import changes from `dev' branch of rmottola/Arctic-Fox:

- Bug 1209039 - Temporarily disable thread names in Moz2D to work around a static check failure CLOSED TREE. r=me (8c45ce9eb)
- missing bit of Bug 1198216 - Check for presence of ICU::Timezone::recreateDefault() (e047330f1)
- Bug 1233743 - Remove the Mutex typedef from gfx/2d. r=vlad (c1b5a3746)
- Bug 1083101 - Implement gfx::DrawingJob. r=jrmuizel (22818c618)
- Bug 1083101 - Extend DrawCommand storage functionality and fix a bug with dashed stroke patterns. r=jrmuizel (11daecf61)
- Bug 1083101 - Make gfx::DrawingCommand methods const. r=jrmuizel (f5099f18d)
- Bug 1127665 - Fix the condition of if-statement of name updating when the Bluetoooth device paired. r=btian (a751b7b6c)
- Bug 1128383 - [bluetooth2] Add adapter.onpairingaborted event handler, f=jocelyn, f=jaliu, r=shuang, r=bz (cc9fe48d9)
- Bug 1054756, part 3 - Implement Symbol.toPrimitive. Replace existing convert hooks with methods. r=jandem. (4c3db3ac3)
- Bug 1083101 - Make SyncObject's waiting jobs list lock-free. r=jrmuizel (a5793e016)
- pointer style (80bb87e64)
- Bug 1207006 - Remove the unhelpfully-confusing exceptionCodeIndented. r=bz (5fc73954b)
- pointer style (f46f24dfb)
- Bug 1145854 - Don't leak WrapperOwner::className's string. r=billm (6e83a9377)
- Bug 1187234 - Throw a TypeError when Array.isArray is passed a revoked proxy. r=efaust (75e166521)
- Bug 1164764 - Make all the various DeadObjectProxy handler methods call a single function to report a dead object, rather than repeating the same function call/arguments everywhere. r=evilpies (686daa9d2)

js/src/jsarray.cpp

@@ -57,8 +57,40 @@ using mozilla::IsNaN;
 using mozilla::UniquePtr;
 
 using JS::AutoCheckCannotGC;
+using JS::IsArrayAnswer;
 using JS::ToUint32;
 
+bool
+JS::IsArray(JSContext* cx, HandleObject obj, IsArrayAnswer* answer)
+{
+    if (obj->is<ArrayObject>() || obj->is<UnboxedArrayObject>()) {
+        *answer = IsArrayAnswer::Array;
+        return true;
+    }
+
+    if (obj->is<ProxyObject>())
+        return Proxy::isArray(cx, obj, answer);
+
+    *answer = IsArrayAnswer::NotArray;
+    return true;
+}
+
+bool
+JS::IsArray(JSContext* cx, HandleObject obj, bool* isArray)
+{
+    IsArrayAnswer answer;
+    if (!IsArray(cx, obj, &answer))
+        return false;
+
+    if (answer == IsArrayAnswer::RevokedProxy) {
+        JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_PROXY_REVOKED);
+        return false;
+    }
+
+    *isArray = answer == IsArrayAnswer::Array;
+    return true;
+}
+
 bool
 js::GetLengthProperty(JSContext* cx, HandleObject obj, uint32_t* lengthp)
 {
@@ -1995,8 +2027,13 @@ js::array_push(JSContext* cx, unsigned argc, Value* vp)
             // SetOrExtendAnyBoxedOrUnboxedDenseElements takes care of updating the
             // length for boxed and unboxed arrays. Handle updates to the length of
             // non-arrays here.
-            if (!IsArray(obj, cx))
+            bool isArray;
+            if (!IsArray(cx, obj, &isArray))
+                return false;
+
+            if (!isArray)
                 return SetLengthProperty(cx, obj, newlength);
+
             return true;
         }
     }
@@ -2589,7 +2626,10 @@ js::array_concat(JSContext* cx, unsigned argc, Value* vp)
 
     RootedObject narr(cx);
     uint32_t length;
-    if (IsArray(aobj, cx) && !ObjectMayHaveExtraIndexedProperties(aobj)) {
+    bool isArray;
+    if (!IsArray(cx, aobj, &isArray))
+        return false;
+    if (isArray && !ObjectMayHaveExtraIndexedProperties(aobj)) {
         if (!GetLengthProperty(cx, aobj, &length))
             return false;
 
@@ -2614,7 +2654,10 @@ js::array_concat(JSContext* cx, unsigned argc, Value* vp)
                 RootedObject obj(cx, &v.toObject());
 
                 // This should be IsConcatSpreadable
-                if (!IsArray(obj, cx) || ObjectMayHaveExtraIndexedProperties(obj))
+                bool isArray;
+                if (!IsArray(cx, obj, &isArray))
+                    return false;
+                if (!isArray || ObjectMayHaveExtraIndexedProperties(obj))
                     break;
 
                 uint32_t argLength;
@@ -2670,7 +2713,10 @@ js::array_concat(JSContext* cx, unsigned argc, Value* vp)
         if (v.isObject()) {
             RootedObject obj(cx, &v.toObject());
             // This should be IsConcatSpreadable
-            if (IsArray(obj, cx)) {
+            bool isArray;
+            if (!IsArray(cx, obj, &isArray))
+                return false;
+            if (isArray) {
                 uint32_t alength;
                 if (!GetLengthProperty(cx, obj, &alength))
                     return false;
@@ -2993,7 +3039,8 @@ array_isArray(JSContext* cx, unsigned argc, Value* vp)
     bool isArray = false;
     if (args.get(0).isObject()) {
         RootedObject obj(cx, &args[0].toObject());
-        isArray = IsArray(obj, cx);
+        if (!IsArray(cx, obj, &isArray))
+            return false;
     }
     args.rval().setBoolean(isArray);
     return true;