Merge branch 'master' into releaseRB_20230715

17 files changed, 319 insertions, 131 deletions

diff --git a/build/moz.configure/old.configure b/build/moz.configure/old.configure
index 40cc9e89fc..3d3873eae8 100644
--- a/build/moz.configure/old.configure
+++ b/build/moz.configure/old.configure
@@ -276,7 +276,9 @@ def old_configure_options(*options):
     '--with-ios-sdk',
     '--with-jitreport-granularity',
     '--with-macbundlename-prefix',
+    '--with-macbundle-entitlement',
     '--with-macbundle-identity',
+    '--with-macbundle-type',
     '--with-macos-private-frameworks',
     '--with-macos-sdk',
     '--with-nspr-cflags',
diff --git a/dom/performance/Performance.cpp b/dom/performance/Performance.cpp
index 109f767557..217faa5afe 100755
--- a/dom/performance/Performance.cpp
+++ b/dom/performance/Performance.cpp
@@ -414,16 +414,16 @@ DOMHighResTimeStamp Performance::ConvertNameToTimestamp(const nsAString& aName,
 DOMHighResTimeStamp
 Performance::ResolveEndTimeForMeasure(
   const Optional<nsAString>& aEndMark,
-  const PerformanceMeasureOptions* aOptions,
+  const Maybe<const PerformanceMeasureOptions&>& aOptions,
   ErrorResult& aRv)
 {
   DOMHighResTimeStamp endTime;
   if (aEndMark.WasPassed()) {
     endTime = ConvertMarkToTimestampWithString(aEndMark.Value(), aRv);
-  } else if (aOptions != nullptr && aOptions->mEnd.WasPassed()) {
+  } else if (aOptions && aOptions->mEnd.WasPassed()) {
     endTime = ConvertMarkToTimestamp(ResolveTimestampAttribute::End,
                                      aOptions->mEnd.Value(), aRv);
-  } else if (aOptions != nullptr && aOptions->mStart.WasPassed() &&
+  } else if (aOptions && aOptions->mStart.WasPassed() &&
              aOptions->mDuration.WasPassed()) {
     const DOMHighResTimeStamp start = ConvertMarkToTimestamp(
         ResolveTimestampAttribute::Start, aOptions->mStart.Value(), aRv);
@@ -448,16 +448,16 @@ Performance::ResolveEndTimeForMeasure(
 
 DOMHighResTimeStamp
 Performance::ResolveStartTimeForMeasure(
-  const nsAString* aStartMark,
-  const PerformanceMeasureOptions* aOptions,
+  const Maybe<const nsAString&>& aStartMark,
+  const Maybe<const PerformanceMeasureOptions&>& aOptions,
   ErrorResult& aRv)
 {
   DOMHighResTimeStamp startTime;
-  if (aOptions != nullptr && aOptions->mStart.WasPassed()) {
+  if (aOptions && aOptions->mStart.WasPassed()) {
     startTime = ConvertMarkToTimestamp(ResolveTimestampAttribute::Start,
                                        aOptions->mStart.Value(),
                                        aRv);
-  } else if (aOptions != nullptr && aOptions->mDuration.WasPassed() &&
+  } else if (aOptions && aOptions->mDuration.WasPassed() &&
              aOptions->mEnd.WasPassed()) {
     const DOMHighResTimeStamp duration =
       ConvertMarkToTimestampWithDOMHighResTimeStamp(
@@ -475,7 +475,7 @@ Performance::ResolveStartTimeForMeasure(
     }
 
     startTime = end - duration;
-  } else if (aStartMark != nullptr) {
+  } else if (aStartMark) {
     startTime = ConvertMarkToTimestampWithString(*aStartMark, aRv);
   } else {
     startTime = 0;
@@ -497,13 +497,14 @@ Performance::Measure(JSContext* aCx,
     mUserEntries.Clear();
   }
 
-  const PerformanceMeasureOptions* options = nullptr;
+  // Maybe is more readable than using the union type directly.
+  Maybe<const PerformanceMeasureOptions&> options;
   if (aStartOrMeasureOptions.IsPerformanceMeasureOptions()) {
-    options = &aStartOrMeasureOptions.GetAsPerformanceMeasureOptions();
+    options.emplace(aStartOrMeasureOptions.GetAsPerformanceMeasureOptions());
   }
 
   const bool isOptionsNotEmpty =
-      (options != nullptr) &&
+      options.isSome() &&
       (!options->mDetail.isUndefined() || options->mStart.WasPassed() ||
        options->mEnd.WasPassed() || options->mDuration.WasPassed());
   if (isOptionsNotEmpty) {
@@ -530,9 +531,10 @@ Performance::Measure(JSContext* aCx,
     return nullptr;
   }
 
-  const nsAString* startMark = nullptr;
+  // Convert to Maybe for consistency with options.
+  Maybe<const nsAString&> startMark;
   if (aStartOrMeasureOptions.IsString()) {
-    startMark = &aStartOrMeasureOptions.GetAsString();
+    startMark.emplace(aStartOrMeasureOptions.GetAsString());
   }
   const DOMHighResTimeStamp startTime =
     ResolveStartTimeForMeasure(startMark, options, aRv);
@@ -541,7 +543,7 @@ Performance::Measure(JSContext* aCx,
   }
 
