import changes from `dev' branch of rmottola/Arctic-Fox:

- Bug 1190733 - Test initializedLength() instead of length() during the fast path for reversing unboxed arrays, r=jandem. (b5dcbd0e3)
- Bug 1070767 - Enable {Array, %TypedArray%}.prototype.includes in all builds. r=lth (de595c002)
- Bug 1195298 - Fix NewDenseArray intrinsic to work when the first argument is a double. r=till (1f551ada2)
- Bug 1190727 - Make initialization of temporary results array resilient against Array.prototype setters in self-hosted Map#next implementation. r=jandem (d705c623c)
- Bug 1200108 - Remove NewDenseArray intrinsic, use std_Array instead. r=till (e5c4126c6)
- Bug 1199822 - Turn self-hosting's cycle-check into an assertion; r=till (804600283)
- Bug 1194148 - Self-host Array.prototype.toString. r=till (4ffb4712c)
- pointer style (7b1a9900c)
- Bug 1200809 part 5 - Convert self-hosting intrinsics to new InlinableNatives system. r=till (8dd5eb0b9)
- pointer style (7974610a2)
- Bug 1200809 part 6 - Convert various natives to new InlinableNatives system. r=nbp (81d75199c)
- Bug 1200809 part 7 - Convert SIMD natives to new InlinableNatives system. r=nbp (5e67097e0)
- Bug 1200809 part 8 - Don't call shouldAbortOnPreliminaryGroups if we have an uninlinable native. r=bhackett (bd20f201f)
- Bug 1114507 - Part 1: Add/release the appId's refcnt if frame is in main process. r=kanru (741889791)
- Bug 1190903 - Don't send StopIMEStateManagement message after TabParent has been destroyed (r=masayuki) (97bba211b)
- Bug 1166592 - Remove ParentIdleListener from idle service when ActorDestroy() to avoid leaking ContentParent. r=khuey (771549a18)
- Bug 1114507 - Part 3: Remove PContetBridge channel when grandchild-process is killed. r=kanru (a84f888b3)
- Bug 1114507 - Part 2: Add/release the appId's refcnt in oop case. r=kanru (1fdb788b0)
- Bug 1114507 - Part 4: Test cases. r=kanru (889a770c7)
- pointer style (80bd2082b)
- Bug 1159347 - Make BaseProxyHandler::getPropertyDescriptor not-pure virtual. r=efaust (56de51919)
- Bug 1166847 - Implement OpaqueCrossCompartmentWrapper;r=evilpies (d762e785e)

js/src/jsarray.cpp

@@ -1149,43 +1149,6 @@ ArrayJoin(JSContext* cx, CallArgs& args)
     return true;
 }
 
-/* ES5 15.4.4.2. NB: The algorithm here differs from the one in ES3. */
-static bool
-array_toString(JSContext* cx, unsigned argc, Value* vp)
-{
-    JS_CHECK_RECURSION(cx, return false);
-
-    CallArgs args = CallArgsFromVp(argc, vp);
-    RootedObject obj(cx, ToObject(cx, args.thisv()));
-    if (!obj)
-        return false;
-
-    RootedValue join(cx, args.calleev());
-    if (!GetProperty(cx, obj, obj, cx->names().join, &join))
-        return false;
-
-    if (!IsCallable(join)) {
-        JSString* str = JS_BasicObjectToString(cx, obj);
-        if (!str)
-            return false;
-        args.rval().setString(str);
-        return true;
-    }
-
-    InvokeArgs args2(cx);
-    if (!args2.init(0))
-        return false;
-
-    args2.setCallee(join);
-    args2.setThis(ObjectValue(*obj));
-
-    /* Do the call. */
-    if (!Invoke(cx, args2))
-        return false;
-    args.rval().set(args2.rval());
-    return true;
-}
-
 /* ES5 15.4.4.3 */
 static bool
 array_toLocaleString(JSContext* cx, unsigned argc, Value* vp)
@@ -1282,10 +1245,10 @@ ArrayReverseDenseKernel(JSContext* cx, HandleObject obj, uint32_t length)
         /* Fill out the array's initialized length to its proper length. */
         obj->as<NativeObject>().ensureDenseInitializedLength(cx, length, 0);
     } else {
-        // Unboxed arrays can only be reversed if their initialized length
+        // Unboxed arrays can only be reversed here if their initialized length
         // matches their actual length. Otherwise the reversal will place holes
         // at the beginning of the array, which we don't support.
-        if (length != obj->as<UnboxedArrayObject>().length())
+        if (length != obj->as<UnboxedArrayObject>().initializedLength())
             return DenseElementResult::Incomplete;
     }
 
@@ -3107,8 +3070,8 @@ static const JSFunctionSpec array_methods[] = {
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str,      array_toSource,     0,0),
 #endif
-    JS_FN(js_toString_str,      array_toString,     0,0),
-    JS_FN(js_toLocaleString_str,array_toLocaleString,0,0),
+    JS_SELF_HOSTED_FN(js_toString_str, "ArrayToString",      0,0),
+    JS_FN(js_toLocaleString_str,       array_toLocaleString, 0,0),
 
     /* Perl-ish methods. */
     JS_FN("join",               array_join,         1,JSFUN_GENERIC_NATIVE),
@@ -3147,7 +3110,6 @@ static const JSFunctionSpec array_methods[] = {
 
     /* ES7 additions */
     JS_SELF_HOSTED_FN("includes",    "ArrayIncludes",    2,0),
-
     JS_FS_END
 };
 
@@ -3299,7 +3261,7 @@ const Class ArrayObject::class_ = {
     nullptr, /* construct */
     nullptr, /* trace */
     {
-        GenericCreateConstructor<ArrayConstructor, 1, gc::AllocKind::FUNCTION>,
+        GenericCreateConstructor<ArrayConstructor, 1, AllocKind::FUNCTION, &jit::JitInfo_Array>,
         CreateArrayPrototype,
         array_static_methods,
         nullptr,