink);
@@ -10164,19 +10184,21 @@ nsGlobalWindow::GetInterface(const nsIID & aIID, void **aSink)
   }
 #endif
   else if (aIID.Equals(NS_GET_IID(nsIDOMWindowUtils))) {
-    FORWARD_TO_OUTER(GetInterface, (aIID, aSink), NS_ERROR_NOT_INITIALIZED);
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    NS_ENSURE_TRUE(outer, NS_ERROR_NOT_INITIALIZED);
 
     if (!mWindowUtils) {
-      mWindowUtils = new nsDOMWindowUtils(this);
+      mWindowUtils = new nsDOMWindowUtils(outer);
     }
 
     *aSink = mWindowUtils;
     NS_ADDREF(((nsISupports *) *aSink));
   }
   else if (aIID.Equals(NS_GET_IID(nsILoadContext))) {
-    FORWARD_TO_OUTER(GetInterface, (aIID, aSink), NS_ERROR_NOT_INITIALIZED);
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    NS_ENSURE_TRUE(outer, NS_ERROR_NOT_INITIALIZED);
 
-    nsCOMPtr<nsILoadContext> loadContext(do_QueryInterface(mDocShell));
+    nsCOMPtr<nsILoadContext> loadContext(do_QueryInterface(outer->mDocShell));
     loadContext.forget(aSink);
   }
   else {
@@ -11029,7 +11051,14 @@ nsGlobalWindow::FireDelayedDOMEvents()
 nsIDOMWindow *
 nsGlobalWindow::GetParentInternal()
 {
-  FORWARD_TO_OUTER(GetParentInternal, (), nullptr);
+  if (IsInnerWindow()) {
+    nsGlobalWindow* outer = GetOuterWindowInternal();
+    if (!outer) {
+      NS_WARNING("No outer window available!");
+      return nullptr;
+    }
+    return outer->GetParentInternal();
+  }
 
   nsCOMPtr<nsIDOMWindow> parent;
   GetParent(getter_AddRefs(parent));
@@ -12150,7 +12179,7 @@ nsGlobalWindow::GetTreeOwner()
 already_AddRefed<nsIBaseWindow>
 nsGlobalWindow::GetTreeOwnerWindow()
 {
-  FORWARD_TO_OUTER(GetTreeOwnerWindow, (), nullptr);
+  MOZ_ASSERT(IsOuterWindow());
 
   nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
 
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 2218c0e02fc4..da7297e05be9 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -341,7 +341,6 @@ public:
   virtual JSObject *GetGlobalJSObject();
 
   // nsIScriptGlobalObject
-  virtual nsIScriptContext *GetContext();
   JSObject *FastGetGlobalJSObject() const
   {
     return mJSObject;
@@ -529,11 +528,6 @@ public:
   // Inner windows only.
   bool DialogsAreBeingAbused();
 
-  // Ask the user if further dialogs should be blocked, if dialogs are currently
-  // being abused. This is used in the cases where we have no modifiable UI to
-  // show, in that case we show a separate dialog to ask this question.
-  bool ConfirmDialogIfNeeded();
-
   // These functions are used for controlling and determining whether dialogs
   // (alert, prompt, confirm) are currently allowed in this window.
   void EnableDialogs();
@@ -1280,9 +1274,6 @@ protected:
   nsresult CloneStorageEvent(const nsAString& aType,
                              nsCOMPtr<nsIDOMStorageEvent>& aEvent);
 
-  // Implements Get{Real,Scriptable}Top.
-  nsresult GetTopImpl(nsIDOMWindow **aWindow, bool aScriptable);
-
   // Outer windows only.
   nsDOMWindowList* GetWindowList();
 
@@ -1321,6 +1312,11 @@ protected:
   already_AddRefed<nsIDOMWindow>
     GetContentInternal(mozilla::ErrorResult& aError);
 
+  // Ask the user if further dialogs should be blocked, if dialogs are currently
+  // being abused. This is used in the cases where we have no modifiable UI to
+  // show, in that case we show a separate dialog to ask this question.
+  bool ConfirmDialogIfNeeded();
+
   // When adding new member variables, be careful not to create cycles
   // through JavaScript.  If there is any chance that a member variable
   // could own objects that are implemented in JavaScript, then those

From 73e93948d6c5b9550eafa20fd27a4be2193de20b Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sat, 14 Dec 2013 10:40:24 -0800
Subject: [PATCH 407/459] Bumping gaia.json for 1 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/5449cb5b262e
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Revert "Merge pull request #14667 from mcav/utf7"

This reverts commit cfa88581f0bdaa3d4b7a3773ae87edc55260a2ab, reversing
changes made to b44a75862ebcb651381eabc9c3a3b203d76d63bf.

This is breaking 6 integration tests
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 1c68ef678c93..4a263b166708 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "45fc76dab5449af2aa333a92251780291a8334ac", 
+    "revision": "5449cb5b262e434869f7d0926ccc675c77e1b9f1", 
     "repo_path": "/integration/gaia-central"
 }

From 7af3ae48695a356daa2a9fb2ac605fc0ac0f047a Mon Sep 17 00:00:00 2001
From: Dave Hylands <dhylands@mozilla.com>
Date: Sat, 14 Dec 2013 11:44:57 -0800
Subject: [PATCH 408/459] Bug 915974 - Make adb stay on if USB functions are
 being used. r=fabrice

---
 b2g/chrome/content/settings.js | 60 ++++++++++++++++++++++++++++++++--
 1 file changed, 57 insertions(+), 3 deletions(-)

diff --git a/b2g/chrome/content/settings.js b/b2g/chrome/content/settings.js
index 8db0360d7859..5c2b9b307607 100644
--- a/b2g/chrome/content/settings.js
+++ b/b2g/chrome/content/settings.js
@@ -223,6 +223,7 @@ let AdbController = {
   lockEnabled: undefined,
   disableAdbTimer: null,
   disableAdbTimeoutHours: 12,
+  umsActive: false,
 
   debug: function(str) {
     dump("AdbController: " + str + "\n");
@@ -304,6 +305,51 @@ let AdbController = {
   },
 
   updateState: function() {
+    this.umsActive = false;
+    this.storages = navigator.getDeviceStorages('sdcard');
+    this.updateStorageState(0);
+  },
+
+  updateStorageState: function(storageIndex) {
+    if (storageIndex >= this.storages.length) {
+      // We've iterated through all of the storage objects, now we can
+      // really do updateStateInternal.
+      this.updateStateInternal();
+      return;
+    }
+    let storage = this.storages[storageIndex];
+    if (this.DEBUG) {
+      this.debug("Checking availability of storage: '" +
+                 storage.storageName);
+    }
+
+    let req = storage.available();
+    req.onsuccess = function(e) {
+      if (this.DEBUG) {
+        this.debug("Storage: '" + storage.storageName + "' is '" +
+                   e.target.result);
+      }
+      if (e.target.result == 'shared') {
+        // We've found a storage area that's being shared with the PC.
+        // We can stop looking now.
+        this.umsActive = true;
+        this.updateStateInternal();
+        return;
+      }
+      this.updateStorageState(storageIndex + 1);
+    }.bind(this);
+    req.onerror = function(e) {
+      dump("AdbController: error querying storage availability for '" +
+           this.storages[storageIndex].storageName + "' (ignoring)\n");
+      this.updateStorageState(storageIndex + 1);
+    }.bind(this);
+  },
+
+  updateStateInternal: function() {
+    if (this.DEBUG) {
+      this.debug("updateStateInternal: called");
+    }
+
     if (this.remoteDebuggerEnabled === undefined ||
         this.lockEnabled === undefined ||
         this.locked === undefined) {
@@ -338,8 +384,15 @@ let AdbController = {
       this.debug("isDebugging=" + isDebugging);
     }
 
+    // If USB Mass Storage, USB tethering, or a debug session is active,
+    // then we don't want to disable adb in an automatic fashion (i.e.
+    // when the screen locks or due to timeout).
+    let sysUsbConfig = libcutils.property_get("sys.usb.config");
+    let rndisActive = (sysUsbConfig.split(",").indexOf("rndis") >= 0);
+    let usbFuncActive = rndisActive || this.umsActive || isDebugging;
+
     let enableAdb = this.remoteDebuggerEnabled &&
-      (!(this.lockEnabled && this.locked) || isDebugging);
+      (!(this.lockEnabled && this.locked) || usbFuncActive);
 
     let useDisableAdbTimer = true;
     try {
@@ -359,7 +412,8 @@ let AdbController = {
       this.debug("updateState: enableAdb = " + enableAdb +
                  " remoteDebuggerEnabled = " + this.remoteDebuggerEnabled +
                  " lockEnabled = " + this.lockEnabled +
-                 " locked = " + this.locked);
+                 " locked = " + this.locked +
+                 " usbFuncActive = " + usbFuncActive);
     }
 
     // Configure adb.
@@ -391,7 +445,7 @@ let AdbController = {
       }
     }
     if (useDisableAdbTimer) {
-      if (enableAdb && !isDebugging) {
+      if (enableAdb && !usbFuncActive) {
         this.startDisableAdbTimer();
       } else {
         this.stopDisableAdbTimer();

From d52ab1f8f1a461f8b826a05a74a8e1e2bab97cc2 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Sat, 14 Dec 2013 14:40:55 -0600
Subject: [PATCH 409/459] Bug 941774 - New dom utils methods for injecting
 native touch input. r=smaug

---
 dom/base/nsDOMWindowUtils.cpp             |  57 ++++++++++++
 dom/interfaces/base/nsIDOMWindowUtils.idl | 101 +++++++++++++++++++---
 2 files changed, 145 insertions(+), 13 deletions(-)

diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 698c9de79ba3..2ba41b97318a 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -1149,6 +1149,63 @@ nsDOMWindowUtils::SendNativeMouseScrollEvent(int32_t aScreenX,
                                                   aAdditionalFlags);
 }
 
+NS_IMETHODIMP
+nsDOMWindowUtils::SendNativeTouchPoint(uint32_t aPointerId,
+                                       uint32_t aTouchState,
+                                       int32_t aScreenX,
+                                       int32_t aScreenY,
+                                       double aPressure,
+                                       uint32_t aOrientation)
+{
+  if (!nsContentUtils::IsCallerChrome()) {
+    return NS_ERROR_DOM_SECURITY_ERR;
+  }
+
+  nsCOMPtr<nsIWidget> widget = GetWidget();
+  if (!widget) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (aPressure < 0 || aPressure > 1 || aOrientation > 359) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  return widget->SynthesizeNativeTouchPoint(aPointerId,
+                                            (nsIWidget::TouchPointerState)aTouchState,
+                                            nsIntPoint(aScreenX, aScreenY),
+                                            aPressure, aOrientation);
+}
+
+NS_IMETHODIMP
+nsDOMWindowUtils::SendNativeTouchTap(int32_t aScreenX,
+                                     int32_t aScreenY,
+                                     bool aLongTap)
+{
+  if (!nsContentUtils::IsCallerChrome()) {
+    return NS_ERROR_DOM_SECURITY_ERR;
+  }
+
+  nsCOMPtr<nsIWidget> widget = GetWidget();
+  if (!widget) {
+    return NS_ERROR_FAILURE;
+  }
+  return widget->SynthesizeNativeTouchTap(nsIntPoint(aScreenX, aScreenY), aLongTap);
+}
+
+NS_IMETHODIMP
+nsDOMWindowUtils::ClearNativeTouchSequence()
+{
+  if (!nsContentUtils::IsCallerChrome()) {
+    return NS_ERROR_DOM_SECURITY_ERR;
+  }
+
+  nsCOMPtr<nsIWidget> widget = GetWidget();
+  if (!widget) {
+    return NS_ERROR_FAILURE;
+  }
+  return widget->ClearNativeTouchSequence();
+}
+
 NS_IMETHODIMP
 nsDOMWindowUtils::ActivateNativeMenuItemAt(const nsAString& indexString)
 {
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index 4f6559033209..57b23a4e7283 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -43,7 +43,7 @@ interface nsIDOMEventTarget;
 interface nsIRunnable;
 interface nsICompositionStringSynthesizer;
 
-[scriptable, uuid(3d9bf70c-5b83-11e3-9090-3c970e9f4238)]
+[scriptable, uuid(38740b7e-095e-4198-a012-cf5f9e102a6a)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -442,6 +442,28 @@ interface nsIDOMWindowUtils : nsISupports {
                             in long aModifierFlags,
                             in nsIDOMElement aElement);
 
+  /**
+   * The values for sendNativeMouseScrollEvent's aAdditionalFlags.
+   */
+
+  /**
+   * If MOUSESCROLL_PREFER_WIDGET_AT_POINT is set, widget will dispatch
+   * the event to a widget which is under the cursor.  Otherwise, dispatch to
+   * a default target on the platform.  E.g., on Windows, it's focused window.
+   */
+  const unsigned long MOUSESCROLL_PREFER_WIDGET_AT_POINT = 0x00000001;
+
+  /**
+   * The platform specific values of aAdditionalFlags.  Must be over 0x00010000.
+   */
+
+  /**
+   * If MOUSESCROLL_WIN_SCROLL_LPARAM_NOT_NULL is set and aNativeMessage is
+   * WM_VSCROLL or WM_HSCROLL, widget will set the window handle to the lParam
+   * instead of NULL.
+   */
+  const unsigned long MOUSESCROLL_WIN_SCROLL_LPARAM_NOT_NULL = 0x00010000;
+
   /**
    * See nsIWidget::SynthesizeNativeMouseScrollEvent
    *
@@ -466,26 +488,79 @@ interface nsIDOMWindowUtils : nsISupports {
                                   in nsIDOMElement aElement);
 
   /**
-   * The values of aAdditionalFlags.
+   * Touch states for sendNativeTouchPoint. These values match
+   * nsIWidget's TouchPointerState.
    */
 
-  /**
-   * If MOUSESCROLL_PREFER_WIDGET_AT_POINT is set, widget will dispatch
-   * the event to a widget which is under the cursor.  Otherwise, dispatch to
-   * a default target on the platform.  E.g., on Windows, it's focused window.
-   */
-  const unsigned long MOUSESCROLL_PREFER_WIDGET_AT_POINT = 0x00000001;
+  // The pointer is in a hover state above the digitizer
+  const long TOUCH_HOVER   = 0x01;
+  // The pointer is in contact with the digitizer
+  const long TOUCH_CONTACT = 0x02;
+  // The pointer has been removed from the digitizer detection area
+  const long TOUCH_REMOVE  = 0x04;
+  // The pointer has been canceled. Will cancel any pending os level
+  // gestures that would be triggered as a result of completion of the
+  // input sequence. This may not cancel moz platform related events
+  // that might get tirggered by input already delivered.
+  const long TOUCH_CANCEL  = 0x08;
 
   /**
-   * The platform specific values of aAdditionalFlags.  Must be over 0x00010000.
+   * Create a new or update an existing touch point on the digitizer.
+   * To trigger os level gestures, individual touch points should
+   * transition through a complete set of touch states which should be
+   * sent as individual calls. For example:
+   * tap - msg1:TOUCH_CONTACT, msg2:TOUCH_REMOVE
+   * drag - msg1-n:TOUCH_CONTACT (moving), msgn+1:TOUCH_REMOVE
+   * hover drag - msg1-n:TOUCH_HOVER (moving), msgn+1:TOUCH_REMOVE
+   *
+   * Widget support: Windows 8.0+, Winrt/Win32. Other widgets will
+   * throw.
+   *
+   * @param aPointerId The touch point id to create or update.
+   * @param aTouchState one or more of the touch states listed above
+   * @param aScreenX, aScreenY screen coords of this event
+   * @param aPressure 0.0 -> 1.0 float val indicating pressure
+   * @param aOrientation 0 -> 359 degree value indicating the
+   * orientation of the pointer. Use 90 for normal taps.
    */
+  void sendNativeTouchPoint(in unsigned long aPointerId,
+                            in unsigned long aTouchState,
+                            in long aScreenX,
+                            in long aScreenY,
+                            in double aPressure,
+                            in unsigned long aOrientation);
 
   /**
-   * If MOUSESCROLL_WIN_SCROLL_LPARAM_NOT_NULL is set and aNativeMessage is
-   * WM_VSCROLL or WM_HSCROLL, widget will set the window handle to the lParam
-   * instead of NULL.
+   * Simulates native touch based taps on the input digitizer. Events
+   * triggered by this call are injected at the os level. Events do not
+   * bypass widget level input processing and as such can be used to
+   * test widget event logic and async pan-zoom controller functionality.
+   * Cannot be accessed from an unprivileged context.
+   *
+   * Long taps (based on the aLongTap parameter) will be completed
+   * asynchrnously after the call returns. Long tap delay is based on
+   * the ui.click_hold_context_menus.delay pref or 1500 msec if pref
+   * is not set.
+   *
+   * Widget support: Windows 8.0+, Winrt/Win32. Other widgets will
+   * throw.
+   *
+   * @param aScreenX, aScreenY screen coords of this event
+   * @param aLongTap true if the tap should be long, false for a short
+   * tap.
    */
-  const unsigned long MOUSESCROLL_WIN_SCROLL_LPARAM_NOT_NULL = 0x00010000;
+  void sendNativeTouchTap(in long aScreenX,
+                          in long aScreenY,
+                          in boolean aLongTap);
+
+  /**
+   * Cancel any existing touch points or long tap delays. Calling this is safe
+   * even if you're sure there aren't any pointers recorded. You should call
+   * this when tests shut down to reset the digitizer driver. Not doing so can
+   * leave the digitizer in an undetermined state which can screw up subsequent
+   * tests and native input.
+   */
+  void clearNativeTouchSequence();
 
   /**
    * See nsIWidget::ActivateNativeMenuItemAt

From 9fda9d68ee0f8f7ca162bd88a524ccfa84e46563 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Sat, 14 Dec 2013 14:40:55 -0600
Subject: [PATCH 410/459] Bug 941774 - Centralize various dpi related queries
 on Windows. r=bbondy

---
 gfx/thebes/gfxWindowsPlatform.cpp    |  18 +++--
 gfx/thebes/gfxWindowsPlatform.h      |   7 +-
 widget/windows/WinUtils.cpp          |  42 +++++++++++
 widget/windows/WinUtils.h            |   9 +++
 widget/windows/nsNativeThemeWin.cpp  |   5 +-
 widget/windows/nsWindow.cpp          |   2 +-
 widget/windows/winrt/MetroInput.cpp  |  10 ++-
 widget/windows/winrt/MetroUtils.cpp  | 108 ++++++++++++++++-----------
 widget/windows/winrt/MetroUtils.h    |   8 +-
 widget/windows/winrt/MetroWidget.cpp |  29 +------
 widget/windows/winrt/UIABridge.cpp   |   8 +-
 11 files changed, 149 insertions(+), 97 deletions(-)

diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index d265edc8e2d7..d777c4d4c251 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -33,6 +33,8 @@
 #include "mozilla/layers/CompositorParent.h"   // for CompositorParent::IsInCompositorThread
 #include "DeviceManagerD3D9.h"
 
+#include "WinUtils.h"
+
 #ifdef CAIRO_HAS_DWRITE_FONT
 #include "gfxDWriteFontList.h"
 #include "gfxDWriteFonts.h"
@@ -46,10 +48,6 @@
 
 #include <string>
 
-using namespace mozilla;
-using namespace mozilla::gfx;
-using namespace mozilla::layers;
-
 #ifdef CAIRO_HAS_D2D_SURFACE
 #include "gfxD2DSurface.h"
 
@@ -67,6 +65,9 @@ using namespace mozilla::layers;
 #include "d3dkmtQueryStatistics.h"
 
 using namespace mozilla;
+using namespace mozilla::gfx;
+using namespace mozilla::layers;
+using namespace mozilla::widget;
 
 #ifdef CAIRO_HAS_D2D_SURFACE
 
@@ -363,8 +364,6 @@ gfxWindowsPlatform::gfxWindowsPlatform()
      */ 
     CoInitialize(nullptr); 
 
-    mScreenDC = GetDC(nullptr);
-
 #ifdef CAIRO_HAS_D2D_SURFACE
     RegisterStrongMemoryReporter(new GfxD2DSurfaceCacheReporter());
     RegisterStrongMemoryReporter(new GfxD2DSurfaceVramReporter());
@@ -384,7 +383,6 @@ gfxWindowsPlatform::~gfxWindowsPlatform()
 {
     mDeviceManager = nullptr;
 
-    ::ReleaseDC(nullptr, mScreenDC);
     // not calling FT_Done_FreeType because cairo may still hold references to
     // these FT_Faces.  See bug 458169.
 #ifdef CAIRO_HAS_D2D_SURFACE
@@ -401,6 +399,12 @@ gfxWindowsPlatform::~gfxWindowsPlatform()
     CoUninitialize();
 }
 
+double
+gfxWindowsPlatform::GetDPIScale()
+{
+  return WinUtils::LogToPhysFactor();
+}
+
 void
 gfxWindowsPlatform::UpdateRenderMode()
 {
diff --git a/gfx/thebes/gfxWindowsPlatform.h b/gfx/thebes/gfxWindowsPlatform.h
index c3d05e17d896..07cb51bf55c4 100644
--- a/gfx/thebes/gfxWindowsPlatform.h
+++ b/gfx/thebes/gfxWindowsPlatform.h
@@ -175,16 +175,12 @@ public:
     HRESULT CreateDevice(nsRefPtr<IDXGIAdapter1> &adapter1, int featureLevelIndex);
 #endif
 
-    HDC GetScreenDC() { return mScreenDC; }
-
     /**
      * Return the resolution scaling factor to convert between "logical" or
      * "screen" pixels as used by Windows (dependent on the DPI scaling option
      * in the Display control panel) and actual device pixels.
      */
-    double GetDPIScale() {
-        return GetDeviceCaps(mScreenDC, LOGPIXELSY) / 96.0;
-    }
+    double GetDPIScale();
 
     nsresult GetFontList(nsIAtom *aLangGroup,
                          const nsACString& aGenericFamily,
@@ -274,7 +270,6 @@ protected:
 
     int8_t mUseClearTypeForDownloadableFonts;
     int8_t mUseClearTypeAlways;
-    HDC mScreenDC;
 
 private:
     void Init();
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 4457d57d0bba..cab69860b6ed 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -37,6 +37,7 @@
 #include "gfxColor.h"
 #ifdef MOZ_METRO
 #include "winrt/MetroInput.h"
+#include "winrt/MetroUtils.h"
 #endif // MOZ_METRO
 
 #ifdef NS_ENABLE_TSF
@@ -185,6 +186,47 @@ WinUtils::Log(const char *fmt, ...)
   delete[] buffer;
 }
 
+/* static */
+double
+WinUtils::LogToPhysFactor()
+{
+  // dpi / 96.0
+  if (XRE_GetWindowsEnvironment() == WindowsEnvironmentType_Metro) {
+#ifdef MOZ_METRO
+    return MetroUtils::LogToPhysFactor();
+#else
+    return 1.0;
+#endif
+  } else {
+    HDC hdc = ::GetDC(nullptr);
+    double result = ::GetDeviceCaps(hdc, LOGPIXELSY) / 96.0;
+    ::ReleaseDC(nullptr, hdc);
+    return result;
+  }
+}
+
+/* static */
+double
+WinUtils::PhysToLogFactor()
+{
+  // 1.0 / (dpi / 96.0)
+  return 1.0 / LogToPhysFactor();
+}
+
+/* static */
+double
+WinUtils::PhysToLog(int32_t aValue)
+{
+  return double(aValue) * PhysToLogFactor();
+}
+
+/* static */
+int32_t
+WinUtils::LogToPhys(double aValue)
+{
+  return int32_t(NS_round(aValue * LogToPhysFactor()));
+}
+
 /* static */
 bool
 WinUtils::PeekMessage(LPMSG aMsg, HWND aWnd, UINT aFirstMessage,
diff --git a/widget/windows/WinUtils.h b/widget/windows/WinUtils.h
index 6a003d5a250a..1a71fb1c42d3 100644
--- a/widget/windows/WinUtils.h
+++ b/widget/windows/WinUtils.h
@@ -69,6 +69,15 @@ public:
 
 class WinUtils {
 public:
+  /**
+   * Functions to convert between logical pixels as used by most Windows APIs
+   * and physical (device) pixels.
+   */
+  static double LogToPhysFactor();
+  static double PhysToLogFactor();
+  static int32_t LogToPhys(double aValue);
+  static double PhysToLog(int32_t aValue);
+
   /**
    * Logging helpers that dump output to prlog module 'Widget', console, and
    * OutputDebugString. Note these output in both debug and release builds.
diff --git a/widget/windows/nsNativeThemeWin.cpp b/widget/windows/nsNativeThemeWin.cpp
index 7978fa81a1e0..3460310268d1 100644
--- a/widget/windows/nsNativeThemeWin.cpp
+++ b/widget/windows/nsNativeThemeWin.cpp
@@ -2430,7 +2430,7 @@ nsNativeThemeWin::GetMinimumWidgetSize(nsRenderingContext* aContext, nsIFrame* a
   if (NS_FAILED(rv))
     return rv;
 
-  HDC hdc = gfxWindowsPlatform::GetPlatform()->GetScreenDC();
+  HDC hdc = ::GetDC(nullptr);
   if (!hdc)
     return NS_ERROR_FAILURE;
 
@@ -2448,12 +2448,13 @@ nsNativeThemeWin::GetMinimumWidgetSize(nsRenderingContext* aContext, nsIFrame* a
 
     case NS_THEME_MENUSEPARATOR:
     {
-      SIZE gutterSize(GetGutterSize(theme,hdc));
+      SIZE gutterSize(GetGutterSize(theme, hdc));
       aResult->width += gutterSize.cx;
       break;
     }
   }
 
+  ::ReleaseDC(nullptr, hdc);
   return NS_OK;
 }
 
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index 4dc262cb3191..5eb2d9a48d8e 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -979,7 +979,7 @@ float nsWindow::GetDPI()
 
 double nsWindow::GetDefaultScaleInternal()
 {
-  return gfxWindowsPlatform::GetPlatform()->GetDPIScale();
+  return WinUtils::LogToPhysFactor();
 }
 
 nsWindow*
diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index f5cc5683e650..73768b215b09 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -15,6 +15,7 @@
 #include "MetroAppShell.h"
 #include "mozilla/MouseEvents.h"
 #include "mozilla/TouchEvents.h"
+#include "WinUtils.h"
 
 // System headers (alphabetical)
 #include <windows.ui.core.h> // ABI::Window::UI::Core namespace
@@ -26,6 +27,7 @@
 using namespace ABI::Windows; // UI, System, Foundation namespaces
 using namespace Microsoft; // WRL namespace (ComPtr, possibly others)
 using namespace mozilla;
+using namespace mozilla::widget;
 using namespace mozilla::widget::winrt;
 using namespace mozilla::dom;
 
@@ -75,8 +77,8 @@ namespace {
 
     nsIntPoint touchPoint = MetroUtils::LogToPhys(position);
     nsIntPoint touchRadius;
-    touchRadius.x = MetroUtils::LogToPhys(contactRect.Width) / 2;
-    touchRadius.y = MetroUtils::LogToPhys(contactRect.Height) / 2;
+    touchRadius.x = WinUtils::LogToPhys(contactRect.Width) / 2;
+    touchRadius.y = WinUtils::LogToPhys(contactRect.Height) / 2;
     return new Touch(pointerId,
                      touchPoint,
                      // Rotation radius and angle.
@@ -122,8 +124,8 @@ namespace {
     props->get_Pressure(&pressure);
     nsIntPoint touchPoint = MetroUtils::LogToPhys(position);
     nsIntPoint touchRadius;
-    touchRadius.x = MetroUtils::LogToPhys(contactRect.Width) / 2;
-    touchRadius.y = MetroUtils::LogToPhys(contactRect.Height) / 2;
+    touchRadius.x = WinUtils::LogToPhys(contactRect.Width) / 2;
+    touchRadius.y = WinUtils::LogToPhys(contactRect.Height) / 2;
 
     // from Touch.Equals
     return touchPoint != aTouch->mRefPoint ||
diff --git a/widget/windows/winrt/MetroUtils.cpp b/widget/windows/winrt/MetroUtils.cpp
index 9e1db5479d2c..c5e0acb14487 100644
--- a/widget/windows/winrt/MetroUtils.cpp
+++ b/widget/windows/winrt/MetroUtils.cpp
@@ -33,72 +33,92 @@ using namespace Microsoft::WRL::Wrappers;
 using namespace ABI::Windows::UI::ViewManagement;
 using namespace ABI::Windows::Graphics::Display;
 
-// File-scoped statics (unnamed namespace)
-namespace {
-  FLOAT LogToPhysFactor() {
-    ComPtr<IDisplayInformationStatics> dispInfoStatics;
-    if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayInformation).Get(),
-                                       dispInfoStatics.GetAddressOf()))) {
-      ComPtr<IDisplayInformation> dispInfo;
-      if (SUCCEEDED(dispInfoStatics->GetForCurrentView(&dispInfo))) {
-        FLOAT dpi;
-        if (SUCCEEDED(dispInfo->get_LogicalDpi(&dpi))) {
-          return dpi / 96.0f;
-        }
-      }
-    }
-
-    ComPtr<IDisplayPropertiesStatics> dispProps;
-    if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayProperties).Get(),
-                                       dispProps.GetAddressOf()))) {
-      FLOAT dpi;
-      if (SUCCEEDED(dispProps->get_LogicalDpi(&dpi))) {
-        return dpi / 96.0f;
-      }
-    }
-
-    return 1.0f;
-  }
-
-  FLOAT PhysToLogFactor() {
-    return 1.0f / LogToPhysFactor();
-  }
-};
-
 // Conversion between logical and physical coordinates
-int32_t
-MetroUtils::LogToPhys(FLOAT aValue)
+
+double
+MetroUtils::LogToPhysFactor()
 {
-  return int32_t(NS_round(aValue * LogToPhysFactor()));
+  ComPtr<IDisplayInformationStatics> dispInfoStatics;
+  if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayInformation).Get(),
+                                      dispInfoStatics.GetAddressOf()))) {
+    ComPtr<IDisplayInformation> dispInfo;
+    if (SUCCEEDED(dispInfoStatics->GetForCurrentView(&dispInfo))) {
+      FLOAT dpi;
+      if (SUCCEEDED(dispInfo->get_LogicalDpi(&dpi))) {
+        return (double)dpi / 96.0f;
+      }
+    }
+  }
+
+  ComPtr<IDisplayPropertiesStatics> dispProps;
+  if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayProperties).Get(),
+                                      dispProps.GetAddressOf()))) {
+    FLOAT dpi;
+    if (SUCCEEDED(dispProps->get_LogicalDpi(&dpi))) {
+      return (double)dpi / 96.0f;
+    }
+  }
+
+  return 1.0;
+}
+
+double
+MetroUtils::PhysToLogFactor()
+{
+  return 1.0 / LogToPhysFactor();
+}
+
+double
+MetroUtils::ScaleFactor()
+{
+  // Return the resolution scale factor reported by the metro environment.
+  // XXX TODO: also consider the desktop resolution setting, as IE appears to do?
+  ComPtr<IDisplayInformationStatics> dispInfoStatics;
+  if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayInformation).Get(),
+                                      dispInfoStatics.GetAddressOf()))) {
+    ComPtr<IDisplayInformation> dispInfo;
+    if (SUCCEEDED(dispInfoStatics->GetForCurrentView(&dispInfo))) {
+      ResolutionScale scale;
+      if (SUCCEEDED(dispInfo->get_ResolutionScale(&scale))) {
+        return (double)scale / 100.0;
+      }
+    }
+  }
+
+  ComPtr<IDisplayPropertiesStatics> dispProps;
+  if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayProperties).Get(),
+                                     dispProps.GetAddressOf()))) {
+    ResolutionScale scale;
+    if (SUCCEEDED(dispProps->get_ResolutionScale(&scale))) {
+      return (double)scale / 100.0;
+    }
+  }
+
+  return 1.0;
 }
 
 nsIntPoint
 MetroUtils::LogToPhys(const Point& aPt)
 {
-  FLOAT factor = LogToPhysFactor();
+  double factor = LogToPhysFactor();
   return nsIntPoint(int32_t(NS_round(aPt.X * factor)), int32_t(NS_round(aPt.Y * factor)));
 }
 
 nsIntRect
 MetroUtils::LogToPhys(const Rect& aRect)
 {
-  FLOAT factor = LogToPhysFactor();
+  double factor = LogToPhysFactor();
   return nsIntRect(int32_t(NS_round(aRect.X * factor)),
                    int32_t(NS_round(aRect.Y * factor)),
                    int32_t(NS_round(aRect.Width * factor)),
                    int32_t(NS_round(aRect.Height * factor)));
 }
 
-FLOAT
-MetroUtils::PhysToLog(int32_t aValue)
-{
-  return FLOAT(aValue) * PhysToLogFactor();
-}
-
 Point
 MetroUtils::PhysToLog(const nsIntPoint& aPt)
 {
-  FLOAT factor = PhysToLogFactor();
+  // Points contain FLOATs
+  FLOAT factor = (FLOAT)PhysToLogFactor();
   Point p = { FLOAT(aPt.x) * factor, FLOAT(aPt.y) * factor };
   return p;
 }
diff --git a/widget/windows/winrt/MetroUtils.h b/widget/windows/winrt/MetroUtils.h
index 9b6fb9446e92..5b4a110d4c2a 100644
--- a/widget/windows/winrt/MetroUtils.h
+++ b/widget/windows/winrt/MetroUtils.h
@@ -73,13 +73,15 @@ class MetroUtils
 public:
   // Functions to convert between logical pixels as used by most Windows APIs
   // and physical (device) pixels.
-  // See MSDN documentation about DIPs (device independent pixels) for details.
-  static int32_t LogToPhys(FLOAT aValue);
+  static double LogToPhysFactor();
+  static double PhysToLogFactor();
   static nsIntPoint LogToPhys(const Point& aPt);
   static nsIntRect LogToPhys(const Rect& aRect);
-  static FLOAT PhysToLog(int32_t aValue);
   static Point PhysToLog(const nsIntPoint& aPt);
 
+  // Resolution scale factor
+  static double ScaleFactor();
+
   static nsresult FireObserver(const char* aMessage, const PRUnichar* aData = nullptr);
 
   static HRESULT CreateUri(HSTRING aUriStr, Microsoft::WRL::ComPtr<IUriRuntimeClass>& aUriOut);
diff --git a/widget/windows/winrt/MetroWidget.cpp b/widget/windows/winrt/MetroWidget.cpp
index d48dec1e9502..4eb2d95493f6 100644
--- a/widget/windows/winrt/MetroWidget.cpp
+++ b/widget/windows/winrt/MetroWidget.cpp
@@ -1331,33 +1331,10 @@ MetroWidget::GetAccessible()
 }
 #endif
 
-double MetroWidget::GetDefaultScaleInternal()
+double
+MetroWidget::GetDefaultScaleInternal()
 {
-  // Return the resolution scale factor reported by the metro environment.
-  // XXX TODO: also consider the desktop resolution setting, as IE appears to do?
-
-  ComPtr<IDisplayInformationStatics> dispInfoStatics;
-  if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayInformation).Get(),
-                                      dispInfoStatics.GetAddressOf()))) {
-    ComPtr<IDisplayInformation> dispInfo;
-    if (SUCCEEDED(dispInfoStatics->GetForCurrentView(&dispInfo))) {
-      ResolutionScale scale;
-      if (SUCCEEDED(dispInfo->get_ResolutionScale(&scale))) {
-        return (double)scale / 100.0;
-      }
-    }
-  }
-
-  ComPtr<IDisplayPropertiesStatics> dispProps;
-  if (SUCCEEDED(GetActivationFactory(HStringReference(RuntimeClass_Windows_Graphics_Display_DisplayProperties).Get(),
-                                     dispProps.GetAddressOf()))) {
-    ResolutionScale scale;
-    if (SUCCEEDED(dispProps->get_ResolutionScale(&scale))) {
-      return (double)scale / 100.0;
-    }
-  }
-
-  return 1.0;
+  return MetroUtils::ScaleFactor();
 }
 
 LayoutDeviceIntPoint
diff --git a/widget/windows/winrt/UIABridge.cpp b/widget/windows/winrt/UIABridge.cpp
index 403e82c6a225..2d38304b5cd2 100644
--- a/widget/windows/winrt/UIABridge.cpp
+++ b/widget/windows/winrt/UIABridge.cpp
@@ -315,10 +315,10 @@ UIABridge::get_BoundingRectangle(UiaRect * retVal)
   mWindow->get_Bounds(&bounds);
 
   // we need to return physical pixels
-  retVal->left = MetroUtils::LogToPhys(bounds.X);
-  retVal->top = MetroUtils::LogToPhys(bounds.Y);
-  retVal->width = MetroUtils::LogToPhys(bounds.Width);
-  retVal->height = MetroUtils::LogToPhys(bounds.Height);
+  retVal->left = WinUtils::LogToPhys(bounds.X);
+  retVal->top = WinUtils::LogToPhys(bounds.Y);
+  retVal->width = WinUtils::LogToPhys(bounds.Width);
+  retVal->height = WinUtils::LogToPhys(bounds.Height);
 
   return S_OK;
 }

From 195cafc7e693155aec700d7da92eb544182e6d3e Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Sat, 14 Dec 2013 14:40:56 -0600
Subject: [PATCH 411/459] Bug 941774 - Base widget implementation. r=roc

---
 widget/nsIWidget.h                |  90 +++++++++++++++++++++++++-
 widget/xpwidgets/nsBaseWidget.cpp | 101 ++++++++++++++++++++++++++++++
 widget/xpwidgets/nsBaseWidget.h   |  13 ++++
 3 files changed, 201 insertions(+), 3 deletions(-)

diff --git a/widget/nsIWidget.h b/widget/nsIWidget.h
index 498d5647e79d..1722f213c087 100644
--- a/widget/nsIWidget.h
+++ b/widget/nsIWidget.h
@@ -12,12 +12,15 @@
 #include "nsStringGlue.h"
 
 #include "nsCOMPtr.h"
+#include "nsAutoPtr.h"
 #include "nsWidgetInitData.h"
 #include "nsTArray.h"
+#include "nsITimer.h"
 #include "nsXULAppAPI.h"
 #include "mozilla/EventForwards.h"
 #include "mozilla/layers/LayersTypes.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/TimeStamp.h"
 #include "Units.h"
 
 // forward declarations
@@ -97,8 +100,8 @@ typedef void* nsNativeWidget;
 #endif
 
 #define NS_IWIDGET_IID \
-{ 0x746cb189, 0x9793, 0x4e53, \
-  { 0x89, 0x47, 0x78, 0x56, 0xb6, 0xcd, 0x9f, 0x71 } }
+{ 0x67da44c4, 0xe21b, 0x4742, \
+  { 0x9c, 0x2b, 0x26, 0xc7, 0x70, 0x21, 0xde, 0x87 } }
 
 /*
  * Window shadow styles
@@ -493,7 +496,9 @@ class nsIWidget : public nsISupports {
       : mLastChild(nullptr)
       , mPrevSibling(nullptr)
       , mOnDestroyCalled(false)
-    {}
+    {
+      ClearNativeTouchSequence();
+    }
 
         
     /**
@@ -1559,6 +1564,85 @@ class nsIWidget : public nsISupports {
                                                       uint32_t aModifierFlags,
                                                       uint32_t aAdditionalFlags) = 0;
 
+    /*
+     * TouchPointerState states for SynthesizeNativeTouchPoint. Match
+     * touch states in nsIDOMWindowUtils.idl.
+     */
+    enum TouchPointerState {
+      // The pointer is in a hover state above the digitizer
+      TOUCH_HOVER    = 0x01,
+      // The pointer is in contact with the digitizer
+      TOUCH_CONTACT  = 0x02,
+      // The pointer has been removed from the digitizer detection area
+      TOUCH_REMOVE   = 0x04,
+      // The pointer has been canceled. Will cancel any pending os level
+      // gestures that would triggered as a result of completion of the
+      // input sequence. This may not cancel moz platform related events
+      // that might get tirggered by input already delivered.
+      TOUCH_CANCEL   = 0x08
+    };
+
+    /*
+     * Create a new or update an existing touch pointer on the digitizer.
+     * To trigger os level gestures, individual touch points should
+     * transition through a complete set of touch states which should be
+     * sent as individual messages.
+     *
+     * @param aPointerId The touch point id to create or update.
+     * @param aPointerState one or more of the touch states listed above
+     * @param aScreenX, aScreenY screen coords of this event
+     * @param aPressure 0.0 -> 1.0 float val indicating pressure
+     * @param aOrientation 0 -> 359 degree value indicating the
+     * orientation of the pointer. Use 90 for normal taps.
+     */
+    virtual nsresult SynthesizeNativeTouchPoint(uint32_t aPointerId,
+                                                TouchPointerState aPointerState,
+                                                nsIntPoint aPointerScreenPoint,
+                                                double aPointerPressure,
+                                                uint32_t aPointerOrientation) = 0;
+
+    /*
+     * Cancels all active simulated touch input points and pending long taps.
+     * Native widgets should track existing points such that they can clear the
+     * digitizer state when this call is made.
+     */
+    virtual nsresult ClearNativeTouchSequence();
+
+    /*
+     * Helper for simulating a simple tap event with one touch point. When
+     * aLongTap is true, simulates a native long tap with a duration equal to
+     * ui.click_hold_context_menus.delay. This pref is compatible with the
+     * apzc long tap duration. Defaults to 1.5 seconds.
+     */
+    nsresult SynthesizeNativeTouchTap(nsIntPoint aPointerScreenPoint,
+                                      bool aLongTap);
+
+private:
+  class LongTapInfo
+  {
+  public:
+    LongTapInfo(int32_t aPointerId, nsIntPoint& aPoint,
+                mozilla::TimeDuration aDuration) :
+      mPointerId(aPointerId),
+      mPosition(aPoint),
+      mDuration(aDuration),
+      mStamp(mozilla::TimeStamp::Now())
+    {
+    }
+
+    int32_t mPointerId;
+    nsIntPoint mPosition;
+    mozilla::TimeDuration mDuration;
+    mozilla::TimeStamp mStamp;
+  };
+
+  static void OnLongTapTimerCallback(nsITimer* aTimer, void* aClosure);
+
+  nsAutoPtr<LongTapInfo> mLongTapTouchPoint;
+  nsCOMPtr<nsITimer> mLongTapTimer;
+  static int32_t sPointerIdCounter;
+
+public:
     /**
      * Activates a native menu item at the position specified by the index
      * string. The index string is a string of positive integers separated
diff --git a/widget/xpwidgets/nsBaseWidget.cpp b/widget/xpwidgets/nsBaseWidget.cpp
index 1916ced3277d..384363eb741e 100644
--- a/widget/xpwidgets/nsBaseWidget.cpp
+++ b/widget/xpwidgets/nsBaseWidget.cpp
@@ -70,6 +70,11 @@ nsIContent* nsBaseWidget::mLastRollup = nullptr;
 // in NativeWindowTheme.
 bool            gDisableNativeTheme               = false;
 
+// Async pump timer during injected long touch taps
+#define TOUCH_INJECT_PUMP_TIMER_MSEC 50
+#define TOUCH_INJECT_LONG_TAP_DEFAULT_MSEC 1500
+int32_t nsIWidget::sPointerIdCounter = 0;
+
 // nsBaseWidget
 NS_IMPL_ISUPPORTS1(nsBaseWidget, nsIWidget)
 
@@ -1526,7 +1531,103 @@ nsBaseWidget::GetRootAccessible()
   return nullptr;
 }
 
+#endif // ACCESSIBILITY
+
+nsresult
+nsIWidget::SynthesizeNativeTouchTap(nsIntPoint aPointerScreenPoint, bool aLongTap)
+{
+  if (sPointerIdCounter > TOUCH_INJECT_MAX_POINTS) {
+    sPointerIdCounter = 0;
+  }
+  int pointerId = sPointerIdCounter;
+  sPointerIdCounter++;
+  nsresult rv = SynthesizeNativeTouchPoint(pointerId, TOUCH_CONTACT,
+                                           aPointerScreenPoint, 1.0, 90);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  if (!aLongTap) {
+    nsresult rv = SynthesizeNativeTouchPoint(pointerId, TOUCH_REMOVE,
+                                             aPointerScreenPoint, 0, 0);
+    return rv;
+  }
+
+  // initiate a long tap
+  int elapse = Preferences::GetInt("ui.click_hold_context_menus.delay",
+                                   TOUCH_INJECT_LONG_TAP_DEFAULT_MSEC);
+  if (!mLongTapTimer) {
+    mLongTapTimer = do_CreateInstance(NS_TIMER_CONTRACTID, &rv);
+    if (NS_FAILED(rv)) {
+      SynthesizeNativeTouchPoint(pointerId, TOUCH_CANCEL,
+                                 aPointerScreenPoint, 0, 0);
+      return NS_ERROR_UNEXPECTED;
+    }
+    // Windows requires recuring events, so we set this to a smaller window
+    // than the pref value.
+    int timeout = elapse;
+    if (timeout > TOUCH_INJECT_PUMP_TIMER_MSEC) {
+      timeout = TOUCH_INJECT_PUMP_TIMER_MSEC;
+    }
+    mLongTapTimer->InitWithFuncCallback(OnLongTapTimerCallback, this,
+                                        timeout,
+                                        nsITimer::TYPE_REPEATING_SLACK);
+  }
+
+  // If we already have a long tap pending, cancel it. We only allow one long
+  // tap to be active at a time.
+  if (mLongTapTouchPoint) {
+    SynthesizeNativeTouchPoint(mLongTapTouchPoint->mPointerId, TOUCH_CANCEL,
+                               mLongTapTouchPoint->mPosition, 0, 0);
+  }
+
+  mLongTapTouchPoint = new LongTapInfo(pointerId, aPointerScreenPoint,
+                                       TimeDuration::FromMilliseconds(elapse));
+  return NS_OK;
+}
+
+// static
+void
+nsIWidget::OnLongTapTimerCallback(nsITimer* aTimer, void* aClosure)
+{
+  nsIWidget *self = static_cast<nsIWidget *>(aClosure);
+
+  if ((self->mLongTapTouchPoint->mStamp + self->mLongTapTouchPoint->mDuration) >
+      TimeStamp::Now()) {
+#ifdef XP_WIN
+    // Windows needs us to keep pumping feedback to the digitizer, so update
+    // the pointer id with the same position.
+    self->SynthesizeNativeTouchPoint(self->mLongTapTouchPoint->mPointerId,
+                                     TOUCH_CONTACT,
+                                     self->mLongTapTouchPoint->mPosition,
+                                     1.0, 90);
 #endif
+    return;
+  }
+
+  // finished, remove the touch point
+  self->mLongTapTimer->Cancel();
+  self->mLongTapTimer = nullptr;
+  self->SynthesizeNativeTouchPoint(self->mLongTapTouchPoint->mPointerId,
+                                   TOUCH_REMOVE,
+                                   self->mLongTapTouchPoint->mPosition,
+                                   0, 0);
+  self->mLongTapTouchPoint = nullptr;
+}
+
+nsresult
+nsIWidget::ClearNativeTouchSequence()
+{
+  if (!mLongTapTimer) {
+    return NS_OK;
+  }
+  mLongTapTimer->Cancel();
+  mLongTapTimer = nullptr;
+  SynthesizeNativeTouchPoint(mLongTapTouchPoint->mPointerId, TOUCH_CANCEL,
+                             mLongTapTouchPoint->mPosition, 0, 0);
+  mLongTapTouchPoint = nullptr;
+  return NS_OK;
+}
 
 #ifdef DEBUG
 //////////////////////////////////////////////////////////////
diff --git a/widget/xpwidgets/nsBaseWidget.h b/widget/xpwidgets/nsBaseWidget.h
index 283ecf67b795..787aa679d375 100644
--- a/widget/xpwidgets/nsBaseWidget.h
+++ b/widget/xpwidgets/nsBaseWidget.h
@@ -41,6 +41,11 @@ namespace base {
 class Thread;
 }
 
+// Windows specific constant indicating the maximum number of touch points the
+// inject api will allow. This also sets the maximum numerical value for touch
+// ids we can use when injecting touch points on Windows.
+#define TOUCH_INJECT_MAX_POINTS 256
+
 class nsBaseWidget;
 
 class WidgetShutdownObserver MOZ_FINAL : public nsIObserver
@@ -320,6 +325,14 @@ protected:
                                                     uint32_t aAdditionalFlags)
   { return NS_ERROR_UNEXPECTED; }
 
+  virtual nsresult SynthesizeNativeTouchPoint(uint32_t aPointerId,
+                                              TouchPointerState aPointerState,
+                                              nsIntPoint aPointerScreenPoint,
+                                              double aPointerPressure,
+                                              uint32_t aPointerOrientation)
+  { return NS_ERROR_UNEXPECTED; }
+
+protected:
   // Stores the clip rectangles in aRects into mClipRects. Returns true
   // if the new rectangles are different from the old rectangles.
   bool StoreWindowClipRegion(const nsTArray<nsIntRect>& aRects);

From bfe08331dacc91205b1a8930e6f64ea8a6e2be5b Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Sat, 14 Dec 2013 14:40:56 -0600
Subject: [PATCH 412/459] Bug 941774 - Win32/winrt shared implementation.
 r=bbondy

---
 widget/windows/nsWindowBase.cpp       | 168 ++++++++++++++++++++++++++
 widget/windows/nsWindowBase.h         |  39 ++++++
 widget/windows/touchinjection_sdk80.h | 107 ++++++++++++++++
 3 files changed, 314 insertions(+)
 create mode 100644 widget/windows/touchinjection_sdk80.h

diff --git a/widget/windows/nsWindowBase.cpp b/widget/windows/nsWindowBase.cpp
index 695769e5dabd..49fbac5c3fea 100644
--- a/widget/windows/nsWindowBase.cpp
+++ b/widget/windows/nsWindowBase.cpp
@@ -6,9 +6,16 @@
 #include "nsWindowBase.h"
 
 #include "mozilla/MiscEvents.h"
+
+#include "WinUtils.h"
 #include "npapi.h"
 
 using namespace mozilla;
+using namespace mozilla::widget;
+
+static const wchar_t kUser32LibName[] =  L"user32.dll";
+bool nsWindowBase::sTouchInjectInitialized = false;
+InjectTouchInputPtr nsWindowBase::sInjectTouchFuncPtr;
 
 bool
 nsWindowBase::DispatchPluginEvent(const MSG& aMsg)
@@ -27,3 +34,164 @@ nsWindowBase::DispatchPluginEvent(const MSG& aMsg)
   pluginEvent.retargetToFocusedDocument = true;
   return DispatchWindowEvent(&pluginEvent);
 }
+
+// static
+bool
+nsWindowBase::InitTouchInjection()
+{
+  if (!sTouchInjectInitialized) {
+    // Initialize touch injection on the first call
+    HMODULE hMod = LoadLibraryW(kUser32LibName);
+    if (!hMod) {
+      return false;
+    }
+
+    InitializeTouchInjectionPtr func =
+      (InitializeTouchInjectionPtr)GetProcAddress(hMod, "InitializeTouchInjection");
+    if (!func) {
+      WinUtils::Log("InitializeTouchInjection not available.");
+      return false;
+    }
+
+    if (!func(TOUCH_INJECT_MAX_POINTS, TOUCH_FEEDBACK_DEFAULT)) {
+      WinUtils::Log("InitializeTouchInjection failure. GetLastError=%d", GetLastError());
+      return false;
+    }
+
+    sInjectTouchFuncPtr =
+      (InjectTouchInputPtr)GetProcAddress(hMod, "InjectTouchInput");
+    if (!sInjectTouchFuncPtr) {
+      WinUtils::Log("InjectTouchInput not available.");
+      return false;
+    }
+    sTouchInjectInitialized = true;
+  }
+  return true;
+}
+
+bool
+nsWindowBase::InjectTouchPoint(uint32_t aId, nsIntPoint& aPointerScreenPoint,
+                               POINTER_FLAGS aFlags, uint32_t aPressure,
+                               uint32_t aOrientation)
+{
+  if (aId > TOUCH_INJECT_MAX_POINTS) {
+    WinUtils::Log("Pointer ID exceeds maximum. See TOUCH_INJECT_MAX_POINTS.");
+    return false;
+  }
+
+  POINTER_TOUCH_INFO info;
+  memset(&info, 0, sizeof(POINTER_TOUCH_INFO));
+
+  info.touchFlags = TOUCH_FLAG_NONE;
+  info.touchMask = TOUCH_MASK_CONTACTAREA|TOUCH_MASK_ORIENTATION|TOUCH_MASK_PRESSURE;
+  info.pressure = aPressure;
+  info.orientation = aOrientation;
+  
+  info.pointerInfo.pointerFlags = aFlags;
+  info.pointerInfo.pointerType =  PT_TOUCH;
+  info.pointerInfo.pointerId = aId;
+  info.pointerInfo.ptPixelLocation.x = WinUtils::LogToPhys(aPointerScreenPoint.x);
+  info.pointerInfo.ptPixelLocation.y = WinUtils::LogToPhys(aPointerScreenPoint.y);
+
+  info.rcContact.top = info.pointerInfo.ptPixelLocation.y - 2;
+  info.rcContact.bottom = info.pointerInfo.ptPixelLocation.y + 2;
+  info.rcContact.left = info.pointerInfo.ptPixelLocation.x - 2;
+  info.rcContact.right = info.pointerInfo.ptPixelLocation.x + 2;
+  
+  if (!sInjectTouchFuncPtr(1, &info)) {
+    WinUtils::Log("InjectTouchInput failure. GetLastError=%d", GetLastError());
+    return false;
+  }
+  return true;
+}
+
+nsresult
+nsWindowBase::SynthesizeNativeTouchPoint(uint32_t aPointerId,
+                                         nsIWidget::TouchPointerState aPointerState,
+                                         nsIntPoint aPointerScreenPoint,
+                                         double aPointerPressure,
+                                         uint32_t aPointerOrientation)
+{
+  if (!InitTouchInjection()) {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
+  bool hover = aPointerState & TOUCH_HOVER;
+  bool contact = aPointerState & TOUCH_CONTACT;
+  bool remove = aPointerState & TOUCH_REMOVE;
+  bool cancel = aPointerState & TOUCH_CANCEL;
+
+  // win api expects a value from 0 to 1024. aPointerPressure is a value
+  // from 0.0 to 1.0.
+  uint32_t pressure = (uint32_t)ceil(aPointerPressure * 1024);
+
+  // If we already know about this pointer id get it's record
+  PointerInfo* info = mActivePointers.Get(aPointerId);
+
+  // We know about this pointer, send an update
+  if (info) {
+    POINTER_FLAGS flags = POINTER_FLAG_UPDATE;
+    if (hover) {
+      flags |= POINTER_FLAG_INRANGE;
+    } else if (contact) {
+      flags |= POINTER_FLAG_INCONTACT|POINTER_FLAG_INRANGE;
+    } else if (remove) {
+      flags = POINTER_FLAG_UP;
+      // Remove the pointer from our tracking list. This is nsAutPtr wrapped,
+      // so shouldn't leak.
+      mActivePointers.Remove(aPointerId);
+    }
+
+    if (cancel) {
+      flags |= POINTER_FLAG_CANCELED;
+    }
+
+    return !InjectTouchPoint(aPointerId, aPointerScreenPoint, flags,
+                             pressure, aPointerOrientation) ?
+      NS_ERROR_UNEXPECTED : NS_OK;
+  }
+
+  // Missing init state, error out
+  if (remove || cancel) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  // Create a new pointer
+  info = new PointerInfo(aPointerId, aPointerScreenPoint);
+
+  POINTER_FLAGS flags = POINTER_FLAG_INRANGE;
+  if (contact) {
+    flags |= POINTER_FLAG_INCONTACT|POINTER_FLAG_DOWN;
+  }
+
+  mActivePointers.Put(aPointerId, info);
+  return !InjectTouchPoint(aPointerId, aPointerScreenPoint, flags,
+                           pressure, aPointerOrientation) ?
+    NS_ERROR_UNEXPECTED : NS_OK;
+}
+
+// static
+PLDHashOperator
+nsWindowBase::CancelTouchPoints(const unsigned int& aPointerId, nsAutoPtr<PointerInfo>& aInfo, void* aUserArg)
+{
+  nsWindowBase* self = static_cast<nsWindowBase*>(aUserArg);
+  self->InjectTouchPoint(aInfo.get()->mPointerId, aInfo.get()->mPosition, POINTER_FLAG_CANCELED);
+  return (PLDHashOperator)(PL_DHASH_NEXT|PL_DHASH_REMOVE);
+}
+
+nsresult
+nsWindowBase::ClearNativeTouchSequence()
+{
+  if (!sTouchInjectInitialized) {
+    return NS_OK;
+  }
+
+  // cancel all input points
+  mActivePointers.Enumerate(CancelTouchPoints, (void*)this);
+
+  nsBaseWidget::ClearNativeTouchSequence();
+
+  return NS_OK;
+}
+
+
diff --git a/widget/windows/nsWindowBase.h b/widget/windows/nsWindowBase.h
index d073d7fcdf7d..a5740668c7ca 100644
--- a/widget/windows/nsWindowBase.h
+++ b/widget/windows/nsWindowBase.h
@@ -8,7 +8,10 @@
 
