Merge m-c to f-t

2024-10-19 00:05:36 +00:00 · 2015-10-03 15:56:56 -07:00 · 2015-10-03 15:56:56 -07:00 · 718f29ed28
commit 718f29ed28
parent 464a796d36 41e2b2b6f7
254 changed files with 12962 additions and 11831 deletions
--- a/2
+++ b/2
@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.

-Bug 1205242 - Changed toolchain, needs clobber
+Bug 1182727 - Changed toolchain, needs clobber again :(
--- a/accessible/atk/AccessibleWrap.cpp
+++ b/accessible/atk/AccessibleWrap.cpp
@ -1115,6 +1115,10 @@ GetInterfacesForProxy(ProxyAccessible* aProxy, uint32_t aInterfaces)
  if (aInterfaces & Interfaces::DOCUMENT)
    interfaces |= 1 << MAI_INTERFACE_DOCUMENT;

+  if (aInterfaces & Interfaces::SELECTION) {
+    interfaces |= 1 << MAI_INTERFACE_SELECTION;
+  }
+
  return interfaces;
 }

--- a/accessible/ipc/DocAccessibleChild.cpp
+++ b/accessible/ipc/DocAccessibleChild.cpp
@ -43,6 +43,10 @@ InterfacesFor(Accessible* aAcc)
  if (aAcc->IsDoc())
    interfaces |= Interfaces::DOCUMENT;

+  if (aAcc->IsSelect()) {
+    interfaces |= Interfaces::SELECTION;
+  }
+
  return interfaces;
 }

--- a/accessible/ipc/ProxyAccessible.cpp
+++ b/accessible/ipc/ProxyAccessible.cpp
@ -1000,6 +1000,14 @@ ProxyAccessible::IndexOfEmbeddedChild(const ProxyAccessible* aChild)
 ProxyAccessible*
 ProxyAccessible::EmbeddedChildAt(size_t aChildIdx)
 {
+  // For an outer doc the only child is a document, which is of course an
+  // embedded child.  Further asking the child process for the id of the child
+  // document won't work because the id of the child doc will be 0, which we
+  // would interpret as being our parent document.
+  if (mOuterDoc) {
+    return ChildAt(aChildIdx);
+  }
+
  uint64_t childID;
  unused << mDoc->SendEmbeddedChildAt(mID, aChildIdx, &childID);
  return mDoc->GetAccessible(childID);
--- a/accessible/ipc/ProxyAccessible.h
+++ b/accessible/ipc/ProxyAccessible.h
@ -391,6 +391,7 @@ enum Interfaces
  TABLE = 16,
  TABLECELL = 32,
  DOCUMENT = 64,
+  SELECTION = 128,
 };

 }
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@ -1066,19 +1066,6 @@ pref("dom.wakelock.enabled", true);
 // Enable webapps add-ons
 pref("dom.apps.customization.enabled", true);

-#ifdef MOZ_GRAPHENE
-// Enable touch caret by default
-pref("touchcaret.enabled", true);
-// Enable selection caret by default
-pref("selectioncaret.enabled", true);
-#else
-// Original caret implementation on collapsed selection.
-pref("touchcaret.enabled", false);
-// Original caret implementation on non-collapsed selection.
-pref("selectioncaret.enabled", false);
-#endif
-
-
 // New implementation to unify touch-caret and selection-carets.
 pref("layout.accessiblecaret.enabled", true);

--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@ -666,7 +666,7 @@ var shell = {
          let manifestURI = Services.io.newURI(manifest, null, documentURI);
          let updateService = Cc['@mozilla.org/offlinecacheupdate-service;1']
                              .getService(Ci.nsIOfflineCacheUpdateService);
-          updateService.scheduleUpdate(manifestURI, documentURI, window);
+          updateService.scheduleUpdate(manifestURI, documentURI, principal, window);
        } catch (e) {
          dump('Error while creating offline cache: ' + e + '\n');
        }
--- a/b2g/graphene/graphene.js
+++ b/b2g/graphene/graphene.js
@ -27,10 +27,8 @@ pref("browser.autofocus", true);
 pref("layers.async-pan-zoom.enabled", false);
 pref("network.predictor.enabled", true);

-// Not touch caret
+// No AccessibleCaret
 pref("layout.accessiblecaret.enabled", false);
-pref("selectioncaret.enabled", false);
-pref("touchcaret.enabled", false);

 pref("gfx.vsync.hw-vsync.enabled", true);
 pref("gfx.vsync.compositor", true);
--- a/browser/app/blocklist.xml
+++ b/browser/app/blocklist.xml
@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1443217898000">
+<blocklist xmlns="http://www.mozilla.org/2006/addons-blocklist" lastupdate="1443743586000">
  <emItems>
      <emItem  blockID="i58" id="webmaster@buzzzzvideos.info">
                        <versionRange  minVersion="0" maxVersion="*">
@ -1282,6 +1282,12 @@
                    </versionRange>
                    <prefs>
              </prefs>
+    </emItem>
+      <emItem  blockID="i1030" id="support@todoist.com">
+                        <versionRange  minVersion="0" maxVersion="3.9" severity="1">
+                    </versionRange>
+                    <prefs>
+              </prefs>
    </emItem>
      <emItem  blockID="i65" id="activity@facebook.com">
                        <versionRange  minVersion="0" maxVersion="*">
@ -1810,6 +1816,12 @@
                    </versionRange>
                    <prefs>
              </prefs>
+    </emItem>
+      <emItem  blockID="i1022" id="g99hiaoekjoasiijdkoleabsy278djasi@jetpack">
+                        <versionRange  minVersion="0" maxVersion="*" severity="3">
+                    </versionRange>
+                    <prefs>
+              </prefs>
    </emItem>
      <emItem  blockID="i746" id="{58d2a791-6199-482f-a9aa-9b725ec61362}">
                        <versionRange  minVersion="0" maxVersion="*" severity="1">
@ -2085,6 +2097,16 @@
                    </versionRange>
                    <prefs>
              </prefs>
+    </emItem>
+      <emItem  blockID="i1024" id="{458fb825-2370-4973-bf66-9d7142141847}">
+                        <versionRange  minVersion="0" maxVersion="*" severity="1">
+                    </versionRange>
+                    <prefs>
+                  <pref>app.update.auto</pref>
+                  <pref>app.update.enabled</pref>
+                  <pref>app.update.interval</pref>
+                  <pref>app.update.url</pref>
+              </prefs>
    </emItem>
      <emItem  blockID="i476" id="mbroctone@facebook.com">
                        <versionRange  minVersion="0" maxVersion="*" severity="3">
@ -3205,6 +3227,14 @@
                  <match name="filename" exp="(NPSWF32.*\.dll)|(NPSWF64.*\.dll)|(Flash\ Player\.plugin)" />                      <versionRange  minVersion="13.0" maxVersion="13.*" severity="0" vulnerabilitystatus="1"></versionRange>
                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
          </pluginItem>
+      <pluginItem  blockID="p1026">
+                  <match name="filename" exp="(NPSWF32.*\.dll)|(NPSWF64.*\.dll)|(Flash\ Player\.plugin)" />                      <versionRange  minVersion="18.0.0.204" maxVersion="18.0.0.232" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
+      <pluginItem  os="Linux" blockID="p1028">
+                  <match name="filename" exp="libflashplayer\.so" />                      <versionRange  minVersion="11.2.202.482" maxVersion="11.2.202.508" severity="0" vulnerabilitystatus="1"></versionRange>
+                            <infoURL>https://get.adobe.com/flashplayer/</infoURL>
+          </pluginItem>
    </pluginItems>

  <gfxItems>
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -6287,7 +6287,8 @@ var OfflineApps = {

    var updateService = Cc["@mozilla.org/offlinecacheupdate-service;1"].
                        getService(Ci.nsIOfflineCacheUpdateService);
-    updateService.scheduleUpdate(manifestURI, aDocument.documentURIObject, window);
+    updateService.scheduleUpdate(manifestURI, aDocument.documentURIObject,
+                                 aDocument.nodePrincipal, window);
  },

  /////////////////////////////////////////////////////////////////////////////
--- a/browser/components/search/test/head.js
+++ b/browser/components/search/test/head.js
@ -6,34 +6,11 @@ XPCOMUtils.defineLazyModuleGetter(this, "Promise",

 function whenNewWindowLoaded(aOptions, aCallback) {
  let win = OpenBrowserWindow(aOptions);
-  let gotLoad = false;
-  let gotActivate = Services.focus.activeWindow == win;
-
-  function maybeRunCallback() {
-    if (gotLoad && gotActivate) {
-      executeSoon(function() { aCallback(win); });
-    }
-  }
-
-  if (!gotActivate) {
-    win.addEventListener("activate", function onActivate() {
-      info("Got activate.");
-      win.removeEventListener("activate", onActivate, false);
-      gotActivate = true;
-      maybeRunCallback();
-    }, false);
-  } else {
-    info("Was activated.");
-  }
-
-  Services.obs.addObserver(function observer(aSubject, aTopic) {
-    if (win == aSubject) {
-      info("Delayed startup finished");
-      Services.obs.removeObserver(observer, aTopic);
-      gotLoad = true;
-      maybeRunCallback();
-    }
-  }, "browser-delayed-startup-finished", false);
+  let focused = SimpleTest.promiseFocus(win);
+  let startupFinished = TestUtils.topicObserved("browser-delayed-startup-finished",
+                                                subject => subject == win).then(() => win);
+  Promise.all([focused, startupFinished])
+    .then(results => executeSoon(() => aCallback(results[1])));

  return win;
 }
--- a/build/clang-plugin/clang-plugin.cpp
+++ b/build/clang-plugin/clang-plugin.cpp
@ -103,6 +103,11 @@ private:
    virtual void run(const MatchFinder::MatchResult &Result);
  };

+  class RefCountedCopyConstructorChecker : public MatchFinder::MatchCallback {
+  public:
+    virtual void run(const MatchFinder::MatchResult &Result);
+  };
+
  ScopeChecker scopeChecker;
  ArithmeticArgChecker arithmeticArgChecker;
  TrivialCtorDtorChecker trivialCtorDtorChecker;
@ -116,6 +121,7 @@ private:
  ExplicitImplicitChecker explicitImplicitChecker;
  NoAutoTypeChecker noAutoTypeChecker;
  NoExplicitMoveConstructorChecker noExplicitMoveConstructorChecker;
+  RefCountedCopyConstructorChecker refCountedCopyConstructorChecker;
  MatchFinder astMatcher;
 };

@ -615,8 +621,6 @@ AST_MATCHER(MemberExpr, isAddRefOrRelease) {
 }

 /// This matcher will select classes which are refcounted.
-AST_MATCHER(QualType, isRefCounted) { return isClassRefCounted(Node); }
-
 AST_MATCHER(CXXRecordDecl, hasRefCntMember) {
  return isClassRefCounted(&Node) && getClassRefCntMember(&Node);
 }
@ -672,6 +676,10 @@ AST_MATCHER(QualType, autoNonAutoableType) {
 AST_MATCHER(CXXConstructorDecl, isExplicitMoveConstructor) {
  return Node.isExplicit() && Node.isMoveConstructor();
 }
+
+AST_MATCHER(CXXConstructorDecl, isCompilerProvidedCopyConstructor) {
+  return !Node.isUserProvided() && Node.isCopyConstructor();
+}
 }
 }

@ -950,6 +958,12 @@ DiagnosticsMatcher::DiagnosticsMatcher() {

  astMatcher.addMatcher(constructorDecl(isExplicitMoveConstructor()).bind("node"),
                        &noExplicitMoveConstructorChecker);
+
+  astMatcher.addMatcher(constructExpr(hasDeclaration(
+                                          constructorDecl(
+                                              isCompilerProvidedCopyConstructor(),
+                                              ofClass(hasRefCntMember())))).bind("node"),
+                        &refCountedCopyConstructorChecker);
 }

 // These enum variants determine whether an allocation has occured in the code.
@ -1374,6 +1388,28 @@ void DiagnosticsMatcher::NoExplicitMoveConstructorChecker::run(
  Diag.Report(D->getLocation(), ErrorID);
 }

+void DiagnosticsMatcher::RefCountedCopyConstructorChecker::run(
+    const MatchFinder::MatchResult &Result) {
+  DiagnosticsEngine &Diag = Result.Context->getDiagnostics();
+  unsigned ErrorID = Diag.getDiagnosticIDs()->getCustomDiagID(
+      DiagnosticIDs::Error, "Invalid use of compiler-provided copy constructor "
+                            "on refcounted type");
+  unsigned NoteID = Diag.getDiagnosticIDs()->getCustomDiagID(
+      DiagnosticIDs::Note, "The default copy constructor also copies the "
+                           "default mRefCnt property, leading to reference "
+                           "count imbalance issues. Please provide your own "
+                           "copy constructor which only copies the fields which "
+                           "need to be copied");
+
+  // Everything we needed to know was checked in the matcher - we just report
+  // the error here
+  const CXXConstructExpr *E =
+    Result.Nodes.getNodeAs<CXXConstructExpr>("node");
+
+  Diag.Report(E->getLocation(), ErrorID);
+  Diag.Report(E->getLocation(), NoteID);
+}
+
 class MozCheckAction : public PluginASTAction {
 public:
  ASTConsumerPtr CreateASTConsumer(CompilerInstance &CI,
--- a/build/clang-plugin/tests/Makefile.in
+++ b/build/clang-plugin/tests/Makefile.in
@ -4,7 +4,7 @@

 # Build without any warning flags, and with clang verify flag for a
 # syntax-only build (no codegen), without a limit on the number of errors.
-OS_CFLAGS := $(filter-out -W%,$(OS_CFLAGS)) -fsyntax-only -Xclang -verify -ferror-limit=0
+OS_CFLAGS := $(filter-out -W%,$(OS_CFLAGS)) -fsyntax-only -Xclang -verify -ferror-limit=0 -std=c11
 OS_CXXFLAGS := $(filter-out -W%,$(OS_CXXFLAGS)) -fsyntax-only -Xclang -verify -ferror-limit=0

 include $(topsrcdir)/config/rules.mk
--- a/build/clang-plugin/tests/TestRefCountedCopyConstructor.cpp
+++ b/build/clang-plugin/tests/TestRefCountedCopyConstructor.cpp
@ -0,0 +1,25 @@
+// Implicit copy construct which is unused
+class RC1 {
+  void AddRef();
+  void Release();
+  int mRefCnt;
+};
+
+// Explicit copy constructor which is used
+class RC2 {
+public:
+  RC2();
+  RC2(const RC2&);
+private:
+  void AddRef();
+  void Release();
+  int mRefCnt;
+};
+
+void f() {
+  RC1* r1 = new RC1();
+  RC1* r1p = new RC1(*r1); // expected-error {{Invalid use of compiler-provided copy constructor on refcounted type}} expected-note {{The default copy constructor also copies the default mRefCnt property, leading to reference count imbalance issues. Please provide your own copy constructor which only copies the fields which need to be copied}}
+
+  RC2* r2 = new RC2();
+  RC2* r2p = new RC2(*r2);
+}
--- a/build/clang-plugin/tests/moz.build
+++ b/build/clang-plugin/tests/moz.build
@ -26,6 +26,7 @@ SOURCES += [
    'TestNonMemMovable.cpp',
    'TestNonTemporaryClass.cpp',
    'TestNoRefcountedInsideLambdas.cpp',
+    'TestRefCountedCopyConstructor.cpp',
    'TestStackClass.cpp',
    'TestTrivialCtorDtor.cpp',
 ]
--- a/build/unix/build-clang/README
+++ b/build/unix/build-clang/README
@ -0,0 +1,34 @@
+build-clang.py
+==============
+
+A script to build clang from source.
+
+```
+usage: build-clang.py [-h] -c CONFIG [--clean]
+
+optional arguments:
+  -h, --help            show this help message and exit
+  -c CONFIG, --config CONFIG
+                        Clang configuration file
+  --clean               Clean the build directory
+```
+
+Config file format
+------------------
+
+build-clang.py accepts a JSON config format with the following fields:
+
+* llvm_revision: The LLVM SVN revision to build.
+* stages: Use 1, 2, or 3 to select different compiler stages.  The default is 3.
+* llvm_repo: SVN path to the LLVM repo.
+* clang_repo: SVN path to the Clang repo.
+* compiler_repo: SVN path to the compiler-rt repo.
+* libcxx_repo: SVN path to the libcxx repo.
+* python_path: Path to the Python 2.7 installation on the machine building clang.
+* gcc_dir: Path to the gcc toolchain installation, only required on Linux.
+* cc: Path to the bootsraping C Compiler.
+* cxx: Path to the bootsraping C++ Compiler.
+* patches: Optional list of patches to apply per platform.  Supported platforms: macosx64, linux32, linux64.  The default is Release.
+* build_type: The type of build to make.  Supported types: Release, Debug, RelWithDebInfo or MinSizeRel.
+* build_libcxx: Whether to build with libcxx.  The default is false.
+* assertions: Whether to enable LLVM assertions.  The default is false.
--- a/build/unix/build-clang/build-clang.py
+++ b/build/unix/build-clang/build-clang.py
@ -14,19 +14,27 @@ import tempfile
 import glob
 import errno
 from contextlib import contextmanager
+import sys

-centOS6 = False
-
+DEBUG = os.getenv("DEBUG")

 def check_run(args):
+    global DEBUG
+    if DEBUG:
+        print >> sys.stderr, ' '.join(args)
    r = subprocess.call(args)
    assert r == 0


 def run_in(path, args):
    d = os.getcwd()
+    global DEBUG
+    if DEBUG:
+        print >> sys.stderr, 'cd "%s"' % path
    os.chdir(path)
    check_run(args)
+    if DEBUG:
+        print >> sys.stderr, 'cd "%s"' % d
    os.chdir(d)


@ -36,14 +44,12 @@ def patch(patch, srcdir):
               '-s'])


-def build_package(package_source_dir, package_build_dir, configure_args,
-                  make_args):
+def build_package(package_build_dir, run_cmake, cmake_args):
    if not os.path.exists(package_build_dir):
        os.mkdir(package_build_dir)
-    run_in(package_build_dir,
-           ["%s/configure" % package_source_dir] + configure_args)
-    run_in(package_build_dir, ["make", "-j4"] + make_args)
-    run_in(package_build_dir, ["make", "install"])
+    if run_cmake:
+        run_in(package_build_dir, ["cmake"] + cmake_args)
+    run_in(package_build_dir, ["ninja", "install"])


@contextmanager
@ -57,7 +63,9 @@ def updated_env(env):

 def build_tar_package(tar, name, base, directory):
    name = os.path.realpath(name)
-    run_in(base, [tar, "-cJf", name, directory])
+    run_in(base, [tar,
+                  "-c -%s -f" % "J" if ".xz" in name else "j",
+                  name, directory])


 def copy_dir_contents(src, dest):
@ -115,9 +123,15 @@ def svn_co(url, directory, revision):
    check_run(["svn", "co", "-r", revision, url, directory])


-def build_one_stage(env, stage_dir, llvm_source_dir):
+def svn_update(directory, revision):
+    run_in(directory, ["svn", "update", "-r", revision])
+
+
+def build_one_stage(env, src_dir, stage_dir, build_libcxx, build_type, assertions,
+                    python_path):
    with updated_env(env):
-        build_one_stage_aux(stage_dir, llvm_source_dir)
+        build_one_stage_aux(src_dir, stage_dir, build_libcxx, build_type,
+                            assertions, python_path)


 def get_platform():
@ -137,34 +151,27 @@ def is_darwin():
    return platform.system() == "Darwin"


-def build_one_stage_aux(stage_dir, llvm_source_dir):
-    os.mkdir(stage_dir)
+def build_one_stage_aux(src_dir, stage_dir, build_libcxx,
+                        build_type, assertions, python_path):
+    if not os.path.exists(stage_dir):
+        os.mkdir(stage_dir)

    build_dir = stage_dir + "/build"
    inst_dir = stage_dir + "/clang"

-    targets = ["x86", "x86_64"]
-    # The Darwin equivalents of binutils appear to have intermittent problems
-    # with objects in compiler-rt that are compiled for arm.  Since the arm
-    # support is only necessary for iOS (which we don't support), only enable
-    # arm support on Linux.
-    if not is_darwin():
-        targets.append("arm")
+    run_cmake = True
+    if os.path.exists(build_dir):
+        run_cmake = False

-    global centOS6
-    if centOS6:
-        python_path = "/usr/bin/python2.7"
-    else:
-        python_path = "/usr/local/bin/python2.7"
-
-    configure_opts = ["--enable-optimized",
-                      "--enable-targets=" + ",".join(targets),
-                      "--disable-assertions",
-                      "--disable-libedit",
-                      "--with-python=%s" % python_path,
-                      "--prefix=%s" % inst_dir,
-                      "--disable-compiler-version-checks"]
-    build_package(llvm_source_dir, build_dir, configure_opts, [])
+    cmake_args = ["-GNinja",
+                  "-DCMAKE_BUILD_TYPE=%s" % build_type,
+                  "-DLLVM_TARGETS_TO_BUILD=X86;ARM",
+                  "-DLLVM_ENABLE_ASSERTIONS=%s" % ("ON" if assertions else "OFF"),
+                  "-DPYTHON_EXECUTABLE=%s" % python_path,
+                  "-DCMAKE_INSTALL_PREFIX=%s" % inst_dir,
+                  "-DLLVM_TOOL_LIBCXX_BUILD=%s" % ("ON" if build_libcxx else "OFF"),
+                  src_dir];
+    build_package(build_dir, run_cmake, cmake_args)

 if __name__ == "__main__":
    # The directories end up in the debug info, so the easy way of getting
@ -181,12 +188,6 @@ if __name__ == "__main__":
    compiler_rt_source_dir = source_dir + "/compiler-rt"
    libcxx_source_dir = source_dir + "/libcxx"

-    global centOS6
-    if centOS6:
-        gcc_dir = "/home/worker/workspace/build/src/gcc"
-    else:
-        gcc_dir = "/tools/gcc-4.7.3-0moz1"
-
    if is_darwin():
        os.environ['MACOSX_DEPLOYMENT_TARGET'] = '10.7'

