Merge m-i to m-c, a=merge

2024-11-29 15:52:07 +00:00 · 2015-06-13 19:49:13 -07:00 · 2015-06-13 19:49:13 -07:00 · fca7cc1fcd
commit fca7cc1fcd
parent 2f4d09b07a d73cdd33ea
222 changed files with 10160 additions and 581 deletions
--- a/aclocal.m4
+++ b/aclocal.m4
@ -34,6 +34,7 @@ builtin(include, build/autoconf/icu.m4)dnl
 builtin(include, build/autoconf/ffi.m4)dnl
 builtin(include, build/autoconf/clang-plugin.m4)dnl
 builtin(include, build/autoconf/alloc.m4)dnl
+builtin(include, build/autoconf/ios.m4)dnl

 MOZ_PROG_CHECKMSYS()

--- a/build/autoconf/arch.m4
+++ b/build/autoconf/arch.m4
@ -37,7 +37,6 @@ if test -z "$MOZ_ARCH"; then
        ;;
    arm-Darwin)
        MOZ_ARCH=toolchain-default
-        MOZ_THUMB=yes
        ;;
    esac
 fi
--- a/build/autoconf/ios.m4
+++ b/build/autoconf/ios.m4
@ -0,0 +1,108 @@
+dnl This Source Code Form is subject to the terms of the Mozilla Public
+dnl License, v. 2.0. If a copy of the MPL was not distributed with this
+dnl file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+AC_DEFUN([MOZ_IOS_PATH_PROG],
+[
+changequote({,})
+_prog_name=ifelse($2, {}, `echo $1 | tr "[:upper:]" "[:lower:]"`, $2)
+changequote([,])
+AC_CACHE_CHECK([for $_prog_name in iOS SDK],
+ac_cv_ios_path_$1,
+[
+_path=`xcrun --sdk $ios_sdk --find $_prog_name 2>/dev/null`
+_res=$?
+if test $_res -ne 0; then
+   AC_MSG_ERROR([Could not find '$_prog_name' in the iOS SDK])
+fi
+ac_cv_ios_path_$1=$_path
+])
+$1="${ac_cv_ios_path_$1}$3"
+])
+
+AC_DEFUN([MOZ_IOS_SDK],
+[
+
+MOZ_ARG_WITH_STRING(ios-sdk,
+[  --with-ios-sdk=TYPE
+                          Type of iOS SDK to use (iphonesimulator, iphoneos)
+                          and optionally version (like iphoneos8.2)],
+    ios_sdk=$withval)
+
+MOZ_ARG_ENABLE_STRING(ios-target,
+                      [  --enable-ios-target=VER (default=8.0)
+                          Set the minimum iOS version needed at runtime],
+                      [_IOS_TARGET=$enableval])
+_IOS_TARGET_DEFAULT=8.0
+
+case "$target" in
+arm*-apple-darwin*)
+    if test -z "$ios_sdk" -o "$ios_sdk" = "yes"; then
+       ios_sdk=iphoneos
+    fi
+    case "$ios_sdk" in
+         iphoneos*)
+                ios_target_arg="-miphoneos-version-min"
+                ;;
+         *)
+                AC_MSG_ERROR([Only 'iphoneos' SDKs are valid when targeting iOS device, don't know what to do with '$ios_sdk'.])
+                ;;
+    esac
+    ;;
+*-apple-darwin*)
+    ios_target_arg="-mios-simulator-version-min"
+    case "$ios_sdk" in
+         # Empty SDK is okay, this might be an OS X desktop build.
+         ""|iphonesimulator*)
+                ;;
+         # Default to iphonesimulator
+         yes)
+                ios_sdk=iphonesimulator
+                ;;
+         *)
+                AC_MSG_ERROR([Only 'iphonesimulator' SDKs are valid when targeting iOS simulator.])
+                ;;
+    esac
+    ;;
+esac
+
+
+if test -n "$ios_sdk"; then
+   if test -z "$_IOS_TARGET"; then
+      _IOS_TARGET=$_IOS_TARGET_DEFAULT
+      ios_target_arg="${ios_target_arg}=${_IOS_TARGET}"
+   fi
+   # Ensure that xcrun knows where this SDK is.
+   ios_sdk_path=`xcrun --sdk $ios_sdk --show-sdk-path 2>/dev/null`
+   _ret=$?
+   if test $_ret -ne 0; then
+      AC_MSG_ERROR([iOS SDK '$ios_sdk' could not be found.])
+   fi
+   MOZ_IOS=1
+   export HOST_CC=clang
+   export HOST_CXX=clang++
+   # Add isysroot, arch, and ios target arguments
+   case "$target_cpu" in
+        arm*)
+                ARGS="-arch armv7"
+                ;;
+        *)
+                # Unfortunately simulator builds need this.
+                export CROSS_COMPILE=1
+                ;;
+   esac
+   ARGS=" $ARGS -isysroot $ios_sdk_path $ios_target_arg"
+   # Now find our tools
+   MOZ_IOS_PATH_PROG(CC, clang, $ARGS)
+   MOZ_IOS_PATH_PROG(CXX, clang++, $ARGS)
+   export CPP="$CC -E"
+   export LD="$CXX"
+   MOZ_IOS_PATH_PROG(AR)
+   MOZ_IOS_PATH_PROG(AS, as, $ARGS)
+   MOZ_IOS_PATH_PROG(OTOOL)
+   MOZ_IOS_PATH_PROG(STRIP)
+   export PKG_CONFIG_PATH=${ios_sdk_path}/usr/lib/pkgconfig/
+fi
+
+AC_SUBST(MOZ_IOS)
+])
--- a/config/rules.mk
+++ b/config/rules.mk
@ -214,6 +214,12 @@ endif # !GNU_CC

 endif # WINNT

+ifeq (arm-Darwin,$(CPU_ARCH)-$(OS_TARGET))
+ifdef PROGRAM
+MOZ_PROGRAM_LDFLAGS += -Wl,-rpath -Wl,@executable_path/Frameworks
+endif
+endif
+
 ifeq ($(SOLARIS_SUNPRO_CXX),1)
 ifeq (86,$(findstring 86,$(OS_TEST)))
 OS_LDFLAGS += -M $(MOZILLA_DIR)/config/solaris_ia32.map
@ -390,7 +396,12 @@ ifdef SHARED_LIBRARY
 ifdef IS_COMPONENT
 EXTRA_DSO_LDOPTS	+= -bundle
 else
-EXTRA_DSO_LDOPTS	+= -dynamiclib -install_name @executable_path/$(SHARED_LIBRARY) -compatibility_version 1 -current_version 1 -single_module
+ifdef MOZ_IOS
+_LOADER_PATH := @rpath
+else
+_LOADER_PATH := @executable_path
+endif
+EXTRA_DSO_LDOPTS	+= -dynamiclib -install_name $(_LOADER_PATH)/$(SHARED_LIBRARY) -compatibility_version 1 -current_version 1 -single_module
 endif
 endif
 endif
--- a/configure.in
+++ b/configure.in
@ -338,6 +338,12 @@ else
    esac
 fi

+case "$target" in
+*-apple-darwin*)
+    MOZ_IOS_SDK
+    ;;
+esac
+
 AC_SUBST(ANDROID_SOURCE)
 AC_SUBST(ANDROID_PACKAGE_NAME)
 AC_SUBST(OBJCOPY)
@ -1818,7 +1824,12 @@ Linux)
        MOZ_ENABLE_PROFILER_SPS=
    esac
    ;;
-WINNT|Darwin) ;;
+WINNT) ;;
+Darwin)
+    if test -n "$MOZ_IOS"; then
+        MOZ_ENABLE_PROFILER_SPS=
+    fi
+    ;;
 *)
    MOZ_ENABLE_PROFILER_SPS=
    ;;
@ -2036,7 +2047,7 @@ case "$target" in
    DLL_SUFFIX=".dylib"
    DSO_LDOPTS=''
    STRIP_FLAGS="$STRIP_FLAGS -x -S"
-    # Check whether we're targeting OS X or iOS
+    # Ensure that if we're targeting iOS an SDK was provided.
    AC_CACHE_CHECK(for iOS target,
                   ac_cv_ios_target,
                   [AC_TRY_COMPILE([#include <TargetConditionals.h>
@ -2046,7 +2057,10 @@ case "$target" in
                                   [],
                                   ac_cv_ios_target="yes",
                                   ac_cv_ios_target="no")])
-    if test "$ac_cv_ios_target" = "yes"; then
+    if test "$ac_cv_ios_target" = "yes" -a -z $MOZ_IOS; then
+       AC_MSG_ERROR([targeting iOS but not using an iOS SDK?])
+    fi
+    if test -n "$MOZ_IOS"; then
        AC_DEFINE(XP_IOS)
        AC_DEFINE(XP_DARWIN)
        _PLATFORM_DEFAULT_TOOLKIT='cairo-uikit'
@ -3811,6 +3825,9 @@ MOZ_OFFICIAL_BRANDING=
 MOZ_FEEDS=1
 MOZ_WEBAPP_RUNTIME=
 MOZ_AUTH_EXTENSION=1
+if test "$MOZ_IOS"; then
+   MOZ_AUTH_EXTENSION=
+fi
 MOZ_RAW=
 MOZ_VORBIS=
 MOZ_TREMOR=
@ -3868,6 +3885,9 @@ MOZ_URL_CLASSIFIER=
 MOZ_XUL=1
 MOZ_ZIPWRITER=1
 NS_PRINTING=1
+if test "$MOZ_IOS"; then
+   NS_PRINTING=
+fi
 MOZ_PDF_PRINTING=
 MOZ_NO_SMART_CARDS=
 NSS_DISABLE_DBM=
@ -4316,7 +4336,10 @@ cairo-cocoa)
    CXXFLAGS="$CXXFLAGS $TK_CFLAGS"
    MOZ_USER_DIR="Mozilla"
    MOZ_FS_LAYOUT=bundle
+    # skip event loop instrumentation on UIKit for now
+    if test "$MOZ_WIDGET_TOOLKIT" == "cocoa"; then
      MOZ_INSTRUMENT_EVENT_LOOP=1
+    fi
    ;;

 cairo-uikit)
@ -4324,7 +4347,7 @@ cairo-uikit)
    AC_DEFINE(MOZ_WIDGET_UIKIT)
    LDFLAGS="$LDFLAGS -framework UIKit -lobjc"
    TK_CFLAGS="-DNO_X11"
-    TK_LIBS='-Wl,-framework,Foundation -Wl,-framework,CoreFoundation -Wl,-framework,CoreGraphics -Wl,-framework,CoreText'
+    TK_LIBS='-Wl,-framework,Foundation -Wl,-framework,CoreFoundation -Wl,-framework,CoreGraphics -Wl,-framework,CoreText -Wl,-framework,AVFoundation -Wl,-framework,AudioToolbox -Wl,-framework,CoreMedia -Wl,-framework,CoreVideo -Wl,-framework,OpenGLES -Wl,-framework,QuartzCore'
    CFLAGS="$CFLAGS $TK_CFLAGS"
    CXXFLAGS="$CXXFLAGS $TK_CFLAGS"
    MOZ_USER_DIR="Mozilla"
@ -4448,6 +4471,10 @@ MOZ_ARG_DISABLE_BOOL(printing,
    NS_PRINTING=,
    NS_PRINTING=1)

+if test -n "$MOZ_IOS" -a -n "$NS_PRINTING"; then
+   AC_MSG_ERROR([Printing is not supported on iOS.])
+fi
+
 if test "$NS_PRINTING"; then
    AC_DEFINE(NS_PRINTING)
    AC_DEFINE(NS_PRINT_PREVIEW)
@ -5748,11 +5775,16 @@ AC_SUBST(MOZ_CHILD_PERMISSIONS)
 dnl ========================================================
 dnl NegotiateAuth
 dnl ========================================================
+
 MOZ_ARG_DISABLE_BOOL(negotiateauth,
 [  --disable-negotiateauth Disable GSS-API negotiation ],
    MOZ_AUTH_EXTENSION=,
    MOZ_AUTH_EXTENSION=1 )

+if test -n "$MOZ_IOS" -a -n "$MOZ_AUTH_EXTENSION"; then
+   AC_MSG_ERROR([negotiateauth is not supported on iOS.])
+fi
+
 dnl ========================================================
 dnl Pref extensions (autoconfig)
 dnl ========================================================
@ -6028,9 +6060,14 @@ MOZ_GAMEPAD_BACKEND=stub

 # Gamepad DOM is built on supported platforms by default.
 case "$OS_TARGET" in
-     Darwin|WINNT|Linux)
+     WINNT|Linux)
       MOZ_GAMEPAD=1
       ;;
+     Darwin)
+       if test -z "$MOZ_IOS"; then
+         MOZ_GAMEPAD=1
+       fi
+       ;;
     Android)
       if test "$MOZ_WIDGET_TOOLKIT" != "gonk"; then
         MOZ_GAMEPAD=1
@ -6048,7 +6085,9 @@ MOZ_ARG_DISABLE_BOOL(gamepad,
 if test "$MOZ_GAMEPAD"; then
    case "$OS_TARGET" in
    Darwin)
+        if test -z "$MOZ_IOS"; then
            MOZ_GAMEPAD_BACKEND=cocoa
+        fi
        ;;
    WINNT)
        MOZ_GAMEPAD_BACKEND=windows
@ -6081,7 +6120,9 @@ i?86-*-mingw*|x86_64-*-mingw*)
  MOZ_CRASHREPORTER=1
  ;;
 i?86-apple-darwin*|x86_64-apple-darwin*)
+  if test -z "$MOZ_IOS"; then
    MOZ_CRASHREPORTER=1
+  fi
  ;;
 i?86-*-linux*|x86_64-*-linux*|arm-*-linux*)
  if test "$MOZ_ENABLE_GTK"; then
@ -6165,6 +6206,8 @@ if test -n "$MOZ_LIBJPEG_TURBO"; then
  Darwin:x86_64)
    LIBJPEG_TURBO_ASFLAGS="-f macho64 -rnasm -pnasm -D__x86_64__ -DPIC -DMACHO"
  ;;
+  Darwin:arm*)
+  ;;
  WINNT:x86)
    LIBJPEG_TURBO_ASFLAGS="-f win32 -rnasm -pnasm -DPIC -DWIN32"
  ;;
@ -6455,6 +6498,10 @@ dnl ========================================================
 dnl Updater
 dnl ========================================================

+if test "$MOZ_IOS"; then
+  MOZ_UPDATER=
+fi
+
 MOZ_ARG_DISABLE_BOOL(updater,
 [  --disable-updater       Disable building of updater],
    MOZ_UPDATER=,
@ -8322,7 +8369,12 @@ case "$OS_TARGET" in
      NECKO_WIFI=1
    fi
    ;;
-  Darwin|DragonFly|FreeBSD|SunOS|WINNT)
+  Darwin)
+    if test -z "$MOZ_IOS"; then
+      NECKO_WIFI=1
+    fi
+    ;;
+  DragonFly|FreeBSD|SunOS|WINNT)
    NECKO_WIFI=1
    ;;
  Linux)
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@ -2277,7 +2277,7 @@ nsDocument::Reset(nsIChannel* aChannel, nsILoadGroup* aLoadGroup)
                                NS_GET_IID(nsIURI), getter_AddRefs(baseURI));
    if (baseURI) {
      mDocumentBaseURI = baseURI;
-      mChromeXHRDocBaseURI = baseURI;
+      mChromeXHRDocBaseURI = nullptr;
    }
  }

@ -2359,7 +2359,7 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup,
  mOriginalURI = nullptr;

  SetDocumentURI(aURI);
-  mChromeXHRDocURI = aURI;
+  mChromeXHRDocURI = nullptr;
  // If mDocumentBaseURI is null, nsIDocument::GetBaseURI() returns
  // mDocumentURI.
  mDocumentBaseURI = nullptr;
--- a/dom/base/test/test_XHRDocURI.html
+++ b/dom/base/test/test_XHRDocURI.html
@ -486,6 +486,14 @@ function runTest() {
  xhr.send();
  yield undefined;

+  history.pushState({}, "pushStateTest", window.location.href + "/pushStateTest");
+  ok(document.documentURI.indexOf("pushStateTest") > -1);
+
+  var chromeDoc = SpecialPowers.wrap(document);
+  ok(chromeDoc.documentURI.indexOf("pushStateTest") > -1);
+
+  history.back();
+
  SimpleTest.finish();
  SpecialPowers.removePermission("systemXHR", document);
  yield undefined;
--- a/dom/bindings/test/test_exception_options_from_jsimplemented.html
+++ b/dom/bindings/test/test_exception_options_from_jsimplemented.html
@ -31,7 +31,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1107592
         "http://mochi.test:8888/tests/dom/bindings/test/test_exception_options_from_jsimplemented.html",
         "Should have the right file name");
      is(e.lineNumber, 20, "Should have the right line number");
-      is(e.columnNumber, 6, "Should have the right column number");
+      is(e.columnNumber, 7, "Should have the right column number");
    }

    try {
--- a/dom/cache/TypeUtils.cpp
+++ b/dom/cache/TypeUtils.cpp
@ -242,7 +242,7 @@ TypeUtils::ToCacheResponse(CacheResponse& aOut, Response& aIn, ErrorResult& aRv)
  }

  nsCOMPtr<nsIInputStream> stream;
-  aIn.GetBody(getter_AddRefs(stream));
+  ir->GetInternalBody(getter_AddRefs(stream));
  if (stream) {
    aIn.SetBodyUsed();
  }
--- a/dom/events/test/test_error_events.html
+++ b/dom/events/test/test_error_events.html
@ -38,8 +38,8 @@
    [ "Callback message", msg, "Error: hello" ],
    [ "Event error-object", errorEvent.error, thrown],
    [ "Callback error-object", error, thrown ],
-    [ "Event column", errorEvent.colno, 15 ],
-    [ "Callback column", column, 15 ]
+    [ "Event column", errorEvent.colno, 16 ],
+    [ "Callback column", column, 16 ]
  ]);
 </script>
 <script>
--- a/dom/fetch/InternalResponse.h
+++ b/dom/fetch/InternalResponse.h
@ -117,6 +117,17 @@ public:
    return Headers();
  }

+  void
+  GetInternalBody(nsIInputStream** aStream)
+  {
+    if (mWrappedResponse) {
+      MOZ_ASSERT(!mBody);
+      return mWrappedResponse->GetBody(aStream);
+    }
+    nsCOMPtr<nsIInputStream> stream = mBody;
+    stream.forget(aStream);
+  }
+
  void
  GetBody(nsIInputStream** aStream)
  {
@ -125,12 +136,7 @@ public:
      return;
    }

-    if (mWrappedResponse) {
-      MOZ_ASSERT(!mBody);
-      return mWrappedResponse->GetBody(aStream);
-    }
-    nsCOMPtr<nsIInputStream> stream = mBody;
-    stream.forget(aStream);
+    return GetInternalBody(aStream);
  }

  void
--- a/dom/html/HTMLSharedElement.cpp
+++ b/dom/html/HTMLSharedElement.cpp
@ -175,10 +175,9 @@ SetBaseURIUsingFirstBaseWithHref(nsIDocument* aDocument, nsIContent* aMustMatch)

      // Try to set our base URI.  If that fails, try to set base URI to null
      nsresult rv = aDocument->SetBaseURI(newBaseURI);
-      aDocument->SetChromeXHRDocBaseURI(newBaseURI);
+      aDocument->SetChromeXHRDocBaseURI(nullptr);
      if (NS_FAILED(rv)) {
        aDocument->SetBaseURI(nullptr);
-        aDocument->SetChromeXHRDocBaseURI(nullptr);
      }
      return;
    }
--- a/dom/plugins/ipc/PluginInstanceChild.cpp
+++ b/dom/plugins/ipc/PluginInstanceChild.cpp
@ -130,7 +130,7 @@ PluginInstanceChild::PluginInstanceChild(const NPPluginFuncs* aPluginIface,
    , mMode(aMode)
    , mNames(aNames)
    , mValues(aValues)
-#if defined(XP_MACOSX)
+#if defined(XP_DARWIN)
    , mContentsScaleFactor(1.0)
 #endif
    , mDrawingModel(kDefaultDrawingModel)
@ -1281,6 +1281,8 @@ PluginInstanceChild::AnswerNPP_SetWindow(const NPRemoteWindow& aWindow)
    // TODO: Need Android impl
 #elif defined(MOZ_WIDGET_QT)
    // TODO: Need QT-nonX impl
+#elif defined(MOZ_WIDGET_UIKIT)
+    // Don't care
 #else
 #  error Implement me for your OS
 #endif
@ -2933,7 +2935,7 @@ PluginInstanceChild::MaybeCreatePlatformHelperSurface(void)
 bool
 PluginInstanceChild::EnsureCurrentBuffer(void)
 {
-#ifndef XP_MACOSX
+#ifndef XP_DARWIN
    nsIntRect toInvalidate(0, 0, 0, 0);
    gfxIntSize winSize = gfxIntSize(mWindow.width, mWindow.height);

@ -2979,7 +2981,7 @@ PluginInstanceChild::EnsureCurrentBuffer(void)
    }

    return true;
-#else // XP_MACOSX
+#elif defined(XP_MACOSX)

    if (!mDoubleBufferCARenderer.HasCALayer()) {
        void *caLayer = nullptr;
@ -3033,9 +3035,8 @@ PluginInstanceChild::EnsureCurrentBuffer(void)
        nsIntRect toInvalidate(0, 0, mWindow.width, mWindow.height);
        mAccumulatedInvalidRect.UnionRect(mAccumulatedInvalidRect, toInvalidate);
    }
-  
-    return true;
 #endif
+    return true;
 }

 void
--- a/dom/plugins/ipc/PluginInstanceChild.h
+++ b/dom/plugins/ipc/PluginInstanceChild.h
@ -374,7 +374,7 @@ private:
    InfallibleTArray<nsCString> mValues;
    NPP_t mData;
    NPWindow mWindow;
-#if defined(XP_MACOSX)
+#if defined(XP_DARWIN)
    double mContentsScaleFactor;
 #endif
    int16_t               mDrawingModel;
--- a/dom/plugins/ipc/PluginInstanceParent.cpp
+++ b/dom/plugins/ipc/PluginInstanceParent.cpp
@ -270,7 +270,7 @@ PluginInstanceParent::AnswerNPN_GetValue_NPNVnetscapeWindow(NativeWindowHandle*
    HWND id;
 #elif defined(MOZ_X11)
    XID id;
-#elif defined(XP_MACOSX)
+#elif defined(XP_DARWIN)
    intptr_t id;
 #elif defined(ANDROID)
    // TODO: Need Android impl
--- a/dom/plugins/ipc/PluginMessageUtils.h
+++ b/dom/plugins/ipc/PluginMessageUtils.h
@ -105,7 +105,7 @@ struct NPRemoteWindow
 typedef HWND NativeWindowHandle;
 #elif defined(MOZ_X11)
 typedef XID NativeWindowHandle;
-#elif defined(XP_MACOSX) || defined(ANDROID) || defined(MOZ_WIDGET_QT)
+#elif defined(XP_DARWIN) || defined(ANDROID) || defined(MOZ_WIDGET_QT)
 typedef intptr_t NativeWindowHandle; // never actually used, will always be 0
 #else
 #error Need NativeWindowHandle for this platform
--- a/dom/plugins/ipc/PluginModuleChild.cpp
+++ b/dom/plugins/ipc/PluginModuleChild.cpp
@ -280,7 +280,7 @@ PluginModuleChild::InitForChrome(const std::string& aPluginFilename,

    nsPluginFile pluginFile(localFile);