 #include "mozilla/EventForwards.h"
 #include "nsBaseWidget.h"
+#include "nsClassHashtable.h"
+
 #include <windows.h>
+#include "touchinjection_sdk80.h"
 
 /*
  * nsWindowBase - Base class of common methods other classes need to access
@@ -75,6 +78,42 @@ public:
     return (mInputContext.mIMEState.mEnabled == IMEState::PLUGIN);
   }
 
+public:
+  /*
+   * Touch input injection apis
+   */
+  virtual nsresult SynthesizeNativeTouchPoint(uint32_t aPointerId,
+                                              TouchPointerState aPointerState,
+                                              nsIntPoint aPointerScreenPoint,
+                                              double aPointerPressure,
+                                              uint32_t aPointerOrientation);
+  virtual nsresult ClearNativeTouchSequence();
+
+protected:
+  static bool InitTouchInjection();
+  bool InjectTouchPoint(uint32_t aId, nsIntPoint& aPointerScreenPoint,
+                        POINTER_FLAGS aFlags, uint32_t aPressure = 1024,
+                        uint32_t aOrientation = 90);
+
+  class PointerInfo
+  {
+  public:
+    PointerInfo(int32_t aPointerId, nsIntPoint& aPoint) :
+      mPointerId(aPointerId),
+      mPosition(aPoint)
+    {
+    }
+
+    int32_t mPointerId;
+    nsIntPoint mPosition;
+  };
+
+  static PLDHashOperator CancelTouchPoints(const unsigned int& aPointerId, nsAutoPtr<PointerInfo>& aInfo, void* aUserArg);
+
+  nsClassHashtable<nsUint32HashKey, PointerInfo> mActivePointers;
+  static bool sTouchInjectInitialized;
+  static InjectTouchInputPtr sInjectTouchFuncPtr;
+
 protected:
   InputContext mInputContext;
 };
diff --git a/widget/windows/touchinjection_sdk80.h b/widget/windows/touchinjection_sdk80.h
new file mode 100644
index 000000000000..e93f62089b3d
--- /dev/null
+++ b/widget/windows/touchinjection_sdk80.h
@@ -0,0 +1,107 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef touchinjection_sdk80_h
+#define touchinjection_sdk80_h
+
+// Note, this isn't inclusive of all touch injection header info.
+// You may need to add more to expand on current apis. 
+
+#ifndef TOUCH_FEEDBACK_DEFAULT
+
+#define TOUCH_FEEDBACK_DEFAULT 0x1
+#define TOUCH_FEEDBACK_INDIRECT 0x2
+#define TOUCH_FEEDBACK_NONE 0x3
+
+enum {
+  PT_POINTER  = 0x00000001,   // Generic pointer
+  PT_TOUCH    = 0x00000002,   // Touch
+  PT_PEN      = 0x00000003,   // Pen
+  PT_MOUSE    = 0x00000004,   // Mouse
+};
+
+typedef DWORD POINTER_INPUT_TYPE;
+typedef UINT32 POINTER_FLAGS;
+
+typedef enum {
+  POINTER_CHANGE_NONE,
+  POINTER_CHANGE_FIRSTBUTTON_DOWN,
+  POINTER_CHANGE_FIRSTBUTTON_UP,
+  POINTER_CHANGE_SECONDBUTTON_DOWN,
+  POINTER_CHANGE_SECONDBUTTON_UP,
+  POINTER_CHANGE_THIRDBUTTON_DOWN,
+  POINTER_CHANGE_THIRDBUTTON_UP,
+  POINTER_CHANGE_FOURTHBUTTON_DOWN,
+  POINTER_CHANGE_FOURTHBUTTON_UP,
+  POINTER_CHANGE_FIFTHBUTTON_DOWN,
+  POINTER_CHANGE_FIFTHBUTTON_UP,
+} POINTER_BUTTON_CHANGE_TYPE;
+
+typedef struct {
+  POINTER_INPUT_TYPE    pointerType;
+  UINT32          pointerId;
+  UINT32          frameId;
+  POINTER_FLAGS   pointerFlags;
+  HANDLE          sourceDevice;
+  HWND            hwndTarget;
+  POINT           ptPixelLocation;
+  POINT           ptHimetricLocation;
+  POINT           ptPixelLocationRaw;
+  POINT           ptHimetricLocationRaw;
+  DWORD           dwTime;
+  UINT32          historyCount;
+  INT32           InputData;
+  DWORD           dwKeyStates;
+  UINT64          PerformanceCount;
+  POINTER_BUTTON_CHANGE_TYPE ButtonChangeType;
+} POINTER_INFO;
+
+typedef UINT32 TOUCH_FLAGS;
+typedef UINT32 TOUCH_MASK;
+
+typedef struct {
+  POINTER_INFO    pointerInfo;
+  TOUCH_FLAGS     touchFlags;
+  TOUCH_MASK      touchMask;
+  RECT            rcContact;
+  RECT            rcContactRaw;
+  UINT32          orientation;
+  UINT32          pressure;
+} POINTER_TOUCH_INFO;
+
+#define TOUCH_FLAG_NONE                 0x00000000 // Default
+
+#define TOUCH_MASK_NONE                 0x00000000 // Default - none of the optional fields are valid
+#define TOUCH_MASK_CONTACTAREA          0x00000001 // The rcContact field is valid
+#define TOUCH_MASK_ORIENTATION          0x00000002 // The orientation field is valid
+#define TOUCH_MASK_PRESSURE             0x00000004 // The pressure field is valid
+
+#define POINTER_FLAG_NONE               0x00000000 // Default
+#define POINTER_FLAG_NEW                0x00000001 // New pointer
+#define POINTER_FLAG_INRANGE            0x00000002 // Pointer has not departed
+#define POINTER_FLAG_INCONTACT          0x00000004 // Pointer is in contact
+#define POINTER_FLAG_FIRSTBUTTON        0x00000010 // Primary action
+#define POINTER_FLAG_SECONDBUTTON       0x00000020 // Secondary action
+#define POINTER_FLAG_THIRDBUTTON        0x00000040 // Third button
+#define POINTER_FLAG_FOURTHBUTTON       0x00000080 // Fourth button
+#define POINTER_FLAG_FIFTHBUTTON        0x00000100 // Fifth button
+#define POINTER_FLAG_PRIMARY            0x00002000 // Pointer is primary
+#define POINTER_FLAG_CONFIDENCE         0x00004000 // Pointer is considered unlikely to be accidental
+#define POINTER_FLAG_CANCELED           0x00008000 // Pointer is departing in an abnormal manner
+#define POINTER_FLAG_DOWN               0x00010000 // Pointer transitioned to down state (made contact)
+#define POINTER_FLAG_UPDATE             0x00020000 // Pointer update
+#define POINTER_FLAG_UP                 0x00040000 // Pointer transitioned from down state (broke contact)
+#define POINTER_FLAG_WHEEL              0x00080000 // Vertical wheel
+#define POINTER_FLAG_HWHEEL             0x00100000 // Horizontal wheel
+#define POINTER_FLAG_CAPTURECHANGED     0x00200000 // Lost capture
+
+#endif // TOUCH_FEEDBACK_DEFAULT
+
+#define TOUCH_FLAGS_CONTACTUPDATE (POINTER_FLAG_UPDATE|POINTER_FLAG_INRANGE|POINTER_FLAG_INCONTACT)
+#define TOUCH_FLAGS_CONTACTDOWN (POINTER_FLAG_DOWN|POINTER_FLAG_INRANGE|POINTER_FLAG_INCONTACT)
+
+typedef BOOL (WINAPI* InitializeTouchInjectionPtr)(UINT32 maxCount, DWORD dwMode);
+typedef BOOL (WINAPI* InjectTouchInputPtr)(UINT32 count, CONST POINTER_TOUCH_INFO *info);
+
+#endif // touchinjection_sdk80_h
\ No newline at end of file

From f8072ac4970149cd1bde750051812ed1e9817540 Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Sat, 14 Dec 2013 14:40:56 -0600
Subject: [PATCH 413/459] Bug 945765 - Add some basic front end apzc tests to
 catch regressions. r=mbrubeck

---
 .../tests/mochitest/browser_apzc_basic.js     | 117 ++++++++++++++++++
 browser/metro/base/tests/mochitest/head.js    |  89 +++++++++++--
 browser/metro/base/tests/mochitest/metro.ini  |   2 +
 .../base/tests/mochitest/res/textdivs01.html  |  36 ++++++
 4 files changed, 235 insertions(+), 9 deletions(-)
 create mode 100644 browser/metro/base/tests/mochitest/browser_apzc_basic.js
 create mode 100644 browser/metro/base/tests/mochitest/res/textdivs01.html

diff --git a/browser/metro/base/tests/mochitest/browser_apzc_basic.js b/browser/metro/base/tests/mochitest/browser_apzc_basic.js
new file mode 100644
index 000000000000..8a49f1052013
--- /dev/null
+++ b/browser/metro/base/tests/mochitest/browser_apzc_basic.js
@@ -0,0 +1,117 @@
+// -*- Mode: js2; tab-width: 2; indent-tabs-mode: nil; js2-basic-offset: 2; js2-skip-preprocessor-directives: t; -*-
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+function test() {
+  if (!isLandscapeMode()) {
+    todo(false, "browser_snapped_tests need landscape mode to run.");
+    return;
+  }
+
+  runTests();
+}
+
+let kTransformTimeout = 5000;
+
+let gEdit = null;
+let tabAdded = false;
+
+function setUp() {
+  if (!tabAdded) {
+    yield addTab(chromeRoot + "res/textdivs01.html");
+    tabAdded = true;
+  }
+  yield hideContextUI();
+}
+
+/*
+gTests.push({
+  desc: "soft keyboard reliability",
+  setUp: setUp,
+  run: function() {
+    yield waitForMs(3000);
+
+    let edit = Browser.selectedBrowser.contentDocument.getElementById("textinput");
+    // show the soft keyboard
+    let keyboardPromise = waitForObserver("metro_softkeyboard_shown", 20000);
+    sendNativeTap(edit);
+    yield waitForMs(5000);
+    sendNativeTap(edit);
+    yield keyboardPromise;
+    yield waitForMs(5000);
+
+    // hide the soft keyboard / navbar
+    keyboardPromise = waitForObserver("metro_softkeyboard_hidden", 20000);
+    sendNativeTap(Browser.selectedBrowser.contentDocument.getElementById("first"));
+    yield keyboardPromise;
+    yield waitForMs(5000);
+  },
+  tearDown: function () {
+    clearNativeTouchSequence();
+  }
+});
+*/
+
+gTests.push({
+  desc: "native long tap works",
+  setUp: setUp,
+  run: function() {
+    let edit = Browser.selectedBrowser.contentDocument.getElementById("textinput");
+    let promise = waitForEvent(document, "popupshown");
+    sendNativeLongTap(edit);
+    yield promise;
+    ContextMenuUI.hide();
+  },
+  tearDown: function () {
+    clearNativeTouchSequence();
+  }
+});
+
+gTests.push({
+  desc: "double tap transforms",
+  setUp: setUp,
+  run: function() {
+    let beginPromise = waitForObserver("apzc-transform-begin", kTransformTimeout);
+    let endPromise = waitForObserver("apzc-transform-end", kTransformTimeout);
+
+    sendNativeDoubleTap(Browser.selectedBrowser.contentDocument.getElementById("second"));
+
+    yield beginPromise;
+    yield endPromise;
+
+    beginPromise = waitForObserver("apzc-transform-begin", kTransformTimeout);
+    endPromise = waitForObserver("apzc-transform-end", kTransformTimeout);
+
+    sendNativeDoubleTap(Browser.selectedBrowser.contentDocument.getElementById("second"));
+
+    yield beginPromise;
+    yield endPromise;
+  },
+  tearDown: function () {
+    clearNativeTouchSequence();
+  }
+});
+
+gTests.push({
+  desc: "scroll transforms",
+  setUp: setUp,
+  run: function() {
+    let beginPromise = waitForObserver("apzc-transform-begin", kTransformTimeout);
+    let endPromise = waitForObserver("apzc-transform-end", kTransformTimeout);
+
+    var touchdrag = new TouchDragAndHold();
+    touchdrag.useNativeEvents = true;
+    touchdrag.nativePointerId = 1;
+    yield touchdrag.start(Browser.selectedTab.browser.contentWindow,
+                          10, 100, 10, 10);
+    touchdrag.end();
+
+    yield beginPromise;
+    yield endPromise;
+  },
+  tearDown: function () {
+    clearNativeTouchSequence();
+  }
+});
diff --git a/browser/metro/base/tests/mochitest/head.js b/browser/metro/base/tests/mochitest/head.js
index 9aa24539f446..3812ee6d8f21 100644
--- a/browser/metro/base/tests/mochitest/head.js
+++ b/browser/metro/base/tests/mochitest/head.js
@@ -557,8 +557,11 @@ function waitForObserver(aObsEvent, aTimeoutMs) {
 }
 
 /*=============================================================================
-  Native input synthesis helpers
-=============================================================================*/
+ * Native input helpers - these helpers send input directly to the os
+ * generating os level input events that get processed by widget and
+ * apzc logic.
+ *===========================================================================*/
+
 // Keyboard layouts for use with synthesizeNativeKey
 const usEnglish = 0x409;
 const arSpanish = 0x2C0A;
@@ -640,6 +643,36 @@ function synthesizeNativeMouseMUp(aElement, aOffsetX, aOffsetY) {
                         0x0040);  // MOUSEEVENTF_MIDDLEUP
 }
 
+// WARNING: these calls can trigger the soft keyboard on tablets, but not
+// on test slaves (bug 947428).
+// WARNING: When testing the apzc, be careful of bug 933990. Events sent
+// shortly after loading a page may get ignored.
+
+function sendNativeLongTap(aElement, aX, aY) {
+  let coords = logicalCoordsForElement(aElement, aX, aY);
+  Browser.windowUtils.sendNativeTouchTap(coords.x, coords.y, true);
+}
+
+function sendNativeTap(aElement, aX, aY) {
+  let coords = logicalCoordsForElement(aElement, aX, aY);
+  Browser.windowUtils.sendNativeTouchTap(coords.x, coords.y, false);
+}
+
+function sendNativeDoubleTap(aElement, aX, aY) {
+  let coords = logicalCoordsForElement(aElement, aX, aY);
+  Browser.windowUtils.sendNativeTouchTap(coords.x, coords.y, false);
+  Browser.windowUtils.sendNativeTouchTap(coords.x, coords.y, false);
+}
+
+function clearNativeTouchSequence() {
+  Browser.windowUtils.clearNativeTouchSequence();
+}
+
+/*=============================================================================
+ * Synthesized event helpers - these helpers synthesize input events that get
+ * dispatched directly to the dom. As such widget and apzc logic is bypassed.
+ *===========================================================================*/
+
 /*
  * logicalCoordsForElement - given coordinates relative to top-left of
  * given element, returns logical coordinates for window. If a non-numeric
@@ -784,6 +817,17 @@ TouchDragAndHold.prototype = {
   _numSteps: 50,
   _debug: false,
   _win: null,
+  _native: false,
+  _pointerId: 1,
+  _dui: Components.interfaces.nsIDOMWindowUtils,
+
+  set useNativeEvents(aValue) {
+    this._native = aValue;
+  },
+
+  set nativePointerId(aValue) {
+    this._pointerId = aValue;
+  },
 
   callback: function callback() {
     if (this._win == null)
@@ -795,8 +839,14 @@ TouchDragAndHold.prototype = {
     }
 
     if (++this._step.steps >= this._numSteps) {
-      EventUtils.synthesizeTouchAtPoint(this._endPoint.xPos, this._endPoint.yPos,
-                                        { type: "touchmove" }, this._win);
+      if (this._native) {
+        this._utils.sendNativeTouchPoint(this._pointerId, this._dui.TOUCH_CONTACT,
+                                         this._endPoint.xPos, this._endPoint.yPos,
+                                         1, 90);
+      } else {
+        EventUtils.synthesizeTouchAtPoint(this._endPoint.xPos, this._endPoint.yPos,
+                                          { type: "touchmove" }, this._win);
+      }
       this._defer.resolve();
       return;
     }
@@ -805,8 +855,16 @@ TouchDragAndHold.prototype = {
     if (this._debug) {
       info("[" + this._step.steps + "] touchmove " + this._currentPoint.xPos + " x " + this._currentPoint.yPos);
     }
-    EventUtils.synthesizeTouchAtPoint(this._currentPoint.xPos, this._currentPoint.yPos,
-                                      { type: "touchmove" }, this._win);
+
+    if (this._native) {
+      this._utils.sendNativeTouchPoint(this._pointerId, this._dui.TOUCH_CONTACT,
+                                       this._currentPoint.xPos, this._currentPoint.yPos,
+                                       1, 90);
+    } else {
+      EventUtils.synthesizeTouchAtPoint(this._currentPoint.xPos, this._currentPoint.yPos,
+                                        { type: "touchmove" }, this._win);
+    }
+
     let self = this;
     setTimeout(function () { self.callback(); }, this._timeoutStep);
   },
@@ -814,13 +872,20 @@ TouchDragAndHold.prototype = {
   start: function start(aWindow, aStartX, aStartY, aEndX, aEndY) {
     this._defer = Promise.defer();
     this._win = aWindow;
+    this._utils = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                         .getInterface(Ci.nsIDOMWindowUtils);
     this._endPoint = { xPos: aEndX, yPos: aEndY };
     this._currentPoint = { xPos: aStartX, yPos: aStartY };
     this._step = { steps: 0, x: (aEndX - aStartX) / this._numSteps, y: (aEndY - aStartY) / this._numSteps };
     if (this._debug) {
       info("[0] touchstart " + aStartX + " x " + aStartY);
     }
-    EventUtils.synthesizeTouchAtPoint(aStartX, aStartY, { type: "touchstart" }, aWindow);
+    if (this._native) {
+      this._utils.sendNativeTouchPoint(this._pointerId, this._dui.TOUCH_CONTACT,
+                                       aStartX, aStartY, 1, 90);
+    } else {
+      EventUtils.synthesizeTouchAtPoint(aStartX, aStartY, { type: "touchstart" }, aWindow);
+    }
     let self = this;
     setTimeout(function () { self.callback(); }, this._timeoutStep);
     return this._defer.promise;
@@ -847,8 +912,14 @@ TouchDragAndHold.prototype = {
       info("[" + this._step.steps + "] touchend " + this._endPoint.xPos + " x " + this._endPoint.yPos);
       SelectionHelperUI.debugClearDebugPoints();
     }
-    EventUtils.synthesizeTouchAtPoint(this._endPoint.xPos, this._endPoint.yPos,
-                                      { type: "touchend" }, this._win);
+    if (this._native) {
+      this._utils.sendNativeTouchPoint(this._pointerId, this._dui.TOUCH_REMOVE,
+                                       this._endPoint.xPos, this._endPoint.yPos,
+                                       1, 90);
+    } else {
+      EventUtils.synthesizeTouchAtPoint(this._endPoint.xPos, this._endPoint.yPos,
+                                        { type: "touchend" }, this._win);
+    }
     this._win = null;
   },
 };
diff --git a/browser/metro/base/tests/mochitest/metro.ini b/browser/metro/base/tests/mochitest/metro.ini
index 307029ee5c6d..e3a68774ec92 100644
--- a/browser/metro/base/tests/mochitest/metro.ini
+++ b/browser/metro/base/tests/mochitest/metro.ini
@@ -24,6 +24,7 @@ support-files =
   helpers/ViewStateHelper.js
   res/image01.png
   res/textblock01.html
+  res/textdivs01.html
   res/textinput01.html
   res/textarea01.html
   res/testEngine.xml
@@ -55,6 +56,7 @@ support-files =
 [browser_urlbar.js]
 [browser_urlbar_highlightURLs.js]
 [browser_urlbar_trimURLs.js]
+[browser_apzc_basic.js]
 
 # These tests have known failures in debug builds
 [browser_selection_basic.js]
diff --git a/browser/metro/base/tests/mochitest/res/textdivs01.html b/browser/metro/base/tests/mochitest/res/textdivs01.html
new file mode 100644
index 000000000000..dd6ecc348318
--- /dev/null
+++ b/browser/metro/base/tests/mochitest/res/textdivs01.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8" />
+<style>
+div
+{
+  padding: 25px;
+  width: 300px;
+  display: block;
+}
+</style>
+</head>
+<body>
+<br />
+<input id="textinput" style="width:100px; height:25px;" value="The rabbit-hole went straight on like a tunnel for some way and then dipped suddenly down" type="text">
+<div id="first">
+    Alice was beginning to get very tired of sitting by her sister on the bank, and of having
+    nothing to do: once or twice she had peeped into the book her sister was reading 
+    but it had no pictures or conversations in it, `and what is the use of a book,' thought
+    Alice `without pictures or conversation?'
+</div>
+<div id="second">
+    Alice was beginning to get very tired of sitting by her sister on the bank, and of having
+    nothing to do: once or twice she had peeped into the book her sister was reading, but it
+    had no pictures or conversations in it, `and what is the use of a book,' thought Alice
+    `without pictures or conversation?'
+</div>
+<div id="third">
+    So she was considering in her own mind (as well as she could, for the hot day made her
+    feel very sleepy and stupid), whether the pleasure of making a daisy-chain would be worth
+    the trouble of getting up and picking the daisies, when suddenly a White Rabbit with pink
+    eyes ran close by her.
+</div>
+<div style="height:1000px;"></div>
+</body></html>
\ No newline at end of file

From a1a1ededd04c2d3c14e8720ceab32b9c616746ab Mon Sep 17 00:00:00 2001
From: Jim Mathies <jmathies@mozilla.com>
Date: Sat, 14 Dec 2013 14:40:56 -0600
Subject: [PATCH 414/459] Bug 947146 - Remove hover states from elements that
 get touch tapped, plus some tests. r=mbrubeck

---
 .../mochitest/browser_menu_hoverstate.js      | 147 ++++++++++++++++++
 browser/metro/base/tests/mochitest/metro.ini  |   1 +
 widget/windows/winrt/MetroInput.cpp           |  44 +++---
 widget/windows/winrt/MetroWidget.cpp          |  16 +-
 widget/windows/winrt/MetroWidget.h            |   2 +
 5 files changed, 186 insertions(+), 24 deletions(-)
 create mode 100644 browser/metro/base/tests/mochitest/browser_menu_hoverstate.js

diff --git a/browser/metro/base/tests/mochitest/browser_menu_hoverstate.js b/browser/metro/base/tests/mochitest/browser_menu_hoverstate.js
new file mode 100644
index 000000000000..59e6dcb1286a
--- /dev/null
+++ b/browser/metro/base/tests/mochitest/browser_menu_hoverstate.js
@@ -0,0 +1,147 @@
+// -*- Mode: js2; tab-width: 2; indent-tabs-mode: nil; js2-basic-offset: 2; js2-skip-preprocessor-directives: t; -*-
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+function test() {
+  if (!isLandscapeMode()) {
+    todo(false, "browser_snapped_tests need landscape mode to run.");
+    return;
+  }
+
+  runTests();
+}
+let tabAdded = false;
+
+function setUp() {
+  if (!tabAdded) {
+    yield addTab(chromeRoot + "res/textdivs01.html");
+    tabAdded = true;
+  }
+  yield hideContextUI();
+}
+
+XPCOMUtils.defineLazyServiceGetter(this, "gDOMUtils",
+  "@mozilla.org/inspector/dom-utils;1", "inIDOMUtils");
+
+const kActiveState = 0x00000001;
+const kHoverState = 0x00000004;
+
+gTests.push({
+  desc: "hover states of menus",
+  setUp: setUp,
+  run: function() {
+    // Clicking on menu items should not leave the clicked menu item
+    // in the :active or :hover state.
+
+    let typesArray = [
+      "copy",
+      "paste"
+    ];
+
+    let promise = waitForEvent(document, "popupshown");
+    ContextMenuUI.showContextMenu({
+      target: null,
+      json: {
+        types: typesArray,
+        string: '',
+        xPos: 1,
+        yPos: 1,
+        leftAligned: true,
+        bottomAligned: true
+    }});
+    yield promise;
+
+    // should be visible
+    ok(ContextMenuUI._menuPopup.visible, "is visible");
+
+    let menuItem = document.getElementById("context-copy");
+    promise = waitForEvent(document, "popuphidden");
+    sendNativeTap(menuItem);
+    yield promise;
+
+    for (let idx = 0; idx < ContextMenuUI.commands.childNodes.length; idx++) {
+      let item = ContextMenuUI.commands.childNodes[idx];
+      let state = gDOMUtils.getContentState(item);
+      if ((state & kHoverState) || (state & kActiveState)) {
+        ok(false, "found invalid state on context menu item (" + state.toString(2) + ")");
+      }
+    }
+
+    // Do it again, but this time check the visible menu too and
+    // click a different menu item.
+    promise = waitForEvent(document, "popupshown");
+    ContextMenuUI.showContextMenu({
+      target: null,
+      json: {
+        types: typesArray,
+        string: '',
+        xPos: 1,
+        yPos: 1,
+        leftAligned: true,
+        bottomAligned: true
+    }});
+    yield promise;
+
+    // should be visible
+    ok(ContextMenuUI._menuPopup.visible, "is visible");
+
+    for (let idx = 0; idx < ContextMenuUI.commands.childNodes.length; idx++) {
+      let item = ContextMenuUI.commands.childNodes[idx];
+      let state = gDOMUtils.getContentState(item);
+      if ((state & kHoverState) || (state & kActiveState)) {
+        ok(false, "found invalid state on context menu item (" + state.toString(2) + ")");
+      }
+    }
+
+    menuItem = document.getElementById("context-paste");
+    promise = waitForEvent(document, "popuphidden");
+    sendNativeTap(menuItem);
+    yield promise;
+
+    for (let idx = 0; idx < ContextMenuUI.commands.childNodes.length; idx++) {
+      let item = ContextMenuUI.commands.childNodes[idx];
+      let state = gDOMUtils.getContentState(item);
+      if ((state & kHoverState) || (state & kActiveState)) {
+        ok(false, "found invalid state on context menu item (" + state.toString(2) + ")");
+      }
+    }
+  },
+  tearDown: function () {
+    clearNativeTouchSequence();
+  }
+});
+
+gTests.push({
+  desc: "hover states of nav bar buttons",
+  setUp: setUp,
+  run: function() {
+    // show nav bar
+    yield showNavBar();
+
+    // tap bookmark button
+    sendNativeTap(Appbar.starButton);
+    yield waitForMs(100);
+    
+    // check hover state
+    let state = gDOMUtils.getContentState(Appbar.starButton);
+    if ((state & kHoverState) || (state & kActiveState)) {
+      ok(false, "found invalid state on star button (" + state.toString(2) + ")");
+    }
+
+    // tap bookmark button
+    sendNativeTap(Appbar.starButton);
+    yield waitForMs(100);
+    
+    // check hover state
+    let state = gDOMUtils.getContentState(Appbar.starButton);
+    if ((state & kHoverState) || (state & kActiveState)) {
+      ok(false, "found invalid state on star button (" + state.toString(2) + ")");
+    }
+  },
+  tearDown: function () {
+    clearNativeTouchSequence();
+  }
+});
+
diff --git a/browser/metro/base/tests/mochitest/metro.ini b/browser/metro/base/tests/mochitest/metro.ini
index e3a68774ec92..f3d3825d3003 100644
--- a/browser/metro/base/tests/mochitest/metro.ini
+++ b/browser/metro/base/tests/mochitest/metro.ini
@@ -57,6 +57,7 @@ support-files =
 [browser_urlbar_highlightURLs.js]
 [browser_urlbar_trimURLs.js]
 [browser_apzc_basic.js]
+[browser_menu_hoverstate.js]
 
 # These tests have known failures in debug builds
 [browser_selection_basic.js]
diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index 73768b215b09..d8e02ecabf12 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -16,6 +16,8 @@
 #include "mozilla/MouseEvents.h"
 #include "mozilla/TouchEvents.h"
 #include "WinUtils.h"
+#include "nsIPresShell.h"
+#include "nsEventStateManager.h"
 
 // System headers (alphabetical)
 #include <windows.ui.core.h> // ABI::Window::UI::Core namespace
@@ -966,7 +968,6 @@ MetroInput::HandleTap(const Foundation::Point& aPoint, unsigned int aTapCount)
     return;
   }
 
-  // send mousemove
   WidgetMouseEvent* mouseEvent =
     new WidgetMouseEvent(true, NS_MOUSE_MOVE, mWidget.Get(),
                          WidgetMouseEvent::eReal, WidgetMouseEvent::eNormal);
@@ -975,7 +976,6 @@ MetroInput::HandleTap(const Foundation::Point& aPoint, unsigned int aTapCount)
   mouseEvent->inputSource = nsIDOMMouseEvent::MOZ_SOURCE_TOUCH;
   DispatchAsyncEventIgnoreStatus(mouseEvent);
 
-  // Send the mousedown
   mouseEvent =
     new WidgetMouseEvent(true, NS_MOUSE_BUTTON_DOWN, mWidget.Get(),
                          WidgetMouseEvent::eReal, WidgetMouseEvent::eNormal);
@@ -993,22 +993,6 @@ MetroInput::HandleTap(const Foundation::Point& aPoint, unsigned int aTapCount)
   mouseEvent->inputSource = nsIDOMMouseEvent::MOZ_SOURCE_TOUCH;
   mouseEvent->button = WidgetMouseEvent::buttonType::eLeftButton;
   DispatchAsyncEventIgnoreStatus(mouseEvent);
-
-  // Send one more mousemove to avoid getting a hover state.
-  // In the Metro environment for any application, a tap does not imply a
-  // mouse cursor move.  In desktop environment for any application a tap
-  // does imply a cursor move.
-  POINT point;
-  if (GetCursorPos(&point)) {
-    ScreenToClient((HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW), &point);
-    mouseEvent =
-      new WidgetMouseEvent(true, NS_MOUSE_MOVE, mWidget.Get(),
-                           WidgetMouseEvent::eReal, WidgetMouseEvent::eNormal);
-    mouseEvent->refPoint = LayoutDeviceIntPoint(point.x, point.y);
-    mouseEvent->clickCount = aTapCount;
-    mouseEvent->inputSource = nsIDOMMouseEvent::MOZ_SOURCE_TOUCH;
-    DispatchAsyncEventIgnoreStatus(mouseEvent);
-  }
 }
 
 void
@@ -1048,11 +1032,27 @@ MetroInput::DispatchAsyncEventIgnoreStatus(WidgetInputEvent* aEvent)
 void
 MetroInput::DeliverNextQueuedEventIgnoreStatus()
 {
-  WidgetGUIEvent* event =
+  nsAutoPtr<WidgetGUIEvent> event =
     static_cast<WidgetGUIEvent*>(mInputEventQueue.PopFront());
-  MOZ_ASSERT(event);
-  DispatchEventIgnoreStatus(event);
-  delete event;
+  MOZ_ASSERT(event.get());
+  DispatchEventIgnoreStatus(event.get());
+
+  // Clear :hover/:active states for mouse events generated by HandleTap
+  WidgetMouseEvent* mouseEvent = event.get()->AsMouseEvent();
+  if (!mouseEvent) {
+    return;
+  }
+  if (mouseEvent->message != NS_MOUSE_BUTTON_UP ||
+      mouseEvent->inputSource != nsIDOMMouseEvent::MOZ_SOURCE_TOUCH) {
+    return;
+  }
+  nsCOMPtr<nsIPresShell> presShell = mWidget->GetPresShell();
+  if (presShell) {
+    nsEventStateManager* esm = presShell->GetPresContext()->EventStateManager();
+    if (esm) {
+      esm->SetContentState(nullptr, NS_EVENT_STATE_HOVER);
+    }
+  }
 }
 
 void
diff --git a/widget/windows/winrt/MetroWidget.cpp b/widget/windows/winrt/MetroWidget.cpp
index 4eb2d95493f6..deeb3f7a02d9 100644
--- a/widget/windows/winrt/MetroWidget.cpp
+++ b/widget/windows/winrt/MetroWidget.cpp
@@ -1346,7 +1346,8 @@ MetroWidget::CSSIntPointToLayoutDeviceIntPoint(const CSSIntPoint &aCSSPoint)
   return devPx;
 }
 
-float MetroWidget::GetDPI()
+float
+MetroWidget::GetDPI()
 {
   if (!mView) {
     return 96.0;
@@ -1354,7 +1355,8 @@ float MetroWidget::GetDPI()
   return mView->GetDPI();
 }
 
-void MetroWidget::ChangedDPI()
+void
+MetroWidget::ChangedDPI()
 {
   if (mWidgetListener) {
     nsIPresShell* presShell = mWidgetListener->GetPresShell();
@@ -1364,6 +1366,16 @@ void MetroWidget::ChangedDPI()
   }
 }
 
+already_AddRefed<nsIPresShell>
+MetroWidget::GetPresShell()
+{
+  if (mWidgetListener) {
+    nsCOMPtr<nsIPresShell> ps = mWidgetListener->GetPresShell();
+    return ps.forget();
+  }
+  return nullptr;
+}
+
 NS_IMETHODIMP
 MetroWidget::ConstrainPosition(bool aAllowSlop, int32_t *aX, int32_t *aY)
 {
diff --git a/widget/windows/winrt/MetroWidget.h b/widget/windows/winrt/MetroWidget.h
index 7c57e1a78e33..084267aad60f 100644
--- a/widget/windows/winrt/MetroWidget.h
+++ b/widget/windows/winrt/MetroWidget.h
@@ -175,6 +175,8 @@ public:
   virtual void  FreeNativeData(void * data, uint32_t aDataType);
   virtual nsIntPoint WidgetToScreenOffset();
 
+  already_AddRefed<nsIPresShell> GetPresShell();
+
   void UserActivity();
 
 #ifdef ACCESSIBILITY

From c3404e294cb34a4239cc7c46c85fc0caf93812e0 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sat, 14 Dec 2013 13:55:23 -0800
Subject: [PATCH 415/459] Bumping gaia.json for 1 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/de7d1d59e942
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Revert "Revert "Merge pull request #14667 from mcav/utf7""

This reverts commit 7852023abb572c522a07af558e7c19f557cc4866.

That was a wrong revert, it didn't fix the failing tests.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 4a263b166708..bf77336385d2 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "5449cb5b262e434869f7d0926ccc675c77e1b9f1", 
+    "revision": "de7d1d59e9424ae0952f773c46dad879e5cdc2ae", 
     "repo_path": "/integration/gaia-central"
 }

From 1a8912a93e2627b0bb34d49fff2a49446e75b199 Mon Sep 17 00:00:00 2001
From: Marco Castelluccio <mar.castelluccio@studenti.unina.it>
Date: Sun, 15 Dec 2013 14:03:28 -0500
Subject: [PATCH 416/459] Bug 917673 - Throw APP_PACKAGE_INVALID when the JAR
 is invalid and throw APP_PACKAGE_CORRUPT when the JAR has been tampered with.
 r=fabrice

---
 dom/apps/src/Webapps.jsm | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/dom/apps/src/Webapps.jsm b/dom/apps/src/Webapps.jsm
index 167c02901422..655c9174c516 100755
--- a/dom/apps/src/Webapps.jsm
+++ b/dom/apps/src/Webapps.jsm
@@ -2958,8 +2958,15 @@ onInstallSuccessAck: function onInstallSuccessAck(aManifestURL,
 
       if (Components.isSuccessCode(result)) {
         isSigned = true;
-      } else if (result == Cr.NS_ERROR_FILE_CORRUPTED) {
+      } else if (result == Cr.NS_ERROR_SIGNED_JAR_MODIFIED_ENTRY ||
+                 result == Cr.NS_ERROR_SIGNED_JAR_UNSIGNED_ENTRY ||
+                 result == Cr.NS_ERROR_SIGNED_JAR_ENTRY_MISSING) {
         throw "APP_PACKAGE_CORRUPTED";
+      } else if (result == Cr.NS_ERROR_FILE_CORRUPTED ||
+                 result == Cr.NS_ERROR_SIGNED_JAR_ENTRY_TOO_LARGE ||
+                 result == Cr.NS_ERROR_SIGNED_JAR_ENTRY_INVALID ||
+                 result == Cr.NS_ERROR_SIGNED_JAR_MANIFEST_INVALID) {
+        throw "APP_PACKAGE_INVALID";
       } else if ((!aIsLocalFileInstall || isLaterThanBuildTime) &&
                  (result != Cr.NS_ERROR_SIGNED_JAR_NOT_SIGNED)) {
         throw "INVALID_SIGNATURE";

From 9986b0074f42bef19b3dab210018840ee93e9d65 Mon Sep 17 00:00:00 2001
From: Jason Smith <jsmith@mozilla.com>
Date: Sat, 14 Dec 2013 15:49:09 -0800
Subject: [PATCH 417/459] Bug 950406 - Turn on P2P mochitests in b2g desktop
 builds. r=jesup

---
 testing/mochitest/b2g-desktop.json | 27 ---------------------------
 1 file changed, 27 deletions(-)

diff --git a/testing/mochitest/b2g-desktop.json b/testing/mochitest/b2g-desktop.json
index b2d73839b6ac..f611c6216579 100644
--- a/testing/mochitest/b2g-desktop.json
+++ b/testing/mochitest/b2g-desktop.json
@@ -294,33 +294,6 @@
 
     "dom/imptests/editing/conformancetest/test_runtest.html":"takes too long",
 
-    "dom/media/tests/mochitest/test_dataChannel_basicAudio.html":"bug 908473",
-    "dom/media/tests/mochitest/test_dataChannel_basicAudioVideo.html":"",
-    "dom/media/tests/mochitest/test_dataChannel_basicAudioVideoCombined.html":"",
-    "dom/media/tests/mochitest/test_dataChannel_basicDataOnly.html":"",
-    "dom/media/tests/mochitest/test_dataChannel_basicVideo.html":"",
-    "dom/media/tests/mochitest/test_dataChannel_noOffer.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_addCandidateInHaveLocalOffer.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_basicAudio.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_basicAudioVideo.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_basicAudioVideoCombined.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_basicVideo.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_bug822674.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_bug825703.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_bug827843.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_bug834153.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_bug835370.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_errorCallbacks.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveAudio.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideo.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideoAudio.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_setLocalAnswerInHaveLocalOffer.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_setLocalAnswerInStable.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_setLocalOfferInHaveRemoteOffer.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_setRemoteAnswerInHaveRemoteOffer.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_setRemoteAnswerInStable.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_setRemoteOfferInHaveLocalOffer.html":"",
-    "dom/media/tests/mochitest/test_peerConnection_throwInCallbacks.html":"",
     "dom/media/tests/ipc/test_ipc.html":"nested ipc not working",
 
     "dom/network/tests/test_networkstats_basics.html":"Will be fixed in bug 858005",

From 1ec93cb6e12f85abd1ddeb15d03c5b9f3bf6dbff Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sat, 14 Dec 2013 18:48:06 -0800
Subject: [PATCH 418/459] Back out 2412b1a7b97e (bug 863872) for Android
 xpcshell orange

---
 .../components/telemetry/TelemetryFile.jsm    |  75 +----
 toolkit/components/telemetry/TelemetryPing.js |  26 +-
 .../tests/unit/test_TelemetryPing.js          |   4 +-
 .../tests/unit/test_TelemetrySendOldPings.js  | 265 ------------------
 .../telemetry/tests/unit/xpcshell.ini         |   2 -
 5 files changed, 19 insertions(+), 353 deletions(-)
 delete mode 100644 toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js

diff --git a/toolkit/components/telemetry/TelemetryFile.jsm b/toolkit/components/telemetry/TelemetryFile.jsm
index 8db9eb815b58..7a21d5c2fd4e 100644
--- a/toolkit/components/telemetry/TelemetryFile.jsm
+++ b/toolkit/components/telemetry/TelemetryFile.jsm
@@ -22,13 +22,8 @@ const PR_EXCL = 0x80;
 const RW_OWNER = parseInt("0600", 8);
 const RWX_OWNER = parseInt("0700", 8);
 
-// Files that have been lying around for longer than MAX_PING_FILE_AGE are
-// deleted without being loaded.
-const MAX_PING_FILE_AGE = 14 * 24 * 60 * 60 * 1000; // 2 weeks
-
-// Files that are older than OVERDUE_PING_FILE_AGE, but younger than
-// MAX_PING_FILE_AGE indicate that we need to send all of our pings ASAP.
-const OVERDUE_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
+// Delete ping files that have been lying around for longer than this.
+const MAX_PING_FILE_AGE = 7 * 24 * 60 * 60 * 1000; // 1 week
 
 // The number of outstanding saved pings that we have issued loading
 // requests for.
@@ -37,14 +32,6 @@ let pingsLoaded = 0;
 // The number of those requests that have actually completed.
 let pingLoadsCompleted = 0;
 
-// The number of pings that we have destroyed due to being older
-// than MAX_PING_FILE_AGE.
-let pingsDiscarded = 0;
-
-// The number of pings that are older than OVERDUE_PING_FILE_AGE
-// but younger than MAX_PING_FILE_AGE.
-let pingsOverdue = 0;
-
 // If |true|, send notifications "telemetry-test-save-complete"
 // and "telemetry-test-load-complete" once save/load is complete.
 let shouldNotifyUponSave = false;
@@ -54,14 +41,6 @@ let pendingPings = [];
 
 this.TelemetryFile = {
 
-  get MAX_PING_FILE_AGE() {
-    return MAX_PING_FILE_AGE;
-  },
-
-  get OVERDUE_PING_FILE_AGE() {
-    return OVERDUE_PING_FILE_AGE;
-  },
-
   /**
    * Save a single ping to a file.
    *
@@ -163,7 +142,7 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadSavedPings: function(sync, onLoad = null, onDone = null) {
+  loadSavedPings: function(sync, onLoad = null) {
     let directory = ensurePingDirectory();
     let entries = directory.directoryEntries
                            .QueryInterface(Ci.nsIDirectoryEnumerator);
@@ -171,7 +150,7 @@ this.TelemetryFile = {
     pingLoadsCompleted = 0;
     try {
       while (entries.hasMoreElements()) {
-        this.loadHistograms(entries.nextFile, sync, onLoad, onDone);
+        this.loadHistograms(entries.nextFile, sync, onLoad);
       }
     } finally {
       entries.close();
@@ -190,26 +169,20 @@ this.TelemetryFile = {
    * ping. It is passed |true| in case of success, |false| in case of
    * format error.
    */
-  loadHistograms: function loadHistograms(file, sync, onLoad = null, onDone = null) {
-    let now = Date.now();
+  loadHistograms: function loadHistograms(file, sync, onLoad = null) {
+    let now = new Date();
     if (now - file.lastModifiedTime > MAX_PING_FILE_AGE) {
       // We haven't had much luck in sending this file; delete it.
       file.remove(true);
-      pingsDiscarded++;
       return;
     }
 
-    // This file is a bit stale, and overdue for sending.
-    if (now - file.lastModifiedTime > OVERDUE_PING_FILE_AGE) {
-      pingsOverdue++;
-    }
-
     pingsLoaded++;
     if (sync) {
       let stream = Cc["@mozilla.org/network/file-input-stream;1"]
                    .createInstance(Ci.nsIFileInputStream);
       stream.init(file, -1, -1, 0);
-      addToPendingPings(file, stream, onLoad, onDone);
+      addToPendingPings(file, stream, onLoad);
     } else {
       let channel = NetUtil.newChannel(file);
       channel.contentType = "application/json";
@@ -218,7 +191,7 @@ this.TelemetryFile = {
         if (!Components.isSuccessCode(result)) {
           return;
         }
-        addToPendingPings(file, stream, onLoad, onDone);
+        addToPendingPings(file, stream, onLoad);
       }).bind(this));
     }
   },
@@ -230,22 +203,6 @@ this.TelemetryFile = {
     return pingsLoaded;
   },
 
-  /**
-   * The number of pings loaded that are older than OVERDUE_PING_FILE_AGE
-   * but younger than MAX_PING_FILE_AGE.
-   */
-  get pingsOverdue() {
-    return pingsOverdue;
-  },
-
-  /**
-   * The number of pings that we just tossed out for being older than
-   * MAX_PING_FILE_AGE.
-   */
-  get pingsDiscarded() {
-    return pingsDiscarded;
-  },
-
   /**
    * Iterate destructively through the pending pings.
    *
@@ -292,7 +249,7 @@ function ensurePingDirectory() {
   return directory;
 };
 
-function addToPendingPings(file, stream, onLoad, onDone) {
+function addToPendingPings(file, stream, onLoad) {
   let success = false;
 
   try {
@@ -306,25 +263,19 @@ function addToPendingPings(file, stream, onLoad, onDone) {
     }
     pingLoadsCompleted++;
     pendingPings.push(ping);
+    if (shouldNotifyUponSave &&
+        pingLoadsCompleted == pingsLoaded) {
+      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
+    }
     success = true;
   } catch (e) {
     // An error reading the file, or an error parsing the contents.
     stream.close();           // close is idempotent.
     file.remove(true); // FIXME: Should be false, isn't it?
   }
-
   if (onLoad) {
     onLoad(success);
   }
-
-  if (pingLoadsCompleted == pingsLoaded) {
-    if (onDone) {
-      onDone();
-    }
-    if (shouldNotifyUponSave) {
-      Services.obs.notifyObservers(null, "telemetry-test-load-complete", null);
-    }
-  }
 };
 
 function finishTelemetrySave(ok, stream) {
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index b265432610ac..6a34661fb0e0 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -39,8 +39,6 @@ const PREF_PREVIOUS_BUILDID = PREF_BRANCH + "previousBuildID";
 const TELEMETRY_INTERVAL = 60000;
 // Delay before intializing telemetry (ms)
 const TELEMETRY_DELAY = 60000;
-// Delay before initializing telemetry if we're testing (ms)
-const TELEMETRY_TEST_DELAY = 100;
 
 // Seconds of idle time before pinging.
 // On idle-daily a gather-telemetry notification is fired, during it probes can
@@ -220,9 +218,6 @@ TelemetryPing.prototype = {
       ret.savedPings = TelemetryFile.pingsLoaded;
     }
 
-    ret.pingsOverdue = TelemetryFile.pingsOverdue;
-    ret.pingsDiscarded = TelemetryFile.pingsDiscarded;
-
     return ret;
   },
 
@@ -603,9 +598,7 @@ TelemetryPing.prototype = {
 
   popPayloads: function popPayloads(reason) {
     function payloadIter() {
-      if (reason != "overdue-flush") {
-        yield this.getSessionPayloadAndSlug(reason);
-      }
+      yield this.getSessionPayloadAndSlug(reason);
       let iterator = TelemetryFile.popPendingPings(reason);
       for (let data of iterator) {
         yield data;
@@ -767,7 +760,7 @@ TelemetryPing.prototype = {
   /**
    * Initializes telemetry within a timer. If there is no PREF_SERVER set, don't turn on telemetry.
    */
-  setup: function setup(aTesting) {
+  setup: function setup() {
     // Initialize some probes that are kept in their own modules
     this._thirdPartyCookies = new ThirdPartyCookieProbe();
     this._thirdPartyCookies.init();
@@ -830,17 +823,7 @@ TelemetryPing.prototype = {
         {
           let success_histogram = Telemetry.getHistogramById("READ_SAVED_PING_SUCCESS");
           success_histogram.add(success);
-        }), () =>
-        {
-          // If we have any TelemetryPings lying around, we'll be aggressive
-          // and try to send them all off ASAP.
-          if (TelemetryFile.pingsOverdue > 0) {
-            // It doesn't really matter what we pass to this.send as a reason,
-            // since it's never sent to the server. All that this.send does with
-            // the reason is check to make sure it's not a test-ping.
-            this.send("overdue-flush", this._server);
-          }
-        });
+        }));
       this.attachObservers();
       this.gatherMemory();
 
@@ -848,8 +831,7 @@ TelemetryPing.prototype = {
       });
       delete this._timer;
     }
-    this._timer.initWithCallback(timerCallback.bind(this),
-                                 aTesting ? TELEMETRY_TEST_DELAY : TELEMETRY_DELAY,
+    this._timer.initWithCallback(timerCallback.bind(this), TELEMETRY_DELAY,
                                  Ci.nsITimer.TYPE_ONE_SHOT);
   },
 
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
index a7ecadcd8511..a9c70abaa70d 100644
--- a/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
+++ b/toolkit/components/telemetry/tests/unit/test_TelemetryPing.js
@@ -142,7 +142,7 @@ function decodeRequestPayload(request) {
     let observer = {
       buffer: "",
       onStreamComplete: function(loader, context, status, length, result) {
-        this.buffer = String.fromCharCode.apply(this, result);
+	this.buffer = String.fromCharCode.apply(this, result);
       }
     };
 