@ -194,14 +195,67 @@ if __name__ == "__main__":
    parser.add_argument('-c', '--config', required=True,
                        type=argparse.FileType('r'),
                        help="Clang configuration file")
+    parser.add_argument('--clean', required=False,
+                        action='store_true',
+                        help="Clean the build directory")

    args = parser.parse_args()
    config = json.load(args.config)
+
+    if args.clean:
+        shutil.rmtree(build_dir)
+        os.sys.exit(0)
+
    llvm_revision = config["llvm_revision"]
    llvm_repo = config["llvm_repo"]
    clang_repo = config["clang_repo"]
    compiler_repo = config["compiler_repo"]
    libcxx_repo = config["libcxx_repo"]
+    stages = 3
+    if "stages" in config:
+        stages = int(config["stages"])
+        if stages not in (1, 2, 3):
+            raise ValueError("We only know how to build 1, 2, or 3 stages")
+    build_type = "Release"
+    if "build_type" in config:
+        build_type = config["build_type"]
+        if build_type not in ("Release", "Debug", "RelWithDebInfo", "MinSizeRel"):
+            raise ValueError("We only know how to do Release, Debug, RelWithDebInfo or MinSizeRel builds")
+    build_libcxx = False
+    if "build_libcxx" in config:
+        build_libcxx = config["build_libcxx"]
+        if build_libcxx not in (True, False):
+            raise ValueError("Only boolean values are accepted for build_libcxx.")
+    assertions = False
+    if "assertions" in config:
+        assertions = config["assertions"]
+        if assertions not in (True, False):
+            raise ValueError("Only boolean values are accepted for assertions.")
+    python_path = None
+    if "python_path" not in config:
+        raise ValueError("Config file needs to set python_path")
+    python_path = config["python_path"]
+    gcc_dir = None
+    if "gcc_dir" in config:
+        gcc_dir = config["gcc_dir"]
+        if not os.path.exists(gcc_dir):
+            raise ValueError("gcc_dir must point to an existing path")
+    if not is_darwin() and gcc_dir is None:
+        raise ValueError("Config file needs to set gcc_dir")
+    cc = None
+    if "cc" in config:
+        cc = config["cc"]
+        if not os.path.exists(cc):
+            raise ValueError("cc must point to an existing path")
+    else:
+        raise ValueError("Config file needs to set cc")
+    cxx = None
+    if "cxx" in config:
+        cxx = config["cxx"]
+        if not os.path.exists(cxx):
+            raise ValueError("cxx must point to an existing path")
+    else:
+        raise ValueError("Config file needs to set cxx")

    if not os.path.exists(source_dir):
        os.makedirs(source_dir)
@ -216,50 +270,69 @@ if __name__ == "__main__":
                   llvm_source_dir + "/projects/libcxx")
        for p in config.get("patches", {}).get(get_platform(), []):
            patch(p, source_dir)
+    else:
+        svn_update(llvm_source_dir, llvm_revision)
+        svn_update(clang_source_dir, llvm_revision)
+        svn_update(compiler_rt_source_dir, llvm_revision)
+        svn_update(libcxx_source_dir, llvm_revision)

-    if os.path.exists(build_dir):
-        shutil.rmtree(build_dir)
-    os.makedirs(build_dir)
+    if not os.path.exists(build_dir):
+        os.makedirs(build_dir)

    stage1_dir = build_dir + '/stage1'
    stage1_inst_dir = stage1_dir + '/clang'

+    final_stage_dir = stage1_dir
+
    if is_darwin():
        extra_cflags = ""
        extra_cxxflags = "-stdlib=libc++"
        extra_cflags2 = ""
        extra_cxxflags2 = "-stdlib=libc++"
-        cc = "/usr/bin/clang"
-        cxx = "/usr/bin/clang++"
    else:
-        extra_cflags = ""
-        extra_cxxflags = ""
-        extra_cflags2 = "-static-libgcc --gcc-toolchain=%s" % gcc_dir
-        extra_cxxflags2 = "-static-libgcc -static-libstdc++ --gcc-toolchain=%s" % gcc_dir
-        cc = gcc_dir + "/bin/gcc"
-        cxx = gcc_dir + "/bin/g++"
+        extra_cflags = "-static-libgcc"
+        extra_cxxflags = "-static-libgcc -static-libstdc++"
+        extra_cflags2 = "-fPIC --gcc-toolchain=%s" % gcc_dir
+        extra_cxxflags2 = "-fPIC --gcc-toolchain=%s" % gcc_dir

-    if os.environ.has_key('LD_LIBRARY_PATH'):
-        os.environ['LD_LIBRARY_PATH'] = '%s/lib64/:%s' % (gcc_dir, os.environ['LD_LIBRARY_PATH']);
-    else:
-        os.environ['LD_LIBRARY_PATH'] = '%s/lib64/' % gcc_dir
+        if os.environ.has_key('LD_LIBRARY_PATH'):
+            os.environ['LD_LIBRARY_PATH'] = '%s/lib64/:%s' % (gcc_dir, os.environ['LD_LIBRARY_PATH']);
+        else:
+            os.environ['LD_LIBRARY_PATH'] = '%s/lib64/' % gcc_dir

    build_one_stage(
        {"CC": cc + " %s" % extra_cflags,
         "CXX": cxx + " %s" % extra_cxxflags},
-        stage1_dir, llvm_source_dir)
+        llvm_source_dir, stage1_dir, build_libcxx,
+        build_type, assertions, python_path)

-    stage2_dir = build_dir + '/stage2'
-    build_one_stage(
-        {"CC": stage1_inst_dir + "/bin/clang %s" % extra_cflags2,
-         "CXX": stage1_inst_dir + "/bin/clang++ %s" % extra_cxxflags2},
-        stage2_dir, llvm_source_dir)
+    if stages > 1:
+        stage2_dir = build_dir + '/stage2'
+        stage2_inst_dir = stage2_dir + '/clang'
+        final_stage_dir = stage2_dir
+        build_one_stage(
+            {"CC": stage1_inst_dir + "/bin/clang %s" % extra_cflags2,
+             "CXX": stage1_inst_dir + "/bin/clang++ %s" % extra_cxxflags2},
+            llvm_source_dir, stage2_dir, build_libcxx,
+            build_type, assertions, python_path)
+
+        if stages > 2:
+            stage3_dir = build_dir + '/stage3'
+            final_stage_dir = stage3_dir
+            build_one_stage(
+                {"CC": stage2_inst_dir + "/bin/clang %s" % extra_cflags2,
+                 "CXX": stage2_inst_dir + "/bin/clang++ %s" % extra_cxxflags2},
+                llvm_source_dir, stage3_dir, build_libcxx,
+                build_type, assertions, python_path)

    if not is_darwin():
-        stage2_inst_dir = stage2_dir + '/clang'
+        final_stage_inst_dir = final_stage_dir + '/clang'
        build_and_use_libgcc(
            {"CC": cc + " %s" % extra_cflags,
             "CXX": cxx + " %s" % extra_cxxflags},
-            stage2_inst_dir)
+            final_stage_inst_dir)

-    build_tar_package("tar", "clang.tar.xz", stage2_dir, "clang")
+    if is_darwin():
+        build_tar_package("tar", "clang.tar.bz2", final_stage_dir, "clang")
+    else:
+        build_tar_package("tar", "clang.tar.xz", final_stage_dir, "clang")
--- a/build/unix/build-clang/clang-3.3.json
+++ b/build/unix/build-clang/clang-3.3.json
@ -1,11 +0,0 @@
-{
-    "llvm_revision": "183744",
-    "llvm_repo": "http://llvm.org/svn/llvm-project/llvm/branches/release_33",
-    "clang_repo": "http://llvm.org/svn/llvm-project/cfe/branches/release_33",
-    "compiler_repo": "http://llvm.org/svn/llvm-project/compiler-rt/branches/release_33",
-    "patches": {
-        "macosx64": ["llvm-debug-frame.patch"],
-        "linux64": ["llvm-debug-frame.patch", "no-sse-on-linux.patch"],
-        "linux32": ["llvm-debug-frame.patch", "no-sse-on-linux.patch"]
-    }
-}
--- a/build/unix/build-clang/clang-3.6.json
+++ b/build/unix/build-clang/clang-3.6.json
@ -1,8 +0,0 @@
-{
-    "llvm_revision": "241773",
-    "llvm_repo": "http://llvm.org/svn/llvm-project/llvm/branches/release_36",
-    "clang_repo": "http://llvm.org/svn/llvm-project/cfe/branches/release_36",
-    "compiler_repo": "http://llvm.org/svn/llvm-project/compiler-rt/branches/release_36",
-    "patches": {
-    }
-}
--- a/build/unix/build-clang/clang-static-analysis-linux64-centos6.json
+++ b/build/unix/build-clang/clang-static-analysis-linux64-centos6.json
@ -0,0 +1,20 @@
+{
+    "llvm_revision": "247539",
+    "stages": "3",
+    "build_libcxx": false,
+    "build_type": "Release",
+    "assertions": false,
+    "llvm_repo": "https://llvm.org/svn/llvm-project/llvm/trunk",
+    "clang_repo": "https://llvm.org/svn/llvm-project/cfe/trunk",
+    "compiler_repo": "https://llvm.org/svn/llvm-project/compiler-rt/trunk",
+    "libcxx_repo": "https://llvm.org/svn/llvm-project/libcxx/trunk",
+    "python_path": "/usr/bin/python2.7",
+    "gcc_dir": "/home/worker/workspace/build/src/gcc",
+    "cc": "/home/worker/workspace/build/src/gcc/bin/gcc",
+    "cxx": "/home/worker/workspace/build/src/gcc/bin/g++",
+    "patches": {
+        "macosx64": ["llvm-debug-frame.patch"],
+        "linux64": ["llvm-debug-frame.patch"],
+        "linux32": ["llvm-debug-frame.patch"]
+    }
+}
--- a/build/unix/build-clang/clang-static-analysis-linux64.json
+++ b/build/unix/build-clang/clang-static-analysis-linux64.json
@ -0,0 +1,20 @@
+{
+    "llvm_revision": "247539",
+    "stages": "3",
+    "build_libcxx": false,
+    "build_type": "Release",
+    "assertions": false,
+    "llvm_repo": "https://llvm.org/svn/llvm-project/llvm/trunk",
+    "clang_repo": "https://llvm.org/svn/llvm-project/cfe/trunk",
+    "compiler_repo": "https://llvm.org/svn/llvm-project/compiler-rt/trunk",
+    "libcxx_repo": "https://llvm.org/svn/llvm-project/libcxx/trunk",
+    "python_path": "/usr/local/bin/python2.7",
+    "gcc_dir": "/tools/gcc-4.7.3-0moz1",
+    "cc": "/home/worker/workspace/build/src/gcc/bin/gcc",
+    "cxx": "/home/worker/workspace/build/src/gcc/bin/g++",
+    "patches": {
+        "macosx64": ["llvm-debug-frame.patch"],
+        "linux64": ["llvm-debug-frame.patch"],
+        "linux32": ["llvm-debug-frame.patch"]
+    }
+}
--- a/build/unix/build-clang/clang-static-analysis-macosx64.json
+++ b/build/unix/build-clang/clang-static-analysis-macosx64.json
@ -1,9 +1,16 @@
 {
    "llvm_revision": "247539",
+    "stages": "3",
+    "build_libcxx": true,
+    "build_type": "Release",
+    "assertions": false,
    "llvm_repo": "https://llvm.org/svn/llvm-project/llvm/trunk",
    "clang_repo": "https://llvm.org/svn/llvm-project/cfe/trunk",
    "compiler_repo": "https://llvm.org/svn/llvm-project/compiler-rt/trunk",
    "libcxx_repo": "https://llvm.org/svn/llvm-project/libcxx/trunk",
+    "python_path": "/usr/local/bin/python2.7",
+    "cc": "/usr/bin/clang",
+    "cxx": "/usr/bin/clang++",
    "patches": {
        "macosx64": ["llvm-debug-frame.patch"],
        "linux64": ["llvm-debug-frame.patch"],
--- a/build/unix/build-clang/no-sse-on-linux.patch
+++ b/build/unix/build-clang/no-sse-on-linux.patch
@ -1,13 +0,0 @@
-Index: lib/Driver/Tools.cpp
-===================================================================
--- a/clang/lib/Driver/Tools.cpp        (revision 181515)
-+++ b/clang/lib/Driver/Tools.cpp        (working copy)
-@@ -1245,7 +1245,7 @@
-   // All x86 devices running Android have core2 as their common
-   // denominator. This makes a better choice than pentium4.
-   if (Triple.getEnvironment() == llvm::Triple::Android)
-    return "core2";
-+    return "686";
-
-   // Fallback to p4.
-   return "pentium4";
--- a/build/unix/build-clang/setup.sh
+++ b/build/unix/build-clang/setup.sh
@ -1,4 +0,0 @@
-#!/bin/sh
-
-rm -rf clang
-tar -xjf clang.tar.bz2
--- a/caps/BasePrincipal.cpp
+++ b/caps/BasePrincipal.cpp
@ -269,6 +269,44 @@ BasePrincipal::SubsumesConsideringDomain(nsIPrincipal *aOther, bool *aResult)
  return NS_OK;
 }

+NS_IMETHODIMP
+BasePrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsPrincipal)
+{
+  // Check the internal method first, which allows us to quickly approve loads
+  // for the System Principal.
+  if (MayLoadInternal(aURI)) {
+    return NS_OK;
+  }
+
+  nsresult rv;
+  if (aAllowIfInheritsPrincipal) {
+    // If the caller specified to allow loads of URIs that inherit
+    // our principal, allow the load if this URI inherits its principal.
+    bool doesInheritSecurityContext;
+    rv = NS_URIChainHasFlags(aURI, nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT,
+                             &doesInheritSecurityContext);
+    if (NS_SUCCEEDED(rv) && doesInheritSecurityContext) {
+      return NS_OK;
+    }
+  }
+
+  bool fetchableByAnyone;
+  rv = NS_URIChainHasFlags(aURI, nsIProtocolHandler::URI_FETCHABLE_BY_ANYONE, &fetchableByAnyone);
+  if (NS_SUCCEEDED(rv) && fetchableByAnyone) {
+    return NS_OK;
+  }
+
+  if (aReport) {
+    nsCOMPtr<nsIURI> prinURI;
+    rv = GetURI(getter_AddRefs(prinURI));
+    if (NS_SUCCEEDED(rv) && prinURI) {
+      nsScriptSecurityManager::ReportError(nullptr, NS_LITERAL_STRING("CheckSameOriginError"), prinURI, aURI);
+    }
+  }
+
+  return NS_ERROR_DOM_BAD_URI;
+}
+
 NS_IMETHODIMP
 BasePrincipal::GetCsp(nsIContentSecurityPolicy** aCsp)
 {
--- a/caps/BasePrincipal.h
+++ b/caps/BasePrincipal.h
@ -18,6 +18,8 @@ class nsILoadContext;
 class nsIObjectOutputStream;
 class nsIObjectInputStream;

+class nsExpandedPrincipal;
+
 namespace mozilla {

 class OriginAttributes : public dom::OriginAttributesDictionary
@ -141,6 +143,7 @@ public:
  NS_IMETHOD EqualsConsideringDomain(nsIPrincipal* other, bool* _retval) final;
  NS_IMETHOD Subsumes(nsIPrincipal* other, bool* _retval) final;
  NS_IMETHOD SubsumesConsideringDomain(nsIPrincipal* other, bool* _retval) final;
+  NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report, bool allowIfInheritsPrincipal) final;
  NS_IMETHOD GetCsp(nsIContentSecurityPolicy** aCsp) override;
  NS_IMETHOD SetCsp(nsIContentSecurityPolicy* aCsp) override;
  NS_IMETHOD GetCspJSON(nsAString& outCSPinJSON) override;
@ -174,6 +177,12 @@ protected:
  virtual nsresult GetOriginInternal(nsACString& aOrigin) = 0;
  virtual bool SubsumesInternal(nsIPrincipal* aOther, DocumentDomainConsideration aConsider) = 0;

+  // Internal, side-effect-free check to determine whether the concrete
+  // principal would allow the load ignoring any common behavior implemented in
+  // BasePrincipal::CheckMayLoad.
+  virtual bool MayLoadInternal(nsIURI* aURI) = 0;
+  friend class ::nsExpandedPrincipal;
+
  // Helper to check whether this principal is associated with an addon that
  // allows unprivileged code to load aURI.
  bool AddonAllowsLoad(nsIURI* aURI);
--- a/caps/nsNullPrincipal.cpp
+++ b/caps/nsNullPrincipal.cpp
@ -107,15 +107,9 @@ nsNullPrincipal::GetOriginInternal(nsACString& aOrigin)
  return mURI->GetSpec(aOrigin);
 }

-NS_IMETHODIMP
-nsNullPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsPrincipal)
- {
-  if (aAllowIfInheritsPrincipal) {
-    if (nsPrincipal::IsPrincipalInherited(aURI)) {
-      return NS_OK;
-    }
-  }
-
+bool
+nsNullPrincipal::MayLoadInternal(nsIURI* aURI)
+{
  // Also allow the load if we are the principal of the URI being checked.
  nsCOMPtr<nsIURIWithPrincipal> uriPrinc = do_QueryInterface(aURI);
  if (uriPrinc) {
@ -123,16 +117,11 @@ nsNullPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsP
    uriPrinc->GetPrincipal(getter_AddRefs(principal));

    if (principal == this) {
-      return NS_OK;
+      return true;
    }
  }

-  if (aReport) {
-    nsScriptSecurityManager::ReportError(
-      nullptr, NS_LITERAL_STRING("CheckSameOriginError"), mURI, aURI);
-  }
-
-  return NS_ERROR_DOM_BAD_URI;
+  return false;
 }

 NS_IMETHODIMP
--- a/caps/nsNullPrincipal.h
+++ b/caps/nsNullPrincipal.h
@ -44,7 +44,6 @@ public:
  NS_IMETHOD GetURI(nsIURI** aURI) override;
  NS_IMETHOD GetDomain(nsIURI** aDomain) override;
  NS_IMETHOD SetDomain(nsIURI* aDomain) override;
-  NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report, bool allowIfInheritsPrincipal) override;
  NS_IMETHOD GetIsNullPrincipal(bool* aIsNullPrincipal) override;
  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain) override;
  nsresult GetOriginInternal(nsACString& aOrigin) override;
@ -68,6 +67,8 @@ public:
    return aOther == this;
  }

+  bool MayLoadInternal(nsIURI* aURI) override;
+
  nsCOMPtr<nsIURI> mURI;
  nsCOMPtr<nsIContentSecurityPolicy> mCSP;
 };
--- a/caps/nsPrincipal.cpp
+++ b/caps/nsPrincipal.cpp
@ -238,17 +238,9 @@ nsPrincipal::GetURI(nsIURI** aURI)
  return NS_EnsureSafeToReturn(mCodebase, aURI);
 }

-NS_IMETHODIMP
-nsPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsPrincipal)
+bool
+nsPrincipal::MayLoadInternal(nsIURI* aURI)
 {
-   if (aAllowIfInheritsPrincipal) {
-    // If the caller specified to allow loads of URIs that inherit
-    // our principal, allow the load if this URI inherits its principal
-    if (nsPrincipal::IsPrincipalInherited(aURI)) {
-      return NS_OK;
-    }
-  }
-
  // See if aURI is something like a Blob URI that is actually associated with
  // a principal.
  nsCOMPtr<nsIURIWithPrincipal> uriWithPrin = do_QueryInterface(aURI);
@ -257,17 +249,17 @@ nsPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsPrinc
    uriWithPrin->GetPrincipal(getter_AddRefs(uriPrin));
  }
  if (uriPrin && nsIPrincipal::Subsumes(uriPrin)) {
-      return NS_OK;
+    return true;
  }

  // If this principal is associated with an addon, check whether that addon
  // has been given permission to load from this domain.
  if (AddonAllowsLoad(aURI)) {
-    return NS_OK;
+    return true;
  }

  if (nsScriptSecurityManager::SecurityCompareURIs(mCodebase, aURI)) {
-    return NS_OK;
+    return true;
  }

  // If strict file origin policy is in effect, local files will always fail
@ -276,13 +268,10 @@ nsPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsPrinc
  if (nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
      NS_URIIsLocalFile(aURI) &&
      NS_RelaxStrictFileOriginPolicy(aURI, mCodebase)) {
-    return NS_OK;
+    return true;
  }

-  if (aReport) {
-    nsScriptSecurityManager::ReportError(nullptr, NS_LITERAL_STRING("CheckSameOriginError"), mCodebase, aURI);
-  }
-  return NS_ERROR_DOM_BAD_URI;
+  return false;
 }

 void
@ -758,17 +747,16 @@ nsExpandedPrincipal::SubsumesInternal(nsIPrincipal* aOther,
  return false;
 }

-NS_IMETHODIMP
-nsExpandedPrincipal::CheckMayLoad(nsIURI* uri, bool aReport, bool aAllowIfInheritsPrincipal)
+bool
+nsExpandedPrincipal::MayLoadInternal(nsIURI* uri)
 {
-  nsresult rv;
  for (uint32_t i = 0; i < mPrincipals.Length(); ++i){
-    rv = mPrincipals[i]->CheckMayLoad(uri, aReport, aAllowIfInheritsPrincipal);
-    if (NS_SUCCEEDED(rv))
-      return rv;
+    if (BasePrincipal::Cast(mPrincipals[i])->MayLoadInternal(uri)) {
+      return true;
+    }
  }

-  return NS_ERROR_DOM_BAD_URI;
+  return false;
 }

 NS_IMETHODIMP
--- a/caps/nsPrincipal.h
+++ b/caps/nsPrincipal.h
@ -26,7 +26,6 @@ public:
  NS_IMETHOD GetURI(nsIURI** aURI) override;
  NS_IMETHOD GetDomain(nsIURI** aDomain) override;
  NS_IMETHOD SetDomain(nsIURI* aDomain) override;
-  NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report, bool allowIfInheritsPrincipal) override;
  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain) override;
  virtual bool IsOnCSSUnprefixingWhitelist() override;
  bool IsCodebasePrincipal() const override { return true; }
@ -40,23 +39,6 @@ public:
  virtual void GetScriptLocation(nsACString& aStr) override;
  void SetURI(nsIURI* aURI);

