Adding upstream version 86.0.1.upstream/86.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

6 files changed, 1052 insertions, 0 deletions

diff --git a/js/public/experimental/CTypes.h b/js/public/experimental/CTypes.h
new file mode 100644
index 0000000000..f7f6bace34
--- /dev/null
+++ b/js/public/experimental/CTypes.h
@@ -0,0 +1,105 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef js_experimental_CTypes_h
+#define js_experimental_CTypes_h
+
+#include "mozilla/Attributes.h"  // MOZ_RAII
+
+#include <stddef.h>  // size_t
+
+#include "jstypes.h"  // JS_PUBLIC_API, JS_FRIEND_API
+
+#include "js/TypeDecls.h"
+
+namespace JS {
+
+#ifdef JS_HAS_CTYPES
+
+/**
+ * Initialize the 'ctypes' object on a global variable 'obj'. The 'ctypes'
+ * object will be sealed.
+ */
+extern JS_PUBLIC_API bool InitCTypesClass(JSContext* cx,
+                                          Handle<JSObject*> global);
+
+#endif  // JS_HAS_CTYPES
+
+/**
+ * The type of ctypes activity that is occurring.
+ */
+enum class CTypesActivityType {
+  BeginCall,
+  EndCall,
+  BeginCallback,
+  EndCallback,
+};
+
+/**
+ * The signature of a function invoked at the leading or trailing edge of ctypes
+ * activity.
+ */
+using CTypesActivityCallback = void (*)(JSContext*, CTypesActivityType);
+
+/**
+ * Sets a callback that is run whenever js-ctypes is about to be used when
+ * calling into C.
+ */
+extern JS_FRIEND_API void SetCTypesActivityCallback(JSContext* cx,
+                                                    CTypesActivityCallback cb);
+
+class MOZ_RAII JS_FRIEND_API AutoCTypesActivityCallback {
+ private:
+  JSContext* cx;
+  CTypesActivityCallback callback;
+  CTypesActivityType endType;
+
+ public:
+  AutoCTypesActivityCallback(JSContext* cx, CTypesActivityType beginType,
+                             CTypesActivityType endType);
+
+  ~AutoCTypesActivityCallback() { DoEndCallback(); }
+
+  void DoEndCallback() {
+    if (callback) {
+      callback(cx, endType);
+      callback = nullptr;
+    }
+  }
+};
+
+#ifdef JS_HAS_CTYPES
+
+/**
+ * Convert a unicode string 'source' of length 'slen' to the platform native
+ * charset, returning a null-terminated string allocated with JS_malloc. On
+ * failure, this function should report an error.
+ */
+using CTypesUnicodeToNativeFun = char* (*)(JSContext*, const char16_t*, size_t);
+
+/**
+ * Set of function pointers that ctypes can use for various internal functions.
+ * See JS::SetCTypesCallbacks below. Providing nullptr for a function is safe
+ * and will result in the applicable ctypes functionality not being available.
+ */
+struct CTypesCallbacks {
+  CTypesUnicodeToNativeFun unicodeToNative;
+};
+
+/**
+ * Set the callbacks on the provided 'ctypesObj' object. 'callbacks' should be a
+ * pointer to static data that exists for the lifetime of 'ctypesObj', but it
+ * may safely be altered after calling this function and without having
+ * to call this function again.
+ */
+extern JS_PUBLIC_API void SetCTypesCallbacks(JSObject* ctypesObj,
+                                             const CTypesCallbacks* callbacks);
+
+#endif  // JS_HAS_CTYPES
+
+}  // namespace JS
+
+#endif  // js_experimental_CTypes_h
diff --git a/js/public/experimental/CodeCoverage.h b/js/public/experimental/CodeCoverage.h
new file mode 100644
index 0000000000..768d702106
--- /dev/null
+++ b/js/public/experimental/CodeCoverage.h
@@ -0,0 +1,40 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef js_experimental_CodeCoverage_h
+#define js_experimental_CodeCoverage_h
+
+#include "jstypes.h"     // JS_FRIEND_API
+#include "js/Utility.h"  // JS::UniqueChars
+
+struct JS_PUBLIC_API JSContext;
+
+namespace js {
+
+/**
+ * Enable the collection of lcov code coverage metrics.
+ * Must be called before a runtime is created and before any calls to
+ * GetCodeCoverageSummary.
+ */
+extern JS_FRIEND_API void EnableCodeCoverage();
+
+/**
+ * Generate lcov trace file content for the current realm, and allocate a new
+ * buffer and return the content in it, the size of the newly allocated content
+ * within the buffer would be set to the length out-param. The 'All' variant
+ * will collect data for all realms in the runtime.
+ *
+ * In case of out-of-memory, this function returns nullptr. The length
+ * out-param is undefined on failure.