@@ -363,7 +363,7 @@ function runOldPingFileTest() {
   do_check_true(histogramsFile.exists());
 
   let mtime = histogramsFile.lastModifiedTime;
-  histogramsFile.lastModifiedTime = mtime - (14 * 24 * 60 * 60 * 1000 + 60000); // 14 days, 1m
+  histogramsFile.lastModifiedTime = mtime - 8 * 24 * 60 * 60 * 1000; // 8 days.
   TelemetryPing.testLoadHistograms(histogramsFile, true);
   do_check_false(histogramsFile.exists());
 }
diff --git a/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js b/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
deleted file mode 100644
index f840563b0fe9..000000000000
--- a/toolkit/components/telemetry/tests/unit/test_TelemetrySendOldPings.js
+++ /dev/null
@@ -1,265 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
-   http://creativecommons.org/publicdomain/zero/1.0/
-
-/**
- * This test case populates the profile with some fake stored
- * pings, and checks that:
- *
- * 1) Pings that are considered "expired" are deleted and never sent.
- * 2) Pings that are considered "overdue" trigger a send of all
- *    overdue and recent pings.
- */
-
-Components.utils.import("resource://gre/modules/Services.jsm");
-
-// Get the TelemetryPing definitions directly so we can test it without going through xpcom.
-// That gives us Cc, Ci, Cr and Cu, as well as a number of consts like PREF_ENABLED,
-// and PREF_SERVER.
-Services.scriptloader.loadSubScript("resource://gre/components/TelemetryPing.js");
-
-Cu.import("resource://testing-common/httpd.js");
-Cu.import("resource://gre/modules/Promise.jsm");
-Cu.import("resource://gre/modules/TelemetryFile.jsm");
-
-// We increment TelemetryFile's MAX_PING_FILE_AGE and
-// OVERDUE_PING_FILE_AGE by 1ms so that our test pings exceed
-// those points in time.
-const EXPIRED_PING_FILE_AGE = TelemetryFile.MAX_PING_FILE_AGE + 1;
-const OVERDUE_PING_FILE_AGE = TelemetryFile.OVERDUE_PING_FILE_AGE + 1;
-
-const PING_SAVE_FOLDER = "saved-telemetry-pings";
-const PING_TIMEOUT_LENGTH = 5000;
-const EXPIRED_PINGS = 5;
-const OVERDUE_PINGS = 6;
-const RECENT_PINGS = 4;
-
-const TOTAL_EXPECTED_PINGS = OVERDUE_PINGS + RECENT_PINGS;
-
-let gHttpServer = new HttpServer();
-let gCreatedPings = 0;
-let gSeenPings = 0;
-
-/**
- * Creates some TelemetryPings for the current session and
- * saves them to disk. Each ping gets a unique ID slug based on
- * an incrementor.
- *
- * @param aNum the number of pings to create.
- * @param aAge the age in milliseconds to offset from now. A value
- *             of 10 would make the ping 10ms older than now, for
- *             example.
- * @returns an Array with the created pings.
- */
-function createSavedPings(aNum, aAge) {
-  // Create a TelemetryPing service that we can generate payloads from.
-  // Luckily, the TelemetryPing constructor does nothing that we need to
-  // clean up.
-  let pingService = new TelemetryPing();
-  let pings = [];
-  let age = Date.now() - aAge;
-  for (let i = 0; i < aNum; ++i) {
-    let payload = pingService.getPayload();
-    let ping = { slug: "test-ping-" + gCreatedPings, reason: "test", payload: payload };
-    TelemetryFile.savePing(ping);
-    if (aAge) {
-      // savePing writes to the file synchronously, so we're good to
-      // modify the lastModifedTime now.
-      let file = getSaveFileForPing(ping);
-      file.lastModifiedTime = age;
-    }
-    gCreatedPings++;
-    pings.push(ping);
-  }
-  return pings;
-}
-
-/**
- * Deletes locally saved pings in aPings if they
- * exist.
- *
- * @param aPings an Array of pings to delete.
- */
-function clearPings(aPings) {
-  for (let ping of aPings) {
-    let file = getSaveFileForPing(ping);
-    if (file.exists()) {
-      file.remove(false);
-    }
-  }
-}
-
-/**
- * Returns a handle for the file that aPing should be
- * stored in locally.
- *
- * @returns nsILocalFile
- */
-function getSaveFileForPing(aPing) {
-  let file = Services.dirsvc.get("ProfD", Ci.nsILocalFile).clone();
-  file.append(PING_SAVE_FOLDER);
-  file.append(aPing.slug);
-  return file;
-}
-
-/**
- * Wait for PING_TIMEOUT_LENGTH ms, and make sure we didn't receive
- * TelemetryPings in that time.
- *
- * @returns Promise
- */
-function assertReceivedNoPings() {
-  let deferred = Promise.defer();
-
-  do_timeout(PING_TIMEOUT_LENGTH, function() {
-    if (gSeenPings > 0) {
-      deferred.reject();
-    } else {
-      deferred.resolve();
-    }
-  });
-
-  return deferred.promise;
-}
-
-/**
- * Returns a Promise that rejects if the number of TelemetryPings
- * received by the HttpServer is not equal to aExpectedNum.
- *
- * @param aExpectedNum the number of pings we expect to receive.
- * @returns Promise
- */
-function assertReceivedPings(aExpectedNum) {
-  let deferred = Promise.defer();
-
-  do_timeout(PING_TIMEOUT_LENGTH, function() {
-    if (gSeenPings == aExpectedNum) {
-      deferred.resolve();
-    } else {
-      deferred.reject("Saw " + gSeenPings + " TelemetryPings, " +
-                      "but expected " + aExpectedNum);
-    }
-  })
-
-  return deferred.promise;
-}
-
-/**
- * Throws if any pings in aPings is saved locally.
- *
- * @param aPings an Array of pings to check.
- */
-function assertNotSaved(aPings) {
-  let saved = 0;
-  for (let ping of aPings) {
-    let file = getSaveFileForPing(ping);
-    if (file.exists()) {
-      saved++;
-    }
-  }
-  if (saved > 0) {
-    do_throw("Found " + saved + " unexpected saved pings.");
-  }
-}
-
-/**
- * Our handler function for the HttpServer that simply
- * increments the gSeenPings global when it successfully
- * receives and decodes a TelemetryPing payload.
- *
- * @param aRequest the HTTP request sent from HttpServer.
- */
-function pingHandler(aRequest) {
-  gSeenPings++;
-}
-
-/**
- * Returns a Promise that resolves when gHttpServer has been
- * successfully shut down.
- *
- * @returns Promise
- */
-function stopHttpServer() {
-  let deferred = Promise.defer();
-  gHttpServer.stop(function() {
-    deferred.resolve();
-  })
-  return deferred.promise;
-}
-
-/**
- * Teardown a TelemetryPing instance and clear out any pending
- * pings to put as back in the starting state.
- */
-function resetTelemetry(aPingService) {
-  aPingService.uninstall();
-  // Quick and dirty way to clear TelemetryFile's pendingPings
-  // collection, and put it back in its initial state.
-  let gen = TelemetryFile.popPendingPings();
-  for (let item of gen) {};
-}
-
-/**
- * Creates and returns a TelemetryPing instance in "testing"
- * mode.
- */
-function startTelemetry() {
-  let service = new TelemetryPing();
-  service.setup(true);
-  return service;
-}
-
-function run_test() {
-  gHttpServer.registerPrefixHandler("/submit/telemetry/", pingHandler);
-  gHttpServer.start(-1);
-  do_get_profile();
-  Services.prefs.setBoolPref(PREF_ENABLED, true);
-  Services.prefs.setCharPref(PREF_SERVER,
-                             "http://localhost:" + gHttpServer.identity.primaryPort);
-  run_next_test();
-}
-
-/**
- * Test that pings that are considered too old are just chucked out
- * immediately and never sent.
- */
-add_task(function test_expired_pings_are_deleted() {
-  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
-  let pingService = startTelemetry();
-  yield assertReceivedNoPings();
-  assertNotSaved(expiredPings);
-  resetTelemetry(pingService);
-})
-
-/**
- * Test that really recent pings are not sent on Telemetry initialization.
- */
-add_task(function test_recent_pings_not_sent() {
-  let recentPings = createSavedPings(RECENT_PINGS);
-  let pingService = startTelemetry();
-  yield assertReceivedNoPings();
-  resetTelemetry(pingService);
-  clearPings(recentPings);
-});
-
-/**
- * Create some recent, expired and overdue pings. The overdue pings should
- * trigger a send of all recent and overdue pings, but the expired pings
- * should just be deleted.
- */
-add_task(function test_overdue_pings_trigger_send() {
-  let recentPings = createSavedPings(RECENT_PINGS);
-  let expiredPings = createSavedPings(EXPIRED_PINGS, EXPIRED_PING_FILE_AGE);
-  let overduePings = createSavedPings(OVERDUE_PINGS, OVERDUE_PING_FILE_AGE);
-
-  let pingService = startTelemetry();
-  yield assertReceivedPings(TOTAL_EXPECTED_PINGS);
-
-  assertNotSaved(recentPings);
-  assertNotSaved(expiredPings);
-  assertNotSaved(overduePings);
-  resetTelemetry(pingService);
-})
-
-add_task(function teardown() {
-  yield stopHttpServer();
-});
diff --git a/toolkit/components/telemetry/tests/unit/xpcshell.ini b/toolkit/components/telemetry/tests/unit/xpcshell.ini
index 5a0d1b138cd3..339219fedcdc 100644
--- a/toolkit/components/telemetry/tests/unit/xpcshell.ini
+++ b/toolkit/components/telemetry/tests/unit/xpcshell.ini
@@ -12,5 +12,3 @@ tail =
 [test_TelemetryStopwatch.js]
 [test_TelemetryPingBuildID.js]
 [test_ThirdPartyCookieProbe.js]
-[test_TelemetrySendOldPings.js]
-skip-if = debug == true

From 0fe9bca9cc812d724f60ea05d3398aaf61507715 Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Mon, 16 Dec 2013 01:07:06 +0900
Subject: [PATCH 419/459] Bug 950032 - Part 1: Remove dead code from
 japanese.map. r=smontagu

---
 intl/uconv/ucvja/japanese.map | 40 -----------------------------------
 1 file changed, 40 deletions(-)

diff --git a/intl/uconv/ucvja/japanese.map b/intl/uconv/ucvja/japanese.map
index 939805a818a1..5a53358c056f 100644
--- a/intl/uconv/ucvja/japanese.map
+++ b/intl/uconv/ucvja/japanese.map
@@ -5,46 +5,6 @@
 
 /* generated by JaMap.java */
 
-static const uint16_t gIndexShiftJis[] = {
-  0xFFFD,    188,    376,    564,    752,      0,      0,    940,
-    1128,   1316,   1504,   1692,   1880,   2068,   2256,   2444,
-    2632,   2820,   3008,   3196,   3384,   3572,   3760,   3948,
-    4136,   4324,   4512,   4700,   4888,   5076,   5264,   5452,
-  0xFFFD, 0xFF61, 0xFF62, 0xFF63, 0xFF64, 0xFF65, 0xFF66, 0xFF67,
-  0xFF68, 0xFF69, 0xFF6A, 0xFF6B, 0xFF6C, 0xFF6D, 0xFF6E, 0xFF6F,
-  0xFF70, 0xFF71, 0xFF72, 0xFF73, 0xFF74, 0xFF75, 0xFF76, 0xFF77,
-  0xFF78, 0xFF79, 0xFF7A, 0xFF7B, 0xFF7C, 0xFF7D, 0xFF7E, 0xFF7F,
-  0xFF80, 0xFF81, 0xFF82, 0xFF83, 0xFF84, 0xFF85, 0xFF86, 0xFF87,
-  0xFF88, 0xFF89, 0xFF8A, 0xFF8B, 0xFF8C, 0xFF8D, 0xFF8E, 0xFF8F,
-  0xFF90, 0xFF91, 0xFF92, 0xFF93, 0xFF94, 0xFF95, 0xFF96, 0xFF97,
-  0xFF98, 0xFF99, 0xFF9A, 0xFF9B, 0xFF9C, 0xFF9D, 0xFF9E, 0xFF9F,
-    5640,   5828,   6016,   6204,   6392,   6580,   6768,   6956,
-    7144,   7332,   7520,      0,      0,   7708,   7896,      0,
-  0xE000, 0xE0BC, 0xE178, 0xE234, 0xE2F0, 0xE3AC, 0xE468, 0xE524,
-  0xE5E0, 0xE69C,   8084,   8272,   8460, 0xFFFD, 0xFFFD, 0xFFFD,
-};
-static const uint16_t gIndexJis0208[] = {
-  0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD,    188,    282,    376,    470,    564,    658,    752,
-     846,      0,      0,      0,      0,    940,      0,      0,
-    1222,   1316,   1410,   1504,   1598,   1692,   1786,   1880,
-    1974,   2068,   2162,   2256,   2350,   2444,   2538,   2632,
-    2726,   2820,   2914,   3008,   3102,   3196,   3290,   3384,
-    3478,   3572,   3666,   3760,   3854,   3948,   4042,   4136,
-    4230,   4324,   4418,   4512,   4606,   4700,   4794,   4888,
-    4982,   5076,   5170,   5264,   5358,   5452,   5546,   5640,
-    5734,   5828,   5922,   6016,   6110,   6204,   6298,   6392,
-    6486,   6580,   6674,   6768,   6862,   6956,   7050,   7144,
-    7238,   7332,   7426,   7520,   7614,      0,      0,      0,
-       0,   7708,   7802,   7896,   7990,      0,      0, 0xFFFD,
-};
-static const uint16_t * const gIndex[] = {
-  gIndexShiftJis, gIndexJis0208
-};
-
 // IE-compatible handling of undefined codepoints:
 // 0x80 --> U+0080
 // 0xa0 --> U+F8F0

From f012b041c5dac5ce18d332623d30b7a9d863717c Mon Sep 17 00:00:00 2001
From: Shoji Matsumoto <shom@vinelinux.org>
Date: Mon, 16 Dec 2013 01:07:18 +0900
Subject: [PATCH 420/459] Bug 950032 - Part 2: Import jamap.pl from bug 108136.
 r=smontagu

---
 intl/uconv/tools/jamap.pl | 370 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 370 insertions(+)
 create mode 100644 intl/uconv/tools/jamap.pl

diff --git a/intl/uconv/tools/jamap.pl b/intl/uconv/tools/jamap.pl
new file mode 100644
index 000000000000..3c70fae4a0c4
--- /dev/null
+++ b/intl/uconv/tools/jamap.pl
@@ -0,0 +1,370 @@
+#!/usr/local/bin/perl
+use strict;
+
+my @source_files;
+
+my @sjis_h;
+$sjis_h[0] = -1;
+@sjis_h[0x81..0x9f] = map { 0x2100 + $_ * 0x200 } (0 .. 30);
+@sjis_h[0xe0..0xef] = map { 0x5F00 + $_ * 0x200 } (0 .. 15);
+@sjis_h[0xf0..0xf9] = (-2) x 10;
+my @sjis_l;
+@sjis_l[0x40..0x7e] = (0x21..0x5f);
+@sjis_l[0x80..0xfc] = (0x60..0x7e, 0x121..0x17e);
+
+sub sjis_to_jis {
+  my ($s) = @_;
+  my $j;
+  my $type;
+
+  my $h = $sjis_h[($s>>8)&0xff];
+
+  if ( $h > 0 ) { # jis0208
+
+    my $l = $sjis_l[$s&0xff];
+    if ( $l == 0 ) {
+      $j = $s;
+      $type = 'sjis2undef';
+    } else {
+      $j = $h + $l;
+      if ( $j >= 0x3000 && $j < 0x7500 ) { # jis0208 kanji
+        $type = 'jis0208';
+      } elsif ( $j < 0x2900 ) { # jis0208
+        $type = 'jis0208';
+      } else {
+        $type = 'jis0208undef';
+      }
+    }
+
+  } elsif ( $h == -1 ) { # single byte
+
+    $j = $s;
+    if ( $s <= 0x7f ) { # jis0201 roman
+      $type = 'jis0201';
+    } elsif ( $s >= 0xa1 && $s <= 0xdf ) { # jis0201 kana
+      $type = 'jis0201';
+    } else { # sjis single byte undefined
+      $type = 'sjis1undef';
+    }
+
+  } elsif ( $h == -2 ) { # private use
+    $j = $s;
+    $type = 'private';
+
+  } else { # sjis undefined
+    $j = $s;
+    $type = 'sjis2undef';
+  }
+
+  return ($j, $type);
+}
+
+
+sub read_sjis_map {
+  my ($filename, $s_col, $u_col) = @_;
+  my %map;
+  open MAP, $filename or die $!;
+  while (<MAP>) {
+    my @cols = split /\s+/;
+    my ($s, $u) = @cols[$s_col, $u_col];
+    $s =~ /^0x[0-9A-Fa-f]+$/ && $u =~ /^0x[0-9A-Fa-f]+$/ or next;
+
+    $s = oct($s);
+    $u = oct($u);
+
+    my ($j, $type) = sjis_to_jis($s);
+    push @{$map{$type}}, [$j, $s, $u];
+
+  }
+  close MAP or warn $!;
+  push @source_files, $filename;
+  return %map;
+}
+
+sub read_0212_map {
+  my ($filename, $j_col, $u_col) = @_;
+  my $map;
+  open MAP, $filename or die $!;
+  while (<MAP>) {
+    my @cols = split /\s+/;
+    my ($j, $u) = @cols[$j_col, $u_col];
+    $j =~ /^0x[0-9A-Fa-f]+$/ && $u =~ /^0x[0-9A-Fa-f]+$/ or next;
+
+    $j = oct($j);
+    $u = oct($u);
+
+    push @$map, [$j, 0, $u];
+  }
+  close MAP or warn $!;
+  push @source_files, $filename;
+  return $map;
+}
+
+
+my %printed;
+sub write_fromu_map {
+  my ($filename, $code, @maps) = @_;
+  open MAP, ">$filename" or die $!;
+  foreach my $map (@maps) {
+    foreach my $pair (@$map) {
+      my ($j, $s, $u) = @$pair;
+      if ( $code eq 'sjis' ) {
+        $j = $s;
+      }
+      if ( defined($printed{$u}) ) {
+        if ( $printed{$u} ne $j ) {
+          printf "conflict 0x%04x to 0x%04x, 0x%04x\n", $u, $printed{$u}, $j;
+        }
+      } else {
+        if ( $j < 0x100 ) {
+          printf MAP "0x%02X\t0x%04X\n", $j, $u;
+        } else {
+          printf MAP "0x%04X\t0x%04X\n", $j, $u;
+        }
+        $printed{$u} = $j;
+      }
+    }
+  }
+  close MAP or warn $!;
+}
+
+my @table;
+my %table;
+my $table_next_count = 0;
+
+sub get_94table_index {
+  my ($map_table) = @_;
+  my $key = join ',', map {int($map_table->[$_])} (0 .. 93);
+  my $table_index = $table{$key};
+  if ( !defined($table_index) ) {
+    $table_index = $table_next_count;
+    $table_next_count += 94;
+    $table[$table_index] = $map_table;
+    $table{$key} = $table_index;
+  }
+  return $table_index;
+}
+
+sub get_188table_index {
+  my ($map_table) = @_;
+  my $map_table1 = [ @{$map_table}[0 .. 93] ];
+  my $map_table2 = [ @{$map_table}[94 .. 187] ];
+  my $key = join ',', map {int($map_table->[$_])} (0 .. 187);
+  my $key1 = join ',', map {int($map_table1->[$_])} (0 .. 93);
+  my $key2 = join ',', map {int($map_table2->[$_])} (0 .. 93);
+  my $table_index = $table{$key};
+  if ( !defined($table_index) ) {
+    $table_index = $table_next_count;
+    $table_next_count += 188;
+    $table[$table_index] = $map_table1;
+    $table[$table_index + 94] = $map_table2;
+    $table{$key} = $table_index;
+    $table{$key1} = $table_index unless defined($table{$key1});
+    $table{$key2} = $table_index + 94 unless defined($table{$key2});
+  }
+  return $table_index;
+}
+
+get_188table_index([]);
+
+sub print_sjis_table_index {
+  my @maps = @_;
+  my %map_table;
+  foreach my $map (@maps) {
+    foreach my $pair (@$map) {
+      my ($j, $s, $u) = @$pair;
+      my $row = $s >> 8;
+      my $cell = $s&0xff;
+      if ( $cell >= 0x40 && $cell <= 0x7e ) {
+        $cell -= 0x40;
+      } elsif ( $cell >= 0x80 && $cell <= 0xfc ) {
+        $cell -= 0x41;
+      } else {
+        next;
+      }
+      if ( defined($map_table{$row}->[$cell]) && $map_table{$row}->[$cell] != $u ) {
+         print "conflict!\n";
+      }
+      $map_table{$row}->[$cell] = $u;
+    }
+  }
+
+  print MAP "\n  {";
+  for ( my $i = 0x80; $i < 0x100; $i++ ) {
+    if ( ($i & 0x7) == 0 ) {
+      print MAP "\n   ";
+    }
+    if ( $i >= 0xa1 && $i <= 0xdf ) {
+      printf MAP " 0x%04X,", $i + 0xfec0;
+    } elsif ( $i >= 0xf0 && $i <= 0xf9 ) {
+      printf MAP " 0x%04X,", 0xe000 + ($i - 0xf0) * 188;
+    } elsif ( $i == 0x80 || $i == 0xa0 || $i >= 0xfd ) {
+      print MAP " 0xFFFD,";
+    } else {
+      my $table_index = get_188table_index($map_table{$i});
+      printf MAP " %6d,", $table_index;
+    }
+  }
+  print MAP "\n  },";
+}
+
+sub print_jis_table_index {
+  my @maps = @_;
+  my %map_table;
+  foreach my $map (@maps) {
+    foreach my $pair (@$map) {
+      my ($j, $s, $u) = @$pair;
+      my $row = $j >> 8;
+      my $cell = ($j&0xff) - 0x21;
+      if ( defined($map_table{$row}->[$cell]) && $map_table{$row}->[$cell] != $u ) {
+         print "conflict!\n";
+      }
+      $map_table{$row}->[$cell] = $u;
+    }
+  }
+
+  print MAP "\n  {";
+  for ( my $i = 0; $i < 0x80; $i++ ) {
+    if ( ($i & 0x7) == 0 ) {
+      print MAP "\n   ";
+    }
+    if ( $i >= 0x21 && $i <= 0x7e ) {
+      my $table_index = get_94table_index($map_table{$i});
+      printf MAP " %6d,", $table_index;
+    } else {
+      print MAP " 0xFFFD,";
+    }
+  }
+  print MAP "\n  },";
+}
+
+sub print_table_index {
+  my ($map_name, @maps) = @_;
+  print MAP "static const PRUint16 g${map_name}Index[][128] = {";
+  print_sjis_table_index(@maps);
+  print_jis_table_index(@maps);
+  print MAP "\n};\n\n";
+}
+
+sub print_0212_table_index {
+  my ($map_name, @maps) = @_;
+  print MAP "static const PRUint16 g${map_name}Index[][128] = {";
+  print_jis_table_index(@maps);
+  print MAP "\n};\n\n";
+}
+
+
+sub print_table {
+  print MAP "static const PRUint16 gJapaneseMap[] = {";
+  for ( my $i = 0; $i < $table_next_count; $i += 94 ) {
+    my $index = $i;
+    print MAP "\n  /* index $index */\n         ";
+    my $map_table = $table[$i];
+    my $print_count = 1;
+    for ( my $j = 0; $j < 94; $j++ ) {
+      my $u = $map_table->[$j];
+      if ( $u == 0 ) { $u = 0xfffd; }
+      printf MAP " 0x%04X,", $u;
+      if ( ++$print_count == 8 ) {
+        print MAP "\n ";
+        $print_count = 0;
+      }
+    }
+  }
+  print MAP "\n};\n\n";
+}
+
+
+my %cp932 = read_sjis_map('CP932.TXT', 0, 1);
+my %mac = read_sjis_map('JAPANESE.TXT', 0, 1);
+my %ibm = read_sjis_map('IBM943.TXT', 0, 1);
+my $jis0212 = read_0212_map('JIS0212.TXT', 0, 1);
+
+my %mac_b02;
+#push @{$mac_b02{jis0208}}, [0x2131, 0x8150, 0x203e];
+push @{$mac_b02{jis0208}}, [0x2144, 0x8163, 0x22ef];
+
+%printed = ();
+write_fromu_map('jis0201-uf-unify', 'jis',
+  $cp932{jis0201},
+  $mac{jis0201},
+  $ibm{jis0201}
+);
+write_fromu_map('jis0208-uf-unify', 'jis',
+  $cp932{jis0208},
+  $mac{jis0208},
+  $mac_b02{jis0208},
+  $ibm{jis0208}
+);
+
+%printed = ();
+write_fromu_map('jis0208ext-uf-unify', 'jis',
+  $cp932{jis0208undef},
+  $ibm{jis0208undef}
+);
+
+%printed = ();
+write_fromu_map('sjis-uf-unify', 'sjis',
+  @cp932{'jis0201', 'jis0208', 'jis0208undef', 'sjis1undef', 'sjis2undef'},
+  @mac{'jis0201', 'jis0208'},
+  $mac_b02{jis0208},
+  @ibm{'jis0201', 'jis0208', 'jis0208undef', 'sjis1undef', 'sjis2undef'}
+);
+
+open MAP, ">japanese.map" or die $!;
+binmode MAP;
+
+while (<DATA>) {
+  if ( /^!/ ) { last; }
+  print MAP;
+}
+print MAP "/* generated by mkjpmap.pl @source_files */\n\n";
+
+print_table_index('CP932', @cp932{'jis0208', 'jis0208undef', 'sjis2undef'});
+print_table_index('Apple', @mac{'jis0208'}, @cp932{'jis0208undef', 'sjis2undef'});
+print_table_index('IBM943', @ibm{'jis0208', 'jis0208undef', 'sjis2undef'});
+print_0212_table_index('JIS0212', $jis0212);
+print_table();
+
+close MAP or warn $!;
+
+__DATA__
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: NPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Netscape Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/NPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code.
+ *
+ * The Initial Developer of the Original Code is 
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the NPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the NPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+!

From 359bde40d3483d1ff53a95287034a18a582cbbdb Mon Sep 17 00:00:00 2001
From: Masatoshi Kimura <VYV03354@nifty.ne.jp>
Date: Mon, 16 Dec 2013 01:07:44 +0900
Subject: [PATCH 421/459] Bug 950032 - Part 3: Update jamap.pl to the latest
 tip. r=smontagu

---
 intl/uconv/tools/jamap.pl     |  88 +++++---------
 intl/uconv/ucvja/japanese.map | 220 +++++++++++++++-------------------
 2 files changed, 126 insertions(+), 182 deletions(-)

diff --git a/intl/uconv/tools/jamap.pl b/intl/uconv/tools/jamap.pl
index 3c70fae4a0c4..34420aba88d5 100644
--- a/intl/uconv/tools/jamap.pl
+++ b/intl/uconv/tools/jamap.pl
@@ -92,6 +92,7 @@ sub read_0212_map {
 
     $j = oct($j);
     $u = oct($u);
+    $u = 0xff5e if $u == 0x007e;
 
     push @$map, [$j, 0, $u];
   }
@@ -189,23 +190,25 @@ sub print_sjis_table_index {
     }
   }
 
-  print MAP "\n  {";
   for ( my $i = 0x80; $i < 0x100; $i++ ) {
     if ( ($i & 0x7) == 0 ) {
-      print MAP "\n   ";
+      print MAP "\n ";
     }
     if ( $i >= 0xa1 && $i <= 0xdf ) {
       printf MAP " 0x%04X,", $i + 0xfec0;
     } elsif ( $i >= 0xf0 && $i <= 0xf9 ) {
       printf MAP " 0x%04X,", 0xe000 + ($i - 0xf0) * 188;
-    } elsif ( $i == 0x80 || $i == 0xa0 || $i >= 0xfd ) {
+    } elsif ( $i == 0x80 ) {
       print MAP " 0xFFFD,";
+    } elsif ( $i == 0xa0 ) {
+      print MAP " 0xF8F0,";
+    } elsif ( $i >= 0xfd ) {
+      printf MAP " 0x%04X,", $i + (0xf8f1 - 0xfd);
     } else {
       my $table_index = get_188table_index($map_table{$i});
       printf MAP " %6d,", $table_index;
     }
   }
-  print MAP "\n  },";
 }
 
 sub print_jis_table_index {
@@ -223,10 +226,9 @@ sub print_jis_table_index {
     }
   }
 
-  print MAP "\n  {";
   for ( my $i = 0; $i < 0x80; $i++ ) {
     if ( ($i & 0x7) == 0 ) {
-      print MAP "\n   ";
+      print MAP "\n ";
     }
     if ( $i >= 0x21 && $i <= 0x7e ) {
       my $table_index = get_94table_index($map_table{$i});
@@ -235,27 +237,31 @@ sub print_jis_table_index {
       print MAP " 0xFFFD,";
     }
   }
-  print MAP "\n  },";
 }
 
 sub print_table_index {
   my ($map_name, @maps) = @_;
-  print MAP "static const PRUint16 g${map_name}Index[][128] = {";
+  print MAP "static const uint16_t g${map_name}IndexShiftJis[] = {";
   print_sjis_table_index(@maps);
+  print MAP "\n};\n";
+  print MAP "static const uint16_t g${map_name}IndexJis0208[] = {";
   print_jis_table_index(@maps);
+  print MAP "\n};\n";
+  print MAP "static const uint16_t * const g${map_name}Index[] = {";
+  print MAP "\n  g${map_name}IndexShiftJis, g${map_name}IndexJis0208";
   print MAP "\n};\n\n";
 }
 
 sub print_0212_table_index {
   my ($map_name, @maps) = @_;
-  print MAP "static const PRUint16 g${map_name}Index[][128] = {";
+  print MAP "static const uint16_t g${map_name}Index[] = {";
   print_jis_table_index(@maps);
   print MAP "\n};\n\n";
 }
 
 
 sub print_table {
-  print MAP "static const PRUint16 gJapaneseMap[] = {";
+  print MAP "static const uint16_t gJapaneseMap[] = {";
   for ( my $i = 0; $i < $table_next_count; $i += 94 ) {
     my $index = $i;
     print MAP "\n  /* index $index */\n         ";
@@ -271,29 +277,21 @@ sub print_table {
       }
     }
   }
-  print MAP "\n};\n\n";
+  print MAP "\n};\n";
 }
 
 
 my %cp932 = read_sjis_map('CP932.TXT', 0, 1);
-my %mac = read_sjis_map('JAPANESE.TXT', 0, 1);
 my %ibm = read_sjis_map('IBM943.TXT', 0, 1);
 my $jis0212 = read_0212_map('JIS0212.TXT', 0, 1);
 
-my %mac_b02;
-#push @{$mac_b02{jis0208}}, [0x2131, 0x8150, 0x203e];
-push @{$mac_b02{jis0208}}, [0x2144, 0x8163, 0x22ef];
-
 %printed = ();
 write_fromu_map('jis0201-uf-unify', 'jis',
   $cp932{jis0201},
-  $mac{jis0201},
   $ibm{jis0201}
 );
 write_fromu_map('jis0208-uf-unify', 'jis',
   $cp932{jis0208},
-  $mac{jis0208},
-  $mac_b02{jis0208},
   $ibm{jis0208}
 );
 
@@ -306,8 +304,6 @@ write_fromu_map('jis0208ext-uf-unify', 'jis',
 %printed = ();
 write_fromu_map('sjis-uf-unify', 'sjis',
   @cp932{'jis0201', 'jis0208', 'jis0208undef', 'sjis1undef', 'sjis2undef'},
-  @mac{'jis0201', 'jis0208'},
-  $mac_b02{jis0208},
   @ibm{'jis0201', 'jis0208', 'jis0208undef', 'sjis1undef', 'sjis2undef'}
 );
 
@@ -318,10 +314,17 @@ while (<DATA>) {
   if ( /^!/ ) { last; }
   print MAP;
 }
-print MAP "/* generated by mkjpmap.pl @source_files */\n\n";
+print MAP "/* generated by jamap.pl @source_files */\n\n";
+print MAP <<EOM;
+// IE-compatible handling of undefined codepoints:
+// 0x80 --> U+0080
+// 0xa0 --> U+F8F0
+// 0xfd --> U+F8F1
+// 0xfe --> U+F8F2
+// 0xff --> U+F8F3
+EOM
 
 print_table_index('CP932', @cp932{'jis0208', 'jis0208undef', 'sjis2undef'});
-print_table_index('Apple', @mac{'jis0208'}, @cp932{'jis0208undef', 'sjis2undef'});
 print_table_index('IBM943', @ibm{'jis0208', 'jis0208undef', 'sjis2undef'});
 print_0212_table_index('JIS0212', $jis0212);
 print_table();
@@ -330,41 +333,8 @@ close MAP or warn $!;
 
 __DATA__
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: NPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Netscape Public License
- * Version 1.1 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- * http://www.mozilla.org/NPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code.
- *
- * The Initial Developer of the Original Code is 
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the NPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the NPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 !
diff --git a/intl/uconv/ucvja/japanese.map b/intl/uconv/ucvja/japanese.map
index 5a53358c056f..16f7107e1087 100644
--- a/intl/uconv/ucvja/japanese.map
+++ b/intl/uconv/ucvja/japanese.map
@@ -3,7 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/* generated by JaMap.java */
+/* generated by jamap.pl CP932.TXT IBM943.TXT JIS0212.TXT */
 
 // IE-compatible handling of undefined codepoints:
 // 0x80 --> U+0080
@@ -12,7 +12,7 @@
 // 0xfe --> U+F8F2
 // 0xff --> U+F8F3
 static const uint16_t gCP932IndexShiftJis[] = {
-  0xFFFD,   8648,    376,    564,    752,      0,      0,    940,
+  0xFFFD,    188,    376,    564,    752,      0,      0,    940,
     1128,   1316,   1504,   1692,   1880,   2068,   2256,   2444,
     2632,   2820,   3008,   3196,   3384,   3572,   3760,   3948,
     4136,   4324,   4512,   4700,   4888,   5076,   5264,   5452,
@@ -34,7 +34,7 @@ static const uint16_t gCP932IndexJis0208[] = {
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD,   8648,   8742,    376,    470,    564,    658,    752,
+  0xFFFD,    188,    282,    376,    470,    564,    658,    752,
      846,      0,      0,      0,      0,    940,      0,      0,
     1222,   1316,   1410,   1504,   1598,   1692,   1786,   1880,
     1974,   2068,   2162,   2256,   2350,   2444,   2538,   2632,
@@ -52,7 +52,7 @@ static const uint16_t * const gCP932Index[] = {
 };
 