-  static bool IsPrincipalInherited(nsIURI* aURI) {
-    // return true if the loadee URI has
-    // the URI_INHERITS_SECURITY_CONTEXT flag set.
-    bool doesInheritSecurityContext;
-    nsresult rv =
-    NS_URIChainHasFlags(aURI,
-                        nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT,
-                        &doesInheritSecurityContext);
-
-    if (NS_SUCCEEDED(rv) && doesInheritSecurityContext) {
-      return true;
-    }
-
-    return false;
-  }
-
-
  /**
   * Computes the puny-encoded origin of aURI.
   */
@ -79,6 +61,7 @@ protected:
  virtual ~nsPrincipal();

  bool SubsumesInternal(nsIPrincipal* aOther, DocumentDomainConsideration aConsideration) override;
+  bool MayLoadInternal(nsIURI* aURI) override;
 };

 class nsExpandedPrincipal : public nsIExpandedPrincipal, public mozilla::BasePrincipal
@ -95,7 +78,6 @@ public:
  NS_IMETHOD GetURI(nsIURI** aURI) override;
  NS_IMETHOD GetDomain(nsIURI** aDomain) override;
  NS_IMETHOD SetDomain(nsIURI* aDomain) override;
-  NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report, bool allowIfInheritsPrincipal) override;
  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain) override;
  virtual bool IsOnCSSUnprefixingWhitelist() override;
  virtual void GetScriptLocation(nsACString &aStr) override;
@ -105,6 +87,7 @@ protected:
  virtual ~nsExpandedPrincipal();

  bool SubsumesInternal(nsIPrincipal* aOther, DocumentDomainConsideration aConsideration) override;
+  bool MayLoadInternal(nsIURI* aURI) override;

 private:
  nsTArray< nsCOMPtr<nsIPrincipal> > mPrincipals;
--- a/caps/nsSystemPrincipal.cpp
+++ b/caps/nsSystemPrincipal.cpp
@ -41,12 +41,6 @@ nsSystemPrincipal::GetScriptLocation(nsACString &aStr)
 // Methods implementing nsIPrincipal //
 ///////////////////////////////////////

-NS_IMETHODIMP
-nsSystemPrincipal::CheckMayLoad(nsIURI* uri, bool aReport, bool aAllowIfInheritsPrincipal)
-{
-    return NS_OK;
-}
-
 NS_IMETHODIMP
 nsSystemPrincipal::GetHashValue(uint32_t *result)
 {
--- a/caps/nsSystemPrincipal.h
+++ b/caps/nsSystemPrincipal.h
@ -29,7 +29,6 @@ public:
  NS_IMETHOD GetURI(nsIURI** aURI) override;
  NS_IMETHOD GetDomain(nsIURI** aDomain) override;
  NS_IMETHOD SetDomain(nsIURI* aDomain) override;
-  NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report, bool allowIfInheritsPrincipal) override;
  NS_IMETHOD GetCsp(nsIContentSecurityPolicy** aCsp) override;
  NS_IMETHOD SetCsp(nsIContentSecurityPolicy* aCsp) override;
  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain) override;
@ -46,6 +45,11 @@ protected:
  {
    return true;
  }
+
+  bool MayLoadInternal(nsIURI* aURI) override
+  {
+    return true;
+  }
 };

 #endif // nsSystemPrincipal_h__
--- a/caps/tests/mochitest/test_extensionURL.html
+++ b/caps/tests/mochitest/test_extensionURL.html
@ -121,15 +121,33 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1161831
      return p;
    }

+    function testXHR(url, shouldThrow) {
+      return new Promise(function(resolve, reject) {
+        var xhr = new XMLHttpRequest();
+        xhr.addEventListener("load", () => { ok(!shouldThrow, "XHR succeeded for " + url); resolve(); });
+        xhr.addEventListener("error", () => { ok(false, "Unexpected XHR error: " + url); resolve(); });
+        try {
+          xhr.open("GET", url, true);
+          xhr.send();
+        } catch (e) {
+          ok(shouldThrow, "XHR threw for " + url);
+          resolve();
+        }
+      });
+    }
+
    //
    // Perform some loads and make sure they work correctly.
    //
    testLoad.bind(null, 'moz-extension://cherise', navigateFromChromeWithLocation)()
    .then(testLoad.bind(null, 'moz-extension://cherise', navigateFromChromeWithWebNav))
    .then(testLoad.bind(null, 'moz-extension://cherise', navigateWithLocation, /* shouldThrow = */ true))
+    .then(testXHR.bind(null, 'moz-extension://cherise', /* shouldThrow = */ true))
    .then(setWhitelistCallback.bind(null, /cherise/))
    .then(testLoad.bind(null, 'moz-extension://cherise', navigateWithLocation))
+    .then(testXHR.bind(null, 'moz-extension://cherise'))
    .then(testLoad.bind(null, 'moz-extension://liebchen', navigateWithLocation, /* shouldThrow = */ true))
+    .then(testXHR.bind(null, 'moz-extension://liebchen', /* shouldThrow = */ true))
    .then(setWhitelistCallback.bind(null, /cherise|liebchen/))
    .then(testLoad.bind(null, 'moz-extension://liebchen', navigateWithLocation))
    .then(testLoad.bind(null, 'moz-extension://liebchen', navigateWithSrc))
--- a/dom/apps/Webapps.jsm
+++ b/dom/apps/Webapps.jsm
@ -195,10 +195,10 @@ const STORE_ID_PENDING_PREFIX = "#unknownID#";

 this.DOMApplicationRegistry = {
  // pseudo-constants for the different application kinds.
-  get kPackaged()       "packaged",
-  get kHosted()         "hosted",
-  get kHostedAppcache() "hosted-appcache",
-  get kAndroid()        "android-native",
+  get kPackaged()       { return "packaged"; },
+  get kHosted()         { return "hosted"; },
+  get kHostedAppcache() { return "hosted-appcache"; },
+  get kAndroid()        { return "android-native"; },

  // Path to the webapps.json file where we store the registry data.
  appsFile: null,
@ -1989,8 +1989,12 @@ this.DOMApplicationRegistry = {
        },
        id: aApp.id
      });
+      let appURI = NetUtil.newURI(aApp.origin, null, null);
+      let principal =
+        Services.scriptSecurityManager.createCodebasePrincipal(appURI,
+                                                               {appId: aApp.localId});
      let cacheUpdate = updateSvc.scheduleAppUpdate(
-        appcacheURI, docURI, aApp.localId, false, aProfileDir);
+        appcacheURI, docURI, principal, aApp.localId, false, aProfileDir);

      // We save the download details for potential further usage like
      // cancelling it.
@ -2139,8 +2143,12 @@ this.DOMApplicationRegistry = {
          new ManifestHelper(manifest, aData.origin, aData.manifestURL);
        debug("onlyCheckAppCache - launch updateSvc.checkForUpdate for " +
              helper.fullAppcachePath());
+        let appURI = NetUtil.newURI(aApp.origin, null, null);
+        let principal =
+          Services.scriptSecurityManager.createCodebasePrincipal(appURI,
+                                                                 {appId: aApp.localId});
        updateSvc.checkForUpdate(Services.io.newURI(helper.fullAppcachePath(), null, null),
-                                 app.localId, false, updateObserver);
+                                 principal, app.localId, false, updateObserver);
      });
      return;
    }
@ -2409,9 +2417,13 @@ this.DOMApplicationRegistry = {
            manifest.fullAppcachePath());

      let updateDeferred = Promise.defer();
+      let appURI = NetUtil.newURI(aApp.origin, null, null);
+      let principal =
+        Services.scriptSecurityManager.createCodebasePrincipal(appURI,
+                                                               {appId: aApp.localId});

      updateSvc.checkForUpdate(Services.io.newURI(manifest.fullAppcachePath(), null, null),
-                               aApp.localId, false,
+                               principal, aApp.localId, false,
                               (aSubject, aTopic, aData) => updateDeferred.resolve(aTopic));

      let topic = yield updateDeferred.promise;
--- a/dom/apps/tests/test_app_update.html
+++ b/dom/apps/tests/test_app_update.html
@ -158,7 +158,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=826058
    ok(app, "App is non-null");
    if (app.installState == "pending") {
      ok(true, "App is pending. Waiting for progress");
-      app.onprogress = function() ok(true, "Got download progress");
+      app.onprogress = () => ok(true, "Got download progress");
      app.ondownloadsuccess = continueTest;
      app.ondownloaderror = mozAppsError;
      yield undefined;
@ -173,8 +173,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=826058
    // manifest, so there should always be an update.
    var lastCheck = app.lastUpdateCheck;
    ok(true, "Setting callbacks");
-    app.ondownloadapplied = function() ok(true, "downloadapplied fired.");
-    app.ondownloadavailable = function() ok(false, "downloadavailable fired");
+    app.ondownloadapplied = () => ok(true, "downloadapplied fired.");
+    app.ondownloadavailable = () => ok(false, "downloadavailable fired");
    ok(true, "Checking for updates");
    var request = app.checkForUpdate();
    request.onerror = mozAppsError;
--- a/dom/base/nsContentSink.cpp
+++ b/dom/base/nsContentSink.cpp
@ -1171,7 +1171,8 @@ nsContentSink::ProcessOfflineManifest(const nsAString& aManifestSpec)

    if (updateService) {
      nsCOMPtr<nsIDOMDocument> domdoc = do_QueryInterface(mDocument);
-      updateService->ScheduleOnDocumentStop(manifestURI, mDocumentURI, domdoc);
+      updateService->ScheduleOnDocumentStop(manifestURI, mDocumentURI,
+                                            mDocument->NodePrincipal(), domdoc);
    }
    break;
  }
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@ -2710,6 +2710,7 @@ nsContentUtils::SubjectPrincipal()
  MOZ_ASSERT(NS_IsMainThread());
  JSContext* cx = GetCurrentJSContext();
  if (!cx) {
+    Telemetry::Accumulate(Telemetry::SUBJECT_PRINCIPAL_ACCESSED_WITHOUT_SCRIPT_ON_STACK, true);
    return GetSystemPrincipal();
  }

--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@ -7838,9 +7838,7 @@ nsDocument::GetViewportInfo(const ScreenIntSize& aDisplaySize)
  // pixel an integer, and we want the adjusted value.
  float fullZoom = context ? context->DeviceContext()->GetFullZoom() : 1.0;
  fullZoom = (fullZoom == 0.0) ? 1.0 : fullZoom;
-  CSSToLayoutDeviceScale layoutDeviceScale(
-    (float)nsPresContext::AppUnitsPerCSSPixel() /
-    context->AppUnitsPerDevPixel());
+  CSSToLayoutDeviceScale layoutDeviceScale = context->CSSToDevPixelScale();

  CSSToScreenScale defaultScale = layoutDeviceScale
                                * LayoutDeviceToScreenScale(1.0);
@ -8052,7 +8050,7 @@ nsDocument::GetViewportInfo(const ScreenIntSize& aDisplaySize)

    // We need to perform a conversion, but only if the initial or maximum
    // scale were set explicitly by the user.
-    if (mValidScaleFloat) {
+    if (mValidScaleFloat && scaleFloat >= scaleMinFloat && scaleFloat <= scaleMaxFloat) {
      CSSSize displaySize = ScreenSize(aDisplaySize) / scaleFloat;
      size.width = std::max(size.width, displaySize.width);
      size.height = std::max(size.height, displaySize.height);
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -4411,7 +4411,7 @@ nsGlobalWindow::GetApplicationCache(ErrorResult& aError)

  if (!mApplicationCache) {
    nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(GetDocShell()));
-    if (!webNav) {
+    if (!webNav || !mDoc) {
      aError.Throw(NS_ERROR_FAILURE);
      return nullptr;
    }
@ -4426,7 +4426,7 @@ nsGlobalWindow::GetApplicationCache(ErrorResult& aError)
    nsContentUtils::GetOfflineAppManifest(mDoc, getter_AddRefs(manifestURI));

    nsRefPtr<nsDOMOfflineResourceList> applicationCache =
-      new nsDOMOfflineResourceList(manifestURI, uri, this);
+      new nsDOMOfflineResourceList(manifestURI, uri, mDoc->NodePrincipal(), this);

    applicationCache->Init();

--- a/dom/base/nsViewportInfo.cpp
+++ b/dom/base/nsViewportInfo.cpp
@ -10,13 +10,6 @@

 using namespace mozilla;

-void
-nsViewportInfo::SetDefaultZoom(const CSSToScreenScale& aDefaultZoom)
-{
-  MOZ_ASSERT(aDefaultZoom.scale >= 0.0f);
-  mDefaultZoom = aDefaultZoom;
-}
-
 void
 nsViewportInfo::ConstrainViewportValues()
 {
@ -24,6 +17,12 @@ nsViewportInfo::ConstrainViewportValues()
  // dev.w3.org/csswg/css-device-adapt section 6.2
  mMaxZoom = std::max(mMinZoom, mMaxZoom);

-  mDefaultZoom = mDefaultZoom < mMaxZoom ? mDefaultZoom : mMaxZoom;
-  mDefaultZoom = mDefaultZoom > mMinZoom ? mDefaultZoom : mMinZoom;
+  if (mDefaultZoom > mMaxZoom) {
+    mDefaultZoomValid = false;
+    mDefaultZoom = mMaxZoom;
+  }
+  if (mDefaultZoom < mMinZoom) {
+    mDefaultZoomValid = false;
+    mDefaultZoom = mMinZoom;
+  }
 }
--- a/dom/base/nsViewportInfo.h
+++ b/dom/base/nsViewportInfo.h
@ -12,7 +12,7 @@
 /**
 * Default values for the nsViewportInfo class.
 */
-static const mozilla::LayoutDeviceToScreenScale kViewportMinScale(0.0f);
+static const mozilla::LayoutDeviceToScreenScale kViewportMinScale(0.1f);
 static const mozilla::LayoutDeviceToScreenScale kViewportMaxScale(10.0f);
 static const mozilla::CSSIntSize kViewportMinSize(200, 40);
 static const mozilla::CSSIntSize kViewportMaxSize(10000, 10000);
@ -27,6 +27,7 @@ class MOZ_STACK_CLASS nsViewportInfo
    nsViewportInfo(const mozilla::ScreenIntSize& aDisplaySize,
                   const mozilla::CSSToScreenScale& aDefaultZoom,
                   bool aAllowZoom) :
+      mDefaultZoomValid(true),
      mDefaultZoom(aDefaultZoom),
      mAutoSize(true),
      mAllowZoom(aAllowZoom)
@ -44,6 +45,7 @@ class MOZ_STACK_CLASS nsViewportInfo
                   const mozilla::CSSSize& aSize,
                   bool aAutoSize,
                   bool aAllowZoom) :
+                     mDefaultZoomValid(true),
                     mDefaultZoom(aDefaultZoom),
                     mMinZoom(aMinZoom),
                     mMaxZoom(aMaxZoom),
@ -54,8 +56,8 @@ class MOZ_STACK_CLASS nsViewportInfo
      ConstrainViewportValues();
    }

+    bool IsDefaultZoomValid() const { return mDefaultZoomValid; }
    mozilla::CSSToScreenScale GetDefaultZoom() const { return mDefaultZoom; }
-    void SetDefaultZoom(const mozilla::CSSToScreenScale& aDefaultZoom);
    mozilla::CSSToScreenScale GetMinZoom() const { return mMinZoom; }
    mozilla::CSSToScreenScale GetMaxZoom() const { return mMaxZoom; }

@ -73,6 +75,10 @@ class MOZ_STACK_CLASS nsViewportInfo
     */
    void ConstrainViewportValues();

+    // If the default zoom was specified and was between the min and max
+    // zoom values.
+    bool mDefaultZoomValid;
+
    // Default zoom indicates the level at which the display is 'zoomed in'
    // initially for the user, upon loading of the page.
    mozilla::CSSToScreenScale mDefaultZoom;
--- a/dom/base/test/test_bug416317-1.html
+++ b/dom/base/test/test_bug416317-1.html
@ -9,6 +9,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=416317
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
  <script>
    SimpleTest.waitForExplicitFinish();
+    SimpleTest.requestLongerTimeout(3);
  </script>
 </head>
 <body>
--- a/dom/base/test/test_copypaste.html
+++ b/dom/base/test/test_copypaste.html
@ -18,7 +18,7 @@
 <script class="testbody" type="text/javascript">

 SimpleTest.waitForExplicitFinish();
-addLoadEvent(function () testCopyPaste(false));
+addLoadEvent(() => testCopyPaste(false));

 </script>
 </pre>
--- a/dom/base/test/test_copypaste.xhtml
+++ b/dom/base/test/test_copypaste.xhtml
@ -32,7 +32,7 @@ function modifySelectionDiv12() {
 }

 SimpleTest.waitForExplicitFinish();
-addLoadEvent(function () testCopyPaste(true));
+addLoadEvent(() => testCopyPaste(true));

 ]]>
 </script>
--- a/dom/base/test/test_meta_viewport0.html
+++ b/dom/base/test/test_meta_viewport0.html
@ -16,12 +16,16 @@

    let tests = [];

+    function fuzzeq(a, b, msg) {
+      ok(Math.abs(a - b) < 1e-6, msg);
+    }
+
    tests.push(function test1() {
      SpecialPowers.pushPrefEnv(scaleRatio(1.0),
        function() {
          let info = getViewportInfo(800, 480);
-          is(info.defaultZoom, 0,       "initial scale is unspecified");
-          is(info.minZoom,     0,       "minumum scale defaults to the absolute minumum");
+          fuzzeq(info.defaultZoom, 0.1, "initial scale is unspecified");
+          fuzzeq(info.minZoom, 0.1,     "minimum scale defaults to the absolute minimum");
          is(info.maxZoom,     10,      "maximum scale defaults to the absolute maximum");
          is(info.width,       980,     "width is the default width");
          is(info.height,      588,     "height is proportional to displayHeight");
--- a/dom/base/test/test_object.html
+++ b/dom/base/test/test_object.html
@ -510,6 +510,6 @@
            [ 'addToDoc' ],
            [ 'displayInherit' ]
          )});
-        runWhenDone(function() SimpleTest.finish());
+        runWhenDone(() => SimpleTest.finish());
      }
    </script>
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@ -2689,6 +2689,26 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
        # if we don't need to create anything, why are we generating this?
        assert needInterfaceObject or needInterfacePrototypeObject

+        getParentProto = fill(
+            """
+            JS::${type}<JSObject*> parentProto(${getParentProto});
+            if (!parentProto) {
+              return;
+            }
+            """,
+            type=parentProtoType,
+            getParentProto=getParentProto)
+
+        getConstructorProto = fill(
+            """
+            JS::${type}<JSObject*> constructorProto(${getConstructorProto});
+            if (!constructorProto) {
+              return;
+            }
+            """,
+            type=constructorProtoType,
+            getConstructorProto=getConstructorProto)
+
        idsToInit = []
        # There is no need to init any IDs in bindings that don't want Xrays.
        if self.descriptor.wantsXrays:
@ -2728,75 +2748,6 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
        else:
            prefCache = None

-        if self.descriptor.hasUnforgeableMembers:
-            assert needInterfacePrototypeObject
-            # We want to use the same JSClass and prototype as the object we'll
-            # end up defining the unforgeable properties on in the end, so that
-            # we can use JS_InitializePropertiesFromCompatibleNativeObject to do
-            # a fast copy.  In the case of proxies that's null, because the
-            # expando object is a vanilla object, but in the case of other DOM
-            # objects it's whatever our class is.
-            #
-            # Also, for a global we can't use the global's class; just use
-            # nullpr and when we do the copy off the holder we'll take a slower
-            # path.  This also means that we don't need to worry about matching
-            # the prototype.
-            if self.descriptor.proxy or self.descriptor.isGlobal():
-                holderClass = "nullptr"
-                holderProto = "nullptr"
-            else:
-                holderClass = "Class.ToJSClass()"
-                holderProto = "*protoCache"
-            failureCode = dedent(
-                """
-                *protoCache = nullptr;
-                if (interfaceCache) {
-                  *interfaceCache = nullptr;
-                }
-                return;
-                """)
-            createUnforgeableHolder = CGGeneric(fill(
-                """
-                JS::Rooted<JSObject*> unforgeableHolder(aCx);
-                {
-                  JS::Rooted<JSObject*> holderProto(aCx, ${holderProto});
-                  unforgeableHolder = JS_NewObjectWithoutMetadata(aCx, ${holderClass}, holderProto);
-                  if (!unforgeableHolder) {
-                    $*{failureCode}
-                  }
-                }
-                """,
-                holderProto=holderProto,
-                holderClass=holderClass,
-                failureCode=failureCode))
-            defineUnforgeables = InitUnforgeablePropertiesOnHolder(self.descriptor,
-                                                                   self.properties,
-                                                                   failureCode)
-            createUnforgeableHolder = CGList(
-                [createUnforgeableHolder, defineUnforgeables])
-        else:
-            createUnforgeableHolder = None
-
-        getParentProto = fill(
-            """
-            JS::${type}<JSObject*> parentProto(${getParentProto});
-            if (!parentProto) {
-              return;
-            }
-            """,
-            type=parentProtoType,
-            getParentProto=getParentProto)
-
-        getConstructorProto = fill(
-            """
-            JS::${type}<JSObject*> constructorProto(${getConstructorProto});
-            if (!constructorProto) {
-              return;
-            }
-            """,
-            type=constructorProtoType,
-            getConstructorProto=getConstructorProto)
-
        if (needInterfaceObject and
            self.descriptor.needsConstructHookHolder()):
            constructHookHolder = "&" + CONSTRUCT_HOOK_NAME + "_holder"
@ -2869,18 +2820,6 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
            chromeProperties=chromeProperties,
            name='"' + self.descriptor.interface.identifier.name + '"' if needInterfaceObject else "nullptr")

-        if self.descriptor.hasUnforgeableMembers:
-            assert needInterfacePrototypeObject
-            setUnforgeableHolder = CGGeneric(dedent(
-                """
-                if (*protoCache) {
-                  js::SetReservedSlot(*protoCache, DOM_INTERFACE_PROTO_SLOTS_BASE,
-                                      JS::ObjectValue(*unforgeableHolder));
-                }
-                """))
-        else:
-            setUnforgeableHolder = None
-
        aliasedMembers = [m for m in self.descriptor.interface.members if m.isMethod() and m.aliases]
        if aliasedMembers:
            assert needInterfacePrototypeObject
@ -2938,9 +2877,70 @@ class CGCreateInterfaceObjectsMethod(CGAbstractMethod):
        else:
            defineAliases = None

