Merge inbound to m-c.

b2g/app/b2g.js

@@ -903,6 +903,7 @@ pref("apz.y_stationary_size_multiplier", "1.8");
 pref("apz.enlarge_displayport_when_clipped", true);
 // Use "sticky" axis locking
 pref("apz.axis_lock_mode", 2);
+pref("apz.subframe.enabled", true);
 
 // This preference allows FirefoxOS apps (and content, I think) to force
 // the use of software (instead of hardware accelerated) 2D canvases by

browser/metro/profile/metro.js

@@ -58,6 +58,7 @@ pref("apz.min_skate_speed", "10.0");
 // 0 = free, 1 = standard, 2 = sticky
 pref("apz.axis_lock_mode", 2);
 pref("apz.cross_slide.enabled", true);
+pref("apz.subframe.enabled", true);
 
 // Enable Microsoft TSF support by default for imes.
 pref("intl.tsf.enable", true);

content/media/TextTrack.cpp

@@ -109,6 +109,7 @@ void
 TextTrack::AddCue(TextTrackCue& aCue)
 {
   mCueList->AddCue(aCue);
+  aCue.SetTrack(this);
   if (mTextTrackList) {
     HTMLMediaElement* mediaElement = mTextTrackList->GetMediaElement();
     if (mediaElement) {

content/media/TextTrackCue.h

@@ -16,12 +16,12 @@
 #include "nsIDocument.h"
 #include "mozilla/dom/HTMLDivElement.h"
 #include "mozilla/dom/UnionTypes.h"
+#include "mozilla/dom/TextTrack.h"
 
 namespace mozilla {
 namespace dom {
 
 class HTMLTrackElement;
-class TextTrack;
 class TextTrackRegion;
 
 class TextTrackCue MOZ_FINAL : public DOMEventTargetHelper
@@ -317,6 +317,11 @@ class TextTrackCue MOZ_FINAL : public DOMEventTargetHelper
     return mId;
   }
 
+  void SetTrack(TextTrack* aTextTrack)
+  {
+    mTrack = aTextTrack;
+  }
+
   /**
    * Produces a tree of anonymous content based on the tree of the processed
    * cue text.

content/media/test/test_texttrackcue.html

@@ -53,9 +53,10 @@
       is(cue.endTime, 0.7, "Cue's end time should be 0.7.");
       is(cue.pauseOnExit, false, "Cue's pause on exit flag should be false.");
       is(cue.text, "This", "Cue's text should be set correctly.");
-      // TODO: https://bugzilla.mozilla.org/show_bug.cgi?id=879431
-      // GetTrack() isn't implemented so this *is* returning undefined currently.
-      todo_isnot(cue.track, undefined, "Cue's track should be defined.");
+      is(cue.track, trackElement.track, "Cue's track should be defined.");
+
+      cue.track = null;
+      isnot(cue.track, null, "Cue's track should not be able to be set.");
 
       // Check that all cue times were not rounded
       is(cueList[1].startTime, 1.2, "Second cue's start time should be 1.2.");
@@ -184,7 +185,9 @@
 
       // Check that we can create and add new VTTCues
       var vttCue = new VTTCue(3.999, 4, "foo");
+      is(vttCue.track, undefined, "Cue's track should be undefined.");
       trackElement.track.addCue(vttCue);
+      is(cue.track, trackElement.track, "Cue's track should be defined.");
       is(cueList.length, 7, "Cue list length should now be 7.");
 
       // Check that new VTTCue was added correctly

dom/bindings/Codegen.py

@@ -1374,7 +1374,8 @@ def definition_body(self):
   }
   JS::Rooted<JS::Value> v(aCx);
   if (!WrapNewBindingObject(aCx, aObj, result, &v)) {
-    MOZ_ASSERT(JS_IsExceptionPending(aCx));
+    //XXX Assertion disabled for now, see bug 991271.
+    MOZ_ASSERT(true || JS_IsExceptionPending(aCx));
     return nullptr;
   }
   return &v.toObject();"""
@@ -4729,7 +4730,8 @@ def wrapAndSetPtr(wrapCall, failureCode=None):
             if not descriptor.hasXPConnectImpls:
                 # Can only fail to wrap as a new-binding object
                 # if they already threw an exception.
-                failed = ("MOZ_ASSERT(JS_IsExceptionPending(cx));\n" +
+                #XXX Assertion disabled for now, see bug 991271.
+                failed = ("MOZ_ASSERT(true || JS_IsExceptionPending(cx));\n" +
                           "%s" % exceptionCode)
             else:
                 if descriptor.notflattened:
@@ -11267,7 +11269,8 @@ def getImpl(self):
 JS::Rooted<JSObject*> scopeObj(cx, globalHolder->GetGlobalJSObject());
 JS::Rooted<JS::Value> wrappedVal(cx);
 if (!WrapNewBindingObject(cx, scopeObj, impl, &wrappedVal)) {
-  MOZ_ASSERT(JS_IsExceptionPending(cx));
+  //XXX Assertion disabled for now, see bug 991271.
+  MOZ_ASSERT(true || JS_IsExceptionPending(cx));
   aRv.Throw(NS_ERROR_UNEXPECTED);
   return nullptr;
 }