 static const uint16_t gIBM943IndexShiftJis[] = {
-  0xFFFD,   8836,    376,    564,    752,      0,      0,    940,
+  0xFFFD,   8648,    376,    564,    752,      0,      0,    940,
     1128,   1316,   1504,   1692,   1880,   2068,   2256,   2444,
     2632,   2820,   3008,   3196,   3384,   3572,   3760,   3948,
     4136,   4324,   4512,   4700,   4888,   5076,   5264,   5452,
@@ -65,16 +65,16 @@ static const uint16_t gIBM943IndexShiftJis[] = {
   0xFF90, 0xFF91, 0xFF92, 0xFF93, 0xFF94, 0xFF95, 0xFF96, 0xFF97,
   0xFF98, 0xFF99, 0xFF9A, 0xFF9B, 0xFF9C, 0xFF9D, 0xFF9E, 0xFF9F,
     5640,   5828,   6016,   6204,   6392,   6580,   6768,   6956,
-    7144,   7332,   7520,      0,      0,   7708,   9024,      0,
+    7144,   7332,   7520,      0,      0,   7708,   8836,      0,
   0xE000, 0xE0BC, 0xE178, 0xE234, 0xE2F0, 0xE3AC, 0xE468, 0xE524,
-  0xE5E0, 0xE69C,   9212,   8272,   8460, 0xF8F1, 0xF8F2, 0xF8F3,
+  0xE5E0, 0xE69C,   9024,   8272,   8460, 0xF8F1, 0xF8F2, 0xF8F3,
 };
 static const uint16_t gIBM943IndexJis0208[] = {
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD,   8836,   8742,    376,    470,    564,    658,    752,
+  0xFFFD,   8648,    282,    376,    470,    564,    658,    752,
      846,      0,      0,      0,      0,    940,      0,      0,
     1222,   1316,   1410,   1504,   1598,   1692,   1786,   1880,
     1974,   2068,   2162,   2256,   2350,   2444,   2538,   2632,
@@ -85,7 +85,7 @@ static const uint16_t gIBM943IndexJis0208[] = {
     5734,   5828,   5922,   6016,   6110,   6204,   6298,   6392,
     6486,   6580,   6674,   6768,   6862,   6956,   7050,   7144,
     7238,   7332,   7426,   7520,   7614,      0,      0,      0,
-       0,   7708,   7802,   7896,   9118,      0,      0, 0xFFFD,
+       0,   7708,   7802,   7896,   8930,      0,      0, 0xFFFD,
 };
 static const uint16_t * const gIBM943Index[] = {
   gIBM943IndexShiftJis, gIBM943IndexJis0208
@@ -96,16 +96,16 @@ static const uint16_t gJIS0212Index[] = {
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD,      0,   9400,      0,      0,      0,   9494,   9588,
-       0,   9682,   9776,   9870,      0,      0,      0,      0,
-    9964,  10058,  10152,  10246,  10340,  10434,  10528,  10622,
-   10716,  10810,  10904,  10998,  11092,  11186,  11280,  11374,
-   11468,  11562,  11656,  11750,  11844,  11938,  12032,  12126,
-   12220,  12314,  12408,  12502,  12596,  12690,  12784,  12878,
-   12972,  13066,  13160,  13254,  13348,  13442,  13536,  13630,
-   13724,  13818,  13912,  14006,  14100,  14194,  14288,  14382,
-   14476,  14570,  14664,  14758,  14852,  14946,  15040,  15134,
-   15228,  15322,  15416,  15510,  15604,  15698,      0,      0,
+  0xFFFD,      0,   9212,      0,      0,      0,   9306,   9400,
+       0,   9494,   9588,   9682,      0,      0,      0,      0,
+    9776,   9870,   9964,  10058,  10152,  10246,  10340,  10434,
+   10528,  10622,  10716,  10810,  10904,  10998,  11092,  11186,
+   11280,  11374,  11468,  11562,  11656,  11750,  11844,  11938,
+   12032,  12126,  12220,  12314,  12408,  12502,  12596,  12690,
+   12784,  12878,  12972,  13066,  13160,  13254,  13348,  13442,
+   13536,  13630,  13724,  13818,  13912,  14006,  14100,  14194,
+   14288,  14382,  14476,  14570,  14664,  14758,  14852,  14946,
+   15040,  15134,  15228,  15322,  15416,  15510,      0,      0,
        0,      0,      0,      0,      0,      0,      0,      0,
        0,      0,      0,      0,      0,      0,      0, 0xFFFD,
 };
@@ -141,14 +141,14 @@ static const uint16_t gJapaneseMap[] = {
           0x3000, 0x3001, 0x3002, 0xFF0C, 0xFF0E, 0x30FB, 0xFF1A,
   0xFF1B, 0xFF1F, 0xFF01, 0x309B, 0x309C, 0x00B4, 0xFF40, 0x00A8,
   0xFF3E, 0xFFE3, 0xFF3F, 0x30FD, 0x30FE, 0x309D, 0x309E, 0x3003,
-  0x4EDD, 0x3005, 0x3006, 0x3007, 0x30FC, 0x2014, 0x2010, 0xFF0F,
-  0xFF3C, 0x301C, 0x2016, 0xFF5C, 0x2026, 0x2025, 0x2018, 0x2019,
+  0x4EDD, 0x3005, 0x3006, 0x3007, 0x30FC, 0x2015, 0x2010, 0xFF0F,
+  0xFF3C, 0xFF5E, 0x2225, 0xFF5C, 0x2026, 0x2025, 0x2018, 0x2019,
   0x201C, 0x201D, 0xFF08, 0xFF09, 0x3014, 0x3015, 0xFF3B, 0xFF3D,
   0xFF5B, 0xFF5D, 0x3008, 0x3009, 0x300A, 0x300B, 0x300C, 0x300D,
-  0x300E, 0x300F, 0x3010, 0x3011, 0xFF0B, 0x2212, 0x00B1, 0x00D7,
+  0x300E, 0x300F, 0x3010, 0x3011, 0xFF0B, 0xFF0D, 0x00B1, 0x00D7,
   0x00F7, 0xFF1D, 0x2260, 0xFF1C, 0xFF1E, 0x2266, 0x2267, 0x221E,
   0x2234, 0x2642, 0x2640, 0x00B0, 0x2032, 0x2033, 0x2103, 0xFFE5,
-  0xFF04, 0x00A2, 0x00A3, 0xFF05, 0xFF03, 0xFF06, 0xFF0A, 0xFF20,
+  0xFF04, 0xFFE0, 0xFFE1, 0xFF05, 0xFF03, 0xFF06, 0xFF0A, 0xFF20,
   0x00A7, 0x2606, 0x2605, 0x25CB, 0x25CF, 0x25CE, 0x25C7,
   /* index 282 */
           0x25C6, 0x25A1, 0x25A0, 0x25B3, 0x25B2, 0x25BD, 0x25BC,
@@ -156,7 +156,7 @@ static const uint16_t gJapaneseMap[] = {
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0x2208, 0x220B, 0x2286, 0x2287, 0x2282, 0x2283,
   0x222A, 0x2229, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0x2227, 0x2228, 0x00AC, 0x21D2, 0x21D4, 0x2200,
+  0xFFFD, 0xFFFD, 0x2227, 0x2228, 0xFFE2, 0x21D2, 0x21D4, 0x2200,
   0x2203, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0x2220, 0x22A5, 0x2312, 0x2202,
   0x2207, 0x2261, 0x2252, 0x226A, 0x226B, 0x221A, 0x223D, 0x221D,
@@ -1311,11 +1311,11 @@ static const uint16_t gJapaneseMap[] = {
           0x3000, 0x3001, 0x3002, 0xFF0C, 0xFF0E, 0x30FB, 0xFF1A,
   0xFF1B, 0xFF1F, 0xFF01, 0x309B, 0x309C, 0x00B4, 0xFF40, 0x00A8,
   0xFF3E, 0xFFE3, 0xFF3F, 0x30FD, 0x30FE, 0x309D, 0x309E, 0x3003,
-  0x4EDD, 0x3005, 0x3006, 0x3007, 0x30FC, 0x2015, 0x2010, 0xFF0F,
-  0xFF3C, 0xFF5E, 0x2225, 0xFF5C, 0x2026, 0x2025, 0x2018, 0x2019,
+  0x4EDD, 0x3005, 0x3006, 0x3007, 0x30FC, 0x2014, 0x2010, 0xFF0F,
+  0xFF3C, 0x301C, 0x2016, 0xFF5C, 0x2026, 0x2025, 0x2018, 0x2019,
   0x201C, 0x201D, 0xFF08, 0xFF09, 0x3014, 0x3015, 0xFF3B, 0xFF3D,
   0xFF5B, 0xFF5D, 0x3008, 0x3009, 0x300A, 0x300B, 0x300C, 0x300D,
-  0x300E, 0x300F, 0x3010, 0x3011, 0xFF0B, 0xFF0D, 0x00B1, 0x00D7,
+  0x300E, 0x300F, 0x3010, 0x3011, 0xFF0B, 0x2212, 0x00B1, 0x00D7,
   0x00F7, 0xFF1D, 0x2260, 0xFF1C, 0xFF1E, 0x2266, 0x2267, 0x221E,
   0x2234, 0x2642, 0x2640, 0x00B0, 0x2032, 0x2033, 0x2103, 0xFFE5,
   0xFF04, 0xFFE0, 0xFFE1, 0xFF05, 0xFF03, 0xFF06, 0xFF0A, 0xFF20,
@@ -1334,32 +1334,6 @@ static const uint16_t gJapaneseMap[] = {
   0xFFFD, 0xFFFD, 0x212B, 0x2030, 0x266F, 0x266D, 0x266A, 0x2020,
   0x2021, 0x00B6, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0x25EF,
   /* index 8836 */
-          0x3000, 0x3001, 0x3002, 0xFF0C, 0xFF0E, 0x30FB, 0xFF1A,
-  0xFF1B, 0xFF1F, 0xFF01, 0x309B, 0x309C, 0x00B4, 0xFF40, 0x00A8,
-  0xFF3E, 0xFFE3, 0xFF3F, 0x30FD, 0x30FE, 0x309D, 0x309E, 0x3003,
-  0x4EDD, 0x3005, 0x3006, 0x3007, 0x30FC, 0x2014, 0x2010, 0xFF0F,
-  0xFF3C, 0x301C, 0x2016, 0xFF5C, 0x2026, 0x2025, 0x2018, 0x2019,
-  0x201C, 0x201D, 0xFF08, 0xFF09, 0x3014, 0x3015, 0xFF3B, 0xFF3D,
-  0xFF5B, 0xFF5D, 0x3008, 0x3009, 0x300A, 0x300B, 0x300C, 0x300D,
-  0x300E, 0x300F, 0x3010, 0x3011, 0xFF0B, 0x2212, 0x00B1, 0x00D7,
-  0x00F7, 0xFF1D, 0x2260, 0xFF1C, 0xFF1E, 0x2266, 0x2267, 0x221E,
-  0x2234, 0x2642, 0x2640, 0x00B0, 0x2032, 0x2033, 0x2103, 0xFFE5,
-  0xFF04, 0xFFE0, 0xFFE1, 0xFF05, 0xFF03, 0xFF06, 0xFF0A, 0xFF20,
-  0x00A7, 0x2606, 0x2605, 0x25CB, 0x25CF, 0x25CE, 0x25C7,
-  /* index 8930 */
-          0x25C6, 0x25A1, 0x25A0, 0x25B3, 0x25B2, 0x25BD, 0x25BC,
-  0x203B, 0x3012, 0x2192, 0x2190, 0x2191, 0x2193, 0x3013, 0xFFFD,
-  0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0x2208, 0x220B, 0x2286, 0x2287, 0x2282, 0x2283,
-  0x222A, 0x2229, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0x2227, 0x2228, 0xFFE2, 0x21D2, 0x21D4, 0x2200,
-  0x2203, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0x2220, 0x22A5, 0x2312, 0x2202,
-  0x2207, 0x2261, 0x2252, 0x226A, 0x226B, 0x221A, 0x223D, 0x221D,
-  0x2235, 0x222B, 0x222C, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  0xFFFD, 0xFFFD, 0x212B, 0x2030, 0x266F, 0x266D, 0x266A, 0x2020,
-  0x2021, 0x00B6, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0x25EF,
-  /* index 9024 */
           0x72BE, 0x7324, 0xFA16, 0x7377, 0x73BD, 0x73C9, 0x73D6,
   0x73E3, 0x73D2, 0x7407, 0x73F5, 0x7426, 0x742A, 0x7429, 0x742E,
   0x7462, 0x7489, 0x749F, 0x7501, 0x756F, 0x7682, 0x769C, 0x769E,
@@ -1372,7 +1346,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8A37, 0x8A79, 0x8AA7, 0x8ABE, 0x8ADF, 0xFA22, 0x8AF6, 0x8B53,
   0x8B7F, 0x8CF0, 0x8CF4, 0x8D12, 0x8D76, 0xFA23, 0x8ECF, 0xFA24,
   0xFA25, 0x9067, 0x90DE, 0xFA26, 0x9115, 0x9127, 0x91DA,
-  /* index 9118 */
+  /* index 8930 */
           0x91D7, 0x91DE, 0x91ED, 0x91EE, 0x91E4, 0x91E5, 0x9206,
   0x9210, 0x920A, 0x923A, 0x9240, 0x923C, 0x924E, 0x9259, 0x9251,
   0x9239, 0x9267, 0x92A7, 0x9277, 0x9278, 0x92E7, 0x92D7, 0x92D9,
@@ -1385,7 +1359,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9BBB, 0x9C00, 0x9D70, 0x9D6B, 0xFA2D, 0x9E19, 0x9ED1, 0xFFFD,
   0xFFFD, 0x2170, 0x2171, 0x2172, 0x2173, 0x2174, 0x2175, 0x2176,
   0x2177, 0x2178, 0x2179, 0xFFE2, 0x00A6, 0xFF07, 0xFF02,
-  /* index 9212 */
+  /* index 9024 */
           0x2170, 0x2171, 0x2172, 0x2173, 0x2174, 0x2175, 0x2176,
   0x2177, 0x2178, 0x2179, 0x2160, 0x2161, 0x2162, 0x2163, 0x2164,
   0x2165, 0x2166, 0x2167, 0x2168, 0x2169, 0xFFE2, 0x00A6, 0xFF07,
@@ -1398,7 +1372,7 @@ static const uint16_t gJapaneseMap[] = {
   0x52DB, 0x5300, 0x5307, 0x5324, 0x5372, 0x5393, 0x53B2, 0x53DD,
   0xFA0E, 0x549C, 0x548A, 0x54A9, 0x54FF, 0x5586, 0x5759, 0x5765,
   0x57AC, 0x57C8, 0x57C7, 0xFA0F, 0xFA10, 0x589E, 0x58B2,
-  /* index 9306 */
+  /* index 9118 */
           0x590B, 0x5953, 0x595B, 0x595D, 0x5963, 0x59A4, 0x59BA,
   0x5B56, 0x5BC0, 0x752F, 0x5BD8, 0x5BEC, 0x5C1E, 0x5CA6, 0x5CBA,
   0x5CF5, 0x5D27, 0x5D53, 0xFA11, 0x5D42, 0x5D6D, 0x5DB8, 0x5DB9,
@@ -1411,7 +1385,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6844, 0x68CF, 0xFA13, 0x6968, 0xFA14, 0x6998, 0x69E2, 0x6A30,
   0x6A6B, 0x6A46, 0x6A73, 0x6A7E, 0x6AE2, 0x6AE4, 0x6BD6, 0x6C3F,
   0x6C5C, 0x6C86, 0x6C6F, 0x6CDA, 0x6D04, 0x6D87, 0x6D6F,
-  /* index 9400 */
+  /* index 9212 */
           0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0x02D8,
   0x02C7, 0x00B8, 0x02D9, 0x02DD, 0x00AF, 0x02DB, 0x02DA, 0xFF5E,
@@ -1424,7 +1398,7 @@ static const uint16_t gJapaneseMap[] = {
   0xFFFD, 0xFFFD, 0xFFFD, 0x00BA, 0x00AA, 0x00A9, 0x00AE, 0x2122,
   0x00A4, 0x2116, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  /* index 9494 */
+  /* index 9306 */
           0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
@@ -1437,7 +1411,7 @@ static const uint16_t gJapaneseMap[] = {
   0xFFFD, 0x038E, 0x03AB, 0xFFFD, 0x038F, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0x03AC, 0x03AD, 0x03AE, 0x03AF, 0x03CA, 0x0390, 0x03CC,
   0x03C2, 0x03CD, 0x03CB, 0x03B0, 0x03CE, 0xFFFD, 0xFFFD,
-  /* index 9588 */
+  /* index 9400 */
           0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
@@ -1450,7 +1424,7 @@ static const uint16_t gJapaneseMap[] = {
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0x0452, 0x0453, 0x0454, 0x0455, 0x0456, 0x0457,
   0x0458, 0x0459, 0x045A, 0x045B, 0x045C, 0x045E, 0x045F,
-  /* index 9682 */
+  /* index 9494 */
           0x00C6, 0x0110, 0xFFFD, 0x0126, 0xFFFD, 0x0132, 0xFFFD,
   0x0141, 0x013F, 0xFFFD, 0x014A, 0x00D8, 0x0152, 0xFFFD, 0x0166,
   0x00DE, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
@@ -1463,7 +1437,7 @@ static const uint16_t gJapaneseMap[] = {
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  /* index 9776 */
+  /* index 9588 */
           0x00C1, 0x00C0, 0x00C4, 0x00C2, 0x0102, 0x01CD, 0x0100,
   0x0104, 0x00C5, 0x00C3, 0x0106, 0x0108, 0x010C, 0x00C7, 0x010A,
   0x010E, 0x00C9, 0x00C8, 0x00CB, 0x00CA, 0x011A, 0x0116, 0x0112,
@@ -1476,7 +1450,7 @@ static const uint16_t gJapaneseMap[] = {
   0x0170, 0x016A, 0x0172, 0x016E, 0x0168, 0x01D7, 0x01DB, 0x01D9,
   0x01D5, 0x0174, 0x00DD, 0x0178, 0x0176, 0x0179, 0x017D, 0x017B,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  /* index 9870 */
+  /* index 9682 */
           0x00E1, 0x00E0, 0x00E4, 0x00E2, 0x0103, 0x01CE, 0x0101,
   0x0105, 0x00E5, 0x00E3, 0x0107, 0x0109, 0x010D, 0x00E7, 0x010B,
   0x010F, 0x00E9, 0x00E8, 0x00EB, 0x00EA, 0x011B, 0x0117, 0x0113,
@@ -1489,7 +1463,7 @@ static const uint16_t gJapaneseMap[] = {
   0x0171, 0x016B, 0x0173, 0x016F, 0x0169, 0x01D8, 0x01DC, 0x01DA,
   0x01D6, 0x0175, 0x00FD, 0x00FF, 0x0177, 0x017A, 0x017E, 0x017C,
   0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD, 0xFFFD,
-  /* index 9964 */
+  /* index 9776 */
           0x4E02, 0x4E04, 0x4E05, 0x4E0C, 0x4E12, 0x4E1F, 0x4E23,
   0x4E24, 0x4E28, 0x4E2B, 0x4E2E, 0x4E2F, 0x4E30, 0x4E35, 0x4E40,
   0x4E41, 0x4E44, 0x4E47, 0x4E51, 0x4E5A, 0x4E5C, 0x4E63, 0x4E68,
@@ -1502,7 +1476,7 @@ static const uint16_t gJapaneseMap[] = {
   0x4F48, 0x4F49, 0x4F4B, 0x4F4C, 0x4F52, 0x4F54, 0x4F56, 0x4F58,
   0x4F5F, 0x4F63, 0x4F6A, 0x4F6C, 0x4F6E, 0x4F71, 0x4F77, 0x4F78,
   0x4F79, 0x4F7A, 0x4F7D, 0x4F7E, 0x4F81, 0x4F82, 0x4F84,
-  /* index 10058 */
+  /* index 9870 */
           0x4F85, 0x4F89, 0x4F8A, 0x4F8C, 0x4F8E, 0x4F90, 0x4F92,
   0x4F93, 0x4F94, 0x4F97, 0x4F99, 0x4F9A, 0x4F9E, 0x4F9F, 0x4FB2,
   0x4FB7, 0x4FB9, 0x4FBB, 0x4FBC, 0x4FBD, 0x4FBE, 0x4FC0, 0x4FC1,
@@ -1515,7 +1489,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5052, 0x5053, 0x5057, 0x5059, 0x505F, 0x5060, 0x5062, 0x5063,
   0x5066, 0x5067, 0x506A, 0x506D, 0x5070, 0x5071, 0x503B, 0x5081,
   0x5083, 0x5084, 0x5086, 0x508A, 0x508E, 0x508F, 0x5090,
-  /* index 10152 */
+  /* index 9964 */
           0x5092, 0x5093, 0x5094, 0x5096, 0x509B, 0x509C, 0x509E,
   0x509F, 0x50A0, 0x50A1, 0x50A2, 0x50AA, 0x50AF, 0x50B0, 0x50B9,
   0x50BA, 0x50BD, 0x50C0, 0x50C3, 0x50C4, 0x50C7, 0x50CC, 0x50CE,
@@ -1528,7 +1502,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5153, 0x5155, 0x5157, 0x5158, 0x515F, 0x5164, 0x5166, 0x517E,
   0x5183, 0x5184, 0x518B, 0x518E, 0x5198, 0x519D, 0x51A1, 0x51A3,
   0x51AD, 0x51B8, 0x51BA, 0x51BC, 0x51BE, 0x51BF, 0x51C2,
-  /* index 10246 */
+  /* index 10058 */
           0x51C8, 0x51CF, 0x51D1, 0x51D2, 0x51D3, 0x51D5, 0x51D8,
   0x51DE, 0x51E2, 0x51E5, 0x51EE, 0x51F2, 0x51F3, 0x51F4, 0x51F7,
   0x5201, 0x5202, 0x5205, 0x5212, 0x5213, 0x5215, 0x5216, 0x5218,
@@ -1541,7 +1515,7 @@ static const uint16_t gJapaneseMap[] = {
   0x52C8, 0x52CC, 0x52CF, 0x52D1, 0x52D4, 0x52D6, 0x52DB, 0x52DC,
   0x52E1, 0x52E5, 0x52E8, 0x52E9, 0x52EA, 0x52EC, 0x52F0, 0x52F1,
   0x52F4, 0x52F6, 0x52F7, 0x5300, 0x5303, 0x530A, 0x530B,
-  /* index 10340 */
+  /* index 10152 */
           0x530C, 0x5311, 0x5313, 0x5318, 0x531B, 0x531C, 0x531E,
   0x531F, 0x5325, 0x5327, 0x5328, 0x5329, 0x532B, 0x532C, 0x532D,
   0x5330, 0x5332, 0x5335, 0x533C, 0x533D, 0x533E, 0x5342, 0x534C,
@@ -1554,7 +1528,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5427, 0x5428, 0x542A, 0x542F, 0x5431, 0x5434, 0x5435, 0x5443,
   0x5444, 0x5447, 0x544D, 0x544F, 0x545E, 0x5462, 0x5464, 0x5466,
   0x5467, 0x5469, 0x546B, 0x546D, 0x546E, 0x5474, 0x547F,
-  /* index 10434 */
+  /* index 10246 */
           0x5481, 0x5483, 0x5485, 0x5488, 0x5489, 0x548D, 0x5491,
   0x5495, 0x5496, 0x549C, 0x549F, 0x54A1, 0x54A6, 0x54A7, 0x54A9,
   0x54AA, 0x54AD, 0x54AE, 0x54B1, 0x54B7, 0x54B9, 0x54BA, 0x54BB,
@@ -1567,7 +1541,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5586, 0x5588, 0x558E, 0x558F, 0x5591, 0x5592, 0x5593, 0x5594,
   0x5597, 0x55A3, 0x55A4, 0x55AD, 0x55B2, 0x55BF, 0x55C1, 0x55C3,
   0x55C6, 0x55C9, 0x55CB, 0x55CC, 0x55CE, 0x55D1, 0x55D2,
-  /* index 10528 */
+  /* index 10340 */
           0x55D3, 0x55D7, 0x55D8, 0x55DB, 0x55DE, 0x55E2, 0x55E9,
   0x55F6, 0x55FF, 0x5605, 0x5608, 0x560A, 0x560D, 0x560E, 0x560F,
   0x5610, 0x5611, 0x5612, 0x5619, 0x562C, 0x5630, 0x5633, 0x5635,
@@ -1580,7 +1554,7 @@ static const uint16_t gJapaneseMap[] = {
   0x56B7, 0x56BE, 0x56C5, 0x56C9, 0x56CA, 0x56CB, 0x56CF, 0x56D0,
   0x56CC, 0x56CD, 0x56D9, 0x56DC, 0x56DD, 0x56DF, 0x56E1, 0x56E4,
   0x56E5, 0x56E6, 0x56E7, 0x56E8, 0x56F1, 0x56EB, 0x56ED,
-  /* index 10622 */
+  /* index 10434 */
           0x56F6, 0x56F7, 0x5701, 0x5702, 0x5707, 0x570A, 0x570C,
   0x5711, 0x5715, 0x571A, 0x571B, 0x571D, 0x5720, 0x5722, 0x5723,
   0x5724, 0x5725, 0x5729, 0x572A, 0x572C, 0x572E, 0x572F, 0x5733,
@@ -1593,7 +1567,7 @@ static const uint16_t gJapaneseMap[] = {
   0x57C8, 0x57CC, 0x57CF, 0x57D5, 0x57DD, 0x57DE, 0x57E4, 0x57E6,
   0x57E7, 0x57E9, 0x57ED, 0x57F0, 0x57F5, 0x57F6, 0x57F8, 0x57FD,
   0x57FE, 0x57FF, 0x5803, 0x5804, 0x5808, 0x5809, 0x57E1,
-  /* index 10716 */
+  /* index 10528 */
           0x580C, 0x580D, 0x581B, 0x581E, 0x581F, 0x5820, 0x5826,
   0x5827, 0x582D, 0x5832, 0x5839, 0x583F, 0x5849, 0x584C, 0x584D,
   0x584F, 0x5850, 0x5855, 0x585F, 0x5861, 0x5864, 0x5867, 0x5868,
@@ -1606,7 +1580,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5921, 0x5923, 0x5924, 0x5928, 0x592F, 0x5930, 0x5933, 0x5935,
   0x5936, 0x593F, 0x5943, 0x5946, 0x5952, 0x5953, 0x5959, 0x595B,
   0x595D, 0x595E, 0x595F, 0x5961, 0x5963, 0x596B, 0x596D,
-  /* index 10810 */
+  /* index 10622 */
           0x596F, 0x5972, 0x5975, 0x5976, 0x5979, 0x597B, 0x597C,
   0x598B, 0x598C, 0x598E, 0x5992, 0x5995, 0x5997, 0x599F, 0x59A4,
   0x59A7, 0x59AD, 0x59AE, 0x59AF, 0x59B0, 0x59B3, 0x59B7, 0x59BA,
@@ -1619,7 +1593,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5A7A, 0x5A7B, 0x5A7E, 0x5A8B, 0x5A90, 0x5A93, 0x5A96, 0x5A99,
   0x5A9C, 0x5A9E, 0x5A9F, 0x5AA0, 0x5AA2, 0x5AA7, 0x5AAC, 0x5AB1,
   0x5AB2, 0x5AB3, 0x5AB5, 0x5AB8, 0x5ABA, 0x5ABB, 0x5ABF,
-  /* index 10904 */
+  /* index 10716 */
           0x5AC4, 0x5AC6, 0x5AC8, 0x5ACF, 0x5ADA, 0x5ADC, 0x5AE0,
   0x5AE5, 0x5AEA, 0x5AEE, 0x5AF5, 0x5AF6, 0x5AFD, 0x5B00, 0x5B01,
   0x5B08, 0x5B17, 0x5B34, 0x5B19, 0x5B1B, 0x5B1D, 0x5B21, 0x5B25,
@@ -1632,7 +1606,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5BFD, 0x5C0C, 0x5C17, 0x5C1E, 0x5C1F, 0x5C23, 0x5C26, 0x5C29,
   0x5C2B, 0x5C2C, 0x5C2E, 0x5C30, 0x5C32, 0x5C35, 0x5C36, 0x5C59,
   0x5C5A, 0x5C5C, 0x5C62, 0x5C63, 0x5C67, 0x5C68, 0x5C69,
-  /* index 10998 */
+  /* index 10810 */
           0x5C6D, 0x5C70, 0x5C74, 0x5C75, 0x5C7A, 0x5C7B, 0x5C7C,
   0x5C7D, 0x5C87, 0x5C88, 0x5C8A, 0x5C8F, 0x5C92, 0x5C9D, 0x5C9F,
   0x5CA0, 0x5CA2, 0x5CA3, 0x5CA6, 0x5CAA, 0x5CB2, 0x5CB4, 0x5CB5,
@@ -1645,7 +1619,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5D92, 0x5D93, 0x5D94, 0x5D95, 0x5D99, 0x5D9B, 0x5D9F, 0x5DA0,
   0x5DA7, 0x5DAB, 0x5DB0, 0x5DB4, 0x5DB8, 0x5DB9, 0x5DC3, 0x5DC7,
   0x5DCB, 0x5DD0, 0x5DCE, 0x5DD8, 0x5DD9, 0x5DE0, 0x5DE4,
-  /* index 11092 */
+  /* index 10904 */
           0x5DE9, 0x5DF8, 0x5DF9, 0x5E00, 0x5E07, 0x5E0D, 0x5E12,
   0x5E14, 0x5E15, 0x5E18, 0x5E1F, 0x5E20, 0x5E2E, 0x5E28, 0x5E32,
   0x5E35, 0x5E3E, 0x5E4B, 0x5E50, 0x5E49, 0x5E51, 0x5E56, 0x5E58,
@@ -1658,7 +1632,7 @@ static const uint16_t gJapaneseMap[] = {
   0x5F28, 0x5F2B, 0x5F2C, 0x5F2E, 0x5F30, 0x5F34, 0x5F36, 0x5F3B,
   0x5F3D, 0x5F3F, 0x5F40, 0x5F44, 0x5F45, 0x5F47, 0x5F4D, 0x5F50,
   0x5F54, 0x5F58, 0x5F5B, 0x5F60, 0x5F63, 0x5F64, 0x5F67,
-  /* index 11186 */
+  /* index 10998 */
           0x5F6F, 0x5F72, 0x5F74, 0x5F75, 0x5F78, 0x5F7A, 0x5F7D,
   0x5F7E, 0x5F89, 0x5F8D, 0x5F8F, 0x5F96, 0x5F9C, 0x5F9D, 0x5FA2,
   0x5FA7, 0x5FAB, 0x5FA4, 0x5FAC, 0x5FAF, 0x5FB0, 0x5FB1, 0x5FB8,
@@ -1671,7 +1645,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6061, 0x6067, 0x6071, 0x607E, 0x607F, 0x6082, 0x6086, 0x6088,
   0x608A, 0x608E, 0x6091, 0x6093, 0x6095, 0x6098, 0x609D, 0x609E,
   0x60A2, 0x60A4, 0x60A5, 0x60A8, 0x60B0, 0x60B1, 0x60B7,
-  /* index 11280 */
+  /* index 11092 */
           0x60BB, 0x60BE, 0x60C2, 0x60C4, 0x60C8, 0x60C9, 0x60CA,
   0x60CB, 0x60CE, 0x60CF, 0x60D4, 0x60D5, 0x60D9, 0x60DB, 0x60DD,
   0x60DE, 0x60E2, 0x60E5, 0x60F2, 0x60F5, 0x60F8, 0x60FC, 0x60FD,
@@ -1684,7 +1658,7 @@ static const uint16_t gJapaneseMap[] = {
   0x61A0, 0x61A5, 0x61A8, 0x61AA, 0x61AD, 0x61B8, 0x61B9, 0x61BC,
   0x61C0, 0x61C1, 0x61C2, 0x61CE, 0x61CF, 0x61D5, 0x61DC, 0x61DD,
   0x61DE, 0x61DF, 0x61E1, 0x61E2, 0x61E7, 0x61E9, 0x61E5,
-  /* index 11374 */
+  /* index 11186 */
           0x61EC, 0x61ED, 0x61EF, 0x6201, 0x6203, 0x6204, 0x6207,
   0x6213, 0x6215, 0x621C, 0x6220, 0x6222, 0x6223, 0x6227, 0x6229,
   0x622B, 0x6239, 0x623D, 0x6242, 0x6243, 0x6244, 0x6246, 0x624C,
@@ -1697,7 +1671,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6336, 0x6339, 0x633C, 0x6341, 0x6342, 0x6343, 0x6344, 0x6346,
   0x634A, 0x634B, 0x634E, 0x6352, 0x6353, 0x6354, 0x6358, 0x635B,
   0x6365, 0x6366, 0x636C, 0x636D, 0x6371, 0x6374, 0x6375,
-  /* index 11468 */
+  /* index 11280 */
           0x6378, 0x637C, 0x637D, 0x637F, 0x6382, 0x6384, 0x6387,
   0x638A, 0x6390, 0x6394, 0x6395, 0x6399, 0x639A, 0x639E, 0x63A4,
   0x63A6, 0x63AD, 0x63AE, 0x63AF, 0x63BD, 0x63C1, 0x63C5, 0x63C8,
@@ -1710,7 +1684,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6473, 0x6474, 0x647B, 0x647D, 0x6485, 0x6487, 0x648F, 0x6490,
   0x6491, 0x6498, 0x6499, 0x649B, 0x649D, 0x649F, 0x64A1, 0x64A3,
   0x64A6, 0x64A8, 0x64AC, 0x64B3, 0x64BD, 0x64BE, 0x64BF,
-  /* index 11562 */
+  /* index 11374 */
           0x64C4, 0x64C9, 0x64CA, 0x64CB, 0x64CC, 0x64CE, 0x64D0,
   0x64D1, 0x64D5, 0x64D7, 0x64E4, 0x64E5, 0x64E9, 0x64EA, 0x64ED,
   0x64F0, 0x64F5, 0x64F7, 0x64FB, 0x64FF, 0x6501, 0x6504, 0x6508,
@@ -1723,7 +1697,7 @@ static const uint16_t gJapaneseMap[] = {
   0x65CE, 0x65D0, 0x65D4, 0x65D6, 0x65D8, 0x65DF, 0x65F0, 0x65F2,
   0x65F4, 0x65F5, 0x65F9, 0x65FE, 0x65FF, 0x6600, 0x6604, 0x6608,
   0x6609, 0x660D, 0x6611, 0x6612, 0x6615, 0x6616, 0x661D,
-  /* index 11656 */
+  /* index 11468 */
           0x661E, 0x6621, 0x6622, 0x6623, 0x6624, 0x6626, 0x6629,
   0x662A, 0x662B, 0x662C, 0x662E, 0x6630, 0x6631, 0x6633, 0x6639,
   0x6637, 0x6640, 0x6645, 0x6646, 0x664A, 0x664C, 0x6651, 0x664E,
@@ -1736,7 +1710,7 @@ static const uint16_t gJapaneseMap[] = {
   0x66DF, 0x66E8, 0x66EB, 0x66EC, 0x66EE, 0x66FA, 0x6705, 0x6707,
   0x670E, 0x6713, 0x6719, 0x671C, 0x6720, 0x6722, 0x6733, 0x673E,
   0x6745, 0x6747, 0x6748, 0x674C, 0x6754, 0x6755, 0x675D,
-  /* index 11750 */
+  /* index 11562 */
           0x6766, 0x676C, 0x676E, 0x6774, 0x6776, 0x677B, 0x6781,
   0x6784, 0x678E, 0x678F, 0x6791, 0x6793, 0x6796, 0x6798, 0x6799,
   0x679B, 0x67B0, 0x67B1, 0x67B2, 0x67B5, 0x67BB, 0x67BC, 0x67BD,
@@ -1749,7 +1723,7 @@ static const uint16_t gJapaneseMap[] = {
   0x687A, 0x687B, 0x687C, 0x6882, 0x6884, 0x6886, 0x6888, 0x6896,
   0x6898, 0x689A, 0x689C, 0x68A1, 0x68A3, 0x68A5, 0x68A9, 0x68AA,
   0x68AE, 0x68B2, 0x68BB, 0x68C5, 0x68C8, 0x68CC, 0x68CF,
-  /* index 11844 */
+  /* index 11656 */
           0x68D0, 0x68D1, 0x68D3, 0x68D6, 0x68D9, 0x68DC, 0x68DD,
   0x68E5, 0x68E8, 0x68EA, 0x68EB, 0x68EC, 0x68ED, 0x68F0, 0x68F1,
   0x68F5, 0x68F6, 0x68FB, 0x68FC, 0x68FD, 0x6906, 0x6909, 0x690A,
@@ -1762,7 +1736,7 @@ static const uint16_t gJapaneseMap[] = {
   0x69D6, 0x69D7, 0x69E2, 0x69E5, 0x69EE, 0x69EF, 0x69F1, 0x69F3,
   0x69F5, 0x69FE, 0x6A00, 0x6A01, 0x6A03, 0x6A0F, 0x6A11, 0x6A15,
   0x6A1A, 0x6A1D, 0x6A20, 0x6A24, 0x6A28, 0x6A30, 0x6A32,
-  /* index 11938 */
+  /* index 11750 */
           0x6A34, 0x6A37, 0x6A3B, 0x6A3E, 0x6A3F, 0x6A45, 0x6A46,
   0x6A49, 0x6A4A, 0x6A4E, 0x6A50, 0x6A51, 0x6A52, 0x6A55, 0x6A56,
   0x6A5B, 0x6A64, 0x6A67, 0x6A6A, 0x6A71, 0x6A73, 0x6A7E, 0x6A81,
@@ -1775,7 +1749,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6B24, 0x6B28, 0x6B2B, 0x6B2C, 0x6B2F, 0x6B35, 0x6B36, 0x6B3B,
   0x6B3F, 0x6B46, 0x6B4A, 0x6B4D, 0x6B52, 0x6B56, 0x6B58, 0x6B5D,
   0x6B60, 0x6B67, 0x6B6B, 0x6B6E, 0x6B70, 0x6B75, 0x6B7D,
-  /* index 12032 */
+  /* index 11844 */
           0x6B7E, 0x6B82, 0x6B85, 0x6B97, 0x6B9B, 0x6B9F, 0x6BA0,
   0x6BA2, 0x6BA3, 0x6BA8, 0x6BA9, 0x6BAC, 0x6BAD, 0x6BAE, 0x6BB0,
   0x6BB8, 0x6BB9, 0x6BBD, 0x6BBE, 0x6BC3, 0x6BC4, 0x6BC9, 0x6BCC,
@@ -1788,7 +1762,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6C7B, 0x6C85, 0x6C86, 0x6C87, 0x6C89, 0x6C94, 0x6C95, 0x6C97,
   0x6C98, 0x6C9C, 0x6C9F, 0x6CB0, 0x6CB2, 0x6CB4, 0x6CC2, 0x6CC6,
   0x6CCD, 0x6CCF, 0x6CD0, 0x6CD1, 0x6CD2, 0x6CD4, 0x6CD6,
-  /* index 12126 */
+  /* index 11938 */
           0x6CDA, 0x6CDC, 0x6CE0, 0x6CE7, 0x6CE9, 0x6CEB, 0x6CEC,
   0x6CEE, 0x6CF2, 0x6CF4, 0x6D04, 0x6D07, 0x6D0A, 0x6D0E, 0x6D0F,
   0x6D11, 0x6D13, 0x6D1A, 0x6D26, 0x6D27, 0x6D28, 0x6C67, 0x6D2E,
@@ -1801,7 +1775,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6E04, 0x6E1E, 0x6E22, 0x6E27, 0x6E32, 0x6E36, 0x6E39, 0x6E3B,
   0x6E3C, 0x6E44, 0x6E45, 0x6E48, 0x6E49, 0x6E4B, 0x6E4F, 0x6E51,
   0x6E52, 0x6E53, 0x6E54, 0x6E57, 0x6E5C, 0x6E5D, 0x6E5E,
-  /* index 12220 */
+  /* index 12032 */
           0x6E62, 0x6E63, 0x6E68, 0x6E73, 0x6E7B, 0x6E7D, 0x6E8D,
   0x6E93, 0x6E99, 0x6EA0, 0x6EA7, 0x6EAD, 0x6EAE, 0x6EB1, 0x6EB3,
   0x6EBB, 0x6EBF, 0x6EC0, 0x6EC1, 0x6EC3, 0x6EC7, 0x6EC8, 0x6ECA,
@@ -1814,7 +1788,7 @@ static const uint16_t gJapaneseMap[] = {
   0x6F8D, 0x6F90, 0x6F92, 0x6F93, 0x6F94, 0x6F96, 0x6F9A, 0x6F9F,
   0x6FA0, 0x6FA5, 0x6FA6, 0x6FA7, 0x6FA8, 0x6FAE, 0x6FAF, 0x6FB0,
   0x6FB5, 0x6FB6, 0x6FBC, 0x6FC5, 0x6FC7, 0x6FC8, 0x6FCA,
-  /* index 12314 */
+  /* index 12126 */
           0x6FDA, 0x6FDE, 0x6FE8, 0x6FE9, 0x6FF0, 0x6FF5, 0x6FF9,
   0x6FFC, 0x6FFD, 0x7000, 0x7005, 0x7006, 0x7007, 0x700D, 0x7017,
   0x7020, 0x7023, 0x702F, 0x7034, 0x7037, 0x7039, 0x703C, 0x7043,
@@ -1827,7 +1801,7 @@ static const uint16_t gJapaneseMap[] = {
   0x710C, 0x710F, 0x711E, 0x7120, 0x712B, 0x712D, 0x712F, 0x7130,
   0x7131, 0x7138, 0x7141, 0x7145, 0x7146, 0x7147, 0x714A, 0x714B,
   0x7150, 0x7152, 0x7157, 0x715A, 0x715C, 0x715E, 0x7160,
-  /* index 12408 */
+  /* index 12220 */
           0x7168, 0x7179, 0x7180, 0x7185, 0x7187, 0x718C, 0x7192,
   0x719A, 0x719B, 0x71A0, 0x71A2, 0x71AF, 0x71B0, 0x71B2, 0x71B3,
   0x71BA, 0x71BF, 0x71C0, 0x71C1, 0x71C4, 0x71CB, 0x71CC, 0x71D3,
@@ -1840,7 +1814,7 @@ static const uint16_t gJapaneseMap[] = {
   0x728D, 0x728E, 0x7293, 0x729B, 0x72A8, 0x72AD, 0x72AE, 0x72B1,
   0x72B4, 0x72BE, 0x72C1, 0x72C7, 0x72C9, 0x72CC, 0x72D5, 0x72D6,
   0x72D8, 0x72DF, 0x72E5, 0x72F3, 0x72F4, 0x72FA, 0x72FB,
-  /* index 12502 */
+  /* index 12314 */
           0x72FE, 0x7302, 0x7304, 0x7305, 0x7307, 0x730B, 0x730D,
   0x7312, 0x7313, 0x7318, 0x7319, 0x731E, 0x7322, 0x7324, 0x7327,
   0x7328, 0x732C, 0x7331, 0x7332, 0x7335, 0x733A, 0x733B, 0x733D,
@@ -1853,7 +1827,7 @@ static const uint16_t gJapaneseMap[] = {
   0x73C5, 0x73C6, 0x73C9, 0x73CB, 0x73CC, 0x73CF, 0x73D2, 0x73D3,
   0x73D6, 0x73D9, 0x73DD, 0x73E1, 0x73E3, 0x73E6, 0x73E7, 0x73E9,
   0x73F4, 0x73F5, 0x73F7, 0x73F9, 0x73FA, 0x73FB, 0x73FD,
-  /* index 12596 */
+  /* index 12408 */
           0x73FF, 0x7400, 0x7401, 0x7404, 0x7407, 0x740A, 0x7411,
   0x741A, 0x741B, 0x7424, 0x7426, 0x7428, 0x7429, 0x742A, 0x742B,
   0x742C, 0x742D, 0x742E, 0x742F, 0x7430, 0x7431, 0x7439, 0x7440,
@@ -1866,7 +1840,7 @@ static const uint16_t gJapaneseMap[] = {
   0x74BB, 0x74BF, 0x74C8, 0x74C9, 0x74CC, 0x74D0, 0x74D3, 0x74D8,
   0x74DA, 0x74DB, 0x74DE, 0x74DF, 0x74E4, 0x74E8, 0x74EA, 0x74EB,
   0x74EF, 0x74F4, 0x74FA, 0x74FB, 0x74FC, 0x74FF, 0x7506,
-  /* index 12690 */
+  /* index 12502 */
           0x7512, 0x7516, 0x7517, 0x7520, 0x7521, 0x7524, 0x7527,
   0x7529, 0x752A, 0x752F, 0x7536, 0x7539, 0x753D, 0x753E, 0x753F,
   0x7540, 0x7543, 0x7547, 0x7548, 0x754E, 0x7550, 0x7552, 0x7557,
@@ -1879,7 +1853,7 @@ static const uint16_t gJapaneseMap[] = {
   0x7608, 0x760A, 0x760C, 0x760F, 0x7612, 0x7613, 0x7615, 0x7616,
   0x7619, 0x761B, 0x761C, 0x761D, 0x761E, 0x7623, 0x7625, 0x7626,
   0x7629, 0x762D, 0x7632, 0x7633, 0x7635, 0x7638, 0x7639,
-  /* index 12784 */
+  /* index 12596 */
           0x763A, 0x763C, 0x764A, 0x7640, 0x7641, 0x7643, 0x7644,
   0x7645, 0x7649, 0x764B, 0x7655, 0x7659, 0x765F, 0x7664, 0x7665,
   0x766D, 0x766E, 0x766F, 0x7671, 0x7674, 0x7681, 0x7685, 0x768C,
@@ -1892,7 +1866,7 @@ static const uint16_t gJapaneseMap[] = {
   0x772E, 0x772F, 0x7734, 0x7735, 0x7736, 0x7739, 0x773D, 0x773E,
   0x7742, 0x7745, 0x7746, 0x774A, 0x774D, 0x774E, 0x774F, 0x7752,
   0x7756, 0x7757, 0x775C, 0x775E, 0x775F, 0x7760, 0x7762,
-  /* index 12878 */
+  /* index 12690 */
           0x7764, 0x7767, 0x776A, 0x776C, 0x7770, 0x7772, 0x7773,
   0x7774, 0x777A, 0x777D, 0x7780, 0x7784, 0x778C, 0x778D, 0x7794,
   0x7795, 0x7796, 0x779A, 0x779F, 0x77A2, 0x77A7, 0x77AA, 0x77AE,
@@ -1905,7 +1879,7 @@ static const uint16_t gJapaneseMap[] = {
   0x7863, 0x7864, 0x7868, 0x786A, 0x786E, 0x787A, 0x787E, 0x788A,
   0x788F, 0x7894, 0x7898, 0x78A1, 0x789D, 0x789E, 0x789F, 0x78A4,
   0x78A8, 0x78AC, 0x78AD, 0x78B0, 0x78B1, 0x78B2, 0x78B3,
-  /* index 12972 */
+  /* index 12784 */
           0x78BB, 0x78BD, 0x78BF, 0x78C7, 0x78C8, 0x78C9, 0x78CC,
   0x78CE, 0x78D2, 0x78D3, 0x78D5, 0x78D6, 0x78E4, 0x78DB, 0x78DF,
   0x78E0, 0x78E1, 0x78E6, 0x78EA, 0x78F2, 0x78F3, 0x7900, 0x78F6,
@@ -1918,7 +1892,7 @@ static const uint16_t gJapaneseMap[] = {
   0x7998, 0x799B, 0x799C, 0x79A1, 0x79A8, 0x79A9, 0x79AB, 0x79AF,
   0x79B1, 0x79B4, 0x79B8, 0x79BB, 0x79C2, 0x79C4, 0x79C7, 0x79C8,
   0x79CA, 0x79CF, 0x79D4, 0x79D6, 0x79DA, 0x79DD, 0x79DE,
-  /* index 13066 */
+  /* index 12878 */
           0x79E0, 0x79E2, 0x79E5, 0x79EA, 0x79EB, 0x79ED, 0x79F1,
   0x79F8, 0x79FC, 0x7A02, 0x7A03, 0x7A07, 0x7A09, 0x7A0A, 0x7A0C,
   0x7A11, 0x7A15, 0x7A1B, 0x7A1E, 0x7A21, 0x7A27, 0x7A2B, 0x7A2D,
@@ -1931,7 +1905,7 @@ static const uint16_t gJapaneseMap[] = {
   0x7AD1, 0x7ADB, 0x7AE8, 0x7AE9, 0x7AEB, 0x7AEC, 0x7AF1, 0x7AF4,
   0x7AFB, 0x7AFD, 0x7AFE, 0x7B07, 0x7B14, 0x7B1F, 0x7B23, 0x7B27,
   0x7B29, 0x7B2A, 0x7B2B, 0x7B2D, 0x7B2E, 0x7B2F, 0x7B30,
-  /* index 13160 */
+  /* index 12972 */
           0x7B31, 0x7B34, 0x7B3D, 0x7B3F, 0x7B40, 0x7B41, 0x7B47,
   0x7B4E, 0x7B55, 0x7B60, 0x7B64, 0x7B66, 0x7B69, 0x7B6A, 0x7B6D,
   0x7B6F, 0x7B72, 0x7B73, 0x7B77, 0x7B84, 0x7B89, 0x7B8E, 0x7B90,
@@ -1944,7 +1918,7 @@ static const uint16_t gJapaneseMap[] = {
   0x7C20, 0x7C25, 0x7C26, 0x7C28, 0x7C2C, 0x7C31, 0x7C33, 0x7C34,
   0x7C36, 0x7C39, 0x7C3A, 0x7C46, 0x7C4A, 0x7C55, 0x7C51, 0x7C52,
   0x7C53, 0x7C59, 0x7C5A, 0x7C5B, 0x7C5C, 0x7C5D, 0x7C5E,
-  /* index 13254 */
+  /* index 13066 */
           0x7C61, 0x7C63, 0x7C67, 0x7C69, 0x7C6D, 0x7C6E, 0x7C70,
   0x7C72, 0x7C79, 0x7C7C, 0x7C7D, 0x7C86, 0x7C87, 0x7C8F, 0x7C94,
   0x7C9E, 0x7CA0, 0x7CA6, 0x7CB0, 0x7CB6, 0x7CB7, 0x7CBA, 0x7CBB,
@@ -1957,7 +1931,7 @@ static const uint16_t gJapaneseMap[] = {
   0x7D5C, 0x7D5D, 0x7D65, 0x7D67, 0x7D6A, 0x7D70, 0x7D78, 0x7D7A,
   0x7D7B, 0x7D7F, 0x7D81, 0x7D82, 0x7D83, 0x7D85, 0x7D86, 0x7D88,
   0x7D8B, 0x7D8C, 0x7D8D, 0x7D91, 0x7D96, 0x7D97, 0x7D9D,
-  /* index 13348 */
+  /* index 13160 */
           0x7D9E, 0x7DA6, 0x7DA7, 0x7DAA, 0x7DB3, 0x7DB6, 0x7DB7,
   0x7DB9, 0x7DC2, 0x7DC3, 0x7DC4, 0x7DC5, 0x7DC6, 0x7DCC, 0x7DCD,
   0x7DCE, 0x7DD7, 0x7DD9, 0x7E00, 0x7DE2, 0x7DE5, 0x7DE6, 0x7DEA,
@@ -1970,7 +1944,7 @@ static const uint16_t gJapaneseMap[] = {
   0x7E9A, 0x7E9D, 0x7E9E, 0x7F3C, 0x7F3B, 0x7F3D, 0x7F3E, 0x7F3F,
   0x7F43, 0x7F44, 0x7F47, 0x7F4F, 0x7F52, 0x7F53, 0x7F5B, 0x7F5C,
   0x7F5D, 0x7F61, 0x7F63, 0x7F64, 0x7F65, 0x7F66, 0x7F6D,
-  /* index 13442 */
+  /* index 13254 */
           0x7F71, 0x7F7D, 0x7F7E, 0x7F7F, 0x7F80, 0x7F8B, 0x7F8D,
   0x7F8F, 0x7F90, 0x7F91, 0x7F96, 0x7F97, 0x7F9C, 0x7FA1, 0x7FA2,
   0x7FA6, 0x7FAA, 0x7FAD, 0x7FB4, 0x7FBC, 0x7FBF, 0x7FC0, 0x7FC3,
@@ -1983,7 +1957,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8071, 0x8075, 0x8081, 0x8088, 0x808E, 0x809C, 0x809E, 0x80A6,
   0x80A7, 0x80AB, 0x80B8, 0x80B9, 0x80C8, 0x80CD, 0x80CF, 0x80D2,
   0x80D4, 0x80D5, 0x80D7, 0x80D8, 0x80E0, 0x80ED, 0x80EE,
-  /* index 13536 */
+  /* index 13348 */
           0x80F0, 0x80F2, 0x80F3, 0x80F6, 0x80F9, 0x80FA, 0x80FE,
   0x8103, 0x810B, 0x8116, 0x8117, 0x8118, 0x811C, 0x811E, 0x8120,
   0x8124, 0x8127, 0x812C, 0x8130, 0x8135, 0x813A, 0x813C, 0x8145,
@@ -1996,7 +1970,7 @@ static const uint16_t gJapaneseMap[] = {
   0x81F6, 0x81F8, 0x81F9, 0x81FD, 0x81FF, 0x8200, 0x8203, 0x820F,
   0x8213, 0x8214, 0x8219, 0x821A, 0x821D, 0x8221, 0x8222, 0x8228,
   0x8232, 0x8234, 0x823A, 0x8243, 0x8244, 0x8245, 0x8246,
-  /* index 13630 */
+  /* index 13442 */
           0x824B, 0x824E, 0x824F, 0x8251, 0x8256, 0x825C, 0x8260,
   0x8263, 0x8267, 0x826D, 0x8274, 0x827B, 0x827D, 0x827F, 0x8280,
   0x8281, 0x8283, 0x8284, 0x8287, 0x8289, 0x828A, 0x828E, 0x8291,
@@ -2009,7 +1983,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8321, 0x8322, 0x832C, 0x832D, 0x832E, 0x8330, 0x8333, 0x8337,
   0x833A, 0x833C, 0x833D, 0x8342, 0x8343, 0x8344, 0x8347, 0x834D,
   0x834E, 0x8351, 0x8355, 0x8356, 0x8357, 0x8370, 0x8378,
-  /* index 13724 */
+  /* index 13536 */
           0x837D, 0x837F, 0x8380, 0x8382, 0x8384, 0x8386, 0x838D,
   0x8392, 0x8394, 0x8395, 0x8398, 0x8399, 0x839B, 0x839C, 0x839D,
   0x83A6, 0x83A7, 0x83A9, 0x83AC, 0x83BE, 0x83BF, 0x83C0, 0x83C7,
@@ -2022,7 +1996,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8481, 0x8485, 0x8492, 0x8493, 0x8495, 0x849E, 0x84A6, 0x84A8,
   0x84A9, 0x84AA, 0x84AF, 0x84B1, 0x84B4, 0x84BA, 0x84BD, 0x84BE,
   0x84C0, 0x84C2, 0x84C7, 0x84C8, 0x84CC, 0x84CF, 0x84D3,
-  /* index 13818 */
+  /* index 13630 */
           0x84DC, 0x84E7, 0x84EA, 0x84EF, 0x84F0, 0x84F1, 0x84F2,
   0x84F7, 0x8532, 0x84FA, 0x84FB, 0x84FD, 0x8502, 0x8503, 0x8507,
   0x850C, 0x850E, 0x8510, 0x851C, 0x851E, 0x8522, 0x8523, 0x8524,
@@ -2035,7 +2009,7 @@ static const uint16_t gJapaneseMap[] = {
   0x85B6, 0x85B7, 0x85B8, 0x85BC, 0x85BD, 0x85BE, 0x85BF, 0x85C2,
   0x85C7, 0x85CA, 0x85CB, 0x85CE, 0x85AD, 0x85D8, 0x85DA, 0x85DF,
   0x85E0, 0x85E6, 0x85E8, 0x85ED, 0x85F3, 0x85F6, 0x85FC,
-  /* index 13912 */
+  /* index 13724 */
           0x85FF, 0x8600, 0x8604, 0x8605, 0x860D, 0x860E, 0x8610,
   0x8611, 0x8612, 0x8618, 0x8619, 0x861B, 0x861E, 0x8621, 0x8627,
   0x8629, 0x8636, 0x8638, 0x863A, 0x863C, 0x863D, 0x8640, 0x8642,
@@ -2048,7 +2022,7 @@ static const uint16_t gJapaneseMap[] = {
   0x86DC, 0x86E0, 0x86E3, 0x86E5, 0x86E7, 0x8688, 0x86FA, 0x86FC,
   0x86FD, 0x8704, 0x8705, 0x8707, 0x870B, 0x870E, 0x870F, 0x8710,
   0x8713, 0x8714, 0x8719, 0x871E, 0x871F, 0x8721, 0x8723,
-  /* index 14006 */
+  /* index 13818 */
           0x8728, 0x872E, 0x872F, 0x8731, 0x8732, 0x8739, 0x873A,
   0x873C, 0x873D, 0x873E, 0x8740, 0x8743, 0x8745, 0x874D, 0x8758,
   0x875D, 0x8761, 0x8764, 0x8765, 0x876F, 0x8771, 0x8772, 0x877B,
@@ -2061,7 +2035,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8801, 0x8803, 0x8806, 0x8809, 0x880A, 0x880B, 0x8810, 0x8819,
   0x8812, 0x8813, 0x8814, 0x8818, 0x881A, 0x881B, 0x881C, 0x881E,
   0x881F, 0x8828, 0x882D, 0x882E, 0x8830, 0x8832, 0x8835,
-  /* index 14100 */
+  /* index 13912 */
           0x883A, 0x883C, 0x8841, 0x8843, 0x8845, 0x8848, 0x8849,
   0x884A, 0x884B, 0x884E, 0x8851, 0x8855, 0x8856, 0x8858, 0x885A,
   0x885C, 0x885F, 0x8860, 0x8864, 0x8869, 0x8871, 0x8879, 0x887B,
@@ -2074,7 +2048,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8939, 0x893A, 0x893E, 0x8940, 0x8942, 0x8945, 0x8946, 0x8949,
   0x894F, 0x8952, 0x8957, 0x895A, 0x895B, 0x895C, 0x8961, 0x8962,
   0x8963, 0x896B, 0x896E, 0x8970, 0x8973, 0x8975, 0x897A,
-  /* index 14194 */
+  /* index 14006 */
           0x897B, 0x897C, 0x897D, 0x8989, 0x898D, 0x8990, 0x8994,
   0x8995, 0x899B, 0x899C, 0x899F, 0x89A0, 0x89A5, 0x89B0, 0x89B4,
   0x89B5, 0x89B6, 0x89B7, 0x89BC, 0x89D4, 0x89D5, 0x89D6, 0x89D7,
@@ -2087,7 +2061,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8A76, 0x8A77, 0x8A79, 0x8A7A, 0x8A7B, 0x8A7E, 0x8A7F, 0x8A80,
   0x8A83, 0x8A86, 0x8A8B, 0x8A8F, 0x8A90, 0x8A92, 0x8A96, 0x8A97,
   0x8A99, 0x8A9F, 0x8AA7, 0x8AA9, 0x8AAE, 0x8AAF, 0x8AB3,
-  /* index 14288 */
+  /* index 14100 */
           0x8AB6, 0x8AB7, 0x8ABB, 0x8ABE, 0x8AC3, 0x8AC6, 0x8AC8,
   0x8AC9, 0x8ACA, 0x8AD1, 0x8AD3, 0x8AD4, 0x8AD5, 0x8AD7, 0x8ADD,
   0x8ADF, 0x8AEC, 0x8AF0, 0x8AF4, 0x8AF5, 0x8AF6, 0x8AFC, 0x8AFF,
@@ -2100,7 +2074,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8C49, 0x8C4B, 0x8C4F, 0x8C51, 0x8C53, 0x8C54, 0x8C57, 0x8C58,
   0x8C5B, 0x8C5D, 0x8C59, 0x8C63, 0x8C64, 0x8C66, 0x8C68, 0x8C69,
   0x8C6D, 0x8C73, 0x8C75, 0x8C76, 0x8C7B, 0x8C7E, 0x8C86,
-  /* index 14382 */
+  /* index 14194 */
           0x8C87, 0x8C8B, 0x8C90, 0x8C92, 0x8C93, 0x8C99, 0x8C9B,
   0x8C9C, 0x8CA4, 0x8CB9, 0x8CBA, 0x8CC5, 0x8CC6, 0x8CC9, 0x8CCB,
   0x8CCF, 0x8CD6, 0x8CD5, 0x8CD9, 0x8CDD, 0x8CE1, 0x8CE8, 0x8CEC,
@@ -2113,7 +2087,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8DD7, 0x8DD9, 0x8DE4, 0x8DE5, 0x8DE7, 0x8DEC, 0x8DF0, 0x8DBC,
   0x8DF1, 0x8DF2, 0x8DF4, 0x8DFD, 0x8E01, 0x8E04, 0x8E05, 0x8E06,
   0x8E0B, 0x8E11, 0x8E14, 0x8E16, 0x8E20, 0x8E21, 0x8E22,
-  /* index 14476 */
+  /* index 14288 */
           0x8E23, 0x8E26, 0x8E27, 0x8E31, 0x8E33, 0x8E36, 0x8E37,
   0x8E38, 0x8E39, 0x8E3D, 0x8E40, 0x8E41, 0x8E4B, 0x8E4D, 0x8E4E,
   0x8E4F, 0x8E54, 0x8E5B, 0x8E5C, 0x8E5D, 0x8E5E, 0x8E61, 0x8E62,
@@ -2126,7 +2100,7 @@ static const uint16_t gJapaneseMap[] = {
   0x8F08, 0x8F0F, 0x8F10, 0x8F16, 0x8F17, 0x8F18, 0x8F1E, 0x8F20,
   0x8F21, 0x8F23, 0x8F25, 0x8F27, 0x8F28, 0x8F2C, 0x8F2D, 0x8F2E,
   0x8F34, 0x8F35, 0x8F36, 0x8F37, 0x8F3A, 0x8F40, 0x8F41,
-  /* index 14570 */
+  /* index 14382 */
           0x8F43, 0x8F47, 0x8F4F, 0x8F51, 0x8F52, 0x8F53, 0x8F54,
   0x8F55, 0x8F58, 0x8F5D, 0x8F5E, 0x8F65, 0x8F9D, 0x8FA0, 0x8FA1,
   0x8FA4, 0x8FA5, 0x8FA6, 0x8FB5, 0x8FB6, 0x8FB8, 0x8FBE, 0x8FC0,
@@ -2139,7 +2113,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9088, 0x908B, 0x908C, 0x908E, 0x9090, 0x9095, 0x9097, 0x9098,
   0x9099, 0x909B, 0x90A0, 0x90A1, 0x90A2, 0x90A5, 0x90B0, 0x90B2,
   0x90B3, 0x90B4, 0x90B6, 0x90BD, 0x90CC, 0x90BE, 0x90C3,
-  /* index 14664 */
+  /* index 14476 */
           0x90C4, 0x90C5, 0x90C7, 0x90C8, 0x90D5, 0x90D7, 0x90D8,
   0x90D9, 0x90DC, 0x90DD, 0x90DF, 0x90E5, 0x90D2, 0x90F6, 0x90EB,
   0x90EF, 0x90F0, 0x90F4, 0x90FE, 0x90FF, 0x9100, 0x9104, 0x9105,
@@ -2152,7 +2126,7 @@ static const uint16_t gJapaneseMap[] = {
   0x918A, 0x918E, 0x9191, 0x9193, 0x9194, 0x9195, 0x9198, 0x919E,
   0x91A1, 0x91A6, 0x91A8, 0x91AC, 0x91AD, 0x91AE, 0x91B0, 0x91B1,
   0x91B2, 0x91B3, 0x91B6, 0x91BB, 0x91BC, 0x91BD, 0x91BF,
-  /* index 14758 */
+  /* index 14570 */
           0x91C2, 0x91C3, 0x91C5, 0x91D3, 0x91D4, 0x91D7, 0x91D9,
   0x91DA, 0x91DE, 0x91E4, 0x91E5, 0x91E9, 0x91EA, 0x91EC, 0x91ED,
   0x91EE, 0x91EF, 0x91F0, 0x91F1, 0x91F7, 0x91F9, 0x91FB, 0x91FD,
@@ -2165,7 +2139,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9265, 0x9267, 0x9268, 0x9269, 0x926E, 0x926F, 0x9270, 0x9275,
   0x9276, 0x9277, 0x9278, 0x9279, 0x927B, 0x927C, 0x927D, 0x927F,
   0x9288, 0x9289, 0x928A, 0x928D, 0x928E, 0x9292, 0x9297,
-  /* index 14852 */
+  /* index 14664 */
           0x9299, 0x929F, 0x92A0, 0x92A4, 0x92A5, 0x92A7, 0x92A8,
   0x92AB, 0x92AF, 0x92B2, 0x92B6, 0x92B8, 0x92BA, 0x92BB, 0x92BC,
   0x92BD, 0x92BF, 0x92C0, 0x92C1, 0x92C2, 0x92C3, 0x92C5, 0x92C6,
@@ -2178,7 +2152,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9347, 0x9348, 0x9349, 0x9350, 0x9351, 0x9352, 0x9355, 0x9357,
   0x9358, 0x935A, 0x935E, 0x9364, 0x9365, 0x9367, 0x9369, 0x936A,
   0x936D, 0x936F, 0x9370, 0x9371, 0x9373, 0x9374, 0x9376,
-  /* index 14946 */
+  /* index 14758 */
           0x937A, 0x937D, 0x937F, 0x9380, 0x9381, 0x9382, 0x9388,
   0x938A, 0x938B, 0x938D, 0x938F, 0x9392, 0x9395, 0x9398, 0x939B,
   0x939E, 0x93A1, 0x93A3, 0x93A4, 0x93A6, 0x93A8, 0x93AB, 0x93B4,
@@ -2191,7 +2165,7 @@ static const uint16_t gJapaneseMap[] = {
   0x943D, 0x9443, 0x9445, 0x9448, 0x944A, 0x944C, 0x9455, 0x9459,
   0x945C, 0x945F, 0x9461, 0x9463, 0x9468, 0x946B, 0x946D, 0x946E,
   0x946F, 0x9471, 0x9472, 0x9484, 0x9483, 0x9578, 0x9579,
-  /* index 15040 */
+  /* index 14852 */
           0x957E, 0x9584, 0x9588, 0x958C, 0x958D, 0x958E, 0x959D,
   0x959E, 0x959F, 0x95A1, 0x95A6, 0x95A9, 0x95AB, 0x95AC, 0x95B4,
   0x95B6, 0x95BA, 0x95BD, 0x95BF, 0x95C6, 0x95C8, 0x95C9, 0x95CB,
@@ -2204,7 +2178,7 @@ static const uint16_t gJapaneseMap[] = {
   0x969D, 0x969F, 0x96A4, 0x96A5, 0x96A6, 0x96A9, 0x96AE, 0x96AF,
   0x96B3, 0x96BA, 0x96CA, 0x96D2, 0x5DB2, 0x96D8, 0x96DA, 0x96DD,
   0x96DE, 0x96DF, 0x96E9, 0x96EF, 0x96F1, 0x96FA, 0x9702,
-  /* index 15134 */
+  /* index 14946 */
           0x9703, 0x9705, 0x9709, 0x971A, 0x971B, 0x971D, 0x9721,
   0x9722, 0x9723, 0x9728, 0x9731, 0x9733, 0x9741, 0x9743, 0x974A,
   0x974E, 0x974F, 0x9755, 0x9757, 0x9758, 0x975A, 0x975B, 0x9763,
@@ -2217,7 +2191,7 @@ static const uint16_t gJapaneseMap[] = {
   0x97DE, 0x97E0, 0x97DB, 0x97E1, 0x97E4, 0x97EF, 0x97F1, 0x97F4,
   0x97F7, 0x97F8, 0x97FA, 0x9807, 0x980A, 0x9819, 0x980D, 0x980E,
   0x9814, 0x9816, 0x981C, 0x981E, 0x9820, 0x9823, 0x9826,
-  /* index 15228 */
+  /* index 15040 */
           0x982B, 0x982E, 0x982F, 0x9830, 0x9832, 0x9833, 0x9835,
   0x9825, 0x983E, 0x9844, 0x9847, 0x984A, 0x9851, 0x9852, 0x9853,
   0x9856, 0x9857, 0x9859, 0x985A, 0x9862, 0x9863, 0x9865, 0x9866,
@@ -2230,7 +2204,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9940, 0x9941, 0x9946, 0x9947, 0x9948, 0x994D, 0x994E, 0x9954,
   0x9958, 0x9959, 0x995B, 0x995C, 0x995E, 0x995F, 0x9960, 0x999B,
   0x999D, 0x999F, 0x99A6, 0x99B0, 0x99B1, 0x99B2, 0x99B5,
-  /* index 15322 */
+  /* index 15134 */
           0x99B9, 0x99BA, 0x99BD, 0x99BF, 0x99C3, 0x99C9, 0x99D3,
   0x99D4, 0x99D9, 0x99DA, 0x99DC, 0x99DE, 0x99E7, 0x99EA, 0x99EB,
   0x99EC, 0x99F0, 0x99F4, 0x99F5, 0x99F9, 0x99FD, 0x99FE, 0x9A02,
@@ -2243,7 +2217,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9AD2, 0x9AD5, 0x9AD6, 0x9AD7, 0x9ADB, 0x9ADC, 0x9AE0, 0x9AE4,
   0x9AE5, 0x9AE7, 0x9AE9, 0x9AEC, 0x9AF2, 0x9AF3, 0x9AF5, 0x9AF9,
   0x9AFA, 0x9AFD, 0x9AFF, 0x9B00, 0x9B01, 0x9B02, 0x9B03,
-  /* index 15416 */
+  /* index 15228 */
           0x9B04, 0x9B05, 0x9B08, 0x9B09, 0x9B0B, 0x9B0C, 0x9B0D,
   0x9B0E, 0x9B10, 0x9B12, 0x9B16, 0x9B19, 0x9B1B, 0x9B1C, 0x9B20,
   0x9B26, 0x9B2B, 0x9B2D, 0x9B33, 0x9B34, 0x9B35, 0x9B37, 0x9B39,
@@ -2256,7 +2230,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9BB7, 0x9BB8, 0x9BBB, 0x9BBC, 0x9BBE, 0x9BBF, 0x9BC1, 0x9BC7,
   0x9BC8, 0x9BCE, 0x9BD0, 0x9BD7, 0x9BD8, 0x9BDD, 0x9BDF, 0x9BE5,
   0x9BE7, 0x9BEA, 0x9BEB, 0x9BEF, 0x9BF3, 0x9BF7, 0x9BF8,
-  /* index 15510 */
+  /* index 15322 */
           0x9BF9, 0x9BFA, 0x9BFD, 0x9BFF, 0x9C00, 0x9C02, 0x9C0B,
   0x9C0F, 0x9C11, 0x9C16, 0x9C18, 0x9C19, 0x9C1A, 0x9C1C, 0x9C1E,
   0x9C22, 0x9C23, 0x9C26, 0x9C27, 0x9C28, 0x9C29, 0x9C2A, 0x9C31,
@@ -2269,7 +2243,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9D33, 0x9D34, 0x9D3A, 0x9D3C, 0x9D45, 0x9D3D, 0x9D42, 0x9D43,
   0x9D47, 0x9D4A, 0x9D53, 0x9D54, 0x9D5F, 0x9D63, 0x9D62, 0x9D65,
   0x9D69, 0x9D6A, 0x9D6B, 0x9D70, 0x9D76, 0x9D77, 0x9D7B,
-  /* index 15604 */
+  /* index 15416 */
           0x9D7C, 0x9D7E, 0x9D83, 0x9D84, 0x9D86, 0x9D8A, 0x9D8D,
   0x9D8E, 0x9D92, 0x9D93, 0x9D95, 0x9D96, 0x9D97, 0x9D98, 0x9DA1,
   0x9DAA, 0x9DAC, 0x9DAE, 0x9DB1, 0x9DB5, 0x9DB9, 0x9DBC, 0x9DBF,
@@ -2282,7 +2256,7 @@ static const uint16_t gJapaneseMap[] = {
   0x9EA4, 0x9EA8, 0x9EAC, 0x9EAE, 0x9EAF, 0x9EB0, 0x9EB3, 0x9EB4,
   0x9EB5, 0x9EC6, 0x9EC8, 0x9ECB, 0x9ED5, 0x9EDF, 0x9EE4, 0x9EE7,
   0x9EEC, 0x9EED, 0x9EEE, 0x9EF0, 0x9EF1, 0x9EF2, 0x9EF5,
-  /* index 15698 */
+  /* index 15510 */
           0x9EF8, 0x9EFF, 0x9F02, 0x9F03, 0x9F09, 0x9F0F, 0x9F10,
   0x9F11, 0x9F12, 0x9F14, 0x9F16, 0x9F17, 0x9F19, 0x9F1A, 0x9F1B,
   0x9F1F, 0x9F22, 0x9F26, 0x9F2A, 0x9F2B, 0x9F2F, 0x9F31, 0x9F32,

From 99bbd6a13205bf0c75fdf1ba404eb74ca4aec2dc Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Sun, 15 Dec 2013 12:47:09 -0500
Subject: [PATCH 422/459] Backed out changesets a7fc463961ce and 65061e971eb8
 (bug 935793) for breaking Travis testing (bug 950441).