   JS::Rooted<JS::Value> detail(aCx);
-  if (options != nullptr && !options->mDetail.isNullOrUndefined()) {
+  if (options && !options->mDetail.isNullOrUndefined()) {
     StructuredSerializeOptions serializeOptions;
     JS::Rooted<JS::Value> valueToClone(aCx, options->mDetail);
     nsContentUtils::StructuredClone(aCx, GetParentObject(), valueToClone,
diff --git a/dom/performance/Performance.h b/dom/performance/Performance.h
index dc58322416..7a60eb85a9 100644
--- a/dom/performance/Performance.h
+++ b/dom/performance/Performance.h
@@ -195,11 +195,11 @@ private:
 
   DOMHighResTimeStamp ResolveEndTimeForMeasure(
       const Optional<nsAString>& aEndMark,
-      const PerformanceMeasureOptions* aOptions,
+      const Maybe<const PerformanceMeasureOptions&>& aOptions,
       ErrorResult& aRv);
   DOMHighResTimeStamp ResolveStartTimeForMeasure(
-      const nsAString* aStartMark,
-      const PerformanceMeasureOptions* aOptions,
+      const Maybe<const nsAString&>& aStartMark,
+      const Maybe<const PerformanceMeasureOptions&>& aOptions,
       ErrorResult& aRv);
 };
 
diff --git a/js/src/builtin/SelfHostingDefines.h b/js/src/builtin/SelfHostingDefines.h
index 987351815c..9a93a2c795 100644
--- a/js/src/builtin/SelfHostingDefines.h
+++ b/js/src/builtin/SelfHostingDefines.h
@@ -52,11 +52,6 @@
 // stored.
 #define LAZY_FUNCTION_NAME_SLOT 0
 
-// The extended slot which contains a boolean value that indicates whether
-// that the canonical name of the self-hosted builtins is set in self-hosted
-// global. This slot is used only in debug build.
-#define HAS_SELFHOSTED_CANONICAL_NAME_SLOT 0
-
 // Stores the length for bound functions, so the .length property doesn't need
 // to be resolved eagerly.
 #define BOUND_FUN_LENGTH_SLOT 1
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index d617941503..a1b669bf91 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -2807,9 +2807,6 @@ Parser<ParseHandler>::newFunction(HandleAtom atom, FunctionSyntaxKind kind,
 
     gc::AllocKind allocKind = gc::AllocKind::FUNCTION;
     JSFunction::Flags flags;
-#ifdef DEBUG
-    bool isGlobalSelfHostedBuiltin = false;
-#endif
     switch (kind) {
       case FunctionSyntaxKind::Expression:
         flags = (generatorKind == NotGenerator && asyncKind == SyncFunction
@@ -2846,12 +2843,9 @@ Parser<ParseHandler>::newFunction(HandleAtom atom, FunctionSyntaxKind kind,
         break;
       default:
         MOZ_ASSERT(kind == FunctionSyntaxKind::Statement);
-#ifdef DEBUG
         if (options().selfHostingMode && !pc->isFunctionBox()) {
-            isGlobalSelfHostedBuiltin = true;
             allocKind = gc::AllocKind::FUNCTION_EXTENDED;
         }
-#endif
         flags = (generatorKind == NotGenerator && asyncKind == SyncFunction
                  ? JSFunction::INTERPRETED_NORMAL
                  : JSFunction::INTERPRETED_GENERATOR_OR_ASYNC);
@@ -2867,10 +2861,6 @@ Parser<ParseHandler>::newFunction(HandleAtom atom, FunctionSyntaxKind kind,
         return nullptr;
     if (options().selfHostingMode) {
         fun->setIsSelfHostedBuiltin();
-#ifdef DEBUG
-        if (isGlobalSelfHostedBuiltin)
-            fun->setExtendedSlot(HAS_SELFHOSTED_CANONICAL_NAME_SLOT, BooleanValue(false));
-#endif
     }
     return fun;
 }
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 9e5853b454..0e29f02176 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3530,9 +3530,6 @@ CreateNonSyntacticEnvironmentChain(JSContext* cx, AutoObjectVector& envChain,
 static bool
 IsFunctionCloneable(HandleFunction fun)
 {
-    if (!fun->isInterpreted())
-        return true;
-
     // If a function was compiled with non-global syntactic environments on
     // the environment chain, we could have baked in EnvironmentCoordinates
     // into the script. We cannot clone it without breaking the compiler's
@@ -3570,27 +3567,17 @@ CloneFunctionObject(JSContext* cx, HandleObject funobj, HandleObject env, Handle
             return nullptr;
     }
 
-    if (!IsFunctionCloneable(fun)) {
-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_CLONE_FUNOBJ_SCOPE);
-        return nullptr;
-    }
-
-    if (fun->isBoundFunction()) {
-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT);
-        return nullptr;
-    }
-
-    if (IsAsmJSModule(fun)) {
+    if (fun->isNative()) {
         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT);
         return nullptr;
     }
 
-    if (IsWrappedAsyncFunction(fun)) {
-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT);
+    if (!IsFunctionCloneable(fun)) {
+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_BAD_CLONE_FUNOBJ_SCOPE);
         return nullptr;
     }
 