gfx/thebes/gfxPrefs.h

@@ -119,6 +119,7 @@ class gfxPrefs MOZ_FINAL
   DECL_GFX_PREF(Live, "apz.min_skate_speed",                   APZMinSkateSpeed, float, 1.0f);
   DECL_GFX_PREF(Live, "apz.num_paint_duration_samples",        APZNumPaintDurationSamples, int32_t, 3);
   DECL_GFX_PREF(Live, "apz.pan_repaint_interval",              APZPanRepaintInterval, int32_t, 250);
+  DECL_GFX_PREF(Live, "apz.subframe.enabled",                  APZSubframeEnabled, bool, false);
   DECL_GFX_PREF(Live, "apz.touch_start_tolerance",             APZTouchStartTolerance, float, 1.0f/4.5f);
   DECL_GFX_PREF(Live, "apz.use_paint_duration",                APZUsePaintDuration, bool, true);
   DECL_GFX_PREF(Live, "apz.velocity_bias",                     APZVelocityBias, float, 1.0f);

image/src/imgLoader.cpp

@@ -401,7 +401,6 @@ static nsresult NewImageChannel(nsIChannel **aResult,
                                 nsIPrincipal *aLoadingPrincipal)
 {
   nsresult rv;
-  nsCOMPtr<nsIChannel> newChannel;
   nsCOMPtr<nsIHttpChannel> newHttpChannel;
 
   nsCOMPtr<nsIInterfaceRequestor> callbacks;
@@ -463,6 +462,18 @@ static nsresult NewImageChannel(nsIChannel **aResult,
                                                       *aResult, aURI, false);
   *aForcePrincipalCheckForCacheEntry = setOwner;
 
+  // Create a new loadgroup for this new channel, using the old group as
+  // the parent. The indirection keeps the channel insulated from cancels,
+  // but does allow a way for this revalidation to be associated with at
+  // least one base load group for scheduling/caching purposes.
+
+  nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
+  nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
+  if (childLoadGroup) {
+    childLoadGroup->SetParentLoadGroup(aLoadGroup);
+  }
+  (*aResult)->SetLoadGroup(loadGroup);
+
   return NS_OK;
 }
 
@@ -1679,18 +1690,9 @@ nsresult imgLoader::LoadImage(nsIURI *aURI,
     PR_LOG(GetImgLog(), PR_LOG_DEBUG,
            ("[this=%p] imgLoader::LoadImage -- Created new imgRequest [request=%p]\n", this, request.get()));
 
-    // Create a loadgroup for this new channel.  This way if the channel
-    // is redirected, we'll have a way to cancel the resulting channel.
-    // Inform the new loadgroup of the old one so they can still be correlated
-    // together as a logical group.
-    nsCOMPtr<nsILoadGroup> loadGroup =
-        do_CreateInstance(NS_LOADGROUP_CONTRACTID);
-    nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
-    if (childLoadGroup)
-      childLoadGroup->SetParentLoadGroup(aLoadGroup);
-    newChannel->SetLoadGroup(loadGroup);
-
-    request->Init(aURI, aURI, loadGroup, newChannel, entry, aCX,
+    nsCOMPtr<nsILoadGroup> channelLoadGroup;
+    newChannel->GetLoadGroup(getter_AddRefs(channelLoadGroup));
+    request->Init(aURI, aURI, channelLoadGroup, newChannel, entry, aCX,
                   aLoadingPrincipal, corsmode);
 
     // Pass the inner window ID of the loading document, if possible.

js/src/frontend/Parser.cpp

@@ -1257,8 +1257,11 @@ Parser<ParseHandler>::newFunction(GenericParseContext *pc, HandleAtom atom,
                               : (kind == Arrow)
                                 ? JSFunction::INTERPRETED_LAMBDA_ARROW
                                 : JSFunction::INTERPRETED;
+    gc::AllocKind allocKind = (kind == Arrow)
+                              ? JSFunction::ExtendedFinalizeKind
+                              : JSFunction::FinalizeKind;
     fun = NewFunctionWithProto(context, NullPtr(), nullptr, 0, flags, NullPtr(), atom, proto,
-                               JSFunction::FinalizeKind, MaybeSingletonObject);
+                               allocKind, MaybeSingletonObject);
     if (!fun)
         return nullptr;
     if (options().selfHostingMode)

js/src/jit-test/tests/arrow-functions/bug889158.js

@@ -0,0 +1,4 @@
+var f = x => arguments.callee;
+
+for (var i=0; i<5; i++)
+    assertEq(f(), f);

js/src/jit-test/tests/arrow-functions/length.js

@@ -7,5 +7,5 @@ assertEq((() => 0).length, 0);
 assertEq(((a) => 0).length, 1);
 assertEq(((a, b) => 0).length, 2);
 
