Issue #1791 - Part 1: Support unprefixed CSS "appearance" property.

Alias -moz-appearance and -webkit-appearance to this.
2021-07-08 22:08:12 +00:00
176 changed files with 7161 additions and 13240 deletions
@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.

-Clobber for NSS update
+Clobber for NSS update
@@ -10,8 +10,9 @@ DIRS += ['lgpllibs']
 if not CONFIG['MOZ_SYSTEM_JPEG']:
    external_dirs += ['media/libjpeg']

-if not CONFIG['MOZ_SYSTEM_BZ2']:
-    external_dirs += ['modules/libbz2']
+if CONFIG['MOZ_UPDATER']:
+    if not CONFIG['MOZ_SYSTEM_BZ2']:
+        external_dirs += ['modules/libbz2']

 # There's no "native" brotli or woff2 yet, but probably in the future...
 external_dirs += ['modules/brotli']
@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------

-4.8.3
+4.8.2
@@ -123,9 +123,9 @@ extern "C" {
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
 ** [sqlite_version()] and [sqlite_source_id()].
 */
-#define SQLITE_VERSION        "3.36.0"
-#define SQLITE_VERSION_NUMBER 3036000
-#define SQLITE_SOURCE_ID      "2021-06-18 18:36:39 5c9a6c06871cb9fe42814af9c039eb6da5427a6ec28f187af7ebfb62eafa66e5"
+#define SQLITE_VERSION        "3.33.0"
+#define SQLITE_VERSION_NUMBER 3033000
+#define SQLITE_SOURCE_ID      "2020-08-14 13:23:32 fca8dc8b578f215a969cd899336378966156154710873e68b3d9ac5881b0ff3f"

 /*
 ** CAPI3REF: Run-Time Library Version Numbers
@@ -504,7 +504,6 @@ SQLITE_API int sqlite3_exec(
 #define SQLITE_IOERR_COMMIT_ATOMIC     (SQLITE_IOERR | (30<<8))
 #define SQLITE_IOERR_ROLLBACK_ATOMIC   (SQLITE_IOERR | (31<<8))
 #define SQLITE_IOERR_DATA              (SQLITE_IOERR | (32<<8))
-#define SQLITE_IOERR_CORRUPTFS         (SQLITE_IOERR | (33<<8))
 #define SQLITE_LOCKED_SHAREDCACHE      (SQLITE_LOCKED |  (1<<8))
 #define SQLITE_LOCKED_VTAB             (SQLITE_LOCKED |  (2<<8))
 #define SQLITE_BUSY_RECOVERY           (SQLITE_BUSY   |  (1<<8))
@@ -1128,23 +1127,6 @@ struct sqlite3_io_methods {
 ** file to the database file, but before the *-shm file is updated to
 ** record the fact that the pages have been checkpointed.
 ** </ul>
-**
-** <li>[[SQLITE_FCNTL_EXTERNAL_READER]]
-** The EXPERIMENTAL [SQLITE_FCNTL_EXTERNAL_READER] opcode is used to detect
-** whether or not there is a database client in another process with a wal-mode
-** transaction open on the database or not. It is only available on unix.The
-** (void*) argument passed with this file-control should be a pointer to a
-** value of type (int). The integer value is set to 1 if the database is a wal
-** mode database and there exists at least one client in another process that
-** currently has an SQL transaction open on the database. It is set to 0 if
-** the database is not a wal-mode db, or if there is no such connection in any
-** other process. This opcode cannot be used to detect transactions opened
-** by clients within the current process, only within other processes.
-** </ul>
-**
-** <li>[[SQLITE_FCNTL_CKSM_FILE]]
-** Used by the cksmvfs VFS module only.
-** </ul>
 */
 #define SQLITE_FCNTL_LOCKSTATE               1
 #define SQLITE_FCNTL_GET_LOCKPROXYFILE       2
@@ -1184,8 +1166,6 @@ struct sqlite3_io_methods {
 #define SQLITE_FCNTL_CKPT_DONE              37
 #define SQLITE_FCNTL_RESERVE_BYTES          38
 #define SQLITE_FCNTL_CKPT_START             39
-#define SQLITE_FCNTL_EXTERNAL_READER        40
-#define SQLITE_FCNTL_CKSM_FILE              41

 /* deprecated names */
 #define SQLITE_GET_LOCKPROXYFILE      SQLITE_FCNTL_GET_LOCKPROXYFILE
@@ -2134,13 +2114,7 @@ struct sqlite3_mem_methods {
 ** The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether triggers are disabled or enabled
 ** following this call.  The second parameter may be a NULL pointer, in
-** which case the trigger setting is not reported back.
-**
-** <p>Originally this option disabled all triggers.  ^(However, since
-** SQLite version 3.35.0, TEMP triggers are still allowed even if
-** this option is off.  So, in other words, this option now only disables
-** triggers in the main database schema or in the schemas of ATTACH-ed
-** databases.)^ </dd>
+** which case the trigger setting is not reported back. </dd>
 **
 ** [[SQLITE_DBCONFIG_ENABLE_VIEW]]
 ** <dt>SQLITE_DBCONFIG_ENABLE_VIEW</dt>
@@ -2151,13 +2125,7 @@ struct sqlite3_mem_methods {
 ** The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether views are disabled or enabled
 ** following this call.  The second parameter may be a NULL pointer, in
-** which case the view setting is not reported back.
-**
-** <p>Originally this option disabled all views.  ^(However, since
-** SQLite version 3.35.0, TEMP views are still allowed even if
-** this option is off.  So, in other words, this option now only disables
-** views in the main database schema or in the schemas of ATTACH-ed
-** databases.)^ </dd>
+** which case the view setting is not reported back. </dd>
 **
 ** [[SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER]]
 ** <dt>SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER</dt>
@@ -3530,7 +3498,6 @@ SQLITE_API void sqlite3_progress_handler(sqlite3*, int, int(*)(void*), void*);
 **          that uses dot-files in place of posix advisory locking.
 ** <tr><td> file:data.db?mode=readonly <td>
 **          An error. "readonly" is not a valid option for the "mode" parameter.
-**          Use "ro" instead:  "file:data.db?mode=ro".
 ** </table>
 **
 ** ^URI hexadecimal escape sequences (%HH) are supported within the path and
@@ -3729,7 +3696,7 @@ SQLITE_API sqlite3_file *sqlite3_database_file_object(const char*);
 ** If the Y parameter to sqlite3_free_filename(Y) is anything other
 ** than a NULL pointer or a pointer previously acquired from
 ** sqlite3_create_filename(), then bad things such as heap
-** corruption or segfaults may occur. The value Y should not be
+** corruption or segfaults may occur. The value Y should be
 ** used again after sqlite3_free_filename(Y) has been called.  This means
 ** that if the [sqlite3_vfs.xOpen()] method of a VFS has been called using Y,
 ** then the corresponding [sqlite3_module.xClose() method should also be
@@ -4198,15 +4165,6 @@ SQLITE_API const char *sqlite3_normalized_sql(sqlite3_stmt *pStmt);
 ** [BEGIN] merely sets internal flags, but the [BEGIN|BEGIN IMMEDIATE] and
 ** [BEGIN|BEGIN EXCLUSIVE] commands do touch the database and so
 ** sqlite3_stmt_readonly() returns false for those commands.
-**
-** ^This routine returns false if there is any possibility that the
-** statement might change the database file.  ^A false return does
-** not guarantee that the statement will change the database file.
-** ^For example, an UPDATE statement might have a WHERE clause that
-** makes it a no-op, but the sqlite3_stmt_readonly() result would still
-** be false.  ^Similarly, a CREATE TABLE IF NOT EXISTS statement is a
-** read-only no-op if the table already exists, but
-** sqlite3_stmt_readonly() still returns false for such a statement.
 */
 SQLITE_API int sqlite3_stmt_readonly(sqlite3_stmt *pStmt);

@@ -4376,22 +4334,18 @@ typedef struct sqlite3_context sqlite3_context;
 ** contain embedded NULs.  The result of expressions involving strings
 ** with embedded NULs is undefined.
 **
-** ^The fifth argument to the BLOB and string binding interfaces controls
-** or indicates the lifetime of the object referenced by the third parameter.
-** These three options exist:
-** ^ (1) A destructor to dispose of the BLOB or string after SQLite has finished
-** with it may be passed. ^It is called to dispose of the BLOB or string even
-** if the call to the bind API fails, except the destructor is not called if
-** the third parameter is a NULL pointer or the fourth parameter is negative.
-** ^ (2) The special constant, [SQLITE_STATIC], may be passsed to indicate that
-** the application remains responsible for disposing of the object. ^In this
-** case, the object and the provided pointer to it must remain valid until
-** either the prepared statement is finalized or the same SQL parameter is
-** bound to something else, whichever occurs sooner.
-** ^ (3) The constant, [SQLITE_TRANSIENT], may be passed to indicate that the
-** object is to be copied prior to the return from sqlite3_bind_*(). ^The
-** object and pointer to it must remain valid until then. ^SQLite will then
-** manage the lifetime of its private copy.
+** ^The fifth argument to the BLOB and string binding interfaces
+** is a destructor used to dispose of the BLOB or
+** string after SQLite has finished with it.  ^The destructor is called
+** to dispose of the BLOB or string even if the call to the bind API fails,
+** except the destructor is not called if the third parameter is a NULL
+** pointer or the fourth parameter is negative.
+** ^If the fifth argument is
+** the special value [SQLITE_STATIC], then SQLite assumes that the
+** information is in static, unmanaged space and does not need to be freed.
+** ^If the fifth argument has the value [SQLITE_TRANSIENT], then
+** SQLite makes its own private copy of the data immediately, before
+** the sqlite3_bind_*() routine returns.
 **
 ** ^The sixth argument to sqlite3_bind_text64() must be one of
 ** [SQLITE_UTF8], [SQLITE_UTF16], [SQLITE_UTF16BE], or [SQLITE_UTF16LE]
@@ -5133,6 +5087,7 @@ SQLITE_API int sqlite3_reset(sqlite3_stmt *pStmt);
 ** within VIEWs, TRIGGERs, CHECK constraints, generated column expressions,
 ** index expressions, or the WHERE clause of partial indexes.
 **
+** <span style="background-color:#ffff90;">
 ** For best security, the [SQLITE_DIRECTONLY] flag is recommended for
 ** all application-defined SQL functions that do not need to be
 ** used inside of triggers, view, CHECK constraints, or other elements of
@@ -5142,6 +5097,7 @@ SQLITE_API int sqlite3_reset(sqlite3_stmt *pStmt);
 ** a database file to include invocations of the function with parameters
 ** chosen by the attacker, which the application will then execute when
 ** the database file is opened and read.
+** </span>
 **
 ** ^(The fifth parameter is an arbitrary pointer.  The implementation of the
 ** function can gain access to this pointer using [sqlite3_user_data()].)^
@@ -6230,57 +6186,6 @@ SQLITE_API const char *sqlite3_db_filename(sqlite3 *db, const char *zDbName);
 */
 SQLITE_API int sqlite3_db_readonly(sqlite3 *db, const char *zDbName);

-/*
-** CAPI3REF: Determine the transaction state of a database
-** METHOD: sqlite3
-**
-** ^The sqlite3_txn_state(D,S) interface returns the current
-** [transaction state] of schema S in database connection D.  ^If S is NULL,
-** then the highest transaction state of any schema on database connection D
-** is returned.  Transaction states are (in order of lowest to highest):
-** <ol>
-** <li value="0"> SQLITE_TXN_NONE
-** <li value="1"> SQLITE_TXN_READ
-** <li value="2"> SQLITE_TXN_WRITE
-** </ol>
-** ^If the S argument to sqlite3_txn_state(D,S) is not the name of
-** a valid schema, then -1 is returned.
-*/
-SQLITE_API int sqlite3_txn_state(sqlite3*,const char *zSchema);
-
-/*
-** CAPI3REF: Allowed return values from [sqlite3_txn_state()]
-** KEYWORDS: {transaction state}
-**
-** These constants define the current transaction state of a database file.
-** ^The [sqlite3_txn_state(D,S)] interface returns one of these
-** constants in order to describe the transaction state of schema S
-** in [database connection] D.
-**
-** <dl>
-** [[SQLITE_TXN_NONE]] <dt>SQLITE_TXN_NONE</dt>
-** <dd>The SQLITE_TXN_NONE state means that no transaction is currently
-** pending.</dd>
-**
-** [[SQLITE_TXN_READ]] <dt>SQLITE_TXN_READ</dt>
-** <dd>The SQLITE_TXN_READ state means that the database is currently
-** in a read transaction.  Content has been read from the database file
-** but nothing in the database file has changed.  The transaction state
-** will advanced to SQLITE_TXN_WRITE if any changes occur and there are
-** no other conflicting concurrent write transactions.  The transaction
-** state will revert to SQLITE_TXN_NONE following a [ROLLBACK] or
-** [COMMIT].</dd>
-**
-** [[SQLITE_TXN_WRITE]] <dt>SQLITE_TXN_WRITE</dt>
-** <dd>The SQLITE_TXN_WRITE state means that the database is currently
-** in a write transaction.  Content has been written to the database file
-** but has not yet committed.  The transaction state will change to
-** to SQLITE_TXN_NONE at the next [ROLLBACK] or [COMMIT].</dd>
-*/
-#define SQLITE_TXN_NONE  0
-#define SQLITE_TXN_READ  1
-#define SQLITE_TXN_WRITE 2
-
 /*
 ** CAPI3REF: Find the next prepared statement
 ** METHOD: sqlite3
@@ -7807,10 +7712,7 @@ SQLITE_API int sqlite3_test_control(int op, ...);
 #define SQLITE_TESTCTRL_RESULT_INTREAL          27
 #define SQLITE_TESTCTRL_PRNG_SEED               28
 #define SQLITE_TESTCTRL_EXTRA_SCHEMA_CHECKS     29
-#define SQLITE_TESTCTRL_SEEK_COUNT              30
-#define SQLITE_TESTCTRL_TRACEFLAGS              31
-#define SQLITE_TESTCTRL_TUNE                    32
-#define SQLITE_TESTCTRL_LAST                    32  /* Largest TESTCTRL */
+#define SQLITE_TESTCTRL_LAST                    29  /* Largest TESTCTRL */