+        if self.descriptor.hasUnforgeableMembers:
+            assert needInterfacePrototypeObject
+
+            # We want to use the same JSClass and prototype as the object we'll
+            # end up defining the unforgeable properties on in the end, so that
+            # we can use JS_InitializePropertiesFromCompatibleNativeObject to do
+            # a fast copy.  In the case of proxies that's null, because the
+            # expando object is a vanilla object, but in the case of other DOM
+            # objects it's whatever our class is.
+            #
+            # Also, for a global we can't use the global's class; just use
+            # nullpr and when we do the copy off the holder we'll take a slower
+            # path.  This also means that we don't need to worry about matching
+            # the prototype.
+            if self.descriptor.proxy or self.descriptor.isGlobal():
+                holderClass = "nullptr"
+                holderProto = "nullptr"
+            else:
+                holderClass = "Class.ToJSClass()"
+                holderProto = "*protoCache"
+            failureCode = dedent(
+                """
+                *protoCache = nullptr;
+                if (interfaceCache) {
+                  *interfaceCache = nullptr;
+                }
+                return;
+                """)
+            createUnforgeableHolder = CGGeneric(fill(
+                """
+                JS::Rooted<JSObject*> unforgeableHolder(aCx);
+                {
+                  JS::Rooted<JSObject*> holderProto(aCx, ${holderProto});
+                  unforgeableHolder = JS_NewObjectWithoutMetadata(aCx, ${holderClass}, holderProto);
+                  if (!unforgeableHolder) {
+                    $*{failureCode}
+                  }
+                }
+                """,
+                holderProto=holderProto,
+                holderClass=holderClass,
+                failureCode=failureCode))
+            defineUnforgeables = InitUnforgeablePropertiesOnHolder(self.descriptor,
+                                                                   self.properties,
+                                                                   failureCode)
+            createUnforgeableHolder = CGList(
+                [createUnforgeableHolder, defineUnforgeables])
+
+            installUnforgeableHolder = CGGeneric(dedent(
+                """
+                if (*protoCache) {
+                  js::SetReservedSlot(*protoCache, DOM_INTERFACE_PROTO_SLOTS_BASE,
+                                      JS::ObjectValue(*unforgeableHolder));
+                }
+                """))
+
+            unforgeableHolderSetup = CGList(
+                [createUnforgeableHolder, installUnforgeableHolder], "\n")
+        else:
+            unforgeableHolderSetup = None
+
        return CGList(
            [getParentProto, CGGeneric(getConstructorProto), initIds,
-             prefCache, CGGeneric(call), defineAliases, createUnforgeableHolder, setUnforgeableHolder],
+             prefCache, CGGeneric(call), defineAliases, unforgeableHolderSetup],
            "\n").define()


--- a/dom/browser-element/mochitest/browserElement_NextPaint.js
+++ b/dom/browser-element/mochitest/browserElement_NextPaint.js
@ -29,7 +29,7 @@ function runTest() {
    });

    // Force the iframe to repaint.
-    SimpleTest.executeSoon(function () iframe.src += '#next');
+    SimpleTest.executeSoon(() => iframe.src += '#next');
  });

  // Remove the first listener to make sure it's not called.
--- a/dom/canvas/test/test_canvas.html
+++ b/dom/canvas/test/test_canvas.html
@ -7468,25 +7468,25 @@ var _thrown = undefined; try {
  ctx.createImageData(Infinity, Infinity);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.createImageData({valueOf:function() Infinity}, 10);
+  ctx.createImageData({valueOf:() => Infinity}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.createImageData({valueOf:function() -Infinity}, 10);
+  ctx.createImageData({valueOf:() => -Infinity}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.createImageData({valueOf:function() NaN}, 10);
+  ctx.createImageData({valueOf:() => NaN}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.createImageData(10, {valueOf:function() Infinity});
+  ctx.createImageData(10, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.createImageData(10, {valueOf:function() -Infinity});
+  ctx.createImageData(10, {valueOf:() => -Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.createImageData(10, {valueOf:function() NaN});
+  ctx.createImageData(10, {valueOf:() => NaN});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.createImageData({valueOf:function() Infinity}, {valueOf:function() Infinity});
+  ctx.createImageData({valueOf:() => Infinity}, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");


@ -7774,73 +7774,73 @@ var _thrown = undefined; try {
  ctx.getImageData(10, 10, Infinity, Infinity);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, 10, 10, 10);
+  ctx.getImageData({valueOf:() => Infinity}, 10, 10, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() -Infinity}, 10, 10, 10);
+  ctx.getImageData({valueOf:() => -Infinity}, 10, 10, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() NaN}, 10, 10, 10);
+  ctx.getImageData({valueOf:() => NaN}, 10, 10, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, {valueOf:function() Infinity}, 10, 10);
+  ctx.getImageData(10, {valueOf:() => Infinity}, 10, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, {valueOf:function() -Infinity}, 10, 10);
+  ctx.getImageData(10, {valueOf:() => -Infinity}, 10, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, {valueOf:function() NaN}, 10, 10);
+  ctx.getImageData(10, {valueOf:() => NaN}, 10, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, 10, {valueOf:function() Infinity}, 10);
+  ctx.getImageData(10, 10, {valueOf:() => Infinity}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, 10, {valueOf:function() -Infinity}, 10);
+  ctx.getImageData(10, 10, {valueOf:() => -Infinity}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, 10, {valueOf:function() NaN}, 10);
+  ctx.getImageData(10, 10, {valueOf:() => NaN}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, 10, 10, {valueOf:function() Infinity});
+  ctx.getImageData(10, 10, 10, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, 10, 10, {valueOf:function() -Infinity});
+  ctx.getImageData(10, 10, 10, {valueOf:() => -Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, 10, 10, {valueOf:function() NaN});
+  ctx.getImageData(10, 10, 10, {valueOf:() => NaN});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, {valueOf:function() Infinity}, 10, 10);
+  ctx.getImageData({valueOf:() => Infinity}, {valueOf:() => Infinity}, 10, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, {valueOf:function() Infinity}, {valueOf:function() Infinity}, 10);
+  ctx.getImageData({valueOf:() => Infinity}, {valueOf:() => Infinity}, {valueOf:() => Infinity}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, {valueOf:function() Infinity}, {valueOf:function() Infinity}, {valueOf:function() Infinity});
+  ctx.getImageData({valueOf:() => Infinity}, {valueOf:() => Infinity}, {valueOf:() => Infinity}, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, {valueOf:function() Infinity}, 10, {valueOf:function() Infinity});
+  ctx.getImageData({valueOf:() => Infinity}, {valueOf:() => Infinity}, 10, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, 10, {valueOf:function() Infinity}, 10);
+  ctx.getImageData({valueOf:() => Infinity}, 10, {valueOf:() => Infinity}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, 10, {valueOf:function() Infinity}, {valueOf:function() Infinity});
+  ctx.getImageData({valueOf:() => Infinity}, 10, {valueOf:() => Infinity}, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData({valueOf:function() Infinity}, 10, 10, {valueOf:function() Infinity});
+  ctx.getImageData({valueOf:() => Infinity}, 10, 10, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, {valueOf:function() Infinity}, {valueOf:function() Infinity}, 10);
+  ctx.getImageData(10, {valueOf:() => Infinity}, {valueOf:() => Infinity}, 10);
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, {valueOf:function() Infinity}, {valueOf:function() Infinity}, {valueOf:function() Infinity});
+  ctx.getImageData(10, {valueOf:() => Infinity}, {valueOf:() => Infinity}, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, {valueOf:function() Infinity}, 10, {valueOf:function() Infinity});
+  ctx.getImageData(10, {valueOf:() => Infinity}, 10, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");
 var _thrown = undefined; try {
-  ctx.getImageData(10, 10, {valueOf:function() Infinity}, {valueOf:function() Infinity});
+  ctx.getImageData(10, 10, {valueOf:() => Infinity}, {valueOf:() => Infinity});
 } catch (e) { _thrown = e }; ok(_thrown && _thrown instanceof TypeError, "should throw TypeError");


--- a/dom/contacts/fallback/ContactDB.jsm
+++ b/dom/contacts/fallback/ContactDB.jsm
@ -1039,7 +1039,7 @@ ContactDB.prototype = {
          contactsArray.push(aContacts[i]);
        }

-        let contactIdsArray = contactsArray.map(function(el) el.id);
+        let contactIdsArray = contactsArray.map(el => el.id);

        // save contact ids in cache
        this.newTxn("readwrite", SAVED_GETALL_STORE_NAME, function(txn, store) {
--- a/dom/crypto/CryptoKey.cpp
+++ b/dom/crypto/CryptoKey.cpp
@ -385,31 +385,41 @@ CryptoKey::AllUsagesRecognized(const Sequence<nsString>& aUsages)
  return true;
 }

-void CryptoKey::SetSymKey(const CryptoBuffer& aSymKey)
+nsresult CryptoKey::SetSymKey(const CryptoBuffer& aSymKey)
 {
-  mSymKey = aSymKey;
+  if (!mSymKey.Assign(aSymKey)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  return NS_OK;
 }

-void
+nsresult
 CryptoKey::SetPrivateKey(SECKEYPrivateKey* aPrivateKey)
 {
  nsNSSShutDownPreventionLock locker;
+
  if (!aPrivateKey || isAlreadyShutDown()) {
    mPrivateKey = nullptr;
-    return;
+    return NS_OK;
  }
+
  mPrivateKey = SECKEY_CopyPrivateKey(aPrivateKey);
+  return mPrivateKey ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
 }

-void
+nsresult
 CryptoKey::SetPublicKey(SECKEYPublicKey* aPublicKey)
 {
  nsNSSShutDownPreventionLock locker;
+
  if (!aPublicKey || isAlreadyShutDown()) {
    mPublicKey = nullptr;
-    return;
+    return NS_OK;
  }
+
  mPublicKey = SECKEY_CopyPublicKey(aPublicKey);
+  return mPublicKey ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
 }

 const CryptoBuffer&
@ -1268,8 +1278,8 @@ CryptoKey::ReadStructuredClone(JSStructuredCloneReader* aReader)
    return false;
  }

-  if (sym.Length() > 0)  {
-    mSymKey = sym;
+  if (sym.Length() > 0 && !mSymKey.Assign(sym))  {
+    return false;
  }
  if (priv.Length() > 0) {
    mPrivateKey = CryptoKey::PrivateKeyFromPkcs8(priv, locker);
--- a/dom/crypto/CryptoKey.h
+++ b/dom/crypto/CryptoKey.h
@ -127,9 +127,9 @@ public:
  static bool IsRecognizedUsage(const nsString& aUsage);
  static bool AllUsagesRecognized(const Sequence<nsString>& aUsages);

-  void SetSymKey(const CryptoBuffer& aSymKey);
-  void SetPrivateKey(SECKEYPrivateKey* aPrivateKey);
-  void SetPublicKey(SECKEYPublicKey* aPublicKey);
+  nsresult SetSymKey(const CryptoBuffer& aSymKey);
+  nsresult SetPrivateKey(SECKEYPrivateKey* aPrivateKey);
+  nsresult SetPublicKey(SECKEYPublicKey* aPublicKey);

  // Accessors for the keys themselves
  // Note: GetPrivateKey and GetPublicKey return copies of the internal
--- a/dom/crypto/WebCryptoTask.cpp
+++ b/dom/crypto/WebCryptoTask.cpp
@ -1288,7 +1288,11 @@ public:

  void SetKeyData(const CryptoBuffer& aKeyData)
  {
-    mKeyData = aKeyData;
+    if (!mKeyData.Assign(aKeyData)) {
+      mEarlyRv = NS_ERROR_DOM_OPERATION_ERR;
+      return;
+    }
+
    mDataIsJwk = false;

    if (mFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_JWK)) {
@ -1468,7 +1472,10 @@ public:
      return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
    }

-    mKey->SetSymKey(mKeyData);
+    if (NS_FAILED(mKey->SetSymKey(mKeyData))) {
+      return NS_ERROR_DOM_OPERATION_ERR;
+    }
+
    mKey->SetType(CryptoKey::SECRET);

    if (mDataIsJwk && !JwkCompatible(mJwk, mKey)) {
@ -1574,7 +1581,10 @@ private:
        return NS_ERROR_DOM_DATA_ERR;
      }

-      mKey->SetPublicKey(pubKey.get());
+      if (NS_FAILED(mKey->SetPublicKey(pubKey.get()))) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
      mKey->SetType(CryptoKey::PUBLIC);
    } else if (mFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_PKCS8) ||
        (mFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_JWK) &&
@ -1590,7 +1600,10 @@ private:
        return NS_ERROR_DOM_DATA_ERR;
      }

-      mKey->SetPrivateKey(privKey.get());
+      if (NS_FAILED(mKey->SetPrivateKey(privKey.get()))) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
      mKey->SetType(CryptoKey::PRIVATE);
      pubKey = SECKEY_ConvertToPublicKey(privKey.get());
      if (!pubKey) {
@ -1708,7 +1721,10 @@ private:
        return NS_ERROR_DOM_DATA_ERR;
      }

-      mKey->SetPrivateKey(privKey.get());
+      if (NS_FAILED(mKey->SetPrivateKey(privKey.get()))) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
      mKey->SetType(CryptoKey::PRIVATE);
    } else if (mFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_RAW) ||
               mFormat.EqualsLiteral(WEBCRYPTO_KEY_FORMAT_SPKI) ||
@ -1745,7 +1761,10 @@ private:
        }
      }

-      mKey->SetPublicKey(pubKey.get());
+      if (NS_FAILED(mKey->SetPublicKey(pubKey.get()))) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
      mKey->SetType(CryptoKey::PUBLIC);
    } else {
      return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
@ -1867,7 +1886,10 @@ private:
        ATTEMPT_BUFFER_ASSIGN(mGenerator, &pubKey->u.dh.base);
      }

-      mKey->SetPublicKey(pubKey.get());
+      if (NS_FAILED(mKey->SetPublicKey(pubKey.get()))) {
+        return NS_ERROR_DOM_OPERATION_ERR;
+      }
+
      mKey->SetType(CryptoKey::PUBLIC);
    } else {
      return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
@ -2153,8 +2175,11 @@ private:

  virtual void Resolve() override
  {
-    mKey->SetSymKey(mKeyData);
-    mResultPromise->MaybeResolve(mKey);
+    if (NS_SUCCEEDED(mKey->SetSymKey(mKeyData))) {
+      mResultPromise->MaybeResolve(mKey);
+    } else {
+      mResultPromise->MaybeReject(NS_ERROR_DOM_OPERATION_ERR);
+    }
  }

  virtual void Cleanup() override
@ -2378,13 +2403,15 @@ GenerateAsymmetricKeyTask::DoCrypto()
    return NS_ERROR_DOM_UNKNOWN_ERR;
  }

-  mKeyPair.mPrivateKey.get()->SetPrivateKey(mPrivateKey);
-  mKeyPair.mPublicKey.get()->SetPublicKey(mPublicKey);
+  nsresult rv = mKeyPair.mPrivateKey.get()->SetPrivateKey(mPrivateKey);
+  NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
+  rv = mKeyPair.mPublicKey.get()->SetPublicKey(mPublicKey);
+  NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);

  // PK11_GenerateKeyPair() does not set a CKA_EC_POINT attribute on the
  // private key, we need this later when exporting to PKCS8 and JWK though.
  if (mMechanism == CKM_EC_KEY_PAIR_GEN) {
-    nsresult rv = mKeyPair.mPrivateKey->AddPublicKeyData(mPublicKey);
+    rv = mKeyPair.mPrivateKey->AddPublicKeyData(mPublicKey);
    NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_OPERATION_ERR);
  }

--- a/dom/events/test/test_bug1096146.html
+++ b/dom/events/test/test_bug1096146.html
@ -56,7 +56,7 @@ function waitAndVerifyResult(count) {
    runTests();
 	} else {
    SimpleTest.requestFlakyTimeout("We must delay to wait for scroll/keydown events.");
-    setTimeout(function () waitAndVerifyResult(count + 1), 100);
+    setTimeout(() => waitAndVerifyResult(count + 1), 100);
  }
 }

--- a/dom/events/test/test_dom_before_after_keyboard_event_remote.html
+++ b/dom/events/test/test_dom_before_after_keyboard_event_remote.html
@ -150,7 +150,7 @@ function waitAndVerifyResult(aCount) {
    testEventOrder();
  }
  else {
-    setTimeout(function () waitAndVerifyResult(aCount + 1),
+    setTimeout(() => waitAndVerifyResult(aCount + 1),
               100);
  }
 }
--- a/dom/events/test/test_dragstart.html
+++ b/dom/events/test/test_dragstart.html
@ -37,17 +37,17 @@ function afterDragTests()
  ok(gDataTransfer instanceof DataTransfer, "DataTransfer after dragstart event");
  checkTypes(gDataTransfer, [], 0, "after dragstart event");

-  expectError(function() gDataTransfer.setData("text/plain", "Some Text"),
+  expectError(() => gDataTransfer.setData("text/plain", "Some Text"),
              "NoModificationAllowedError", "setData when read only");
-  expectError(function() gDataTransfer.clearData("text/plain"),
+  expectError(() => gDataTransfer.clearData("text/plain"),
              "NoModificationAllowedError", "clearData when read only");
-  expectError(function() gDataTransfer.mozSetDataAt("text/plain", "Some Text", 0),
+  expectError(() => gDataTransfer.mozSetDataAt("text/plain", "Some Text", 0),
              "NoModificationAllowedError", "setDataAt when read only");
-  expectError(function() gDataTransfer.mozClearDataAt("text/plain", 0),
+  expectError(() => gDataTransfer.mozClearDataAt("text/plain", 0),
              "NoModificationAllowedError", "clearDataAt when read only");
-  expectError(function() gDataTransfer.setDragImage(draggable, 10, 10),
+  expectError(() => gDataTransfer.setDragImage(draggable, 10, 10),
              "NoModificationAllowedError", "setDragImage when read only");
-  expectError(function() gDataTransfer.addElement(draggable),
+  expectError(() => gDataTransfer.addElement(draggable),
              "NoModificationAllowedError", "addElement when read only");

  var evt = document.createEvent("dragevent");
@ -153,7 +153,7 @@ function test_DataTransfer(dt)
  is(dt.getData("text/plain"), "", "empty data is empty");

  // calling setDataAt requires an index that is 0 <= index <= dt.itemCount
-  expectError(function() dt.mozSetDataAt("text/plain", "Some Text", 1),
+  expectError(() => dt.mozSetDataAt("text/plain", "Some Text", 1),
              "IndexSizeError", "setDataAt index too high");

  is(dt.mozUserCancelled, false, "userCancelled");
@ -171,9 +171,9 @@ function test_DataTransfer(dt)
  is(dt.mozGetDataAt("", 0), null, "invalid type getDataAt"),

  // similar with clearDataAt and getDataAt
-  expectError(function() dt.mozGetDataAt("text/plain", 1),
+  expectError(() => dt.mozGetDataAt("text/plain", 1),
              "IndexSizeError", "getDataAt index too high");
-  expectError(function() dt.mozClearDataAt("text/plain", 1),
+  expectError(() => dt.mozClearDataAt("text/plain", 1),
              "IndexSizeError", "clearDataAt index too high");

  dt.setData("text/plain", "Sample Text");
@ -284,7 +284,7 @@ function test_DataTransfer(dt)
  dt.clearData();
  dt.mozSetDataAt("text/plain", "First Item", 0);
  dt.mozSetDataAt("text/plain", "Second Item", 1);
-  expectError(function() dt.mozSetDataAt("text/plain", "Some Text", 3),
+  expectError(() => dt.mozSetDataAt("text/plain", "Some Text", 3),
              "IndexSizeError", "setDataAt index too high with two items");
  is(dt.mozItemCount, 2, "setDataAt item itemCount");
  checkOneDataItem(dt, ["text/plain"], ["First Item"], 0, "setDataAt item at index 0");
@ -328,7 +328,7 @@ function test_DataTransfer(dt)
  checkOneDataItem(dt, ["text/plain", "text/html"],
                   ["First Item", "Changed with setData"], 0, "clearDataAt last type at index 0");
  checkOneDataItem(dt, ["application/-moz-node"], [draggable], 1, "clearDataAt last type item at index 2");
-  expectError(function() dt.mozGetDataAt("text/plain", 2),
+  expectError(() => dt.mozGetDataAt("text/plain", 2),
              "IndexSizeError", "getDataAt after item removed index too high");

  dt.mozSetDataAt("text/unknown", "Unknown type", 2);
@ -355,7 +355,7 @@ function test_DataTransfer(dt)
  checkOneDataItem(dt, ["text/unknown"],
                   ["Unknown type"], 1, "clearData type that does not exist item at index 1");

-  expectError(function() dt.mozClearDataAt("text/plain", 3),
+  expectError(() => dt.mozClearDataAt("text/plain", 3),
              "IndexSizeError", "clearData index too high with two items");

  // ensure that clearData() removes all data associated with the first item
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@ -2202,10 +2202,6 @@ HTMLInputElement::MozIsTextField(bool aExcludePassword, bool* aResult)
 NS_IMETHODIMP
 HTMLInputElement::SetUserInput(const nsAString& aValue)
 {
-  if (!nsContentUtils::IsCallerChrome()) {
-    return NS_ERROR_DOM_SECURITY_ERR;
-  }
-
  if (mType == NS_FORM_INPUT_FILE)
  {
    Sequence<nsString> list;
--- a/dom/html/test/test_bug109445.html
+++ b/dom/html/test/test_bug109445.html
@ -42,13 +42,13 @@ onhashchange = function() {
  if (!second) {
    second = true;
    is(location.hash, "#x", "First map");
-    SimpleTest.waitForFocus(function() synthesizeMouse(images[1], 50, 50, {}));
+    SimpleTest.waitForFocus(() => synthesizeMouse(images[1], 50, 50, {}));
  } else {
    is(location.hash, "#y", "Second map");
    SimpleTest.finish();
  }
 };
-SimpleTest.waitForFocus(function() synthesizeMouse(images[0], 50, 50, {}));
+SimpleTest.waitForFocus(() => synthesizeMouse(images[0], 50, 50, {}));
 </script>
 </pre>
 </body>
--- a/dom/html/test/test_bug109445.xhtml
+++ b/dom/html/test/test_bug109445.xhtml
@ -42,13 +42,13 @@ onhashchange = function() {
  if (!second) {
    second = true;
    is(location.hash, "#x", "First map");
-    SimpleTest.waitForFocus(function() synthesizeMouse(images[1], 50, 50, {}));
+    SimpleTest.waitForFocus(() => synthesizeMouse(images[1], 50, 50, {}));
  } else {
    is(location.hash, "#y", "Second map");
    SimpleTest.finish();
  }
 };
-SimpleTest.waitForFocus(function() synthesizeMouse(images[0], 50, 50, {}));
+SimpleTest.waitForFocus(() => synthesizeMouse(images[0], 50, 50, {}));
 </script>
 </pre>
 </body>
--- a/dom/html/test/test_bug564001.html
+++ b/dom/html/test/test_bug564001.html
@ -41,7 +41,7 @@ onhashchange = function() {
  is(location.hash, "#PASS", "Should get the first map in tree order.");
  SimpleTest.finish();
 };
-SimpleTest.waitForFocus(function() synthesizeMouse(images[0], 50, 50, {}));
+SimpleTest.waitForFocus(() => synthesizeMouse(images[0], 50, 50, {}));
 </script>
 </pre>
 </body>
--- a/dom/html/test/test_bug659743.xml
+++ b/dom/html/test/test_bug659743.xml
@ -42,13 +42,13 @@ onhashchange = function() {
  if (!second) {
    second = true;
    is(location.hash, "#x", "First map");
-    SimpleTest.waitForFocus(function() synthesizeMouse(images[1], 50, 50, {}));
+    SimpleTest.waitForFocus(() => synthesizeMouse(images[1], 50, 50, {}));
  } else {
    is(location.hash, "#y", "Second map");
    SimpleTest.finish();
  }
 };
-SimpleTest.waitForFocus(function() synthesizeMouse(images[0], 50, 50, {}));
+SimpleTest.waitForFocus(() => synthesizeMouse(images[0], 50, 50, {}));
 </script>
 </pre>
 </body>
--- a/dom/identity/DOMIdentity.jsm
+++ b/dom/identity/DOMIdentity.jsm
@ -80,8 +80,8 @@ function IDPProvisioningContext(aID, aOrigin, aTargetMM) {
 }

