reverting rmottola/Arctic-Fox changes in order to bisect memory leak and greasemonkey issue:

- Bug 1136925 part 1. Stop passing a parent to JS_CloneObject (02806f3cb)
- Bug 1136925 part 2. Stop passing a parent to Wrapper::New. (1d51cbd34)
- Bug 1136925 part 3. Stop passing parents to js::NewProxyObject. (dc13db8da)
- Bug 1136925 part 4. Stop passing parents to ProxyObject::New. (e2d30e340)
- Bug 1130679: IonMonkey: Make it possible to guard on type changes/bailouts (ecec18313)
- Bug 1136980 part 1. Get rid of JS_SetParent uses in DOM/XPConnect. (5cad9c256)
- Bug 1136980 part 2. Remove JS_SetParent, even though we have a CLOSED TREE (96cf58c85)
- Bug 1066229 - Part 5: Emitter support for basic ES6 ClassStatements. (e2a3cc979)
- Bug 1135423 - Use unboxed objects for object literals where possible, clean up object literal creation and property initialization code (1d9e381c2)
- Bug 1137523 part 2 - Unprefix a few js_* functions I forgot in part 1 (e6beaf0d8)
- Bug 1135816 - Handle unboxed object receivers when compiling getter/setter calls in baseline/Ion (82233087e)
- Bug 1138265 - TraceLogger: Throw error when trying to enable in AsmJS (64c799042)
- Bug 1113369, part 1 - Introduce JS::ObjectOpResult and use it in js::StandardDefineProperty. (15663c476)
- Bug 1113369, part 1½ - Avoid regressing error messages by adding obj to the ObjectOpResult methods that could throw a TypeError. (e063faf08)
- Bug 1113369, part 2 - js::SetArrayLength ObjectOpResult support. (cf8326017)
- Bug 1113369, part 3 - [[DefineOwnProperty]] ObjectOpResult support. (e16605a90)
- Bug 1113369, part 4 - [[Set]] ObjectOpResult support. (6f94604d4)
- Bug 1077002 - Give a better error message when showModalDialog is used (18d8ecc12)
- Bug 1135792. Stop assuming that every binding for a global with a non-worker descriptor is a binding for Window. (dd0260c12)
- Bug 1135810. Add more explicit checks for whether a descriptor wants Xrays or not instead of assuming that Xrays are desired if and only if descriptor.workers is false. (17ef71544)
- Bug 1050456 - Part 1: Prevent prerendered pages from showing the slow script dialog (173044922)
- Bug 1050456 - Part 2: Add a nsGlobalWindow::GetIsPrerendered helper (ac680a5f7)
hopefully we can re-apply them later.

js/src/jsarray.cpp

@@ -363,7 +363,7 @@ SetArrayElement(JSContext* cx, HandleObject obj, double index, HandleValue v)
         return false;
 
     RootedValue tmp(cx, v);
-    return SetProperty(cx, obj, obj, id, &tmp);
+    return SetProperty(cx, obj, obj, id, &tmp, true);
 }
 
 /*
@@ -433,7 +433,7 @@ bool
 js::SetLengthProperty(JSContext* cx, HandleObject obj, double length)
 {
     RootedValue v(cx, NumberValue(length));
-    return SetProperty(cx, obj, obj, cx->names().length, &v);
+    return SetProperty(cx, obj, obj, cx->names().length, &v, true);
 }
 
 /*
@@ -459,8 +459,7 @@ array_length_getter(JSContext* cx, HandleObject obj_, HandleId id, MutableHandle
 }
 
 static bool
-array_length_setter(JSContext *cx, HandleObject obj, HandleId id, MutableHandleValue vp,
-                    ObjectOpResult &result)
+array_length_setter(JSContext* cx, HandleObject obj, HandleId id, bool strict, MutableHandleValue vp)
 {
     if (!obj->is<ArrayObject>()) {
         // This array .length property was found on the prototype
@@ -468,14 +467,13 @@ array_length_setter(JSContext *cx, HandleObject obj, HandleId id, MutableHandleV
         // we're here, do an impression of SetPropertyByDefining.
         const Class* clasp = obj->getClass();
         return DefineProperty(cx, obj, cx->names().length, vp,
-                              clasp->getProperty, clasp->setProperty, JSPROP_ENUMERATE, result);
+                              clasp->getProperty, clasp->setProperty, JSPROP_ENUMERATE);
     }
 
     Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
     MOZ_ASSERT(arr->lengthIsWritable(),
                "setter shouldn't be called if property is non-writable");
-
-    return ArraySetLength(cx, arr, id, JSPROP_PERMANENT, vp, result);
+    return ArraySetLength(cx, arr, id, JSPROP_PERMANENT, vp, strict);
 }
 
 struct ReverseIndexComparator
@@ -508,7 +506,7 @@ js::CanonicalizeArrayLengthValue(JSContext* cx, HandleValue v, uint32_t* newLen)
 /* ES6 20130308 draft 8.4.2.4 ArraySetLength */
 bool
 js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
-                   unsigned attrs, HandleValue value, ObjectOpResult &result)
+                   unsigned attrs, HandleValue value, bool setterIsStrict)
 {
     MOZ_ASSERT(id == NameToId(cx->names().length));
 