+ */
+extern JS_FRIEND_API JS::UniqueChars GetCodeCoverageSummary(JSContext* cx,
+                                                            size_t* length);
+extern JS_FRIEND_API JS::UniqueChars GetCodeCoverageSummaryAll(JSContext* cx,
+                                                               size_t* length);
+
+}  // namespace js
+
+#endif  // js_experimental_CodeCoverage_h
diff --git a/js/public/experimental/Intl.h b/js/public/experimental/Intl.h
new file mode 100644
index 0000000000..052bffb7ed
--- /dev/null
+++ b/js/public/experimental/Intl.h
@@ -0,0 +1,50 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef js_experimental_Intl_h
+#define js_experimental_Intl_h
+
+#include "jstypes.h"  // JS_FRIEND_API
+
+#include "js/TypeDecls.h"
+
+namespace JS {
+
+/**
+ * Create and add the Intl.MozDateTimeFormat constructor function to the
+ * provided object.
+ *
+ * This custom date/time formatter constructor gives users the ability to
+ * specify a custom format pattern. This pattern is passed *directly* to ICU
+ * with NO SYNTAX PARSING OR VALIDATION WHATSOEVER.  ICU appears to have a
+ * modicum of testing of this, and it won't fall over completely if passed bad
+ * input.  But the current behavior is entirely under-specified and emphatically
+ * not shippable on the web, and it *must* be fixed before this functionality
+ * can be exposed in the real world.  (There are also some questions about
+ * whether the format exposed here is the *right* one to standardize, that will
+ * also need to be resolved to ship this.)
+ *
+ * If JS was built without JS_HAS_INTL_API, this function will throw an
+ * exception.
+ */
+extern JS_FRIEND_API bool AddMozDateTimeFormatConstructor(
+    JSContext* cx, Handle<JSObject*> intl);
+
+/**
+ * Create and add the Intl.MozDisplayNames constructor function to the
+ * provided object.  This constructor acts like the standard |Intl.DisplayNames|
+ * but accepts certain additional syntax that isn't standardized to the point of
+ * being shippable.
+ *
+ * If JS was built without JS_HAS_INTL_API, this function will throw an
+ * exception.
+ */
+extern JS_FRIEND_API bool AddMozDisplayNamesConstructor(JSContext* cx,
+                                                        Handle<JSObject*> intl);
+
+}  // namespace JS
+
+#endif  // js_experimental_Intl_h
diff --git a/js/public/experimental/JitInfo.h b/js/public/experimental/JitInfo.h
new file mode 100644
index 0000000000..1b070021bd
--- /dev/null
+++ b/js/public/experimental/JitInfo.h
@@ -0,0 +1,336 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef js_experimental_JitInfo_h
+#define js_experimental_JitInfo_h
+
+#include "mozilla/Assertions.h"  // MOZ_ASSERT
+
+#include <stddef.h>  // size_t
+#include <stdint.h>  // uint16_t, uint32_t
+
+#include "js/CallArgs.h"    // JS::CallArgs, JS::detail::CallArgsBase, JSNative
+#include "js/RootingAPI.h"  // JS::{,Mutable}Handle, JS::Rooted
+#include "js/Value.h"       // JS::Value, JSValueType
+
+namespace js {
+
+namespace jit {
+
+enum class InlinableNative : uint16_t;
+
+}  // namespace jit
+
+}  // namespace js
+
+/**
+ * A class, expected to be passed by value, which represents the CallArgs for a
+ * JSJitGetterOp.
+ */
+class JSJitGetterCallArgs : protected JS::MutableHandle<JS::Value> {
+ public:
+  explicit JSJitGetterCallArgs(const JS::CallArgs& args)
+      : JS::MutableHandle<JS::Value>(args.rval()) {}
+
+  explicit JSJitGetterCallArgs(JS::Rooted<JS::Value>* rooted)
+      : JS::MutableHandle<JS::Value>(rooted) {}
+
+  explicit JSJitGetterCallArgs(JS::MutableHandle<JS::Value> handle)
+      : JS::MutableHandle<JS::Value>(handle) {}
+
+  JS::MutableHandle<JS::Value> rval() { return *this; }
+};
+
+/**
+ * A class, expected to be passed by value, which represents the CallArgs for a
+ * JSJitSetterOp.
+ */
+class JSJitSetterCallArgs : protected JS::MutableHandle<JS::Value> {
+ public:
+  explicit JSJitSetterCallArgs(const JS::CallArgs& args)
+      : JS::MutableHandle<JS::Value>(args[0]) {}
+
+  explicit JSJitSetterCallArgs(JS::Rooted<JS::Value>* rooted)
+      : JS::MutableHandle<JS::Value>(rooted) {}
+
+  JS::MutableHandle<JS::Value> operator[](unsigned i) {
+    MOZ_ASSERT(i == 0);
+    return *this;
+  }
+
+  unsigned length() const { return 1; }
+
+  // Add get() or maybe hasDefined() as needed
+};
+
+struct JSJitMethodCallArgsTraits;
+
+/**
+ * A class, expected to be passed by reference, which represents the CallArgs
+ * for a JSJitMethodOp.