 IDPProvisioningContext.prototype = {
-  get id() this._id,
-  get origin() this._origin,
+  get id() { return this._id; },
+  get origin() { return this._origin; },

  sendAsyncMessage: _sendAsyncMessage,

@ -112,8 +112,8 @@ function IDPAuthenticationContext(aID, aOrigin, aTargetMM) {
 }

 IDPAuthenticationContext.prototype = {
-  get id() this._id,
-  get origin() this._origin,
+  get id() { return this._id; },
+  get origin() { return this._origin; },

  sendAsyncMessage: _sendAsyncMessage,

--- a/dom/indexedDB/test/browser_perwindow_privateBrowsing.js
+++ b/dom/indexedDB/test/browser_perwindow_privateBrowsing.js
@ -42,9 +42,9 @@ function test2()
  var win = OpenBrowserWindow({private: true});
  win.addEventListener("load", function onLoad() {
    win.removeEventListener("load", onLoad, false);
-    executeSoon(function() test3(win));
+    executeSoon(() => test3(win));
  }, false);
-  registerCleanupFunction(function() win.close());
+  registerCleanupFunction(() => win.close());
 }

 function test3(win)
--- a/dom/interfaces/core/nsIDOMNSEditableElement.idl
+++ b/dom/interfaces/core/nsIDOMNSEditableElement.idl
@ -16,13 +16,13 @@ interface nsIEditor;
 *
 */

-[scriptable, uuid(b33eb56c-3120-418c-892b-774b00c7dde8)]
+[scriptable, uuid(3503de34-6631-4594-b7be-c36ff6a520c4)]
 interface nsIDOMNSEditableElement : nsISupports
 {
-  readonly attribute nsIEditor editor;
+  [noscript] readonly attribute nsIEditor editor;
  // This is similar to set .value on nsIDOMInput/TextAreaElements, but
  // handling of the value change is closer to the normal user input, so 
  // 'change' event for example will be dispatched when focusing out the
  // element.
-  void setUserInput(in DOMString input);
+  [noscript] void setUserInput(in DOMString input);
 };
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@ -2518,6 +2518,7 @@ ContentChild::RecvUnregisterSheet(const URIParams& aURI, const uint32_t& aType)
 POfflineCacheUpdateChild*
 ContentChild::AllocPOfflineCacheUpdateChild(const URIParams& manifestURI,
                                            const URIParams& documentURI,
+                                            const PrincipalInfo& aLoadingPrincipalInfo,
                                            const bool& stickDocument,
                                            const TabId& aTabId)
 {
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@ -459,6 +459,7 @@ public:
    virtual POfflineCacheUpdateChild* AllocPOfflineCacheUpdateChild(
            const URIParams& manifestURI,
            const URIParams& documentURI,
+            const PrincipalInfo& aLoadingPrincipalInfo,
            const bool& stickDocument,
            const TabId& aTabId) override;
    virtual bool
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@ -5104,6 +5104,7 @@ ContentParent::GetManagedTabContext()
 mozilla::docshell::POfflineCacheUpdateParent*
 ContentParent::AllocPOfflineCacheUpdateParent(const URIParams& aManifestURI,
                                              const URIParams& aDocumentURI,
+                                              const PrincipalInfo& aLoadingPrincipalInfo,
                                              const bool& aStickDocument,
                                              const TabId& aTabId)
 {
@ -5124,6 +5125,7 @@ bool
 ContentParent::RecvPOfflineCacheUpdateConstructor(POfflineCacheUpdateParent* aActor,
                                                  const URIParams& aManifestURI,
                                                  const URIParams& aDocumentURI,
+                                                  const PrincipalInfo& aLoadingPrincipal,
                                                  const bool& aStickDocument,
                                                  const TabId& aTabId)
 {
@ -5132,7 +5134,7 @@ ContentParent::RecvPOfflineCacheUpdateConstructor(POfflineCacheUpdateParent* aAc
    nsRefPtr<mozilla::docshell::OfflineCacheUpdateParent> update =
        static_cast<mozilla::docshell::OfflineCacheUpdateParent*>(aActor);

-    nsresult rv = update->Schedule(aManifestURI, aDocumentURI, aStickDocument);
+    nsresult rv = update->Schedule(aManifestURI, aDocumentURI, aLoadingPrincipal, aStickDocument);
    if (NS_FAILED(rv) && IsAlive()) {
        // Inform the child of failure.
        unused << update->SendFinish(false, false);
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@ -81,6 +81,7 @@ class ContentParent final : public PContentParent
    typedef mozilla::ipc::PFileDescriptorSetParent PFileDescriptorSetParent;
    typedef mozilla::ipc::TestShellParent TestShellParent;
    typedef mozilla::ipc::URIParams URIParams;
+    typedef mozilla::ipc::PrincipalInfo PrincipalInfo;
    typedef mozilla::dom::ClonedMessageData ClonedMessageData;

 public:
@ -394,12 +395,14 @@ public:
    virtual POfflineCacheUpdateParent*
    AllocPOfflineCacheUpdateParent(const URIParams& aManifestURI,
                                   const URIParams& aDocumentURI,
+                                   const PrincipalInfo& aLoadingPrincipalInfo,
                                   const bool& aStickDocument,
                                   const TabId& aTabId) override;
    virtual bool
    RecvPOfflineCacheUpdateConstructor(POfflineCacheUpdateParent* aActor,
                                       const URIParams& aManifestURI,
                                       const URIParams& aDocumentURI,
+                                       const PrincipalInfo& aLoadingPrincipal,
                                       const bool& stickDocument,
                                       const TabId& aTabId) override;
    virtual bool
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@ -60,6 +60,7 @@ include PTabContext;
 include URIParams;
 include PluginTypes;
 include ProtocolTypes;
+include PBackgroundSharedTypes;
 include PContentPermission;
 include BrowserConfiguration;
 include GraphicsMessages;
@ -1021,6 +1022,8 @@ parent:
     *   URI of the manifest to fetch, the application cache group ID
     * @param documentURI
     *   URI of the document that referred the manifest
+     * @param loadingPrincipal
+     *   Principal of the document that referred the manifest
     * @param stickDocument
     *   True if the update was initiated by a document load that referred
     *   a manifest.
@ -1040,7 +1043,8 @@ parent:
     *   To identify which tab owns the app.
     */
    POfflineCacheUpdate(URIParams manifestURI, URIParams documentURI,
-                        bool stickDocument, TabId tabId);
+                        PrincipalInfo loadingPrincipal, bool stickDocument,
+                        TabId tabId);

    /**
     * Sets "offline-app" permission for the principal.  Called when we hit
--- a/dom/json/test/unit/test_encode.js
+++ b/dom/json/test/unit/test_encode.js
@ -41,15 +41,15 @@ function testStringEncode()
 function testToJSON() {
  var obj1 = {a:1};
  var obj2 = {foo:"bar"};
-  do_check_eq(nativeJSON.encode({toJSON: function() obj1}), '{"a":1}');
-  do_check_eq(nativeJSON.encode({toJSON: function() obj2}), '{"foo":"bar"}');
+  do_check_eq(nativeJSON.encode({toJSON: () => obj1}), '{"a":1}');
+  do_check_eq(nativeJSON.encode({toJSON: () => obj2}), '{"foo":"bar"}');
  
-  do_check_eq(nativeJSON.encode({toJSON: function() null}), null);
-  do_check_eq(nativeJSON.encode({toJSON: function() ""}), null);
-  do_check_eq(nativeJSON.encode({toJSON: function() undefined }), null);
-  do_check_eq(nativeJSON.encode({toJSON: function() 5}), null);
-  do_check_eq(nativeJSON.encode({toJSON: function() function(){}}), null);
-  do_check_eq(nativeJSON.encode({toJSON: function() dump}), null);
+  do_check_eq(nativeJSON.encode({toJSON: () => null}), null);
+  do_check_eq(nativeJSON.encode({toJSON: () => ""}), null);
+  do_check_eq(nativeJSON.encode({toJSON: () => undefined }), null);
+  do_check_eq(nativeJSON.encode({toJSON: () => 5}), null);
+  do_check_eq(nativeJSON.encode({toJSON: () => function(){}}), null);
+  do_check_eq(nativeJSON.encode({toJSON: () => dump}), null);
 }

 function testThrowingToJSON() {
--- a/dom/offline/nsDOMOfflineResourceList.cpp
+++ b/dom/offline/nsDOMOfflineResourceList.cpp
@ -81,11 +81,13 @@ NS_IMPL_EVENT_HANDLER(nsDOMOfflineResourceList, obsolete)

 nsDOMOfflineResourceList::nsDOMOfflineResourceList(nsIURI *aManifestURI,
                                                   nsIURI *aDocumentURI,
+                                                   nsIPrincipal *aLoadingPrincipal,
                                                   nsPIDOMWindow *aWindow)
  : DOMEventTargetHelper(aWindow)
  , mInitialized(false)
  , mManifestURI(aManifestURI)
  , mDocumentURI(aDocumentURI)
+  , mLoadingPrincipal(aLoadingPrincipal)
  , mExposeCacheUpdateStatus(true)
  , mStatus(nsIDOMOfflineResourceList::IDLE)
  , mCachedKeys(nullptr)
@ -359,7 +361,8 @@ nsDOMOfflineResourceList::MozAdd(const nsAString& aURI)
  rv = appCache->GetClientID(clientID);
  NS_ENSURE_SUCCESS(rv, rv);

-  rv = update->InitPartial(mManifestURI, clientID, mDocumentURI);
+  rv = update->InitPartial(mManifestURI, clientID,
+                           mDocumentURI, mLoadingPrincipal);
  NS_ENSURE_SUCCESS(rv, rv);

  rv = update->AddDynamicURI(requestedURI);
@ -466,7 +469,7 @@ nsDOMOfflineResourceList::Update()
    do_QueryInterface(GetOwner());

  nsCOMPtr<nsIOfflineCacheUpdate> update;
-  rv = updateService->ScheduleUpdate(mManifestURI, mDocumentURI,
+  rv = updateService->ScheduleUpdate(mManifestURI, mDocumentURI, mLoadingPrincipal,
                                     window, getter_AddRefs(update));
  NS_ENSURE_SUCCESS(rv, rv);

--- a/dom/offline/nsDOMOfflineResourceList.h
+++ b/dom/offline/nsDOMOfflineResourceList.h
@ -52,6 +52,7 @@ public:

  nsDOMOfflineResourceList(nsIURI* aManifestURI,
                           nsIURI* aDocumentURI,
+                           nsIPrincipal* aLoadingPrincipal,
                           nsPIDOMWindow* aWindow);

  void FirePendingEvents();
@ -153,6 +154,7 @@ private:
  nsCString mManifestSpec;

  nsCOMPtr<nsIURI> mDocumentURI;
+  nsCOMPtr<nsIPrincipal> mLoadingPrincipal;
  nsCOMPtr<nsIApplicationCacheService> mApplicationCacheService;
  nsCOMPtr<nsIApplicationCache> mAvailableApplicationCache;
  nsCOMPtr<nsIOfflineCacheUpdate> mCacheUpdate;
--- a/dom/plugins/test/mochitest/test_bug751809.html
+++ b/dom/plugins/test/mochitest/test_bug751809.html
@ -51,7 +51,7 @@
    var objLoadingContent = SpecialPowers.wrap(plugin);

    objLoadingContent.playPlugin();
-    var condition = function() plugin.setColor !== undefined;
+    var condition = () => plugin.setColor !== undefined;
    waitForCondition(condition, afterPluginActivation, "Waited too long for plugin to activate");
  }
    
@ -76,7 +76,7 @@
    }

    synthesizeMouseAtCenter(plugin, {});
-    var condition = function() plugin.getMouseUpEventCount() > 0;
+    var condition = () => plugin.getMouseUpEventCount() > 0;
    waitForCondition(condition, afterFirstClick, "Waited too long for plugin to receive the mouse click");
  }

--- a/dom/tests/browser/browser_ConsoleStoragePBTest_perwindowpb.js
+++ b/dom/tests/browser/browser_ConsoleStoragePBTest_perwindowpb.js
@ -66,7 +66,7 @@ function test() {
      // execute should only be called when need, like when you are opening
      // web pages on the test. If calling executeSoon() is not necesary, then
      // call whenNewWindowLoaded() instead of testOnWindow() on your test.
-      executeSoon(function() aCallback(aWin));
+      executeSoon(() => aCallback(aWin));
    });
  };

--- a/dom/tests/browser/browser_localStorage_privatestorageevent.js
+++ b/dom/tests/browser/browser_localStorage_privatestorageevent.js
@ -13,7 +13,7 @@ function test() {
          return;
        }
        win.removeEventListener("DOMContentLoaded", onInnerLoad, true);
-        executeSoon(function() callback(win));
+        executeSoon(() => callback(win));
      }, true);
      if (!options) {
        win.gBrowser.loadURI("about:blank");
--- a/dom/tests/mochitest/ajax/offline/test_lowDeviceStorage.html
+++ b/dom/tests/mochitest/ajax/offline/test_lowDeviceStorage.html
@ -29,6 +29,8 @@ var obs = SpecialPowers.Cc["@mozilla.org/observer-service;1"]

 var errorReceived = false;

+var systemPrincipal = SpecialPowers.Services.scriptSecurityManager.getSystemPrincipal();
+
 function finish() {
  obs.notifyObservers(updateService, "disk-space-watcher", "free");

@ -73,7 +75,7 @@ if (OfflineTest.setup()) {
                  .getService(Ci.nsIIOService);
  var manifestURI = ioService.newURI(manifest, null, null);
  var documentURI = ioService.newURI(document.documentURI, null, null);
-  var update = updateService.scheduleUpdate(manifestURI, documentURI, window);
+  var update = updateService.scheduleUpdate(manifestURI, documentURI, systemPrincipal, window);
  update.addObserver(updateObserver, false);
 }

--- a/dom/tests/mochitest/ajax/offline/test_updateCheck.html
+++ b/dom/tests/mochitest/ajax/offline/test_updateCheck.html
@ -29,10 +29,12 @@ var manifestURI = Cc["@mozilla.org/network/io-service;1"]
 var updateService = Cc['@mozilla.org/offlinecacheupdate-service;1']
                    .getService(Ci.nsIOfflineCacheUpdateService);

+var systemPrincipal = SpecialPowers.Services.scriptSecurityManager.getSystemPrincipal();
+
 function manifestCached()
 {
  // Run first check for an update
-  updateService.checkForUpdate(manifestURI, 0, false, {
+  updateService.checkForUpdate(manifestURI, systemPrincipal, 0, false, {
    observe: function(subject, topic, data) {
      OfflineTest.is(topic, "offline-cache-update-unavailable", "No update avail");

@ -40,13 +42,13 @@ function manifestCached()
      OfflineTest.setSJSState(manifest, "second");

      // Check we now get notification on update ready
-      updateService.checkForUpdate(manifestURI, 0, false, {
+      updateService.checkForUpdate(manifestURI, systemPrincipal, 0, false, {
        observe: function(subject, topic, data) {
          OfflineTest.is(topic, "offline-cache-update-available", "Update avail (1)");

          // Do the check again.  We must get the same result.  Double check is here
          // to make sure we don't overwrite any data in the cache by the check it self.
-          updateService.checkForUpdate(manifestURI, 0, false, {
+          updateService.checkForUpdate(manifestURI, systemPrincipal, 0, false, {
            observe: function(subject, topic, data) {
              OfflineTest.is(topic, "offline-cache-update-available", "Update avail (2)");

@ -64,7 +66,7 @@ function manifestCached()
 function manifestUpdated()
 {
  // Check for an update after manifest has been updated
-  updateService.checkForUpdate(manifestURI, 0, false, {
+  updateService.checkForUpdate(manifestURI, systemPrincipal, 0, false, {
    observe: function(subject, topic, data) {
      OfflineTest.is(topic, "offline-cache-update-unavailable", "No update avail (2)");

--- a/dom/tests/mochitest/bugs/test_bug642026.html
+++ b/dom/tests/mochitest/bugs/test_bug642026.html
@ -48,7 +48,7 @@ for (var p in result) {
    result1[result[p]] = true;
 }

-ok(expResult.every(function(c) result1[c]), "all of the standard classes have been enumerated");
+ok(expResult.every(c => result1[c]), "all of the standard classes have been enumerated");

 </script>
 </pre>
--- a/dom/tests/mochitest/chrome/focus_frameset.html
+++ b/dom/tests/mochitest/chrome/focus_frameset.html
@ -4,7 +4,7 @@
        src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
 <script>
 if (opener)
-  SimpleTest.waitForFocus(function () opener.framesetWindowLoaded(window));
+  SimpleTest.waitForFocus(() => opener.framesetWindowLoaded(window));
 // Don't try to call finish() in this frame, since it will get upset that we
 // ran no tests.
 SimpleTest.waitForExplicitFinish();
--- a/dom/tests/mochitest/chrome/focus_window2.xul
+++ b/dom/tests/mochitest/chrome/focus_window2.xul
@ -13,7 +13,7 @@
 function focused()
 {
  if (window.arguments)
-    setTimeout(function () window.arguments[0](window, window.arguments[1]), 0);
+    setTimeout(() => window.arguments[0](window, window.arguments[1]), 0);
 }

 SimpleTest.waitForFocus(focused);
--- a/dom/tests/mochitest/chrome/sizemode_attribute.xul
+++ b/dom/tests/mochitest/chrome/sizemode_attribute.xul
@ -16,32 +16,32 @@ let tests = [
  },

  function test2() {
-    listen("fullscreen", function() checkAndContinue("fullscreen"));
+    listen("fullscreen", () => checkAndContinue("fullscreen"));
    window.fullScreen = true;
  },

  function test3() {
-    listen("fullscreen", function() checkAndContinue("normal"));
+    listen("fullscreen", () => checkAndContinue("normal"));
    window.fullScreen = false;
  },

  function test4() {
-    listen("resize", function() checkAndContinue("maximized"));
+    listen("resize", () => checkAndContinue("maximized"));
    window.maximize();
  },

  function test5() {
-    listen("fullscreen", function() checkAndContinue("fullscreen"));
+    listen("fullscreen", () => checkAndContinue("fullscreen"));
    window.fullScreen = true;
  },

  function test6() {
-    listen("fullscreen", function() checkAndContinue("maximized"));
+    listen("fullscreen", () => checkAndContinue("maximized"));
    window.fullScreen = false;
  },

  function test7() {
-    listen("resize", function() checkAndContinue("normal"));
+    listen("resize", () => checkAndContinue("normal"));
    window.restore();
  },

--- a/dom/tests/mochitest/chrome/window_focus.xul
+++ b/dom/tests/mochitest/chrome/window_focus.xul
@ -315,12 +315,12 @@ function mouseOnElement(element, expectedElement, focusChanged, testid)
  if (noFocusOnMouse) {
    // no focus so the last focus method will be 0
    gLastFocusMethod = 0;
-    expectFocusShift(function () synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView),
+    expectFocusShift(() => synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView),
                     expectedWindow, null, true, testid);
    gLastFocusMethod = fm.FLAG_BYMOUSE;
  }
  else {
-    expectFocusShift(function () synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView),
+    expectFocusShift(() => synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView),
                     element.ownerDocument.defaultView,
                     expectedElement, focusChanged, testid);
  }
@ -333,7 +333,7 @@ function done()
  opener.wrappedJSObject.SimpleTest.finish();
 }

-var pressTab = function () synthesizeKey("VK_TAB", { });
+var pressTab = () => synthesizeKey("VK_TAB", { });

 function setFocusTo(id, fwindow)
 {
@ -400,10 +400,10 @@ function startTest()
    }
    setFocusTo("last", window);
    expectFocusShift(pressTab, null, getById(partialTabList[0]), true, "partial tab key wrap to start");
-    expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+    expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }),
                     null, getById("last"), true, "partial shift tab key wrap to end");
    for (var idx = partialTabList.length - 1; idx >= 0; idx--) {
-      expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+      expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }),
                       null, getById(partialTabList[idx]), true, "partial tab key " + partialTabList[idx]);
    }
  }
@ -416,13 +416,13 @@ function startTest()
    // wrapping around at end with TAB key
    setFocusTo("last", window);
    expectFocusShift(pressTab, null, getById("t1"), true, "tab key wrap to start");
-    expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+    expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }),
                     null, getById("last"), true, "shift tab key wrap to end");

    // Shift+TAB key
    setFocusTo("o5", window);
    for (idx = kTabbableSteps; idx > 0; idx--) {
-      expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+      expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }),
                       null, getById("t" + idx), true, "shift tab key t" + idx);
    }
  }
@ -436,7 +436,7 @@ function startTest()
  var selectFired = false;
  function selectListener() { selectFired = true; }
  t19.addEventListener("select", selectListener, false); 
-  expectFocusShift(function() t19.select(),
+  expectFocusShift(() => t19.select(),
                   null, getById("t" + 19), true, "input.select()");
  t19.removeEventListener("select", selectListener, false); 
  ok(selectFired, "select event fires for input");
@ -487,7 +487,7 @@ function startTest()
  if (idx == kOverflowElementIndex) {
    gLastFocusMethod = fm.FLAG_BYMOUSE;
    var element = getById("t" + idx);
-    expectFocusShift(function () synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView),
+    expectFocusShift(() => synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView),
                     window, null, true, "mouse on scrollable element");
  }