-#if defined(MOZ_X11) || defined(OS_MACOSX)
+#if defined(MOZ_X11) || defined(XP_MACOSX)
    nsPluginInfo info = nsPluginInfo();
    if (NS_FAILED(pluginFile.GetPluginInfo(info, &mLibrary))) {
        return false;
@ -291,7 +291,7 @@ PluginModuleChild::InitForChrome(const std::string& aPluginFilename,
    if (StringBeginsWith(nsDependentCString(info.fDescription), flash10Head)) {
        AddQuirk(QUIRK_FLASH_EXPOSE_COORD_TRANSLATION);
    }
-#else // defined(OS_MACOSX)
+#else // defined(XP_MACOSX)
    const char* namePrefix = "Plugin Content";
    char nameBuffer[80];
    snprintf(nameBuffer, sizeof(nameBuffer), "%s (%s)", namePrefix, info.fName);
--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@ -122,6 +122,10 @@ MOCHITEST_CHROME_MANIFESTS += [
    'test/serviceworkers/chrome.ini'
 ]

+BROWSER_CHROME_MANIFESTS += [
+    'test/serviceworkers/browser.ini',
+]
+
 XPCSHELL_TESTS_MANIFESTS += ['test/xpcshell/xpcshell.ini']

 BROWSER_CHROME_MANIFESTS += ['test/browser.ini']
--- a/dom/workers/test/serviceworkers/browser.ini
+++ b/dom/workers/test/serviceworkers/browser.ini
@ -0,0 +1,7 @@
+[DEFAULT]
+support-files =
+  browser_base_force_refresh.html
+  browser_cached_force_refresh.html
+  force_refresh_browser_worker.js
+
+[browser_force_refresh.js]
--- a/dom/workers/test/serviceworkers/browser_base_force_refresh.html
+++ b/dom/workers/test/serviceworkers/browser_base_force_refresh.html
@ -0,0 +1,30 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+</head>
+<body>
+<script type="text/javascript">
+addEventListener('load', function(event) {
+  navigator.serviceWorker.register('force_refresh_browser_worker.js').then(function(swr) {
+    if (!swr) {
+      return;
+    }
+    var custom = new Event('base-register', { bubbles: true });
+    document.dispatchEvent(custom);
+  });
+
+  navigator.serviceWorker.ready.then(function() {
+    var custom = new Event('base-sw-ready', { bubbles: true });
+    document.dispatchEvent(custom);
+  });
+
+  var custom = new Event('base-load', { bubbles: true });
+  document.dispatchEvent(custom);
+});
+</script>
+</body>
+</html>
--- a/dom/workers/test/serviceworkers/browser_cached_force_refresh.html
+++ b/dom/workers/test/serviceworkers/browser_cached_force_refresh.html
@ -0,0 +1,17 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+</head>
+<body>
+<script type="text/javascript">
+addEventListener('load', function(event) {
+  var custom = new Event('cached-load', { bubbles: true });
+  document.dispatchEvent(custom);
+});
+</script>
+</body>
+</html>
--- a/dom/workers/test/serviceworkers/browser_force_refresh.js
+++ b/dom/workers/test/serviceworkers/browser_force_refresh.js
@ -0,0 +1,54 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+var gTestRoot = getRootDirectory(gTestPath).replace("chrome://mochitests/content/",
+                                                    "http://mochi.test:8888/")
+
+function refresh() {
+  EventUtils.synthesizeKey('R', { accelKey: true });
+}
+
+function forceRefresh() {
+  EventUtils.synthesizeKey('R', { accelKey: true, shiftKey: true });
+}
+
+function test() {
+  waitForExplicitFinish();
+  SpecialPowers.pushPrefEnv({'set': [['dom.serviceWorkers.enabled', true],
+                                     ['dom.serviceWorkers.exemptFromPerDomainMax', true],
+                                     ['dom.serviceWorkers.testing.enabled', true],
+                                     ['dom.caches.enabled', true]]},
+                            function() {
+    var url = gTestRoot + 'browser_base_force_refresh.html';
+    var tab = gBrowser.addTab(url);
+    gBrowser.selectedTab = tab;
+
+    var cachedLoad = false;
+
+    function eventHandler(event) {
+      if (event.type === 'base-load') {
+        if (cachedLoad) {
+          gBrowser.removeTab(tab);
+          executeSoon(finish);
+        }
+      } else if (event.type === 'base-register') {
+        ok(!cachedLoad, 'cached load should not occur before base register');
+        refresh();
+      } else if (event.type === 'base-sw-ready') {
+        ok(!cachedLoad, 'cached load should not occur before base ready');
+        refresh();
+      } else if (event.type === 'cached-load') {
+        ok(!cachedLoad, 'cached load should not occur twice');
+        cachedLoad = true;
+        forceRefresh();
+      }
+
+      return;
+    }
+
+    addEventListener('base-load', eventHandler, true, true);
+    addEventListener('base-register', eventHandler, true, true);
+    addEventListener('base-sw-ready', eventHandler, true, true);
+    addEventListener('cached-load', eventHandler, true, true);
+  });
+}
--- a/dom/workers/test/serviceworkers/force_refresh_browser_worker.js
+++ b/dom/workers/test/serviceworkers/force_refresh_browser_worker.js
@ -0,0 +1,22 @@
+var name = 'browserRefresherCache';
+
+self.addEventListener('install', function(event) {
+  event.waitUntil(
+    Promise.all([caches.open(name),
+                 fetch('./browser_cached_force_refresh.html')]).then(function(results) {
+      var cache = results[0];
+      var response = results[1];
+      return cache.put('./browser_base_force_refresh.html', response);
+    })
+  );
+});
+
+self.addEventListener('fetch', function (event) {
+  event.respondWith(
+    caches.open(name).then(function(cache) {
+      return cache.match(event.request);
+    }).then(function(response) {
+      return response || fetch(event.request);
+    })
+  );
+});
--- a/gfx/2d/ExtendInputEffectD2D1.cpp
+++ b/gfx/2d/ExtendInputEffectD2D1.cpp
@ -172,7 +172,7 @@ ExtendInputEffectD2D1::MapInvalidRect(UINT32 inputIndex,
                                      D2D1_RECT_L invalidInputRect,
                                      D2D1_RECT_L* pInvalidOutputRect) const
 {
-  MOZ_ASSERT(inputIndex = 0);
+  MOZ_ASSERT(inputIndex == 0);

  *pInvalidOutputRect = invalidInputRect;
  return S_OK;
--- a/gfx/2d/RadialGradientEffectD2D1.cpp
+++ b/gfx/2d/RadialGradientEffectD2D1.cpp
@ -251,7 +251,7 @@ RadialGradientEffectD2D1::MapInvalidRect(UINT32 inputIndex,
                                         D2D1_RECT_L invalidInputRect,
                                         D2D1_RECT_L* pInvalidOutputRect) const
 {
-  MOZ_ASSERT(inputIndex = 0);
+  MOZ_ASSERT(inputIndex == 0);

  *pInvalidOutputRect = invalidInputRect;
  return S_OK;
--- a/gfx/cairo/cairo/src/cairo-quartz-font.c
+++ b/gfx/cairo/cairo/src/cairo-quartz-font.c
@ -76,9 +76,6 @@ static void (*CGFontGetGlyphsForUnicharsPtr) (CGFontRef, const UniChar[], const
 static void (*CGContextSetAllowsFontSmoothingPtr) (CGContextRef, bool) = NULL;
 static bool (*CGContextGetAllowsFontSmoothingPtr) (CGContextRef) = NULL;

-/* Not public in the least bit */
-static CGPathRef (*CGFontGetGlyphPathPtr) (CGFontRef fontRef, CGAffineTransform *textTransform, int unknown, CGGlyph glyph) = NULL;
-
 /* CGFontGetHMetrics isn't public, but the other functions are public/present in 10.5 */
 typedef struct {
    int ascent;
@ -121,7 +118,6 @@ quartz_font_ensure_symbols(void)
    /* These have the same name in 10.4 and 10.5 */
    CGFontGetUnitsPerEmPtr = dlsym(RTLD_DEFAULT, "CGFontGetUnitsPerEm");
    CGFontGetGlyphAdvancesPtr = dlsym(RTLD_DEFAULT, "CGFontGetGlyphAdvances");
-    CGFontGetGlyphPathPtr = dlsym(RTLD_DEFAULT, "CGFontGetGlyphPath");

    CGFontGetHMetricsPtr = dlsym(RTLD_DEFAULT, "CGFontGetHMetrics");
    CGFontGetAscentPtr = dlsym(RTLD_DEFAULT, "CGFontGetAscent");
@ -138,7 +134,6 @@ quartz_font_ensure_symbols(void)
 	CGFontGetGlyphsForUnicharsPtr &&
 	CGFontGetUnitsPerEmPtr &&
 	CGFontGetGlyphAdvancesPtr &&
-	CGFontGetGlyphPathPtr &&
 	(CGFontGetHMetricsPtr || (CGFontGetAscentPtr && CGFontGetDescentPtr && CGFontGetLeadingPtr)))
 	_cairo_quartz_font_symbols_present = TRUE;

@ -560,6 +555,7 @@ _cairo_quartz_init_glyph_path (cairo_quartz_scaled_font_t *font,
    CGGlyph glyph = _cairo_quartz_scaled_glyph_index (scaled_glyph);
    CGAffineTransform textMatrix;
    CGPathRef glyphPath;
+    CTFontRef ctFont;
    cairo_path_fixed_t *path;

    if (glyph == INVALID_GLYPH) {
@ -574,7 +570,9 @@ _cairo_quartz_init_glyph_path (cairo_quartz_scaled_font_t *font,
 					-font->base.scale.yy,
 					0, 0);

-    glyphPath = CGFontGetGlyphPathPtr (font_face->cgFont, &textMatrix, 0, glyph);
+    ctFont = CTFontCreateWithGraphicsFont (font_face->cgFont, 0.0, NULL, NULL);
+    glyphPath = CTFontCreatePathForGlyph (ctFont, glyph, &textMatrix);
+    CFRelease (ctFont);
    if (!glyphPath)
 	return CAIRO_INT_STATUS_UNSUPPORTED;

@ -802,7 +800,7 @@ _cairo_quartz_scaled_font_get_ct_font_ref (cairo_scaled_font_t *abstract_font)
    return ffont->ctFont;
 }

-#ifndef __LP64__
+#if !defined(__LP64__) && !TARGET_OS_IPHONE
 /*
 * compat with old ATSUI backend
 */
--- a/gfx/cairo/cairo/src/cairo-quartz-image.h
+++ b/gfx/cairo/cairo/src/cairo-quartz-image.h
@ -39,8 +39,13 @@
 #include "cairo.h"

 #if CAIRO_HAS_QUARTZ_IMAGE_SURFACE
+#include "TargetConditionals.h"

+#if !TARGET_OS_IPHONE
 #include <Carbon/Carbon.h>
+#else
+#include <CoreGraphics/CoreGraphics.h>
+#endif

 CAIRO_BEGIN_DECLS

--- a/gfx/cairo/cairo/src/cairo-quartz-surface.c
+++ b/gfx/cairo/cairo/src/cairo-quartz-surface.c
@ -34,7 +34,9 @@
 *	Vladimir Vukicevic <vladimir@mozilla.com>
 */

+#ifndef _GNU_SOURCE
 #define _GNU_SOURCE /* required for RTLD_DEFAULT */
+#endif
 #include "cairoint.h"

 #include "cairo-quartz-private.h"
@ -177,10 +179,15 @@ static void quartz_ensure_symbols(void)

    CTFontDrawGlyphsPtr = dlsym(RTLD_DEFAULT, "CTFontDrawGlyphs");

+#if !TARGET_OS_IPHONE
    if (Gestalt(gestaltSystemVersion, &_cairo_quartz_osx_version) != noErr) {
        // assume 10.5
        _cairo_quartz_osx_version = 0x1050;
    }
+#else
+    //TODO: this is not great
+    _cairo_quartz_osx_version = 0x1050;
+#endif

    _cairo_quartz_symbol_lookup_done = TRUE;
 }
--- a/gfx/cairo/cairo/src/cairo-quartz.h
+++ b/gfx/cairo/cairo/src/cairo-quartz.h
@ -39,8 +39,14 @@
 #include "cairo.h"

 #if CAIRO_HAS_QUARTZ_SURFACE
+#include "TargetConditionals.h"

+#if !TARGET_OS_IPHONE
 #include <ApplicationServices/ApplicationServices.h>
+#else
+#include <CoreGraphics/CoreGraphics.h>
+#include <CoreText/CoreText.h>
+#endif

 CAIRO_BEGIN_DECLS

@ -88,7 +94,7 @@ cairo_quartz_surface_get_image (cairo_surface_t *surface);
 cairo_public cairo_font_face_t *
 cairo_quartz_font_face_create_for_cgfont (CGFontRef font);

-#ifndef __LP64__
+#if !defined(__LP64__) && !TARGET_OS_IPHONE
 cairo_public cairo_font_face_t *
 cairo_quartz_font_face_create_for_atsu_font_id (ATSUFontID font_id);
 #endif
--- a/gfx/cairo/cairo/src/moz.build
+++ b/gfx/cairo/cairo/src/moz.build
@ -56,7 +56,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
        ]
    else:
        DEFINES['CAIRO_OMIT_WIN32_PRINTING'] = True
-elif CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
+elif CONFIG['MOZ_WIDGET_TOOLKIT'] in {'cocoa', 'uikit'}:
    EXPORTS.cairo += [
        'cairo-quartz-image.h',
        'cairo-quartz.h',
--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@ -1718,6 +1718,7 @@ APZCTreeManager::GetApzcToGeckoTransform(const AsyncPanZoomController *aApzc) co
 already_AddRefed<AsyncPanZoomController>
 APZCTreeManager::GetMultitouchTarget(AsyncPanZoomController* aApzc1, AsyncPanZoomController* aApzc2) const
 {
+  MonitorAutoLock lock(mTreeLock);
  nsRefPtr<AsyncPanZoomController> apzc;
  // For now, we only ever want to do pinching on the root-content APZC for
  // a given layers id.
@ -1741,7 +1742,7 @@ APZCTreeManager::GetMultitouchTarget(AsyncPanZoomController* aApzc1, AsyncPanZoo
 already_AddRefed<AsyncPanZoomController>
 APZCTreeManager::CommonAncestor(AsyncPanZoomController* aApzc1, AsyncPanZoomController* aApzc2) const
 {
-  MonitorAutoLock lock(mTreeLock);
+  mTreeLock.AssertCurrentThreadOwns();
  nsRefPtr<AsyncPanZoomController> ancestor;

  // If either aApzc1 or aApzc2 is null, min(depth1, depth2) will be 0 and this function
--- a/gfx/skia/generate_mozbuild.py
+++ b/gfx/skia/generate_mozbuild.py
@ -75,7 +75,7 @@ LOCAL_INCLUDES += [
    'trunk/src/utils/win',
 ]

-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gtk2', 'gtk3', 'qt', 'gonk', 'cocoa'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in {'android', 'gtk2', 'gtk3', 'qt', 'gonk', 'cocoa', 'uikit'}:
    DEFINES['SK_USE_POSIX_THREADS'] = 1

 if CONFIG['INTEL_ARCHITECTURE'] and CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSSE3']:
@ -84,11 +84,13 @@ if CONFIG['INTEL_ARCHITECTURE'] and CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSSE3']:
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gonk'):
    DEFINES['SK_FONTHOST_CAIRO_STANDALONE'] = 0

-if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android') or \
-   (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa') or \
-   (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk') or \
-   (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'qt') or \
-   CONFIG['MOZ_WIDGET_GTK']:
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in {
+    'android',
+    'cocoa',
+    'uikit',
+    'gonk',
+    'qt',
+  } or CONFIG['MOZ_WIDGET_GTK']:
    DEFINES['SK_FONTHOST_DOES_NOT_USE_FONTMGR'] = 1

 if CONFIG['GKMEDIAS_SHARED_LIBRARY']:
@ -410,7 +412,7 @@ def write_mozbuild(includes, sources):
  f.write("if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gonk'):\n")
  write_sources(f, sources['android'], 4)

-  f.write("if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':\n")
+  f.write("if CONFIG['MOZ_WIDGET_TOOLKIT'] in {'cocoa', 'uikit'}:\n")
  write_sources(f, sources['mac'], 4)

  f.write("if CONFIG['MOZ_WIDGET_GTK']:\n")
--- a/gfx/skia/moz.build
+++ b/gfx/skia/moz.build
@ -735,7 +735,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gonk'):
        'trunk/src/ports/SkFontHost_FreeType.cpp',
        'trunk/src/ports/SkFontHost_FreeType_common.cpp',
    ]
-if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in {'cocoa', 'uikit'}:
    UNIFIED_SOURCES += [
        'trunk/src/ports/SkDebug_stdio.cpp',
        'trunk/src/ports/SkOSFile_posix.cpp',
@ -907,7 +907,7 @@ LOCAL_INCLUDES += [
    'trunk/src/utils/win',
 ]

-if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gtk2', 'gtk3', 'qt', 'gonk', 'cocoa'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gtk2', 'gtk3', 'qt', 'gonk', 'cocoa', 'uikit'):
    DEFINES['SK_USE_POSIX_THREADS'] = 1

 if CONFIG['INTEL_ARCHITECTURE'] and CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSSE3']:
@ -916,7 +916,7 @@ if CONFIG['INTEL_ARCHITECTURE'] and CONFIG['HAVE_TOOLCHAIN_SUPPORT_MSSSE3']:
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('android', 'gonk'):
    DEFINES['SK_FONTHOST_CAIRO_STANDALONE'] = 0

-if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android') or    (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa') or    (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk') or    (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'qt') or    CONFIG['MOZ_WIDGET_GTK']:
+if (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android') or    (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa') or (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'uikit') or    (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk') or    (CONFIG['MOZ_WIDGET_TOOLKIT'] == 'qt') or    CONFIG['MOZ_WIDGET_GTK']:
    DEFINES['SK_FONTHOST_DOES_NOT_USE_FONTMGR'] = 1

 if CONFIG['GKMEDIAS_SHARED_LIBRARY']:
--- a/gfx/skia/trunk/src/opts/SkBlitRow_opts_SSE4_x64_asm.S
+++ b/gfx/skia/trunk/src/opts/SkBlitRow_opts_SSE4_x64_asm.S
@ -7,7 +7,7 @@

 #include <SkPreConfig.h>

-#if defined(__clang__) || (defined(__GNUC__) && !defined(SK_BUILD_FOR_MAC))
+#if defined(__clang__) || (defined(__GNUC__) && !(defined(SK_BUILD_FOR_MAC) || defined(SK_BUILD_FOR_IOS)))

 #define EXTRACT_ALPHA(var1, var2) \
    movdqa      %var1, %var2;           /* Clone source pixels to extract alpha */\
@ -50,7 +50,7 @@
    .type S32A_Opaque_BlitRow32_SSE4_asm, @function
 #endif
    .p2align 4
-#if defined(SK_BUILD_FOR_MAC)
+#if defined(SK_BUILD_FOR_MAC) || defined(SK_BUILD_FOR_IOS)
    .global _S32A_Opaque_BlitRow32_SSE4_asm
    .private_extern _S32A_Opaque_BlitRow32_SSE4_asm
 _S32A_Opaque_BlitRow32_SSE4_asm:
--- a/js/src/configure.in
+++ b/js/src/configure.in
@ -238,6 +238,12 @@ else
    MOZ_ANDROID_NDK
 fi

+case "$target" in
+*-apple-darwin*)
+    MOZ_IOS_SDK
+    ;;
+esac
+
 dnl ========================================================
 dnl Checks for compilers.
 dnl ========================================================
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@ -4598,7 +4598,6 @@ ParseNode::getConstantValue(ExclusiveContext* cx, AllowConstantObjects allowObje
        return true;
      case PNK_CALLSITEOBJ:
      case PNK_ARRAY: {
-        RootedValue value(cx);
        unsigned count;
        ParseNode* pn;

@ -4606,8 +4605,12 @@ ParseNode::getConstantValue(ExclusiveContext* cx, AllowConstantObjects allowObje
            vp.setMagic(JS_GENERIC_MAGIC);
            return true;
        }
-        if (allowObjects == DontAllowNestedObjects)
+
+        ObjectGroup::NewArrayKind arrayKind = ObjectGroup::NewArrayKind::Normal;
+        if (allowObjects == ForCopyOnWriteArray) {
+            arrayKind = ObjectGroup::NewArrayKind::CopyOnWrite;
            allowObjects = DontAllowObjects;
+        }

        if (getKind() == PNK_CALLSITEOBJ) {
            count = pn_count - 1;
@ -4618,26 +4621,25 @@ ParseNode::getConstantValue(ExclusiveContext* cx, AllowConstantObjects allowObje
            pn = pn_head;
        }

-        RootedArrayObject obj(cx, NewDenseFullyAllocatedArray(cx, count, nullptr, newKind));
-        if (!obj)
+        AutoValueVector values(cx);
+        if (!values.appendN(MagicValue(JS_ELEMENTS_HOLE), count))
            return false;
-
-        unsigned idx = 0;
-        RootedId id(cx);
-        for (; pn; idx++, pn = pn->pn_next) {
-            if (!pn->getConstantValue(cx, allowObjects, &value))
+        size_t idx;
+        for (idx = 0; pn; idx++, pn = pn->pn_next) {
+            if (!pn->getConstantValue(cx, allowObjects, values[idx]))
                return false;
-            if (value.isMagic(JS_GENERIC_MAGIC)) {
+            if (values[idx].isMagic(JS_GENERIC_MAGIC)) {
                vp.setMagic(JS_GENERIC_MAGIC);
                return true;
            }
-            id = INT_TO_JSID(idx);
-            if (!DefineProperty(cx, obj, id, value, nullptr, nullptr, JSPROP_ENUMERATE))
-                return false;
        }
        MOZ_ASSERT(idx == count);

