import changes from `dev' branch of rmottola/Arctic-Fox:

- Bug 1147247 - Use PRErrorCodeSuccess constant instead of literal 0 to represent success in PSM xpcshell tests. r=dkeeler (493559944)
- bug 1151512 - only allow whitelisted certificates to be issued by CNNIC root certificates r=jcj r=rbarnes (cd2131810)
- bug 1157873 - remove certificates from CNNIC whitelist that aren't in the Pilot Certificate Transparency log r=rbarnes (a1a1a01a8)
- Bug 996872 - Reduce calls to getXPCOMStatusFromNSS() in PSM xpcshell tests. r=keeler relanding on a CLOSED TREE (c26cb3a1c)
- Bug 1149805 - Switch head_psm.js to Assert.jsm methods and add expected result strings. r=keeler (a97667d2f)
- bug 1102436 - remove PublicKeyPinningService::CheckChainAgainstAllNames r=Cykesiopka (2fdfc2694)
- Bug 1164409 - Reduce PSM xpcshell script code duplication. r=keeler (eaf339d67)
- Bug 1170431 - Pass buildid as input to pycert.py. r=gps (0ad7492ef)
- pointer and comment style (f659d45ec)
- add missing test of Bug 1138195 - Ensure that the bytecode analysis is consistent with the bindings. r=jandem (a4aa50c3e)
- And fix this to actually compile... Still bug 1160311. (f15aef67f)
- pointer style (d41e7fda2)
- Bug 1194139 - Fix includes order to make the SM style checker happy. (d02e8c839)
- pointer style (4ac1a858a)
- Bug 1193212 - Ensure properties deleted by setting Array#length are suppressed in active for..in iteration. r=jandem (b5b3b479d)
- Bug 1176712 - Cannot have two activities with same name and different filters. r=fabrice (231b5a89d)
- Bug 1161537 - Intermittent test_dev_mode_activity.html | Got error: undefined - expected PASS r=me (c1b0c88d0)
- Bug 1105766 - Part 1: Extend the GC allocation logic to work on Windows Phone. r=terrence (e17916f5b)
- Bug 1105766 - Part 2: A couple of additions to enable compilation on Windows Phone 8. r=terrence r=ehoogeveen (1d3d809fe)
- Bug 1189967 - Avoid including <string> from Char16.h. r=nfroyd (695a687bb)
- Bug 1345331: Include <intrin.h> at top-level before lz4.c can include it in a namespace. r=Waldo (63216582f)
- remove namespace (09dd2830c)
- Bug 1145056 - Coverity complains on every use of MutexAutoLock and GuardObjectNotifier. r=froydnj (0f891929d)
- Bug 1145056 - Assert that the guard notifier has been initialized. r=froydnj (061895ad3)
- spacing (56b8e1fea)
- Bug 1113300 - Add a way to use SegmentedVector like a stack. r=froydnj (2fdaf928e)
- bug 606080 - add SplayTree::LookupOrAdd r=froydnj (95591b341)
- Bug 1177541 - Remove warning if file is not found during deferred open. r=mcmanus (f15650a51)
- spaces and style (2b0558951)

js/src/jsarray.cpp

@@ -612,7 +612,14 @@ js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
         // that element must prevent any deletions below it.  Bug 586842 should
         // fix this inefficiency by moving indexed storage to be entirely
         // separate from non-indexed storage.
-        if (!arr->isIndexed()) {
+        // A second reason for this optimization to be invalid is an active
+        // for..in iteration over the array. Keys deleted before being reached
+        // during the iteration must not be visited, and suppressing them here
+        // would be too costly.
+        ObjectGroup* arrGroup = arr->getGroup(cx);
+        if (!arr->isIndexed() &&
+            !MOZ_UNLIKELY(!arrGroup || arrGroup->hasAllFlags(OBJECT_FLAG_ITERATED)))
+        {
             if (!arr->maybeCopyElementsForWrite(cx))
                 return false;