-assertEq(((...arr) => arr).length, 1);
-assertEq(((a=1, b=2) => 0).length, 2);
+assertEq(((...arr) => arr).length, 0);
+assertEq(((a=1, b=2) => 0).length, 0);

js/src/jit-test/tests/arrow-functions/this-5.js

@@ -0,0 +1,12 @@
+// Arrow functions can have primitive |this| values.
+
+Number.prototype.foo = function() {
+    "use strict";
+    return () => this;
+}
+
+for (var i=0; i<5; i++) {
+    var n = i.foo()();
+    assertEq(typeof n, "number");
+    assertEq(n, i);
+}

js/src/jit-test/tests/arrow-functions/this-6.js

@@ -0,0 +1,11 @@
+// Eval expressions in arrow functions use the correct |this| value.
+
+function Dog(name) {
+    this.name = name;
+    this.getName = () => eval("this.name");
+    this.getNameHard = () => eval("(() => this.name)()");
+}
+
+var d = new Dog("Max");
+assertEq(d.getName(), d.name);
+assertEq(d.getNameHard(), d.name);

js/src/jit-test/tests/ion/bug984830.js

@@ -0,0 +1,15 @@
+function getTestCaseResult(expected, actual) {
+      if (actual != expected)
+              return Math.abs(actual - expected) <= 1E-10;
+}
+function InstanceOf(object, constructor) {
+      while ( object != null )
+              object = object.__proto__;
+}
+function WorkerBee () {}
+function Engineer () {}
+Engineer.prototype = new WorkerBee();
+var pat = new Engineer();
+getTestCaseResult(pat.__proto__.__proto__.__proto__.__proto__ == Object.prototype);
+getTestCaseResult(InstanceOf(pat, Engineer));
+evaluate("getTestCaseResult( Object.prototype.__proto__ );", { compileAndGo: true });

js/src/jit/BaselineCompiler.cpp

@@ -1103,6 +1103,17 @@ BaselineCompiler::emit_JSOP_NULL()
 bool
 BaselineCompiler::emit_JSOP_THIS()
 {
+    if (function() && function()->isArrow()) {
+        // Arrow functions store their (lexical) |this| value in an
+        // extended slot.
+        frame.syncStack(0);
+        Register scratch = R0.scratchReg();
+        masm.loadPtr(frame.addressOfCallee(), scratch);
+        masm.loadValue(Address(scratch, FunctionExtended::offsetOfArrowThisSlot()), R0);
+        frame.push(R0);
+        return true;
+    }
+
     // Keep this value in R0
     frame.pushThis();
 

js/src/jit/CodeGenerator.cpp

@@ -4061,6 +4061,15 @@ CodeGenerator::visitComputeThis(LComputeThis *lir)
     return true;
 }
 
+bool
+CodeGenerator::visitLoadArrowThis(LLoadArrowThis *lir)
+{
+    Register callee = ToRegister(lir->callee());
+    ValueOperand output = ToOutValue(lir);
+    masm.loadValue(Address(callee, FunctionExtended::offsetOfArrowThisSlot()), output);
+    return true;
+}
+
 bool
 CodeGenerator::visitArrayLength(LArrayLength *lir)
 {

js/src/jit/CodeGenerator.h

@@ -160,6 +160,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitSetArgumentsObjectArg(LSetArgumentsObjectArg *lir);
     bool visitReturnFromCtor(LReturnFromCtor *lir);
     bool visitComputeThis(LComputeThis *lir);
+    bool visitLoadArrowThis(LLoadArrowThis *lir);
     bool visitArrayLength(LArrayLength *lir);
     bool visitSetArrayLength(LSetArrayLength *lir);
     bool visitTypedArrayLength(LTypedArrayLength *lir);

js/src/jit/IonBuilder.cpp

@@ -1657,18 +1657,10 @@ IonBuilder::inspectOpcode(JSOp op)
       case JSOP_THIS:
         return jsop_this();
 
-      case JSOP_CALLEE:
-      {
-        MDefinition *callee;
-        if (inliningDepth_ == 0) {
-            MInstruction *calleeIns = MCallee::New(alloc());
-            current->add(calleeIns);
-            callee = calleeIns;
-        } else {
-            callee = inlineCallInfo_->fun();
-        }
-        current->push(callee);
-        return true;
+      case JSOP_CALLEE: {
+         MDefinition *callee = getCallee();
+         current->push(callee);
+         return true;
       }
 
       case JSOP_GETPROP:
@@ -3032,7 +3024,7 @@ IonBuilder::filterTypesAtTest(MTest *test)
         return true;
 
