import changes from `dev' branch of rmottola/Arctic-Fox:

- Bug 1154563 - Drop the unused argument of WorkerPrivate::Close(); r=baku (366f353f9f)
- Bug 1178721 - Implement SuspendWorkersForWindow;r=khuey (a49bc9a306)
- Bug 1207490 - Part 6: Remove use of expression closure from browser/devtools/. r=vporof (1c4d153319)
- Bug 1198982: Don't fail the SW load for an importScripts failure. r=bkelly (948f5dca94)
- Bug 1160890 - Part 1: Remove unneeded code from ImportScripts(). r=smaug (e31f7c82eb)
- Bug 1160890 - Part 2: ImportScripts() should return muted errors with 3rd party scripts. r=smaug (347e54a605)
- Bug 1188141: Make Worker error events not bubble. r=baku (509fd46933)
- Bug 1160890, r=smaug (0ce3ee09d6)
- Bug 1208687: Only discard events from the outermost queue. r=ehsan (bce722c16b)
- Bug 949376 - MessageEvent::initMessageEvent, r=smaug (8878e51c91)
- Bug 1214772 - Part 2: Make FetchEvent inherit from ExtendableEvent; r=bzbarsky (edff91f7fb)
- Bug 1218131 - Mark FetchEvent.request as SameObject; r=bzbarsky (1f79b94838)
- Bug 1188545 - Add tests for service workers' lifetime management. r=nsm (9bac3b9f2d)
- Bug 1218135 - Remove FetchEvent.client; r=bzbarsky (e95e4e5326)
- Bug 1218151 - Make FetchEventInit.isReload default to false; r=bzbarsky (795d597a3b)
- Bug 1218621 - Keep the service worker alive while the promise passed to FetchEvent.respondWith() settles; r=catalinb (653633c136)
- Bug 1212636 - Add a better error message for the content corrupcted error caused by the Promise being passed to FetchEvent.respondWith; r=bkelly (d6ebabc2f2)
- Bug 1215140 P4 Make service worker respondWith() use channel ConsoleReportCollector. r=bz (0e07f364d4)
- Bug 1218499 - Make FetchEvent.request nullable; r=bzbarsky (850630ea6d)
- Bug 1179397 - Disallow FetchEvent.respondWith() when the dispatch flag is unset; r=jdm (2e57abf1c6)
- Bug 1215140 P5 Report the line number where respondWith() was called. r=bz (484e385ce3)
- Bug 1161239 - Emit a warning if the respondWith handler is resolved with a non-Object value; r=baku (cf2779f827)
- Bug 1181054 - Part 1: Move FormFillIterator and FormDataParser to FetchUtil.cpp; r=bkelly (9f62174f72)
- Bug 1181054 - Part 2: Refactor the code to extract an HTTP header from a buffer from FormDataParser; r=bkelly (7f57f76ce1)
- Bug 1181054 - Part 3: Correctly handle upload channels that have embedded body headers when dispatching a FetchEvent; r=bkelly (ebbfac4419)
-  ug 1181054 - Part 4: Make fetch-event.https.html pass; r=bkelly (b2d88a3f5b)
- Bug 1215140 P6 Update service worker interception error strings to include detailed parameters. r=bz (7918278f09)
- Bug 1219852 P1 Extract common JS values for rejected respondWith() promises. r=bz (12a6beed6c)
- Bug 1219852 P2 Report non-response values passed to FetchEvent.respondWith(). r=bz (69fdad9d5f)
- Bug 1207068 - Implement ExtendableMessageEvent interface. r=baku (29fd7c1c59)
- Bug 1224061: Make Event::InitEvent infallible. r=smaug Bug 1224061 followup to fix bustage. r=me on a CLOSED TREE IGNORE IDL (b4fc91b14b)
- Bug 1205109 - Make pushsubscriptionchange extendable. r=mt (abb45ac864)
- Bug 1207491 - Part 8: Remove use of expression closure from browser/omponents/nsBrowserContentHandler.js. r=Gijs (98dcb2cbee)
- Bug 1182571: Followup bustage fix from merge fail. CLOSED TREE (5062c88996)
- Bug 1213646: Allow URI_IS_UI_RESOURCE and safe about: URIs when SEC_ALLOW_CHROME is set. r=bz (6ca4e2322f)
- Bug 1191645 - Use channel->asycnOpen2 in dom/base/nsSyncLoadService.cpp. r=sicking (3fbd471f6b)
- Bug 1194526 - Use channel->asycnOpen2 in dom/base/nsScriptLoader.cpp (r=sicking) (7207efa45b)
- Bug 1084009 - Part 1/3 - Parse sync scripts off the main thread. r=smaug (72f4d5c749)
- Bug 1084009 - Part 2/3 - Only parse scripts off-main-thread on multicore systems. r=luke (ffb7e2270e)
- Bug 1209193 - Cache PR_GetNumberOfProcessors when checking to do off-main-thread script compilation. r=luke (c514373ad7)
- Bug 663570 - MetaCSP Part 7: CSP preload validation (r=bz) (5398116f85)
- Bug 1207863 - Fix ScopeIter iterating a strict eval frame that errored out before its CallObject was allocated. (r=jorendorff) (ae38882b7c)
- Bug 1223006 - Fix some typo in spidermonkey's comments. r=nbp (7d49536a0f)
- Bug 1223490 - Use stable hashing for InnerViewTable; r=jonco (12b4329982)

js/src/vm/ArrayBufferObject.h

@@ -501,9 +501,17 @@ class InnerViewTable
     friend class ArrayBufferObject;
 
   private:
+    // This key is a raw pointer and not a ReadBarriered because the post-
+    // barrier would hold nursery-allocated entries live unconditionally. It is
+    // a very common pattern in low-level and performance-oriented JavaScript
+    // to create hundreds or thousands of very short lived temporary views on a
+    // larger buffer; having to tenured all of these would be a catastrophic
+    // performance regression. Thus, it is vital that nursery pointers in this
+    // map not be held live. Special support is required in the minor GC,
+    // implemented in sweepAfterMinorGC.
     typedef HashMap<JSObject*,
                     ViewVector,
-                    DefaultHasher<JSObject*>,
+                    MovableCellHasher<JSObject*>,
                     SystemAllocPolicy> Map;
 
     // For all objects sharing their storage with some other view, this maps
@@ -511,7 +519,10 @@ class InnerViewTable
     Map map;
 
     // List of keys from innerViews where either the source or at least one
-    // target is in the nursery.
+    // target is in the nursery. The raw pointer to a JSObject is allowed here
+    // because this vector is cleared after every minor collection. Users in
+    // sweepAfterMinorCollection must be careful to use MaybeForwarded before
+    // touching these pointers.
     Vector<JSObject*, 0, SystemAllocPolicy> nurseryKeys;
 
     // Whether nurseryKeys is a complete list.