-    if (IsWrappedAsyncGenerator(fun)) {
+    if (fun->isBoundFunction()) {
         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_CANT_CLONE_OBJECT);
         return nullptr;
     }
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 67df78c2f1..5255aebbfc 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -50,6 +50,7 @@
 #include "vm/StringBuffer.h"
 #include "vm/WrapperObject.h"
 #include "vm/Xdr.h"
+#include "wasm/AsmJS.h"
 
 #include "jsscriptinlines.h"
 
@@ -1250,7 +1251,7 @@ JSFunction::infallibleIsDefaultClassConstructor(JSContext* cx) const
 
     bool isDefault = false;
     if (isInterpretedLazy()) {
-        JSAtom* name = &getExtendedSlot(LAZY_FUNCTION_NAME_SLOT).toString()->asAtom();
+        JSAtom* name = GetSelfHostedFunctionName(const_cast<JSFunction*>(this));
         isDefault = name == cx->names().DefaultDerivedClassConstructor ||
                     name == cx->names().DefaultBaseClassConstructor;
     } else {
@@ -1270,7 +1271,7 @@ JSFunction::isDerivedClassConstructor()
         // There is only one plausible lazy self-hosted derived
         // constructor.
         if (isSelfHostedBuiltin()) {
-            JSAtom* name = &getExtendedSlot(LAZY_FUNCTION_NAME_SLOT).toString()->asAtom();
+            JSAtom* name = GetSelfHostedFunctionName(this);
 
             // This function is called from places without access to a
             // JSContext. Trace some plumbing to get what we want.
@@ -1529,7 +1530,7 @@ JSFunction::createScriptForLazilyInterpretedFunction(JSContext* cx, HandleFuncti
 
     /* Lazily cloned self-hosted script. */
     MOZ_ASSERT(fun->isSelfHostedBuiltin());
-    RootedAtom funAtom(cx, &fun->getExtendedSlot(LAZY_FUNCTION_NAME_SLOT).toString()->asAtom());
+    RootedAtom funAtom(cx, GetSelfHostedFunctionName(fun));
     if (!funAtom)
         return false;
     Rooted<PropertyName*> funName(cx, funAtom->asPropertyName());
@@ -1568,9 +1569,7 @@ JSFunction::maybeRelazify(JSRuntime* rt)
         return;
 
     // To delazify self-hosted builtins we need the name of the function
-    // to clone. This name is stored in the first extended slot. Since
-    // that slot is sometimes also used for other purposes, make sure it
-    // contains a string.
+    // to clone. This name is stored in the first extended slot.
     if (isSelfHostedBuiltin() &&
         (!isExtended() || !getExtendedSlot(LAZY_FUNCTION_NAME_SLOT).isString()))
     {
@@ -1588,7 +1587,7 @@ JSFunction::maybeRelazify(JSRuntime* rt)
     } else {
         MOZ_ASSERT(isSelfHostedBuiltin());
         MOZ_ASSERT(isExtended());
-        MOZ_ASSERT(getExtendedSlot(LAZY_FUNCTION_NAME_SLOT).toString()->isAtom());
+        MOZ_ASSERT(GetSelfHostedFunctionName(this));
     }
 
     comp->scheduleDelazificationForDebugger();
@@ -2026,6 +2025,8 @@ bool
 js::CanReuseScriptForClone(JSCompartment* compartment, HandleFunction fun,
                            HandleObject newParent)
 {
+    MOZ_ASSERT(fun->isInterpreted());
+
     if (compartment != fun->compartment() ||
         fun->isSingleton() ||
         ObjectGroup::useSingletonForClone(fun))
@@ -2044,12 +2045,11 @@ js::CanReuseScriptForClone(JSCompartment* compartment, HandleFunction fun,
     if (IsSyntacticEnvironment(newParent))
         return true;
 
-    // We need to clone the script if we're interpreted and not already marked
-    // as having a non-syntactic scope. If we're lazy, go ahead and clone the
-    // script; see the big comment at the end of CopyScriptInternal for the
-    // explanation of what's going on there.
-    return !fun->isInterpreted() ||
-           (fun->hasScript() && fun->nonLazyScript()->hasNonSyntacticScope());
+    // We need to clone the script if we're not already marked as having a
+    // non-syntactic scope. If we're lazy, go ahead and clone the script; see
+    // the big comment at the end of CopyScriptInternal for the explanation of
+    // what's going on there.
+    return fun->hasScript() && fun->nonLazyScript()->hasNonSyntacticScope();
 }
 
 static inline JSFunction*
@@ -2096,6 +2096,7 @@ js::CloneFunctionReuseScript(JSContext* cx, HandleFunction fun, HandleObject enc
                              HandleObject proto /* = nullptr */)
 {
     MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv));
+    MOZ_ASSERT(fun->isInterpreted());
     MOZ_ASSERT(!fun->isBoundFunction());
     MOZ_ASSERT(CanReuseScriptForClone(cx->compartment(), fun, enclosingEnv));
 