+ */
+class JSJitMethodCallArgs
+    : protected JS::detail::CallArgsBase<JS::detail::NoUsedRval> {
+ private:
+  using Base = JS::detail::CallArgsBase<JS::detail::NoUsedRval>;
+  friend struct JSJitMethodCallArgsTraits;
+
+ public:
+  explicit JSJitMethodCallArgs(const JS::CallArgs& args) {
+    argv_ = args.array();
+    argc_ = args.length();
+  }
+
+  JS::MutableHandle<JS::Value> rval() const { return Base::rval(); }
+
+  unsigned length() const { return Base::length(); }
+
+  JS::MutableHandle<JS::Value> operator[](unsigned i) const {
+    return Base::operator[](i);
+  }
+
+  bool hasDefined(unsigned i) const { return Base::hasDefined(i); }
+
+  JSObject& callee() const {
+    // We can't use Base::callee() because that will try to poke at
+    // this->usedRval_, which we don't have.
+    return argv_[-2].toObject();
+  }
+
+  JS::Handle<JS::Value> get(unsigned i) const { return Base::get(i); }
+
+  bool requireAtLeast(JSContext* cx, const char* fnname,
+                      unsigned required) const {
+    // Can just forward to Base, since it only needs the length and we
+    // forward that already.
+    return Base::requireAtLeast(cx, fnname, required);
+  }
+};
+
+struct JSJitMethodCallArgsTraits {
+  static constexpr size_t offsetOfArgv = offsetof(JSJitMethodCallArgs, argv_);
+  static constexpr size_t offsetOfArgc = offsetof(JSJitMethodCallArgs, argc_);
+};
+
+using JSJitGetterOp = bool (*)(JSContext*, JS::Handle<JSObject*>, void*,
+                               JSJitGetterCallArgs);
+using JSJitSetterOp = bool (*)(JSContext*, JS::Handle<JSObject*>, void*,
+                               JSJitSetterCallArgs);
+using JSJitMethodOp = bool (*)(JSContext*, JS::Handle<JSObject*>, void*,
+                               const JSJitMethodCallArgs&);
+
+/**
+ * This struct contains metadata passed from the DOM to the JS Engine for JIT
+ * optimizations on DOM property accessors.
+ *
+ * Eventually, this should be made available to general JSAPI users as *not*
+ * experimental and *not* a friend API, but we're not ready to do so yet.
+ */
+class JSJitInfo {
+ public:
+  enum OpType {
+    Getter,
+    Setter,
+    Method,
+    StaticMethod,
+    InlinableNative,
+    IgnoresReturnValueNative,
+    // Must be last
+    OpTypeCount
+  };
+
+  enum ArgType {
+    // Basic types
+    String = (1 << 0),
+    Integer = (1 << 1),  // Only 32-bit or less
+    Double = (1 << 2),   // Maybe we want to add Float sometime too
+    Boolean = (1 << 3),
+    Object = (1 << 4),
+    Null = (1 << 5),
+
+    // And derived types
+    Numeric = Integer | Double,
+    // Should "Primitive" use the WebIDL definition, which
+    // excludes string and null, or the typical JS one that includes them?
+    Primitive = Numeric | Boolean | Null | String,
+    ObjectOrNull = Object | Null,
+    Any = ObjectOrNull | Primitive,
+
+    // Our sentinel value.
+    ArgTypeListEnd = (1 << 31)
+  };
+
+  static_assert(Any & String, "Any must include String");
+  static_assert(Any & Integer, "Any must include Integer");
+  static_assert(Any & Double, "Any must include Double");
+  static_assert(Any & Boolean, "Any must include Boolean");
+  static_assert(Any & Object, "Any must include Object");
+  static_assert(Any & Null, "Any must include Null");
+
+  /**
+   * An enum that describes what this getter/setter/method aliases.  This
+   * determines what things can be hoisted past this call, and if this
+   * call is movable what it can be hoisted past.
+   */
+  enum AliasSet {
+    /**
+     * Alias nothing: a constant value, getting it can't affect any other
+     * values, nothing can affect it.
+     */
+    AliasNone,
+
+    /**
+     * Alias things that can modify the DOM but nothing else.  Doing the
+     * call can't affect the behavior of any other function.
+     */
+    AliasDOMSets,
+
+    /**
+     * Alias the world.  Calling this can change arbitrary values anywhere
+     * in the system.  Most things fall in this bucket.
+     */
+    AliasEverything,
+
+    /** Must be last. */
+    AliasSetCount
+  };
+
+  bool needsOuterizedThisObject() const {
+    return type() != Getter && type() != Setter;
+  }
+
+  bool isTypedMethodJitInfo() const { return isTypedMethod; }
+
+  OpType type() const { return OpType(type_); }
+
+  AliasSet aliasSet() const { return AliasSet(aliasSet_); }
+
+  JSValueType returnType() const { return JSValueType(returnType_); }
+
+  union {
+    JSJitGetterOp getter;
+    JSJitSetterOp setter;
+    JSJitMethodOp method;
+    /** A DOM static method, used for Promise wrappers */
+    JSNative staticMethod;
+    JSNative ignoresReturnValueMethod;
+  };
+
+  static unsigned offsetOfIgnoresReturnValueNative() {
+    return offsetof(JSJitInfo, ignoresReturnValueMethod);
+  }
+
+  union {
+    uint16_t protoID;
+    js::jit::InlinableNative inlinableNative;
+  };
+
+  union {
+    uint16_t depth;
+
+    // Additional opcode for some InlinableNative functions.
