No issue - Set the default for incremental cycle collector to be off.

Negative performance impact if enabled.

dom/script/ScriptLoader.cpp

@@ -2362,11 +2362,14 @@ ScriptLoader::EvaluateScript(ScriptLoadRequest* aRequest)
              JS::Rooted<JSScript*> script(cx);
              script = exec.GetScript();
 
-             // Create a ClassicScript object and associate it with the
-             // JSScript.
-             RefPtr<ClassicScript> classicScript = new ClassicScript(
-                 aRequest->mFetchOptions, aRequest->mBaseURL);
-             classicScript->AssociateWithScript(script);
+             // With scripts disabled GetScript() will return nullptr
+             if (script) {
+                 // Create a ClassicScript object and associate it with the
+                 // JSScript.
+                 RefPtr<ClassicScript> classicScript = new ClassicScript(
+                     aRequest->mFetchOptions, aRequest->mBaseURL);
+                 classicScript->AssociateWithScript(script);
+             }
 
              rv = exec.ExecScript();
           }

dom/xbl/nsBindingManager.cpp

@@ -717,8 +717,9 @@ nsBindingManager::WalkRules(nsIStyleRuleProcessor::EnumFunc aFunc,
       aData->mTreeMatchContext.mIsTopmostScope = (index == 0);
       binding->WalkRules(aFunc, aData);
     }
-    aData->mTreeMatchContext.mForAssignedSlot = false;
 
+    aData->mTreeMatchContext.mForAssignedSlot = false;
+    aData->mTreeMatchContext.mIsTopmostScope = false;
     aData->mTreeMatchContext.mRestrictToSlottedPseudo = false;
   }
 

js/src/jit/BaselineBailouts.cpp

@@ -1803,6 +1803,14 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfo)
     MOZ_ASSERT(numFrames > 0);
     BailoutKind bailoutKind = bailoutInfo->bailoutKind;
     bool checkGlobalDeclarationConflicts = bailoutInfo->checkGlobalDeclarationConflicts;
+    uint8_t* incomingStack = bailoutInfo->incomingStack;
+
+    // We have to get rid of the rematerialized frame, whether it is
+    // restored or unwound.
+    auto guardRemoveRematerializedFramesFromDebugger = mozilla::MakeScopeExit([&] {
+        JitActivation* act = cx->activation()->asJit();
+        act->removeRematerializedFramesFromDebugger(cx, incomingStack);
+    });
 
     // Free the bailout buffer.
     js_free(bailoutInfo);
@@ -1876,6 +1884,7 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfo)
             if (frameno == numFrames - 1) {
                 outerScript = frame->script();
                 outerFp = iter.fp();
+                MOZ_ASSERT(outerFp == incomingStack);
             }
 
             frameno++;
@@ -1902,18 +1911,23 @@ jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfo)
                 // We must attempt to copy all rematerialized frames over,
                 // even if earlier ones failed, to invoke the proper frame
                 // cleanup in the Debugger.
-                ok = CopyFromRematerializedFrame(cx, act, outerFp, --inlineDepth,
-                                                 iter.baselineFrame());
+                if (!CopyFromRematerializedFrame(cx, act, outerFp, --inlineDepth,
+                                                 iter.baselineFrame()))
+                {
+                    ok = false;
+                }
             }
             ++iter;
         }
 
-        // After copying from all the rematerialized frames, remove them from
-        // the table to keep the table up to date.
-        act->removeRematerializedFrame(outerFp);
-
         if (!ok)
             return false;
+
+        // After copying from all the rematerialized frames, remove them from
+        // the table to keep the table up to date.
+        guardRemoveRematerializedFramesFromDebugger.release();
+        act->removeRematerializedFrame(outerFp);
+
     }
 
     JitSpew(JitSpew_BaselineBailouts,

js/src/jit/JitFrames.cpp

@@ -888,7 +888,12 @@ HandleException(ResumeFromException* rfe)
                 ++frames;
             }
 
+            // Remove left-over state which might have been needed for bailout.
             activation->removeIonFrameRecovery(iter.jsFrame());
+            activation->removeRematerializedFrame(iter.fp());
+
+            // If invalidated, decrement the number of frames remaining on the
+            // stack for the given IonScript.
             if (invalidated)
                 ionScript->decrementInvalidationCount(cx->runtime()->defaultFreeOp());
 

js/src/moz.build

@@ -406,12 +406,15 @@ if CONFIG['ENABLE_TRACE_LOGGING']:
         'vm/TraceLoggingTypes.cpp',
     ]
 
