import changes from `dev' branch of rmottola/Arctic-Fox:

- pointer style (34e9d556e)
- Bug 1175466 - Allocate arguments objects in the nursery. r=terrence (14e7d019d)
- Bug 1175511 - Use template objects for arguments object allocation. r=bhackett (09c43e10e)
- Bug 1169250 - Zero-initialize all function object members r=jandem (55e6c44d7)
- Bug 987514, part 3 - Make every global have a (usually empty) Reflect object; rename JS_InitReflect -> JS_InitReflectParse. r=Waldo. (f7beebe35)
- Bug 987514, part 4 - Implement most of the standard Reflect methods. r=Waldo. (0ee01d6da)
- Bug 1160665 - Use the same implementation for both internal and external barriers; r=jonco (5291b100f)
- Bug 1175511 - Use template objects for arguments object allocation. r=bhackett (980240980)
- Bug 1170182 - Remove dead functions from js/src. r=jorendorff (2f6130fa2)
- Bug 1167468: Assert that JSObjects and their metadata are always in the same compartment. r=fitzgen (dc780d455)
- Bug 1172138 - Call PR_LogInit before profiler_init. r=froydnj (bd23dafce)
- re-add WebM NesteggReporter (b22381367)
- Bug 1159507 - make allocation times consistent with timeline; r=fitzgen,mccr8 (3a9c8e3dc)
- Bug 1174906 - Add a mozilla::Variant<T1, T2, ...> template class; r=Waldo (7c12bcf74)
- Bug 1068988 - Part 1: Add byte size to the allocation log; r=shu (4cbbbd8db)
- Bug 1068988 - Part 2: Add a test for byte sizes in the allocations log; r=shu (aa7d187db)
- Bug 1068988 - Part 3: Document the size property in the allocations log; r=shu (fa774e0bd)
- Bug 1068988 - Part 4: Fix object-pending-metadata root marking; r=shu (89961c6ee)
- Bug 1155211: Part 3.1 - Update tests for extractLane; r=h4writer (e8d0da406)
- Bug 1155211: Part 3.2 - Remove lanes getters; r=nbp (840230594)
- Bug 1155211: Part 3.3 - New tests; r=h4writer (9e8a8a456)
- Bug 1174850 - Remove the explicitly relocatable store buffers; r=jonco (02bc4962b)
- Bug 1165843 - Don't fire the pre-barrier in HeapPtr destructor r=terrence (d6277ed50)
- pointer style (5c58f858d)
- Bug 1175642 - Fix the interface that RelocatablePtr uses to interact with the StoreBuffer; r=jonco (30c4c1b47)
- Bug 1165054 - Add API to clear postbarrier callbacks and use it when CPOW tables are destroyed r=terrence (e8d62c559)
- Bug 1131285 - Propagate checkTypeSet flag correctly, r=jandem. (2baae056d)
- re-shufflemethods due to bad patching (5bb9a0ae5)
- Bug 977805 followup - Fix some issues with IonCache::reset reprotection. r=luke (11bcad882)
- Bug 1180854 - Record and expose Ion IC stub optimization info to Jit Coach. r=shu (fa00fd728)
- Bug 1179264 - Only assert markedness of sampled scripts in JitcodeMap during finalization. (r=terrence) (e9639d963)
- Bug 1173764 - Enable LAllocation/LUse serialization in optimized builds. r=bhackett (a10398167)
- Bug 1173764 - Disable JitSpew argument computation in optimizied builds. r=bhackett (54d0f0b5e)
- cleanup spaces and pointer style (d79dba082)
- Bug 1175761 - Avoid using types in the nursery during optimization tracking, r=shu. (739174bd3)
- Bug 1176511 - Minor GC when tracking types as a better bandaid. (r=terrence) (3913d0b0d)
- Bug 1182730 - Mark the JitcodeGlobalTable unconditionally when minor collecting. (r=terrence) (86ace1dcd)
- Bug 1182730 - Followup: only mark the JitcodeGlobalMap when profiling is on. (r=djvj) (be105dff4)
- Bug 1187512 - Fix accumulated unified bustage in SpiderMonkey; r=jonco (8a663452f)
- Bug 1155211: Rename bitselect into selectBits; r=nbp (b644a0731)
- Bug 1155211: Remove selectBits on Float types; r=nbp (588ffbc3e)
- Bug 1175494 - comprehensive atomics tests for asm.js. r=luke (1ef4b9c1d)
- Bug 1141986 - Atomics.exchange on integer elements -- asm.js parts. r=bbouvier (d7eeba2b4)
- Bug 1183308 - Fix ARM64 bustage from Bug 1141986. r=efaust (8915a33ac)
- real part of previous partial Bug 1038839 - Use type information for alias analysis. r=jandem (98f3ac4f9)
- Bug 1148375 - Ignore unhandled Elements. r=jandem (a74a4954e)
- Bug 1180990 - Add checks for nursery objects when building MIR. r=jandem (55117882e)
- Bug 1180049 - Add OOM check in MNewArray constructor. r=bhackett (95dca3f7d)
- Bug 1186271: IonMonkey: Honor truncated flag during folding of binary operations, r=nbp (34d66ad0b)
- Bug 1173869: IonMonkey - Cleanup of some dead code in MBinaryArithInstruction::infer, r=jandem (4d42ac15a)
- Bug 1193112: IonMonkey - Let the float32 optimization work with Float32, r=bbouvier (fae4514b6)