 /*
 ** CAPI3REF: SQL Keyword Checking
@@ -9290,11 +9192,10 @@ SQLITE_API int sqlite3_vtab_on_conflict(sqlite3 *);
 ** CAPI3REF: Determine If Virtual Table Column Access Is For UPDATE
 **
 ** If the sqlite3_vtab_nochange(X) routine is called within the [xColumn]
-** method of a [virtual table], then it might return true if the
+** method of a [virtual table], then it returns true if and only if the
 ** column is being fetched as part of an UPDATE operation during which the
-** column value will not change.  The virtual table implementation can use
-** this hint as permission to substitute a return value that is less
-** expensive to compute and that the corresponding
+** column value will not change.  Applications might use this to substitute
+** a return value that is less expensive to compute and that the corresponding
 ** [xUpdate] method understands as a "no-change" value.
 **
 ** If the [xColumn] method calls sqlite3_vtab_nochange() and finds that
@@ -9303,12 +9204,6 @@ SQLITE_API int sqlite3_vtab_on_conflict(sqlite3 *);
 ** any of the [sqlite3_result_int|sqlite3_result_xxxxx() interfaces].
 ** In that case, [sqlite3_value_nochange(X)] will return true for the
 ** same column in the [xUpdate] method.
-**
-** The sqlite3_vtab_nochange() routine is an optimization.  Virtual table
-** implementations should continue to give a correct answer even if the
-** sqlite3_vtab_nochange() interface were to always return false.  In the
-** current implementation, the sqlite3_vtab_nochange() interface does always
-** returns false for the enhanced [UPDATE FROM] statement.
 */
 SQLITE_API int sqlite3_vtab_nochange(sqlite3_context*);

@@ -9450,7 +9345,6 @@ SQLITE_API void sqlite3_stmt_scanstatus_reset(sqlite3_stmt*);

 /*
 ** CAPI3REF: Flush caches to disk mid-transaction
-** METHOD: sqlite3
 **
 ** ^If a write-transaction is open on [database connection] D when the
 ** [sqlite3_db_cacheflush(D)] interface invoked, any dirty
@@ -9483,7 +9377,6 @@ SQLITE_API int sqlite3_db_cacheflush(sqlite3*);

 /*
 ** CAPI3REF: The pre-update hook.
-** METHOD: sqlite3
 **
 ** ^These interfaces are only available if SQLite is compiled using the
 ** [SQLITE_ENABLE_PREUPDATE_HOOK] compile-time option.
@@ -9524,7 +9417,7 @@ SQLITE_API int sqlite3_db_cacheflush(sqlite3*);
 ** seventh parameter is the final rowid value of the row being inserted
 ** or updated. The value of the seventh parameter passed to the callback
 ** function is not defined for operations on WITHOUT ROWID tables, or for
-** DELETE operations on rowid tables.
+** INSERT operations on rowid tables.
 **
 ** The [sqlite3_preupdate_old()], [sqlite3_preupdate_new()],
 ** [sqlite3_preupdate_count()], and [sqlite3_preupdate_depth()] interfaces
@@ -9562,15 +9455,6 @@ SQLITE_API int sqlite3_db_cacheflush(sqlite3*);
 ** triggers; or 2 for changes resulting from triggers called by top-level
 ** triggers; and so forth.
 **
-** When the [sqlite3_blob_write()] API is used to update a blob column,
-** the pre-update hook is invoked with SQLITE_DELETE. This is because the
-** in this case the new values are not available. In this case, when a
-** callback made with op==SQLITE_DELETE is actuall a write using the
-** sqlite3_blob_write() API, the [sqlite3_preupdate_blobwrite()] returns
-** the index of the column being written. In other cases, where the
-** pre-update hook is being invoked for some other reason, including a
-** regular DELETE, sqlite3_preupdate_blobwrite() returns -1.
-**
 ** See also:  [sqlite3_update_hook()]
 */
 #if defined(SQLITE_ENABLE_PREUPDATE_HOOK)
@@ -9591,12 +9475,10 @@ SQLITE_API int sqlite3_preupdate_old(sqlite3 *, int, sqlite3_value **);
 SQLITE_API int sqlite3_preupdate_count(sqlite3 *);
 SQLITE_API int sqlite3_preupdate_depth(sqlite3 *);
 SQLITE_API int sqlite3_preupdate_new(sqlite3 *, int, sqlite3_value **);
-SQLITE_API int sqlite3_preupdate_blobwrite(sqlite3 *);
 #endif

 /*
 ** CAPI3REF: Low-level system error code
-** METHOD: sqlite3
 **
 ** ^Attempt to return the underlying operating system error code or error
 ** number that caused the most recent I/O error or failure to open a file.
@@ -9830,8 +9712,8 @@ SQLITE_API SQLITE_EXPERIMENTAL int sqlite3_snapshot_recover(sqlite3 *db, const c
 ** SQLITE_SERIALIZE_NOCOPY bit is omitted from argument F if a memory
 ** allocation error occurs.
 **
-** This interface is omitted if SQLite is compiled with the
-** [SQLITE_OMIT_DESERIALIZE] option.
+** This interface is only available if SQLite is compiled with the
+** [SQLITE_ENABLE_DESERIALIZE] option.
 */
 SQLITE_API unsigned char *sqlite3_serialize(
  sqlite3 *db,           /* The database connection */
@@ -9882,8 +9764,8 @@ SQLITE_API unsigned char *sqlite3_serialize(
 ** SQLITE_DESERIALIZE_FREEONCLOSE bit is set in argument F, then
 ** [sqlite3_free()] is invoked on argument P prior to returning.
 **
-** This interface is omitted if SQLite is compiled with the
-** [SQLITE_OMIT_DESERIALIZE] option.
+** This interface is only available if SQLite is compiled with the
+** [SQLITE_ENABLE_DESERIALIZE] option.
 */
 SQLITE_API int sqlite3_deserialize(
  sqlite3 *db,            /* The database connection */
@@ -10132,38 +10014,6 @@ SQLITE_API int sqlite3session_create(
 */
 SQLITE_API void sqlite3session_delete(sqlite3_session *pSession);

-/*
-** CAPIREF: Conigure a Session Object
-** METHOD: sqlite3_session
-**
-** This method is used to configure a session object after it has been
-** created. At present the only valid value for the second parameter is
-** [SQLITE_SESSION_OBJCONFIG_SIZE].
-**
-** Arguments for sqlite3session_object_config()
-**
-** The following values may passed as the the 4th parameter to
-** sqlite3session_object_config().
-**
-** <dt>SQLITE_SESSION_OBJCONFIG_SIZE <dd>
-**   This option is used to set, clear or query the flag that enables
-**   the [sqlite3session_changeset_size()] API. Because it imposes some
-**   computational overhead, this API is disabled by default. Argument
-**   pArg must point to a value of type (int). If the value is initially
-**   0, then the sqlite3session_changeset_size() API is disabled. If it
-**   is greater than 0, then the same API is enabled. Or, if the initial
-**   value is less than zero, no change is made. In all cases the (int)
-**   variable is set to 1 if the sqlite3session_changeset_size() API is
-**   enabled following the current call, or 0 otherwise.
-**
-**   It is an error (SQLITE_MISUSE) to attempt to modify this setting after
-**   the first table has been attached to the session object.
-*/
-SQLITE_API int sqlite3session_object_config(sqlite3_session*, int op, void *pArg);
-
-/*
-*/
-#define SQLITE_SESSION_OBJCONFIG_SIZE 1

 /*
 ** CAPI3REF: Enable Or Disable A Session Object
@@ -10408,22 +10258,6 @@ SQLITE_API int sqlite3session_changeset(
  void **ppChangeset              /* OUT: Buffer containing changeset */
 );

-/*
-** CAPI3REF: Return An Upper-limit For The Size Of The Changeset
-** METHOD: sqlite3_session
-**
-** By default, this function always returns 0. For it to return
-** a useful result, the sqlite3_session object must have been configured
-** to enable this API using sqlite3session_object_config() with the
-** SQLITE_SESSION_OBJCONFIG_SIZE verb.
-**
-** When enabled, this function returns an upper limit, in bytes, for the size
-** of the changeset that might be produced if sqlite3session_changeset() were
-** called. The final changeset size might be equal to or smaller than the
-** size in bytes returned by this function.
-*/
-SQLITE_API sqlite3_int64 sqlite3session_changeset_size(sqlite3_session *pSession);
-
 /*
 ** CAPI3REF: Load The Difference Between Tables Into A Session
 ** METHOD: sqlite3_session
@@ -10541,14 +10375,6 @@ SQLITE_API int sqlite3session_patchset(
 */
 SQLITE_API int sqlite3session_isempty(sqlite3_session *pSession);

-/*
-** CAPI3REF: Query for the amount of heap memory used by a session object.
-**
-** This API returns the total amount of heap memory in bytes currently
-** used by the session object passed as the only argument.
-*/
-SQLITE_API sqlite3_int64 sqlite3session_memory_used(sqlite3_session *pSession);
-
 /*
 ** CAPI3REF: Create An Iterator To Traverse A Changeset
 ** CONSTRUCTOR: sqlite3_changeset_iter
@@ -10651,23 +10477,18 @@ SQLITE_API int sqlite3changeset_next(sqlite3_changeset_iter *pIter);
 ** call to [sqlite3changeset_next()] must have returned [SQLITE_ROW]. If this
 ** is not the case, this function returns [SQLITE_MISUSE].
 **
-** Arguments pOp, pnCol and pzTab may not be NULL. Upon return, three
-** outputs are set through these pointers:
-**
-** *pOp is set to one of [SQLITE_INSERT], [SQLITE_DELETE] or [SQLITE_UPDATE],
-** depending on the type of change that the iterator currently points to;
-**
-** *pnCol is set to the number of columns in the table affected by the change; and
-**
-** *pzTab is set to point to a nul-terminated utf-8 encoded string containing
-** the name of the table affected by the current change. The buffer remains
-** valid until either sqlite3changeset_next() is called on the iterator
-** or until the conflict-handler function returns.
-**
-** If pbIndirect is not NULL, then *pbIndirect is set to true (1) if the change
+** If argument pzTab is not NULL, then *pzTab is set to point to a
+** nul-terminated utf-8 encoded string containing the name of the table
+** affected by the current change. The buffer remains valid until either
+** sqlite3changeset_next() is called on the iterator or until the
+** conflict-handler function returns. If pnCol is not NULL, then *pnCol is
+** set to the number of columns in the table affected by the change. If
+** pbIndirect is not NULL, then *pbIndirect is set to true (1) if the change
 ** is an indirect change, or false (0) otherwise. See the documentation for
 ** [sqlite3session_indirect()] for a description of direct and indirect
-** changes.
+** changes. Finally, if pOp is not NULL, then *pOp is set to one of
+** [SQLITE_INSERT], [SQLITE_DELETE] or [SQLITE_UPDATE], depending on the
+** type of change that the iterator currently points to.
 **
 ** If no error occurs, SQLITE_OK is returned. If an error does occur, an
 ** SQLite error code is returned. The values of the output variables may not
@@ -23,19 +23,6 @@ function enableSourceMaps() {

 function _resolveSourceMapURL(source) {
  const { url = "", sourceMapURL = "" } = source;
-  
-  const UNSUPPORTED_PROTOCOLS = ["chrome://", "resource://"];
-  if (path.isURL(sourceMapURL) && UNSUPPORTED_PROTOCOLS.some(protocol => sourceMapURL.startsWith(protocol))) {
-    // If it's an internal protocol, don't allow it and return empty.
-    return "";
-  }
-  if (path.isURL(sourceMapURL) && sourceMapURL.startsWith("file://")) {
-    // Only allow file:// source maps from file:// docs
-    if (!url.startsWith("file://")) {
-      return "";
-    }
-  }
-  
  if (path.isURL(sourceMapURL) || url == "") {
    // If it's already a full URL or the source doesn't have a URL,
    // don't resolve anything.
@@ -8,7 +8,6 @@
 * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
 * Copyright (C) 2011 Google Inc. All rights reserved.
 * Copyright (C) 2009 Mozilla Foundation. All rights reserved.
- * Copyright (C) 2022 Moonchild Productions. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
@@ -401,15 +400,9 @@ const CurlUtils = {
   */
  escapeStringWin: function (str) {
    /* 
-       Replace the backtick character ` with `` in order to escape it.
-       The backtick character is an escape character in PowerShell and
-       can, among other things, be used to disable the effect of some
-       of the other escapes created below.
-
-       Replace dollar sign because of commands in powershell when using
-       double quotes. e.g $(calc.exe).
-       
-       Also see http://www.rlmueller.net/PowerShellEscape.htm for details.
+       Replace dollar sign because of commands (e.g $(cmd.exe)) in
+       powershell when using double quotes.
+       Useful details http://www.rlmueller.net/PowerShellEscape.htm

       Replace quote by double quote (but not by \") because it is
       recognized by both cmd.exe and MS Crt arguments parser.
@@ -423,15 +416,13 @@ const CurlUtils = {
       MS Crt arguments parser won't collapse them.