@ -496,7 +496,7 @@ function startTest()
  for (idx = kTabbableSteps; idx >= 1; idx--) {
    if ((navigator.platform.indexOf("Mac") == 0) && (idx == kBeforeTabboxIndex + 1))
      continue;
-    expectFocusShift(function () getById("t" + idx).focus(),
+    expectFocusShift(() => getById("t" + idx).focus(),
                     null, getById("t" + idx), true, "focus method on element t" + idx);
  }

@ -511,7 +511,7 @@ function startTest()
  // focus() method on elements that are not tabbable 
  for (idx = 1; idx <= kFocusSteps; idx++) {
    var expected = getById("o" + (idx % 2 ? idx : idx - 1));
-    expectFocusShift(function () getById("o" + idx).focus(),
+    expectFocusShift(() => getById("o" + idx).focus(),
                     expected.ownerDocument.defaultView,
                     expected, idx % 2, "focus method on non-tabbable element o" + idx);
  }
@ -520,7 +520,7 @@ function startTest()
  // or are not focusable for other reasons (for instance, being disabled)
  for (idx = 1; idx <= kNoFocusSteps; idx++) {
    var expected = getById("o" + (idx % 2 ? idx : idx - 1));
-    expectFocusShift(function () getById("o" + idx).focus(),
+    expectFocusShift(() => getById("o" + idx).focus(),
                     expected.ownerDocument.defaultView,
                     expected, idx % 2, "focus method on unfocusable element n" + idx);
  }
@ -530,11 +530,11 @@ function startTest()
  if (!gPartialTabbing) {
    gLastFocusMethod = fm.FLAG_BYMOVEFOCUS;
    var legend = getById("legend");
-    expectFocusShift(function () legend.focus(),
+    expectFocusShift(() => legend.focus(),
                     null, getById("t28"), true, "focus method on unfocusable legend");
    gLastFocusMethod = 0;
    legend.tabIndex = "0";
-    expectFocusShift(function () legend.focus(),
+    expectFocusShift(() => legend.focus(),
                     null, getById("legend"), true, "focus method on focusable legend");
    legend.tabIndex = "-1";
  }
@ -560,7 +560,7 @@ function startTest()
      accessKeyDetails.altKey = isContent;
    }

-    expectFocusShift(function () synthesizeKey(key, accessKeyDetails),
+    expectFocusShift(() => synthesizeKey(key, accessKeyDetails),
                     null, getById(keys[k]), true, "accesskey " + key);
  }

@ -569,27 +569,27 @@ function startTest()
  mouseOnElement(getById("ad"), getById("t29"), true, "mouse on html label with content inside");
  mouseOnElement(getById("ag"), getById("n6"), true, "mouse on html label with for attribute");
  gLastFocusMethod = 0;
-  expectFocusShift(function () synthesizeMouse(getById("aj"), 2, 2, { }),
+  expectFocusShift(() => synthesizeMouse(getById("aj"), 2, 2, { }),
                   null, getById("o9"), true, "mouse on xul label with content inside");
-  expectFocusShift(function () synthesizeMouse(getById("ak"), 2, 2, { }),
+  expectFocusShift(() => synthesizeMouse(getById("ak"), 2, 2, { }),
                   null, getById("n4"), true, "mouse on xul label with control attribute");

  // test accesskeys that shouldn't work
  k = "o".charCodeAt(0);
  while (k++ < "v".charCodeAt(0)) {
    var key = String.fromCharCode(k);
-    expectFocusShift(function () synthesizeKey(key, accessKeyDetails),
+    expectFocusShift(() => synthesizeKey(key, accessKeyDetails),
                     window, getById("n4"), false, "non accesskey " + key);
  }
  gLastFocusMethod = -1;

  // should focus the for element when using the focus method on a label as well
-  expectFocusShift(function () getById("ad").focus(),
+  expectFocusShift(() => getById("ad").focus(),
                   null, getById("t29"), true, "mouse on html label using focus method");

  // make sure that the text is selected when clicking a label associated with an input
  getById("ag").htmlFor = "t19";
-  expectFocusShift(function () synthesizeMouse(getById("ag"), 2, 2, { }, gChildWindow),
+  expectFocusShift(() => synthesizeMouse(getById("ag"), 2, 2, { }, gChildWindow),
                   null, getById("t19"), true, "mouse on html label with for attribute changed");
  is(t19.selectionStart, 0, "input focused from label, selectionStart");
  is(t19.selectionEnd, 5, "input focused from label, selectionEnd");
@ -597,7 +597,7 @@ function startTest()
  // switch to another panel in a tabbox and ensure that tabbing moves between
  // elements on the new panel.
  $("tabbox").selectedIndex = 1;
-  expectFocusShift(function () getById("t" + kBeforeTabboxIndex).focus(),
+  expectFocusShift(() => getById("t" + kBeforeTabboxIndex).focus(),
                   null, getById("t" + kBeforeTabboxIndex), true, "focus method on element before tabbox");

  if (!gPartialTabbing) {
@ -615,8 +615,8 @@ function startTest()
  var t3 = $("t3");
  var t17 = getById("t17");
  var t19 = getById("t19");
-  var shiftFocusParentDocument = function() o9.focus();
-  var shiftFocusChildDocument = function() t17.focus();
+  var shiftFocusParentDocument = () => o9.focus();
+  var shiftFocusChildDocument = () => t17.focus();

  var trapBlur = function (element, eventListener, blurFunction)
  {
@ -628,8 +628,8 @@ function startTest()
  }

  var functions = [
-    function(element) element.focus(),
-    function(element) synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView)
+    element => element.focus(),
+    element => synthesizeMouse(element, 4, 4, { }, element.ownerDocument.defaultView)
  ];

  // first, check cases where the focus is adjusted during the blur event. Iterate twice,
@ -642,25 +642,25 @@ function startTest()
    // element (t3) within the same document, yet the focus is shifted to a
    // third element (o9) in the same document during the blur event for the
    // first element.
-    trapBlur(o5, shiftFocusParentDocument, function () adjustFocus(t3));
+    trapBlur(o5, shiftFocusParentDocument, () => adjustFocus(t3));
    compareEvents("commandupdate: cu blur: o5 commandupdate: cu focus: o9",
                  window, o9, "change focus to sibling during element blur, attempted sibling" + mod);

    // similar, but the third element (t17) is in a child document
-    trapBlur(o9, shiftFocusChildDocument, function () adjustFocus(t3));
+    trapBlur(o9, shiftFocusChildDocument, () => adjustFocus(t3));
    compareEvents("commandupdate: cu blur: o9 blur: outer-document blur: outer-window " +
                  "focus: child-document focus: child-window commandupdate: cu focus: t17",
                  gChildWindow, t17, "change focus to child document during element blur, attempted sibling" + mod);

    // similar, but an attempt to switch focus within the same document, but the
    // third element (t17) is in a parent document
-    trapBlur(t17, shiftFocusParentDocument, function () adjustFocus(t19));
+    trapBlur(t17, shiftFocusParentDocument, () => adjustFocus(t19));
    compareEvents("commandupdate: cu blur: t17 blur: child-document blur: child-window " +
                  "focus: outer-document focus: outer-window commandupdate: cu focus: o9",
                  window, o9, "change focus to parent document during element blur, attempted sibling" + mod);

    // similar, but blur is called instead of switching focus
-    trapBlur(t3, shiftFocusParentDocument, function () t3.blur());
+    trapBlur(t3, shiftFocusParentDocument, () => t3.blur());
    compareEvents("commandupdate: cu blur: t3 commandupdate: cu focus: o9",
                  window, o9, "change focus to same document during clear focus" + mod);

@ -669,7 +669,7 @@ function startTest()
    // child document. In this case, the focus in the parent document should be
    // what was set during the blur event, but the actual focus should still
    // move to the child document.
-    trapBlur(t3, shiftFocusParentDocument, function () adjustFocus(t17));
+    trapBlur(t3, shiftFocusParentDocument, () => adjustFocus(t17));
    compareEvents("commandupdate: cu blur: t3 commandupdate: cu focus: o9 " +
                  "blur: outer-document blur: outer-window " +
                  "focus: child-document focus: child-window commandupdate: cu focus: t17",
@ -678,7 +678,7 @@ function startTest()
       "change focus to sibling during element blur, attempted child, focused in parent" + mod);

    // similar, but with a parent
-    trapBlur(t19, shiftFocusChildDocument, function () adjustFocus(t3));
+    trapBlur(t19, shiftFocusChildDocument, () => adjustFocus(t3));
    compareEvents("commandupdate: cu blur: t19 commandupdate: cu focus: t17 " +
                  "blur: child-document blur: child-window " +
                  "focus: outer-document focus: outer-window commandupdate: cu focus: t3",
@ -687,13 +687,13 @@ function startTest()
       "change focus to sibling during element blur, attempted child, focused in child" + mod);

    // similar, with a child, but the blur event focuses a child element also
-    trapBlur(t3, shiftFocusChildDocument, function () adjustFocus(t19));
+    trapBlur(t3, shiftFocusChildDocument, () => adjustFocus(t19));
    compareEvents("commandupdate: cu blur: t3 blur: outer-document blur: outer-window " +
                  "focus: child-document focus: child-window commandupdate: cu focus: t17",
                  gChildWindow, t17, "change focus to child during element blur, attempted child" + mod);

    // similar, with a parent, where the blur event focuses a parent element also
-    trapBlur(t17, shiftFocusParentDocument, function () adjustFocus(t3));
+    trapBlur(t17, shiftFocusParentDocument, () => adjustFocus(t3));
    compareEvents("commandupdate: cu blur: t17 blur: child-document blur: child-window " +
                  "focus: outer-document focus: outer-window commandupdate: cu focus: o9",
                  window, o9, "change focus to parent during element blur, attempted parent" + mod);
@ -733,7 +733,7 @@ function startTest()
                window, o9, "change focus to parent document during element focus");

  // clear the focus during the focus event
-  trapFocus(t3, function () fm.clearFocus(window));
+  trapFocus(t3, () => fm.clearFocus(window));
  compareEvents("commandupdate: cu blur: o9 commandupdate: cu focus: t3 commandupdate: cu blur: t3",
                window, null, "clear focus during focus event");

@ -767,16 +767,16 @@ function startTest()
  gLastFocusMethod = 0;
  gEvents = "";
  // focus is being shifted in a child, so the focus should not change
-  expectFocusShift(function () fm.setFocus(getById("t20"), fm.FLAG_NOSWITCHFRAME),
+  expectFocusShift(() => fm.setFocus(getById("t20"), fm.FLAG_NOSWITCHFRAME),
                   window, getById("o5"), false, "no switch frame focus to child");
  setFocusTo("t20", gChildWindow);

  // here, however, focus is being shifted in a parent, which will have to blur
  // the child, so the focus will always change
-  expectFocusShift(function () fm.setFocus(getById("o5"), fm.FLAG_NOSWITCHFRAME),
+  expectFocusShift(() => fm.setFocus(getById("o5"), fm.FLAG_NOSWITCHFRAME),
                   window, getById("o5"), true, "no switch frame focus to parent");

-  expectFocusShift(function () fm.setFocus(getById("t1"), fm.FLAG_NOSWITCHFRAME),
+  expectFocusShift(() => fm.setFocus(getById("t1"), fm.FLAG_NOSWITCHFRAME),
                   window, getById("t1"), true, "no switch frame focus to same window");

  // ---- tests for focus and scrolling into view ----
@ -804,19 +804,19 @@ function startTest()
  $("innerbox").appendChild(textbox2);

  gLastFocusMethod = 0;
-  expectFocusShift(function () textbox2.focus(),
+  expectFocusShift(() => textbox2.focus(),
                   null, textbox2.inputField, true, "focus on textbox");
  gLastFocusMethod = fm.FLAG_BYKEY;
-  expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+  expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }),
                   null, textbox1.inputField, true, "shift+tab on textbox");

  textbox1.tabIndex = 2;
  textbox2.tabIndex = 2;
  gLastFocusMethod = 0;
-  expectFocusShift(function () textbox2.focus(),
+  expectFocusShift(() => textbox2.focus(),
                   null, textbox2.inputField, true, "focus on textbox with tabindex set");
  gLastFocusMethod = fm.FLAG_BYKEY;
-  expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+  expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }),
                   null, textbox1.inputField, true, "shift+tab on textbox with tabindex set");

  // ---- test for bug 618907 which ensures that canceling the mousedown event still focuses the
@ -826,7 +826,7 @@ function startTest()
  childContentFrame.style.MozUserFocus = "";

  var frab = childContentFrame.contentDocument.getElementById("fra-b");
-  var mouseDownListener = function(event) event.preventDefault();
+  var mouseDownListener = event => event.preventDefault();
  frab.addEventListener("mousedown", mouseDownListener, false);

  var childElementToFocus = childContentFrame.contentDocument.getElementById("fra");
@ -838,7 +838,7 @@ function startTest()
  setFocusTo("t1", window);

  gLastFocusMethod = -1;
-  expectFocusShift(function () synthesizeMouse(frab, 5, 5, { }, childContentFrame.contentWindow),
+  expectFocusShift(() => synthesizeMouse(frab, 5, 5, { }, childContentFrame.contentWindow),
                   null, childElementToFocus, true,
                   "mousedown event canceled - chrome to content");

@ -855,7 +855,7 @@ function startTest()
  // ---- test to check that refocusing an element during a blur event doesn't succeed

  var t1 = getById("t1");
-  t1.addEventListener("blur", function() t1.focus(), true);
+  t1.addEventListener("blur", () => t1.focus(), true);
  t1.focus();
  var t3 = getById("t3");
  synthesizeMouse(t3, 2, 2, { });
@ -874,23 +874,23 @@ function doCommandDispatcherTests()
  gLastFocus = t19;
  gEvents = "";

-  expectFocusShift(function () document.commandDispatcher.focusedElement = getById("o9"),
+  expectFocusShift(() => document.commandDispatcher.focusedElement = getById("o9"),
                   null, getById("o9"), true, "command dispatcher set focusedElement");
-  expectFocusShift(function () document.commandDispatcher.advanceFocus(),
+  expectFocusShift(() => document.commandDispatcher.advanceFocus(),
                   null, getById("o13"), true, "command dispatcher advanceFocus");
-  expectFocusShift(function () document.commandDispatcher.rewindFocus(),
+  expectFocusShift(() => document.commandDispatcher.rewindFocus(),
                   null, getById("o9"), true, "command dispatcher rewindFocus");
-  expectFocusShift(function () document.commandDispatcher.focusedElement = null,
+  expectFocusShift(() => document.commandDispatcher.focusedElement = null,
                   null, null, true, "command dispatcher set focusedElement to null");
-  expectFocusShift(function () document.commandDispatcher.focusedWindow = gChildWindow,
+  expectFocusShift(() => document.commandDispatcher.focusedWindow = gChildWindow,
                   null, getById("t19"), true, "command dispatcher set focusedElement to null");
-  expectFocusShift(function () document.commandDispatcher.focusedElement = null,
+  expectFocusShift(() => document.commandDispatcher.focusedElement = null,
                   gChildWindow, null, true, "command dispatcher set focusedElement to null in child");
-  expectFocusShift(function () document.commandDispatcher.advanceFocusIntoSubtree(getById("t19")),
+  expectFocusShift(() => document.commandDispatcher.advanceFocusIntoSubtree(getById("t19")),
                   null, getById("t20"), true, "command dispatcher advanceFocusIntoSubtree child");
-  expectFocusShift(function () document.commandDispatcher.advanceFocusIntoSubtree(null),
+  expectFocusShift(() => document.commandDispatcher.advanceFocusIntoSubtree(null),
                   null, getById("t21"), true, "command dispatcher advanceFocusIntoSubtree null child");
-  expectFocusShift(function () document.commandDispatcher.advanceFocusIntoSubtree(getById("o9").parentNode),
+  expectFocusShift(() => document.commandDispatcher.advanceFocusIntoSubtree(getById("o9").parentNode),
                   null, getById("o9"), true, "command dispatcher advanceFocusIntoSubtree parent");
 }

@ -925,11 +925,11 @@ function testMoveFocus()
  var newFocus;
  gLastFocusMethod = fm.FLAG_BYMOVEFOCUS;
  var expectedFirst = getById(gPartialTabbing ? "t3" : "t1");
-  expectFocusShift(function () newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FIRST, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FIRST, 0),
                   window, expectedFirst, true, "moveFocus to first null window null content");
  is(newFocus, fm.focusedElement, "moveFocus to first null window null content return value");

-  expectFocusShift(function () newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_LAST, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_LAST, 0),
                   window, getById("last"), true, "moveFocus to last null window null content");
  is(newFocus, fm.focusedElement, "moveFocus to last null window null content return value");

@ -944,13 +944,13 @@ function testMoveFocus()
  gEvents = "";
  gLastFocus = null;
  gLastFocusMethod = fm.FLAG_BYMOVEFOCUS;
-  expectFocusShift(function () newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FIRST, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FIRST, 0),
                   window, expectedFirst, true, "moveFocus to first null window null content no focus");
  is(newFocus, fm.focusedElement, "moveFocus to first null window null content no focus return value");
  fm.clearFocus(window);
  gEvents = "";
  gLastFocus = null;
-  expectFocusShift(function () newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_LAST, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_LAST, 0),
                   window, getById("last"), true, "moveFocus to last null window null content no focus");
  is(newFocus, fm.focusedElement, "moveFocus to last null window null content no focus return value");
  fm.clearFocus(window);
@ -964,14 +964,14 @@ function testMoveFocus()
  // moving focus from a specified element
  setFocusTo("t6", window);
  gLastFocusMethod = fm.FLAG_BYMOVEFOCUS;
-  expectFocusShift(function () newFocus = fm.moveFocus(null, getById("specialroot"), fm.MOVEFOCUS_FIRST, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(null, getById("specialroot"), fm.MOVEFOCUS_FIRST, 0),
                   window, getById("t3"), true, "moveFocus to first null window with content");
 // XXXndeakin P3 this doesn't work
-//  expectFocusShift(function () newFocus = fm.moveFocus(null, getById("specialroot"), fm.MOVEFOCUS_LAST, 0),
+//  expectFocusShift(() => newFocus = fm.moveFocus(null, getById("specialroot"), fm.MOVEFOCUS_LAST, 0),
 //                   window, getById("o3"), true, "moveFocus to last null window with content");

  // move focus to first in child window
-  expectFocusShift(function () newFocus = fm.moveFocus(gChildWindow, null, fm.MOVEFOCUS_FIRST, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(gChildWindow, null, fm.MOVEFOCUS_FIRST, 0),
                   gChildWindow, getById("t" + (kChildDocumentRootIndex + 1)), true,
                   "moveFocus to first child window null content");
  is(newFocus, getById("t" + (kChildDocumentRootIndex + 1)),
@ -980,7 +980,7 @@ function testMoveFocus()
  // move focus to last in child window
  setFocusTo("t6", window);
  var expectedLast = getById(gPartialTabbing ? "t30" : "t" + (kBeforeTabboxIndex - 1));
-  expectFocusShift(function () newFocus = fm.moveFocus(gChildWindow, null, fm.MOVEFOCUS_LAST, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(gChildWindow, null, fm.MOVEFOCUS_LAST, 0),
                   gChildWindow, expectedLast, true,
                   "moveFocus to last child window null content");
  is(newFocus, getById(expectedLast),
@ -1049,18 +1049,18 @@ function testMoveFocus()
    gLastFocusMethod = fm.FLAG_BYKEY;

    selection.selectAllChildren(getById("hiddenspan"));
-    expectFocusShift(function () synthesizeKey("VK_TAB", { }),
+    expectFocusShift(() => synthesizeKey("VK_TAB", { }),
                     gChildWindow, getById("t26"), true, "tab with selection on hidden content");

    setFocusTo($("o15"), window);
    $("o15").hidden = true;
    document.documentElement.getBoundingClientRect(); // flush after hiding
-    expectFocusShift(function () synthesizeKey("VK_TAB", { }),
+    expectFocusShift(() => synthesizeKey("VK_TAB", { }),
                     window, $("o17"), true, "tab with focus on hidden content");

    $("o17").hidden = true;
    document.documentElement.getBoundingClientRect();
-    expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }),
+    expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }),
                     window, $("o13"), true, "shift+tab with focus on hidden content");
  }

@ -1071,7 +1071,7 @@ function testMoveFocus()
  setFocusTo("t18", gChildWindow);

  gLastFocusMethod = fm.FLAG_BYMOVEFOCUS;
-  expectFocusShift(function () newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FORWARD, 0),
+  expectFocusShift(() => newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FORWARD, 0),
                   gChildWindow, t19, true, "moveFocus to next textbox");
  is(t19.selectionStart, 0, "input focused after moveFocus selectionStart");
  is(t19.selectionEnd, 5, "input focused after moveFocus selectionEnd");
@ -1079,7 +1079,7 @@ function testMoveFocus()
  t19.setSelectionRange(0, 0);
  setFocusTo("t18", gChildWindow);
  gLastFocusMethod = fm.FLAG_BYKEY;
-  expectFocusShift(function () newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FORWARD, fm.FLAG_BYKEY),
+  expectFocusShift(() => newFocus = fm.moveFocus(null, null, fm.MOVEFOCUS_FORWARD, fm.FLAG_BYKEY),
                   gChildWindow, t19, true, "moveFocus to next textbox by key");
  is(t19.selectionStart, 0, "input focused after moveFocus by key selectionStart");
  is(t19.selectionEnd, 5, "input focused after moveFocus by key selectionEnd");
@ -1187,43 +1187,43 @@ function framesetWindowLoaded(framesetWindow)
    gNewExpectedWindow = framesetWindow.frames[(idx - 1) >> 1];
    if (idx % 2)
      initEvents(gNewExpectedWindow);
-    expectFocusShift(function () synthesizeKey("VK_TAB", { }, framesetWindow),
+    expectFocusShift(() => synthesizeKey("VK_TAB", { }, framesetWindow),
                     gNewExpectedWindow, getById("f" + idx), true, "frameset tab key f" + idx);
    gMoveToFocusFrame = false;
    gOldExpectedWindow = gNewExpectedWindow;
  }

  gNewExpectedWindow = framesetWindow.frames[0];
-  expectFocusShift(function () synthesizeKey("VK_TAB", { }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_TAB", { }, framesetWindow),
                   gNewExpectedWindow, getById("f1"), true, "frameset tab key wrap to start");
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[3];
-  expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f8"), true, "frameset shift tab key wrap to end");

  for (idx = 7; idx >= 1; idx--) {
    gOldExpectedWindow = gNewExpectedWindow;
    gNewExpectedWindow = framesetWindow.frames[(idx - 1) >> 1];
-    expectFocusShift(function () synthesizeKey("VK_TAB", { shiftKey: true }, framesetWindow),
+    expectFocusShift(() => synthesizeKey("VK_TAB", { shiftKey: true }, framesetWindow),
                     gNewExpectedWindow, getById("f" + idx), true, "frameset shift tab key f" + idx);
  }