@@ -2106,13 +2107,12 @@ js::CloneFunctionReuseScript(JSContext* cx, HandleFunction fun, HandleObject enc
     if (fun->hasScript()) {
         clone->initScript(fun->nonLazyScript());
         clone->initEnvironment(enclosingEnv);
-    } else if (fun->isInterpretedLazy()) {
+    } else {
+        MOZ_ASSERT(fun->isInterpretedLazy());
         MOZ_ASSERT(fun->compartment() == clone->compartment());
         LazyScript* lazy = fun->lazyScriptOrNull();
         clone->initLazyScript(lazy);
         clone->initEnvironment(enclosingEnv);
-    } else {
-        clone->initNative(fun->native(), fun->jitInfo());
     }
 
     /*
@@ -2130,25 +2130,19 @@ js::CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject enclo
                            HandleObject proto /* = nullptr */)
 {
     MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv));
+    MOZ_ASSERT(fun->isInterpreted());
     MOZ_ASSERT(!fun->isBoundFunction());
 
-    JSScript::AutoDelazify funScript(cx);
-    if (fun->isInterpreted()) {
-        funScript = fun;
-        if (!funScript)
-            return nullptr;
-    }
+    JSScript::AutoDelazify funScript(cx, fun);
+    if (!funScript)
+        return nullptr;
 
     RootedFunction clone(cx, NewFunctionClone(cx, fun, SingletonObject, allocKind, proto));
     if (!clone)
         return nullptr;
 
-    if (fun->hasScript()) {
-        clone->initScript(nullptr);
-        clone->initEnvironment(enclosingEnv);
-    } else {
-        clone->initNative(fun->native(), fun->jitInfo());
-    }
+    clone->initScript(nullptr);
+    clone->initEnvironment(enclosingEnv);
 
     /*
      * Across compartments or if we have to introduce a non-syntactic scope we
@@ -2165,18 +2159,54 @@ js::CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject enclo
                   newScope->hasOnChain(ScopeKind::NonSyntactic));
 #endif
 
-    if (clone->isInterpreted()) {
-        RootedScript script(cx, fun->nonLazyScript());
-        MOZ_ASSERT(script->compartment() == fun->compartment());
-        MOZ_ASSERT(cx->compartment() == clone->compartment(),
-                   "Otherwise we could relazify clone below!");
+    RootedScript script(cx, fun->nonLazyScript());
+    MOZ_ASSERT(script->compartment() == fun->compartment());
+    MOZ_ASSERT(cx->compartment() == clone->compartment(),
+               "Otherwise we could relazify clone below!");
 
-        RootedScript clonedScript(cx, CloneScriptIntoFunction(cx, newScope, clone, script));
-        if (!clonedScript)
-            return nullptr;
-        Debugger::onNewScript(cx, clonedScript);
-    }
+    RootedScript clonedScript(cx, CloneScriptIntoFunction(cx, newScope, clone, script));
+    if (!clonedScript)
+        return nullptr;
+    Debugger::onNewScript(cx, clonedScript);
+
+    return clone;
+}
+
+JSFunction*
+js::CloneAsmJSModuleFunction(JSContext* cx, HandleFunction fun)
+{
+    MOZ_ASSERT(fun->isNative());
+    MOZ_ASSERT(IsAsmJSModule(fun));
+    MOZ_ASSERT(fun->isExtended());
+    MOZ_ASSERT(cx->compartment() == fun->compartment());
+
+    JSFunction* clone = NewFunctionClone(cx, fun, GenericObject, AllocKind::FUNCTION_EXTENDED,
+                                         /* proto = */ nullptr);
+    if (!clone)
+        return nullptr;
+
+    MOZ_ASSERT(fun->native() == InstantiateAsmJS);
+    MOZ_ASSERT(!fun->jitInfo());
+    clone->initNative(InstantiateAsmJS, nullptr);
+
+    clone->setGroup(fun->group());
+    return clone;
+}
+
+JSFunction*
+js::CloneSelfHostingIntrinsic(JSContext* cx, HandleFunction fun)
+{
+    MOZ_ASSERT(fun->isNative());
+    MOZ_ASSERT(fun->compartment()->isSelfHosting);
+    MOZ_ASSERT(!fun->isExtended());
+    MOZ_ASSERT(cx->compartment() != fun->compartment());
+
+    JSFunction* clone = NewFunctionClone(cx, fun, SingletonObject, AllocKind::FUNCTION,
+                                         /* proto = */ nullptr);
+    if (!clone)
+        return nullptr;
 
+    clone->initNative(fun->native(), fun->jitInfo());
     return clone;
 }
 
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 1833aaeea5..49aac71654 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -824,6 +824,12 @@ CloneFunctionAndScript(JSContext* cx, HandleFunction fun, HandleObject parent,
                        gc::AllocKind kind = gc::AllocKind::FUNCTION,
                        HandleObject proto = nullptr);
 
+extern JSFunction*
+CloneAsmJSModuleFunction(JSContext* cx, HandleFunction fun);
+
+extern JSFunction*
+CloneSelfHostingIntrinsic(JSContext* cx, HandleFunction fun);
+
 } // namespace js
 
 inline js::FunctionExtended*
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index d7c1b8e84a..3515a9336b 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -4302,7 +4302,13 @@ js::Lambda(JSContext* cx, HandleFunction fun, HandleObject parent)
 {
     MOZ_ASSERT(!fun->isArrow());
 