       Replace new line outside of quotes since cmd.exe doesn't let
-       us do it inside.
+       to do it inside.
    */
-    return "\"" + 
-      str.replaceAll("`", "``")
-         .replaceAll("$", "`$")
-         .replaceAll('"', '""')
-         .replaceAll("%", '"%"')
-         .replace(/\\/g, "\\\\")
-         .replace(/[\r\n]+/g, "\"^$&\"") + "\"";
+    return "\"" + str.replace(/\$/g, "`$")
+                     .replace(/"/g, "\"\"")
+                     .replace(/%/g, "\"%\"")
+                     .replace(/\\/g, "\\\\")
+                     .replace(/[\r\n]+/g, "\"^$&\"") + "\"";
  }
 };

@@ -822,8 +822,6 @@ nsDocShell::nsDocShell()
  , mTouchEventsOverride(nsIDocShell::TOUCHEVENTS_OVERRIDE_NONE)
  , mStateFloodGuardCount(0)
  , mStateFloodGuardReported(false)
-  , mReloadFloodGuardCount(0)
-  , mReloadFloodGuardReported(false)
 {
  AssertOriginAttributesMatchPrivateBrowsing();
  mHistoryID = ++gDocshellIDCounter;
@@ -5331,25 +5329,6 @@ nsDocShell::LoadErrorPage(nsIURI* aURI, const char16_t* aURL,
                      nullptr);
 }

-bool
-nsDocShell::IsReloadFlooding()
-{
-  if (mReloadFloodGuardCount > kReloadLimit) {
-    TimeStamp now = TimeStamp::Now();
-
-    if (now - mReloadFloodGuardUpdated > TimeDuration::FromSeconds(kReloadTimeSecs)) {
-      mReloadFloodGuardCount = 0;
-      mReloadFloodGuardUpdated = now;
-      mReloadFloodGuardReported = false;
-      return false;
-    }
-    return true;
-  }
-
-  mReloadFloodGuardCount++;
-  return false;
-}
-
 NS_IMETHODIMP
 nsDocShell::Reload(uint32_t aReloadFlags)
 {
@@ -5375,26 +5354,6 @@ nsDocShell::Reload(uint32_t aReloadFlags)
    shistInt->NotifyOnHistoryReload(mCurrentURI, aReloadFlags, &canReload);
  }

-  // If we're being flooded with reload requests, we should abort early
-  // from the reload logic.
-  if (IsReloadFlooding()) {
-    // Report a warning to the console to tell developers why their reload
-    // failed.
-    // Do this only if not yet marked reported so we only report it once per
-    // flood interval.
-    if (!mReloadFloodGuardReported) {
-#if 0
-      nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
-                                      NS_LITERAL_CSTRING("Reload"),
-                                      GetDocument(),
-                                      nsContentUtils::eDOM_PROPERTIES,
-                                      "ReloadFloodingPrevented");
-#endif
-      mReloadFloodGuardReported = true;
-    }
-    return NS_OK;
-  }
-
  if (!canReload) {
    return NS_OK;
  }
@@ -9394,11 +9353,7 @@ nsDocShell::SetupNewViewer(nsIContentViewer* aNewViewer)
  mContentViewer->SetNavigationTiming(mTiming);

  if (NS_FAILED(mContentViewer->Init(widget, bounds))) {
-    nsCOMPtr<nsIContentViewer> viewer = mContentViewer;
-    viewer->Close(nullptr);
-    viewer->Destroy();
    mContentViewer = nullptr;
-    mCurrentURI = nullptr;
    NS_WARNING("ContentViewer Initialization failed");
    return NS_ERROR_FAILURE;
  }
@@ -1058,15 +1058,6 @@ private:
  const int32_t kStateUpdateLimit = 50;
  const double kRefreshTimeSecs = 10.0;

-  // Keep track how how many history state changes we're getting, to catch &
-  // prevent flooding.
-  int32_t mReloadFloodGuardCount;
-  mozilla::TimeStamp mReloadFloodGuardUpdated;
-  bool mReloadFloodGuardReported;
-  // We have a limit of reloading 50 times every 10 seconds.
-  const int32_t kReloadLimit = 50;
-  const double kReloadTimeSecs = 10.0;
-
  // Separate function to do the actual name (i.e. not _top, _self etc.)
  // searching for FindItemWithName.
  nsresult DoFindItemWithName(const nsAString& aName,
@@ -1086,9 +1077,6 @@ private:
  // ReplaceState.
  bool IsStateChangeFlooding();

-  // Helper method for Reload which checks for excessive calls to Reload.
-  bool IsReloadFlooding();
-
 #ifdef DEBUG
  // We're counting the number of |nsDocShells| to help find leaks
  static unsigned long gNumberOfDocShells;
@@ -775,7 +775,6 @@ FileReader::Shutdown()
    mAsyncStream = nullptr;
  }

-  ClearProgressEventTimer();
  FreeFileData();
  mResultArrayBuffer = nullptr;

@@ -9892,13 +9892,6 @@ nsGlobalWindow::Btoa(const nsAString& aBinaryData,
  aError = nsContentUtils::Btoa(aBinaryData, aAsciiBase64String);
 }

-void
-nsGlobalWindow::GetOrigin(nsAString& aOrigin)
-{
-  MOZ_ASSERT(IsInnerWindow());
-  nsContentUtils::GetUTFOrigin(GetPrincipal(), aOrigin);
-}
-
 //*****************************************************************************
 // nsGlobalWindow::nsIDOMEventTarget
 //*****************************************************************************
@@ -958,7 +958,6 @@ public:
            mozilla::ErrorResult& aError);
  void Btoa(const nsAString& aBinaryData, nsAString& aAsciiBase64String,
            mozilla::ErrorResult& aError);
-  void GetOrigin(nsAString& aOrigin);
  mozilla::dom::DOMStorage* GetSessionStorage(mozilla::ErrorResult& aError);
  mozilla::dom::DOMStorage*
  GetLocalStorage(mozilla::ErrorResult& aError);
@@ -15,7 +15,6 @@
 #include "xpcpublic.h"

 #include "mozilla/Base64.h"
-#include "mozilla/CheckedInt.h"
 #include "mozilla/dom/ScriptSettings.h"

 using namespace mozilla;
@@ -139,11 +138,6 @@ nsStructuredCloneContainer::GetDataAsBase64(nsAString &aOut)

  auto iter = Data().Start();
  size_t size = Data().Size();
-  CheckedInt<nsAutoCString::size_type> sizeCheck(size);
-  if (!sizeCheck.isValid()) {
-    return NS_ERROR_FAILURE;
-  }
-
  nsAutoCString binaryData;
  binaryData.SetLength(size);
  Data().ReadBytes(iter, binaryData.BeginWriting(), size);
@@ -197,11 +197,6 @@ FirstNon8Bit(const char16_t *str, const char16_t *end)
 bool
 nsTextFragment::SetTo(const char16_t* aBuffer, int32_t aLength, bool aUpdateBidi)
 {
-  if (MOZ_UNLIKELY(aLength < 0 || static_cast<uint32_t>(aLength) >
-                                      NS_MAX_TEXT_FRAGMENT_LENGTH)) {
-    return false;
-  }
-
  ReleaseText();

  if (aLength == 0) {
@@ -333,30 +328,26 @@ nsTextFragment::Append(const char16_t* aBuffer, uint32_t aLength, bool aUpdateBi
  // This is a common case because some callsites create a textnode
  // with a value by creating the node and then calling AppendData.
  if (mState.mLength == 0) {
-    if (MOZ_UNLIKELY(aLength > INT32_MAX)) {
-      return false;
-    }
    return SetTo(aBuffer, aLength, aUpdateBidi);
  }

  // Should we optimize for aData.Length() == 0?

-  // Note: Using CheckedInt here is wrong as nsTextFragment is 29 bits and needs an
-  // explicit check for that length and not INT_MAX. Also, this method can be a very
-  // hot path and cause performance loss since CheckedInt isn't inlined.
-  if (NS_MAX_TEXT_FRAGMENT_LENGTH - mState.mLength < aLength) {
-    return false;  // Would be overflowing if we'd continue.
+  CheckedUint32 length = mState.mLength;
+  length += aLength;
+
+  if (!length.isValid()) {
+    return false;
  }

  if (mState.mIs2b) {
-    size_t size = mState.mLength + aLength;
-    if (SIZE_MAX / sizeof(char16_t) < size) {
-      return false;  // Would be overflowing if we'd continue.
+    length *= sizeof(char16_t);
+    if (!length.isValid()) {
+      return false;
    }
-    size *= sizeof(char16_t);

    // Already a 2-byte string so the result will be too
-    char16_t* buff = static_cast<char16_t*>(realloc(m2b, size));
+    char16_t* buff = static_cast<char16_t*>(realloc(m2b, length.value()));
    if (!buff) {
      return false;
    }
@@ -376,15 +367,14 @@ nsTextFragment::Append(const char16_t* aBuffer, uint32_t aLength, bool aUpdateBi
  int32_t first16bit = FirstNon8Bit(aBuffer, aBuffer + aLength);

  if (first16bit != -1) { // aBuffer contains no non-8bit character
-    size_t size = mState.mLength + aLength;
-    if (SIZE_MAX / sizeof(char16_t) < size) {
-      return false;  // Would be overflowing if we'd continue.
+    length *= sizeof(char16_t);
+    if (!length.isValid()) {
+      return false;
    }
-    size *= sizeof(char16_t);

    // The old data was 1-byte, but the new is not so we have to expand it
    // all to 2-byte
-    char16_t* buff = static_cast<char16_t*>(malloc(size));
+    char16_t* buff = static_cast<char16_t*>(malloc(length.value()));
    if (!buff) {
      return false;
    }
@@ -412,22 +402,15 @@ nsTextFragment::Append(const char16_t* aBuffer, uint32_t aLength, bool aUpdateBi
  }

  // The new and the old data is all 1-byte
-
-  // Note: Using CheckedInt here is wrong. See above.
-  if (NS_MAX_TEXT_FRAGMENT_LENGTH - mState.mLength < aLength) {
-    return false;  // Would be overflowing if we'd continue.
-  }
-  
-  size_t size = mState.mLength + aLength;
-  MOZ_ASSERT(sizeof(char) == 1);
  char* buff;
  if (mState.mInHeap) {
-    buff = static_cast<char*>(realloc(const_cast<char*>(m1b), size));
+    buff = static_cast<char*>(realloc(const_cast<char*>(m1b), length.value()));
    if (!buff) {
      return false;
    }
-  } else {
-    buff = static_cast<char*>(malloc(size));
+  }
+  else {
+    buff = static_cast<char*>(malloc(length.value()));
    if (!buff) {
      return false;
    }
@@ -21,8 +21,6 @@

 class nsString;

-#define NS_MAX_TEXT_FRAGMENT_LENGTH (static_cast<uint32_t>(0x1FFFFFFF))
-
 // XXX should this normalize the code to keep a \u0000 at the end?

 // XXX nsTextFragmentPool?
@@ -205,8 +203,6 @@ public:
    return mState.mIs2b ? m2b[aIndex] : static_cast<unsigned char>(m1b[aIndex]);
  }

-  // Packed 32-bit data structure:
-  // [InHeap(1)][Is2b(1)][IsBidi(1)][Data(29)]
  struct FragmentBits {
    // uint32_t to ensure that the values are unsigned, because we
    // want 0/1, not 0/-1!
@@ -216,8 +212,6 @@ public:
    uint32_t mInHeap : 1;
    uint32_t mIs2b : 1;
    uint32_t mIsBidi : 1;
-    // Note: If you change the number of bits of mLength, you also need to
-    // change NS_MAX_TEXT_FRAGMENT_LENGTH (see top of file).
    uint32_t mLength : 29;
  };

@@ -293,6 +293,7 @@ DOMInterfaces = {
    # We can also get rid of the UnwrapArg bits in
    # the dom QueryInterface (in BindingUtils.cpp) at that point.
    'hasXPConnectImpls': True,
+    'concrete': False,
    'jsImplParent': 'mozilla::DOMEventTargetHelper',
    'implicitJSContext': [ 'dispatchEvent' ]
 },
@@ -2321,11 +2321,22 @@ class MethodDefiner(PropertyDefiner):
                if len(signatures) > 1 or len(signatures[0][1]) > 1 or not argTypeIsIID(signatures[0][1][0]):
                    raise TypeError("There should be only one queryInterface method with 1 argument of type IID")

-                # Make sure to not stick QueryInterface on abstract interfaces.
+                # Make sure to not stick QueryInterface on abstract interfaces that
+                # have hasXPConnectImpls (like EventTarget).  So only put it on
+                # interfaces that are concrete and all of whose ancestors are abstract.
+                def allAncestorsAbstract(iface):
+                    if not iface.parent:
+                        return True
+                    desc = self.descriptor.getDescriptor(iface.parent.identifier.name)
+                    if desc.concrete:
+                        return False
+                    return allAncestorsAbstract(iface.parent)
                if (not self.descriptor.interface.hasInterfacePrototypeObject() or
-                    not self.descriptor.concrete):
+                    not self.descriptor.concrete or
+                    not allAncestorsAbstract(self.descriptor.interface)):
                    raise TypeError("QueryInterface is only supported on "
-                                    "interfaces that are concrete: " +
+                                    "interfaces that are concrete and all "
+                                    "of whose ancestors are abstract: " +
                                    self.descriptor.name)
                condition = "WantsQueryInterface<%s>::Enabled" % descriptor.nativeType
                self.regular.append({
@@ -1066,15 +1066,6 @@ WebGLContext::DoFakeVertexAttrib0(const char* funcName, GLuint vertexCount)
        vertexCount = 1;
    }