-        ObjectGroup::fixArrayGroup(cx, obj);
+        JSObject* obj = ObjectGroup::newArrayObject(cx, values.begin(), values.length(),
+                                                    newKind, arrayKind);
+        if (!obj)
+            return false;
+
        vp.setObject(*obj);
        return true;
      }
@ -4649,8 +4651,7 @@ ParseNode::getConstantValue(ExclusiveContext* cx, AllowConstantObjects allowObje
            vp.setMagic(JS_GENERIC_MAGIC);
            return true;
        }
-        if (allowObjects == DontAllowNestedObjects)
-            allowObjects = DontAllowObjects;
+        MOZ_ASSERT(allowObjects == AllowObjects);

        AutoIdValueVector properties(cx);

@ -7894,7 +7895,7 @@ BytecodeEmitter::emitTree(ParseNode* pn)
            // every time the initializer executes.
            if (emitterMode != BytecodeEmitter::SelfHosting && pn->pn_count != 0) {
                RootedValue value(cx);
-                if (!pn->getConstantValue(cx, ParseNode::DontAllowNestedObjects, &value))
+                if (!pn->getConstantValue(cx, ParseNode::ForCopyOnWriteArray, &value))
                    return false;
                if (!value.isMagic(JS_GENERIC_MAGIC)) {
                    // Note: the group of the template object might not yet reflect
@ -7904,9 +7905,9 @@ BytecodeEmitter::emitTree(ParseNode* pn)
                    // group for the template is accurate. We don't do this here as we
                    // want to use ObjectGroup::allocationSiteGroup, which requires a
                    // finished script.
-                    NativeObject* obj = &value.toObject().as<NativeObject>();
-                    if (!ObjectElements::MakeElementsCopyOnWrite(cx, obj))
-                        return false;
+                    JSObject* obj = &value.toObject();
+                    MOZ_ASSERT(obj->is<ArrayObject>() &&
+                               obj->as<ArrayObject>().denseElementsAreCopyOnWrite());

                    ObjectBox* objbox = parser->newObjectBox(obj);
                    if (!objbox)
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@ -898,8 +898,8 @@ class ParseNode

    enum AllowConstantObjects {
        DontAllowObjects = 0,
-        DontAllowNestedObjects,
-        AllowObjects
+        AllowObjects,
+        ForCopyOnWriteArray
    };

    bool getConstantValue(ExclusiveContext* cx, AllowConstantObjects allowObjects, MutableHandleValue vp,
--- a/js/src/jit-test/tests/basic/exception-column-number.js
+++ b/js/src/jit-test/tests/basic/exception-column-number.js
@ -0,0 +1,11 @@
+try {
+    Array.indexOf();
+} catch (e) {
+    assertEq(e.columnNumber, 5);
+    // Filter the filename from the stack, since we have no clue what
+    // to expect there.  Search for ':' from the end, because the file
+    // path may contain ':' in it.
+    var lastColon = e.stack.lastIndexOf(':');
+    var afterPath = e.stack.lastIndexOf(':', lastColon - 1);
+    assertEq(e.stack.substring(afterPath), ":2:5\n");
+}
--- a/js/src/jit-test/tests/debug/Object-deleteProperty-error-02.js
+++ b/js/src/jit-test/tests/debug/Object-deleteProperty-error-02.js
@ -8,7 +8,7 @@ dbg.onDebuggerStatement = function (frame) {
        assertEq(exc.message, "diaf");
        assertEq(exc.fileName, "fail");
        assertEq(exc.lineNumber, 4);
-        assertEq(exc.columnNumber, 24);
+        assertEq(exc.columnNumber, 25);
        return;
    }
    throw new Error("deleteProperty should throw");
--- a/js/src/jit-test/tests/ion/recover-iterator-next.js
+++ b/js/src/jit-test/tests/ion/recover-iterator-next.js
@ -16,6 +16,10 @@ if (getJitCompilerOptions()["ion.warmup.trigger"] <= 90)
 if (getJitCompilerOptions()["ion.forceinlineCaches"])
    setJitCompilerOption("ion.forceinlineCaches", 0);

+// Frequent GCs can interfere with the tests being performed here.
+if (typeof gczeal != "undefined")
+    gczeal(0);
+
 var arr = new Array();
 var max = 2000;
 for (var i=0; i < max; i++)
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@ -3459,13 +3459,14 @@ BaselineCompiler::emit_JSOP_REST()
 {
    frame.syncStack(0);

-    ArrayObject* templateObject = NewDenseUnallocatedArray(cx, 0, nullptr, TenuredObject);
+    JSObject* templateObject =
+        ObjectGroup::newArrayObject(cx, nullptr, 0, TenuredObject,
+                                    ObjectGroup::NewArrayKind::UnknownIndex);
    if (!templateObject)
        return false;
-    ObjectGroup::fixRestArgumentsGroup(cx, templateObject);

    // Call IC.
-    ICRest_Fallback::Compiler compiler(cx, templateObject);
+    ICRest_Fallback::Compiler compiler(cx, &templateObject->as<ArrayObject>());
    if (!emitOpIC(compiler.getStub(&stubSpace_)))
        return false;

--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@ -12580,10 +12580,10 @@ static bool DoRestFallback(JSContext* cx, BaselineFrame* frame, ICRest_Fallback*
    unsigned numRest = numActuals > numFormals ? numActuals - numFormals : 0;
    Value* rest = frame->argv() + numFormals;

-    ArrayObject* obj = NewDenseCopiedArray(cx, numRest, rest, nullptr);
+    JSObject* obj = ObjectGroup::newArrayObject(cx, rest, numRest, GenericObject,
+                                                ObjectGroup::NewArrayKind::UnknownIndex);
    if (!obj)
        return false;
-    ObjectGroup::fixRestArgumentsGroup(cx, obj);
    res.setObject(*obj);
    return true;
 }
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@ -530,6 +530,11 @@ IonBuilder::inlineArray(CallInfo& callInfo)
        return InliningStatus_NotInlined;
    }

+    if (templateObject->is<UnboxedArrayObject>()) {
+        if (templateObject->group()->unboxedLayout().nativeGroup())
+            return InliningStatus_NotInlined;
+    }
+
    // Multiple arguments imply array initialization, not just construction.
    if (callInfo.argc() >= 2) {
        initLength = callInfo.argc();
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@ -289,7 +289,8 @@ ArrayPushDense(JSContext* cx, HandleObject obj, HandleValue v, uint32_t* length)
 {
    *length = GetAnyBoxedOrUnboxedArrayLength(obj);
    DenseElementResult result =
-        SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, *length, v.address(), 1, DontUpdateTypes);
+        SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, *length, v.address(), 1,
+                                                  ShouldUpdateTypes::DontUpdate);
    if (result != DenseElementResult::Incomplete) {
        (*length)++;
        return result == DenseElementResult::Success;
@ -1105,7 +1106,7 @@ SetDenseOrUnboxedArrayElement(JSContext* cx, HandleObject obj, int32_t index,

    DenseElementResult result =
        SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, index, value.address(), 1,
-                                                  DontUpdateTypes);
+                                                  ShouldUpdateTypes::DontUpdate);
    if (result != DenseElementResult::Incomplete)
        return result == DenseElementResult::Success;

--- a/js/src/jsapi-tests/testErrorCopying.cpp
+++ b/js/src/jsapi-tests/testErrorCopying.cpp
@ -15,14 +15,14 @@ static uint32_t column = 0;
 BEGIN_TEST(testErrorCopying_columnCopied)
 {
        //0        1         2
-        //0123456789012345678901234567
+        //1234567890123456789012345678
    EXEC("function check() { Object; foo; }");

    JS::RootedValue rval(cx);
    JS_SetErrorReporter(rt, my_ErrorReporter);
    CHECK(!JS_CallFunctionName(cx, global, "check", JS::HandleValueArray::empty(),
                               &rval));
-    CHECK(column == 27);
+    CHECK(column == 28);
    return true;
 }

--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@ -248,9 +248,8 @@ ElementAdder::append(JSContext* cx, HandleValue v)
 {
    MOZ_ASSERT(index_ < length_);
    if (resObj_) {
-        DenseElementResult result = SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, resObj_, index_,
-                                                                              v.address(), 1,
-                                                                              UpdateTypes);
+        DenseElementResult result =
+            SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, resObj_, index_, v.address(), 1);
        if (result == DenseElementResult::Failure)
            return false;
        if (result == DenseElementResult::Incomplete) {
@ -366,8 +365,7 @@ SetArrayElement(JSContext* cx, HandleObject obj, double index, HandleValue v)

    if ((obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>()) && !obj->isIndexed() && index <= UINT32_MAX) {
        DenseElementResult result =
-            SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, uint32_t(index), v.address(), 1,
-                                                      UpdateTypes);
+            SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, uint32_t(index), v.address(), 1);
        if (result != DenseElementResult::Incomplete)
            return result == DenseElementResult::Success;
    }
@ -1208,7 +1206,9 @@ js::array_join(JSContext* cx, unsigned argc, Value* vp)

 /* vector must point to rooted memory. */
 static bool
-InitArrayElements(JSContext* cx, HandleObject obj, uint32_t start, uint32_t count, const Value* vector, ShouldUpdateTypes updateTypes)
+InitArrayElements(JSContext* cx, HandleObject obj, uint32_t start,
+                  uint32_t count, const Value* vector,
+                  ShouldUpdateTypes updateTypes = ShouldUpdateTypes::Update)
 {
    MOZ_ASSERT(count <= MAX_ARRAY_INDEX);

@ -1954,7 +1954,7 @@ js::array_sort(JSContext* cx, unsigned argc, Value* vp)
            }
        }

-        if (!InitArrayElements(cx, obj, 0, uint32_t(n), vec.begin(), DontUpdateTypes))
+        if (!InitArrayElements(cx, obj, 0, uint32_t(n), vec.begin(), ShouldUpdateTypes::DontUpdate))
            return false;
    }

@ -2013,7 +2013,7 @@ js::array_push(JSContext* cx, unsigned argc, Value* vp)
    if (!ObjectMayHaveExtraIndexedProperties(obj)) {
        DenseElementResult result =
            SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, length,
-                                                      args.array(), args.length(), UpdateTypes);
+                                                      args.array(), args.length());
        if (result != DenseElementResult::Incomplete) {
            if (result == DenseElementResult::Failure)
                return false;
@ -2031,7 +2031,7 @@ js::array_push(JSContext* cx, unsigned argc, Value* vp)
    }

    /* Steps 4-5. */
-    if (!InitArrayElements(cx, obj, length, args.length(), args.array(), UpdateTypes))
+    if (!InitArrayElements(cx, obj, length, args.length(), args.array()))
        return false;

    /* Steps 6-7. */
@ -2277,7 +2277,7 @@ js::array_unshift(JSContext* cx, unsigned argc, Value* vp)
        }

        /* Copy from args to the bottom of the array. */
-        if (!InitArrayElements(cx, obj, 0, args.length(), args.array(), UpdateTypes))
+        if (!InitArrayElements(cx, obj, 0, args.length(), args.array()))
            return false;

        newlen += args.length();
@ -3443,7 +3443,7 @@ js::NewDenseUnallocatedArray(ExclusiveContext* cx, uint32_t length,
 }

 ArrayObject*
-js::NewDenseCopiedArray(JSContext* cx, uint32_t length, HandleArrayObject src,
+js::NewDenseCopiedArray(ExclusiveContext* cx, uint32_t length, HandleArrayObject src,
                        uint32_t elementOffset, HandleObject proto /* = nullptr */)
 {
    MOZ_ASSERT(!src->isIndexed());
@ -3463,11 +3463,11 @@ js::NewDenseCopiedArray(JSContext* cx, uint32_t length, HandleArrayObject src,

 // values must point at already-rooted Value objects
 ArrayObject*
-js::NewDenseCopiedArray(JSContext* cx, uint32_t length, const Value* values,
+js::NewDenseCopiedArray(ExclusiveContext* cx, uint32_t length, const Value* values,
                        HandleObject proto /* = nullptr */,
                        NewObjectKind newKind /* = GenericObject */)
 {
-    ArrayObject* arr = NewArray<UINT32_MAX>(cx, length, proto);
+    ArrayObject* arr = NewArray<UINT32_MAX>(cx, length, proto, newKind);
    if (!arr)
        return nullptr;

@ -3522,7 +3522,7 @@ js::NewDenseCopyOnWriteArray(JSContext* cx, HandleArrayObject templateObject, gc
 // capacity (up to maxLength), using the specified group if possible.
 template <uint32_t maxLength>
 static inline JSObject*
-NewArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length,
+NewArrayTryUseGroup(ExclusiveContext* cx, HandleObjectGroup group, size_t length,
                    NewObjectKind newKind = GenericObject, bool forceAnalyze = false)
 {
    MOZ_ASSERT(newKind != SingletonObject);
@ -3558,13 +3558,14 @@ NewArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length,
 }

 JSObject*
-js::NewFullyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length)
+js::NewFullyAllocatedArrayTryUseGroup(ExclusiveContext* cx, HandleObjectGroup group, size_t length,
+                                      NewObjectKind newKind)
 {
-    return NewArrayTryUseGroup<UINT32_MAX>(cx, group, length);
+    return NewArrayTryUseGroup<UINT32_MAX>(cx, group, length, newKind);
 }

 JSObject*
-js::NewPartlyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length)
+js::NewPartlyAllocatedArrayTryUseGroup(ExclusiveContext* cx, HandleObjectGroup group, size_t length)
 {
    return NewArrayTryUseGroup<ArrayObject::EagerAllocationMaxLength>(cx, group, length);
 }
@ -3627,25 +3628,27 @@ js::NewPartlyAllocatedArrayForCallingAllocationSite(JSContext* cx, size_t length
 }

 JSObject*
-js::NewCopiedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, const Value* vp, size_t length)
+js::NewCopiedArrayTryUseGroup(ExclusiveContext* cx, HandleObjectGroup group,
+                              const Value* vp, size_t length, NewObjectKind newKind,
+                              ShouldUpdateTypes updateTypes)
 {
-    JSObject* obj = NewFullyAllocatedArrayTryUseGroup(cx, group, length);
+    JSObject* obj = NewFullyAllocatedArrayTryUseGroup(cx, group, length, newKind);
    if (!obj)
        return nullptr;

    DenseElementResult result =
-        SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, 0, vp, length, UpdateTypes);
+        SetOrExtendAnyBoxedOrUnboxedDenseElements(cx, obj, 0, vp, length, updateTypes);
    if (result == DenseElementResult::Failure)
        return nullptr;
    if (result == DenseElementResult::Success)
        return obj;

    MOZ_ASSERT(obj->is<UnboxedArrayObject>());
-    if (!UnboxedArrayObject::convertToNative(cx, obj))
+    if (!UnboxedArrayObject::convertToNative(cx->asJSContext(), obj))
        return nullptr;

    result = SetOrExtendBoxedOrUnboxedDenseElements<JSVAL_TYPE_MAGIC>(cx, obj, 0, vp, length,
-                                                                      UpdateTypes);
+                                                                      updateTypes);
    MOZ_ASSERT(result != DenseElementResult::Incomplete);
    if (result == DenseElementResult::Failure)
        return nullptr;
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@ -67,12 +67,12 @@ NewDenseFullyAllocatedArray(ExclusiveContext* cx, uint32_t length, HandleObject

 /* Create a dense array with a copy of the dense array elements in src. */
 extern ArrayObject*
-NewDenseCopiedArray(JSContext* cx, uint32_t length, HandleArrayObject src,
+NewDenseCopiedArray(ExclusiveContext* cx, uint32_t length, HandleArrayObject src,
                    uint32_t elementOffset, HandleObject proto = nullptr);

 /* Create a dense array from the given array values, which must be rooted */
 extern ArrayObject*
-NewDenseCopiedArray(JSContext* cx, uint32_t length, const Value* values,
+NewDenseCopiedArray(ExclusiveContext* cx, uint32_t length, const Value* values,
                    HandleObject proto = nullptr, NewObjectKind newKind = GenericObject);

 /* Create a dense array based on templateObject with the given length. */
@ -86,10 +86,11 @@ NewDenseCopyOnWriteArray(JSContext* cx, HandleArrayObject templateObject, gc::In
 // The methods below can create either boxed or unboxed arrays.

 extern JSObject*
-NewFullyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length);
+NewFullyAllocatedArrayTryUseGroup(ExclusiveContext* cx, HandleObjectGroup group, size_t length,
+                                  NewObjectKind newKind = GenericObject);

 extern JSObject*
-NewPartlyAllocatedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, size_t length);
+NewPartlyAllocatedArrayTryUseGroup(ExclusiveContext* cx, HandleObjectGroup group, size_t length);

 extern JSObject*
 NewFullyAllocatedArrayTryReuseGroup(JSContext* cx, JSObject* obj, size_t length,
@ -107,8 +108,17 @@ NewFullyAllocatedArrayForCallingAllocationSite(JSContext* cx, size_t length,
 extern JSObject*
 NewPartlyAllocatedArrayForCallingAllocationSite(JSContext* cx, size_t length);

+enum class ShouldUpdateTypes
+{
+    Update,
+    DontUpdate
+};
+
 extern JSObject*
-NewCopiedArrayTryUseGroup(JSContext* cx, HandleObjectGroup group, const Value* vp, size_t length);
+NewCopiedArrayTryUseGroup(ExclusiveContext* cx, HandleObjectGroup group,
+                          const Value* vp, size_t length,
+                          NewObjectKind newKind = GenericObject,
+                          ShouldUpdateTypes updateTypes = ShouldUpdateTypes::Update);

 extern JSObject*
 NewCopiedArrayForCallingAllocationSite(JSContext* cx, const Value* vp, size_t length);
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@ -261,6 +261,10 @@ PopulateReportBlame(JSContext* cx, JSErrorReport* report)

    report->filename = iter.scriptFilename();
    report->lineno = iter.computeLine(&report->column);
+    // XXX: Make the column 1-based as in other browsers, instead of 0-based
+    // which is how SpiderMonkey stores it internally. This will be
+    // unnecessary once bug 1144340 is fixed.
+    report->column++;
    report->isMuted = iter.mutedErrors();
 }

--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@ -360,6 +360,10 @@ Error(JSContext* cx, unsigned argc, Value* vp)
            return false;
    } else {
        lineNumber = iter.done() ? 0 : iter.computeLine(&columnNumber);
+        // XXX: Make the column 1-based as in other browsers, instead of 0-based
+        // which is how SpiderMonkey stores it internally. This will be
+        // unnecessary once bug 1144340 is fixed.
+        ++columnNumber;
    }

    RootedObject stack(cx);
@ -867,6 +871,10 @@ ErrorReport::populateUncaughtExceptionReportVA(JSContext* cx, va_list ap)
    if (!iter.done()) {
        ownedReport.filename = iter.scriptFilename();
        ownedReport.lineno = iter.computeLine(&ownedReport.column);
+        // XXX: Make the column 1-based as in other browsers, instead of 0-based
+        // which is how SpiderMonkey stores it internally. This will be
+        // unnecessary once bug 1144340 is fixed.
+        ++ownedReport.column;
        ownedReport.isMuted = iter.mutedErrors();
    }

--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@ -1398,12 +1398,6 @@ class AutoEnterOOMUnsafeRegion
 class AutoEnterOOMUnsafeRegion {};
 #endif /* DEBUG */

-// This tests whether something is inside the GGC's nursery only;
-// use sparingly, mostly testing for any nursery, using IsInsideNursery,
-// is appropriate.
-bool
-IsInsideGGCNursery(const gc::Cell* cell);
-
 // A singly linked list of zones.
 class ZoneList
 {
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@ -1589,23 +1589,26 @@ js::CloneObject(JSContext* cx, HandleObject obj, Handle<js::TaggedProto> proto)
 }

 static bool
-GetScriptArrayObjectElements(JSContext* cx, HandleArrayObject obj, AutoValueVector& values)
+GetScriptArrayObjectElements(JSContext* cx, HandleObject obj, AutoValueVector& values)
 {
    MOZ_ASSERT(!obj->isSingleton());
+    MOZ_ASSERT(obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>());

-    if (obj->nonProxyIsExtensible()) {
-        MOZ_ASSERT(obj->slotSpan() == 0);
-
-        if (!values.appendN(MagicValue(JS_ELEMENTS_HOLE), obj->getDenseInitializedLength()))
+    size_t length = GetAnyBoxedOrUnboxedArrayLength(obj);
+    if (!values.appendN(MagicValue(JS_ELEMENTS_HOLE), length))
        return false;

-        for (size_t i = 0; i < obj->getDenseInitializedLength(); i++)
-            values[i].set(obj->getDenseElement(i));
+    if (obj->nonProxyIsExtensible()) {
+        MOZ_ASSERT_IF(obj->is<ArrayObject>(), obj->as<ArrayObject>().slotSpan() == 0);
+
+        size_t initlen = GetAnyBoxedOrUnboxedInitializedLength(obj);
+        for (size_t i = 0; i < initlen; i++)
+            values[i].set(GetAnyBoxedOrUnboxedDenseElement(obj, i));
    } else {
        // Call site objects are frozen before they escape to script, which
        // converts their dense elements into data properties.
-
-        for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
+        ArrayObject* aobj = &obj->as<ArrayObject>();
+        for (Shape::Range<NoGC> r(aobj->lastProperty()); !r.empty(); r.popFront()) {
            Shape& shape = r.front();
            if (shape.propid() == NameToId(cx->names().length))
                continue;
@ -1619,12 +1622,7 @@ GetScriptArrayObjectElements(JSContext* cx, HandleArrayObject obj, AutoValueVect
                continue;

            uint32_t index = JSID_TO_INT(shape.propid());
-            while (index >= values.length()) {
-                if (!values.append(MagicValue(JS_ELEMENTS_HOLE)))
-                    return false;
-            }
-
-            values[index].set(obj->getSlot(shape.slot()));
+            values[index].set(aobj->getSlot(shape.slot()));
        }
    }

@ -1695,40 +1693,27 @@ js::DeepCloneObjectLiteral(JSContext* cx, HandleObject obj, NewObjectKind newKin
    /* NB: Keep this in sync with XDRObjectLiteral. */
    MOZ_ASSERT_IF(obj->isSingleton(),
                  JS::CompartmentOptionsRef(cx).getSingletonsAsTemplates());
-    MOZ_ASSERT(obj->is<PlainObject>() || obj->is<UnboxedPlainObject>() || obj->is<ArrayObject>());
-    MOZ_ASSERT(cx->isInsideCurrentCompartment(obj));
+    MOZ_ASSERT(obj->is<PlainObject>() || obj->is<UnboxedPlainObject>() ||
+               obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>());
    MOZ_ASSERT(newKind != SingletonObject);