+    uint16_t nativeOp;
+  };
+
+  // These fields are carefully packed to take up 4 bytes.  If you need more
+  // bits for whatever reason, please see if you can steal bits from existing
+  // fields before adding more members to this structure.
+  static constexpr size_t OpTypeBits = 4;
+  static constexpr size_t AliasSetBits = 4;
+  static constexpr size_t ReturnTypeBits = 8;
+  static constexpr size_t SlotIndexBits = 10;
+
+  /** The OpType that says what sort of function we are. */
+  uint32_t type_ : OpTypeBits;
+
+  /**
+   * The alias set for this op.  This is a _minimal_ alias set; in
+   * particular for a method it does not include whatever argument
+   * conversions might do.  That's covered by argTypes and runtime
+   * analysis of the actual argument types being passed in.
+   */
+  uint32_t aliasSet_ : AliasSetBits;
+
+  /** The return type tag.  Might be JSVAL_TYPE_UNKNOWN. */
+  uint32_t returnType_ : ReturnTypeBits;
+
+  static_assert(OpTypeCount <= (1 << OpTypeBits),
+                "Not enough space for OpType");
+  static_assert(AliasSetCount <= (1 << AliasSetBits),
+                "Not enough space for AliasSet");
+  static_assert((sizeof(JSValueType) * 8) <= ReturnTypeBits,
+                "Not enough space for JSValueType");
+
+  /** Is op fallible? False in setters. */
+  uint32_t isInfallible : 1;
+
+  /**
+   * Is op movable?  To be movable the op must
+   * not AliasEverything, but even that might
+   * not be enough (e.g. in cases when it can
+   * throw or is explicitly not movable).
+   */
+  uint32_t isMovable : 1;
+
+  /**
+   * Can op be dead-code eliminated? Again, this
+   * depends on whether the op can throw, in
+   * addition to the alias set.
+   */
+  uint32_t isEliminatable : 1;
+
+  // XXXbz should we have a JSValueType for the type of the member?
+  /**
+   * True if this is a getter that can always
+   * get the value from a slot of the "this" object.
+   */
+  uint32_t isAlwaysInSlot : 1;
+
+  /**
+   * True if this is a getter that can sometimes (if the slot doesn't contain
+   * UndefinedValue()) get the value from a slot of the "this" object.
+   */
+  uint32_t isLazilyCachedInSlot : 1;
+
+  /** True if this is an instance of JSTypedMethodJitInfo. */
+  uint32_t isTypedMethod : 1;
+
+  /**
+   * If isAlwaysInSlot or isSometimesInSlot is true,
+   * the index of the slot to get the value from.
+   * Otherwise 0.
+   */
+  uint32_t slotIndex : SlotIndexBits;
+
+  static constexpr size_t maxSlotIndex = (1 << SlotIndexBits) - 1;
+};
+
+static_assert(sizeof(JSJitInfo) == (sizeof(void*) + 2 * sizeof(uint32_t)),
+              "There are several thousand instances of JSJitInfo stored in "
+              "a binary. Please don't increase its space requirements without "
+              "verifying that there is no other way forward (better packing, "
+              "smaller datatypes for fields, subclassing, etc.).");
+
+struct JSTypedMethodJitInfo {
+  // We use C-style inheritance here, rather than C++ style inheritance
+  // because not all compilers support brace-initialization for non-aggregate
+  // classes. Using C++ style inheritance and constructors instead of
+  // brace-initialization would also force the creation of static
+  // constructors (on some compilers) when JSJitInfo and JSTypedMethodJitInfo
+  // structures are declared. Since there can be several thousand of these
+  // structures present and we want to have roughly equivalent performance
+  // across a range of compilers, we do things manually.
+  JSJitInfo base;
+
+  const JSJitInfo::ArgType* const argTypes; /* For a method, a list of sets of
+                                               types that the function
+                                               expects.  This can be used,
+                                               for example, to figure out
+                                               when argument coercions can
+                                               have side-effects. */
+};
+
+#endif  // js_experimental_JitInfo_h
diff --git a/js/public/experimental/SourceHook.h b/js/public/experimental/SourceHook.h
new file mode 100644
index 0000000000..a908800dfd
--- /dev/null
+++ b/js/public/experimental/SourceHook.h
@@ -0,0 +1,99 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * The context-wide source hook allows the source of scripts/functions to be
+ * discarded, if that source is constant and readily-reloadable if it's needed
+ * in the future.