-    if (gl->WorkAroundDriverBugs() && gl->Vendor() == gl::GLVendor::Nouveau) {
-      // Padded/strided to vec4, so 4x4bytes.
-      const auto effectiveVertAttribBytes = CheckedInt<int32_t>(vertexCount) * 4 * 4;
-      if (!effectiveVertAttribBytes.isValid()) {
-        ErrorOutOfMemory("`offset + count` too large for Mesa.");
-        return false;
-      }
-    }
-
    const auto whatDoesAttrib0Need = WhatDoesVertexAttrib0Need();
    if (MOZ_LIKELY(whatDoesAttrib0Need == WebGLVertexAttrib0Status::Default))
        return true;
@@ -1,20 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/dom/ConstructibleEventTarget.h"
-#include "mozilla/dom/EventTargetBinding.h"
-
-namespace mozilla {
-namespace dom {
-
-JSObject*
-ConstructibleEventTarget::WrapObject(JSContext* cx, JS::Handle<JSObject*> aGivenProto)
-{
-  return EventTargetBinding::Wrap(cx, this, aGivenProto);
-}
-
-} // namespace dom
-} // namespace mozilla
-
@@ -1,34 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_ConstructibleEventTarget_h_
-#define mozilla_dom_ConstructibleEventTarget_h_
-
-#include "mozilla/DOMEventTargetHelper.h"
-#include "js/RootingAPI.h"
-
-namespace mozilla {
-namespace dom {
-
-class ConstructibleEventTarget : public DOMEventTargetHelper
-{
-public:
-  // We're not worrying about ISupports and Cycle Collection here just for a wrapper function.
-  // This does mean that ConstructibleEventTarget will show up in CC and refcount logs as a
-  // DOMEventTargetHelper, but that's OK.
-
-  explicit ConstructibleEventTarget(nsIGlobalObject* aGlobalObject)
-    : DOMEventTargetHelper(aGlobalObject)
-  {
-  }
-
-  virtual JSObject* WrapObject(JSContext* cx,
-			       JS::Handle<JSObject*> aGivenProto) override;
-};
-
-} // namespace dom
-} // namespace mozilla
-
-#endif // mozilla_dom_ConstructibleEventTarget_h_
@@ -146,7 +146,10 @@ public:
  void BindToOwner(nsPIDOMWindowInner* aOwner);
  void BindToOwner(DOMEventTargetHelper* aOther);
  virtual void DisconnectFromOwner();                   
-  using EventTarget::GetParentObject;
+  nsIGlobalObject* GetParentObject() const
+  {
+    return GetOwnerGlobal();
+  }
  virtual nsIGlobalObject* GetOwnerGlobal() const override
  {
    nsCOMPtr<nsIGlobalObject> parentObject = do_QueryReferent(mParentObject);
@@ -639,11 +639,16 @@ DataTransfer::PrincipalMaySetData(const nsAString& aType,
      return false;
    }

-    // Don't allow adding internal types of the form */x-moz-*, but
-    // special-case the url types as they are simple variations of urls.
-    if (FindInReadable(NS_LITERAL_STRING(kInternal_Mimetype_Prefix), aType) &&
-        !StringBeginsWith(aType, NS_LITERAL_STRING("text/x-moz-url"))) {
-      NS_WARNING("Disallowing adding requested internal type to DataTransfer");
+    if (aType.EqualsASCII(kFileMime) ||
+        aType.EqualsASCII(kFilePromiseMime)) {
+      NS_WARNING("Disallowing adding x-moz-file or x-moz-file-promize types to DataTransfer");
+      return false;
+    }
+    
+    // Disallow content from creating x-moz-place flavors, so that it cannot
+    // create fake Places smart queries exposing user data.
+    if (StringBeginsWith(aType, NS_LITERAL_STRING("text/x-moz-place"))) {
+      NS_WARNING("Disallowing adding moz-place types to DataTransfer");
      return false;
    }
  }
@@ -751,8 +751,6 @@ EventListenerManager::SetEventHandler(nsIAtom* aName,
                                      bool aPermitUntrustedEvents,
                                      Element* aElement)
 {
-  auto removeEventHandler = MakeScopeExit([&] { RemoveEventHandler(aName, EmptyString()); });
-
  nsCOMPtr<nsIDocument> doc;
  nsCOMPtr<nsIScriptGlobalObject> global =
    GetScriptGlobalAndDocument(getter_AddRefs(doc));
@@ -827,8 +825,6 @@ EventListenerManager::SetEventHandler(nsIAtom* aName,
  NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
  NS_ENSURE_STATE(global->GetGlobalJSObject());

-  removeEventHandler.release();
-
  Listener* listener = SetEventHandlerInternal(aName,
                                               EmptyString(),
                                               TypedEventHandler(),
@@ -7,26 +7,11 @@
 #include "mozilla/dom/Event.h"
 #include "mozilla/dom/EventTarget.h"
 #include "mozilla/dom/EventTargetBinding.h"
-#include "mozilla/dom/ConstructibleEventTarget.h"
-#include "nsIGlobalObject.h"
 #include "nsThreadUtils.h"

 namespace mozilla {
 namespace dom {

-/* static */
-already_AddRefed<EventTarget>
-EventTarget::Constructor(const GlobalObject& aGlobal, ErrorResult& aRv)
-{
-  nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aGlobal.GetAsSupports());
-  if (!global) {
-    aRv.Throw(NS_ERROR_UNEXPECTED);
-    return nullptr;
-  }
-  RefPtr<EventTarget> target = new ConstructibleEventTarget(global);
-  return target.forget();
-}
-
 void
 EventTarget::RemoveEventListener(const nsAString& aType,
                                 EventListener* aListener,
@@ -26,7 +26,6 @@ class Event;
 class EventListener;
 class EventListenerOptionsOrBoolean;
 class EventHandlerNonNull;
-class GlobalObject;

 template <class T> struct Nullable;

@@ -42,8 +41,6 @@ public:
  NS_DECLARE_STATIC_IID_ACCESSOR(NS_EVENTTARGET_IID)

  // WebIDL API
-  static already_AddRefed<EventTarget> Constructor(const GlobalObject& aGlobal,
-                                                   ErrorResult& aRv);
  using nsIDOMEventTarget::AddEventListener;
  using nsIDOMEventTarget::RemoveEventListener;
  using nsIDOMEventTarget::DispatchEvent;
@@ -58,11 +55,6 @@ public:
                                   ErrorResult& aRv);
  bool DispatchEvent(JSContext* aCx, Event& aEvent, ErrorResult& aRv);

-  nsIGlobalObject* GetParentObject() const
-  {
-    return GetOwnerGlobal();
-  }
-
  // Note, this takes the type in onfoo form!
  EventHandlerNonNull* GetEventHandler(const nsAString& aType)
  {
@@ -40,7 +40,6 @@ EXPORTS.mozilla.dom += [
    'ClipboardEvent.h',
    'CommandEvent.h',
    'CompositionEvent.h',
-    'ConstructibleEventTarget.h',
    'CustomEvent.h',
    'DataContainerEvent.h',
    'DataTransfer.h',
@@ -81,7 +80,6 @@ SOURCES += [
    'ClipboardEvent.cpp',
    'CommandEvent.cpp',
    'CompositionEvent.cpp',
-    'ConstructibleEventTarget.cpp',
    'ContentEventHandler.cpp',
    'CustomEvent.cpp',
    'DataContainerEvent.cpp',
@@ -193,13 +193,7 @@ HTMLObjectElement::AfterMaybeChangeAttr(int32_t aNamespaceID, nsIAtom* aName,
    // attributes before inserting the node into the document.
    if (aNotify && IsInComposedDoc() && mIsDoneAddingChildren &&
        aName == nsGkAtoms::data) {
-      nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
-          [self = RefPtr<HTMLObjectElement>(this), aNotify]() {
-            if (self->IsInComposedDoc()) {
-              self->LoadObject(aNotify, true);
-            }
-          }));
-      return NS_OK;
+      return LoadObject(aNotify, true);
    }
  }

@@ -177,13 +177,8 @@ HTMLSharedObjectElement::AfterMaybeChangeAttr(int32_t aNamespaceID,
      // a document, just in case that the caller wants to set additional
      // attributes before inserting the node into the document.
      if (aNotify && IsInComposedDoc() && mIsDoneAddingChildren) {
-        nsContentUtils::AddScriptRunner(NS_NewRunnableFunction(
-            [self = RefPtr<HTMLSharedObjectElement>(this), aNotify]() {
-              if (self->IsInComposedDoc()) {
-                self->LoadObject(aNotify, true);
-              }
-            }));
-        return NS_OK;
+        nsresult rv = LoadObject(aNotify, true);
+        NS_ENSURE_SUCCESS(rv, rv);
      }
    }
  }
@@ -26311,17 +26311,13 @@ ObjectStoreAddOrPutRequestOp::DoDatabaseWork(DatabaseConnection* aConnection)
      return rv;
    }
  } else {
-    AutoTArray<char, 4096> flatCloneData;  // 4096 from JSStructuredCloneData
-    if (!flatCloneData.SetLength(cloneDataSize, fallible)) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-    { // iter scope
-      auto iter = cloneData.Start();
-      MOZ_ALWAYS_TRUE(cloneData.ReadBytes(iter, flatCloneData.Elements(), cloneDataSize));
-    }
+    nsCString flatCloneData;
+    flatCloneData.SetLength(cloneDataSize);
+    auto iter = cloneData.Start();
+    cloneData.ReadBytes(iter, flatCloneData.BeginWriting(), cloneDataSize);

    // Compress the bytes before adding into the database.
-    const char* uncompressed = flatCloneData.Elements();
+    const char* uncompressed = flatCloneData.BeginReading();
    size_t uncompressedLength = cloneDataSize;

    size_t compressedLength = snappy::MaxCompressedLength(uncompressedLength);
@@ -2817,10 +2817,10 @@ bool
 ContentChild::RecvGetFilesResponse(const nsID& aUUID,
                                   const GetFilesResponseResult& aResult)
 {
-  RefPtr<GetFilesHelperChild> child;
+  GetFilesHelperChild* child = mGetFilesPendingRequests.GetWeak(aUUID);
  // This object can already been deleted in case DeleteGetFilesRequest has
  // been called when the response was sending by the parent.
-  if (!mGetFilesPendingRequests.Remove(aUUID, getter_AddRefs(child))) {
+  if (!child) {
    return true;
  }

@@ -2841,6 +2841,7 @@ ContentChild::RecvGetFilesResponse(const nsID& aUUID,
    child->Finished(succeeded ? NS_OK : NS_ERROR_OUT_OF_MEMORY);
  }

+  mGetFilesPendingRequests.Remove(aUUID);
  return true;
 }

@@ -318,5 +318,3 @@ LargeAllocationInIFrame=A Large-Allocation header was ignored due to the load oc
 LargeAllocationNonE10S=A Large-Allocation header was ignored due to the document not being loaded out of process.
 # LOCALIZATION NOTE: Do not translate "pushState" and "replaceState"
 PushStateFloodingPrevented=Call to pushState or replaceState ignored due to excessive calls within a short timeframe.
-# LOCALIZATION NOTE: Do not translate "Reload"
-ReloadFloodingPrevented=Call to Reload ignored due to excessive calls within a short timeframe.
@@ -819,9 +819,8 @@ ADTSTrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize)

  const int64_t streamLen = StreamLength();
  if (mInfo && streamLen > 0) {
-    int64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
    // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, max);
+    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
  }

  uint32_t read = 0;
@@ -465,12 +465,10 @@ MediaSourceTrackDemuxer::DoGetSamples(int32_t aNumSamples)
  }
  RefPtr<SamplesHolder> samples = new SamplesHolder;
  samples->mSamples.AppendElement(sample);
-  {
+  if (mNextRandomAccessPoint.ToMicroseconds() <= sample->mTime) {
    MonitorAutoLock mon(mMonitor);
-    if (mNextRandomAccessPoint.ToMicroseconds() <= sample->mTime) {
-      mNextRandomAccessPoint =
-        mManager->GetNextRandomAccessPoint(mType, MediaSourceDemuxer::EOS_FUZZ);
-    }
+    mNextRandomAccessPoint =
+      mManager->GetNextRandomAccessPoint(mType, MediaSourceDemuxer::EOS_FUZZ);
  }
  return SamplesPromise::CreateAndResolve(samples, __func__);
 }
@@ -676,9 +676,8 @@ MP3TrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize) {

  const int64_t streamLen = StreamLength();
  if (mInfo && streamLen > 0) {
-    uint64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
    // Prevent blocking reads after successful initialization.
-    aSize = std::min<int64_t>(aSize, max);
+    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
  }

  uint32_t read = 0;
@@ -611,8 +611,7 @@ WAVTrackDemuxer::Read(uint8_t* aBuffer, int64_t aOffset, int32_t aSize)
 {
  const int64_t streamLen = StreamLength();
  if (mInfo && streamLen > 0) {
-    int64_t max = streamLen > aOffset ? streamLen - aOffset : 0;
-    aSize = std::min<int64_t>(aSize, max);
+    aSize = std::min<int64_t>(aSize, streamLen - aOffset);
  }
  uint32_t read = 0;
  const nsresult rv = mSource.ReadAt(aOffset,
@@ -425,7 +425,6 @@ void WebMBufferedState::NotifyDataArrived(const unsigned char* aBuffer, uint32_t
 }

 void WebMBufferedState::Reset() {
-  ReentrantMonitorAutoEnter mon(mReentrantMonitor);
  mRangeParsers.Clear();
  mTimeMapping.Clear();
 }
@@ -730,17 +730,12 @@ PromiseWorkerProxy::Create(WorkerPrivate* aWorkerPrivate,
  RefPtr<PromiseWorkerProxy> proxy =
    new PromiseWorkerProxy(aWorkerPrivate, aWorkerPromise, aCb);

-  // Maintain a reference so that we have a valid object to clean up when
-  // removing the feature.
-  proxy.get()->AddRef();
-
  // We do this to make sure the worker thread won't shut down before the
  // promise is resolved/rejected on the worker thread.
  if (!proxy->AddRefObject()) {
    // Probably the worker is terminating. We cannot complete the operation
-    // and we have to release all the resources. CleanUp releases the extra
-    // ref, too
-    proxy->CleanUp();
+    // and we have to release all the resources.
+    proxy->CleanProperties();
    return nullptr;
  }

@@ -768,6 +763,24 @@ PromiseWorkerProxy::~PromiseWorkerProxy()
  MOZ_ASSERT(!mWorkerPrivate);
 }

+void
+PromiseWorkerProxy::CleanProperties()
+{
+#ifdef DEBUG
+  WorkerPrivate* worker = GetCurrentThreadWorkerPrivate();
+  MOZ_ASSERT(worker);
+  worker->AssertIsOnWorkerThread();
+#endif
+  // Ok to do this unprotected from Create().
+  // CleanUp() holds the lock before calling this.
+  mCleanedUp = true;
+  mWorkerPromise = nullptr;
+  mWorkerPrivate = nullptr;
+
+  // Clear the StructuredCloneHolderBase class.
+  Clear();
+}
+
 bool
 PromiseWorkerProxy::AddRefObject()
 {
@@ -868,9 +881,8 @@ PromiseWorkerProxy::CleanUp()
      return;
    }

-    if (mWorkerPrivate) {
-      mWorkerPrivate->AssertIsOnWorkerThread();
-    }
+    MOZ_ASSERT(mWorkerPrivate);
+    mWorkerPrivate->AssertIsOnWorkerThread();