---
 accessible/src/jsat/AccessFu.jsm            | 20 ++++++-------
 b2g/components/ErrorPage.jsm                |  8 ++----
 content/base/public/nsIFrameLoader.idl      |  7 +----
 content/base/src/nsFrameLoader.cpp          | 32 +++++++++------------
 dom/browser-element/BrowserElementParent.js | 16 +++--------
 dom/inputmethod/Keyboard.jsm                |  8 ++----
 dom/ipc/ProcessPriorityManager.cpp          | 11 ++-----
 7 files changed, 32 insertions(+), 70 deletions(-)

diff --git a/accessible/src/jsat/AccessFu.jsm b/accessible/src/jsat/AccessFu.jsm
index fb7bcdbbd263..c0cf612968c5 100644
--- a/accessible/src/jsat/AccessFu.jsm
+++ b/accessible/src/jsat/AccessFu.jsm
@@ -118,8 +118,8 @@ this.AccessFu = {
     Output.start();
     TouchAdapter.start();
 
-    Services.obs.addObserver(this, 'remote-browser-shown', false);
-    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
+    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
     Services.obs.addObserver(this, 'Accessibility:NextObject', false);
     Services.obs.addObserver(this, 'Accessibility:PreviousObject', false);
     Services.obs.addObserver(this, 'Accessibility:Focus', false);
@@ -162,8 +162,8 @@ this.AccessFu = {
     Utils.win.removeEventListener('TabClose', this);
     Utils.win.removeEventListener('TabSelect', this);
 
-    Services.obs.removeObserver(this, 'remote-browser-shown');
-    Services.obs.removeObserver(this, 'inprocess-browser-shown');
+    Services.obs.removeObserver(this, 'remote-browser-frame-shown');
+    Services.obs.removeObserver(this, 'in-process-browser-or-app-frame-shown');
     Services.obs.removeObserver(this, 'Accessibility:NextObject');
     Services.obs.removeObserver(this, 'Accessibility:PreviousObject');
     Services.obs.removeObserver(this, 'Accessibility:Focus');
@@ -304,15 +304,11 @@ this.AccessFu = {
       case 'Accessibility:MoveByGranularity':
         this.Input.moveByGranularity(JSON.parse(aData));
         break;
-      case 'remote-browser-shown':
-      case 'inprocess-browser-shown':
+      case 'remote-browser-frame-shown':
+      case 'in-process-browser-or-app-frame-shown':
       {
-        // Ignore notifications that aren't from a BrowserOrApp
-        let frameLoader = aSubject.QueryInterface(Ci.nsIFrameLoader);
-        if (!frameLoader.ownerIsBrowserOrAppFrame) {
-          return;
-        }
-        this._handleMessageManager(frameLoader.messageManager);
+        let mm = aSubject.QueryInterface(Ci.nsIFrameLoader).messageManager;
+        this._handleMessageManager(mm);
         break;
       }
     }
diff --git a/b2g/components/ErrorPage.jsm b/b2g/components/ErrorPage.jsm
index ba9cb3af03e0..8b6c2985e638 100644
--- a/b2g/components/ErrorPage.jsm
+++ b/b2g/components/ErrorPage.jsm
@@ -150,16 +150,12 @@ let ErrorPage = {
   },
 
   init: function errorPageInit() {
-    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
-    Services.obs.addObserver(this, 'remote-browser-shown', false);
+    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
   },
 
   observe: function errorPageObserve(aSubject, aTopic, aData) {
     let frameLoader = aSubject.QueryInterface(Ci.nsIFrameLoader);
-    // Ignore notifications that aren't from a BrowserOrApp
-    if (!frameLoader.ownerIsBrowserOrAppFrame) {
-      return;
-    }
     let mm = frameLoader.messageManager;
 
     // This won't happen from dom/ipc/preload.js in non-OOP builds.
diff --git a/content/base/public/nsIFrameLoader.idl b/content/base/public/nsIFrameLoader.idl
index bcbc5fd93028..a2f3e812d621 100644
--- a/content/base/public/nsIFrameLoader.idl
+++ b/content/base/public/nsIFrameLoader.idl
@@ -111,7 +111,7 @@ interface nsIContentViewManager : nsISupports
   readonly attribute nsIContentView rootContentView;
 };
 
-[scriptable, builtinclass, uuid(a723673b-a26e-4cc6-ae23-ec70df9d97c9)]
+[scriptable, builtinclass, uuid(5b9949dc-56f1-47b6-b6d2-3785bb90ed6d)]
 interface nsIFrameLoader : nsISupports
 {
   /**
@@ -272,11 +272,6 @@ interface nsIFrameLoader : nsISupports
    * have a notion of visibility in the parent process when frames are OOP.
    */
   [infallible] attribute boolean visible;
-
-  /**
-   * Find out whether the owner content really is a browser or app frame
-   */
-  readonly attribute boolean ownerIsBrowserOrAppFrame;
 };
 
 %{C++
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 9c74e96b4ae9..1c4d99da8d62 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -948,9 +948,9 @@ nsFrameLoader::ShowRemoteFrame(const nsIntSize& size,
     EnsureMessageManager();
 
     nsCOMPtr<nsIObserverService> os = services::GetObserverService();
-    if (os && !mRemoteBrowserInitialized) {
+    if (OwnerIsBrowserOrAppFrame() && os && !mRemoteBrowserInitialized) {
       os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
-                          "remote-browser-shown", nullptr);
+                          "remote-browser-frame-shown", nullptr);
       mRemoteBrowserInitialized = true;
     }
   } else {
@@ -1409,14 +1409,6 @@ nsFrameLoader::OwnerIsBrowserOrAppFrame()
   return browserFrame ? browserFrame->GetReallyIsBrowserOrApp() : false;
 }
 
-// The xpcom getter version
-NS_IMETHODIMP
-nsFrameLoader::GetOwnerIsBrowserOrAppFrame(bool* aResult)
-{
-  *aResult = OwnerIsBrowserOrAppFrame();
-  return NS_OK;
-}
-
 bool
 nsFrameLoader::OwnerIsAppFrame()
 {
@@ -1685,16 +1677,18 @@ nsFrameLoader::MaybeCreateDocShell()
     mDocShell->SetIsBrowserInsideApp(containingAppId);
   }
 
-  nsCOMPtr<nsIObserverService> os = services::GetObserverService();
-  if (os) {
-    os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
-                        "inprocess-browser-shown", nullptr);
-  }
+  if (OwnerIsBrowserOrAppFrame()) {
+    nsCOMPtr<nsIObserverService> os = services::GetObserverService();
+    if (os) {
+      os->NotifyObservers(NS_ISUPPORTS_CAST(nsIFrameLoader*, this),
+                          "in-process-browser-or-app-frame-shown", nullptr);
+    }
 
-  if (OwnerIsBrowserOrAppFrame() && mMessageManager) {
-    mMessageManager->LoadFrameScript(
-      NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js"),
-      /* allowDelayedLoad = */ true);
+    if (mMessageManager) {
+      mMessageManager->LoadFrameScript(
+        NS_LITERAL_STRING("chrome://global/content/BrowserElementChild.js"),
+        /* allowDelayedLoad = */ true);
+    }
   }
 
   return NS_OK;
diff --git a/dom/browser-element/BrowserElementParent.js b/dom/browser-element/BrowserElementParent.js
index b4741d477e0a..9bd9dd4280a3 100644
--- a/dom/browser-element/BrowserElementParent.js
+++ b/dom/browser-element/BrowserElementParent.js
@@ -65,8 +65,8 @@ BrowserElementParentFactory.prototype = {
     // alive for as long as its frame element lives.
     this._bepMap = new WeakMap();
 
-    Services.obs.addObserver(this, 'remote-browser-shown', /* ownsWeak = */ true);
-    Services.obs.addObserver(this, 'inprocess-browser-shown', /* ownsWeak = */ true);
+    Services.obs.addObserver(this, 'remote-browser-frame-shown', /* ownsWeak = */ true);
+    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', /* ownsWeak = */ true);
   },
 
   _browserFramesPrefEnabled: function() {
@@ -79,19 +79,11 @@ BrowserElementParentFactory.prototype = {
   },
 
   _observeInProcessBrowserFrameShown: function(frameLoader) {
-    // Ignore notifications that aren't from a BrowserOrApp
-    if (!frameLoader.QueryInterface(Ci.nsIFrameLoader).ownerIsBrowserOrAppFrame) {
-      return;
-    }
     debug("In-process browser frame shown " + frameLoader);
     this._createBrowserElementParent(frameLoader, /* hasRemoteFrame = */ false);
   },
 
   _observeRemoteBrowserFrameShown: function(frameLoader) {
-    // Ignore notifications that aren't from a BrowserOrApp
-    if (!frameLoader.QueryInterface(Ci.nsIFrameLoader).ownerIsBrowserOrAppFrame) {
-      return;
-    }
     debug("Remote browser frame shown " + frameLoader);
     this._createBrowserElementParent(frameLoader, /* hasRemoteFrame = */ true);
   },
@@ -111,10 +103,10 @@ BrowserElementParentFactory.prototype = {
         this._init();
       }
       break;
-    case 'remote-browser-shown':
+    case 'remote-browser-frame-shown':
       this._observeRemoteBrowserFrameShown(subject);
       break;
-    case 'inprocess-browser-shown':
+    case 'in-process-browser-or-app-frame-shown':
       this._observeInProcessBrowserFrameShown(subject);
       break;
     case 'content-document-global-created':
diff --git a/dom/inputmethod/Keyboard.jsm b/dom/inputmethod/Keyboard.jsm
index 94456ff8d510..14b56041be66 100644
--- a/dom/inputmethod/Keyboard.jsm
+++ b/dom/inputmethod/Keyboard.jsm
@@ -44,8 +44,8 @@ this.Keyboard = {
   },
 
   init: function keyboardInit() {
-    Services.obs.addObserver(this, 'inprocess-browser-shown', false);
-    Services.obs.addObserver(this, 'remote-browser-shown', false);
+    Services.obs.addObserver(this, 'in-process-browser-or-app-frame-shown', false);
+    Services.obs.addObserver(this, 'remote-browser-frame-shown', false);
     Services.obs.addObserver(this, 'oop-frameloader-crashed', false);
 
     for (let name of this._messageNames)
@@ -63,10 +63,6 @@ this.Keyboard = {
         ppmm.broadcastAsyncMessage('Keyboard:FocusChange', { 'type': 'blur' });
       }
     } else {
-      // Ignore notifications that aren't from a BrowserOrApp
-      if (!frameLoader.ownerIsBrowserOrAppFrame) {
-        return;
-      }
       this.initFormsFrameScript(mm);
     }
   },
diff --git a/dom/ipc/ProcessPriorityManager.cpp b/dom/ipc/ProcessPriorityManager.cpp
index b9c34d7801cc..d6bb96cd352c 100644
--- a/dom/ipc/ProcessPriorityManager.cpp
+++ b/dom/ipc/ProcessPriorityManager.cpp
@@ -602,7 +602,7 @@ ParticularProcessPriorityManager::Init()
   nsCOMPtr<nsIObserverService> os = services::GetObserverService();
   if (os) {
     os->AddObserver(this, "audio-channel-process-changed", /* ownsWeak */ true);
-    os->AddObserver(this, "remote-browser-shown", /* ownsWeak */ true);
+    os->AddObserver(this, "remote-browser-frame-shown", /* ownsWeak */ true);
     os->AddObserver(this, "ipc:browser-destroyed", /* ownsWeak */ true);
     os->AddObserver(this, "frameloader-visible-changed", /* ownsWeak */ true);
   }
@@ -674,7 +674,7 @@ ParticularProcessPriorityManager::Observe(nsISupports* aSubject,
 
   if (topic.EqualsLiteral("audio-channel-process-changed")) {
     OnAudioChannelProcessChanged(aSubject);
-  } else if (topic.EqualsLiteral("remote-browser-shown")) {
+  } else if (topic.EqualsLiteral("remote-browser-frame-shown")) {
     OnRemoteBrowserFrameShown(aSubject);
   } else if (topic.EqualsLiteral("ipc:browser-destroyed")) {
     OnTabParentDestroyed(aSubject);
@@ -747,13 +747,6 @@ ParticularProcessPriorityManager::OnRemoteBrowserFrameShown(nsISupports* aSubjec
   nsCOMPtr<nsIFrameLoader> fl = do_QueryInterface(aSubject);
   NS_ENSURE_TRUE_VOID(fl);
 
-  // Ignore notifications that aren't from a BrowserOrApp
-  bool isBrowserOrApp;
-  fl->GetOwnerIsBrowserOrAppFrame(&isBrowserOrApp);
-  if (!isBrowserOrApp) {
-    return;
-  }
-
   nsCOMPtr<nsITabParent> tp;
   fl->GetTabParent(getter_AddRefs(tp));
   NS_ENSURE_TRUE_VOID(tp);

From 4842c69eb15cd11231b63ffd0fa7697f28945fb2 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Sun, 15 Dec 2013 19:46:34 +0100
Subject: [PATCH 423/459] Bug 947587 - fix non-ion builds r=bhackett

---
 js/src/jsapi.cpp   |  2 +-
 js/src/jsinfer.cpp | 12 ++++++++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 8073ec4f366e..dbed14c1b291 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4249,7 +4249,7 @@ struct AutoLastFrameCheck
 # define fast_getc getc
 #endif
 
-typedef Vector<char, 8, TempAllocPolicy> FileContents;
+typedef js::Vector<char, 8, TempAllocPolicy> FileContents;
 
 static bool
 ReadCompleteFile(JSContext *cx, FILE *fp, FileContents &buffer)
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 62a11ca76e3b..7fe019b6902e 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -574,10 +574,10 @@ class types::CompilerConstraintList
     // OOM during generation of some constraint.
     bool failed_;
 
+#ifdef JS_ION
     // Allocator used for constraints.
     LifoAlloc *alloc_;
 
-#ifdef JS_ION
     // Constraints generated on heap properties.
     Vector<CompilerConstraint *, 0, jit::IonAllocPolicy> constraints;
 
@@ -588,8 +588,8 @@ class types::CompilerConstraintList
   public:
     CompilerConstraintList(jit::TempAllocator &alloc)
       : failed_(false)
-      , alloc_(alloc.lifoAlloc())
 #ifdef JS_ION
+      , alloc_(alloc.lifoAlloc())
       , constraints(alloc)
       , frozenScripts(alloc)
 #endif
@@ -661,14 +661,22 @@ class types::CompilerConstraintList
         failed_ = true;
     }
     LifoAlloc *alloc() const {
+#ifdef JS_ION
         return alloc_;
+#else
+        MOZ_CRASH();
+#endif
     }
 };
 
 CompilerConstraintList *
 types::NewCompilerConstraintList(jit::TempAllocator &alloc)
 {
+#ifdef JS_ION
     return alloc.lifoAlloc()->new_<CompilerConstraintList>(alloc);
+#else
+    MOZ_CRASH();
+#endif
 }
 
 /* static */ bool

From 9f0759f40eb8b599665a9a6946ff4e2819fcb27b Mon Sep 17 00:00:00 2001
From: Steven MacLeod <smacleod@mozilla.com>
Date: Sun, 15 Dec 2013 14:05:53 -0500
Subject: [PATCH 424/459] Bug 546169 - Use an event listener instead of a
 timeout to avoid intermittent failures. r=gavin

---
 browser/components/safebrowsing/content/test/browser.ini    | 6 +++---
 .../safebrowsing/content/test/browser_bug415846.js          | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/browser/components/safebrowsing/content/test/browser.ini b/browser/components/safebrowsing/content/test/browser.ini
index f84f08496ec5..b20c45360d97 100644
--- a/browser/components/safebrowsing/content/test/browser.ini
+++ b/browser/components/safebrowsing/content/test/browser.ini
@@ -2,7 +2,7 @@
 support-files = head.js
 
 [browser_bug400731.js]
-# [browser_bug415846.js]
-# Disabled for too many intermittent failures (bug 546169)
-# Previously disabled on Mac because of its bizarre special-and-unique
+[browser_bug415846.js]
+skip-if = os == "mac"
+# Disabled on Mac because of its bizarre special-and-unique
 # snowflake of a help menu.
diff --git a/browser/components/safebrowsing/content/test/browser_bug415846.js b/browser/components/safebrowsing/content/test/browser_bug415846.js
index 1f75bd1a9fce..079283c8e6b2 100644
--- a/browser/components/safebrowsing/content/test/browser_bug415846.js
+++ b/browser/components/safebrowsing/content/test/browser_bug415846.js
@@ -37,11 +37,13 @@ function testNormal_PopupListener() {
   
   // Now launch the phishing test.  Can't use onload here because error pages don't
   // fire normal load events.
+  window.addEventListener("DOMContentLoaded", testPhishing, true);
   content.location = "http://www.mozilla.org/firefox/its-a-trap.html";
-  setTimeout(testPhishing, 2000);
 }
 
 function testPhishing() {
+  window.removeEventListener("DOMContentLoaded", testPhishing, true);
+
   menu.addEventListener("popupshown", testPhishing_PopupListener, false);
   menu.openPopup(null, "", 0, 0, false, null);
 }

From 69c8b117ce0c9b01acc0b7c72c3cc0392cc63c54 Mon Sep 17 00:00:00 2001
From: Alessandro Decina <alessandro.d@gmail.com>
Date: Sun, 15 Dec 2013 14:06:14 -0500
Subject: [PATCH 425/459] Bug 928806 - Allow SharedPlanarYCbCrImage images to
 optionally have padding. r=nical

Overload YCbCrImageDataSerializer.InitializeBufferInfo to take explicit plane
offsets. Make SharedPlanarYCbCrImage::SetDataNoCopy set the offsets based on the
Y, Cb and Cr plane pointers passed by the caller.
---
 gfx/layers/YCbCrImageDataSerializer.cpp   | 26 +++++++++++++++++------
 gfx/layers/YCbCrImageDataSerializer.h     |  6 ++++++
 gfx/layers/ipc/SharedPlanarYCbCrImage.cpp | 15 ++++++++++++-
 3 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/gfx/layers/YCbCrImageDataSerializer.cpp b/gfx/layers/YCbCrImageDataSerializer.cpp
index ed171224f016..46a36290385f 100644
--- a/gfx/layers/YCbCrImageDataSerializer.cpp
+++ b/gfx/layers/YCbCrImageDataSerializer.cpp
@@ -153,17 +153,18 @@ YCbCrImageDataSerializer::ComputeMinBufferSize(uint32_t aSize)
 }
 
 void
-YCbCrImageDataSerializer::InitializeBufferInfo(const gfx::IntSize& aYSize,
+YCbCrImageDataSerializer::InitializeBufferInfo(uint32_t aYOffset,
+                                               uint32_t aCbOffset,
+                                               uint32_t aCrOffset,
+                                               const gfx::IntSize& aYSize,
                                                const gfx::IntSize& aCbCrSize,
                                                StereoMode aStereoMode)
 {
   YCbCrBufferInfo* info = GetYCbCrBufferInfo(mData);
-  info->mYOffset = MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
-  info->mCbOffset = info->mYOffset
-                  + MOZ_ALIGN_WORD(aYSize.width * aYSize.height);
-  info->mCrOffset = info->mCbOffset
-                  + MOZ_ALIGN_WORD(aCbCrSize.width * aCbCrSize.height);
-
+  uint32_t info_size = MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
+  info->mYOffset = info_size + aYOffset;
+  info->mCbOffset = info_size + aCbOffset;
+  info->mCrOffset = info_size + aCrOffset;
   info->mYWidth = aYSize.width;
   info->mYHeight = aYSize.height;
   info->mCbCrWidth = aCbCrSize.width;
@@ -171,6 +172,17 @@ YCbCrImageDataSerializer::InitializeBufferInfo(const gfx::IntSize& aYSize,
   info->mStereoMode = aStereoMode;
 }
 
+void
+YCbCrImageDataSerializer::InitializeBufferInfo(const gfx::IntSize& aYSize,
+                                               const gfx::IntSize& aCbCrSize,
+                                               StereoMode aStereoMode)
+{
+  uint32_t yOffset = MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
+  uint32_t cbOffset = yOffset + MOZ_ALIGN_WORD(aYSize.width * aYSize.height);
+  uint32_t crOffset = cbOffset + MOZ_ALIGN_WORD(aCbCrSize.width * aCbCrSize.height);
+  return InitializeBufferInfo(yOffset, cbOffset, crOffset, aYSize, aCbCrSize, aStereoMode);
+}
+
 void
 YCbCrImageDataSerializer::InitializeBufferInfo(const gfxIntSize& aYSize,
                                                const gfxIntSize& aCbCrSize,
diff --git a/gfx/layers/YCbCrImageDataSerializer.h b/gfx/layers/YCbCrImageDataSerializer.h
index 1ec52ed00ee7..e6b14cdeebf6 100644
--- a/gfx/layers/YCbCrImageDataSerializer.h
+++ b/gfx/layers/YCbCrImageDataSerializer.h
@@ -114,6 +114,12 @@ public:
    * The provided pointer should point to the beginning of the (chunk of)
    * buffer on which we want to store the image.
    */
+  void InitializeBufferInfo(uint32_t aYOffset,
+                            uint32_t aCbOffset,
+                            uint32_t aCrOffset,
+                            const gfx::IntSize& aYSize,
+                            const gfx::IntSize& aCbCrSize,
+                            StereoMode aStereoMode);
   void InitializeBufferInfo(const gfx::IntSize& aYSize,
                             const gfx::IntSize& aCbCrSize,
                             StereoMode aStereoMode);
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index f90226221072..a4b7ebe1c5e6 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -143,8 +143,21 @@ SharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 {
   mData = aData;
   mSize = aData.mPicSize;
+  /* SetDataNoCopy is used to update YUV plane offsets without (re)allocating
+   * memory previously allocated with AllocateAndGetNewBuffer().
+   * serializer.GetData() returns the address of the memory previously allocated
+   * with AllocateAndGetNewBuffer(), that we subtract from the Y, Cb, Cr
+   * channels to compute 0-based offsets to pass to InitializeBufferInfo.
+   */
   YCbCrImageDataSerializer serializer(mTextureClient->GetBuffer());
-  serializer.InitializeBufferInfo(aData.mYSize,
+  uint8_t *base = serializer.GetData();
+  uint32_t yOffset = aData.mYChannel - base;
+  uint32_t cbOffset = aData.mCbChannel - base;
+  uint32_t crOffset = aData.mCrChannel - base;
+  serializer.InitializeBufferInfo(yOffset,
+                                  cbOffset,
+                                  crOffset,
+                                  aData.mYSize,
                                   aData.mCbCrSize,
                                   aData.mStereoMode);
 }

From 8f24e879275a0095cb314e04f74f4be5857f23e7 Mon Sep 17 00:00:00 2001
From: Corey Ford <corey@coreyford.name>
Date: Sat, 14 Dec 2013 20:00:23 -0800
Subject: [PATCH 426/459] Bug 950418 - Enable sticky pref for
 sticky-legend-1.html reftest. r=dholbert

---
 layout/reftests/forms/fieldset/reftest.list | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/layout/reftests/forms/fieldset/reftest.list b/layout/reftests/forms/fieldset/reftest.list
index 7ca5207e247e..da8e4f81c0e5 100644
--- a/layout/reftests/forms/fieldset/reftest.list
+++ b/layout/reftests/forms/fieldset/reftest.list
@@ -8,4 +8,4 @@ random-if(B2G) == fieldset-overflow-auto-1.html fieldset-overflow-auto-1-ref.htm
 == positioned-container-1.html positioned-container-1-ref.html
 == relpos-legend-1.html relpos-legend-1-ref.html
 == relpos-legend-2.html relpos-legend-2-ref.html
-== sticky-legend-1.html sticky-legend-1-ref.html
+test-pref(layout.css.sticky.enabled,true) == sticky-legend-1.html sticky-legend-1-ref.html

From a2b953dbcb499a68fd6c3029272a7db1ab5a4f64 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sun, 15 Dec 2013 11:45:24 -0800
Subject: [PATCH 427/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/f88be8e2bdfe
Author: Etienne Segonzac <etienne@segonzac.info>
Desc: Merge pull request #14660 from etiennesegonzac/bug-949487-window-manager-insta-kill

Bug 949487 -  Harden the AppWindowManager against apps that gets insta-killed r=alive

========

https://hg.mozilla.org/integration/gaia-central/rev/cabdfa599bb7
Author: Etienne Segonzac <etienne@segonzac.info>
Desc: Bug 949487 -  Harden the AppWindowManager against app that gets
insta-killed
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index bf77336385d2..ce46db44bbc3 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "de7d1d59e9424ae0952f773c46dad879e5cdc2ae", 
+    "revision": "f88be8e2bdfecbd76666fd486bd54fd7276f99c1", 
     "repo_path": "/integration/gaia-central"
 }

From 4c7bd8bdf9744d8b55ca25b6d248d1b7bf46cc33 Mon Sep 17 00:00:00 2001
From: Steve Singer <steve@ssinger.info>
Date: Sun, 15 Dec 2013 22:40:20 +0100
Subject: [PATCH 428/459] Bug 950343 - Include GLContext headers on non-SKIA
 builds. r=vlad

---
 content/canvas/src/CanvasRenderingContext2D.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index 74b9992e4b39..393cedeceabb 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -91,18 +91,18 @@
 #include "mozilla/dom/TextMetrics.h"
 #include "mozilla/dom/UnionTypes.h"
 #include "nsGlobalWindow.h"
+#include "GLContext.h"
+#include "GLContextProvider.h"
 
 #ifdef USE_SKIA_GPU
 #undef free // apparently defined by some windows header, clashing with a free()
             // method in SkTypes.h
-#include "GLContext.h"
-#include "GLContextProvider.h"
 #include "GLContextSkia.h"
 #include "SurfaceTypes.h"
 #include "nsIGfxInfo.h"
+#endif
 using mozilla::gl::GLContext;
 using mozilla::gl::GLContextProvider;
-#endif
 
 #ifdef XP_WIN
 #include "gfxWindowsPlatform.h"

From 736ea6d8cfc98ac8c9fdd340aa652d7aa1300c78 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Sun, 15 Dec 2013 13:47:11 -0800
Subject: [PATCH 429/459] Bug 948621 (part 1) - DMD: Handle arbitrary PC values
 in stack frames.  r=iacobcatalin. DONTBUILD because NPOTB

--HG--
extra : rebase_source : 63a30251498dc5e5df2952a468f46ada8598e03e
---
 memory/replace/dmd/DMD.cpp | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/memory/replace/dmd/DMD.cpp b/memory/replace/dmd/DMD.cpp
index fb53c453b5af..3c9c8db74a8e 100644
--- a/memory/replace/dmd/DMD.cpp
+++ b/memory/replace/dmd/DMD.cpp
@@ -600,18 +600,17 @@ class LocationService
 
   struct Entry
   {
-    static const void* const kUnused;
-
-    const void* mPc;        // if mPc==kUnused, the entry is unused
+    const void* mPc;
     char*       mFunction;  // owned by the Entry;  may be null
     const char* mLibrary;   // owned by mLibraryStrings;  never null
                             //   in a non-empty entry is in use
     ptrdiff_t   mLOffset;
     char*       mFileName;  // owned by the Entry; may be null
-    unsigned long mLineNo;
+    uint32_t    mLineNo:31;
+    uint32_t    mInUse:1;   // is the entry used?
 
     Entry()
-      : mPc(kUnused), mFunction(nullptr), mLibrary(nullptr), mLOffset(0), mFileName(nullptr), mLineNo(0)
+      : mPc(0), mFunction(nullptr), mLibrary(nullptr), mLOffset(0), mFileName(nullptr), mLineNo(0), mInUse(0)
     {}
 
     ~Entry()
@@ -639,6 +638,8 @@ class LocationService
       mLibrary = aLibrary;
       mLOffset = aLOffset;
       mLineNo = aLineNo;
+
+      mInUse = 1;
     }
 
     size_t SizeOfExcludingThis() {
@@ -675,8 +676,7 @@ public:
     MOZ_ASSERT(index < kNumEntries);
     Entry& entry = mEntries[index];
 
-    MOZ_ASSERT(aPc != Entry::kUnused);
-    if (entry.mPc != aPc) {
+    if (!entry.mInUse || entry.mPc != aPc) {
       mNumCacheMisses++;
 
       // NS_DescribeCodeAddress can (on Linux) acquire a lock inside
@@ -753,7 +753,7 @@ public:
   {
     size_t n = 0;
     for (size_t i = 0; i < kNumEntries; i++) {
-      if (mEntries[i].mPc != Entry::kUnused) {
+      if (mEntries[i].mInUse) {
         n++;
       }
     }
@@ -764,10 +764,6 @@ public:
   size_t NumCacheMisses() const { return mNumCacheMisses; }
 };
 
-// We can't use 0 because that sometimes shows up as a PC in stack traces.
-const void* const LocationService::Entry::kUnused =
-  reinterpret_cast<const void* const>(intptr_t(-1));
-
 //---------------------------------------------------------------------------
 // Stack traces
 //---------------------------------------------------------------------------

From 6b9163f5605bc0eb5e0262dc0f99b799162e6992 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Sun, 15 Dec 2013 13:50:39 -0800
Subject: [PATCH 430/459] Bug 948621 (part 2) - Abort DMD-enabled Windows
 builds unless --enable-profiling is specified.  r=ehsan.

--HG--
extra : rebase_source : 7398d8d7f13792912f27948f9681ff608a0e90c6
---
 memory/replace/dmd/DMD.cpp   | 3 +++
 memory/replace/dmd/moz.build | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/memory/replace/dmd/DMD.cpp b/memory/replace/dmd/DMD.cpp
index 3c9c8db74a8e..ee025e11cc7d 100644
--- a/memory/replace/dmd/DMD.cpp
+++ b/memory/replace/dmd/DMD.cpp
@@ -15,6 +15,9 @@
 #include <string.h>
 
 #ifdef XP_WIN
+#if defined(MOZ_OPTIMIZE) && !defined(MOZ_PROFILING)
+#error "Optimized, DMD-enabled builds on Windows must be built with --enable-profiling"
+#endif
 #include <windows.h>
 #include <process.h>
 #else
diff --git a/memory/replace/dmd/moz.build b/memory/replace/dmd/moz.build
index 26876696b7df..8c08f84d4983 100644
--- a/memory/replace/dmd/moz.build
+++ b/memory/replace/dmd/moz.build
@@ -23,3 +23,6 @@ LIBRARY_NAME = 'dmd'
 FORCE_SHARED_LIB = True
 
 DEFINES['MOZ_NO_MOZALLOC'] = True
+
+if CONFIG['MOZ_OPTIMIZE']:
+    DEFINES['MOZ_OPTIMIZE'] = True

From 1dfe73b53642a925649c63d0b86e27baea7d463e Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sun, 15 Dec 2013 13:58:28 -0800
Subject: [PATCH 431/459] Back out e9ca04f323d0 (bug 928806) on suspicion of
 causing ASan and Linux debug gtest crashes CLOSED TREE

---
 gfx/layers/YCbCrImageDataSerializer.cpp   | 26 ++++++-----------------
 gfx/layers/YCbCrImageDataSerializer.h     |  6 ------
 gfx/layers/ipc/SharedPlanarYCbCrImage.cpp | 15 +------------
 3 files changed, 8 insertions(+), 39 deletions(-)

diff --git a/gfx/layers/YCbCrImageDataSerializer.cpp b/gfx/layers/YCbCrImageDataSerializer.cpp
index 46a36290385f..ed171224f016 100644
--- a/gfx/layers/YCbCrImageDataSerializer.cpp
+++ b/gfx/layers/YCbCrImageDataSerializer.cpp
@@ -153,18 +153,17 @@ YCbCrImageDataSerializer::ComputeMinBufferSize(uint32_t aSize)
 }
 
 void
-YCbCrImageDataSerializer::InitializeBufferInfo(uint32_t aYOffset,
-                                               uint32_t aCbOffset,
-                                               uint32_t aCrOffset,
-                                               const gfx::IntSize& aYSize,
+YCbCrImageDataSerializer::InitializeBufferInfo(const gfx::IntSize& aYSize,
                                                const gfx::IntSize& aCbCrSize,
                                                StereoMode aStereoMode)
 {
   YCbCrBufferInfo* info = GetYCbCrBufferInfo(mData);
-  uint32_t info_size = MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
-  info->mYOffset = info_size + aYOffset;
-  info->mCbOffset = info_size + aCbOffset;
-  info->mCrOffset = info_size + aCrOffset;
+  info->mYOffset = MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
+  info->mCbOffset = info->mYOffset
+                  + MOZ_ALIGN_WORD(aYSize.width * aYSize.height);
+  info->mCrOffset = info->mCbOffset
+                  + MOZ_ALIGN_WORD(aCbCrSize.width * aCbCrSize.height);
+
   info->mYWidth = aYSize.width;
   info->mYHeight = aYSize.height;
   info->mCbCrWidth = aCbCrSize.width;
@@ -172,17 +171,6 @@ YCbCrImageDataSerializer::InitializeBufferInfo(uint32_t aYOffset,
   info->mStereoMode = aStereoMode;
 }
 
-void
-YCbCrImageDataSerializer::InitializeBufferInfo(const gfx::IntSize& aYSize,
-                                               const gfx::IntSize& aCbCrSize,
-                                               StereoMode aStereoMode)
-{
-  uint32_t yOffset = MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
-  uint32_t cbOffset = yOffset + MOZ_ALIGN_WORD(aYSize.width * aYSize.height);
-  uint32_t crOffset = cbOffset + MOZ_ALIGN_WORD(aCbCrSize.width * aCbCrSize.height);
-  return InitializeBufferInfo(yOffset, cbOffset, crOffset, aYSize, aCbCrSize, aStereoMode);
-}
-
 void
 YCbCrImageDataSerializer::InitializeBufferInfo(const gfxIntSize& aYSize,
                                                const gfxIntSize& aCbCrSize,
diff --git a/gfx/layers/YCbCrImageDataSerializer.h b/gfx/layers/YCbCrImageDataSerializer.h
index e6b14cdeebf6..1ec52ed00ee7 100644
--- a/gfx/layers/YCbCrImageDataSerializer.h
+++ b/gfx/layers/YCbCrImageDataSerializer.h
@@ -114,12 +114,6 @@ public:
    * The provided pointer should point to the beginning of the (chunk of)
    * buffer on which we want to store the image.
    */
-  void InitializeBufferInfo(uint32_t aYOffset,
-                            uint32_t aCbOffset,
-                            uint32_t aCrOffset,
-                            const gfx::IntSize& aYSize,
-                            const gfx::IntSize& aCbCrSize,
-                            StereoMode aStereoMode);
   void InitializeBufferInfo(const gfx::IntSize& aYSize,
                             const gfx::IntSize& aCbCrSize,
                             StereoMode aStereoMode);
diff --git a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
index a4b7ebe1c5e6..f90226221072 100644
--- a/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
+++ b/gfx/layers/ipc/SharedPlanarYCbCrImage.cpp
@@ -143,21 +143,8 @@ SharedPlanarYCbCrImage::SetDataNoCopy(const Data &aData)
 {
   mData = aData;
   mSize = aData.mPicSize;
-  /* SetDataNoCopy is used to update YUV plane offsets without (re)allocating
-   * memory previously allocated with AllocateAndGetNewBuffer().
-   * serializer.GetData() returns the address of the memory previously allocated
-   * with AllocateAndGetNewBuffer(), that we subtract from the Y, Cb, Cr
-   * channels to compute 0-based offsets to pass to InitializeBufferInfo.
-   */
   YCbCrImageDataSerializer serializer(mTextureClient->GetBuffer());
-  uint8_t *base = serializer.GetData();
-  uint32_t yOffset = aData.mYChannel - base;
-  uint32_t cbOffset = aData.mCbChannel - base;
-  uint32_t crOffset = aData.mCrChannel - base;
-  serializer.InitializeBufferInfo(yOffset,
-                                  cbOffset,
-                                  crOffset,
-                                  aData.mYSize,
+  serializer.InitializeBufferInfo(aData.mYSize,
                                   aData.mCbCrSize,
                                   aData.mStereoMode);
 }

From 474287201a438551660767952a965a41ed8d9972 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Sun, 15 Dec 2013 19:00:54 -0500
Subject: [PATCH 432/459] Bug 950505 - Build content/media/wmf in unified mode;
 r=roc

---
 content/media/wmf/WMFUtils.h | 5 +++++
 content/media/wmf/moz.build  | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/content/media/wmf/WMFUtils.h b/content/media/wmf/WMFUtils.h
index 0e39f9aabe82..89cdfb92d339 100644
--- a/content/media/wmf/WMFUtils.h
+++ b/content/media/wmf/WMFUtils.h
@@ -4,6 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef WMFUtils_h
+#define WMFUtils_h
+
 #include "WMF.h"
 #include "nsString.h"
 #include "nsRect.h"
@@ -99,3 +102,5 @@ IsFlagSet(DWORD flags, DWORD pattern) {
 }
 
 } // namespace mozilla
+
+#endif
diff --git a/content/media/wmf/moz.build b/content/media/wmf/moz.build
index 48baf30f9cbb..ebdc76d0cccf 100644
--- a/content/media/wmf/moz.build
+++ b/content/media/wmf/moz.build
@@ -12,7 +12,7 @@ EXPORTS += [
     'WMFUtils.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'DXVA2Manager.cpp',
     'WMFByteStream.cpp',
     'WMFDecoder.cpp',

From 6b77470726fa1784cc5fd2880b74f028171aea25 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Sun, 15 Dec 2013 19:00:54 -0500
Subject: [PATCH 433/459] Bug 950506 - Build content/media/directshow in
 unified mode; r=roc

---
 content/media/MP3FrameParser.h     | 5 +++++
 content/media/directshow/moz.build | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/content/media/MP3FrameParser.h b/content/media/MP3FrameParser.h
index e50a6bcc96b3..ff68c256b86a 100644
--- a/content/media/MP3FrameParser.h
+++ b/content/media/MP3FrameParser.h
@@ -4,6 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef MP3FrameParser_h
+#define MP3FrameParser_h
+
 #include <stdint.h>
 
 #include "mozilla/Mutex.h"
@@ -205,3 +208,5 @@ private:
 };
 
 }
+
+#endif
diff --git a/content/media/directshow/moz.build b/content/media/directshow/moz.build
index 6f958231b718..5119f58f7db7 100644
--- a/content/media/directshow/moz.build
+++ b/content/media/directshow/moz.build
@@ -12,7 +12,7 @@ EXPORTS += [
     'DirectShowUtils.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'AudioSinkFilter.cpp',
     'AudioSinkInputPin.cpp',
     'DirectShowDecoder.cpp',

From 4b71daabb061d07ed05221ea84547d80a4cd21ea Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Sun, 15 Dec 2013 19:00:54 -0500
Subject: [PATCH 434/459] Bug 950507 - Build content/media/fmp4 in unified
 mode; r=roc

---
 content/media/fmp4/moz.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/media/fmp4/moz.build b/content/media/fmp4/moz.build
index fc63df6aef82..d83fd7d3f52b 100644
--- a/content/media/fmp4/moz.build
+++ b/content/media/fmp4/moz.build
@@ -30,7 +30,7 @@ EXPORTS.mp4_demuxer += [
     'demuxer/video_util.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'BlankDecoderModule.cpp',
     'demuxer/aac.cc',
     'demuxer/audio_decoder_config.cc',
@@ -58,7 +58,7 @@ if CONFIG['MOZ_WMF']:
       'wmf/WMFDecoderModule.h',
       'wmf/WMFVideoDecoder.h',
   ]
-  SOURCES += [
+  UNIFIED_SOURCES += [
       'wmf/MFTDecoder.cpp',
       'wmf/WMFAudioDecoder.cpp',
       'wmf/WMFDecoderModule.cpp',

From a8a1493f29755417154a24dbe5235f984cbb2a15 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Sun, 15 Dec 2013 19:00:54 -0500
Subject: [PATCH 435/459] Bug 950508 - Build widget/windows in unified mode;
 r=roc

---
 widget/windows/JumpListBuilder.h      |  1 +
 widget/windows/JumpListItem.h         |  1 +
 widget/windows/TaskbarPreview.h       |  1 +
 widget/windows/TaskbarPreviewButton.h |  1 +
 widget/windows/WinTaskbar.h           |  1 +
 widget/windows/moz.build              | 26 +++++++++++++++++---------
 widget/windows/nsFilePicker.h         |  1 +
 widget/windows/nsImageClipboard.h     |  5 +++++
 widget/windows/nsNativeDragSource.cpp |  4 ++--
 widget/windows/nsNativeDragTarget.cpp |  5 ++---
 widget/windows/nsNativeDragTarget.h   |  1 +
 widget/windows/nsNativeThemeWin.h     |  5 +++++
 widget/windows/nsUXThemeConstants.h   |  5 +++++
 13 files changed, 43 insertions(+), 14 deletions(-)

diff --git a/widget/windows/JumpListBuilder.h b/widget/windows/JumpListBuilder.h
index 2c32fb656492..c28de6d95226 100644
--- a/widget/windows/JumpListBuilder.h
+++ b/widget/windows/JumpListBuilder.h
@@ -12,6 +12,7 @@
 #define NTDDI_VERSION NTDDI_WIN7
 // Needed for various com interfaces
 #include <shobjidl.h>
+#undef LogSeverity // SetupAPI.h #defines this as DWORD
 
 #include "nsString.h"
 #include "nsIMutableArray.h"
diff --git a/widget/windows/JumpListItem.h b/widget/windows/JumpListItem.h
index 59f6715297bf..1529ad5a448e 100644
--- a/widget/windows/JumpListItem.h
+++ b/widget/windows/JumpListItem.h
@@ -8,6 +8,7 @@
 
 #include <windows.h>
 #include <shobjidl.h>
+#undef LogSeverity // SetupAPI.h #defines this as DWORD
 
 #include "nsIJumpListItem.h"  // defines nsIJumpListItem
 #include "nsIMIMEInfo.h" // defines nsILocalHandlerApp
diff --git a/widget/windows/TaskbarPreview.h b/widget/windows/TaskbarPreview.h
index 6450972f752b..9fe5aa53761e 100644
--- a/widget/windows/TaskbarPreview.h
+++ b/widget/windows/TaskbarPreview.h
@@ -10,6 +10,7 @@
 
 #include <windows.h>
 #include <shobjidl.h>
+#undef LogSeverity // SetupAPI.h #defines this as DWORD
 
 #include <nsITaskbarPreview.h>
 #include <nsAutoPtr.h>
diff --git a/widget/windows/TaskbarPreviewButton.h b/widget/windows/TaskbarPreviewButton.h
index cd4c53ed82ae..2dcd33c5e50f 100644
--- a/widget/windows/TaskbarPreviewButton.h
+++ b/widget/windows/TaskbarPreviewButton.h
@@ -10,6 +10,7 @@
 
 #include <windows.h>
 #include <shobjidl.h>
+#undef LogSeverity // SetupAPI.h #defines this as DWORD
 
 #include <nsITaskbarPreviewButton.h>
 #include <nsAutoPtr.h>
diff --git a/widget/windows/WinTaskbar.h b/widget/windows/WinTaskbar.h
index c0925247f542..4eaec876f7c7 100644
--- a/widget/windows/WinTaskbar.h
+++ b/widget/windows/WinTaskbar.h
@@ -10,6 +10,7 @@
 
 #include <windows.h>
 #include <shobjidl.h>
+#undef LogSeverity // SetupAPI.h #defines this as DWORD
 #include "nsIWinTaskbar.h"
 #include "mozilla/Attributes.h"
 
diff --git a/widget/windows/moz.build b/widget/windows/moz.build
index 5d1faeb04e40..566506e0a21d 100644
--- a/widget/windows/moz.build
+++ b/widget/windows/moz.build
@@ -19,24 +19,20 @@ EXPORTS.mozilla.widget += [
     'AudioSession.h',
 ]
 
-SOURCES += [
+UNIFIED_SOURCES += [
     'AudioSession.cpp',
     'GfxInfo.cpp',
     'IEnumFE.cpp',
-    'JumpListBuilder.cpp',
     'JumpListItem.cpp',
     'KeyboardLayout.cpp',
     'nsAppShell.cpp',
-    'nsBidiKeyboard.cpp',
     'nsClipboard.cpp',
     'nsColorPicker.cpp',
     'nsDataObj.cpp',
     'nsDataObjCollection.cpp',
     'nsDragService.cpp',
-    'nsFilePicker.cpp',
     'nsIdleServiceWin.cpp',
     'nsImageClipboard.cpp',
-    'nsIMM32Handler.cpp',
     'nsLookAndFeel.cpp',
     'nsNativeDragSource.cpp',
     'nsNativeDragTarget.cpp',
@@ -46,7 +42,6 @@ SOURCES += [
     'nsSound.cpp',
     'nsToolkit.cpp',
     'nsUXThemeData.cpp',
-    'nsWidgetFactory.cpp',
     'nsWindow.cpp',
     'nsWindowBase.cpp',
     'nsWindowDbg.cpp',
@@ -59,18 +54,31 @@ SOURCES += [
     'WidgetTraceEvent.cpp',
     'WindowHook.cpp',
     'WinIMEHandler.cpp',
-    'WinMouseScrollHandler.cpp',
     'WinTaskbar.cpp',
+]
+
+# The following files cannot be built in unified mode because they force NSPR logging.
+SOURCES += [
+    'nsIMM32Handler.cpp',
+    'WinMouseScrollHandler.cpp',
     'WinUtils.cpp',
 ]
 
+# The following files cannot be built in unified mode because of name clashes.
+SOURCES += [
+    'JumpListBuilder.cpp',
+    'nsBidiKeyboard.cpp',
+    'nsFilePicker.cpp',
+    'nsWidgetFactory.cpp',
+]
+
 if CONFIG['MOZ_CRASHREPORTER']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'LSPAnnotator.cpp',
     ]
 
 if CONFIG['NS_PRINTING']:
-    SOURCES += [
+    UNIFIED_SOURCES += [
         'nsDeviceContextSpecWin.cpp',
         'nsPrintOptionsWin.cpp',
         'nsPrintSettingsWin.cpp',
diff --git a/widget/windows/nsFilePicker.h b/widget/windows/nsFilePicker.h
index e6dc23aa44c6..ac7212ec3da6 100644
--- a/widget/windows/nsFilePicker.h
+++ b/widget/windows/nsFilePicker.h
@@ -30,6 +30,7 @@
 #include "nsdefs.h"
 #include <commdlg.h>
 #include <shobjidl.h>
+#undef LogSeverity // SetupAPI.h #defines this as DWORD
 
 class nsILoadContext;
 
diff --git a/widget/windows/nsImageClipboard.h b/widget/windows/nsImageClipboard.h
index a12bd0f5d0ff..25b33cc56c0c 100644
--- a/widget/windows/nsImageClipboard.h
+++ b/widget/windows/nsImageClipboard.h
@@ -3,6 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef nsImageClipboard_h
+#define nsImageClipboard_h
+
 /* Things To Do 11/8/00
 
 Check image metrics, can we support them? Do we need to?
@@ -86,3 +89,5 @@ private:
   void CalcBitShift(bitFields * aColorMask);
 
 }; // nsImageFromClipboard
+
+#endif
diff --git a/widget/windows/nsNativeDragSource.cpp b/widget/windows/nsNativeDragSource.cpp
index 9651bf83d53f..857907076703 100644
--- a/widget/windows/nsNativeDragSource.cpp
+++ b/widget/windows/nsNativeDragSource.cpp
@@ -12,8 +12,6 @@
 #include "nsWidgetsCID.h"
 #include "nsIDragService.h"
 
-static NS_DEFINE_IID(kCDragServiceCID,  NS_DRAGSERVICE_CID);
-
 /*
  * class nsNativeDragSource
  */
@@ -68,6 +66,8 @@ nsNativeDragSource::Release(void)
 STDMETHODIMP
 nsNativeDragSource::QueryContinueDrag(BOOL fEsc, DWORD grfKeyState)
 {
+  static NS_DEFINE_IID(kCDragServiceCID,  NS_DRAGSERVICE_CID);
+
   nsCOMPtr<nsIDragService> dragService = do_GetService(kCDragServiceCID);
   if (dragService) {
     DWORD pos = ::GetMessagePos();
diff --git a/widget/windows/nsNativeDragTarget.cpp b/widget/windows/nsNativeDragTarget.cpp
index b728f3d63c7a..01345338a2ef 100644
--- a/widget/windows/nsNativeDragTarget.cpp
+++ b/widget/windows/nsNativeDragTarget.cpp
@@ -22,9 +22,6 @@
 using namespace mozilla;
 using namespace mozilla::widget;
 
-/* Define Class IDs */
-static NS_DEFINE_IID(kCDragServiceCID,  NS_DRAGSERVICE_CID);
-
 /* Define Interface IDs */
 static NS_DEFINE_IID(kIDragServiceIID, NS_IDRAGSERVICE_IID);
 
@@ -40,6 +37,8 @@ nsNativeDragTarget::nsNativeDragTarget(nsIWidget * aWidget)
     mEffectsPreferred(DROPEFFECT_NONE),
     mTookOwnRef(false), mWidget(aWidget), mDropTargetHelper(nullptr)
 {
+  static NS_DEFINE_IID(kCDragServiceCID,  NS_DRAGSERVICE_CID);
+
   mHWnd = (HWND)mWidget->GetNativeData(NS_NATIVE_WINDOW);
 
   /*
diff --git a/widget/windows/nsNativeDragTarget.h b/widget/windows/nsNativeDragTarget.h
index 15a8ff1c4224..431127e91891 100644
--- a/widget/windows/nsNativeDragTarget.h
+++ b/widget/windows/nsNativeDragTarget.h
@@ -12,6 +12,7 @@
 
 #ifndef IDropTargetHelper
 #include <shobjidl.h> // Vista drag image interfaces
+#undef LogSeverity // SetupAPI.h #defines this as DWORD
 #endif
 
 #include "mozilla/Attributes.h"
diff --git a/widget/windows/nsNativeThemeWin.h b/widget/windows/nsNativeThemeWin.h
index 9db8906ac166..c296bbf17ccf 100644
--- a/widget/windows/nsNativeThemeWin.h
+++ b/widget/windows/nsNativeThemeWin.h
@@ -4,6 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef nsNativeThemeWin_h
+#define nsNativeThemeWin_h
+
 #include "nsITheme.h"
 #include "nsCOMPtr.h"
 #include "nsIAtom.h"
@@ -118,3 +121,5 @@ private:
   TimeStamp mProgressDeterminateTimeStamp;
   TimeStamp mProgressIndeterminateTimeStamp;
 };
+
+#endif
diff --git a/widget/windows/nsUXThemeConstants.h b/widget/windows/nsUXThemeConstants.h
index 6b569d66e8a4..731dcedf25e4 100644
--- a/widget/windows/nsUXThemeConstants.h
+++ b/widget/windows/nsUXThemeConstants.h
@@ -5,6 +5,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#ifndef nsUXThemeConstants_h
+#define nsUXThemeConstants_h
+
 /* 
  * The following constants are used to determine how a widget is drawn using
  * Windows' Theme API. For more information on theme parts and states see
@@ -244,3 +247,5 @@ enum {
 };
 
 }}} // mozilla::widget::themeconst
+
+#endif

From 93e90b7ec1f5c1e502febe9129732d702a6d59d0 Mon Sep 17 00:00:00 2001
From: Nicholas Cameron <ncameron@mozilla.com>
Date: Mon, 16 Dec 2013 11:17:58 +1300
Subject: [PATCH 436/459] Bug 950504. Remove MatrixForThebesMatrix.
 r=mattwoodrow

--HG--
extra : rebase_source : 77103221abbb55d23f9d399d4973ef0b8f269079
---
 gfx/layers/opengl/CompositorOGL.cpp |  2 +-
 gfx/thebes/gfx2DGlue.h              | 18 ++++++------------
 2 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index 8e2ab2757824..c7fd32ee8272 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -1497,7 +1497,7 @@ CompositorOGL::CopyToTarget(DrawTarget *aTarget, const gfxMatrix& aTransform)
     mGLContext->ReadPixelsToSourceSurface(IntSize(width, height));
 
   // Map from GL space to Cairo space and reverse the world transform.
-  Matrix glToCairoTransform = MatrixForThebesMatrix(aTransform);
+  Matrix glToCairoTransform = ToMatrix(aTransform);
   glToCairoTransform.Invert();
   glToCairoTransform.Scale(1.0, -1.0);
   glToCairoTransform.Translate(0.0, -height);
diff --git a/gfx/thebes/gfx2DGlue.h b/gfx/thebes/gfx2DGlue.h
index 071bf0173afc..78d69d218a6b 100644
--- a/gfx/thebes/gfx2DGlue.h
+++ b/gfx/thebes/gfx2DGlue.h
@@ -55,6 +55,12 @@ inline Matrix ToMatrix(const gfxMatrix &aMatrix)
                 Float(aMatrix.yy), Float(aMatrix.x0), Float(aMatrix.y0));
 }
 
+inline gfxMatrix ThebesMatrix(const Matrix &aMatrix)
+{
+  return gfxMatrix(aMatrix._11, aMatrix._12, aMatrix._21,
+                   aMatrix._22, aMatrix._31, aMatrix._32);
+}
+
 inline Point ToPoint(const gfxPoint &aPoint)
 {
   return Point(Float(aPoint.x), Float(aPoint.y));
@@ -199,18 +205,6 @@ inline JoinStyle ToJoinStyle(gfxContext::GraphicsLineJoin aStyle)
   MOZ_CRASH("Incomplete switch");
 }
 
-inline gfxMatrix ThebesMatrix(const Matrix &aMatrix)
-{
-  return gfxMatrix(aMatrix._11, aMatrix._12, aMatrix._21,
-                   aMatrix._22, aMatrix._31, aMatrix._32);
-}
-
-inline Matrix MatrixForThebesMatrix(const gfxMatrix &aMatrix)
-{
-  return Matrix(aMatrix.xx, aMatrix.yx, aMatrix.xy,
-                aMatrix.yy, aMatrix.x0, aMatrix.y0);
-}
-
 inline gfxImageFormat SurfaceFormatToImageFormat(SurfaceFormat aFormat)
 {
   switch (aFormat) {

From 67783ac649a8935afa65fde50bf01c29c0b5aa5d Mon Sep 17 00:00:00 2001
From: Nick Alexander <nalexander@mozilla.com>
Date: Sun, 15 Dec 2013 15:53:59 -0800
Subject: [PATCH 437/459] Bug 949880 - Refactor Android Sync's SyncAdapter for
 FxAccount use. r=rnewman