-    if (obj->is<ArrayObject>()) {
-        HandleArrayObject aobj = obj.as<ArrayObject>();
-
+    if (obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>()) {
        AutoValueVector values(cx);
-        if (!GetScriptArrayObjectElements(cx, aobj, values))
+        if (!GetScriptArrayObjectElements(cx, obj, values))
            return nullptr;

        // Deep clone any elements.
-        uint32_t initialized = aobj->getDenseInitializedLength();
-        for (uint32_t i = 0; i < initialized; ++i) {
+        for (uint32_t i = 0; i < values.length(); ++i) {
            if (!DeepCloneValue(cx, values[i].address(), newKind))
                return nullptr;
        }

-        RootedArrayObject clone(cx, NewDenseUnallocatedArray(cx, aobj->length(),
-                                                             nullptr, newKind));
-        if (!clone || !clone->ensureElements(cx, values.length()))
-            return nullptr;
+        ObjectGroup::NewArrayKind arrayKind = ObjectGroup::NewArrayKind::Normal;
+        if (obj->is<ArrayObject>() && obj->as<ArrayObject>().denseElementsAreCopyOnWrite())
+            arrayKind = ObjectGroup::NewArrayKind::CopyOnWrite;

-        clone->setDenseInitializedLength(values.length());
-        clone->initDenseElements(0, values.begin(), values.length());
-
-        if (aobj->denseElementsAreCopyOnWrite()) {
-            if (!ObjectElements::MakeElementsCopyOnWrite(cx, clone))
-                return nullptr;
-        } else {
-            ObjectGroup::fixArrayGroup(cx, &clone->as<ArrayObject>());
-        }
-
-        return clone;
+        return ObjectGroup::newArrayObject(cx, values.begin(), values.length(), newKind,
+                                           arrayKind);
    }

    AutoIdValueVector properties(cx);
@ -1830,8 +1815,9 @@ js::XDRObjectLiteral(XDRState<mode>* xdr, MutableHandleObject obj)
        if (mode == XDR_ENCODE) {
            MOZ_ASSERT(obj->is<PlainObject>() ||
                       obj->is<UnboxedPlainObject>() ||
-                       obj->is<ArrayObject>());
-            isArray = obj->is<ArrayObject>() ? 1 : 0;
+                       obj->is<ArrayObject>() ||
+                       obj->is<UnboxedArrayObject>());
+            isArray = (obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>()) ? 1 : 0;
        }

        if (!xdr->codeUint32(&isArray))
@ -1842,69 +1828,39 @@ js::XDRObjectLiteral(XDRState<mode>* xdr, MutableHandleObject obj)
    RootedId tmpId(cx);

    if (isArray) {
-        uint32_t length;
-        RootedArrayObject aobj(cx);
-
-        if (mode == XDR_ENCODE) {
-            aobj = &obj->as<ArrayObject>();
-            length = aobj->length();
-        }
-
-        if (!xdr->codeUint32(&length))
-            return false;
-
-        if (mode == XDR_DECODE) {
-            obj.set(NewDenseUnallocatedArray(cx, length, nullptr, TenuredObject));
-            if (!obj)
-                return false;
-            aobj = &obj->as<ArrayObject>();
-        }
-
        AutoValueVector values(cx);
-        if (mode == XDR_ENCODE && !GetScriptArrayObjectElements(cx, aobj, values))
+        if (mode == XDR_ENCODE && !GetScriptArrayObjectElements(cx, obj, values))
            return false;

        uint32_t initialized;
-        {
        if (mode == XDR_ENCODE)
            initialized = values.length();
        if (!xdr->codeUint32(&initialized))
            return false;
-            if (mode == XDR_DECODE) {
-                if (initialized) {
-                    if (!aobj->ensureElements(cx, initialized))
+        if (mode == XDR_DECODE && !values.appendN(MagicValue(JS_ELEMENTS_HOLE), initialized))
            return false;
-                }
-            }
-        }

        // Recursively copy dense elements.
        for (unsigned i = 0; i < initialized; i++) {
-            if (mode == XDR_ENCODE)
-                tmpValue = values[i];
-
-            if (!xdr->codeConstValue(&tmpValue))
+            if (!xdr->codeConstValue(values[i]))
                return false;
-
-            if (mode == XDR_DECODE) {
-                aobj->setDenseInitializedLength(i + 1);
-                aobj->initDenseElement(i, tmpValue);
-            }
        }

        uint32_t copyOnWrite;
        if (mode == XDR_ENCODE)
-            copyOnWrite = aobj->denseElementsAreCopyOnWrite();
+            copyOnWrite = obj->is<ArrayObject>() &&
+                          obj->as<ArrayObject>().denseElementsAreCopyOnWrite();
        if (!xdr->codeUint32(&copyOnWrite))
            return false;

        if (mode == XDR_DECODE) {
-            if (copyOnWrite) {
-                if (!ObjectElements::MakeElementsCopyOnWrite(cx, aobj))
+            ObjectGroup::NewArrayKind arrayKind = copyOnWrite
+                                                  ? ObjectGroup::NewArrayKind::CopyOnWrite
+                                                  : ObjectGroup::NewArrayKind::Normal;
+            obj.set(ObjectGroup::newArrayObject(cx, values.begin(), values.length(),
+                                                TenuredObject, arrayKind));
+            if (!obj)
                return false;
-            } else {
-                ObjectGroup::fixArrayGroup(cx, aobj);
-            }
        }

        return true;
@ -1962,65 +1918,6 @@ js::XDRObjectLiteral(XDRState<XDR_ENCODE>* xdr, MutableHandleObject obj);
 template bool
 js::XDRObjectLiteral(XDRState<XDR_DECODE>* xdr, MutableHandleObject obj);

-JSObject*
-js::CloneObjectLiteral(JSContext* cx, HandleObject srcObj)
-{
-    if (srcObj->is<PlainObject>()) {
-        AllocKind kind = GetBackgroundAllocKind(gc::GetGCObjectKind(srcObj->as<PlainObject>().numFixedSlots()));
-        MOZ_ASSERT_IF(srcObj->isTenured(), kind == srcObj->asTenured().getAllocKind());
-
-        RootedObject proto(cx, cx->global()->getOrCreateObjectPrototype(cx));
-        if (!proto)
-            return nullptr;
-        RootedObjectGroup group(cx, ObjectGroup::defaultNewGroup(cx, &PlainObject::class_,
-                                                                 TaggedProto(proto)));
-        if (!group)
-            return nullptr;
-
-        RootedPlainObject res(cx, NewObjectWithGroup<PlainObject>(cx, group, kind, TenuredObject));
-        if (!res)
-            return nullptr;
-
-        // XXXbz Do we still need the reshape here?  We got "kind" off the
-        // srcObj, no?  See bug 1143270.
-        RootedShape newShape(cx, ReshapeForAllocKind(cx, srcObj->as<PlainObject>().lastProperty(),
-                                                     TaggedProto(proto), kind));
-        if (!newShape || !res->setLastProperty(cx, newShape))
-            return nullptr;
-
-        return res;
-    }
-
-    RootedArrayObject srcArray(cx, &srcObj->as<ArrayObject>());
-    MOZ_ASSERT(srcArray->denseElementsAreCopyOnWrite());
-    MOZ_ASSERT(srcArray->getElementsHeader()->ownerObject() == srcObj);
-
-    size_t length = srcArray->as<ArrayObject>().length();
-    RootedArrayObject res(cx, NewDenseFullyAllocatedArray(cx, length, nullptr, TenuredObject));
-    if (!res)
-        return nullptr;
-
-    RootedId id(cx);
-    RootedValue value(cx);
-    for (size_t i = 0; i < length; i++) {
-        // The only markable values in copy on write arrays are atoms, which
-        // can be freely copied between compartments.
-        value = srcArray->getDenseElement(i);
-        MOZ_ASSERT_IF(value.isMarkable(),
-                      value.toGCThing()->isTenured() &&
-                      value.toGCThing()->asTenured().zoneFromAnyThread()->isAtomsZone());
-
-        id = INT_TO_JSID(i);
-        if (!DefineProperty(cx, res, id, value, nullptr, nullptr, JSPROP_ENUMERATE))
-            return nullptr;
-    }
-
-    if (!ObjectElements::MakeElementsCopyOnWrite(cx, res))
-        return nullptr;
-
-    return res;
-}
-
 void
 NativeObject::fillInAfterSwap(JSContext* cx, const Vector<Value>& values, void* priv)
 {
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@ -1277,9 +1277,6 @@ template<XDRMode mode>
 bool
 XDRObjectLiteral(XDRState<mode>* xdr, MutableHandleObject obj);

-extern JSObject*
-CloneObjectLiteral(JSContext* cx, HandleObject srcObj);
-
 extern bool
 ReportGetterOnlyAssignment(JSContext* cx, bool strict);

--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@ -3087,13 +3087,7 @@ js::CloneScript(JSContext* cx, HandleObject enclosingScope, HandleFunction fun,
                    clone = CloneFunctionAndScript(cx, enclosingScope, innerFun, polluted);
                }
            } else {
-                /*
-                 * Clone object literals emitted for the JSOP_NEWOBJECT opcode. We only emit that
-                 * instead of the less-optimized JSOP_NEWINIT for self-hosted code or code compiled
-                 * with JSOPTION_COMPILE_N_GO set. As we don't clone the latter type of code, this
-                 * case should only ever be hit when cloning objects from self-hosted code.
-                 */
-                clone = CloneObjectLiteral(cx, obj);
+                clone = DeepCloneObjectLiteral(cx, obj, TenuredObject);
            }
            if (!clone || !objects.append(clone))
                return nullptr;
--- a/js/src/tests/ecma/extensions/errorcolumnblame.js
+++ b/js/src/tests/ecma/extensions/errorcolumnblame.js
@ -21,54 +21,58 @@ function test(f, col) {
 function foo(o) {
 	return o.p;
 }
-test(foo, 1);
+test(foo, 2);

-//234567890123456789
-test(function(f) { return f.bar; }, 19);
+//345678901234567890
+test(function(f) { return f.bar; }, 20);
 //       1         2
-//2345678901234567890123456
-test(function(f) { return f(); }, 26);
+//3456789012345678901234567
+test(function(f) { return f(); }, 27);
 /* Cover negative colspan case using for(;;) loop with error in update part. */
 test(function(){
-        //0         1         2         3         4
-        //012345678901234567890123456789012345678901
+        //         1         2         3         4
+        //123456789012345678901234567890123456789012
    eval("function baz() { for (var i = 0; i < 10; i += a.b); assertEq(i !== i, true); }");
    baz();
-}, 41);
+}, 42);

 //       1         2         3
-//234567890123456789012345678901234
-test(function() { var tmp = null; tmp(); }, 34)
-test(function() { var tmp = null;  tmp.foo; }, 35)
+//3456789012345678901234567890123456
+test(function() { var tmp = null; tmp(); }, 35)
+test(function() { var tmp = null;  tmp.foo; }, 36)

 /* Just a generic 'throw'. */
 test(function() {
-//234567890123456789
+//       1         2
+//345678901234567890
    foo({}); throw new Error('a');
-}, 19);
+}, 20);

 /* Be sure to report the right statement */
 test(function() {
    function f() { return true; }
    function g() { return false; }
-//234567890123456789012345678
+//       1         2
+//345678901234567890123456789
    f(); g(); f(); if (f()) a += e;
-}, 28);
+}, 29);

-//2345678901234567890
-test(function() { e++; }, 18);
-test(function() {print += e; }, 17);
-test(function(){e += 1 }, 16);
-test(function() {  print[e]; }, 19);
-test(function() { e[1]; }, 18);
-test(function() { e(); }, 18);
-test(function() { 1(); }, 18);
-test(function() { Object.defineProperty() }, 18);
+//       1         2
+//345678901234567890
+test(function() { e++; }, 19);
+test(function() {print += e; }, 18);
+test(function(){e += 1 }, 17);
+test(function() {  print[e]; }, 20);
+test(function() { e[1]; }, 19);
+test(function() { e(); }, 19);
+test(function() { 1(); }, 19);
+test(function() { Object.defineProperty() }, 19);

 test(function() {
-//23456789012345678901
+//       1         2
+//34567890123456789012
    function foo() { asdf; } foo()
-}, 21);
+}, 22);

 reportCompare(0, 0, "ok");

--- a/js/src/tests/shell/warning.js
+++ b/js/src/tests/shell/warning.js
@ -16,7 +16,7 @@ assertEq(warning !== null, true);
 assertEq(warning.name, "None");
 assertEq(warning.message.includes("mutating"), true);
 assertEq(warning.lineNumber, 1);
-assertEq(warning.columnNumber, 1);
+assertEq(warning.columnNumber, 2);

 // Clear last warning.

--- a/js/src/vm/JSONParser.cpp
+++ b/js/src/vm/JSONParser.cpp
@ -598,13 +598,11 @@ JSONParserBase::finishArray(MutableHandleValue vp, ElementVector& elements)
 {
    MOZ_ASSERT(&elements == &stack.back().elements());

-    ArrayObject* obj = NewDenseCopiedArray(cx, elements.length(), elements.begin());
+    JSObject* obj = ObjectGroup::newArrayObject(cx, elements.begin(), elements.length(),
+                                                GenericObject);
    if (!obj)
        return false;

-    /* Try to assign a new group to the array according to its elements. */
-    ObjectGroup::fixArrayGroup(cx, obj);
-
    vp.setObject(*obj);
    if (!freeElements.append(&elements))
        return false;
--- a/js/src/vm/NativeObject-inl.h
+++ b/js/src/vm/NativeObject-inl.h
@ -240,29 +240,6 @@ NativeObject::getDenseOrTypedArrayElement(uint32_t idx)
    return getDenseElement(idx);
 }

-inline void
-NativeObject::initDenseElementsUnbarriered(uint32_t dstStart, const Value* src, uint32_t count) {
-    /*
-     * For use by parallel threads, which since they cannot see nursery
-     * things do not require a barrier.
-     */
-    MOZ_ASSERT(dstStart + count <= getDenseCapacity());
-    MOZ_ASSERT(!denseElementsAreCopyOnWrite());
-#ifdef DEBUG
-    /*
-     * This asserts a global invariant: parallel code does not
-     * observe objects inside the generational GC's nursery.
-     */
-    MOZ_ASSERT(!gc::IsInsideGGCNursery(this));
-    for (uint32_t index = 0; index < count; ++index) {
-        const Value& value = src[index];
-        if (value.isMarkable())
-            MOZ_ASSERT(!gc::IsInsideGGCNursery(static_cast<gc::Cell*>(value.toGCThing())));
-    }
-#endif
-    memcpy(&elements_[dstStart], src, count * sizeof(HeapSlot));
-}
-
 /* static */ inline NativeObject*
 NativeObject::copy(ExclusiveContext* cx, gc::AllocKind kind, gc::InitialHeap heap,
                   HandleNativeObject templateObject)
--- a/js/src/vm/NativeObject.h
+++ b/js/src/vm/NativeObject.h
@ -291,21 +291,6 @@ static inline bool
 IsObjectValueInCompartment(Value v, JSCompartment* comp);
 #endif

-/*
- * NOTE: This is a placeholder for bug 619558.
- *
- * Run a post write barrier that encompasses multiple contiguous slots in a
- * single step.
- */
-inline void
-DenseRangeWriteBarrierPost(JSRuntime* rt, NativeObject* obj, uint32_t start, uint32_t count)
-{
-    if (count > 0) {
-        JS::shadow::Runtime* shadowRuntime = JS::shadow::Runtime::asShadowRuntime(rt);
-        shadowRuntime->gcStoreBufferPtr()->putSlotFromAnyThread(obj, HeapSlot::Element, start, count);
-    }
-}
-
 // Operations which change an object's dense elements can either succeed, fail,
 // or be unable to complete. For native objects, the latter is used when the
 // object's elements must become sparse instead. The enum below is used for
@ -940,6 +925,20 @@ class NativeObject : public JSObject
    inline void ensureDenseInitializedLengthNoPackedCheck(ExclusiveContext* cx,
                                                          uint32_t index, uint32_t extra);

+    // Run a post write barrier that encompasses multiple contiguous elements in a
+    // single step.
+    inline void elementsRangeWriteBarrierPost(uint32_t start, uint32_t count) {
+        for (size_t i = 0; i < count; i++) {
+            const Value& v = elements_[start + i];
+            if (v.isObject() && IsInsideNursery(&v.toObject())) {
+                JS::shadow::Runtime* shadowRuntime = shadowRuntimeFromMainThread();
+                shadowRuntime->gcStoreBufferPtr()->putSlotFromAnyThread(this, HeapSlot::Element,
+                                                                        start + i, count - i);
+                return;
+            }
+        }
+    }
+
  public:
    void setDenseInitializedLength(uint32_t length) {
        MOZ_ASSERT(length <= getDenseCapacity());
@ -987,7 +986,7 @@ class NativeObject : public JSObject
                elements_[dstStart + i].set(this, HeapSlot::Element, dstStart + i, src[i]);
        } else {
            memcpy(&elements_[dstStart], src, count * sizeof(HeapSlot));
-            DenseRangeWriteBarrierPost(runtimeFromMainThread(), this, dstStart, count);
+            elementsRangeWriteBarrierPost(dstStart, count);
        }
    }

@ -995,11 +994,9 @@ class NativeObject : public JSObject
        MOZ_ASSERT(dstStart + count <= getDenseCapacity());
        MOZ_ASSERT(!denseElementsAreCopyOnWrite());
        memcpy(&elements_[dstStart], src, count * sizeof(HeapSlot));
-        DenseRangeWriteBarrierPost(runtimeFromMainThread(), this, dstStart, count);
+        elementsRangeWriteBarrierPost(dstStart, count);
    }

-    void initDenseElementsUnbarriered(uint32_t dstStart, const Value* src, uint32_t count);
-
    void moveDenseElements(uint32_t dstStart, uint32_t srcStart, uint32_t count) {
        MOZ_ASSERT(dstStart + count <= getDenseCapacity());
        MOZ_ASSERT(srcStart + count <= getDenseInitializedLength());
@ -1031,7 +1028,7 @@ class NativeObject : public JSObject
            }
        } else {
            memmove(elements_ + dstStart, elements_ + srcStart, count * sizeof(HeapSlot));
-            DenseRangeWriteBarrierPost(runtimeFromMainThread(), this, dstStart, count);
+            elementsRangeWriteBarrierPost(dstStart, count);
        }
    }

@ -1043,7 +1040,7 @@ class NativeObject : public JSObject
        MOZ_ASSERT(!denseElementsAreCopyOnWrite());

        memmove(elements_ + dstStart, elements_ + srcStart, count * sizeof(Value));
-        DenseRangeWriteBarrierPost(runtimeFromMainThread(), this, dstStart, count);
+        elementsRangeWriteBarrierPost(dstStart, count);
    }

    bool shouldConvertDoubleElements() {
--- a/js/src/vm/ObjectGroup.cpp
+++ b/js/src/vm/ObjectGroup.cpp
@ -16,8 +16,11 @@

 #include "jsobjinlines.h"

+#include "vm/UnboxedObject-inl.h"
+
 using namespace js;

+using mozilla::DebugOnly;
 using mozilla::PodZero;

 /////////////////////////////////////////////////////////////////////
@ -724,26 +727,25 @@ ObjectGroup::defaultNewGroup(JSContext* cx, JSProtoKey key)
 struct ObjectGroupCompartment::ArrayObjectKey : public DefaultHasher<ArrayObjectKey>
 {
    TypeSet::Type type;
-    JSObject* proto;

    ArrayObjectKey()
-      : type(TypeSet::UndefinedType()), proto(nullptr)
+      : type(TypeSet::UndefinedType())
    {}

-    ArrayObjectKey(TypeSet::Type type, JSObject* proto)
-      : type(type), proto(proto)
+    explicit ArrayObjectKey(TypeSet::Type type)
+      : type(type)
    {}

    static inline uint32_t hash(const ArrayObjectKey& v) {
-        return (uint32_t) (v.type.raw() ^ ((uint32_t)(size_t)v.proto >> 2));
+        return v.type.raw();
    }

    static inline bool match(const ArrayObjectKey& v1, const ArrayObjectKey& v2) {
-        return v1.type == v2.type && v1.proto == v2.proto;
+        return v1.type == v2.type;
    }

    bool operator==(const ArrayObjectKey& other) {
-        return type == other.type && proto == other.proto;
+        return type == other.type;
    }

    bool operator!=(const ArrayObjectKey& other) {
@ -771,52 +773,39 @@ GetValueTypeForTable(const Value& v)
    return type;
 }

-/* static */ void
-ObjectGroup::fixArrayGroup(ExclusiveContext* cx, ArrayObject* obj)
+/* static */ JSObject*
+ObjectGroup::newArrayObject(ExclusiveContext* cx,
+                            const Value* vp, size_t length,
+                            NewObjectKind newKind, NewArrayKind arrayKind)
 {
-    AutoEnterAnalysis enter(cx);
+    MOZ_ASSERT(newKind != SingletonObject);

-    /*
-     * If the array is of homogenous type, pick a group which will be
-     * shared with all other singleton/JSON arrays of the same type.
-     * If the array is heterogenous, keep the existing group, which has
-     * unknown properties.
-     */
-
-    unsigned len = obj->getDenseInitializedLength();
-    if (len == 0)
-        return;
-
-    TypeSet::Type type = GetValueTypeForTable(obj->getDenseElement(0));
-
-    for (unsigned i = 1; i < len; i++) {
-        TypeSet::Type ntype = GetValueTypeForTable(obj->getDenseElement(i));
-        if (ntype != type) {
-            if (NumberTypes(type, ntype))
-                type = TypeSet::DoubleType();
-            else
-                return;
-        }
+    // If we are making a copy on write array, don't try to adjust the group as
+    // getOrFixupCopyOnWriteObject will do this before any objects are copied
+    // from this one.
+    if (arrayKind == NewArrayKind::CopyOnWrite) {
+        ArrayObject* obj = NewDenseCopiedArray(cx, length, vp, nullptr, newKind);
+        if (!obj || !ObjectElements::MakeElementsCopyOnWrite(cx, obj))
+            return nullptr;
+        return obj;
    }