js/ipc/JavaScriptShared.cpp

@@ -85,33 +85,26 @@ IdToObjectMap::empty() const
     return table_.empty();
 }
 
-ObjectToIdMap::ObjectToIdMap()
-  : table_(nullptr)
+ObjectToIdMap::ObjectToIdMap(JSRuntime* rt)
+  : rt_(rt)
 {
 }
 
 ObjectToIdMap::~ObjectToIdMap()
 {
-    if (table_) {
-        dom::AddForDeferredFinalization<Table>(table_);
-        table_ = nullptr;
-    }
+    JS_ClearAllPostBarrierCallbacks(rt_);
 }
 
 bool
 ObjectToIdMap::init()
 {
-    if (table_)
-        return true;
-
-    table_ = new Table(SystemAllocPolicy());
-    return table_ && table_->init(32);
+    return table_.initialized() || table_.init(32);
 }
 
 void
 ObjectToIdMap::trace(JSTracer* trc)
 {
-    for (Table::Enum e(*table_); !e.empty(); e.popFront()) {
+    for (Table::Enum e(table_); !e.empty(); e.popFront()) {
         JSObject* obj = e.front().key();
         JS_CallUnbarrieredObjectTracer(trc, &obj, "ipc-object");
         if (obj != e.front().key())
@@ -122,7 +115,7 @@ ObjectToIdMap::trace(JSTracer* trc)
 void
 ObjectToIdMap::sweep()
 {
-    for (Table::Enum e(*table_); !e.empty(); e.popFront()) {
+    for (Table::Enum e(table_); !e.empty(); e.popFront()) {
         JSObject* obj = e.front().key();
         JS_UpdateWeakPointerAfterGCUnbarriered(&obj);
         if (!obj)
@@ -135,7 +128,7 @@ ObjectToIdMap::sweep()
 ObjectId
 ObjectToIdMap::find(JSObject* obj)
 {
-    Table::Ptr p = table_->lookup(obj);
+    Table::Ptr p = table_.lookup(obj);
     if (!p)
         return ObjectId::nullId();
     return p->value();
@@ -144,9 +137,9 @@ ObjectToIdMap::find(JSObject* obj)
 bool
 ObjectToIdMap::add(JSContext* cx, JSObject* obj, ObjectId id)
 {
-    if (!table_->put(obj, id))
+    if (!table_.put(obj, id))
         return false;
-    JS_StoreObjectPostBarrierCallback(cx, keyMarkCallback, obj, table_);
+    JS_StoreObjectPostBarrierCallback(cx, keyMarkCallback, obj, &table_);
     return true;
 }
 
@@ -166,13 +159,13 @@ ObjectToIdMap::keyMarkCallback(JSTracer* trc, JSObject* key, void* data)
 void
 ObjectToIdMap::remove(JSObject* obj)
 {
-    table_->remove(obj);
+    table_.remove(obj);
 }
 
 void
 ObjectToIdMap::clear()
 {
-    table_->clear();
+    table_.clear();
 }
 
 bool JavaScriptShared::sLoggingInitialized;
@@ -182,7 +175,9 @@ bool JavaScriptShared::sStackLoggingEnabled;
 JavaScriptShared::JavaScriptShared(JSRuntime* rt)
   : rt_(rt),
     refcount_(1),
-    nextSerialNumber_(1)
+    nextSerialNumber_(1),
+    unwaivedObjectIds_(rt),
+    waivedObjectIds_(rt)
 {
     if (!sLoggingInitialized) {
         sLoggingInitialized = true;