--HG--
extra : rebase_source : 28937855c499bb621458b15424ac67378e43f9db
---
 mobile/android/base/android-services.mozbuild |  6 ++
 mobile/android/base/sync/GlobalSession.java   | 29 +++---
 .../android/base/sync/JSONRecordFetcher.java  |  3 +
 .../SharedPreferencesClientsDataDelegate.java | 57 +++++++++++
 ...aredPreferencesNodeAssignmentCallback.java | 63 ++++++++++++
 .../android/base/sync/SyncConfiguration.java  | 18 ----
 .../android/base/sync/SyncConstants.java.in   |  2 +
 mobile/android/base/sync/Utils.java           | 11 +++
 .../delegates/BaseGlobalSessionCallback.java  | 36 +++++++
 .../sync/delegates/GlobalSessionCallback.java | 60 +----------
 .../delegates/NodeAssignmentCallback.java     | 42 ++++++++
 .../android/base/sync/net/BaseResource.java   |  5 +-
 .../domain/PasswordRecordFactory.java         | 19 ++++
 .../domain/TabsRecordFactory.java             | 17 ++++
 mobile/android/base/sync/setup/Constants.java |  4 -
 .../android/base/sync/setup/SyncAccounts.java |  6 +-
 .../setup/activities/AccountActivity.java     |  4 +-
 .../setup/auth/EnsureUserExistenceStage.java  |  4 +-
 .../sync/setup/auth/FetchUserNodeStage.java   |  4 +-
 .../sync/stage/EnsureClusterURLStage.java     | 27 +++--
 .../sync/stage/FennecTabsServerSyncStage.java | 15 +--
 .../sync/stage/PasswordsServerSyncStage.java  | 14 +--
 .../base/sync/syncadapter/SyncAdapter.java    | 99 ++++---------------
 .../junit3/src/sync/TestClientsStage.java     |  3 +-
 .../junit3/src/sync/TestResetting.java        |  3 +-
 .../junit3/src/sync/TestSyncAccounts.java     |  2 +-
 .../junit3/src/sync/TestUpgradeRequired.java  | 58 +----------
 .../DefaultGlobalSessionCallback.java         |  7 +-
 .../src/testhelpers/MockGlobalSession.java    |  4 +-
 .../testhelpers/MockPrefsGlobalSession.java   | 10 +-
 30 files changed, 344 insertions(+), 288 deletions(-)
 create mode 100644 mobile/android/base/sync/SharedPreferencesClientsDataDelegate.java
 create mode 100644 mobile/android/base/sync/SharedPreferencesNodeAssignmentCallback.java
 create mode 100644 mobile/android/base/sync/delegates/BaseGlobalSessionCallback.java
 create mode 100644 mobile/android/base/sync/delegates/NodeAssignmentCallback.java
 create mode 100644 mobile/android/base/sync/repositories/domain/PasswordRecordFactory.java
 create mode 100644 mobile/android/base/sync/repositories/domain/TabsRecordFactory.java

diff --git a/mobile/android/base/android-services.mozbuild b/mobile/android/base/android-services.mozbuild
index 91ecd0389e05..bf6a806b53f5 100644
--- a/mobile/android/base/android-services.mozbuild
+++ b/mobile/android/base/android-services.mozbuild
@@ -539,12 +539,14 @@ sync_java_files = [
     'sync/crypto/PersistedCrypto5Keys.java',
     'sync/CryptoRecord.java',
     'sync/DelayedWorkTracker.java',
+    'sync/delegates/BaseGlobalSessionCallback.java',
     'sync/delegates/ClientsDataDelegate.java',
     'sync/delegates/FreshStartDelegate.java',
     'sync/delegates/GlobalSessionCallback.java',
     'sync/delegates/JSONRecordFetchDelegate.java',
     'sync/delegates/KeyUploadDelegate.java',
     'sync/delegates/MetaGlobalDelegate.java',
+    'sync/delegates/NodeAssignmentCallback.java',
     'sync/delegates/WipeServerDelegate.java',
     'sync/EngineSettings.java',
     'sync/ExtendedJSONObject.java',
@@ -662,9 +664,11 @@ sync_java_files = [
     'sync/repositories/domain/HistoryRecord.java',
     'sync/repositories/domain/HistoryRecordFactory.java',
     'sync/repositories/domain/PasswordRecord.java',
+    'sync/repositories/domain/PasswordRecordFactory.java',
     'sync/repositories/domain/Record.java',
     'sync/repositories/domain/RecordParseException.java',
     'sync/repositories/domain/TabsRecord.java',
+    'sync/repositories/domain/TabsRecordFactory.java',
     'sync/repositories/domain/VersionConstants.java',
     'sync/repositories/FetchFailedException.java',
     'sync/repositories/HashSetStoreTracker.java',
@@ -715,6 +719,8 @@ sync_java_files = [
     'sync/setup/InvalidSyncKeyException.java',
     'sync/setup/SyncAccounts.java',
     'sync/setup/SyncAuthenticatorService.java',
+    'sync/SharedPreferencesClientsDataDelegate.java',
+    'sync/SharedPreferencesNodeAssignmentCallback.java',
     'sync/stage/AbstractNonRepositorySyncStage.java',
     'sync/stage/AbstractSessionManagingSyncStage.java',
     'sync/stage/AndroidBrowserBookmarksServerSyncStage.java',
diff --git a/mobile/android/base/sync/GlobalSession.java b/mobile/android/base/sync/GlobalSession.java
index 86adf1c426e4..0d23f79b9f3f 100644
--- a/mobile/android/base/sync/GlobalSession.java
+++ b/mobile/android/base/sync/GlobalSession.java
@@ -22,12 +22,13 @@ import org.json.simple.parser.ParseException;
 import org.mozilla.gecko.background.common.log.Logger;
 import org.mozilla.gecko.sync.crypto.CryptoException;
 import org.mozilla.gecko.sync.crypto.KeyBundle;
+import org.mozilla.gecko.sync.delegates.BaseGlobalSessionCallback;
 import org.mozilla.gecko.sync.delegates.ClientsDataDelegate;
 import org.mozilla.gecko.sync.delegates.FreshStartDelegate;
-import org.mozilla.gecko.sync.delegates.GlobalSessionCallback;
 import org.mozilla.gecko.sync.delegates.JSONRecordFetchDelegate;
 import org.mozilla.gecko.sync.delegates.KeyUploadDelegate;
 import org.mozilla.gecko.sync.delegates.MetaGlobalDelegate;
+import org.mozilla.gecko.sync.delegates.NodeAssignmentCallback;
 import org.mozilla.gecko.sync.delegates.WipeServerDelegate;
 import org.mozilla.gecko.sync.net.AuthHeaderProvider;
 import org.mozilla.gecko.sync.net.BaseResource;
@@ -70,9 +71,10 @@ public class GlobalSession implements PrefsSource, HttpResponseObserver {
   protected Map<Stage, GlobalSyncStage> stages;
   public Stage currentState = Stage.idle;
 
-  public final GlobalSessionCallback callback;
-  private Context context;
-  private ClientsDataDelegate clientsDelegate;
+  public final BaseGlobalSessionCallback callback;
+  protected final Context context;
+  protected final ClientsDataDelegate clientsDelegate;
+  protected final NodeAssignmentCallback nodeAssignmentCallback;
 
   /**
    * Map from engine name to new settings for an updated meta/global record.
@@ -98,15 +100,15 @@ public class GlobalSession implements PrefsSource, HttpResponseObserver {
     return config.wboURI(collection, id);
   }
 
-  public GlobalSession(String serverURL,
-                       String username,
+  public GlobalSession(String username,
                        AuthHeaderProvider authHeaderProvider,
                        String prefsPath,
                        KeyBundle syncKeyBundle,
-                       GlobalSessionCallback callback,
+                       BaseGlobalSessionCallback callback,
                        Context context,
                        Bundle extras,
-                       ClientsDataDelegate clientsDelegate)
+                       ClientsDataDelegate clientsDelegate,
+                       NodeAssignmentCallback nodeAssignmentCallback)
                            throws SyncConfigurationException, IllegalArgumentException, IOException, ParseException, NonObjectJSONException {
     if (username == null) {
       throw new IllegalArgumentException("username must not be null.");
@@ -116,12 +118,6 @@ public class GlobalSession implements PrefsSource, HttpResponseObserver {
     }
 
     Logger.debug(LOG_TAG, "GlobalSession initialized with bundle " + extras);
-    URI serverURI;
-    try {
-      serverURI = (serverURL == null) ? null : new URI(serverURL);
-    } catch (URISyntaxException e) {
-      throw new SyncConfigurationException();
-    }
 
     if (syncKeyBundle == null ||
         syncKeyBundle.getEncryptionKey() == null ||
@@ -132,10 +128,9 @@ public class GlobalSession implements PrefsSource, HttpResponseObserver {
     this.callback        = callback;
     this.context         = context;
     this.clientsDelegate = clientsDelegate;
+    this.nodeAssignmentCallback = nodeAssignmentCallback;
 
     config = new SyncConfiguration(username, authHeaderProvider, prefsPath, this);
-
-    config.serverURL     = serverURI;
     config.syncKeyBundle = syncKeyBundle;
 
     registerCommands();
@@ -199,7 +194,7 @@ public class GlobalSession implements PrefsSource, HttpResponseObserver {
     HashMap<Stage, GlobalSyncStage> stages = new HashMap<Stage, GlobalSyncStage>();
 
     stages.put(Stage.checkPreconditions,      new CheckPreconditionsStage());
-    stages.put(Stage.ensureClusterURL,        new EnsureClusterURLStage());
+    stages.put(Stage.ensureClusterURL,        new EnsureClusterURLStage(nodeAssignmentCallback));
     stages.put(Stage.fetchInfoCollections,    new FetchInfoCollectionsStage());
     stages.put(Stage.fetchMetaGlobal,         new FetchMetaGlobalStage());
     stages.put(Stage.ensureKeysStage,         new EnsureCrypto5KeysStage());
diff --git a/mobile/android/base/sync/JSONRecordFetcher.java b/mobile/android/base/sync/JSONRecordFetcher.java
index b43487c2e405..b76146a1e065 100644
--- a/mobile/android/base/sync/JSONRecordFetcher.java
+++ b/mobile/android/base/sync/JSONRecordFetcher.java
@@ -27,6 +27,9 @@ public class JSONRecordFetcher {
   protected JSONRecordFetchDelegate delegate;
 
   public JSONRecordFetcher(final String uri, final AuthHeaderProvider authHeaderProvider) {
+    if (uri == null) {
+      throw new IllegalArgumentException("uri must not be null");
+    }
     this.uri = uri;
     this.authHeaderProvider = authHeaderProvider;
   }
diff --git a/mobile/android/base/sync/SharedPreferencesClientsDataDelegate.java b/mobile/android/base/sync/SharedPreferencesClientsDataDelegate.java
new file mode 100644
index 000000000000..47006f9af851
--- /dev/null
+++ b/mobile/android/base/sync/SharedPreferencesClientsDataDelegate.java
@@ -0,0 +1,57 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync;
+
+import org.mozilla.gecko.background.common.GlobalConstants;
+import org.mozilla.gecko.sync.delegates.ClientsDataDelegate;
+
+import android.content.SharedPreferences;
+
+/**
+ * A <code>ClientsDataDelegate</code> implementation that persists to a
+ * <code>SharedPreferences</code> instance.
+ */
+public class SharedPreferencesClientsDataDelegate implements ClientsDataDelegate {
+  protected final SharedPreferences sharedPreferences;
+
+  public SharedPreferencesClientsDataDelegate(SharedPreferences sharedPreferences) {
+    this.sharedPreferences = sharedPreferences;
+  }
+
+  @Override
+  public synchronized String getAccountGUID() {
+    String accountGUID = sharedPreferences.getString(SyncConfiguration.PREF_ACCOUNT_GUID, null);
+    if (accountGUID == null) {
+      accountGUID = Utils.generateGuid();
+      sharedPreferences.edit().putString(SyncConfiguration.PREF_ACCOUNT_GUID, accountGUID).commit();
+    }
+    return accountGUID;
+  }
+
+  @Override
+  public synchronized String getClientName() {
+    String clientName = sharedPreferences.getString(SyncConfiguration.PREF_CLIENT_NAME, null);
+    if (clientName == null) {
+      clientName = GlobalConstants.MOZ_APP_DISPLAYNAME + " on " + android.os.Build.MODEL;
+      sharedPreferences.edit().putString(SyncConfiguration.PREF_CLIENT_NAME, clientName).commit();
+    }
+    return clientName;
+  }
+
+  @Override
+  public synchronized void setClientsCount(int clientsCount) {
+    sharedPreferences.edit().putLong(SyncConfiguration.PREF_NUM_CLIENTS, (long) clientsCount).commit();
+  }
+
+  @Override
+  public boolean isLocalGUID(String guid) {
+    return getAccountGUID().equals(guid);
+  }
+
+  @Override
+  public synchronized int getClientsCount() {
+    return (int) sharedPreferences.getLong(SyncConfiguration.PREF_NUM_CLIENTS, 0);
+  }
+}
diff --git a/mobile/android/base/sync/SharedPreferencesNodeAssignmentCallback.java b/mobile/android/base/sync/SharedPreferencesNodeAssignmentCallback.java
new file mode 100644
index 000000000000..5408a167bc98
--- /dev/null
+++ b/mobile/android/base/sync/SharedPreferencesNodeAssignmentCallback.java
@@ -0,0 +1,63 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync;
+import java.net.URI;
+import java.net.URISyntaxException;
+
+import org.mozilla.gecko.sync.delegates.NodeAssignmentCallback;
+
+import android.content.SharedPreferences;
+import android.content.SharedPreferences.Editor;
+
+public class SharedPreferencesNodeAssignmentCallback implements NodeAssignmentCallback {
+  protected final SharedPreferences sharedPreferences;
+  protected final String nodeWeaveURL;
+
+  public SharedPreferencesNodeAssignmentCallback(SharedPreferences sharedPreferences, String nodeWeaveURL)
+      throws SyncConfigurationException {
+    this.sharedPreferences = sharedPreferences;
+    if (nodeWeaveURL == null) {
+      throw new IllegalArgumentException("nodeWeaveURL must not be null");
+    }
+    try {
+      new URI(nodeWeaveURL);
+    } catch (URISyntaxException e) {
+      throw new SyncConfigurationException();
+    }
+    this.nodeWeaveURL = nodeWeaveURL;
+  }
+
+  public synchronized boolean getClusterURLIsStale() {
+    return sharedPreferences.getBoolean(SyncConfiguration.PREF_CLUSTER_URL_IS_STALE, false);
+  }
+
+  public synchronized void setClusterURLIsStale(boolean clusterURLIsStale) {
+    Editor edit = sharedPreferences.edit();
+    edit.putBoolean(SyncConfiguration.PREF_CLUSTER_URL_IS_STALE, clusterURLIsStale);
+    edit.commit();
+  }
+
+  @Override
+  public boolean wantNodeAssignment() {
+    return getClusterURLIsStale();
+  }
+
+  @Override
+  public void informNodeAuthenticationFailed(GlobalSession session, URI failedClusterURL) {
+    // TODO: communicate to the user interface that we need a new user password!
+    // TODO: only freshen the cluster URL (better yet, forget the cluster URL) after the user has provided new credentials.
+    setClusterURLIsStale(false);
+  }
+
+  @Override
+  public void informNodeAssigned(GlobalSession session, URI oldClusterURL, URI newClusterURL) {
+    setClusterURLIsStale(false);
+  }
+
+  @Override
+  public String nodeWeaveURL() {
+    return this.nodeWeaveURL;
+  }
+}
diff --git a/mobile/android/base/sync/SyncConfiguration.java b/mobile/android/base/sync/SyncConfiguration.java
index 972fb9b120bf..ea2ae771fcb4 100644
--- a/mobile/android/base/sync/SyncConfiguration.java
+++ b/mobile/android/base/sync/SyncConfiguration.java
@@ -175,12 +175,9 @@ public class SyncConfiguration {
     }
   }
 
-  public static final String DEFAULT_USER_API = "https://auth.services.mozilla.com/user/1.0/";
-
   private static final String LOG_TAG = "SyncConfiguration";
 
   // These must be set in GlobalSession's constructor.
-  public URI             serverURL;
   public URI             clusterURL;
   public KeyBundle       syncKeyBundle;
 
@@ -453,21 +450,6 @@ public class SyncConfiguration {
     collectionKeys = k;
   }
 
-  public String nodeWeaveURL() {
-    return this.nodeWeaveURL((this.serverURL == null) ? null : this.serverURL.toASCIIString());
-  }
-
-  public String nodeWeaveURL(String serverURL) {
-    String userPart = username + "/node/weave";
-    if (serverURL == null) {
-      return DEFAULT_USER_API + userPart;
-    }
-    if (!serverURL.endsWith("/")) {
-      serverURL = serverURL + "/";
-    }
-    return serverURL + "user/1.0/" + userPart;
-  }
-
   protected String infoBaseURL() {
     return clusterURL + GlobalSession.API_VERSION + "/" + username + "/info/";
   }
diff --git a/mobile/android/base/sync/SyncConstants.java.in b/mobile/android/base/sync/SyncConstants.java.in
index 9ae2a272207a..60356f67659c 100644
--- a/mobile/android/base/sync/SyncConstants.java.in
+++ b/mobile/android/base/sync/SyncConstants.java.in
@@ -53,4 +53,6 @@ public class SyncConstants {
    * Account type.
    */
   public static final String PER_ACCOUNT_TYPE_PERMISSION = "@MOZ_ANDROID_SHARED_ACCOUNT_TYPE@.permission.PER_ACCOUNT_TYPE";
+
+  public static final String DEFAULT_AUTH_SERVER = "https://auth.services.mozilla.com/";
 }
diff --git a/mobile/android/base/sync/Utils.java b/mobile/android/base/sync/Utils.java
index 46b166e21d10..b559ef7ae232 100644
--- a/mobile/android/base/sync/Utils.java
+++ b/mobile/android/base/sync/Utils.java
@@ -530,4 +530,15 @@ public class Utils {
   public static String obfuscateEmail(final String in) {
     return in.replaceAll("[^@\\.]", "X");
   }
+
+  public static String nodeWeaveURL(String serverURL, String username) {
+    String userPart = username + "/node/weave";
+    if (serverURL == null) {
+      return SyncConstants.DEFAULT_AUTH_SERVER + "user/1.0/" + userPart;
+    }
+    if (!serverURL.endsWith("/")) {
+      serverURL = serverURL + "/";
+    }
+    return serverURL + "user/1.0/" + userPart;
+  }
 }
diff --git a/mobile/android/base/sync/delegates/BaseGlobalSessionCallback.java b/mobile/android/base/sync/delegates/BaseGlobalSessionCallback.java
new file mode 100644
index 000000000000..24f55d2159cf
--- /dev/null
+++ b/mobile/android/base/sync/delegates/BaseGlobalSessionCallback.java
@@ -0,0 +1,36 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.delegates;
+
+import java.net.URI;
+
+import org.mozilla.gecko.sync.GlobalSession;
+import org.mozilla.gecko.sync.stage.GlobalSyncStage.Stage;
+
+public interface BaseGlobalSessionCallback {
+  /**
+   * Request that no further syncs occur within the next `backoff` milliseconds.
+   * @param backoff a duration in milliseconds.
+   */
+  void requestBackoff(long backoff);
+
+  /**
+   * Called on a 401 HTTP response.
+   */
+  void informUnauthorizedResponse(GlobalSession globalSession, URI oldClusterURL);
+
+
+  /**
+   * Called when an HTTP failure indicates that a software upgrade is required.
+   */
+  void informUpgradeRequiredResponse(GlobalSession session);
+
+  void handleAborted(GlobalSession globalSession, String reason);
+  void handleError(GlobalSession globalSession, Exception ex);
+  void handleSuccess(GlobalSession globalSession);
+  void handleStageCompleted(Stage currentState, GlobalSession globalSession);
+
+  boolean shouldBackOff();
+}
diff --git a/mobile/android/base/sync/delegates/GlobalSessionCallback.java b/mobile/android/base/sync/delegates/GlobalSessionCallback.java
index f7e356a3fffe..ffa4aa59d92c 100644
--- a/mobile/android/base/sync/delegates/GlobalSessionCallback.java
+++ b/mobile/android/base/sync/delegates/GlobalSessionCallback.java
@@ -4,63 +4,5 @@
 
 package org.mozilla.gecko.sync.delegates;
 
-import java.net.URI;
-
-import org.mozilla.gecko.sync.GlobalSession;
-import org.mozilla.gecko.sync.stage.GlobalSyncStage.Stage;
-
-public interface GlobalSessionCallback {
-
-  /**
-   * Request that no further syncs occur within the next `backoff` milliseconds.
-   * @param backoff a duration in milliseconds.
-   */
-  void requestBackoff(long backoff);
-
-  /**
-   * If true, request node assignment from the server, i.e., fetch node/weave cluster URL.
-   */
-  boolean wantNodeAssignment();
-
-  /**
-   * Called on a 401 HTTP response.
-   */
-  void informUnauthorizedResponse(GlobalSession globalSession, URI oldClusterURL);
-
-  /**
-   * Called when a new node is assigned. If there already was an old node, the
-   * new node is different from the old node assignment, indicating node
-   * reassignment. If there wasn't an old node, we've been freshly assigned.
-   *
-   * @param globalSession
-   * @param oldClusterURL
-   *          The old node/weave cluster URL (possibly null).
-   * @param newClusterURL
-   *          The new node/weave cluster URL (not null).
-   */
-  void informNodeAssigned(GlobalSession globalSession, URI oldClusterURL, URI newClusterURL);
-
-  /**
-   * Called when wantNodeAssignment() is true, and the new node assignment is
-   * the same as the old node assignment, indicating a user authentication
-   * error.
-   *
-   * @param globalSession
-   * @param failedClusterURL
-   *          The new node/weave cluster URL.
-   */
-  void informNodeAuthenticationFailed(GlobalSession globalSession, URI failedClusterURL);
-
-  /**
-   * Called when an HTTP failure indicates that a software upgrade is required.
-   */
-  void informUpgradeRequiredResponse(GlobalSession session);
-
-  void handleAborted(GlobalSession globalSession, String reason);
-  void handleError(GlobalSession globalSession, Exception ex);
-  void handleSuccess(GlobalSession globalSession);
-  void handleStageCompleted(Stage currentState, GlobalSession globalSession);
-
-  boolean shouldBackOff();
-
+public interface GlobalSessionCallback extends BaseGlobalSessionCallback, NodeAssignmentCallback {
 }
diff --git a/mobile/android/base/sync/delegates/NodeAssignmentCallback.java b/mobile/android/base/sync/delegates/NodeAssignmentCallback.java
new file mode 100644
index 000000000000..55cae37288f0
--- /dev/null
+++ b/mobile/android/base/sync/delegates/NodeAssignmentCallback.java
@@ -0,0 +1,42 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.delegates;
+
+import java.net.URI;
+
+import org.mozilla.gecko.sync.GlobalSession;
+
+public interface NodeAssignmentCallback {
+  /**
+   * If true, request node assignment from the server, i.e., fetch node/weave cluster URL.
+   */
+  public boolean wantNodeAssignment();
+
+  /**
+   * Called when a new node is assigned. If there already was an old node, the
+   * new node is different from the old node assignment, indicating node
+   * reassignment. If there wasn't an old node, we've been freshly assigned.
+   *
+   * @param globalSession
+   * @param oldClusterURL
+   *          The old node/weave cluster URL (possibly null).
+   * @param newClusterURL
+   *          The new node/weave cluster URL (not null).
+   */
+  public void informNodeAssigned(GlobalSession globalSession, URI oldClusterURL, URI newClusterURL);
+
+  /**
+   * Called when wantNodeAssignment() is true, and the new node assignment is
+   * the same as the old node assignment, indicating a user authentication
+   * error.
+   *
+   * @param globalSession
+   * @param failedClusterURL
+   *          The new node/weave cluster URL.
+   */
+  public void informNodeAuthenticationFailed(GlobalSession globalSession, URI failedClusterURL);
+
+  public String nodeWeaveURL();
+}
diff --git a/mobile/android/base/sync/net/BaseResource.java b/mobile/android/base/sync/net/BaseResource.java
index 6de8898fea65..32903ed8c93d 100644
--- a/mobile/android/base/sync/net/BaseResource.java
+++ b/mobile/android/base/sync/net/BaseResource.java
@@ -91,7 +91,10 @@ public class BaseResource implements Resource {
   }
 
   public BaseResource(URI uri, boolean rewrite) {
-    if (rewrite && uri.getHost().equals("localhost")) {
+    if (uri == null) {
+      throw new IllegalArgumentException("uri must not be null");
+    }
+    if (rewrite && "localhost".equals(uri.getHost())) {
       // Rewrite localhost URIs to refer to the special Android emulator loopback passthrough interface.
       Logger.debug(LOG_TAG, "Rewriting " + uri + " to point to " + ANDROID_LOOPBACK_IP + ".");
       try {
diff --git a/mobile/android/base/sync/repositories/domain/PasswordRecordFactory.java b/mobile/android/base/sync/repositories/domain/PasswordRecordFactory.java
new file mode 100644
index 000000000000..fc7ef916d5b2
--- /dev/null
+++ b/mobile/android/base/sync/repositories/domain/PasswordRecordFactory.java
@@ -0,0 +1,19 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.repositories.domain;
+
+import org.mozilla.gecko.sync.CryptoRecord;
+import org.mozilla.gecko.sync.repositories.RecordFactory;
+import org.mozilla.gecko.sync.repositories.domain.PasswordRecord;
+import org.mozilla.gecko.sync.repositories.domain.Record;
+
+public class PasswordRecordFactory extends RecordFactory {
+  @Override
+  public Record createRecord(Record record) {
+    PasswordRecord r = new PasswordRecord();
+    r.initFromEnvelope((CryptoRecord) record);
+    return r;
+  }
+}
diff --git a/mobile/android/base/sync/repositories/domain/TabsRecordFactory.java b/mobile/android/base/sync/repositories/domain/TabsRecordFactory.java
new file mode 100644
index 000000000000..9504434d8c21
--- /dev/null
+++ b/mobile/android/base/sync/repositories/domain/TabsRecordFactory.java
@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.repositories.domain;
+
+import org.mozilla.gecko.sync.CryptoRecord;
+import org.mozilla.gecko.sync.repositories.RecordFactory;
+
+public class TabsRecordFactory extends RecordFactory {
+  @Override
+  public Record createRecord(Record record) {
+    TabsRecord r = new TabsRecord();
+    r.initFromEnvelope((CryptoRecord) record);
+    return r;
+  }
+}
diff --git a/mobile/android/base/sync/setup/Constants.java b/mobile/android/base/sync/setup/Constants.java
index fa76adb73e6a..d4a31c72680c 100644
--- a/mobile/android/base/sync/setup/Constants.java
+++ b/mobile/android/base/sync/setup/Constants.java
@@ -51,10 +51,6 @@ public class Constants {
     Intent.FLAG_ACTIVITY_NO_ANIMATION;
 
   // Constants for Account Authentication.
-  public static final String AUTH_NODE_DEFAULT    = "https://auth.services.mozilla.com/";
-  public static final String AUTH_NODE_PATHNAME   = "user/";
-  public static final String AUTH_NODE_VERSION    = "1.0/";
-  public static final String AUTH_NODE_SUFFIX     = "node/weave";
   public static final String AUTH_SERVER_VERSION  = "1.1/";
   public static final String AUTH_SERVER_SUFFIX   = "info/collections/";
 
diff --git a/mobile/android/base/sync/setup/SyncAccounts.java b/mobile/android/base/sync/setup/SyncAccounts.java
index 4f69350bface..1e4bd3a3629d 100644
--- a/mobile/android/base/sync/setup/SyncAccounts.java
+++ b/mobile/android/base/sync/setup/SyncAccounts.java
@@ -44,8 +44,6 @@ public class SyncAccounts {
   private static final String MOTO_BLUR_SETTINGS_ACTIVITY = "com.motorola.blur.settings.AccountsAndServicesPreferenceActivity";
   private static final String MOTO_BLUR_PACKAGE           = "com.motorola.blur.setup";
 
-  public final static String DEFAULT_SERVER = "https://auth.services.mozilla.com/";
-
   /**
    * Return Sync accounts.
    *
@@ -249,10 +247,10 @@ public class SyncAccounts {
     final String syncKey   = syncAccount.syncKey;
     final String password  = syncAccount.password;
     final String serverURL = (syncAccount.serverURL == null) ?
-        DEFAULT_SERVER : syncAccount.serverURL;
+        SyncConstants.DEFAULT_AUTH_SERVER : syncAccount.serverURL;
 
     Logger.debug(LOG_TAG, "Using account manager " + accountManager);
-    if (!RepoUtils.stringsEqual(syncAccount.serverURL, DEFAULT_SERVER)) {
+    if (!RepoUtils.stringsEqual(syncAccount.serverURL, SyncConstants.DEFAULT_AUTH_SERVER)) {
       Logger.info(LOG_TAG, "Setting explicit server URL: " + serverURL);
     }
 
diff --git a/mobile/android/base/sync/setup/activities/AccountActivity.java b/mobile/android/base/sync/setup/activities/AccountActivity.java
index d39b683c403b..2729109f41f8 100644
--- a/mobile/android/base/sync/setup/activities/AccountActivity.java
+++ b/mobile/android/base/sync/setup/activities/AccountActivity.java
@@ -45,7 +45,7 @@ public class AccountActivity extends AccountAuthenticatorActivity {
   private String              username;
   private String              password;
   private String              key;
-  private String              server = Constants.AUTH_NODE_DEFAULT;
+  private String              server = SyncConstants.DEFAULT_AUTH_SERVER;
 
   // UI elements.
   private EditText            serverInput;
@@ -162,7 +162,7 @@ public class AccountActivity extends AccountAuthenticatorActivity {
     username = usernameInput.getText().toString().toLowerCase(Locale.US);
     password = passwordInput.getText().toString();
     key      = synckeyInput.getText().toString();
-    server   = Constants.AUTH_NODE_DEFAULT;
+    server   = SyncConstants.DEFAULT_AUTH_SERVER;
 
     if (serverCheckbox.isChecked()) {
       String userServer = serverInput.getText().toString();
diff --git a/mobile/android/base/sync/setup/auth/EnsureUserExistenceStage.java b/mobile/android/base/sync/setup/auth/EnsureUserExistenceStage.java
index 83715328ab5b..fc316304b134 100644
--- a/mobile/android/base/sync/setup/auth/EnsureUserExistenceStage.java
+++ b/mobile/android/base/sync/setup/auth/EnsureUserExistenceStage.java
@@ -15,7 +15,6 @@ import java.security.GeneralSecurityException;
 import org.mozilla.gecko.background.common.log.Logger;
 import org.mozilla.gecko.sync.net.BaseResource;
 import org.mozilla.gecko.sync.net.BaseResourceDelegate;
-import org.mozilla.gecko.sync.setup.Constants;
 
 import ch.boye.httpclientandroidlib.HttpResponse;
 import ch.boye.httpclientandroidlib.client.ClientProtocolException;
@@ -53,7 +52,8 @@ public class EnsureUserExistenceStage implements AuthenticatorStage {
 
     };
 
-    String userRequestUrl = aa.nodeServer + Constants.AUTH_NODE_PATHNAME + Constants.AUTH_NODE_VERSION + aa.username;
+    // This is not the same as Utils.nodeWeaveURL: it's missing the trailing node/weave.
+    String userRequestUrl = aa.nodeServer + "user/1.0/" + aa.username;
     final BaseResource httpResource = new BaseResource(userRequestUrl);
     httpResource.delegate = new BaseResourceDelegate(httpResource) {
 
diff --git a/mobile/android/base/sync/setup/auth/FetchUserNodeStage.java b/mobile/android/base/sync/setup/auth/FetchUserNodeStage.java
index 06426c429087..65768a3eed1e 100644
--- a/mobile/android/base/sync/setup/auth/FetchUserNodeStage.java
+++ b/mobile/android/base/sync/setup/auth/FetchUserNodeStage.java
@@ -12,9 +12,9 @@ import java.net.URISyntaxException;
 import java.security.GeneralSecurityException;
 
 import org.mozilla.gecko.background.common.log.Logger;
+import org.mozilla.gecko.sync.Utils;
 import org.mozilla.gecko.sync.net.BaseResource;
 import org.mozilla.gecko.sync.net.BaseResourceDelegate;
-import org.mozilla.gecko.sync.setup.Constants;
 
 import ch.boye.httpclientandroidlib.HttpResponse;
 import ch.boye.httpclientandroidlib.client.ClientProtocolException;
@@ -61,7 +61,7 @@ public class FetchUserNodeStage implements AuthenticatorStage {
         aa.abort(AuthenticationResult.FAILURE_OTHER, e);
       }
     };
-    String nodeRequestUrl = aa.nodeServer + Constants.AUTH_NODE_PATHNAME + Constants.AUTH_NODE_VERSION + aa.username + "/" + Constants.AUTH_NODE_SUFFIX;
+    String nodeRequestUrl = Utils.nodeWeaveURL(aa.nodeServer, aa.username);
     // Might contain a plaintext username in the case of old Sync accounts.
     Logger.pii(LOG_TAG, "NodeUrl: " + nodeRequestUrl);
     final BaseResource httpResource = makeFetchNodeRequest(callbackDelegate, nodeRequestUrl);
diff --git a/mobile/android/base/sync/stage/EnsureClusterURLStage.java b/mobile/android/base/sync/stage/EnsureClusterURLStage.java
index cbb993bc9725..096479b73a5b 100644
--- a/mobile/android/base/sync/stage/EnsureClusterURLStage.java
+++ b/mobile/android/base/sync/stage/EnsureClusterURLStage.java
@@ -16,6 +16,7 @@ import org.mozilla.gecko.background.common.log.Logger;
 import org.mozilla.gecko.sync.NodeAuthenticationException;
 import org.mozilla.gecko.sync.NullClusterURLException;
 import org.mozilla.gecko.sync.ThreadPool;
+import org.mozilla.gecko.sync.delegates.NodeAssignmentCallback;
 import org.mozilla.gecko.sync.net.BaseResource;
 import org.mozilla.gecko.sync.net.BaseResourceDelegate;
 
@@ -24,6 +25,8 @@ import ch.boye.httpclientandroidlib.HttpResponse;
 import ch.boye.httpclientandroidlib.client.ClientProtocolException;
 
 public class EnsureClusterURLStage extends AbstractNonRepositorySyncStage {
+  private static final String LOG_TAG = EnsureClusterURLStage.class.getSimpleName();
+
   public interface ClusterURLFetchDelegate {
     /**
      * 200 - Success.
@@ -50,7 +53,12 @@ public class EnsureClusterURLStage extends AbstractNonRepositorySyncStage {
     public void handleError(Exception e);
   }
 
-  protected static final String LOG_TAG = "EnsureClusterURLStage";
+  protected final NodeAssignmentCallback callback;
+
+  public EnsureClusterURLStage(NodeAssignmentCallback callback) {
+    super();
+    this.callback = callback;
+  }
 
   // TODO: if cluster URL has changed since last time, we need to ensure that we do
   // a fresh start. This takes place at the GlobalSession level. Verify!
@@ -173,7 +181,7 @@ public class EnsureClusterURLStage extends AbstractNonRepositorySyncStage {
 
   public void execute() throws NoSuchStageException {
     final URI oldClusterURL = session.config.getClusterURL();
-    final boolean wantNodeAssignment = session.callback.wantNodeAssignment();
+    final boolean wantNodeAssignment = callback.wantNodeAssignment();
 
     if (!wantNodeAssignment && oldClusterURL != null) {
       Logger.info(LOG_TAG, "Cluster URL is already set and not stale. Continuing with sync.");
@@ -190,12 +198,12 @@ public class EnsureClusterURLStage extends AbstractNonRepositorySyncStage {
 
         if (oldClusterURL != null && oldClusterURL.equals(url)) {
           // Our cluster URL is marked as stale and the fresh cluster URL is the same -- this is the user's problem.
-          session.callback.informNodeAuthenticationFailed(session, url);
+          callback.informNodeAuthenticationFailed(session, url);
           session.abort(new NodeAuthenticationException(), "User password has changed.");
           return;
         }
 
-        session.callback.informNodeAssigned(session, oldClusterURL, url); // No matter what, we're getting a new node/weave clusterURL.
+        callback.informNodeAssigned(session, oldClusterURL, url); // No matter what, we're getting a new node/weave clusterURL.
         session.config.setClusterURL(url);
 
         ThreadPool.run(new Runnable() {
@@ -216,7 +224,12 @@ public class EnsureClusterURLStage extends AbstractNonRepositorySyncStage {
         int statusCode = response.getStatusLine().getStatusCode();
         Logger.warn(LOG_TAG, "Got HTTP failure fetching node assignment: " + statusCode);
         if (statusCode == 404) {
-          URI serverURL = session.config.serverURL;
+          URI serverURL = null;
+          try {
+            serverURL = new URI(callback.nodeWeaveURL());
+          } catch (URISyntaxException e) {
+            // Fall through to abort.
+          }
           if (serverURL != null) {
             Logger.info(LOG_TAG, "Using serverURL <" + serverURL.toASCIIString() + "> as clusterURL.");
             session.config.setClusterURL(serverURL);
@@ -224,7 +237,7 @@ public class EnsureClusterURLStage extends AbstractNonRepositorySyncStage {
             return;
           }
           Logger.warn(LOG_TAG, "No serverURL set to use as fallback cluster URL. Aborting sync.");
-          // Fallthrough to abort.
+          // Fall through to abort.
         } else {
           session.interpretHTTPFailure(response);
         }
@@ -241,7 +254,7 @@ public class EnsureClusterURLStage extends AbstractNonRepositorySyncStage {
       @Override
       public void run() {
         try {
-          fetchClusterURL(session.config.nodeWeaveURL(), delegate);
+          fetchClusterURL(callback.nodeWeaveURL(), delegate);
         } catch (URISyntaxException e) {
           session.abort(e, "Invalid URL for node/weave.");
         }
diff --git a/mobile/android/base/sync/stage/FennecTabsServerSyncStage.java b/mobile/android/base/sync/stage/FennecTabsServerSyncStage.java
index f74ea10e64c0..c3731163a682 100644
--- a/mobile/android/base/sync/stage/FennecTabsServerSyncStage.java
+++ b/mobile/android/base/sync/stage/FennecTabsServerSyncStage.java
@@ -4,27 +4,16 @@
 
 package org.mozilla.gecko.sync.stage;
 
-import org.mozilla.gecko.sync.CryptoRecord;
 import org.mozilla.gecko.sync.delegates.ClientsDataDelegate;
 import org.mozilla.gecko.sync.repositories.RecordFactory;
 import org.mozilla.gecko.sync.repositories.Repository;
 import org.mozilla.gecko.sync.repositories.android.FennecTabsRepository;
-import org.mozilla.gecko.sync.repositories.domain.Record;
-import org.mozilla.gecko.sync.repositories.domain.TabsRecord;
+import org.mozilla.gecko.sync.repositories.domain.TabsRecordFactory;
 import org.mozilla.gecko.sync.repositories.domain.VersionConstants;
 
 public class FennecTabsServerSyncStage extends ServerSyncStage {
   private static final String COLLECTION = "tabs";
 
-  public class FennecTabsRecordFactory extends RecordFactory {
-    @Override
-    public Record createRecord(Record record) {
-      TabsRecord r = new TabsRecord();
-      r.initFromEnvelope((CryptoRecord) record);
-      return r;
-    }
-  }
-
   @Override
   protected String getCollection() {
     return COLLECTION;
@@ -48,6 +37,6 @@ public class FennecTabsServerSyncStage extends ServerSyncStage {
 
   @Override
   protected RecordFactory getRecordFactory() {
-    return new FennecTabsRecordFactory();
+    return new TabsRecordFactory();
   }
 }
diff --git a/mobile/android/base/sync/stage/PasswordsServerSyncStage.java b/mobile/android/base/sync/stage/PasswordsServerSyncStage.java
index d8c3d03dd4ee..c781ce2cc5b2 100644
--- a/mobile/android/base/sync/stage/PasswordsServerSyncStage.java
+++ b/mobile/android/base/sync/stage/PasswordsServerSyncStage.java
@@ -4,12 +4,10 @@
 
 package org.mozilla.gecko.sync.stage;
 
-import org.mozilla.gecko.sync.CryptoRecord;
 import org.mozilla.gecko.sync.repositories.RecordFactory;
 import org.mozilla.gecko.sync.repositories.Repository;
 import org.mozilla.gecko.sync.repositories.android.PasswordsRepositorySession;
-import org.mozilla.gecko.sync.repositories.domain.PasswordRecord;
-import org.mozilla.gecko.sync.repositories.domain.Record;
+import org.mozilla.gecko.sync.repositories.domain.PasswordRecordFactory;
 import org.mozilla.gecko.sync.repositories.domain.VersionConstants;
 
 public class PasswordsServerSyncStage extends ServerSyncStage {
@@ -37,14 +35,4 @@ public class PasswordsServerSyncStage extends ServerSyncStage {
   protected RecordFactory getRecordFactory() {
     return new PasswordRecordFactory();
   }
-
-  public class PasswordRecordFactory extends RecordFactory {
-
-    @Override
-    public Record createRecord(Record record) {
-      PasswordRecord r = new PasswordRecord();
-      r.initFromEnvelope((CryptoRecord) record);
-      return r;
-    }
-  }
 }
diff --git a/mobile/android/base/sync/syncadapter/SyncAdapter.java b/mobile/android/base/sync/syncadapter/SyncAdapter.java
index abe0785d27a1..c13aad47b86a 100644
--- a/mobile/android/base/sync/syncadapter/SyncAdapter.java
+++ b/mobile/android/base/sync/syncadapter/SyncAdapter.java
@@ -17,6 +17,8 @@ import org.mozilla.gecko.sync.AlreadySyncingException;
 import org.mozilla.gecko.sync.CredentialException;
 import org.mozilla.gecko.sync.GlobalSession;
 import org.mozilla.gecko.sync.NonObjectJSONException;
+import org.mozilla.gecko.sync.SharedPreferencesClientsDataDelegate;
+import org.mozilla.gecko.sync.SharedPreferencesNodeAssignmentCallback;
 import org.mozilla.gecko.sync.SyncConfiguration;
 import org.mozilla.gecko.sync.SyncConfigurationException;
 import org.mozilla.gecko.sync.SyncConstants;
@@ -26,8 +28,8 @@ import org.mozilla.gecko.sync.Utils;
 import org.mozilla.gecko.sync.config.AccountPickler;
 import org.mozilla.gecko.sync.crypto.CryptoException;
 import org.mozilla.gecko.sync.crypto.KeyBundle;
+import org.mozilla.gecko.sync.delegates.BaseGlobalSessionCallback;
 import org.mozilla.gecko.sync.delegates.ClientsDataDelegate;
-import org.mozilla.gecko.sync.delegates.GlobalSessionCallback;
 import org.mozilla.gecko.sync.net.AuthHeaderProvider;
 import org.mozilla.gecko.sync.net.BasicAuthHeaderProvider;
 import org.mozilla.gecko.sync.net.ConnectionMonitorThread;
@@ -51,7 +53,7 @@ import android.database.sqlite.SQLiteConstraintException;
 import android.database.sqlite.SQLiteException;
 import android.os.Bundle;
 
-public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSessionCallback, ClientsDataDelegate {
+public class SyncAdapter extends AbstractThreadedSyncAdapter implements BaseGlobalSessionCallback {
   private static final String  LOG_TAG = "SyncAdapter";
 
   private static final int     BACKOFF_PAD_SECONDS = 5;
@@ -195,6 +197,8 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
   protected Account localAccount;
   protected boolean thisSyncIsForced = false;
   protected SharedPreferences accountSharedPreferences;
+  protected SharedPreferencesClientsDataDelegate clientsDataDelegate;
+  protected SharedPreferencesNodeAssignmentCallback nodeAssignmentDelegate;
 
   /**
    * Return the number of milliseconds until we're allowed to sync again,
@@ -220,7 +224,7 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
       return false;
     }
 
-    if (wantNodeAssignment()) {
+    if (nodeAssignmentDelegate.wantNodeAssignment()) {
       /*
        * We recently had a 401 and we aborted the last sync. We should kick off
        * another sync to fetch a new node/weave cluster URL, since ours is
@@ -359,11 +363,14 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
           final String profile = Constants.DEFAULT_PROFILE;
           final long version = SyncConfiguration.CURRENT_PREFS_VERSION;
           self.accountSharedPreferences = Utils.getSharedPreferences(mContext, product, username, serverURL, profile, version);
+          self.clientsDataDelegate = new SharedPreferencesClientsDataDelegate(accountSharedPreferences);
+          final String nodeWeaveURL = Utils.nodeWeaveURL(serverURL, username);
+          self.nodeAssignmentDelegate = new SharedPreferencesNodeAssignmentCallback(accountSharedPreferences, nodeWeaveURL);
 
           Logger.info(LOG_TAG,
-              "Client is named '" + getClientName() + "'" +
-              ", has client guid " + getAccountGUID() +
-              ", and has " + getClientsCount() + " clients.");
+              "Client is named '" + clientsDataDelegate.getClientName() + "'" +
+              ", has client guid " + clientsDataDelegate.getAccountGUID() +
+              ", and has " + clientsDataDelegate.getClientsCount() + " clients.");
 
           thisSyncIsForced = (extras != null) && (extras.getBoolean(ContentResolver.SYNC_EXTRAS_MANUAL, false));
           long delay = delayMilliseconds();
@@ -405,7 +412,7 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
         syncMonitor.wait();
 
         if (setNextSync.get()) {
-          long interval = getSyncInterval();
+          long interval = getSyncInterval(clientsDataDelegate);
           long next = System.currentTimeMillis() + interval;
 
           if (thisSyncIsForced) {
@@ -426,13 +433,13 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
     }
   }
 
-  public int getSyncInterval() {
+  public int getSyncInterval(ClientsDataDelegate clientsDataDelegate) {
     // Must have been a problem that means we can't access the Account.
     if (this.localAccount == null) {
       return SINGLE_DEVICE_INTERVAL_MILLISECONDS;
     }
 
-    int clientsCount = this.getClientsCount();
+    int clientsCount = clientsDataDelegate.getClientsCount();
     if (clientsCount <= 1) {
       return SINGLE_DEVICE_INTERVAL_MILLISECONDS;
     }
@@ -481,8 +488,8 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
         password,
         serverURL,
         null, // We'll re-fetch cluster URL; not great, but not harmful.
-        getClientName(),
-        getAccountGUID());
+        clientsDataDelegate.getClientName(),
+        clientsDataDelegate.getAccountGUID());
 
       // Bug 772971: pickle Sync account parameters on background thread to
       // avoid strict mode warnings.
@@ -502,11 +509,10 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
       // Do nothing.
     }
 
-    // TODO: default serverURL.
     final KeyBundle keyBundle = new KeyBundle(username, syncKey);
     final AuthHeaderProvider authHeaderProvider = new BasicAuthHeaderProvider(username, password);
-    GlobalSession globalSession = new GlobalSession(serverURL, username, authHeaderProvider, prefsPath,
-                                                    keyBundle, this, this.mContext, extras, this);
+    GlobalSession globalSession = new GlobalSession(username, authHeaderProvider, prefsPath,
+                                                    keyBundle, this, this.mContext, extras, clientsDataDelegate, nodeAssignmentDelegate);
 
     globalSession.start();
   }
@@ -545,72 +551,9 @@ public class SyncAdapter extends AbstractThreadedSyncAdapter implements GlobalSe
     Logger.trace(LOG_TAG, "Stage completed: " + currentState);
   }
 
-  @Override
-  public synchronized String getAccountGUID() {
-    String accountGUID = accountSharedPreferences.getString(SyncConfiguration.PREF_ACCOUNT_GUID, null);
-    if (accountGUID == null) {
-      Logger.debug(LOG_TAG, "Account GUID was null. Creating a new one.");
-      accountGUID = Utils.generateGuid();
-      accountSharedPreferences.edit().putString(SyncConfiguration.PREF_ACCOUNT_GUID, accountGUID).commit();
-    }
-    return accountGUID;
-  }
-
-  @Override
-  public synchronized String getClientName() {
-    String clientName = accountSharedPreferences.getString(SyncConfiguration.PREF_CLIENT_NAME, null);
-    if (clientName == null) {
-      clientName = GlobalConstants.MOZ_APP_DISPLAYNAME + " on " + android.os.Build.MODEL;
-      accountSharedPreferences.edit().putString(SyncConfiguration.PREF_CLIENT_NAME, clientName).commit();
-    }
-    return clientName;
-  }
-
-  @Override
-  public synchronized void setClientsCount(int clientsCount) {
-    accountSharedPreferences.edit().putLong(SyncConfiguration.PREF_NUM_CLIENTS, (long) clientsCount).commit();
-  }
-
-  @Override
-  public boolean isLocalGUID(String guid) {
-    return getAccountGUID().equals(guid);
-  }
-
-  @Override
-  public synchronized int getClientsCount() {
-    return (int) accountSharedPreferences.getLong(SyncConfiguration.PREF_NUM_CLIENTS, 0);
-  }
-
-  public synchronized boolean getClusterURLIsStale() {
-    return accountSharedPreferences.getBoolean(SyncConfiguration.PREF_CLUSTER_URL_IS_STALE, false);
-  }
-
-  public synchronized void setClusterURLIsStale(boolean clusterURLIsStale) {
-    Editor edit = accountSharedPreferences.edit();
-    edit.putBoolean(SyncConfiguration.PREF_CLUSTER_URL_IS_STALE, clusterURLIsStale);
-    edit.commit();
-  }
-
-  @Override
-  public boolean wantNodeAssignment() {
-    return getClusterURLIsStale();
-  }
-
-  @Override
-  public void informNodeAuthenticationFailed(GlobalSession session, URI failedClusterURL) {
-    // TODO: communicate to the user interface that we need a new user password!
-    // TODO: only freshen the cluster URL (better yet, forget the cluster URL) after the user has provided new credentials.
-    setClusterURLIsStale(false);
-  }
-
-  @Override
-  public void informNodeAssigned(GlobalSession session, URI oldClusterURL, URI newClusterURL) {
-    setClusterURLIsStale(false);
-  }
-
   @Override
   public void informUnauthorizedResponse(GlobalSession session, URI oldClusterURL) {
-    setClusterURLIsStale(true);
+    nodeAssignmentDelegate.setClusterURLIsStale(true);
   }
 
   @Override
diff --git a/mobile/android/tests/background/junit3/src/sync/TestClientsStage.java b/mobile/android/tests/background/junit3/src/sync/TestClientsStage.java
index 337ad7edf9f2..6a8acea7b827 100644
--- a/mobile/android/tests/background/junit3/src/sync/TestClientsStage.java
+++ b/mobile/android/tests/background/junit3/src/sync/TestClientsStage.java
@@ -41,10 +41,9 @@ public class TestClientsStage extends AndroidSyncTestCase {
     final ClientsDataDelegate delegate = new MockClientsDataDelegate();
 
     final GlobalSession session = new GlobalSession(
-        null,
         TEST_USERNAME, new BasicAuthHeaderProvider(TEST_USERNAME, TEST_PASSWORD), null,
         new KeyBundle(TEST_USERNAME, TEST_SYNC_KEY),
-        callback, context, null, delegate);
+        callback, context, null, delegate, callback);
 
     SyncClientsEngineStage stage = new SyncClientsEngineStage() {
 
diff --git a/mobile/android/tests/background/junit3/src/sync/TestResetting.java b/mobile/android/tests/background/junit3/src/sync/TestResetting.java
index 03961084b0cd..5ce38d98c914 100644
--- a/mobile/android/tests/background/junit3/src/sync/TestResetting.java
+++ b/mobile/android/tests/background/junit3/src/sync/TestResetting.java
@@ -153,10 +153,9 @@ public class TestResetting extends AndroidSyncTestCase {
 
   private GlobalSession createDefaultGlobalSession(final GlobalSessionCallback callback) throws SyncConfigurationException, IllegalArgumentException, NonObjectJSONException, IOException, ParseException, CryptoException {
     return new GlobalSession(
-        null,
         TEST_USERNAME, new BasicAuthHeaderProvider(TEST_USERNAME, TEST_PASSWORD), null,
         new KeyBundle(TEST_USERNAME, TEST_SYNC_KEY),
-        callback, getApplicationContext(), null, null) {
+        callback, getApplicationContext(), null, null, callback) {
 
       @Override
       public boolean engineIsEnabled(String engineName,
diff --git a/mobile/android/tests/background/junit3/src/sync/TestSyncAccounts.java b/mobile/android/tests/background/junit3/src/sync/TestSyncAccounts.java
index ab58ed7be324..79d58a05e5c2 100644
--- a/mobile/android/tests/background/junit3/src/sync/TestSyncAccounts.java
+++ b/mobile/android/tests/background/junit3/src/sync/TestSyncAccounts.java
@@ -169,7 +169,7 @@ public class TestSyncAccounts extends AndroidSyncTestCase {
     assertNotNull(account);
 
     SharedPreferences prefs = Utils.getSharedPreferences(context, TEST_PRODUCT, TEST_USERNAME,
-        SyncAccounts.DEFAULT_SERVER, TEST_PROFILE, TEST_VERSION);
+        SyncConstants.DEFAULT_AUTH_SERVER, TEST_PROFILE, TEST_VERSION);
 
     // Verify that client record is set.
     assertEquals(TEST_GUID, prefs.getString(SyncConfiguration.PREF_ACCOUNT_GUID, null));
diff --git a/mobile/android/tests/background/junit3/src/sync/TestUpgradeRequired.java b/mobile/android/tests/background/junit3/src/sync/TestUpgradeRequired.java
index 5fd68a914890..301fc5eb9239 100644
--- a/mobile/android/tests/background/junit3/src/sync/TestUpgradeRequired.java
+++ b/mobile/android/tests/background/junit3/src/sync/TestUpgradeRequired.java
@@ -5,10 +5,10 @@ package org.mozilla.gecko.background.sync;
 