    // Release the Promise and remove the PromiseWorkerProxy from the holders of
    // the worker thread since the Promise has been resolved/rejected or the
@@ -878,12 +890,7 @@ PromiseWorkerProxy::CleanUp()
    MOZ_ASSERT(mWorkerHolder);
    mWorkerHolder = nullptr;

-    mCleanedUp = true;
-    mWorkerPromise = nullptr;
-    mWorkerPrivate = nullptr;
-
-    // Clear the StructuredCloneHolderBase class.
-    Clear();
+    CleanProperties();
  }
  Release();
 }
@@ -190,6 +190,9 @@ private:

  bool AddRefObject();

+  // If not called from Create(), be sure to hold Lock().
+  void CleanProperties();
+
  // Function pointer for calling Promise::{ResolveInternal,RejectInternal}.
  typedef void (Promise::*RunCallbackFunc)(JSContext*,
                                           JS::Handle<JS::Value>);
@@ -812,10 +812,6 @@ HostResolveImportedModule(JSContext* aCx, JS::Handle<JSObject*> aModule,
  if (!string.init(aCx, aSpecifier)) {
    return nullptr;
  }
-  if (!aModule || !aCx) {
-    // Our module context was ripped out from under us...
-    return nullptr;
-  }

  nsCOMPtr<nsIURI> uri = ResolveModuleSpecifier(script, string);

@@ -828,10 +824,6 @@ HostResolveImportedModule(JSContext* aCx, JS::Handle<JSObject*> aModule,

  ModuleScript* ms = script->Loader()->GetFetchedModule(uri);
  MOZ_ASSERT(ms, "Resolved module not found in module map");
-  if (!ms) {
-    // Already-resolved module has been removed from the map/unloaded...
-    return nullptr;
-  }

  MOZ_ASSERT(!ms->HasParseError());
  MOZ_ASSERT(ms->ModuleRecord());
@@ -213,10 +213,8 @@ DOMStorageDBChild::RecvObserve(const nsCString& aTopic,
                               const nsString& aOriginAttributesPattern,
                               const nsCString& aOriginScope)
 {
-  DOMStorageObserver* observer = DOMStorageObserver::Self();
-  if (observer) {
-    observer->Notify(aTopic.get(), aOriginAttributesPattern, aOriginScope);
-  }
+  DOMStorageObserver::Self()->Notify(
+    aTopic.get(), aOriginAttributesPattern, aOriginScope);
  return true;
 }

@@ -90,8 +90,6 @@ DOMStorageObserver::Shutdown()
  if (!sSelf) {
    return NS_ERROR_NOT_INITIALIZED;
  }
-  
-  sSelf->mSinks.Clear();

  NS_RELEASE(sSelf);
  return NS_OK;
@@ -125,10 +123,6 @@ DOMStorageObserver::Observe(nsISupports* aSubject,
                            const char* aTopic,
                            const char16_t* aData)
 {
-  if (NS_WARN_IF(!sSelf)) {  // Shutdown took place, so bail.
-    return NS_OK;
-  }
-
  nsresult rv;

  // Start the thread that opens the database.
@@ -23,8 +23,7 @@ dictionary AddEventListenerOptions : EventListenerOptions {
  boolean once = false;
 };

-[Constructor,
- Exposed=(Window,Worker,WorkerDebugger,System)]
+[Exposed=(Window,Worker,WorkerDebugger,System)]
 interface EventTarget {
  /* Passing null for wantsUntrusted means "default behavior", which
     differs in content and chrome.  In content that default boolean
@@ -13,8 +13,9 @@
 // https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope-mixin
 [NoInterfaceObject, Exposed=(Window,Worker)]
 interface WindowOrWorkerGlobalScope {
-  // .origin on Window or Worker globals
-  [Replaceable] readonly attribute USVString origin;
+  // XXXbz We don't implement 'origin' yet on either window or worker globals.
+  // See bug 1306170.
+  // [Replaceable] readonly attribute USVString origin;

  // base64 utility methods
  [Throws]
@@ -2233,10 +2233,6 @@ void ReportLoadError(ErrorResult& aRv, nsresult aLoadResult,
      aLoadResult = NS_ERROR_DOM_SECURITY_ERR;
      break;

-    case NS_ERROR_CORRUPTED_CONTENT:
-      aLoadResult = NS_ERROR_DOM_NETWORK_ERR;
-      break;
-
    default:
      // For lack of anything better, go ahead and throw a NetworkError here.
      // We don't want to throw a JS exception, because for toplevel script
@@ -1759,7 +1759,6 @@ WorkerLoadInfo::StealFrom(WorkerLoadInfo& aOther)
  mPrincipalInfo = aOther.mPrincipalInfo.forget();

  mDomain = aOther.mDomain;
-  mOrigin = aOther.mOrigin;
  mServiceWorkerCacheName = aOther.mServiceWorkerCacheName;
  mWindowID = aOther.mWindowID;
  mServiceWorkerID = aOther.mServiceWorkerID;
@@ -3624,8 +3623,6 @@ WorkerPrivateParent<Derived>::SetPrincipal(nsIPrincipal* aPrincipal,
  mLoadInfo.mPrincipalInfo = new PrincipalInfo();
  mLoadInfo.mOriginAttributes = nsContentUtils::GetOriginAttributes(aLoadGroup);

-  nsContentUtils::GetUTFOrigin(aPrincipal, mLoadInfo.mOrigin);
-
  MOZ_ALWAYS_SUCCEEDS(
    PrincipalToPrincipalInfo(aPrincipal, mLoadInfo.mPrincipalInfo));
 }
@@ -4342,11 +4339,6 @@ WorkerPrivate::Constructor(JSContext* aCx,
    return nullptr;
  }

-  // From this point on (worker thread has been started) we
-  // must keep ourself alive. We can now only be cleared by
-  // ClearSelfAndParentEventTargetRef().
-  worker->mSelfRef = worker;
-
  worker->EnableDebugger();

  RefPtr<CompileScriptRunnable> compiler =
@@ -4356,6 +4348,8 @@ WorkerPrivate::Constructor(JSContext* aCx,
    return nullptr;
  }

+  worker->mSelfRef = worker;
+
  return worker.forget();
 }

@@ -4646,14 +4640,9 @@ WorkerPrivate::DoRunLoop(JSContext* aCx)
  AssertIsOnWorkerThread();
  MOZ_ASSERT(mThread);

-  RefPtr<WorkerThread> thread;
  {
    MutexAutoLock lock(mMutex);
    mJSContext = aCx;
-    // mThread is set before we enter, and is never changed during DoRunLoop.
-    // copy to local so we don't trigger mutex analysis
-    MOZ_ASSERT(mThread);
-    thread = mThread;

    MOZ_ASSERT(mStatus == Pending);
    mStatus = Running;
@@ -4683,7 +4672,7 @@ WorkerPrivate::DoRunLoop(JSContext* aCx)

      while (mControlQueue.IsEmpty() &&
             !(debuggerRunnablesPending = !mDebuggerQueue.IsEmpty()) &&
-             !(normalRunnablesPending = NS_HasPendingEvents(thread))) {
+             !(normalRunnablesPending = NS_HasPendingEvents(mThread))) {
        WaitForWorkerEvents();
      }

@@ -4693,7 +4682,7 @@ WorkerPrivate::DoRunLoop(JSContext* aCx)
        // irrelevant

        // The state of the world may have changed, recheck it.
-        normalRunnablesPending = NS_HasPendingEvents(thread);
+        normalRunnablesPending = NS_HasPendingEvents(mThread);
        // The debugger queue doesn't get cleared, so we can ignore that.
      }

@@ -4786,9 +4775,9 @@ WorkerPrivate::DoRunLoop(JSContext* aCx)
      }
    } else if (normalRunnablesPending) {
      // Process a single runnable from the main queue.
-      NS_ProcessNextEvent(thread, false);
+      NS_ProcessNextEvent(mThread, false);

-      normalRunnablesPending = NS_HasPendingEvents(thread);
+      normalRunnablesPending = NS_HasPendingEvents(mThread);
      if (normalRunnablesPending && GlobalScope()) {
        // Now *might* be a good time to GC. Let the JS engine make the decision.
        JSAutoCompartment ac(aCx, GlobalScope()->GetGlobalJSObject());
@@ -5190,14 +5179,10 @@ WorkerPrivate::ClearMainEventQueue(WorkerRanOrNot aRanOrNot)
  mCancelAllPendingRunnables = true;

  if (WorkerNeverRan == aRanOrNot) {
-    nsTArray<RefPtr<WorkerRunnable>> prestart;
-    {
-      MutexAutoLock lock(mMutex);
-      mPreStartRunnables.SwapElements(prestart);
-    }
-    for (uint32_t count = prestart.Length(), index = 0; index < count;
+    for (uint32_t count = mPreStartRunnables.Length(), index = 0;
+         index < count;
         index++) {
-      RefPtr<WorkerRunnable> runnable = prestart[index].forget();
+      RefPtr<WorkerRunnable> runnable = mPreStartRunnables[index].forget();
      static_cast<nsIRunnable*>(runnable.get())->Run();
    }
  } else {
@@ -5443,20 +5428,20 @@ WorkerPrivate::CreateNewSyncLoop(Status aFailStatus)
 {
  AssertIsOnWorkerThread();

-  nsCOMPtr<nsIEventTarget> realEventTarget;
  {
    MutexAutoLock lock(mMutex);

    if (mStatus >= aFailStatus) {
      return nullptr;
    }
-    
-    nsCOMPtr<nsIThreadInternal> thread = do_QueryInterface(NS_GetCurrentThread());
-    MOZ_ASSERT(thread);
-    
-    MOZ_ALWAYS_SUCCEEDS(thread->PushEventQueue(getter_AddRefs(realEventTarget)));
  }

+  nsCOMPtr<nsIThreadInternal> thread = do_QueryInterface(NS_GetCurrentThread());
+  MOZ_ASSERT(thread);
+
+  nsCOMPtr<nsIEventTarget> realEventTarget;
+  MOZ_ALWAYS_SUCCEEDS(thread->PushEventQueue(getter_AddRefs(realEventTarget)));
+
  RefPtr<EventTarget> workerEventTarget =
    new EventTarget(this, realEventTarget);

@@ -5478,18 +5463,9 @@ WorkerPrivate::RunCurrentSyncLoop()
 {
  AssertIsOnWorkerThread();

-  RefPtr<WorkerThread> thread;
  JSContext* cx = GetJSContext();
  MOZ_ASSERT(cx);

-  // mThread is set before we enter, and is never changed during
-  // RunCurrentSyncLoop.
-  {
-    MutexAutoLock lock(mMutex);
-    // Copy to local
-    thread = mThread;
-  }
-
  // This should not change between now and the time we finish running this sync
  // loop.
  uint32_t currentLoopIndex = mSyncLoopStack.Length() - 1;
@@ -5508,7 +5484,7 @@ WorkerPrivate::RunCurrentSyncLoop()
    bool normalRunnablesPending = false;

    // Don't block with the periodic GC timer running.
-    if (!NS_HasPendingEvents(thread)) {
+    if (!NS_HasPendingEvents(mThread)) {
      SetGCTimerMode(IdleTimer);
    }

@@ -5519,7 +5495,7 @@ WorkerPrivate::RunCurrentSyncLoop()
      for (;;) {
        while (mControlQueue.IsEmpty() &&
               !normalRunnablesPending &&
-               !(normalRunnablesPending = NS_HasPendingEvents(thread))) {
+               !(normalRunnablesPending = NS_HasPendingEvents(mThread))) {
          WaitForWorkerEvents();
        }

@@ -5528,7 +5504,7 @@ WorkerPrivate::RunCurrentSyncLoop()
          // XXXkhuey how should we handle Abort here? See Bug 1003730.

          // The state of the world may have changed. Recheck it.
-          normalRunnablesPending = NS_HasPendingEvents(thread);
+          normalRunnablesPending = NS_HasPendingEvents(mThread);

          // NB: If we processed a NotifyRunnable, we might have run
          // non-control runnables, one of which may have shut down the
@@ -5551,7 +5527,7 @@ WorkerPrivate::RunCurrentSyncLoop()
      // Make sure the periodic timer is running before we continue.
      SetGCTimerMode(PeriodicTimer);

-      MOZ_ALWAYS_TRUE(NS_ProcessNextEvent(thread, false));
+      MOZ_ALWAYS_TRUE(NS_ProcessNextEvent(mThread, false));

      // Now *might* be a good time to GC. Let the JS engine make the decision.
      if (JS::CurrentGlobalOrNull(cx)) {
@@ -5560,7 +5536,7 @@ WorkerPrivate::RunCurrentSyncLoop()
    }
  }

-  // Make sure that the stack didn't change under us.
+  // Make sure that the stack didn't change underneath us.
  MOZ_ASSERT(mSyncLoopStack[currentLoopIndex] == loopInfo);

  return DestroySyncLoop(currentLoopIndex);
@@ -624,12 +624,6 @@ public:
    return mLoadInfo.mPrincipal;
  }

-  const nsAString&
-  Origin() const
-  {
-    return mLoadInfo.mOrigin;
-  }
-
  nsILoadGroup*
  GetLoadGroup() const
  {
@@ -356,13 +356,6 @@ WorkerGlobalScope::Btoa(const nsAString& aBtoa, nsAString& aOutput, ErrorResult&
  aRv = nsContentUtils::Btoa(aBtoa, aOutput);
 }

-void
-WorkerGlobalScope::GetOrigin(nsAString& aOrigin) const
-{
-  mWorkerPrivate->AssertIsOnWorkerThread();
-  aOrigin = mWorkerPrivate->Origin();
-}
-
 void
 WorkerGlobalScope::Dump(const Optional<nsAString>& aString) const
 {
@@ -145,9 +145,6 @@ public:
  void
  Btoa(const nsAString& aBtoa, nsAString& aOutput, ErrorResult& aRv) const;

-  void
-  GetOrigin(nsAString& aOrigin) const;
-
  IMPL_EVENT_HANDLER(online)
  IMPL_EVENT_HANDLER(offline)