-    RootedObject clone(cx, CloneFunctionObjectIfNotSingleton(cx, fun, parent));
+    JSFunction* clone;
+    if (fun->isNative()) {
+        MOZ_ASSERT(IsAsmJSModule(fun));
+        clone = CloneAsmJSModuleFunction(cx, fun);
+    } else {
+        clone = CloneFunctionObjectIfNotSingleton(cx, fun, parent);
+    }
     if (!clone)
         return nullptr;
 
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 357e151bde..de497d02e1 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -903,6 +903,22 @@ intrinsic_NewRegExpStringIterator(JSContext* cx, unsigned argc, Value* vp)
     return true;
 }
 
+JSAtom*
+js::GetSelfHostedFunctionName(JSFunction* fun)
+{
+    Value name = fun->getExtendedSlot(LAZY_FUNCTION_NAME_SLOT);
+    if (!name.isString()) {
+        return nullptr;
+    }
+    return &name.toString()->asAtom();
+}
+
+static void
+SetSelfHostedFunctionName(JSFunction* fun, JSAtom* name)
+{
+    fun->setExtendedSlot(LAZY_FUNCTION_NAME_SLOT, StringValue(name));
+}
+
 static bool
 intrinsic_SetCanonicalName(JSContext* cx, unsigned argc, Value* vp)
 {
@@ -915,10 +931,18 @@ intrinsic_SetCanonicalName(JSContext* cx, unsigned argc, Value* vp)
     if (!atom)
         return false;
 
+    // _SetCanonicalName can only be called on top-level function declarations.
+    MOZ_ASSERT(fun->kind() == JSFunction::NormalFunction);
+    MOZ_ASSERT(!fun->isLambda());
+
+    // It's an error to call _SetCanonicalName multiple times.
+    MOZ_ASSERT(!GetSelfHostedFunctionName(fun));
+
+    // Set the lazy function name so we can later retrieve the script from the
+    // self-hosting global.
+    SetSelfHostedFunctionName(fun, fun->explicitName());
     fun->setAtom(atom);
-#ifdef DEBUG
-    fun->setExtendedSlot(HAS_SELFHOSTED_CANONICAL_NAME_SLOT, BooleanValue(true));
-#endif
+
     args.rval().setUndefined();
     return true;
 }
@@ -2909,23 +2933,33 @@ CloneObject(JSContext* cx, HandleNativeObject selfHostedObject)
     RootedObject clone(cx);
     if (selfHostedObject->is<JSFunction>()) {
         RootedFunction selfHostedFunction(cx, &selfHostedObject->as<JSFunction>());
-        bool hasName = selfHostedFunction->explicitName() != nullptr;
-
-        // Arrow functions use the first extended slot for their lexical |this| value.
-        MOZ_ASSERT(!selfHostedFunction->isArrow());
-        js::gc::AllocKind kind = hasName
-                                 ? gc::AllocKind::FUNCTION_EXTENDED
-                                 : selfHostedFunction->getAllocKind();
-        MOZ_ASSERT(!CanReuseScriptForClone(cx->compartment(), selfHostedFunction, cx->global()));
-        Rooted<LexicalEnvironmentObject*> globalLexical(cx, &cx->global()->lexicalEnvironment());
-        RootedScope emptyGlobalScope(cx, &cx->global()->emptyGlobalScope());
-        clone = CloneFunctionAndScript(cx, selfHostedFunction, globalLexical, emptyGlobalScope,
-                                       kind);
-        // To be able to re-lazify the cloned function, its name in the
-        // self-hosting compartment has to be stored on the clone.
-        if (clone && hasName) {
-            clone->as<JSFunction>().setExtendedSlot(LAZY_FUNCTION_NAME_SLOT,
-                                                    StringValue(selfHostedFunction->explicitName()));
+        if (selfHostedFunction->isInterpreted()) {
+            // Arrow functions use the first extended slot for their lexical |this| value.
+            // And methods use the first extended slot for their home-object.
+            // We only expect to see normal functions here.
+            MOZ_ASSERT(selfHostedFunction->kind() == JSFunction::NormalFunction);
+            js::gc::AllocKind kind = selfHostedFunction->getAllocKind();
+
+            Handle<GlobalObject*> global = cx->global();
+            Rooted<LexicalEnvironmentObject*> globalLexical(cx, &global->lexicalEnvironment());
+            RootedScope emptyGlobalScope(cx, &global->emptyGlobalScope());
+            MOZ_ASSERT(!CanReuseScriptForClone(cx->compartment(), selfHostedFunction, global));
+            clone = CloneFunctionAndScript(cx, selfHostedFunction, globalLexical, emptyGlobalScope,
+                                           kind);
+            // To be able to re-lazify the cloned function, its name in the
+            // self-hosting compartment has to be stored on the clone. Re-lazification
+            // is only possible if this isn't a function expression.
+            if (clone && !selfHostedFunction->isLambda()) {
+                // If |_SetCanonicalName| was called on the function, the self-hosted
+                // name is stored in the extended slot.
+                JSAtom* name = GetSelfHostedFunctionName(selfHostedFunction);
+                if (!name) {
+                    name = selfHostedFunction->explicitName();
+                }
+                SetSelfHostedFunctionName(&clone->as<JSFunction>(), name);
+            }
+        } else {
+            clone = CloneSelfHostingIntrinsic(cx, selfHostedFunction);
         }
     } else if (selfHostedObject->is<RegExpObject>()) {
         RegExpObject& reobj = selfHostedObject->as<RegExpObject>();
@@ -3010,7 +3044,7 @@ JSRuntime::createLazySelfHostedFunctionClone(JSContext* cx, HandlePropertyName s
     if (!selfHostedFun->isClassConstructor() && !selfHostedFun->hasGuessedAtom() &&
         selfHostedFun->explicitName() != selfHostedName)
     {
-        MOZ_ASSERT(selfHostedFun->getExtendedSlot(HAS_SELFHOSTED_CANONICAL_NAME_SLOT).toBoolean());
+        MOZ_ASSERT(GetSelfHostedFunctionName(selfHostedFun) == selfHostedName);
         funName = selfHostedFun->explicitName();
     }
 