+jit_ioncheck1_deunified_sources = []
+jit_ioncheck2_deunified_sources = []
+jit_ioncheck3_deunified_sources = []
 if not CONFIG['ENABLE_ION']:
-    jit_ioncheck1_deunified_sources = [
+    jit_ioncheck1_deunified_sources += [
         'jit/none/Trampoline-none.cpp'
     ]
 elif CONFIG['JS_CODEGEN_X86'] or CONFIG['JS_CODEGEN_X64']:
-    jit_ioncheck1_deunified_sources = [
+    jit_ioncheck1_deunified_sources += [
         'jit/x86-shared/Architecture-x86-shared.cpp',
         'jit/x86-shared/Assembler-x86-shared.cpp',
         'jit/x86-shared/AssemblerBuffer-x86-shared.cpp',
@@ -424,7 +427,7 @@ elif CONFIG['JS_CODEGEN_X86'] or CONFIG['JS_CODEGEN_X64']:
         'jit/x86-shared/MoveEmitter-x86-shared.cpp',
     ]
     if CONFIG['JS_CODEGEN_X64']:
-        jit_ioncheck2_deunified_sources = [
+        jit_ioncheck2_deunified_sources += [
             'jit/x64/Assembler-x64.cpp',
             'jit/x64/Bailouts-x64.cpp',
             'jit/x64/BaselineCompiler-x64.cpp',
@@ -436,7 +439,7 @@ elif CONFIG['JS_CODEGEN_X86'] or CONFIG['JS_CODEGEN_X64']:
             'jit/x64/Trampoline-x64.cpp',
         ]
     else:
-        jit_ioncheck2_deunified_sources = [
+        jit_ioncheck2_deunified_sources += [
             'jit/x86/Assembler-x86.cpp',
             'jit/x86/Bailouts-x86.cpp',
             'jit/x86/BaselineCompiler-x86.cpp',
@@ -448,7 +451,7 @@ elif CONFIG['JS_CODEGEN_X86'] or CONFIG['JS_CODEGEN_X64']:
             'jit/x86/Trampoline-x86.cpp',
         ]
 elif CONFIG['JS_CODEGEN_ARM']:
-    jit_ioncheck1_deunified_sources = [
+    jit_ioncheck1_deunified_sources += [
         'jit/arm/Architecture-arm.cpp',
         'jit/arm/Assembler-arm.cpp',
         'jit/arm/Bailouts-arm.cpp',
@@ -464,16 +467,16 @@ elif CONFIG['JS_CODEGEN_ARM']:
         'jit/arm/Trampoline-arm.cpp',
     ]
     if CONFIG['JS_SIMULATOR_ARM']:
-        jit_ioncheck2_deunified_sources = [
+        jit_ioncheck2_deunified_sources += [
             'jit/arm/Simulator-arm.cpp'
         ]
     elif CONFIG['OS_ARCH'] == 'Darwin':
-        jit_ioncheck2_deunified_sources = [
+        jit_ioncheck2_deunified_sources += [
             'jit/arm/llvm-compiler-rt/arm/aeabi_idivmod.S',
             'jit/arm/llvm-compiler-rt/arm/aeabi_uidivmod.S',
         ]
 elif CONFIG['JS_CODEGEN_ARM64']:
-    jit_ioncheck1_deunified_sources = [
+    jit_ioncheck1_deunified_sources += [
         'jit/arm64/Architecture-arm64.cpp',
         'jit/arm64/Assembler-arm64.cpp',
         'jit/arm64/Bailouts-arm64.cpp',
@@ -496,14 +499,14 @@ elif CONFIG['JS_CODEGEN_ARM64']:
         'jit/arm64/vixl/Utils-vixl.cpp'
     ]
     if CONFIG['JS_SIMULATOR_ARM64']:
-        jit_ioncheck2_deunified_sources = [
+        jit_ioncheck2_deunified_sources += [
             'jit/arm64/vixl/Debugger-vixl.cpp',
             'jit/arm64/vixl/Logic-vixl.cpp',
             'jit/arm64/vixl/MozSimulator-vixl.cpp',
             'jit/arm64/vixl/Simulator-vixl.cpp'
         ]
 elif CONFIG['JS_CODEGEN_MIPS32'] or CONFIG['JS_CODEGEN_MIPS64']:
-    jit_ioncheck1_deunified_sources = [
+    jit_ioncheck1_deunified_sources += [
         'jit/mips-shared/Architecture-mips-shared.cpp',
         'jit/mips-shared/Assembler-mips-shared.cpp',
         'jit/mips-shared/Bailouts-mips-shared.cpp',
@@ -515,7 +518,7 @@ elif CONFIG['JS_CODEGEN_MIPS32'] or CONFIG['JS_CODEGEN_MIPS64']:
         'jit/mips-shared/MoveEmitter-mips-shared.cpp',
     ]
     if CONFIG['JS_CODEGEN_MIPS32']:
-        jit_ioncheck2_deunified_sources = [
+        jit_ioncheck2_deunified_sources += [
             'jit/mips32/Architecture-mips32.cpp',
             'jit/mips32/Assembler-mips32.cpp',
             'jit/mips32/Bailouts-mips32.cpp',
@@ -529,11 +532,11 @@ elif CONFIG['JS_CODEGEN_MIPS32'] or CONFIG['JS_CODEGEN_MIPS64']:
             'jit/mips32/Trampoline-mips32.cpp',
         ]
         if CONFIG['JS_SIMULATOR_MIPS32']:
-            jit_ioncheck3_deunified_sources = [
+            jit_ioncheck3_deunified_sources += [
                 'jit/mips32/Simulator-mips32.cpp'
             ]
     elif CONFIG['JS_CODEGEN_MIPS64']:
-        jit_ioncheck2_deunified_sources = [
+        jit_ioncheck2_deunified_sources += [
             'jit/mips64/Architecture-mips64.cpp',
             'jit/mips64/Assembler-mips64.cpp',
             'jit/mips64/Bailouts-mips64.cpp',
@@ -547,7 +550,7 @@ elif CONFIG['JS_CODEGEN_MIPS32'] or CONFIG['JS_CODEGEN_MIPS64']:
             'jit/mips64/Trampoline-mips64.cpp',
         ]
         if CONFIG['JS_SIMULATOR_MIPS64']:
-            jit_ioncheck3_deunified_sources = [
+            jit_ioncheck3_deunified_sources += [
                 'jit/mips64/Simulator-mips64.cpp'
             ]
 