@@ -245,7 +245,6 @@ struct WorkerLoadInfo

  nsAutoPtr<mozilla::ipc::PrincipalInfo> mPrincipalInfo;
  nsCString mDomain;
-  nsString mOrigin; // Derived from mPrincipal; can be used on worker threads.

  nsString mServiceWorkerCacheName;

@@ -86,7 +86,6 @@
 #include "mozilla/Preferences.h"
 #include "private/pprio.h"
 #include "XMLHttpRequestUpload.h"
-#include "nsHostObjectProtocolHandler.h"

 using namespace mozilla::net;

@@ -2881,11 +2880,6 @@ XMLHttpRequestMainThread::SendInternal(const RequestBodyBase* aBody)
    return NS_ERROR_DOM_NETWORK_ERR;
  }

-  // non-GET requests aren't allowed for blob.
-  if (IsBlobURI(mRequestURL) && !mRequestMethod.EqualsLiteral("GET")) {
-    return NS_ERROR_DOM_NETWORK_ERR;
-  }
-
  PopulateNetworkInterfaceId();

  // XXX We should probably send a warning to the JS console
@@ -74,7 +74,6 @@ URIUtils::ResetWithSource(nsIDocument *aNewDoc, nsINode *aSourceNode)
    aNewDoc->Reset(channel, loadGroup);
    aNewDoc->SetPrincipal(sourcePrincipal);
    aNewDoc->SetBaseURI(sourceDoc->GetDocBaseURI());
-    aNewDoc->SetSandboxFlags(sourceDoc->GetSandboxFlags());

    // Copy charset
    aNewDoc->SetDocumentCharacterSetSource(
@@ -236,6 +236,19 @@ txMozillaXMLOutput::endDocument(nsresult aResult)
        }
    }

+    if (!mRefreshString.IsEmpty()) {
+        nsPIDOMWindowOuter* win = mDocument->GetWindow();
+        if (win) {
+            nsCOMPtr<nsIRefreshURI> refURI =
+                do_QueryInterface(win->GetDocShell());
+            if (refURI) {
+                refURI->SetupRefreshURIFromHeader(mDocument->GetDocBaseURI(),
+                                                  mDocument->NodePrincipal(),
+                                                  mRefreshString);
+            }
+        }
+    }
+
    if (mNotifier) {
        mNotifier->OnTransformEnd();
    }
@@ -731,11 +744,35 @@ txMozillaXMLOutput::endHTMLElement(nsIContent* aElement)
        mCurrentNodeStack.RemoveObjectAt(last);
        mTableState = static_cast<TableState>
                                 (NS_PTR_TO_INT32(mTableStateStack.pop()));
+
+        return NS_OK;
+    }
+    else if (mCreatingNewDocument && aElement->IsHTMLElement(nsGkAtoms::meta)) {
+        // handle HTTP-EQUIV data
+        nsAutoString httpEquiv;
+        aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::httpEquiv, httpEquiv);
+        if (!httpEquiv.IsEmpty()) {
+            nsAutoString value;
+            aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::content, value);
+            if (!value.IsEmpty()) {
+                nsContentUtils::ASCIIToLower(httpEquiv);
+                nsCOMPtr<nsIAtom> header = NS_Atomize(httpEquiv);
+                processHTTPEquiv(header, value);
+            }
+        }
    }
    
    return NS_OK;
 }

+void txMozillaXMLOutput::processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue)
+{
+    // For now we only handle "refresh". There's a longer list in
+    // HTMLContentSink::ProcessHeaderData
+    if (aHeader == nsGkAtoms::refresh)
+        LossyCopyUTF16toASCII(aValue, mRefreshString);
+}
+
 nsresult
 txMozillaXMLOutput::createResultDocument(const nsSubstring& aName, int32_t aNsID,
                                         nsIDOMDocument* aSourceDocument,
@@ -80,6 +80,7 @@ private:
    nsresult createTxWrapper();
    nsresult startHTMLElement(nsIContent* aElement, bool aXHTML);
    nsresult endHTMLElement(nsIContent* aElement);
+    void processHTTPEquiv(nsIAtom* aHeader, const nsString& aValue);
    nsresult createHTMLElement(nsIAtom* aName,
                               nsIContent** aResult);

@@ -104,6 +105,7 @@ private:
    RefPtr<txTransformNotifier> mNotifier;

    uint32_t mTreeDepth, mBadChildLevel;
+    nsCString mRefreshString;

    txStack mTableStateStack;
    enum TableState {
@@ -239,10 +239,9 @@ txToFragmentHandlerFactory::createHandlerWith(txOutputFormat* aFormat,
 class txVariable : public txIGlobalParameter
 {
 public:
-    explicit txVariable(nsIVariant* aValue, txAExprResult* aTxValue)
-      : mValue(aValue)
+    explicit txVariable(nsIVariant* aValue) : mValue(aValue)
    {
-        NS_ASSERTION(aValue && aTxValue, "missing value");
+        NS_ASSERTION(aValue, "missing value");
    }
    explicit txVariable(txAExprResult* aValue) : mTxValue(aValue)
    {
@@ -250,13 +249,12 @@ public:
    }
    nsresult getValue(txAExprResult** aValue)
    {
+        NS_ASSERTION(mValue || mTxValue, "variablevalue is null");
+
        if (!mTxValue) {
-          // XXX: This should not happen as we normally convert values before
-          // we call this function. For corner cases where this isn't true, we
-          // perform the conversion here.
-          nsresult rv = Convert(mValue, getter_AddRefs(mTxValue));
-          NS_ENSURE_SUCCESS(rv, rv);
-        }        
+            nsresult rv = Convert(mValue, getter_AddRefs(mTxValue));
+            NS_ENSURE_SUCCESS(rv, rv);
+        }

        *aValue = mTxValue;
        NS_ADDREF(*aValue);
@@ -273,11 +271,11 @@ public:
    {
        return mValue;
    }
-    void setValue(nsIVariant* aValue, txAExprResult* aTxValue)
+    void setValue(nsIVariant* aValue)
    {
-        NS_ASSERTION(aValue && aTxValue, "setting variablevalue to null");
+        NS_ASSERTION(aValue, "setting variablevalue to null");
        mValue = aValue;
-        mTxValue = aTxValue;
+        mTxValue = nullptr;
    }
    void setValue(txAExprResult* aValue)
    {
@@ -286,14 +284,14 @@ public:
        mTxValue = aValue;
    }

-    static nsresult Convert(nsIVariant *aValue, txAExprResult** aResult);
-
    friend void ImplCycleCollectionUnlink(txVariable& aVariable);
    friend void ImplCycleCollectionTraverse(
        nsCycleCollectionTraversalCallback& aCallback, txVariable& aVariable,
        const char* aName, uint32_t aFlags);

 private:
+    static nsresult Convert(nsIVariant *aValue, txAExprResult** aResult);
+
    nsCOMPtr<nsIVariant> mValue;
    RefPtr<txAExprResult> mTxValue;
 };
@@ -950,17 +948,13 @@ txMozillaXSLTProcessor::SetParameter(const nsAString & aNamespaceURI,
    nsCOMPtr<nsIAtom> localName = NS_Atomize(aLocalName);
    txExpandedName varName(nsId, localName);

-    RefPtr<txAExprResult> txValue;
-    rv = txVariable::Convert(value, getter_AddRefs(txValue));
-    NS_ENSURE_SUCCESS(rv, rv);
-
    txVariable* var = static_cast<txVariable*>(mVariables.get(varName));
    if (var) {
-        var->setValue(value, txValue);
+        var->setValue(value);
        return NS_OK;
    }

-    var = new txVariable(value, txValue);
+    var = new txVariable(value);
    return mVariables.add(varName, var);
 }

@@ -205,7 +205,6 @@ bool Image11::redefine(GLenum target, GLenum internalformat, const gl::Extents &
 {
    if (mWidth != size.width ||
        mHeight != size.height ||
-        mDepth != size.depth ||
        mInternalFormat != internalformat ||
        forceRelease)
    {
@@ -96,8 +96,6 @@ imgRequest::Init(nsIURI *aURI,
                 ReferrerPolicy aReferrerPolicy)
 {
  MOZ_ASSERT(NS_IsMainThread(), "Cannot use nsIURI off main thread!");
-  // Init() can only be called once, and that's before it can be used off
-  // mainthread

  LOG_FUNC(gImgLog, "imgRequest::Init");

@@ -802,14 +800,7 @@ imgRequest::OnStopRequest(nsIRequest* aRequest,

  RefPtr<imgRequest> strongThis = this;

-  bool isMultipart = false;
-  bool newPartPending = false;
-  {
-    MutexAutoLock lock(mMutex);
-    isMultipart = mIsMultiPartChannel;
-    newPartPending = mNewPartPending;
-  }
-  if (isMultipart && newPartPending) {
+  if (mIsMultiPartChannel && mNewPartPending) {
    OnDataAvailable(aRequest, ctxt, nullptr, 0, 0);
  }

@@ -1529,63 +1529,12 @@ Promise_static_all(JSContext* cx, unsigned argc, Value* vp)
    return true;
 }

-static MOZ_MUST_USE bool PerformPromiseAllSettled(JSContext *cx, JS::ForOfIterator& iterator,
-                                                  HandleObject C, HandleObject promiseObj,
-                                                  HandleObject resolve, HandleObject reject,
-                                                  bool* done);
-
-// ES2020
-static bool
-Promise_static_allSettled(JSContext* cx, unsigned argc, Value* vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    RootedValue iterable(cx, args.get(0));
-    RootedValue CVal(cx, args.thisv());
-    if (!CVal.isObject()) {
-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_NONNULL_OBJECT,
-                                  "Receiver of Promise.allSettled call");
-        return false;
-    }
-
-    RootedObject C(cx, &CVal.toObject());
-    RootedObject resultPromise(cx);
-    RootedObject resolve(cx);
-    RootedObject reject(cx);
-    if (!NewPromiseCapability(cx, C, &resultPromise, &resolve, &reject, false))
-        return false;
-
-    JS::ForOfIterator iter(cx);
-    if (!iter.init(iterable, JS::ForOfIterator::AllowNonIterable))
-        return AbruptRejectPromise(cx, args, resultPromise, reject);
-
-    if (!iter.valueIsIterable()) {
-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
-                                  "Argument of Promise.allSettled");
-        return AbruptRejectPromise(cx, args, resultPromise, reject);
-    }
-
-    bool done;
-    bool result = PerformPromiseAllSettled(cx, iter, C, resultPromise, resolve, reject, &done);
-
-    if (!result) {
-        if (!done)
-            iter.closeThrow();
-
-        return AbruptRejectPromise(cx, args, resultPromise, reject);
-    }
-
-    args.rval().setObject(*resultPromise);
-    return true;
-}
-
 static MOZ_MUST_USE bool PerformPromiseThen(JSContext* cx, Handle<PromiseObject*> promise,
                                            HandleValue onFulfilled_, HandleValue onRejected_,
                                            HandleObject resultPromise,
                                            HandleObject resolve, HandleObject reject);

 static bool PromiseAllResolveElementFunction(JSContext* cx, unsigned argc, Value* vp);
-static bool PromiseAllSettledResolveElementFunction(JSContext* cx, unsigned argc, Value* vp);
-static bool PromiseAllSettledRejectElementFunction(JSContext* cx, unsigned argc, Value* vp);

 // Unforgeable version of ES2016, 25.4.4.1.
 MOZ_MUST_USE JSObject*
@@ -1899,120 +1848,6 @@ PerformPromiseAll(JSContext *cx, JS::ForOfIterator& iterator, HandleObject C,
    }
 }

-static MOZ_MUST_USE bool
-PerformPromiseAllSettled(JSContext *cx, JS::ForOfIterator& iterator, HandleObject C,
-                         HandleObject promiseObj, HandleObject resolve, HandleObject reject,
-                         bool* done)
-{
-    *done = false;
-
-    RootedObject unwrappedPromiseObj(cx);
-    if (IsWrapper(promiseObj)) {
-        unwrappedPromiseObj = CheckedUnwrap(promiseObj);
-        MOZ_ASSERT(unwrappedPromiseObj);
-    }
-
-    RootedValue CVal(cx, ObjectValue(*C));
-
-    RootedObject valuesArray(cx);
-    if (unwrappedPromiseObj) {
-        JSAutoCompartment ac(cx, unwrappedPromiseObj);
-        valuesArray = NewDenseFullyAllocatedArray(cx, 0);
-    } else {
-        valuesArray = NewDenseFullyAllocatedArray(cx, 0);
-    }
-    if (!valuesArray)
-        return false;
-
-    RootedValue valuesArrayVal(cx, ObjectValue(*valuesArray));
-    if (!cx->compartment()->wrap(cx, &valuesArrayVal))
-        return false;
-
-    Rooted<PromiseAllDataHolder*> dataHolder(cx, NewPromiseAllDataHolder(cx, promiseObj,
-                                                                         valuesArrayVal, resolve));
-    if (!dataHolder)
-        return false;
-    RootedValue dataHolderVal(cx, ObjectValue(*dataHolder));
-
-    uint32_t index = 0;
-
-    RootedValue nextValue(cx);
-    RootedId indexId(cx);
-
-    while (true) {
-        if (!iterator.next(&nextValue, done)) {
-            *done = true;
-            return false;
-        }
-
-        if (*done) {
-            int32_t remainingCount = dataHolder->decreaseRemainingCount();
-            if (remainingCount == 0) {
-                return RunResolutionFunction(cx, resolve, valuesArrayVal, ResolveMode,
-                                             promiseObj);
-            }
-            return true;
-        }
-
-        { // Scoped for AutoCompartment
-            JSAutoCompartment ac(cx, valuesArray);
-            indexId = INT_TO_JSID(index);
-            if (!DefineProperty(cx, valuesArray, indexId, UndefinedHandleValue))
-                return false;
-        }
-
-        RootedValue nextPromise(cx);
-        RootedValue staticResolve(cx);
-	RootedValue staticReject(cx);
-
-	// Because Promise.allSettled can continue whether the promise is fulfilled or rejected, we 
-	// should only return false if neither condition is true.
-
-        if (!GetProperty(cx, CVal, cx->names().resolve, &staticResolve) && 
-	    !GetProperty(cx, CVal, cx->names().reject, &staticReject))
-            return false;
-
-        FixedInvokeArgs<1> resolveArgs(cx);
-        resolveArgs[0].set(nextValue);
-        FixedInvokeArgs<1> rejectArgs(cx);
-        rejectArgs[0].set(nextValue);
-        if (!Call(cx, staticResolve, CVal, resolveArgs, &nextPromise) && 
-	    !Call(cx, staticReject, CVal, rejectArgs, &nextPromise))
-            return false;
-
-		
-	RootedFunction resolveFunc(cx, NewNativeFunction(cx, PromiseAllSettledResolveElementFunction,
-			           1, nullptr,
-			           gc::AllocKind::FUNCTION_EXTENDED,
-			           GenericObject));
-		
-	RootedFunction rejectFunc(cx, NewNativeFunction(cx, PromiseAllSettledRejectElementFunction,
-				  1, nullptr,
-				  gc::AllocKind::FUNCTION_EXTENDED,
-				  GenericObject));
-	if (!resolveFunc && !rejectFunc) {
-	     return false;
-	}
-		
-	resolveFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, dataHolderVal);
-	resolveFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex,
-				Int32Value(index));
-	rejectFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, dataHolderVal);
-	rejectFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex,
-				Int32Value(index));
-
-        dataHolder->increaseRemainingCount();
-
-        RootedValue resolveFunVal(cx, ObjectValue(*resolveFunc));
-        RootedValue rejectFunVal(cx, ObjectValue(*rejectFunc));
-        if (!BlockOnPromise(cx, nextPromise, promiseObj, resolveFunVal, rejectFunVal))
-            return false;
-
-        index++;
-        MOZ_ASSERT(index > 0);
-    }
-}
-
 // ES2016, 25.4.4.1.2.
 static bool
 PromiseAllResolveElementFunction(JSContext* cx, unsigned argc, Value* vp)
@@ -2086,159 +1921,6 @@ PromiseAllResolveElementFunction(JSContext* cx, unsigned argc, Value* vp)
    return true;
 }