+ *
+ * Ordinarily, functions and scripts store a copy of their underlying source, to
+ * support |Function.prototype.toString| and debuggers.  Some scripts, however,
+ * might be constant and retrievable on demand -- perhaps burned into the binary
+ * or in a readonly file provided by the embedding.  Why not just ask the
+ * embedding for a copy of the source?
+ *
+ * The context-wide |SourceHook| gives embedders a way to respond to these
+ * requests.  The source of scripts/functions compiled with the compile option
+ * |JS::CompileOptions::setSourceIsLazy(true)| is eligible to be discarded.
+ * (The exact conditions under which source is discarded are unspecified.)  *If*
+ * source is discarded, performing an operation that requires source uses the
+ * source hook to load the source.
+ *
+ * The source hook must return the *exact* same source for every call.  (This is
+ * why the source hook is unsuitable for use with scripts loaded from the web:
+ * in general, their contents can change over time.)  If the source hook doesn't
+ * return the exact same source, Very Bad Things may happen.  (For example,
+ * previously-valid indexes into the source will no longer be coherent: they
+ * might index out of bounds, into the middle of multi-unit code points, &c.)
+ *
+ * These APIs are experimental because they shouldn't provide a per-*context*
+ * mechanism, rather something that's per-compilation.
+ */
+
+#ifndef js_experimental_SourceHook_h
+#define js_experimental_SourceHook_h
+
+#include "mozilla/UniquePtr.h"  // mozilla::UniquePtr
+
+#include <stddef.h>  // size_t
+
+#include "jstypes.h"  // JS_FRIEND_API
+
+struct JS_PUBLIC_API JSContext;
+
+namespace js {
+
+/**
+ * A class of objects that return source code on demand.
+ *
+ * When code is compiled with setSourceIsLazy(true), SpiderMonkey doesn't
+ * retain the source code (and doesn't do lazy bytecode generation). If we ever
+ * need the source code, say, in response to a call to Function.prototype.
+ * toSource or Debugger.Source.prototype.text, then we call the 'load' member
+ * function of the instance of this class that has hopefully been registered
+ * with the runtime, passing the code's URL, and hope that it will be able to
+ * find the source.
+ */
+class SourceHook {
+ public:
+  virtual ~SourceHook() = default;
+
+  /**
+   * Attempt to load the source for |filename|.
+   *
+   * On success, return true and store an owning pointer to the UTF-8 or UTF-16
+   * contents of the file in whichever of |twoByteSource| or |utf8Source| is
+   * non-null.  (Exactly one of these will be non-null.)  If the stored pointer
+   * is non-null, source was loaded and must be |js_free|'d when it's no longer
+   * needed.  If the stored pointer is null, the JS engine will simply act as if
+   * source was unavailable, and users like |Function.prototype.toString| will
+   * produce fallback results, e.g. "[native code]".
+   *
+   * On failure, return false.  The contents of whichever of |twoByteSource| or
+   * |utf8Source| was initially non-null are unspecified and must not be
+   * |js_free|'d.
+   */
+  virtual bool load(JSContext* cx, const char* filename,
+                    char16_t** twoByteSource, char** utf8Source,
+                    size_t* length) = 0;
+};
+
+/**
+ * Have |cx| use |hook| to retrieve lazily-retrieved source code. See the
+ * comments for SourceHook. The context takes ownership of the hook, and
+ * will delete it when the context itself is deleted, or when a new hook is
+ * set.
+ */
+extern JS_FRIEND_API void SetSourceHook(JSContext* cx,
+                                        mozilla::UniquePtr<SourceHook> hook);
+
+/** Remove |cx|'s source hook, and return it. The caller now owns the hook. */
+extern JS_FRIEND_API mozilla::UniquePtr<SourceHook> ForgetSourceHook(
+    JSContext* cx);
+
+}  // namespace js
+
+#endif  // js_experimental_SourceHook_h
diff --git a/js/public/experimental/TypedData.h b/js/public/experimental/TypedData.h
new file mode 100644
index 0000000000..405d5dfe55
--- /dev/null
+++ b/js/public/experimental/TypedData.h
@@ -0,0 +1,422 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * Typed array, ArrayBuffer, and DataView creation, predicate, and accessor
+ * functions.
+ */
+
+#ifndef js_experimental_TypedData_h
+#define js_experimental_TypedData_h
+
+#include "mozilla/Assertions.h"  // MOZ_ASSERT, MOZ_CRASH
+#include "mozilla/Casting.h"     // mozilla::AssertedCast
+
+#include <stddef.h>  // size_t
+#include <stdint.h>  // {,u}int8_t, {,u}int16_t, {,u}int32_t
+
+#include "jstypes.h"  // JS_FRIEND_API
+
+#include "js/Object.h"      // JS::GetClass, JS::GetPrivate, JS::GetReservedSlot
+#include "js/RootingAPI.h"  // JS::Handle
+#include "js/ScalarType.h"  // js::Scalar::Type
+
+struct JSClass;
+class JS_PUBLIC_API JSObject;
+
+namespace JS {
+
+class JS_PUBLIC_API AutoRequireNoGC;
+
+}  // namespace JS
+
+/*
+ * Create a new typed array with nelements elements.