@@ -3019,7 +3053,7 @@ JSRuntime::createLazySelfHostedFunctionClone(JSContext* cx, HandlePropertyName s
     if (!fun)
         return false;
     fun->setIsSelfHostedBuiltin();
-    fun->setExtendedSlot(LAZY_FUNCTION_NAME_SLOT, StringValue(selfHostedName));
+    SetSelfHostedFunctionName(fun, selfHostedName);
     return true;
 }
 
@@ -3105,7 +3139,7 @@ JSRuntime::assertSelfHostedFunctionHasCanonicalName(JSContext* cx, HandlePropert
 #ifdef DEBUG
     JSFunction* selfHostedFun = getUnclonedSelfHostedFunction(cx, name);
     MOZ_ASSERT(selfHostedFun);
-    MOZ_ASSERT(selfHostedFun->getExtendedSlot(HAS_SELFHOSTED_CANONICAL_NAME_SLOT).toBoolean());
+    MOZ_ASSERT(GetSelfHostedFunctionName(selfHostedFun) == name);
 #endif
 }
 
@@ -3127,15 +3161,6 @@ js::IsSelfHostedFunctionWithName(JSFunction* fun, JSAtom* name)
     return fun->isSelfHostedBuiltin() && GetSelfHostedFunctionName(fun) == name;
 }
 
-JSAtom*
-js::GetSelfHostedFunctionName(JSFunction* fun)
-{
-    Value name = fun->getExtendedSlot(LAZY_FUNCTION_NAME_SLOT);
-    if (!name.isString())
-        return nullptr;
-    return &name.toString()->asAtom();
-}
-
 static_assert(JSString::MAX_LENGTH <= INT32_MAX,
               "StringIteratorNext in builtin/String.js assumes the stored index "
               "into the string is an Int32Value");
diff --git a/js/src/vm/SelfHosting.h b/js/src/vm/SelfHosting.h
index 6b1a03e851..04962f4445 100644
--- a/js/src/vm/SelfHosting.h
+++ b/js/src/vm/SelfHosting.h
@@ -22,6 +22,19 @@ namespace js {
 bool
 IsSelfHostedFunctionWithName(JSFunction* fun, JSAtom* name);
 
+/*
+ * Returns the name of the function's binding in the self-hosted global.
+ *
+ * This returns a non-null value only when:
+ *   * This is a top level function declaration in the self-hosted global.
+ *   * And either:
+ *     * This function is not cloned and `_SetCanonicalName` has been called to
+ *       set a different function name.
+ *     * This function is cloned.
+ *
+ * For functions not cloned and not `_SetCanonicalName`ed, use
+ * `fun->explicitName()` instead.
+ */
 JSAtom*
 GetSelfHostedFunctionName(JSFunction* fun);
 
diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
index 4e00a25206..a91b0e804d 100644
--- a/js/src/wasm/AsmJS.cpp
+++ b/js/src/wasm/AsmJS.cpp
@@ -8101,8 +8101,8 @@ AsmJSModuleFunctionToModule(JSFunction* fun)
 }
 
 // Implements the semantics of an asm.js module function that has been successfully validated.
-static bool
-InstantiateAsmJS(JSContext* cx, unsigned argc, JS::Value* vp)
+bool
+js::InstantiateAsmJS(JSContext* cx, unsigned argc, JS::Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
diff --git a/js/src/wasm/AsmJS.h b/js/src/wasm/AsmJS.h
index a38b204a8b..296617c79b 100644
--- a/js/src/wasm/AsmJS.h
+++ b/js/src/wasm/AsmJS.h
@@ -56,6 +56,9 @@ IsAsmJSFunction(JSFunction* fun);
 extern bool
 IsAsmJSStrictModeModuleOrFunction(JSFunction* fun);
 
+extern bool
+InstantiateAsmJS(JSContext* cx, unsigned argc, JS::Value* vp);
+
 // asm.js testing natives:
 
 extern bool
diff --git a/mfbt/Maybe.h b/mfbt/Maybe.h
index bc123b047f..cc02528f92 100644
--- a/mfbt/Maybe.h
+++ b/mfbt/Maybe.h
@@ -16,6 +16,7 @@
 