-    setGroupToHomogenousArray(cx, obj, type);
-}
-
-/* static */ void
-ObjectGroup::fixRestArgumentsGroup(ExclusiveContext* cx, ArrayObject* obj)
-{
-    AutoEnterAnalysis enter(cx);
-
-    // Tracking element types for rest argument arrays is not worth it, but we
-    // still want it to be known that it's a dense array.
-    setGroupToHomogenousArray(cx, obj, TypeSet::UnknownType());
-}
-
-/* static */ void
-ObjectGroup::setGroupToHomogenousArray(ExclusiveContext* cx, JSObject* obj,
-                                       TypeSet::Type elementType)
-{
-    MOZ_ASSERT(cx->zone()->types.activeAnalysis);
+    // Get a type which captures all the elements in the array to be created.
+    TypeSet::Type elementType = TypeSet::UnknownType();
+    if (arrayKind != NewArrayKind::UnknownIndex && length != 0) {
+        elementType = GetValueTypeForTable(vp[0]);
+        for (unsigned i = 1; i < length; i++) {
+            TypeSet::Type ntype = GetValueTypeForTable(vp[i]);
+            if (ntype != elementType) {
+                if (NumberTypes(elementType, ntype)) {
+                    elementType = TypeSet::DoubleType();
+                } else {
+                    elementType = TypeSet::UnknownType();
+                    break;
+                }
+            }
+        }
+    }

    ObjectGroupCompartment::ArrayObjectTable*& table =
        cx->compartment()->objectGroups.arrayObjectTable;
@ -827,29 +816,49 @@ ObjectGroup::setGroupToHomogenousArray(ExclusiveContext* cx, JSObject* obj,
            ReportOutOfMemory(cx);
            js_delete(table);
            table = nullptr;
-            return;
+            return nullptr;
        }
    }

-    ObjectGroupCompartment::ArrayObjectKey key(elementType, obj->getProto());
+    ObjectGroupCompartment::ArrayObjectKey key(elementType);
    DependentAddPtr<ObjectGroupCompartment::ArrayObjectTable> p(cx, *table, key);
-    if (p) {
-        obj->setGroup(p->value());
-    } else {
-        // Make a new group to use for future arrays with the same elements.
-        RootedObject objProto(cx, obj->getProto());
-        Rooted<TaggedProto> taggedProto(cx, TaggedProto(objProto));
-        ObjectGroup* group = ObjectGroupCompartment::makeGroup(cx, &ArrayObject::class_, taggedProto);
+
+    if (!p) {
+        RootedArrayObject obj(cx, NewDenseCopiedArray(cx, length, vp, nullptr, TenuredObject));
+        if (!obj)
+            return nullptr;
+
+        Rooted<TaggedProto> proto(cx, TaggedProto(obj->getProto()));
+        RootedObjectGroup group(cx, ObjectGroupCompartment::makeGroup(cx, &ArrayObject::class_,
+                                                                      proto));
        if (!group)
-            return;
-        obj->setGroup(group);
+            return nullptr;

        AddTypePropertyId(cx, group, nullptr, JSID_VOID, elementType);

-        key.proto = objProto;
-        if (!p.add(cx, *table, key, group))
-            cx->recoverFromOutOfMemory();
+        obj->setGroup(group);
+
+        if (elementType != TypeSet::UnknownType()) {
+            // Keep track of the initial objects we create with this type.
+            // If the initial ones have a consistent shape and property types, we
+            // will try to use an unboxed layout for the group.
+            PreliminaryObjectArrayWithTemplate* preliminaryObjects =
+                cx->new_<PreliminaryObjectArrayWithTemplate>(nullptr);
+            if (!preliminaryObjects)
+                return nullptr;
+            group->setPreliminaryObjects(preliminaryObjects);
+            preliminaryObjects->registerNewObject(obj);
        }
+
+        if (!p.add(cx, *table, key, group))
+            return nullptr;
+
+        return obj;
+    }
+
+    RootedObjectGroup group(cx, p->value());
+    return NewCopiedArrayTryUseGroup(cx, group, vp, length, newKind,
+                                     ShouldUpdateTypes::DontUpdate);
 }

 /////////////////////////////////////////////////////////////////////
@ -1450,11 +1459,6 @@ ObjectGroupCompartment::sweep(FreeOp* fop)
                else
                    key.type = TypeSet::ObjectType(group);
            }
-            if (key.proto && key.proto != TaggedProto::LazyProto &&
-                IsAboutToBeFinalizedUnbarriered(&key.proto))
-            {
-                remove = true;
-            }
            if (IsAboutToBeFinalized(&e.front().value()))
                remove = true;

--- a/js/src/vm/ObjectGroup.h
+++ b/js/src/vm/ObjectGroup.h
@ -586,14 +586,20 @@ class ObjectGroup : public gc::TenuredCell

    // Static accessors for ObjectGroupCompartment ArrayObjectTable and PlainObjectTable.

-    // Update the group of a freshly created array according to
-    // the object's current contents.
-    static void fixArrayGroup(ExclusiveContext* cx, ArrayObject* obj);
+    enum class NewArrayKind {
+        Normal,       // Specialize array group based on its element type.
+        CopyOnWrite,  // Make an array with copy-on-write elements.
+        UnknownIndex  // Make an array with an unknown element type.
+    };

-    // Update the group of a freshly created 'rest' arguments object.
-    static void fixRestArgumentsGroup(ExclusiveContext* cx, ArrayObject* obj);
+    // Create an ArrayObject or UnboxedArrayObject with the specified elements
+    // and a group specialized for the elements.
+    static JSObject* newArrayObject(ExclusiveContext* cx, const Value* vp, size_t length,
+                                    NewObjectKind newKind,
+                                    NewArrayKind arrayKind = NewArrayKind::Normal);

-    // Create a PlainObject or UnboxedPlainObject with the specified properties.
+    // Create a PlainObject or UnboxedPlainObject with the specified properties
+    // and a group specialized for those properties.
    static JSObject* newPlainObject(ExclusiveContext* cx,
                                    IdValuePair* properties, size_t nproperties,
                                    NewObjectKind newKind);
@ -623,8 +629,6 @@ class ObjectGroup : public gc::TenuredCell

  private:
    static ObjectGroup* defaultNewGroup(JSContext* cx, JSProtoKey key);
-    static void setGroupToHomogenousArray(ExclusiveContext* cx, JSObject* obj,
-                                          TypeSet::Type type);
 };

 // Structure used to manage the groups in a compartment.
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@ -143,11 +143,8 @@ InterpreterFrame::createRestParameter(JSContext* cx)
    unsigned nformal = fun()->nargs() - 1, nactual = numActualArgs();
    unsigned nrest = (nactual > nformal) ? nactual - nformal : 0;
    Value* restvp = argv() + nformal;
-    ArrayObject* obj = NewDenseCopiedArray(cx, nrest, restvp, nullptr);
-    if (!obj)
-        return nullptr;
-    ObjectGroup::fixRestArgumentsGroup(cx, obj);
-    return obj;
+    return ObjectGroup::newArrayObject(cx, restvp, nrest, GenericObject,
+                                       ObjectGroup::NewArrayKind::UnknownIndex);
 }

 static inline void
--- a/js/src/vm/UnboxedObject-inl.h
+++ b/js/src/vm/UnboxedObject-inl.h
@ -432,17 +432,11 @@ EnsureBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj, size_t count)
    return true;
 }

-enum ShouldUpdateTypes
-{
-    UpdateTypes = true,
-    DontUpdateTypes = false
-};
-
 template <JSValueType Type>
 static inline DenseElementResult
-SetOrExtendBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj,
+SetOrExtendBoxedOrUnboxedDenseElements(ExclusiveContext* cx, JSObject* obj,
                                       uint32_t start, const Value* vp, uint32_t count,
-                                       ShouldUpdateTypes updateTypes)
+                                       ShouldUpdateTypes updateTypes = ShouldUpdateTypes::Update)
 {
    if (Type == JSVAL_TYPE_MAGIC) {
        NativeObject* nobj = &obj->as<NativeObject>();
@ -461,7 +455,7 @@ SetOrExtendBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj,
        if (obj->is<ArrayObject>() && start + count >= obj->as<ArrayObject>().length())
            obj->as<ArrayObject>().setLengthInt32(start + count);

-        if (updateTypes == DontUpdateTypes && !nobj->shouldConvertDoubleElements()) {
+        if (updateTypes == ShouldUpdateTypes::DontUpdate && !nobj->shouldConvertDoubleElements()) {
            nobj->copyDenseElements(start, vp, count);
        } else {
            for (size_t i = 0; i < count; i++)
@ -491,7 +485,7 @@ SetOrExtendBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj,
    // which will overwrite the already-modified elements as well as the ones
    // that were left alone.
    size_t i = 0;
-    if (updateTypes == DontUpdateTypes) {
+    if (updateTypes == ShouldUpdateTypes::DontUpdate) {
        for (size_t j = start; i < count && j < oldInitlen; i++)
            nobj->setElementNoTypeChangeSpecific<Type>(j, vp[i]);
    } else {
@ -503,7 +497,7 @@ SetOrExtendBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj,

    if (i != count) {
        obj->as<UnboxedArrayObject>().setInitializedLength(start + count);
-        if (updateTypes == DontUpdateTypes) {
+        if (updateTypes == ShouldUpdateTypes::DontUpdate) {
            for (; i < count; i++)
                nobj->initElementNoTypeChangeSpecific<Type>(start + i, vp[i]);
        } else {
@ -680,9 +674,9 @@ struct Signature ## Functor {                                           \
 }

 DenseElementResult
-SetOrExtendAnyBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj,
+SetOrExtendAnyBoxedOrUnboxedDenseElements(ExclusiveContext* cx, JSObject* obj,
                                          uint32_t start, const Value* vp, uint32_t count,
-                                          ShouldUpdateTypes updateTypes);
+                                          ShouldUpdateTypes updateTypes = ShouldUpdateTypes::Update);

 DenseElementResult
 MoveAnyBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj,
--- a/js/src/vm/UnboxedObject.cpp
+++ b/js/src/vm/UnboxedObject.cpp
@ -2006,10 +2006,11 @@ js::TryConvertToUnboxedLayout(ExclusiveContext* cx, Shape* templateShape,
 }

 DefineBoxedOrUnboxedFunctor6(SetOrExtendBoxedOrUnboxedDenseElements,
-                             JSContext*, JSObject*, uint32_t, const Value*, uint32_t, ShouldUpdateTypes);
+                             ExclusiveContext*, JSObject*, uint32_t, const Value*, uint32_t,
+                             ShouldUpdateTypes);

 DenseElementResult
-js::SetOrExtendAnyBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj,
+js::SetOrExtendAnyBoxedOrUnboxedDenseElements(ExclusiveContext* cx, JSObject* obj,
                                              uint32_t start, const Value* vp, uint32_t count,
                                              ShouldUpdateTypes updateTypes)
 {
--- a/js/src/vm/Xdr.h
+++ b/js/src/vm/Xdr.h
@ -29,7 +29,7 @@ namespace js {
 *
 *  https://developer.mozilla.org/en-US/docs/SpiderMonkey/Internals/Bytecode
 */
-static const uint32_t XDR_BYTECODE_VERSION_SUBTRAHEND = 291;
+static const uint32_t XDR_BYTECODE_VERSION_SUBTRAHEND = 292;
 static const uint32_t XDR_BYTECODE_VERSION =
    uint32_t(0xb973c0de - XDR_BYTECODE_VERSION_SUBTRAHEND);

--- a/layout/forms/nsNumberControlFrame.cpp
+++ b/layout/forms/nsNumberControlFrame.cpp
@ -124,78 +124,106 @@ nsNumberControlFrame::Reflow(nsPresContext* aPresContext,
    nsFormControlFrame::RegUnRegAccessKey(this, true);
  }

-  // The width of our content box, which is the available width
+  const WritingMode myWM = aReflowState.GetWritingMode();
+
+  // The ISize of our content box, which is the available ISize
  // for our anonymous content:
-  const nscoord contentBoxWidth = aReflowState.ComputedWidth();
-  nscoord contentBoxHeight = aReflowState.ComputedHeight();
+  const nscoord contentBoxISize = aReflowState.ComputedISize();
+  nscoord contentBoxBSize = aReflowState.ComputedBSize();
+
+  // Figure out our border-box sizes as well (by adding borderPadding to
+  // content-box sizes):
+  const nscoord borderBoxISize = contentBoxISize +
+    aReflowState.ComputedLogicalBorderPadding().IStartEnd(myWM);
+
+  nscoord borderBoxBSize;
+  if (contentBoxBSize != NS_INTRINSICSIZE) {
+    borderBoxBSize = contentBoxBSize +
+      aReflowState.ComputedLogicalBorderPadding().BStartEnd(myWM);
+  } // else, we'll figure out borderBoxBSize after we resolve contentBoxBSize.

  nsIFrame* outerWrapperFrame = mOuterWrapper->GetPrimaryFrame();

  if (!outerWrapperFrame) { // display:none?
-    if (contentBoxHeight == NS_INTRINSICSIZE) {
-      contentBoxHeight = 0;
+    if (contentBoxBSize == NS_INTRINSICSIZE) {
+      contentBoxBSize = 0;
+      borderBoxBSize =
+        aReflowState.ComputedLogicalBorderPadding().BStartEnd(myWM);
    }
  } else {
    NS_ASSERTION(outerWrapperFrame == mFrames.FirstChild(), "huh?");

    nsHTMLReflowMetrics wrappersDesiredSize(aReflowState);

-    WritingMode wm = outerWrapperFrame->GetWritingMode();
-    LogicalSize availSize = aReflowState.ComputedSize(wm);
-    availSize.BSize(wm) = NS_UNCONSTRAINEDSIZE;
+    WritingMode wrapperWM = outerWrapperFrame->GetWritingMode();
+    LogicalSize availSize = aReflowState.ComputedSize(wrapperWM);
+    availSize.BSize(wrapperWM) = NS_UNCONSTRAINEDSIZE;

    nsHTMLReflowState wrapperReflowState(aPresContext, aReflowState,
                                         outerWrapperFrame, availSize);

-    // offsets of wrapper frame
-    nscoord xoffset = aReflowState.ComputedPhysicalBorderPadding().left +
-                        wrapperReflowState.ComputedPhysicalMargin().left;
-    nscoord yoffset = aReflowState.ComputedPhysicalBorderPadding().top +
-                        wrapperReflowState.ComputedPhysicalMargin().top;
+    // Convert wrapper margin into my own writing-mode (in case it differs):
+    LogicalMargin wrapperMargin =
+      wrapperReflowState.ComputedLogicalMargin().ConvertTo(myWM, wrapperWM);
+
+    // offsets of wrapper frame within this frame:
+    LogicalPoint
+      wrapperOffset(myWM,
+                    aReflowState.ComputedLogicalBorderPadding().IStart(myWM) +
+                    wrapperMargin.IStart(myWM),
+                    aReflowState.ComputedLogicalBorderPadding().BStart(myWM) +
+                    wrapperMargin.BStart(myWM));

    nsReflowStatus childStatus;
    ReflowChild(outerWrapperFrame, aPresContext, wrappersDesiredSize,
-                wrapperReflowState, xoffset, yoffset, 0, childStatus);
+                wrapperReflowState, myWM, wrapperOffset, 0, 0, childStatus);
    MOZ_ASSERT(NS_FRAME_IS_FULLY_COMPLETE(childStatus),
-               "We gave our child unconstrained height, so it should be complete");
+               "We gave our child unconstrained available block-size, "
+               "so it should be complete");

-    nscoord wrappersMarginBoxHeight = wrappersDesiredSize.Height() +
-      wrapperReflowState.ComputedPhysicalMargin().TopBottom();
+    nscoord wrappersMarginBoxBSize =
+      wrappersDesiredSize.BSize(myWM) + wrapperMargin.BStartEnd(myWM);

-    if (contentBoxHeight == NS_INTRINSICSIZE) {
+    if (contentBoxBSize == NS_INTRINSICSIZE) {
      // We are intrinsically sized -- we should shrinkwrap the outer wrapper's
-      // height:
-      contentBoxHeight = wrappersMarginBoxHeight;
+      // block-size:
+      contentBoxBSize = wrappersMarginBoxBSize;

-      // Make sure we obey min/max-height in the case when we're doing intrinsic
+      // Make sure we obey min/max-bsize in the case when we're doing intrinsic
      // sizing (we get it for free when we have a non-intrinsic
-      // aReflowState.ComputedHeight()).  Note that we do this before
-      // adjusting for borderpadding, since mComputedMaxHeight and
-      // mComputedMinHeight are content heights.
-      contentBoxHeight =
-        NS_CSS_MINMAX(contentBoxHeight,
-                      aReflowState.ComputedMinHeight(),
-                      aReflowState.ComputedMaxHeight());
+      // aReflowState.ComputedBSize()).  Note that we do this before
+      // adjusting for borderpadding, since ComputedMaxBSize and
+      // ComputedMinBSize are content heights.
+      contentBoxBSize =
+        NS_CSS_MINMAX(contentBoxBSize,
+                      aReflowState.ComputedMinBSize(),
+                      aReflowState.ComputedMaxBSize());
+
+      borderBoxBSize = contentBoxBSize +
+        aReflowState.ComputedLogicalBorderPadding().BStartEnd(myWM);
    }

-    // Center child vertically
-    nscoord extraSpace = contentBoxHeight - wrappersMarginBoxHeight;
-    yoffset += std::max(0, extraSpace / 2);
+    // Center child in block axis
+    nscoord extraSpace = contentBoxBSize - wrappersMarginBoxBSize;
+    wrapperOffset.B(myWM) += std::max(0, extraSpace / 2);
+
+    // Needed in FinishReflowChild, for logical-to-physical conversion:
+    nscoord borderBoxWidth = myWM.IsVertical() ?
+      borderBoxBSize : borderBoxISize;

    // Place the child
    FinishReflowChild(outerWrapperFrame, aPresContext, wrappersDesiredSize,
-                      &wrapperReflowState, xoffset, yoffset, 0);
+                      &wrapperReflowState, myWM, wrapperOffset,
+                      borderBoxWidth, 0);

    aDesiredSize.SetBlockStartAscent(
       wrappersDesiredSize.BlockStartAscent() +
       outerWrapperFrame->BStart(aReflowState.GetWritingMode(),
-                                 contentBoxWidth));
+                                 contentBoxISize));
  }

-  aDesiredSize.Width() = contentBoxWidth +
-                         aReflowState.ComputedPhysicalBorderPadding().LeftRight();
-  aDesiredSize.Height() = contentBoxHeight +
-                          aReflowState.ComputedPhysicalBorderPadding().TopBottom();
+  LogicalSize logicalDesiredSize(myWM, borderBoxISize, borderBoxBSize);
+  aDesiredSize.SetSize(myWM, logicalDesiredSize);

  aDesiredSize.SetOverflowAreasToDesiredBounds();

--- a/layout/generic/nsFlexContainerFrame.cpp
+++ b/layout/generic/nsFlexContainerFrame.cpp
@ -152,11 +152,13 @@ PhysicalCoordFromFlexRelativeCoord(nscoord aFlexRelativeCoord,
  (axisTracker_).IsCrossAxisHorizontal() ? (width_) : (height_)

 // Logical versions of helper-macros above:
-#define GET_MAIN_COMPONENT_LOGICAL(axisTracker_, isize_, bsize_)  \
+#define GET_MAIN_COMPONENT_LOGICAL(axisTracker_, wm_, isize_, bsize_)  \
+  wm_.IsOrthogonalTo(axisTracker_.GetWritingMode()) != \
    (axisTracker_).IsRowOriented() ? (isize_) : (bsize_)

-#define GET_CROSS_COMPONENT_LOGICAL(axisTracker_, inline_, block_)  \
-  (axisTracker_).IsRowOriented() ? (block_) : (inline_)
+#define GET_CROSS_COMPONENT_LOGICAL(axisTracker_, wm_, isize_, bsize_)  \
+  wm_.IsOrthogonalTo(axisTracker_.GetWritingMode()) != \
+    (axisTracker_).IsRowOriented() ? (bsize_) : (isize_)

 // Encapsulates our flex container's main & cross axes.
 class MOZ_STACK_CLASS nsFlexContainerFrame::FlexboxAxisTracker {
@ -180,6 +182,9 @@ public:
  }
  // XXXdholbert [END DEPRECATED]

+  // Returns the flex container's writing mode.
+  WritingMode GetWritingMode() const { return mWM; }
+
  // Returns true if our main axis is in the reverse direction of our
  // writing mode's corresponding axis. (From 'flex-direction: *-reverse')
  bool IsMainAxisReversed() const {
@ -327,7 +332,11 @@ public:
           const FlexboxAxisTracker& aAxisTracker);

  // Simplified constructor, to be used only for generating "struts":
-  FlexItem(nsIFrame* aChildFrame, nscoord aCrossSize);
+  // (NOTE: This "strut" constructor uses the *container's* writing mode, which
+  // we'll use on this FlexItem instead of the child frame's real writing mode.
+  // This is fine - it doesn't matter what writing mode we use for a
+  // strut, since it won't render any content and we already know its size.)
+  FlexItem(nsIFrame* aChildFrame, nscoord aCrossSize, WritingMode aContainerWM);

  // Accessors
  nsIFrame* Frame() const          { return mFrame; }
@ -360,10 +369,9 @@ public:
      // will matter more (& can be expanded/tested) once we officially support
      // logical directions & vertical writing-modes in flexbox, in bug 1079155
      // or a dependency.
-      WritingMode wm = mFrame->GetWritingMode();
      // Use GetFirstLineBaseline(), or just GetBaseline() if that fails.
-      if (!nsLayoutUtils::GetFirstLineBaseline(wm, mFrame, &mAscent)) {
-        mAscent = mFrame->GetLogicalBaseline(wm);
+      if (!nsLayoutUtils::GetFirstLineBaseline(mWM, mFrame, &mAscent)) {
+        mAscent = mFrame->GetLogicalBaseline(mWM);
      }
    }
    return mAscent;
@ -415,6 +423,7 @@ public:
  // visibility:collapse.
  bool IsStrut() const             { return mIsStrut; }

+  WritingMode GetWritingMode() const { return mWM; }
  uint8_t GetAlignSelf() const     { return mAlignSelf; }

  // Returns the flex factor (flex-grow or flex-shrink), depending on
@ -693,6 +702,7 @@ protected:
  // Does this item need to resolve a min-[width|height]:auto (in main-axis).
  bool mNeedsMinSizeAutoResolution;