+ *
+ * These functions (except the WithBuffer variants) fill in the array with
+ * zeros.
+ */
+
+extern JS_FRIEND_API JSObject* JS_NewInt8Array(JSContext* cx,
+                                               uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewUint8Array(JSContext* cx,
+                                                uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewUint8ClampedArray(JSContext* cx,
+                                                       uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewInt16Array(JSContext* cx,
+                                                uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewUint16Array(JSContext* cx,
+                                                 uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewInt32Array(JSContext* cx,
+                                                uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewUint32Array(JSContext* cx,
+                                                 uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewFloat32Array(JSContext* cx,
+                                                  uint32_t nelements);
+extern JS_FRIEND_API JSObject* JS_NewFloat64Array(JSContext* cx,
+                                                  uint32_t nelements);
+
+/*
+ * Create a new typed array and copy in values from the given object. The
+ * object is used as if it were an array; that is, the new array (if
+ * successfully created) will have length given by array.length, and its
+ * elements will be those specified by array[0], array[1], and so on, after
+ * conversion to the typed array element type.
+ */
+
+extern JS_FRIEND_API JSObject* JS_NewInt8ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewUint8ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewUint8ClampedArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewInt16ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewUint16ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewInt32ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewUint32ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewFloat32ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+extern JS_FRIEND_API JSObject* JS_NewFloat64ArrayFromArray(
+    JSContext* cx, JS::Handle<JSObject*> array);
+
+/*
+ * Create a new typed array using the given ArrayBuffer or
+ * SharedArrayBuffer for storage.  The length value is optional; if -1
+ * is passed, enough elements to use up the remainder of the byte
+ * array is used as the default value.
+ */
+
+extern JS_FRIEND_API JSObject* JS_NewInt8ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewUint8ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewUint8ClampedArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewInt16ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewUint16ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewInt32ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewUint32ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewBigInt64ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewBigUint64ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewFloat32ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+extern JS_FRIEND_API JSObject* JS_NewFloat64ArrayWithBuffer(
+    JSContext* cx, JS::Handle<JSObject*> arrayBuffer, size_t byteOffset,
+    int64_t length);
+
+/**
+ * Check whether obj supports JS_GetTypedArray* APIs. Note that this may return
+ * false if a security wrapper is encountered that denies the unwrapping. If
+ * this test or one of the JS_Is*Array tests succeeds, then it is safe to call
+ * the various accessor JSAPI calls defined below.
+ */
+extern JS_FRIEND_API bool JS_IsTypedArrayObject(JSObject* obj);
+
+/**
+ * Check whether obj supports JS_GetArrayBufferView* APIs. Note that this may
+ * return false if a security wrapper is encountered that denies the
+ * unwrapping. If this test or one of the more specific tests succeeds, then it
+ * is safe to call the various ArrayBufferView accessor JSAPI calls defined
+ * below.
+ */
+extern JS_FRIEND_API bool JS_IsArrayBufferViewObject(JSObject* obj);
+
+/*
+ * Test for specific typed array types (ArrayBufferView subtypes)
+ */
+
+extern JS_FRIEND_API bool JS_IsInt8Array(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsUint8Array(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsUint8ClampedArray(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsInt16Array(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsUint16Array(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsInt32Array(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsUint32Array(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsFloat32Array(JSObject* obj);
+extern JS_FRIEND_API bool JS_IsFloat64Array(JSObject* obj);
+
+/**
+ * Return the isShared flag of a typed array, which denotes whether
+ * the underlying buffer is a SharedArrayBuffer.
+ *
+ * |obj| must have passed a JS_IsTypedArrayObject/JS_Is*Array test, or somehow
+ * be known that it would pass such a test: it is a typed array or a wrapper of
+ * a typed array, and the unwrapping will succeed.
+ */
+extern JS_FRIEND_API bool JS_GetTypedArraySharedness(JSObject* obj);
+
+/*
+ * Test for specific typed array types (ArrayBufferView subtypes) and return
+ * the unwrapped object if so, else nullptr.  Never throws.