  // document shifting
  // XXXndeakin P3 ctrl+tab doesn't seem to be testable currently for some reason
  gNewExpectedWindow = framesetWindow.frames[1];
-  expectFocusShift(function () synthesizeKey("VK_F6", { ctrlKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { ctrlKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f3"), true, "switch document forward with f6");
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[2];
-  expectFocusShift(function () synthesizeKey("VK_F6", { }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { }, framesetWindow),
                   gNewExpectedWindow, getById("f5"), true, "switch document forward with ctrl+tab");
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[3];
-  expectFocusShift(function () synthesizeKey("VK_F6", { ctrlKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { ctrlKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f7"), true, "switch document forward with ctrl+f6");
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[0];
-  expectFocusShift(function () synthesizeKey("VK_F6", { ctrlKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { ctrlKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f1"), true, "switch document forward and wrap");

 // going backwards by document and wrapping doesn't currently work, but didn't work
@ -1232,7 +1232,7 @@ function framesetWindowLoaded(framesetWindow)
 /*
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[3];
-  expectFocusShift(function () synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f7"), true, "switch document backward and wrap");
 */

@ -1241,15 +1241,15 @@ function framesetWindowLoaded(framesetWindow)

  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[2];
-  expectFocusShift(function () synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f5"), true, "switch document backward with f6");
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[1];
-  expectFocusShift(function () synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f3"), true, "switch document backward with ctrl+tab");
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = framesetWindow.frames[0];
-  expectFocusShift(function () synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
+  expectFocusShift(() => synthesizeKey("VK_F6", { ctrlKey: true, shiftKey: true }, framesetWindow),
                   gNewExpectedWindow, getById("f1"), true, "switch document backward with ctrl+f6");

  // skip the window switching tests for now on Linux, as raising and lowering
@ -1282,13 +1282,13 @@ function switchWindowTest(otherWindow, framesetWindow)
  gOldExpectedWindow = otherWindow;
  gNewExpectedWindow = framesetWindow.frames[1];

-  expectFocusShift(function () gNewExpectedWindow.focus(),
+  expectFocusShift(() => gNewExpectedWindow.focus(),
                   gNewExpectedWindow, getById("f4"), true, "switch to frame in another window");
  is(fm.getFocusedElementForWindow(otherWindow, false, {}).id, "other", "inactive window has focused element");

  gOldExpectedWindow = framesetWindow.frames[1];
  gNewExpectedWindow = otherWindow;
-  expectFocusShift(function () otherWindow.focus(),
+  expectFocusShift(() => otherWindow.focus(),
                   gNewExpectedWindow, getById("other"), true, "switch to another window");

  var exh = false;
@ -1321,13 +1321,13 @@ function switchWindowTest(otherWindow, framesetWindow)

  gOldExpectedWindow = otherWindow;
  gNewExpectedWindow = framesetWindow.frames[1];
-  expectFocusShift(function () fm.activeWindow = topWindow,
+  expectFocusShift(() => fm.activeWindow = topWindow,
                   gNewExpectedWindow, getById("f4"), true, "switch to frame activeWindow");

  fm.clearFocus(otherWindow);
  gOldExpectedWindow = gNewExpectedWindow;
  gNewExpectedWindow = otherWindow;
-  expectFocusShift(function () fm.setFocus(otherElement, fm.FLAG_RAISE),
+  expectFocusShift(() => fm.setFocus(otherElement, fm.FLAG_RAISE),
                   gNewExpectedWindow, getById("other"), true, "switch to window with raise");

  getTopWindow(framesetWindow).document.commandDispatcher.focusedWindow = gOldExpectedWindow;
--- a/dom/tests/mochitest/general/test_497898.html
+++ b/dom/tests/mochitest/general/test_497898.html
@ -14,7 +14,7 @@ function done()

 function switchFocus()
 {
-  setTimeout(function () window.open('497633.html', '_new', 'width=300,height=300'), 0);
+  setTimeout(() => window.open('497633.html', '_new', 'width=300,height=300'), 0);
 }
 </script>
 </head>
--- a/dom/tests/mochitest/general/test_domWindowUtils_scrollbarSize.html
+++ b/dom/tests/mochitest/general/test_domWindowUtils_scrollbarSize.html
@ -18,7 +18,7 @@
        return doc.getElementById("float").offsetWidth > 200;
      }

-      checkScrollbarSizeFlush(utils, function (w, h) w == 0 && h == 0,
+      checkScrollbarSizeFlush(utils, (w, h) => w == 0 && h == 0,
        "[overflow=hidden] corrrect scrollbar size after flushing");

      // Some platforms (esp. mobile) may have floating scrollbars that don't
@ -27,17 +27,17 @@
        let body = doc.querySelector("body");
        body.style.overflowY = "scroll";

-        checkScrollbarSize(utils, function (w, h) w == 0 && h == 0,
+        checkScrollbarSize(utils, (w, h) => w == 0 && h == 0,
          "[overflowY=scroll] correct scrollbar size w/o flushing");

-        checkScrollbarSizeFlush(utils, function (w, h) w > 0 && h == 0,
+        checkScrollbarSizeFlush(utils, (w, h) => w > 0 && h == 0,
          "[overflowY=scroll] correct scrollbar size after flushing");

        body.style.overflowX = "scroll";
-        checkScrollbarSize(utils, function (w, h) w > 0 && h == 0,
+        checkScrollbarSize(utils, (w, h) => w > 0 && h == 0,
          "[overflowXY=scroll] correct scrollbar size w/o flushing");

-        checkScrollbarSizeFlush(utils, function (w, h) w > 0 && h > 0,
+        checkScrollbarSizeFlush(utils, (w, h) => w > 0 && h > 0,
          "[overflowXY=scroll] correct scrollbar size after flushing");
      }

--- a/dom/tests/mochitest/localstorage/test_localStorageBasePrivateBrowsing_perwindowpb.html
+++ b/dom/tests/mochitest/localstorage/test_localStorageBasePrivateBrowsing_perwindowpb.html
@ -246,7 +246,7 @@ function doTest() {
        prefBranch.clearUserPref("browser.startup.homepage_override.mstone");
        SimpleTest.finish();
      };
-      SimpleTest.executeSoon(function() testOnWindow(true, callback));
+      SimpleTest.executeSoon(() => testOnWindow(true, callback));
    });
  });
 }
--- a/dom/tests/mochitest/localstorage/test_localStorageQuotaPrivateBrowsing_perwindowpb.html
+++ b/dom/tests/mochitest/localstorage/test_localStorageQuotaPrivateBrowsing_perwindowpb.html
@ -39,7 +39,7 @@ function startTest() {
    }, false);
    slave = aWindow.content.frames[0];

-    SimpleTest.waitForFocus(function() doNextTest(aWindow), aWindow);
+    SimpleTest.waitForFocus(() => doNextTest(aWindow), aWindow);
  });
 }

--- a/dom/wifi/WifiWorker.js
+++ b/dom/wifi/WifiWorker.js
@ -2636,7 +2636,9 @@ WifiWorker.prototype = {

        // Only fire the event if the link speed changed or the signal
        // strength changed by more than 10%.
-        function tensPlace(percent) ((percent / 10) | 0)
+        function tensPlace(percent) {
+          return (percent / 10) | 0;
+        }

        if (last && last.linkSpeed === info.linkSpeed &&
            last.ipAddress === info.ipAddress &&
--- a/dom/xbl/test/file_bug821850.xhtml
+++ b/dom/xbl/test/file_bug821850.xhtml
@ -152,12 +152,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=821850
    is(window.primitiveExpando, 11, "Can see waived expandos");
    is(window.stringExpando, "stringExpando", "Can see waived expandos");
    is(typeof window.objectExpando, "object", "object expando exists");
-    checkThrows(function() window.objectExpando.foo);
+    checkThrows(() => window.objectExpando.foo);
    is(SpecialPowers.wrap(window.objectExpando).foo, 12, "SpecialPowers sees the right thing");
    is(typeof window.globalExpando, "object", "Can see global object");
-    checkThrows(function() window.globalExpando.win);
+    checkThrows(() => window.globalExpando.win);
    is(window.functionExpando(), "called", "XBL functions are callable");
-    checkThrows(function() window.functionExpando.prop);
+    checkThrows(() => window.functionExpando.prop);

    // Inspect the bound element.
    var bound = document.getElementById('bound');
--- a/dom/xul/templates/tests/chrome/templates_shared.js
+++ b/dom/xul/templates/tests/chrome/templates_shared.js
@ -440,7 +440,7 @@ function compareConsoleMessages()
  var consoleService = Components.classes["@mozilla.org/consoleservice;1"].
                         getService(Components.interfaces.nsIConsoleService);
  var messages = consoleService.getMessageArray() || [];
-  messages = messages.map(function (m) m.message);
+  messages = messages.map(m => m.message);
  // Copy to avoid modifying expectedConsoleMessages
  var expect = expectedConsoleMessages.concat();
  for (var m = 0; m < messages.length; m++) {
--- a/dom/xul/templates/tests/chrome/test_tmpl_errors.xul
+++ b/dom/xul/templates/tests/chrome/test_tmpl_errors.xul
@ -33,37 +33,37 @@ var tests = [

 // <queryset> used in invalid location
 {
-  pre: function(template) template.insertBefore(document.createElement("queryset"), template.lastChild),
+  pre: template => template.insertBefore(document.createElement("queryset"), template.lastChild),
  error: "Error parsing template: unexpected <queryset> element",
-  post: function(queryset) queryset.parentNode.removeChild(queryset)
+  post: queryset => queryset.parentNode.removeChild(queryset)
 },

 // no member variable found
 {
-  pre: function(template) $("action").firstChild.removeAttribute("uri"),
+  pre: template => $("action").firstChild.removeAttribute("uri"),
  error: "Error parsing template: no member variable found. Action body should have an element with uri attribute",
-  post: function() $("action").firstChild.setAttribute("uri", "?child")
+  post: () => $("action").firstChild.setAttribute("uri", "?child")
 },

 // bad binding subject
 {
-  pre: function(template) $("binding").removeAttribute("subject"),
+  pre: template => $("binding").removeAttribute("subject"),
  error: "Error parsing template: <binding> requires a variable for its subject attribute",
-  post: function() $("binding").setAttribute("subject", "?child"),
+  post: () => $("binding").setAttribute("subject", "?child"),
 },

 // bad binding predicate
 {
-  pre: function(template) $("binding").removeAttribute("predicate"),
+  pre: template => $("binding").removeAttribute("predicate"),
  error: "Error parsing template: <binding> element is missing a predicate attribute",
-  post: function() $("binding").setAttribute("predicate", "http://www.some-fictitious-zoo.com/rdf#name"),
+  post: () => $("binding").setAttribute("predicate", "http://www.some-fictitious-zoo.com/rdf#name"),
 },

 // bad binding object
 {
-  pre: function(template) $("binding").setAttribute("object", "blah"),
+  pre: template => $("binding").setAttribute("object", "blah"),
  error: "Error parsing template: <binding> requires a variable for its object attribute",
-  post: function() $("binding").setAttribute("object", "?name"),
+  post: () => $("binding").setAttribute("object", "?name"),
 },

 // where condition missing a subject
@ -120,65 +120,65 @@ var tests = [

 // bad member container
 {
-  pre: function(template) $("member").setAttribute("container", "blah"),
+  pre: template => $("member").setAttribute("container", "blah"),
  error: "Error parsing template: <member> requires a variable for its container attribute",
-  post: function() $("member").setAttribute("container", "?uri"),
+  post: () => $("member").setAttribute("container", "?uri"),
 },

 // bad member child
 {
-  pre: function(template) $("member").setAttribute("child", "blah"),
+  pre: template => $("member").setAttribute("child", "blah"),
  error: "Error parsing template: <member> requires a variable for its child attribute",
-  post: function() $("member").setAttribute("child", "?child"),
+  post: () => $("member").setAttribute("child", "?child"),
 },

 // bad triple subject
 {
-  pre: function(template) $("triple").removeAttribute("subject"),
+  pre: template => $("triple").removeAttribute("subject"),
  error: "Error parsing template: <triple> requires a variable for its subject attribute",
-  post: function() $("triple").setAttribute("subject", "?child"),
+  post: () => $("triple").setAttribute("subject", "?child"),
 },

 // missing triple predicate
 {
-  pre: function(template) $("triple").removeAttribute("predicate"),
+  pre: template => $("triple").removeAttribute("predicate"),
  error: "Error parsing template: <triple> should have a non-variable value as a predicate",
-  post: function() $("triple").setAttribute("predicate", "http://www.some-fictitious-zoo.com/rdf#name"),
+  post: () => $("triple").setAttribute("predicate", "http://www.some-fictitious-zoo.com/rdf#name"),
 },

 // bad triple predicate
 {
-  pre: function(template) $("triple").setAttribute("predicate", "?predicate"),
+  pre: template => $("triple").setAttribute("predicate", "?predicate"),
  error: "Error parsing template: <triple> should have a non-variable value as a predicate",
-  post: function() $("triple").setAttribute("predicate", "http://www.some-fictitious-zoo.com/rdf#name"),
+  post: () => $("triple").setAttribute("predicate", "http://www.some-fictitious-zoo.com/rdf#name"),
 },

 // bad triple object
 {
-  pre: function(template) $("triple").removeAttribute("object"),
+  pre: template => $("triple").removeAttribute("object"),
  error: "Error parsing template: <triple> requires a variable for its object attribute",
-  post: function() $("triple").setAttribute("object", "?name"),
+  post: () => $("triple").setAttribute("object", "?name"),
 },

 // content not first element in query
 {
  pre: function(template) { var content = $("content"); content.parentNode.appendChild(content); return content; },
  error: "Error parsing template: expected <content> to be first",
-  post: function(content) content.parentNode.insertBefore(content, content.parentNode.firstChild),
+  post: content => content.parentNode.insertBefore(content, content.parentNode.firstChild),
 },

 // member container variable not bound
 {
-  pre: function(template) $("member").removeAttribute("container"),
+  pre: template => $("member").removeAttribute("container"),
  error: "Error parsing template: neither container or child variables of <member> has a value",
-  post: function() $("member").setAttribute("container", "?uri"),
+  post: () => $("member").setAttribute("container", "?uri"),
 },

 // neither triple subject or object variable are bound
 {
-  pre: function(template) $("triple").setAttribute("subject", "?blah"),
+  pre: template => $("triple").setAttribute("subject", "?blah"),
  error: "Error parsing template: neither subject or object variables of <triple> has a value",
-  post: function() $("triple").setAttribute("subject", "?child"),
+  post: () => $("triple").setAttribute("subject", "?child"),
 },

 // neither triple subject or object variable are bound
--- a/gfx/layers/apz/test/reftest/initial-scale-1-ref.html
+++ b/gfx/layers/apz/test/reftest/initial-scale-1-ref.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html><head>
+<meta name="viewport" content="width=device-width">
+</head>
+<body>
+This tests that an initial-scale of 0 (i.e. garbage) is overridden<br/>
+with something a little more sane.
+</body>
+</html>
+
--- a/gfx/layers/apz/test/reftest/initial-scale-1.html
+++ b/gfx/layers/apz/test/reftest/initial-scale-1.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html><head>
+<meta name="viewport" content="initial-scale=0; width=device-width">
+</head>
+<body>
+This tests that an initial-scale of 0 (i.e. garbage) is overridden<br/>
+with something a little more sane.
+</body>
+</html>
+
--- a/gfx/layers/apz/test/reftest/reftest.list
+++ b/gfx/layers/apz/test/reftest/reftest.list
@ -12,3 +12,6 @@ chaos-mode skip-if(!asyncPan) == async-scrollbar-1-vh-rtl.html async-scrollbar-1
 # off, hence the fuzzy-if clauses.
 chaos-mode skip-if(!asyncZoom) fuzzy-if(B2G,98,82) == async-scrollbar-zoom-1.html async-scrollbar-zoom-1-ref.html
 chaos-mode skip-if(!asyncZoom) fuzzy-if(B2G,94,146) == async-scrollbar-zoom-2.html async-scrollbar-zoom-2-ref.html
+
+# Meta-viewport tag support
+chaos-mode skip-if(!asyncZoom) == initial-scale-1.html initial-scale-1-ref.html
--- a/js/src/builtin/TypedObject.h
+++ b/js/src/builtin/TypedObject.h
@ -593,7 +593,7 @@ class TypedObject : public JSObject
    static bool GetBuffer(JSContext* cx, unsigned argc, Value* vp);
    static bool GetByteOffset(JSContext* cx, unsigned argc, Value* vp);

-    Shape** addressOfShapeFromGC() { return shape_.unsafeGet(); }
+    Shape** addressOfShapeFromGC() { return shape_.unsafeUnbarrieredForTracing(); }
 };

 typedef Handle<TypedObject*> HandleTypedObject;
--- a/js/src/gc/Barrier.cpp
+++ b/js/src/gc/Barrier.cpp
@ -17,6 +17,21 @@

 #ifdef DEBUG

+template <typename T>
+void
+js::BarrieredBase<T>::assertTypeConstraints() const
+{
+    static_assert(mozilla::IsBaseOf<js::gc::Cell, typename mozilla::RemovePointer<T>::Type>::value ||
+                  mozilla::IsSame<JS::Value, T>::value ||
+                  mozilla::IsSame<jsid, T>::value ||
+                  mozilla::IsSame<js::TaggedProto, T>::value,
+                  "ensure only supported types are instantiated with barriers");
+}
+#define INSTANTIATE_ALL_VALID_TYPES(type) \
+    template void js::BarrieredBase<type>::assertTypeConstraints() const;
+FOR_EACH_GC_POINTER_TYPE(INSTANTIATE_ALL_VALID_TYPES)
+#undef INSTANTIATE_ALL_VALID_TYPES
+
 bool
 js::HeapSlot::preconditionForSet(NativeObject* owner, Kind kind, uint32_t slot)
 {
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@ -135,20 +135,27 @@
 *
 * This file implements four classes, illustrated here:
 *
- * BarrieredBase          abstract base class which provides common operations
- *  |  |  |  |
- *  |  |  | PreBarriered  provides pre-barriers only
- *  |  |  |
- *  |  | HeapPtr          provides pre- and post-barriers
+ * BarrieredBase             base class of all barriers
 *  |  |
- *  | RelocatablePtr      provides pre- and post-barriers and is relocatable
+ *  | WriteBarrieredBase     base class which provides common write operations
+ *  |  |  |  |  |
+ *  |  |  |  | PreBarriered  provides pre-barriers only
+ *  |  |  |  |
+ *  |  |  | HeapPtr          provides pre- and post-barriers
+ *  |  |  |
+ *  |  | RelocatablePtr      provides pre- and post-barriers and is relocatable
+ *  |  |
+ *  | HeapSlot               similar to HeapPtr, but tailored to slots storage
 *  |
- * HeapSlot               similar to HeapPtr, but tailored to slots storage
+ * ReadBarrieredBase         base class which provides common read operations
+ *  |
+ * ReadBarriered             provides read barriers only
+ *
 *
 * The implementation of the barrier logic is implemented on T::writeBarrier.*,
 * via:
 *
- * BarrieredBase<T>::pre
+ * WriteBarrieredBase<T>::pre
 *  -> InternalGCMethods<T*>::preBarrier
 *      -> T::writeBarrierPre
 *  -> InternalGCMethods<Value>::preBarrier
@ -302,47 +309,71 @@ struct InternalGCMethods<jsid>
    static void postBarrier(jsid* idp, jsid prev, jsid next) {}
 };

+// Barrier classes can use Mixins to add methods to a set of barrier
+// instantiations, to make the barriered thing look and feel more like the
+// thing itself.
 template <typename T>
 class BarrieredBaseMixins {};

-/*
- * Base class for barriered pointer types.
- */
-template <class T>
+// Base class of all barrier types.
+template <typename T>
 class BarrieredBase : public BarrieredBaseMixins<T>
 {
  protected:
+    // BarrieredBase is not directly instantiable.
+    explicit BarrieredBase(T v) : value(v) {
+#ifdef DEBUG
+        assertTypeConstraints();
+#endif
+    }
+
+    // Storage for all barrier classes. |value| must be a GC thing reference
+    // type: either a direct pointer to a GC thing or a supported tagged
+    // pointer that can reference GC things, such as JS::Value or jsid. Nested
+    // barrier types are NOT supported. See assertTypeConstraints.
    T value;

-    explicit BarrieredBase(T v) : value(v) {}
+  public:
+    // Note: this is public because C++ cannot friend to a specific template instantiation.
+    // Friending to the generic template leads to a number of unintended consequences, including
+    // template resolution ambiguity and a circular dependency with Tracing.h.
+    T* unsafeUnbarrieredForTracing() { return &value; }
+
+  private:
+#ifdef DEBUG
+    // Static type assertions about T must be moved out of line to avoid
+    // circular dependencies between Barrier classes and GC memory definitions.
+    void assertTypeConstraints() const;
+#endif
+};
+
+// Base class for barriered pointer types that intercept only writes.
+template <class T>
+class WriteBarrieredBase : public BarrieredBase<T>
+{
+  protected:
+    // WriteBarrieredBase is not directly instantiable.
+    explicit WriteBarrieredBase(T v) : BarrieredBase<T>(v) {}

  public:
    DECLARE_POINTER_COMPARISON_OPS(T);
    DECLARE_POINTER_CONSTREF_OPS(T);

-    /* Use this if the automatic coercion to T isn't working. */
-    const T& get() const { return value; }
+    // Use this if the automatic coercion to T isn't working.
+    const T& get() const { return this->value; }