-// ES2020.
-static bool
-PromiseAllSettledResolveElementFunction(JSContext* cx, unsigned argc, Value* vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    RootedFunction resolve(cx, &args.callee().as<JSFunction>());
-    RootedValue xVal(cx, args.get(0));
-    RootedValue dataVal(cx, resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_Data));
-
-    if (dataVal.isUndefined()) {
-        args.rval().setUndefined();
-        return true;
-    }
-
-    Rooted<PromiseAllDataHolder*> data(cx, &dataVal.toObject().as<PromiseAllDataHolder>());
-
-    resolve->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, UndefinedValue());
-
-    int32_t index = resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex)
-                    .toInt32();
-
-    RootedValue valuesVal(cx, data->valuesArray());
-    RootedObject valuesObj(cx, &valuesVal.toObject());
-    bool valuesListIsWrapped = false;
-    if (IsWrapper(valuesObj)) {
-        valuesListIsWrapped = true;
-        // See comment for PerformPromiseAll, step 3 for why we unwrap here.
-        valuesObj = UncheckedUnwrap(valuesObj);
-    }
-    NativeObject* values = &valuesObj->as<NativeObject>();
-
-    // The index is guaranteed to be initialized to `undefined`.
-    if (valuesListIsWrapped) {
-        AutoCompartment ac(cx, values);
-        if (!cx->compartment()->wrap(cx, &xVal))
-            return false;
-    }
-    
-    RootedPlainObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx));
-    if (!obj) {
-        return false;
-    }
-    RootedId id(cx, NameToId(cx->names().status));
-    RootedValue statusValue(cx);
-    statusValue.setString(cx->names().fulfilled);
-    if (!::JS_DefinePropertyById(cx, obj, id, statusValue, JSPROP_ENUMERATE)) {
-      return false;
-    }
-    id = NameToId(cx->names().value);
-    if (!::JS_DefinePropertyById(cx, obj, id, xVal, JSPROP_ENUMERATE)) {
-      return false;
-    }
-
-    RootedValue objVal(cx, ObjectValue(*obj));
-/*  if (needsWrapping) {
-    AutoRealm ar(cx, valuesObj);
-    if (!cx->compartment()->wrap(cx, &objVal)) {
-      return false;
-    }
-  }    */
-    values->setDenseElement(index, objVal);
-
-    uint32_t remainingCount = data->decreaseRemainingCount();
-
-    if (remainingCount == 0) {
-        RootedObject resolveAllFun(cx, data->resolveObj());
-        RootedObject promiseObj(cx, data->promiseObj());
-        if (!RunResolutionFunction(cx, resolveAllFun, valuesVal, ResolveMode, promiseObj))
-            return false;
-    }
-
-    args.rval().setUndefined();
-    return true;
-}
-
-static bool
-PromiseAllSettledRejectElementFunction(JSContext* cx, unsigned argc, Value* vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    RootedFunction resolve(cx, &args.callee().as<JSFunction>());
-    RootedValue xVal(cx, args.get(0));
-    RootedValue dataVal(cx, resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_Data));
-
-    if (dataVal.isUndefined()) {
-        args.rval().setUndefined();
-        return true;
-    }
-
-    Rooted<PromiseAllDataHolder*> data(cx, &dataVal.toObject().as<PromiseAllDataHolder>());
-
-    resolve->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, UndefinedValue());
-
-    int32_t index = resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex)
-                    .toInt32();
-
-    RootedValue valuesVal(cx, data->valuesArray());
-    RootedObject valuesObj(cx, &valuesVal.toObject());
-    bool valuesListIsWrapped = false;
-    if (IsWrapper(valuesObj)) {
-        valuesListIsWrapped = true;
-        // See comment for PerformPromiseAll, step 3 for why we unwrap here.
-        valuesObj = UncheckedUnwrap(valuesObj);
-    }
-    NativeObject* values = &valuesObj->as<NativeObject>();
-
-    // The index is guaranteed to be initialized to `undefined`.
-    if (valuesListIsWrapped) {
-        AutoCompartment ac(cx, values);
-        if (!cx->compartment()->wrap(cx, &xVal))
-            return false;
-    }
-    
-    RootedPlainObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx));
-    if (!obj) {
-        return false;
-    }
-    RootedId id(cx, NameToId(cx->names().status));
-    RootedValue statusValue(cx);
-    statusValue.setString(cx->names().rejected);
-    if (!::JS_DefinePropertyById(cx, obj, id, statusValue, JSPROP_ENUMERATE)) {
-      return false;
-    }
-    RootedValue resultValue(cx);
-    id = NameToId(cx->names().reason);
-    if (!::JS_DefinePropertyById(cx, obj, id, xVal, JSPROP_ENUMERATE)) {
-      return false;
-    }
-
-    RootedValue objVal(cx, ObjectValue(*obj));
-/*  if (needsWrapping) {
-    AutoRealm ar(cx, valuesObj);
-    if (!cx->compartment()->wrap(cx, &objVal)) {
-      return false;
-    }
-  }    */
-    values->setDenseElement(index, objVal);    
-
-
-    uint32_t remainingCount = data->decreaseRemainingCount();
-
-    if (remainingCount == 0) {
-        RootedObject resolveAllFun(cx, data->resolveObj());
-        RootedObject promiseObj(cx, data->promiseObj());
-        if (!RunResolutionFunction(cx, resolveAllFun, valuesVal, ResolveMode, promiseObj))
-            return false;
-    }
-
-    args.rval().setUndefined();
-    return true;
-}
-
 static MOZ_MUST_USE bool PerformPromiseRace(JSContext *cx, JS::ForOfIterator& iterator,
                                            HandleObject C, HandleObject promiseObj,
                                            HandleObject resolve, HandleObject reject,
@@ -3564,7 +3246,6 @@ static const JSPropertySpec promise_properties[] = {

 static const JSFunctionSpec promise_static_methods[] = {
    JS_FN("all", Promise_static_all, 1, 0),
-    JS_FN("allSettled", Promise_static_allSettled, 1, 0),
    JS_FN("race", Promise_static_race, 1, 0),
    JS_FN("reject", Promise_reject, 1, 0),
    JS_FN("resolve", Promise_static_resolve, 1, 0),
@@ -10113,7 +10113,7 @@ class MLoadTypedArrayElementHole
        return congruentIfOperandsEqual(other);
    }
    AliasSet getAliasSet() const override {
-        return AliasSet::Load(AliasSet::UnboxedElement | AliasSet::ObjectFields);
+        return AliasSet::Load(AliasSet::UnboxedElement);
    }
    bool canProduceFloat32() const override { return arrayType_ == Scalar::Float32; }

@@ -2121,15 +2121,6 @@ class MacroAssembler : public MacroAssemblerSpecific
    inline void assertStackAlignment(uint32_t alignment, int32_t offset = 0);
 };

-// StackMacroAssembler checks no GC will happen while it's on the stack.
-class MOZ_RAII StackMacroAssembler : public MacroAssembler {
-  JS::AutoCheckCannotGC nogc;
-
-public:
-  StackMacroAssembler() : MacroAssembler() {}
-  explicit StackMacroAssembler(JSContext* cx) : MacroAssembler(cx) {}
-};
-
 static inline Assembler::DoubleCondition
 JSOpToDoubleCondition(JSOp op)
 {
@@ -123,7 +123,7 @@ if CONFIG['JS_BUNDLED_EDITLINE']:
    DIRS += ['editline']

 if CONFIG['JS_NEW_REGEXP']:
-    DIRS += ['new-regexp']
+    DIRS += ['regexp']

 if not CONFIG['JS_DISABLE_SHELL']:
    DIRS += ['shell']
@@ -7,7 +7,7 @@
 #include <iostream>
 #include <sstream>

-#include "new-regexp/special-case.h"
+#include "regexp/special-case.h"

 namespace v8 {
 namespace internal {
@@ -34,9 +34,4 @@ if CONFIG['ENABLE_INTL_API']:
    SOURCES += [
        'property-sequences.cc',
        'special-case.cc'
-    ]
-    
-if CONFIG['_MSC_VER']:
-    # This is intended as a temporary workaround to unblock compilation
-    # on VS2015 in warnings as errors mode.
-    CXXFLAGS += ['-wd4275']
+    ]
@@ -4,7 +4,7 @@

 #ifdef V8_INTL_SUPPORT

-#include "new-regexp/property-sequences.h"
+#include "regexp/property-sequences.h"

 namespace v8 {
 namespace internal {
@@ -7,7 +7,7 @@

 #ifdef V8_INTL_SUPPORT

-#include "new-regexp/regexp-shim.h"
+#include "regexp/regexp-shim.h"

 namespace v8 {
 namespace internal {
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-ast.h"
+#include "regexp/regexp-ast.h"

 namespace v8 {
 namespace internal {
@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_AST_H_
 #define V8_REGEXP_REGEXP_AST_H_

-#include "new-regexp/regexp-shim.h"
+#include "regexp/regexp-shim.h"

 namespace v8 {
 namespace internal {
@@ -5,9 +5,9 @@
 #ifndef V8_REGEXP_REGEXP_BYTECODE_GENERATOR_INL_H_
 #define V8_REGEXP_REGEXP_BYTECODE_GENERATOR_INL_H_

-#include "new-regexp/regexp-bytecode-generator.h"
+#include "regexp/regexp-bytecode-generator.h"

-#include "new-regexp/regexp-bytecodes.h"
+#include "regexp/regexp-bytecodes.h"

 namespace v8 {
 namespace internal {
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-bytecode-generator.h"
+#include "regexp/regexp-bytecode-generator.h"

-#include "new-regexp/regexp-bytecode-generator-inl.h"
-#include "new-regexp/regexp-bytecode-peephole.h"
-#include "new-regexp/regexp-bytecodes.h"
-#include "new-regexp/regexp-macro-assembler.h"
+#include "regexp/regexp-bytecode-generator-inl.h"
+#include "regexp/regexp-bytecode-peephole.h"
+#include "regexp/regexp-bytecodes.h"
+#include "regexp/regexp-macro-assembler.h"

 namespace v8 {
 namespace internal {
@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_BYTECODE_GENERATOR_H_
 #define V8_REGEXP_REGEXP_BYTECODE_GENERATOR_H_

-#include "new-regexp/regexp-macro-assembler.h"
+#include "regexp/regexp-macro-assembler.h"

 namespace v8 {
 namespace internal {
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-bytecode-peephole.h"
+#include "regexp/regexp-bytecode-peephole.h"

-#include "new-regexp/regexp-bytecodes.h"
+#include "regexp/regexp-bytecodes.h"

 namespace v8 {
 namespace internal {
@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_BYTECODE_PEEPHOLE_H_
 #define V8_REGEXP_REGEXP_BYTECODE_PEEPHOLE_H_

-#include "new-regexp/regexp-shim.h"
+#include "regexp/regexp-shim.h"

 namespace v8 {
 namespace internal {
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-bytecodes.h"
+#include "regexp/regexp-bytecodes.h"

 #include <cctype>

@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_BYTECODES_H_
 #define V8_REGEXP_REGEXP_BYTECODES_H_

-#include "new-regexp/regexp-shim.h"
+#include "regexp/regexp-shim.h"

 namespace v8 {
 namespace internal {
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-compiler.h"
+#include "regexp/regexp-compiler.h"

-#include "new-regexp/regexp.h"
+#include "regexp/regexp.h"
 #ifdef V8_INTL_SUPPORT
-#include "new-regexp/special-case.h"
+#include "regexp/special-case.h"
 #endif  // V8_INTL_SUPPORT

 #ifdef V8_INTL_SUPPORT
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-compiler.h"
+#include "regexp/regexp-compiler.h"

-#include "new-regexp/regexp-macro-assembler-arch.h"
+#include "regexp/regexp-macro-assembler-arch.h"
 #ifdef V8_INTL_SUPPORT
-#include "new-regexp/special-case.h"
+#include "regexp/special-case.h"
 #endif  // V8_INTL_SUPPORT

 #ifdef V8_INTL_SUPPORT
@@ -7,7 +7,7 @@

 #include <bitset>

-#include "new-regexp/regexp-nodes.h"
+#include "regexp/regexp-nodes.h"

 namespace v8 {
 namespace internal {
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-dotprinter.h"
+#include "regexp/regexp-dotprinter.h"

-#include "new-regexp/regexp-compiler.h"
+#include "regexp/regexp-compiler.h"

 namespace v8 {
 namespace internal {
@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_DOTPRINTER_H_
 #define V8_REGEXP_REGEXP_DOTPRINTER_H_

-#include "new-regexp/regexp-shim.h"
+#include "regexp/regexp-shim.h"

 namespace v8 {
 namespace internal {
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-error.h"
+#include "regexp/regexp-error.h"

 namespace v8 {
 namespace internal {
@@ -4,12 +4,12 @@

 // A simple interpreter for the Irregexp byte code.