 #include <new>  // for placement new
 #include <type_traits>
+#include <utility>
 
 namespace mozilla {
 
@@ -83,7 +84,15 @@ template<class T>
 class Maybe
 {
   bool mIsSome;
-  AlignedStorage2<T> mStorage;
+
+  // To support |Maybe<const Type>| we give |mStorage| the type |T| with any
+  // const-ness removed.  That allows us to |emplace()| an object into
+  // |mStorage|.  Since we treat the contained object as having type |T|
+  // everywhere else (both internally, and when exposed via public methods) the
+  // contained object is still treated as const once stored since |const| is
+  // part of |T|'s type signature.
+  typedef typename RemoveCV<T>::Type StorageType;
+  AlignedStorage2<StorageType> mStorage;
 
 public:
   typedef T ValueType;
@@ -453,6 +462,72 @@ public:
   }
 };
 
+template <typename T>
+class Maybe<T&> {
+ public:
+  constexpr Maybe() = default;
+  constexpr MOZ_IMPLICIT Maybe(Nothing) {}
+
+  void emplace(T& aRef) { mValue = &aRef; }
+
+  /* Methods that check whether this Maybe contains a value */
+  explicit operator bool() const { return isSome(); }
+  bool isSome() const { return mValue; }
+  bool isNothing() const { return !mValue; }
+
+  T& ref() const {
+    MOZ_DIAGNOSTIC_ASSERT(isSome());
+    return *mValue;
+  }
+
+  T* operator->() const { return &ref(); }
+  T& operator*() const { return ref(); }
+
+  // Deliberately not defining value and ptr accessors, as these may be
+  // confusing on a reference-typed Maybe.
+
+  // XXX Should we define refOr?
+
+  void reset() { mValue = nullptr; }
+
+  template <typename Func>
+  Maybe& apply(Func&& aFunc) {
+    if (isSome()) {
+      std::forward<Func>(aFunc)(ref());
+    }
+    return *this;
+  }
+
+  template <typename Func>
+  const Maybe& apply(Func&& aFunc) const {
+    if (isSome()) {
+      std::forward<Func>(aFunc)(ref());
+    }
+    return *this;
+  }
+
+  template <typename Func>
+  auto map(Func&& aFunc) {
+    Maybe<decltype(std::forward<Func>(aFunc)(ref()))> val;
+    if (isSome()) {
+      val.emplace(std::forward<Func>(aFunc)(ref()));
+    }
+    return val;
+  }
+
+  template <typename Func>
+  auto map(Func&& aFunc) const {
+    Maybe<decltype(std::forward<Func>(aFunc)(ref()))> val;
+    if (isSome()) {
+      val.emplace(std::forward<Func>(aFunc)(ref()));
+    }
+    return val;
+  }
+
+ private:
+  T* mValue = nullptr;
+};
+
 /*
  * Some() creates a Maybe<T> value containing the provided T value. If T has a
  * move constructor, it's used to make this as efficient as possible.
@@ -474,6 +549,13 @@ Some(T&& aValue)
   return value;
 }
 
+template <typename T>
+Maybe<T&> SomeRef(T& aValue) {
+  Maybe<T&> value;
+  value.emplace(aValue);
+  return value;
+}
+
 template<typename T>
 Maybe<typename RemoveCV<typename RemoveReference<T>::Type>::Type>
 ToMaybe(T* aPtr)
@@ -492,6 +574,9 @@ ToMaybe(T* aPtr)
 template<typename T> bool
 operator==(const Maybe<T>& aLHS, const Maybe<T>& aRHS)
 {
+  static_assert(!std::is_reference<T>::value,
+                "operator== is not defined for Maybe<T&>, compare values or "
+                "addresses explicitly instead");
   if (aLHS.isNothing() != aRHS.isNothing()) {
     return false;
   }
diff --git a/old-configure.in b/old-configure.in
index d351b81752..4e23dae932 100644
--- a/old-configure.in
+++ b/old-configure.in
@@ -4763,6 +4763,16 @@ AC_DEFINE_UNQUOTED(MOZ_MACBUNDLE_ID,$MOZ_MACBUNDLE_ID)
 AC_SUBST(MOZ_MACBUNDLE_ID)
 
 dnl ========================================================
+dnl = Mac bundle codesign entitlements
+dnl ========================================================
+MOZ_ARG_WITH_STRING(macbundle-entitlement,
+[  --with-macbundle-entitlement=entitlementname
+                          Entitlements to add to the Mac application bundle],
+[ MOZ_MACBUNDLE_ENTITLEMENT="$withval"])
+
+AC_SUBST(MOZ_MACBUNDLE_ENTITLEMENT)
+
+dnl ========================================================
 dnl = Mac bundle codesign identity
 dnl ========================================================
 MOZ_ARG_WITH_STRING(macbundle-identity,
@@ -4773,6 +4783,17 @@ MOZ_ARG_WITH_STRING(macbundle-identity,
 AC_SUBST(MOZ_MACBUNDLE_IDENTITY)
 