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
-import java.net.URI;
 
 import org.json.simple.parser.ParseException;
 import org.mozilla.gecko.background.helpers.AndroidSyncTestCase;
+import org.mozilla.gecko.background.testhelpers.DefaultGlobalSessionCallback;
 import org.mozilla.gecko.background.testhelpers.MockGlobalSession;
 import org.mozilla.gecko.db.BrowserContract;
 import org.mozilla.gecko.sync.GlobalSession;
@@ -21,7 +21,6 @@ import org.mozilla.gecko.sync.delegates.GlobalSessionCallback;
 import org.mozilla.gecko.sync.setup.Constants;
 import org.mozilla.gecko.sync.setup.SyncAccounts;
 import org.mozilla.gecko.sync.setup.SyncAccounts.SyncAccountParameters;
-import org.mozilla.gecko.sync.stage.GlobalSyncStage.Stage;
 import org.mozilla.gecko.sync.syncadapter.SyncAdapter;
 
 import android.accounts.Account;
@@ -163,7 +162,7 @@ public class TestUpgradeRequired extends AndroidSyncTestCase {
    */
   public void testUpgradeResponse() throws SyncConfigurationException, IllegalArgumentException, NonObjectJSONException, IOException, ParseException, CryptoException {
     final Result calledUpgradeRequired = new Result();
-    final GlobalSessionCallback callback = new BlankGlobalSessionCallback() {
+    final GlobalSessionCallback callback = new DefaultGlobalSessionCallback() {
       @Override
       public void informUpgradeRequiredResponse(final GlobalSession session) {
         calledUpgradeRequired.called = true;
@@ -171,7 +170,7 @@ public class TestUpgradeRequired extends AndroidSyncTestCase {
     };
 
     final GlobalSession session = new MockGlobalSession(
-        TEST_SERVER, TEST_USERNAME, TEST_PASSWORD,
+        TEST_USERNAME, TEST_PASSWORD,
         new KeyBundle(TEST_USERNAME, TEST_SYNC_KEY), callback);
 
     session.interpretHTTPFailure(simulate400());
@@ -182,55 +181,4 @@ public class TestUpgradeRequired extends AndroidSyncTestCase {
   public void tearDown() {
     deleteTestAccount();
   }
-
-  public abstract class BlankGlobalSessionCallback implements GlobalSessionCallback {
-    public BlankGlobalSessionCallback() {
-    }
-
-    @Override
-    public void requestBackoff(long backoff) {
-    }
-
-    @Override
-    public boolean wantNodeAssignment() {
-      return false;
-    }
-
-    @Override
-    public void informUnauthorizedResponse(GlobalSession globalSession,
-                                           URI oldClusterURL) {
-    }
-
-    @Override
-    public void informNodeAssigned(GlobalSession globalSession,
-                                   URI oldClusterURL, URI newClusterURL) {
-    }
-
-    @Override
-    public void informNodeAuthenticationFailed(GlobalSession globalSession,
-                                               URI failedClusterURL) {
-    }
-
-    @Override
-    public void handleAborted(GlobalSession globalSession, String reason) {
-    }
-
-    @Override
-    public void handleError(GlobalSession globalSession, Exception ex) {
-    }
-
-    @Override
-    public void handleSuccess(GlobalSession globalSession) {
-    }
-
-    @Override
-    public void handleStageCompleted(Stage currentState,
-                                     GlobalSession globalSession) {
-    }
-
-    @Override
-    public boolean shouldBackOff() {
-      return false;
-    }
-  }
 }
diff --git a/mobile/android/tests/background/junit3/src/testhelpers/DefaultGlobalSessionCallback.java b/mobile/android/tests/background/junit3/src/testhelpers/DefaultGlobalSessionCallback.java
index dddb80f8aede..e1750d16ea0f 100644
--- a/mobile/android/tests/background/junit3/src/testhelpers/DefaultGlobalSessionCallback.java
+++ b/mobile/android/tests/background/junit3/src/testhelpers/DefaultGlobalSessionCallback.java
@@ -60,4 +60,9 @@ public class DefaultGlobalSessionCallback implements GlobalSessionCallback {
   public boolean shouldBackOff() {
     return false;
   }
-}
\ No newline at end of file
+
+  @Override
+  public String nodeWeaveURL() {
+    return null;
+  }
+}
diff --git a/mobile/android/tests/background/junit3/src/testhelpers/MockGlobalSession.java b/mobile/android/tests/background/junit3/src/testhelpers/MockGlobalSession.java
index c3c899ed681e..e8b0921dac61 100644
--- a/mobile/android/tests/background/junit3/src/testhelpers/MockGlobalSession.java
+++ b/mobile/android/tests/background/junit3/src/testhelpers/MockGlobalSession.java
@@ -19,10 +19,10 @@ import org.mozilla.gecko.sync.stage.GlobalSyncStage.Stage;
 
 public class MockGlobalSession extends MockPrefsGlobalSession {
 
-  public MockGlobalSession(String clusterURL, String username, String password,
+  public MockGlobalSession(String username, String password,
       KeyBundle syncKeyBundle, GlobalSessionCallback callback)
           throws SyncConfigurationException, IllegalArgumentException, IOException, ParseException, NonObjectJSONException {
-    super(clusterURL, username, password, null, syncKeyBundle, callback, /* context */ null, null, null);
+    super(username, password, null, syncKeyBundle, callback, /* context */ null, null, null);
   }
 
   @Override
diff --git a/mobile/android/tests/background/junit3/src/testhelpers/MockPrefsGlobalSession.java b/mobile/android/tests/background/junit3/src/testhelpers/MockPrefsGlobalSession.java
index 4c366f525514..5cfedc28eaf1 100644
--- a/mobile/android/tests/background/junit3/src/testhelpers/MockPrefsGlobalSession.java
+++ b/mobile/android/tests/background/junit3/src/testhelpers/MockPrefsGlobalSession.java
@@ -26,23 +26,23 @@ public class MockPrefsGlobalSession extends GlobalSession {
 
   public MockSharedPreferences prefs;
 
-  public MockPrefsGlobalSession(String serverURL,
+  public MockPrefsGlobalSession(
       String username, String password, String prefsPath,
       KeyBundle syncKeyBundle, GlobalSessionCallback callback, Context context,
       Bundle extras, ClientsDataDelegate clientsDelegate)
       throws SyncConfigurationException, IllegalArgumentException, IOException,
       ParseException, NonObjectJSONException {
-    this(serverURL, username, new BasicAuthHeaderProvider(username, password), prefsPath, syncKeyBundle, callback, context, extras, clientsDelegate);
+    this(username, new BasicAuthHeaderProvider(username, password), prefsPath, syncKeyBundle, callback, context, extras, clientsDelegate);
   }
 
-  public MockPrefsGlobalSession(String serverURL,
+  public MockPrefsGlobalSession(
       String username, AuthHeaderProvider authHeaderProvider, String prefsPath,
       KeyBundle syncKeyBundle, GlobalSessionCallback callback, Context context,
       Bundle extras, ClientsDataDelegate clientsDelegate)
       throws SyncConfigurationException, IllegalArgumentException, IOException,
       ParseException, NonObjectJSONException {
-    super(serverURL, username, authHeaderProvider, prefsPath, syncKeyBundle,
-        callback, context, extras, clientsDelegate);
+    super(username, authHeaderProvider, prefsPath, syncKeyBundle,
+        callback, context, extras, clientsDelegate, callback);
   }
 
   @Override

From 1291e1b2482ee7a8f9ef64d98ce492b083edc5e3 Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Mon, 16 Dec 2013 13:31:03 +1300
Subject: [PATCH 438/459] Bug 938107 - Wait for media state machine thread to
 shutdown during XPCOM shutdown before returning. r=roc

Add a MediaShutdownManager and have that as the only xpcom-shutdown
observer. This then shutsdown the MediaDecoders, and blocks waiting for
the media state machine's shared thread to complete shutdown before
exiting from the xpcom-shutdown observer. This ensures that the
MediaDecoder infrastructure does not use XPCOM on any thread after XPCOM
has shutdown, which is a logical error.
---
 content/media/MediaDecoder.cpp             |   6 +-
 content/media/MediaDecoderStateMachine.cpp |  14 +-
 content/media/MediaShutdownManager.cpp     | 236 +++++++++++++++++++++
 content/media/MediaShutdownManager.h       | 167 +++++++++++++++
 content/media/moz.build                    |   1 +
 5 files changed, 414 insertions(+), 10 deletions(-)
 create mode 100644 content/media/MediaShutdownManager.cpp
 create mode 100644 content/media/MediaShutdownManager.h

diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index 9ca3b7ed2ffc..cc6c13b66f65 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -13,7 +13,6 @@
 #include "VideoUtils.h"
 #include "MediaDecoderStateMachine.h"
 #include "mozilla/dom/TimeRanges.h"
-#include "nsContentUtils.h"
 #include "ImageContainer.h"
 #include "MediaResource.h"
 #include "nsError.h"
@@ -23,6 +22,7 @@
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
 #include <algorithm>
+#include "MediaShutdownManager.h"
 
 #ifdef MOZ_WMF
 #include "WMFDecoder.h"
@@ -444,7 +444,7 @@ bool MediaDecoder::Init(MediaDecoderOwner* aOwner)
   MOZ_ASSERT(NS_IsMainThread());
   mOwner = aOwner;
   mVideoFrameContainer = aOwner->GetVideoFrameContainer();
-  nsContentUtils::RegisterShutdownObserver(this);
+  MediaShutdownManager::Instance().Register(this);
   return true;
 }
 
@@ -480,7 +480,7 @@ void MediaDecoder::Shutdown()
   StopProgress();
   mOwner = nullptr;
 
-  nsContentUtils::UnregisterShutdownObserver(this);
+  MediaShutdownManager::Instance().Unregister(this);
 }
 
 MediaDecoder::~MediaDecoder()
diff --git a/content/media/MediaDecoderStateMachine.cpp b/content/media/MediaDecoderStateMachine.cpp
index bcce960333ab..a91aa98e01ba 100644
--- a/content/media/MediaDecoderStateMachine.cpp
+++ b/content/media/MediaDecoderStateMachine.cpp
@@ -26,6 +26,8 @@
 #include "ImageContainer.h"
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
+#include "nsContentUtils.h"
+#include "MediaShutdownManager.h"
 
 #include "prenv.h"
 #include "mozilla/Preferences.h"
@@ -178,7 +180,7 @@ public:
   {
     ReentrantMonitorAutoEnter mon(mMonitor);
     NS_ASSERTION(mStateMachineThread, "Should have non-null state machine thread!");
-    return mStateMachineThread;
+    return mStateMachineThread->GetThread();
   }
 
   // Requests that a decode thread be created for aStateMachine. The thread
@@ -234,7 +236,7 @@ private:
   // Global state machine thread. Write on the main thread
   // only, read from the decoder threads. Synchronized via
   // the mMonitor.
-  nsIThread* mStateMachineThread;
+  nsRefPtr<StateMachineThread> mStateMachineThread;
 
   // Queue of state machines waiting for decode threads. Entries at the front
   // get their threads first.
@@ -258,7 +260,8 @@ void StateMachineTracker::EnsureGlobalStateMachine()
   ReentrantMonitorAutoEnter mon(mMonitor);
   if (mStateMachineCount == 0) {
     NS_ASSERTION(!mStateMachineThread, "Should have null state machine thread!");
-    DebugOnly<nsresult> rv = NS_NewNamedThread("Media State", &mStateMachineThread);
+    mStateMachineThread = new StateMachineThread();
+    DebugOnly<nsresult> rv = mStateMachineThread->Init();
     NS_ABORT_IF_FALSE(NS_SUCCEEDED(rv), "Can't create media state machine thread");
   }
   mStateMachineCount++;
@@ -291,11 +294,8 @@ void StateMachineTracker::CleanupGlobalStateMachine()
     NS_ASSERTION(mPending.GetSize() == 0, "Shouldn't all requests be handled by now?");
     {
       ReentrantMonitorAutoEnter mon(mMonitor);
-      nsCOMPtr<nsIRunnable> event = new ShutdownThreadEvent(mStateMachineThread);
-      NS_RELEASE(mStateMachineThread);
+      mStateMachineThread->Shutdown();
       mStateMachineThread = nullptr;
-      NS_DispatchToMainThread(event);
-
       NS_ASSERTION(mDecodeThreadCount == 0, "Decode thread count must be zero.");
       sInstance = nullptr;
     }
diff --git a/content/media/MediaShutdownManager.cpp b/content/media/MediaShutdownManager.cpp
new file mode 100644
index 000000000000..b065ac68c548
--- /dev/null
+++ b/content/media/MediaShutdownManager.cpp
@@ -0,0 +1,236 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MediaShutdownManager.h"
+#include "nsContentUtils.h"
+#include "mozilla/StaticPtr.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "MediaDecoder.h"
+
+namespace mozilla {
+
+StateMachineThread::StateMachineThread()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_CTOR(StateMachineThread);
+}
+
+StateMachineThread::~StateMachineThread()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_DTOR(StateMachineThread);
+}
+
+void
+StateMachineThread::Shutdown()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mThread);
+  if (mThread) {
+    nsCOMPtr<nsIRunnable> event =
+      NS_NewRunnableMethod(this, &StateMachineThread::ShutdownThread);
+    NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
+  }
+}
+
+void
+StateMachineThread::ShutdownThread()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mThread);
+  mThread->Shutdown();
+  mThread = nullptr;
+  MediaShutdownManager::Instance().Unregister(this);
+}
+
+nsresult
+StateMachineThread::Init()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  nsresult rv = NS_NewNamedThread("Media State", getter_AddRefs(mThread));
+  NS_ENSURE_SUCCESS(rv, rv);
+  MediaShutdownManager::Instance().Register(this);
+  return NS_OK;
+}
+
+nsIThread*
+StateMachineThread::GetThread()
+{
+  MOZ_ASSERT(mThread);
+  return mThread;
+}
+
+void
+StateMachineThread::SpinUntilShutdownComplete()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  while (mThread) {
+    bool processed = false;
+    nsresult rv = NS_GetCurrentThread()->ProcessNextEvent(true, &processed);
+    if (NS_FAILED(rv)) {
+      NS_WARNING("Failed to spin main thread while awaiting media shutdown");
+      break;
+    }
+  }
+}
+
+NS_IMPL_ISUPPORTS1(MediaShutdownManager, nsIObserver)
+
+MediaShutdownManager::MediaShutdownManager()
+  : mIsObservingShutdown(false),
+    mIsDoingXPCOMShutDown(false)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_CTOR(MediaShutdownManager);
+}
+
+MediaShutdownManager::~MediaShutdownManager()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_DTOR(MediaShutdownManager);
+}
+
+// Note that we don't use ClearOnShutdown() on this StaticRefPtr, as that
+// may interfere with our shutdown listener.
+StaticRefPtr<MediaShutdownManager> MediaShutdownManager::sInstance;
+
+MediaShutdownManager&
+MediaShutdownManager::Instance()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (!sInstance) {
+    sInstance = new MediaShutdownManager();
+  }
+  return *sInstance;
+}
+
+void
+MediaShutdownManager::EnsureCorrectShutdownObserverState()
+{
+  MOZ_ASSERT(!mIsDoingXPCOMShutDown);
+  bool needShutdownObserver = (mDecoders.Count() > 0) ||
+                              (mStateMachineThreads.Count() > 0);
+  if (needShutdownObserver != mIsObservingShutdown) {
+    mIsObservingShutdown = needShutdownObserver;
+    if (mIsObservingShutdown) {
+      nsContentUtils::RegisterShutdownObserver(this);
+    } else {
+      nsContentUtils::UnregisterShutdownObserver(this);
+      // Clear our singleton reference. This will probably delete
+      // this instance, so don't deref |this| clearing sInstance.
+      sInstance = nullptr;
+    }
+  }
+}
+
+void
+MediaShutdownManager::Register(MediaDecoder* aDecoder)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  // Don't call Register() after you've Unregistered() all the decoders,
+  // that's not going to work.
+  MOZ_ASSERT(!mDecoders.Contains(aDecoder));
+  mDecoders.PutEntry(aDecoder);
+  MOZ_ASSERT(mDecoders.Contains(aDecoder));
+  MOZ_ASSERT(mDecoders.Count() > 0);
+  EnsureCorrectShutdownObserverState();
+}
+
+void
+MediaShutdownManager::Unregister(MediaDecoder* aDecoder)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mDecoders.Contains(aDecoder));
+  if (!mIsDoingXPCOMShutDown) {
+    mDecoders.RemoveEntry(aDecoder);
+    EnsureCorrectShutdownObserverState();
+  }
+}
+
+NS_IMETHODIMP
+MediaShutdownManager::Observe(nsISupports *aSubjet,
+                              const char *aTopic,
+                              const PRUnichar *someData)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
+    Shutdown();
+  }
+  return NS_OK;
+}
+
+void
+MediaShutdownManager::Register(StateMachineThread* aThread)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!mStateMachineThreads.Contains(aThread));
+  mStateMachineThreads.PutEntry(aThread);
+  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
+  MOZ_ASSERT(mStateMachineThreads.Count() > 0);
+  EnsureCorrectShutdownObserverState();
+}
+
+void
+MediaShutdownManager::Unregister(StateMachineThread* aThread)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
+  if (!mIsDoingXPCOMShutDown) {
+    mStateMachineThreads.RemoveEntry(aThread);
+    EnsureCorrectShutdownObserverState();
+  }
+}
+
+static PLDHashOperator
+ShutdownMediaDecoder(nsPtrHashKey<MediaDecoder>* aEntry, void*)
+{
+  aEntry->GetKey()->Shutdown();
+  return PL_DHASH_REMOVE;
+}
+
+static PLDHashOperator
+JoinStateMachineThreads(nsRefPtrHashKey<StateMachineThread>* aEntry, void*)
+{
+  aEntry->GetKey()->SpinUntilShutdownComplete();
+  return PL_DHASH_REMOVE;
+}
+
+void
+MediaShutdownManager::Shutdown()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(sInstance);
+
+  // Mark that we're shutting down, so that Unregister(*) calls don't remove
+  // hashtable entries. If Unregsiter(*) was to remove from the hash table,
+  // the iterations over the hashtables below would be disrupted.
+  mIsDoingXPCOMShutDown = true;
+
+  // Iterate over the decoders and shut them down, and remove them from the
+  // hashtable.
+  mDecoders.EnumerateEntries(ShutdownMediaDecoder, nullptr);
+  MOZ_ASSERT(mDecoders.Count() == 0);
+
+  // Iterate over the StateMachineThreads and wait for them to have finished
+  // shutting down, and remove them from the hashtable. Once all the decoders
+  // have shutdown the active state machine thread will naturally shutdown
+  // asynchronously. We may also have another state machine thread active,
+  // if construction and shutdown of the state machine thread has interleaved.
+  mStateMachineThreads.EnumerateEntries(JoinStateMachineThreads, nullptr);
+  MOZ_ASSERT(mStateMachineThreads.Count() == 0);
+
+  // Remove the MediaShutdownManager instance from the shutdown observer
+  // list.
+  nsContentUtils::UnregisterShutdownObserver(this);
+
+  // Clear the singleton instance. The only remaining reference should be the
+  // reference that the observer service used to call us with. The
+  // MediaShutdownManager will be deleted once the observer service cleans
+  // up after it finishes its notifications.
+  sInstance = nullptr;
+}
+
+} // namespace mozilla
diff --git a/content/media/MediaShutdownManager.h b/content/media/MediaShutdownManager.h
new file mode 100644
index 000000000000..ec6f21ff7cfc
--- /dev/null
+++ b/content/media/MediaShutdownManager.h
@@ -0,0 +1,167 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(MediaShutdownManager_h_)
+#define MediaShutdownManager_h_
+
+#include "nsIObserver.h"
+#include "mozilla/Monitor.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/StaticPtr.h"
+#include "nsIThread.h"
+#include "nsCOMPtr.h"
+#include "nsTHashtable.h"
+
+namespace mozilla {
+
+class MediaDecoder;
+class StateMachineThread;
+
+// The MediaShutdownManager manages shutting down the MediaDecoder
+// infrastructure in response to an xpcom-shutdown notification. This happens
+// when Gecko is shutting down in the middle of operation. This is tricky, as
+// there are a number of moving parts that must be shutdown in a particular
+// order. Additionally the xpcom-shutdown observer *must* block until all
+// threads are shutdown, which is tricky since we have a number of threads
+// here and their shutdown is asynchronous. We can't have each element of
+// our pipeline listening for xpcom-shutdown, as if each observer blocks
+// waiting for its threads to shutdown it will block other xpcom-shutdown
+// notifications from firing, and shutdown of one part of the media pipeline
+// (say the State Machine thread) may depend another part to be shutdown
+// first (the MediaDecoder threads). Additionally we need to not interfere
+// with shutdown in the the non-xpcom-shutdown case, where we need to be able
+// to recreate the State Machine thread after it's been destroyed without
+// affecting the shutdown of the old State Machine thread. The
+// MediaShutdownManager encapsulates all these dependencies, and provides
+// a single xpcom-shutdown listener for the MediaDecoder infrastructure, to
+// ensure that no shutdown order dependencies leak out of the MediaDecoder
+// stack. The MediaShutdownManager is a singleton.
+//
+// The MediaShutdownManager ensures that the MediaDecoder stack is shutdown
+// before returning from its xpcom-shutdown observer by keeping track of all
+// the active MediaDecoders, and upon xpcom-shutdown calling Shutdown() on
+// every MediaDecoder and then spinning the main thread event loop until the
+// State Machine thread has shutdown. Once the State Machine thread has been
+// shutdown, the xpcom-shutdown observer returns.
+//
+// Note that calling the Unregister() functions may result in the singleton
+// being deleted, so don't store references to the singleton, always use the
+// singleton by derefing the referenced returned by
+// MediaShutdownManager::Instance(), which ensures that the singleton is
+// created when needed.
+// i.e. like this:
+//    MediaShutdownManager::Instance()::Unregister(someDecoder);
+//    MediaShutdownManager::Instance()::Register(someOtherDecoder);
+// Not like this:
+//  MediaShutdownManager& instance = MediaShutdownManager::Instance();
+//  instance.Unregister(someDecoder); // Warning! May delete instance!
+//  instance.Register(someOtherDecoder); // BAD! instance may be dangling!
+class MediaShutdownManager : public nsIObserver {
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
+  // The MediaShutdownManager is a singleton, access its instance with
+  // this accessor.
+  static MediaShutdownManager& Instance();
+
+  // Notifies the MediaShutdownManager that it needs to track the shutdown
+  // of this MediaDecoder.
+  void Register(MediaDecoder* aDecoder);
+
+  // Notifies the MediaShutdownManager that a MediaDecoder that it was
+  // tracking has shutdown, and it no longer needs to be shutdown in the
+  // xpcom-shutdown listener.
+  void Unregister(MediaDecoder* aDecoder);
+
+  // Notifies the MediaShutdownManager of a state machine thread that
+  // must be tracked. Note that we track State Machine threads individually
+  // as their shutdown and the construction of a new state machine thread
+  // can interleave. This stores a strong ref to the state machine.
+  void Register(StateMachineThread* aThread);
+
+  // Notifies the MediaShutdownManager that a StateMachineThread that it was
+  // tracking has shutdown, and it no longer needs to be shutdown in the
+  // xpcom-shutdown listener. This drops the strong reference to the
+  // StateMachineThread, which may destroy it.
+  void Unregister(StateMachineThread* aThread);
+
+private:
+
+  MediaShutdownManager();
+  virtual ~MediaShutdownManager();
+
+  void Shutdown();
+
+  // Ensures we have a shutdown listener if we need one, and removes the
+  // listener and destroys the singleton if we don't.
+  void EnsureCorrectShutdownObserverState();
+
+  static StaticRefPtr<MediaShutdownManager> sInstance;
+
+  // Note: These are deliberately weak references! The MediaDecoders must
+  // unregister themselves before they're deleted.
+  nsTHashtable<nsPtrHashKey<MediaDecoder>> mDecoders;
+
+  // References to the state machine threads that we're tracking shutdown
+  // of. Note that although there is supposed to be a single state machine,
+  // the construction and shutdown of these can interleave, so we must track
+  // individual instances of the state machine threads.
+  // These are strong references.
+  nsTHashtable<nsRefPtrHashKey<StateMachineThread>> mStateMachineThreads;
+
+  // True if we have an XPCOM shutdown observer.
+  bool mIsObservingShutdown;
+
+  bool mIsDoingXPCOMShutDown;
+};
+
+// A wrapper for the state machine thread. We must wrap this so that the
+// state machine threads can shutdown independently from the
+// StateMachineTracker, under the control of the MediaShutdownManager.
+// The state machine thread is shutdown naturally when all decoders
+// complete their shutdown. So if a new decoder is created just as the
+// old state machine thread has shutdown, we need to be able to shutdown
+// the old state machine thread independently of the StateMachineTracker
+// creating a new state machine thread. Also if this happens we need to
+// be able to force both state machine threads to shutdown in the
+// MediaShutdownManager, which is why we maintain a set of state machine
+// threads, even though there's supposed to only be one alive at once.
+// This class does not enforce its own thread safety, the StateMachineTracker
+// ensures thread safety when it uses the StateMachineThread.
+class StateMachineThread {
+public:
+  StateMachineThread();
+  ~StateMachineThread();
+
+  NS_INLINE_DECL_REFCOUNTING(StateMachineThread);
+
+  // Creates the wrapped thread.
+  nsresult Init();
+
+  // Returns a reference to the underlying thread. Don't shut this down
+  // directly, use StateMachineThread::Shutdown() instead.
+  nsIThread* GetThread();
+
+  // Dispatches an event to the main thread to shutdown the wrapped thread.
+  // The owner's (StateMachineTracker's) reference to the StateMachineThread
+  // can be dropped, the StateMachineThread will shutdown itself
+  // asynchronously.
+  void Shutdown();
+
+  // Processes events on the main thread event loop until this thread
+  // has been shutdown. Use this to block until the asynchronous shutdown
+  // has complete.
+  void SpinUntilShutdownComplete();
+
+private:
+  void ShutdownThread();
+  nsCOMPtr<nsIThread> mThread;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/moz.build b/content/media/moz.build
index b09fbca9bb3f..fe8615003992 100644
--- a/content/media/moz.build
+++ b/content/media/moz.build
@@ -123,6 +123,7 @@ UNIFIED_SOURCES += [
     'MediaDecoderStateMachine.cpp',
     'MediaRecorder.cpp',
     'MediaResource.cpp',
+    'MediaShutdownManager.cpp',
     'MediaStreamGraph.cpp',
     'MediaStreamTrack.cpp',
     'MP3FrameParser.cpp',

From cabe53fbe0d219d0e73190d84dd6fce0de506c5f Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Mon, 16 Dec 2013 13:48:54 +1300
Subject: [PATCH 439/459] Bug 938107 - Backed out changeset 7aff3ce81046 for
 bustage. r=bustage.

---
 content/media/MediaDecoder.cpp             |   6 +-
 content/media/MediaDecoderStateMachine.cpp |  14 +-
 content/media/MediaShutdownManager.cpp     | 236 ---------------------
 content/media/MediaShutdownManager.h       | 167 ---------------
 content/media/moz.build                    |   1 -
 5 files changed, 10 insertions(+), 414 deletions(-)
 delete mode 100644 content/media/MediaShutdownManager.cpp
 delete mode 100644 content/media/MediaShutdownManager.h

diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index cc6c13b66f65..9ca3b7ed2ffc 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -13,6 +13,7 @@
 #include "VideoUtils.h"
 #include "MediaDecoderStateMachine.h"
 #include "mozilla/dom/TimeRanges.h"
+#include "nsContentUtils.h"
 #include "ImageContainer.h"
 #include "MediaResource.h"
 #include "nsError.h"
@@ -22,7 +23,6 @@
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
 #include <algorithm>
-#include "MediaShutdownManager.h"
 
 #ifdef MOZ_WMF
 #include "WMFDecoder.h"
@@ -444,7 +444,7 @@ bool MediaDecoder::Init(MediaDecoderOwner* aOwner)
   MOZ_ASSERT(NS_IsMainThread());
   mOwner = aOwner;
   mVideoFrameContainer = aOwner->GetVideoFrameContainer();
-  MediaShutdownManager::Instance().Register(this);
+  nsContentUtils::RegisterShutdownObserver(this);
   return true;
 }
 
@@ -480,7 +480,7 @@ void MediaDecoder::Shutdown()
   StopProgress();
   mOwner = nullptr;
 
-  MediaShutdownManager::Instance().Unregister(this);
+  nsContentUtils::UnregisterShutdownObserver(this);
 }
 
 MediaDecoder::~MediaDecoder()
diff --git a/content/media/MediaDecoderStateMachine.cpp b/content/media/MediaDecoderStateMachine.cpp
index a91aa98e01ba..bcce960333ab 100644
--- a/content/media/MediaDecoderStateMachine.cpp
+++ b/content/media/MediaDecoderStateMachine.cpp
@@ -26,8 +26,6 @@
 #include "ImageContainer.h"
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
-#include "nsContentUtils.h"
-#include "MediaShutdownManager.h"
 
 #include "prenv.h"
 #include "mozilla/Preferences.h"
@@ -180,7 +178,7 @@ public:
   {
     ReentrantMonitorAutoEnter mon(mMonitor);
     NS_ASSERTION(mStateMachineThread, "Should have non-null state machine thread!");
-    return mStateMachineThread->GetThread();
+    return mStateMachineThread;
   }
 
   // Requests that a decode thread be created for aStateMachine. The thread
@@ -236,7 +234,7 @@ private:
   // Global state machine thread. Write on the main thread
   // only, read from the decoder threads. Synchronized via
   // the mMonitor.
-  nsRefPtr<StateMachineThread> mStateMachineThread;
+  nsIThread* mStateMachineThread;
 
   // Queue of state machines waiting for decode threads. Entries at the front
   // get their threads first.
@@ -260,8 +258,7 @@ void StateMachineTracker::EnsureGlobalStateMachine()
   ReentrantMonitorAutoEnter mon(mMonitor);
   if (mStateMachineCount == 0) {
     NS_ASSERTION(!mStateMachineThread, "Should have null state machine thread!");
-    mStateMachineThread = new StateMachineThread();
-    DebugOnly<nsresult> rv = mStateMachineThread->Init();
+    DebugOnly<nsresult> rv = NS_NewNamedThread("Media State", &mStateMachineThread);
     NS_ABORT_IF_FALSE(NS_SUCCEEDED(rv), "Can't create media state machine thread");
   }
   mStateMachineCount++;
@@ -294,8 +291,11 @@ void StateMachineTracker::CleanupGlobalStateMachine()
     NS_ASSERTION(mPending.GetSize() == 0, "Shouldn't all requests be handled by now?");
     {
       ReentrantMonitorAutoEnter mon(mMonitor);
-      mStateMachineThread->Shutdown();
+      nsCOMPtr<nsIRunnable> event = new ShutdownThreadEvent(mStateMachineThread);
+      NS_RELEASE(mStateMachineThread);
       mStateMachineThread = nullptr;
+      NS_DispatchToMainThread(event);
+
       NS_ASSERTION(mDecodeThreadCount == 0, "Decode thread count must be zero.");
       sInstance = nullptr;
     }
diff --git a/content/media/MediaShutdownManager.cpp b/content/media/MediaShutdownManager.cpp
deleted file mode 100644
index b065ac68c548..000000000000
--- a/content/media/MediaShutdownManager.cpp
+++ /dev/null
@@ -1,236 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et cindent: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "MediaShutdownManager.h"
-#include "nsContentUtils.h"
-#include "mozilla/StaticPtr.h"
-#include "mozilla/ClearOnShutdown.h"
-#include "MediaDecoder.h"
-
-namespace mozilla {
-
-StateMachineThread::StateMachineThread()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_CTOR(StateMachineThread);
-}
-
-StateMachineThread::~StateMachineThread()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_DTOR(StateMachineThread);
-}
-
-void
-StateMachineThread::Shutdown()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mThread);
-  if (mThread) {
-    nsCOMPtr<nsIRunnable> event =
-      NS_NewRunnableMethod(this, &StateMachineThread::ShutdownThread);
-    NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
-  }
-}
-
-void
-StateMachineThread::ShutdownThread()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mThread);
-  mThread->Shutdown();
-  mThread = nullptr;
-  MediaShutdownManager::Instance().Unregister(this);
-}
-
-nsresult
-StateMachineThread::Init()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  nsresult rv = NS_NewNamedThread("Media State", getter_AddRefs(mThread));
-  NS_ENSURE_SUCCESS(rv, rv);
-  MediaShutdownManager::Instance().Register(this);
-  return NS_OK;
-}
-
-nsIThread*
-StateMachineThread::GetThread()
-{
-  MOZ_ASSERT(mThread);
-  return mThread;
-}
-
-void
-StateMachineThread::SpinUntilShutdownComplete()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  while (mThread) {
-    bool processed = false;
-    nsresult rv = NS_GetCurrentThread()->ProcessNextEvent(true, &processed);
-    if (NS_FAILED(rv)) {
-      NS_WARNING("Failed to spin main thread while awaiting media shutdown");
-      break;
-    }
-  }
-}
-
-NS_IMPL_ISUPPORTS1(MediaShutdownManager, nsIObserver)
-
-MediaShutdownManager::MediaShutdownManager()
-  : mIsObservingShutdown(false),
-    mIsDoingXPCOMShutDown(false)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_CTOR(MediaShutdownManager);
-}
-
-MediaShutdownManager::~MediaShutdownManager()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_DTOR(MediaShutdownManager);
-}
-
-// Note that we don't use ClearOnShutdown() on this StaticRefPtr, as that
-// may interfere with our shutdown listener.
-StaticRefPtr<MediaShutdownManager> MediaShutdownManager::sInstance;
-
-MediaShutdownManager&
-MediaShutdownManager::Instance()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  if (!sInstance) {
-    sInstance = new MediaShutdownManager();
-  }
-  return *sInstance;
-}
-
-void
-MediaShutdownManager::EnsureCorrectShutdownObserverState()
-{
-  MOZ_ASSERT(!mIsDoingXPCOMShutDown);
-  bool needShutdownObserver = (mDecoders.Count() > 0) ||
-                              (mStateMachineThreads.Count() > 0);
-  if (needShutdownObserver != mIsObservingShutdown) {
-    mIsObservingShutdown = needShutdownObserver;
-    if (mIsObservingShutdown) {
-      nsContentUtils::RegisterShutdownObserver(this);
-    } else {
-      nsContentUtils::UnregisterShutdownObserver(this);
-      // Clear our singleton reference. This will probably delete
-      // this instance, so don't deref |this| clearing sInstance.
-      sInstance = nullptr;
-    }
-  }
-}
-
-void
-MediaShutdownManager::Register(MediaDecoder* aDecoder)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  // Don't call Register() after you've Unregistered() all the decoders,
-  // that's not going to work.
-  MOZ_ASSERT(!mDecoders.Contains(aDecoder));
-  mDecoders.PutEntry(aDecoder);
-  MOZ_ASSERT(mDecoders.Contains(aDecoder));
-  MOZ_ASSERT(mDecoders.Count() > 0);
-  EnsureCorrectShutdownObserverState();
-}
-
-void
-MediaShutdownManager::Unregister(MediaDecoder* aDecoder)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mDecoders.Contains(aDecoder));
-  if (!mIsDoingXPCOMShutDown) {
-    mDecoders.RemoveEntry(aDecoder);
-    EnsureCorrectShutdownObserverState();
-  }
-}
-
-NS_IMETHODIMP
-MediaShutdownManager::Observe(nsISupports *aSubjet,
-                              const char *aTopic,
-                              const PRUnichar *someData)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
-    Shutdown();
-  }
-  return NS_OK;
-}
-
-void
-MediaShutdownManager::Register(StateMachineThread* aThread)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(!mStateMachineThreads.Contains(aThread));
-  mStateMachineThreads.PutEntry(aThread);
-  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
-  MOZ_ASSERT(mStateMachineThreads.Count() > 0);
-  EnsureCorrectShutdownObserverState();
-}
-
-void
-MediaShutdownManager::Unregister(StateMachineThread* aThread)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
-  if (!mIsDoingXPCOMShutDown) {
-    mStateMachineThreads.RemoveEntry(aThread);
-    EnsureCorrectShutdownObserverState();
-  }
-}
-
-static PLDHashOperator
-ShutdownMediaDecoder(nsPtrHashKey<MediaDecoder>* aEntry, void*)
-{
-  aEntry->GetKey()->Shutdown();
-  return PL_DHASH_REMOVE;
-}
-
-static PLDHashOperator
-JoinStateMachineThreads(nsRefPtrHashKey<StateMachineThread>* aEntry, void*)
-{
-  aEntry->GetKey()->SpinUntilShutdownComplete();
-  return PL_DHASH_REMOVE;
-}
-
-void
-MediaShutdownManager::Shutdown()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(sInstance);
-
-  // Mark that we're shutting down, so that Unregister(*) calls don't remove
-  // hashtable entries. If Unregsiter(*) was to remove from the hash table,
-  // the iterations over the hashtables below would be disrupted.
-  mIsDoingXPCOMShutDown = true;
-
-  // Iterate over the decoders and shut them down, and remove them from the
-  // hashtable.
-  mDecoders.EnumerateEntries(ShutdownMediaDecoder, nullptr);
-  MOZ_ASSERT(mDecoders.Count() == 0);
-
-  // Iterate over the StateMachineThreads and wait for them to have finished
-  // shutting down, and remove them from the hashtable. Once all the decoders
-  // have shutdown the active state machine thread will naturally shutdown
-  // asynchronously. We may also have another state machine thread active,
-  // if construction and shutdown of the state machine thread has interleaved.
-  mStateMachineThreads.EnumerateEntries(JoinStateMachineThreads, nullptr);
-  MOZ_ASSERT(mStateMachineThreads.Count() == 0);
-
-  // Remove the MediaShutdownManager instance from the shutdown observer
-  // list.
-  nsContentUtils::UnregisterShutdownObserver(this);
-
-  // Clear the singleton instance. The only remaining reference should be the
-  // reference that the observer service used to call us with. The
-  // MediaShutdownManager will be deleted once the observer service cleans
-  // up after it finishes its notifications.
-  sInstance = nullptr;
-}
-
-} // namespace mozilla
diff --git a/content/media/MediaShutdownManager.h b/content/media/MediaShutdownManager.h
deleted file mode 100644
index ec6f21ff7cfc..000000000000
--- a/content/media/MediaShutdownManager.h
+++ /dev/null
@@ -1,167 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et cindent: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#if !defined(MediaShutdownManager_h_)
-#define MediaShutdownManager_h_
-
-#include "nsIObserver.h"
-#include "mozilla/Monitor.h"
-#include "mozilla/RefPtr.h"
-#include "mozilla/StaticPtr.h"
-#include "nsIThread.h"
-#include "nsCOMPtr.h"
-#include "nsTHashtable.h"
-
-namespace mozilla {
-
-class MediaDecoder;
-class StateMachineThread;
-
-// The MediaShutdownManager manages shutting down the MediaDecoder
-// infrastructure in response to an xpcom-shutdown notification. This happens
-// when Gecko is shutting down in the middle of operation. This is tricky, as
-// there are a number of moving parts that must be shutdown in a particular
-// order. Additionally the xpcom-shutdown observer *must* block until all
-// threads are shutdown, which is tricky since we have a number of threads
-// here and their shutdown is asynchronous. We can't have each element of
-// our pipeline listening for xpcom-shutdown, as if each observer blocks
-// waiting for its threads to shutdown it will block other xpcom-shutdown
-// notifications from firing, and shutdown of one part of the media pipeline
-// (say the State Machine thread) may depend another part to be shutdown
-// first (the MediaDecoder threads). Additionally we need to not interfere
-// with shutdown in the the non-xpcom-shutdown case, where we need to be able
-// to recreate the State Machine thread after it's been destroyed without
-// affecting the shutdown of the old State Machine thread. The
-// MediaShutdownManager encapsulates all these dependencies, and provides
-// a single xpcom-shutdown listener for the MediaDecoder infrastructure, to
-// ensure that no shutdown order dependencies leak out of the MediaDecoder
-// stack. The MediaShutdownManager is a singleton.
-//
-// The MediaShutdownManager ensures that the MediaDecoder stack is shutdown
-// before returning from its xpcom-shutdown observer by keeping track of all
-// the active MediaDecoders, and upon xpcom-shutdown calling Shutdown() on
-// every MediaDecoder and then spinning the main thread event loop until the
-// State Machine thread has shutdown. Once the State Machine thread has been
-// shutdown, the xpcom-shutdown observer returns.
-//
-// Note that calling the Unregister() functions may result in the singleton
-// being deleted, so don't store references to the singleton, always use the
-// singleton by derefing the referenced returned by
-// MediaShutdownManager::Instance(), which ensures that the singleton is
-// created when needed.
-// i.e. like this:
-//    MediaShutdownManager::Instance()::Unregister(someDecoder);
-//    MediaShutdownManager::Instance()::Register(someOtherDecoder);
-// Not like this:
-//  MediaShutdownManager& instance = MediaShutdownManager::Instance();
-//  instance.Unregister(someDecoder); // Warning! May delete instance!
-//  instance.Register(someOtherDecoder); // BAD! instance may be dangling!
-class MediaShutdownManager : public nsIObserver {
-public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIOBSERVER
-
-  // The MediaShutdownManager is a singleton, access its instance with
-  // this accessor.
-  static MediaShutdownManager& Instance();
-
-  // Notifies the MediaShutdownManager that it needs to track the shutdown
-  // of this MediaDecoder.
-  void Register(MediaDecoder* aDecoder);
-
-  // Notifies the MediaShutdownManager that a MediaDecoder that it was
-  // tracking has shutdown, and it no longer needs to be shutdown in the
-  // xpcom-shutdown listener.
-  void Unregister(MediaDecoder* aDecoder);
-
-  // Notifies the MediaShutdownManager of a state machine thread that
-  // must be tracked. Note that we track State Machine threads individually
-  // as their shutdown and the construction of a new state machine thread
-  // can interleave. This stores a strong ref to the state machine.
-  void Register(StateMachineThread* aThread);
-
-  // Notifies the MediaShutdownManager that a StateMachineThread that it was
-  // tracking has shutdown, and it no longer needs to be shutdown in the
-  // xpcom-shutdown listener. This drops the strong reference to the
-  // StateMachineThread, which may destroy it.
-  void Unregister(StateMachineThread* aThread);
-
-private:
-
-  MediaShutdownManager();
-  virtual ~MediaShutdownManager();
-
-  void Shutdown();
-
-  // Ensures we have a shutdown listener if we need one, and removes the
-  // listener and destroys the singleton if we don't.
-  void EnsureCorrectShutdownObserverState();
-
-  static StaticRefPtr<MediaShutdownManager> sInstance;
-
-  // Note: These are deliberately weak references! The MediaDecoders must
-  // unregister themselves before they're deleted.
-  nsTHashtable<nsPtrHashKey<MediaDecoder>> mDecoders;
-
-  // References to the state machine threads that we're tracking shutdown
-  // of. Note that although there is supposed to be a single state machine,
-  // the construction and shutdown of these can interleave, so we must track
-  // individual instances of the state machine threads.
-  // These are strong references.
-  nsTHashtable<nsRefPtrHashKey<StateMachineThread>> mStateMachineThreads;
-
-  // True if we have an XPCOM shutdown observer.
-  bool mIsObservingShutdown;
-
-  bool mIsDoingXPCOMShutDown;
-};
-
-// A wrapper for the state machine thread. We must wrap this so that the
-// state machine threads can shutdown independently from the
-// StateMachineTracker, under the control of the MediaShutdownManager.
-// The state machine thread is shutdown naturally when all decoders
-// complete their shutdown. So if a new decoder is created just as the
-// old state machine thread has shutdown, we need to be able to shutdown
-// the old state machine thread independently of the StateMachineTracker
-// creating a new state machine thread. Also if this happens we need to
-// be able to force both state machine threads to shutdown in the
-// MediaShutdownManager, which is why we maintain a set of state machine
-// threads, even though there's supposed to only be one alive at once.
-// This class does not enforce its own thread safety, the StateMachineTracker
-// ensures thread safety when it uses the StateMachineThread.
-class StateMachineThread {
-public:
-  StateMachineThread();
-  ~StateMachineThread();
-
-  NS_INLINE_DECL_REFCOUNTING(StateMachineThread);
-
-  // Creates the wrapped thread.
-  nsresult Init();
-
-  // Returns a reference to the underlying thread. Don't shut this down
-  // directly, use StateMachineThread::Shutdown() instead.
-  nsIThread* GetThread();
-
-  // Dispatches an event to the main thread to shutdown the wrapped thread.
-  // The owner's (StateMachineTracker's) reference to the StateMachineThread
-  // can be dropped, the StateMachineThread will shutdown itself
-  // asynchronously.
-  void Shutdown();
-
-  // Processes events on the main thread event loop until this thread
-  // has been shutdown. Use this to block until the asynchronous shutdown
-  // has complete.
-  void SpinUntilShutdownComplete();
-
-private:
-  void ShutdownThread();
-  nsCOMPtr<nsIThread> mThread;
-};
-
-} // namespace mozilla
-
-#endif
diff --git a/content/media/moz.build b/content/media/moz.build
index fe8615003992..b09fbca9bb3f 100644
--- a/content/media/moz.build
+++ b/content/media/moz.build
@@ -123,7 +123,6 @@ UNIFIED_SOURCES += [
     'MediaDecoderStateMachine.cpp',
     'MediaRecorder.cpp',
     'MediaResource.cpp',
-    'MediaShutdownManager.cpp',
     'MediaStreamGraph.cpp',
     'MediaStreamTrack.cpp',
     'MP3FrameParser.cpp',

From d0580aac77d1b627a1b7e8627b14d5e969700d53 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sun, 15 Dec 2013 17:15:24 -0800
Subject: [PATCH 440/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/054b7aea884b
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Merge pull request #14617 from Rik/move-status-messages-949542

Bug 949542 - Status messages are a bit too high r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/9540dd67f8a7
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Bug 949542 - Status messages are a bit too high

========

https://hg.mozilla.org/integration/gaia-central/rev/32a0985c1b98
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Merge pull request #14614 from Rik/call-screen-banner-multiline-946742

Bug 946742 - Message overlapped during multiparty when a call is released r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/66d405973b78
Author: Anthony Ricaud <anthony@ricaud.me>
Desc: Bug 946742 - Message overlapped during multiparty when a call is released
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ce46db44bbc3..969802ee5b60 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "f88be8e2bdfecbd76666fd486bd54fd7276f99c1", 
+    "revision": "054b7aea884b244d9d6303e8b7361104734d631c", 
     "repo_path": "/integration/gaia-central"
 }

From 2476fccfbd2559a854950793ede9470a26662884 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sun, 15 Dec 2013 18:05:28 -0800
Subject: [PATCH 441/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/345f69046067
Author: George <georgeiscoming@gmail.com>
Desc: Merge pull request #14641 from cctuan/949966

Bug 949966 - [Gallery] empty message of delete dialog

========

https://hg.mozilla.org/integration/gaia-central/rev/dad53410a020
Author: cctuan <georgeiscoming@gmail.com>
Desc: Bug 949966 - [Gallery] empty message of delete dialog
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 969802ee5b60..9130bece3b05 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "054b7aea884b244d9d6303e8b7361104734d631c", 
+    "revision": "345f6904606712c9029d13a19bb59f93616aa18d", 
     "repo_path": "/integration/gaia-central"
 }

From 19b29c1ae28dcd2a9668f6e079326220d4d2b1a4 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sun, 15 Dec 2013 18:30:23 -0800
Subject: [PATCH 442/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/a8f8d540eb85
Author: gasolin <gasolin@gmail.com>
Desc: Merge pull request #14681 from gasolin/issue-950082

Revert "Merge pull request #13875 from gasolin/issue-939011"

========

https://hg.mozilla.org/integration/gaia-central/rev/ba8d8fc12ace
Author: gasolin <gasolin@gmail.com>
Desc: Revert "Merge pull request #13875 from gasolin/issue-939011"

This reverts commit 204d32ec1dfa27d87b8ee43ae17b65c005c52b45, reversing
changes made to 97fe3c8a60623821fd0ec265fb11786c3ab50431.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 9130bece3b05..54f89799b6f5 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "345f6904606712c9029d13a19bb59f93616aa18d", 
+    "revision": "a8f8d540eb85be0e7eeda4932cd68b9bea9fc71e", 
     "repo_path": "/integration/gaia-central"
 }

From c50e895de82c0de850c933d1fbbe0808489a61dc Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Mon, 16 Dec 2013 15:52:59 +1300
Subject: [PATCH 443/459] Bug 938108 - Wait for media state machine thread to
 shutdown during XPCOM shutdown before returning. r=roc

Add a MediaShutdownManager and have that as the only xpcom-shutdown
observer. This then shutsdown the MediaDecoders, and blocks waiting for
the media state machine's shared thread to complete shutdown before
exiting from the xpcom-shutdown observer. This ensures that the
MediaDecoder infrastructure does not use XPCOM on any thread after XPCOM
has shutdown, which is a logical error.
---
 content/media/MediaDecoder.cpp             |   6 +-
 content/media/MediaDecoderStateMachine.cpp |  14 +-
 content/media/MediaShutdownManager.cpp     | 236 +++++++++++++++++++++
 content/media/MediaShutdownManager.h       | 168 +++++++++++++++
 content/media/moz.build                    |   1 +
 5 files changed, 415 insertions(+), 10 deletions(-)
 create mode 100644 content/media/MediaShutdownManager.cpp
 create mode 100644 content/media/MediaShutdownManager.h

diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index 9ca3b7ed2ffc..cc6c13b66f65 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -13,7 +13,6 @@
 #include "VideoUtils.h"
 #include "MediaDecoderStateMachine.h"
 #include "mozilla/dom/TimeRanges.h"
-#include "nsContentUtils.h"
 #include "ImageContainer.h"
 #include "MediaResource.h"
 #include "nsError.h"
@@ -23,6 +22,7 @@
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
 #include <algorithm>
+#include "MediaShutdownManager.h"
 
 #ifdef MOZ_WMF
 #include "WMFDecoder.h"
@@ -444,7 +444,7 @@ bool MediaDecoder::Init(MediaDecoderOwner* aOwner)
   MOZ_ASSERT(NS_IsMainThread());
   mOwner = aOwner;
   mVideoFrameContainer = aOwner->GetVideoFrameContainer();
-  nsContentUtils::RegisterShutdownObserver(this);
+  MediaShutdownManager::Instance().Register(this);
   return true;
 }
 
@@ -480,7 +480,7 @@ void MediaDecoder::Shutdown()
   StopProgress();
   mOwner = nullptr;
 
-  nsContentUtils::UnregisterShutdownObserver(this);
+  MediaShutdownManager::Instance().Unregister(this);
 }
 
 MediaDecoder::~MediaDecoder()
diff --git a/content/media/MediaDecoderStateMachine.cpp b/content/media/MediaDecoderStateMachine.cpp
index bcce960333ab..a91aa98e01ba 100644
--- a/content/media/MediaDecoderStateMachine.cpp
+++ b/content/media/MediaDecoderStateMachine.cpp
@@ -26,6 +26,8 @@
 #include "ImageContainer.h"
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
+#include "nsContentUtils.h"
+#include "MediaShutdownManager.h"
 
 #include "prenv.h"
 #include "mozilla/Preferences.h"
@@ -178,7 +180,7 @@ public:
   {
     ReentrantMonitorAutoEnter mon(mMonitor);
     NS_ASSERTION(mStateMachineThread, "Should have non-null state machine thread!");
-    return mStateMachineThread;
+    return mStateMachineThread->GetThread();
   }
 
   // Requests that a decode thread be created for aStateMachine. The thread
@@ -234,7 +236,7 @@ private:
   // Global state machine thread. Write on the main thread
   // only, read from the decoder threads. Synchronized via
   // the mMonitor.
-  nsIThread* mStateMachineThread;
+  nsRefPtr<StateMachineThread> mStateMachineThread;
 