+  const WritingMode mWM; // The flex item's writing mode.
  uint8_t mAlignSelf; // My "align-self" computed value (with "auto"
                      // swapped out for parent"s "align-items" value,
                      // in our constructor).
@ -1055,16 +1065,17 @@ nsFlexContainerFrame::GenerateFlexItemForChild(
  const nsStylePosition* stylePos = aChildFrame->StylePosition();
  float flexGrow   = stylePos->mFlexGrow;
  float flexShrink = stylePos->mFlexShrink;
+  WritingMode childWM = childRS.GetWritingMode();

  // MAIN SIZES (flex base size, min/max size)
  // -----------------------------------------
-  nscoord flexBaseSize = GET_MAIN_COMPONENT_LOGICAL(aAxisTracker,
+  nscoord flexBaseSize = GET_MAIN_COMPONENT_LOGICAL(aAxisTracker, childWM,
                                                    childRS.ComputedISize(),
                                                    childRS.ComputedBSize());
-  nscoord mainMinSize = GET_MAIN_COMPONENT_LOGICAL(aAxisTracker,
+  nscoord mainMinSize = GET_MAIN_COMPONENT_LOGICAL(aAxisTracker, childWM,
                                                   childRS.ComputedMinISize(),
                                                   childRS.ComputedMinBSize());
-  nscoord mainMaxSize = GET_MAIN_COMPONENT_LOGICAL(aAxisTracker,
+  nscoord mainMaxSize = GET_MAIN_COMPONENT_LOGICAL(aAxisTracker, childWM,
                                                   childRS.ComputedMaxISize(),
                                                   childRS.ComputedMaxBSize());
  // This is enforced by the nsHTMLReflowState where these values come from:
@ -1076,15 +1087,15 @@ nsFlexContainerFrame::GenerateFlexItemForChild(
  // or we might resolve it to something else in SizeItemInCrossAxis(); hence,
  // it's tentative. See comment under "Cross Size Determination" for more.
  nscoord tentativeCrossSize =
-    GET_CROSS_COMPONENT_LOGICAL(aAxisTracker,
+    GET_CROSS_COMPONENT_LOGICAL(aAxisTracker, childWM,
                                childRS.ComputedISize(),
                                childRS.ComputedBSize());
  nscoord crossMinSize =
-    GET_CROSS_COMPONENT_LOGICAL(aAxisTracker,
+    GET_CROSS_COMPONENT_LOGICAL(aAxisTracker, childWM,
                                childRS.ComputedMinISize(),
                                childRS.ComputedMinBSize());
  nscoord crossMaxSize =
-    GET_CROSS_COMPONENT_LOGICAL(aAxisTracker,
+    GET_CROSS_COMPONENT_LOGICAL(aAxisTracker, childWM,
                                childRS.ComputedMaxISize(),
                                childRS.ComputedMaxBSize());

@ -1205,7 +1216,7 @@ CrossSizeToUseWithRatio(const FlexItem& aFlexItem,

  if (IsCrossSizeDefinite(aItemReflowState, aAxisTracker)) {
    // Definite cross size.
-    return GET_CROSS_COMPONENT_LOGICAL(aAxisTracker,
+    return GET_CROSS_COMPONENT_LOGICAL(aAxisTracker, aFlexItem.GetWritingMode(),
                                       aItemReflowState.ComputedISize(),
                                       aItemReflowState.ComputedBSize());
  }
@ -1213,7 +1224,7 @@ CrossSizeToUseWithRatio(const FlexItem& aFlexItem,
  if (aMinSizeFallback) {
    // Indefinite cross-size, and we're resolving main min-size, so we'll fall
    // back to ussing the cross min-size (which should be definite).
-    return GET_CROSS_COMPONENT_LOGICAL(aAxisTracker,
+    return GET_CROSS_COMPONENT_LOGICAL(aAxisTracker, aFlexItem.GetWritingMode(),
                                       aItemReflowState.ComputedMinISize(),
                                       aItemReflowState.ComputedMinBSize());
  }
@ -1275,7 +1286,7 @@ PartiallyResolveAutoMinSize(const FlexItem& aFlexItem,

  // * the computed max-width (max-height), if that value is definite:
  nscoord maxSize =
-    GET_MAIN_COMPONENT_LOGICAL(aAxisTracker,
+    GET_MAIN_COMPONENT_LOGICAL(aAxisTracker, aFlexItem.GetWritingMode(),
                               aItemReflowState.ComputedMaxISize(),
                               aItemReflowState.ComputedMaxBSize());
  if (maxSize != NS_UNCONSTRAINEDSIZE) {
@ -1379,7 +1390,7 @@ nsFlexContainerFrame::
    // XXXdholbert Maybe this should share logic with ComputeCrossSize()...
    // Alternately, maybe tentative container cross size should be passed down.
    nscoord containerCrossSize =
-      GET_CROSS_COMPONENT_LOGICAL(aAxisTracker,
+      GET_CROSS_COMPONENT_LOGICAL(aAxisTracker, aAxisTracker.GetWritingMode(),
                                  flexContainerRS->ComputedISize(),
                                  flexContainerRS->ComputedBSize());
    // Is container's cross size "definite"?
@ -1554,6 +1565,7 @@ FlexItem::FlexItem(nsHTMLReflowState& aFlexItemReflowState,
    mIsStretched(false),
    mIsStrut(false),
    // mNeedsMinSizeAutoResolution is initialized in CheckForMinSizeAuto()
+    mWM(aFlexItemReflowState.GetWritingMode()),
    mAlignSelf(aFlexItemReflowState.mStylePosition->mAlignSelf)
 {
  MOZ_ASSERT(mFrame, "expecting a non-null child frame");
@ -1605,7 +1617,8 @@ FlexItem::FlexItem(nsHTMLReflowState& aFlexItemReflowState,
 // Simplified constructor for creating a special "strut" FlexItem, for a child
 // with visibility:collapse. The strut has 0 main-size, and it only exists to
 // impose a minimum cross size on whichever FlexLine it ends up in.
-FlexItem::FlexItem(nsIFrame* aChildFrame, nscoord aCrossSize)
+FlexItem::FlexItem(nsIFrame* aChildFrame, nscoord aCrossSize,
+                   WritingMode aContainerWM)
  : mFrame(aChildFrame),
    mFlexGrow(0.0f),
    mFlexShrink(0.0f),
@ -1629,6 +1642,7 @@ FlexItem::FlexItem(nsIFrame* aChildFrame, nscoord aCrossSize)
    mIsStretched(false),
    mIsStrut(true), // (this is the constructor for making struts, after all)
    mNeedsMinSizeAutoResolution(false),
+    mWM(aContainerWM),
    mAlignSelf(NS_STYLE_ALIGN_ITEMS_FLEX_START)
 {
  MOZ_ASSERT(mFrame, "expecting a non-null child frame");
@ -3116,7 +3130,7 @@ nsFlexContainerFrame::GenerateFlexLines(
    // least wrap when we hit its max main-size.
    if (wrapThreshold == NS_UNCONSTRAINEDSIZE) {
      const nscoord flexContainerMaxMainSize =
-        GET_MAIN_COMPONENT_LOGICAL(aAxisTracker,
+        GET_MAIN_COMPONENT_LOGICAL(aAxisTracker, aAxisTracker.GetWritingMode(),
                                   aReflowState.ComputedMaxISize(),
                                   aReflowState.ComputedMaxBSize());

@ -3152,7 +3166,8 @@ nsFlexContainerFrame::GenerateFlexLines(
        aStruts[nextStrutIdx].mItemIdx == itemIdxInContainer) {

      // Use the simplified "strut" FlexItem constructor:
-      item = new FlexItem(childFrame, aStruts[nextStrutIdx].mStrutCrossSize);
+      item = new FlexItem(childFrame, aStruts[nextStrutIdx].mStrutCrossSize,
+                          aReflowState.GetWritingMode());
      nextStrutIdx++;
    } else {
      item = GenerateFlexItemForChild(aPresContext, childFrame,
--- a/layout/reftests/forms/input/number/number-similar-to-text-unthemed-rtl-ref.html
+++ b/layout/reftests/forms/input/number/number-similar-to-text-unthemed-rtl-ref.html
@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <body style="direction: rtl">
+    <input type="text" style="-moz-appearance:none; width:200px;" value="1">
+    <!-- div to cover spin box area -->
+    <div style="display:block; position:absolute; background-color:black; width:200px; height:100px; top:0px; right:100px;"></div>
+  </body>
+</html>
--- a/layout/reftests/forms/input/number/number-similar-to-text-unthemed-rtl.html
+++ b/layout/reftests/forms/input/number/number-similar-to-text-unthemed-rtl.html
@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <body style="direction: rtl">
+    <input type="number" style="-moz-appearance:none; width:200px;" value="1">
+    <!-- div to cover spin box area -->
+    <div style="display:block; position:absolute; background-color:black; width:200px; height:100px; top:0px; right:100px;"></div>
+  </body>
+</html>
--- a/layout/reftests/forms/input/number/reftest.list
+++ b/layout/reftests/forms/input/number/reftest.list
@ -9,6 +9,7 @@ skip-if(!Android&&!B2G&&!Mulet) == number-same-as-text-unthemed.html number-same

 # should look the same as type=text, except for the spin box
 == number-similar-to-text-unthemed.html number-similar-to-text-unthemed-ref.html
+== number-similar-to-text-unthemed-rtl.html number-similar-to-text-unthemed-rtl-ref.html