+ */
+
+namespace js {
+
+extern JS_FRIEND_API JSObject* UnwrapInt8Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapUint8Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapUint8ClampedArray(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapInt16Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapUint16Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapInt32Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapUint32Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapBigInt64Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapBigUint64Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapFloat32Array(JSObject* obj);
+extern JS_FRIEND_API JSObject* UnwrapFloat64Array(JSObject* obj);
+
+extern JS_FRIEND_API JSObject* UnwrapArrayBufferView(JSObject* obj);
+
+extern JS_FRIEND_API JSObject* UnwrapReadableStream(JSObject* obj);
+
+namespace detail {
+
+extern JS_FRIEND_DATA const JSClass* const Int8ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Uint8ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Uint8ClampedArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Int16ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Uint16ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Int32ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Uint32ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const BigInt64ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const BigUint64ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Float32ArrayClassPtr;
+extern JS_FRIEND_DATA const JSClass* const Float64ArrayClassPtr;
+
+const size_t TypedArrayLengthSlot = 1;
+
+}  // namespace detail
+
+#define JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Type, type)                      \
+  inline void Get##Type##ArrayLengthAndData(                                \
+      JSObject* obj, uint32_t* length, bool* isSharedMemory, type** data) { \
+    MOZ_ASSERT(JS::GetClass(obj) == detail::Type##ArrayClassPtr);           \
+    const JS::Value& lenSlot =                                              \
+        JS::GetReservedSlot(obj, detail::TypedArrayLengthSlot);             \
+    *length = mozilla::AssertedCast<uint32_t>(size_t(lenSlot.toPrivate())); \
+    *isSharedMemory = JS_GetTypedArraySharedness(obj);                      \
+    *data = static_cast<type*>(JS::GetPrivate(obj));                        \
+  }
+
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Int8, int8_t)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Uint8, uint8_t)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Uint8Clamped, uint8_t)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Int16, int16_t)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Uint16, uint16_t)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Int32, int32_t)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Uint32, uint32_t)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Float32, float)
+JS_DEFINE_DATA_AND_LENGTH_ACCESSOR(Float64, double)
+
+#undef JS_DEFINE_DATA_AND_LENGTH_ACCESSOR
+
+// This one isn't inlined because it's rather tricky (by dint of having to deal
+// with a dozen-plus classes and varying slot layouts.
+extern JS_FRIEND_API void GetArrayBufferViewLengthAndData(JSObject* obj,
+                                                          uint32_t* length,
+                                                          bool* isSharedMemory,
+                                                          uint8_t** data);
+
+}  // namespace js
+
+/*
+ * Unwrap Typed arrays all at once. Return nullptr without throwing if the
+ * object cannot be viewed as the correct typed array, or the typed array
+ * object on success, filling both outparameters.
+ */
+extern JS_FRIEND_API JSObject* JS_GetObjectAsInt8Array(JSObject* obj,
+                                                       uint32_t* length,
+                                                       bool* isSharedMemory,
+                                                       int8_t** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsUint8Array(JSObject* obj,
+                                                        uint32_t* length,
+                                                        bool* isSharedMemory,
+                                                        uint8_t** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsUint8ClampedArray(
+    JSObject* obj, uint32_t* length, bool* isSharedMemory, uint8_t** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsInt16Array(JSObject* obj,
+                                                        uint32_t* length,
+                                                        bool* isSharedMemory,
+                                                        int16_t** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsUint16Array(JSObject* obj,
+                                                         uint32_t* length,
+                                                         bool* isSharedMemory,
+                                                         uint16_t** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsInt32Array(JSObject* obj,
+                                                        uint32_t* length,
+                                                        bool* isSharedMemory,
+                                                        int32_t** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsUint32Array(JSObject* obj,
+                                                         uint32_t* length,
+                                                         bool* isSharedMemory,
+                                                         uint32_t** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsFloat32Array(JSObject* obj,
+                                                          uint32_t* length,
+                                                          bool* isSharedMemory,
+                                                          float** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsFloat64Array(JSObject* obj,
+                                                          uint32_t* length,
+                                                          bool* isSharedMemory,
+                                                          double** data);
+extern JS_FRIEND_API JSObject* JS_GetObjectAsArrayBufferView(
+    JSObject* obj, uint32_t* length, bool* isSharedMemory, uint8_t** data);
+
+/*
+ * Get the type of elements in a typed array, or MaxTypedArrayViewType if a
+ * DataView.
+ *
+ * |obj| must have passed a JS_IsArrayBufferView/JS_Is*Array test, or somehow
+ * be known that it would pass such a test: it is an ArrayBufferView or a
+ * wrapper of an ArrayBufferView, and the unwrapping will succeed.
+ */
+extern JS_FRIEND_API js::Scalar::Type JS_GetArrayBufferViewType(JSObject* obj);
+
+/**
+ * Return the number of elements in a typed array.
+ *
+ * |obj| must have passed a JS_IsTypedArrayObject/JS_Is*Array test, or somehow
+ * be known that it would pass such a test: it is a typed array or a wrapper of
+ * a typed array, and the unwrapping will succeed.
+ */
+extern JS_FRIEND_API uint32_t JS_GetTypedArrayLength(JSObject* obj);
+
+/**
+ * Return the byte offset from the start of an ArrayBuffer to the start of a
+ * typed array view.
+ *
+ * |obj| must have passed a JS_IsTypedArrayObject/JS_Is*Array test, or somehow
+ * be known that it would pass such a test: it is a typed array or a wrapper of
+ * a typed array, and the unwrapping will succeed.
+ */
+extern JS_FRIEND_API uint32_t JS_GetTypedArrayByteOffset(JSObject* obj);
+
+/**
+ * Return the byte length of a typed array.
+ *
+ * |obj| must have passed a JS_IsTypedArrayObject/JS_Is*Array test, or somehow
+ * be known that it would pass such a test: it is a typed array or a wrapper of
+ * a typed array, and the unwrapping will succeed.