-    /*
-     * Use these if you want to change the value without invoking barriers.
-     * Obviously this is dangerous unless you know the barrier is not needed.
-     */
-    T* unsafeGet() { return &value; }
-    const T* unsafeGet() const { return &value; }
-    void unsafeSet(T v) { value = v; }
+    // Use this if you want to change the value without invoking barriers.
+    // Obviously this is dangerous unless you know the barrier is not needed.
+    void unsafeSet(T v) { this->value = v; }

-    /* For users who need to manually barrier the raw types. */
+    // For users who need to manually barrier the raw types.
    static void writeBarrierPre(const T& v) { InternalGCMethods<T>::preBarrier(v); }

  protected:
-    void pre() { InternalGCMethods<T>::preBarrier(value); }
-    void post(T prev, T next) { InternalGCMethods<T>::postBarrier(&value, prev, next); }
+    void pre() { InternalGCMethods<T>::preBarrier(this->value); }
+    void post(T prev, T next) { InternalGCMethods<T>::postBarrier(&this->value, prev, next); }
 };

-template <>
-class BarrieredBaseMixins<JS::Value> : public ValueOperations<BarrieredBase<JS::Value> >
-{};
-
 /*
 * PreBarriered only automatically handles pre-barriers. Post-barriers must
 * be manually implemented when using this class. HeapPtr and RelocatablePtr
@ -350,15 +381,15 @@ class BarrieredBaseMixins<JS::Value> : public ValueOperations<BarrieredBase<JS::
 * of moving behavior, e.g. for HashMap keys.
 */
 template <class T>
-class PreBarriered : public BarrieredBase<T>
+class PreBarriered : public WriteBarrieredBase<T>
 {
  public:
-    PreBarriered() : BarrieredBase<T>(GCMethods<T>::initial()) {}
+    PreBarriered() : WriteBarrieredBase<T>(GCMethods<T>::initial()) {}
    /*
     * Allow implicit construction for use in generic contexts, such as DebuggerWeakMap::markKeys.
     */
-    MOZ_IMPLICIT PreBarriered(T v) : BarrieredBase<T>(v) {}
-    explicit PreBarriered(const PreBarriered<T>& v) : BarrieredBase<T>(v.value) {}
+    MOZ_IMPLICIT PreBarriered(T v) : WriteBarrieredBase<T>(v) {}
+    explicit PreBarriered(const PreBarriered<T>& v) : WriteBarrieredBase<T>(v.value) {}
    ~PreBarriered() { this->pre(); }

    void init(T v) {
@ -395,14 +426,14 @@ class PreBarriered : public BarrieredBase<T>
 * automatically handling deletion or movement.
 */
 template <class T>
-class HeapPtr : public BarrieredBase<T>
+class HeapPtr : public WriteBarrieredBase<T>
 {
  public:
-    HeapPtr() : BarrieredBase<T>(GCMethods<T>::initial()) {}
-    explicit HeapPtr(T v) : BarrieredBase<T>(v) {
+    HeapPtr() : WriteBarrieredBase<T>(GCMethods<T>::initial()) {}
+    explicit HeapPtr(T v) : WriteBarrieredBase<T>(v) {
        this->post(GCMethods<T>::initial(), v);
    }
-    explicit HeapPtr(const HeapPtr<T>& v) : BarrieredBase<T>(v) {
+    explicit HeapPtr(const HeapPtr<T>& v) : WriteBarrieredBase<T>(v) {
        this->post(GCMethods<T>::initial(), v);
    }
 #ifdef DEBUG
@ -447,11 +478,11 @@ class HeapPtr : public BarrieredBase<T>
 * used in contexts where this ability is necessary.
 */
 template <class T>
-class RelocatablePtr : public BarrieredBase<T>
+class RelocatablePtr : public WriteBarrieredBase<T>
 {
  public:
-    RelocatablePtr() : BarrieredBase<T>(GCMethods<T>::initial()) {}
-    explicit RelocatablePtr(T v) : BarrieredBase<T>(v) {
+    RelocatablePtr() : WriteBarrieredBase<T>(GCMethods<T>::initial()) {}
+    explicit RelocatablePtr(T v) : WriteBarrieredBase<T>(v) {
        this->post(GCMethods<T>::initial(), this->value);
    }

@ -461,7 +492,7 @@ class RelocatablePtr : public BarrieredBase<T>
     * function that will be used for both lvalue and rvalue copies, so we can
     * simply omit the rvalue variant.
     */
-    RelocatablePtr(const RelocatablePtr<T>& v) : BarrieredBase<T>(v) {
+    RelocatablePtr(const RelocatablePtr<T>& v) : WriteBarrieredBase<T>(v) {
        this->post(GCMethods<T>::initial(), this->value);
    }

@ -497,52 +528,83 @@ class RelocatablePtr : public BarrieredBase<T>
    }
 };

-/*
- * Incremental GC requires that weak pointers have read barriers. This is mostly
- * an issue for empty shapes stored in JSCompartment. The problem happens when,
- * during an incremental GC, some JS code stores one of the compartment's empty
- * shapes into an object already marked black. Normally, this would not be a
- * problem, because the empty shape would have been part of the initial snapshot
- * when the GC started. However, since this is a weak pointer, it isn't. So we
- * may collect the empty shape even though a live object points to it. To fix
- * this, we mark these empty shapes black whenever they get read out.
- */
-template <class T>
-class ReadBarriered
+// Base class for barriered pointer types that intercept reads and writes.
+template <typename T>
+class ReadBarrieredBase : public BarrieredBase<T>
 {
-    T value;
+  protected:
+    // ReadBarrieredBase is not directly instantiable.
+    explicit ReadBarrieredBase(T v) : BarrieredBase<T>(v) {}

-  public:
-    ReadBarriered() : value(nullptr) {}
-    explicit ReadBarriered(T value) : value(value) {}
-    explicit ReadBarriered(const Rooted<T>& rooted) : value(rooted) {}
-
-    T get() const {
-        if (!InternalGCMethods<T>::isMarkable(value))
-            return GCMethods<T>::initial();
-        InternalGCMethods<T>::readBarrier(value);
-        return value;
-    }
-
-    T unbarrieredGet() const {
-        return value;
-    }
-
-    operator T() const { return get(); }
-
-    T& operator*() const { return *get(); }
-    T operator->() const { return get(); }
-
-    T* unsafeGet() { return &value; }
-    T const * unsafeGet() const { return &value; }
-
-    void set(T v) { value = v; }
+  protected:
+    void read() const { InternalGCMethods<T>::readBarrier(this->value); }
+    void post(T prev, T next) { InternalGCMethods<T>::postBarrier(&this->value, prev, next); }
 };

+// Incremental GC requires that weak pointers have read barriers. This is mostly
+// an issue for empty shapes stored in JSCompartment. The problem happens when,
+// during an incremental GC, some JS code stores one of the compartment's empty
+// shapes into an object already marked black. Normally, this would not be a
+// problem, because the empty shape would have been part of the initial snapshot
+// when the GC started. However, since this is a weak pointer, it isn't. So we
+// may collect the empty shape even though a live object points to it. To fix
+// this, we mark these empty shapes black whenever they get read out.
+//
+// Note that this class also has post-barriers, so is safe to use with nursery
+// pointers. However, when used as a hashtable key, care must still be taken to
+// insert manual post-barriers on the table for rekeying if the key is based in
+// any way on the address of the object.
+template <typename T>
+class ReadBarriered : public ReadBarrieredBase<T>
+{
+  public:
+    ReadBarriered() : ReadBarrieredBase<T>(GCMethods<T>::initial()) {}
+    explicit ReadBarriered(const T& v) : ReadBarrieredBase<T>(v) {
+        this->post(GCMethods<T>::initial(), v);
+    }
+    ~ReadBarriered() {
+        this->post(this->value, GCMethods<T>::initial());
+    }
+
+    const T get() const {
+        if (!InternalGCMethods<T>::isMarkable(this->value))
+            return GCMethods<T>::initial();
+        this->read();
+        return this->value;
+    }
+
+    const T unbarrieredGet() const {
+        return this->value;
+    }
+
+    explicit operator bool() const {
+        return bool(this->value);
+    }
+
+    operator const T() const { return get(); }
+
+    const T operator->() const { return get(); }
+
+    T const* unsafeGet() const { return &this->value; }
+
+    void set(const T& v)
+    {
+        T tmp = this->value;
+        this->value = v;
+        this->post(tmp, v);
+    }
+};
+
+// Add Value operations to all Barrier types. Note, this must be defined before
+// HeapSlot for HeapSlot's base to get these operations.
+template <>
+class BarrieredBaseMixins<JS::Value> : public ValueOperations<WriteBarrieredBase<JS::Value>>
+{};
+
 // A pre- and post-barriered Value that is specialized to be aware that it
 // resides in a slots or elements vector. This allows it to be relocated in
 // memory, but with substantially less overhead than a RelocatablePtr.
-class HeapSlot : public BarrieredBase<Value>
+class HeapSlot : public WriteBarrieredBase<Value>
 {
  public:
    enum Kind {
@ -553,13 +615,13 @@ class HeapSlot : public BarrieredBase<Value>
    explicit HeapSlot() = delete;

    explicit HeapSlot(NativeObject* obj, Kind kind, uint32_t slot, const Value& v)
-      : BarrieredBase<Value>(v)
+      : WriteBarrieredBase<Value>(v)
    {
        post(obj, kind, slot, v);
    }

    explicit HeapSlot(NativeObject* obj, Kind kind, uint32_t slot, const HeapSlot& s)
-      : BarrieredBase<Value>(s.value)
+      : WriteBarrieredBase<Value>(s.value)
    {
        post(obj, kind, slot, s);
    }
@ -590,8 +652,6 @@ class HeapSlot : public BarrieredBase<Value>
        reinterpret_cast<HeapSlot*>(const_cast<Value*>(&target))->post(owner, kind, slot, target);
    }

-    Value* unsafeGet() { return &value; }
-
  private:
    void post(NativeObject* owner, Kind kind, uint32_t slot, const Value& target) {
        MOZ_ASSERT(preconditionForWriteBarrierPost(owner, kind, slot, target));
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@ -341,46 +341,6 @@ AssertRootMarkingPhase(JSTracer* trc)

 /*** Tracing Interface ***************************************************************************/

-#define FOR_EACH_GC_POINTER_TYPE(D) \
-    D(AccessorShape*) \
-    D(BaseShape*) \
-    D(UnownedBaseShape*) \
-    D(jit::JitCode*) \
-    D(NativeObject*) \
-    D(ArrayObject*) \
-    D(ArgumentsObject*) \
-    D(ArrayBufferObject*) \
-    D(ArrayBufferObjectMaybeShared*) \
-    D(ArrayBufferViewObject*) \
-    D(DebugScopeObject*) \
-    D(GlobalObject*) \
-    D(JSObject*) \
-    D(JSFunction*) \
-    D(ModuleObject*) \
-    D(ModuleEnvironmentObject*) \
-    D(NestedScopeObject*) \
-    D(PlainObject*) \
-    D(SavedFrame*) \
-    D(ScopeObject*) \
-    D(ScriptSourceObject*) \
-    D(SharedArrayBufferObject*) \
-    D(SharedTypedArrayObject*) \
-    D(ImportEntryObject*) \
-    D(ExportEntryObject*) \
-    D(JSScript*) \
-    D(LazyScript*) \
-    D(Shape*) \
-    D(JSAtom*) \
-    D(JSString*) \
-    D(JSFlatString*) \
-    D(JSLinearString*) \
-    D(PropertyName*) \
-    D(JS::Symbol*) \
-    D(js::ObjectGroup*) \
-    D(Value) \
-    D(jsid) \
-    D(TaggedProto)
-
 // The second parameter to BaseGCType is derived automatically based on T. The
 // relation here is that for any T, the TraceKind will automatically,
 // statically select the correct Cell layout for marking. Below, we instantiate
@ -430,9 +390,9 @@ template <typename T> void DoMarking(GCMarker* gcmarker, T thing);

 template <typename T>
 void
-js::TraceEdge(JSTracer* trc, BarrieredBase<T>* thingp, const char* name)
+js::TraceEdge(JSTracer* trc, WriteBarrieredBase<T>* thingp, const char* name)
 {
-    DispatchToTracer(trc, ConvertToBase(thingp->unsafeGet()), name);
+    DispatchToTracer(trc, ConvertToBase(thingp->unsafeUnbarrieredForTracing()), name);
 }

 template <typename T>
@ -461,12 +421,12 @@ js::TraceNullableRoot(JSTracer* trc, T* thingp, const char* name)

 template <typename T>
 void
-js::TraceRange(JSTracer* trc, size_t len, BarrieredBase<T>* vec, const char* name)
+js::TraceRange(JSTracer* trc, size_t len, WriteBarrieredBase<T>* vec, const char* name)
 {
    JS::AutoTracingIndex index(trc);
    for (auto i : MakeRange(len)) {
        if (InternalGCMethods<T>::isMarkable(vec[i].get()))
-            DispatchToTracer(trc, ConvertToBase(vec[i].unsafeGet()), name);
+            DispatchToTracer(trc, ConvertToBase(vec[i].unsafeUnbarrieredForTracing()), name);
        ++index;
    }
 }
@ -486,11 +446,11 @@ js::TraceRootRange(JSTracer* trc, size_t len, T* vec, const char* name)

 // Instantiate a copy of the Tracing templates for each derived type.
 #define INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS(type) \
-    template void js::TraceEdge<type>(JSTracer*, BarrieredBase<type>*, const char*); \
+    template void js::TraceEdge<type>(JSTracer*, WriteBarrieredBase<type>*, const char*); \
    template void js::TraceManuallyBarrieredEdge<type>(JSTracer*, type*, const char*); \
    template void js::TraceRoot<type>(JSTracer*, type*, const char*); \
    template void js::TraceNullableRoot<type>(JSTracer*, type*, const char*); \
-    template void js::TraceRange<type>(JSTracer*, size_t, BarrieredBase<type>*, const char*); \
+    template void js::TraceRange<type>(JSTracer*, size_t, WriteBarrieredBase<type>*, const char*); \
    template void js::TraceRootRange<type>(JSTracer*, size_t, type*, const char*);
 FOR_EACH_GC_POINTER_TYPE(INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS)
 #undef INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS
@ -510,13 +470,14 @@ template void js::TraceManuallyBarrieredCrossCompartmentEdge<JSScript*>(JSTracer

 template <typename T>
 void
-js::TraceCrossCompartmentEdge(JSTracer* trc, JSObject* src, BarrieredBase<T>* dst, const char* name)
+js::TraceCrossCompartmentEdge(JSTracer* trc, JSObject* src, WriteBarrieredBase<T>* dst,
+                              const char* name)
 {
    if (ShouldMarkCrossCompartment(trc, src, dst->get()))
-        DispatchToTracer(trc, dst->unsafeGet(), name);
+        DispatchToTracer(trc, dst->unsafeUnbarrieredForTracing(), name);
 }
-template void js::TraceCrossCompartmentEdge<Value>(JSTracer*, JSObject*, BarrieredBase<Value>*,
-                                                   const char*);
+template void js::TraceCrossCompartmentEdge<Value>(JSTracer*, JSObject*,
+                                                   WriteBarrieredBase<Value>*, const char*);

 template <typename T>
 void
@ -1933,8 +1894,8 @@ js::gc::StoreBuffer::SlotsEdge::trace(TenuringTracer& mover) const
        int32_t initLen = obj->getDenseInitializedLength();
        int32_t clampedStart = Min(start_, initLen);
        int32_t clampedEnd = Min(start_ + count_, initLen);
-        mover.traceSlots(static_cast<HeapSlot*>(obj->getDenseElements() + clampedStart)->unsafeGet(),
-                         clampedEnd - clampedStart);
+        mover.traceSlots(static_cast<HeapSlot*>(obj->getDenseElements() + clampedStart)
+                            ->unsafeUnbarrieredForTracing(), clampedEnd - clampedStart);
    } else {
        int32_t start = Min(uint32_t(start_), obj->slotSpan());
        int32_t end = Min(uint32_t(start_) + count_, obj->slotSpan());
@ -2071,7 +2032,7 @@ js::TenuringTracer::traceObject(JSObject* obj)
        !nobj->denseElementsAreCopyOnWrite() &&
        ObjectDenseElementsMayBeMarkable(nobj))
    {
-        Value* elems = static_cast<HeapSlot*>(nobj->getDenseElements())->unsafeGet();
+        Value* elems = static_cast<HeapSlot*>(nobj->getDenseElements())->unsafeUnbarrieredForTracing();
        traceSlots(elems, elems + nobj->getDenseInitializedLength());
    }

@ -2087,9 +2048,9 @@ js::TenuringTracer::traceObjectSlots(NativeObject* nobj, uint32_t start, uint32_
    HeapSlot* dynEnd;
    nobj->getSlotRange(start, length, &fixedStart, &fixedEnd, &dynStart, &dynEnd);
    if (fixedStart)
-        traceSlots(fixedStart->unsafeGet(), fixedEnd->unsafeGet());
+        traceSlots(fixedStart->unsafeUnbarrieredForTracing(), fixedEnd->unsafeUnbarrieredForTracing());
    if (dynStart)
-        traceSlots(dynStart->unsafeGet(), dynEnd->unsafeGet());
+        traceSlots(dynStart->unsafeUnbarrieredForTracing(), dynEnd->unsafeUnbarrieredForTracing());
 }

 void
@ -2362,16 +2323,16 @@ IsMarkedUnbarriered(T* thingp)

 template <typename T>
 bool
-IsMarked(BarrieredBase<T>* thingp)
+IsMarked(WriteBarrieredBase<T>* thingp)
 {
-    return IsMarkedInternal(ConvertToBase(thingp->unsafeGet()));
+    return IsMarkedInternal(ConvertToBase(thingp->unsafeUnbarrieredForTracing()));
 }

 template <typename T>
 bool
-IsMarked(ReadBarriered<T>* thingp)
+IsMarked(ReadBarrieredBase<T>* thingp)
 {
-    return IsMarkedInternal(ConvertToBase(thingp->unsafeGet()));
+    return IsMarkedInternal(ConvertToBase(thingp->unsafeUnbarrieredForTracing()));
 }

 template <typename T>
@ -2383,26 +2344,26 @@ IsAboutToBeFinalizedUnbarriered(T* thingp)

 template <typename T>
 bool
-IsAboutToBeFinalized(BarrieredBase<T>* thingp)
+IsAboutToBeFinalized(WriteBarrieredBase<T>* thingp)
 {
-    return IsAboutToBeFinalizedInternal(ConvertToBase(thingp->unsafeGet()));
+    return IsAboutToBeFinalizedInternal(ConvertToBase(thingp->unsafeUnbarrieredForTracing()));
 }

 template <typename T>
 bool
-IsAboutToBeFinalized(ReadBarriered<T>* thingp)
+IsAboutToBeFinalized(ReadBarrieredBase<T>* thingp)
 {
-    return IsAboutToBeFinalizedInternal(ConvertToBase(thingp->unsafeGet()));
+    return IsAboutToBeFinalizedInternal(ConvertToBase(thingp->unsafeUnbarrieredForTracing()));
 }

 // Instantiate a copy of the Tracing templates for each derived type.
 #define INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS(type) \
    template bool IsMarkedUnbarriered<type>(type*); \
-    template bool IsMarked<type>(BarrieredBase<type>*); \
-    template bool IsMarked<type>(ReadBarriered<type>*); \
+    template bool IsMarked<type>(WriteBarrieredBase<type>*); \
+    template bool IsMarked<type>(ReadBarrieredBase<type>*); \
    template bool IsAboutToBeFinalizedUnbarriered<type>(type*); \
-    template bool IsAboutToBeFinalized<type>(BarrieredBase<type>*); \
-    template bool IsAboutToBeFinalized<type>(ReadBarriered<type>*);
+    template bool IsAboutToBeFinalized<type>(WriteBarrieredBase<type>*); \
+    template bool IsAboutToBeFinalized<type>(ReadBarrieredBase<type>*);
 FOR_EACH_GC_POINTER_TYPE(INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS)
 #undef INSTANTIATE_ALL_VALID_TRACE_FUNCTIONS

--- a/js/src/gc/Marking.h
+++ b/js/src/gc/Marking.h
@ -388,11 +388,11 @@ IsMarkedUnbarriered(T* thingp);

 template <typename T>
 bool
-IsMarked(BarrieredBase<T>* thingp);
+IsMarked(WriteBarrieredBase<T>* thingp);

 template <typename T>
 bool
-IsMarked(ReadBarriered<T>* thingp);
+IsMarked(ReadBarrieredBase<T>* thingp);

 template <typename T>
 bool
@ -400,11 +400,11 @@ IsAboutToBeFinalizedUnbarriered(T* thingp);

 template <typename T>
 bool
-IsAboutToBeFinalized(BarrieredBase<T>* thingp);
+IsAboutToBeFinalized(WriteBarrieredBase<T>* thingp);

 template <typename T>
 bool
-IsAboutToBeFinalized(ReadBarriered<T>* thingp);
+IsAboutToBeFinalized(ReadBarrieredBase<T>* thingp);

 inline Cell*
 ToMarkable(const Value& v)
--- a/js/src/gc/Tracer.h
+++ b/js/src/gc/Tracer.h
@ -54,7 +54,7 @@ namespace js {
 // effect of tracing the edge depends on the JSTracer being used.
 template <typename T>
 void
-TraceEdge(JSTracer* trc, BarrieredBase<T>* thingp, const char* name);
+TraceEdge(JSTracer* trc, WriteBarrieredBase<T>* thingp, const char* name);

 // Trace through a "root" edge. These edges are the initial edges in the object
 // graph traversal. Root edges are asserted to only be traversed in the initial
@ -79,7 +79,7 @@ TraceManuallyBarrieredEdge(JSTracer* trc, T* thingp, const char* name);
 // Trace all edges contained in the given array.
 template <typename T>
 void
-TraceRange(JSTracer* trc, size_t len, BarrieredBase<T>* vec, const char* name);
+TraceRange(JSTracer* trc, size_t len, WriteBarrieredBase<T>* vec, const char* name);

 // Trace all root edges in the given array.
 template <typename T>
@ -90,7 +90,7 @@ TraceRootRange(JSTracer* trc, size_t len, T* vec, const char* name);
 // destination thing is not being GC'd, then the edge will not be traced.
 template <typename T>
 void
-TraceCrossCompartmentEdge(JSTracer* trc, JSObject* src, BarrieredBase<T>* dst,
+TraceCrossCompartmentEdge(JSTracer* trc, JSObject* src, WriteBarrieredBase<T>* dst,
                          const char* name);

 // As above but with manual barriers.
--- a/Show More
+++ b/Show More