@@ -639,20 +642,16 @@ if CONFIG['JS_LTO']:
     if CONFIG['JS_POSIX_NSPR']:
         SOURCES += posix_nspr_deunified_sources
     SOURCES += jit_ioncheck1_deunified_sources
-    if CONFIG['ENABLE_ION']:
-        SOURCES += jit_ioncheck2_deunified_sources
-    if CONFIG['JS_CODEGEN_MIPS32'] or CONFIG['JS_CODEGEN_MIPS64']:
-        SOURCES += jit_ioncheck3_deunified_sources
+    SOURCES += jit_ioncheck2_deunified_sources
+    SOURCES += jit_ioncheck3_deunified_sources
 else:
     FILES_PER_UNIFIED_FILE = 6
     UNIFIED_SOURCES += main_deunified_sources
     if CONFIG['JS_POSIX_NSPR']:
         UNIFIED_SOURCES += posix_nspr_deunified_sources
     UNIFIED_SOURCES += jit_ioncheck1_deunified_sources
-    if CONFIG['ENABLE_ION']:
-        UNIFIED_SOURCES += jit_ioncheck2_deunified_sources
-    if CONFIG['JS_CODEGEN_MIPS32'] or CONFIG['JS_CODEGEN_MIPS64']:
-        UNIFIED_SOURCES += jit_ioncheck3_deunified_sources
+    UNIFIED_SOURCES += jit_ioncheck2_deunified_sources
+    UNIFIED_SOURCES += jit_ioncheck3_deunified_sources
 
 USE_LIBS += [
     'nspr',

js/src/vm/Stack.cpp

@@ -1584,6 +1584,8 @@ jit::JitActivation::removeRematerializedFramesFromDebugger(JSContext* cx, uint8_
     if (RematerializedFrameTable::Ptr p = rematerializedFrames_->lookup(top)) {
         for (uint32_t i = 0; i < p->value().length(); i++)
             Debugger::handleUnrecoverableIonBailoutError(cx, p->value()[i]);
+        RematerializedFrame::FreeInVector(p->value());
+        rematerializedFrames_->remove(p);
     }
 }
 

layout/style/nsCSSRuleProcessor.cpp

@@ -680,7 +680,11 @@ void RuleHash::EnumerateAllRules(Element* aElement, ElementDependentRuleProcesso
       aData->mTreeMatchContext.mAncestorFilter.HasFilter() ?
         &aData->mTreeMatchContext.mAncestorFilter : nullptr;
 #ifdef DEBUG
-    if (filter) {
+    bool isRestricted = (aData->mTreeMatchContext.mShadowHosts.Length() > 0 ||
+      aData->mTreeMatchContext.mRestrictToSlottedPseudo ||
+      aData->mTreeMatchContext.mOnlyMatchHostPseudo ||
+      aData->mTreeMatchContext.mForAssignedSlot);
+    if (filter && !isRestricted) {
       filter->AssertHasAllAncestors(aElement);
     }
 #endif
@@ -1711,7 +1715,13 @@ static bool SelectorMatches(Element* aElement,
 
   Element* targetElement = aElement;
   if (aTreeMatchContext.mForAssignedSlot) {
-    targetElement = aElement->GetAssignedSlot()->AsElement();
+    HTMLSlotElement* slot = aElement->GetAssignedSlot();
+    // We're likely testing the slottable's ancestors and it might
+    // not have an assigned slot, so return early.
+    if (!slot) {
+      return false;
+    }
+    targetElement = slot->AsElement();
   }
 
   // namespace/tag match

modules/libpref/init/all.js

@@ -1191,7 +1191,10 @@ pref("dom.sysmsg.enabled", false);
 // Enable pre-installed applications.
 pref("dom.webapps.useCurrentProfile", false);
 
-pref("dom.cycle_collector.incremental", true);
+// Use incremental cycle collection?
+// In practice this gave a noticeable performance hit. Default off.
+// See forum topic https://forum.palemoon.org/viewtopic.php?f=62&t=29887
+pref("dom.cycle_collector.incremental", false);
 
 // Parsing perf prefs. For now just mimic what the old code did.
 #ifndef XP_WIN