-#include "new-regexp/regexp-interpreter.h"
+#include "regexp/regexp-interpreter.h"

-#include "new-regexp/regexp-bytecodes.h"
-#include "new-regexp/regexp-macro-assembler.h"
-#include "new-regexp/regexp-stack.h"  // For kMaximumStackSize.
-#include "new-regexp/regexp.h"
+#include "regexp/regexp-bytecodes.h"
+#include "regexp/regexp-macro-assembler.h"
+#include "regexp/regexp-stack.h"  // For kMaximumStackSize.
+#include "regexp/regexp.h"

 #ifdef V8_INTL_SUPPORT
 #include "unicode/uchar.h"
@@ -22,7 +22,6 @@
 #define V8_USE_COMPUTED_GOTO 1
 #endif  // V8_HAS_COMPUTED_GOTO

-
 namespace v8 {
 namespace internal {

@@ -7,7 +7,7 @@
 #ifndef V8_REGEXP_REGEXP_INTERPRETER_H_
 #define V8_REGEXP_REGEXP_INTERPRETER_H_

-#include "new-regexp/regexp.h"
+#include "regexp/regexp.h"

 namespace v8 {
 namespace internal {
@@ -16,7 +16,7 @@
 #define RegexpMacroAssemblerArch_h

 #include "jit/MacroAssembler.h"
-#include "new-regexp/regexp-macro-assembler.h"
+#include "regexp/regexp-macro-assembler.h"

 namespace v8 {
 namespace internal {
@@ -186,7 +186,7 @@ class SMRegExpMacroAssembler final : public NativeRegExpMacroAssembler {
    if (num_registers_ <= register_index) {
      num_registers_ = register_index + 1;
    }
-    static_assert(alignof(uintptr_t) <= alignof(FrameData),"Regexp: Alignment of uintptr_t and FrameData mismatch");
+    static_assert(alignof(uintptr_t) <= alignof(FrameData));
    return sizeof(FrameData) + register_index * sizeof(uintptr_t*);
  }

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-macro-assembler-tracer.h"
+#include "regexp/regexp-macro-assembler-tracer.h"


 namespace v8 {
@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_MACRO_ASSEMBLER_TRACER_H_
 #define V8_REGEXP_REGEXP_MACRO_ASSEMBLER_TRACER_H_

-#include "new-regexp/regexp-macro-assembler.h"
+#include "regexp/regexp-macro-assembler.h"

 namespace v8 {
 namespace internal {
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-macro-assembler.h"
+#include "regexp/regexp-macro-assembler.h"

-#include "new-regexp/regexp-stack.h"
+#include "regexp/regexp-stack.h"

 #ifdef V8_INTL_SUPPORT
 #include "unicode/uchar.h"
@@ -5,9 +5,9 @@
 #ifndef V8_REGEXP_REGEXP_MACRO_ASSEMBLER_H_
 #define V8_REGEXP_REGEXP_MACRO_ASSEMBLER_H_

-#include "new-regexp/regexp-ast.h"
-#include "new-regexp/regexp-shim.h"
-#include "new-regexp/regexp.h"
+#include "regexp/regexp-ast.h"
+#include "regexp/regexp-shim.h"
+#include "regexp/regexp.h"

 namespace v8 {
 namespace internal {
@@ -9,17 +9,12 @@
 // found in the LICENSE file.

 #include "jit/Linker.h"
-#include "gc/Zone.h"
-#include "new-regexp/regexp-macro-assembler-arch.h"
-#include "new-regexp/regexp-stack.h"
+#include "regexp/regexp-macro-assembler-arch.h"
+#include "regexp/regexp-stack.h"
 #include "vm/MatchPairs.h"

 #include "jit/MacroAssembler-inl.h"

-using namespace js;
-using namespace js::irregexp;
-using namespace js::jit;
-
 namespace v8 {
 namespace internal {

@@ -89,9 +84,19 @@ void SMRegExpMacroAssembler::AdvanceRegister(int reg, int by) {
 }

 void SMRegExpMacroAssembler::Backtrack() {
-    // Pop code location from backtrack stack and jump to location.
-    Pop(temp0_);
-    masm_.jump(temp0_);
+  // Check for an interrupt. We have to restart from the beginning if we
+  // are interrupted, so we only check for urgent interrupts.
+  js::jit::Label noInterrupt;
+  masm_.branchTest32(
+      Assembler::Zero, AbsoluteAddress(cx_->addressOfInterruptBits()),
+      Imm32(uint32_t(js::InterruptReason::CallbackUrgent)), &noInterrupt);
+  masm_.movePtr(ImmWord(js::RegExpRunStatus_Error), temp0_);
+  masm_.jump(&exit_label_);
+  masm_.bind(&noInterrupt);
+
+  // Pop code location from backtrack stack and jump to location.
+  Pop(temp0_);
+  masm_.jump(temp0_);
 }

 void SMRegExpMacroAssembler::Bind(Label* label) {
@@ -541,8 +546,7 @@ bool SMRegExpMacroAssembler::CheckSpecialCharacterClass(uc16 type,
        masm_.branch32(Assembler::Above, current_character_, Imm32('z'),
                       no_match);
      }
-      static_assert(arraysize(word_character_map) > unibrow::Latin1::kMaxChar,
-                    "regex: arraysize(word_character_map) > unibrow::Latin1::kMaxChar");
+      static_assert(arraysize(word_character_map) > unibrow::Latin1::kMaxChar);
      masm_.movePtr(ImmPtr(word_character_map), temp0_);
      masm_.load8ZeroExtend(
          BaseIndex(temp0_, current_character_, js::jit::TimesOne), temp0_);
@@ -554,8 +558,7 @@ bool SMRegExpMacroAssembler::CheckSpecialCharacterClass(uc16 type,
      if (mode_ != LATIN1) {
        masm_.branch32(Assembler::Above, current_character_, Imm32('z'), &done);
      }
-      static_assert(arraysize(word_character_map) > unibrow::Latin1::kMaxChar,
-                    "regex: arraysize(word_character_map) > unibrow::Latin1::kMaxChar");
+      static_assert(arraysize(word_character_map) > unibrow::Latin1::kMaxChar);
      masm_.movePtr(ImmPtr(word_character_map), temp0_);
      masm_.load8ZeroExtend(
          BaseIndex(temp0_, current_character_, js::jit::TimesOne), temp0_);
@@ -821,7 +824,7 @@ static Handle<HeapObject> DummyCode() {
 // Finalize code. This is called last, so that we know how many
 // registers we need.
 Handle<HeapObject> SMRegExpMacroAssembler::GetCode(Handle<String> source) {
-  if (!cx_->compartment()->ensureJitCompartmentExists(cx_)) {
+  if (!cx_->realm()->ensureJitRealmExists(cx_)) {
    return DummyCode();
  }

@@ -838,9 +841,8 @@ Handle<HeapObject> SMRegExpMacroAssembler::GetCode(Handle<String> source) {
  stackOverflowHandler();

  Linker linker(masm_);
-  JitCode* code = linker.newCode<NoGC>(cx_, REGEXP_CODE);
+  JitCode* code = linker.newCode(cx_, js::jit::CodeKind::RegExp);
  if (!code) {
-    ReportOutOfMemory(cx_);
    return DummyCode();
  }

@@ -1159,7 +1161,7 @@ SMRegExpMacroAssembler::Implementation() {
 /*static */
 uint32_t SMRegExpMacroAssembler::CaseInsensitiveCompareStrings(
    const char16_t* substring1, const char16_t* substring2, size_t byteLength) {
-  JS::AutoCheckCannotGC nogc;
+  js::AutoUnsafeCallWithABI unsafe;

  MOZ_ASSERT(byteLength % sizeof(char16_t) == 0);
  size_t length = byteLength / sizeof(char16_t);
@@ -1182,7 +1184,7 @@ uint32_t SMRegExpMacroAssembler::CaseInsensitiveCompareStrings(
 /*static */
 uint32_t SMRegExpMacroAssembler::CaseInsensitiveCompareUCStrings(
    const char16_t* substring1, const char16_t* substring2, size_t byteLength) {
-  JS::AutoCheckCannotGC nogc;
+  js::AutoUnsafeCallWithABI unsafe;

  MOZ_ASSERT(byteLength % sizeof(char16_t) == 0);
  size_t length = byteLength / sizeof(char16_t);
@@ -1204,7 +1206,7 @@ uint32_t SMRegExpMacroAssembler::CaseInsensitiveCompareUCStrings(

 /* static */
 bool SMRegExpMacroAssembler::GrowBacktrackStack(RegExpStack* regexp_stack) {
-  JS::AutoCheckCannotGC nogc;
+  js::AutoUnsafeCallWithABI unsafe;
  size_t size = regexp_stack->stack_capacity();
  return !!regexp_stack->EnsureCapacity(size * 2);
 }
@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_NODES_H_
 #define V8_REGEXP_REGEXP_NODES_H_

-#include "new-regexp/regexp-macro-assembler.h"
+#include "regexp/regexp-macro-assembler.h"

 namespace v8 {
 namespace internal {
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-parser.h"
+#include "regexp/regexp-parser.h"

 #include <vector>

-#include "new-regexp/property-sequences.h"
-#include "new-regexp/regexp-macro-assembler.h"
-#include "new-regexp/regexp.h"
+#include "regexp/property-sequences.h"
+#include "regexp/regexp-macro-assembler.h"
+#include "regexp/regexp.h"

 #ifdef V8_INTL_SUPPORT
 #include "unicode/uniset.h"
@@ -5,8 +5,8 @@
 #ifndef V8_REGEXP_REGEXP_PARSER_H_
 #define V8_REGEXP_REGEXP_PARSER_H_

-#include "new-regexp/regexp-ast.h"
-#include "new-regexp/regexp-error.h"
+#include "regexp/regexp-ast.h"
+#include "regexp/regexp-error.h"

 namespace v8 {
 namespace internal {
@@ -327,9 +327,7 @@ class V8_EXPORT_PRIVATE RegExpParser {
    bool operator()(const RegExpCapture* lhs, const RegExpCapture* rhs) const {
      DCHECK_NOT_NULL(lhs);
      DCHECK_NOT_NULL(rhs);
-      ZoneVector<uc16> lhname = *lhs->name();
-      ZoneVector<uc16> rhname = *rhs->name();      
-      return lhname < rhname;
+      return *lhs->name() < *rhs->name();
    }
  };

@@ -10,10 +10,8 @@

 #include <iostream>

-#include "new-regexp/regexp-shim.h"
-#include "new-regexp/regexp-stack.h"
-
-#include "mozilla/Sprintf.h" // for SprintfLiteral
+#include "regexp/regexp-shim.h"
+#include "regexp/regexp-stack.h"

 namespace v8 {
 namespace internal {
@@ -127,6 +125,8 @@ PseudoHandle<ByteArrayData> ByteArray::takeOwnership(Isolate* isolate) {
 }

 void Isolate::trace(JSTracer* trc) {
+  js::gc::AssertRootMarkingPhase(trc);
+
  for (auto iter = handleArena_.Iter(); !iter.Done(); iter.Next()) {
    auto& elem = iter.Get();
    JS::GCPolicy<JS::Value>::trace(trc, &elem, "Isolate handle arena");
@@ -20,15 +20,14 @@

 #include <algorithm>
 #include <cctype>
-#include <iostream> // needed for gcc 10

 #include "jit/Label.h"
 #include "jit/shared/Assembler-shared.h"
 #include "js/Value.h"
-#include "new-regexp/RegExpTypes.h"
-#include "new-regexp/util/flags.h"
-#include "new-regexp/util/vector.h"
-#include "new-regexp/util/zone.h"
+#include "regexp/RegExpTypes.h"
+#include "regexp/util/flags.h"
+#include "regexp/util/vector.h"
+#include "regexp/util/zone.h"
 #include "vm/NativeObject.h"

 // Forward declaration of classes
@@ -1173,6 +1172,7 @@ extern bool FLAG_trace_regexp_bytecodes;
 extern bool FLAG_trace_regexp_parser;
 extern bool FLAG_trace_regexp_peephole_optimization;

+#define V8_USE_COMPUTED_GOTO 1
 #define COMPILING_IRREGEXP_FOR_EXTERNAL_EMBEDDER

 }  // namespace internal
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-#include "new-regexp/regexp-stack.h"
+#include "regexp/regexp-stack.h"


 namespace v8 {
@@ -5,7 +5,7 @@
 #ifndef V8_REGEXP_REGEXP_STACK_H_
 #define V8_REGEXP_REGEXP_STACK_H_

-#include "new-regexp/regexp-shim.h"
+#include "regexp/regexp-shim.h"

 namespace v8 {
 namespace internal {
@@ -5,8 +5,8 @@
 #ifndef V8_REGEXP_REGEXP_H_
 #define V8_REGEXP_REGEXP_H_

-#include "new-regexp/regexp-error.h"
-#include "new-regexp/regexp-shim.h"
+#include "regexp/regexp-error.h"
+#include "regexp/regexp-shim.h"

 namespace v8 {
 namespace internal {
@@ -11,7 +11,7 @@
 // Semantics: Canonicalize) step 3.

 #ifdef V8_INTL_SUPPORT
-#include "new-regexp/special-case.h"
+#include "regexp/special-case.h"

 #include "unicode/uniset.h"
 namespace v8 {