partly import changes from tenfourfox:

- #651: M1497246 M1776658 M1773717 (bc6daa0ae)

dom/bindings/ToJSValue.h

@@ -126,7 +126,7 @@ ToJSValue(JSContext* aCx,
   // Make sure we're called in a compartment
   MOZ_ASSERT(JS::CurrentGlobalOrNull(aCx));
 
-  aValue.setNumber(aArgument);
+  aValue.set(JS_NumberValue(aArgument));
   return true;
 }
 

dom/jsurl/nsJSProtocolHandler.cpp

@@ -200,7 +200,7 @@ nsresult nsJSThunk::EvaluateScript(nsIChannel *aChannel,
     // Sandboxed document check: javascript: URI's are disabled
     // in a sandboxed document unless 'allow-scripts' was specified.
     nsIDocument* doc = aOriginalInnerWindow->GetExtantDoc();
-    if (doc && doc->HasScriptsBlockedBySandbox()) {
+    if (doc && !doc->IsScriptEnabled()) {
         return NS_ERROR_DOM_RETVAL_UNDEFINED;
     }
 

js/xpconnect/src/XPCConvert.cpp

@@ -134,7 +134,7 @@ XPCConvert::NativeData2JS(MutableHandleValue d, const void* s,
         d.setNumber(*static_cast<const float*>(s));
         return true;
     case nsXPTType::T_DOUBLE:
-        d.setNumber(*static_cast<const double*>(s));
+        d.set(JS_NumberValue(*static_cast<const double*>(s)));
         return true;
     case nsXPTType::T_BOOL  :
         d.setBoolean(*static_cast<const bool*>(s));

js/xpconnect/src/XPCVariant.cpp

@@ -424,7 +424,7 @@ XPCVariant::VariantDataToJS(nsIVariant* variant,
             double d;
             if (NS_FAILED(variant->GetAsDouble(&d)))
                 return false;
-            pJSVal.setNumber(d);
+            pJSVal.set(JS_NumberValue(d));
             return true;
         }
         case nsIDataType::VTYPE_BOOL:

xpcom/glue/nsTArray.h

@@ -1273,6 +1273,8 @@ protected:
   elem_type* ReplaceElementsAt(index_type aStart, size_type aCount,
                                const Item* aArray, size_type aArrayLen)
   {
+    MOZ_RELEASE_ASSERT(!(aStart > Length()));
+    MOZ_RELEASE_ASSERT(!(aCount > (Length() - aStart)));
     // Adjust memory allocation up-front to catch errors.
     if (!ActualAlloc::Successful(this->template EnsureCapacity<ActualAlloc>(
           Length() + aArrayLen - aCount, sizeof(elem_type)))) {