@@ -531,8 +529,11 @@ js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
     // OrdinaryDefineOwnProperty in ES6, the default [[DefineOwnProperty]] in
     // ES5 -- but we reimplement all the conflict-detection bits ourselves here
     // so that we can use a customized length representation.)
-    if (!(attrs & JSPROP_PERMANENT) || (attrs & JSPROP_ENUMERATE))
-        return result.fail(JSMSG_CANT_REDEFINE_PROP);
+    if (!(attrs & JSPROP_PERMANENT) || (attrs & JSPROP_ENUMERATE)) {
+        if (!setterIsStrict)
+            return true;
+        return Throw(cx, id, JSMSG_CANT_REDEFINE_PROP);
+    }
 
     /* Steps 6-7. */
     bool lengthIsWritable = arr->lengthIsWritable();
@@ -549,9 +550,14 @@ js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
     /* Steps 8-9 for arrays with non-writable length. */
     if (!lengthIsWritable) {
         if (newLen == oldLen)
-            return result.succeed();
+            return true;
 
-        return result.fail(JSMSG_CANT_REDEFINE_ARRAY_LENGTH);
+        if (setterIsStrict) {
+            return JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, GetErrorMessage, nullptr,
+                                                JSMSG_CANT_REDEFINE_ARRAY_LENGTH);
+        }
+
+        return JSObject::reportReadOnly(cx, id, JSREPORT_STRICT | JSREPORT_WARNING);
     }
 
     /* Step 8. */
@@ -732,20 +738,53 @@ js::ArraySetLength(JSContext* cx, Handle<ArrayObject*> arr, HandleId id,
         }
     }
 
-    if (!succeeded)
-        return result.fail(JSMSG_CANT_TRUNCATE_ARRAY);
+    if (setterIsStrict && !succeeded) {
+        RootedId elementId(cx);
+        if (!IndexToId(cx, newLen - 1, &elementId))
+            return false;
+        return arr->reportNotConfigurable(cx, elementId);
+    }
 
-    return result.succeed();
+    return true;
 }
 
 bool
-js::WouldDefinePastNonwritableLength(HandleNativeObject obj, uint32_t index)
+js::WouldDefinePastNonwritableLength(ExclusiveContext* cx,
+                                     HandleObject obj, uint32_t index, bool strict,
+                                     bool* definesPast)
 {
-    if (!obj->is<ArrayObject>())
-        return false;
+    if (!obj->is<ArrayObject>()) {
+        *definesPast = false;
+        return true;
+    }
 
-    ArrayObject *arr = &obj->as<ArrayObject>();
-    return !arr->lengthIsWritable() && index >= arr->length();
+    Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
+    uint32_t length = arr->length();
+    if (index < length) {
+        *definesPast = false;
+        return true;
+    }
+
+    if (arr->lengthIsWritable()) {
+        *definesPast = false;
+        return true;
+    }
+
+    *definesPast = true;
+
+    // Error in strict mode code or warn with strict option.
+    unsigned flags = strict ? JSREPORT_ERROR : (JSREPORT_STRICT | JSREPORT_WARNING);
+    if (!cx->isJSContext())
+        return true;
+
+    JSContext* ncx = cx->asJSContext();
+
+    if (!strict && !ncx->compartment()->options().extraWarnings(ncx))
+        return true;
+
+    // XXX include the index and maybe array length in the error message
+    return JS_ReportErrorFlagsAndNumber(ncx, flags, GetErrorMessage, nullptr,
+                                        JSMSG_CANT_DEFINE_PAST_ARRAY_LENGTH);
 }
 
 static bool
@@ -1269,7 +1308,7 @@ InitArrayElements(JSContext* cx, HandleObject obj, uint32_t start, uint32_t coun
         value = *vector++;
         indexv = DoubleValue(index);
         if (!ValueToId<CanGC>(cx, indexv, &id) ||
-            !SetProperty(cx, obj, obj, id, &value))
+            !SetProperty(cx, obj, obj, id, &value, true))
         {
             return false;
         }
@@ -3073,7 +3112,8 @@ array_of(JSContext* cx, unsigned argc, Value* vp)
     }
 
     // Steps 9-10.
-    if (!SetLengthProperty(cx, obj, args.length()))
+    RootedValue v(cx, NumberValue(args.length()));
+    if (!SetProperty(cx, obj, obj, cx->names().length, &v, true))
         return false;
 
     // Step 11.