     // There is no TypeSet that can get filtered.
-    if (!subject->resultTypeSet())
+    if (!subject->resultTypeSet() || subject->resultTypeSet()->unknown())
         return true;
 
     // Only do this optimization if the typeset does contains null or undefined.
@@ -9534,6 +9526,14 @@ IonBuilder::jsop_this()
     if (!info().funMaybeLazy())
         return abort("JSOP_THIS outside of a JSFunction.");
 
+    if (info().funMaybeLazy()->isArrow()) {
+        // Arrow functions store their lexical |this| in an extended slot.
+        MLoadArrowThis *thisObj = MLoadArrowThis::New(alloc(), getCallee());
+        current->add(thisObj);
+        current->push(thisObj);
+        return true;
+    }
+
     if (script()->strict() || info().funMaybeLazy()->isSelfHostedBuiltin()) {
         // No need to wrap primitive |this| in strict mode or self-hosted code.
         current->pushSlot(info().thisSlot());
@@ -10230,3 +10230,15 @@ IonBuilder::constantInt(int32_t i)
 {
     return constant(Int32Value(i));
 }
+
+MDefinition *
+IonBuilder::getCallee()
+{
+    if (inliningDepth_ == 0) {
+        MInstruction *callee = MCallee::New(alloc());
+        current->add(callee);
+        return callee;
+    }
+
+    return inlineCallInfo_->fun();
+}

js/src/jit/IonBuilder.h

@@ -534,6 +534,8 @@ class IonBuilder : public MIRGenerator
     MInstruction *getTypedArrayLength(MDefinition *obj);
     MInstruction *getTypedArrayElements(MDefinition *obj);
 
+    MDefinition *getCallee();
+
     bool jsop_add(MDefinition *left, MDefinition *right);
     bool jsop_bitnot();
     bool jsop_bitop(JSOp op);

js/src/jit/IonMacroAssembler.cpp

@@ -1846,24 +1846,23 @@ MacroAssembler::branchIfNotInterpretedConstructor(Register fun, Register scratch
     // Emit code for the following test:
     //
     // bool isInterpretedConstructor() const {
-    //     return isInterpreted() && !isFunctionPrototype() &&
+    //     return isInterpreted() && !isFunctionPrototype() && !isArrow() &&
     //         (!isSelfHostedBuiltin() || isSelfHostedConstructor());
     // }
 
     // First, ensure it's a scripted function.
     load32(Address(fun, JSFunction::offsetOfNargs()), scratch);
     branchTest32(Assembler::Zero, scratch, Imm32(JSFunction::INTERPRETED << 16), label);
 
-    // Common case: if both IS_FUN_PROTO and SELF_HOSTED are not set,
-    // we're done.
+    // Common case: if IS_FUN_PROTO, ARROW and SELF_HOSTED are not set,
+    // the function is an interpreted constructor and we're done.
     Label done;
-    uint32_t bits = (JSFunction::IS_FUN_PROTO | JSFunction::SELF_HOSTED) << 16;
+    uint32_t bits = (JSFunction::IS_FUN_PROTO | JSFunction::ARROW | JSFunction::SELF_HOSTED) << 16;
     branchTest32(Assembler::Zero, scratch, Imm32(bits), &done);
     {
-        // The callee is either Function.prototype or self-hosted. Fail if
-        // SELF_HOSTED_CTOR is not set. This means the callee must be
-        // Function.prototype or a self-hosted function that's not a
-        // constructor.
+        // The callee is either Function.prototype, an arrow function or
+        // self-hosted. None of these are constructible, except self-hosted
+        // constructors, so branch to |label| if SELF_HOSTED_CTOR is not set.
         branchTest32(Assembler::Zero, scratch, Imm32(JSFunction::SELF_HOSTED_CTOR << 16), label);
 
 #ifdef DEBUG

js/src/jit/LIR-Common.h

@@ -1056,6 +1056,20 @@ class LComputeThis : public LInstructionHelper<1, BOX_PIECES, 0>
     }
 };
 
+class LLoadArrowThis : public LInstructionHelper<BOX_PIECES, 1, 0>
+{
+  public:
+    LLoadArrowThis(const LAllocation &callee) {
+        setOperand(0, callee);
+    }
+
+    LIR_HEADER(LoadArrowThis)
+
+    const LAllocation *callee() {
+        return getOperand(0);
+    }
+};
+
 // Writes a typed argument for a function call to the frame's argument vector.
 class LStackArgT : public LInstructionHelper<0, 1, 0>
 {