Merge inbound to mozilla-central. a=merge

browser/config/mozconfigs/linux64/source

@@ -2,3 +2,4 @@
 # our script for generating it. This allows us to run configure without any
 # extra dependencies on specific toolchains, e.g. gtk3.
 ac_add_options --disable-compile-environment
+ac_add_options --disable-nodejs

build/moz.configure/warnings.configure

@@ -31,6 +31,9 @@ add_gcc_warning('-Woverloaded-virtual', cxx_compiler)
 # catches pointer arithmetic using NULL or sizeof(void)
 add_gcc_warning('-Wpointer-arith')
 
+# catch modifying constructor parameter that shadows member variable
+check_and_add_gcc_warning('-Wshadow-field-in-constructor-modified')
+
 # catches comparing signed/unsigned ints
 add_gcc_warning('-Wsign-compare')
 
@@ -50,11 +53,16 @@ add_gcc_warning('-Wno-invalid-offsetof', cxx_compiler)
 # catches objects passed by value to variadic functions.
 check_and_add_gcc_warning('-Wclass-varargs')
 
+# catches some implicit conversion of floats to ints
+check_and_add_gcc_warning('-Wfloat-overflow-conversion')
+check_and_add_gcc_warning('-Wfloat-zero-conversion')
+
 # catches issues around loops
 check_and_add_gcc_warning('-Wloop-analysis')
 
 # catches C++ version forward-compat issues
 check_and_add_gcc_warning('-Wc++1z-compat', cxx_compiler)
+check_and_add_gcc_warning('-Wc++2a-compat', cxx_compiler)
 
 # catches possible misuse of the comma operator
 check_and_add_gcc_warning('-Wcomma', cxx_compiler)
@@ -79,6 +87,9 @@ check_and_add_gcc_warning('-Werror=non-literal-null-conversion',
 # catches string literals used in boolean expressions
 check_and_add_gcc_warning('-Wstring-conversion')
 
+# catches overlapping range comparisons that are always true or false
+check_and_add_gcc_warning('-Wtautological-overlap-compare')
+
 # we inline 'new' and 'delete' in mozalloc
 check_and_add_gcc_warning('-Wno-inline-new-delete', cxx_compiler)
 

gfx/layers/wr/WebRenderCommandBuilder.cpp

@@ -388,6 +388,11 @@ struct DIGroup
   static IntRect
   ToDeviceSpace(nsRect aBounds, Matrix& aMatrix, int32_t aAppUnitsPerDevPixel, LayerIntPoint aOffset)
   {
+    // RoundedOut can convert empty rectangles to non-empty ones
+    // so special case them here
+    if (aBounds.IsEmpty()) {
+      return IntRect();
+    }
     return RoundedOut(aMatrix.TransformBounds(ToRect(nsLayoutUtils::RectToGfxRect(aBounds, aAppUnitsPerDevPixel)))) - aOffset.ToUnknownPoint();
   }
 

js/src/frontend/ForOfLoopControl.cpp

@@ -124,6 +124,15 @@ ForOfLoopControl::emitIteratorCloseInScope(BytecodeEmitter* bce,
     return bce->tryNoteList.append(JSTRY_FOR_OF_ITERCLOSE, 0, start, end);
 }
 
+// Since we're in the middle of emitting code that will leave
+// |bce->innermostEmitterScope()|, passing the innermost emitter scope to
+// emitIteratorCloseInScope and looking up .generator there would be very,
+// very wrong.  We'd find .generator in the function environment, and we'd
+// compute a NameLocation with the correct slot, but we'd compute a
+// hop-count to the function environment that was too big.  At runtime we'd
+// either crash, or we'd find a user-controllable value in that slot, and
+// Very Bad Things would ensue as we reinterpreted that value as an
+// iterator.
 bool
 ForOfLoopControl::emitPrepareForNonLocalJumpFromScope(BytecodeEmitter* bce,
                                                       EmitterScope& currentScope,

js/src/jit-test/tests/auto-regress/bug1454285.js

@@ -0,0 +1,86 @@
+// IteratorClose in for-await-of with block-scoped function.
+
+// Non-local-jump without target.
+
+(async function() {
+    for await (let c of []) {
+        function f() {};
+        return;
+    }
+})();
+(async function() {
+    for await (let c of []) {
+        function f() {};
+        break;
+    }
+})();
+(async function() {
+    for await (let c of []) {
+        function f() {};
+        continue;
+    }
+})();
+
+// Non-local-jump with target.
+
+(async function() {
+    for (let x of []) {
+        x: for (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                return;
+            }
+        }
+    }
+})();
+(async function() {
+    for (let x of []) {
+        x: for (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                break x;
+            }
+        }
+    }
+})();
+(async function() {
+    for (let x of []) {
+        x: for (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                continue x;
+            }
+        }
+    }
+})();
+
+(async function() {
+    for await (let x of []) {
+        x: for await (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                return;
+            }
+        }
+    }
+})();
+(async function() {
+    for await (let x of []) {
+        x: for await (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                break x;
+            }
+        }
+    }
+})();
+(async function() {
+    for await (let x of []) {
+        x: for await (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                continue x;
+            }
+        }
+    }
+})();

js/src/jit-test/tests/debug/Debugger-findScripts-21.js

@@ -1,21 +0,0 @@
-// Test that delazification works after compartment merging.
-
-if (helperThreadCount() === 0)
-  quit(0);
-
-var g = newGlobal();
-var dbg = new Debugger(g);
-
-var log;
-dbg.onNewScript = function (s) {
-  log += "s";
-  log += dbg.findScripts({ source: s.source }).length;
-}
-
-// Delazify everything just in case before we start the off-thread compile.
-dbg.findScripts();
-
-log = "";
-g.offThreadCompileScript("function inner() { function inner2() { print('inner2'); } print('inner'); }");
-g.runOffThreadScript();
-assertEq(log, "s3");