 # dynamic type changes:
 fuzzy-if(/^Windows\x20NT\x205\.1/.test(http.oscpu),64,4) fuzzy-if(cocoaWidget,63,4) == to-number-from-other-type-unthemed-1.html to-number-from-other-type-unthemed-1-ref.html
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-007-ref.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-007-ref.html
@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      width: 40px;
+      height: 30px;
+      border: 1px solid gray;
+      margin-bottom: 5px;
+    }
+    .flexContainer > * {
+      width: 20px;
+      height: 15px;
+      float: left;
+    }
+    .item1 {
+      /* Note: flex items are ordered as "CMYK": cyan, magenta, yellow, black */
+      background: cyan;
+    }
+    .item2 {
+      background: magenta;
+    }
+    .item3 {
+      background: yellow;
+    }
+    .item4 {
+      background: black;
+    }
+  </style>
+</head>
+<body>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-007.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-007.html
@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Test: Verify that explicit sizes are honored on flex items whose writing-mode may differ from the flex container's writing-mode</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#layout-algorithm">
+  <link rel="help" href="http://www.w3.org/TR/css-writing-modes-3/#propdef-writing-mode">
+  <link rel="match" href="flexbox-writing-mode-007-ref.html">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      display: flex;
+      width: 40px;
+      height: 30px;
+      border: 1px solid gray;
+      margin-bottom: 5px;
+      writing-mode: horizontal-tb;
+      flex-flow: row wrap;
+    }
+    .flexContainer > * {
+      width: 20px;
+      height: 15px;
+    }
+    .item1 {
+      /* Note: flex items are ordered as "CMYK": cyan, magenta, yellow, black */
+      background: cyan;
+    }
+    .item2 {
+      background: magenta;
+    }
+    .item3 {
+      background: yellow;
+    }
+    .item4 {
+      background: black;
+    }
+
+    /* Classes applied to flex container, to customize its children
+     * (which should not affect their sizing):
+     */
+    .kids_horizontal_tb > * {
+      writing-mode: horizontal-tb;
+    }
+    .kids_vertical_lr > * {
+      writing-mode: vertical-lr;
+    }
+    .kids_vertical_rl > * {
+      writing-mode: vertical-rl;
+    }
+
+  </style>
+</head>
+<body>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_horizontal_tb">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_vertical_lr">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_vertical_rl">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-008-ref.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-008-ref.html
@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      width: 40px;
+      height: 30px;
+      border: 1px solid gray;
+      margin-bottom: 5px;
+    }
+    .flexContainer > * {
+      width: 20px;
+      height: 15px;
+      float: left;
+    }
+    .item1 {
+      /* Note: flex items are ordered as "CMYK": cyan, magenta, yellow, black */
+      background: cyan;
+    }
+    .item2 {
+      background: magenta;
+    }
+    .item3 {
+      background: yellow;
+    }
+    .item4 {
+      background: black;
+    }
+  </style>
+</head>
+<body>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item3"></div>
+    <div class="item2"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item3"></div>
+    <div class="item2"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item3"></div>
+    <div class="item2"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item3"></div>
+    <div class="item2"></div><div class="item4"></div>
+  </div>
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-008.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-008.html
@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Test: Verify that explicit sizes are honored on flex items whose writing-mode may differ from the flex container's writing-mode</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#layout-algorithm">
+  <link rel="help" href="http://www.w3.org/TR/css-writing-modes-3/#propdef-writing-mode">
+  <link rel="match" href="flexbox-writing-mode-008-ref.html">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      display: flex;
+      width: 40px;
+      height: 30px;
+      border: 1px solid gray;
+      margin-bottom: 5px;
+      writing-mode: vertical-lr;
+      flex-flow: row wrap;
+    }
+    .flexContainer > * {
+      width: 20px;
+      height: 15px;
+    }
+    .item1 {
+      /* Note: flex items are ordered as "CMYK": cyan, magenta, yellow, black */
+      background: cyan;
+    }
+    .item2 {
+      background: magenta;
+    }
+    .item3 {
+      background: yellow;
+    }
+    .item4 {
+      background: black;
+    }
+
+    /* Classes applied to flex container, to customize its children
+     * (which should not affect their sizing):
+     */
+    .kids_horizontal_tb > * {
+      writing-mode: horizontal-tb;
+    }
+    .kids_vertical_lr > * {
+      writing-mode: vertical-lr;
+    }
+    .kids_vertical_rl > * {
+      writing-mode: vertical-rl;
+    }
+
+  </style>
+</head>
+<body>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_horizontal_tb">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_vertical_lr">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_vertical_rl">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-009-ref.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-009-ref.html
@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Reftest Reference</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      width: 40px;
+      height: 30px;
+      border: 1px solid gray;
+      margin-bottom: 5px;
+    }
+    .flexContainer > * {
+      width: 20px;
+      height: 15px;
+      float: left;
+    }
+    .item1 {
+      /* Note: flex items are ordered as "CMYK": cyan, magenta, yellow, black */
+      background: cyan;
+    }
+    .item2 {
+      background: magenta;
+    }
+    .item3 {
+      background: yellow;
+    }
+    .item4 {
+      background: black;
+    }
+  </style>
+</head>
+<body>
+  <div class="flexContainer">
+    <div class="item3"></div><div class="item1"></div>
+    <div class="item4"></div><div class="item2"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item3"></div><div class="item1"></div>
+    <div class="item4"></div><div class="item2"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item3"></div><div class="item1"></div>
+    <div class="item4"></div><div class="item2"></div>
+  </div>
+  <div class="flexContainer">
+    <div class="item3"></div><div class="item1"></div>
+    <div class="item4"></div><div class="item2"></div>
+  </div>
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-009.html
+++ b/layout/reftests/w3c-css/submitted/flexbox/flexbox-writing-mode-009.html
@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+<head>
+  <title>CSS Test: Verify that explicit sizes are honored on flex items whose writing-mode may differ from the flex container's writing-mode</title>
+  <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#layout-algorithm">
+  <link rel="help" href="http://www.w3.org/TR/css-writing-modes-3/#propdef-writing-mode">
+  <link rel="match" href="flexbox-writing-mode-009-ref.html">
+  <meta charset="utf-8">
+  <style>
+    .flexContainer {
+      display: flex;
+      width: 40px;
+      height: 30px;
+      border: 1px solid gray;
+      margin-bottom: 5px;
+      writing-mode: vertical-rl;
+      flex-flow: row wrap;
+    }
+    .flexContainer > * {
+      width: 20px;
+      height: 15px;
+    }
+    .item1 {
+      /* Note: flex items are ordered as "CMYK": cyan, magenta, yellow, black */
+      background: cyan;
+    }
+    .item2 {
+      background: magenta;
+    }
+    .item3 {
+      background: yellow;
+    }
+    .item4 {
+      background: black;
+    }
+
+    /* Classes applied to flex container, to customize its children
+     * (which should not affect their sizing):
+     */
+    .kids_horizontal_tb > * {
+      writing-mode: horizontal-tb;
+    }
+    .kids_vertical_lr > * {
+      writing-mode: vertical-lr;
+    }
+    .kids_vertical_rl > * {
+      writing-mode: vertical-rl;
+    }
+
+  </style>
+</head>
+<body>
+  <div class="flexContainer">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_horizontal_tb">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_vertical_lr">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+  <div class="flexContainer kids_vertical_rl">
+    <div class="item1"></div><div class="item2"></div>
+    <div class="item3"></div><div class="item4"></div>
+  </div>
+</body>
+</html>
--- a/layout/reftests/w3c-css/submitted/flexbox/reftest.list
+++ b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
@ -190,3 +190,6 @@ test-pref(layout.css.vertical-text.enabled,true) == flexbox-writing-mode-003.htm
 test-pref(layout.css.vertical-text.enabled,true) == flexbox-writing-mode-004.html flexbox-writing-mode-004-ref.html
 test-pref(layout.css.vertical-text.enabled,true) fails == flexbox-writing-mode-005.html flexbox-writing-mode-005-ref.html # bug 1131451
 test-pref(layout.css.vertical-text.enabled,true) fails == flexbox-writing-mode-006.html flexbox-writing-mode-006-ref.html # bug 1131451
+test-pref(layout.css.vertical-text.enabled,true) == flexbox-writing-mode-007.html flexbox-writing-mode-007-ref.html
+test-pref(layout.css.vertical-text.enabled,true) == flexbox-writing-mode-008.html flexbox-writing-mode-008-ref.html
+test-pref(layout.css.vertical-text.enabled,true) == flexbox-writing-mode-009.html flexbox-writing-mode-009-ref.html
--- a/layout/reftests/xul/colors-16x8-noSize.svg
+++ b/layout/reftests/xul/colors-16x8-noSize.svg
@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- This SVG file has an aspect-ratio (from its viewBox attribute),
+     but no intrinsic size.
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     viewBox="0 0 16 8">
+  <rect x="0" y="0" width="8px" height="4px" style="fill: blue"/>
+  <rect x="8" y="0" width="8px" height="4px" style="fill: black"/>
+  <rect x="0" y="4" width="8px" height="4px" style="fill: rgb(255,128,128)"/>
+  <rect x="8" y="4" width="8px" height="4px" style="fill: lime"/>
+</svg>
--- a/layout/reftests/xul/colors-16x8-parDefault.svg
+++ b/layout/reftests/xul/colors-16x8-parDefault.svg
@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- This SVG file has the default preserveAspectRatio (xMidyMid meet).
+
+     If it's rendered via e.g. a square <img> element with 'object-fit: fill',
+     the SVG will receive the <img>'s full content-box to use as its viewport.
+     But, importantly, its viewBox-region should NOT be stretched/squashed to
+     fill this viewport; instead, the viewBox will scale *proportionally* until
+     it *just* fits inside the viewport (the <img>), without overflowing, and
+     it'll be centered inside the viewport in whichever dimension has extra
+     space available. (This is what "xMidYMid meet" requires.)
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     width="16" height="8" viewBox="0 0 16 8">
+  <rect x="0" y="0" width="8px" height="4px" style="fill: blue"/>
+  <rect x="8" y="0" width="8px" height="4px" style="fill: black"/>
+  <rect x="0" y="4" width="8px" height="4px" style="fill: rgb(255,128,128)"/>
+  <rect x="8" y="4" width="8px" height="4px" style="fill: lime"/>
+</svg>
--- a/layout/reftests/xul/colors-16x8.png
+++ b/layout/reftests/xul/colors-16x8.png
--- a/layout/reftests/xul/colors-16x8.svg
+++ b/layout/reftests/xul/colors-16x8.svg
@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- This SVG file is meant to mimic colors-8x16.png as closely
+     as possible. In particular, this SVG has:
+      (1) an intrinsic size (from the 'width' & 'height' attributes)
+      (2) preserveAspectRatio="none", allowing it to stretch in the
+          same way that a raster image would.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="none"
+     width="16" height="8" viewBox="0 0 16 8">
+  <rect x="0" y="0" width="8px" height="4px" style="fill: blue"/>
+  <rect x="8" y="0" width="8px" height="4px" style="fill: black"/>
+  <rect x="0" y="4" width="8px" height="4px" style="fill: rgb(255,128,128)"/>
+  <rect x="8" y="4" width="8px" height="4px" style="fill: lime"/>
+</svg>
--- a/layout/reftests/xul/colors-8x16-noSize.svg
+++ b/layout/reftests/xul/colors-8x16-noSize.svg
@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- This SVG file has an aspect-ratio (from its viewBox attribute),
+     but no intrinsic size.
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     viewBox="0 0 8 16">
+  <rect x="0" y="0" width="4px" height="8px" style="fill: blue"/>
+  <rect x="4" y="0" width="4px" height="8px" style="fill: black"/>
+  <rect x="0" y="8" width="4px" height="8px" style="fill: rgb(255,128,128)"/>
+  <rect x="4" y="8" width="4px" height="8px" style="fill: lime"/>
+</svg>
--- a/layout/reftests/xul/colors-8x16-parDefault.svg
+++ b/layout/reftests/xul/colors-8x16-parDefault.svg
@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- This SVG file has the default preserveAspectRatio (xMidyMid meet).
+
+     If it's rendered via e.g. a square <img> element with 'object-fit: fill',
+     the SVG will receive the <img>'s full content-box to use as its viewport.
+     But, importantly, its viewBox-region should NOT be stretched/squashed to
+     fill this viewport; instead, the viewBox will scale *proportionally* until
+     it *just* fits inside the viewport (the <img>), without overflowing, and
+     it'll be centered inside the viewport in whichever dimension has extra
+     space available. (This is what "xMidYMid meet" requires.)
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     width="8" height="16" viewBox="0 0 8 16">
+  <rect x="0" y="0" width="4px" height="8px" style="fill: blue"/>
+  <rect x="4" y="0" width="4px" height="8px" style="fill: black"/>
+  <rect x="0" y="8" width="4px" height="8px" style="fill: rgb(255,128,128)"/>
+  <rect x="4" y="8" width="4px" height="8px" style="fill: lime"/>
+</svg>
--- a/layout/reftests/xul/colors-8x16.png
+++ b/layout/reftests/xul/colors-8x16.png
--- a/layout/reftests/xul/colors-8x16.svg
+++ b/layout/reftests/xul/colors-8x16.svg
@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- This SVG file is meant to mimic colors-8x16.png as closely
+     as possible. In particular, this SVG has:
+      (1) an intrinsic size (from the 'width' & 'height' attributes)
+      (2) preserveAspectRatio="none", allowing it to stretch in the
+          same way that a raster image would.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="none"
+     width="8" height="16" viewBox="0 0 8 16">
+  <rect x="0" y="0" width="4px" height="8px" style="fill: blue"/>
+  <rect x="4" y="0" width="4px" height="8px" style="fill: black"/>
+  <rect x="0" y="8" width="4px" height="8px" style="fill: rgb(255,128,128)"/>
+  <rect x="4" y="8" width="4px" height="8px" style="fill: lime"/>
+</svg>
--- a/layout/reftests/xul/generate-object-fit-xul-tests.sh
+++ b/layout/reftests/xul/generate-object-fit-xul-tests.sh
@ -0,0 +1,95 @@
+#!/bin/bash
+#
+# Any copyright is dedicated to the Public Domain.
+# http://creativecommons.org/publicdomain/zero/1.0/
+#
+# Script to generate XUL <image> reftest files, from corresponding reftest
+# files that use <img>.
+#
+# This script expects to be run from this working directory:
+#  mozilla-central/layout/reftests/w3c-css/submitted/images3
+
+XUL_REFTEST_PATH="../../../xul"
+
+imageFileArr=("colors-16x8.png"            "colors-8x16.png"
+              "colors-16x8.svg"            "colors-8x16.svg"
+              "colors-16x8-noSize.svg"     "colors-8x16-noSize.svg"
+              "colors-16x8-parDefault.svg" "colors-8x16-parDefault.svg")
+numImageFiles=${#imageFileArr[@]}
+
+# Copy image files
+for ((i = 0; i < $numImageFiles; i++)); do
+  imageFileName=${imageFileArr[$i]}
+  imageDest=$XUL_REFTEST_PATH/$imageFileName
+
+  echo "Copying $imageDest."
+  hg cp support/$imageFileName $imageDest
+done
+
+# Add comment & default-preferences line to reftest.list in dest directory:
+reftestListFileName="$XUL_REFTEST_PATH/reftest.list"
+echo "
+# Tests for XUL <image> with 'object-fit' & 'object-position':
+# These tests should be very similar to tests in our w3c-css/submitted/images3
+# reftest directory. They live here because they use XUL, and it
+# wouldn't be fair of us to make a W3C testsuite implicitly depend on XUL.
+default-preferences test-pref(layout.css.object-fit-and-position.enabled,true)"\
+  >> $reftestListFileName
+
+# Loop across all object-fit tests that use <img> ("i" suffix):
+for origTestName in object-fit*i.html; do
+  newTestName=$(echo $origTestName |
+                sed "s/i.html/.xul/")
+
+  # Find the corresponding reference case:
+  referenceName=$(echo $origTestName |
+                  sed "s/i.html/-ref.html/")
+
+  # Generate reference file (dropping "support" subdir from image paths):
+  echo "Copying $referenceName to $XUL_REFTEST_PATH."
+  newReferenceFullPath=$XUL_REFTEST_PATH/$referenceName
+  hg cp $referenceName $newReferenceFullPath
+  sed -i "s,support/,," $newReferenceFullPath
+
+  # Generate testcase
+  # (converting <video poster="support/foo.png"> to <video src="foo.webm">):
+  echo "Generating $newTestName from $origTestName."
+  newTestFullPath=$XUL_REFTEST_PATH/$newTestName
+  hg cp $origTestName $newTestFullPath
+
+  # Replace doctype with XML decl:
+  sed -i "s/<!DOCTYPE html>/<?xml version=\"1.0\"?>/" $newTestFullPath
+
+  # Replace html tags with window tags:
+  sed -i "s,<html>,<window xmlns=\"http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\">," $newTestFullPath
+  sed -i "s,</html>,</window>," $newTestFullPath
+
+  # Delete a bunch of HTML (not XUL) / W3C-testsuite boilerplate:
+  sed -i "/head>/d" $newTestFullPath # Delete head open & close tags
+  sed -i "/body>/d" $newTestFullPath # Delete body open & close tags
+  sed -i "/<meta/d" $newTestFullPath # Delete meta charset tag
+  sed -i "/<title/d" $newTestFullPath # Delete title line
+  sed -i "/<link/d" $newTestFullPath # Delete link tags
+
+  # Add 4px to all sizes, since in XUL, sizes are for border-box
+  # instead of content-box.
+  sed -i "s/ 48px/ 52px/" $newTestFullPath
+  sed -i "s/ 32px/ 36px/" $newTestFullPath
+  sed -i "s/ 8px/ 12px/" $newTestFullPath
+
+  # Fix style open/close tags, and add 8px of padding on outer <window> to
+  # match our HTML reference case, and change style rule to target <image>:
+  sed -i "s,  <style type=\"text/css\">,\<style xmlns=\"http://www.w3.org/1999/xhtml\"><![CDATA[\n      window { padding: 8px; }," $newTestFullPath
+  sed -i "s,  </style>,]]></style>," $newTestFullPath
+  sed -i "s/img {/image {/" $newTestFullPath
+
+  sed -i "s,support/,," $newTestFullPath
+  sed -i "s,<img\(.*\)>,<image\1/>," $newTestFullPath
+  sed -i "s,  <!--,<hbox>\n    <!--," $newTestFullPath
+  sed -i "s,  <br>,</hbox>," $newTestFullPath
+
+  # Update reftest manifest:
+  echo "== $newTestName $referenceName" \
+    >> $reftestListFileName
+
+done
--- a/layout/reftests/xul/generate-object-position-xul-tests.sh
+++ b/layout/reftests/xul/generate-object-position-xul-tests.sh
@ -0,0 +1,68 @@
+#!/bin/bash
+#
+# Any copyright is dedicated to the Public Domain.
+# http://creativecommons.org/publicdomain/zero/1.0/
+#
+# Script to generate XUL <image> reftest files, from corresponding reftest
+# files that use <img>.
+#
+# This script expects to be run from this working directory:
+#  mozilla-central/layout/reftests/w3c-css/submitted/images3
+# and it expects to be run *after* generate-object-fit-xul-tests.sh, since the
+# copied test files will make use of image resources which are copied by that
+# other script.
+
+XUL_REFTEST_PATH="../../../xul"
+
+reftestListFileName="$XUL_REFTEST_PATH/reftest.list"
+
+# Loop across all object-position tests that use <img> ("i" suffix):
+for origTestName in object-position-png-*i.html; do
+  newTestName=$(echo $origTestName |
+                sed "s/i.html/.xul/")
+
+  # Find the corresponding reference case:
+  referenceName=$(echo $origTestName |
+                  sed "s/i.html/-ref.html/")
+
+  # Generate reference file (dropping "support" subdir from image paths):
+  echo "Copying $referenceName to $XUL_REFTEST_PATH."
+  newReferenceFullPath=$XUL_REFTEST_PATH/$referenceName
+  hg cp $referenceName $newReferenceFullPath
+  sed -i "s,support/,," $newReferenceFullPath
+
+  # Generate testcase
+  # (converting <video poster="support/foo.png"> to <video src="foo.webm">):
+  echo "Generating $newTestName from $origTestName."
+  newTestFullPath=$XUL_REFTEST_PATH/$newTestName
+  hg cp $origTestName $newTestFullPath
+
+  # Replace doctype with XML decl:
+  sed -i "s/<!DOCTYPE html>/<?xml version=\"1.0\"?>/" $newTestFullPath
+
+  # Replace html tags with window tags:
+  sed -i "s,<html>,<window xmlns=\"http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\">," $newTestFullPath
+
+  # Delete a bunch of HTML (not XUL) / W3C-testsuite boilerplate:
+  sed -i "/head>/d" $newTestFullPath # Delete head open & close tags
+  sed -i "/body>/d" $newTestFullPath # Delete body open & close tags
+  sed -i "/<meta/d" $newTestFullPath # Delete meta charset tag
+  sed -i "/<title/d" $newTestFullPath # Delete title line
+  sed -i "/<link/d" $newTestFullPath # Delete link tags
+
+  # Fix style open/close tags, and add 8px of padding on outer <window> to
+  # match our HTML reference case, and change style rule to target <image>.
+  # Also, add <hbox> to wrap the image elements.
+  sed -i "s,  <style type=\"text/css\">,\<style xmlns=\"http://www.w3.org/1999/xhtml\"><![CDATA[\n      window { padding: 8px; }," $newTestFullPath
+  sed -i "s,  </style>,]]></style>\n  <hbox>," $newTestFullPath
+  sed -i "s,</html>,  </hbox>\n</window>," $newTestFullPath
+  sed -i "s/img {/image {/" $newTestFullPath
+
+  sed -i "s,support/,," $newTestFullPath
+  sed -i "s,<img\(.*\)>,<image\1/>," $newTestFullPath
+
+  # Update reftest manifest:
+  echo "== $newTestName $referenceName" \
+    >> $reftestListFileName
+
+done
--- a/layout/reftests/xul/object-fit-contain-png-001-ref.html
+++ b/layout/reftests/xul/object-fit-contain-png-001-ref.html
@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+    <style type="text/css">
+      .objectOuter {
+        border: 1px dashed gray;
+        padding: 1px;
+        float: left;
+      }
+      .objectOuter > * {
+        background-image: url("colors-16x8.png");
+        background-size: contain;
+        background-repeat: no-repeat;
+        image-rendering: -moz-crisp-edges;
+      }
+      .bigWide {
+        width: 48px;
+        height: 32px;
+      }
+      .bigTall {
+        width: 32px;
+        height: 48px;
+      }
+      .small {
+        width: 8px;
+        height: 8px;
+      }
+
+      br { clear: both; }
+
+      .tr { background-position: top right }
+      .bl { background-position: bottom left }
+      .tl { background-position: top 25% left 25% }
+      .br { background-position: bottom 1px right 2px }
+
+      .tc { background-position: top 3px center }
+      .cr { background-position: center right 25% }
+      .default { background-position: 50% 50% }
+    </style>
+  </head>
+  <body>
+    <!-- big/wide: -->
+    <div class="objectOuter"><div class="bigWide tr"></div></div>
+    <div class="objectOuter"><div class="bigWide bl"></div></div>
+    <div class="objectOuter"><div class="bigWide tl"></div></div>
+    <div class="objectOuter"><div class="bigWide br"></div></div>
+    <div class="objectOuter"><div class="bigWide tc"></div></div>
+    <div class="objectOuter"><div class="bigWide cr"></div></div>
+    <div class="objectOuter"><div class="bigWide default"></div></div>
+    <br>
+    <!-- big/tall: -->
+    <div class="objectOuter"><div class="bigTall tr"></div></div>
+    <div class="objectOuter"><div class="bigTall bl"></div></div>
+    <div class="objectOuter"><div class="bigTall tl"></div></div>
+    <div class="objectOuter"><div class="bigTall br"></div></div>
+    <div class="objectOuter"><div class="bigTall tc"></div></div>
+    <div class="objectOuter"><div class="bigTall cr"></div></div>
+    <div class="objectOuter"><div class="bigTall default"></div></div>
+    <br>
+    <!-- small: -->
+    <div class="objectOuter"><div class="small tr"></div></div>
+    <div class="objectOuter"><div class="small bl"></div></div>
+    <div class="objectOuter"><div class="small tl"></div></div>
+    <div class="objectOuter"><div class="small br"></div></div>
+    <div class="objectOuter"><div class="small tc"></div></div>
+    <div class="objectOuter"><div class="small cr"></div></div>
+    <div class="objectOuter"><div class="small default"></div></div>
+    <br>
+  </body>
+</html>
--- a/layout/reftests/xul/object-fit-contain-png-001.xul
+++ b/layout/reftests/xul/object-fit-contain-png-001.xul
@ -0,0 +1,70 @@
+<?xml version="1.0"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+      window { padding: 8px; }
+      image {
+        border: 1px dashed gray;
+        padding: 1px;
+        object-fit: contain;
+        image-rendering: -moz-crisp-edges;
+        float: left;
+      }
+
+      .bigWide {
+        width: 52px;
+        height: 36px;
+      }
+      .bigTall {
+        width: 36px;
+        height: 52px;
+      }
+      .small {
+        width: 12px;
+        height: 12px;
+      }
+
+      br { clear: both; }
+
+      .tr { object-position: top right }
+      .bl { object-position: bottom left }
+      .tl { object-position: top 25% left 25% }
+      .br { object-position: bottom 1px right 2px }
+
+      .tc { object-position: top 3px center }
+      .cr { object-position: center right 25% }
+  ]]></style>
+  <hbox>
+    <!-- big/wide: -->
+    <image src="colors-16x8.png" class="bigWide tr"/>
+    <image src="colors-16x8.png" class="bigWide bl"/>
+    <image src="colors-16x8.png" class="bigWide tl"/>
+    <image src="colors-16x8.png" class="bigWide br"/>
+    <image src="colors-16x8.png" class="bigWide tc"/>
+    <image src="colors-16x8.png" class="bigWide cr"/>
+    <image src="colors-16x8.png" class="bigWide"/>
+  </hbox>
+  <hbox>
+    <!-- big/tall: -->
+    <image src="colors-16x8.png" class="bigTall tr"/>
+    <image src="colors-16x8.png" class="bigTall bl"/>
+    <image src="colors-16x8.png" class="bigTall tl"/>
+    <image src="colors-16x8.png" class="bigTall br"/>
+    <image src="colors-16x8.png" class="bigTall tc"/>
+    <image src="colors-16x8.png" class="bigTall cr"/>
+    <image src="colors-16x8.png" class="bigTall"/>
+  </hbox>
+  <hbox>
+    <!-- small: -->
+    <image src="colors-16x8.png" class="small tr"/>
+    <image src="colors-16x8.png" class="small bl"/>
+    <image src="colors-16x8.png" class="small tl"/>
+    <image src="colors-16x8.png" class="small br"/>
+    <image src="colors-16x8.png" class="small tc"/>
+    <image src="colors-16x8.png" class="small cr"/>
+    <image src="colors-16x8.png" class="small"/>
+  </hbox>
+</window>
--- a/layout/reftests/xul/object-fit-contain-png-002-ref.html
+++ b/layout/reftests/xul/object-fit-contain-png-002-ref.html
@ -0,0 +1,77 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+    <style type="text/css">
+      .objectOuter {
+        border: 1px dashed gray;
+        padding: 1px;
+        float: left;
+      }
+      .objectOuter > * {
+        background-image: url("colors-8x16.png");
+        background-size: contain;
+        background-repeat: no-repeat;
+        image-rendering: -moz-crisp-edges;
+      }
+      .bigWide {
+        width: 48px;
+        height: 32px;
+      }
+      .bigTall {
+        width: 32px;
+        height: 48px;
+      }
+      .small {
+        width: 8px;
+        height: 8px;
+      }
+
+      br { clear: both; }
+
+      .tr { background-position: top right }
+      .bl { background-position: bottom left }
+      .tl { background-position: top 25% left 25% }
+      .br { background-position: bottom 1px right 2px }
+
+      .tc { background-position: top 3px center }
+      .cr { background-position: center right 25% }
+      .default { background-position: 50% 50% }
+    </style>
+  </head>
+  <body>
+    <!-- big/wide: -->
+    <div class="objectOuter"><div class="bigWide tr"></div></div>
+    <div class="objectOuter"><div class="bigWide bl"></div></div>