 dnl ========================================================
+dnl = Mac bundle DMG type
+dnl ========================================================
+MOZ_ARG_WITH_STRING(macbundle-type,
+[  --with-macbundle-type=hybrid
+                          Method to use to create the DMG],
+[ MOZ_MACBUNDLE_TYPE="$withval"])
+
+AC_SUBST(MOZ_MACBUNDLE_TYPE)
+
+
+dnl ========================================================
 dnl = Child Process Name for IPC
 dnl ========================================================
 MOZ_CHILD_PROCESS_NAME="plugin-container${BIN_SUFFIX}"
diff --git a/python/mozbuild/mozpack/dmg.py b/python/mozbuild/mozpack/dmg.py
index b231f731b8..505cd8729e 100644
--- a/python/mozbuild/mozpack/dmg.py
+++ b/python/mozbuild/mozpack/dmg.py
@@ -44,19 +44,25 @@ def set_folder_icon(dir):
 
 def create_dmg_from_staged(stagedir, output_dmg, tmpdir, volume_name):
     'Given a prepared directory stagedir, produce a DMG at output_dmg.'
+    import buildconfig
     if not is_linux:
         # Running on OS X
         hybrid = os.path.join(tmpdir, 'hybrid.dmg')
-        subprocess.check_call(['hdiutil', 'create',
-                               '-fs', 'HFS+',
-                               '-volname', volume_name,
-                               '-srcfolder', stagedir,
-                               '-ov', hybrid])
+        hdiutiloptions = ['create', '-fs', 'HFS+',
+                                    '-volname', volume_name,
+                                    '-srcfolder', stagedir,
+                                    '-ov', hybrid]
+        if buildconfig.substs['MOZ_MACBUNDLE_TYPE'] == 'hybrid':
+            hdiutiloptions = ['makehybrid', '-hfs',
+                                            '-hfs-volume-name', volume_name,
+                                            '-hfs-openfolder', stagedir,
+                                            '-ov', stagedir,
+                                            '-o', hybrid]
+        subprocess.check_call(['hdiutil'] + hdiutiloptions)
         subprocess.check_call(['hdiutil', 'convert', '-format', 'UDBZ',
                                '-imagekey', 'bzip2-level=9',
                                '-ov', hybrid, '-o', output_dmg])
     else:
-        import buildconfig
         uncompressed = os.path.join(tmpdir, 'uncompressed.dmg')
         subprocess.check_call([
             buildconfig.substs['GENISOIMAGE'],
@@ -123,15 +129,28 @@ def create_dmg(source_directory, output_dmg, volume_name, extra_files):
             identity = buildconfig.substs['MOZ_MACBUNDLE_IDENTITY']
             if identity != '':
                 dylibs = []
+                entitlements = []
                 appbundle = os.path.join(stagedir, buildconfig.substs['MOZ_MACBUNDLE_NAME'])
                 # If the -bin file is in Resources add it to the dylibs as well
                 resourcebin = os.path.join(appbundle, 'Contents/Resources/' + buildconfig.substs['MOZ_APP_NAME'] + '-bin')
                 if os.path.isfile(resourcebin):
                     dylibs.append(resourcebin)
                 # Create a list of dylibs in Contents/Resources that won't get signed by --deep
-                for root, dirnames, filenames in os.walk('Contents/Resources/'):
+                for root, dirnames, filenames in os.walk(os.path.join(appbundle,'Contents/Resources/')):
                     for filename in fnmatch.filter(filenames, '*.dylib'):
                         dylibs.append(os.path.join(root, filename))
+                # Select default entitlements based on whether debug is enabled
                 entitlement = os.path.abspath(os.path.join(os.getcwd(), '../../platform/security/mac/production.entitlements.xml'))
-                subprocess.check_call(['codesign', '--deep', '--timestamp', '--options', 'runtime', '--entitlements', entitlement, '-s', identity] + dylibs + [appbundle])
+                if buildconfig.substs['MOZ_DEBUG']:
+                    entitlement = os.path.abspath(os.path.join(os.getcwd(), '../../platform/security/mac/developer.entitlements.xml'))
+                # Check to see if the entitlements are disabled or overrided by mozconfig
+                entitlementname = buildconfig.substs['MOZ_MACBUNDLE_ENTITLEMENT']
+                if entitlementname != '':
+                    if os.path.isfile(entitlementname):
+                        entitlement = entitlementname
+                if entitlementname != 'none':
+                    if os.path.isfile(entitlement):
+                        entitlements = ['--entitlements', entitlement]
+                # Call the codesign tool
+                subprocess.check_call(['codesign', '--deep', '--timestamp', '--options', 'runtime'] + entitlements + [ '-s', identity] + dylibs + [appbundle])
         create_dmg_from_staged(stagedir, output_dmg, tmpdir, volume_name)
diff --git a/xpcom/build/PoisonIOInterposerMac.cpp b/xpcom/build/PoisonIOInterposerMac.cpp
index d76b728ade..d76d6af415 100644
--- a/xpcom/build/PoisonIOInterposerMac.cpp
+++ b/xpcom/build/PoisonIOInterposerMac.cpp
@@ -4,7 +4,9 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "PoisonIOInterposer.h"
+#ifndef __aarch64__
 #include "mach_override.h"
+#endif
 
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/Assertions.h"
@@ -360,9 +362,11 @@ InitPoisonIOInterposer()
     if (!d->Function) {
       continue;
     }
+#ifndef __aarch64__
     DebugOnly<mach_error_t> t = mach_override_ptr(d->Function, d->Wrapper,
                                                   &d->Buffer);
     MOZ_ASSERT(t == err_none);
+#endif
   }
 }