Bug 1098004 Implement snappy compression framing protocol as nsI(Input|Output)Streams. r=froydnj
Bug 1109160: Report Gecko version in SDP. r=abr
Bug 1110530. Use a rectangle instead of a region for layer bounds. r=roc

We only ever look at the bounds of this region so we can just track
that in a single rect instead of a region.

--HG--
extra : rebase_source : 4cd84ab724d9dde1c578e71362cab8033af7a210
Bug 527444 - Use "do_register_cleanup(...)" calls instead of "tail_*.js" files in xpcshell, Core, and Toolkit. f=sgautherie, r=jdm
Bug 1047124 - Clean up memory leaks. r=BenWa
Bug 1109405 - Fix shutdown of MediaEngineWebRTC sources with multiple attached streams. r=jesup
Bug 1105194 - Bail early if Websocket connection is being disconnected. r=smaug
Bug 1101331: Modify directory structure of B2G.app to allow for building of gaia after OSX v2 changes to Firefox. r=rstrong
Bug 1090636, part 1 - Factor out SetExistingProperty from SetPropertyHelper. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 375efc7d9b4b07544f48b53ca5d9031ea4dda2c1
extra : source : 388e4a23e7fb0be8a7f7561e7043531c7132e6f0
Bug 1090636, part 2 - Move SetExistingProperty above SetPropertyHelper. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 69f6d18d98d066adfb2742dd5f4411a2a5b3b7a5
extra : source : db5a8d2f9a23ec92e03d9ec5c5ed609179c32abe
Bug 1090636, part 3 - Shadow an existing property even if pobj == obj. r=efaust.

--HG--
extra : rebase_source : 798fff4a674af97ced2f8972ac65bb5761ac4f27
extra : source : 6425c066275186a8b072e7fa2235af6a9b1b202e
Bug 1090636, part 4 - Update SetPropertyByDefining to implement ES6 draft rev 28 section 9.1.9 steps 5.c-f. r=efaust.

--HG--
extra : rebase_source : c0444b48a571a4c58dc2aef64d8c2fbb6ddc93b5
extra : source : b5a38a0df65d6f7ffeb60344df6155f2aae19bcb
Bug 1090636, part 5 - In SetExistingProperty, correctly handle assigning to array.length. r=efaust.

This one is a little complicated. There is some code in SetExistingProperty that is supposed to determine whether or not we should shadow a property that wasn't found on the receiver. This code does not work correctly for array.length properties. (array.length is a data property, so of course it should be shadowed -- but it is non-shadowable() because hasSlot() is false.)

Having fixed that bug, the call to SetArrayLength is only necessary in the non-shadowing case. (In fact, it would be unnecessary altogether but for Parallel JS.) This in turn makes 'attrs' unnecessary, so delete that.

This is a behavior change (a bug fix) in the case of proxies, as the test illustrates.

--HG--
extra : rebase_source : c968a95baf41944ca82a16d40af51a1512ad0938
extra : source : f322eac33cfa1b54486d1d73f62658019774e373
Bug 1090636, part 6 - Change DefineNativeProperty to support redefining array elements. r=efaust.

As it stands, this code is relatively obscure, so the fact that it's amazingly busted is of little consequence. But once we implement ES6 assignment, this code will be fairly easy to trigger when assigning to any Proxy whose target is an Array.

--HG--
extra : rebase_source : f939b92b42f0470fb0309097fb82f46383a61b25
extra : source : 1ecbc62d82a38e6e36e6ede090d711f3b3ad13ba
Bug 1090636, part 7 - Assigning to an array element via a proxy should trigger the "shadowing" code. r=efaust.

--HG--
extra : rebase_source : 8cdde27dfe42ef2ade0220b7930de66d0249db92
Bug 1090636, part 8 - Factor out SetDenseOrTypedArrayElement from SetExistingProperty. No change in behavior. r=efaust.

--HG--
extra : rebase_source : ca88c753431c65130ea9bad71fd36a8c88a747d4
Bug 1090636, part 9 - Move SetDenseOrTypedArrayElement above SetExistingProperty. No change in behavior. r=efaust.

--HG--
extra : rebase_source : ef3261205f73b1984a798d68b661aee662ad5a66
Bug 1090636, part 10 - Refactor SetExistingProperty. No change in behavior. r=efaust.

At this point, SetPropertyHelper has been factored into five parts:
  SetPropertyByDefining
  SetNonexistentProperty
  SetDenseOrTypedArrayElement
  SetExistingProperty
  SetPropertyHelper

each with a comment on top and a reasonably clear responsibility. The longest is less than 100 lines, including comments.

--HG--
extra : rebase_source : 4d32ae23b5cdbaa357c205766894dfaa2184c755
Bug 1090636, part 11 - Pass pobj (the object that contains the element) to SetDenseOrTypedArrayElement rather than obj. Reflect.set could trigger the bug being fixed here, so we leave a sleeper test for it. r=efaust.

--HG--
extra : rebase_source : 712fb4a4ffd98c0c3e6ba10b3c7dd7bfe8d497f5
Bug 1090636, part 12 - Move NativeSet. No change in behavior. r=efaust.

--HG--
extra : rebase_source : 0b78614bc37c7d90132c8e3bb4bb3cafcfde079b