+    <div class="objectOuter"><div class="bigWide tl"></div></div>
+    <div class="objectOuter"><div class="bigWide br"></div></div>
+    <div class="objectOuter"><div class="bigWide tc"></div></div>
+    <div class="objectOuter"><div class="bigWide cr"></div></div>
+    <div class="objectOuter"><div class="bigWide default"></div></div>
+    <br>
+    <!-- big/tall: -->
+    <div class="objectOuter"><div class="bigTall tr"></div></div>
+    <div class="objectOuter"><div class="bigTall bl"></div></div>
+    <div class="objectOuter"><div class="bigTall tl"></div></div>
+    <div class="objectOuter"><div class="bigTall br"></div></div>
+    <div class="objectOuter"><div class="bigTall tc"></div></div>
+    <div class="objectOuter"><div class="bigTall cr"></div></div>
+    <div class="objectOuter"><div class="bigTall default"></div></div>
+    <br>
+    <!-- small: -->
+    <div class="objectOuter"><div class="small tr"></div></div>
+    <div class="objectOuter"><div class="small bl"></div></div>
+    <div class="objectOuter"><div class="small tl"></div></div>
+    <div class="objectOuter"><div class="small br"></div></div>
+    <div class="objectOuter"><div class="small tc"></div></div>
+    <div class="objectOuter"><div class="small cr"></div></div>
+    <div class="objectOuter"><div class="small default"></div></div>
+    <br>
+  </body>
+</html>
--- a/layout/reftests/xul/object-fit-contain-png-002.xul
+++ b/layout/reftests/xul/object-fit-contain-png-002.xul
@ -0,0 +1,70 @@
+<?xml version="1.0"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+      window { padding: 8px; }
+      image {
+        border: 1px dashed gray;
+        padding: 1px;
+        object-fit: contain;
+        image-rendering: -moz-crisp-edges;
+        float: left;
+      }
+
+      .bigWide {
+        width: 52px;
+        height: 36px;
+      }
+      .bigTall {
+        width: 36px;
+        height: 52px;
+      }
+      .small {
+        width: 12px;
+        height: 12px;
+      }
+
+      br { clear: both; }
+
+      .tr { object-position: top right }
+      .bl { object-position: bottom left }
+      .tl { object-position: top 25% left 25% }
+      .br { object-position: bottom 1px right 2px }
+
+      .tc { object-position: top 3px center }
+      .cr { object-position: center right 25% }
+  ]]></style>
+  <hbox>
+    <!-- big/wide: -->
+    <image src="colors-8x16.png" class="bigWide tr"/>
+    <image src="colors-8x16.png" class="bigWide bl"/>
+    <image src="colors-8x16.png" class="bigWide tl"/>
+    <image src="colors-8x16.png" class="bigWide br"/>
+    <image src="colors-8x16.png" class="bigWide tc"/>
+    <image src="colors-8x16.png" class="bigWide cr"/>
+    <image src="colors-8x16.png" class="bigWide"/>
+  </hbox>
+  <hbox>
+    <!-- big/tall: -->
+    <image src="colors-8x16.png" class="bigTall tr"/>
+    <image src="colors-8x16.png" class="bigTall bl"/>
+    <image src="colors-8x16.png" class="bigTall tl"/>
+    <image src="colors-8x16.png" class="bigTall br"/>
+    <image src="colors-8x16.png" class="bigTall tc"/>
+    <image src="colors-8x16.png" class="bigTall cr"/>
+    <image src="colors-8x16.png" class="bigTall"/>
+  </hbox>
+  <hbox>
+    <!-- small: -->
+    <image src="colors-8x16.png" class="small tr"/>
+    <image src="colors-8x16.png" class="small bl"/>
+    <image src="colors-8x16.png" class="small tl"/>
+    <image src="colors-8x16.png" class="small br"/>
+    <image src="colors-8x16.png" class="small tc"/>
+    <image src="colors-8x16.png" class="small cr"/>
+    <image src="colors-8x16.png" class="small"/>
+  </hbox>
+</window>
--- a/layout/reftests/xul/object-fit-contain-svg-001-ref.html
+++ b/layout/reftests/xul/object-fit-contain-svg-001-ref.html
@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+    <style type="text/css">
+      .objectOuter {
+        border: 1px dashed gray;
+        padding: 1px;
+        float: left;
+      }
+      .objectOuter > * {
+        background-image: url("colors-16x8.svg");
+        background-size: contain;
+        background-repeat: no-repeat;
+      }
+      .bigWide {
+        width: 48px;
+        height: 32px;
+      }
+      .bigTall {
+        width: 32px;
+        height: 48px;
+      }
+      .small {
+        width: 8px;
+        height: 8px;
+      }
+
+      br { clear: both; }
+
+      .tr { background-position: top right }
+      .bl { background-position: bottom left }
+      .tl { background-position: top 25% left 25% }
+      .br { background-position: bottom 1px right 2px }
+
+      .tc { background-position: top 3px center }
+      .cr { background-position: center right 25% }
+      .default { background-position: 50% 50% }
+    </style>
+  </head>
+  <body>
+    <!-- big/wide: -->
+    <div class="objectOuter"><div class="bigWide tr"></div></div>
+    <div class="objectOuter"><div class="bigWide bl"></div></div>
+    <div class="objectOuter"><div class="bigWide tl"></div></div>
+    <div class="objectOuter"><div class="bigWide br"></div></div>
+    <div class="objectOuter"><div class="bigWide tc"></div></div>
+    <div class="objectOuter"><div class="bigWide cr"></div></div>
+    <div class="objectOuter"><div class="bigWide default"></div></div>
+    <br>
+    <!-- big/tall: -->
+    <div class="objectOuter"><div class="bigTall tr"></div></div>
+    <div class="objectOuter"><div class="bigTall bl"></div></div>
+    <div class="objectOuter"><div class="bigTall tl"></div></div>
+    <div class="objectOuter"><div class="bigTall br"></div></div>
+    <div class="objectOuter"><div class="bigTall tc"></div></div>
+    <div class="objectOuter"><div class="bigTall cr"></div></div>
+    <div class="objectOuter"><div class="bigTall default"></div></div>
+    <br>
+    <!-- small: -->
+    <div class="objectOuter"><div class="small tr"></div></div>
+    <div class="objectOuter"><div class="small bl"></div></div>
+    <div class="objectOuter"><div class="small tl"></div></div>
+    <div class="objectOuter"><div class="small br"></div></div>
+    <div class="objectOuter"><div class="small tc"></div></div>
+    <div class="objectOuter"><div class="small cr"></div></div>
+    <div class="objectOuter"><div class="small default"></div></div>
+    <br>
+  </body>
+</html>
--- a/layout/reftests/xul/object-fit-contain-svg-001.xul
+++ b/layout/reftests/xul/object-fit-contain-svg-001.xul
@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+      window { padding: 8px; }
+      image {
+        border: 1px dashed gray;
+        padding: 1px;
+        object-fit: contain;
+        float: left;
+      }
+
+      .bigWide {
+        width: 52px;
+        height: 36px;
+      }
+      .bigTall {
+        width: 36px;
+        height: 52px;
+      }
+      .small {
+        width: 12px;
+        height: 12px;
+      }
+
+      br { clear: both; }
+
+      .tr { object-position: top right }
+      .bl { object-position: bottom left }
+      .tl { object-position: top 25% left 25% }
+      .br { object-position: bottom 1px right 2px }
+
+      .tc { object-position: top 3px center }
+      .cr { object-position: center right 25% }
+  ]]></style>
+  <hbox>
+    <!-- big/wide: -->
+    <image src="colors-16x8.svg" class="bigWide tr"/>
+    <image src="colors-16x8.svg" class="bigWide bl"/>
+    <image src="colors-16x8.svg" class="bigWide tl"/>
+    <image src="colors-16x8.svg" class="bigWide br"/>
+    <image src="colors-16x8.svg" class="bigWide tc"/>
+    <image src="colors-16x8.svg" class="bigWide cr"/>
+    <image src="colors-16x8.svg" class="bigWide"/>
+  </hbox>
+  <hbox>
+    <!-- big/tall: -->
+    <image src="colors-16x8.svg" class="bigTall tr"/>
+    <image src="colors-16x8.svg" class="bigTall bl"/>
+    <image src="colors-16x8.svg" class="bigTall tl"/>
+    <image src="colors-16x8.svg" class="bigTall br"/>
+    <image src="colors-16x8.svg" class="bigTall tc"/>
+    <image src="colors-16x8.svg" class="bigTall cr"/>
+    <image src="colors-16x8.svg" class="bigTall"/>
+  </hbox>
+  <hbox>
+    <!-- small: -->
+    <image src="colors-16x8.svg" class="small tr"/>
+    <image src="colors-16x8.svg" class="small bl"/>
+    <image src="colors-16x8.svg" class="small tl"/>
+    <image src="colors-16x8.svg" class="small br"/>
+    <image src="colors-16x8.svg" class="small tc"/>
+    <image src="colors-16x8.svg" class="small cr"/>
+    <image src="colors-16x8.svg" class="small"/>
+  </hbox>
+</window>
--- a/layout/reftests/xul/object-fit-contain-svg-002-ref.html
+++ b/layout/reftests/xul/object-fit-contain-svg-002-ref.html
@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+    <style type="text/css">
+      .objectOuter {
+        border: 1px dashed gray;
+        padding: 1px;
+        float: left;
+      }
+      .objectOuter > * {
+        background-image: url("colors-8x16.svg");
+        background-size: contain;
+        background-repeat: no-repeat;
+      }
+      .bigWide {
+        width: 48px;
+        height: 32px;
+      }
+      .bigTall {
+        width: 32px;
+        height: 48px;
+      }
+      .small {
+        width: 8px;
+        height: 8px;
+      }
+
+      br { clear: both; }
+
+      .tr { background-position: top right }
+      .bl { background-position: bottom left }
+      .tl { background-position: top 25% left 25% }
+      .br { background-position: bottom 1px right 2px }
+
+      .tc { background-position: top 3px center }
+      .cr { background-position: center right 25% }
+      .default { background-position: 50% 50% }
+    </style>
+  </head>
+  <body>
+    <!-- big/wide: -->
+    <div class="objectOuter"><div class="bigWide tr"></div></div>
+    <div class="objectOuter"><div class="bigWide bl"></div></div>
+    <div class="objectOuter"><div class="bigWide tl"></div></div>
+    <div class="objectOuter"><div class="bigWide br"></div></div>
+    <div class="objectOuter"><div class="bigWide tc"></div></div>
+    <div class="objectOuter"><div class="bigWide cr"></div></div>
+    <div class="objectOuter"><div class="bigWide default"></div></div>
+    <br>
+    <!-- big/tall: -->
+    <div class="objectOuter"><div class="bigTall tr"></div></div>
+    <div class="objectOuter"><div class="bigTall bl"></div></div>
+    <div class="objectOuter"><div class="bigTall tl"></div></div>
+    <div class="objectOuter"><div class="bigTall br"></div></div>
+    <div class="objectOuter"><div class="bigTall tc"></div></div>
+    <div class="objectOuter"><div class="bigTall cr"></div></div>
+    <div class="objectOuter"><div class="bigTall default"></div></div>
+    <br>
+    <!-- small: -->
+    <div class="objectOuter"><div class="small tr"></div></div>
+    <div class="objectOuter"><div class="small bl"></div></div>
+    <div class="objectOuter"><div class="small tl"></div></div>
+    <div class="objectOuter"><div class="small br"></div></div>
+    <div class="objectOuter"><div class="small tc"></div></div>
+    <div class="objectOuter"><div class="small cr"></div></div>
+    <div class="objectOuter"><div class="small default"></div></div>
+    <br>
+  </body>
+</html>
--- a/layout/reftests/xul/object-fit-contain-svg-002.xul
+++ b/layout/reftests/xul/object-fit-contain-svg-002.xul
@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+      window { padding: 8px; }
+      image {
+        border: 1px dashed gray;
+        padding: 1px;
+        object-fit: contain;
+        float: left;
+      }
+
+      .bigWide {
+        width: 52px;
+        height: 36px;
+      }
+      .bigTall {
+        width: 36px;
+        height: 52px;
+      }
+      .small {
+        width: 12px;
+        height: 12px;
+      }
+
+      br { clear: both; }
+
+      .tr { object-position: top right }
+      .bl { object-position: bottom left }
+      .tl { object-position: top 25% left 25% }
+      .br { object-position: bottom 1px right 2px }
+
+      .tc { object-position: top 3px center }
+      .cr { object-position: center right 25% }
+  ]]></style>
+  <hbox>
+    <!-- big/wide: -->
+    <image src="colors-8x16.svg" class="bigWide tr"/>
+    <image src="colors-8x16.svg" class="bigWide bl"/>
+    <image src="colors-8x16.svg" class="bigWide tl"/>
+    <image src="colors-8x16.svg" class="bigWide br"/>
+    <image src="colors-8x16.svg" class="bigWide tc"/>
+    <image src="colors-8x16.svg" class="bigWide cr"/>
+    <image src="colors-8x16.svg" class="bigWide"/>
+  </hbox>
+  <hbox>
+    <!-- big/tall: -->
+    <image src="colors-8x16.svg" class="bigTall tr"/>
+    <image src="colors-8x16.svg" class="bigTall bl"/>
+    <image src="colors-8x16.svg" class="bigTall tl"/>
+    <image src="colors-8x16.svg" class="bigTall br"/>
+    <image src="colors-8x16.svg" class="bigTall tc"/>
+    <image src="colors-8x16.svg" class="bigTall cr"/>
+    <image src="colors-8x16.svg" class="bigTall"/>
+  </hbox>
+  <hbox>
+    <!-- small: -->
+    <image src="colors-8x16.svg" class="small tr"/>
+    <image src="colors-8x16.svg" class="small bl"/>
+    <image src="colors-8x16.svg" class="small tl"/>
+    <image src="colors-8x16.svg" class="small br"/>
+    <image src="colors-8x16.svg" class="small tc"/>
+    <image src="colors-8x16.svg" class="small cr"/>
+    <image src="colors-8x16.svg" class="small"/>
+  </hbox>
+</window>
--- a/layout/reftests/xul/object-fit-contain-svg-003-ref.html
+++ b/layout/reftests/xul/object-fit-contain-svg-003-ref.html
@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+    <style type="text/css">
+      .objectOuter {
+        border: 1px dashed gray;
+        padding: 1px;
+        float: left;
+      }
+      .objectOuter > * {
+        background-image: url("colors-16x8-noSize.svg");
+        background-size: contain;
+        background-repeat: no-repeat;
+      }
+      .bigWide {
+        width: 48px;
+        height: 32px;
+      }
+      .bigTall {
+        width: 32px;
+        height: 48px;
+      }
+      .small {
+        width: 8px;
+        height: 8px;
+      }
+
+      br { clear: both; }
+
+      .tr { background-position: top right }
+      .bl { background-position: bottom left }
+      .tl { background-position: top 25% left 25% }
+      .br { background-position: bottom 1px right 2px }
+
+      .tc { background-position: top 3px center }
+      .cr { background-position: center right 25% }
+      .default { background-position: 50% 50% }
+    </style>
+  </head>
+  <body>
+    <!-- big/wide: -->
+    <div class="objectOuter"><div class="bigWide tr"></div></div>
+    <div class="objectOuter"><div class="bigWide bl"></div></div>
+    <div class="objectOuter"><div class="bigWide tl"></div></div>
+    <div class="objectOuter"><div class="bigWide br"></div></div>
+    <div class="objectOuter"><div class="bigWide tc"></div></div>
+    <div class="objectOuter"><div class="bigWide cr"></div></div>
+    <div class="objectOuter"><div class="bigWide default"></div></div>
+    <br>
+    <!-- big/tall: -->
+    <div class="objectOuter"><div class="bigTall tr"></div></div>
+    <div class="objectOuter"><div class="bigTall bl"></div></div>
+    <div class="objectOuter"><div class="bigTall tl"></div></div>
+    <div class="objectOuter"><div class="bigTall br"></div></div>
+    <div class="objectOuter"><div class="bigTall tc"></div></div>
+    <div class="objectOuter"><div class="bigTall cr"></div></div>
+    <div class="objectOuter"><div class="bigTall default"></div></div>
+    <br>
+    <!-- small: -->
+    <div class="objectOuter"><div class="small tr"></div></div>
+    <div class="objectOuter"><div class="small bl"></div></div>
+    <div class="objectOuter"><div class="small tl"></div></div>
+    <div class="objectOuter"><div class="small br"></div></div>
+    <div class="objectOuter"><div class="small tc"></div></div>
+    <div class="objectOuter"><div class="small cr"></div></div>
+    <div class="objectOuter"><div class="small default"></div></div>
+    <br>
+  </body>
+</html>
--- a/layout/reftests/xul/object-fit-contain-svg-003.xul
+++ b/layout/reftests/xul/object-fit-contain-svg-003.xul
@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+      window { padding: 8px; }
+      image {
+        border: 1px dashed gray;
+        padding: 1px;
+        object-fit: contain;
+        float: left;
+      }
+
+      .bigWide {
+        width: 52px;
+        height: 36px;
+      }
+      .bigTall {
+        width: 36px;
+        height: 52px;
+      }
+      .small {
+        width: 12px;
+        height: 12px;
+      }
+
+      br { clear: both; }
+
+      .tr { object-position: top right }
+      .bl { object-position: bottom left }
+      .tl { object-position: top 25% left 25% }
+      .br { object-position: bottom 1px right 2px }
+
+      .tc { object-position: top 3px center }
+      .cr { object-position: center right 25% }
+  ]]></style>
+  <hbox>
+    <!-- big/wide: -->
+    <image src="colors-16x8-noSize.svg" class="bigWide tr"/>
+    <image src="colors-16x8-noSize.svg" class="bigWide bl"/>
+    <image src="colors-16x8-noSize.svg" class="bigWide tl"/>
+    <image src="colors-16x8-noSize.svg" class="bigWide br"/>
+    <image src="colors-16x8-noSize.svg" class="bigWide tc"/>
+    <image src="colors-16x8-noSize.svg" class="bigWide cr"/>
+    <image src="colors-16x8-noSize.svg" class="bigWide"/>
+  </hbox>
+  <hbox>
+    <!-- big/tall: -->
+    <image src="colors-16x8-noSize.svg" class="bigTall tr"/>
+    <image src="colors-16x8-noSize.svg" class="bigTall bl"/>
+    <image src="colors-16x8-noSize.svg" class="bigTall tl"/>
+    <image src="colors-16x8-noSize.svg" class="bigTall br"/>
+    <image src="colors-16x8-noSize.svg" class="bigTall tc"/>
+    <image src="colors-16x8-noSize.svg" class="bigTall cr"/>
+    <image src="colors-16x8-noSize.svg" class="bigTall"/>
+  </hbox>
+  <hbox>
+    <!-- small: -->
+    <image src="colors-16x8-noSize.svg" class="small tr"/>
+    <image src="colors-16x8-noSize.svg" class="small bl"/>
+    <image src="colors-16x8-noSize.svg" class="small tl"/>
+    <image src="colors-16x8-noSize.svg" class="small br"/>
+    <image src="colors-16x8-noSize.svg" class="small tc"/>
+    <image src="colors-16x8-noSize.svg" class="small cr"/>
+    <image src="colors-16x8-noSize.svg" class="small"/>
+  </hbox>
+</window>
--- a/layout/reftests/xul/object-fit-contain-svg-004-ref.html
+++ b/layout/reftests/xul/object-fit-contain-svg-004-ref.html
@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+    <style type="text/css">
+      .objectOuter {
+        border: 1px dashed gray;
+        padding: 1px;
+        float: left;
+      }
+      .objectOuter > * {
+        background-image: url("colors-8x16-noSize.svg");
+        background-size: contain;
+        background-repeat: no-repeat;
+      }
+      .bigWide {
+        width: 48px;
+        height: 32px;
+      }
+      .bigTall {
+        width: 32px;
+        height: 48px;
+      }
+      .small {
+        width: 8px;
+        height: 8px;
+      }
+
+      br { clear: both; }
+
+      .tr { background-position: top right }
+      .bl { background-position: bottom left }
+      .tl { background-position: top 25% left 25% }
+      .br { background-position: bottom 1px right 2px }
+
+      .tc { background-position: top 3px center }
+      .cr { background-position: center right 25% }
+      .default { background-position: 50% 50% }
+    </style>
+  </head>
+  <body>
+    <!-- big/wide: -->
+    <div class="objectOuter"><div class="bigWide tr"></div></div>
+    <div class="objectOuter"><div class="bigWide bl"></div></div>
+    <div class="objectOuter"><div class="bigWide tl"></div></div>
+    <div class="objectOuter"><div class="bigWide br"></div></div>
+    <div class="objectOuter"><div class="bigWide tc"></div></div>
+    <div class="objectOuter"><div class="bigWide cr"></div></div>
+    <div class="objectOuter"><div class="bigWide default"></div></div>
+    <br>
+    <!-- big/tall: -->
+    <div class="objectOuter"><div class="bigTall tr"></div></div>
+    <div class="objectOuter"><div class="bigTall bl"></div></div>
+    <div class="objectOuter"><div class="bigTall tl"></div></div>
+    <div class="objectOuter"><div class="bigTall br"></div></div>
+    <div class="objectOuter"><div class="bigTall tc"></div></div>
+    <div class="objectOuter"><div class="bigTall cr"></div></div>
+    <div class="objectOuter"><div class="bigTall default"></div></div>
+    <br>
+    <!-- small: -->
+    <div class="objectOuter"><div class="small tr"></div></div>
+    <div class="objectOuter"><div class="small bl"></div></div>
+    <div class="objectOuter"><div class="small tl"></div></div>
+    <div class="objectOuter"><div class="small br"></div></div>
+    <div class="objectOuter"><div class="small tc"></div></div>
+    <div class="objectOuter"><div class="small cr"></div></div>
+    <div class="objectOuter"><div class="small default"></div></div>
+    <br>
+  </body>
+</html>
--- a/layout/reftests/xul/object-fit-contain-svg-004.xul
+++ b/layout/reftests/xul/object-fit-contain-svg-004.xul
@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+      window { padding: 8px; }
+      image {
+        border: 1px dashed gray;
+        padding: 1px;
+        object-fit: contain;
+        float: left;
+      }
+
+      .bigWide {
+        width: 52px;
+        height: 36px;
+      }
+      .bigTall {
+        width: 36px;
+        height: 52px;
+      }
+      .small {
+        width: 12px;
+        height: 12px;
+      }
+
+      br { clear: both; }
+
+      .tr { object-position: top right }
+      .bl { object-position: bottom left }
+      .tl { object-position: top 25% left 25% }
+      .br { object-position: bottom 1px right 2px }
+
+      .tc { object-position: top 3px center }
+      .cr { object-position: center right 25% }
+  ]]></style>
+  <hbox>
+    <!-- big/wide: -->
+    <image src="colors-8x16-noSize.svg" class="bigWide tr"/>
+    <image src="colors-8x16-noSize.svg" class="bigWide bl"/>
+    <image src="colors-8x16-noSize.svg" class="bigWide tl"/>
+    <image src="colors-8x16-noSize.svg" class="bigWide br"/>
+    <image src="colors-8x16-noSize.svg" class="bigWide tc"/>
+    <image src="colors-8x16-noSize.svg" class="bigWide cr"/>
+    <image src="colors-8x16-noSize.svg" class="bigWide"/>
+  </hbox>
+  <hbox>
+    <!-- big/tall: -->
+    <image src="colors-8x16-noSize.svg" class="bigTall tr"/>
+    <image src="colors-8x16-noSize.svg" class="bigTall bl"/>
+    <image src="colors-8x16-noSize.svg" class="bigTall tl"/>
+    <image src="colors-8x16-noSize.svg" class="bigTall br"/>
+    <image src="colors-8x16-noSize.svg" class="bigTall tc"/>
+    <image src="colors-8x16-noSize.svg" class="bigTall cr"/>
+    <image src="colors-8x16-noSize.svg" class="bigTall"/>
+  </hbox>
+  <hbox>
+    <!-- small: -->
+    <image src="colors-8x16-noSize.svg" class="small tr"/>
+    <image src="colors-8x16-noSize.svg" class="small bl"/>
+    <image src="colors-8x16-noSize.svg" class="small tl"/>
+    <image src="colors-8x16-noSize.svg" class="small br"/>
+    <image src="colors-8x16-noSize.svg" class="small tc"/>
+    <image src="colors-8x16-noSize.svg" class="small cr"/>
+    <image src="colors-8x16-noSize.svg" class="small"/>
+  </hbox>
+</window>
--- a/layout/reftests/xul/object-fit-contain-svg-005-ref.html
+++ b/layout/reftests/xul/object-fit-contain-svg-005-ref.html
@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>CSS Reftest Reference</title>
+    <link rel="author" title="Daniel Holbert" href="mailto:dholbert@mozilla.com">
+    <style type="text/css">
+      .objectOuter {
+        border: 1px dashed gray;
+        padding: 1px;
+        float: left;
+      }
+      .objectOuter > * {
+        background-image: url("colors-16x8-parDefault.svg");
+        background-size: contain;
+        background-repeat: no-repeat;
+      }
+      .bigWide {
+        width: 48px;
+        height: 32px;
+      }
+      .bigTall {
+        width: 32px;
+        height: 48px;
+      }
+      .small {
+        width: 8px;
+        height: 8px;
+      }
+
+      br { clear: both; }
+
+      .tr { background-position: top right }
+      .bl { background-position: bottom left }
+      .tl { background-position: top 25% left 25% }
+      .br { background-position: bottom 1px right 2px }
+
+      .tc { background-position: top 3px center }
+      .cr { background-position: center right 25% }
+      .default { background-position: 50% 50% }
+    </style>
+  </head>
+  <body>
+    <!-- big/wide: -->
+    <div class="objectOuter"><div class="bigWide tr"></div></div>
+    <div class="objectOuter"><div class="bigWide bl"></div></div>
+    <div class="objectOuter"><div class="bigWide tl"></div></div>
+    <div class="objectOuter"><div class="bigWide br"></div></div>
+    <div class="objectOuter"><div class="bigWide tc"></div></div>
+    <div class="objectOuter"><div class="bigWide cr"></div></div>
+    <div class="objectOuter"><div class="bigWide default"></div></div>
+    <br>
+    <!-- big/tall: -->
+    <div class="objectOuter"><div class="bigTall tr"></div></div>
+    <div class="objectOuter"><div class="bigTall bl"></div></div>
+    <div class="objectOuter"><div class="bigTall tl"></div></div>
+    <div class="objectOuter"><div class="bigTall br"></div></div>
+    <div class="objectOuter"><div class="bigTall tc"></div></div>
+    <div class="objectOuter"><div class="bigTall cr"></div></div>
+    <div class="objectOuter"><div class="bigTall default"></div></div>
+    <br>
+    <!-- small: -->
+    <div class="objectOuter"><div class="small tr"></div></div>
+    <div class="objectOuter"><div class="small bl"></div></div>
+    <div class="objectOuter"><div class="small tl"></div></div>
+    <div class="objectOuter"><div class="small br"></div></div>
+    <div class="objectOuter"><div class="small tc"></div></div>
+    <div class="objectOuter"><div class="small cr"></div></div>
+    <div class="objectOuter"><div class="small default"></div></div>
+    <br>
+  </body>
+</html>
--- a/layout/reftests/xul/object-fit-contain-svg-005.xul
+++ b/layout/reftests/xul/object-fit-contain-svg-005.xul
@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <style xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+      window { padding: 8px; }
+      image {
+        border: 1px dashed gray;
+        padding: 1px;
+        object-fit: contain;
+        float: left;
+      }
+
+      .bigWide {
+        width: 52px;
+        height: 36px;
+      }
+      .bigTall {
+        width: 36px;
+        height: 52px;
+      }
+      .small {
+        width: 12px;
+        height: 12px;
+      }
+
+      br { clear: both; }
+
+      .tr { object-position: top right }
+      .bl { object-position: bottom left }
+      .tl { object-position: top 25% left 25% }
+      .br { object-position: bottom 1px right 2px }
+
+      .tc { object-position: top 3px center }
+      .cr { object-position: center right 25% }
+  ]]></style>
+  <hbox>
+    <!-- big/wide: -->
+    <image src="colors-16x8-parDefault.svg" class="bigWide tr"/>
+    <image src="colors-16x8-parDefault.svg" class="bigWide bl"/>
+    <image src="colors-16x8-parDefault.svg" class="bigWide tl"/>
+    <image src="colors-16x8-parDefault.svg" class="bigWide br"/>
+    <image src="colors-16x8-parDefault.svg" class="bigWide tc"/>
+    <image src="colors-16x8-parDefault.svg" class="bigWide cr"/>
+    <image src="colors-16x8-parDefault.svg" class="bigWide"/>
+  </hbox>
+  <hbox>
+    <!-- big/tall: -->
+    <image src="colors-16x8-parDefault.svg" class="bigTall tr"/>
+    <image src="colors-16x8-parDefault.svg" class="bigTall bl"/>
+    <image src="colors-16x8-parDefault.svg" class="bigTall tl"/>
+    <image src="colors-16x8-parDefault.svg" class="bigTall br"/>
+    <image src="colors-16x8-parDefault.svg" class="bigTall tc"/>
+    <image src="colors-16x8-parDefault.svg" class="bigTall cr"/>
+    <image src="colors-16x8-parDefault.svg" class="bigTall"/>
+  </hbox>
+  <hbox>
+    <!-- small: -->
+    <image src="colors-16x8-parDefault.svg" class="small tr"/>
+    <image src="colors-16x8-parDefault.svg" class="small bl"/>
+    <image src="colors-16x8-parDefault.svg" class="small tl"/>
+    <image src="colors-16x8-parDefault.svg" class="small br"/>
+    <image src="colors-16x8-parDefault.svg" class="small tc"/>
+    <image src="colors-16x8-parDefault.svg" class="small cr"/>
+    <image src="colors-16x8-parDefault.svg" class="small"/>
+  </hbox>
+</window>
--- a/Show More
+++ b/Show More