+ */
+extern JS_FRIEND_API uint32_t JS_GetTypedArrayByteLength(JSObject* obj);
+
+/**
+ * More generic name for JS_GetTypedArrayByteLength to cover DataViews as well
+ */
+extern JS_FRIEND_API uint32_t JS_GetArrayBufferViewByteLength(JSObject* obj);
+
+/**
+ * More generic name for JS_GetTypedArrayByteOffset to cover DataViews as well
+ */
+extern JS_FRIEND_API uint32_t JS_GetArrayBufferViewByteOffset(JSObject* obj);
+
+/*
+ * Return a pointer to the start of the data referenced by a typed array. The
+ * data is still owned by the typed array, and should not be modified on
+ * another thread. Furthermore, the pointer can become invalid on GC (if the
+ * data is small and fits inside the array's GC header), so callers must take
+ * care not to hold on across anything that could GC.
+ *
+ * |obj| must have passed a JS_Is*Array test, or somehow be known that it would
+ * pass such a test: it is a typed array or a wrapper of a typed array, and the
+ * unwrapping will succeed.
+ *
+ * |*isSharedMemory| will be set to true if the typed array maps a
+ * SharedArrayBuffer, otherwise to false.
+ */
+
+extern JS_FRIEND_API int8_t* JS_GetInt8ArrayData(JSObject* obj,
+                                                 bool* isSharedMemory,
+                                                 const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API uint8_t* JS_GetUint8ArrayData(JSObject* obj,
+                                                   bool* isSharedMemory,
+                                                   const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API uint8_t* JS_GetUint8ClampedArrayData(
+    JSObject* obj, bool* isSharedMemory, const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API int16_t* JS_GetInt16ArrayData(JSObject* obj,
+                                                   bool* isSharedMemory,
+                                                   const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API uint16_t* JS_GetUint16ArrayData(
+    JSObject* obj, bool* isSharedMemory, const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API int32_t* JS_GetInt32ArrayData(JSObject* obj,
+                                                   bool* isSharedMemory,
+                                                   const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API uint32_t* JS_GetUint32ArrayData(
+    JSObject* obj, bool* isSharedMemory, const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API float* JS_GetFloat32ArrayData(JSObject* obj,
+                                                   bool* isSharedMemory,
+                                                   const JS::AutoRequireNoGC&);
+extern JS_FRIEND_API double* JS_GetFloat64ArrayData(JSObject* obj,
+                                                    bool* isSharedMemory,
+                                                    const JS::AutoRequireNoGC&);
+
+/**
+ * Same as above, but for any kind of ArrayBufferView. Prefer the type-specific
+ * versions when possible.
+ */
+extern JS_FRIEND_API void* JS_GetArrayBufferViewData(
+    JSObject* obj, bool* isSharedMemory, const JS::AutoRequireNoGC&);
+
+/**
+ * Return a "fixed" pointer (one that will not move during a GC) to the
+ * ArrayBufferView's data. Note that this will not keep the object alive; the
+ * holding object should be rooted or traced. If the view is storing the data
+ * inline, this will copy the data to the provided buffer, returning nullptr if
+ * bufSize is inadequate.
+ *
+ * Avoid using this unless necessary. JS_GetArrayBufferViewData is simpler and
+ * more efficient because it requires the caller to ensure that a GC will not
+ * occur and thus does not need to handle movable data.
+ */
+extern JS_FRIEND_API uint8_t* JS_GetArrayBufferViewFixedData(JSObject* obj,
+                                                             uint8_t* buffer,
+                                                             size_t bufSize);
+
+/**
+ * If the bufSize passed to JS_GetArrayBufferViewFixedData is at least this
+ * many bytes, then any copied data is guaranteed to fit into the provided
+ * buffer.
+ */
+extern JS_FRIEND_API size_t JS_MaxMovableTypedArraySize();
+
+/**
+ * Return the ArrayBuffer or SharedArrayBuffer underlying an ArrayBufferView.
+ * This may return a detached buffer.  |obj| must be an object that would
+ * return true for JS_IsArrayBufferViewObject().
+ */
+extern JS_FRIEND_API JSObject* JS_GetArrayBufferViewBuffer(
+    JSContext* cx, JS::Handle<JSObject*> obj, bool* isSharedMemory);
+
+/**
+ * Create a new DataView using the given buffer for storage. The given buffer
+ * must be an ArrayBuffer or SharedArrayBuffer (or a cross-compartment wrapper
+ * of either type), and the offset and length must fit within the bounds of the
+ * buffer. Currently, nullptr will be returned and an exception will be thrown
+ * if these conditions do not hold, but do not depend on that behavior.
+ */
+JS_FRIEND_API JSObject* JS_NewDataView(JSContext* cx,
+                                       JS::Handle<JSObject*> buffer,
+                                       size_t byteOffset, size_t byteLength);
+
+#endif  // js_experimental_TypedData_h