   // Queue of state machines waiting for decode threads. Entries at the front
   // get their threads first.
@@ -258,7 +260,8 @@ void StateMachineTracker::EnsureGlobalStateMachine()
   ReentrantMonitorAutoEnter mon(mMonitor);
   if (mStateMachineCount == 0) {
     NS_ASSERTION(!mStateMachineThread, "Should have null state machine thread!");
-    DebugOnly<nsresult> rv = NS_NewNamedThread("Media State", &mStateMachineThread);
+    mStateMachineThread = new StateMachineThread();
+    DebugOnly<nsresult> rv = mStateMachineThread->Init();
     NS_ABORT_IF_FALSE(NS_SUCCEEDED(rv), "Can't create media state machine thread");
   }
   mStateMachineCount++;
@@ -291,11 +294,8 @@ void StateMachineTracker::CleanupGlobalStateMachine()
     NS_ASSERTION(mPending.GetSize() == 0, "Shouldn't all requests be handled by now?");
     {
       ReentrantMonitorAutoEnter mon(mMonitor);
-      nsCOMPtr<nsIRunnable> event = new ShutdownThreadEvent(mStateMachineThread);
-      NS_RELEASE(mStateMachineThread);
+      mStateMachineThread->Shutdown();
       mStateMachineThread = nullptr;
-      NS_DispatchToMainThread(event);
-
       NS_ASSERTION(mDecodeThreadCount == 0, "Decode thread count must be zero.");
       sInstance = nullptr;
     }
diff --git a/content/media/MediaShutdownManager.cpp b/content/media/MediaShutdownManager.cpp
new file mode 100644
index 000000000000..b065ac68c548
--- /dev/null
+++ b/content/media/MediaShutdownManager.cpp
@@ -0,0 +1,236 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MediaShutdownManager.h"
+#include "nsContentUtils.h"
+#include "mozilla/StaticPtr.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "MediaDecoder.h"
+
+namespace mozilla {
+
+StateMachineThread::StateMachineThread()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_CTOR(StateMachineThread);
+}
+
+StateMachineThread::~StateMachineThread()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_DTOR(StateMachineThread);
+}
+
+void
+StateMachineThread::Shutdown()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mThread);
+  if (mThread) {
+    nsCOMPtr<nsIRunnable> event =
+      NS_NewRunnableMethod(this, &StateMachineThread::ShutdownThread);
+    NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
+  }
+}
+
+void
+StateMachineThread::ShutdownThread()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mThread);
+  mThread->Shutdown();
+  mThread = nullptr;
+  MediaShutdownManager::Instance().Unregister(this);
+}
+
+nsresult
+StateMachineThread::Init()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  nsresult rv = NS_NewNamedThread("Media State", getter_AddRefs(mThread));
+  NS_ENSURE_SUCCESS(rv, rv);
+  MediaShutdownManager::Instance().Register(this);
+  return NS_OK;
+}
+
+nsIThread*
+StateMachineThread::GetThread()
+{
+  MOZ_ASSERT(mThread);
+  return mThread;
+}
+
+void
+StateMachineThread::SpinUntilShutdownComplete()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  while (mThread) {
+    bool processed = false;
+    nsresult rv = NS_GetCurrentThread()->ProcessNextEvent(true, &processed);
+    if (NS_FAILED(rv)) {
+      NS_WARNING("Failed to spin main thread while awaiting media shutdown");
+      break;
+    }
+  }
+}
+
+NS_IMPL_ISUPPORTS1(MediaShutdownManager, nsIObserver)
+
+MediaShutdownManager::MediaShutdownManager()
+  : mIsObservingShutdown(false),
+    mIsDoingXPCOMShutDown(false)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_CTOR(MediaShutdownManager);
+}
+
+MediaShutdownManager::~MediaShutdownManager()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_COUNT_DTOR(MediaShutdownManager);
+}
+
+// Note that we don't use ClearOnShutdown() on this StaticRefPtr, as that
+// may interfere with our shutdown listener.
+StaticRefPtr<MediaShutdownManager> MediaShutdownManager::sInstance;
+
+MediaShutdownManager&
+MediaShutdownManager::Instance()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (!sInstance) {
+    sInstance = new MediaShutdownManager();
+  }
+  return *sInstance;
+}
+
+void
+MediaShutdownManager::EnsureCorrectShutdownObserverState()
+{
+  MOZ_ASSERT(!mIsDoingXPCOMShutDown);
+  bool needShutdownObserver = (mDecoders.Count() > 0) ||
+                              (mStateMachineThreads.Count() > 0);
+  if (needShutdownObserver != mIsObservingShutdown) {
+    mIsObservingShutdown = needShutdownObserver;
+    if (mIsObservingShutdown) {
+      nsContentUtils::RegisterShutdownObserver(this);
+    } else {
+      nsContentUtils::UnregisterShutdownObserver(this);
+      // Clear our singleton reference. This will probably delete
+      // this instance, so don't deref |this| clearing sInstance.
+      sInstance = nullptr;
+    }
+  }
+}
+
+void
+MediaShutdownManager::Register(MediaDecoder* aDecoder)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  // Don't call Register() after you've Unregistered() all the decoders,
+  // that's not going to work.
+  MOZ_ASSERT(!mDecoders.Contains(aDecoder));
+  mDecoders.PutEntry(aDecoder);
+  MOZ_ASSERT(mDecoders.Contains(aDecoder));
+  MOZ_ASSERT(mDecoders.Count() > 0);
+  EnsureCorrectShutdownObserverState();
+}
+
+void
+MediaShutdownManager::Unregister(MediaDecoder* aDecoder)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mDecoders.Contains(aDecoder));
+  if (!mIsDoingXPCOMShutDown) {
+    mDecoders.RemoveEntry(aDecoder);
+    EnsureCorrectShutdownObserverState();
+  }
+}
+
+NS_IMETHODIMP
+MediaShutdownManager::Observe(nsISupports *aSubjet,
+                              const char *aTopic,
+                              const PRUnichar *someData)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
+    Shutdown();
+  }
+  return NS_OK;
+}
+
+void
+MediaShutdownManager::Register(StateMachineThread* aThread)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!mStateMachineThreads.Contains(aThread));
+  mStateMachineThreads.PutEntry(aThread);
+  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
+  MOZ_ASSERT(mStateMachineThreads.Count() > 0);
+  EnsureCorrectShutdownObserverState();
+}
+
+void
+MediaShutdownManager::Unregister(StateMachineThread* aThread)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
+  if (!mIsDoingXPCOMShutDown) {
+    mStateMachineThreads.RemoveEntry(aThread);
+    EnsureCorrectShutdownObserverState();
+  }
+}
+
+static PLDHashOperator
+ShutdownMediaDecoder(nsPtrHashKey<MediaDecoder>* aEntry, void*)
+{
+  aEntry->GetKey()->Shutdown();
+  return PL_DHASH_REMOVE;
+}
+
+static PLDHashOperator
+JoinStateMachineThreads(nsRefPtrHashKey<StateMachineThread>* aEntry, void*)
+{
+  aEntry->GetKey()->SpinUntilShutdownComplete();
+  return PL_DHASH_REMOVE;
+}
+
+void
+MediaShutdownManager::Shutdown()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(sInstance);
+
+  // Mark that we're shutting down, so that Unregister(*) calls don't remove
+  // hashtable entries. If Unregsiter(*) was to remove from the hash table,
+  // the iterations over the hashtables below would be disrupted.
+  mIsDoingXPCOMShutDown = true;
+
+  // Iterate over the decoders and shut them down, and remove them from the
+  // hashtable.
+  mDecoders.EnumerateEntries(ShutdownMediaDecoder, nullptr);
+  MOZ_ASSERT(mDecoders.Count() == 0);
+
+  // Iterate over the StateMachineThreads and wait for them to have finished
+  // shutting down, and remove them from the hashtable. Once all the decoders
+  // have shutdown the active state machine thread will naturally shutdown
+  // asynchronously. We may also have another state machine thread active,
+  // if construction and shutdown of the state machine thread has interleaved.
+  mStateMachineThreads.EnumerateEntries(JoinStateMachineThreads, nullptr);
+  MOZ_ASSERT(mStateMachineThreads.Count() == 0);
+
+  // Remove the MediaShutdownManager instance from the shutdown observer
+  // list.
+  nsContentUtils::UnregisterShutdownObserver(this);
+
+  // Clear the singleton instance. The only remaining reference should be the
+  // reference that the observer service used to call us with. The
+  // MediaShutdownManager will be deleted once the observer service cleans
+  // up after it finishes its notifications.
+  sInstance = nullptr;
+}
+
+} // namespace mozilla
diff --git a/content/media/MediaShutdownManager.h b/content/media/MediaShutdownManager.h
new file mode 100644
index 000000000000..b4a9d9dd38c2
--- /dev/null
+++ b/content/media/MediaShutdownManager.h
@@ -0,0 +1,168 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#if !defined(MediaShutdownManager_h_)
+#define MediaShutdownManager_h_
+
+#include "nsIObserver.h"
+#include "mozilla/Monitor.h"
+#include "mozilla/RefPtr.h"
+#include "mozilla/StaticPtr.h"
+#include "nsIThread.h"
+#include "nsCOMPtr.h"
+#include "nsTHashtable.h"
+#include "nsHashKeys.h"
+
+namespace mozilla {
+
+class MediaDecoder;
+class StateMachineThread;
+
+// The MediaShutdownManager manages shutting down the MediaDecoder
+// infrastructure in response to an xpcom-shutdown notification. This happens
+// when Gecko is shutting down in the middle of operation. This is tricky, as
+// there are a number of moving parts that must be shutdown in a particular
+// order. Additionally the xpcom-shutdown observer *must* block until all
+// threads are shutdown, which is tricky since we have a number of threads
+// here and their shutdown is asynchronous. We can't have each element of
+// our pipeline listening for xpcom-shutdown, as if each observer blocks
+// waiting for its threads to shutdown it will block other xpcom-shutdown
+// notifications from firing, and shutdown of one part of the media pipeline
+// (say the State Machine thread) may depend another part to be shutdown
+// first (the MediaDecoder threads). Additionally we need to not interfere
+// with shutdown in the the non-xpcom-shutdown case, where we need to be able
+// to recreate the State Machine thread after it's been destroyed without
+// affecting the shutdown of the old State Machine thread. The
+// MediaShutdownManager encapsulates all these dependencies, and provides
+// a single xpcom-shutdown listener for the MediaDecoder infrastructure, to
+// ensure that no shutdown order dependencies leak out of the MediaDecoder
+// stack. The MediaShutdownManager is a singleton.
+//
+// The MediaShutdownManager ensures that the MediaDecoder stack is shutdown
+// before returning from its xpcom-shutdown observer by keeping track of all
+// the active MediaDecoders, and upon xpcom-shutdown calling Shutdown() on
+// every MediaDecoder and then spinning the main thread event loop until the
+// State Machine thread has shutdown. Once the State Machine thread has been
+// shutdown, the xpcom-shutdown observer returns.
+//
+// Note that calling the Unregister() functions may result in the singleton
+// being deleted, so don't store references to the singleton, always use the
+// singleton by derefing the referenced returned by
+// MediaShutdownManager::Instance(), which ensures that the singleton is
+// created when needed.
+// i.e. like this:
+//    MediaShutdownManager::Instance()::Unregister(someDecoder);
+//    MediaShutdownManager::Instance()::Register(someOtherDecoder);
+// Not like this:
+//  MediaShutdownManager& instance = MediaShutdownManager::Instance();
+//  instance.Unregister(someDecoder); // Warning! May delete instance!
+//  instance.Register(someOtherDecoder); // BAD! instance may be dangling!
+class MediaShutdownManager : public nsIObserver {
+public:
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
+  // The MediaShutdownManager is a singleton, access its instance with
+  // this accessor.
+  static MediaShutdownManager& Instance();
+
+  // Notifies the MediaShutdownManager that it needs to track the shutdown
+  // of this MediaDecoder.
+  void Register(MediaDecoder* aDecoder);
+
+  // Notifies the MediaShutdownManager that a MediaDecoder that it was
+  // tracking has shutdown, and it no longer needs to be shutdown in the
+  // xpcom-shutdown listener.
+  void Unregister(MediaDecoder* aDecoder);
+
+  // Notifies the MediaShutdownManager of a state machine thread that
+  // must be tracked. Note that we track State Machine threads individually
+  // as their shutdown and the construction of a new state machine thread
+  // can interleave. This stores a strong ref to the state machine.
+  void Register(StateMachineThread* aThread);
+
+  // Notifies the MediaShutdownManager that a StateMachineThread that it was
+  // tracking has shutdown, and it no longer needs to be shutdown in the
+  // xpcom-shutdown listener. This drops the strong reference to the
+  // StateMachineThread, which may destroy it.
+  void Unregister(StateMachineThread* aThread);
+
+private:
+
+  MediaShutdownManager();
+  virtual ~MediaShutdownManager();
+
+  void Shutdown();
+
+  // Ensures we have a shutdown listener if we need one, and removes the
+  // listener and destroys the singleton if we don't.
+  void EnsureCorrectShutdownObserverState();
+
+  static StaticRefPtr<MediaShutdownManager> sInstance;
+
+  // Note: These are deliberately weak references! The MediaDecoders must
+  // unregister themselves before they're deleted.
+  nsTHashtable<nsPtrHashKey<MediaDecoder>> mDecoders;
+
+  // References to the state machine threads that we're tracking shutdown
+  // of. Note that although there is supposed to be a single state machine,
+  // the construction and shutdown of these can interleave, so we must track
+  // individual instances of the state machine threads.
+  // These are strong references.
+  nsTHashtable<nsRefPtrHashKey<StateMachineThread>> mStateMachineThreads;
+
+  // True if we have an XPCOM shutdown observer.
+  bool mIsObservingShutdown;
+
+  bool mIsDoingXPCOMShutDown;
+};
+
+// A wrapper for the state machine thread. We must wrap this so that the
+// state machine threads can shutdown independently from the
+// StateMachineTracker, under the control of the MediaShutdownManager.
+// The state machine thread is shutdown naturally when all decoders
+// complete their shutdown. So if a new decoder is created just as the
+// old state machine thread has shutdown, we need to be able to shutdown
+// the old state machine thread independently of the StateMachineTracker
+// creating a new state machine thread. Also if this happens we need to
+// be able to force both state machine threads to shutdown in the
+// MediaShutdownManager, which is why we maintain a set of state machine
+// threads, even though there's supposed to only be one alive at once.
+// This class does not enforce its own thread safety, the StateMachineTracker
+// ensures thread safety when it uses the StateMachineThread.
+class StateMachineThread {
+public:
+  StateMachineThread();
+  ~StateMachineThread();
+
+  NS_INLINE_DECL_REFCOUNTING(StateMachineThread);
+
+  // Creates the wrapped thread.
+  nsresult Init();
+
+  // Returns a reference to the underlying thread. Don't shut this down
+  // directly, use StateMachineThread::Shutdown() instead.
+  nsIThread* GetThread();
+
+  // Dispatches an event to the main thread to shutdown the wrapped thread.
+  // The owner's (StateMachineTracker's) reference to the StateMachineThread
+  // can be dropped, the StateMachineThread will shutdown itself
+  // asynchronously.
+  void Shutdown();
+
+  // Processes events on the main thread event loop until this thread
+  // has been shutdown. Use this to block until the asynchronous shutdown
+  // has complete.
+  void SpinUntilShutdownComplete();
+
+private:
+  void ShutdownThread();
+  nsCOMPtr<nsIThread> mThread;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/media/moz.build b/content/media/moz.build
index b09fbca9bb3f..fe8615003992 100644
--- a/content/media/moz.build
+++ b/content/media/moz.build
@@ -123,6 +123,7 @@ UNIFIED_SOURCES += [
     'MediaDecoderStateMachine.cpp',
     'MediaRecorder.cpp',
     'MediaResource.cpp',
+    'MediaShutdownManager.cpp',
     'MediaStreamGraph.cpp',
     'MediaStreamTrack.cpp',
     'MP3FrameParser.cpp',

From fe4ee2f87794f3e7d90eb387c6bf770132865853 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sun, 15 Dec 2013 19:45:24 -0800
Subject: [PATCH 444/459] Bumping gaia.json for 3 gaia-central revision(s)
 a=gaia-bump
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

========

https://hg.mozilla.org/integration/gaia-central/rev/23011328ff7d
Author: Alive.Kuo <alegnadise@gmail.com>
Desc: Merge pull request #14671 from alivedise/bugzilla/949209/publish

Bug 949209 - Publish custom detail with window, r=timdream

========

https://hg.mozilla.org/integration/gaia-central/rev/e2a283d5e2ab
Author: Hubert Figuière <hub@figuiere.net>
Desc: Bug 949209 - We now get src in detail.

========

https://hg.mozilla.org/integration/gaia-central/rev/154a435e72b5
Author: Alive Kuo <alegnadise@gmail.com>
Desc: Bug 949209 - Publish custom detail with window
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 54f89799b6f5..86360e27fa1e 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "a8f8d540eb85be0e7eeda4932cd68b9bea9fc71e", 
+    "revision": "23011328ff7d6a9677558137ce2522e7205a780b", 
     "repo_path": "/integration/gaia-central"
 }

From 63157b5e4b5e3111850a65dea97817dccc633ebe Mon Sep 17 00:00:00 2001
From: Phil Ringnalda <philringnalda@gmail.com>
Date: Sun, 15 Dec 2013 19:56:24 -0800
Subject: [PATCH 445/459] Back out 377f51d0e354 (bug 938108) for crashtest
 shutdown crashes

---
 content/media/MediaDecoder.cpp             |   6 +-
 content/media/MediaDecoderStateMachine.cpp |  14 +-
 content/media/MediaShutdownManager.cpp     | 236 ---------------------
 content/media/MediaShutdownManager.h       | 168 ---------------
 content/media/moz.build                    |   1 -
 5 files changed, 10 insertions(+), 415 deletions(-)
 delete mode 100644 content/media/MediaShutdownManager.cpp
 delete mode 100644 content/media/MediaShutdownManager.h

diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index cc6c13b66f65..9ca3b7ed2ffc 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -13,6 +13,7 @@
 #include "VideoUtils.h"
 #include "MediaDecoderStateMachine.h"
 #include "mozilla/dom/TimeRanges.h"
+#include "nsContentUtils.h"
 #include "ImageContainer.h"
 #include "MediaResource.h"
 #include "nsError.h"
@@ -22,7 +23,6 @@
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
 #include <algorithm>
-#include "MediaShutdownManager.h"
 
 #ifdef MOZ_WMF
 #include "WMFDecoder.h"
@@ -444,7 +444,7 @@ bool MediaDecoder::Init(MediaDecoderOwner* aOwner)
   MOZ_ASSERT(NS_IsMainThread());
   mOwner = aOwner;
   mVideoFrameContainer = aOwner->GetVideoFrameContainer();
-  MediaShutdownManager::Instance().Register(this);
+  nsContentUtils::RegisterShutdownObserver(this);
   return true;
 }
 
@@ -480,7 +480,7 @@ void MediaDecoder::Shutdown()
   StopProgress();
   mOwner = nullptr;
 
-  MediaShutdownManager::Instance().Unregister(this);
+  nsContentUtils::UnregisterShutdownObserver(this);
 }
 
 MediaDecoder::~MediaDecoder()
diff --git a/content/media/MediaDecoderStateMachine.cpp b/content/media/MediaDecoderStateMachine.cpp
index a91aa98e01ba..bcce960333ab 100644
--- a/content/media/MediaDecoderStateMachine.cpp
+++ b/content/media/MediaDecoderStateMachine.cpp
@@ -26,8 +26,6 @@
 #include "ImageContainer.h"
 #include "nsComponentManagerUtils.h"
 #include "nsITimer.h"
-#include "nsContentUtils.h"
-#include "MediaShutdownManager.h"
 
 #include "prenv.h"
 #include "mozilla/Preferences.h"
@@ -180,7 +178,7 @@ public:
   {
     ReentrantMonitorAutoEnter mon(mMonitor);
     NS_ASSERTION(mStateMachineThread, "Should have non-null state machine thread!");
-    return mStateMachineThread->GetThread();
+    return mStateMachineThread;
   }
 
   // Requests that a decode thread be created for aStateMachine. The thread
@@ -236,7 +234,7 @@ private:
   // Global state machine thread. Write on the main thread
   // only, read from the decoder threads. Synchronized via
   // the mMonitor.
-  nsRefPtr<StateMachineThread> mStateMachineThread;
+  nsIThread* mStateMachineThread;
 
   // Queue of state machines waiting for decode threads. Entries at the front
   // get their threads first.
@@ -260,8 +258,7 @@ void StateMachineTracker::EnsureGlobalStateMachine()
   ReentrantMonitorAutoEnter mon(mMonitor);
   if (mStateMachineCount == 0) {
     NS_ASSERTION(!mStateMachineThread, "Should have null state machine thread!");
-    mStateMachineThread = new StateMachineThread();
-    DebugOnly<nsresult> rv = mStateMachineThread->Init();
+    DebugOnly<nsresult> rv = NS_NewNamedThread("Media State", &mStateMachineThread);
     NS_ABORT_IF_FALSE(NS_SUCCEEDED(rv), "Can't create media state machine thread");
   }
   mStateMachineCount++;
@@ -294,8 +291,11 @@ void StateMachineTracker::CleanupGlobalStateMachine()
     NS_ASSERTION(mPending.GetSize() == 0, "Shouldn't all requests be handled by now?");
     {
       ReentrantMonitorAutoEnter mon(mMonitor);
-      mStateMachineThread->Shutdown();
+      nsCOMPtr<nsIRunnable> event = new ShutdownThreadEvent(mStateMachineThread);
+      NS_RELEASE(mStateMachineThread);
       mStateMachineThread = nullptr;
+      NS_DispatchToMainThread(event);
+
       NS_ASSERTION(mDecodeThreadCount == 0, "Decode thread count must be zero.");
       sInstance = nullptr;
     }
diff --git a/content/media/MediaShutdownManager.cpp b/content/media/MediaShutdownManager.cpp
deleted file mode 100644
index b065ac68c548..000000000000
--- a/content/media/MediaShutdownManager.cpp
+++ /dev/null
@@ -1,236 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et cindent: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "MediaShutdownManager.h"
-#include "nsContentUtils.h"
-#include "mozilla/StaticPtr.h"
-#include "mozilla/ClearOnShutdown.h"
-#include "MediaDecoder.h"
-
-namespace mozilla {
-
-StateMachineThread::StateMachineThread()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_CTOR(StateMachineThread);
-}
-
-StateMachineThread::~StateMachineThread()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_DTOR(StateMachineThread);
-}
-
-void
-StateMachineThread::Shutdown()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mThread);
-  if (mThread) {
-    nsCOMPtr<nsIRunnable> event =
-      NS_NewRunnableMethod(this, &StateMachineThread::ShutdownThread);
-    NS_DispatchToMainThread(event, NS_DISPATCH_NORMAL);
-  }
-}
-
-void
-StateMachineThread::ShutdownThread()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mThread);
-  mThread->Shutdown();
-  mThread = nullptr;
-  MediaShutdownManager::Instance().Unregister(this);
-}
-
-nsresult
-StateMachineThread::Init()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  nsresult rv = NS_NewNamedThread("Media State", getter_AddRefs(mThread));
-  NS_ENSURE_SUCCESS(rv, rv);
-  MediaShutdownManager::Instance().Register(this);
-  return NS_OK;
-}
-
-nsIThread*
-StateMachineThread::GetThread()
-{
-  MOZ_ASSERT(mThread);
-  return mThread;
-}
-
-void
-StateMachineThread::SpinUntilShutdownComplete()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  while (mThread) {
-    bool processed = false;
-    nsresult rv = NS_GetCurrentThread()->ProcessNextEvent(true, &processed);
-    if (NS_FAILED(rv)) {
-      NS_WARNING("Failed to spin main thread while awaiting media shutdown");
-      break;
-    }
-  }
-}
-
-NS_IMPL_ISUPPORTS1(MediaShutdownManager, nsIObserver)
-
-MediaShutdownManager::MediaShutdownManager()
-  : mIsObservingShutdown(false),
-    mIsDoingXPCOMShutDown(false)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_CTOR(MediaShutdownManager);
-}
-
-MediaShutdownManager::~MediaShutdownManager()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_COUNT_DTOR(MediaShutdownManager);
-}
-
-// Note that we don't use ClearOnShutdown() on this StaticRefPtr, as that
-// may interfere with our shutdown listener.
-StaticRefPtr<MediaShutdownManager> MediaShutdownManager::sInstance;
-
-MediaShutdownManager&
-MediaShutdownManager::Instance()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  if (!sInstance) {
-    sInstance = new MediaShutdownManager();
-  }
-  return *sInstance;
-}
-
-void
-MediaShutdownManager::EnsureCorrectShutdownObserverState()
-{
-  MOZ_ASSERT(!mIsDoingXPCOMShutDown);
-  bool needShutdownObserver = (mDecoders.Count() > 0) ||
-                              (mStateMachineThreads.Count() > 0);
-  if (needShutdownObserver != mIsObservingShutdown) {
-    mIsObservingShutdown = needShutdownObserver;
-    if (mIsObservingShutdown) {
-      nsContentUtils::RegisterShutdownObserver(this);
-    } else {
-      nsContentUtils::UnregisterShutdownObserver(this);
-      // Clear our singleton reference. This will probably delete
-      // this instance, so don't deref |this| clearing sInstance.
-      sInstance = nullptr;
-    }
-  }
-}
-
-void
-MediaShutdownManager::Register(MediaDecoder* aDecoder)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  // Don't call Register() after you've Unregistered() all the decoders,
-  // that's not going to work.
-  MOZ_ASSERT(!mDecoders.Contains(aDecoder));
-  mDecoders.PutEntry(aDecoder);
-  MOZ_ASSERT(mDecoders.Contains(aDecoder));
-  MOZ_ASSERT(mDecoders.Count() > 0);
-  EnsureCorrectShutdownObserverState();
-}
-
-void
-MediaShutdownManager::Unregister(MediaDecoder* aDecoder)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mDecoders.Contains(aDecoder));
-  if (!mIsDoingXPCOMShutDown) {
-    mDecoders.RemoveEntry(aDecoder);
-    EnsureCorrectShutdownObserverState();
-  }
-}
-
-NS_IMETHODIMP
-MediaShutdownManager::Observe(nsISupports *aSubjet,
-                              const char *aTopic,
-                              const PRUnichar *someData)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  if (strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID) == 0) {
-    Shutdown();
-  }
-  return NS_OK;
-}
-
-void
-MediaShutdownManager::Register(StateMachineThread* aThread)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(!mStateMachineThreads.Contains(aThread));
-  mStateMachineThreads.PutEntry(aThread);
-  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
-  MOZ_ASSERT(mStateMachineThreads.Count() > 0);
-  EnsureCorrectShutdownObserverState();
-}
-
-void
-MediaShutdownManager::Unregister(StateMachineThread* aThread)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(mStateMachineThreads.Contains(aThread));
-  if (!mIsDoingXPCOMShutDown) {
-    mStateMachineThreads.RemoveEntry(aThread);
-    EnsureCorrectShutdownObserverState();
-  }
-}
-
-static PLDHashOperator
-ShutdownMediaDecoder(nsPtrHashKey<MediaDecoder>* aEntry, void*)
-{
-  aEntry->GetKey()->Shutdown();
-  return PL_DHASH_REMOVE;
-}
-
-static PLDHashOperator
-JoinStateMachineThreads(nsRefPtrHashKey<StateMachineThread>* aEntry, void*)
-{
-  aEntry->GetKey()->SpinUntilShutdownComplete();
-  return PL_DHASH_REMOVE;
-}
-
-void
-MediaShutdownManager::Shutdown()
-{
-  MOZ_ASSERT(NS_IsMainThread());
-  MOZ_ASSERT(sInstance);
-
-  // Mark that we're shutting down, so that Unregister(*) calls don't remove
-  // hashtable entries. If Unregsiter(*) was to remove from the hash table,
-  // the iterations over the hashtables below would be disrupted.
-  mIsDoingXPCOMShutDown = true;
-
-  // Iterate over the decoders and shut them down, and remove them from the
-  // hashtable.
-  mDecoders.EnumerateEntries(ShutdownMediaDecoder, nullptr);
-  MOZ_ASSERT(mDecoders.Count() == 0);
-
-  // Iterate over the StateMachineThreads and wait for them to have finished
-  // shutting down, and remove them from the hashtable. Once all the decoders
-  // have shutdown the active state machine thread will naturally shutdown
-  // asynchronously. We may also have another state machine thread active,
-  // if construction and shutdown of the state machine thread has interleaved.
-  mStateMachineThreads.EnumerateEntries(JoinStateMachineThreads, nullptr);
-  MOZ_ASSERT(mStateMachineThreads.Count() == 0);
-
-  // Remove the MediaShutdownManager instance from the shutdown observer
-  // list.
-  nsContentUtils::UnregisterShutdownObserver(this);
-
-  // Clear the singleton instance. The only remaining reference should be the
-  // reference that the observer service used to call us with. The
-  // MediaShutdownManager will be deleted once the observer service cleans
-  // up after it finishes its notifications.
-  sInstance = nullptr;
-}
-
-} // namespace mozilla
diff --git a/content/media/MediaShutdownManager.h b/content/media/MediaShutdownManager.h
deleted file mode 100644
index b4a9d9dd38c2..000000000000
--- a/content/media/MediaShutdownManager.h
+++ /dev/null
@@ -1,168 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim:set ts=2 sw=2 sts=2 et cindent: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#if !defined(MediaShutdownManager_h_)
-#define MediaShutdownManager_h_
-
-#include "nsIObserver.h"
-#include "mozilla/Monitor.h"
-#include "mozilla/RefPtr.h"
-#include "mozilla/StaticPtr.h"
-#include "nsIThread.h"
-#include "nsCOMPtr.h"
-#include "nsTHashtable.h"
-#include "nsHashKeys.h"
-
-namespace mozilla {
-
-class MediaDecoder;
-class StateMachineThread;
-
-// The MediaShutdownManager manages shutting down the MediaDecoder
-// infrastructure in response to an xpcom-shutdown notification. This happens
-// when Gecko is shutting down in the middle of operation. This is tricky, as
-// there are a number of moving parts that must be shutdown in a particular
-// order. Additionally the xpcom-shutdown observer *must* block until all
-// threads are shutdown, which is tricky since we have a number of threads
-// here and their shutdown is asynchronous. We can't have each element of
-// our pipeline listening for xpcom-shutdown, as if each observer blocks
-// waiting for its threads to shutdown it will block other xpcom-shutdown
-// notifications from firing, and shutdown of one part of the media pipeline
-// (say the State Machine thread) may depend another part to be shutdown
-// first (the MediaDecoder threads). Additionally we need to not interfere
-// with shutdown in the the non-xpcom-shutdown case, where we need to be able
-// to recreate the State Machine thread after it's been destroyed without
-// affecting the shutdown of the old State Machine thread. The
-// MediaShutdownManager encapsulates all these dependencies, and provides
-// a single xpcom-shutdown listener for the MediaDecoder infrastructure, to
-// ensure that no shutdown order dependencies leak out of the MediaDecoder
-// stack. The MediaShutdownManager is a singleton.
-//
-// The MediaShutdownManager ensures that the MediaDecoder stack is shutdown
-// before returning from its xpcom-shutdown observer by keeping track of all
-// the active MediaDecoders, and upon xpcom-shutdown calling Shutdown() on
-// every MediaDecoder and then spinning the main thread event loop until the
-// State Machine thread has shutdown. Once the State Machine thread has been
-// shutdown, the xpcom-shutdown observer returns.
-//
-// Note that calling the Unregister() functions may result in the singleton
-// being deleted, so don't store references to the singleton, always use the
-// singleton by derefing the referenced returned by
-// MediaShutdownManager::Instance(), which ensures that the singleton is
-// created when needed.
-// i.e. like this:
-//    MediaShutdownManager::Instance()::Unregister(someDecoder);
-//    MediaShutdownManager::Instance()::Register(someOtherDecoder);
-// Not like this:
-//  MediaShutdownManager& instance = MediaShutdownManager::Instance();
-//  instance.Unregister(someDecoder); // Warning! May delete instance!
-//  instance.Register(someOtherDecoder); // BAD! instance may be dangling!
-class MediaShutdownManager : public nsIObserver {
-public:
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIOBSERVER
-
-  // The MediaShutdownManager is a singleton, access its instance with
-  // this accessor.
-  static MediaShutdownManager& Instance();
-
-  // Notifies the MediaShutdownManager that it needs to track the shutdown
-  // of this MediaDecoder.
-  void Register(MediaDecoder* aDecoder);
-
-  // Notifies the MediaShutdownManager that a MediaDecoder that it was
-  // tracking has shutdown, and it no longer needs to be shutdown in the
-  // xpcom-shutdown listener.
-  void Unregister(MediaDecoder* aDecoder);
-
-  // Notifies the MediaShutdownManager of a state machine thread that
-  // must be tracked. Note that we track State Machine threads individually
-  // as their shutdown and the construction of a new state machine thread
-  // can interleave. This stores a strong ref to the state machine.
-  void Register(StateMachineThread* aThread);
-
-  // Notifies the MediaShutdownManager that a StateMachineThread that it was
-  // tracking has shutdown, and it no longer needs to be shutdown in the
-  // xpcom-shutdown listener. This drops the strong reference to the
-  // StateMachineThread, which may destroy it.
-  void Unregister(StateMachineThread* aThread);
-
-private:
-
-  MediaShutdownManager();
-  virtual ~MediaShutdownManager();
-
-  void Shutdown();
-
-  // Ensures we have a shutdown listener if we need one, and removes the
-  // listener and destroys the singleton if we don't.
-  void EnsureCorrectShutdownObserverState();
-
-  static StaticRefPtr<MediaShutdownManager> sInstance;
-
-  // Note: These are deliberately weak references! The MediaDecoders must
-  // unregister themselves before they're deleted.
-  nsTHashtable<nsPtrHashKey<MediaDecoder>> mDecoders;
-
-  // References to the state machine threads that we're tracking shutdown
-  // of. Note that although there is supposed to be a single state machine,
-  // the construction and shutdown of these can interleave, so we must track
-  // individual instances of the state machine threads.
-  // These are strong references.
-  nsTHashtable<nsRefPtrHashKey<StateMachineThread>> mStateMachineThreads;
-
-  // True if we have an XPCOM shutdown observer.
-  bool mIsObservingShutdown;
-
-  bool mIsDoingXPCOMShutDown;
-};
-
-// A wrapper for the state machine thread. We must wrap this so that the
-// state machine threads can shutdown independently from the
-// StateMachineTracker, under the control of the MediaShutdownManager.
-// The state machine thread is shutdown naturally when all decoders
-// complete their shutdown. So if a new decoder is created just as the
-// old state machine thread has shutdown, we need to be able to shutdown
-// the old state machine thread independently of the StateMachineTracker
-// creating a new state machine thread. Also if this happens we need to
-// be able to force both state machine threads to shutdown in the
-// MediaShutdownManager, which is why we maintain a set of state machine
-// threads, even though there's supposed to only be one alive at once.
-// This class does not enforce its own thread safety, the StateMachineTracker
-// ensures thread safety when it uses the StateMachineThread.
-class StateMachineThread {
-public:
-  StateMachineThread();
-  ~StateMachineThread();
-
-  NS_INLINE_DECL_REFCOUNTING(StateMachineThread);
-
-  // Creates the wrapped thread.
-  nsresult Init();
-
-  // Returns a reference to the underlying thread. Don't shut this down
-  // directly, use StateMachineThread::Shutdown() instead.
-  nsIThread* GetThread();
-
-  // Dispatches an event to the main thread to shutdown the wrapped thread.
-  // The owner's (StateMachineTracker's) reference to the StateMachineThread
-  // can be dropped, the StateMachineThread will shutdown itself
-  // asynchronously.
-  void Shutdown();
-
-  // Processes events on the main thread event loop until this thread
-  // has been shutdown. Use this to block until the asynchronous shutdown
-  // has complete.
-  void SpinUntilShutdownComplete();
-
-private:
-  void ShutdownThread();
-  nsCOMPtr<nsIThread> mThread;
-};
-
-} // namespace mozilla
-
-#endif
diff --git a/content/media/moz.build b/content/media/moz.build
index fe8615003992..b09fbca9bb3f 100644
--- a/content/media/moz.build
+++ b/content/media/moz.build
@@ -123,7 +123,6 @@ UNIFIED_SOURCES += [
     'MediaDecoderStateMachine.cpp',
     'MediaRecorder.cpp',
     'MediaResource.cpp',
-    'MediaShutdownManager.cpp',
     'MediaStreamGraph.cpp',
     'MediaStreamTrack.cpp',
     'MP3FrameParser.cpp',

From 5ac8fedf48bca8678d6beebc755aebba65723825 Mon Sep 17 00:00:00 2001
From: Mark Hammond <mhammond@skippinet.com.au>
Date: Mon, 16 Dec 2013 15:07:44 +1100
Subject: [PATCH 446/459] Bug 948258 - Move browser tests from
 dom/indexedDB/test/Makefile.in to browser.ini. r=ted

---
 dom/indexedDB/test/Makefile.in      | 30 -----------------------------
 dom/indexedDB/test/browser.ini      | 23 ++++++++++++++++++++++
 dom/indexedDB/test/moz.build        |  2 ++
 python/mozbuild/mozbuild/mozinfo.py |  4 ++++
 4 files changed, 29 insertions(+), 30 deletions(-)
 delete mode 100644 dom/indexedDB/test/Makefile.in
 create mode 100644 dom/indexedDB/test/browser.ini

diff --git a/dom/indexedDB/test/Makefile.in b/dom/indexedDB/test/Makefile.in
deleted file mode 100644
index b2f6de0db518..000000000000
--- a/dom/indexedDB/test/Makefile.in
+++ /dev/null
@@ -1,30 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#   test_bug847147.html disabled for timeouts
-#   test_writer_starvation.html  disabled for infinite loops, bug 595368
-ifeq (browser,$(MOZ_BUILD_APP))
-MOCHITEST_BROWSER_FILES = \
-  browser_forgetThisSite.js \
-  browser_forgetThisSiteAdd.html \
-  browser_forgetThisSiteGet.html \
-  browserHelpers.js \
-  browser_permissionsPrompt.html \
-  browser_permissionsPromptAllow.js \
-  browser_permissionsPromptDeny.js \
-  browser_perwindow_privateBrowsing.js \
-  browser_quotaPrompt.html \
-  browser_quotaPromptAllow.js \
-  browser_quotaPromptDeny.js \
-  browser_quotaPromptDatabases.html \
-  browser_quotaPromptDatabases.js \
-  browser_quotaPromptDelete.html \
-  browser_quotaPromptDelete.js \
-  browser_bug839193.js \
-  bug839193.js \
-  bug839193.xul \
-  head.js \
-  $(NULL)
-
-endif
diff --git a/dom/indexedDB/test/browser.ini b/dom/indexedDB/test/browser.ini
new file mode 100644
index 000000000000..aab604c52ce0
--- /dev/null
+++ b/dom/indexedDB/test/browser.ini
@@ -0,0 +1,23 @@
+[DEFAULT]
+run-if = buildapp == "browser"
+support-files =
+  head.js
+  browser_forgetThisSiteAdd.html
+  browser_forgetThisSiteGet.html
+  browserHelpers.js
+  browser_permissionsPrompt.html
+  browser_quotaPrompt.html
+  browser_quotaPromptDatabases.html
+  browser_quotaPromptDelete.html
+  bug839193.js
+  bug839193.xul
+
+[browser_forgetThisSite.js]
+[browser_permissionsPromptAllow.js]
+[browser_permissionsPromptDeny.js]
+[browser_perwindow_privateBrowsing.js]
+[browser_quotaPromptAllow.js]
+[browser_quotaPromptDeny.js]
+[browser_quotaPromptDatabases.js]
+[browser_quotaPromptDelete.js]
+[browser_bug839193.js]
diff --git a/dom/indexedDB/test/moz.build b/dom/indexedDB/test/moz.build
index 403454f077d8..41b8f4e58ea6 100644
--- a/dom/indexedDB/test/moz.build
+++ b/dom/indexedDB/test/moz.build
@@ -12,5 +12,7 @@ XPCSHELL_TESTS_MANIFESTS += ['unit/xpcshell.ini']
 
 MOCHITEST_MANIFESTS += ['mochitest.ini']
 
+BROWSER_CHROME_MANIFESTS += ['browser.ini']
+
 MOCHITEST_CHROME_MANIFESTS += ['chrome.ini']
 
diff --git a/python/mozbuild/mozbuild/mozinfo.py b/python/mozbuild/mozbuild/mozinfo.py
index f4864a618c22..230281886053 100755
--- a/python/mozbuild/mozbuild/mozinfo.py
+++ b/python/mozbuild/mozbuild/mozinfo.py
@@ -51,6 +51,10 @@ def build_dict(config, env=os.environ):
     if 'MOZ_APP_NAME' in substs:
         d["appname"] = substs["MOZ_APP_NAME"]
 
+    # Build app name
+    if 'MOZ_BUILD_APP' in substs:
+        d["buildapp"] = substs["MOZ_BUILD_APP"]
+
     # processor
     p = substs["TARGET_CPU"]
     # for universal mac builds, put in a special value

From f508cc964251999743aecea6a7b7905af7a55fb1 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sun, 15 Dec 2013 20:10:23 -0800
Subject: [PATCH 447/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/f63fa4e31cea
Author: EragonJ <eragonj@eragonj.me>
Desc: Merge pull request #14626 from EragonJ/bug-945140-another-try

Bug 945140 - [DSDS] SIM 2 can still MT/MO SMS and MT voice call in airpl...

========

https://hg.mozilla.org/integration/gaia-central/rev/6aec6f6cd451
Author: EragonJ <eragonj@eragonj.me>
Desc: Bug 945140 - [DSDS] SIM 2 can still MT/MO SMS and MT voice call in airplane mode.

- make airplane mode work in dsds & single sim
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 86360e27fa1e..8a674ca7034d 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "23011328ff7d6a9677558137ce2522e7205a780b", 
+    "revision": "f63fa4e31cea664886f43504529d96bc046506fc", 
     "repo_path": "/integration/gaia-central"
 }

From 19f041629523655d4fba0877ff5db77179716615 Mon Sep 17 00:00:00 2001
From: Edwin Flores <eflores@mozilla.com>
Date: Mon, 16 Dec 2013 17:47:50 +1300
Subject: [PATCH 448/459] Bug 948326 - Actually address review comments in bug
 918135 r=cpearce

---
 content/media/MP3FrameParser.cpp | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/content/media/MP3FrameParser.cpp b/content/media/MP3FrameParser.cpp
index e60906aef0b9..9b93387c9864 100644
--- a/content/media/MP3FrameParser.cpp
+++ b/content/media/MP3FrameParser.cpp
@@ -486,8 +486,8 @@ void MP3FrameParser::Parse(const char* aBuffer, uint32_t aLength, uint64_t aOffs
   mOffset = offset + bytesRead;
 
   // If we've parsed lots of data and we still have nothing, just give up.
-  // We don't count ID3 headers towards that count, as MP3 files can have
-  // massive ID3 sections.
+  // We don't count ID3 headers towards the skipped bytes count, as MP3 files
+  // can have massive ID3 sections.
   if (!mID3Parser.IsParsed() && mMP3Offset < 0 &&
       mOffset - mTotalID3Size > MAX_SKIPPED_BYTES) {
     mIsMP3 = NOT_MP3;
@@ -498,8 +498,17 @@ int64_t MP3FrameParser::GetDuration()
 {
   MutexAutoLock mon(mLock);
 
-  if (mMP3Offset < 0) {
-    return -1; // Not a single frame decoded yet
+  if (!ParsedHeaders() || !mSamplesPerSecond) {
+    // Not a single frame decoded yet.
+    return -1;
+  }
+
+  MOZ_ASSERT(mFrameCount > 0 && mTotalFrameSize > 0,
+             "Frame parser should have seen at least one MP3 frame of positive length.");
+
+  if (!mFrameCount || !mTotalFrameSize) {
+    // This should never happen.
+    return -1;
   }
 
   double frames;

From 2e614964490880cf3d9f284182d9021ff8accc0c Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Sun, 15 Dec 2013 23:00:24 -0800
Subject: [PATCH 449/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/35b93b697fb5
Author: Askeing Yen (fyen) <askeing@gmail.com>
Desc: Merge pull request #14686 from echangmoz/master

Bug 950539 - Fix gallery tests

========

https://hg.mozilla.org/integration/gaia-central/rev/b506389d0119
Author: Eric Chang <echang@mozilla.com>
Desc: Bug 950539 - Fix gallery tests
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 8a674ca7034d..8a68178661c9 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "f63fa4e31cea664886f43504529d96bc046506fc", 
+    "revision": "35b93b697fb5fb9b49eea558f22dc44da1a14d9e", 
     "repo_path": "/integration/gaia-central"
 }

From 5d3a0435a7a7278036dc9266b63a9bbe85037f3f Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 00:15:23 -0800
Subject: [PATCH 450/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/00a9ef21f108
Author: gasolin <gasolin@gmail.com>
Desc: Merge pull request #14642 from gasolin/issue-916661

Bug 916661 - Refactor Authentication Dialog in AppWindow submodule, r=alive

========

https://hg.mozilla.org/integration/gaia-central/rev/be6cefe51db9
Author: gasolin <gasolin@gmail.com>
Desc: Bug 916661 - Refactor Authentication Dialog in AppWindow submodule
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 8a68178661c9..fa00efae0d25 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "35b93b697fb5fb9b49eea558f22dc44da1a14d9e", 
+    "revision": "00a9ef21f108f55c07a2503fdf15163f0c77bd9d", 
     "repo_path": "/integration/gaia-central"
 }

From 2217ced60b7dd997ee5b33ef1288afffff6c2e74 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 00:25:24 -0800
Subject: [PATCH 451/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/6497ac39da4b
Author: Julien Wajsberg <felash@gmail.com>
Desc: Merge pull request #14673 from julienw/950083-css-changes

Bug 950083 - css changes

========

https://hg.mozilla.org/integration/gaia-central/rev/bc9b96cfe376
Author: Julien Wajsberg <felash@gmail.com>
Desc: Bug 950083 - CSS fixes after bug 943807 landed r=yurenju

========

https://hg.mozilla.org/integration/gaia-central/rev/389cc8c11491
Author: Cristian Rodriguez <crdlc@tid.es>
Desc: Merge pull request #14634 from crdlc/bug-949948

Bug 949948 - [Homescreen] Dock tests fail when it is launched isolated

========

https://hg.mozilla.org/integration/gaia-central/rev/9d19d6e17075
Author: crdlc <crdlc@tid.es>
Desc: Bug 949948 - [Homescreen] Dock tests fail when it is launched isolated
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index fa00efae0d25..5e3aa8352706 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "00a9ef21f108f55c07a2503fdf15163f0c77bd9d", 
+    "revision": "6497ac39da4beef0d76cdbceb2a1145f1c7044a7", 
     "repo_path": "/integration/gaia-central"
 }

From 89289ffa6644ecb949275e9d5387f91ce38e1506 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Mon, 16 Dec 2013 08:57:37 +0000
Subject: [PATCH 452/459] Bug 950006 - Don't skip zeal GCs if allocating
 without the possibility of GC r=billm

---
 js/src/jsgcinlines.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index c162df0b8946..ddd1080683fe 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -434,7 +434,7 @@ NewGCThing(ThreadSafeContext *cx, AllocKind kind, size_t thingSize, InitialHeap
         JS_OOM_POSSIBLY_FAIL_REPORT(ncx);
 
 #ifdef JS_GC_ZEAL
-        if (rt->needZealousGC() && allowGC)
+        if (allowGC && rt->needZealousGC())
             js::gc::RunDebugGC(ncx);
 #endif
 

From ef6ab01e3dd26e7d682baf8a5bc68c708aea834d Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 01:00:25 -0800
Subject: [PATCH 453/459] Bumping gaia.json for 4 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/65bc12c42fbd
Author: gasolin <gasolin@gmail.com>
Desc: Merge pull request #14637 from gasolin/issue-916660

Bug 916660 - [Window Management] refactor app modal dialog, r=alive

========

https://hg.mozilla.org/integration/gaia-central/rev/c2b7a5c399d6
Author: gasolin <gasolin@gmail.com>
Desc: Bug 916660 - [Window Management] refactor app modal dialog

========

https://hg.mozilla.org/integration/gaia-central/rev/4edda9e2838b
Author: Rex KM Lee <rexboy@mozilla.com>
Desc: Merge pull request #14608 from rexboy7/fix-bug922006

bug 922006 - [Dialer] Refactor onload event listener to make dialer.js testable. r=etienne

========

https://hg.mozilla.org/integration/gaia-central/rev/dc7849bf11ea
Author: Rex Lee <rexboy@mozilla.com>
Desc: bug 922006 - [Dialer] Refactor onload event listener to make dialer.js testable
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 5e3aa8352706..ed6a3fc48ba7 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "6497ac39da4beef0d76cdbceb2a1145f1c7044a7", 
+    "revision": "65bc12c42fbde109aeb2f11b5476f01ef3e12545", 
     "repo_path": "/integration/gaia-central"
 }

From c869903cb27cebdf1b02ffc014064b0b8e00d3d0 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 01:15:24 -0800
Subject: [PATCH 454/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/fc14afb62388
Author: lissyx <lissyx+github@lissyx.dyndns.org>
Desc: Merge pull request #14658 from lissyx/bug950070

Bug 950070 - Perform correct localization of the roaming notifier on lockscreen r=kaze

========

https://hg.mozilla.org/integration/gaia-central/rev/bbcaf255cf16
Author: Alexandre Lissy <lissyx+github@lissyx.dyndns.org>
Desc: Bug 950070 - Perform correct localization of the roaming notifier on lockscreen

The localize() method takes as a third argument an object, not a string.
Doing this like this results in a lockscreen not substituting correctly
and hence displaying ``{{operator}} (Roaming)'' to the user.
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index ed6a3fc48ba7..b33583901c5c 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "65bc12c42fbde109aeb2f11b5476f01ef3e12545", 
+    "revision": "fc14afb62388750d9d4fa8a8b77f03ddb254b924", 
     "repo_path": "/integration/gaia-central"
 }

From dad290b1cd3bd4a3e1f396219b07714bef54e2d9 Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Mon, 16 Dec 2013 10:47:31 +0100
Subject: [PATCH 455/459] Bug 942530 - Use typed enums in jsinfer.h. r=bhackett

---
 js/src/jsinfer.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index 69e7591d9684..e5d8ac01cfc3 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -10,6 +10,7 @@
 #define jsinfer_h
 
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/TypedEnum.h"
 
 #include "jsalloc.h"
 #include "jsfriendapi.h"
@@ -325,7 +326,7 @@ public:
 };
 
 /* Flags and other state stored in TypeSet::flags */
-enum {
+enum MOZ_ENUM_TYPE(uint32_t) {
     TYPE_FLAG_UNDEFINED =  0x1,
     TYPE_FLAG_NULL      =  0x2,
     TYPE_FLAG_BOOLEAN   =  0x4,
@@ -375,7 +376,7 @@ enum {
 typedef uint32_t TypeFlags;
 
 /* Flags and other state stored in TypeObject::flags */
-enum {
+enum MOZ_ENUM_TYPE(uint32_t) {
     /* Whether this type object is associated with some allocation site. */
     OBJECT_FLAG_FROM_ALLOCATION_SITE  = 0x1,
 
@@ -526,11 +527,13 @@ class TypeSet
         flags |= TYPE_FLAG_CONFIGURED_PROPERTY;
     }
     bool canSetDefinite(unsigned slot) {
-        return (slot + 1) <= (TYPE_FLAG_DEFINITE_MASK >> TYPE_FLAG_DEFINITE_SHIFT);
+        // Note: the cast is required to work around an MSVC issue.
+        return (slot + 1) <= (unsigned(TYPE_FLAG_DEFINITE_MASK) >> TYPE_FLAG_DEFINITE_SHIFT);
     }
     void setDefinite(unsigned slot) {
         JS_ASSERT(canSetDefinite(slot));
         flags |= ((slot + 1) << TYPE_FLAG_DEFINITE_SHIFT);
+        JS_ASSERT(definiteSlot() == slot);
     }
 
     /* Whether any values in this set might have the specified type. */

From f5aaa859979691ca04a1f0e8eaf62d0cd0a381e0 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 02:05:24 -0800
Subject: [PATCH 456/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/2efa965ef8e9
Author: Jan Jongboom <janjongboom@gmail.com>
Desc: Merge pull request #14264 from ltedone/Bug_945258-Enable_auto_correction_for_Swedish

Bug 945258 - Enable auto correction for Swedish. r=janjongboom

========

https://hg.mozilla.org/integration/gaia-central/rev/99c65527eda2
Author: Luigi Tedone <luigitedone@gmail.com>
Desc: Bug 945258 - Enable auto correction for Swedish
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index b33583901c5c..7fad24119f9e 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "fc14afb62388750d9d4fa8a8b77f03ddb254b924", 
+    "revision": "2efa965ef8e9cc44b1c4a9e2041aa0db0c8b456f", 
     "repo_path": "/integration/gaia-central"
 }

From f875f7b1b1a8fbffcba820ce50606c8a8edb384b Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 02:15:24 -0800
Subject: [PATCH 457/459] Bumping gaia.json for 8 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/d7b108f7d294
Author: Arnau <arnau@arnaumarch.com>
Desc: Merge pull request #14589 from rnowm/settings-icons

Bug 948856 - [Settings] Update setting icons to use Icon Fonts

========

https://hg.mozilla.org/integration/gaia-central/rev/a58bb5572c91
Author: rnowm <arnau@arnaumarch.com>
Desc: Bug 948856 - [Settings] Update setting icons to use Icon Fonts

========

https://hg.mozilla.org/integration/gaia-central/rev/6cdf6f0934e6
Author: Askeing Yen (fyen) <askeing@gmail.com>
Desc: Merge pull request #14694 from askeing/950592

Bug 950592 - Xfail test_browser_play_youtube_video.py

========

https://hg.mozilla.org/integration/gaia-central/rev/ed8e1a49f212
Author: askeing <askeing@gmail.com>
Desc: Bug 950592 - Xfail test_browser_play_youtube_video.py

========

https://hg.mozilla.org/integration/gaia-central/rev/adaba1c00dd5
Author: evelynhung <jj.evelyn@gmail.com>
Desc: Merge pull request #14699 from evelynhung/issue-943317

Bug 943317 - add a timer for expiring disableTap, r=crdlc

========

https://hg.mozilla.org/integration/gaia-central/rev/8877af277f72
Author: Evelyn Hung <jj.evelyn@gmail.com>
Desc: Bug 943317 - add a timer for expiring disableTap
(cherry picked from commit e95ac024020604d71f50c8d33f1fd669d17b031e)

========

https://hg.mozilla.org/integration/gaia-central/rev/8e09514ea956
Author: EragonJ <eragonj@eragonj.me>
Desc: Merge pull request #14560 from EragonJ/bug-947339

Bug 947339 - [B2G][Settings][Lock Screen] always show create passcode

========

https://hg.mozilla.org/integration/gaia-central/rev/1e47fbc4864e
Author: EragonJ <eragonj@eragonj.me>
Desc: Bug 947339 - [B2G][Settings][Lock Screen] always show create passcode

- use data-mode to show/hide right labels
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 7fad24119f9e..5c99827a7a74 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "2efa965ef8e9cc44b1c4a9e2041aa0db0c8b456f", 
+    "revision": "d7b108f7d294cc4700dbc833a5a64098eb510450", 
     "repo_path": "/integration/gaia-central"
 }

From fad13a9fe29502f047d1e182fbcf08cf27679efa Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 02:30:24 -0800
Subject: [PATCH 458/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/dbbee3739477
Author: Arnau <arnau@arnaumarch.com>
Desc: Merge pull request #14622 from rnowm/942907

Bug 942907 - asterisk * sign for favorites wraps into main space with long contact names

========

https://hg.mozilla.org/integration/gaia-central/rev/0344f325874d
Author: rnowm <arnau@arnaumarch.com>
Desc: Bug 942907 - asterisk * sign for favorites wraps into main space with long contact names
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 5c99827a7a74..276768464768 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "d7b108f7d294cc4700dbc833a5a64098eb510450", 
+    "revision": "dbbee373947797af6baff52589645f3300cd5811", 
     "repo_path": "/integration/gaia-central"
 }

From e9ab5f0725cae5e5e95f2b5eae0878ea93e11237 Mon Sep 17 00:00:00 2001
From: Gaia Pushbot <release+gaiajson@mozilla.com>
Date: Mon, 16 Dec 2013 02:55:24 -0800
Subject: [PATCH 459/459] Bumping gaia.json for 2 gaia-central revision(s)
 a=gaia-bump

========

https://hg.mozilla.org/integration/gaia-central/rev/f112883f55f9
Author: evelynhung <jj.evelyn@gmail.com>
Desc: Merge pull request #14559 from MBRSL/bug-947786-navigator

Bug 947786 - remove 'var navigator = window.navigator', r=evelyn

========

https://hg.mozilla.org/integration/gaia-central/rev/5fe510a4a1ba
Author: Tom Jao <tjao@mozilla.com>
Desc: Bug 947786 - remove 'var navigator = window.navigator'
---
 b2g/config/gaia.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 276768464768..7e6761bfe466 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -1,4 +1,4 @@
 {
-    "revision": "dbbee373947797af6baff52589645f3300cd5811", 
+    "revision": "f112883f55f9f23abd5aac107ca09f5471c37798", 
     "repo_path": "/integration/gaia-central"
 }